suricata
decode-geneve.c
Go to the documentation of this file.
1 /* Copyright (C) 2020-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Ali Jad Khalil <jadkhal@amazon.com>
22  *
23  * Geneve tunneling scheme decoder.
24  *
25  * This implementation is based on the following specification doc:
26  * https://tools.ietf.org/html/draft-ietf-nvo3-geneve-16#section-3
27  */
28 
29 #include "suricata-common.h"
30 #include "decode.h"
31 #include "decode-geneve.h"
32 #include "decode-events.h"
33 
34 #include "detect-engine-port.h"
35 
36 #include "flow.h"
37 
38 #include "util-validate.h"
39 #include "util-unittest.h"
40 #include "util-debug.h"
41 
42 #include "pkt-var.h"
43 #include "util-profiling.h"
44 #include "host.h"
45 
46 #define VALID_GENEVE_VERSIONS \
47  { \
48  0 \
49  }
50 #define GENEVE_VERSION(hdr_ptr) (hdr_ptr->ver_plus_len >> 6)
51 #define GENEVE_RESERVED_FLAGS(hdr_ptr) (hdr_ptr->flags & 0x3F)
52 
53 #define GENEVE_MIN_HEADER_LEN sizeof(GeneveHeader)
54 #define GENEVE_TOTAL_OPT_LEN(hdr_ptr) ((hdr_ptr->ver_plus_len & 0x3F) << 2)
55 #define GENEVE_TOTAL_HEADER_LEN(hdr_ptr) (GENEVE_MIN_HEADER_LEN + GENEVE_TOTAL_OPT_LEN(hdr_ptr))
56 
57 #define GENEVE_MIN_SINGLE_OPT_LEN sizeof(GeneveOption)
58 #define GENEVE_SINGLE_OPT_LEN(option_ptr) ((option_ptr->flags_plus_len & 0x1F) << 2)
59 #define GENEVE_SINGLE_OPT_TOTAL_LEN(option_ptr) \
60  (GENEVE_MIN_SINGLE_OPT_LEN + GENEVE_SINGLE_OPT_LEN(option_ptr))
61 
62 #define GENEVE_MAX_PORTS 4
63 #define GENEVE_UNSET_PORT -1
64 #define GENEVE_DEFAULT_PORT 6081
65 #define GENEVE_DEFAULT_PORT_S "6081"
66 
67 static bool g_geneve_enabled = true;
68 static int g_geneve_ports_idx = 0;
69 static int g_geneve_ports[GENEVE_MAX_PORTS] = { GENEVE_DEFAULT_PORT, GENEVE_UNSET_PORT,
71 
72 /* Geneve structs based on diagrams from the following specification doc:
73  * https://tools.ietf.org/html/draft-ietf-nvo3-geneve-16#section-3 */
74 typedef struct GeneveOption_ {
75  uint16_t option_class;
76  uint8_t type;
77  uint8_t flags_plus_len;
78  uint8_t option_data[0];
80 
81 typedef struct GeneveHeader_ {
82  uint8_t ver_plus_len;
83  uint8_t flags;
84  uint16_t eth_type;
85  uint8_t vni[3];
86  uint8_t res;
89 
90 bool DecodeGeneveEnabledForPort(const uint16_t sp, const uint16_t dp)
91 {
92  SCLogDebug("ports %u->%u ports %d %d %d %d", sp, dp, g_geneve_ports[0], g_geneve_ports[1],
93  g_geneve_ports[2], g_geneve_ports[3]);
94 
95  if (g_geneve_enabled) {
96  for (int i = 0; i < g_geneve_ports_idx; i++) {
97  if (g_geneve_ports[i] == GENEVE_UNSET_PORT)
98  return false;
99 
100  const int port = g_geneve_ports[i];
101  if (port == (const int)sp || port == (const int)dp)
102  return true;
103  }
104  }
105  return false;
106 }
107 
108 static void DecodeGeneveConfigPorts(const char *pstr)
109 {
110  SCLogDebug("parsing \'%s\'", pstr);
111 
112  DetectPort *head = NULL;
113  DetectPortParse(NULL, &head, pstr);
114 
115  g_geneve_ports_idx = 0;
116  for (DetectPort *p = head; p != NULL; p = p->next) {
117  if (g_geneve_ports_idx >= GENEVE_MAX_PORTS) {
118  SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY, "more than %d Geneve ports defined",
120  break;
121  }
122  g_geneve_ports[g_geneve_ports_idx++] = (int)p->port;
