mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
122 lines
4.2 KiB
C
122 lines
4.2 KiB
C
/* Copyright (C) 2024 Open Information Security Foundation
|
|
*
|
|
* You can copy, redistribute or modify this Program under the terms of
|
|
* the GNU General Public License version 2 as published by the Free
|
|
* Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* version 2 along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
|
* 02110-1301, USA.
|
|
*/
|
|
|
|
#ifndef SURICATA_FLOW_CALLBACKS_H
|
|
#define SURICATA_FLOW_CALLBACKS_H
|
|
|
|
#include "suricata-common.h"
|
|
#include "flow.h"
|
|
|
|
/** \brief Function type for flow initialization callbacks.
|
|
*
|
|
* Once registered with SCFlowRegisterInitCallback, this function will
|
|
* be called every time a flow is initialized, or in other words,
|
|
* every time Suricata picks up a flow.
|
|
*
|
|
* \param tv The ThreadVars data structure for the thread creating the
|
|
* flow.
|
|
* \param f The newly initialized flow.
|
|
* \param p The packet related to creating the new flow.
|
|
* \param user The user data provided during callback registration.
|
|
*/
|
|
typedef void (*SCFlowInitCallbackFn)(ThreadVars *tv, Flow *f, const Packet *p, void *user);
|
|
|
|
/** \brief Register a flow init callback.
|
|
*
|
|
* Register a user provided function to be called every time a flow is
|
|
* initialized for use.
|
|
*
|
|
* \param fn Pointer to function to be called
|
|
* \param user Additional user data to be passed to callback
|
|
*
|
|
* \returns true if callback was registered, otherwise false if the
|
|
* callback could not be registered due to memory allocation error.
|
|
*/
|
|
bool SCFlowRegisterInitCallback(SCFlowInitCallbackFn fn, void *user);
|
|
|
|
/** \internal
|
|
*
|
|
* Run all registered flow init callbacks.
|
|
*/
|
|
void SCFlowRunInitCallbacks(ThreadVars *tv, Flow *f, const Packet *p);
|
|
|
|
/** \brief Function type for flow update callbacks.
|
|
*
|
|
* Once registered with SCFlowRegisterUpdateCallback, this function
|
|
* will be called every time a flow is updated by a packet (basically
|
|
* everytime a packet is seen on a flow).
|
|
*
|
|
* \param tv The ThreadVars data structure for the thread updating the
|
|
* flow.
|
|
* \param f The flow being updated.
|
|
* \param p The packet responsible for the flow update.
|
|
* \param user The user data provided during callback registration.
|
|
*/
|
|
typedef void (*SCFlowUpdateCallbackFn)(ThreadVars *tv, Flow *f, Packet *p, void *user);
|
|
|
|
/** \brief Register a flow update callback.
|
|
*
|
|
* Register a user provided function to be called everytime a flow is
|
|
* updated.
|
|
*
|
|
* \param fn Pointer to function to be called
|
|
* \param user Additional user data to be passed to callback
|
|
*
|
|
* \returns true if callback was registered, otherwise false if the
|
|
* callback could not be registered due to memory allocation error.
|
|
*/
|
|
bool SCFlowRegisterUpdateCallback(SCFlowUpdateCallbackFn fn, void *user);
|
|
|
|
/** \internal
|
|
*
|
|
* Run all registered flow update callbacks.
|
|
*/
|
|
void SCFlowRunUpdateCallbacks(ThreadVars *tv, Flow *f, Packet *p);
|
|
|
|
/** \brief Function type for flow finish callbacks.
|
|
*
|
|
* Once registered with SCFlowRegisterFinshCallback, this function
|
|
* will be called when Suricata is done with a flow.
|
|
*
|
|
* \param tv The ThreadVars data structure for the thread finishing
|
|
* the flow.
|
|
* \param f The flow being finshed.
|
|
* \param user The user data provided during callback registration.
|
|
*/
|
|
typedef void (*SCFlowFinishCallbackFn)(ThreadVars *tv, Flow *f, void *user);
|
|
|
|
/** \brief Register a flow init callback.
|
|
*
|
|
* Register a user provided function to be called every time a flow is
|
|
* finished.
|
|
*
|
|
* \param fn Pointer to function to be called
|
|
* \param user Additional user data to be passed to callback
|
|
*
|
|
* \returns true if callback was registered, otherwise false if the
|
|
* callback could not be registered due to memory allocation error.
|
|
*/
|
|
bool SCFlowRegisterFinishCallback(SCFlowFinishCallbackFn fn, void *user);
|
|
|
|
/** \internal
|
|
*
|
|
* Run all registered flow init callbacks.
|
|
*/
|
|
void SCFlowRunFinishCallbacks(ThreadVars *tv, Flow *f);
|
|
|
|
#endif /* SURICATA_FLOW_CALLBACKS_H */
|