suricata
decode.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \defgroup decode Packet decoding
20  *
21  * \brief Code in charge of protocol decoding
22  *
23  * The task of decoding packets is made in different files and
24  * as Suricata is supporting encapsulation there is a potential
25  * recursivity in the call.
26  *
27  * For each protocol a DecodePROTO function is provided. For
28  * example we have DecodeIPV4() for IPv4 and DecodePPP() for
29  * PPP.
30  *
31  * These functions have all a pkt and a len argument which
32  * are respectively a pointer to the protocol data and the length
33  * of this protocol data.
34  *
35  * \attention The pkt parameter must point to the effective data because
36  * it will be used later to set per protocol pointer like Packet::tcph
37  *
38  * @{
39  */
40 
41 
42 /**
43  * \file
44  *
45  * \author Victor Julien <victor@inliniac.net>
46  *
47  * Decode the raw packet
48  */
49 
50 #include "suricata-common.h"
51 #include "suricata.h"
52 #include "conf.h"
53 #include "decode.h"
54 #include "decode-teredo.h"
55 #include "util-debug.h"
56 #include "util-mem.h"
57 #include "app-layer-detect-proto.h"
58 #include "app-layer.h"
59 #include "tm-threads.h"
60 #include "util-error.h"
61 #include "util-print.h"
62 #include "tmqh-packetpool.h"
63 #include "util-profiling.h"
64 #include "pkt-var.h"
65 #include "util-mpm-ac.h"
66 #include "util-hash-string.h"
67 #include "output.h"
68 #include "output-flow.h"
69 #include "flow-storage.h"
70 
71 uint32_t default_packet_size = 0;
72 extern bool stats_decoder_events;
73 extern const char *stats_decoder_events_prefix;
74 extern bool stats_stream_events;
75 
77  const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
78 {
79  switch (proto) {
80  case DECODE_TUNNEL_PPP:
81  return DecodePPP(tv, dtv, p, pkt, len);
82  case DECODE_TUNNEL_IPV4:
83  return DecodeIPV4(tv, dtv, p, pkt, len);
84  case DECODE_TUNNEL_IPV6:
86  return DecodeIPV6(tv, dtv, p, pkt, len);
87  case DECODE_TUNNEL_VLAN:
88  return DecodeVLAN(tv, dtv, p, pkt, len);
90  return DecodeEthernet(tv, dtv, p, pkt, len);
92  return DecodeERSPAN(tv, dtv, p, pkt, len);
94  return DecodeERSPANTypeI(tv, dtv, p, pkt, len);
95  default:
96  SCLogDebug("FIXME: DecodeTunnel: protocol %" PRIu32 " not supported.", proto);
97  break;
98  }
99  return TM_ECODE_OK;
100 }
101 
102 /**
103  * \brief Return a malloced packet.
104  */
106 {
108  SCFree(p);
109 }
110 
111 /**
112  * \brief Finalize decoding of a packet
113  *
114  * This function needs to be call at the end of decode
115  * functions when decoding has been successful.
116  *
117  */
119 {
120  if (p->flags & PKT_IS_INVALID) {
122  }
123 }
124 
127 {
128  for (uint8_t i = 0; i < p->events.cnt; i++) {
129  const uint8_t e = p->events.events[i];
130 
132  continue;
134  continue;
136  }
137 }
138 
139 /**
140  * \brief Get a malloced packet.
141  *
142  * \retval p packet, NULL on error
143  */
145 {
147  if (unlikely(p == NULL)) {
148  return NULL;
149  }
150 
151  memset(p, 0, SIZE_OF_PACKET);
154  p->flags |= PKT_ALLOC;
155 
156  SCLogDebug("allocated a new packet only using alloc...");
157 
159  return p;
160 }
161 
162 /**
163  * \brief Return a packet to where it was allocated.
164  */
166 {
167  if (p->flags & PKT_ALLOC)
168  PacketFree(p);
169  else
171 }
172 
173 /**
174  * \brief Get a packet. We try to get a packet from the packetpool first, but
175  * if that is empty we alloc a packet that is free'd again after
176  * processing.
177  *
178  * \retval p packet, NULL on error
179  */
181 {
182  /* try the pool first */
184 
185  if (p == NULL) {
186  /* non fatal, we're just not processing a packet then */
187  p = PacketGetFromAlloc();
188  } else {
190  }
191 
192  return p;
193 }
194 
195 inline int PacketCallocExtPkt(Packet *p, int datalen)
196 {
197  if (! p->ext_pkt) {
198  p->ext_pkt = SCCalloc(1, datalen);
199  if (unlikely(p->ext_pkt == NULL)) {
200  SET_PKT_LEN(p, 0);
201  return -1;
202  }
203  }
204  return 0;
205 }
206 
207 /**
208  * \brief Copy data to Packet payload at given offset
209  *
210  * This function copies data/payload to a Packet. It uses the
211  * space allocated at Packet creation (pointed by Packet::pkt)
212  * or allocate some memory (pointed by Packet::ext_pkt) if the
213  * data size is to big to fit in initial space (of size
214  * default_packet_size).
