suricata
defrag.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Endace Technology Limited, Jason Ish <jason.ish@endace.com>
22  */
23 
24 #ifndef SURICATA_DEFRAG_H
25 #define SURICATA_DEFRAG_H
26 
27 #include "threads.h"
28 #include "util-pool.h"
29 #include "threadvars.h"
30 #include "decode.h"
31 
32 /**
33  * A context for an instance of a fragmentation re-assembler, in case
34  * we ever need more than one.
35  */
36 typedef struct DefragContext_ {
37  Pool *frag_pool; /**< Pool of fragments. */
39 
40  time_t timeout; /**< Default timeout. */
42 
43 /**
44  * Storage for an individual fragment.
45  */
46 typedef struct Frag_ {
47  uint16_t offset; /**< The offset of this fragment, already
48  * multiplied by 8. */
49 
50  uint32_t len; /**< The length of this fragment. */
51 
52  uint8_t hlen; /**< The length of this fragments IP header. */
53 
54  uint8_t more_frags:4; /**< More frags? */
55  uint8_t skip:4; /**< Skip this fragment during re-assembly. */
56 
57  uint16_t ip_hdr_offset; /**< Offset in the packet where the IP
58  * header starts. */
59  uint16_t frag_hdr_offset; /**< Offset in the packet where the frag
60  * header starts. */
61 
62  uint16_t data_offset; /**< Offset to the packet data. */
63  uint16_t data_len; /**< Length of data. */
64 
65  uint16_t ltrim; /**< Number of leading bytes to trim when
66  * re-assembling the packet. */
67 
68  uint8_t *pkt; /**< The actual packet. */
69 
70 #ifdef DEBUG
71  uint64_t pcap_cnt; /**< pcap_cnt of original packet */
72 #endif
73 
75 } Frag;
76 
77 int DefragRbFragCompare(struct Frag_ *a, struct Frag_ *b);
78 
79 RB_HEAD(IP_FRAGMENTS, Frag_);
81 
82 /**
83  * A defragmentation tracker. Used to track fragments that make up a
84  * single packet.
85  */
86 typedef struct DefragTracker_ {
87  SCMutex lock; /**< Mutex for locking list operations on
88  * this tracker. */
89 
90  uint16_t vlan_id[VLAN_MAX_LAYERS]; /**< VLAN ID tracker applies to. */
91 
92  uint32_t id; /**< IP ID for this tracker. 32 bits for IPv6, 16
93  * for IPv4. */
94 
95  uint8_t proto; /**< IP protocol for this tracker. */
96 
97  uint8_t policy; /**< Reassembly policy this tracker will use. */
98 
99  uint8_t af; /**< Address family for this tracker, AF_INET or
100  * AF_INET6. */
101 
102  uint8_t seen_last; /**< Has this tracker seen the last fragment? */
103 
104  uint8_t remove; /**< remove */
105 
106  Address src_addr; /**< Source address for this tracker. */
107  Address dst_addr; /**< Destination address for this tracker. */
108 
109  SCTime_t timeout; /**< When this tracker will timeout. */
110  uint32_t host_timeout; /**< Host timeout, statically assigned from the yaml */
111 
112  /** use cnt, reference counter */
113  SC_ATOMIC_DECLARE(unsigned int, use_cnt);
114 
115  struct IP_FRAGMENTS fragment_tree;
116 
117  /** hash pointers, protected by hash row mutex/spin */
120 
121  /** list pointers, protected by tracker-queue mutex/spin */
125 
126 void DefragInit(void);
127 void DefragDestroy(void);
128 
129 uint8_t DefragGetOsPolicy(Packet *);
132 void DefragRegisterTests(void);
133 
134 #endif /* SURICATA_DEFRAG_H */
Frag_
Definition: defrag.h:46
DefragGetOsPolicy
uint8_t DefragGetOsPolicy(Packet *)
Get the defrag policy based on the destination address of the packet.
Definition: defrag.c:923
Defrag
Packet * Defrag(ThreadVars *, DecodeThreadVars *, Packet *)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:1002
DefragTracker_::hnext
struct DefragTracker_ * hnext
Definition: defrag.h:118
RB_PROTOTYPE
RB_PROTOTYPE(IP_FRAGMENTS, Frag_, rb, DefragRbFragCompare)
threads.h
DefragTrackerFreeFrags
void DefragTrackerFreeFrags(DefragTracker *)
Free all frags associated with a tracker.
