- ``frame_start``: a pointer to the start of the frame buffer in the stream (``cur_i`` in the SMB code snippet)
- ``frame_len``: what we expect the frame length to be (the engine may need to wait until it has enough data. See what is done in the telnet snippet request frames registering)
- ``frame_type``: type of frame it's being registering (defined in an enum, as shown further above)
+- ``tx_id``: an optional transaction id, if the frame belongs to a transaction. May be set later like `frame_len`
``StreamSlice`` contains the input data to the parser, alongside other Stream-related data important in parsing context. Definition is found in *applayer.rs*:
input,
input.len() as i64,
DnsFrameType::Pdu as u8,
+ None,
);
self.parse_request(input, false)
}
input,
input.len() as i64,
DnsFrameType::Pdu as u8,
+ None,
);
self.parse_response(input, false)
}
msg,
msg.len() as i64,
DnsFrameType::Pdu as u8,
+ None,
);
if self.parse_request(msg, true) {
cur_i = &cur_i[(size + 2)..];
msg,
msg.len() as i64,
DnsFrameType::Pdu as u8,
+ None,
);
if self.parse_response(msg, true) {
cur_i = &cur_i[(size + 2)..];
#[allow(clippy::not_unsafe_ptr_arg_deref)]
pub fn new(
flow: *const Flow, stream_slice: &StreamSlice, frame_start: &[u8], frame_len: i64,
- frame_type: u8,
+ frame_type: u8, tx_id: Option<u64>,
) -> Option<Self> {
let offset = frame_start.as_ptr() as usize - stream_slice.as_slice().as_ptr() as usize;
SCLogDebug!("offset {} stream_slice.len() {} frame_start.len() {}", offset, stream_slice.len(), frame_start.len());
};
let id = unsafe { AppLayerFrameGetId(frame) };
if id > 0 {
- Some(Self {
+ let r = Self {
id,
direction: Direction::from(stream_slice.flags()),
- })
+ };
+ if let Some(tx_id) = tx_id {
+ unsafe {
+ AppLayerFrameSetTxIdById(flow, r.direction(), id, tx_id);
+ };
+ }
+ Some(r)
} else {
None
}
#[cfg(test)]
pub fn new(
_flow: *const Flow, _stream_slice: &StreamSlice, _frame_start: &[u8], _frame_len: i64,
- _frame_type: u8,
+ _frame_type: u8, _tx_id: Option<u64>,
) -> Option<Self> {
None
}
current,
(current.len() - rem.len()) as i64,
MQTTFrameType::Pdu as u8,
+ None,
);
SCLogDebug!("request msg {:?}", msg);
if let MQTTOperation::TRUNCATED(ref trunc) = msg.op {
current,
(current.len() - rem.len()) as i64,
MQTTFrameType::Pdu as u8,
+ None,
);
SCLogDebug!("response msg {:?}", msg);
) {
let hdr = stream_slice.as_slice();
//MQTT payload has a fixed header of 2 bytes
- let _mqtt_hdr = Frame::new(flow, stream_slice, hdr, 2, MQTTFrameType::Header as u8);
+ let _mqtt_hdr = Frame::new(flow, stream_slice, hdr, 2, MQTTFrameType::Header as u8, None);
SCLogDebug!("mqtt_hdr Frame {:?}", _mqtt_hdr);
let rem_length = input.header.remaining_length as usize;
let data = &hdr[2..rem_length + 2];
data,
rem_length as i64,
MQTTFrameType::Data as u8,
+ None,
);
SCLogDebug!("mqtt_data Frame {:?}", _mqtt_data);
}
}
fn add_rpc_udp_ts_pdu(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], rpc_len: i64) -> Option<Frame> {
- let rpc_udp_ts_pdu = Frame::new(flow, stream_slice, input, rpc_len, NFSFrameType::RPCPdu as u8);