215  *
216  * \param Pointer to the Packet to modify
217  * \param Offset of the copy relatively to payload of Packet
218  * \param Pointer to the data to copy
219  * \param Length of the data to copy
220  */
221 inline int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
222 {
223  if (unlikely(offset + datalen > MAX_PAYLOAD_SIZE)) {
224  /* too big */
225  return -1;
226  }
227 
228  /* Do we have already an packet with allocated data */
229  if (! p->ext_pkt) {
230  uint32_t newsize = offset + datalen;
231  // check overflow
232  if (newsize < offset)
233  return -1;
234  if (newsize <= default_packet_size) {
235  /* data will fit in memory allocated with packet */
236  memcpy(GET_PKT_DIRECT_DATA(p) + offset, data, datalen);
237  } else {
238  /* here we need a dynamic allocation */
240  if (unlikely(p->ext_pkt == NULL)) {
241  SET_PKT_LEN(p, 0);
242  return -1;
243  }
244  /* copy initial data */
246  /* copy data as asked */
247  memcpy(p->ext_pkt + offset, data, datalen);
248  }
249  } else {
250  memcpy(p->ext_pkt + offset, data, datalen);
251  }
252  return 0;
253 }
254 
255 /**
256  * \brief Copy data to Packet payload and set packet length
257  *
258  * \param Pointer to the Packet to modify
259  * \param Pointer to the data to copy
260  * \param Length of the data to copy
261  */
262 inline int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
263 {
264  SET_PKT_LEN(p, (size_t)pktlen);
265  return PacketCopyDataOffset(p, 0, pktdata, pktlen);
266 }
267 
268 /**
269  * \brief Setup a pseudo packet (tunnel)
270  *
271  * \param parent parent packet for this pseudo pkt
272  * \param pkt raw packet data
273  * \param len packet data length
274  * \param proto protocol of the tunneled packet
275  *
276  * \retval p the pseudo packet or NULL if out of memory
277  */
279  const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
280 {
281  int ret;
282 
283  SCEnter();
284 
285  /* get us a packet */
287  if (unlikely(p == NULL)) {
288  SCReturnPtr(NULL, "Packet");
289  }
290 
291  /* copy packet and set length, proto */
292  PacketCopyData(p, pkt, len);
293  p->recursion_level = parent->recursion_level + 1;
294  p->ts.tv_sec = parent->ts.tv_sec;
295  p->ts.tv_usec = parent->ts.tv_usec;
296  p->datalink = DLT_RAW;
297  p->tenant_id = parent->tenant_id;
298 
299  /* set the root ptr to the lowest layer */
300  if (parent->root != NULL)
301  p->root = parent->root;
302  else
303  p->root = parent;
304 
305  /* tell new packet it's part of a tunnel */
306  SET_TUNNEL_PKT(p);
307 
308  ret = DecodeTunnel(tv, dtv, p, GET_PKT_DATA(p),
309  GET_PKT_LEN(p), proto);
310 
311  if (unlikely(ret != TM_ECODE_OK) ||
313  {
314  /* Not a (valid) tunnel packet */
315  SCLogDebug("tunnel packet is invalid");
316 
317  p->root = NULL;
318  UNSET_TUNNEL_PKT(p);
320  SCReturnPtr(NULL, "Packet");
321  }
322 
323 
324  /* tell parent packet it's part of a tunnel */
325  SET_TUNNEL_PKT(parent);
326 
327  /* increment tunnel packet refcnt in the root packet */
329 
330  /* disable payload (not packet) inspection on the parent, as the payload
331  * is the packet we will now run through the system separately. We do
332  * check it against the ip/port/other header checks though */
334  SCReturnPtr(p, "Packet");
335 }
336 
337 /**
338  * \brief Setup a pseudo packet (reassembled frags)
339  *
340  * Difference with PacketPseudoPktSetup is that this func doesn't increment
341  * the recursion level. It needs to be on the same level as the frags because
342  * we run the flow engine against this and we need to get the same flow.
343  *
344  * \param parent parent packet for this pseudo pkt
345  * \param pkt raw packet data
346  * \param len packet data length
347  * \param proto protocol of the tunneled packet
348  *
349  * \retval p the pseudo packet or NULL if out of memory
350  */
351 Packet *PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto)
352 {
353  SCEnter();
354 
355  /* get us a packet */
357  if (unlikely(p == NULL)) {
358  SCReturnPtr(NULL, "Packet");
359  }
360 
361  /* set the root ptr to the lowest layer */
362  if (parent->root != NULL)
363  p->root = parent->root;
364  else
365  p->root = parent;
366 
367  /* copy packet and set lenght, proto */
368  if (pkt && len) {
369  PacketCopyData(p, pkt, len);
370  }
371  p->recursion_level = parent->recursion_level; /* NOT incremented */
372  p->ts.tv_sec = parent->ts.tv_sec;
373  p->ts.tv_usec = parent->ts.tv_usec;
374  p->datalink = DLT_RAW;
375  p->tenant_id = parent->tenant_id;
376  /* tell new packet it's part of a tunnel */
377  SET_TUNNEL_PKT(p);
378  p->vlan_id[0] = parent->vlan_id[0];
379  p->vlan_id[1] = parent->vlan_id[1];
380  p->vlan_idx = parent->vlan_idx;
381  p->livedev = parent->livedev;
382 
383  SCReturnPtr(p, "Packet");
384 }
385 
386 /**
387  * \brief inform defrag "parent" that a pseudo packet is
388  * now associated to it.
