suricata
decode-geneve.c
Go to the documentation of this file.
1 /* Copyright (C) 2020-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Ali Jad Khalil <jadkhal@amazon.com>
22  *
23  * Geneve tunneling scheme decoder.
24  *
25  * This implementation is based on the following specification doc:
26  * https://tools.ietf.org/html/draft-ietf-nvo3-geneve-16#section-3
27  */
28 
29 #include "suricata-common.h"
30 #include "decode.h"
31 #include "decode-geneve.h"
32 #include "decode-events.h"
33 
34 #include "detect.h"
35 #include "detect-engine-port.h"
36 
37 #include "flow.h"
38 
39 #include "util-validate.h"
40 #include "util-unittest.h"
41 #include "util-debug.h"
42 
43 #include "pkt-var.h"
44 #include "util-profiling.h"
45 #include "host.h"
46 
47 #define VALID_GENEVE_VERSIONS \
48  { \
49  0 \
50  }
51 #define GENEVE_VERSION(hdr_ptr) (hdr_ptr->ver_plus_len >> 6)
52 #define GENEVE_RESERVED_FLAGS(hdr_ptr) (hdr_ptr->flags & 0x3F)
53 
54 #define GENEVE_MIN_HEADER_LEN sizeof(GeneveHeader)
55 #define GENEVE_TOTAL_OPT_LEN(hdr_ptr) ((uint8_t)((hdr_ptr->ver_plus_len & 0x3F) << 2))
56 #define GENEVE_TOTAL_HEADER_LEN(hdr_ptr) (GENEVE_MIN_HEADER_LEN + GENEVE_TOTAL_OPT_LEN(hdr_ptr))
57 
58 #define GENEVE_MIN_SINGLE_OPT_LEN sizeof(GeneveOption)
59 #define GENEVE_SINGLE_OPT_LEN(option_ptr) ((uint8_t)((option_ptr->flags_plus_len & 0x1F) << 2))
60 #define GENEVE_SINGLE_OPT_TOTAL_LEN(option_ptr) \
61  (GENEVE_MIN_SINGLE_OPT_LEN + GENEVE_SINGLE_OPT_LEN(option_ptr))
62 
63 #define GENEVE_MAX_PORTS 4
64 #define GENEVE_UNSET_PORT -1
65 #define GENEVE_DEFAULT_PORT 6081
66 #define GENEVE_DEFAULT_PORT_S "6081"
67 
68 static bool g_geneve_enabled = true;
69 static int g_geneve_ports_idx = 0;
70 static int g_geneve_ports[GENEVE_MAX_PORTS] = { GENEVE_DEFAULT_PORT, GENEVE_UNSET_PORT,
72 
73 /* Geneve structs based on diagrams from the following specification doc:
74  * https://tools.ietf.org/html/draft-ietf-nvo3-geneve-16#section-3 */
75 typedef struct GeneveOption_ {
76  uint16_t option_class;
77  uint8_t type;
78  uint8_t flags_plus_len;
79  uint8_t option_data[0];
81 
82 typedef struct GeneveHeader_ {
83  uint8_t ver_plus_len;
84  uint8_t flags;
85  uint16_t eth_type;
86  uint8_t vni[3];
87  uint8_t res;
90 
91 bool DecodeGeneveEnabledForPort(const uint16_t sp, const uint16_t dp)
92 {
93  SCLogDebug("ports %u->%u ports %d %d %d %d", sp, dp, g_geneve_ports[0], g_geneve_ports[1],
94  g_geneve_ports[2], g_geneve_ports[3]);
95 
96  if (g_geneve_enabled) {
97  for (int i = 0; i < g_geneve_ports_idx; i++) {
98  if (g_geneve_ports[i] == GENEVE_UNSET_PORT)
99  return false;
100 
101  const int port = g_geneve_ports[i];
102  if (port == (const int)sp || port == (const int)dp)
103  return true;
104  }
105  }
106  return false;
107 }
108 
109 static void DecodeGeneveConfigPorts(const char *pstr)
110 {
111  SCLogDebug("parsing \'%s\'", pstr);
112 
113  DetectPort *head = NULL;
114  DetectPortParse(NULL, &head, pstr);
115 
116  g_geneve_ports_idx = 0;
117  for (DetectPort *p = head; p != NULL; p = p->next) {
118  if (g_geneve_ports_idx >= GENEVE_MAX_PORTS) {
119  SCLogWarning("more than %d Geneve ports defined", GENEVE_MAX_PORTS);
120  break;
121  }
122  g_geneve_ports[g_geneve_ports_idx++] = (int)p->port;