+ let rpc_udp_ts_pdu = Frame::new(flow, stream_slice, input, rpc_len, NFSFrameType::RPCPdu as u8, None);
SCLogDebug!("rpc_udp_pdu ts frame {:?}", rpc_udp_ts_pdu);
rpc_udp_ts_pdu
}
fn add_rpc_udp_ts_creds(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], creds_len: i64) {
- let _rpc_udp_ts_creds = Frame::new(flow, stream_slice, input, creds_len, NFSFrameType::RPCCreds as u8);
+ let _rpc_udp_ts_creds = Frame::new(flow, stream_slice, input, creds_len, NFSFrameType::RPCCreds as u8, None);
SCLogDebug!("rpc_creds ts frame {:?}", _rpc_udp_ts_creds);
}
fn add_rpc_tcp_ts_pdu(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], rpc_len: i64) -> Option<Frame> {
- let rpc_tcp_ts_pdu = Frame::new(flow, stream_slice, input, rpc_len, NFSFrameType::RPCPdu as u8);
+ let rpc_tcp_ts_pdu = Frame::new(flow, stream_slice, input, rpc_len, NFSFrameType::RPCPdu as u8, None);
SCLogDebug!("rpc_tcp_pdu ts frame {:?}", rpc_tcp_ts_pdu);
rpc_tcp_ts_pdu
}
fn add_rpc_tcp_ts_creds(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], creds_len: i64) {
- let _rpc_tcp_ts_creds = Frame::new(flow, stream_slice, input, creds_len, NFSFrameType::RPCCreds as u8);
+ let _rpc_tcp_ts_creds = Frame::new(flow, stream_slice, input, creds_len, NFSFrameType::RPCCreds as u8, None);
SCLogDebug!("rpc_tcp_ts_creds {:?}", _rpc_tcp_ts_creds);
}
fn add_nfs_ts_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nfs_len: i64) {
- let _nfs_req_pdu = Frame::new(flow, stream_slice, input, nfs_len, NFSFrameType::NFSPdu as u8);
+ let _nfs_req_pdu = Frame::new(flow, stream_slice, input, nfs_len, NFSFrameType::NFSPdu as u8, None);
SCLogDebug!("nfs_ts_pdu Frame {:?}", _nfs_req_pdu);
}
fn add_nfs4_ts_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nfs4_len: i64) {
- let _nfs4_ts_pdu = Frame::new(flow, stream_slice, input, nfs4_len, NFSFrameType::NFS4Pdu as u8);
+ let _nfs4_ts_pdu = Frame::new(flow, stream_slice, input, nfs4_len, NFSFrameType::NFS4Pdu as u8, None);
SCLogDebug!("nfs4_ts_pdu Frame: {:?}", _nfs4_ts_pdu);
if nfs4_len > 8 {
- let _nfs4_ts_hdr = Frame::new(flow, stream_slice, input, 8, NFSFrameType::NFS4Hdr as u8);
+ let _nfs4_ts_hdr = Frame::new(flow, stream_slice, input, 8, NFSFrameType::NFS4Hdr as u8, None);
SCLogDebug!("nfs4_ts_hdr Frame {:?}", _nfs4_ts_hdr);
- let _nfs4_ts_ops = Frame::new(flow, stream_slice, &input[8..], nfs4_len - 8, NFSFrameType::NFS4Ops as u8);
+ let _nfs4_ts_ops = Frame::new(flow, stream_slice, &input[8..], nfs4_len - 8, NFSFrameType::NFS4Ops as u8, None);
SCLogDebug!("nfs4_ts_ops Frame {:?}", _nfs4_ts_ops);
}
}
fn add_rpc_udp_tc_pdu(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], rpc_len: i64) -> Option<Frame> {
- let rpc_udp_tc_pdu = Frame::new(flow, stream_slice, input, rpc_len, NFSFrameType::RPCPdu as u8);
+ let rpc_udp_tc_pdu = Frame::new(flow, stream_slice, input, rpc_len, NFSFrameType::RPCPdu as u8, None);
SCLogDebug!("rpc_tc_pdu frame {:?}", rpc_udp_tc_pdu);
rpc_udp_tc_pdu
}
fn add_rpc_udp_tc_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], rpc_len: i64) {
if rpc_len > 8 {