389  */
391 {
392  /* tell parent packet it's part of a tunnel */
393  SET_TUNNEL_PKT(parent);
394 
395  /* increment tunnel packet refcnt in the root packet */
396  TUNNEL_INCR_PKT_TPR(parent);
397 
398  /* disable payload (not packet) inspection on the parent, as the payload
399  * is the packet we will now run through the system separately. We do
400  * check it against the ip/port/other header checks though */
402 }
403 
405 {
406 #ifdef CAPTURE_OFFLOAD
407  /* Don't try to bypass if flow is already out or
408  * if we have failed to do it once */
409  if (p->flow) {
410  int state = SC_ATOMIC_GET(p->flow->flow_state);
411  if ((state == FLOW_STATE_LOCAL_BYPASSED) ||
412  (state == FLOW_STATE_CAPTURE_BYPASSED)) {
413  return;
414  }
415  FlowBypassInfo *fc = SCCalloc(sizeof(FlowBypassInfo), 1);
416  if (fc) {
418  } else {
419  return;
420  }
421  }
422  if (p->BypassPacketsFlow && p->BypassPacketsFlow(p)) {
423  if (p->flow) {
424  FlowUpdateState(p->flow, FLOW_STATE_CAPTURE_BYPASSED);
425  }
426  } else {
427  if (p->flow) {
429  }
430  }
431 #else /* CAPTURE_OFFLOAD */
432  if (p->flow) {
433  int state = SC_ATOMIC_GET(p->flow->flow_state);
434  if (state == FLOW_STATE_LOCAL_BYPASSED)
435  return;
437  }
438 #endif
439 }
440 
441 /** \brief switch direction of a packet */
443 {
444  if (PKT_IS_TOSERVER(p)) {
447 
451  }
452  } else {
455 
459  }
460  }
461 }
462 
463 /* counter name store */
464 static HashTable *g_counter_table = NULL;
465 static SCMutex g_counter_table_mutex = SCMUTEX_INITIALIZER;
466 
468 {
469  SCMutexLock(&g_counter_table_mutex);
470  if (g_counter_table) {
471  HashTableFree(g_counter_table);
472  g_counter_table = NULL;
473  }
474  SCMutexUnlock(&g_counter_table_mutex);
475 }
476 
478 {
479  /* register counters */
480  dtv->counter_pkts = StatsRegisterCounter("decoder.pkts", tv);
481  dtv->counter_bytes = StatsRegisterCounter("decoder.bytes", tv);
482  dtv->counter_invalid = StatsRegisterCounter("decoder.invalid", tv);
483  dtv->counter_ipv4 = StatsRegisterCounter("decoder.ipv4", tv);
484  dtv->counter_ipv6 = StatsRegisterCounter("decoder.ipv6", tv);
485  dtv->counter_eth = StatsRegisterCounter("decoder.ethernet", tv);
486  dtv->counter_raw = StatsRegisterCounter("decoder.raw", tv);
487  dtv->counter_null = StatsRegisterCounter("decoder.null", tv);
488  dtv->counter_sll = StatsRegisterCounter("decoder.sll", tv);
489  dtv->counter_tcp = StatsRegisterCounter("decoder.tcp", tv);
490  dtv->counter_udp = StatsRegisterCounter("decoder.udp", tv);
491  dtv->counter_sctp = StatsRegisterCounter("decoder.sctp", tv);
492  dtv->counter_icmpv4 = StatsRegisterCounter("decoder.icmpv4", tv);
493  dtv->counter_icmpv6 = StatsRegisterCounter("decoder.icmpv6", tv);
494  dtv->counter_ppp = StatsRegisterCounter("decoder.ppp", tv);
495  dtv->counter_pppoe = StatsRegisterCounter("decoder.pppoe", tv);
496  dtv->counter_gre = StatsRegisterCounter("decoder.gre", tv);
497  dtv->counter_vlan = StatsRegisterCounter("decoder.vlan", tv);
498  dtv->counter_vlan_qinq = StatsRegisterCounter("decoder.vlan_qinq", tv);
499  dtv->counter_vxlan = StatsRegisterCounter("decoder.vxlan", tv);
500  dtv->counter_ieee8021ah = StatsRegisterCounter("decoder.ieee8021ah", tv);
501  dtv->counter_teredo = StatsRegisterCounter("decoder.teredo", tv);
502  dtv->counter_ipv4inipv6 = StatsRegisterCounter("decoder.ipv4_in_ipv6", tv);
503  dtv->counter_ipv6inipv6 = StatsRegisterCounter("decoder.ipv6_in_ipv6", tv);
504  dtv->counter_mpls = StatsRegisterCounter("decoder.mpls", tv);
505  dtv->counter_avg_pkt_size = StatsRegisterAvgCounter("decoder.avg_pkt_size", tv);
506  dtv->counter_max_pkt_size = StatsRegisterMaxCounter("decoder.max_pkt_size", tv);
507  dtv->counter_erspan = StatsRegisterMaxCounter("decoder.erspan", tv);
508  dtv->counter_flow_memcap = StatsRegisterCounter("flow.memcap", tv);
509 
512  dtv->counter_flow_icmp4 = StatsRegisterCounter("flow.icmpv4", tv);
513  dtv->counter_flow_icmp6 = StatsRegisterCounter("flow.icmpv6", tv);
514 
516  StatsRegisterCounter("defrag.ipv4.fragments", tv);
