suricata
decode-geneve.c
Go to the documentation of this file.
1 /* Copyright (C) 2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Ali Jad Khalil <jadkhal@amazon.com>
22  *
23  * Geneve tunneling scheme decoder.
24  *
25  * This implementation is based on the following specification doc:
26  * https://tools.ietf.org/html/draft-ietf-nvo3-geneve-16#section-3
27  */
28 
29 #include "suricata-common.h"
30 #include "decode.h"
31 #include "decode-geneve.h"
32 #include "decode-events.h"
33 
34 #include "detect-engine-port.h"
35 
36 #include "flow.h"
37 
38 #include "util-unittest.h"
39 #include "util-debug.h"
40 
41 #include "pkt-var.h"
42 #include "util-profiling.h"
43 #include "host.h"
44 
45 #define VALID_GENEVE_VERSIONS \
46  { \
47  0 \
48  }
49 #define GENEVE_VERSION(hdr_ptr) (hdr_ptr->ver_plus_len >> 6)
50 #define GENEVE_RESERVED_FLAGS(hdr_ptr) (hdr_ptr->flags & 0x3F)
51 
52 #define GENEVE_MIN_HEADER_LEN sizeof(GeneveHeader)
53 #define GENEVE_TOTAL_OPT_LEN(hdr_ptr) ((hdr_ptr->ver_plus_len & 0x3F) << 2)
54 #define GENEVE_TOTAL_HEADER_LEN(hdr_ptr) (GENEVE_MIN_HEADER_LEN + GENEVE_TOTAL_OPT_LEN(hdr_ptr))
55 
56 #define GENEVE_MIN_SINGLE_OPT_LEN sizeof(GeneveOption)
57 #define GENEVE_SINGLE_OPT_LEN(option_ptr) ((option_ptr->flags_plus_len & 0x1F) << 2)
58 #define GENEVE_SINGLE_OPT_TOTAL_LEN(option_ptr) \
59  (GENEVE_MIN_SINGLE_OPT_LEN + GENEVE_SINGLE_OPT_LEN(option_ptr))
60 
61 #define GENEVE_MAX_PORTS 4
62 #define GENEVE_UNSET_PORT -1
63 #define GENEVE_DEFAULT_PORT 6081
64 #define GENEVE_DEFAULT_PORT_S "6081"
65 
66 static bool g_geneve_enabled = true;
67 static int g_geneve_ports_idx = 0;
68 static int g_geneve_ports[GENEVE_MAX_PORTS] = { GENEVE_DEFAULT_PORT, GENEVE_UNSET_PORT,
70 
71 /* Geneve structs based on diagrams from the following specification doc:
72  * https://tools.ietf.org/html/draft-ietf-nvo3-geneve-16#section-3 */
73 typedef struct GeneveOption_ {
74  uint16_t option_class;
75  uint8_t type;
76  uint8_t flags_plus_len;
77  uint8_t option_data[0];
79 
80 typedef struct GeneveHeader_ {
81  uint8_t ver_plus_len;
82  uint8_t flags;
83  uint16_t eth_type;
84  uint8_t vni[3];
85  uint8_t res;
88 
89 bool DecodeGeneveEnabledForPort(const uint16_t sp, const uint16_t dp)
90 {
91  SCLogDebug("ports %u->%u ports %d %d %d %d", sp, dp, g_geneve_ports[0], g_geneve_ports[1],
92  g_geneve_ports[2], g_geneve_ports[3]);
93 
94  if (g_geneve_enabled) {
95  for (int i = 0; i < g_geneve_ports_idx; i++) {
96  if (g_geneve_ports[i] == GENEVE_UNSET_PORT)
97  return false;
98 
99  const int port = g_geneve_ports[i];
100  if (port == (const int)sp || port == (const int)dp)
101  return true;
102  }
103  }
104  return false;
105 }
106 
107 static void DecodeGeneveConfigPorts(const char *pstr)
108 {
109  SCLogDebug("parsing \'%s\'", pstr);
110 
111  DetectPort *head = NULL;
112  DetectPortParse(NULL, &head, pstr);
113 
114  g_geneve_ports_idx = 0;
115  for (DetectPort *p = head; p != NULL; p = p->next) {
116  if (g_geneve_ports_idx >= GENEVE_MAX_PORTS) {
117  SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY, "more than %d Geneve ports defined",
119  break;
120  }
121  g_geneve_ports[g_geneve_ports_idx++] = (int)p->port;
