suricata
decode-geneve.c
Go to the documentation of this file.
1 /* Copyright (C) 2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Ali Jad Khalil <jadkhal@amazon.com>
22  *
23  * Geneve tunneling scheme decoder.
24  *
25  * This implementation is based on the following specification doc:
26  * https://tools.ietf.org/html/draft-ietf-nvo3-geneve-16#section-3
27  */
28 
29 #include "suricata-common.h"
30 #include "decode.h"
31 #include "decode-geneve.h"
32 #include "decode-events.h"
33 
34 #include "detect-engine-port.h"
35 
36 #include "flow.h"
37 
38 #include "util-unittest.h"
39 #include "util-debug.h"
40 
41 #include "pkt-var.h"
42 #include "util-profiling.h"
43 #include "host.h"
44 
45 #define VALID_GENEVE_VERSIONS \
46  { \
47  0 \
48  }
49 #define GENEVE_VERSION(hdr_ptr) (hdr_ptr->ver_plus_len >> 6)
50 #define GENEVE_RESERVED_FLAGS(hdr_ptr) (hdr_ptr->flags & 0x3F)
51 
52 #define GENEVE_MIN_HEADER_LEN sizeof(GeneveHeader)
53 #define GENEVE_TOTAL_OPT_LEN(hdr_ptr) ((hdr_ptr->ver_plus_len & 0x3F) << 2)
54 #define GENEVE_TOTAL_HEADER_LEN(hdr_ptr) (GENEVE_MIN_HEADER_LEN + GENEVE_TOTAL_OPT_LEN(hdr_ptr))
55 
56 #define GENEVE_MIN_SINGLE_OPT_LEN sizeof(GeneveOption)
57 #define GENEVE_SINGLE_OPT_LEN(option_ptr) ((option_ptr->flags_plus_len & 0x1F) << 2)
58 #define GENEVE_SINGLE_OPT_TOTAL_LEN(option_ptr) \
59  (GENEVE_MIN_SINGLE_OPT_LEN + GENEVE_SINGLE_OPT_LEN(option_ptr))
60 
61 #define GENEVE_MAX_PORTS 4
62 #define GENEVE_UNSET_PORT -1
63 #define GENEVE_DEFAULT_PORT 6081
64 #define GENEVE_DEFAULT_PORT_S "6081"
65 
66 static bool g_geneve_enabled = true;
67 static int g_geneve_ports_idx = 0;
68 static int g_geneve_ports[GENEVE_MAX_PORTS] = { GENEVE_DEFAULT_PORT, GENEVE_UNSET_PORT,
70 
71 /* Geneve structs based on diagrams from the following specification doc:
72  * https://tools.ietf.org/html/draft-ietf-nvo3-geneve-16#section-3 */
73 typedef struct GeneveOption_ {
74  uint16_t option_class;
75  uint8_t type;
76  uint8_t flags_plus_len;
77  uint8_t option_data[0];
79 
80 typedef struct GeneveHeader_ {
81  uint8_t ver_plus_len;
82  uint8_t flags;
83  uint16_t eth_type;
84  uint8_t vni[3];
85  uint8_t res;
88 
89 bool DecodeGeneveEnabledForPort(const uint16_t sp, const uint16_t dp)
90 {
91  SCLogDebug("ports %u->%u ports %d %d %d %d", sp, dp, g_geneve_ports[0], g_geneve_ports[1],
92  g_geneve_ports[2], g_geneve_ports[3]);
93 
94  if (g_geneve_enabled) {
95  for (int i = 0; i < g_geneve_ports_idx; i++) {
96  if (g_geneve_ports[i] == GENEVE_UNSET_PORT)
97  return false;
98 
99  const int port = g_geneve_ports[i];
100  if (port == (const int)sp || port == (const int)dp)
101  return true;
102  }
103  }
104  return false;
105 }
106 
107 static void DecodeGeneveConfigPorts(const char *pstr)
108 {
109  SCLogDebug("parsing \'%s\'", pstr);
110 
111  DetectPort *head = NULL;
112  DetectPortParse(NULL, &head, pstr);
113 
114  g_geneve_ports_idx = 0;
115  for (DetectPort *p = head; p != NULL; p = p->next) {
116  if (g_geneve_ports_idx >= GENEVE_MAX_PORTS) {
117  SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY, "more than %d Geneve ports defined",
119  break;
120  }