123  }
124 
126 }
127 
129 {
130  int enabled = 0;
131  if (ConfGetBool("decoder.geneve.enabled", &enabled) == 1) {
132  if (enabled) {
133  g_geneve_enabled = true;
134  } else {
135  g_geneve_enabled = false;
136  }
137  }
138 
139  if (g_geneve_enabled) {
140  ConfNode *node = ConfGetNode("decoder.geneve.ports");
141  if (node && node->val) {
142  DecodeGeneveConfigPorts(node->val);
143  } else {
144  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
145  }
146  }
147 }
148 
149 static inline bool IsValidGeneveVersion(const GeneveHeader *geneve_hdr)
150 {
151  const int valid_versions[] = VALID_GENEVE_VERSIONS;
152  const int num_versions = sizeof(valid_versions) / sizeof(int);
153  const uint8_t cur_version = GENEVE_VERSION(geneve_hdr);
154 
155  for (int i = 0; i < num_versions; i++) {
156  if (valid_versions[i] == cur_version)
157  return true;
158  }
159 
160  return false;
161 }
162 
163 /* Performs a check to ensure that option lens add up to total length specified in the fixed header
164  */
165 static inline bool IsHeaderLengthConsistentWithOptions(const GeneveHeader *geneve_hdr)
166 {
167  uint8_t *geneve_opt_ptr = (uint8_t *)geneve_hdr->options;
168  int remaining_hdr_len = GENEVE_TOTAL_OPT_LEN(geneve_hdr);
169 
170  while (remaining_hdr_len > 0) {
171  const GeneveOption *cur_opt = (const GeneveOption *)geneve_opt_ptr;
172  const uint8_t cur_option_len = GENEVE_SINGLE_OPT_TOTAL_LEN(cur_opt);
173 
174  geneve_opt_ptr += cur_option_len;
175  remaining_hdr_len -=
176  cur_option_len; /* cur_option_len will always be between 4-128, inclusive */
177  }
178 
179  return (remaining_hdr_len == 0);
180 }
181 
182 /** \param pkt payload data directly above UDP header
183  * \param len length in bytes of pkt
184  */
185 int DecodeGeneve(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
186 {
187  DEBUG_VALIDATE_BUG_ON(pkt == NULL);
188 
189  const GeneveHeader *geneve_hdr = (const GeneveHeader *)pkt;
190 
191  uint16_t eth_type, geneve_hdr_len;
192  int decode_tunnel_proto = DECODE_TUNNEL_UNSET;
193 
194  /* General Geneve packet validation */
195  if (unlikely(!g_geneve_enabled))
196  return TM_ECODE_FAILED;
197 
199  return TM_ECODE_FAILED;
200  if (!PacketIncreaseCheckLayers(p)) {
201  return TM_ECODE_FAILED;
202  }
203 
204  /* Specific Geneve header field validation */
205  geneve_hdr_len = GENEVE_TOTAL_HEADER_LEN(geneve_hdr);
206  if (len < geneve_hdr_len)
207  return TM_ECODE_FAILED;
208 
209  if (!IsValidGeneveVersion(geneve_hdr))
210  return TM_ECODE_FAILED;
211 
212  if (GENEVE_RESERVED_FLAGS(geneve_hdr) != 0 || geneve_hdr->res != 0)
213  return TM_ECODE_FAILED;
214 
215  if (!IsHeaderLengthConsistentWithOptions(geneve_hdr))
216  return TM_ECODE_FAILED;
217 
218 #if DEBUG
219  /* Print the VNI for debugging purposes */
220  uint32_t vni = (geneve_hdr->vni[0] << 16) + (geneve_hdr->vni[1] << 8) + (geneve_hdr->vni[2]);
221  SCLogDebug("Geneve vni %u", vni);
222 #endif
223 
224  /* Increment stats counter for Geneve packets */
226 
227  /* Determine first protocol encapsulated after Geneve header */
228  eth_type = SCNtohs(geneve_hdr->eth_type);
229  SCLogDebug("Geneve ethertype 0x%04x", eth_type);
230 
