suricata
app-layer-frames.h
Go to the documentation of this file.
1 /* Copyright (C) 2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have frameeived a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __APP_LAYER_FRAMES_H__
25 #define __APP_LAYER_FRAMES_H__
26 
27 #include "rust.h"
28 
29 /** max 63 to fit the 64 bit per protocol space */
30 #define FRAME_STREAM_TYPE 63
31 /** always the first frame to be created. TODO but what about protocol upgrades? */
32 #define FRAME_STREAM_ID 1
33 
34 typedef int64_t FrameId;
35 
36 enum {
38 #define FRAME_FLAG_TX_ID_SET BIT_U8(FRAME_FLAGE_TX_ID_SET)
40 #define FRAME_FLAG_ENDS_AT_EOF BIT_U8(FRAME_FLAGE_ENDS_AT_EOF)
42 #define FRAME_FLAG_LOGGED BIT_U8(FRAME_FLAGE_LOGGED)
43 };
44 
45 typedef struct Frame {
46  uint8_t type; /**< protocol specific field type. E.g. NBSS.HDR or SMB.DATA */
47  uint8_t flags; /**< frame flags: FRAME_FLAG_* */
48  uint8_t event_cnt;
49  // TODO one event per frame enough?
50  uint8_t events[4]; /**< per frame store for events */
51  uint64_t offset; /**< offset from the start of the stream */
52  int64_t len;
53  int64_t id;
54  uint64_t tx_id; /**< tx_id to match this frame. UINT64T_MAX if not used. */
55  uint64_t inspect_progress; /**< inspection tracker relative to the start of the frame */
57 
58 #define FRAMES_STATIC_CNT 3
59 
60 typedef struct Frames {
61  uint16_t cnt;
62  uint16_t dyn_size; /**< size in elements of `dframes` */
63  uint32_t left_edge_rel;
64  uint64_t base_id;
65  Frame sframes[FRAMES_STATIC_CNT]; /**< static frames */
66  Frame *dframes; /**< dynamically allocated space for more frames */
67 #ifdef DEBUG
68  uint8_t ipproto;
69  AppProto alproto;
70 #endif
72 
73 typedef struct FramesContainer {
77 
78 void FramesFree(Frames *frames);
79 void FramesPrune(Flow *f, Packet *p);
80 
81 Frame *AppLayerFrameNewByPointer(Flow *f, const StreamSlice *stream_slice,
82  const uint8_t *frame_start, const int64_t len, int dir, uint8_t frame_type);
83 Frame *AppLayerFrameNewByRelativeOffset(Flow *f, const StreamSlice *stream_slice,
84  const uint32_t frame_start_rel, const int64_t len, int dir, uint8_t frame_type);
85 Frame *AppLayerFrameNewByAbsoluteOffset(Flow *f, const StreamSlice *stream_slice,
86  const uint64_t frame_start, const int64_t len, int dir, uint8_t frame_type);
87 void AppLayerFrameDump(Flow *f);
88 
89 Frame *FrameGetByIndex(Frames *frames, const uint32_t idx);
90 Frame *FrameGetById(Frames *frames, const int64_t id);
91 
92 Frame *AppLayerFrameGetById(Flow *f, const int direction, const FrameId frame_id);
94 void AppLayerFrameAddEvent(Frame *frame, uint8_t e);
95 void AppLayerFrameAddEventById(Flow *f, const int dir, const FrameId id, uint8_t e);
96 void AppLayerFrameSetLength(Frame *frame, int64_t len);
97 void AppLayerFrameSetLengthById(Flow *f, const int dir, const FrameId id, int64_t len);
98 void AppLayerFrameSetTxId(Frame *r, uint64_t tx_id);
99 void AppLayerFrameSetTxIdById(Flow *f, const int dir, const FrameId id, uint64_t tx_id);
100 
101 void AppLayerFramesSlide(Flow *f, const uint32_t slide, const uint8_t direction);
102 
105 
106 void FrameConfigInit(void);
107 void FrameConfigEnableAll(void);
108 void FrameConfigEnable(const AppProto p, const uint8_t type);
109 
110 #endif
Frame::inspect_progress
uint64_t inspect_progress
Definition: app-layer-frames.h:55
len
uint8_t len
Definition: app-layer-dnp3.h:2
Frame::tx_id
uint64_t tx_id
Definition: app-layer-frames.h:54
FRAME_FLAGE_ENDS_AT_EOF
@ FRAME_FLAGE_ENDS_AT_EOF
Definition: app-layer-frames.h:39
FRAME_FLAGE_TX_ID_SET
@ FRAME_FLAGE_TX_ID_SET
Definition: app-layer-frames.h:37
FrameConfigInit
void FrameConfigInit(void)
Definition: app-layer-frames.c:38
Frame::events
uint8_t events[4]
Definition: app-layer-frames.h:50
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
FramesContainer::toserver
Frames toserver
Definition: app-layer-frames.h:74
AppLayerFramesSetupContainer
FramesContainer * AppLayerFramesSetupContainer(Flow *f)
Definition: app-layer-parser.c:190
Frame::offset
uint64_t offset
Definition: app-layer-frames.h:51
Frame
Definition: app-layer-frames.h:45
Flow_
Flow data structure.