- let _rpc_udp_tc_hdr = Frame::new(flow, stream_slice, input, 8, NFSFrameType::RPCHdr as u8);
- let _rpc_udp_tc_data = Frame::new(flow, stream_slice, &input[8..], rpc_len - 8, NFSFrameType::RPCData as u8);
+ let _rpc_udp_tc_hdr = Frame::new(flow, stream_slice, input, 8, NFSFrameType::RPCHdr as u8, None);
+ let _rpc_udp_tc_data = Frame::new(flow, stream_slice, &input[8..], rpc_len - 8, NFSFrameType::RPCData as u8, None);
SCLogDebug!("rpc_udp_tc_hdr frame {:?}", _rpc_udp_tc_hdr);
SCLogDebug!("rpc_udp_tc_data frame {:?}", _rpc_udp_tc_data);
}
}
fn add_rpc_tcp_tc_pdu(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], rpc_tcp_len: i64) -> Option<Frame> {
- let rpc_tcp_tc_pdu = Frame::new(flow, stream_slice, input, rpc_tcp_len, NFSFrameType::RPCPdu as u8);
+ let rpc_tcp_tc_pdu = Frame::new(flow, stream_slice, input, rpc_tcp_len, NFSFrameType::RPCPdu as u8, None);
SCLogDebug!("rpc_tcp_pdu tc frame {:?}", rpc_tcp_tc_pdu);
rpc_tcp_tc_pdu
}
fn add_rpc_tcp_tc_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], rpc_tcp_len: i64) {
if rpc_tcp_len > 12 {
- let _rpc_tcp_tc_hdr = Frame::new(flow, stream_slice, input, 12, NFSFrameType::RPCHdr as u8);
- let _rpc_tcp_tc_data = Frame::new(flow, stream_slice, &input[12..], rpc_tcp_len - 12, NFSFrameType::RPCData as u8);
+ let _rpc_tcp_tc_hdr = Frame::new(flow, stream_slice, input, 12, NFSFrameType::RPCHdr as u8, None);
+ let _rpc_tcp_tc_data = Frame::new(flow, stream_slice, &input[12..], rpc_tcp_len - 12, NFSFrameType::RPCData as u8, None);
SCLogDebug!("rpc_tcp_tc_hdr frame {:?}", _rpc_tcp_tc_hdr);
SCLogDebug!("rpc_tcp_tc_data frame {:?}", _rpc_tcp_tc_data);
}
fn add_nfs_tc_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nfs_len: i64) {
if nfs_len > 0 {
- let _nfs_tc_pdu = Frame::new(flow, stream_slice, input, nfs_len, NFSFrameType::NFSPdu as u8);
+ let _nfs_tc_pdu = Frame::new(flow, stream_slice, input, nfs_len, NFSFrameType::NFSPdu as u8, None);
SCLogDebug!("nfs_tc_pdu frame {:?}", _nfs_tc_pdu);
- let _nfs_res_status = Frame::new(flow, stream_slice, input, 4, NFSFrameType::NFSStatus as u8);
+ let _nfs_res_status = Frame::new(flow, stream_slice, input, 4, NFSFrameType::NFSStatus as u8, None);
SCLogDebug!("nfs_tc_status frame {:?}", _nfs_res_status);
}
}
fn add_nfs4_tc_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nfs4_len: i64) {
if nfs4_len > 0 {
- let _nfs4_tc_pdu = Frame::new(flow, stream_slice, input, nfs4_len, NFSFrameType::NFS4Pdu as u8);
+ let _nfs4_tc_pdu = Frame::new(flow, stream_slice, input, nfs4_len, NFSFrameType::NFS4Pdu as u8, None);
SCLogDebug!("nfs4_tc_pdu frame {:?}", _nfs4_tc_pdu);
- let _nfs4_tc_status = Frame::new(flow, stream_slice, input, 4, NFSFrameType::NFS4Status as u8);
+ let _nfs4_tc_status = Frame::new(flow, stream_slice, input, 4, NFSFrameType::NFS4Status as u8, None);
SCLogDebug!("nfs4_tc_status frame {:?}", _nfs4_tc_status);
}
if nfs4_len > 8 {
- let _nfs4_tc_hdr = Frame::new(flow, stream_slice, input, 8, NFSFrameType::NFS4Hdr as u8);
+ let _nfs4_tc_hdr = Frame::new(flow, stream_slice, input, 8, NFSFrameType::NFS4Hdr as u8, None);
SCLogDebug!("nfs4_tc_hdr frame {:?}", _nfs4_tc_hdr);