123  }
124 
126 }
127 
129 {
130  int enabled = 0;
131  if (ConfGetBool("decoder.geneve.enabled", &enabled) == 1) {
132  if (enabled) {
133  g_geneve_enabled = true;
134  } else {
135  g_geneve_enabled = false;
136  }
137  }
138 
139  if (g_geneve_enabled) {
140  ConfNode *node = ConfGetNode("decoder.geneve.ports");
141  if (node && node->val) {
142  DecodeGeneveConfigPorts(node->val);
143  } else {
144  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
145  }
146  }
147 }
148 
149 static inline bool IsValidGeneveVersion(const GeneveHeader *geneve_hdr)
150 {
151  const int valid_verisons[] = VALID_GENEVE_VERSIONS;
152  const int num_versions = sizeof(valid_verisons) / sizeof(int);
153  const uint8_t cur_version = GENEVE_VERSION(geneve_hdr);
154 
155  for (int i = 0; i < num_versions; i++) {
156  if (valid_verisons[i] == cur_version)
157  return true;
158  }
159 
160  return false;
161 }
162 
163 /* Performs a check to ensure that option lens add up to total length specified in the fixed header
164  */
165 static inline bool IsHeaderLengthConsistentWithOptions(const GeneveHeader *geneve_hdr)
166 {
167  uint8_t *geneve_opt_ptr = (uint8_t *)geneve_hdr->options;
168  int remaining_hdr_len = GENEVE_TOTAL_OPT_LEN(geneve_hdr);
169 
170  while (remaining_hdr_len > 0) {
171  const GeneveOption *cur_opt = (const GeneveOption *)geneve_opt_ptr;
172  const uint8_t cur_option_len = GENEVE_SINGLE_OPT_TOTAL_LEN(cur_opt);
173 
174  geneve_opt_ptr += cur_option_len;
175  remaining_hdr_len -=
176  cur_option_len; /* cur_option_len will always be between 4-128, inclusive */
177  }
178 
179  return (remaining_hdr_len == 0);
180 }
181 
182 /** \param pkt payload data directly above UDP header
183  * \param len length in bytes of pkt
184  */
185 int DecodeGeneve(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
186 {
187  DEBUG_VALIDATE_BUG_ON(pkt == NULL);
188 
189  const GeneveHeader *geneve_hdr = (const GeneveHeader *)pkt;
190 
191  uint16_t eth_type, geneve_hdr_len;
192  int decode_tunnel_proto = DECODE_TUNNEL_UNSET;
193 
194  /* General Geneve packet validation */
195  if (unlikely(!g_geneve_enabled))
196  return TM_ECODE_FAILED;
197 
199  return TM_ECODE_FAILED;
200  if (!PacketIncreaseCheckLayers(p)) {
201  return TM_ECODE_FAILED;
202  }
203 
204  /* Specific Geneve header field validation */
205  geneve_hdr_len = GENEVE_TOTAL_HEADER_LEN(geneve_hdr);
206  if (len < geneve_hdr_len)
207  return TM_ECODE_FAILED;
208 
209  if (!IsValidGeneveVersion(geneve_hdr))
210  return TM_ECODE_FAILED;
211 
212  if (GENEVE_RESERVED_FLAGS(geneve_hdr) != 0 || geneve_hdr->res != 0)
213  return TM_ECODE_FAILED;
214 
215  if (!IsHeaderLengthConsistentWithOptions(geneve_hdr))
216  return TM_ECODE_FAILED;
217 
218 #if DEBUG
219  /* Print the VNI for debugging purposes */
220  uint32_t vni = (geneve_hdr->vni[0] << 16) + (geneve_hdr->vni[1] << 8) + (geneve_hdr->vni[2]);
221  SCLogDebug("Geneve vni %u", vni);
222 #endif
223 
224  /* Increment stats counter for Geneve packets */
226 
227  /* Determine first protocol encapsulated after Geneve header */
228  eth_type = SCNtohs(geneve_hdr->eth_type);
229  SCLogDebug("Geneve ethertype 0x%04x", eth_type);
230 
