suricata
decode.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \defgroup decode Packet decoding
20  *
21  * \brief Code in charge of protocol decoding
22  *
23  * The task of decoding packets is made in different files and
24  * as Suricata is supporting encapsulation there is a potential
25  * recursivity in the call.
26  *
27  * For each protocol a DecodePROTO function is provided. For
28  * example we have DecodeIPV4() for IPv4 and DecodePPP() for
29  * PPP.
30  *
31  * These functions have all a pkt and a len argument which
32  * are respectively a pointer to the protocol data and the length
33  * of this protocol data.
34  *
35  * \attention The pkt parameter must point to the effective data because
36  * it will be used later to set per protocol pointer like Packet::tcph
37  *
38  * @{
39  */
40 
41 
42 /**
43  * \file
44  *
45  * \author Victor Julien <victor@inliniac.net>
46  *
47  * Decode the raw packet
48  */
49 
50 #include "suricata-common.h"
51 #include "decode.h"
52 
53 #include "packet.h"
54 #include "flow.h"
55 #include "flow-storage.h"
56 #include "tmqh-packetpool.h"
57 #include "app-layer.h"
58 #include "output.h"
59 
60 #include "decode-vxlan.h"
61 #include "decode-geneve.h"
62 #include "decode-erspan.h"
63 #include "decode-teredo.h"
64 #include "decode-arp.h"
65 
66 #include "defrag-hash.h"
67 
68 #include "util-hash.h"
69 #include "util-hash-string.h"
70 #include "util-print.h"
71 #include "util-profiling.h"
72 #include "util-validate.h"
73 #include "util-debug.h"
74 #include "util-exception-policy.h"
75 #include "action-globals.h"
76 
77 uint32_t default_packet_size = 0;
78 extern bool stats_decoder_events;
79 extern const char *stats_decoder_events_prefix;
80 extern bool stats_stream_events;
83 
84 /* Settings order as in the enum */
85 // clang-format off
88  /* EXCEPTION_POLICY_NOT_SET */ false,
89  /* EXCEPTION_POLICY_AUTO */ false,
90  /* EXCEPTION_POLICY_PASS_PACKET */ true,
91  /* EXCEPTION_POLICY_PASS_FLOW */ false,
92  /* EXCEPTION_POLICY_BYPASS_FLOW */ true,
93  /* EXCEPTION_POLICY_DROP_PACKET */ false,
94  /* EXCEPTION_POLICY_DROP_FLOW */ false,
95  /* EXCEPTION_POLICY_REJECT */ true,
96  },
97  .valid_settings_ips = {
98  /* EXCEPTION_POLICY_NOT_SET */ false,
99  /* EXCEPTION_POLICY_AUTO */ false,
100  /* EXCEPTION_POLICY_PASS_PACKET */ true,
101  /* EXCEPTION_POLICY_PASS_FLOW */ false,
102  /* EXCEPTION_POLICY_BYPASS_FLOW */ true,
103  /* EXCEPTION_POLICY_DROP_PACKET */ true,
104  /* EXCEPTION_POLICY_DROP_FLOW */ false,
105  /* EXCEPTION_POLICY_REJECT */ true,
106  },
107 };
108 // clang-format on
109 
110 /* Settings order as in the enum */
111 // clang-format off
113  .valid_settings_ids = {
114  /* EXCEPTION_POLICY_NOT_SET */ false,
115  /* EXCEPTION_POLICY_AUTO */ false,
116  /* EXCEPTION_POLICY_PASS_PACKET */ true,
117  /* EXCEPTION_POLICY_PASS_FLOW */ false,
118  /* EXCEPTION_POLICY_BYPASS_FLOW */ true,
119  /* EXCEPTION_POLICY_DROP_PACKET */ false,
120  /* EXCEPTION_POLICY_DROP_FLOW */ false,
121  /* EXCEPTION_POLICY_REJECT */ true,