122  }
123 
125 }
126 
128 {
129  int enabled = 0;
130  if (ConfGetBool("decoder.geneve.enabled", &enabled) == 1) {
131  if (enabled) {
132  g_geneve_enabled = true;
133  } else {
134  g_geneve_enabled = false;
135  }
136  }
137 
138  if (g_geneve_enabled) {
139  ConfNode *node = ConfGetNode("decoder.geneve.ports");
140  if (node && node->val) {
141  DecodeGeneveConfigPorts(node->val);
142  } else {
143  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
144  }
145  }
146 }
147 
148 static inline bool IsValidGeneveVersion(const GeneveHeader *geneve_hdr)
149 {
150  const int valid_verisons[] = VALID_GENEVE_VERSIONS;
151  const int num_versions = sizeof(valid_verisons) / sizeof(int);
152  const uint8_t cur_version = GENEVE_VERSION(geneve_hdr);
153 
154  for (int i = 0; i < num_versions; i++) {
155  if (valid_verisons[i] == cur_version)
156  return true;
157  }
158 
159  return false;
160 }
161 
162 /* Performs a check to ensure that option lens add up to total length specified in the fixed header
163  */
164 static inline bool IsHeaderLengthConsistentWithOptions(const GeneveHeader *geneve_hdr)
165 {
166  uint8_t *geneve_opt_ptr = (uint8_t *)geneve_hdr->options;
167  int remaining_hdr_len = GENEVE_TOTAL_OPT_LEN(geneve_hdr);
168 
169  while (remaining_hdr_len > 0) {
170  const GeneveOption *cur_opt = (const GeneveOption *)geneve_opt_ptr;
171  const uint8_t cur_option_len = GENEVE_SINGLE_OPT_TOTAL_LEN(cur_opt);
172 
173  geneve_opt_ptr += cur_option_len;
174  remaining_hdr_len -=
175  cur_option_len; /* cur_option_len will always be between 4-128, inclusive */
176  }
177 
178  return (remaining_hdr_len == 0);
179 }
180 
181 /** \param pkt payload data directly above UDP header
182  * \param len length in bytes of pkt
183  */
184 int DecodeGeneve(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
185 {
186  const GeneveHeader *geneve_hdr = (const GeneveHeader *)pkt;
187 
188  uint16_t eth_type, geneve_hdr_len;
189  int decode_tunnel_proto = DECODE_TUNNEL_UNSET;
190 
191  /* General Geneve packet validation */
192  if (unlikely(!g_geneve_enabled))
193  return TM_ECODE_FAILED;
194 
196  return TM_ECODE_FAILED;
197  if (!PacketIncreaseCheckLayers(p)) {
198  return TM_ECODE_FAILED;
199  }
200 
201  /* Specific Geneve header field validation */
202  geneve_hdr_len = GENEVE_TOTAL_HEADER_LEN(geneve_hdr);
203  if (len < geneve_hdr_len)
204  return TM_ECODE_FAILED;
205 
206  if (!IsValidGeneveVersion(geneve_hdr))
207  return TM_ECODE_FAILED;
208 
209  if (GENEVE_RESERVED_FLAGS(geneve_hdr) != 0 || geneve_hdr->res != 0)
210  return TM_ECODE_FAILED;
211 
212  if (!IsHeaderLengthConsistentWithOptions(geneve_hdr))
213  return TM_ECODE_FAILED;
214 
215 #if DEBUG
216  /* Print the VNI for debugging purposes */
217  uint32_t vni = (geneve_hdr->vni[0] << 16) + (geneve_hdr->vni[1] << 8) + (geneve_hdr->vni[2]);
218  SCLogDebug("Geneve vni %u", vni);
219 #endif
220 
221  /* Increment stats counter for Geneve packets */
223 
224  /* Determine first protocol encapsulated after Geneve header */
225  eth_type = SCNtohs(geneve_hdr->eth_type);
226  SCLogDebug("Geneve ethertype 0x%04x", eth_type);
227 
228  switch (eth_type) {