- let _nfs4_tc_ops = Frame::new(flow, stream_slice, &input[8..], nfs4_len - 8, NFSFrameType::NFS4Ops as u8);
+ let _nfs4_tc_ops = Frame::new(flow, stream_slice, &input[8..], nfs4_len - 8, NFSFrameType::NFS4Ops as u8, None);
SCLogDebug!("nfs4_tc_ops frame {:?}", _nfs4_tc_ops);
}
}
current,
consumed as i64,
RFBFrameType::Pdu as u8,
+ None,
);
current = rem;
current,
consumed as i64,
RFBFrameType::Pdu as u8,
+ None,
);
current = rem;
current,
consumed as i64,
RFBFrameType::Pdu as u8,
+ None,
);
current = rem;
current,
consumed as i64,
RFBFrameType::Pdu as u8,
+ None,
);
current = rem;
current,
consumed as i64,
RFBFrameType::Pdu as u8,
+ None,
);
current = rem;
current,
consumed as i64,
RFBFrameType::Pdu as u8,
+ None,
);
current = rem;
current,
consumed as i64,
RFBFrameType::Pdu as u8,
+ None,
);
current = rem;
current,
consumed as i64,
RFBFrameType::Pdu as u8,
+ None,
);
current = rem;
current,
consumed as i64,
RFBFrameType::Pdu as u8,
+ None,
);
current = rem;
current,
consumed as i64,
RFBFrameType::Pdu as u8,
+ None,
);
current = rem;
}
}
- fn build_tx_request(&mut self, input: &[u8], request: Request) {
- let mut tx = self.new_tx(crate::core::Direction::ToServer);
- tx.request = Some(request);
- if let Ok((_, req_line)) = sip_take_line(input) {
- tx.request_line = req_line;
- }
- self.transactions.push_back(tx);
- }
-
// app-layer-frame-documentation tag start: parse_request
fn parse_request(&mut self, flow: *const core::Flow, stream_slice: StreamSlice) -> bool {
let input = stream_slice.as_slice();
input,
input.len() as i64,
SIPFrameType::Pdu as u8,
+ None,
);
SCLogDebug!("ts: pdu {:?}", _pdu);
match sip_parse_request(input) {
Ok((_, request)) => {
- sip_frames_ts(flow, &stream_slice, &request);
- self.build_tx_request(input, request);
+ let mut tx = self.new_tx(crate::core::Direction::ToServer);
+ sip_frames_ts(flow, &stream_slice, &request, tx.id);
+ tx.request = Some(request);
+ if let Ok((_, req_line)) = sip_take_line(input) {
+ tx.request_line = req_line;
+ }
+ self.transactions.push_back(tx);
return true;
}
// app-layer-frame-documentation tag end: parse_request
start,
-1_i64,
SIPFrameType::Pdu as u8,
+ None,
);
SCLogDebug!("ts: pdu {:?}", self.request_frame);
}
match sip_parse_request(start) {
Ok((rem, request)) => {
- sip_frames_ts(flow, &stream_slice, &request);
- self.build_tx_request(start, request);
+ let mut tx = self.new_tx(crate::core::Direction::ToServer);
+ let tx_id = tx.id;
+ sip_frames_ts(flow, &stream_slice, &request, tx_id);
+ tx.request = Some(request);
+ if let Ok((_, req_line)) = sip_take_line(input) {
+ tx.request_line = req_line;
+ }
+ self.transactions.push_back(tx);
let consumed = start.len() - rem.len();
start = rem;
if let Some(frame) = &self.request_frame {
frame.set_len(flow, consumed as i64);
+ frame.set_tx(flow, tx_id);
self.request_frame = None;
}
}
return AppLayerResult::ok();
}
- fn build_tx_response(&mut self, input: &[u8], response: Response) {
- let mut tx = self.new_tx(crate::core::Direction::ToClient);
- tx.response = Some(response);
