suricata
decode-geneve.c
Go to the documentation of this file.
1 /* Copyright (C) 2020-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Ali Jad Khalil <jadkhal@amazon.com>
22  *
23  * Geneve tunneling scheme decoder.
24  *
25  * This implementation is based on the following specification doc:
26  * https://tools.ietf.org/html/draft-ietf-nvo3-geneve-16#section-3
27  */
28 
29 #include "suricata-common.h"
30 #include "decode.h"
31 #include "decode-geneve.h"
32 #include "decode-events.h"
33 
34 #include "detect.h"
35 #include "detect-engine-port.h"
36 
37 #include "flow.h"
38 
39 #include "util-validate.h"
40 #include "util-unittest.h"
41 #include "util-debug.h"
42 
43 #include "pkt-var.h"
44 #include "util-profiling.h"
45 #include "host.h"
46 
47 #define VALID_GENEVE_VERSIONS \
48  { \
49  0 \
50  }
51 #define GENEVE_VERSION(hdr_ptr) (hdr_ptr->ver_plus_len >> 6)
52 #define GENEVE_RESERVED_FLAGS(hdr_ptr) (hdr_ptr->flags & 0x3F)
53 
54 #define GENEVE_MIN_HEADER_LEN sizeof(GeneveHeader)
55 #define GENEVE_TOTAL_OPT_LEN(hdr_ptr) ((uint8_t)((hdr_ptr->ver_plus_len & 0x3F) << 2))
56 #define GENEVE_TOTAL_HEADER_LEN(hdr_ptr) (GENEVE_MIN_HEADER_LEN + GENEVE_TOTAL_OPT_LEN(hdr_ptr))
57 
58 #define GENEVE_MIN_SINGLE_OPT_LEN sizeof(GeneveOption)
59 #define GENEVE_SINGLE_OPT_LEN(option_ptr) ((uint8_t)((option_ptr->flags_plus_len & 0x1F) << 2))
60 #define GENEVE_SINGLE_OPT_TOTAL_LEN(option_ptr) \
61  (GENEVE_MIN_SINGLE_OPT_LEN + GENEVE_SINGLE_OPT_LEN(option_ptr))
62 
63 #define GENEVE_MAX_PORTS 4
64 #define GENEVE_UNSET_PORT -1
65 #define GENEVE_DEFAULT_PORT 6081
66 #define GENEVE_DEFAULT_PORT_S "6081"
67 
68 static bool g_geneve_enabled = true;
69 static int g_geneve_ports_idx = 0;
70 static int g_geneve_ports[GENEVE_MAX_PORTS] = { GENEVE_DEFAULT_PORT, GENEVE_UNSET_PORT,
72 
73 /* Geneve structs based on diagrams from the following specification doc:
74  * https://tools.ietf.org/html/draft-ietf-nvo3-geneve-16#section-3 */
75 typedef struct GeneveOption_ {
76  uint16_t option_class;
77  uint8_t type;
78  uint8_t flags_plus_len;
79  uint8_t option_data[0];
81 
82 typedef struct GeneveHeader_ {
83  uint8_t ver_plus_len;
84  uint8_t flags;
85  uint16_t eth_type;
86  uint8_t vni[3];
87  uint8_t res;
90 
91 bool DecodeGeneveEnabledForPort(const uint16_t sp, const uint16_t dp)
92 {
93  SCLogDebug("ports %u->%u ports %d %d %d %d", sp, dp, g_geneve_ports[0], g_geneve_ports[1],
94  g_geneve_ports[2], g_geneve_ports[3]);
95 
96  if (g_geneve_enabled) {
97  for (int i = 0; i < g_geneve_ports_idx; i++) {
98  if (g_geneve_ports[i] == GENEVE_UNSET_PORT)
99  return false;
100 
101  const int port = g_geneve_ports[i];
102  if (port == (const int)sp || port == (const int)dp)
103  return true;
104  }
105  }
106  return false;
107 }
108 
109 static void DecodeGeneveConfigPorts(const char *pstr)
110 {
111  SCLogDebug("parsing \'%s\'", pstr);
112 
113  DetectPort *head = NULL;
114  DetectPortParse(NULL, &head, pstr);
115 
116  g_geneve_ports_idx = 0;
117  for (DetectPort *p = head; p != NULL; p = p->next) {
118  if (g_geneve_ports_idx >= GENEVE_MAX_PORTS) {
119  SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY, "more than %d Geneve ports defined",
121  break;
122  }
