Go to the documentation of this file.
97 .valid_settings_ips = {
123 .valid_settings_ips = {
184 SCLogDebug(
"FIXME: DecodeTunnel: protocol %" PRIu32
" not supported.",
proto);
216 for (uint8_t i = 0; i < p->
events.
cnt; i++) {
241 SCLogDebug(
"allocated a new packet only using alloc...");
319 uint32_t newsize =
offset + datalen;
397 if (parent->
root != NULL) {
421 if (parent->
root == NULL) {
424 TUNNEL_INCR_PKT_TPR(p);
429 DecodeSetNoPayloadInspectionFlag(parent);
458 if (parent->
root != NULL) {
493 TUNNEL_INCR_PKT_TPR(parent);
498 DecodeSetNoPayloadInspectionFlag(parent);
509 #ifdef CAPTURE_OFFLOAD
515 (state == FLOW_STATE_CAPTURE_BYPASSED)) {
573 static HashTable *g_counter_table = NULL;
579 if (g_counter_table) {
581 g_counter_table = NULL;
586 static bool IsDefragMemcapExceptionPolicyStatsValid(
enum ExceptionPolicy policy)
594 static bool IsFlowMemcapExceptionPolicyStatsValid(
enum ExceptionPolicy policy)
652 IsFlowMemcapExceptionPolicyStatsValid);
687 IsDefragMemcapExceptionPolicyStatsValid);
698 strncmp(
DEvents[i].event_name,
"decoder.", 8) == 0)
701 if (g_counter_table == NULL) {
705 if (g_counter_table == NULL) {
707 "table init failed");
712 char *dot = strchr(
DEvents[i].event_name,
'.');
714 snprintf(name,
sizeof(name),
"%s.%s",
722 "table name init failed");
726 "table name add failed");
766 PrintInet(AF_INET, (
const void *)&a->addr_data32[0], s,
sizeof(s));
784 SCLogError(
"initializing flow log API for thread failed");
819 p->
ext_pkt = (uint8_t *) pktdata;
827 const char *pkt_src_str = NULL;
830 pkt_src_str =
"wire/pcap";
833 pkt_src_str =
"gre tunnel";
836 pkt_src_str =
"ipv4 tunnel";
839 pkt_src_str =
"ipv6 tunnel";
842 pkt_src_str =
"teredo tunnel";
845 pkt_src_str =
"defrag";
848 pkt_src_str =
"stream (detect/log)";
851 pkt_src_str =
"stream (flow timeout)";
854 pkt_src_str =
"geneve encapsulation";
857 pkt_src_str =
"vxlan encapsulation";
860 pkt_src_str =
"detect reload flush";
863 pkt_src_str =
"capture timeout flush";
866 pkt_src_str =
"shutdown flush";
877 return "decode error";
879 return "defrag error";
881 return "defrag memcap";
883 return "flow memcap";
887 return "stream error";
889 return "stream memcap";
891 return "stream midstream";
893 return "stream urgent";
895 return "stream reassembly";
897 return "applayer error";
899 return "applayer memcap";
903 return "threshold detection_filter";
907 return "tunnel packet drop";
919 return "ips.drop_reason.decode_error";
921 return "ips.drop_reason.defrag_error";
923 return "ips.drop_reason.defrag_memcap";
925 return "ips.drop_reason.flow_memcap";
927 return "ips.drop_reason.flow_drop";
929 return "ips.drop_reason.stream_error";
931 return "ips.drop_reason.stream_memcap";
933 return "ips.drop_reason.stream_midstream";
935 return "ips.drop_reason.stream_urgent";
937 return "ips.drop_reason.stream_reassembly";
939 return "ips.drop_reason.applayer_error";
941 return "ips.drop_reason.applayer_memcap";
943 return "ips.drop_reason.rules";
945 return "ips.drop_reason.threshold_detection_filter";
947 return "ips.drop_reason.nfq_error";
949 return "ips.drop_reason.tunnel_packet_drop";
997 const char *name = PacketDropReasonToJsonString(i);
1011 if (
ConfGetInt(
"decoder.max-layers", &value) == 1) {
1012 if (value < 0 || value > UINT8_MAX) {
1024 if (
ConfGetInt(
"packet-alert-max", &max) == 1) {
1025 if (max <= 0 || max > UINT8_MAX) {
1026 SCLogWarning(
"Invalid value for packet-alert-max, default value set instead");
bool PacketCheckAction(const Packet *p, const uint8_t a)
uint16_t counter_flow_get_used_eval_busy
@ PKT_DROP_REASON_DEFRAG_MEMCAP
@ PKT_DROP_REASON_DEFRAG_ERROR
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
uint16_t counter_defrag_ipv4_reassembled
@ PKT_DROP_REASON_RULES_THRESHOLD
uint16_t counter_ethertype_unknown
uint16_t counter_flow_udp
uint16_t counter_ips_blocked
uint16_t counter_flow_active
TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void **data)
thread init for the flow logger This will run the thread init functions for the individual registered...