122  },
123  .valid_settings_ips = {
124  /* EXCEPTION_POLICY_NOT_SET */ false,
125  /* EXCEPTION_POLICY_AUTO */ false,
126  /* EXCEPTION_POLICY_PASS_PACKET */ true,
127  /* EXCEPTION_POLICY_PASS_FLOW */ false,
128  /* EXCEPTION_POLICY_BYPASS_FLOW */ true,
129  /* EXCEPTION_POLICY_DROP_PACKET */ true,
130  /* EXCEPTION_POLICY_DROP_FLOW */ false,
131  /* EXCEPTION_POLICY_REJECT */ true,
132  },
133 };
134 // clang-format on
135 
136 /**
137  * \brief Initialize PacketAlerts with dynamic alerts array size
138  *
139  */
141 {
142  PacketAlert *pa_array = SCCalloc(packet_alert_max, sizeof(PacketAlert));
143  BUG_ON(pa_array == NULL);
144 
145  return pa_array;
146 }
147 
148 void PacketAlertRecycle(PacketAlert *pa_array, uint16_t cnt)
149 {
150  if (pa_array == NULL)
151  return;
152  /* Clean json content for alerts attached to the packet */
153  for (int i = 0; i < cnt; i++) {
154  struct PacketContextData *current_json = pa_array[i].json_info;
155  while (current_json) {
156  struct PacketContextData *next_json = current_json->next;
157  SCFree(current_json->json_string);
158  SCFree(current_json);
159  current_json = next_json;
160  }
161  pa_array[i].json_info = NULL;
162  }
163 }
164 
166 {
167  if (pa_array == NULL)
168  return;
169  for (int i = 0; i < packet_alert_max; i++) {
170  struct PacketContextData *allocated_json = pa_array[i].json_info;
171  while (allocated_json) {
172  struct PacketContextData *next_json = allocated_json->next;
173  SCFree(allocated_json->json_string);
174  SCFree(allocated_json);
175  allocated_json = next_json;
176  }
177  }
178  SCFree(pa_array);
179 }
180 
181 static int DecodeTunnel(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t,
183 
184 static int DecodeTunnel(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt,
185  uint32_t len, enum DecodeTunnelProto proto)
186 {
187  switch (proto) {
188  case DECODE_TUNNEL_PPP:
189  return DecodePPP(tv, dtv, p, pkt, len);
190  case DECODE_TUNNEL_IPV4:
191  DEBUG_VALIDATE_BUG_ON(len > UINT16_MAX);
192  return DecodeIPV4(tv, dtv, p, pkt, (uint16_t)len);
193  case DECODE_TUNNEL_IPV6:
195  DEBUG_VALIDATE_BUG_ON(len > UINT16_MAX);
196  return DecodeIPV6(tv, dtv, p, pkt, (uint16_t)len);
197  case DECODE_TUNNEL_VLAN:
198  return DecodeVLAN(tv, dtv, p, pkt, len);
200  return DecodeEthernet(tv, dtv, p, pkt, len);
202  return DecodeERSPAN(tv, dtv, p, pkt, len);
204  return DecodeERSPANTypeI(tv, dtv, p, pkt, len);
205  case DECODE_TUNNEL_NSH:
206  return DecodeNSH(tv, dtv, p, pkt, len);
207  case DECODE_TUNNEL_ARP:
208  return DecodeARP(tv, dtv, p, pkt, len);
209  default:
210  SCLogDebug("FIXME: DecodeTunnel: protocol %" PRIu32 " not supported.", proto);
211  break;
212  }
213  return TM_ECODE_OK;
214 }
215 
216 /**
217  * \brief Return a malloced packet.
218  */
220 {
221  PacketDestructor(p);
222  SCFree(p);
223 }
224 
225 /**
226  * \brief Finalize decoding of a packet
227  *
228  * This function needs to be call at the end of decode
229  * functions when decoding has been successful.
