Wireshark  4.3.0
The Wireshark network protocol analyzer
mate.h
1 /* mate.h
2  * MATE -- Meta Analysis and Tracing Engine
3  *
4  * Copyright 2004, Luis E. Garcia Ontanon <luis@ontanon.org>
5  *
6  * Wireshark - Network traffic analyzer
7  * By Gerald Combs <gerald@wireshark.org>
8  * Copyright 1998 Gerald Combs
9  *
10  * SPDX-License-Identifier: GPL-2.0-or-later
11  */
12 
13 
14 #ifndef __MATE_H_
15 #define __MATE_H_
16 
17 #define WS_LOG_DOMAIN "MATE"
18 #include <wireshark.h>
19 
20 #include <gmodule.h>
21 
22 #include <stdio.h>
23 #include <string.h>
24 
25 #include <wsutil/report_message.h>
26 #include <wsutil/wslog.h>
27 
28 #include <epan/packet.h>
29 #include <epan/exceptions.h>
30 #include <epan/strutil.h>
31 #include <epan/prefs.h>
32 #include <epan/proto.h>
33 #include <epan/epan_dissect.h>
34 #include <wsutil/filesystem.h>
35 
36 #include "mate_util.h"
37 
38 /* defaults */
39 
40 #define DEFAULT_GOG_EXPIRATION 2.0
41 
42 #ifdef _WIN32
43 #define DIR_SEP '\\'
44 #else
45 #define DIR_SEP '/'
46 #endif
47 
48 #define DEFAULT_MATE_LIB_PATH "matelib"
49 
50 #define MATE_ITEM_ID_SIZE 24
51 
52 #define VALUE_TOO ((void*)1)
53 
54 #define MateConfigError 65535
55 
56 typedef enum _gop_tree_mode_t {
57  GOP_NULL_TREE,
58  GOP_BASIC_TREE,
59  GOP_FULL_TREE
60 } gop_tree_mode_t;
61 
62 typedef enum _gop_pdu_tree {
63  GOP_NO_TREE,
64  GOP_PDU_TREE,
65  GOP_FRAME_TREE,
66  GOP_BASIC_PDU_TREE
67 } gop_pdu_tree_t;
68 
69 typedef enum _accept_mode_t {
70  ACCEPT_MODE,
71  REJECT_MODE
72 } accept_mode_t;
73 
74 
75 typedef struct _mate_cfg_pdu {
76  char* name;
77  unsigned last_id; /* keeps the last id given to an item of this kind */
78 
79  GHashTable* items; /* all the items of this type */
80  GPtrArray* transforms; /* transformations to be applied */
81 
82  int hfid;
83 
84  int hfid_proto;
85  int hfid_pdu_rel_time;
86  int hfid_pdu_time_in_gop;
87 
88  GHashTable* my_hfids; /* for creating register info */
89 
90  int ett;
91  int ett_attr;
92 
93  GHashTable* hfids_attr; /* k=hfid v=avp_name */
94 
95  bool discard;
96  bool last_extracted;
97  bool drop_unassigned;
98 
99  GPtrArray* transport_ranges; /* hfids of candidate transport ranges from which to extract attributes */
100  GPtrArray* payload_ranges; /* hfids of candidate payload ranges from which to extract attributes */
101 
102  avpl_match_mode criterium_match_mode;
103  accept_mode_t criterium_accept_mode;
104  AVPL* criterium;
105 } mate_cfg_pdu;
106 
107 
108 typedef struct _mate_cfg_gop {
109  char* name;
110  unsigned last_id; /* keeps the last id given to an item of this kind */
111  GHashTable* items; /* all the items of this type */
112 
113  GPtrArray* transforms; /* transformations to be applied */
114  char* on_pdu;
115 
116  AVPL* key; /* key candidate avpl */
117  AVPL* start; /* start candidate avpl */
118  AVPL* stop; /* stop candidate avpl */
119  AVPL* extra; /* attributes to be added */
120 
121  double expiration;
122  double idle_timeout;
123  double lifetime;
124 
125  bool drop_unassigned;
126  gop_pdu_tree_t pdu_tree_mode;
127  bool show_times;
128 
129  GHashTable* my_hfids; /* for creating register info */
130  int hfid;
131  int hfid_start_time;
132  int hfid_stop_time;
133  int hfid_last_time;
134  int hfid_gop_pdu;
135  int hfid_gop_num_pdus;
136 
137  int ett;
138  int ett_attr;
139  int ett_times;
140  int ett_children;
141 
142  GHashTable* gop_index;
143  GHashTable* gog_index;
144 } mate_cfg_gop;
145 
146 
147 typedef struct _mate_cfg_gog {
148  char* name;
149 
150  GHashTable* items; /* all the items of this type */
151  unsigned last_id; /* keeps the last id given to an item of this kind */
152 
