suricata/src/flow-var.c

/* implement per flow vars */

/* TODO
 * - move away from a linked list implementation
 * - use different datatypes, such as string, int, etc.
 * - have more than one instance of the same var, and be able to match on a 
 *   specific one, or one all at a time. So if a certain capture matches
 *   multiple times, we can operate on all of them.
 */

#include "eidps-common.h"
#include "threads.h"
#include "flow-var.h"
#include "flow.h"
#include "detect.h"

/* puts a new value into a flowvar */
void FlowVarUpdate(FlowVar *fv, uint8_t *value, uint16_t size) {
    if (fv->value) free(fv->value);
    fv->value = value;
    fv->value_len = size;
}

/* get the flowvar with name 'name' from the flow
 *
 * name is a normal string*/
FlowVar *FlowVarGet(Flow *f, uint8_t idx) {
    GenericVar *gv = f->flowvar;

    for ( ; gv != NULL; gv = gv->next) {
        if (gv->type == DETECT_FLOWVAR && gv->idx == idx)
            return (FlowVar *)gv;
    }

    return NULL;
}

/* add a flowvar to the flow, or update it */
void FlowVarAdd(Flow *f, uint8_t idx, uint8_t *value, uint16_t size) {
    //printf("Adding flow var \"%s\" with value(%" PRId32 ") \"%s\"\n", name, size, value);

    sc_mutex_lock(&f->m);

    FlowVar *fv = FlowVarGet(f, idx);
    if (fv == NULL) {
        fv = malloc(sizeof(FlowVar));
        if (fv == NULL)
            goto out;

        fv->type = DETECT_FLOWVAR;
        fv->idx = idx;
        fv->value = value;
        fv->value_len = size;
        fv->next = NULL;

        GenericVarAppend(&f->flowvar, (GenericVar *)fv);
    } else {
        FlowVarUpdate(fv, value, size);
    }

out:
    sc_mutex_unlock(&f->m);
}

void FlowVarFree(FlowVar *fv) {
    if (fv == NULL)
        return;

    if (fv->value != NULL)
        free(fv->value);

    free(fv);
}

void FlowVarPrint(GenericVar *gv) {
    uint16_t i;

    if (gv == NULL)
        return;

    if (gv->type == DETECT_FLOWVAR) {
        FlowVar *fv = (FlowVar *)gv;

        printf("Name idx \"%" PRIu32 "\", Value \"", fv->idx);
        for (i = 0; i < fv->value_len; i++) {
            if (isprint(fv->value[i])) printf("%c", fv->value[i]);
            else                       printf("\\%02X", fv->value[i]);
        }
        printf("\", Len \"%" PRIu32 "\"\n", fv->value_len);
    }
    FlowVarPrint(gv->next);
}