suricata
app-layer-frames.h File Reference
#include "rust.h"
Include dependency graph for app-layer-frames.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  Frame
 
struct  Frames
 
struct  FramesContainer
 

Macros

#define FRAME_STREAM_TYPE   63
 
#define FRAME_FLAG_TX_ID_SET   BIT_U8(FRAME_FLAGE_TX_ID_SET)
 
#define FRAME_FLAG_ENDS_AT_EOF   BIT_U8(FRAME_FLAGE_ENDS_AT_EOF)
 
#define FRAME_FLAG_LOGGED   BIT_U8(FRAME_FLAGE_LOGGED)
 
#define FRAMES_STATIC_CNT   3
 

Typedefs

typedef int64_t FrameId
 
typedef struct Frame Frame
 
typedef struct Frames Frames
 
typedef struct FramesContainer FramesContainer
 

Enumerations

enum  { FRAME_FLAGE_TX_ID_SET, FRAME_FLAGE_ENDS_AT_EOF, FRAME_FLAGE_LOGGED }
 

Functions

void FramesFree (Frames *frames)
 
void FramesPrune (Flow *f, Packet *p)
 
FrameAppLayerFrameNewByPointer (Flow *f, const StreamSlice *stream_slice, const uint8_t *frame_start, const int64_t len, int dir, uint8_t frame_type)
 create new frame using a pointer to start of the frame More...
 
FrameAppLayerFrameNewByRelativeOffset (Flow *f, const StreamSlice *stream_slice, const uint32_t frame_start_rel, const int64_t len, int dir, uint8_t frame_type)
 create new frame using a relative offset from the start of the stream slice More...
 
FrameAppLayerFrameNewByAbsoluteOffset (Flow *f, const StreamSlice *stream_slice, const uint64_t frame_start, const int64_t len, int dir, uint8_t frame_type)
 create new frame using the absolute offset from the start of the stream More...
 
void AppLayerFrameDump (Flow *f)
 
FrameFrameGetByIndex (Frames *frames, const uint32_t idx)
 
FrameFrameGetById (Frames *frames, const int64_t id)
 
FrameFrameGetLastOpenByType (Frames *frames, const uint8_t frame_type)
 
FrameAppLayerFrameGetById (Flow *f, const int direction, const FrameId frame_id)
 
FrameAppLayerFrameGetLastOpenByType (Flow *f, const int direction, const uint8_t frame_type)
 
FrameId AppLayerFrameGetId (Frame *r)
 
void AppLayerFrameAddEvent (Frame *frame, uint8_t e)
 
void AppLayerFrameAddEventById (Flow *f, const int dir, const FrameId id, uint8_t e)
 
void AppLayerFrameSetLength (Frame *frame, int64_t len)
 
void AppLayerFrameSetLengthById (Flow *f, const int dir, const FrameId id, int64_t len)
 
void AppLayerFrameSetTxId (Frame *r, uint64_t tx_id)
 
void AppLayerFrameSetTxIdById (Flow *f, const int dir, const FrameId id, uint64_t tx_id)
 
void AppLayerFramesSlide (Flow *f, const uint32_t slide, const uint8_t direction)
 
FramesContainerAppLayerFramesGetContainer (Flow *f)
 
FramesContainerAppLayerFramesSetupContainer (Flow *f)
 
void FrameConfigInit (void)
 
void FrameConfigEnableAll (void)
 
void FrameConfigEnable (const AppProto p, const uint8_t type)
 

Detailed Description

Macro Definition Documentation

◆ FRAME_FLAG_ENDS_AT_EOF

#define FRAME_FLAG_ENDS_AT_EOF   BIT_U8(FRAME_FLAGE_ENDS_AT_EOF)

Definition at line 39 of file app-layer-frames.h.

◆ FRAME_FLAG_LOGGED

#define FRAME_FLAG_LOGGED   BIT_U8(FRAME_FLAGE_LOGGED)

Definition at line 41 of file app-layer-frames.h.

