suricata
defrag.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Endace Technology Limited, Jason Ish <jason.ish@endace.com>
22  */
23 
24 #ifndef __DEFRAG_H__
25 #define __DEFRAG_H__
26 
27 #include "tree.h"
28 #include "util-pool.h"
29 
30 /**
31  * A context for an instance of a fragmentation re-assembler, in case
32  * we ever need more than one.
33  */
34 typedef struct DefragContext_ {
35  Pool *frag_pool; /**< Pool of fragments. */
37 
38  time_t timeout; /**< Default timeout. */
40 
41 /**
42  * Storage for an individual fragment.
43  */
44 typedef struct Frag_ {
45  uint16_t offset; /**< The offset of this fragment, already
46  * multiplied by 8. */
47 
48  uint16_t len; /**< The length of this fragment. */
49 
50  uint8_t hlen; /**< The length of this fragments IP header. */
51 
52  uint8_t more_frags:4; /**< More frags? */
53  uint8_t skip:4; /**< Skip this fragment during re-assembly. */
54 
55  uint16_t ip_hdr_offset; /**< Offset in the packet where the IP
56  * header starts. */
57  uint16_t frag_hdr_offset; /**< Offset in the packet where the frag
58  * header starts. */
59 
60  uint16_t data_offset; /**< Offset to the packet data. */
61  uint16_t data_len; /**< Length of data. */
62 
63  uint16_t ltrim; /**< Number of leading bytes to trim when
64  * re-assembling the packet. */
65 
66  uint8_t *pkt; /**< The actual packet. */
67 
68 #ifdef DEBUG
69  uint64_t pcap_cnt; /**< pcap_cnt of original packet */
70 #endif
71 
72  RB_ENTRY(Frag_) rb;
73 } Frag;
74 
75 int DefragRbFragCompare(struct Frag_ *a, struct Frag_ *b);
76 
77 RB_HEAD(IP_FRAGMENTS, Frag_);
78 RB_PROTOTYPE(IP_FRAGMENTS, Frag_, rb, DefragRbFragCompare);
79 
80 /**
81  * A defragmentation tracker. Used to track fragments that make up a
82  * single packet.
83  */
84 typedef struct DefragTracker_ {
85  SCMutex lock; /**< Mutex for locking list operations on
86  * this tracker. */
87 
88  uint16_t vlan_id[2]; /**< VLAN ID tracker applies to. */
89 
90  uint32_t id; /**< IP ID for this tracker. 32 bits for IPv6, 16
91  * for IPv4. */
92 
93  uint8_t proto; /**< IP protocol for this tracker. */
94 
95  uint8_t policy; /**< Reassembly policy this tracker will use. */
96 
97  uint8_t af; /**< Address family for this tracker, AF_INET or
98  * AF_INET6. */
99 
100  uint8_t seen_last; /**< Has this tracker seen the last fragment? */
101 
102  uint8_t remove; /**< remove */
103 
104  Address src_addr; /**< Source address for this tracker. */
105  Address dst_addr; /**< Destination address for this tracker. */
106 
107  struct timeval timeout; /**< When this tracker will timeout. */
108  uint32_t host_timeout; /**< Host timeout, statically assigned from the yaml */
109 
110  /** use cnt, reference counter */
111  SC_ATOMIC_DECLARE(unsigned int, use_cnt);
112 
113  struct IP_FRAGMENTS fragment_tree;
114 
115  /** hash pointers, protected by hash row mutex/spin */
116  struct DefragTracker_ *hnext;
117  struct DefragTracker_ *hprev;
118 
119  /** list pointers, protected by tracker-queue mutex/spin */
120  struct DefragTracker_ *lnext;
121  struct DefragTracker_ *lprev;
122 } DefragTracker;
123 
124 void DefragInit(void);
125 void DefragDestroy(void);
126 void DefragReload(void); /**< use only in unittests */
127 
128 uint8_t DefragGetOsPolicy(Packet *);
131 void DefragRegisterTests(void);
132 
133 #endif /* __DEFRAG_H__ */
void DefragRegisterTests(void)
Definition: defrag.c:2461
#define SC_ATOMIC_DECLARE(type, name)
wrapper to declare an atomic variable including a (spin) lock to protect it.
Definition: util-atomic.h:57
struct DefragTracker_ DefragTracker
uint8_t af
Definition: defrag.h:97
struct DefragTracker_ * lnext
Definition: defrag.h:120
Address src_addr
Definition: defrag.h:104
struct DefragTracker_ * hprev
Definition: defrag.h:117
void DefragInit(void)
Definition: defrag.c:1045
void DefragDestroy(void)
Definition: defrag.c:1067
struct DefragContext_ DefragContext
SCMutex lock
Definition: defrag.h:85
uint8_t * pkt
Definition: defrag.h:66
RB_HEAD(IP_FRAGMENTS, Frag_)
uint16_t data_offset
Definition: defrag.h:60
Address dst_addr
Definition: defrag.h:105
uint8_t seen_last
Definition: defrag.h:100
#define RB_ENTRY(type)
Definition: tree.h:316
Packet * Defrag(ThreadVars *, DecodeThreadVars *, Packet *, PacketQueue *)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:999
Structure to hold thread specific data for all decode modules.
Definition: decode.h:642
uint16_t offset
Definition: defrag.h:45
int DefragRbFragCompare(struct Frag_ *a, struct Frag_ *b)
Definition: defrag.c:499
time_t timeout
Definition: defrag.h:38
void DefragTrackerFreeFrags(DefragTracker *)
Free all frags associated with a tracker.
Definition: defrag.c:152
uint16_t frag_hdr_offset
Definition: defrag.h:57
uint32_t host_timeout
Definition: defrag.h:108
SCMutex frag_pool_lock
Definition: defrag.h:36
RB_PROTOTYPE(IP_FRAGMENTS, Frag_, rb, DefragRbFragCompare)
uint8_t proto
Definition: defrag.h:93
uint8_t DefragGetOsPolicy(Packet *)
Get the defrag policy based on the destination address of the packet.
Definition: defrag.c:920
#define SCMutex
uint16_t data_len
Definition: defrag.h:61
uint8_t policy
Definition: defrag.h:95
Definition: defrag.h:44
struct DefragTracker_ * hnext
Definition: defrag.h:116
void DefragReload(void)
uint16_t ltrim
Definition: defrag.h:63
uint16_t len
Definition: defrag.h:48
uint32_t id
Definition: defrag.h:90
Per thread variable structure.
Definition: threadvars.h:57
struct DefragTracker_ * lprev
Definition: defrag.h:121
uint8_t hlen
Definition: defrag.h:50
uint16_t ip_hdr_offset
Definition: defrag.h:55
Pool * frag_pool
Definition: defrag.h:35