123  g_geneve_ports[g_geneve_ports_idx++] = (int)p->port;
124  }
125 
127 }
128 
130 {
131  int enabled = 0;
132  if (ConfGetBool("decoder.geneve.enabled", &enabled) == 1) {
133  if (enabled) {
134  g_geneve_enabled = true;
135  } else {
136  g_geneve_enabled = false;
137  }
138  }
139 
140  if (g_geneve_enabled) {
141  ConfNode *node = ConfGetNode("decoder.geneve.ports");
142  if (node && node->val) {
143  DecodeGeneveConfigPorts(node->val);
144  } else {
145  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
146  }
147  }
148 }
149 
150 static inline bool IsValidGeneveVersion(const GeneveHeader *geneve_hdr)
151 {
152  const int valid_verisons[] = VALID_GENEVE_VERSIONS;
153  const int num_versions = sizeof(valid_verisons) / sizeof(int);
154  const uint8_t cur_version = GENEVE_VERSION(geneve_hdr);
155 
156  for (int i = 0; i < num_versions; i++) {
157  if (valid_verisons[i] == cur_version)
158  return true;
159  }
160 
161  return false;
162 }
163 
164 /* Performs a check to ensure that option lens add up to total length specified in the fixed header
165  */
166 static inline bool IsHeaderLengthConsistentWithOptions(const GeneveHeader *geneve_hdr)
167 {
168  uint8_t *geneve_opt_ptr = (uint8_t *)geneve_hdr->options;
169  int remaining_hdr_len = GENEVE_TOTAL_OPT_LEN(geneve_hdr);
170 
171  while (remaining_hdr_len > 0) {
172  const GeneveOption *cur_opt = (const GeneveOption *)geneve_opt_ptr;
173  const uint8_t cur_option_len = GENEVE_SINGLE_OPT_TOTAL_LEN(cur_opt);
174 
175  geneve_opt_ptr += cur_option_len;
176  remaining_hdr_len -=
177  cur_option_len; /* cur_option_len will always be between 4-128, inclusive */
178  }
179 
180  return (remaining_hdr_len == 0);
181 }
182 
183 /** \param pkt payload data directly above UDP header
184  * \param len length in bytes of pkt
185  */
186 int DecodeGeneve(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
187 {
188  DEBUG_VALIDATE_BUG_ON(pkt == NULL);
189 
190  const GeneveHeader *geneve_hdr = (const GeneveHeader *)pkt;
191 
192  uint16_t eth_type, geneve_hdr_len;
193  int decode_tunnel_proto = DECODE_TUNNEL_UNSET;
194 
195  /* General Geneve packet validation */
196  if (unlikely(!g_geneve_enabled))
197  return TM_ECODE_FAILED;
198 
200  return TM_ECODE_FAILED;
201  if (!PacketIncreaseCheckLayers(p)) {
202  return TM_ECODE_FAILED;
203  }
204 
205  /* Specific Geneve header field validation */
206  geneve_hdr_len = GENEVE_TOTAL_HEADER_LEN(geneve_hdr);
207  if (len < geneve_hdr_len)
208  return TM_ECODE_FAILED;
209 
210  if (!IsValidGeneveVersion(geneve_hdr))
211  return TM_ECODE_FAILED;
212 
213  if (GENEVE_RESERVED_FLAGS(geneve_hdr) != 0 || geneve_hdr->res != 0)
214  return TM_ECODE_FAILED;
215 
216  if (!IsHeaderLengthConsistentWithOptions(geneve_hdr))
217  return TM_ECODE_FAILED;
218 
219 #if DEBUG
220  /* Print the VNI for debugging purposes */
221  uint32_t vni = (geneve_hdr->vni[0] << 16) + (geneve_hdr->vni[1] << 8) + (geneve_hdr->vni[2]);
222  SCLogDebug("Geneve vni %u", vni);
223 #endif
224 
225  /* Increment stats counter for Geneve packets */
227 
228  /* Determine first protocol encapsulated after Geneve header */
229  eth_type = SCNtohs(geneve_hdr->eth_type);
