| Wireshark 4.7.0 The Wireshark network protocol analyzer

Loading...
Searching...
No Matches
mate.h
1/* mate.h
2 * MATE -- Meta Analysis and Tracing Engine
3 *
4 * Copyright 2004, Luis E. Garcia Ontanon <luis@ontanon.org>
5 *
6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
9 *
10 * SPDX-License-Identifier: GPL-2.0-or-later
11 */
12
13
14#ifndef __MATE_H_
15#define __MATE_H_
16
17#define WS_LOG_DOMAIN "MATE"
18#include <wireshark.h>
19
20#include <gmodule.h>
21
22#include <stdio.h>
23#include <string.h>
24
25#include <wsutil/report_message.h>
26#include <wsutil/wslog.h>
27
28#include <epan/packet.h>
29#include <epan/exceptions.h>
30#include <epan/strutil.h>
31#include <epan/prefs.h>
32#include <epan/proto.h>
33#include <epan/epan_dissect.h>
34#include <wsutil/filesystem.h>
35
36#include "mate_util.h"
37
38/* defaults */
39
40#define DEFAULT_GOG_EXPIRATION 2.0
41
42#ifdef _WIN32
43#define DIR_SEP '\\'
44#else
45#define DIR_SEP '/'
46#endif
47
48#define DEFAULT_MATE_LIB_PATH "matelib"
49
50#define MATE_ITEM_ID_SIZE 24
51
52#define VALUE_TOO ((void*)1)
53
54#define MateConfigError 65535
55
56 typedef enum _gop_tree_mode_t {
57 GOP_NULL_TREE,
58 GOP_BASIC_TREE,
59 GOP_FULL_TREE
60} gop_tree_mode_t;
61
62 typedef enum _gop_pdu_tree {
63 GOP_NO_TREE,
64 GOP_PDU_TREE,
65 GOP_FRAME_TREE,
66 GOP_BASIC_PDU_TREE
67} gop_pdu_tree_t;
68
69 typedef enum _accept_mode_t {
70 ACCEPT_MODE,
71 REJECT_MODE
72} accept_mode_t;
73
74
75 typedef struct _mate_cfg_pdu {
76 char* name;
77
78 GPtrArray* transforms; /* transformations to be applied */
79
80 int hfid;
81
82 int hfid_proto;
83 int hfid_pdu_rel_time;
84 int hfid_pdu_time_in_gop;
85
86 GHashTable* my_hfids; /* for creating register info */
87
88 int ett;
89 int ett_attr;
90
91 GHashTable* hfids_attr; /* k=hfid v=avp_name */
92
93 bool discard;
94 bool last_extracted;
95 bool drop_unassigned;
96
97 GPtrArray* transport_ranges; /* hfids of candidate transport ranges from which to extract attributes */
98 GPtrArray* payload_ranges; /* hfids of candidate payload ranges from which to extract attributes */
99
100 avpl_match_mode criterium_match_mode;
101 accept_mode_t criterium_accept_mode;
102 AVPL* criterium;
103} mate_cfg_pdu;
104
105
106 typedef struct _mate_cfg_gop {
107 char* name;
108
109 GPtrArray* transforms; /* transformations to be applied */
110 const char* on_pdu;
111
112 AVPL* key; /* key candidate avpl */
113 AVPL* start; /* start candidate avpl */
114 AVPL* stop; /* stop candidate avpl */
115 AVPL* extra; /* attributes to be added */
116
117 double expiration;
118 double idle_timeout;
119 double lifetime;
120
121 bool drop_unassigned;
122 gop_pdu_tree_t pdu_tree_mode;
123 bool show_times;
124
125 GHashTable* my_hfids; /* for creating register info */
126 int hfid;
127 int hfid_start_time;
128 int hfid_stop_time;
129 int hfid_last_time;
130 int hfid_gop_pdu;
131 int hfid_gop_num_pdus;
132
133 int ett;
134 int ett_attr;
135 int ett_times;
136 int ett_children;
137} mate_cfg_gop;
138
139
140 typedef struct _mate_cfg_gog {
141 char* name;
142
143 GPtrArray* transforms; /* transformations to be applied */
144
145 LoAL* keys;
146 AVPL* extra; /* attributes to be added */
147
148 double expiration;
149 gop_tree_mode_t gop_tree_mode;
150 bool show_times;
151
152 GHashTable* my_hfids; /* for creating register info */
153 int hfid;
154 int hfid_gog_num_of_gops;
155 int hfid_gog_gop;
156 int hfid_gog_gopstart;
157 int hfid_gog_gopstop;
158 int hfid_start_time;
159 int hfid_stop_time;
160 int hfid_last_time;
161 int ett;
162 int ett_attr;
163 int ett_times;
164 int ett_children;
165 int ett_gog_gop;
166} mate_cfg_gog;
167
168 typedef struct _mate_config {
169 int hfid_mate;
170
171 GArray *wanted_hfids; /* hfids of protocols and fields MATE needs */