229  case ETHERNET_TYPE_IP:
230  SCLogDebug("Geneve found IPv4");
231  decode_tunnel_proto = DECODE_TUNNEL_IPV4;
232  break;
233  case ETHERNET_TYPE_IPV6:
234  SCLogDebug("Geneve found IPv6");
235  decode_tunnel_proto = DECODE_TUNNEL_IPV6;
236  break;
238  SCLogDebug("Geneve found Ethernet");
239  decode_tunnel_proto = DECODE_TUNNEL_ETHERNET;
240  break;
241  case ETHERNET_TYPE_ARP:
242  SCLogDebug("Geneve found ARP");
243  break;
244  default:
245  SCLogDebug(
246  "Geneve found unsupported Ethertype - expected IPv4, IPv6, ARP, or Ethernet");
248  }
249 
250  /* Set-up and process inner packet if it is a supported ethertype */
251  if (decode_tunnel_proto != DECODE_TUNNEL_UNSET) {
253  tv, dtv, p, pkt + geneve_hdr_len, len - geneve_hdr_len, decode_tunnel_proto);
254 
255  if (tp != NULL) {
258  }
259  }
260 
261  return TM_ECODE_OK;
262 }
263 
264 #ifdef UNITTESTS
265 
266 /**
267  * \test DecodeGeneveTest01 tests a good Geneve header with 16-bytes of options.
268  * Contains a Ethernet+IPv6 DHCP request packet.
269  */
270 static int DecodeGeneveTest01(void)
271 {
272  uint8_t raw_geneve[] = { 0x32, 0x10, 0x17, 0xc1, 0x00, 0xc1, 0x87, 0x51, /* UDP header */
273  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
274  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
275  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
276  0x33, 0x33, 0x00, 0x01, 0x00, 0x02, /* inner destination MAC */
277  0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, /* inner source MAC */
278  0x86, 0xdd, /* type is IPv6 0x86dd */
279  0x60, 0x00, 0x00, 0x00, 0x00, 0x6b, 0x11, 0x01, /* IPv6 hdr */
280  0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x27, 0xff, 0xfe, 0xfe, 0x8f,
281  0x95, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
282  0x00, 0x02, 0x02, 0x22, 0x02, 0x23, 0x00, 0x6b, 0x9c, 0xfb, /* UDP src port 546 */
283  0x03, 0x49, 0x17, 0x4e, 0x00, 0x01, 0x00, 0x0e, /* DHCP request payload */
284  0x00, 0x01, 0x00, 0x01, 0x1c, 0x39, 0xcf, 0x88, 0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, 0x00,
285  0x02, 0x00, 0x0e, 0x00, 0x01, 0x00, 0x01, 0x1c, 0x38, 0x25, 0xe8, 0x08, 0x00, 0x27, 0xd4,
286  0x10, 0xbb, 0x00, 0x06, 0x00, 0x04, 0x00, 0x17, 0x00, 0x18, 0x00, 0x08, 0x00, 0x02, 0x00,
287  0x00, 0x00, 0x19, 0x00, 0x29, 0x27, 0xfe, 0x8f, 0x95, 0x00, 0x00, 0x0e, 0x10, 0x00, 0x00,
288  0x15, 0x18, 0x00, 0x1a, 0x00, 0x19, 0x00, 0x00, 0x1c, 0x20, 0x00, 0x00, 0x1d, 0x4c, 0x40,
289  0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
290  0x00 };
291 
292  Packet *p = PacketGetFromAlloc();
293  FAIL_IF_NULL(p);
294  ThreadVars tv;
296 
297  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
298 
299  memset(&tv, 0, sizeof(ThreadVars));
300  memset(p, 0, SIZE_OF_PACKET);
301  memset(&dtv, 0, sizeof(DecodeThreadVars));
302 
304  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
305 
306  FAIL_IF(p->udph == NULL);
307  FAIL_IF(tv.decode_pq.top == NULL);
308 
310  FAIL_IF(tp->udph == NULL);
311  FAIL_IF_NOT(tp->sp == 546);
312 
313  FlowShutdown();
314  PacketFree(p);
315  PacketFree(tp);
316  PASS;
317 }
318 
319 /**
320  * \test DecodeGeneveTest02 tests a good Geneve header with 16-bytes of options.
