suricata
app-layer-frames.c File Reference
#include "suricata-common.h"
#include "util-print.h"
#include "flow.h"
#include "stream-tcp.h"
#include "app-layer-frames.h"
#include "app-layer-parser.h"
Include dependency graph for app-layer-frames.c:

Go to the source code of this file.

Data Structures

struct  FrameConfig
 

Macros

#define FrameDebug(prefix, frames, frame)
 

Functions

void FrameConfigInit (void)
 
void FrameConfigEnableAll (void)
 
void FrameConfigEnable (const AppProto p, const uint8_t type)
 
FrameFrameGetLastOpenByType (Frames *frames, const uint8_t frame_type)
 
FrameFrameGetById (Frames *frames, const int64_t id)
 
FrameFrameGetByIndex (Frames *frames, const uint32_t idx)
 
void AppLayerFramesSlide (Flow *f, const uint32_t slide, const uint8_t direction)
 
void FramesFree (Frames *frames)
 
FrameAppLayerFrameNewByPointer (Flow *f, const StreamSlice *stream_slice, const uint8_t *frame_start, const int64_t len, int dir, uint8_t frame_type)
 create new frame using a pointer to start of the frame More...
 
FrameAppLayerFrameNewByRelativeOffset (Flow *f, const StreamSlice *stream_slice, const uint32_t frame_start_rel, const int64_t len, int dir, uint8_t frame_type)
 create new frame using a relative offset from the start of the stream slice More...
 
void AppLayerFrameDump (Flow *f)
 
FrameAppLayerFrameNewByAbsoluteOffset (Flow *f, const StreamSlice *stream_slice, const uint64_t frame_start, const int64_t len, int dir, uint8_t frame_type)
 create new frame using the absolute offset from the start of the stream More...
 
void AppLayerFrameAddEvent (Frame *r, uint8_t e)
 
void AppLayerFrameAddEventById (Flow *f, const int dir, const FrameId id, uint8_t e)
 
FrameId AppLayerFrameGetId (Frame *r)
 
void AppLayerFrameSetLength (Frame *frame, int64_t len)
 
void AppLayerFrameSetLengthById (Flow *f, const int dir, const FrameId id, int64_t len)
 
void AppLayerFrameSetTxId (Frame *r, uint64_t tx_id)
 
void AppLayerFrameSetTxIdById (Flow *f, const int dir, const FrameId id, uint64_t tx_id)
 
FrameAppLayerFrameGetById (Flow *f, const int dir, const FrameId frame_id)
 
FrameAppLayerFrameGetLastOpenByType (Flow *f, const int dir, const uint8_t frame_type)
 
void FramesPrune (Flow *f, Packet *p)
 

Detailed Description

Macro Definition Documentation

◆ FrameDebug

#define FrameDebug (   prefix,
  frames,
  frame 
)

Definition at line 86 of file app-layer-frames.c.

Function Documentation

◆ AppLayerFrameAddEvent()

void AppLayerFrameAddEvent ( Frame r,
uint8_t  e 
)

Definition at line 630 of file app-layer-frames.c.

References Frame::event_cnt, Frame::events, and FrameDebug.

Referenced by AppLayerFrameAddEventById().

Here is the caller graph for this function:

◆ AppLayerFrameAddEventById()

void AppLayerFrameAddEventById ( Flow f,
const int  dir,
const FrameId  id,
uint8_t  e 
)

Definition at line 640 of file app-layer-frames.c.

References AppLayerFrameAddEvent(), and AppLayerFrameGetById().

Here is the call graph for this function:

◆ AppLayerFrameDump()

void AppLayerFrameDump ( Flow f)

Definition at line 573 of file app-layer-frames.c.

References Flow_::alparser, AppLayerFramesGetContainer(), Flow_::proto, Flow_::protoctx, FramesContainer::toclient, and FramesContainer::toserver.

Here is the call graph for this function:

◆ AppLayerFrameGetById()

Frame* AppLayerFrameGetById ( Flow f,
const int  dir,
const FrameId  frame_id 
)

Definition at line 684 of file app-layer-frames.c.

References AppLayerFramesGetContainer(), FrameGetById(), SCLogDebug, FramesContainer::toclient, and FramesContainer::toserver.

Referenced by AppLayerFrameAddEventById(), AppLayerFrameSetLengthById(), and AppLayerFrameSetTxIdById().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerFrameGetId()

FrameId AppLayerFrameGetId ( Frame r)

Definition at line 646 of file app-layer-frames.c.

References Frame::id.

◆ AppLayerFrameGetLastOpenByType()

Frame* AppLayerFrameGetLastOpenByType ( Flow f,
const int  dir,
const uint8_t  frame_type 
)

Definition at line 702 of file app-layer-frames.c.

