suricata
app-layer.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \author Victor Julien <victor@inliniac.net>
20  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
21  */
22 
23 #ifndef __APP_LAYER_H__
24 #define __APP_LAYER_H__
25 
26 #include "threadvars.h"
27 #include "decode.h"
28 #include "flow.h"
29 
30 #include "stream-tcp-private.h"
31 #include "stream-tcp-reassemble.h"
32 #include "stream.h"
33 
34 #include "util-profiling.h"
35 
36 #include "rust.h"
37 
38 #define APP_LAYER_DATA_ALREADY_SENT_TO_APP_LAYER \
39  (~STREAM_TOSERVER & ~STREAM_TOCLIENT)
40 
41 /***** L7 layer dispatchers *****/
42 
43 /**
44  * \brief Handles reassembled tcp stream.
45  */
47  Packet *p, Flow *f,
48  TcpSession *ssn, TcpStream **stream,
49  uint8_t *data, uint32_t data_len,
50  uint8_t flags);
51 
52 /**
53  * \brief Handles an udp chunk.
54  */
56  Packet *p, Flow *f);
57 
58 /***** Utility *****/
59 
60 /**
61  * \brief Given a protocol string, returns the corresponding internal
62  * protocol id.
63  *
64  * \param The internal protocol id.
65  */
66 AppProto AppLayerGetProtoByName(char *alproto_name);
67 
68 /**
69  * \brief Given the internal protocol id, returns a string representation
70  * of the protocol.
71  *
72  * \param alproto The internal protocol id.
73  *
74  * \retval String representation of the protocol.
75  */
76 const char *AppLayerGetProtoName(AppProto alproto);
77 
79 
80 /***** Setup/General Registration *****/
81 
82 /**
83  * \brief Setup the app layer.
84  *
85  * Includes protocol detection setup and the protocol parser setup.
86  *
87  * \retval 0 On success.
88  * \retval -1 On failure.
89  */
90 int AppLayerSetup(void);
91 
92 /**
93  * \brief De initializes the app layer.
94  *
95  * Includes de initializing protocol detection and the protocol parser.
96  */
97 int AppLayerDeSetup(void);
98 
99 /**
100  * \brief Creates a new app layer thread context.
101  *
102  * \retval Pointer to the newly create thread context, on success;
103  * NULL, on failure.
104  */
106 
107 /**
108  * \brief Destroys the context created by AppLayeGetCtxThread().
109  *
110  * \param tctx Pointer to the thread context to destroy.
111  */
113 
114 /**
115  * \brief Registers per flow counters for all protocols
116  *
117  */
119 
120 /***** Profiling *****/
121 
123 
124 static inline void AppLayerProfilingReset(AppLayerThreadCtx *app_tctx)
125 {
126 #ifdef PROFILING
128 #endif
129 }
130 
132 
133 static inline void AppLayerProfilingStore(AppLayerThreadCtx *app_tctx, Packet *p)
134 {
135 #ifdef PROFILING
136  AppLayerProfilingStoreInternal(app_tctx, p);
137 #endif
138 }
139 
141 
142 /***** Unittests *****/
143 
144 #ifdef UNITTESTS
145 void AppLayerUnittestsRegister(void);
146 #endif
147 
148 void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step);
149 
150 static inline uint8_t StreamSliceGetFlags(const StreamSlice *stream_slice)
151 {
152  return stream_slice->flags;
153 }
154 
155 static inline const uint8_t *StreamSliceGetData(const StreamSlice *stream_slice)
156 {
157  return stream_slice->input;
158 }
159 
160 static inline uint32_t StreamSliceGetDataLen(const StreamSlice *stream_slice)
161 {
162  return stream_slice->input_len;
163 }
164 
165 static inline bool StreamSliceIsGap(const StreamSlice *stream_slice)
166 {
167  return stream_slice->input == NULL && stream_slice->input_len > 0;
168 }
169 
170 static inline uint32_t StreamSliceGetGapSize(const StreamSlice *stream_slice)
171 {
172  return StreamSliceGetDataLen(stream_slice);
173 }
174 
175 #endif
AppLayerProfilingStoreInternal
void AppLayerProfilingStoreInternal(AppLayerThreadCtx *app_tctx, Packet *p)
Definition: app-layer.c:921
TcpStream_
Definition: stream-tcp-private.h:94
AppLayerGetCtxThread
AppLayerThreadCtx * AppLayerGetCtxThread(ThreadVars *tv)
Creates a new app layer thread context.
Definition: app-layer.c:878
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:78
Flow_
Flow data structure.
Definition: flow.h:353
rust.h
stream-tcp-reassemble.h
AppLayerRegisterGlobalCounters
void AppLayerRegisterGlobalCounters(void)
HACK to work around our broken unix manager (re)init loop.
Definition: app-layer.c:928
AppLayerGetProtoName
const char * AppLayerGetProtoName(AppProto alproto)
Given the internal protocol id, returns a string representation of the protocol.
Definition: app-layer.c:824
AppLayerHandleTCPData
int AppLayerHandleTCPData(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, Packet *p, Flow *f, TcpSession *ssn, TcpStream **stream, uint8_t *data, uint32_t data_len, uint8_t flags)
Handles reassembled tcp stream.
Definition: app-layer.c:587
AppLayerDeSetup
int AppLayerDeSetup(void)
De initializes the app layer.
Definition: app-layer.c:866
decode.h
AppLayerThreadCtx_
This is for the app layer in general and it contains per thread context relevant to both the alpd and...
Definition: app-layer.c:57
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
AppLayerSetup
int AppLayerSetup(void)
Setup the app layer.
Definition: app-layer.c:851
util-profiling.h
stream.h
Packet_
Definition: decode.h:420
stream-tcp-private.h
flags
uint8_t flags
Definition: decode-gre.h:0
AppLayerRegisterThreadCounters
void AppLayerRegisterThreadCounters(ThreadVars *tv)
Registers per flow counters for all protocols.
Definition: app-layer.c:984
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
threadvars.h
AppLayerUnittestsRegister
void AppLayerUnittestsRegister(void)
Definition: app-layer.c:2653
AppLayerListSupportedProtocols
void AppLayerListSupportedProtocols(void)
Definition: app-layer.c:831
AppLayerDestroyCtxThread
void AppLayerDestroyCtxThread(AppLayerThreadCtx *tctx)
Destroys the context created by AppLayeGetCtxThread().
Definition: app-layer.c:900
AppLayerGetProtoByName
AppProto AppLayerGetProtoByName(char *alproto_name)
Given a protocol string, returns the corresponding internal protocol id.
Definition: app-layer.c:817
TcpReassemblyThreadCtx_
Definition: stream-tcp-reassemble.h:60
TcpSession_
Definition: stream-tcp-private.h:260
AppLayerProfilingResetInternal
void AppLayerProfilingResetInternal(AppLayerThreadCtx *app_tctx)
Definition: app-layer.c:916
flow.h
AppLayerHandleUdp
int AppLayerHandleUdp(ThreadVars *tv, AppLayerThreadCtx *app_tctx, Packet *p, Flow *f)
Handles an udp chunk.
Definition: app-layer.c:740
AppLayerIncTxCounter
void AppLayerIncTxCounter(ThreadVars *tv, Flow *f, uint64_t step)
Definition: app-layer.c:115