230  SCLogDebug("Geneve ethertype 0x%04x", eth_type);
231 
232  switch (eth_type) {
233  case ETHERNET_TYPE_IP:
234  SCLogDebug("Geneve found IPv4");
235  decode_tunnel_proto = DECODE_TUNNEL_IPV4;
236  break;
237  case ETHERNET_TYPE_IPV6:
238  SCLogDebug("Geneve found IPv6");
239  decode_tunnel_proto = DECODE_TUNNEL_IPV6;
240  break;
242  SCLogDebug("Geneve found Ethernet");
243  decode_tunnel_proto = DECODE_TUNNEL_ETHERNET;
244  break;
245  case ETHERNET_TYPE_ARP:
246  SCLogDebug("Geneve found ARP");
247  break;
248  default:
249  SCLogDebug(
250  "Geneve found unsupported Ethertype - expected IPv4, IPv6, ARP, or Ethernet");
252  }
253 
254  /* Set-up and process inner packet if it is a supported ethertype */
255  if (decode_tunnel_proto != DECODE_TUNNEL_UNSET) {
257  tv, dtv, p, pkt + geneve_hdr_len, len - geneve_hdr_len, decode_tunnel_proto);
258 
259  if (tp != NULL) {
262  }
263  }
264 
265  return TM_ECODE_OK;
266 }
267 
268 #ifdef UNITTESTS
269 
270 /**
271  * \test DecodeGeneveTest01 tests a good Geneve header with 16-bytes of options.
272  * Contains a Ethernet+IPv6 DHCP request packet.
273  */
274 static int DecodeGeneveTest01(void)
275 {
276  uint8_t raw_geneve[] = { 0x32, 0x10, 0x17, 0xc1, 0x00, 0xc1, 0x87, 0x51, /* UDP header */
277  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
278  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
279  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
280  0x33, 0x33, 0x00, 0x01, 0x00, 0x02, /* inner destination MAC */
281  0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, /* inner source MAC */
282  0x86, 0xdd, /* type is IPv6 0x86dd */
283  0x60, 0x00, 0x00, 0x00, 0x00, 0x6b, 0x11, 0x01, /* IPv6 hdr */
284  0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x27, 0xff, 0xfe, 0xfe, 0x8f,
285  0x95, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
286  0x00, 0x02, 0x02, 0x22, 0x02, 0x23, 0x00, 0x6b, 0x9c, 0xfb, /* UDP src port 546 */
287  0x03, 0x49, 0x17, 0x4e, 0x00, 0x01, 0x00, 0x0e, /* DHCP request payload */
288  0x00, 0x01, 0x00, 0x01, 0x1c, 0x39, 0xcf, 0x88, 0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, 0x00,
289  0x02, 0x00, 0x0e, 0x00, 0x01, 0x00, 0x01, 0x1c, 0x38, 0x25, 0xe8, 0x08, 0x00, 0x27, 0xd4,
290  0x10, 0xbb, 0x00, 0x06, 0x00, 0x04, 0x00, 0x17, 0x00, 0x18, 0x00, 0x08, 0x00, 0x02, 0x00,
291  0x00, 0x00, 0x19, 0x00, 0x29, 0x27, 0xfe, 0x8f, 0x95, 0x00, 0x00, 0x0e, 0x10, 0x00, 0x00,
292  0x15, 0x18, 0x00, 0x1a, 0x00, 0x19, 0x00, 0x00, 0x1c, 0x20, 0x00, 0x00, 0x1d, 0x4c, 0x40,
293  0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
294  0x00 };
295 
296  Packet *p = PacketGetFromAlloc();
297  FAIL_IF_NULL(p);
298  ThreadVars tv;
300 
301  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
302 
303  memset(&tv, 0, sizeof(ThreadVars));
304  memset(&dtv, 0, sizeof(DecodeThreadVars));
305 
307  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
308 
309  FAIL_IF(p->udph == NULL);
310  FAIL_IF(tv.decode_pq.top == NULL);
311 
313  FAIL_IF(tp->udph == NULL);
314  FAIL_IF_NOT(tp->sp == 546);
315 
316  FlowShutdown();
317  PacketFree(p);
318  PacketFree(tp);
319  PASS;
320 }
321 
322 /**
323  * \test DecodeGeneveTest02 tests a good Geneve header with 16-bytes of options.