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
int DecodeERSPAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
ERSPAN Type II.
void PacketFreeOrRelease(Packet *p)
Return a packet to where it was allocated.
uint16_t counter_flow_icmp4
uint16_t counter_max_pkt_size
int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
void PacketBypassCallback(Packet *p)
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
uint16_t counter_avg_pkt_size
void DecodeERSPANConfig(void)
Functions to decode ERSPAN Type I and II packets.
void PacketPoolReturnPacket(Packet *p)
Return packet to Packet pool.
FlowStorageId GetFlowBypassInfoID(void)
@ PKT_DROP_REASON_STREAM_MEMCAP
int DecodeNSH(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode NSH packets.
@ PKT_DROP_REASON_FLOW_MEMCAP
void DecodeTeredoConfig(void)
void CaptureStatsSetup(ThreadVars *tv)
const char * PacketDropReasonToString(enum PacketDropReason r)
uint8_t events[PACKET_ENGINE_EVENT_MAX]
#define PKT_STREAM_MODIFIED
@ DECODE_TUNNEL_IPV6_TEREDO
void AddressDebugPrint(Address *a)
Debug print function for printing addresses.
uint16_t counter_flow_spare_sync_avg
Packet * PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto)
Setup a pseudo packet (reassembled frags)
@ PKT_SRC_CAPTURE_TIMEOUT
PacketAlert * PacketAlertCreate(void)
Initialize PacketAlerts with dynamic alerts array size.
uint16_t counter_flow_get_used_eval
struct CaptureStats_ CaptureStats
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
uint16_t counter_tcp_synack
@ PKT_DROP_REASON_STREAM_REASSEMBLY
int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
Copy data to Packet payload at given offset.
#define FLOW_PKT_TOSERVER
#define ACTION_REJECT_ANY
ExceptionPolicyStatsSetts flow_memcap_eps_stats
int DecodeARP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
uint16_t counter_flow_tcp
#define SCMUTEX_INITIALIZER
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
void PacketAlertGetMaxConfig(void)
uint8_t decoder_max_layers
uint16_t counter_tcp_active_sessions
char StringHashCompareFunc(void *data1, uint16_t datalen1, void *data2, uint16_t datalen2)
int(* BypassPacketsFlow)(struct Packet_ *)
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
void DecodeVXLANConfig(void)
uint16_t counter_max_mac_addrs_src
void DecodeUnregisterCounters(void)
#define GET_PKT_DIRECT_MAX_SIZE(p)
uint16_t counter_flow_get_used
uint32_t StringHashFunc(HashTable *ht, void *data, uint16_t datalen)
PacketEngineEvents events
void PacketAlertFree(PacketAlert *pa)
@ DECODE_EVENT_PACKET_MAX
void HashTableFree(HashTable *ht)
uint16_t counter_flow_spare_sync_empty
uint16_t counter_flow_tcp_reuse
@ PKT_DROP_REASON_STREAM_URG
uint16_t counter_flow_total
#define PKT_DEFAULT_MAX_DECODED_LAYERS
const char * stats_decoder_events_prefix
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
uint16_t counter_flow_spare_sync
uint16_t counter_defrag_tracker_timeout
#define SET_PKT_LEN(p, len)
uint16_t counter_ipv6inipv6
uint16_t StatsRegisterMaxCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the maximum of all the values assigned to it.
@ FLOW_STATE_LOCAL_BYPASSED
uint16_t counter_flow_get_used_failed
uint16_t counter_ips_rejected
#define PKT_IS_TOSERVER(p)
int DecodeERSPANTypeI(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
ERSPAN Type I.
const struct DecodeEvents_ DEvents[]
@ PKT_DROP_REASON_APPLAYER_ERROR
#define SCMutexUnlock(mut)
void PacketSwap(Packet *p)
switch direction of a packet
@ PKT_DROP_REASON_NOT_SET
void PacketDestructor(Packet *p)
Cleanup a packet so that we can free it. No memset needed..
void CaptureStatsUpdate(ThreadVars *tv, const Packet *p)
void ExceptionPolicySetStatsCounters(ThreadVars *tv, ExceptionPolicyCounters *counter, ExceptionPolicyStatsSetts *setting, enum ExceptionPolicy conf_policy, const char *default_str, bool(*isExceptionPolicyValid)(enum ExceptionPolicy))
void * HashTableLookup(HashTable *ht, void *data, uint16_t datalen)
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
#define FLOW_PKT_TOCLIENT_FIRST
int FlowSetStorageById(Flow *f, FlowStorageId id, void *ptr)
void PacketFree(Packet *p)
Return a malloced packet.
const char * PktSrcToString(enum PktSrcEnum pkt_src)
bool valid_settings_ids[EXCEPTION_POLICY_MAX]
uint16_t counter_vlan_qinq
uint16_t counter_defrag_tracker_hard_reuse
#define SCLogWarning(...)