518  StatsRegisterCounter("defrag.ipv4.reassembled", tv);
520  StatsRegisterCounter("defrag.ipv4.timeouts", tv);
522  StatsRegisterCounter("defrag.ipv6.fragments", tv);
524  StatsRegisterCounter("defrag.ipv6.reassembled", tv);
526  StatsRegisterCounter("defrag.ipv6.timeouts", tv);
528  StatsRegisterCounter("defrag.max_frag_hits", tv);
529 
530  for (int i = 0; i < DECODE_EVENT_MAX; i++) {
531  BUG_ON(i != (int)DEvents[i].code);
532 
534  continue;
536  continue;
537 
538  if (i < DECODE_EVENT_PACKET_MAX &&
539  strncmp(DEvents[i].event_name, "decoder.", 8) == 0)
540  {
541  SCMutexLock(&g_counter_table_mutex);
542  if (g_counter_table == NULL) {
543  g_counter_table = HashTableInit(256, StringHashFunc,
546  if (g_counter_table == NULL) {
547  FatalError(SC_ERR_INITIALIZATION, "decoder counter hash "
548  "table init failed");
549  }
550  }
551 
552  char name[256];
553  char *dot = strchr(DEvents[i].event_name, '.');
554  BUG_ON(!dot);
555  snprintf(name, sizeof(name), "%s.%s",
557 
558  const char *found = HashTableLookup(g_counter_table, name, 0);
559  if (!found) {
560  char *add = SCStrdup(name);
561  if (add == NULL)
562  FatalError(SC_ERR_INITIALIZATION, "decoder counter hash "
563  "table name init failed");
564  int r = HashTableAdd(g_counter_table, add, 0);
565  if (r != 0)
566  FatalError(SC_ERR_INITIALIZATION, "decoder counter hash "
567  "table name add failed");
568  found = add;
569  }
571  found, tv);
572 
573  SCMutexUnlock(&g_counter_table_mutex);
574  } else {
576  DEvents[i].event_name, tv);
577  }
578  }
579 
580  return;
581 }
582 
584  const DecodeThreadVars *dtv, const Packet *p)
585 {
587  //StatsIncr(tv, dtv->counter_pkts_per_sec);
591 }
592 
593 /**
594  * \brief Debug print function for printing addresses
595  *
596  * \param Address object
597  *
598  * \todo IPv6
599  */
601 {
602  if (a == NULL)
603  return;
604 
605  switch (a->family) {
606  case AF_INET:
607  {
608  char s[16];
609  PrintInet(AF_INET, (const void *)&a->addr_data32[0], s, sizeof(s));
610  SCLogDebug("%s", s);
611  break;
612  }
613  }
614 }
615 
616 /** \brief Alloc and setup DecodeThreadVars */
618 {
619  DecodeThreadVars *dtv = NULL;
620 
621  if ( (dtv = SCMalloc(sizeof(DecodeThreadVars))) == NULL)
622  return NULL;
623  memset(dtv, 0, sizeof(DecodeThreadVars));
624 
626 
628  SCLogError(SC_ERR_THREAD_INIT, "initializing flow log API for thread failed");
630  return NULL;
631  }
632 
633  return dtv;
634 }
635 
637 {
638  if (dtv != NULL) {
639  if (dtv->app_tctx != NULL)
641 
642  if (dtv->output_flow_thread_data != NULL)
644 
645  SCFree(dtv);
646  }
647 }
648 
649 /**
650  * \brief Set data for Packet and set length when zero copy is used
651  *
652  * \param Pointer to the Packet to modify
653  * \param Pointer to the data
654  * \param Length of the data
655  */
656 inline int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
657 {
658  SET_PKT_LEN(p, (size_t)pktlen);
659  if (unlikely(!pktdata)) {
660  return -1;
661  }
662  // ext_pkt cannot be const (because we sometimes copy)
663  p->ext_pkt = (uint8_t *) pktdata;
664  p->flags |= PKT_ZERO_COPY;
665 
666  return 0;
667 }
668 
669 const char *PktSrcToString(enum PktSrcEnum pkt_src)
670 {
671  const char *pkt_src_str = "<unknown>";
672  switch (pkt_src) {
673  case PKT_SRC_WIRE:
674  pkt_src_str = "wire/pcap";
675  break;
676  case PKT_SRC_DECODER_GRE:
677  pkt_src_str = "gre tunnel";
678  break;
680  pkt_src_str = "ipv4 tunnel";
681  break;
683  pkt_src_str = "ipv6 tunnel";
684  break;
686  pkt_src_str = "teredo tunnel";
687  break;
688  case PKT_SRC_DEFRAG:
689  pkt_src_str = "defrag";
690  break;
692  pkt_src_str = "stream (detect/log)";
693  break;
694  case PKT_SRC_FFR:
695  pkt_src_str = "stream (flow timeout)";
696  break;
698  pkt_src_str = "vxlan encapsulation";
699  break;
701  pkt_src_str = "detect reload flush";
702  break;
704  pkt_src_str = "capture timeout flush";
705  break;
706  }
707  return pkt_src_str;
708 }
709 
711 {
714  } else if (unlikely(PACKET_TEST_ACTION(p, ACTION_DROP))) {
