diff --git a/plugins/epan/falco_bridge/CMakeLists.txt b/plugins/epan/falco_bridge/CMakeLists.txt index a3bbe796f4..974220865b 100644 --- a/plugins/epan/falco_bridge/CMakeLists.txt +++ b/plugins/epan/falco_bridge/CMakeLists.txt @@ -17,6 +17,11 @@ set(DISSECTOR_SRC sinsp-span.cpp ) +set(DISSECTOR_HEADERS + conversation-macros.h + sinsp-span.h +) + set(PLUGIN_FILES plugin.c ${DISSECTOR_SRC} @@ -52,7 +57,6 @@ target_link_libraries(falco-bridge install_plugin(falco-bridge epan) -file(GLOB DISSECTOR_HEADERS RELATIVE "${CMAKE_CURRENT_SOURCE_DIR}" "*.h") CHECKAPI( NAME falco-bridge diff --git a/plugins/epan/falco_bridge/conversation-macros.h b/plugins/epan/falco_bridge/conversation-macros.h index b815de19ff..0385c8d5e5 100644 --- a/plugins/epan/falco_bridge/conversation-macros.h +++ b/plugins/epan/falco_bridge/conversation-macros.h @@ -12,6 +12,24 @@ #define MAX_N_CONV_FILTERS 16 +#define PROTO_DATA_CONVINFO_USER_0 10000 +#define PROTO_DATA_CONVINFO_USER_1 10001 +#define PROTO_DATA_CONVINFO_USER_2 10002 +#define PROTO_DATA_CONVINFO_USER_3 10003 +#define PROTO_DATA_CONVINFO_USER_4 10004 +#define PROTO_DATA_CONVINFO_USER_5 10005 +#define PROTO_DATA_CONVINFO_USER_6 10006 +#define PROTO_DATA_CONVINFO_USER_7 10007 +#define PROTO_DATA_CONVINFO_USER_8 10008 +#define PROTO_DATA_CONVINFO_USER_9 10009 +#define PROTO_DATA_CONVINFO_USER_10 10010 +#define PROTO_DATA_CONVINFO_USER_11 10011 +#define PROTO_DATA_CONVINFO_USER_12 10012 +#define PROTO_DATA_CONVINFO_USER_13 10013 +#define PROTO_DATA_CONVINFO_USER_14 10014 +#define PROTO_DATA_CONVINFO_USER_15 10015 +#define PROTO_DATA_CONVINFO_USER_BASE PROTO_DATA_CONVINFO_USER_0 + is_filter_valid_func fv_func[MAX_N_CONV_FILTERS]; build_filter_string_func bfs_func[MAX_N_CONV_FILTERS]; diff --git a/plugins/epan/falco_bridge/packet-falco-bridge.c b/plugins/epan/falco_bridge/packet-falco-bridge.c index a335f6009e..55761c1bb6 100644 --- a/plugins/epan/falco_bridge/packet-falco-bridge.c +++ b/plugins/epan/falco_bridge/packet-falco-bridge.c @@ -20,27 +20,51 @@ #include #include +#include #ifndef _WIN32 #include #include #endif -#include -#include - -#include #include +#include #include #include +#include +#include +#include + #include #include -#include #include "sinsp-span.h" -#include "packet-falco-bridge.h" #include "conversation-macros.h" +typedef enum bridge_field_flags_e { + BFF_NONE = 0, + BFF_HIDDEN = 1 << 1, // Unused + BFF_INFO = 1 << 2, + BFF_CONVERSATION = 1 << 3 +} bridge_field_flags_e; + +typedef struct bridge_info { + sinsp_source_info_t *ssi; + uint32_t source_id; + int proto; + hf_register_info* hf; + int* hf_ids; + uint32_t visible_fields; + uint32_t* field_flags; + int* field_ids; +} bridge_info; + +typedef struct conv_fld_info { + const char* proto_name; + hf_register_info* field_info; + char field_val[4096]; +} conv_fld_info; + static int proto_falco_bridge = -1; static gint ett_falco_bridge = -1; static gint ett_sinsp_span = -1; @@ -95,11 +119,11 @@ static hf_register_info hf[] = { * Conversation filters mappers setup */ #define MAX_CONV_FILTER_STR_LEN 1024 -conv_fld_info conv_fld_infos[MAX_N_CONV_FILTERS]; +static conv_fld_info conv_fld_infos[MAX_N_CONV_FILTERS]; DECLARE_CONV_FLTS() -char conv_flt_vals[MAX_N_CONV_FILTERS][MAX_CONV_FILTER_STR_LEN]; -guint