◆ FRAME_FLAG_TX_ID_SET

#define FRAME_FLAG_TX_ID_SET   BIT_U8(FRAME_FLAGE_TX_ID_SET)

Definition at line 37 of file app-layer-frames.h.

◆ FRAME_STREAM_TYPE

#define FRAME_STREAM_TYPE   63

max 63 to fit the 64 bit per protocol space

Definition at line 31 of file app-layer-frames.h.

◆ FRAMES_STATIC_CNT

#define FRAMES_STATIC_CNT   3

Definition at line 57 of file app-layer-frames.h.

Typedef Documentation

◆ Frame

typedef struct Frame Frame

◆ FrameId

typedef int64_t FrameId

Definition at line 32 of file app-layer-frames.h.

◆ Frames

typedef struct Frames Frames

◆ FramesContainer

Enumeration Type Documentation

◆ anonymous enum

anonymous enum
Enumerator
FRAME_FLAGE_TX_ID_SET 
FRAME_FLAGE_ENDS_AT_EOF 
FRAME_FLAGE_LOGGED 

Definition at line 34 of file app-layer-frames.h.

Function Documentation

◆ AppLayerFrameAddEvent()

void AppLayerFrameAddEvent ( Frame frame,
uint8_t  e 
)

Definition at line 630 of file app-layer-frames.c.

References Frame::event_cnt, Frame::events, and FrameDebug.

Referenced by AppLayerFrameAddEventById().

Here is the caller graph for this function:

◆ AppLayerFrameAddEventById()

void AppLayerFrameAddEventById ( Flow f,
const int  dir,
const FrameId  id,
uint8_t  e 
)

Definition at line 640 of file app-layer-frames.c.

References AppLayerFrameAddEvent(), and AppLayerFrameGetById().

Here is the call graph for this function:

◆ AppLayerFrameDump()

void AppLayerFrameDump ( Flow f)

Definition at line 573 of file app-layer-frames.c.

References Flow_::alparser, AppLayerFramesGetContainer(), Flow_::proto, Flow_::protoctx, FramesContainer::toclient, and FramesContainer::toserver.

Here is the call graph for this function:

◆ AppLayerFrameGetById()

Frame* AppLayerFrameGetById ( Flow f,
const int  direction,
const FrameId  frame_id 
)

Definition at line 684 of file app-layer-frames.c.

References AppLayerFramesGetContainer(), FrameGetById(), SCLogDebug, FramesContainer::toclient, and FramesContainer::toserver.

Referenced by AppLayerFrameAddEventById(), AppLayerFrameSetLengthById(), and AppLayerFrameSetTxIdById().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ AppLayerFrameGetId()

FrameId AppLayerFrameGetId ( Frame r)

Definition at line 646 of file app-layer-frames.c.

References Frame::id.

◆ AppLayerFrameGetLastOpenByType()

Frame* AppLayerFrameGetLastOpenByType ( Flow f,
const int  direction,
const uint8_t  frame_type 
)

Definition at line 702 of file app-layer-frames.c.

◆ AppLayerFrameNewByAbsoluteOffset()

Frame* AppLayerFrameNewByAbsoluteOffset ( Flow f,
const StreamSlice *  stream_slice,
const uint64_t  frame_start,
const int64_t  len,
int  dir,
uint8_t  frame_type 
)

create new frame using the absolute offset from the start of the stream

Definition at line 588 of file app-layer-frames.c.

◆ AppLayerFrameNewByPointer()

Frame* AppLayerFrameNewByPointer ( Flow f,
const StreamSlice *  stream_slice,
const uint8_t *  frame_start,
const int64_t  len,
int  dir,
uint8_t  frame_type 
)

create new frame using a pointer to start of the frame

Definition at line 447 of file app-layer-frames.c.

References SCLogDebug.

◆ AppLayerFrameNewByRelativeOffset()

Frame* AppLayerFrameNewByRelativeOffset ( Flow f,
const StreamSlice *  stream_slice,
const uint32_t  frame_start_rel,
const int64_t  len,
int  dir,
uint8_t  frame_type 
)

create new frame using a relative offset from the start of the stream slice

Definition at line 526 of file app-layer-frames.c.