230  *
231  */
233 {
234  if (p->flags & PKT_IS_INVALID) {
236  }
237 }
238 
241 {
242  for (uint8_t i = 0; i < p->events.cnt; i++) {
243  const uint8_t e = p->events.events[i];
244 
246  continue;
248  continue;
250  }
251 }
252 
253 /**
254  * \brief Get a malloced packet.
255  *
256  * \retval p packet, NULL on error
257  */
259 {
260  Packet *p = SCCalloc(1, SIZE_OF_PACKET);
261  if (unlikely(p == NULL)) {
262  return NULL;
263  }
264  PacketInit(p);
266 
267  SCLogDebug("allocated a new packet only using alloc...");
268 
270  return p;
271 }
272 
273 /**
274  * \brief Return a packet to where it was allocated.
275  */
277 {
278  if (likely(p->pool != NULL)) {
281  } else {
282  PacketFree(p);
283  }
284 }
285 
286 /**
287  * \brief Get a packet. We try to get a packet from the packetpool first, but
288  * if that is empty we alloc a packet that is free'd again after
289  * processing.
290  *
291  * \retval p packet, NULL on error
292  */
294 {
295  /* try the pool first */
297 
298  if (p == NULL) {
299  /* non fatal, we're just not processing a packet then */
300  p = PacketGetFromAlloc();
301  } else {
304  }
305 
306  return p;
307 }
308 
309 inline int PacketCallocExtPkt(Packet *p, int datalen)
310 {
311  if (! p->ext_pkt) {
312  p->ext_pkt = SCCalloc(1, datalen);
313  if (unlikely(p->ext_pkt == NULL)) {
314  SET_PKT_LEN(p, 0);
315  return -1;
316  }
317  }
318  return 0;
319 }
320 
321 /**
322  * \brief Copy data to Packet payload at given offset
323  *
324  * This function copies data/payload to a Packet. It uses the
325  * space allocated at Packet creation (pointed by Packet::pkt)
326  * or allocate some memory (pointed by Packet::ext_pkt) if the
327  * data size is to big to fit in initial space (of size
328  * default_packet_size).
329  *
330  * \param Pointer to the Packet to modify
331  * \param Offset of the copy relatively to payload of Packet
332  * \param Pointer to the data to copy
333  * \param Length of the data to copy
334  */
335 inline int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
336 {
337  if (unlikely(offset + datalen > MAX_PAYLOAD_SIZE)) {
338  /* too big */
339  SET_PKT_LEN(p, 0);
340  return -1;
341  }
342 
343  /* Do we have already an packet with allocated data */
344  if (! p->ext_pkt) {
345  uint32_t newsize = offset + datalen;
346  // check overflow
347  if (newsize < offset)
348  return -1;
349  if (newsize <= default_packet_size) {
350  /* data will fit in memory allocated with packet */
351  memcpy(GET_PKT_DIRECT_DATA(p) + offset, data, datalen);
352  } else {
353  /* here we need a dynamic allocation */
355  if (unlikely(p->ext_pkt == NULL)) {
356  SET_PKT_LEN(p, 0);
357  return -1;
358  }
359  /* copy initial data */
361  /* copy data as asked */
362  memcpy(p->ext_pkt + offset, data, datalen);
363  }
364  } else {
365  memcpy(p->ext_pkt + offset, data, datalen);
366  }
367  return 0;
368 }
369 
370 /**
371  * \brief Copy data to Packet payload and set packet length
372  *
373  * \param Pointer to the Packet to modify
374  * \param Pointer to the data to copy
375  * \param Length of the data to copy
376  */
377 inline int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
378 {
379  SET_PKT_LEN(p, pktlen);
380  return PacketCopyDataOffset(p, 0, pktdata, pktlen);
381 }
382 
383 /**
384  * \brief Setup a pseudo packet (tunnel)
385  *
386  * \param parent parent packet for this pseudo pkt
387  * \param pkt raw packet data
388  * \param len packet data length
