suricata
app-layer-frames.h
Go to the documentation of this file.
1 /* Copyright (C) 2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef SURICATA_APP_LAYER_FRAMES_H
25 #define SURICATA_APP_LAYER_FRAMES_H
26 
27 #include "rust.h"
28 
29 /** max 63 to fit the 64 bit per protocol space */
30 #define FRAME_STREAM_TYPE 63
31 
32 typedef int64_t FrameId;
33 
34 enum {
36 #define FRAME_FLAG_TX_ID_SET BIT_U8(FRAME_FLAGE_TX_ID_SET)
38 #define FRAME_FLAG_ENDS_AT_EOF BIT_U8(FRAME_FLAGE_ENDS_AT_EOF)
40 #define FRAME_FLAG_LOGGED BIT_U8(FRAME_FLAGE_LOGGED)
41 };
42 
43 typedef struct Frame {
44  uint8_t type; /**< protocol specific field type. E.g. NBSS.HDR or SMB.DATA */
45  uint8_t flags; /**< frame flags: FRAME_FLAG_* */
46  uint8_t event_cnt;
47  // TODO one event per frame enough?
48  uint8_t events[4]; /**< per frame store for events */
49  uint64_t offset; /**< offset from the start of the stream */
50  int64_t len;
51  int64_t id;
52  uint64_t tx_id; /**< tx_id to match this frame. UINT64T_MAX if not used. */
53  uint64_t inspect_progress; /**< inspection tracker relative to the start of the frame */
55 
56 #define FRAMES_STATIC_CNT 3
57 
58 typedef struct Frames {
59  uint16_t cnt;
60  uint16_t dyn_size; /**< size in elements of `dframes` */
61  uint32_t left_edge_rel;
62  uint64_t base_id;
63  Frame sframes[FRAMES_STATIC_CNT]; /**< static frames */
64  Frame *dframes; /**< dynamically allocated space for more frames */
65 #ifdef DEBUG
66  uint8_t ipproto;
67  AppProto alproto;
68 #endif
70 
71 typedef struct FramesContainer {
75 
76 void FramesFree(Frames *frames);
77 void FramesPrune(Flow *f, Packet *p);
78 
79 Frame *AppLayerFrameNewByPointer(Flow *f, const StreamSlice *stream_slice,
80  const uint8_t *frame_start, const int64_t len, int dir, uint8_t frame_type);
81 Frame *AppLayerFrameNewByRelativeOffset(Flow *f, const StreamSlice *stream_slice,
82  const uint32_t frame_start_rel, const int64_t len, int dir, uint8_t frame_type);
83 Frame *AppLayerFrameNewByAbsoluteOffset(Flow *f, const StreamSlice *stream_slice,
84  const uint64_t frame_start, const int64_t len, int dir, uint8_t frame_type);
85 void AppLayerFrameDump(Flow *f);
86 
87 Frame *FrameGetByIndex(Frames *frames, const uint32_t idx);
88 Frame *FrameGetById(Frames *frames, const int64_t id);
89 Frame *FrameGetLastOpenByType(Frames *frames, const uint8_t frame_type);
90 
91 Frame *AppLayerFrameGetById(Flow *f, const int direction, const FrameId frame_id);
92 Frame *AppLayerFrameGetLastOpenByType(Flow *f, const int direction, const uint8_t frame_type);
93 
95 
96 void AppLayerFrameAddEvent(Frame *frame, uint8_t e);
97 void AppLayerFrameAddEventById(Flow *f, const int dir, const FrameId id, uint8_t e);
98 void AppLayerFrameSetLength(Frame *frame, int64_t len);
99 void AppLayerFrameSetLengthById(Flow *f, const int dir, const FrameId id, int64_t len);
100 void AppLayerFrameSetTxId(Frame *r, uint64_t tx_id);
101 void AppLayerFrameSetTxIdById(Flow *f, const int dir, const FrameId id, uint64_t tx_id);
102 
103 void AppLayerFramesSlide(Flow *f, const uint32_t slide, const uint8_t direction);
104 
107 
108 void FrameConfigInit(void);
109 void FrameConfigEnableAll(void);
110 void FrameConfigEnable(const AppProto p, const uint8_t type);
111 
112 #endif
Frame::inspect_progress
uint64_t inspect_progress
Definition: app-layer-frames.h:53
len
uint8_t len
Definition: app-layer-dnp3.h:2
Frame::tx_id
uint64_t tx_id
Definition: app-layer-frames.h:52
FrameConfigInit
void FrameConfigInit(void)
Definition: app-layer-frames.c:38
Frame::events
uint8_t events[4]
Definition: app-layer-frames.h:48
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:81
FramesContainer::toserver
Frames toserver
Definition: app-layer-frames.h:72
AppLayerFramesSetupContainer
FramesContainer * AppLayerFramesSetupContainer(Flow *f)
Definition: app-layer-parser.c:180
Frame::offset
uint64_t offset
Definition: app-layer-frames.h:49
Frame
Definition: app-layer-frames.h:43
Flow_
Flow data structure.