172 unsigned num_fields_wanted; /* number of fields MATE will look at */
173
174 FILE* dbg_facility; /* where to dump dbgprint output ws_message if null */
175
176 char* mate_lib_path; /* where to look for "Include" files first */
177
178 GHashTable* pducfgs; /* k=pducfg->name v=pducfg */
179 GHashTable* gopcfgs; /* k=gopcfg->name v=gopcfg */
180 GHashTable* gogcfgs; /* k=gogcfg->name v=gogcfg */
181 GHashTable* transfs; /* k=transform->name v=transform */
182
183 GPtrArray* pducfglist; /* pducfgs in order of "execution" */
184 GHashTable* gops_by_pduname; /* k=pducfg->name v=gopcfg */
185 GHashTable* gogs_by_gopname; /* k=gopname v=loal where avpl->name == matchedgop->name */
186
187 GArray* hfrs;
188 int ett_root;
189 GArray* ett;
190
191 /* defaults */
192 struct _mate_cfg_defaults {
193 struct _pdu_defaults {
194 avpl_match_mode match_mode;
195 avpl_replace_mode replace_mode;
196 bool last_extracted;
197
198 bool drop_unassigned;
199 bool discard;
200 } pdu;
201
202 struct _gop_defaults {
203 double expiration;
204 double idle_timeout;
205 double lifetime;
206
207 gop_pdu_tree_t pdu_tree_mode;
208 bool show_times;
209 bool drop_unassigned;
210
211 } gop;
212
213 struct _gog_defaults {
214 double expiration;
215 bool show_times;
216 gop_tree_mode_t gop_tree_mode;
217 } gog;
218 } defaults;
219
220 /* what to dbgprint */
221 int dbg_lvl;
222 int dbg_pdu_lvl;
223 int dbg_gop_lvl;
224 int dbg_gog_lvl;
225
226 GPtrArray* config_stack;
227 GString* config_error;
228
229} mate_config;
230
231
232 typedef struct _mate_config_frame {
233 char* filename;
234 unsigned linenum;
235} mate_config_frame;
236
237 typedef struct _gopcfg_runtime_data {
238 unsigned last_id; /* keeps the last id given to an item of this kind */
239 GHashTable* gop_index;
240 GHashTable* gog_index;
241} gopcfg_runtime_data;
242
243 typedef struct _mate_runtime_data {
244 unsigned current_items; /* a count of items */
245 double now;
246 unsigned highest_analyzed_frame;
247
248 GHashTable* frames; /* k=frame.num v=pdus */
249 GHashTable* gops; /* set of gops, for memory management */
250 GHashTable* gogs; /* set of gogs, for memory management */
251
252 GHashTable* pdu_last_ids; /* k=pducfg, v=last id given to a pdu of this cfg */
253 GHashTable* gopcfg_rd; /* k=gopcfg, v=gopcfg_runtime_data */
254 GHashTable* gog_last_ids; /* k=gogcfg, v=last id given to a gog of this cfg */
255} mate_runtime_data;
256
257 typedef struct _mate_pdu mate_pdu;
258 typedef struct _mate_gop mate_gop;
259 typedef struct _mate_gog mate_gog;
260
261/* these are used to contain information regarding pdus, gops and gogs */
262 struct _mate_pdu {
263 uint32_t id; /* 1:1 -> saving a g_malloc */
264 const mate_cfg_pdu* cfg; /* the type of this item */
265
266 AVPL* avpl;
267
268 uint32_t frame; /* which frame I belong to? */
269 double rel_time; /* time since start of capture */
270
271 mate_gop* gop; /* the gop the pdu belongs to (if any) */
272 mate_pdu* next; /* next in gop */
273 double time_in_gop; /* time since gop start */
274
275 bool first; /* is this the first pdu in this frame? */
276 bool is_start; /* this is the start pdu for this gop */
277 bool is_stop; /* this is the stop pdu for this gop */
278 bool after_release; /* this pdu comes after the stop */
279
280};
281
282
283 struct _mate_gop {
284 uint32_t id;
285 const mate_cfg_gop* cfg;
286
287 char* gop_key;
288 AVPL* avpl; /* the attributes of the pdu/gop/gog */
289 unsigned last_n;
290
291 mate_gog* gog; /* the gog of a gop */
292 mate_gop* next; /* next in gog; */
293
294 double expiration; /* when will it expire after release (all gops releases if gog)? */
295 double idle_expiration; /* when will it expire if no new pdus are assigned to it */
296 double time_to_die;
297 double time_to_timeout;
298
299 double start_time; /* time of start */