321  * Contains a IPv4 DNS request packet.
322  */
323 static int DecodeGeneveTest02(void)
324 {
325  uint8_t raw_geneve[] = {
326  0x32, 0x10, 0x17, 0xc1, 0x00, 0x3c, 0x87, 0x51, /* UDP header */
327  0x04, 0x00, 0x08, 0x00, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
328  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
329  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
330  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
331  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
332  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
333  };
334 
335  Packet *p = PacketGetFromAlloc();
336  FAIL_IF_NULL(p);
337  ThreadVars tv;
339 
340  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
341 
342  memset(&tv, 0, sizeof(ThreadVars));
343  memset(p, 0, SIZE_OF_PACKET);
344  memset(&dtv, 0, sizeof(DecodeThreadVars));
345 
347  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
348 
349  FAIL_IF(p->udph == NULL);
350  FAIL_IF(tv.decode_pq.top == NULL);
351 
353  FAIL_IF(tp->udph == NULL);
354  FAIL_IF_NOT(tp->sp == 53);
355 
356  FlowShutdown();
357  PacketFree(p);
358  PacketFree(tp);
359  PASS;
360 }
361 
362 /**
363  * \test DecodeGeneveTest03 tests a good Geneve header with 16-bytes of options.
364  * Contains a IPv4 DNS request packet with a VLAN tag after the Ethernet frame.
365  * In practice, this probably won't be used but it should be support either way.
366  */
367 static int DecodeGeneveTest03(void)
368 {
369  uint8_t raw_geneve[] = {
370  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4e, 0x87, 0x51, /* UDP header */
371  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
372  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
373  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
374  0x33, 0x33, 0x00, 0x01, 0x00, 0x02, /* inner destination MAC */
375  0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, /* inner source MAC */
376  0x81, 0x00, 0x00, 0xad, /* 802.1Q VLAN tag */
377  0x08, 0x00, /* type is IPv4 0x0800 */
378  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
379  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
380  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
381  };
382 
383  Packet *p = PacketGetFromAlloc();
384  FAIL_IF_NULL(p);
385  ThreadVars tv;
387 
388  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
389 
390  memset(&tv, 0, sizeof(ThreadVars));
391  memset(p, 0, SIZE_OF_PACKET);
392  memset(&dtv, 0, sizeof(DecodeThreadVars));
393 
395  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
396 
397  FAIL_IF(p->udph == NULL);
398  FAIL_IF(tv.decode_pq.top == NULL);
399 
401  FAIL_IF(tp->udph == NULL);
402  FAIL_IF_NOT(tp->sp == 53);
403 
404  FlowShutdown();
405  PacketFree(p);
406  PacketFree(tp);
407  PASS;
408 }
409 
410 /**
411  * \test DecodeGeneveTest04 tests default port disabled by the config.
412  */
413 static int DecodeGeneveTest04(void)
414 {
415  uint8_t raw_geneve[] = {
416  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4a, 0x87, 0x51, /* UDP header */
417  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
418  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
419  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
420  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
421  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
422  0x08, 0x00, /* type is IPv4 0x0800 */
423  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
424  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
425  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
426  };
427 
428  Packet *p = PacketGetFromAlloc();
429  FAIL_IF_NULL(p);
430  ThreadVars tv;
432 
433  DecodeGeneveConfigPorts("1"); /* Set Suricata to use a non-default port for Geneve*/
434 
435  memset(&tv, 0, sizeof(ThreadVars));
436  memset(p, 0, SIZE_OF_PACKET);
437  memset(&dtv, 0, sizeof(DecodeThreadVars));
438 
440  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
441 
442  FAIL_IF(p->udph == NULL);
443  FAIL_IF(tv.decode_pq.top != NULL); /* Geneve packet should not have been processed */
444 
445  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S); /* Reset Geneve port list for future calls */
446  FlowShutdown();
447  PacketFree(p);
448  PASS;
449 }
450 
451 /**
452  * \test DecodeGeneveTest05 tests if Geneve header has inconsistent option len values.