Definition: flow.h:356
Frames::cnt
uint16_t cnt
Definition: app-layer-frames.h:59
FrameGetLastOpenByType
Frame * FrameGetLastOpenByType(Frames *frames, const uint8_t frame_type)
Definition: app-layer-frames.c:91
Frame::id
int64_t id
Definition: app-layer-frames.h:51
FramesFree
void FramesFree(Frames *frames)
Definition: app-layer-frames.c:437
rust.h
Frames
Definition: app-layer-frames.h:58
FramesContainer
Definition: app-layer-frames.h:71
AppLayerFramesSlide
void AppLayerFramesSlide(Flow *f, const uint32_t slide, const uint8_t direction)
Definition: app-layer-frames.c:392
FramesContainer
struct FramesContainer FramesContainer
Frames::left_edge_rel
uint32_t left_edge_rel
Definition: app-layer-frames.h:61
FrameGetById
Frame * FrameGetById(Frames *frames, const int64_t id)
Definition: app-layer-frames.c:114
FrameConfigEnableAll
void FrameConfigEnableAll(void)
Definition: app-layer-frames.c:45
AppLayerFrameNewByAbsoluteOffset
Frame * AppLayerFrameNewByAbsoluteOffset(Flow *f, const StreamSlice *stream_slice, const uint64_t frame_start, const int64_t len, int dir, uint8_t frame_type)
create new frame using the absolute offset from the start of the stream
Definition: app-layer-frames.c:588
Frames::dframes
Frame * dframes
Definition: app-layer-frames.h:64
AppLayerFrameAddEventById
void AppLayerFrameAddEventById(Flow *f, const int dir, const FrameId id, uint8_t e)
Definition: app-layer-frames.c:640
FramesContainer::toclient
Frames toclient
Definition: app-layer-frames.h:73
AppLayerFrameSetTxIdById
void AppLayerFrameSetTxIdById(Flow *f, const int dir, const FrameId id, uint64_t tx_id)
Definition: app-layer-frames.c:678
AppLayerFrameGetId
FrameId AppLayerFrameGetId(Frame *r)
Definition: app-layer-frames.c:646
AppLayerFrameAddEvent
void AppLayerFrameAddEvent(Frame *frame, uint8_t e)
Definition: app-layer-frames.c:630
AppLayerFrameDump
void AppLayerFrameDump(Flow *f)
Definition: app-layer-frames.c:573
AppLayerFrameSetTxId
void AppLayerFrameSetTxId(Frame *r, uint64_t tx_id)
Definition: app-layer-frames.c:669
AppLayerFrameNewByRelativeOffset
Frame * AppLayerFrameNewByRelativeOffset(Flow *f, const StreamSlice *stream_slice, const uint32_t frame_start_rel, const int64_t len, int dir, uint8_t frame_type)
create new frame using a relative offset from the start of the stream slice
Definition: app-layer-frames.c:526
Frames
struct Frames Frames
FrameId
int64_t FrameId
Definition: app-layer-frames.h:32
FRAMES_STATIC_CNT
#define FRAMES_STATIC_CNT
Definition: app-layer-frames.h:56
Packet_
Definition: decode.h:475
AppLayerFrameGetById
Frame * AppLayerFrameGetById(Flow *f, const int direction, const FrameId frame_id)
Definition: app-layer-frames.c:684
type
uint16_t type
Definition: decode-vlan.c:107
AppLayerFramesGetContainer
FramesContainer * AppLayerFramesGetContainer(Flow *f)
Definition: app-layer-parser.c:173
FRAME_FLAGE_LOGGED
@ FRAME_FLAGE_LOGGED
Definition: app-layer-frames.h:39
FramesPrune
void FramesPrune(Flow *f, Packet *p)
Definition: app-layer-frames.c:816
AppLayerFrameSetLength
void AppLayerFrameSetLength(Frame *frame, int64_t len)
Definition: app-layer-frames.c:655
Frame::len
int64_t len
Definition: app-layer-frames.h:50
Frame
struct Frame Frame
AppLayerFrameNewByPointer
Frame * AppLayerFrameNewByPointer(Flow *f, const StreamSlice *stream_slice, const uint8_t *frame_start, const int64_t len, int dir, uint8_t frame_type)
create new frame using a pointer to start of the frame
Definition: app-layer-frames.c:447
FrameConfigEnable
void FrameConfigEnable(const AppProto p, const uint8_t type)
Definition: app-layer-frames.c:54
Frame::flags
uint8_t flags
Definition: app-layer-frames.h:45
FrameGetByIndex
Frame * FrameGetByIndex(Frames *frames, const uint32_t idx)
Definition: app-layer-frames.c:134
Frame::type
uint8_t type
Definition: app-layer-frames.h:44
Frame::event_cnt
uint8_t event_cnt
Definition: app-layer-frames.h:46
Frames::sframes
Frame sframes[FRAMES_STATIC_CNT]
Definition: app-layer-frames.h:63
FRAME_FLAGE_TX_ID_SET
@ FRAME_FLAGE_TX_ID_SET
Definition: app-layer-frames.h:35
AppLayerFrameSetLengthById
void AppLayerFrameSetLengthById(Flow *f, const int dir, const FrameId id, int64_t len)
Definition: app-layer-frames.c:663
Frames::base_id
uint64_t base_id
Definition: app-layer-frames.h:62
FRAME_FLAGE_ENDS_AT_EOF
@ FRAME_FLAGE_ENDS_AT_EOF
Definition: app-layer-frames.h:37
AppLayerFrameGetLastOpenByType
Frame * AppLayerFrameGetLastOpenByType(Flow *f, const int direction, const uint8_t frame_type)
Definition: app-layer-frames.c:702
Frames::dyn_size
uint16_t dyn_size
Definition: app-layer-frames.h:60