Skip to content

Commit ba535e5

Browse files
Zainullin DamirZainullin Damir
Zainullin Damir
authored and
Zainullin Damir
committed
++
1 parent 8026500 commit ba535e5

File tree

7 files changed

+121
-108
lines changed

7 files changed

+121
-108
lines changed

‎src/plugins/process/http/src/http.cpp‎

Lines changed: 19 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -165,48 +165,6 @@ void HTTPPlugin::saveParsedValues(
165165
}
166166
}
167167

168-
/*bool HTTPPlugin::parseHTTP(
169-
std::span<const std::byte> payload, FlowRecord& flowRecord, HTTPData& httpData) noexcept
170-
{
171-
HTTPParser parser;
172-
parser.parse(payload);
173-
174-
if (!parser.method.has_value()) {
175-
return {
176-
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
177-
.flowAction = FlowAction::RemovePlugin,
178-
};
179-
}
180-
181-
if (parser.requestParsed && httpData.requestParsed) {
182-
// Must be flush and reinsert ????
183-
return {
184-
.updateRequirement = UpdateRequirement::RequiresUpdate,
185-
.flowAction = FlowAction::Flush,
186-
};
187-
}
188-
189-
if (parser.responseParsed && httpData.responseParsed) {
190-
// Must be flush and reinsert ????
191-
return {
192-
.updateRequirement = UpdateRequirement::RequiresUpdate,
193-
.flowAction = FlowAction::Flush,
194-
};
195-
}
196-
197-
if (httpData.requestParsed && httpData.responseParsed) {
198-
return {
199-
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
200-
.flowAction = FlowAction::NoAction,
201-
};
202-
}
203-
204-
return {
205-
.updateRequirement = UpdateRequirement::RequiresUpdate,
206-
.flowAction = FlowAction::NoAction,
207-
};
208-
}*/
209-
210168
PluginInitResult HTTPPlugin::onInit(const FlowContext& flowContext, void* pluginContext)
211169
{
212170
HTTPParser parser;
@@ -222,9 +180,7 @@ PluginInitResult HTTPPlugin::onInit(const FlowContext& flowContext, void* plugin
222180

223181
auto* pluginData = std::construct_at(reinterpret_cast<HTTPData*>(pluginContext));
224182
saveParsedValues(parser, flowContext.flowRecord, *pluginData);
225-
/*auto [updateRequirement, flowAction] = parseHTTP(
226-
toSpan<const std::byte>(flowContext.packet.payload, flowContext.packet.payload_len),
227-
flowContext.flowRecord, *pluginData);*/
183+
228184
return {
229185
.constructionState = ConstructionState::Constructed,
230186
.updateRequirement = UpdateRequirement::RequiresUpdate,
@@ -242,6 +198,23 @@ PluginUpdateResult HTTPPlugin::beforeUpdate(const FlowContext& flowContext, void
242198
};
243199
}
244200

201+
HTTPParser parser;
202+
parser.parse(
203+
toSpan<const std::byte>(flowContext.packet.payload, flowContext.packet.payload_len));
204+
if (parser.requestParsed && pluginData->requestParsed) {
205+
return {
206+
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
207+
.flowAction = FlowAction::Flush,
208+
};
209+
}
210+
211+
if (parser.responseParsed && pluginData->responseParsed) {
212+
return {
213+
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
214+
.flowAction = FlowAction::Flush,
215+
};
216+
}
217+
245218
return {
246219
.updateRequirement = UpdateRequirement::RequiresUpdate,
247220
.flowAction = FlowAction::NoAction,
@@ -254,12 +227,7 @@ PluginUpdateResult HTTPPlugin::onUpdate(const FlowContext& flowContext, void* pl
254227
HTTPParser parser;
255228
parser.parse(
256229
toSpan<const std::byte>(flowContext.packet.payload, flowContext.packet.payload_len));
257-
if (pluginData->requestParsed && pluginData->responseParsed) {
258-
return {
259-
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
260-
.flowAction = FlowAction::NoAction,
261-
};
262-
}
230+
saveParsedValues(parser, flowContext.flowRecord, *pluginData);
263231