231  switch (eth_type) {
232  case ETHERNET_TYPE_IP:
233  SCLogDebug("Geneve found IPv4");
234  decode_tunnel_proto = DECODE_TUNNEL_IPV4;
235  break;
236  case ETHERNET_TYPE_IPV6:
237  SCLogDebug("Geneve found IPv6");
238  decode_tunnel_proto = DECODE_TUNNEL_IPV6;
239  break;
241  SCLogDebug("Geneve found Ethernet");
242  decode_tunnel_proto = DECODE_TUNNEL_ETHERNET;
243  break;
244  case ETHERNET_TYPE_ARP:
245  SCLogDebug("Geneve found ARP");
246  break;
247  default:
248  SCLogDebug(
249  "Geneve found unsupported Ethertype - expected IPv4, IPv6, ARP, or Ethernet");
251  }
252 
253  /* Set-up and process inner packet if it is a supported ethertype */
254  if (decode_tunnel_proto != DECODE_TUNNEL_UNSET) {
256  tv, dtv, p, pkt + geneve_hdr_len, len - geneve_hdr_len, decode_tunnel_proto);
257 
258  if (tp != NULL) {
261  }
262  }
263 
264  return TM_ECODE_OK;
265 }
266 
267 #ifdef UNITTESTS
268 
269 /**
270  * \test DecodeGeneveTest01 tests a good Geneve header with 16-bytes of options.
271  * Contains a Ethernet+IPv6 DHCP request packet.
272  */
273 static int DecodeGeneveTest01(void)
274 {
275  uint8_t raw_geneve[] = { 0x32, 0x10, 0x17, 0xc1, 0x00, 0xc1, 0x87, 0x51, /* UDP header */
276  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
277  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
278  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
279  0x33, 0x33, 0x00, 0x01, 0x00, 0x02, /* inner destination MAC */
280  0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, /* inner source MAC */
281  0x86, 0xdd, /* type is IPv6 0x86dd */
282  0x60, 0x00, 0x00, 0x00, 0x00, 0x6b, 0x11, 0x01, /* IPv6 hdr */
283  0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x27, 0xff, 0xfe, 0xfe, 0x8f,
284  0x95, 0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
285  0x00, 0x02, 0x02, 0x22, 0x02, 0x23, 0x00, 0x6b, 0x9c, 0xfb, /* UDP src port 546 */
286  0x03, 0x49, 0x17, 0x4e, 0x00, 0x01, 0x00, 0x0e, /* DHCP request payload */
287  0x00, 0x01, 0x00, 0x01, 0x1c, 0x39, 0xcf, 0x88, 0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, 0x00,
288  0x02, 0x00, 0x0e, 0x00, 0x01, 0x00, 0x01, 0x1c, 0x38, 0x25, 0xe8, 0x08, 0x00, 0x27, 0xd4,
289  0x10, 0xbb, 0x00, 0x06, 0x00, 0x04, 0x00, 0x17, 0x00, 0x18, 0x00, 0x08, 0x00, 0x02, 0x00,
290  0x00, 0x00, 0x19, 0x00, 0x29, 0x27, 0xfe, 0x8f, 0x95, 0x00, 0x00, 0x0e, 0x10, 0x00, 0x00,
291  0x15, 0x18, 0x00, 0x1a, 0x00, 0x19, 0x00, 0x00, 0x1c, 0x20, 0x00, 0x00, 0x1d, 0x4c, 0x40,
292  0x20, 0x01, 0x00, 0x00, 0x00, 0x00, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
293  0x00 };
294 
295  Packet *p = PacketGetFromAlloc();
296  FAIL_IF_NULL(p);
297  ThreadVars tv;
299 
300  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
301 
302  memset(&tv, 0, sizeof(ThreadVars));
303  memset(&dtv, 0, sizeof(DecodeThreadVars));
304 
306  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
307 
308  FAIL_IF(p->udph == NULL);
309  FAIL_IF(tv.decode_pq.top == NULL);
310 
312  FAIL_IF(tp->udph == NULL);
313  FAIL_IF_NOT(tp->sp == 546);
314 
315  FlowShutdown();
316  PacketFree(p);
317  PacketFree(tp);
318  PASS;
319 }
320 
321 /**
322  * \test DecodeGeneveTest02 tests a good Geneve header with 16-bytes of options.