121  g_geneve_ports[g_geneve_ports_idx++] = (int)p->port;
122  }
123 
125 }
126 
128 {
129  int enabled = 0;
130  if (ConfGetBool("decoder.geneve.enabled", &enabled) == 1) {
131  if (enabled) {
132  g_geneve_enabled = true;
133  } else {
134  g_geneve_enabled = false;
135  }
136  }
137 
138  if (g_geneve_enabled) {
139  ConfNode *node = ConfGetNode("decoder.geneve.ports");
140  if (node && node->val) {
141  DecodeGeneveConfigPorts(node->val);
142  } else {
143  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
144  }
145  }
146 }
147 
148 static inline bool IsValidGeneveVersion(const GeneveHeader *geneve_hdr)
149 {
150  const int valid_verisons[] = VALID_GENEVE_VERSIONS;
151  const int num_versions = sizeof(valid_verisons) / sizeof(int);
152  const uint8_t cur_version = GENEVE_VERSION(geneve_hdr);
153 
154  for (int i = 0; i < num_versions; i++) {
155  if (valid_verisons[i] == cur_version)
156  return true;
157  }
158 
159  return false;
160 }
161 
162 /* Performs a check to ensure that option lens add up to total length specified in the fixed header
163  */
164 static inline bool IsHeaderLengthConsistentWithOptions(const GeneveHeader *geneve_hdr)
165 {
166  uint8_t *geneve_opt_ptr = (uint8_t *)geneve_hdr->options;
167  int remaining_hdr_len = GENEVE_TOTAL_OPT_LEN(geneve_hdr);
168 
169  while (remaining_hdr_len > 0) {
170  const GeneveOption *cur_opt = (const GeneveOption *)geneve_opt_ptr;
171  const uint8_t cur_option_len = GENEVE_SINGLE_OPT_TOTAL_LEN(cur_opt);
172 
173  geneve_opt_ptr += cur_option_len;
174  remaining_hdr_len -=
175  cur_option_len; /* cur_option_len will always be between 4-128, inclusive */
176  }
177 
178  return (remaining_hdr_len == 0);
179 }
180 
181 /** \param pkt payload data directly above UDP header
182  * \param len length in bytes of pkt
183  */
184 int DecodeGeneve(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
185 {
186  const GeneveHeader *geneve_hdr = (const GeneveHeader *)pkt;
187 
188  uint16_t eth_type, geneve_hdr_len;
189  int decode_tunnel_proto = DECODE_TUNNEL_UNSET;
190 
191  /* General Geneve packet validation */
192  if (unlikely(!g_geneve_enabled))
193  return TM_ECODE_FAILED;
194 
196  return TM_ECODE_FAILED;
197 
198  /* Specific Geneve header field validation */
199  geneve_hdr_len = GENEVE_TOTAL_HEADER_LEN(geneve_hdr);
200  if (len < geneve_hdr_len)
201  return TM_ECODE_FAILED;
202 
203  if (!IsValidGeneveVersion(geneve_hdr))
204  return TM_ECODE_FAILED;
205 
206  if (GENEVE_RESERVED_FLAGS(geneve_hdr) != 0 || geneve_hdr->res != 0)
207  return TM_ECODE_FAILED;
208 
209  if (!IsHeaderLengthConsistentWithOptions(geneve_hdr))
210  return TM_ECODE_FAILED;
211 
212 #if DEBUG
213  /* Print the VNI for debugging purposes */
214  uint32_t vni = (geneve_hdr->vni[0] << 16) + (geneve_hdr->vni[1] << 8) + (geneve_hdr->vni[2]);
215  SCLogDebug("Geneve vni %u", vni);
216 #endif
217 
218  /* Increment stats counter for Geneve packets */
220 
221  /* Determine first protocol encapsulated after Geneve header */
222  eth_type = SCNtohs(geneve_hdr->eth_type);
223  SCLogDebug("Geneve ethertype 0x%04x", eth_type);
224 
225  switch (eth_type) {
226  case ETHERNET_TYPE_IP:
