suricata
app-layer-events.c
Go to the documentation of this file.
1 /* Copyright (C) 2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  * \author Anoop Saldanha <anoopsaldanha@gmail.com>
23  */
24 
25 #include "suricata-common.h"
26 #include "decode.h"
27 #include "flow.h"
28 #include "app-layer-events.h"
29 #include "app-layer-parser.h"
30 #include "util-enum.h"
31 
32 /* events raised during protocol detection are stored in the
33  * packets storage, not in the flow. */
35  { "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS",
37  { "APPLAYER_WRONG_DIRECTION_FIRST_DATA",
39  { "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION",
41  { "APPLAYER_PROTO_DETECTION_SKIPPED",
43  { "APPLAYER_NO_TLS_AFTER_STARTTLS",
45  { "APPLAYER_UNEXPECTED_PROTOCOL",
47  { NULL,
48  -1 },
49 };
50 
51 int AppLayerGetPktEventInfo(const char *event_name, int *event_id)
52 {
53  *event_id = SCMapEnumNameToValue(event_name, app_layer_event_pkt_table);
54  if (*event_id == -1) {
55  SCLogError(SC_ERR_INVALID_ENUM_MAP, "event \"%s\" not present in "
56  "app-layer-event's packet event table.", event_name);
57  /* this should be treated as fatal */
58  return -1;
59  }
60 
61  return 0;
62 }
63 
64 #define DECODER_EVENTS_BUFFER_STEPS 8
65 
66 /**
67  * \brief Set an app layer decoder event.
68  *
69  * \param sevents Pointer to a AppLayerDecoderEvents pointer. If *sevents is NULL
70  * memory will be allocated.
71  * \param event The event to be stored.
72  */
74 {
75  if (*sevents == NULL) {
77  if (new_devents == NULL)
78  return;
79 
80  memset(new_devents, 0, sizeof(AppLayerDecoderEvents));
81  *sevents = new_devents;
82 
83  }
84  if ((*sevents)->cnt == UCHAR_MAX) {
85  /* we're full */
86  return;
87  }
88  if ((*sevents)->cnt == (*sevents)->events_buffer_size) {
89  int steps = DECODER_EVENTS_BUFFER_STEPS;
90  if (UCHAR_MAX - (*sevents)->cnt < steps)
91  steps = UCHAR_MAX - (*sevents)->cnt < steps;
92 
93  void *ptr = SCRealloc((*sevents)->events,
94  ((*sevents)->cnt + steps) * sizeof(uint8_t));
95  if (ptr == NULL) {
96  /* couldn't grow buffer, but no reason to free old
97  * so we keep the events that may already be here */
98  return;
99  }
100  (*sevents)->events = ptr;
101  (*sevents)->events_buffer_size += steps;
102  }
103 
104  (*sevents)->events[(*sevents)->cnt++] = event;
105 }
106 
107 /**
108  * \brief Set an app layer decoder event.
109  *
110  * \param f Pointer to a flow containing DecoderEvents pointer head. If
111  * the head points to a DecoderEvents instance, a
112  * new instance would be created and the pointer head would
113  * would be updated with this new instance
114  * \param event The event to be stored.
115  */
116 void AppLayerDecoderEventsSetEvent(Flow *f, uint8_t event)
117 {
120  AppLayerDecoderEventsSetEventRaw(&events, event);
121  if (events != new)
123 }
124 
126 {
127  if (events != NULL)
128  events->cnt = 0;
129 }
130 
131 
133 {
134  if (events && *events != NULL) {
135  if ((*events)->events != NULL)
136  SCFree((*events)->events);
137  SCFree(*events);
138  *events = NULL;
139  }
140 }
141 
AppLayerDecoderEvents * AppLayerParserGetDecoderEvents(AppLayerParserState *pstate)
void AppLayerDecoderEventsSetEventRaw(AppLayerDecoderEvents **sevents, uint8_t event)
Set an app layer decoder event.
int SCMapEnumNameToValue(const char *enum_name, SCEnumCharMap *table)
Maps a string name to an enum value from the supplied table. Please specify the last element of any m...
Definition: util-enum.c:41
SCEnumCharMap app_layer_event_pkt_table[]
Data structure to store app layer decoder events.
void AppLayerParserSetDecoderEvents(AppLayerParserState *pstate, AppLayerDecoderEvents *devents)
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
void AppLayerDecoderEventsSetEvent(Flow *f, uint8_t event)
Set an app layer decoder event.
#define SCRealloc(x, a)
Definition: util-mem.h:182
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
#define SCMalloc(a)
Definition: util-mem.h:166
#define SCFree(a)
Definition: util-mem.h:228
int AppLayerGetPktEventInfo(const char *event_name, int *event_id)
#define DECODER_EVENTS_BUFFER_STEPS
Flow data structure.
Definition: flow.h:324
AppLayerParserState * alparser
Definition: flow.h:432
void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events)