Go to the documentation of this file.
102 SCLogDebug(
"FIXME: DecodeTunnel: protocol %" PRIu32
" not supported.",
proto);
134 for (uint8_t i = 0; i < p->
events.
cnt; i++) {
162 SCLogDebug(
"allocated a new packet only using alloc...");
237 uint32_t newsize =
offset + datalen;
301 p->
ts.tv_sec = parent->
ts.tv_sec;
302 p->
ts.tv_usec = parent->
ts.tv_usec;
308 if (parent->
root != NULL)
370 if (parent->
root != NULL)
380 p->
ts.tv_sec = parent->
ts.tv_sec;
381 p->
ts.tv_usec = parent->
ts.tv_usec;
420 #ifdef CAPTURE_OFFLOAD
426 (state == FLOW_STATE_CAPTURE_BYPASSED)) {
478 static HashTable *g_counter_table = NULL;
484 if (g_counter_table) {
486 g_counter_table = NULL;
570 strncmp(
DEvents[i].event_name,
"decoder.", 8) == 0)
573 if (g_counter_table == NULL) {
577 if (g_counter_table == NULL) {
579 "table init failed");
584 char *dot = strchr(
DEvents[i].event_name,
'.');
586 snprintf(name,
sizeof(name),
"%s.%s",
594 "table name init failed");
598 "table name add failed");
640 PrintInet(AF_INET, (
const void *)&a->addr_data32[0], s,
sizeof(s));
694 p->
ext_pkt = (uint8_t *) pktdata;
702 const char *pkt_src_str =
"<unknown>";
705 pkt_src_str =
"wire/pcap";
708 pkt_src_str =
"gre tunnel";
711 pkt_src_str =
"ipv4 tunnel";
714 pkt_src_str =
"ipv6 tunnel";
717 pkt_src_str =
"teredo tunnel";
720 pkt_src_str =
"defrag";
723 pkt_src_str =
"stream (detect/log)";
726 pkt_src_str =
"stream (flow timeout)";
729 pkt_src_str =
"geneve encapsulation";
732 pkt_src_str =
"vxlan encapsulation";
735 pkt_src_str =
"detect reload flush";
738 pkt_src_str =
"capture timeout flush";
772 if (
ConfGetInt(
"decoder.max-layers", &value) == 1) {
773 if (value < 0 || value > UINT8_MAX) {
uint16_t counter_flow_get_used_eval_busy
int ConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
uint16_t counter_defrag_ipv4_reassembled
uint16_t counter_flow_udp
uint16_t counter_ips_blocked
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
int DecodeERSPAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
ERSPAN Type II.
void PacketFreeOrRelease(Packet *p)
Return a packet to where it was allocated.
uint16_t counter_flow_icmp4
uint16_t counter_max_pkt_size
int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
void PacketBypassCallback(Packet *p)
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
uint16_t counter_avg_pkt_size
void DecodeERSPANConfig(void)
Functions to decode ERSPAN Type I and II packets.
void PacketPoolReturnPacket(Packet *p)
Return packet to Packet pool.
int DecodeNSH(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode NSH packets.
void DecodeTeredoConfig(void)
uint8_t events[PACKET_ENGINE_EVENT_MAX]
#define PKT_STREAM_MODIFIED
@ DECODE_TUNNEL_IPV6_TEREDO
void AddressDebugPrint(Address *a)
Debug print function for printing addresses.
uint16_t counter_flow_spare_sync_avg
Packet * PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto)
Setup a pseudo packet (reassembled frags)
@ PKT_SRC_CAPTURE_TIMEOUT
uint16_t counter_flow_get_used_eval
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
Copy data to Packet payload at given offset.
#define FLOW_PKT_TOSERVER
#define PACKET_INITIALIZE(p)
Initialize a packet structure for use.
uint16_t counter_flow_tcp
#define SCMUTEX_INITIALIZER
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
uint8_t decoder_max_layers
#define SET_TUNNEL_PKT(p)
char StringHashCompareFunc(void *data1, uint16_t datalen1, void *data2, uint16_t datalen2)
int(* BypassPacketsFlow)(struct Packet_ *)
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
void DecodeVXLANConfig(void)
uint16_t counter_max_mac_addrs_src
void DecodeUnregisterCounters(void)
#define GET_PKT_DIRECT_MAX_SIZE(p)
uint16_t counter_flow_get_used
uint32_t StringHashFunc(HashTable *ht, void *data, uint16_t datalen)
PacketEngineEvents events
void HashTableFree(HashTable *ht)
uint16_t counter_flow_spare_sync_empty
uint16_t counter_flow_tcp_reuse
#define PKT_DEFAULT_MAX_DECODED_LAYERS
const char * stats_decoder_events_prefix
#define ACTION_REJECT_DST
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
uint16_t counter_flow_spare_sync
#define SET_PKT_LEN(p, len)
uint16_t counter_ipv6inipv6
uint16_t StatsRegisterMaxCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the maximum of all the values assigned to it.