227  SCLogDebug("Geneve found IPv4");
228  decode_tunnel_proto = DECODE_TUNNEL_IPV4;
229  break;
230  case ETHERNET_TYPE_IPV6:
231  SCLogDebug("Geneve found IPv6");
232  decode_tunnel_proto = DECODE_TUNNEL_IPV6;
233  break;
235  SCLogDebug("Geneve found Ethernet");
236  decode_tunnel_proto = DECODE_TUNNEL_ETHERNET;
237  break;
238  case ETHERNET_TYPE_ARP:
239  SCLogDebug("Geneve found ARP");
240  break;
241  default:
242  SCLogDebug(
243  "Geneve found unsupported Ethertype - expected IPv4, IPv6, ARP, or Ethernet");
245  }
246 
247  /* Set-up and process inner packet if it is a supported ethertype */
248  if (decode_tunnel_proto != DECODE_TUNNEL_UNSET) {
250  tv, dtv, p, pkt + geneve_hdr_len, len - geneve_hdr_len, decode_tunnel_proto);
251 
252  if (tp != NULL) {
255  }
256  }
257 
258  return TM_ECODE_OK;
259 }
260 
261 #ifdef UNITTESTS
262 
263 /**
264  * \test DecodeGeneveTest01 tests a good Geneve header with 16-bytes of options.
265  * Contains a Ethernet+IPv6 DHCP request packet.
266  */
267 static int DecodeGeneveTest01(void)
268 {
269  uint8_t raw_geneve[] = { 0x32, 0x10, 0x17, 0xc1, 0x00, 0xc1, 0x87, 0x51, /* UDP header */
270  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
271  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
272  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
273  0x33, 0x33, 0x00, 0x01, 0x00, 0x02, /* inner destination MAC */
274  0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, /* inner source MAC */
275  0x86, 0xdd, /* type is IPv6 0x86dd */
276  0x60, 0x00, 0x00, 0x00, 0x00, 0x6b, 0x11, 0x01, /* IPv6 hdr */
277  0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x27, 0xff, 0xfe, 0xfe, 0x8f,
278  0x95, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
279  0x00, 0x02, 0x02, 0x22, 0x02, 0x23, 0x00, 0x6b, 0x9c, 0xfb, /* UDP src port 546 */
280  0x03, 0x49, 0x17, 0x4e, 0x00, 0x01, 0x00, 0x0e, /* DHCP request payload */
281  0x00, 0x01, 0x00, 0x01, 0x1c, 0x39, 0xcf, 0x88, 0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, 0x00,
282  0x02, 0x00, 0x0e, 0x00, 0x01, 0x00, 0x01, 0x1c, 0x38, 0x25, 0xe8, 0x08, 0x00, 0x27, 0xd4,
283  0x10, 0xbb, 0x00, 0x06, 0x00, 0x04, 0x00, 0x17, 0x00, 0x18, 0x00, 0x08, 0x00, 0x02, 0x00,
284  0x00, 0x00, 0x19, 0x00, 0x29, 0x27, 0xfe, 0x8f, 0x95, 0x00, 0x00, 0x0e, 0x10, 0x00, 0x00,
285  0x15, 0x18, 0x00, 0x1a, 0x00, 0x19, 0x00, 0x00, 0x1c, 0x20, 0x00, 0x00, 0x1d, 0x4c, 0x40,
286  0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
287  0x00 };
288 
289  Packet *p = PacketGetFromAlloc();
290  FAIL_IF_NULL(p);
291  ThreadVars tv;
293 
294  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
295 
296  memset(&tv, 0, sizeof(ThreadVars));
297  memset(p, 0, SIZE_OF_PACKET);
298  memset(&dtv, 0, sizeof(DecodeThreadVars));
299 
301  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
302 
303  FAIL_IF(p->udph == NULL);
304  FAIL_IF(tv.decode_pq.top == NULL);
305 
307  FAIL_IF(tp->udph == NULL);
308  FAIL_IF_NOT(tp->sp == 546);
309 
310  FlowShutdown();
311  PacketFree(p);
312  PacketFree(tp);
313  PASS;
314 }
315 
316 /**
317  * \test DecodeGeneveTest02 tests a good Geneve header with 16-bytes of options.