389  * \param proto protocol of the tunneled packet
390  *
391  * \retval p the pseudo packet or NULL if out of memory
392  */
394  const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
395 {
396  int ret;
397 
398  SCEnter();
399 
400  if (parent->nb_decoded_layers + 1 >= decoder_max_layers) {
402  SCReturnPtr(NULL, "Packet");
403  }
404 
405  /* get us a packet */
407  if (unlikely(p == NULL)) {
408  SCReturnPtr(NULL, "Packet");
409  }
410 
411  /* copy packet and set length, proto */
412  PacketCopyData(p, pkt, len);
413  DEBUG_VALIDATE_BUG_ON(parent->recursion_level == 255);
414  p->recursion_level = parent->recursion_level + 1;
416  p->nb_decoded_layers = parent->nb_decoded_layers + 1;
417  p->ts = parent->ts;
418  p->datalink = DLT_RAW;
419  p->tenant_id = parent->tenant_id;
420  p->livedev = parent->livedev;
421 
422  /* set the root ptr to the lowest layer */
423  if (parent->root != NULL) {
424  p->root = parent->root;
425  BUG_ON(parent->ttype != PacketTunnelChild);
426  } else {
427  p->root = parent;
428  parent->ttype = PacketTunnelRoot;
429  }
430  /* tell new packet it's part of a tunnel */
432 
433  ret = DecodeTunnel(tv, dtv, p, GET_PKT_DATA(p),
434  GET_PKT_LEN(p), proto);
435 
436  if (unlikely(ret != TM_ECODE_OK) ||
438  {
439  /* Not a (valid) tunnel packet */
440  SCLogDebug("tunnel packet is invalid");
441  p->root = NULL;
443  SCReturnPtr(NULL, "Packet");
444  }
445 
446  /* Update tunnel settings in parent */
447  if (parent->root == NULL) {
448  parent->ttype = PacketTunnelRoot;
449  }
450  TUNNEL_INCR_PKT_TPR(p);
451 
452  /* disable payload (not packet) inspection on the parent, as the payload
453  * is the packet we will now run through the system separately. We do
454  * check it against the ip/port/other header checks though */
455  DecodeSetNoPayloadInspectionFlag(parent);
456  SCReturnPtr(p, "Packet");
457 }
458 
459 /**
460  * \brief Setup a pseudo packet (reassembled frags)
461  *
462  * Difference with PacketPseudoPktSetup is that this func doesn't increment
463  * the recursion level. It needs to be on the same level as the frags because
464  * we run the flow engine against this and we need to get the same flow.
465  *
466  * \param parent parent packet for this pseudo pkt
467  * \param pkt raw packet data
468  * \param len packet data length
469  * \param proto protocol of the tunneled packet
470  *
471  * \retval p the pseudo packet or NULL if out of memory
472  */
473 Packet *PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto)
474 {
475  SCEnter();
476 
477  /* get us a packet */
479  if (unlikely(p == NULL)) {
480  SCReturnPtr(NULL, "Packet");
481  }
482 
483  /* set the root ptr to the lowest layer */
484  if (parent->root != NULL) {
485  p->root = parent->root;
486  BUG_ON(parent->ttype != PacketTunnelChild);
487  } else {
488  p->root = parent;
489  // we set parent->ttype later
490  }
491  /* tell new packet it's part of a tunnel */
493 
494  /* copy packet and set length, proto */
495  if (pkt && len) {
496  PacketCopyData(p, pkt, len);
497  }
498  p->recursion_level = parent->recursion_level; /* NOT incremented */
499  p->ts = parent->ts;
500  p->tenant_id = parent->tenant_id;
501  memcpy(&p->vlan_id[0], &parent->vlan_id[0], sizeof(p->vlan_id));
502  p->vlan_idx = parent->vlan_idx;
503  p->livedev = parent->livedev;
504 
505  SCReturnPtr(p, "Packet");
506 }
507 
508 /**
509  * \brief inform defrag "parent" that a pseudo packet is
510  * now associated to it.