716  } else if (unlikely(p->flags & PKT_STREAM_MODIFIED)) {
718  } else {
720  }
721 }
722 
724 {
725  s->counter_ips_accepted = StatsRegisterCounter("ips.accepted", tv);
726  s->counter_ips_blocked = StatsRegisterCounter("ips.blocked", tv);
727  s->counter_ips_rejected = StatsRegisterCounter("ips.rejected", tv);
728  s->counter_ips_replaced = StatsRegisterCounter("ips.replaced", tv);
729 }
730 
732 {
735 }
736 
737 /**
738  * @}
739  */
tm-threads.h
DecodeThreadVars_::counter_defrag_ipv4_reassembled
uint16_t counter_defrag_ipv4_reassembled
Definition: decode.h:662
util-hash-string.h
DECODE_EVENT_PACKET_MAX
@ DECODE_EVENT_PACKET_MAX
Definition: decode-events.h:195
DecodeThreadVars_::counter_flow_udp
uint16_t counter_flow_udp
Definition: decode.h:672
len
uint8_t len
Definition: app-layer-dnp3.h:4
DecodeThreadVars_::counter_bytes
uint16_t counter_bytes
Definition: decode.h:629
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:885
CaptureStats_::counter_ips_blocked
uint16_t counter_ips_blocked
Definition: decode.h:687
DecodeThreadVars_::counter_eth
uint16_t counter_eth
Definition: decode.h:635
SCStrdup
#define SCStrdup(a)
Definition: util-mem.h:268
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:168
offset
uint64_t offset
Definition: util-streaming-buffer.h:2
DecodeERSPAN
int DecodeERSPAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
ERSPAN Type II.
Definition: decode-erspan.c:60
PacketFreeOrRelease
void PacketFreeOrRelease(Packet *p)
Return a packet to where it was allocated.
Definition: decode.c:165
DecodeThreadVars_::counter_flow_icmp4
uint16_t counter_flow_icmp4
Definition: decode.h:673
DecodeThreadVars_::counter_vxlan
uint16_t counter_vxlan
Definition: decode.h:651
DecodeThreadVars_::counter_max_pkt_size
uint16_t counter_max_pkt_size
Definition: decode.h:631
DecodePPP
int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-ppp.c:43
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:262
Packet_::vlan_id
uint16_t vlan_id[2]
Definition: decode.h:436
PacketBypassCallback
void PacketBypassCallback(Packet *p)
Definition: decode.c:404
DecodeThreadVars_::counter_avg_pkt_size
uint16_t counter_avg_pkt_size
Definition: decode.h:630
PacketPoolReturnPacket
void PacketPoolReturnPacket(Packet *p)
Return packet to Packet pool.
Definition: tmqh-packetpool.c:289
SCFree
#define SCFree(a)
Definition: util-mem.h:322
FlowBypassInfo_
Definition: flow.h:503
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
ACTION_REJECT
#define ACTION_REJECT
Definition: action-globals.h:31
DecodeTeredoConfig
void DecodeTeredoConfig(void)
Definition: decode-teredo.c:99
PacketEngineEvents_::events
uint8_t events[PACKET_ENGINE_EVENT_MAX]
Definition: decode.h:308
CaptureStats_
Definition: decode.h:684
PKT_STREAM_MODIFIED
#define PKT_STREAM_MODIFIED
Definition: decode.h:1079
DECODE_TUNNEL_IPV6_TEREDO
@ DECODE_TUNNEL_IPV6_TEREDO
Definition: decode.h:886
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:335
AddressDebugPrint
void AddressDebugPrint(Address *a)
Debug print function for printing addresses.
Definition: decode.c:600
PKT_SRC_DECODER_IPV4
@ PKT_SRC_DECODER_IPV4
Definition: decode.h:51
PacketDefragPktSetup
Packet * PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto)
Setup a pseudo packet (reassembled frags)
Definition: decode.c:351
stats_stream_events
bool stats_stream_events
Definition: counters.c:105
PKT_ZERO_COPY
#define PKT_ZERO_COPY
Definition: decode.h:1087
PKT_SRC_CAPTURE_TIMEOUT
@ PKT_SRC_CAPTURE_TIMEOUT
Definition: decode.h:59
Packet_::flags
uint32_t flags
Definition: decode.h:444
Packet_::vlan_idx
uint8_t vlan_idx
Definition: decode.h:437
StatsSetUI64
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
Definition: counters.c:190
DECODE_TUNNEL_ERSPANI
@ DECODE_TUNNEL_ERSPANI
Definition: decode.h:882
DecodeThreadVars_::counter_teredo
uint16_t counter_teredo
Definition: decode.h:654
DecodeThreadVars_::counter_erspan
uint16_t counter_erspan
Definition: decode.h:658
PacketCopyDataOffset
int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
Copy data to Packet payload at given offset.
