suricata
pkt-var.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2016 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * Implements per packet vars
24  *
25  * \todo move away from a linked list implementation
26  * \todo use different datatypes, such as string, int, etc.
27  * \todo have more than one instance of the same var, and be able to match on a
28  * specific one, or one all at a time. So if a certain capture matches
29  * multiple times, we can operate on all of them.
30  */
31 
32 #include "suricata-common.h"
33 #include "decode.h"
34 #include "pkt-var.h"
35 #include "util-debug.h"
36 
37 /* get the pktvar with name 'name' from the pkt
38  *
39  * name is a normal string*/
40 PktVar *PktVarGet(Packet *p, uint32_t id)
41 {
42  PktVar *pv = p->pktvar;
43 
44  for (;pv != NULL; pv = pv->next) {
45  if (pv->id == id)
46  return pv;
47  }
48 
49  return NULL;
50 }
51 
52 /**
53  * \brief add a key-value pktvar to the pkt
54  * \retval r 0 ok, -1 error
55  */
56 int PktVarAddKeyValue(Packet *p, uint8_t *key, uint16_t ksize, uint8_t *value, uint16_t size)
57 {
58  PktVar *pv = SCCalloc(1, sizeof(PktVar));
59  if (unlikely(pv == NULL))
60  return -1;
61 
62  pv->key = key;
63  pv->key_len = ksize;
64  pv->value = value;
65  pv->value_len = size;
66 
67  PktVar *tpv = p->pktvar;
68  if (p->pktvar == NULL)
69  p->pktvar = pv;
70  else {
71  while(tpv) {
72  if (tpv->next == NULL) {
73  tpv->next = pv;
74  return 0;
75  }
76  tpv = tpv->next;
77  }
78  }
79  return 0;
80 }
81 
82 /**
83  * \brief add a key-value pktvar to the pkt
84  * \retval r 0 ok, -1 error
85  */
86 int PktVarAdd(Packet *p, uint32_t id, uint8_t *value, uint16_t size)
87 {
88  PktVar *pv = SCCalloc(1, sizeof(PktVar));
89  if (unlikely(pv == NULL))
90  return -1;
91 
92  pv->id = id;
93  pv->value = value;
94  pv->value_len = size;
95 
96  PktVar *tpv = p->pktvar;
97  if (p->pktvar == NULL)
98  p->pktvar = pv;
99  else {
100  while(tpv) {
101  if (tpv->next == NULL) {
102  tpv->next = pv;
103  return 0;
104  }
105  tpv = tpv->next;
106  }
107  }
108  return 0;
109 }
110 
112 {
113  if (pv == NULL)
114  return;
115 
116  if (pv->key != NULL)
117  SCFree(pv->key);
118  if (pv->value != NULL)
119  SCFree(pv->value);
120  PktVar *pv_next = pv->next;
121 
122  SCFree(pv);
123 
124  if (pv_next != NULL)
125  PktVarFree(pv_next);
126 }
struct PktVar_ * next
Definition: decode.h:313
#define unlikely(expr)
Definition: util-optimize.h:35
uint16_t key_len
Definition: decode.h:316
PktVar * pktvar
Definition: decode.h:491
#define SCCalloc(nm, a)
Definition: util-mem.h:253
uint16_t value_len
Definition: decode.h:317
int PktVarAdd(Packet *p, uint32_t id, uint8_t *value, uint16_t size)
add a key-value pktvar to the pkt
Definition: pkt-var.c:86
uint32_t id
Definition: decode.h:312
void PktVarFree(PktVar *pv)
Definition: pkt-var.c:111
#define SCFree(a)
Definition: util-mem.h:322
uint8_t * key
Definition: decode.h:318
uint8_t * value
Definition: decode.h:319
int PktVarAddKeyValue(Packet *p, uint8_t *key, uint16_t ksize, uint8_t *value, uint16_t size)
add a key-value pktvar to the pkt
Definition: pkt-var.c:56
PktVar * PktVarGet(Packet *p, uint32_t id)
Definition: pkt-var.c:40