511  */
513 {
514  /* tell parent packet it's part of a tunnel */
515  if (parent->ttype == PacketTunnelNone)
516  parent->ttype = PacketTunnelRoot;
517 
518  /* increment tunnel packet refcnt in the root packet */
519  TUNNEL_INCR_PKT_TPR(parent);
520 
521  /* disable payload (not packet) inspection on the parent, as the payload
522  * is the packet we will now run through the system separately. We do
523  * check it against the ip/port/other header checks though */
524  DecodeSetNoPayloadInspectionFlag(parent);
525 }
526 
527 /**
528  * \note if p->flow is set, the flow is locked
529  */
531 {
532  if (PKT_IS_PSEUDOPKT(p))
533  return;
534 
535 #ifdef CAPTURE_OFFLOAD
536  /* Don't try to bypass if flow is already out or
537  * if we have failed to do it once */
538  if (p->flow) {
539  int state = p->flow->flow_state;
540  if ((state == FLOW_STATE_LOCAL_BYPASSED) ||
541  (state == FLOW_STATE_CAPTURE_BYPASSED)) {
542  return;
543  }
544 
545  FlowBypassInfo *fc;
546 
548  if (fc == NULL) {
549  fc = SCCalloc(sizeof(FlowBypassInfo), 1);
550  if (fc) {
552  } else {
553  return;
554  }
555  }
556  }
557  if (p->BypassPacketsFlow && p->BypassPacketsFlow(p)) {
558  if (p->flow) {
559  FlowUpdateState(p->flow, FLOW_STATE_CAPTURE_BYPASSED);
560  }
561  } else {
562  if (p->flow) {
564  }
565  }
566 #else /* CAPTURE_OFFLOAD */
567  if (p->flow) {
568  int state = p->flow->flow_state;
569  if (state == FLOW_STATE_LOCAL_BYPASSED)
570  return;
572  }
573 #endif
574 }
575 
576 /** \brief switch direction of a packet */
578 {
579  if (PKT_IS_TOSERVER(p)) {
582 
586  }
587  } else {
590 
594  }
595  }
596 }
597 
598 /* counter name store */
599 static HashTable *g_counter_table = NULL;
600 static SCMutex g_counter_table_mutex = SCMUTEX_INITIALIZER;
601 
603 {
604  SCMutexLock(&g_counter_table_mutex);
605  if (g_counter_table) {
606  HashTableFree(g_counter_table);
607  g_counter_table = NULL;
608  }
609  SCMutexUnlock(&g_counter_table_mutex);
610 }
611 
612 static bool IsDefragMemcapExceptionPolicyStatsValid(enum ExceptionPolicy policy)
613 {
614  if (EngineModeIsIPS()) {
616  }
618 }
619 
620 static bool IsFlowMemcapExceptionPolicyStatsValid(enum ExceptionPolicy policy)
621 {
622  if (EngineModeIsIPS()) {
624  }
626 }
627 
629 {
630  /* register counters */
631  dtv->counter_pkts = StatsRegisterCounter("decoder.pkts", tv);
632  dtv->counter_bytes = StatsRegisterCounter("decoder.bytes", tv);
633  dtv->counter_invalid = StatsRegisterCounter("decoder.invalid", tv);
634  dtv->counter_ipv4 = StatsRegisterCounter("decoder.ipv4", tv);
635  dtv->counter_ipv6 = StatsRegisterCounter("decoder.ipv6", tv);
636  dtv->counter_eth = StatsRegisterCounter("decoder.ethernet", tv);
637  dtv->counter_arp = StatsRegisterCounter("decoder.arp", tv);
638  dtv->counter_ethertype_unknown = StatsRegisterCounter("decoder.unknown_ethertype", tv);
639  dtv->counter_chdlc = StatsRegisterCounter("decoder.chdlc", tv);
