plugins/epan/mate/mate.h

   1 /* mate.h
   2  * MATE -- Meta Analysis and Tracing Engine
   3  *
   4  * Copyright 2004, Luis E. Garcia Ontanon <luis@ontanon.org>
   5  *
   6  * Wireshark - Network traffic analyzer
   7  * By Gerald Combs <gerald@wireshark.org>
   8  * Copyright 1998 Gerald Combs
   9  *
  10  * SPDX-License-Identifier: GPL-2.0-or-later
  11  */
  12
  13
  14 #ifndef __MATE_H_
  15 #define __MATE_H_
  16
  17 #define WS_LOG_DOMAIN "MATE"
  18 #include <wireshark.h>
  19
  20 #include <gmodule.h>
  21
  22 #include <stdio.h>
  23 #include <string.h>
  24
  25 #include <wsutil/report_message.h>
  26 #include <wsutil/wslog.h>
  27
  28 #include <epan/packet.h>
  29 #include <epan/exceptions.h>
  30 #include <epan/strutil.h>
  31 #include <epan/prefs.h>
  32 #include <epan/proto.h>
  33 #include <epan/epan_dissect.h>
  34 #include <wsutil/filesystem.h>
  35
  36 #include "mate_util.h"
  37
  38 /* defaults */
  39
  40 #define DEFAULT_GOG_EXPIRATION 2.0
  41
  42 #ifdef _WIN32
  43 #define DIR_SEP '\\'
  44 #else
  45 #define DIR_SEP '/'
  46 #endif
  47
  48 #define DEFAULT_MATE_LIB_PATH "matelib"
  49
  50 #define MATE_ITEM_ID_SIZE 24
  51
  52 #define VALUE_TOO ((void*)1)
  53
  54 #define MateConfigError 65535
  55
  56 typedef enum _gop_tree_mode_t {
  57         GOP_NULL_TREE,
  58         GOP_BASIC_TREE,
  59         GOP_FULL_TREE
  60 } gop_tree_mode_t;
  61
  62 typedef enum _gop_pdu_tree {
  63         GOP_NO_TREE,
  64         GOP_PDU_TREE,
  65         GOP_FRAME_TREE,
  66         GOP_BASIC_PDU_TREE
  67 } gop_pdu_tree_t;
  68
  69 typedef enum _accept_mode_t {
  70         ACCEPT_MODE,
  71         REJECT_MODE
  72 } accept_mode_t;
  73
  74
  75 typedef struct _mate_cfg_pdu {
  76         char* name;
  77         unsigned last_id; /* keeps the last id given to an item of this kind */
  78
  79         GHashTable* items; /* all the items of this type */
  80         GPtrArray* transforms; /* transformations to be applied */
  81
  82         int hfid;
  83
  84         int hfid_proto;
  85         int hfid_pdu_rel_time;
  86         int hfid_pdu_time_in_gop;
  87
  88         GHashTable* my_hfids; /* for creating register info */
  89
  90         int ett;
  91         int ett_attr;
  92
  93         GHashTable* hfids_attr; /* k=hfid v=avp_name */
  94
  95         bool discard;
  96         bool last_extracted;
  97         bool drop_unassigned;
  98
  99         GPtrArray* transport_ranges; /* hfids of candidate transport ranges from which to extract attributes */
 100         GPtrArray* payload_ranges; /* hfids of candidate payload ranges from which to extract attributes */
 101
 102         avpl_match_mode criterium_match_mode;
 103         accept_mode_t criterium_accept_mode;
 104         AVPL* criterium;
 105 } mate_cfg_pdu;
 106
 107
 108 typedef struct _mate_cfg_gop {
 109         char* name;
 110         unsigned last_id; /* keeps the last id given to an item of this kind */
 111         GHashTable* items; /* all the items of this type */
 112
 113         GPtrArray* transforms; /* transformations to be applied */
 114         char* on_pdu;
 115
 116         AVPL* key; /* key candidate avpl */
 117         AVPL* start; /* start candidate avpl */
 118         AVPL* stop;  /* stop candidate avpl */
 119         AVPL* extra; /* attributes to be added */
 120
 121         double expiration;
 122         double idle_timeout;
 123         double lifetime;
 124
 125         bool drop_unassigned;
 126         gop_pdu_tree_t pdu_tree_mode;
 127         bool show_times;
 128
 129         GHashTable* my_hfids; /* for creating register info */
 130         int hfid;
 131         int hfid_start_time;
 132         int hfid_stop_time;
 133         int hfid_last_time;
 134         int hfid_gop_pdu;
 135         int hfid_gop_num_pdus;
 136
 137         int ett;
 138         int ett_attr;
 139         int ett_times;
 140         int ett_children;
 141
 142         GHashTable* gop_index;
 143         GHashTable* gog_index;
 144 } mate_cfg_gop;
 145
 146
 147 typedef struct _mate_cfg_gog {
 148         char* name;
 149
 150         GHashTable* items; /* all the items of this type */
 151         unsigned last_id; /* keeps the last id given to an item of this kind */