231  switch (eth_type) {
232  case ETHERNET_TYPE_IP:
233  SCLogDebug("Geneve found IPv4");
234  decode_tunnel_proto = DECODE_TUNNEL_IPV4;
235  break;
236  case ETHERNET_TYPE_IPV6:
237  SCLogDebug("Geneve found IPv6");
238  decode_tunnel_proto = DECODE_TUNNEL_IPV6;
239  break;
241  SCLogDebug("Geneve found Ethernet");
242  decode_tunnel_proto = DECODE_TUNNEL_ETHERNET;
243  break;
244  case ETHERNET_TYPE_ARP:
245  SCLogDebug("Geneve found ARP");
246  break;
247  default:
248  SCLogDebug(
249  "Geneve found unsupported Ethertype - expected IPv4, IPv6, ARP, or Ethernet");
251  }
252 
253  /* Set-up and process inner packet if it is a supported ethertype */
254  if (decode_tunnel_proto != DECODE_TUNNEL_UNSET) {
256  tv, dtv, p, pkt + geneve_hdr_len, len - geneve_hdr_len, decode_tunnel_proto);
257 
258  if (tp != NULL) {
261  }
262  }
263 
264  return TM_ECODE_OK;
265 }
266 
267 #ifdef UNITTESTS
268 
269 /**
270  * \test DecodeGeneveTest01 tests a good Geneve header with 16-bytes of options.
271  * Contains a Ethernet+IPv6 DHCP request packet.
272  */
273 static int DecodeGeneveTest01(void)
274 {
275  uint8_t raw_geneve[] = { 0x32, 0x10, 0x17, 0xc1, 0x00, 0xc1, 0x87, 0x51, /* UDP header */
276  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
277  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
278  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
279  0x33, 0x33, 0x00, 0x01, 0x00, 0x02, /* inner destination MAC */
280  0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, /* inner source MAC */
281  0x86, 0xdd, /* type is IPv6 0x86dd */
282  0x60, 0x00, 0x00, 0x00, 0x00, 0x6b, 0x11, 0x01, /* IPv6 hdr */
283  0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x27, 0xff, 0xfe, 0xfe, 0x8f,
284  0x95, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
285  0x00, 0x02, 0x02, 0x22, 0x02, 0x23, 0x00, 0x6b, 0x9c, 0xfb, /* UDP src port 546 */
286  0x03, 0x49, 0x17, 0x4e, 0x00, 0x01, 0x00, 0x0e, /* DHCP request payload */
287  0x00, 0x01, 0x00, 0x01, 0x1c, 0x39, 0xcf, 0x88, 0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, 0x00,
288  0x02, 0x00, 0x0e, 0x00, 0x01, 0x00, 0x01, 0x1c, 0x38, 0x25, 0xe8, 0x08, 0x00, 0x27, 0xd4,
289  0x10, 0xbb, 0x00, 0x06, 0x00, 0x04, 0x00, 0x17, 0x00, 0x18, 0x00, 0x08, 0x00, 0x02, 0x00,
290  0x00, 0x00, 0x19, 0x00, 0x29, 0x27, 0xfe, 0x8f, 0x95, 0x00, 0x00, 0x0e, 0x10, 0x00, 0x00,
291  0x15, 0x18, 0x00, 0x1a, 0x00, 0x19, 0x00, 0x00, 0x1c, 0x20, 0x00, 0x00, 0x1d, 0x4c, 0x40,
292  0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
293  0x00 };
294 
295  Packet *p = PacketGetFromAlloc();
296  FAIL_IF_NULL(p);
297  ThreadVars tv;
299 
300  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
301 
302  memset(&tv, 0, sizeof(ThreadVars));
303  memset(p, 0, SIZE_OF_PACKET);
304  memset(&dtv, 0, sizeof(DecodeThreadVars));
305 
307  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
308 
309  FAIL_IF(p->udph == NULL);
310  FAIL_IF(tv.decode_pq.top == NULL);
311 
313  FAIL_IF(tp->udph == NULL);
314  FAIL_IF_NOT(tp->sp == 546);
315 
316  FlowShutdown();
317  PacketFree(p);
318  PacketFree(tp);
319  PASS;
320 }
321 
322 /**
323  * \test DecodeGeneveTest02 tests a good Geneve header with 16-bytes of options.