640  dtv->counter_raw = StatsRegisterCounter("decoder.raw", tv);
641  dtv->counter_null = StatsRegisterCounter("decoder.null", tv);
642  dtv->counter_sll = StatsRegisterCounter("decoder.sll", tv);
643  dtv->counter_sll2 = StatsRegisterCounter("decoder.sll2", tv);
644  dtv->counter_tcp = StatsRegisterCounter("decoder.tcp", tv);
645 
647  dtv->counter_tcp_synack = StatsRegisterCounter("tcp.synack", tv);
650 
651  dtv->counter_udp = StatsRegisterCounter("decoder.udp", tv);
652  dtv->counter_sctp = StatsRegisterCounter("decoder.sctp", tv);
653  dtv->counter_esp = StatsRegisterCounter("decoder.esp", tv);
654  dtv->counter_icmpv4 = StatsRegisterCounter("decoder.icmpv4", tv);
655  dtv->counter_icmpv6 = StatsRegisterCounter("decoder.icmpv6", tv);
656  dtv->counter_ppp = StatsRegisterCounter("decoder.ppp", tv);
657  dtv->counter_pppoe = StatsRegisterCounter("decoder.pppoe", tv);
658  dtv->counter_geneve = StatsRegisterCounter("decoder.geneve", tv);
659  dtv->counter_gre = StatsRegisterCounter("decoder.gre", tv);
660  dtv->counter_vlan = StatsRegisterCounter("decoder.vlan", tv);
661  dtv->counter_vlan_qinq = StatsRegisterCounter("decoder.vlan_qinq", tv);
662  dtv->counter_vlan_qinqinq = StatsRegisterCounter("decoder.vlan_qinqinq", tv);
663  dtv->counter_vxlan = StatsRegisterCounter("decoder.vxlan", tv);
664  dtv->counter_vntag = StatsRegisterCounter("decoder.vntag", tv);
665  dtv->counter_ieee8021ah = StatsRegisterCounter("decoder.ieee8021ah", tv);
666  dtv->counter_teredo = StatsRegisterCounter("decoder.teredo", tv);
667  dtv->counter_ipv4inipv6 = StatsRegisterCounter("decoder.ipv4_in_ipv6", tv);
668  dtv->counter_ipv6inipv6 = StatsRegisterCounter("decoder.ipv6_in_ipv6", tv);
669  dtv->counter_mpls = StatsRegisterCounter("decoder.mpls", tv);
670  dtv->counter_avg_pkt_size = StatsRegisterAvgCounter("decoder.avg_pkt_size", tv);
671  dtv->counter_max_pkt_size = StatsRegisterMaxCounter("decoder.max_pkt_size", tv);
672  dtv->counter_max_mac_addrs_src = StatsRegisterMaxCounter("decoder.max_mac_addrs_src", tv);
673  dtv->counter_max_mac_addrs_dst = StatsRegisterMaxCounter("decoder.max_mac_addrs_dst", tv);
674  dtv->counter_erspan = StatsRegisterMaxCounter("decoder.erspan", tv);
675  dtv->counter_nsh = StatsRegisterMaxCounter("decoder.nsh", tv);
676  dtv->counter_flow_memcap = StatsRegisterCounter("flow.memcap", tv);
678  FlowGetMemcapExceptionPolicy(), "exception_policy.flow.memcap.",
679  IsFlowMemcapExceptionPolicyStatsValid);
680 
681  dtv->counter_tcp_active_sessions = StatsRegisterCounter("tcp.active_sessions", tv);
682  dtv->counter_flow_total = StatsRegisterCounter("flow.total", tv);
683  dtv->counter_flow_active = StatsRegisterCounter("flow.active", tv);
686  dtv->counter_flow_icmp4 = StatsRegisterCounter("flow.icmpv4", tv);
687  dtv->counter_flow_icmp6 = StatsRegisterCounter("flow.icmpv6", tv);
688  dtv->counter_flow_tcp_reuse = StatsRegisterCounter("flow.tcp_reuse", tv);