323  * Contains a IPv4 DNS request packet.
324  */
325 static int DecodeGeneveTest02(void)
326 {
327  uint8_t raw_geneve[] = {
328  0x32, 0x10, 0x17, 0xc1, 0x00, 0x3c, 0x87, 0x51, /* UDP header */
329  0x04, 0x00, 0x08, 0x00, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
330  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
331  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
332  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
333  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
334  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
335  };
336 
337  Packet *p = PacketGetFromAlloc();
338  FAIL_IF_NULL(p);
339  ThreadVars tv;
341 
342  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
343 
344  memset(&tv, 0, sizeof(ThreadVars));
345  memset(&dtv, 0, sizeof(DecodeThreadVars));
346 
348  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
349 
350  FAIL_IF(p->udph == NULL);
351  FAIL_IF(tv.decode_pq.top == NULL);
352 
354  FAIL_IF(tp->udph == NULL);
355  FAIL_IF_NOT(tp->sp == 53);
356 
357  FlowShutdown();
358  PacketFree(p);
359  PacketFree(tp);
360  PASS;
361 }
362 
363 /**
364  * \test DecodeGeneveTest03 tests a good Geneve header with 16-bytes of options.
365  * Contains a IPv4 DNS request packet with a VLAN tag after the Ethernet frame.
366  * In practice, this probably won't be used but it should be support either way.
367  */
368 static int DecodeGeneveTest03(void)
369 {
370  uint8_t raw_geneve[] = {
371  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4e, 0x87, 0x51, /* UDP header */
372  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
373  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
374  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
375  0x33, 0x33, 0x00, 0x01, 0x00, 0x02, /* inner destination MAC */
376  0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, /* inner source MAC */
377  0x81, 0x00, 0x00, 0xad, /* 802.1Q VLAN tag */
378  0x08, 0x00, /* type is IPv4 0x0800 */
379  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
380  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
381  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
382  };
383 
384  Packet *p = PacketGetFromAlloc();
385  FAIL_IF_NULL(p);
386  ThreadVars tv;
388 
389  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
390 
391  memset(&tv, 0, sizeof(ThreadVars));
392  memset(&dtv, 0, sizeof(DecodeThreadVars));
393 
395  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
396 
397  FAIL_IF(p->udph == NULL);
398  FAIL_IF(tv.decode_pq.top == NULL);
399 
401  FAIL_IF(tp->udph == NULL);
402  FAIL_IF_NOT(tp->sp == 53);
403 
404  FlowShutdown();
405  PacketFree(p);
406  PacketFree(tp);
407  PASS;
408 }
409 
410 /**
411  * \test DecodeGeneveTest04 tests default port disabled by the config.
412  */
413 static int DecodeGeneveTest04(void)
414 {
415  uint8_t raw_geneve[] = {
416  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4a, 0x87, 0x51, /* UDP header */
417  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
418  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
419  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
420  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
421  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
422  0x08, 0x00, /* type is IPv4 0x0800 */
423  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
424  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
425  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
426  };
427 
428  Packet *p = PacketGetFromAlloc();
429  FAIL_IF_NULL(p);
430  ThreadVars tv;
432 
433  DecodeGeneveConfigPorts("1"); /* Set Suricata to use a non-default port for Geneve*/
434 
435  memset(&tv, 0, sizeof(ThreadVars));
436  memset(&dtv, 0, sizeof(DecodeThreadVars));
437 
439  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
440 
441  FAIL_IF(p->udph == NULL);
442  FAIL_IF(tv.decode_pq.top != NULL); /* Geneve packet should not have been processed */
443 
444  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S); /* Reset Geneve port list for future calls */
445  FlowShutdown();
446  PacketFree(p);
447  PASS;
448 }
449 
450 /**
451  * \test DecodeGeneveTest05 tests if Geneve header has inconsistent option len values.