Definition: decode.c:221
DecodeThreadVars_::counter_raw
uint16_t counter_raw
Definition: decode.h:644
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:218
HashTable_
Definition: util-hash.h:35
PACKET_INITIALIZE
#define PACKET_INITIALIZE(p)
Initialize a packet structure for use.
Definition: decode.h:721
Address_
Definition: decode.h:111
DecodeThreadVars_::counter_flow_tcp
uint16_t counter_flow_tcp
Definition: decode.h:671
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:121
PacketDecodeFinalize
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:118
proto
uint8_t proto
Definition: decode-template.h:2
SET_TUNNEL_PKT
#define SET_TUNNEL_PKT(p)
Definition: decode.h:872
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:440
StringHashCompareFunc
char StringHashCompareFunc(void *data1, uint16_t datalen1, void *data2, uint16_t datalen2)
Definition: util-hash-string.c:35
Packet_::BypassPacketsFlow
int(* BypassPacketsFlow)(struct Packet_ *)
Definition: decode.h:488
TmqhOutputPacketpool
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
Definition: tmqh-packetpool.c:449
DecodeVXLANConfig
void DecodeVXLANConfig(void)
Definition: decode-vxlan.c:88
DecodeUnregisterCounters
void DecodeUnregisterCounters(void)
Definition: decode.c:467
GET_PKT_DIRECT_MAX_SIZE
#define GET_PKT_DIRECT_MAX_SIZE(p)
Definition: decode.h:228
tmqh-packetpool.h
StringHashFunc
uint32_t StringHashFunc(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash-string.c:22
Packet_::events
PacketEngineEvents events
Definition: decode.h:566
PKT_ALLOC
#define PKT_ALLOC
Definition: decode.h:1072
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:78
HashTableFree
void HashTableFree(HashTable *ht)
Definition: util-hash.c:79
Packet_::datalink
int datalink
Definition: decode.h:575
stats_decoder_events_prefix
const char * stats_decoder_events_prefix
Definition: counters.c:103
ACTION_REJECT_DST
#define ACTION_REJECT_DST
Definition: action-globals.h:32
SC_ERR_THREAD_INIT
@ SC_ERR_THREAD_INIT
Definition: util-error.h:79
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:477
DECODE_TUNNEL_ERSPANII
@ DECODE_TUNNEL_ERSPANII
Definition: decode.h:881
SET_PKT_LEN
#define SET_PKT_LEN(p, len)
Definition: decode.h:230
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:657
app-layer-detect-proto.h
StatsRegisterMaxCounter
uint16_t StatsRegisterMaxCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the maximum of all the values assigned to it.
Definition: counters.c:979
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:486
decode.h
util-debug.h
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:49
CaptureStats_::counter_ips_rejected
uint16_t counter_ips_rejected
Definition: decode.h:688
util-error.h
PKT_IS_TOSERVER
#define PKT_IS_TOSERVER(p)
Definition: decode.h:258
DecodeThreadVars_::counter_icmpv4
uint16_t counter_icmpv4
Definition: decode.h:640
DecodeThreadVars_::counter_ppp
uint16_t counter_ppp
Definition: decode.h:647
DecodeERSPANTypeI
int DecodeERSPANTypeI(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Functions to decode ERSPAN Type I and II packets.
Definition: decode-erspan.c:49
DEvents
const struct DecodeEvents_ DEvents[]
Definition: decode-events.c:29
OutputFlowLogThreadInit
TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void *initdata, void **data)
thread init for the flow logger This will run the thread init functions for the individual registered...
Definition: output-flow.c:129
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
PacketSwap
void PacketSwap(Packet *p)
switch direction of a packet
Definition: decode.c:442
DecodeSetNoPayloadInspectionFlag
#define DecodeSetNoPayloadInspectionFlag(p)
Set the No payload inspection Flag for the packet.
Definition: decode.h:956
PktSrcEnum
PktSrcEnum
Definition: decode.h:48
DecodeTunnelProto
DecodeTunnelProto
Definition: decode.h:879
util-print.h
CaptureStatsSetup
void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s)
Definition: decode.c:723
PKT_SRC_DECODER_TEREDO
@ PKT_SRC_DECODER_TEREDO
Definition: decode.h:53
AppLayerGetCtxThread
AppLayerThreadCtx * AppLayerGetCtxThread(ThreadVars *tv)
Creates a new app layer thread context.
Definition: app-layer.c:825
SCEnter
#define SCEnter(...)