Macro used to log WARNING messages.
int HashTableAdd(HashTable *ht, void *data, uint16_t datalen)
void StringHashFreeFunc(void *data)
int PacketCallocExtPkt(Packet *p, int datalen)
@ PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
uint16_t counter_ips_accepted
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
AppLayerThreadCtx * app_tctx
@ PKT_DROP_REASON_STREAM_ERROR
struct LiveDevice_ * livedev
uint16_t counter_ieee8021ah
#define SCReturnPtr(x, type)
AppLayerThreadCtx * AppLayerGetCtxThread(void)
Creates a new app layer thread context.
uint16_t counter_ipv4inipv6
#define FLOW_PKT_TOCLIENT
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
void FlowUpdateState(Flow *f, const enum FlowState s)
ExceptionPolicyCounters counter_defrag_memcap_eps
uint32_t default_packet_size
uint8_t nb_decoded_layers
void(* ReleasePacket)(struct Packet_ *)
@ PKT_DROP_REASON_INNER_PACKET
enum ExceptionPolicy FlowGetMemcapExceptionPolicy(void)
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
uint16_t counter_flow_spare_sync_incomplete
@ PKT_DROP_REASON_APPLAYER_MEMCAP
void DecodeGlobalConfig(void)
uint16_t counter_flow_icmp6
uint16_t counter_ips_replaced
@ PKT_DROP_REASON_NFQ_ERROR
uint16_t counter_defrag_no_frags
uint16_t counter_defrag_ipv6_reassembled
enum PacketTunnelType ttype
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
uint16_t counter_drop_reason[PKT_DROP_REASON_MAX]
ExceptionPolicyCounters counter_flow_memcap_eps
#define PACKET_PROFILING_START(p)
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
ExceptionPolicyStatsSetts defrag_memcap_eps_stats
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
#define SCLogError(...)
Macro used to log ERROR messages.
TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data)
@ PKT_SRC_DETECT_RELOAD_FLUSH
Structure to hold thread specific data for all decode modules.
bool valid_settings_ips[EXCEPTION_POLICY_MAX]
void AppLayerDestroyCtxThread(AppLayerThreadCtx *app_tctx)
Destroys the context created by AppLayerGetCtxThread().
void * output_flow_thread_data
uint16_t counter_max_mac_addrs_dst
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
uint16_t counter_defrag_max_hit
HashTable * HashTableInit(uint32_t size, uint32_t(*Hash)(struct HashTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
Packet * PacketPoolGetPacket(void)
Get a new packet from the packet pool.
uint16_t counter_vlan_qinqinq
#define GET_PKT_DIRECT_DATA(p)
thread_local CaptureStats t_capture_stats
int EngineModeIsIPS(void)
#define ENGINE_SET_INVALID_EVENT(p, e)
void DecodeGeneveConfig(void)
uint16_t counter_flow_memcap
uint16_t counter_defrag_ipv6_fragments
uint16_t packet_alert_max
uint16_t vlan_id[VLAN_MAX_LAYERS]
uint16_t StatsRegisterAvgCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the average of all the values assigned to it.
void PacketDefragPktSetupParent(Packet *parent)
inform defrag "parent" that a pseudo packet is now associated to it.
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
bool stats_decoder_events
@ PKT_DROP_REASON_STREAM_MIDSTREAM
int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
void PacketInit(Packet *p)
Initialize a packet structure for use.
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
@ GENERIC_TOO_MANY_LAYERS
uint16_t counter_flow_get_used_eval_reject
int DecodeVLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
#define FLOW_PKT_TOSERVER_FIRST
enum ExceptionPolicy DefragGetMemcapExceptionPolicy(void)
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
#define DEBUG_VALIDATE_BUG_ON(exp)
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
@ PKT_DROP_REASON_FLOW_DROP
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
uint16_t counter_engine_events[DECODE_EVENT_MAX]
uint16_t counter_defrag_tracker_soft_reuse
@ PKT_DROP_REASON_DECODE_ERROR
uint16_t counter_defrag_ipv4_fragments