153  GPtrArray* transforms; /* transformations to be applied */
154 
155  LoAL* keys;
156  AVPL* extra; /* attributes to be added */
157 
158  double expiration;
159  gop_tree_mode_t gop_tree_mode;
160  bool show_times;
161 
162  GHashTable* my_hfids; /* for creating register info */
163  int hfid;
164  int hfid_gog_num_of_gops;
165  int hfid_gog_gop;
166  int hfid_gog_gopstart;
167  int hfid_gog_gopstop;
168  int hfid_start_time;
169  int hfid_stop_time;
170  int hfid_last_time;
171  int ett;
172  int ett_attr;
173  int ett_times;
174  int ett_children;
175  int ett_gog_gop;
176 } mate_cfg_gog;
177 
178 typedef struct _mate_config {
179  char* mate_config_file; /* name of the config file */
180 
181  int hfid_mate;
182 
183  GArray *wanted_hfids; /* hfids of protocols and fields MATE needs */
184  unsigned num_fields_wanted; /* number of fields MATE will look at */
185 
186  FILE* dbg_facility; /* where to dump dbgprint output ws_message if null */
187 
188  char* mate_lib_path; /* where to look for "Include" files first */
189 
190  GHashTable* pducfgs; /* k=pducfg->name v=pducfg */
191  GHashTable* gopcfgs; /* k=gopcfg->name v=gopcfg */
192  GHashTable* gogcfgs; /* k=gogcfg->name v=gogcfg */
193  GHashTable* transfs; /* k=transform->name v=transform */
194 
195  GPtrArray* pducfglist; /* pducfgs in order of "execution" */
196  GHashTable* gops_by_pduname; /* k=pducfg->name v=gopcfg */
197  GHashTable* gogs_by_gopname; /* k=gopname v=loal where avpl->name == matchedgop->name */
198 
199  GArray* hfrs;
200  int ett_root;
201  GArray* ett;
202 
203  /* defaults */
205  struct _pdu_defaults {
206  avpl_match_mode match_mode;
207  avpl_replace_mode replace_mode;
208  bool last_extracted;
209 
210  bool drop_unassigned;
211  bool discard;
212  } pdu;
213 
214  struct _gop_defaults {
215  double expiration;
216  double idle_timeout;
217  double lifetime;
218 
219  gop_pdu_tree_t pdu_tree_mode;
220  bool show_times;
221  bool drop_unassigned;
222 
223  } gop;
224 
225  struct _gog_defaults {
226  double expiration;
227  bool show_times;
228  gop_tree_mode_t gop_tree_mode;
229  } gog;
230  } defaults;
231 
232  /* what to dbgprint */
233  int dbg_lvl;
234  int dbg_pdu_lvl;
235  int dbg_gop_lvl;
236  int dbg_gog_lvl;
237 
238  GPtrArray* config_stack;
239  GString* config_error;
240 
241 } mate_config;
242 
243 
244 typedef struct _mate_config_frame {
245  char* filename;
246  unsigned linenum;
248 
249 
250 typedef struct _mate_runtime_data {
251  unsigned current_items; /* a count of items */
252  double now;
253  unsigned highest_analyzed_frame;
254 
255  GHashTable* frames; /* k=frame.num v=pdus */
256 
258 
259 typedef struct _mate_pdu mate_pdu;
260 typedef struct _mate_gop mate_gop;
261 typedef struct _mate_gog mate_gog;
262 
263 /* these are used to contain information regarding pdus, gops and gogs */
264 struct _mate_pdu {
265  uint32_t id; /* 1:1 -> saving a g_malloc */
266  mate_cfg_pdu* cfg; /* the type of this item */
267 
268  AVPL* avpl;
269 
270  uint32_t frame; /* which frame I belong to? */
271  mate_pdu* next_in_frame; /* points to the next pdu in this frame */
272  double rel_time; /* time since start of capture */
273 
274  mate_gop* gop; /* the gop the pdu belongs to (if any) */
275  mate_pdu* next; /* next in gop */
276  double time_in_gop; /* time since gop start */
277 
278  bool first; /* is this the first pdu in this frame? */
279  bool is_start; /* this is the start pdu for this gop */
280  bool is_stop; /* this is the stop pdu for this gop */
281  bool after_release; /* this pdu comes after the stop */
282 
283 };
284 
285 
286 struct _mate_gop {
287  uint32_t id;
288  mate_cfg_gop* cfg;
289 
290  char* gop_key;
