suricata
defrag.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Endace Technology Limited, Jason Ish <jason.ish@endace.com>
22  */
23 
24 #ifndef __DEFRAG_H__
25 #define __DEFRAG_H__
26 
27 #include "util-pool.h"
28 
29 /**
30  * A context for an instance of a fragmentation re-assembler, in case
31  * we ever need more than one.
32  */
33 typedef struct DefragContext_ {
34  Pool *frag_pool; /**< Pool of fragments. */
36 
37  time_t timeout; /**< Default timeout. */
39 
40 /**
41  * Storage for an individual fragment.
42  */
43 typedef struct Frag_ {
44  uint16_t offset; /**< The offset of this fragment, already
45  * multiplied by 8. */
46 
47  uint32_t len; /**< The length of this fragment. */
48 
49  uint8_t hlen; /**< The length of this fragments IP header. */
50 
51  uint8_t more_frags:4; /**< More frags? */
52  uint8_t skip:4; /**< Skip this fragment during re-assembly. */
53 
54  uint16_t ip_hdr_offset; /**< Offset in the packet where the IP
55  * header starts. */
56  uint16_t frag_hdr_offset; /**< Offset in the packet where the frag
57  * header starts. */
58 
59  uint16_t data_offset; /**< Offset to the packet data. */
60  uint16_t data_len; /**< Length of data. */
61 
62  uint16_t ltrim; /**< Number of leading bytes to trim when
63  * re-assembling the packet. */
64 
65  uint8_t *pkt; /**< The actual packet. */
66 
67 #ifdef DEBUG
68  uint64_t pcap_cnt; /**< pcap_cnt of original packet */
69 #endif
70 
72 } Frag;
73 
74 int DefragRbFragCompare(struct Frag_ *a, struct Frag_ *b);
75 
76 RB_HEAD(IP_FRAGMENTS, Frag_);
78 
79 /**
80  * A defragmentation tracker. Used to track fragments that make up a
81  * single packet.
82  */
83 typedef struct DefragTracker_ {
84  SCMutex lock; /**< Mutex for locking list operations on
85  * this tracker. */
86 
87  uint16_t vlan_id[2]; /**< VLAN ID tracker applies to. */
88 
89  uint32_t id; /**< IP ID for this tracker. 32 bits for IPv6, 16
90  * for IPv4. */
91 
92  uint8_t proto; /**< IP protocol for this tracker. */
93 
94  uint8_t policy; /**< Reassembly policy this tracker will use. */
95 
96  uint8_t af; /**< Address family for this tracker, AF_INET or
97  * AF_INET6. */
98 
99  uint8_t seen_last; /**< Has this tracker seen the last fragment? */
100 
101  uint8_t remove; /**< remove */
102 
103  Address src_addr; /**< Source address for this tracker. */
104  Address dst_addr; /**< Destination address for this tracker. */
105 
106  struct timeval timeout; /**< When this tracker will timeout. */
107  uint32_t host_timeout; /**< Host timeout, statically assigned from the yaml */
108 
109  /** use cnt, reference counter */
110  SC_ATOMIC_DECLARE(unsigned int, use_cnt);
111 
112  struct IP_FRAGMENTS fragment_tree;
113 
114  /** hash pointers, protected by hash row mutex/spin */
117 
118  /** list pointers, protected by tracker-queue mutex/spin */
122 
123 void DefragInit(void);
124 void DefragDestroy(void);
125 void DefragReload(void); /**< use only in unittests */
126 
127 uint8_t DefragGetOsPolicy(Packet *);
130 void DefragRegisterTests(void);
131 
132 #endif /* __DEFRAG_H__ */
Frag_
Definition: defrag.h:43
DefragGetOsPolicy
uint8_t DefragGetOsPolicy(Packet *)
Get the defrag policy based on the destination address of the packet.