Definition: defrag.c:153
Frag_::data_len
uint16_t data_len
Definition: defrag.h:63
DefragContext_::timeout
time_t timeout
Definition: defrag.h:40
DefragContext_::frag_pool
Pool * frag_pool
Definition: defrag.h:37
DefragTracker_::host_timeout
uint32_t host_timeout
Definition: defrag.h:110
Address_
Definition: decode.h:115
Pool_
Definition: util-pool.h:43
DefragTracker_::SC_ATOMIC_DECLARE
SC_ATOMIC_DECLARE(unsigned int, use_cnt)
DefragTracker_::hprev
struct DefragTracker_ * hprev
Definition: defrag.h:119
DefragTracker_::lock
SCMutex lock
Definition: defrag.h:87
DefragContext_::frag_pool_lock
SCMutex frag_pool_lock
Definition: defrag.h:38
DefragTracker_::remove
uint8_t remove
Definition: defrag.h:104
decode.h
DefragRegisterTests
void DefragRegisterTests(void)
Definition: defrag.c:2509
DefragTracker_::seen_last
uint8_t seen_last
Definition: defrag.h:102
DefragTracker_::policy
uint8_t policy
Definition: defrag.h:97
DefragTracker_
Definition: defrag.h:86
DefragTracker_::vlan_id
uint16_t vlan_id[VLAN_MAX_LAYERS]
Definition: defrag.h:90
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
DefragTracker_::dst_addr
Address dst_addr
Definition: defrag.h:107
Packet_
Definition: decode.h:436
DefragTracker_::id
uint32_t id
Definition: defrag.h:92
DefragTracker_::src_addr
Address src_addr
Definition: defrag.h:106
Frag_::skip
uint8_t skip
Definition: defrag.h:55
SCTime_t
Definition: util-time.h:40
Frag_::pkt
uint8_t * pkt
Definition: defrag.h:68
DefragInit
void DefragInit(void)
Definition: defrag.c:1052
Frag_::data_offset
uint16_t data_offset
Definition: defrag.h:62
DefragTracker_::proto
uint8_t proto
Definition: defrag.h:95
DefragContext_
Definition: defrag.h:36
DefragContext
struct DefragContext_ DefragContext
Frag_::ltrim
uint16_t ltrim
Definition: defrag.h:65
Frag_::RB_ENTRY
RB_ENTRY(Frag_) rb
DefragTracker_::fragment_tree
struct IP_FRAGMENTS fragment_tree
Definition: defrag.h:115
Frag_::len
uint32_t len
Definition: defrag.h:50
DefragTracker_::timeout
SCTime_t timeout
Definition: defrag.h:109
VLAN_MAX_LAYERS
#define VLAN_MAX_LAYERS
Definition: decode-vlan.h:51
Frag_::frag_hdr_offset
uint16_t frag_hdr_offset
Definition: defrag.h:59
threadvars.h
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:685
Frag_::more_frags
uint8_t more_frags
Definition: defrag.h:54
DefragTracker_::af
uint8_t af
Definition: defrag.h:99
DefragTracker_::lnext
struct DefragTracker_ * lnext
Definition: defrag.h:122
Frag
struct Frag_ Frag
DefragTracker_::lprev
struct DefragTracker_ * lprev
Definition: defrag.h:123
Frag_::hlen
uint8_t hlen
Definition: defrag.h:52
DefragRbFragCompare
int DefragRbFragCompare(struct Frag_ *a, struct Frag_ *b)
Definition: defrag.c:521
DefragTracker
struct DefragTracker_ DefragTracker
util-pool.h
SCMutex
#define SCMutex
Definition: threads-debug.h:114
Frag_::offset
uint16_t offset
Definition: defrag.h:47
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1072
Frag_::ip_hdr_offset
uint16_t ip_hdr_offset
Definition: defrag.h:57
RB_HEAD
RB_HEAD(IP_FRAGMENTS, Frag_)