 152
 153         GPtrArray* transforms; /* transformations to be applied */
 154
 155         LoAL* keys;
 156         AVPL* extra; /* attributes to be added */
 157
 158         double expiration;
 159         gop_tree_mode_t gop_tree_mode;
 160         bool show_times;
 161
 162         GHashTable* my_hfids; /* for creating register info */
 163         int hfid;
 164         int hfid_gog_num_of_gops;
 165         int hfid_gog_gop;
 166         int hfid_gog_gopstart;
 167         int hfid_gog_gopstop;
 168         int hfid_start_time;
 169         int hfid_stop_time;
 170         int hfid_last_time;
 171         int ett;
 172         int ett_attr;
 173         int ett_times;
 174         int ett_children;
 175         int ett_gog_gop;
 176 } mate_cfg_gog;
 177
 178 typedef struct _mate_config {
 179         char* mate_config_file; /* name of the config file */
 180
 181         int hfid_mate;
 182
 183         GArray *wanted_hfids;    /* hfids of protocols and fields MATE needs */
 184         unsigned num_fields_wanted; /* number of fields MATE will look at */
 185
 186         FILE* dbg_facility; /* where to dump dbgprint output ws_message if null */
 187
 188         char* mate_lib_path; /* where to look for "Include" files first */
 189
 190         GHashTable* pducfgs; /* k=pducfg->name v=pducfg */
 191         GHashTable* gopcfgs; /* k=gopcfg->name v=gopcfg */
 192         GHashTable* gogcfgs; /* k=gogcfg->name v=gogcfg */
 193         GHashTable* transfs; /* k=transform->name v=transform */
 194
 195         GPtrArray* pducfglist; /* pducfgs in order of "execution" */
 196         GHashTable* gops_by_pduname; /* k=pducfg->name v=gopcfg */
 197         GHashTable* gogs_by_gopname; /* k=gopname v=loal where avpl->name == matchedgop->name */
 198
 199         GArray* hfrs;
 200         int ett_root;
 201         GArray* ett;
 202
 203         /* defaults */
 204         struct _mate_cfg_defaults {
 205                 struct _pdu_defaults {
 206                         avpl_match_mode match_mode;
 207                         avpl_replace_mode replace_mode;
 208                         bool last_extracted;
 209
 210                         bool drop_unassigned;
 211                         bool discard;
 212                 } pdu;
 213
 214                 struct _gop_defaults {
 215                         double expiration;
 216                         double idle_timeout;
 217                         double lifetime;
 218
 219                         gop_pdu_tree_t pdu_tree_mode;
 220                         bool show_times;
 221                         bool drop_unassigned;
 222
 223                 } gop;
 224
 225                 struct _gog_defaults {
 226                         double expiration;
 227                         bool show_times;
 228                         gop_tree_mode_t gop_tree_mode;
 229                 } gog;
 230         } defaults;
 231
 232         /* what to dbgprint */
 233         int dbg_lvl;
 234         int dbg_pdu_lvl;
 235         int dbg_gop_lvl;
 236         int dbg_gog_lvl;
 237
 238         GPtrArray* config_stack;
 239         GString* config_error;
 240
 241 } mate_config;
 242
 243
 244 typedef struct _mate_config_frame {
 245         char* filename;
 246         unsigned  linenum;
 247 } mate_config_frame;
 248
 249
 250 typedef struct _mate_runtime_data {
 251         unsigned current_items; /* a count of items */
 252         double now;
 253         unsigned highest_analyzed_frame;
 254
 255         GHashTable* frames; /* k=frame.num v=pdus */
 256
 257 } mate_runtime_data;
 258
 259 typedef struct _mate_pdu mate_pdu;
 260 typedef struct _mate_gop mate_gop;
 261 typedef struct _mate_gog mate_gog;
 262
 263 /* these are used to contain information regarding pdus, gops and gogs */
 264 struct _mate_pdu {
 265         uint32_t id; /* 1:1 -> saving a g_malloc */
 266         mate_cfg_pdu* cfg; /* the type of this item */
 267
 268         AVPL* avpl;
 269
 270         uint32_t frame; /* which frame I belong to? */
 271         mate_pdu* next_in_frame; /* points to the next pdu in this frame */
 272         double rel_time; /* time since start of capture  */
 273
