Go to the documentation of this file.
125 SCLogDebug(
"FIXME: DecodeTunnel: protocol %" PRIu32
" not supported.",
proto);
157 for (uint8_t i = 0; i < p->
events.
cnt; i++) {
182 SCLogDebug(
"allocated a new packet only using alloc...");
260 uint32_t newsize =
offset + datalen;
338 if (parent->
root != NULL)
366 TUNNEL_INCR_PKT_TPR(p);
371 DecodeSetNoPayloadInspectionFlag(parent);
400 if (parent->
root != NULL)
433 TUNNEL_INCR_PKT_TPR(parent);
438 DecodeSetNoPayloadInspectionFlag(parent);
449 #ifdef CAPTURE_OFFLOAD
455 (state == FLOW_STATE_CAPTURE_BYPASSED)) {
513 static HashTable *g_counter_table = NULL;
519 if (g_counter_table) {
521 g_counter_table = NULL;
611 strncmp(
DEvents[i].event_name,
"decoder.", 8) == 0)
614 if (g_counter_table == NULL) {
618 if (g_counter_table == NULL) {
620 "table init failed");
625 char *dot = strchr(
DEvents[i].event_name,
'.');
627 snprintf(name,
sizeof(name),
"%s.%s",
635 "table name init failed");
639 "table name add failed");
681 PrintInet(AF_INET, (
const void *)&a->addr_data32[0], s,
sizeof(s));
700 SCLogError(
"initializing flow log API for thread failed");
735 p->
ext_pkt = (uint8_t *) pktdata;
743 const char *pkt_src_str =
"<unknown>";
746 pkt_src_str =
"wire/pcap";
749 pkt_src_str =
"gre tunnel";
752 pkt_src_str =
"ipv4 tunnel";
755 pkt_src_str =
"ipv6 tunnel";
758 pkt_src_str =
"teredo tunnel";
761 pkt_src_str =
"defrag";
764 pkt_src_str =
"stream (detect/log)";
767 pkt_src_str =
"stream (flow timeout)";
770 pkt_src_str =
"geneve encapsulation";
773 pkt_src_str =
"vxlan encapsulation";
776 pkt_src_str =
"detect reload flush";
779 pkt_src_str =
"capture timeout flush";
789 return "decode error";
791 return "defrag error";
793 return "defrag memcap";
795 return "flow memcap";
799 return "stream error";
801 return "stream memcap";
803 return "stream midstream";
805 return "applayer error";
807 return "applayer memcap";
811 return "threshold detection_filter";
815 return "tunnel packet drop";
851 if (
ConfGetInt(
"decoder.max-layers", &value) == 1) {
852 if (value < 0 || value > UINT8_MAX) {
864 if (
ConfGetInt(
"packet-alert-max", &max) == 1) {
865 if (max <= 0 || max > UINT8_MAX) {
866 SCLogWarning(
"Invalid value for packet-alert-max, default value set instead");
bool PacketCheckAction(const Packet *p, const uint8_t a)
uint16_t counter_flow_get_used_eval_busy
@ PKT_DROP_REASON_DEFRAG_MEMCAP
@ PKT_DROP_REASON_DEFRAG_ERROR
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
uint16_t counter_defrag_ipv4_reassembled
@ PKT_DROP_REASON_RULES_THRESHOLD
uint16_t counter_ethertype_unknown
uint16_t counter_flow_udp
uint16_t counter_ips_blocked
uint16_t counter_flow_active
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
int DecodeERSPAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
ERSPAN Type II.
void PacketFreeOrRelease(Packet *p)
Return a packet to where it was allocated.
uint16_t counter_flow_icmp4
uint16_t counter_max_pkt_size
int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
@ DECODE_EVENT_PACKET_MAX
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
void PacketBypassCallback(Packet *p)
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
uint16_t counter_avg_pkt_size
void DecodeERSPANConfig(void)
Functions to decode ERSPAN Type I and II packets.
void PacketPoolReturnPacket(Packet *p)
Return packet to Packet pool.
FlowStorageId GetFlowBypassInfoID(void)
@ PKT_DROP_REASON_STREAM_MEMCAP
int DecodeNSH(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode NSH packets.
@ PKT_DROP_REASON_FLOW_MEMCAP
void DecodeTeredoConfig(void)
const char * PacketDropReasonToString(enum PacketDropReason r)
uint8_t events[PACKET_ENGINE_EVENT_MAX]
#define PKT_STREAM_MODIFIED
@ DECODE_TUNNEL_IPV6_TEREDO
void AddressDebugPrint(Address *a)
Debug print function for printing addresses.
uint16_t counter_flow_spare_sync_avg
Packet * PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto)
Setup a pseudo packet (reassembled frags)
@ GENERIC_TOO_MANY_LAYERS
@ PKT_SRC_CAPTURE_TIMEOUT
PacketAlert * PacketAlertCreate(void)
Initialize PacketAlerts with dynamic alerts array size.
uint16_t counter_flow_get_used_eval
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
Copy data to Packet payload at given offset.