324  * Contains a IPv4 DNS request packet.
325  */
326 static int DecodeGeneveTest02(void)
327 {
328  uint8_t raw_geneve[] = {
329  0x32, 0x10, 0x17, 0xc1, 0x00, 0x3c, 0x87, 0x51, /* UDP header */
330  0x04, 0x00, 0x08, 0x00, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
331  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
332  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
333  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
334  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
335  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
336  };
337 
338  Packet *p = PacketGetFromAlloc();
339  FAIL_IF_NULL(p);
340  ThreadVars tv;
342 
343  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
344 
345  memset(&tv, 0, sizeof(ThreadVars));
346  memset(&dtv, 0, sizeof(DecodeThreadVars));
347 
349  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
350 
351  FAIL_IF(p->udph == NULL);
352  FAIL_IF(tv.decode_pq.top == NULL);
353 
355  FAIL_IF(tp->udph == NULL);
356  FAIL_IF_NOT(tp->sp == 53);
357 
358  FlowShutdown();
359  PacketFree(p);
360  PacketFree(tp);
361  PASS;
362 }
363 
364 /**
365  * \test DecodeGeneveTest03 tests a good Geneve header with 16-bytes of options.
366  * Contains a IPv4 DNS request packet with a VLAN tag after the Ethernet frame.
367  * In practice, this probably won't be used but it should be support either way.
368  */
369 static int DecodeGeneveTest03(void)
370 {
371  uint8_t raw_geneve[] = {
372  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4e, 0x87, 0x51, /* UDP header */
373  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
374  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
375  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
376  0x33, 0x33, 0x00, 0x01, 0x00, 0x02, /* inner destination MAC */
377  0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, /* inner source MAC */
378  0x81, 0x00, 0x00, 0xad, /* 802.1Q VLAN tag */
379  0x08, 0x00, /* type is IPv4 0x0800 */
380  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
381  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
382  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
383  };
384 
385  Packet *p = PacketGetFromAlloc();
386  FAIL_IF_NULL(p);
387  ThreadVars tv;
389 
390  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
391 
392  memset(&tv, 0, sizeof(ThreadVars));
393  memset(&dtv, 0, sizeof(DecodeThreadVars));
394 
396  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
397 
398  FAIL_IF(p->udph == NULL);
399  FAIL_IF(tv.decode_pq.top == NULL);
400 
402  FAIL_IF(tp->udph == NULL);
403  FAIL_IF_NOT(tp->sp == 53);
404 
405  FlowShutdown();
406  PacketFree(p);
407  PacketFree(tp);
408  PASS;
409 }
410 
411 /**
412  * \test DecodeGeneveTest04 tests default port disabled by the config.
413  */
414 static int DecodeGeneveTest04(void)
415 {
416  uint8_t raw_geneve[] = {
417  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4a, 0x87, 0x51, /* UDP header */
418  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
419  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
420  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
421  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
422  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
423  0x08, 0x00, /* type is IPv4 0x0800 */
424  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
425  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
426  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
427  };
428 
429  Packet *p = PacketGetFromAlloc();
430  FAIL_IF_NULL(p);
431  ThreadVars tv;
433 
434  DecodeGeneveConfigPorts("1"); /* Set Suricata to use a non-default port for Geneve*/
435 
436  memset(&tv, 0, sizeof(ThreadVars));
437  memset(&dtv, 0, sizeof(DecodeThreadVars));
438 
440  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
441 
442  FAIL_IF(p->udph == NULL);
443  FAIL_IF(tv.decode_pq.top != NULL); /* Geneve packet should not have been processed */
444 
445  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S); /* Reset Geneve port list for future calls */
446  FlowShutdown();
447  PacketFree(p);
448  PASS;
449 }
450 
451 /**
452  * \test DecodeGeneveTest05 tests if Geneve header has inconsistent option len values.
