suricata
flow-util.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Flow utility functions
24  */
25 
26 #include "suricata-common.h"
27 #include "threads.h"
28 
29 #include "flow.h"
30 #include "flow-private.h"
31 #include "flow-util.h"
32 #include "flow-var.h"
33 #include "app-layer.h"
34 
35 #include "util-var.h"
36 #include "util-debug.h"
37 #include "flow-storage.h"
38 
39 #include "detect.h"
40 #include "detect-engine-state.h"
41 
42 #include "decode-icmpv4.h"
43 
44 /** \brief allocate a flow
45  *
46  * We check against the memuse counter. If it passes that check we increment
47  * the counter first, then we try to alloc.
48  *
49  * \retval f the flow or NULL on out of memory
50  */
52 {
53  Flow *f;
54  size_t size = sizeof(Flow) + FlowStorageSize();
55 
56  if (!(FLOW_CHECK_MEMCAP(size))) {
57  return NULL;
58  }
59 
60  (void) SC_ATOMIC_ADD(flow_memuse, size);
61 
62  f = SCMalloc(size);
63  if (unlikely(f == NULL)) {
64  (void)SC_ATOMIC_SUB(flow_memuse, size);
65  return NULL;
66  }
67  memset(f, 0, size);
68 
69  /* coverity[missing_lock] */
70  FLOW_INITIALIZE(f);
71  return f;
72 }
73 
74 
75 /**
76  * \brief cleanup & free the memory of a flow
77  *
78  * \param f flow to clear & destroy
79  */
80 void FlowFree(Flow *f)
81 {
82  FLOW_DESTROY(f);
83  SCFree(f);
84 
85  size_t size = sizeof(Flow) + FlowStorageSize();
86  (void) SC_ATOMIC_SUB(flow_memuse, size);
87 }
88 
89 /**
90  * \brief Function to map the protocol to the defined FLOW_PROTO_* enumeration.
91  *
92  * \param proto protocol which is needed to be mapped
93  */
94 
95 uint8_t FlowGetProtoMapping(uint8_t proto)
96 {
97  switch (proto) {
98  case IPPROTO_TCP:
99  return FLOW_PROTO_TCP;
100  case IPPROTO_UDP:
101  return FLOW_PROTO_UDP;
102  case IPPROTO_ICMP:
103  return FLOW_PROTO_ICMP;
104  case IPPROTO_SCTP:
105  return FLOW_PROTO_SCTP;
106  default:
107  return FLOW_PROTO_DEFAULT;
108  }
109 }
110 
111 uint8_t FlowGetReverseProtoMapping(uint8_t rproto)
112 {
113  switch (rproto) {
114  case FLOW_PROTO_TCP:
115  return IPPROTO_TCP;
116  case FLOW_PROTO_UDP:
117  return IPPROTO_UDP;
118  case FLOW_PROTO_ICMP:
119  return IPPROTO_ICMP;
120  case FLOW_PROTO_SCTP:
121  return IPPROTO_SCTP;
122  default:
123  exit(EXIT_FAILURE);
124  }
125 }
126 
127 static inline void FlowSetICMPv4CounterPart(Flow *f)
128 {
129  int ctype = ICMPv4GetCounterpart(f->icmp_s.type);
130  if (ctype == -1)
131  return;
132 
133  f->icmp_d.type = (uint8_t)ctype;
134 }
135 
136 static inline void FlowSetICMPv6CounterPart(Flow *f)
137 {
138  int ctype = ICMPv6GetCounterpart(f->icmp_s.type);
139  if (ctype == -1)
140  return;
141 
142  f->icmp_d.type = (uint8_t)ctype;
143 }
144 
145 /* initialize the flow from the first packet
146  * we see from it. */
147 void FlowInit(Flow *f, const Packet *p)
148 {
149  SCEnter();
150  SCLogDebug("flow %p", f);
151 
152  f->proto = p->proto;
154  f->vlan_id[0] = p->vlan_id[0];
155  f->vlan_id[1] = p->vlan_id[1];
156 
157  if (PKT_IS_IPV4(p)) {
161  f->flags |= FLOW_IPV4;
162  } else if (PKT_IS_IPV6(p)) {
166  f->flags |= FLOW_IPV6;
167  }
168 #ifdef DEBUG
169  /* XXX handle default */
170  else {
171  printf("FIXME: %s:%s:%" PRId32 "\n", __FILE__, __FUNCTION__, __LINE__);
172  }
173 #endif
174 
175  if (p->tcph != NULL) { /* XXX MACRO */
176  SET_TCP_SRC_PORT(p,&f->sp);
177  SET_TCP_DST_PORT(p,&f->dp);
178  } else if (p->udph != NULL) { /* XXX MACRO */
179  SET_UDP_SRC_PORT(p,&f->sp);
180  SET_UDP_DST_PORT(p,&f->dp);
181  } else if (p->icmpv4h != NULL) {
182  f->icmp_s.type = p->icmp_s.type;
183  f->icmp_s.code = p->icmp_s.code;
184  FlowSetICMPv4CounterPart(f);
185  } else if (p->icmpv6h != NULL) {
186  f->icmp_s.type = p->icmp_s.type;
187  f->icmp_s.code = p->icmp_s.code;
188  FlowSetICMPv6CounterPart(f);
189  } else if (p->sctph != NULL) { /* XXX MACRO */
190  SET_SCTP_SRC_PORT(p,&f->sp);
191  SET_SCTP_DST_PORT(p,&f->dp);
192  } /* XXX handle default */
193 #ifdef DEBUG
194  else {
195  printf("FIXME: %s:%s:%" PRId32 "\n", __FILE__, __FUNCTION__, __LINE__);
196  }
197 #endif
198  COPY_TIMESTAMP(&p->ts, &f->startts);
199 
201 
202  SCReturn;
203 }
204 
#define FLOW_CHECK_MEMCAP(size)
check if a memory alloc would fit in the memcap
Definition: flow-util.h:131
UDPHdr * udph
Definition: decode.h:527
#define SCLogDebug(...)
