suricata
decode-template.c
Go to the documentation of this file.
1 /* Copyright (C) 2015-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author XXX Your Name <your@email.com>
29  *
30  * Decodes XXX describe the protocol
31  */
32 
33 #include "suricata-common.h"
34 #include "suricata.h"
35 #include "decode.h"
36 #include "decode-events.h"
37 #include "decode-template.h"
38 
39 #include "util-validate.h"
40 
41 /**
42  * \brief Function to decode TEMPLATE packets
43  * \param tv thread vars
44  * \param dtv decoder thread vars
45  * \param p packet
46  * \param pkt raw packet data
47  * \param len length in bytes of pkt array
48  * \retval TM_ECODE_OK or TM_ECODE_FAILED on serious error
49  */
50 
52  const uint8_t *pkt, uint32_t len)
53 {
54  DEBUG_VALIDATE_BUG_ON(pkt == NULL);
55 
56  /* TODO add counter for your type of packet to DecodeThreadVars,
57  * and register it in DecodeRegisterPerfCounters */
58  //StatsIncr(tv, dtv->counter_template);
59 
60  /* Validation: make sure that the input data is big enough to hold
61  * the header */
62  if (len < sizeof(TemplateHdr)) {
63  /* in case of errors, we set events. Events are defined in
64  * decode-events.h, and are then exposed to the detection
65  * engine through detect-engine-events.h */
66  //ENGINE_SET_EVENT(p,TEMPLATE_HEADER_TOO_SMALL);
67  return TM_ECODE_FAILED;
68  }
69  /* Each packet keeps a count of decoded layers
70  * This function increases it and returns false
71  * if we have too many decoded layers, such as
72  * ethernet/MPLS/ethernet/MPLS... which may
73  * lead to stack overflow by a too deep recursion
74  */
75  if (!PacketIncreaseCheckLayers(p)) {
76  return TM_ECODE_FAILED;
77  }
78 
79  /* Now we can access the header */
80  const TemplateHdr *hdr = (const TemplateHdr *)pkt;
81 
82  /* lets assume we have UDP encapsulated */
83  if (hdr->proto == 17) {
84  /* we need to pass on the pkt and it's length minus the current
85  * header */
86  size_t hdr_len = sizeof(TemplateHdr);
87 
88  /* in this example it's clear that hdr_len can't be bigger than
89  * 'len', but in more complex cases checking that we can't underflow
90  * len is very important
91  if (hdr_len >= len) {
92  ENGINE_SET_EVENT(p,TEMPLATE_MALFORMED_HDRLEN);
93  return TM_ECODE_FAILED;
94  }
95  */
96 
97  /* invoke the next decoder on the remainder of the data */
98  return DecodeUDP(tv, dtv, p, (uint8_t *)pkt + hdr_len, len - hdr_len);
99  } else {
100  //ENGINE_SET_EVENT(p,TEMPLATE_UNSUPPORTED_PROTOCOL);
101  return TM_ECODE_FAILED;
102  }
103 
104  return TM_ECODE_OK;
105 }
106 
107 /**
108  * @}
109  */
len
uint8_t len
Definition: app-layer-dnp3.h:2
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
decode.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
DecodeTEMPLATE
int DecodeTEMPLATE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode TEMPLATE packets.
Definition: decode-template.c:51
Packet_
Definition: decode.h:416
decode-events.h
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
suricata-common.h
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
util-validate.h
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:640
suricata.h
decode-template.h
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111