- if let Ok((_, resp_line)) = sip_take_line(input) {
- tx.response_line = resp_line;
- }
- self.transactions.push_back(tx);
- }
-
fn parse_response(&mut self, flow: *const core::Flow, stream_slice: StreamSlice) -> bool {
let input = stream_slice.as_slice();
let _pdu = Frame::new(
input,
input.len() as i64,
SIPFrameType::Pdu as u8,
+ None,
);
SCLogDebug!("tc: pdu {:?}", _pdu);
match sip_parse_response(input) {
Ok((_, response)) => {
- sip_frames_tc(flow, &stream_slice, &response);
- self.build_tx_response(input, response);
+ let mut tx = self.new_tx(crate::core::Direction::ToClient);
+ sip_frames_tc(flow, &stream_slice, &response, tx.id);
+ tx.response = Some(response);
+ if let Ok((_, resp_line)) = sip_take_line(input) {
+ tx.response_line = resp_line;
+ }
+ self.transactions.push_back(tx);
return true;
}
Err(Err::Incomplete(_)) => {
start,
-1_i64,
SIPFrameType::Pdu as u8,
+ None,
);
SCLogDebug!("tc: pdu {:?}", self.request_frame);
}
match sip_parse_response(start) {
Ok((rem, response)) => {
- sip_frames_tc(flow, &stream_slice, &response);
- self.build_tx_response(start, response);
+ let mut tx = self.new_tx(crate::core::Direction::ToClient);
+ let tx_id = tx.id;
+ sip_frames_tc(flow, &stream_slice, &response, tx_id);
+ tx.response = Some(response);
+ if let Ok((_, resp_line)) = sip_take_line(input) {
+ tx.response_line = resp_line;
+ }
+ self.transactions.push_back(tx);
let consumed = start.len() - rem.len();
start = rem;
if let Some(frame) = &self.response_frame {
frame.set_len(flow, consumed as i64);
+ frame.set_tx(flow, tx_id);
self.response_frame = None;
}
}
}
// app-layer-frame-documentation tag start: function to add frames
-fn sip_frames_ts(flow: *const core::Flow, stream_slice: &StreamSlice, r: &Request) {
+fn sip_frames_ts(flow: *const core::Flow, stream_slice: &StreamSlice, r: &Request, tx_id: u64) {
let oi = stream_slice.as_slice();
let _f = Frame::new(
flow,
oi,
r.request_line_len as i64,
SIPFrameType::RequestLine as u8,
+ Some(tx_id),
);
SCLogDebug!("ts: request_line {:?}", _f);
let hi = &oi[r.request_line_len as usize..];
hi,
r.headers_len as i64,
SIPFrameType::RequestHeaders as u8,
+ Some(tx_id),
);
SCLogDebug!("ts: request_headers {:?}", _f);
if r.body_len > 0 {
bi,
r.body_len as i64,
SIPFrameType::RequestBody as u8,
+ Some(tx_id),
);
SCLogDebug!("ts: request_body {:?}", _f);
}
}
// app-layer-frame-documentation tag end: function to add frames
-fn sip_frames_tc(flow: *const core::Flow, stream_slice: &StreamSlice, r: &Response) {
+fn sip_frames_tc(flow: *const core::Flow, stream_slice: &StreamSlice, r: &Response, tx_id: u64) {
let oi = stream_slice.as_slice();
let _f = Frame::new(
flow,
oi,
r.response_line_len as i64,
SIPFrameType::ResponseLine as u8,
+ Some(tx_id),
);
let hi = &oi[r.response_line_len as usize..];
SCLogDebug!("tc: response_line {:?}", _f);
hi,
r.headers_len as i64,
SIPFrameType::ResponseHeaders as u8,
+ Some(tx_id),
);
SCLogDebug!("tc: response_headers {:?}", _f);
if r.body_len > 0 {
bi,
r.body_len as i64,
SIPFrameType::ResponseBody as u8,
+ Some(tx_id),
);