 274         mate_gop* gop; /* the gop the pdu belongs to (if any) */
 275         mate_pdu* next; /* next in gop */
 276         double time_in_gop; /* time since gop start */
 277
 278         bool first; /* is this the first pdu in this frame? */
 279         bool is_start; /* this is the start pdu for this gop */
 280         bool is_stop; /* this is the stop pdu for this gop */
 281         bool after_release; /* this pdu comes after the stop */
 282
 283 };
 284
 285
 286 struct _mate_gop {
 287         uint32_t id;
 288         mate_cfg_gop* cfg;
 289
 290         char* gop_key;
 291         AVPL* avpl; /* the attributes of the pdu/gop/gog */
 292         unsigned last_n;
 293
 294         mate_gog* gog; /* the gog of a gop */
 295         mate_gop* next; /* next in gog; */
 296
 297         double expiration; /* when will it expire after release (all gops releases if gog)? */
 298         double idle_expiration; /* when will it expire if no new pdus are assigned to it */
 299         double time_to_die;
 300         double time_to_timeout;
 301
 302         double start_time; /* time of start */
 303         double release_time; /* when this gop/gog was released */
 304         double last_time; /* the rel_time at which the last pdu has been added (to gop or gog's gop) */
 305
 306
 307         int num_of_pdus; /* how many gops a gog has? */
 308         int num_of_after_release_pdus;  /* how many pdus have arrived since it's been released */
 309         mate_pdu* pdus; /* pdus that belong to a gop (NULL in gog) */
 310         mate_pdu* last_pdu; /* last pdu in pdu's list */
 311
 312         bool released; /* has this gop been released? */
 313 };
 314
 315
 316 struct _mate_gog {
 317         uint32_t id;
 318         mate_cfg_gog* cfg;
 319
 320         AVPL* avpl; /* the attributes of the pdu/gop/gog */
 321         unsigned last_n; /* the number of attributes the avpl had the last time we checked */
 322
 323         bool released; /* has this gop been released? */
 324
 325         double expiration; /* when will it expire after release (all gops releases if gog)? */
 326         double idle_expiration; /* when will it expire if no new pdus are assigned to it */
 327
 328         /* on gop and gog: */
 329         double start_time; /* time of start */
 330         double release_time; /* when this gog was released */
 331         double last_time; /* the rel_time at which the last pdu has been added */
 332
 333         mate_gop* gops; /* gops that belong to a gog (NULL in gop) */
 334         mate_gop* last_gop; /* last gop in gop's list */
 335
 336         int num_of_gops; /* how many gops a gog has? */
 337         int num_of_counting_gops;  /* how many of them count for gog release */
 338         int num_of_released_gops;  /* how many of them have already been released */
 339         GPtrArray* gog_keys; /* the keys under which this gog is stored in the gogs hash */
 340 };
 341
 342 typedef union _mate_max_size {
 343         mate_pdu pdu;
 344         mate_gop gop;
 345         mate_gog gog;
 346 } mate_max_size;
 347
 348 /* from mate_runtime.c */
 349 extern void initialize_mate_runtime(mate_config* mc);
 350 extern mate_pdu* mate_get_pdus(uint32_t framenum);
 351 extern void mate_analyze_frame(mate_config *mc, packet_info *pinfo, proto_tree* tree);
 352
 353 /* from mate_setup.c */
 354 extern mate_config* mate_make_config(const char* filename, int mate_hfid);
 355
 356 extern mate_cfg_pdu* new_pducfg(mate_config* mc, char* name);
 357 extern mate_cfg_gop* new_gopcfg(mate_config* mc, char* name);
 358 extern mate_cfg_gog* new_gogcfg(mate_config* mc, char* name);
 359
 360 extern bool add_hfid(mate_config* mc, header_field_info*  hfi, char* as, GHashTable* where);
 361 extern char* add_ranges(char* range, GPtrArray* range_ptr_arr);
 362
 363
 364 /* from mate_parser.l */
 365 extern bool mate_load_config(const char* filename, mate_config* mc);
 366
 367 /* Constructor/Destructor prototypes for Lemon Parser */
 368 #define YYMALLOCARGTYPE size_t
 369 void *MateParserAlloc(void* (*)(YYMALLOCARGTYPE));
 370 void MateParserFree(void*, void (*)(void *));
 371 void MateParser(void*, int, char*,  mate_config*);
 372
 373 #endif