291  AVPL* avpl; /* the attributes of the pdu/gop/gog */
292  unsigned last_n;
293 
294  mate_gog* gog; /* the gog of a gop */
295  mate_gop* next; /* next in gog; */
296 
297  double expiration; /* when will it expire after release (all gops releases if gog)? */
298  double idle_expiration; /* when will it expire if no new pdus are assigned to it */
299  double time_to_die;
300  double time_to_timeout;
301 
302  double start_time; /* time of start */
303  double release_time; /* when this gop/gog was released */
304  double last_time; /* the rel_time at which the last pdu has been added (to gop or gog's gop) */
305 
306 
307  int num_of_pdus; /* how many gops a gog has? */
308  int num_of_after_release_pdus; /* how many pdus have arrived since it's been released */
309  mate_pdu* pdus; /* pdus that belong to a gop (NULL in gog) */
310  mate_pdu* last_pdu; /* last pdu in pdu's list */
311 
312  bool released; /* has this gop been released? */
313 };
314 
315 
316 struct _mate_gog {
317  uint32_t id;
318  mate_cfg_gog* cfg;
319 
320  AVPL* avpl; /* the attributes of the pdu/gop/gog */
321  unsigned last_n; /* the number of attributes the avpl had the last time we checked */
322 
323  bool released; /* has this gop been released? */
324 
325  double expiration; /* when will it expire after release (all gops releases if gog)? */
326  double idle_expiration; /* when will it expire if no new pdus are assigned to it */
327 
328  /* on gop and gog: */
329  double start_time; /* time of start */
330  double release_time; /* when this gog was released */
331  double last_time; /* the rel_time at which the last pdu has been added */
332 
333  mate_gop* gops; /* gops that belong to a gog (NULL in gop) */
334  mate_gop* last_gop; /* last gop in gop's list */
335 
336  int num_of_gops; /* how many gops a gog has? */
337  int num_of_counting_gops; /* how many of them count for gog release */
338  int num_of_released_gops; /* how many of them have already been released */
339  GPtrArray* gog_keys; /* the keys under which this gog is stored in the gogs hash */
340 };
341 
342 typedef union _mate_max_size {
343  mate_pdu pdu;
344  mate_gop gop;
345  mate_gog gog;
346 } mate_max_size;
347 
348 /* from mate_runtime.c */
349 extern void initialize_mate_runtime(mate_config* mc);
350 extern mate_pdu* mate_get_pdus(uint32_t framenum);
351 extern void mate_analyze_frame(mate_config *mc, packet_info *pinfo, proto_tree* tree);
352 
353 /* from mate_setup.c */
354 extern mate_config* mate_make_config(const char* filename, int mate_hfid);
355 
356 extern mate_cfg_pdu* new_pducfg(mate_config* mc, char* name);
357 extern mate_cfg_gop* new_gopcfg(mate_config* mc, char* name);
358 extern mate_cfg_gog* new_gogcfg(mate_config* mc, char* name);
359 
360 extern bool add_hfid(mate_config* mc, header_field_info* hfi, char* as, GHashTable* where);
361 extern char* add_ranges(char* range, GPtrArray* range_ptr_arr);
362 
363 
364 /* from mate_parser.l */
365 extern bool mate_load_config(const char* filename, mate_config* mc);
366 
367 /* Constructor/Destructor prototypes for Lemon Parser */
368 #define YYMALLOCARGTYPE size_t
369 void *MateParserAlloc(void* (*)(YYMALLOCARGTYPE));
370 void MateParserFree(void*, void (*)(void *));
371 void MateParser(void*, int, char*, mate_config*);
372 
373 #endif
Definition: mate_util.h:70
Definition: proto.h:769
Definition: mate_util.h:116
Definition: mate.h:147
Definition: mate.h:108
Definition: mate.h:75
Definition: mate.h:204
Definition: mate.h:244
Definition: mate.h:178
Definition: mate.h:316
Definition: mate.h:286
Definition: mate.h:264
Definition: mate.h:250
Definition: packet_info.h:44
Definition: proto.h:904
Definition: mate.h:342