453  */
454 static int DecodeGeneveTest05(void)
455 {
456  uint8_t raw_geneve[] = {
457  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4a, 0x87, 0x51, /* UDP header */
458  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
459  0x01, 0x08, 0x00, 0x04, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
460  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
461  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
462  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
463  0x08, 0x00, /* type is IPv4 0x0800 */
464  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
465  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
466  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
467  };
468 
469  Packet *p = PacketGetFromAlloc();
470  FAIL_IF_NULL(p);
471  ThreadVars tv;
473 
474  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
475 
476  memset(&tv, 0, sizeof(ThreadVars));
477  memset(&dtv, 0, sizeof(DecodeThreadVars));
478 
480  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
481 
482  FAIL_IF(p->udph == NULL);
483  FAIL_IF(tv.decode_pq.top != NULL); /* Geneve packet should not have been processed */
484 
485  FlowShutdown();
486  PacketFree(p);
487  PASS;
488 }
489 #endif /* UNITTESTS */
490 
492 {
493 #ifdef UNITTESTS
494  UtRegisterTest("DecodeGeneveTest01 -- Ethernet+IPv6 DHCP Request", DecodeGeneveTest01);
495  UtRegisterTest("DecodeGeneveTest02 -- IPv4 DNS Request", DecodeGeneveTest02);
496  UtRegisterTest("DecodeGeneveTest03 -- VLAN+IPv4 DNS Request", DecodeGeneveTest03);
497  UtRegisterTest("DecodeGeneveTest04 -- Non-standard port configuration", DecodeGeneveTest04);
498  UtRegisterTest("DecodeGeneveTest05 -- Inconsistent Geneve hdr option lens", DecodeGeneveTest05);
499 #endif /* UNITTESTS */
500 }
ETHERNET_TYPE_BRIDGE
#define ETHERNET_TYPE_BRIDGE
Definition: decode-ethernet.h:36
host.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
GeneveOption_::flags_plus_len
uint8_t flags_plus_len
Definition: decode-geneve.c:78
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:804
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:167
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
ConfNode_::val
char * val
Definition: conf.h:34
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
Definition: conf.c:473
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
GENEVE_UNKNOWN_PAYLOAD_TYPE
@ GENEVE_UNKNOWN_PAYLOAD_TYPE
Definition: decode-events.h:198
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:296
GENEVE_SINGLE_OPT_TOTAL_LEN
#define GENEVE_SINGLE_OPT_TOTAL_LEN(option_ptr)
Definition: decode-geneve.c:60
ETHERNET_TYPE_IPV6
#define ETHERNET_TYPE_IPV6
Definition: decode-ethernet.h:39
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:176
GENEVE_DEFAULT_PORT
#define GENEVE_DEFAULT_PORT
Definition: decode-geneve.c:65
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:83
GeneveHeader_::ver_plus_len
uint8_t ver_plus_len
Definition: decode-geneve.c:83
util-unittest.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:82
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1055
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:543
DecodeGeneveEnabledForPort
bool DecodeGeneveEnabledForPort(const uint16_t sp, const uint16_t dp)
Definition: decode-geneve.c:91
DetectPortParse
int DetectPortParse(const DetectEngineCtx *de_ctx, DetectPort **head, const char *str)
Function for parsing port strings.
Definition: detect-engine-port.c:1247
GeneveOption_::type
uint8_t type
Definition: decode-geneve.c:77
decode.h
DecodeGeneve
int DecodeGeneve(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-geneve.c:186
util-debug.h
VALID_GENEVE_VERSIONS
#define VALID_GENEVE_VERSIONS
Definition: decode-geneve.c:47
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:206
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
pkt-var.h
Packet_::sp
Port sp
Definition: decode.h:432
eth_type
uint16_t eth_type
Definition: decode-ethernet.h:2
GeneveHeader_::flags
uint8_t flags
Definition: decode-geneve.c:84
GENEVE_TOTAL_OPT_LEN
#define GENEVE_TOTAL_OPT_LEN(hdr_ptr)
Definition: decode-geneve.c:55
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:134
detect-engine-port.h
DetectPort_
Port structure for detection engine.