318  * Contains a IPv4 DNS request packet.
319  */
320 static int DecodeGeneveTest02(void)
321 {
322  uint8_t raw_geneve[] = {
323  0x32, 0x10, 0x17, 0xc1, 0x00, 0x3c, 0x87, 0x51, /* UDP header */
324  0x04, 0x00, 0x08, 0x00, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
325  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
326  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
327  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
328  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
329  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
330  };
331 
332  Packet *p = PacketGetFromAlloc();
333  FAIL_IF_NULL(p);
334  ThreadVars tv;
336 
337  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
338 
339  memset(&tv, 0, sizeof(ThreadVars));
340  memset(p, 0, SIZE_OF_PACKET);
341  memset(&dtv, 0, sizeof(DecodeThreadVars));
342 
344  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
345 
346  FAIL_IF(p->udph == NULL);
347  FAIL_IF(tv.decode_pq.top == NULL);
348 
350  FAIL_IF(tp->udph == NULL);
351  FAIL_IF_NOT(tp->sp == 53);
352 
353  FlowShutdown();
354  PacketFree(p);
355  PacketFree(tp);
356  PASS;
357 }
358 
359 /**
360  * \test DecodeGeneveTest03 tests a good Geneve header with 16-bytes of options.
361  * Contains a IPv4 DNS request packet with a VLAN tag after the Ethernet frame.
362  * In practice, this probably won't be used but it should be support either way.
363  */
364 static int DecodeGeneveTest03(void)
365 {
366  uint8_t raw_geneve[] = {
367  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4e, 0x87, 0x51, /* UDP header */
368  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
369  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
370  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
371  0x33, 0x33, 0x00, 0x01, 0x00, 0x02, /* inner destination MAC */
372  0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, /* inner source MAC */
373  0x81, 0x00, 0x00, 0xad, /* 802.1Q VLAN tag */
374  0x08, 0x00, /* type is IPv4 0x0800 */
375  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
376  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
377  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
378  };
379 
380  Packet *p = PacketGetFromAlloc();
381  FAIL_IF_NULL(p);
382  ThreadVars tv;
384 
385  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
386 
387  memset(&tv, 0, sizeof(ThreadVars));
388  memset(p, 0, SIZE_OF_PACKET);
389  memset(&dtv, 0, sizeof(DecodeThreadVars));
390 
392  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
393 
394  FAIL_IF(p->udph == NULL);
395  FAIL_IF(tv.decode_pq.top == NULL);
396 
398  FAIL_IF(tp->udph == NULL);
399  FAIL_IF_NOT(tp->sp == 53);
400 
401  FlowShutdown();
402  PacketFree(p);
403  PacketFree(tp);
404  PASS;
405 }
406 
407 /**
408  * \test DecodeGeneveTest04 tests default port disabled by the config.
409  */
410 static int DecodeGeneveTest04(void)
411 {
412  uint8_t raw_geneve[] = {
413  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4a, 0x87, 0x51, /* UDP header */
414  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
415  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
416  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
417  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
418  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
419  0x08, 0x00, /* type is IPv4 0x0800 */
420  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
421  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
422  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
423  };
424 
425  Packet *p = PacketGetFromAlloc();
426  FAIL_IF_NULL(p);
427  ThreadVars tv;
429 
430  DecodeGeneveConfigPorts("1"); /* Set Suricata to use a non-default port for Geneve*/
431 
432  memset(&tv, 0, sizeof(ThreadVars));
433  memset(p, 0, SIZE_OF_PACKET);
434  memset(&dtv, 0, sizeof(DecodeThreadVars));
435 
437  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
438 
439  FAIL_IF(p->udph == NULL);
440  FAIL_IF(tv.decode_pq.top != NULL); /* Geneve packet should not have been processed */
441 
442  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S); /* Reset Geneve port list for future calls */
443  FlowShutdown();
444  PacketFree(p);
445  PASS;
446 }
447 
448 /**
449  * \test DecodeGeneveTest05 tests if Geneve header has inconsistent option len values.