#define FLOW_PKT_TOSERVER
#define ACTION_REJECT_ANY
uint16_t counter_flow_tcp
#define SCMUTEX_INITIALIZER
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
void PacketAlertGetMaxConfig(void)
uint8_t decoder_max_layers
#define SET_TUNNEL_PKT(p)
uint16_t counter_tcp_active_sessions
char StringHashCompareFunc(void *data1, uint16_t datalen1, void *data2, uint16_t datalen2)
int(* BypassPacketsFlow)(struct Packet_ *)
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
void DecodeVXLANConfig(void)
uint16_t counter_max_mac_addrs_src
void DecodeUnregisterCounters(void)
#define GET_PKT_DIRECT_MAX_SIZE(p)
uint16_t counter_flow_get_used
uint32_t StringHashFunc(HashTable *ht, void *data, uint16_t datalen)
PacketEngineEvents events
void PacketAlertFree(PacketAlert *pa)
void HashTableFree(HashTable *ht)
uint16_t counter_flow_spare_sync_empty
uint16_t counter_flow_tcp_reuse
uint16_t counter_flow_total
#define PKT_DEFAULT_MAX_DECODED_LAYERS
const char * stats_decoder_events_prefix
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
uint16_t counter_flow_spare_sync
#define SET_PKT_LEN(p, len)
uint16_t counter_ipv6inipv6
uint16_t StatsRegisterMaxCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the maximum of all the values assigned to it.
@ FLOW_STATE_LOCAL_BYPASSED
uint16_t counter_flow_get_used_failed
uint16_t counter_ips_rejected
#define PKT_IS_TOSERVER(p)
int DecodeERSPANTypeI(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
ERSPAN Type I.
const struct DecodeEvents_ DEvents[]
@ PKT_DROP_REASON_APPLAYER_ERROR
TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void *initdata, void **data)
thread init for the flow logger This will run the thread init functions for the individual registered...
#define SCMutexUnlock(mut)
void PacketSwap(Packet *p)
switch direction of a packet
@ PKT_DROP_REASON_NOT_SET
void PacketDestructor(Packet *p)
Cleanup a packet so that we can free it. No memset needed..
void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s)
AppLayerThreadCtx * AppLayerGetCtxThread(ThreadVars *tv)
Creates a new app layer thread context.
void * HashTableLookup(HashTable *ht, void *data, uint16_t datalen)
#define UNSET_TUNNEL_PKT(p)
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
#define FLOW_PKT_TOCLIENT_FIRST
int FlowSetStorageById(Flow *f, FlowStorageId id, void *ptr)
void PacketFree(Packet *p)
Return a malloced packet.
const char * PktSrcToString(enum PktSrcEnum pkt_src)
uint16_t counter_vlan_qinq
#define SCLogWarning(...)
Macro used to log WARNING messages.
int HashTableAdd(HashTable *ht, void *data, uint16_t datalen)
void StringHashFreeFunc(void *data)
uint16_t counter_defrag_ipv6_timeouts
int PacketCallocExtPkt(Packet *p, int datalen)
@ PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
uint16_t counter_ips_accepted
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
AppLayerThreadCtx * app_tctx
uint16_t counter_defrag_ipv4_timeouts
@ PKT_DROP_REASON_STREAM_ERROR
struct LiveDevice_ * livedev
uint16_t counter_ieee8021ah
#define SCReturnPtr(x, type)
uint16_t counter_ipv4inipv6
#define FLOW_PKT_TOCLIENT
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
void FlowUpdateState(Flow *f, const enum FlowState s)
uint32_t default_packet_size
uint8_t nb_decoded_layers
void(* ReleasePacket)(struct Packet_ *)
@ PKT_DROP_REASON_INNER_PACKET
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
uint16_t counter_flow_spare_sync_incomplete
@ PKT_DROP_REASON_APPLAYER_MEMCAP
void DecodeGlobalConfig(void)
uint16_t counter_flow_icmp6
uint16_t counter_ips_replaced
@ PKT_DROP_REASON_NFQ_ERROR
uint16_t counter_defrag_ipv6_reassembled
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
void CaptureStatsUpdate(ThreadVars *tv, CaptureStats *s, const Packet *p)
#define PACKET_PROFILING_START(p)
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
#define SCLogError(...)
Macro used to log ERROR messages.
TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data)
@ PKT_SRC_DETECT_RELOAD_FLUSH
Structure to hold thread specific data for all decode modules.
void AppLayerDestroyCtxThread(AppLayerThreadCtx *app_tctx)
Destroys the context created by AppLayeGetCtxThread().
void * output_flow_thread_data
uint16_t counter_max_mac_addrs_dst
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
uint16_t counter_defrag_max_hit
HashTable * HashTableInit(uint32_t size, uint32_t(*Hash)(struct HashTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
Packet * PacketPoolGetPacket(void)
Get a new packet from the packet pool.
#define GET_PKT_DIRECT_DATA(p)
#define ENGINE_SET_INVALID_EVENT(p, e)
void DecodeGeneveConfig(void)
uint16_t counter_flow_memcap
uint16_t counter_defrag_ipv6_fragments
uint16_t packet_alert_max
uint16_t StatsRegisterAvgCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the average of all the values assigned to it.
void PacketDefragPktSetupParent(Packet *parent)
inform defrag "parent" that a pseudo packet is now associated to it.
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
bool stats_decoder_events
@ PKT_DROP_REASON_STREAM_MIDSTREAM
int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
void PacketInit(Packet *p)
Initialize a packet structure for use.
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
uint16_t counter_flow_get_used_eval_reject
int DecodeVLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
#define FLOW_PKT_TOSERVER_FIRST
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
#define DEBUG_VALIDATE_BUG_ON(exp)
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
@ PKT_DROP_REASON_FLOW_DROP
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
uint16_t counter_engine_events[DECODE_EVENT_MAX]
@ PKT_DROP_REASON_DECODE_ERROR
uint16_t counter_defrag_ipv4_fragments