From: Victor Julien Date: Sun, 12 Nov 2023 08:41:45 +0000 (+0100) Subject: app-layer/frames: add by type getter X-Git-Tag: suricata-8.0.0-beta1~1204 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2e5e3498a6fc6bd34a6db3af2816270cd72cd7d2;p=thirdparty%2Fsuricata.git app-layer/frames: add by type getter AppLayerFrameGetLastOpenByType: Returns the most recent frame with a type with unknown length (-1). Check if type is globally enabled first. --- diff --git a/src/app-layer-frames.c b/src/app-layer-frames.c index 6953d26c9a..ff263b210f 100644 --- a/src/app-layer-frames.c +++ b/src/app-layer-frames.c @@ -692,6 +692,27 @@ Frame *AppLayerFrameGetById(Flow *f, const int dir, const FrameId frame_id) return FrameGetById(frames, frame_id); } +Frame *AppLayerFrameGetLastOpenByType(Flow *f, const int dir, const uint8_t frame_type) +{ + if (!(FrameConfigTypeIsEnabled(f->alproto, frame_type))) + return NULL; + + FramesContainer *frames_container = AppLayerFramesGetContainer(f); + SCLogDebug("get frame_type %" PRIu8 " direction %u/%s frames_container %p", frame_type, dir, + dir == 0 ? "toserver" : "toclient", frames_container); + if (frames_container == NULL) + return NULL; + + Frames *frames; + if (dir == 0) { + frames = &frames_container->toserver; + } else { + frames = &frames_container->toclient; + } + SCLogDebug("frames %p", frames); + return FrameGetLastOpenByType(frames, frame_type); +} + static inline bool FrameIsDone(const Frame *frame, const uint64_t abs_right_edge) { /* frame with negative length means we don't know the size yet. */ diff --git a/src/app-layer-frames.h b/src/app-layer-frames.h index b78077fd2b..2eb3143316 100644 --- a/src/app-layer-frames.h +++ b/src/app-layer-frames.h @@ -91,7 +91,10 @@ Frame *FrameGetById(Frames *frames, const int64_t id); Frame *FrameGetLastOpenByType(Frames *frames, const uint8_t frame_type); Frame *AppLayerFrameGetById(Flow *f, const int direction, const FrameId frame_id); +Frame *AppLayerFrameGetLastOpenByType(Flow *f, const int direction, const uint8_t frame_type); + FrameId AppLayerFrameGetId(Frame *r); + void AppLayerFrameAddEvent(Frame *frame, uint8_t e); void AppLayerFrameAddEventById(Flow *f, const int dir, const FrameId id, uint8_t e); void AppLayerFrameSetLength(Frame *frame, int64_t len);