450  */
451 static int DecodeGeneveTest05(void)
452 {
453  uint8_t raw_geneve[] = {
454  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4a, 0x87, 0x51, /* UDP header */
455  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
456  0x01, 0x08, 0x00, 0x04, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
457  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
458  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
459  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
460  0x08, 0x00, /* type is IPv4 0x0800 */
461  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
462  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
463  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
464  };
465 
466  Packet *p = PacketGetFromAlloc();
467  FAIL_IF_NULL(p);
468  ThreadVars tv;
470 
471  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
472 
473  memset(&tv, 0, sizeof(ThreadVars));
474  memset(p, 0, SIZE_OF_PACKET);
475  memset(&dtv, 0, sizeof(DecodeThreadVars));
476 
478  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
479 
480  FAIL_IF(p->udph == NULL);
481  FAIL_IF(tv.decode_pq.top != NULL); /* Geneve packet should not have been processed */
482 
483  FlowShutdown();
484  PacketFree(p);
485  PASS;
486 }
487 #endif /* UNITTESTS */
488 
490 {
491 #ifdef UNITTESTS
492  UtRegisterTest("DecodeGeneveTest01 -- Ethernet+IPv6 DHCP Request", DecodeGeneveTest01);
493  UtRegisterTest("DecodeGeneveTest02 -- IPv4 DNS Request", DecodeGeneveTest02);
494  UtRegisterTest("DecodeGeneveTest03 -- VLAN+IPv4 DNS Request", DecodeGeneveTest03);
495  UtRegisterTest("DecodeGeneveTest04 -- Non-standard port configuration", DecodeGeneveTest04);
496  UtRegisterTest("DecodeGeneveTest05 -- Inconsistent Geneve hdr option lens", DecodeGeneveTest05);
497 #endif /* UNITTESTS */
498 }
ETHERNET_TYPE_BRIDGE
#define ETHERNET_TYPE_BRIDGE
Definition: decode-ethernet.h:36
host.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
GeneveOption_::flags_plus_len
uint8_t flags_plus_len
Definition: decode-geneve.c:76
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:908
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
ConfNode_::val
char * val
Definition: conf.h:34
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
Definition: conf.c:516
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
GENEVE_SINGLE_OPT_TOTAL_LEN
#define GENEVE_SINGLE_OPT_TOTAL_LEN(option_ptr)
Definition: decode-geneve.c:58
ETHERNET_TYPE_IPV6
#define ETHERNET_TYPE_IPV6
Definition: decode-ethernet.h:39
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:175
FlowInitConfig
void FlowInitConfig(char quiet)
initialize the configuration
Definition: flow.c:516
GENEVE_DEFAULT_PORT
#define GENEVE_DEFAULT_PORT
Definition: decode-geneve.c:63
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
GeneveHeader_::ver_plus_len
uint8_t ver_plus_len
Definition: decode-geneve.c:81
util-unittest.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1150
DecodeGeneveEnabledForPort
bool DecodeGeneveEnabledForPort(const uint16_t sp, const uint16_t dp)
Definition: decode-geneve.c:89
DetectPortParse
int DetectPortParse(const DetectEngineCtx *de_ctx, DetectPort **head, const char *str)
Function for parsing port strings.
Definition: detect-engine-port.c:1243
GeneveOption_::type
uint8_t type
Definition: decode-geneve.c:75
decode.h
DecodeGeneve
int DecodeGeneve(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-geneve.c:184
util-debug.h
VALID_GENEVE_VERSIONS
#define VALID_GENEVE_VERSIONS
Definition: decode-geneve.c:45
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:206
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
pkt-var.h
Packet_::sp
Port sp
Definition: decode.h:421
eth_type
uint16_t eth_type
Definition: decode-ethernet.h:2
GeneveHeader_::flags
uint8_t flags
Definition: decode-geneve.c:82
GENEVE_TOTAL_OPT_LEN
#define GENEVE_TOTAL_OPT_LEN(hdr_ptr)
Definition: decode-geneve.c:53
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:105
detect-engine-port.h
SIZE_OF_PACKET
#define SIZE_OF_PACKET
Definition: decode.h:627
DetectPort_
Port structure for detection engine.