453  */
454 static int DecodeGeneveTest05(void)
455 {
456  uint8_t raw_geneve[] = {
457  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4a, 0x87, 0x51, /* UDP header */
458  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
459  0x01, 0x08, 0x00, 0x04, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
460  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
461  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
462  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
463  0x08, 0x00, /* type is IPv4 0x0800 */
464  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
465  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
466  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
467  };
468 
469  Packet *p = PacketGetFromAlloc();
470  FAIL_IF_NULL(p);
471  ThreadVars tv;
473 
474  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
475 
476  memset(&tv, 0, sizeof(ThreadVars));
477  memset(p, 0, SIZE_OF_PACKET);
478  memset(&dtv, 0, sizeof(DecodeThreadVars));
479 
481  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
482 
483  FAIL_IF(p->udph == NULL);
484  FAIL_IF(tv.decode_pq.top != NULL); /* Geneve packet should not have been processed */
485 
486  FlowShutdown();
487  PacketFree(p);
488  PASS;
489 }
490 #endif /* UNITTESTS */
491 
493 {
494 #ifdef UNITTESTS
495  UtRegisterTest("DecodeGeneveTest01 -- Ethernet+IPv6 DHCP Request", DecodeGeneveTest01);
496  UtRegisterTest("DecodeGeneveTest02 -- IPv4 DNS Request", DecodeGeneveTest02);
497  UtRegisterTest("DecodeGeneveTest03 -- VLAN+IPv4 DNS Request", DecodeGeneveTest03);
498  UtRegisterTest("DecodeGeneveTest04 -- Non-standard port configuration", DecodeGeneveTest04);
499  UtRegisterTest("DecodeGeneveTest05 -- Inconsistent Geneve hdr option lens", DecodeGeneveTest05);
500 #endif /* UNITTESTS */
501 }
ETHERNET_TYPE_BRIDGE
#define ETHERNET_TYPE_BRIDGE
Definition: decode-ethernet.h:36
host.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
GeneveOption_::flags_plus_len
uint8_t flags_plus_len
Definition: decode-geneve.c:76
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:923
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
ConfNode_::val
char * val
Definition: conf.h:34
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
Definition: conf.c:516
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
GENEVE_SINGLE_OPT_TOTAL_LEN
#define GENEVE_SINGLE_OPT_TOTAL_LEN(option_ptr)
Definition: decode-geneve.c:58
ETHERNET_TYPE_IPV6
#define ETHERNET_TYPE_IPV6
Definition: decode-ethernet.h:39
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:175
FlowInitConfig
void FlowInitConfig(char quiet)
initialize the configuration
Definition: flow.c:516
GENEVE_DEFAULT_PORT
#define GENEVE_DEFAULT_PORT
Definition: decode-geneve.c:63
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
GeneveHeader_::ver_plus_len
uint8_t ver_plus_len
Definition: decode-geneve.c:81
util-unittest.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
GENEVE_UNKNOWN_PAYLOAD_TYPE
@ GENEVE_UNKNOWN_PAYLOAD_TYPE
Definition: decode-events.h:193
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1167
DecodeGeneveEnabledForPort
bool DecodeGeneveEnabledForPort(const uint16_t sp, const uint16_t dp)
Definition: decode-geneve.c:89
DetectPortParse
int DetectPortParse(const DetectEngineCtx *de_ctx, DetectPort **head, const char *str)
Function for parsing port strings.
Definition: detect-engine-port.c:1243
GeneveOption_::type
uint8_t type
Definition: decode-geneve.c:75
decode.h
DecodeGeneve
int DecodeGeneve(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-geneve.c:184
util-debug.h
VALID_GENEVE_VERSIONS
#define VALID_GENEVE_VERSIONS
Definition: decode-geneve.c:45
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:206
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
pkt-var.h
Packet_::sp
Port sp
Definition: decode.h:422
eth_type
uint16_t eth_type
Definition: decode-ethernet.h:2
GeneveHeader_::flags
uint8_t flags
Definition: decode-geneve.c:82
GENEVE_TOTAL_OPT_LEN
#define GENEVE_TOTAL_OPT_LEN(hdr_ptr)
Definition: decode-geneve.c:53
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:111
detect-engine-port.h
SIZE_OF_PACKET
#define SIZE_OF_PACKET
Definition: decode.h:635
DetectPort_
Port structure for detection engine.