conv_vals_cnt = 0; -guint conv_fld_cnt = 0; +static char conv_flt_vals[MAX_N_CONV_FILTERS][MAX_CONV_FILTER_STR_LEN]; +static guint conv_vals_cnt = 0; +static guint conv_fld_cnt = 0; void register_conversation_filters_mappings(void) @@ -209,6 +233,7 @@ configure_plugin(bridge_info* bi, char* config _U_) fld_cnt++; } proto_register_field_array(proto_falco_bridge, bi->hf, fld_cnt); + } } @@ -284,7 +309,7 @@ proto_register_falcoplugin(void) * each plugin. */ if ((dir = ws_dir_open(dname, 0, NULL)) != NULL) { - while ((file = ws_dir_read_name(dir)) != NULL) { + while ((ws_dir_read_name(dir)) != NULL) { nbridges++; } ws_dir_close(dir); @@ -331,6 +356,7 @@ get_bridge_info(guint32 source_id) return NULL; } +#define PROTO_DATA_BRIDGE_HANDLE 0x00 static int dissect_falco_bridge(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data) { diff --git a/plugins/epan/falco_bridge/packet-falco-bridge.h b/plugins/epan/falco_bridge/packet-falco-bridge.h deleted file mode 100644 index 7cd089ee0b..0000000000 --- a/plugins/epan/falco_bridge/packet-falco-bridge.h +++ /dev/null @@ -1,80 +0,0 @@ -/* packet-falco-bridge.h - * - * By Loris Degioanni - * Copyright (C) 2021 Sysdig, Inc. -* -* Wireshark - Network traffic analyzer -* By Gerald Combs -* Copyright 1998 Gerald Combs -* -* SPDX-License-Identifier: GPL-2.0-or-later -*/ - -#ifndef __PACKET_FALCO_BRIDGE_H__ -#define __PACKET_FALCO_BRIDGE_H__ - -/* - * API versions of this plugin engine - */ -#define PLUGIN_API_VERSION_MAJOR 0 -#define PLUGIN_API_VERSION_MINOR 2 -#define PLUGIN_API_VERSION_PATCH 0 - -/* - * Return types - */ -#define SCAP_SUCCESS 0 -#define SCAP_FAILURE 1 -#define SCAP_TIMEOUT -1 -#define SCAP_ILLEGAL_INPUT 3 -#define SCAP_NOTFOUND 4 -#define SCAP_INPUT_TOO_SMALL 5 -#define SCAP_EOF 6 -#define SCAP_UNEXPECTED_BLOCK 7 -#define SCAP_VERSION_MISMATCH 8 -#define SCAP_NOT_SUPPORTED 9 - -#define PROTO_DATA_BRIDGE_HANDLE 0x00 -#define PROTO_DATA_CONVINFO_USER_0 10000 -#define PROTO_DATA_CONVINFO_USER_1 10001 -#define PROTO_DATA_CONVINFO_USER_2 10002 -#define PROTO_DATA_CONVINFO_USER_3 10003 -#define PROTO_DATA_CONVINFO_USER_4 10004 -#define PROTO_DATA_CONVINFO_USER_5 10005 -#define PROTO_DATA_CONVINFO_USER_6 10006 -#define PROTO_DATA_CONVINFO_USER_7 10007 -#define PROTO_DATA_CONVINFO_USER_8 10008 -#define PROTO_DATA_CONVINFO_USER_9 10009 -#define PROTO_DATA_CONVINFO_USER_10 10010 -#define PROTO_DATA_CONVINFO_USER_11 10011 -#define PROTO_DATA_CONVINFO_USER_12 10012 -#define PROTO_DATA_CONVINFO_USER_13 10013 -#define PROTO_DATA_CONVINFO_USER_14 10014 -#define PROTO_DATA_CONVINFO_USER_15 10015 -#define PROTO_DATA_CONVINFO_USER_BASE PROTO_DATA_CONVINFO_USER_0 - -typedef enum bridge_field_flags_e { - BFF_NONE = 0, - BFF_HIDDEN = 1 << 1, // Unused - BFF_INFO = 1 << 2, - BFF_CONVERSATION = 1 << 3 -} bridge_field_flags_e; - -typedef struct bridge_info { - sinsp_source_info_t *ssi; - uint32_t source_id; - int proto; - hf_register_info* hf; - int* hf_ids; - uint32_t visible_fields; - uint32_t* field_flags; - int* field_ids; -} bridge_info; - -typedef struct conv_fld_info { - const char* proto_name; - hf_register_info* field_info; - char field_val[4096]; -} conv_fld_info; - -#endif // __PACKET_FALCO_BRIDGE_H__