324  * Contains a IPv4 DNS request packet.
325  */
326 static int DecodeGeneveTest02(void)
327 {
328  uint8_t raw_geneve[] = {
329  0x32, 0x10, 0x17, 0xc1, 0x00, 0x3c, 0x87, 0x51, /* UDP header */
330  0x04, 0x00, 0x08, 0x00, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
331  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
332  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
333  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
334  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
335  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
336  };
337 
338  Packet *p = PacketGetFromAlloc();
339  FAIL_IF_NULL(p);
340  ThreadVars tv;
342 
343  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
344 
345  memset(&tv, 0, sizeof(ThreadVars));
346  memset(p, 0, SIZE_OF_PACKET);
347  memset(&dtv, 0, sizeof(DecodeThreadVars));
348 
350  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
351 
352  FAIL_IF(p->udph == NULL);
353  FAIL_IF(tv.decode_pq.top == NULL);
354 
356  FAIL_IF(tp->udph == NULL);
357  FAIL_IF_NOT(tp->sp == 53);
358 
359  FlowShutdown();
360  PacketFree(p);
361  PacketFree(tp);
362  PASS;
363 }
364 
365 /**
366  * \test DecodeGeneveTest03 tests a good Geneve header with 16-bytes of options.
367  * Contains a IPv4 DNS request packet with a VLAN tag after the Ethernet frame.
368  * In practice, this probably won't be used but it should be support either way.
369  */
370 static int DecodeGeneveTest03(void)
371 {
372  uint8_t raw_geneve[] = {
373  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4e, 0x87, 0x51, /* UDP header */
374  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
375  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
376  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
377  0x33, 0x33, 0x00, 0x01, 0x00, 0x02, /* inner destination MAC */
378  0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, /* inner source MAC */
379  0x81, 0x00, 0x00, 0xad, /* 802.1Q VLAN tag */
380  0x08, 0x00, /* type is IPv4 0x0800 */
381  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
382  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
383  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
384  };
385 
386  Packet *p = PacketGetFromAlloc();
387  FAIL_IF_NULL(p);
388  ThreadVars tv;
390 
391  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
392 
393  memset(&tv, 0, sizeof(ThreadVars));
394  memset(p, 0, SIZE_OF_PACKET);
395  memset(&dtv, 0, sizeof(DecodeThreadVars));
396 
398  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
399 
400  FAIL_IF(p->udph == NULL);
401  FAIL_IF(tv.decode_pq.top == NULL);
402 
404  FAIL_IF(tp->udph == NULL);
405  FAIL_IF_NOT(tp->sp == 53);
406 
407  FlowShutdown();
408  PacketFree(p);
409  PacketFree(tp);
410  PASS;
411 }
412 
413 /**
414  * \test DecodeGeneveTest04 tests default port disabled by the config.
415  */
416 static int DecodeGeneveTest04(void)
417 {
418  uint8_t raw_geneve[] = {
419  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4a, 0x87, 0x51, /* UDP header */
420  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
421  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
422  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
423  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
424  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
425  0x08, 0x00, /* type is IPv4 0x0800 */
426  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
427  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
428  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
429  };
430 
431  Packet *p = PacketGetFromAlloc();
432  FAIL_IF_NULL(p);
433  ThreadVars tv;
435 
436  DecodeGeneveConfigPorts("1"); /* Set Suricata to use a non-default port for Geneve*/
437 
438  memset(&tv, 0, sizeof(ThreadVars));
439  memset(p, 0, SIZE_OF_PACKET);
440  memset(&dtv, 0, sizeof(DecodeThreadVars));
441 
443  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
444 
445  FAIL_IF(p->udph == NULL);
446  FAIL_IF(tv.decode_pq.top != NULL); /* Geneve packet should not have been processed */
447 
448  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S); /* Reset Geneve port list for future calls */
449  FlowShutdown();
450  PacketFree(p);
451  PASS;
452 }
453 
454 /**
455  * \test DecodeGeneveTest05 tests if Geneve header has inconsistent option len values.