SCLogDebug!("tc: response_body {:?}", _f);
}
}
fn add_nbss_ts_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> (Option<Frame>, Option<Frame>, Option<Frame>) {
- let nbss_pdu = Frame::new(flow, stream_slice, input, nbss_len + 4, SMBFrameType::NBSSPdu as u8);
+ let nbss_pdu = Frame::new(flow, stream_slice, input, nbss_len + 4, SMBFrameType::NBSSPdu as u8, None);
SCLogDebug!("NBSS PDU frame {:?}", nbss_pdu);
- let nbss_hdr_frame = Frame::new(flow, stream_slice, input, 4_i64, SMBFrameType::NBSSHdr as u8);
+ let nbss_hdr_frame = Frame::new(flow, stream_slice, input, 4_i64, SMBFrameType::NBSSHdr as u8, None);
SCLogDebug!("NBSS HDR frame {:?}", nbss_hdr_frame);
- let nbss_data_frame = Frame::new(flow, stream_slice, &input[4..], nbss_len, SMBFrameType::NBSSData as u8);
+ let nbss_data_frame = Frame::new(flow, stream_slice, &input[4..], nbss_len, SMBFrameType::NBSSData as u8, None);
SCLogDebug!("NBSS DATA frame {:?}", nbss_data_frame);
(nbss_pdu, nbss_hdr_frame, nbss_data_frame)
}
fn add_smb1_ts_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
- let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB1Pdu as u8);
+ let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB1Pdu as u8, None);
SCLogDebug!("SMB PDU frame {:?}", smb_pdu);
smb_pdu
}
fn add_smb1_ts_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
- let _smb1_hdr = Frame::new(flow, stream_slice, input, 32_i64, SMBFrameType::SMB1Hdr as u8);
+ let _smb1_hdr = Frame::new(flow, stream_slice, input, 32_i64, SMBFrameType::SMB1Hdr as u8, None);
SCLogDebug!("SMBv1 HDR frame {:?}", _smb1_hdr);
if input.len() > 32 {
- let _smb1_data = Frame::new(flow, stream_slice, &input[32..], nbss_len - 32, SMBFrameType::SMB1Data as u8);
+ let _smb1_data = Frame::new(flow, stream_slice, &input[32..], nbss_len - 32, SMBFrameType::SMB1Data as u8, None);
SCLogDebug!("SMBv1 DATA frame {:?}", _smb1_data);
}
}
fn add_smb2_ts_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
- let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB2Pdu as u8);
+ let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB2Pdu as u8, None);
SCLogDebug!("SMBv2 PDU frame {:?}", smb_pdu);
smb_pdu
}
fn add_smb2_ts_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64, hdr_len: i64) {
- let _smb2_hdr = Frame::new(flow, stream_slice, input, hdr_len, SMBFrameType::SMB2Hdr as u8);
+ let _smb2_hdr = Frame::new(flow, stream_slice, input, hdr_len, SMBFrameType::SMB2Hdr as u8, None);
SCLogDebug!("SMBv2 HDR frame {:?}", _smb2_hdr);
if input.len() > hdr_len as usize {
- let _smb2_data = Frame::new(flow, stream_slice, &input[hdr_len as usize..], nbss_len - hdr_len, SMBFrameType::SMB2Data as u8);
+ let _smb2_data = Frame::new(flow, stream_slice, &input[hdr_len as usize..], nbss_len - hdr_len, SMBFrameType::SMB2Data as u8, None);
SCLogDebug!("SMBv2 DATA frame {:?}", _smb2_data);
}
}
fn add_smb3_ts_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
- let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB3Pdu as u8);
+ let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB3Pdu as u8, None);