264232
return {
265233
.updateRequirement = UpdateRequirement::RequiresUpdate,

‎src/plugins/process/http/src/http.hpp‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -52,20 +52,27 @@ class HTTPPlugin : public ProcessPlugin {
5252
*/
5353
PluginInitResult onInit(const FlowContext& flowContext, void* pluginContext) override;
5454

55+
/**
56+
* @brief Called before the main per-packet update.
57+
*
58+
* If both request and response are already parsed, no further updates are needed.
59+
* If a new request or response is parsed and the respective one was already seen,
60+
* the flow is flushed and then reinserted.
61+
*
62+
* @param flowContext Contextual information about the flow to be updated.
63+
* @param pluginContext Pointer to `HTTPData`.
64+
* @return Result of the pre-update check.
65+
*/
5566
PluginUpdateResult beforeUpdate(const FlowContext& flowContext, void* pluginContext) override;
5667

5768
/**
5869
* @brief Updates plugin data with values from new packet.
5970
*
6071
* Inserts parsed HTTP data into `HTTPData`.
61-
* If packet is an HTTP request and request was already seen, the flow is flushed with reinsert.
62-
* If packet is an HTTP response and response was already seen, the flow is flushed with
63-
* reinsert.
6472
*
6573
* @param flowContext Contextual information about the flow to be updated.
6674
* @param pluginContext Pointer to `HTTPData`.
67-
* @return Result of the update, does not require new packets if request and response are
68-
* already parsed.
75+
* @return Result of the update..
6976
*/
7077
PluginUpdateResult onUpdate(const FlowContext& flowContext, void* pluginContext) override;
7178

@@ -82,8 +89,6 @@ class HTTPPlugin : public ProcessPlugin {
8289
PluginDataMemoryLayout getDataMemoryLayout() const noexcept override;
8390

8491
private:
85-
// PluginUpdateResult parseHTTP(std::span<const std::byte> payload, FlowRecord& flowRecord,
86-
// HTTPData& httpData) noexcept;
8792
void
8893
saveParsedValues(const HTTPParser& parser, FlowRecord& flowRecord, HTTPData& httpData) noexcept;
8994

‎src/plugins/process/mpls/src/mpls.cpp‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,14 @@ createMPLSSchema(FieldManager& fieldManager, FieldHandlers<MPLSFields>& handlers
4545
{
4646
FieldGroup schema = fieldManager.createFieldGroup("mpls");
4747

48-
// TODO FIX
49-
/*handlers.insert(MPLSFields::MPLS_TOP_LABEL_STACK_SECTION, schema.addVectorField(
50-
"MPLS_TOP_LABEL_STACK_SECTION",
51-
[](const void* context) { return toSpan<const std::byte>(reinterpret_cast<const uint8_t*>(
52-
&reinterpret_cast<const MPLSData*>(context)->topLabel),
53-
sizeof(uint32_t)); }
54-
));*/
48+
handlers.insert(
49+
MPLSFields::MPLS_TOP_LABEL_STACK_SECTION,
50+
schema.addVectorField("MPLS_TOP_LABEL_STACK_SECTION", [](const void* context) {
51+
return toSpan<const std::byte>(
52+
reinterpret_cast<const std::byte*>(
53+
&reinterpret_cast<const MPLSData*>(context)->topLabel),
54+
sizeof(uint32_t));
55+
}));
5556

5657
return schema;
5758
}

‎src/plugins/process/rtsp/src/rtsp.cpp‎

Lines changed: 47 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -245,35 +245,18 @@ constexpr bool RTSPPlugin::parseResponse(std::string_view payload, RTSPData& plu
245245
}
246246

247247
constexpr PluginUpdateResult
248-
RTSPPlugin::updateExportData(std::span<const std::byte> payload, RTSPData& pluginData) noexcept
248+
RTSPPlugin::updateExportData(std::string_view payload, RTSPData& pluginData) noexcept
249249
{
250-
std::string_view payloadView = {reinterpret_cast<const char*>(payload.data()), payload.size()};
251-
if (isRequest(payloadView)) {
252-
if (pluginData.processingState.requestParsed) {
253-
// TODO Flush and reinsert
254-
return {
255-
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
256-
.flowAction = FlowAction::NoAction};
257-
}
258-
if (!parseRequest(payloadView, pluginData)) {
259-
return {
260-
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
261-
.flowAction = FlowAction::NoAction};
262-
}
250+
if (isRequest(payload) && !parseRequest(payload, pluginData)) {
251+
return {
252+
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
253+
.flowAction = FlowAction::NoAction};
263254
}
264255