◆ AppLayerFrameNewByAbsoluteOffset()

Frame* AppLayerFrameNewByAbsoluteOffset ( Flow f,
const StreamSlice *  stream_slice,
const uint64_t  frame_start,
const int64_t  len,
int  dir,
uint8_t  frame_type 
)

create new frame using the absolute offset from the start of the stream

Definition at line 588 of file app-layer-frames.c.

◆ AppLayerFrameNewByPointer()

Frame* AppLayerFrameNewByPointer ( Flow f,
const StreamSlice *  stream_slice,
const uint8_t *  frame_start,
const int64_t  len,
int  dir,
uint8_t  frame_type 
)

create new frame using a pointer to start of the frame

Definition at line 447 of file app-layer-frames.c.

References SCLogDebug.

◆ AppLayerFrameNewByRelativeOffset()

Frame* AppLayerFrameNewByRelativeOffset ( Flow f,
const StreamSlice *  stream_slice,
const uint32_t  frame_start_rel,
const int64_t  len,
int  dir,
uint8_t  frame_type 
)

create new frame using a relative offset from the start of the stream slice

Definition at line 526 of file app-layer-frames.c.

◆ AppLayerFrameSetLength()

void AppLayerFrameSetLength ( Frame frame,
int64_t  len 
)

Definition at line 655 of file app-layer-frames.c.

References FrameDebug, len, and Frame::len.

Referenced by AppLayerFrameSetLengthById().

Here is the caller graph for this function:

◆ AppLayerFrameSetLengthById()

void AppLayerFrameSetLengthById ( Flow f,
const int  dir,
const FrameId  id,
int64_t  len 
)

Definition at line 663 of file app-layer-frames.c.

References AppLayerFrameGetById(), AppLayerFrameSetLength(), and len.

Here is the call graph for this function:

◆ AppLayerFrameSetTxId()

void AppLayerFrameSetTxId ( Frame r,
uint64_t  tx_id 
)

Definition at line 669 of file app-layer-frames.c.

References Frame::flags, FRAME_FLAG_TX_ID_SET, FrameDebug, and Frame::tx_id.

Referenced by AppLayerFrameSetTxIdById().

Here is the caller graph for this function:

◆ AppLayerFrameSetTxIdById()

void AppLayerFrameSetTxIdById ( Flow f,
const int  dir,
const FrameId  id,
uint64_t  tx_id 
)

Definition at line 678 of file app-layer-frames.c.

References AppLayerFrameGetById(), and AppLayerFrameSetTxId().

Here is the call graph for this function:

◆ AppLayerFramesSlide()

void AppLayerFramesSlide ( Flow f,
const uint32_t  slide,
const uint8_t  direction 
)

Definition at line 392 of file app-layer-frames.c.

References AppLayerFramesGetContainer(), TcpSession_::client, Flow_::protoctx, and FramesContainer::toserver.

Here is the call graph for this function:

◆ FrameConfigEnable()

void FrameConfigEnable ( const AppProto  p,
const uint8_t  type 
)

Definition at line 54 of file app-layer-frames.c.

References BIT_U64, and type.

◆ FrameConfigEnableAll()

void FrameConfigEnableAll ( void  )

Definition at line 45 of file app-layer-frames.c.

References ALPROTO_MAX.

◆ FrameConfigInit()

void FrameConfigInit ( void  )

Definition at line 38 of file app-layer-frames.c.

References ALPROTO_MAX, and SC_ATOMIC_INIT.

Referenced by GlobalsInitPreConfig().

Here is the caller graph for this function:

◆ FrameGetById()

Frame* FrameGetById ( Frames frames,
const int64_t  id 
)

Definition at line 114 of file app-layer-frames.c.

References Frames::cnt, Frames::dframes, FrameDebug, FRAMES_STATIC_CNT, Frame::id, SCLogDebug, and Frames::sframes.

Referenced by AppLayerFrameGetById().

Here is the caller graph for this function:

◆ FrameGetByIndex()

Frame* FrameGetByIndex ( Frames frames,
const uint32_t  idx 
)

◆ FrameGetLastOpenByType()

Frame* FrameGetLastOpenByType ( Frames frames,
const uint8_t  frame_type 
)
Note
"open" means a frame that has no length set (len == -1)
Todo:
perhaps we can search backwards

Definition at line 91 of file app-layer-frames.c.

References Frames::cnt, Frames::dframes, FrameDebug, FRAMES_STATIC_CNT, Frame::len, SCLogDebug, Frames::sframes, and Frame::type.

◆ FramesFree()

void FramesFree ( Frames frames)

Definition at line 437 of file app-layer-frames.c.

References BUG_ON.

◆ FramesPrune()

void FramesPrune ( Flow f,
Packet p 
)