Definition: util-debug.h:337
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:226
HashTableLookup
void * HashTableLookup(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:193
UNSET_TUNNEL_PKT
#define UNSET_TUNNEL_PKT(p)
Definition: decode.h:873
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:267
pkt-var.h
DECODE_TUNNEL_PPP
@ DECODE_TUNNEL_PPP
Definition: decode.h:887
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:224
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:105
PktSrcToString
const char * PktSrcToString(enum PktSrcEnum pkt_src)
Definition: decode.c:669
DecodeThreadVars_::counter_vlan_qinq
uint16_t counter_vlan_qinq
Definition: decode.h:650
HashTableAdd
int HashTableAdd(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:113
SIZE_OF_PACKET
#define SIZE_OF_PACKET
Definition: decode.h:619
StringHashFreeFunc
void StringHashFreeFunc(void *data)
Definition: util-hash-string.c:48
SCMalloc
#define SCMalloc(a)
Definition: util-mem.h:222
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:265
DecodeThreadVars_::counter_defrag_ipv6_timeouts
uint16_t counter_defrag_ipv6_timeouts
Definition: decode.h:666
util-profiling.h
PacketCallocExtPkt
int PacketCallocExtPkt(Packet *p, int datalen)
Definition: decode.c:195
PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
@ PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
Definition: decode.h:56
DECODE_TUNNEL_VLAN
@ DECODE_TUNNEL_VLAN
Definition: decode.h:883
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:52
CaptureStats_::counter_ips_accepted
uint16_t counter_ips_accepted
Definition: decode.h:686
Packet_
Definition: decode.h:408
SCCalloc
#define SCCalloc(nm, a)
Definition: util-mem.h:253
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:580
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:884
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:225
DecodeThreadVars_::app_tctx
AppLayerThreadCtx * app_tctx
Definition: decode.h:625
DecodeThreadVars_::counter_defrag_ipv4_timeouts
uint16_t counter_defrag_ipv4_timeouts
Definition: decode.h:663
decode-teredo.h
conf.h
DecodeThreadVars_::counter_sll
uint16_t counter_sll
Definition: decode.h:643
DecodeThreadVars_::counter_sctp
uint16_t counter_sctp
Definition: decode.h:646
Packet_::livedev
struct LiveDevice_ * livedev
Definition: decode.h:554
DecodeThreadVars_::counter_invalid
uint16_t counter_invalid
Definition: decode.h:633
DecodeThreadVars_::counter_ieee8021ah
uint16_t counter_ieee8021ah
Definition: decode.h:652
SCReturnPtr
#define SCReturnPtr(x, type)
Definition: util-debug.h:353
output-flow.h
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:656
util-mpm-ac.h
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:219
FlowSetStorageById
int FlowSetStorageById(Flow *f, int id, void *ptr)
Definition: flow-storage.c:44
DecodeThreadVars_::counter_vlan
uint16_t counter_vlan
Definition: decode.h:649
DECODE_TUNNEL_ETHERNET
@ DECODE_TUNNEL_ETHERNET
Definition: decode.h:880
DecodeThreadVars_::counter_tcp
uint16_t counter_tcp
Definition: decode.h:638
DecodeThreadVars_::counter_pkts
uint16_t counter_pkts
Definition: decode.h:628
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
default_packet_size
uint32_t default_packet_size
Definition: decode.c:71
ACTION_REJECT_BOTH
#define ACTION_REJECT_BOTH
Definition: action-globals.h:33
util-mem.h
Packet_::ReleasePacket
void(* ReleasePacket)(struct Packet_ *)
Definition: decode.h:485
flow-storage.h
Packet_::flow
struct Flow_ * flow
Definition: decode.h:446
Packet_::tenant_id
uint32_t tenant_id
Definition: decode.h:595
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:636
Packet_::ts
struct timeval ts
Definition: decode.h:452
DecodeGlobalConfig
void DecodeGlobalConfig(void)
Definition: decode.c:731
suricata-common.h
PKT_SRC_FFR
@ PKT_SRC_FFR
Definition: decode.h:55
DecodeThreadVars_::counter_flow_icmp6
uint16_t counter_flow_icmp6
Definition: decode.h:674
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:637
CaptureStats_::counter_ips_replaced
uint16_t counter_ips_replaced
Definition: decode.h:689
DecodeThreadVars_::counter_gre
uint16_t counter_gre
Definition: decode.h:648
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
Packet_::ext_pkt
uint8_t * ext_pkt
Definition: decode.h:551
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:294
DecodeThreadVars_::counter_defrag_ipv6_reassembled
uint16_t counter_defrag_ipv6_reassembled
Definition: decode.h:665
DecodeThreadVars_::counter_udp
uint16_t counter_udp
Definition: decode.h:639
PacketUpdateEngineEventCounters
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Definition: decode.c:125
FatalError
#define FatalError(x,...)