265-
if (isResponse(payloadView)) {
266-
if (pluginData.processingState.responseParsed) {
267-
// TODO Flush and reinsert
268-
return {
269-
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
270-
.flowAction = FlowAction::NoAction};
271-
}
272-
if (!parseResponse(payloadView, pluginData)) {
273-
return {
274-
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
275-
.flowAction = FlowAction::NoAction};
276-
}
256+
if (isResponse(payload) && !parseResponse(payload, pluginData)) {
257+
return {
258+
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
259+
.flowAction = FlowAction::NoAction};
277260
}
278261

279262
return {
@@ -283,10 +266,19 @@ RTSPPlugin::updateExportData(std::span<const std::byte> payload, RTSPData& plugi
283266

284267
PluginInitResult RTSPPlugin::onInit(const FlowContext& flowContext, void* pluginContext)
285268
{
269+
std::string_view payloadView
270+
= {reinterpret_cast<const char*>(flowContext.packet.payload),
271+
flowContext.packet.payload_len};
272+
if (!isRequest(payloadView) && !isResponse(payloadView)) {
273+
return {
274+
.constructionState = ConstructionState::NotConstructed,
275+
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
276+
.flowAction = FlowAction::NoAction,
277+
};
278+
}
279+
286280
auto* pluginData = std::construct_at(reinterpret_cast<RTSPData*>(pluginContext));
287-
auto [updateRequirement, flowAction] = updateExportData(
288-
toSpan<const std::byte>(flowContext.packet.payload, flowContext.packet.payload_len),
289-
*pluginData);
281+
auto [updateRequirement, flowAction] = updateExportData(payloadView, *pluginData);
290282

291283
return {
292284
.constructionState = ConstructionState::Constructed,
@@ -295,11 +287,36 @@ PluginInitResult RTSPPlugin::onInit(const FlowContext& flowContext, void* plugin
295287
};
296288
}
297289

290+
PluginUpdateResult RTSPPlugin::beforeUpdate(const FlowContext& flowContext, void* pluginContext)
291+
{
292+
auto pluginData = *reinterpret_cast<RTSPData*>(pluginContext);
293+
std::string_view payload
294+
= {reinterpret_cast<const char*>(flowContext.packet.payload),
295+
flowContext.packet.payload_len};
296+
297+
if (isRequest(payload) && pluginData.processingState.requestParsed) {
298+
return {
299+
.updateRequirement = UpdateRequirement::RequiresUpdate,
300+
.flowAction = FlowAction::Flush};
301+
}
302+
303+
if (isResponse(payload) && pluginData.processingState.responseParsed) {
304+
return {
305+
.updateRequirement = UpdateRequirement::RequiresUpdate,
306+
.flowAction = FlowAction::Flush};
307+
}
308+
309+
return {
310+
.updateRequirement = UpdateRequirement::RequiresUpdate,
311+
.flowAction = FlowAction::NoAction,
312+
};
313+
}
314+
298315
PluginUpdateResult RTSPPlugin::onUpdate(const FlowContext& flowContext, void* pluginContext)
299316
{
300317
auto* pluginData = reinterpret_cast<RTSPData*>(pluginContext);
301318
return updateExportData(
302-
toSpan<const std::byte>(flowContext.packet.payload, flowContext.packet.payload_len),
319+
toStringView(flowContext.packet.payload, flowContext.packet.payload_len),
303320
*pluginData);
304321
}
305322

‎src/plugins/process/rtsp/src/rtsp.hpp‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -55,14 +55,24 @@ class RTSPPlugin : public ProcessPlugin {
5555
*/
5656
PluginInitResult onInit(const FlowContext& flowContext, void* pluginContext) override;
5757