456  */
457 static int DecodeGeneveTest05(void)
458 {
459  uint8_t raw_geneve[] = {
460  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4a, 0x87, 0x51, /* UDP header */
461  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
462  0x01, 0x08, 0x00, 0x04, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
463  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
464  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
465  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
466  0x08, 0x00, /* type is IPv4 0x0800 */
467  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
468  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
469  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
470  };
471 
472  Packet *p = PacketGetFromAlloc();
473  FAIL_IF_NULL(p);
474  ThreadVars tv;
476 
477  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
478 
479  memset(&tv, 0, sizeof(ThreadVars));
480  memset(p, 0, SIZE_OF_PACKET);
481  memset(&dtv, 0, sizeof(DecodeThreadVars));
482 
484  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
485 
486  FAIL_IF(p->udph == NULL);
487  FAIL_IF(tv.decode_pq.top != NULL); /* Geneve packet should not have been processed */
488 
489  FlowShutdown();
490  PacketFree(p);
491  PASS;
492 }
493 #endif /* UNITTESTS */
494 
496 {
497 #ifdef UNITTESTS
498  UtRegisterTest("DecodeGeneveTest01 -- Ethernet+IPv6 DHCP Request", DecodeGeneveTest01);
499  UtRegisterTest("DecodeGeneveTest02 -- IPv4 DNS Request", DecodeGeneveTest02);
500  UtRegisterTest("DecodeGeneveTest03 -- VLAN+IPv4 DNS Request", DecodeGeneveTest03);
501  UtRegisterTest("DecodeGeneveTest04 -- Non-standard port configuration", DecodeGeneveTest04);
502  UtRegisterTest("DecodeGeneveTest05 -- Inconsistent Geneve hdr option lens", DecodeGeneveTest05);
503 #endif /* UNITTESTS */
504 }
ETHERNET_TYPE_BRIDGE
#define ETHERNET_TYPE_BRIDGE
Definition: decode-ethernet.h:36
host.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
GeneveOption_::flags_plus_len
uint8_t flags_plus_len
Definition: decode-geneve.c:77
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:925
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
ConfNode_::val
char * val
Definition: conf.h:34
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
Definition: conf.c:516
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
GENEVE_SINGLE_OPT_TOTAL_LEN
#define GENEVE_SINGLE_OPT_TOTAL_LEN(option_ptr)
Definition: decode-geneve.c:59
ETHERNET_TYPE_IPV6
#define ETHERNET_TYPE_IPV6
Definition: decode-ethernet.h:39
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:175
GENEVE_DEFAULT_PORT
#define GENEVE_DEFAULT_PORT
Definition: decode-geneve.c:64
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
GeneveHeader_::ver_plus_len
uint8_t ver_plus_len
Definition: decode-geneve.c:82
util-unittest.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1170
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:516
DecodeGeneveEnabledForPort
bool DecodeGeneveEnabledForPort(const uint16_t sp, const uint16_t dp)
Definition: decode-geneve.c:90
DetectPortParse
int DetectPortParse(const DetectEngineCtx *de_ctx, DetectPort **head, const char *str)
Function for parsing port strings.
Definition: detect-engine-port.c:1243
GeneveOption_::type
uint8_t type
Definition: decode-geneve.c:76
decode.h
DecodeGeneve
int DecodeGeneve(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-geneve.c:185
util-debug.h
VALID_GENEVE_VERSIONS
#define VALID_GENEVE_VERSIONS
Definition: decode-geneve.c:46
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:206
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
pkt-var.h
Packet_::sp
Port sp
Definition: decode.h:423
eth_type
uint16_t eth_type
Definition: decode-ethernet.h:2
GeneveHeader_::flags
uint8_t flags
Definition: decode-geneve.c:83
GENEVE_TOTAL_OPT_LEN
#define GENEVE_TOTAL_OPT_LEN(hdr_ptr)
Definition: decode-geneve.c:54
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:111
detect-engine-port.h
SIZE_OF_PACKET
#define SIZE_OF_PACKET
Definition: decode.h:636
DetectPort_
Port structure for detection engine.