Definition: flow.h:357
Frames::cnt
uint16_t cnt
Definition: app-layer-frames.h:61
Frame::id
int64_t id
Definition: app-layer-frames.h:53
FRAME_FLAGE_LOGGED
@ FRAME_FLAGE_LOGGED
Definition: app-layer-frames.h:41
FramesFree
void FramesFree(Frames *frames)
Definition: app-layer-frames.c:406
rust.h
Frames
Definition: app-layer-frames.h:60
FramesContainer
Definition: app-layer-frames.h:73
AppLayerFramesSlide
void AppLayerFramesSlide(Flow *f, const uint32_t slide, const uint8_t direction)
Definition: app-layer-frames.c:361
FramesContainer
struct FramesContainer FramesContainer
Frames::left_edge_rel
uint32_t left_edge_rel
Definition: app-layer-frames.h:63
FrameGetById
Frame * FrameGetById(Frames *frames, const int64_t id)
Definition: app-layer-frames.c:86
FrameConfigEnableAll
void FrameConfigEnableAll(void)
Definition: app-layer-frames.c:45
AppLayerFrameNewByAbsoluteOffset
Frame * AppLayerFrameNewByAbsoluteOffset(Flow *f, const StreamSlice *stream_slice, const uint64_t frame_start, const int64_t len, int dir, uint8_t frame_type)
create new frame using the absolute offset from the start of the stream
Definition: app-layer-frames.c:555
Frames::dframes
Frame * dframes
Definition: app-layer-frames.h:66
AppLayerFrameAddEventById
void AppLayerFrameAddEventById(Flow *f, const int dir, const FrameId id, uint8_t e)
Definition: app-layer-frames.c:607
FramesContainer::toclient
Frames toclient
Definition: app-layer-frames.h:75
type
uint8_t type
Definition: decode-icmpv4.h:0
AppLayerFrameSetTxIdById
void AppLayerFrameSetTxIdById(Flow *f, const int dir, const FrameId id, uint64_t tx_id)
Definition: app-layer-frames.c:645
AppLayerFrameGetId
FrameId AppLayerFrameGetId(Frame *r)
Definition: app-layer-frames.c:613
AppLayerFrameAddEvent
void AppLayerFrameAddEvent(Frame *frame, uint8_t e)
Definition: app-layer-frames.c:597
AppLayerFrameDump
void AppLayerFrameDump(Flow *f)
Definition: app-layer-frames.c:542
AppLayerFrameSetTxId
void AppLayerFrameSetTxId(Frame *r, uint64_t tx_id)
Definition: app-layer-frames.c:636
AppLayerFrameNewByRelativeOffset
Frame * AppLayerFrameNewByRelativeOffset(Flow *f, const StreamSlice *stream_slice, const uint32_t frame_start_rel, const int64_t len, int dir, uint8_t frame_type)
create new frame using a relative offset from the start of the stream slice
Definition: app-layer-frames.c:495
Frames
struct Frames Frames
FrameId
int64_t FrameId
Definition: app-layer-frames.h:34
FRAMES_STATIC_CNT
#define FRAMES_STATIC_CNT
Definition: app-layer-frames.h:58
Packet_
Definition: decode.h:428
AppLayerFrameGetById
Frame * AppLayerFrameGetById(Flow *f, const int direction, const FrameId frame_id)
Definition: app-layer-frames.c:651
AppLayerFramesGetContainer
FramesContainer * AppLayerFramesGetContainer(Flow *f)
Definition: app-layer-parser.c:183
FramesPrune
void FramesPrune(Flow *f, Packet *p)
Definition: app-layer-frames.c:763
AppLayerFrameSetLength
void AppLayerFrameSetLength(Frame *frame, int64_t len)
Definition: app-layer-frames.c:622
Frame::len
int64_t len
Definition: app-layer-frames.h:52
Frame
struct Frame Frame
AppLayerFrameNewByPointer
Frame * AppLayerFrameNewByPointer(Flow *f, const StreamSlice *stream_slice, const uint8_t *frame_start, const int64_t len, int dir, uint8_t frame_type)
create new frame using a pointer to start of the frame
Definition: app-layer-frames.c:416
FrameConfigEnable
void FrameConfigEnable(const AppProto p, const uint8_t type)
Definition: app-layer-frames.c:54
Frame::flags
uint8_t flags
Definition: app-layer-frames.h:47
FrameGetByIndex
Frame * FrameGetByIndex(Frames *frames, const uint32_t idx)
Definition: app-layer-frames.c:106
Frame::type
uint8_t type
Definition: app-layer-frames.h:46
Frame::event_cnt
uint8_t event_cnt
Definition: app-layer-frames.h:48
Frames::sframes
Frame sframes[FRAMES_STATIC_CNT]
Definition: app-layer-frames.h:65
AppLayerFrameSetLengthById
void AppLayerFrameSetLengthById(Flow *f, const int dir, const FrameId id, int64_t len)
Definition: app-layer-frames.c:630
Frames::base_id
uint64_t base_id
Definition: app-layer-frames.h:64
Frames::dyn_size
uint16_t dyn_size
Definition: app-layer-frames.h:62