suricata
app-layer.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \author Victor Julien <victor@inliniac.net>
20  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
21  */
22 
23 #ifndef __APP_LAYER_H__
24 #define __APP_LAYER_H__
25 
26 #include "threadvars.h"
27 #include "decode.h"
28 #include "flow.h"
29 
30 #include "stream-tcp-private.h"
31 #include "stream-tcp-reassemble.h"
32 #include "stream.h"
33 
34 #include "util-profiling.h"
35 
36 #define APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER \
37  (~STREAM_TOSERVER & ~STREAM_TOCLIENT)
38 
39 /***** L7 layer dispatchers *****/
40 
41 /**
42  * \brief Handles reassembled tcp stream.
43  */
45  Packet *p, Flow *f,
46  TcpSession *ssn, TcpStream **stream,
47  uint8_t *data, uint32_t data_len,
48  uint8_t flags);
49 
50 /**
51  * \brief Handles an udp chunk.
52  */
54  Packet *p, Flow *f);
55 
56 /***** Utility *****/
57 
58 /**
59  * \brief Given a protocol string, returns the corresponding internal
60  * protocol id.
61  *
62  * \param The internal protocol id.
63  */
64 AppProto AppLayerGetProtoByName(char *alproto_name);
65 
66 /**
67  * \brief Given the internal protocol id, returns a string representation
68  * of the protocol.
69  *
70  * \param alproto The internal protocol id.
71  *
72  * \retval String representation of the protocol.
73  */
74 const char *AppLayerGetProtoName(AppProto alproto);
75 
77 
78 /***** Setup/General Registration *****/
79 
80 /**
81  * \brief Setup the app layer.
82  *
83  * Includes protocol detection setup and the protocol parser setup.
84  *
85  * \retval 0 On success.
86  * \retval -1 On failure.
87  */
88 int AppLayerSetup(void);
89 
90 /**
91  * \brief De initializes the app layer.
92  *
93  * Includes de initializing protocol detection and the protocol parser.
94  */
95 int AppLayerDeSetup(void);
96 
97 /**
98  * \brief Creates a new app layer thread context.
99  *
100  * \retval Pointer to the newly create thread context, on success;
101  * NULL, on failure.
102  */
104 
105 /**
106  * \brief Destroys the context created by AppLayeGetCtxThread().
107  *
108  * \param tctx Pointer to the thread context to destroy.
109  */
111 
112 /**
113  * \brief Registers per flow counters for all protocols
114  *
115  */
117 
118 /***** Profiling *****/
119 
121 
122 static inline void AppLayerProfilingReset(AppLayerThreadCtx *app_tctx)
123 {
124 #ifdef PROFILING
126 #endif
127 }
128 
130 
131 static inline void AppLayerProfilingStore(AppLayerThreadCtx *app_tctx, Packet *p)
132 {
133 #ifdef PROFILING
134  AppLayerProfilingStoreInternal(app_tctx, p);
135 #endif
136 }
137 
139 
140 /***** Unittests *****/
141 
142 #ifdef UNITTESTS
143 void AppLayerUnittestsRegister(void);
144 #endif
145 
146 void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step);
147 
148 #endif
uint16_t flags
AppProto AppLayerGetProtoByName(char *alproto_name)
Given a protocol string, returns the corresponding internal protocol id.
Definition: app-layer.c:759
const char * AppLayerGetProtoName(AppProto alproto)
Given the internal protocol id, returns a string representation of the protocol.
Definition: app-layer.c:766
void AppLayerListSupportedProtocols(void)
Definition: app-layer.c:773
void AppLayerRegisterGlobalCounters(void)
HACK to work around our broken unix manager (re)init loop.
Definition: app-layer.c:870
uint16_t AppProto
void AppLayerUnittestsRegister(void)
Definition: app-layer.c:2621
void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step)
Definition: app-layer.c:113
void AppLayerDestroyCtxThread(AppLayerThreadCtx *tctx)
Destroys the context created by AppLayeGetCtxThread().
Definition: app-layer.c:842
int AppLayerDeSetup(void)
De initializes the app layer.
Definition: app-layer.c:808
int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream **stream, uint8_t *data, uint32_t data_len, uint8_t flags)
Handles reassembled tcp stream.
Definition: app-layer.c:563
void AppLayerProfilingStoreInternal(AppLayerThreadCtx *app_tctx, Packet *p)
Definition: app-layer.c:863
void AppLayerRegisterThreadCounters(ThreadVars *tv)
Registers per flow counters for all protocols.
Definition: app-layer.c:926
void AppLayerProfilingResetInternal(AppLayerThreadCtx *app_tctx)
Definition: app-layer.c:858
int AppLayerSetup(void)
Setup the app layer.
Definition: app-layer.c:793
Per thread variable structure.
Definition: threadvars.h:57
int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *app_tctx, Packet *p, Flow *f)
Handles an udp chunk.
Definition: app-layer.c:688
This is for the app layer in general and it contains per thread context relevant to both the alpd and...
Definition: app-layer.c:57
Flow data structure.
Definition: flow.h:325
AppLayerThreadCtx * AppLayerGetCtxThread(ThreadVars *tv)
Creates a new app layer thread context.
Definition: app-layer.c:820