Definition: util-debug.h:335
#define FLOW_IPV6
Definition: flow.h:95
#define SET_SCTP_DST_PORT(pkt, prt)
Definition: decode.h:205
uint8_t proto
Definition: flow.h:346
struct Flow_ Flow
Flow data structure.
Port sp
Definition: flow.h:333
#define unlikely(expr)
Definition: util-optimize.h:35
void FlowFree(Flow *f)
cleanup & free the memory of a flow
Definition: flow-util.c:80
int ICMPv6GetCounterpart(uint8_t type)
ICMPV4Hdr * icmpv4h
Definition: decode.h:531
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:89
#define SC_ATOMIC_ADD(name, val)
add a value to our atomic variable
Definition: util-atomic.h:108
uint8_t FlowGetProtoMapping(uint8_t proto)
Function to map the protocol to the defined FLOW_PROTO_* enumeration.
Definition: flow-util.c:95
#define PKT_IS_IPV6(p)
Definition: decode.h:251
uint8_t max_ttl_toserver
Definition: flow.h:428
#define FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, a)
Definition: flow.h:154
struct timeval startts
Definition: flow.h:456
#define SC_ATOMIC_SUB(name, val)
sub a value from our atomic variable
Definition: util-atomic.h:125
TCPHdr * tcph
Definition: decode.h:525
SCTPHdr * sctph
Definition: decode.h:529
#define SET_TCP_SRC_PORT(pkt, prt)
Definition: decode.h:182
#define PKT_IS_IPV4(p)
Definition: decode.h:250
#define SET_UDP_DST_PORT(pkt, prt)
Definition: decode.h:195
uint16_t vlan_id[2]
Definition: decode.h:434
FlowAddress dst
Definition: flow.h:331
struct Flow_::@124::@128 icmp_s
uint16_t vlan_id[2]
Definition: flow.h:348
#define COPY_TIMESTAMP(src, dst)
Definition: flow-util.h:30
#define FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, a)
Definition: flow.h:178
ICMPV6Hdr * icmpv6h
Definition: decode.h:533
uint8_t proto
Definition: decode.h:429
uint8_t recursion_level
Definition: decode.h:432
Data structures and function prototypes for keeping state for the detection engine.
uint8_t FlowGetReverseProtoMapping(uint8_t rproto)
Definition: flow-util.c:111
#define FLOW_DESTROY(f)
Definition: flow-util.h:115
#define SET_UDP_SRC_PORT(pkt, prt)
Definition: decode.h:192
#define SCEnter(...)
Definition: util-debug.h:337
struct Flow_::@126::@129 icmp_d
uint8_t proto
Flow * FlowAlloc(void)
allocate a flow
Definition: flow-util.c:51
uint8_t min_ttl_toserver
Definition: flow.h:427
int ICMPv4GetCounterpart(uint8_t type)
#define SCMalloc(a)
Definition: util-mem.h:174
#define FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, a)
Definition: flow.h:185
#define SCFree(a)
Definition: util-mem.h:236
Port dp
Definition: flow.h:340
unsigned int FlowStorageSize(void)
Definition: flow-storage.c:34
#define SET_SCTP_SRC_PORT(pkt, prt)
Definition: decode.h:201
#define FLOW_INITIALIZE(f)
Definition: flow-util.h:39
#define FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, a)
Definition: flow.h:161
uint8_t recursion_level
Definition: flow.h:347
FlowAddress src
Definition: flow.h:331
struct Packet_::@49::@58 icmp_s
#define SCReturn
Definition: util-debug.h:339
struct timeval ts
Definition: decode.h:450
void FlowInit(Flow *f, const Packet *p)
Definition: flow-util.c:147
uint8_t protomap
Definition: flow.h:402
Flow data structure.
Definition: flow.h:327
#define FLOW_IPV4
Definition: flow.h:93
uint32_t flags
Definition: flow.h:377
#define SET_TCP_DST_PORT(pkt, prt)
Definition: decode.h:186
#define IPV4_GET_IPTTL(p)
Definition: decode-ipv4.h:146