suricata
app-layer-frames.h
Go to the documentation of this file.
1 /* Copyright (C) 2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have frameeived a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __APP_LAYER_FRAMES_H__
25 #define __APP_LAYER_FRAMES_H__
26 
27 #include "rust.h"
28 
29 typedef int64_t FrameId;
30 
31 enum {
33 #define FRAME_FLAG_TX_ID_SET BIT_U8(FRAME_FLAGE_TX_ID_SET)
35 #define FRAME_FLAG_ENDS_AT_EOF BIT_U8(FRAME_FLAGE_ENDS_AT_EOF)
37 #define FRAME_FLAG_LOGGED BIT_U8(FRAME_FLAGE_LOGGED)
38 };
39 
40 typedef struct Frame {
41  uint8_t type; /**< protocol specific field type. E.g. NBSS.HDR or SMB.DATA */
42  uint8_t flags; /**< frame flags: FRAME_FLAG_* */
43  uint8_t event_cnt;
44  // TODO one event per frame enough?
45  uint8_t events[4]; /**< per frame store for events */
46  int64_t rel_offset; /**< relative offset in the stream on top of Stream::stream_offset (if
47  negative the start if before the stream data) */
48  int64_t len;
49  int64_t id;
50  uint64_t tx_id; /**< tx_id to match this frame. UINT64T_MAX if not used. */
52 // size 40
53 
54 #define FRAMES_STATIC_CNT 3
55 
56 typedef struct Frames {
57  uint16_t cnt;
58  uint16_t dyn_size; /**< size in elements of `dframes` */
59  uint32_t left_edge_rel;
60  uint64_t base_id;
61  Frame sframes[FRAMES_STATIC_CNT]; /**< static frames */
62  Frame *dframes; /**< dynamically allocated space for more frames */
63 #ifdef DEBUG
64  uint8_t ipproto;
65  AppProto alproto;
66 #endif
68 // size 136
69 
70 typedef struct FramesContainer {
74 // size 272
75 
76 void FramesFree(Frames *frames);
77 void FramesPrune(Flow *f, Packet *p);
78 
79 Frame *AppLayerFrameNewByPointer(Flow *f, const StreamSlice *stream_slice,
80  const uint8_t *frame_start, const int64_t len, int dir, uint8_t frame_type);
81 Frame *AppLayerFrameNewByRelativeOffset(Flow *f, const StreamSlice *stream_slice,
82  const uint32_t frame_start_rel, const int64_t len, int dir, uint8_t frame_type);
83 Frame *AppLayerFrameNewByAbsoluteOffset(Flow *f, const StreamSlice *stream_slice,
84  const uint64_t frame_start, const int64_t len, int dir, uint8_t frame_type);
85 void AppLayerFrameDump(Flow *f);
86 
87 Frame *FrameGetByIndex(Frames *frames, const uint32_t idx);
88 Frame *FrameGetById(Frames *frames, const int64_t id);
89 
90 Frame *AppLayerFrameGetById(Flow *f, const int direction, const FrameId frame_id);
92 void AppLayerFrameAddEvent(Frame *frame, uint8_t e);
93 void AppLayerFrameAddEventById(Flow *f, const int dir, const FrameId id, uint8_t e);
94 void AppLayerFrameSetLength(Frame *frame, int64_t len);
95 void AppLayerFrameSetLengthById(Flow *f, const int dir, const FrameId id, int64_t len);
96 void AppLayerFrameSetTxId(Frame *r, uint64_t tx_id);
97 void AppLayerFrameSetTxIdById(Flow *f, const int dir, const FrameId id, uint64_t tx_id);
98 
99 void AppLayerFramesSlide(Flow *f, const uint32_t slide, const uint8_t direction);
100 
103 
104 #endif
len
uint8_t len
Definition: app-layer-dnp3.h:2
Frame::tx_id
uint64_t tx_id
Definition: app-layer-frames.h:50
FRAME_FLAGE_ENDS_AT_EOF
@ FRAME_FLAGE_ENDS_AT_EOF
Definition: app-layer-frames.h:34
Frame::rel_offset
int64_t rel_offset
Definition: app-layer-frames.h:46
FRAME_FLAGE_TX_ID_SET
@ FRAME_FLAGE_TX_ID_SET
Definition: app-layer-frames.h:32
Frame::events
uint8_t events[4]
Definition: app-layer-frames.h:45
AppProto
uint16_t AppProto
Definition: app-layer-protos.h:80
FramesContainer::toserver
Frames toserver
Definition: app-layer-frames.h:71
AppLayerFramesSetupContainer
FramesContainer * AppLayerFramesSetupContainer(Flow *f)
Definition: app-layer-parser.c:207
Frame
Definition: app-layer-frames.h:40
Flow_
Flow data structure.
