suricata
decode-template.c
Go to the documentation of this file.
1
/* Copyright (C) 2015-2018 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \ingroup decode
20
*
21
* @{
22
*/
23
24
25
/**
26
* \file
27
*
28
* \author XXX Your Name <your@email.com>
29
*
30
* Decodes XXX describe the protocol
31
*/
32
33
#include "
suricata-common.h
"
34
#include "
suricata.h
"
35
#include "
decode.h
"
36
#include "
decode-events.h
"
37
#include "
decode-template.h
"
38
39
/**
40
* \brief Function to decode TEMPLATE packets
41
* \param tv thread vars
42
* \param dtv decoder thread vars
43
* \param p packet
44
* \param pkt raw packet data
45
* \param len length in bytes of pkt array
46
* \retval TM_ECODE_OK or TM_ECODE_FAILED on serious error
47
*/
48
49
int
DecodeTEMPLATE
(
ThreadVars
*
tv
,
DecodeThreadVars
*
dtv
,
Packet
*p,
50
const
uint8_t *pkt, uint32_t
len
)
51
{
52
/* TODO add counter for your type of packet to DecodeThreadVars,
53
* and register it in DecodeRegisterPerfCounters */
54
//StatsIncr(tv, dtv->counter_template);
55
56
/* Validation: make sure that the input data is big enough to hold
57
* the header */
58
if
(
len
<
sizeof
(TemplateHdr)) {
59
/* in case of errors, we set events. Events are defined in
60
* decode-events.h, and are then exposed to the detection
61
* engine through detect-engine-events.h */
62
//ENGINE_SET_EVENT(p,TEMPLATE_HEADER_TOO_SMALL);
63
return
TM_ECODE_FAILED
;
64
}
65
66
/* Now we can access the header */
67
const
TemplateHdr *hdr = (
const
TemplateHdr *)pkt;
68
69
/* lets assume we have UDP encapsulated */
70
if
(hdr->proto == 17) {
71
/* we need to pass on the pkt and it's length minus the current
72
* header */
73
size_t
hdr_len =
sizeof
(TemplateHdr);
74
75
/* in this example it's clear that hdr_len can't be bigger than
76
* 'len', but in more complex cases checking that we can't underflow
77
* len is very important
78
if (hdr_len >= len) {
79
ENGINE_SET_EVENT(p,TEMPLATE_MALFORMED_HDRLEN);
80
return TM_ECODE_FAILED;
81
}
82
*/
83
84
/* invoke the next decoder on the remainder of the data */
85
return
DecodeUDP
(
tv
,
dtv
, p, (uint8_t *)pkt + hdr_len,
len
- hdr_len);
86
}
else
{
87
//ENGINE_SET_EVENT(p,TEMPLATE_UNSUPPORTED_PROTOCOL);
88
return
TM_ECODE_FAILED
;
89
}
90
91
return
TM_ECODE_OK
;
92
}
93
94
/**
95
* @}
96
*/
len
uint8_t len
Definition:
app-layer-dnp3.h:2
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition:
decode-udp.c:75
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition:
tm-threads-common.h:81
TM_ECODE_OK
@ TM_ECODE_OK
Definition:
tm-threads-common.h:80
decode.h
ThreadVars_
Per thread variable structure.
Definition:
threadvars.h:58
DecodeTEMPLATE
int DecodeTEMPLATE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode TEMPLATE packets.
Definition:
decode-template.c:49
Packet_
Definition:
decode.h:415
decode-events.h
dtv
DecodeThreadVars * dtv
Definition:
fuzz_decodepcapfile.c:30
suricata-common.h
tv
ThreadVars * tv
Definition:
fuzz_decodepcapfile.c:29
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition:
decode.h:634
suricata.h
decode-template.h
src
decode-template.c
Generated on Sat Jan 23 2021 23:30:29 for suricata by
1.8.18