Go to the documentation of this file.
125 SCLogDebug(
"FIXME: DecodeTunnel: protocol %" PRIu32
" not supported.",
proto);
157 for (uint8_t i = 0; i < p->
events.
cnt; i++) {
182 SCLogDebug(
"allocated a new packet only using alloc...");
260 uint32_t newsize =
offset + datalen;
338 if (parent->
root != NULL)
366 TUNNEL_INCR_PKT_TPR(p);
371 DecodeSetNoPayloadInspectionFlag(parent);
400 if (parent->
root != NULL)
432 TUNNEL_INCR_PKT_TPR(parent);
437 DecodeSetNoPayloadInspectionFlag(parent);
448 #ifdef CAPTURE_OFFLOAD
454 (state == FLOW_STATE_CAPTURE_BYPASSED)) {
512 static HashTable *g_counter_table = NULL;
518 if (g_counter_table) {
520 g_counter_table = NULL;
610 strncmp(
DEvents[i].event_name,
"decoder.", 8) == 0)
613 if (g_counter_table == NULL) {
617 if (g_counter_table == NULL) {
619 "table init failed");
624 char *dot = strchr(
DEvents[i].event_name,
'.');
626 snprintf(name,
sizeof(name),
"%s.%s",
634 "table name init failed");
638 "table name add failed");
680 PrintInet(AF_INET, (
const void *)&a->addr_data32[0], s,
sizeof(s));
699 SCLogError(
"initializing flow log API for thread failed");
734 p->
ext_pkt = (uint8_t *) pktdata;
742 const char *pkt_src_str = NULL;
745 pkt_src_str =
"wire/pcap";
748 pkt_src_str =
"gre tunnel";
751 pkt_src_str =
"ipv4 tunnel";
754 pkt_src_str =
"ipv6 tunnel";
757 pkt_src_str =
"teredo tunnel";
760 pkt_src_str =
"defrag";
763 pkt_src_str =
"stream (detect/log)";
766 pkt_src_str =
"stream (flow timeout)";
769 pkt_src_str =
"geneve encapsulation";
772 pkt_src_str =
"vxlan encapsulation";
775 pkt_src_str =
"detect reload flush";
778 pkt_src_str =
"capture timeout flush";
781 pkt_src_str =
"shutdown flush";
792 return "decode error";
794 return "defrag error";
796 return "defrag memcap";
798 return "flow memcap";
802 return "stream error";
804 return "stream memcap";
806 return "stream midstream";
808 return "stream reassembly";
810 return "applayer error";
812 return "applayer memcap";
816 return "threshold detection_filter";
820 return "tunnel packet drop";
832 return "ips.drop_reason.decode_error";
834 return "ips.drop_reason.defrag_error";
836 return "ips.drop_reason.defrag_memcap";
838 return "ips.drop_reason.flow_memcap";
840 return "ips.drop_reason.flow_drop";
842 return "ips.drop_reason.stream_error";
844 return "ips.drop_reason.stream_memcap";
846 return "ips.drop_reason.stream_midstream";
848 return "ips.drop_reason.stream_reassembly";
850 return "ips.drop_reason.applayer_error";
852 return "ips.drop_reason.applayer_memcap";
854 return "ips.drop_reason.rules";
856 return "ips.drop_reason.threshold_detection_filter";
858 return "ips.drop_reason.nfq_error";
860 return "ips.drop_reason.tunnel_packet_drop";
908 const char *name = PacketDropReasonToJsonString(i);
922 if (
ConfGetInt(
"decoder.max-layers", &value) == 1) {
923 if (value < 0 || value > UINT8_MAX) {
935 if (
ConfGetInt(
"packet-alert-max", &max) == 1) {
936 if (max <= 0 || max > UINT8_MAX) {
937 SCLogWarning(
"Invalid value for packet-alert-max, default value set instead");
bool PacketCheckAction(const Packet *p, const uint8_t a)
uint16_t counter_flow_get_used_eval_busy
@ PKT_DROP_REASON_DEFRAG_MEMCAP
@ PKT_DROP_REASON_DEFRAG_ERROR
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
uint16_t counter_defrag_ipv4_reassembled
@ PKT_DROP_REASON_RULES_THRESHOLD
uint16_t counter_ethertype_unknown
uint16_t counter_flow_udp
uint16_t counter_ips_blocked
uint16_t counter_flow_active
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
int DecodeERSPAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
ERSPAN Type II.