Definition: detect.h:191
util-profiling.h
Packet_
Definition: decode.h:416
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:924
GeneveOption_
Definition: decode-geneve.c:74
GeneveOption
struct GeneveOption_ GeneveOption
GeneveHeader_::options
GeneveOption options[0]
Definition: decode-geneve.c:87
DECODE_TUNNEL_ETHERNET
@ DECODE_TUNNEL_ETHERNET
Definition: decode.h:920
SC_ERR_INVALID_YAML_CONF_ENTRY
@ SC_ERR_INVALID_YAML_CONF_ENTRY
Definition: util-error.h:169
decode-events.h
Flow_::next
struct Flow_ * next
Definition: flow.h:401
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
GENEVE_MAX_PORTS
#define GENEVE_MAX_PORTS
Definition: decode-geneve.c:62
PKT_SRC_DECODER_GENEVE
@ PKT_SRC_DECODER_GENEVE
Definition: decode.h:62
GENEVE_UNSET_PORT
#define GENEVE_UNSET_PORT
Definition: decode-geneve.c:63
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:167
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
GENEVE_DEFAULT_PORT_S
#define GENEVE_DEFAULT_PORT_S
Definition: decode-geneve.c:65
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:395
suricata-common.h
PacketQueueNoLock_::top
struct Packet_ * top
Definition: packet-queue.h:33
GENEVE_TOTAL_HEADER_LEN
#define GENEVE_TOTAL_HEADER_LEN(hdr_ptr)
Definition: decode-geneve.c:55
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:644
GeneveHeader_
Definition: decode-geneve.c:81
GENEVE_UNKNOWN_PAYLOAD_TYPE
@ GENEVE_UNKNOWN_PAYLOAD_TYPE
Definition: decode-events.h:197
GeneveHeader_::eth_type
uint16_t eth_type
Definition: decode-geneve.c:84
GeneveOption_::option_class
uint16_t option_class
Definition: decode-geneve.c:75
decode-geneve.h
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:150
GENEVE_RESERVED_FLAGS
#define GENEVE_RESERVED_FLAGS(hdr_ptr)
Definition: decode-geneve.c:51
GeneveHeader
struct GeneveHeader_ GeneveHeader
head
Flow * head
Definition: flow-hash.h:1
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:244
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:640
ConfNode_
Definition: conf.h:32
DecodeThreadVars_::counter_geneve
uint16_t counter_geneve
Definition: decode.h:669
ETHERNET_TYPE_ARP
#define ETHERNET_TYPE_ARP
Definition: decode-ethernet.h:35
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:110
GeneveHeader_::vni
uint8_t vni[3]
Definition: decode-geneve.c:85
Packet_::udph
UDPHdr * udph
Definition: decode.h:535
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1031
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:42
DecodeGeneveConfig
void DecodeGeneveConfig(void)
Definition: decode-geneve.c:128
GENEVE_VERSION
#define GENEVE_VERSION(hdr_ptr)
Definition: decode-geneve.c:50
GENEVE_MIN_HEADER_LEN
#define GENEVE_MIN_HEADER_LEN
Definition: decode-geneve.c:53
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:285
flow.h
DecodeGeneveRegisterTests
void DecodeGeneveRegisterTests(void)
Definition: decode-geneve.c:495
ETHERNET_TYPE_IP
#define ETHERNET_TYPE_IP
Definition: decode-ethernet.h:34
DetectPortCleanupList
void DetectPortCleanupList(const DetectEngineCtx *de_ctx, DetectPort *head)
Free a DetectPort list and each of its members.
Definition: detect-engine-port.c:121
DECODE_TUNNEL_UNSET
@ DECODE_TUNNEL_UNSET
Definition: decode.h:929
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
GeneveHeader_::res
uint8_t res
Definition: decode-geneve.c:86
GeneveOption_::option_data
uint8_t option_data[0]
Definition: decode-geneve.c:78