Definition: detect.h:191
util-profiling.h
Packet_
Definition: decode.h:415
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:922
GeneveOption_
Definition: decode-geneve.c:73
GeneveOption
struct GeneveOption_ GeneveOption
GeneveHeader_::options
GeneveOption options[0]
Definition: decode-geneve.c:86
DECODE_TUNNEL_ETHERNET
@ DECODE_TUNNEL_ETHERNET
Definition: decode.h:918
SC_ERR_INVALID_YAML_CONF_ENTRY
@ SC_ERR_INVALID_YAML_CONF_ENTRY
Definition: util-error.h:169
decode-events.h
Flow_::next
struct Flow_ * next
Definition: flow.h:401
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
GENEVE_MAX_PORTS
#define GENEVE_MAX_PORTS
Definition: decode-geneve.c:61
PKT_SRC_DECODER_GENEVE
@ PKT_SRC_DECODER_GENEVE
Definition: decode.h:62
GENEVE_UNSET_PORT
#define GENEVE_UNSET_PORT
Definition: decode-geneve.c:62
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:167
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
GENEVE_DEFAULT_PORT_S
#define GENEVE_DEFAULT_PORT_S
Definition: decode-geneve.c:64
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:395
suricata-common.h
PacketQueueNoLock_::top
struct Packet_ * top
Definition: packet-queue.h:33
GENEVE_TOTAL_HEADER_LEN
#define GENEVE_TOTAL_HEADER_LEN(hdr_ptr)
Definition: decode-geneve.c:54
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:644
GeneveHeader_
Definition: decode-geneve.c:80
GeneveHeader_::eth_type
uint16_t eth_type
Definition: decode-geneve.c:83
GeneveOption_::option_class
uint16_t option_class
Definition: decode-geneve.c:74
decode-geneve.h
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:150
GENEVE_RESERVED_FLAGS
#define GENEVE_RESERVED_FLAGS(hdr_ptr)
Definition: decode-geneve.c:50
GeneveHeader
struct GeneveHeader_ GeneveHeader
head
Flow * head
Definition: flow-hash.h:1
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:639
ConfNode_
Definition: conf.h:32
DecodeThreadVars_::counter_geneve
uint16_t counter_geneve
Definition: decode.h:668
ETHERNET_TYPE_ARP
#define ETHERNET_TYPE_ARP
Definition: decode-ethernet.h:35
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:110
GeneveHeader_::vni
uint8_t vni[3]
Definition: decode-geneve.c:84
Packet_::udph
UDPHdr * udph
Definition: decode.h:534
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1028
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:42
DecodeGeneveConfig
void DecodeGeneveConfig(void)
Definition: decode-geneve.c:127
GENEVE_VERSION
#define GENEVE_VERSION(hdr_ptr)
Definition: decode-geneve.c:49
GENEVE_MIN_HEADER_LEN
#define GENEVE_MIN_HEADER_LEN
Definition: decode-geneve.c:52
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:285
flow.h
DecodeGeneveRegisterTests
void DecodeGeneveRegisterTests(void)
Definition: decode-geneve.c:492
ETHERNET_TYPE_IP
#define ETHERNET_TYPE_IP
Definition: decode-ethernet.h:34
DetectPortCleanupList
void DetectPortCleanupList(const DetectEngineCtx *de_ctx, DetectPort *head)
Free a DetectPort list and each of its members.
Definition: detect-engine-port.c:121
DECODE_TUNNEL_UNSET
@ DECODE_TUNNEL_UNSET
Definition: decode.h:927
GeneveHeader_::res
uint8_t res
Definition: decode-geneve.c:85
GeneveOption_::option_data
uint8_t option_data[0]
Definition: decode-geneve.c:77