@ FLOW_STATE_LOCAL_BYPASSED
uint16_t counter_flow_get_used_failed
uint16_t counter_ips_rejected
#define PKT_IS_TOSERVER(p)
int DecodeERSPANTypeI(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
ERSPAN Type I.
const struct DecodeEvents_ DEvents[]
TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void *initdata, void **data)
thread init for the flow logger This will run the thread init functions for the individual registered...
#define SCMutexUnlock(mut)
void PacketSwap(Packet *p)
switch direction of a packet
#define DecodeSetNoPayloadInspectionFlag(p)
Set the No payload inspection Flag for the packet.
void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s)
AppLayerThreadCtx * AppLayerGetCtxThread(ThreadVars *tv)
Creates a new app layer thread context.
void * HashTableLookup(HashTable *ht, void *data, uint16_t datalen)
#define UNSET_TUNNEL_PKT(p)
Per thread variable structure.
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
#define FLOW_PKT_TOCLIENT_FIRST
void PacketFree(Packet *p)
Return a malloced packet.
const char * PktSrcToString(enum PktSrcEnum pkt_src)
uint16_t counter_vlan_qinq
int HashTableAdd(HashTable *ht, void *data, uint16_t datalen)
void StringHashFreeFunc(void *data)
uint16_t counter_defrag_ipv6_timeouts
int PacketCallocExtPkt(Packet *p, int datalen)
@ PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
uint16_t counter_ips_accepted
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
AppLayerThreadCtx * app_tctx
uint16_t counter_defrag_ipv4_timeouts
struct LiveDevice_ * livedev
uint16_t counter_ieee8021ah
#define SCReturnPtr(x, type)
uint16_t counter_ipv4inipv6
#define FLOW_PKT_TOCLIENT
int FlowSetStorageById(Flow *f, int id, void *ptr)
void FlowUpdateState(Flow *f, const enum FlowState s)
uint32_t default_packet_size
#define ACTION_REJECT_BOTH
void(* ReleasePacket)(struct Packet_ *)
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
uint16_t counter_flow_spare_sync_incomplete
void DecodeGlobalConfig(void)
uint16_t counter_flow_icmp6
uint16_t counter_ips_replaced
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
uint16_t counter_defrag_ipv6_reassembled
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
#define FatalError(x,...)
void CaptureStatsUpdate(ThreadVars *tv, CaptureStats *s, const Packet *p)
#define PACKET_PROFILING_START(p)
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data)
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
@ PKT_SRC_DETECT_RELOAD_FLUSH
Structure to hold thread specific data for all decode modules.
void AppLayerDestroyCtxThread(AppLayerThreadCtx *app_tctx)
Destroys the context created by AppLayeGetCtxThread().
void * output_flow_thread_data
uint16_t counter_max_mac_addrs_dst
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
uint16_t counter_defrag_max_hit
HashTable * HashTableInit(uint32_t size, uint32_t(*Hash)(struct HashTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
Packet * PacketPoolGetPacket(void)
Get a new packet from the packet pool.
#define GET_PKT_DIRECT_DATA(p)
#define TUNNEL_INCR_PKT_TPR(p)
void DecodeGeneveConfig(void)
uint16_t counter_flow_memcap
uint16_t counter_defrag_ipv6_fragments
uint16_t StatsRegisterAvgCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the average of all the values assigned to it.
void PacketDefragPktSetupParent(Packet *parent)
inform defrag "parent" that a pseudo packet is now associated to it.
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
bool stats_decoder_events
int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
int GetFlowBypassInfoID(void)
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
uint16_t counter_flow_get_used_eval_reject
int DecodeVLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
#define FLOW_PKT_TOSERVER_FIRST
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
#define PACKET_DESTRUCTOR(p)
Cleanup a packet so that we can free it. No memset needed..
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
uint16_t counter_engine_events[DECODE_EVENT_MAX]
@ DECODE_EVENT_PACKET_MAX
#define PACKET_TEST_ACTION(p, a)
uint16_t counter_defrag_ipv4_fragments