452  */
453 static int DecodeGeneveTest05(void)
454 {
455  uint8_t raw_geneve[] = {
456  0x32, 0x10, 0x17, 0xc1, 0x00, 0x4a, 0x87, 0x51, /* UDP header */
457  0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
458  0x01, 0x08, 0x00, 0x04, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
459  0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
460  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
461  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
462  0x08, 0x00, /* type is IPv4 0x0800 */
463  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
464  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, 0x00, 0x35, 0x30, 0x39, 0x00,
465  0x08, 0x98, 0xe4 /* UDP probe src port 53 */
466  };
467 
468  Packet *p = PacketGetFromAlloc();
469  FAIL_IF_NULL(p);
470  ThreadVars tv;
472 
473  DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
474 
475  memset(&tv, 0, sizeof(ThreadVars));
476  memset(&dtv, 0, sizeof(DecodeThreadVars));
477 
479  DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve));
480 
481  FAIL_IF(p->udph == NULL);
482  FAIL_IF(tv.decode_pq.top != NULL); /* Geneve packet should not have been processed */
483 
484  FlowShutdown();
485  PacketFree(p);
486  PASS;
487 }
488 #endif /* UNITTESTS */
489 
491 {
492 #ifdef UNITTESTS
493  UtRegisterTest("DecodeGeneveTest01 -- Ethernet+IPv6 DHCP Request", DecodeGeneveTest01);
494  UtRegisterTest("DecodeGeneveTest02 -- IPv4 DNS Request", DecodeGeneveTest02);
495  UtRegisterTest("DecodeGeneveTest03 -- VLAN+IPv4 DNS Request", DecodeGeneveTest03);
496  UtRegisterTest("DecodeGeneveTest04 -- Non-standard port configuration", DecodeGeneveTest04);
497  UtRegisterTest("DecodeGeneveTest05 -- Inconsistent Geneve hdr option lens", DecodeGeneveTest05);
498 #endif /* UNITTESTS */
499 }
ETHERNET_TYPE_BRIDGE
#define ETHERNET_TYPE_BRIDGE
Definition: decode-ethernet.h:36
host.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
GeneveOption_::flags_plus_len
uint8_t flags_plus_len
Definition: decode-geneve.c:78
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:813
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:167
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
ConfNode_::val
char * val
Definition: conf.h:34
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as a boolean.
Definition: conf.c:483
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
GENEVE_SINGLE_OPT_TOTAL_LEN
#define GENEVE_SINGLE_OPT_TOTAL_LEN(option_ptr)
Definition: decode-geneve.c:60
ETHERNET_TYPE_IPV6
#define ETHERNET_TYPE_IPV6
Definition: decode-ethernet.h:39
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:181
GENEVE_DEFAULT_PORT
#define GENEVE_DEFAULT_PORT
Definition: decode-geneve.c:65
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
GeneveHeader_::ver_plus_len
uint8_t ver_plus_len
Definition: decode-geneve.c:83
util-unittest.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1061
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:547
DecodeGeneveEnabledForPort
bool DecodeGeneveEnabledForPort(const uint16_t sp, const uint16_t dp)
Definition: decode-geneve.c:91
DetectPortParse
int DetectPortParse(const DetectEngineCtx *de_ctx, DetectPort **head, const char *str)
Function for parsing port strings.
Definition: detect-engine-port.c:1246
GeneveOption_::type
uint8_t type
Definition: decode-geneve.c:77
decode.h
DecodeGeneve
int DecodeGeneve(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-geneve.c:185
util-debug.h
VALID_GENEVE_VERSIONS
#define VALID_GENEVE_VERSIONS
Definition: decode-geneve.c:47
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:208
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
pkt-var.h
Packet_::sp
Port sp
Definition: decode.h:437
eth_type
uint16_t eth_type
Definition: decode-ethernet.h:2
GeneveHeader_::flags
uint8_t flags
Definition: decode-geneve.c:84
GENEVE_TOTAL_OPT_LEN
#define GENEVE_TOTAL_OPT_LEN(hdr_ptr)
Definition: decode-geneve.c:55
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:134
detect-engine-port.h
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:249
DetectPort_
Port structure for detection engine.