SCLogDebug!("SMBv3 PDU frame {:?}", smb_pdu);
smb_pdu
}
fn add_smb3_ts_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
- let _smb3_hdr = Frame::new(flow, stream_slice, input, 52_i64, SMBFrameType::SMB3Hdr as u8);
+ let _smb3_hdr = Frame::new(flow, stream_slice, input, 52_i64, SMBFrameType::SMB3Hdr as u8, None);
SCLogDebug!("SMBv3 HDR frame {:?}", _smb3_hdr);
if input.len() > 52 {
- let _smb3_data = Frame::new(flow, stream_slice, &input[52..], nbss_len - 52, SMBFrameType::SMB3Data as u8);
+ let _smb3_data = Frame::new(flow, stream_slice, &input[52..], nbss_len - 52, SMBFrameType::SMB3Data as u8, None);
SCLogDebug!("SMBv3 DATA frame {:?}", _smb3_data);
}
}
}
fn add_nbss_tc_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> (Option<Frame>, Option<Frame>, Option<Frame>) {
- let nbss_pdu = Frame::new(flow, stream_slice, input, nbss_len + 4, SMBFrameType::NBSSPdu as u8);
+ let nbss_pdu = Frame::new(flow, stream_slice, input, nbss_len + 4, SMBFrameType::NBSSPdu as u8, None);
SCLogDebug!("NBSS PDU frame {:?}", nbss_pdu);
- let nbss_hdr_frame = Frame::new(flow, stream_slice, input, 4_i64, SMBFrameType::NBSSHdr as u8);
+ let nbss_hdr_frame = Frame::new(flow, stream_slice, input, 4_i64, SMBFrameType::NBSSHdr as u8, None);
SCLogDebug!("NBSS HDR frame {:?}", nbss_hdr_frame);
- let nbss_data_frame = Frame::new(flow, stream_slice, &input[4..], nbss_len, SMBFrameType::NBSSData as u8);
+ let nbss_data_frame = Frame::new(flow, stream_slice, &input[4..], nbss_len, SMBFrameType::NBSSData as u8, None);
SCLogDebug!("NBSS DATA frame {:?}", nbss_data_frame);
(nbss_pdu, nbss_hdr_frame, nbss_data_frame)
}
fn add_smb1_tc_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
- let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB1Pdu as u8);
+ let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB1Pdu as u8, None);
SCLogDebug!("SMB PDU frame {:?}", smb_pdu);
smb_pdu
}
fn add_smb1_tc_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
- let _smb1_hdr = Frame::new(flow, stream_slice, input, SMB1_HEADER_SIZE as i64, SMBFrameType::SMB1Hdr as u8);
+ let _smb1_hdr = Frame::new(flow, stream_slice, input, SMB1_HEADER_SIZE as i64, SMBFrameType::SMB1Hdr as u8, None);
SCLogDebug!("SMBv1 HDR frame {:?}", _smb1_hdr);
if input.len() > SMB1_HEADER_SIZE {
let _smb1_data = Frame::new(flow, stream_slice, &input[SMB1_HEADER_SIZE..], nbss_len - SMB1_HEADER_SIZE as i64,
- SMBFrameType::SMB1Data as u8);
+ SMBFrameType::SMB1Data as u8, None);
SCLogDebug!("SMBv1 DATA frame {:?}", _smb1_data);
}
}
fn add_smb2_tc_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) -> Option<Frame> {
- let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB2Pdu as u8);
+ let smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB2Pdu as u8, None);
SCLogDebug!("SMBv2 PDU frame {:?}", smb_pdu);
smb_pdu
}
fn add_smb2_tc_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64, hdr_len: i64) {
- let _smb2_hdr = Frame::new(flow, stream_slice, input, hdr_len, SMBFrameType::SMB2Hdr as u8);
+ let _smb2_hdr = Frame::new(flow, stream_slice, input, hdr_len, SMBFrameType::SMB2Hdr as u8, None);