Definition: flow.h:353
Frames::cnt
uint16_t cnt
Definition: app-layer-frames.h:57
Frame::id
int64_t id
Definition: app-layer-frames.h:49
FRAME_FLAGE_LOGGED
@ FRAME_FLAGE_LOGGED
Definition: app-layer-frames.h:36
FramesFree
void FramesFree(Frames *frames)
Definition: app-layer-frames.c:374
rust.h
Frames
Definition: app-layer-frames.h:56
FramesContainer
Definition: app-layer-frames.h:70
AppLayerFramesSlide
void AppLayerFramesSlide(Flow *f, const uint32_t slide, const uint8_t direction)
Definition: app-layer-frames.c:329
FramesContainer
struct FramesContainer FramesContainer
Frames::left_edge_rel
uint32_t left_edge_rel
Definition: app-layer-frames.h:59
FrameGetById
Frame * FrameGetById(Frames *frames, const int64_t id)
Definition: app-layer-frames.c:47
AppLayerFrameNewByAbsoluteOffset
Frame * AppLayerFrameNewByAbsoluteOffset(Flow *f, const StreamSlice *stream_slice, const uint64_t frame_start, const int64_t len, int dir, uint8_t frame_type)
create new frame using the absolute offset from the start of the stream
Definition: app-layer-frames.c:538
Frames::dframes
Frame * dframes
Definition: app-layer-frames.h:62
AppLayerFrameAddEventById
void AppLayerFrameAddEventById(Flow *f, const int dir, const FrameId id, uint8_t e)
Definition: app-layer-frames.c:593
FramesContainer::toclient
Frames toclient
Definition: app-layer-frames.h:72
AppLayerFrameSetTxIdById
void AppLayerFrameSetTxIdById(Flow *f, const int dir, const FrameId id, uint64_t tx_id)
Definition: app-layer-frames.c:631
AppLayerFrameGetId
FrameId AppLayerFrameGetId(Frame *r)
Definition: app-layer-frames.c:599
AppLayerFrameAddEvent
void AppLayerFrameAddEvent(Frame *frame, uint8_t e)
Definition: app-layer-frames.c:583
AppLayerFrameDump
void AppLayerFrameDump(Flow *f)
Definition: app-layer-frames.c:525
AppLayerFrameSetTxId
void AppLayerFrameSetTxId(Frame *r, uint64_t tx_id)
Definition: app-layer-frames.c:622
AppLayerFrameNewByRelativeOffset
Frame * AppLayerFrameNewByRelativeOffset(Flow *f, const StreamSlice *stream_slice, const uint32_t frame_start_rel, const int64_t len, int dir, uint8_t frame_type)
create new frame using a relative offset from the start of the stream slice
Definition: app-layer-frames.c:461
Frames
struct Frames Frames
FrameId
int64_t FrameId
Definition: app-layer-frames.h:29
FRAMES_STATIC_CNT
#define FRAMES_STATIC_CNT
Definition: app-layer-frames.h:54
Packet_
Definition: decode.h:433
AppLayerFrameGetById
Frame * AppLayerFrameGetById(Flow *f, const int direction, const FrameId frame_id)
Definition: app-layer-frames.c:637
AppLayerFramesGetContainer
FramesContainer * AppLayerFramesGetContainer(Flow *f)
Definition: app-layer-parser.c:200
FramesPrune
void FramesPrune(Flow *f, Packet *p)
Definition: app-layer-frames.c:746
AppLayerFrameSetLength
void AppLayerFrameSetLength(Frame *frame, int64_t len)
Definition: app-layer-frames.c:608
Frame::len
int64_t len
Definition: app-layer-frames.h:48
Frame
struct Frame Frame
AppLayerFrameNewByPointer
Frame * AppLayerFrameNewByPointer(Flow *f, const StreamSlice *stream_slice, const uint8_t *frame_start, const int64_t len, int dir, uint8_t frame_type)
create new frame using a pointer to start of the frame
Definition: app-layer-frames.c:384
Frame::flags
uint8_t flags
Definition: app-layer-frames.h:42
FrameGetByIndex
Frame * FrameGetByIndex(Frames *frames, const uint32_t idx)
Definition: app-layer-frames.c:64
Frame::type
uint8_t type
Definition: app-layer-frames.h:41
Frame::event_cnt
uint8_t event_cnt
Definition: app-layer-frames.h:43
Frames::sframes
Frame sframes[FRAMES_STATIC_CNT]
Definition: app-layer-frames.h:61
AppLayerFrameSetLengthById
void AppLayerFrameSetLengthById(Flow *f, const int dir, const FrameId id, int64_t len)
Definition: app-layer-frames.c:616
Frames::base_id
uint64_t base_id
Definition: app-layer-frames.h:60
Frames::dyn_size
uint16_t dyn_size
Definition: app-layer-frames.h:58