Definition: detect.h:214
util-profiling.h
Packet_
Definition: decode.h:430
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:812
GeneveOption_
Definition: decode-geneve.c:75
GeneveOption
struct GeneveOption_ GeneveOption
GeneveHeader_::options
GeneveOption options[0]
Definition: decode-geneve.c:88
DECODE_TUNNEL_ETHERNET
@ DECODE_TUNNEL_ETHERNET
Definition: decode.h:808
decode-events.h
Flow_::next
struct Flow_ * next
Definition: flow.h:395
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
GENEVE_MAX_PORTS
#define GENEVE_MAX_PORTS
Definition: decode-geneve.c:63
PKT_SRC_DECODER_GENEVE
@ PKT_SRC_DECODER_GENEVE
Definition: decode.h:65
GENEVE_UNSET_PORT
#define GENEVE_UNSET_PORT
Definition: decode-geneve.c:64
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:168
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
GENEVE_DEFAULT_PORT_S
#define GENEVE_DEFAULT_PORT_S
Definition: decode-geneve.c:66
GENEVE_UNKNOWN_PAYLOAD_TYPE
@ GENEVE_UNKNOWN_PAYLOAD_TYPE
Definition: decode-events.h:199
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:414
suricata-common.h
PacketQueueNoLock_::top
struct Packet_ * top
Definition: packet-queue.h:35
GENEVE_TOTAL_HEADER_LEN
#define GENEVE_TOTAL_HEADER_LEN(hdr_ptr)
Definition: decode-geneve.c:56
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:695
GeneveHeader_
Definition: decode-geneve.c:82
GeneveHeader_::eth_type
uint16_t eth_type
Definition: decode-geneve.c:85
GeneveOption_::option_class
uint16_t option_class
Definition: decode-geneve.c:76
decode-geneve.h
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:173
GENEVE_RESERVED_FLAGS
#define GENEVE_RESERVED_FLAGS(hdr_ptr)
Definition: decode-geneve.c:52
GeneveHeader
struct GeneveHeader_ GeneveHeader
head
Flow * head
Definition: flow-hash.h:1
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:673
ConfNode_
Definition: conf.h:32
DecodeThreadVars_::counter_geneve
uint16_t counter_geneve
Definition: decode.h:707
ETHERNET_TYPE_ARP
#define ETHERNET_TYPE_ARP
Definition: decode-ethernet.h:35
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:111
GeneveHeader_::vni
uint8_t vni[3]
Definition: decode-geneve.c:86
Packet_::udph
UDPHdr * udph
Definition: decode.h:559
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:897
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:41
DecodeGeneveConfig
void DecodeGeneveConfig(void)
Definition: decode-geneve.c:128
GENEVE_VERSION
#define GENEVE_VERSION(hdr_ptr)
Definition: decode-geneve.c:51
GENEVE_MIN_HEADER_LEN
#define GENEVE_MIN_HEADER_LEN
Definition: decode-geneve.c:54
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:308
flow.h
DecodeGeneveRegisterTests
void DecodeGeneveRegisterTests(void)
Definition: decode-geneve.c:490
ETHERNET_TYPE_IP
#define ETHERNET_TYPE_IP
Definition: decode-ethernet.h:34
DetectPortCleanupList
void DetectPortCleanupList(const DetectEngineCtx *de_ctx, DetectPort *head)
Free a DetectPort list and each of its members.
Definition: detect-engine-port.c:124
DECODE_TUNNEL_UNSET
@ DECODE_TUNNEL_UNSET
Definition: decode.h:817
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:104
GeneveHeader_::res
uint8_t res
Definition: decode-geneve.c:87
GeneveOption_::option_data
uint8_t option_data[0]
Definition: decode-geneve.c:79