SCLogDebug!("SMBv2 HDR frame {:?}", _smb2_hdr);
if input.len() > hdr_len as usize {
- let _smb2_data = Frame::new(flow, stream_slice, &input[hdr_len as usize ..], nbss_len - hdr_len, SMBFrameType::SMB2Data as u8);
+ let _smb2_data = Frame::new(flow, stream_slice, &input[hdr_len as usize ..], nbss_len - hdr_len, SMBFrameType::SMB2Data as u8, None);
SCLogDebug!("SMBv2 DATA frame {:?}", _smb2_data);
}
}
fn add_smb3_tc_pdu_frame(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
- let _smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB3Pdu as u8);
+ let _smb_pdu = Frame::new(flow, stream_slice, input, nbss_len, SMBFrameType::SMB3Pdu as u8, None);
SCLogDebug!("SMBv3 PDU frame {:?}", _smb_pdu);
}
fn add_smb3_tc_hdr_data_frames(&mut self, flow: *const Flow, stream_slice: &StreamSlice, input: &[u8], nbss_len: i64) {
- let _smb3_hdr = Frame::new(flow, stream_slice, input, 52_i64, SMBFrameType::SMB3Hdr as u8);
+ let _smb3_hdr = Frame::new(flow, stream_slice, input, 52_i64, SMBFrameType::SMB3Hdr as u8, None);
SCLogDebug!("SMBv3 HDR frame {:?}", _smb3_hdr);
if input.len() > 52 {
- let _smb3_data = Frame::new(flow, stream_slice, &input[52..], nbss_len - 52, SMBFrameType::SMB3Data as u8);
+ let _smb3_data = Frame::new(flow, stream_slice, &input[52..], nbss_len - 52, SMBFrameType::SMB3Data as u8, None);
SCLogDebug!("SMBv3 DATA frame {:?}", _smb3_data);
}
}
start,
-1_i64,
TelnetFrameType::Pdu as u8,
+ None,
);
}
if self.request_specific_frame.is_none() {
start,
-1_i64,
TelnetFrameType::Ctl as u8,
+ None,
)
} else {
Frame::new(
start,
-1_i64,
TelnetFrameType::Data as u8,
+ None,
)
// app-layer-frame-documentation tag end: parse_request
};
let mut start = input;
while !start.is_empty() {
if self.response_frame.is_none() {
- self.response_frame = Frame::new(flow, stream_slice, start, -1_i64, TelnetFrameType::Pdu as u8);
+ self.response_frame = Frame::new(flow, stream_slice, start, -1_i64, TelnetFrameType::Pdu as u8, None);
}
if self.response_specific_frame.is_none() {
if let Ok((_, is_ctl)) = parser::peek_message_is_ctl(start) {
self.response_specific_frame = if is_ctl {
- Frame::new(flow, stream_slice, start, -1_i64, TelnetFrameType::Ctl as u8)
+ Frame::new(flow, stream_slice, start, -1_i64, TelnetFrameType::Ctl as u8, None)
} else {
- Frame::new(flow, stream_slice, start, -1_i64, TelnetFrameType::Data as u8)
+ Frame::new(flow, stream_slice, start, -1_i64, TelnetFrameType::Data as u8, None)
};
}
}
while !start.is_empty() {
match parser::parse_message(start, max_pl_size) {
Ok((rem, pdu)) => {
+ let mut tx = self.new_tx(direction);
let _pdu = Frame::new(
flow,
&stream_slice,
start,
(start.len() - rem.len() - pdu.payload.len()) as i64,
WebSocketFrameType::Header as u8,
+ Some(tx.tx_id),
);
let _pdu = Frame::new(
flow,
start,
(start.len() - rem.len()) as i64,
WebSocketFrameType::Pdu as u8,
+ Some(tx.tx_id),
);
start = rem;
- let mut tx = self.new_tx(direction);
if pdu.to_skip > 0 {
if direction == Direction::ToClient {
self.to_skip_tc = pdu.to_skip;
projects / thirdparty / suricata.git / commitdiff