Definition: util-debug.h:569
CaptureStatsUpdate
void CaptureStatsUpdate(ThreadVars *tv, CaptureStats *s, const Packet *p)
Definition: decode.c:710
PKT_SRC_DEFRAG
@ PKT_SRC_DEFRAG
Definition: decode.h:54
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
DecodeThreadVars_::counter_ipv4
uint16_t counter_ipv4
Definition: decode.h:636
PACKET_PROFILING_START
#define PACKET_PROFILING_START(p)
Definition: util-profiling.h:92
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:144
PKT_SRC_DECODER_VXLAN
@ PKT_SRC_DECODER_VXLAN
Definition: decode.h:57
StatsAddUI64
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:147
Packet_::root
struct Packet_ * root
Definition: decode.h:578
DecodeThreadVars_::counter_pppoe
uint16_t counter_pppoe
Definition: decode.h:653
DecodeThreadVars_::counter_mpls
uint16_t counter_mpls
Definition: decode.h:655
OutputFlowLogThreadDeinit
TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data)
Definition: output-flow.c:171
PKT_SRC_DETECT_RELOAD_FLUSH
@ PKT_SRC_DETECT_RELOAD_FLUSH
Definition: decode.h:58
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:622
MAX_PAYLOAD_SIZE
#define MAX_PAYLOAD_SIZE
Definition: decode.h:617
AppLayerDestroyCtxThread
void AppLayerDestroyCtxThread(AppLayerThreadCtx *app_tctx)
Destroys the context created by AppLayeGetCtxThread().
Definition: app-layer.c:847
Packet_::recursion_level
uint8_t recursion_level
Definition: decode.h:434
DecodeThreadVars_::output_flow_thread_data
void * output_flow_thread_data
Definition: decode.h:680
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:617
DecodeThreadVars_::counter_defrag_max_hit
uint16_t counter_defrag_max_hit
Definition: decode.h:667
HashTableInit
HashTable * HashTableInit(uint32_t size, uint32_t(*Hash)(struct HashTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hash.c:34
PacketSetData
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
Definition: decode.c:656
PacketPoolGetPacket
Packet * PacketPoolGetPacket(void)
Get a new packet from the packet pool.
Definition: tmqh-packetpool.c:249
GET_PKT_DIRECT_DATA
#define GET_PKT_DIRECT_DATA(p)
Definition: decode.h:227
TUNNEL_INCR_PKT_TPR
#define TUNNEL_INCR_PKT_TPR(p)
Definition: decode.h:862
DecodeThreadVars_::counter_null
uint16_t counter_null
Definition: decode.h:645
DecodeThreadVars_::counter_icmpv6
uint16_t counter_icmpv6
Definition: decode.h:641
suricata.h
Address_::family
char family
Definition: decode.h:112
PKT_SRC_DECODER_GRE
@ PKT_SRC_DECODER_GRE
Definition: decode.h:50
DecodeThreadVars_::counter_flow_memcap
uint16_t counter_flow_memcap
Definition: decode.h:669
DecodeThreadVars_::counter_defrag_ipv6_fragments
uint16_t counter_defrag_ipv6_fragments
Definition: decode.h:664
StatsRegisterAvgCounter
uint16_t StatsRegisterAvgCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the average of all the values assigned to it.
Definition: counters.c:959
SC_ERR_INITIALIZATION
@ SC_ERR_INITIALIZATION
Definition: util-error.h:75
PacketDefragPktSetupParent
void PacketDefragPktSetupParent(Packet *parent)
inform defrag "parent" that a pseudo packet is now associated to it.
Definition: decode.c:390
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:278
SC_ATOMIC_GET
#define SC_ATOMIC_GET(name)
Get the value from the atomic variable.
Definition: util-atomic.h:192
stats_decoder_events
bool stats_decoder_events
Definition: counters.c:102
DecodeTunnel
int DecodeTunnel(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Definition: decode.c:76
DecodeIPV4
int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv4.c:517
GetFlowBypassInfoID
int GetFlowBypassInfoID(void)
Definition: flow-util.c:209
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:939
DecodeVLAN
int DecodeVLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-vlan.c:62
code
uint8_t code
Definition: decode-icmpv4.h:3
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:223
DECODE_EVENT_MAX
@ DECODE_EVENT_MAX
Definition: decode-events.h:262
SCMutex
#define SCMutex
Definition: threads-debug.h:114
PacketGetFromQueueOrAlloc
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:180
DecodeEthernet
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-ethernet.c:41
PACKET_DESTRUCTOR
#define PACKET_DESTRUCTOR(p)
Cleanup a packet so that we can free it. No memset needed..
Definition: decode.h:812
PKT_IS_INVALID
#define PKT_IS_INVALID
Definition: decode.h:1093
DecodeUpdatePacketCounters
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:583
FlowUpdateState
void FlowUpdateState(Flow *f, enum FlowState s)
Definition: flow.c:1123
DecodeThreadVars_::counter_engine_events
uint16_t counter_engine_events[DECODE_EVENT_MAX]
Definition: decode.h:676
output.h
PACKET_TEST_ACTION
#define PACKET_TEST_ACTION(p, a)
Definition: decode.h:847
app-layer.h
DecodeThreadVars_::counter_defrag_ipv4_fragments
uint16_t counter_defrag_ipv4_fragments
Definition: decode.h:661
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:307