300 double release_time; /* when this gop/gog was released */
301 double last_time; /* the rel_time at which the last pdu has been added (to gop or gog's gop) */
302
303
304 int num_of_pdus; /* how many gops a gog has? */
305 int num_of_after_release_pdus; /* how many pdus have arrived since it's been released */
306 mate_pdu* pdus; /* pdus that belong to a gop (NULL in gog) */
307 mate_pdu* last_pdu; /* last pdu in pdu's list */
308
309 bool released; /* has this gop been released? */
310};
311
312
313 struct _mate_gog {
314 uint32_t id;
315 const mate_cfg_gog* cfg;
316
317 AVPL* avpl; /* the attributes of the pdu/gop/gog */
318 unsigned last_n; /* the number of attributes the avpl had the last time we checked */
319
320 bool released; /* has this gop been released? */
321
322 double expiration; /* when will it expire after release (all gops releases if gog)? */
323 double idle_expiration; /* when will it expire if no new pdus are assigned to it */
324
325 /* on gop and gog: */
326 double start_time; /* time of start */
327 double release_time; /* when this gog was released */
328 double last_time; /* the rel_time at which the last pdu has been added */
329
330 mate_gop* gops; /* gops that belong to a gog (NULL in gop) */
331 mate_gop* last_gop; /* last gop in gop's list */
332
333 int num_of_gops; /* how many gops a gog has? */
334 int num_of_counting_gops; /* how many of them count for gog release */
335 int num_of_released_gops; /* how many of them have already been released */
336 GPtrArray* gog_keys; /* the keys under which this gog is stored in the gogs hash */
337};
338
339 typedef union _mate_max_size {
340 mate_pdu pdu;
341 mate_gop gop;
342 mate_gog gog;
343} mate_max_size;
344
345/* from mate_runtime.c */
346 extern void initialize_mate_runtime(mate_config* mc);
347 extern GPtrArray* mate_get_pdus(uint32_t framenum);
348 extern void mate_analyze_frame(mate_config *mc, packet_info *pinfo, proto_tree* tree);
349
350/* from mate_setup.c */
351 extern mate_config* mate_make_config(const char* filename, int mate_hfid);
352
353 extern mate_cfg_pdu* new_pducfg(mate_config* mc, char* name);
354 extern mate_cfg_gop* new_gopcfg(mate_config* mc, char* name);
355 extern mate_cfg_gog* new_gogcfg(mate_config* mc, char* name);
356
357 extern bool add_hfid(mate_config* mc, header_field_info* hfi, char* as, GHashTable* where);
358 extern char* add_ranges(char* range, GPtrArray* range_ptr_arr);
359
360
361/* from mate_parser.l */
362 extern bool mate_load_config(const char* filename, mate_config* mc);
363
364/* Constructor/Destructor prototypes for Lemon Parser */
365#define YYMALLOCARGTYPE size_t
366 void *MateParserAlloc(void* (*)(YYMALLOCARGTYPE));
367 void MateParserFree(void*, void (*)(void *));
368 void MateParser(void*, int, char*, mate_config*);
369
370#endif
epan_dissect.h
exceptions.h
filesystem.h
packet.h
prefs.h
proto.h
report_message.h
_avp_list
Definition mate_util.h:67
_gopcfg_runtime_data
Definition mate.h:237
_header_field_info
Definition proto.h:767
_loal
Definition mate_util.h:113
_mate_cfg_gog
Definition mate.h:140
_mate_cfg_gop
Definition mate.h:106
_mate_cfg_pdu
Definition mate.h:75
_mate_config::_mate_cfg_defaults::_gog_defaults
Definition mate.h:213
_mate_config::_mate_cfg_defaults::_gop_defaults
Definition mate.h:202
_mate_config::_mate_cfg_defaults::_pdu_defaults
Definition mate.h:193
_mate_config::_mate_cfg_defaults
Definition mate.h:192
_mate_config_frame
Definition mate.h:232
_mate_config
Definition mate.h:168
_mate_gog
Definition mate.h:313
_mate_gop
Definition mate.h:283
_mate_pdu
Definition mate.h:262
_mate_runtime_data
Definition mate.h:243
_packet_info
Definition packet_info.h:43
_proto_node
Definition proto.h:907
strutil.h
_mate_max_size
Definition mate.h:339
wslog.h