void PacketFreeOrRelease(Packet *p)
Return a packet to where it was allocated.
uint16_t counter_flow_icmp4
uint16_t counter_max_pkt_size
int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
void PacketBypassCallback(Packet *p)
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
uint16_t counter_avg_pkt_size
void DecodeERSPANConfig(void)
Functions to decode ERSPAN Type I and II packets.
void PacketPoolReturnPacket(Packet *p)
Return packet to Packet pool.
FlowStorageId GetFlowBypassInfoID(void)
@ PKT_DROP_REASON_STREAM_MEMCAP
int DecodeNSH(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode NSH packets.
@ PKT_DROP_REASON_FLOW_MEMCAP
void DecodeTeredoConfig(void)
void CaptureStatsSetup(ThreadVars *tv)
const char * PacketDropReasonToString(enum PacketDropReason r)
uint8_t events[PACKET_ENGINE_EVENT_MAX]
#define PKT_STREAM_MODIFIED
@ DECODE_TUNNEL_IPV6_TEREDO
void AddressDebugPrint(Address *a)
Debug print function for printing addresses.
uint16_t counter_flow_spare_sync_avg
Packet * PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto)
Setup a pseudo packet (reassembled frags)
@ PKT_SRC_CAPTURE_TIMEOUT
PacketAlert * PacketAlertCreate(void)
Initialize PacketAlerts with dynamic alerts array size.
uint16_t counter_flow_get_used_eval
struct CaptureStats_ CaptureStats
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
@ DECODE_EVENT_PACKET_MAX
uint16_t counter_tcp_synack
@ PKT_DROP_REASON_STREAM_REASSEMBLY
int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
Copy data to Packet payload at given offset.
#define FLOW_PKT_TOSERVER
#define ACTION_REJECT_ANY
uint16_t counter_flow_tcp
#define SCMUTEX_INITIALIZER
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
void PacketAlertGetMaxConfig(void)
uint8_t decoder_max_layers
#define SET_TUNNEL_PKT(p)
uint16_t counter_tcp_active_sessions
char StringHashCompareFunc(void *data1, uint16_t datalen1, void *data2, uint16_t datalen2)
int(* BypassPacketsFlow)(struct Packet_ *)
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
void DecodeVXLANConfig(void)
uint16_t counter_max_mac_addrs_src
void DecodeUnregisterCounters(void)
#define GET_PKT_DIRECT_MAX_SIZE(p)
uint16_t counter_flow_get_used
uint32_t StringHashFunc(HashTable *ht, void *data, uint16_t datalen)
PacketEngineEvents events
void PacketAlertFree(PacketAlert *pa)
void HashTableFree(HashTable *ht)
uint16_t counter_flow_spare_sync_empty
uint16_t counter_flow_tcp_reuse
uint16_t counter_flow_total
#define PKT_DEFAULT_MAX_DECODED_LAYERS
const char * stats_decoder_events_prefix
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
uint16_t counter_flow_spare_sync
#define SET_PKT_LEN(p, len)
uint16_t counter_ipv6inipv6
uint16_t StatsRegisterMaxCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the maximum of all the values assigned to it.
@ FLOW_STATE_LOCAL_BYPASSED
uint16_t counter_flow_get_used_failed
uint16_t counter_ips_rejected
#define PKT_IS_TOSERVER(p)
int DecodeERSPANTypeI(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
ERSPAN Type I.
const struct DecodeEvents_ DEvents[]
@ PKT_DROP_REASON_APPLAYER_ERROR
TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void *initdata, void **data)
thread init for the flow logger This will run the thread init functions for the individual registered...