58+
/**
59+
* @brief Called before the main per-packet update.
60+
*
61+
* If a new request or response is parsed and the respective one was already seen,
62+
* the flow is flushed and then reinserted.
63+
*
64+
* @param flowContext Contextual information about the flow to be updated.
65+
* @param pluginContext Pointer to `RTSPData`.
66+
* @return Result of the pre-update.
67+
*/
68+
PluginUpdateResult beforeUpdate(const FlowContext& flowContext, void* pluginContext) override;
69+
5870
/**
5971
* @brief Updates plugin data with values from new packet.
6072
*
6173
* Updates `RTSPData` with parsed RTSP values.
6274
* Skip consequent packets if RTSP parsing fails or both request and response are already
63-
* parsed. Flushes with reinsert if request has been parsed and incoming packet is request.
64-
* Flushes with reinsert if response has been parsed and incoming packet is response.
65-
*
75+
* parsed.
6676
* @param flowContext Contextual information about the flow to be updated.
6777
* @param pluginContext Pointer to `RTSPData`.
6878
* @return Result of the update.
@@ -85,7 +95,7 @@ class RTSPPlugin : public ProcessPlugin {
8595
constexpr bool parseRequest(std::string_view payload, RTSPData& pluginData) noexcept;
8696
constexpr bool parseResponse(std::string_view payload, RTSPData& pluginData) noexcept;
8797
constexpr PluginUpdateResult
88-
updateExportData(std::span<const std::byte> payload, RTSPData& pluginData) noexcept;
98+
updateExportData(std::string_view payload, RTSPData& pluginData) noexcept;
8999

90100
FieldHandlers<RTSPFields> m_fieldHandlers;
91101
};

‎src/plugins/process/smtp/src/smtp.cpp‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -377,14 +377,19 @@ constexpr PluginUpdateResult SMTPPlugin::updateSMTPData(
377377
};
378378
}
379379

380-
return {
381-
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
382-
.flowAction = FlowAction::NoAction,
383-
};
380+
std::unreachable();
384381
}
385382

386383
PluginInitResult SMTPPlugin::onInit(const FlowContext& flowContext, void* pluginContext)
387384
{
385+
constexpr uint16_t SMTP_PORT = 25;
386+
if (flowContext.packet.src_port != SMTP_PORT && flowContext.packet.dst_port != SMTP_PORT) {
387+
return {
388+
.constructionState = ConstructionState::NotConstructed,
389+
.updateRequirement = UpdateRequirement::NoUpdateNeeded,
390+
.flowAction = FlowAction::NoAction,
391+
};
392+
}
388393
auto* pluginData = std::construct_at(reinterpret_cast<SMTPData*>(pluginContext));
389394
auto [updateRequirement, flowAction] = updateSMTPData(
390395
toSpan<const std::byte>(flowContext.packet.payload, flowContext.packet.payload_len),

‎src/plugins/process/tls/src/tls.cpp‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -93,12 +93,19 @@ TLSPlugin::TLSPlugin([[maybe_unused]] const std::string& params, FieldManager& m
9393

9494
PluginInitResult TLSPlugin::onInit(const FlowContext& flowContext, void* pluginContext)
9595
{
96+
auto payload
97+
= toSpan<const std::byte>(flowContext.packet.payload, flowContext.packet.payload_len);
98+
TLSParser parser;
99+
if (!parser.parseHello(payload)) {
100+
return {
101+
.constructionState = ConstructionState::NotConstructed,
102+
.updateRequirement = UpdateRequirement::RequiresUpdate,
103+
.flowAction = FlowAction::NoAction,
104+
};
105+
}
106+
96107
auto* pluginData = std::construct_at(reinterpret_cast<TLSData*>(pluginContext));
97-
parseTLS(
98-
toSpan<const std::byte>(flowContext.packet.payload, flowContext.packet.payload_len),
99-
flowContext.packet.ip_proto,
100-
*pluginData,
101-
flowContext.flowRecord);
108+
parseTLS(payload, flowContext.packet.ip_proto, *pluginData, flowContext.flowRecord);
102109

103110
return {
104111
.constructionState = ConstructionState::Constructed,

0 commit comments

Comments
 (0)