Definition: detect.h:180
util-profiling.h
Packet_
Definition: decode.h:425
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:803
GeneveOption_
Definition: decode-geneve.c:75
GeneveOption
struct GeneveOption_ GeneveOption
GeneveHeader_::options
GeneveOption options[0]
Definition: decode-geneve.c:88
DECODE_TUNNEL_ETHERNET
@ DECODE_TUNNEL_ETHERNET
Definition: decode.h:799
SC_ERR_INVALID_YAML_CONF_ENTRY
@ SC_ERR_INVALID_YAML_CONF_ENTRY
Definition: util-error.h:169
decode-events.h
Flow_::next
struct Flow_ * next
Definition: flow.h:407
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
GENEVE_MAX_PORTS
#define GENEVE_MAX_PORTS
Definition: decode-geneve.c:63
PKT_SRC_DECODER_GENEVE
@ PKT_SRC_DECODER_GENEVE
Definition: decode.h:65
GENEVE_UNSET_PORT
#define GENEVE_UNSET_PORT
Definition: decode-geneve.c:64
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:167
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
GENEVE_DEFAULT_PORT_S
#define GENEVE_DEFAULT_PORT_S
Definition: decode-geneve.c:66
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:403
suricata-common.h
PacketQueueNoLock_::top
struct Packet_ * top
Definition: packet-queue.h:35
GENEVE_TOTAL_HEADER_LEN
#define GENEVE_TOTAL_HEADER_LEN(hdr_ptr)
Definition: decode-geneve.c:56
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:690
GeneveHeader_
Definition: decode-geneve.c:82
GeneveHeader_::eth_type
uint16_t eth_type
Definition: decode-geneve.c:85
GeneveOption_::option_class
uint16_t option_class
Definition: decode-geneve.c:76
decode-geneve.h
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:173
GENEVE_RESERVED_FLAGS
#define GENEVE_RESERVED_FLAGS(hdr_ptr)
Definition: decode-geneve.c:52
GeneveHeader
struct GeneveHeader_ GeneveHeader
head
Flow * head
Definition: flow-hash.h:1
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:242
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:659
ConfNode_
Definition: conf.h:32
DecodeThreadVars_::counter_geneve
uint16_t counter_geneve
Definition: decode.h:688
ETHERNET_TYPE_ARP
#define ETHERNET_TYPE_ARP
Definition: decode-ethernet.h:35
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:111
GeneveHeader_::vni
uint8_t vni[3]
Definition: decode-geneve.c:86
Packet_::udph
UDPHdr * udph
Definition: decode.h:549
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:888
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:40
DecodeGeneveConfig
void DecodeGeneveConfig(void)
Definition: decode-geneve.c:129
GENEVE_VERSION
#define GENEVE_VERSION(hdr_ptr)
Definition: decode-geneve.c:51
GENEVE_MIN_HEADER_LEN
#define GENEVE_MIN_HEADER_LEN
Definition: decode-geneve.c:54
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:308
flow.h
DecodeGeneveRegisterTests
void DecodeGeneveRegisterTests(void)
Definition: decode-geneve.c:491
ETHERNET_TYPE_IP
#define ETHERNET_TYPE_IP
Definition: decode-ethernet.h:34
DetectPortCleanupList
void DetectPortCleanupList(const DetectEngineCtx *de_ctx, DetectPort *head)
Free a DetectPort list and each of its members.
Definition: detect-engine-port.c:121
DECODE_TUNNEL_UNSET
@ DECODE_TUNNEL_UNSET
Definition: decode.h:808
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
GeneveHeader_::res
uint8_t res
Definition: decode-geneve.c:87
GeneveOption_::option_data
uint8_t option_data[0]
Definition: decode-geneve.c:79