Definition: detect.h:191
util-profiling.h
Packet_
Definition: decode.h:414
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:907
GeneveOption_
Definition: decode-geneve.c:73
GeneveOption
struct GeneveOption_ GeneveOption
GeneveHeader_::options
GeneveOption options[0]
Definition: decode-geneve.c:86
DECODE_TUNNEL_ETHERNET
@ DECODE_TUNNEL_ETHERNET
Definition: decode.h:903
SC_ERR_INVALID_YAML_CONF_ENTRY
@ SC_ERR_INVALID_YAML_CONF_ENTRY
Definition: util-error.h:169
decode-events.h
Flow_::next
struct Flow_ * next
Definition: flow.h:394
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
GENEVE_MAX_PORTS
#define GENEVE_MAX_PORTS
Definition: decode-geneve.c:61
PKT_SRC_DECODER_GENEVE
@ PKT_SRC_DECODER_GENEVE
Definition: decode.h:62
GENEVE_UNSET_PORT
#define GENEVE_UNSET_PORT
Definition: decode-geneve.c:62
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:167
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
GENEVE_DEFAULT_PORT_S
#define GENEVE_DEFAULT_PORT_S
Definition: decode-geneve.c:64
GENEVE_UNKNOWN_PAYLOAD_TYPE
@ GENEVE_UNKNOWN_PAYLOAD_TYPE
Definition: decode-events.h:190
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:398
suricata-common.h
PacketQueueNoLock_::top
struct Packet_ * top
Definition: packet-queue.h:33
GENEVE_TOTAL_HEADER_LEN
#define GENEVE_TOTAL_HEADER_LEN(hdr_ptr)
Definition: decode-geneve.c:54
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:644
GeneveHeader_
Definition: decode-geneve.c:80
GeneveHeader_::eth_type
uint16_t eth_type
Definition: decode-geneve.c:83
GeneveOption_::option_class
uint16_t option_class
Definition: decode-geneve.c:74
decode-geneve.h
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:144
GENEVE_RESERVED_FLAGS
#define GENEVE_RESERVED_FLAGS(hdr_ptr)
Definition: decode-geneve.c:50
GeneveHeader
struct GeneveHeader_ GeneveHeader
head
Flow * head
Definition: flow-hash.h:1
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:631
ConfNode_
Definition: conf.h:32
DecodeThreadVars_::counter_geneve
uint16_t counter_geneve
Definition: decode.h:659
ETHERNET_TYPE_ARP
#define ETHERNET_TYPE_ARP
Definition: decode-ethernet.h:35
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:110
GeneveHeader_::vni
uint8_t vni[3]
Definition: decode-geneve.c:84
Packet_::udph
UDPHdr * udph
Definition: decode.h:533
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1011
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:39
DecodeGeneveConfig
void DecodeGeneveConfig(void)
Definition: decode-geneve.c:127
GENEVE_VERSION
#define GENEVE_VERSION(hdr_ptr)
Definition: decode-geneve.c:49
GENEVE_MIN_HEADER_LEN
#define GENEVE_MIN_HEADER_LEN
Definition: decode-geneve.c:52
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:278
flow.h
DecodeGeneveRegisterTests
void DecodeGeneveRegisterTests(void)
Definition: decode-geneve.c:489
ETHERNET_TYPE_IP
#define ETHERNET_TYPE_IP
Definition: decode-ethernet.h:34
DetectPortCleanupList
void DetectPortCleanupList(const DetectEngineCtx *de_ctx, DetectPort *head)
Free a DetectPort list and each of its members.
Definition: detect-engine-port.c:121
DECODE_TUNNEL_UNSET
@ DECODE_TUNNEL_UNSET
Definition: decode.h:911
GeneveHeader_::res
uint8_t res
Definition: decode-geneve.c:85
GeneveOption_::option_data
uint8_t option_data[0]
Definition: decode-geneve.c:77