#define SCMutexUnlock(mut)
void PacketSwap(Packet *p)
switch direction of a packet
@ PKT_DROP_REASON_NOT_SET
void PacketDestructor(Packet *p)
Cleanup a packet so that we can free it. No memset needed..
void CaptureStatsUpdate(ThreadVars *tv, const Packet *p)
AppLayerThreadCtx * AppLayerGetCtxThread(ThreadVars *tv)
Creates a new app layer thread context.
void * HashTableLookup(HashTable *ht, void *data, uint16_t datalen)
#define UNSET_TUNNEL_PKT(p)
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
#define FLOW_PKT_TOCLIENT_FIRST
int FlowSetStorageById(Flow *f, FlowStorageId id, void *ptr)
void PacketFree(Packet *p)
Return a malloced packet.
const char * PktSrcToString(enum PktSrcEnum pkt_src)
uint16_t counter_vlan_qinq
#define SCLogWarning(...)
Macro used to log WARNING messages.
int HashTableAdd(HashTable *ht, void *data, uint16_t datalen)
void StringHashFreeFunc(void *data)
int PacketCallocExtPkt(Packet *p, int datalen)
@ PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
uint16_t counter_ips_accepted
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
AppLayerThreadCtx * app_tctx
@ PKT_DROP_REASON_STREAM_ERROR
struct LiveDevice_ * livedev
uint16_t counter_ieee8021ah
#define SCReturnPtr(x, type)
uint16_t counter_ipv4inipv6
#define FLOW_PKT_TOCLIENT
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
void FlowUpdateState(Flow *f, const enum FlowState s)
uint32_t default_packet_size
uint8_t nb_decoded_layers
void(* ReleasePacket)(struct Packet_ *)
@ PKT_DROP_REASON_INNER_PACKET
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
uint16_t counter_flow_spare_sync_incomplete
@ PKT_DROP_REASON_APPLAYER_MEMCAP
void DecodeGlobalConfig(void)
uint16_t counter_flow_icmp6
uint16_t counter_ips_replaced
@ PKT_DROP_REASON_NFQ_ERROR
uint16_t counter_defrag_ipv6_reassembled
@ GENERIC_TOO_MANY_LAYERS
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
uint16_t counter_drop_reason[PKT_DROP_REASON_MAX]
#define PACKET_PROFILING_START(p)
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
#define SCLogError(...)
Macro used to log ERROR messages.
TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data)
@ PKT_SRC_DETECT_RELOAD_FLUSH
Structure to hold thread specific data for all decode modules.
void AppLayerDestroyCtxThread(AppLayerThreadCtx *app_tctx)
Destroys the context created by AppLayerGetCtxThread().
void * output_flow_thread_data
uint16_t counter_max_mac_addrs_dst
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
uint16_t counter_defrag_max_hit
HashTable * HashTableInit(uint32_t size, uint32_t(*Hash)(struct HashTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
Packet * PacketPoolGetPacket(void)
Get a new packet from the packet pool.
uint16_t counter_vlan_qinqinq
#define GET_PKT_DIRECT_DATA(p)
thread_local CaptureStats t_capture_stats
int EngineModeIsIPS(void)
#define ENGINE_SET_INVALID_EVENT(p, e)
void DecodeGeneveConfig(void)
uint16_t counter_flow_memcap
uint16_t counter_defrag_ipv6_fragments
uint16_t packet_alert_max
uint16_t vlan_id[VLAN_MAX_LAYERS]
uint16_t StatsRegisterAvgCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the average of all the values assigned to it.
void PacketDefragPktSetupParent(Packet *parent)
inform defrag "parent" that a pseudo packet is now associated to it.
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
bool stats_decoder_events
@ PKT_DROP_REASON_STREAM_MIDSTREAM
int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
void PacketInit(Packet *p)
Initialize a packet structure for use.
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
uint16_t counter_flow_get_used_eval_reject
int DecodeVLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
#define FLOW_PKT_TOSERVER_FIRST
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
#define DEBUG_VALIDATE_BUG_ON(exp)
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
@ PKT_DROP_REASON_FLOW_DROP
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
uint16_t counter_engine_events[DECODE_EVENT_MAX]
@ PKT_DROP_REASON_DECODE_ERROR
uint16_t counter_defrag_ipv4_fragments