◆ AppLayerFrameSetLength()

void AppLayerFrameSetLength ( Frame frame,
int64_t  len 
)

Definition at line 655 of file app-layer-frames.c.

References FrameDebug, len, and Frame::len.

Referenced by AppLayerFrameSetLengthById().

Here is the caller graph for this function:

◆ AppLayerFrameSetLengthById()

void AppLayerFrameSetLengthById ( Flow f,
const int  dir,
const FrameId  id,
int64_t  len 
)

Definition at line 663 of file app-layer-frames.c.

References AppLayerFrameGetById(), AppLayerFrameSetLength(), and len.

Here is the call graph for this function:

◆ AppLayerFrameSetTxId()

void AppLayerFrameSetTxId ( Frame r,
uint64_t  tx_id 
)

Definition at line 669 of file app-layer-frames.c.

References Frame::flags, FRAME_FLAG_TX_ID_SET, FrameDebug, and Frame::tx_id.

Referenced by AppLayerFrameSetTxIdById().

Here is the caller graph for this function:

◆ AppLayerFrameSetTxIdById()

void AppLayerFrameSetTxIdById ( Flow f,
const int  dir,
const FrameId  id,
uint64_t  tx_id 
)

Definition at line 678 of file app-layer-frames.c.

References AppLayerFrameGetById(), and AppLayerFrameSetTxId().

Here is the call graph for this function:

◆ AppLayerFramesGetContainer()

FramesContainer* AppLayerFramesGetContainer ( Flow f)

Definition at line 173 of file app-layer-parser.c.

References Flow_::alparser, and AppLayerParserState_::frames.

Referenced by AppLayerFrameDump(), AppLayerFrameGetById(), AppLayerFramesSlide(), FlowNeedsReassembly(), and FramesPrune().

Here is the caller graph for this function:

◆ AppLayerFramesSetupContainer()

◆ AppLayerFramesSlide()

void AppLayerFramesSlide ( Flow f,
const uint32_t  slide,
const uint8_t  direction 
)

Definition at line 392 of file app-layer-frames.c.

References AppLayerFramesGetContainer(), TcpSession_::client, Flow_::protoctx, and FramesContainer::toserver.

Here is the call graph for this function:

◆ FrameConfigEnable()

void FrameConfigEnable ( const AppProto  p,
const uint8_t  type 
)

Definition at line 54 of file app-layer-frames.c.

References BIT_U64, and type.

◆ FrameConfigEnableAll()

void FrameConfigEnableAll ( void  )

Definition at line 45 of file app-layer-frames.c.

References ALPROTO_MAX.

◆ FrameConfigInit()

void FrameConfigInit ( void  )

Definition at line 38 of file app-layer-frames.c.

References ALPROTO_MAX, and SC_ATOMIC_INIT.

Referenced by GlobalsInitPreConfig().

Here is the caller graph for this function:

◆ FrameGetById()

Frame* FrameGetById ( Frames frames,
const int64_t  id 
)

Definition at line 114 of file app-layer-frames.c.

References Frames::cnt, Frames::dframes, FrameDebug, FRAMES_STATIC_CNT, Frame::id, SCLogDebug, and Frames::sframes.

Referenced by AppLayerFrameGetById().

Here is the caller graph for this function:

◆ FrameGetByIndex()

Frame* FrameGetByIndex ( Frames frames,
const uint32_t  idx 
)

◆ FrameGetLastOpenByType()

Frame* FrameGetLastOpenByType ( Frames frames,
const uint8_t  frame_type 
)
Note
"open" means a frame that has no length set (len == -1)
Todo:
perhaps we can search backwards

Definition at line 91 of file app-layer-frames.c.

References Frames::cnt, Frames::dframes, FrameDebug, FRAMES_STATIC_CNT, Frame::len, SCLogDebug, Frames::sframes, and Frame::type.

◆ FramesFree()

void FramesFree ( Frames frames)

Definition at line 437 of file app-layer-frames.c.

References BUG_ON.

◆ FramesPrune()

void FramesPrune ( Flow f,
Packet p 
)