Definition: defrag.c:929
Defrag
Packet * Defrag(ThreadVars *, DecodeThreadVars *, Packet *)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:1008
DefragTracker_::hnext
struct DefragTracker_ * hnext
Definition: defrag.h:115
RB_PROTOTYPE
RB_PROTOTYPE(IP_FRAGMENTS, Frag_, rb, DefragRbFragCompare)
DefragTrackerFreeFrags
void DefragTrackerFreeFrags(DefragTracker *)
Free all frags associated with a tracker.
Definition: defrag.c:155
Frag_::data_len
uint16_t data_len
Definition: defrag.h:60
DefragContext_::timeout
time_t timeout
Definition: defrag.h:37
DefragContext_::frag_pool
Pool * frag_pool
Definition: defrag.h:34
DefragTracker_::host_timeout
uint32_t host_timeout
Definition: defrag.h:107
Address_
Definition: decode.h:113
DefragTracker_::vlan_id
uint16_t vlan_id[2]
Definition: defrag.h:87
Pool_
Definition: util-pool.h:43
DefragTracker_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(unsigned int, use_cnt)
DefragTracker_::hprev
struct DefragTracker_ * hprev
Definition: defrag.h:116
DefragTracker_::lock
SCMutex lock
Definition: defrag.h:84
DefragContext_::frag_pool_lock
SCMutex frag_pool_lock
Definition: defrag.h:35
DefragTracker_::remove
uint8_t remove
Definition: defrag.h:101
DefragRegisterTests
void DefragRegisterTests(void)
Definition: defrag.c:2470
DefragTracker_::seen_last
uint8_t seen_last
Definition: defrag.h:99
DefragTracker_::policy
uint8_t policy
Definition: defrag.h:94
DefragTracker_
Definition: defrag.h:83
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:56
DefragReload
void DefragReload(void)
DefragTracker_::dst_addr
Address dst_addr
Definition: defrag.h:104
DefragTracker_::timeout
struct timeval timeout
Definition: defrag.h:106
Packet_
Definition: decode.h:433
DefragTracker_::id
uint32_t id
Definition: defrag.h:89
DefragTracker_::src_addr
Address src_addr
Definition: defrag.h:103
Frag_::skip
uint8_t skip
Definition: defrag.h:52
Frag_::pkt
uint8_t * pkt
Definition: defrag.h:65
DefragInit
void DefragInit(void)
Definition: defrag.c:1054
Frag_::data_offset
uint16_t data_offset
Definition: defrag.h:59
DefragTracker_::proto
uint8_t proto
Definition: defrag.h:92
DefragContext_
Definition: defrag.h:33
DefragContext
struct DefragContext_ DefragContext
Frag_::ltrim
uint16_t ltrim
Definition: defrag.h:62
Frag_::RB_ENTRY
RB_ENTRY(Frag_) rb
DefragTracker_::fragment_tree
struct IP_FRAGMENTS fragment_tree
Definition: defrag.h:112
Frag_::len
uint32_t len
Definition: defrag.h:47
Frag_::frag_hdr_offset
uint16_t frag_hdr_offset
Definition: defrag.h:56
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:663
Frag_::more_frags
uint8_t more_frags
Definition: defrag.h:51
DefragTracker_::af
uint8_t af
Definition: defrag.h:96
DefragTracker_::lnext
struct DefragTracker_ * lnext
Definition: defrag.h:119
Frag
struct Frag_ Frag
DefragTracker_::lprev
struct DefragTracker_ * lprev
Definition: defrag.h:120
Frag_::hlen
uint8_t hlen
Definition: defrag.h:49
DefragRbFragCompare
int DefragRbFragCompare(struct Frag_ *a, struct Frag_ *b)
Definition: defrag.c:521
DefragTracker
struct DefragTracker_ DefragTracker
util-pool.h
SCMutex
#define SCMutex
Definition: threads-debug.h:114
Frag_::offset
uint16_t offset
Definition: defrag.h:44
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1075
Frag_::ip_hdr_offset
uint16_t ip_hdr_offset
Definition: defrag.h:54
RB_HEAD
RB_HEAD(IP_FRAGMENTS, Frag_)