/src/suricata7/src/pkt-var.c
Line | Count | Source |
1 | | /* Copyright (C) 2007-2016 Open Information Security Foundation |
2 | | * |
3 | | * You can copy, redistribute or modify this Program under the terms of |
4 | | * the GNU General Public License version 2 as published by the Free |
5 | | * Software Foundation. |
6 | | * |
7 | | * This program is distributed in the hope that it will be useful, |
8 | | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
9 | | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
10 | | * GNU General Public License for more details. |
11 | | * |
12 | | * You should have received a copy of the GNU General Public License |
13 | | * version 2 along with this program; if not, write to the Free Software |
14 | | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA |
15 | | * 02110-1301, USA. |
16 | | */ |
17 | | |
18 | | /** |
19 | | * \file |
20 | | * |
21 | | * \author Victor Julien <victor@inliniac.net> |
22 | | * |
23 | | * Implements per packet vars |
24 | | * |
25 | | * \todo move away from a linked list implementation |
26 | | * \todo use different datatypes, such as string, int, etc. |
27 | | * \todo have more than one instance of the same var, and be able to match on a |
28 | | * specific one, or one all at a time. So if a certain capture matches |
29 | | * multiple times, we can operate on all of them. |
30 | | */ |
31 | | |
32 | | #include "suricata-common.h" |
33 | | #include "decode.h" |
34 | | #include "pkt-var.h" |
35 | | #include "util-debug.h" |
36 | | |
37 | | /* get the pktvar with name 'name' from the pkt |
38 | | * |
39 | | * name is a normal string*/ |
40 | | PktVar *PktVarGet(Packet *p, uint32_t id) |
41 | 417 | { |
42 | 417 | PktVar *pv = p->pktvar; |
43 | | |
44 | 417 | for (;pv != NULL; pv = pv->next) { |
45 | 0 | if (pv->id == id) |
46 | 0 | return pv; |
47 | 0 | } |
48 | | |
49 | 417 | return NULL; |
50 | 417 | } |
51 | | |
52 | | /** |
53 | | * \brief add a key-value pktvar to the pkt |
54 | | * \retval r 0 ok, -1 error |
55 | | */ |
56 | | int PktVarAddKeyValue(Packet *p, uint8_t *key, uint16_t ksize, uint8_t *value, uint16_t size) |
57 | 0 | { |
58 | 0 | PktVar *pv = SCCalloc(1, sizeof(PktVar)); |
59 | 0 | if (unlikely(pv == NULL)) |
60 | 0 | return -1; |
61 | | |
62 | 0 | pv->key = key; |
63 | 0 | pv->key_len = ksize; |
64 | 0 | pv->value = value; |
65 | 0 | pv->value_len = size; |
66 | |
|
67 | 0 | PktVar *tpv = p->pktvar; |
68 | 0 | if (p->pktvar == NULL) |
69 | 0 | p->pktvar = pv; |
70 | 0 | else { |
71 | 0 | while(tpv) { |
72 | 0 | if (tpv->next == NULL) { |
73 | 0 | tpv->next = pv; |
74 | 0 | return 0; |
75 | 0 | } |
76 | 0 | tpv = tpv->next; |
77 | 0 | } |
78 | 0 | } |
79 | 0 | return 0; |
80 | 0 | } |
81 | | |
82 | | /** |
83 | | * \brief add a key-value pktvar to the pkt |
84 | | * \retval r 0 ok, -1 error |
85 | | */ |
86 | | int PktVarAdd(Packet *p, uint32_t id, uint8_t *value, uint16_t size) |
87 | 16 | { |
88 | 16 | PktVar *pv = SCCalloc(1, sizeof(PktVar)); |
89 | 16 | if (unlikely(pv == NULL)) |
90 | 0 | return -1; |
91 | | |
92 | 16 | pv->id = id; |
93 | 16 | pv->value = value; |
94 | 16 | pv->value_len = size; |
95 | | |
96 | 16 | PktVar *tpv = p->pktvar; |
97 | 16 | if (p->pktvar == NULL) |
98 | 8 | p->pktvar = pv; |
99 | 8 | else { |
100 | 8 | while(tpv) { |
101 | 8 | if (tpv->next == NULL) { |
102 | 8 | tpv->next = pv; |
103 | 8 | return 0; |
104 | 8 | } |
105 | 0 | tpv = tpv->next; |
106 | 0 | } |
107 | 8 | } |
108 | 8 | return 0; |
109 | 16 | } |
110 | | |
111 | | void PktVarFree(PktVar *pv) |
112 | 16 | { |
113 | 16 | if (pv == NULL) |
114 | 0 | return; |
115 | | |
116 | 16 | if (pv->key != NULL) |
117 | 0 | SCFree(pv->key); |
118 | 16 | if (pv->value != NULL) |
119 | 16 | SCFree(pv->value); |
120 | 16 | PktVar *pv_next = pv->next; |
121 | | |
122 | 16 | SCFree(pv); |
123 | | |
124 | 16 | if (pv_next != NULL) |
125 | 8 | PktVarFree(pv_next); |
126 | 16 | } |