689  dtv->counter_flow_elephant = StatsRegisterCounter("flow.elephant", tv);
690  dtv->counter_flow_get_used = StatsRegisterCounter("flow.get_used", tv);
691  dtv->counter_flow_get_used_eval = StatsRegisterCounter("flow.get_used_eval", tv);
692  dtv->counter_flow_get_used_eval_reject = StatsRegisterCounter("flow.get_used_eval_reject", tv);
693  dtv->counter_flow_get_used_eval_busy = StatsRegisterCounter("flow.get_used_eval_busy", tv);
694  dtv->counter_flow_get_used_failed = StatsRegisterCounter("flow.get_used_failed", tv);
695 
696  dtv->counter_flow_spare_sync_avg = StatsRegisterAvgCounter("flow.wrk.spare_sync_avg", tv);
697  dtv->counter_flow_spare_sync = StatsRegisterCounter("flow.wrk.spare_sync", tv);
698  dtv->counter_flow_spare_sync_incomplete = StatsRegisterCounter("flow.wrk.spare_sync_incomplete", tv);
699  dtv->counter_flow_spare_sync_empty = StatsRegisterCounter("flow.wrk.spare_sync_empty", tv);
700 
702  StatsRegisterCounter("defrag.ipv4.fragments", tv);
703  dtv->counter_defrag_ipv4_reassembled = StatsRegisterCounter("defrag.ipv4.reassembled", tv);
705  StatsRegisterCounter("defrag.ipv6.fragments", tv);
706  dtv->counter_defrag_ipv6_reassembled = StatsRegisterCounter("defrag.ipv6.reassembled", tv);
707  dtv->counter_defrag_max_hit = StatsRegisterCounter("defrag.max_trackers_reached", tv);
708  dtv->counter_defrag_no_frags = StatsRegisterCounter("defrag.max_frags_reached", tv);
709  dtv->counter_defrag_tracker_soft_reuse = StatsRegisterCounter("defrag.tracker_soft_reuse", tv);
710  dtv->counter_defrag_tracker_hard_reuse = StatsRegisterCounter("defrag.tracker_hard_reuse", tv);
711  dtv->counter_defrag_tracker_timeout = StatsRegisterCounter("defrag.wrk.tracker_timeout", tv);
712 
714  DefragGetMemcapExceptionPolicy(), "exception_policy.defrag.memcap.",
715  IsDefragMemcapExceptionPolicyStatsValid);
716 
717  for (int i = 0; i < DECODE_EVENT_MAX; i++) {
718  BUG_ON(i != (int)DEvents[i].code);
719 
721  continue;
723  continue;
724 
725  if (i < DECODE_EVENT_PACKET_MAX &&
726  strncmp(DEvents[i].event_name, "decoder.", 8) == 0)
727  {
728  SCMutexLock(&g_counter_table_mutex);
729  if (g_counter_table == NULL) {
730  g_counter_table = HashTableInit(256, StringHashFunc,
733  if (g_counter_table == NULL) {
734  FatalError("decoder counter hash "
735  "table init failed");
736  }
737  }
738 
739  char name[256];
740  char *dot = strchr(DEvents[i].event_name, '.');
741  BUG_ON(!dot);
742  snprintf(name, sizeof(name), "%s.%s",
744 
745  const char *found = HashTableLookup(g_counter_table, name, 0);
746  if (!found) {
747  char *add = SCStrdup(name);
748  if (add == NULL)
749  FatalError("decoder counter hash "
750  "table name init failed");
751  int r = HashTableAdd(g_counter_table, add, 0);
752  if (r != 0)
753  FatalError("decoder counter hash "
754  "table name add failed");
755  found = add;
756  }
758  found, tv);
759 
760  SCMutexUnlock(&g_counter_table_mutex);
761  } else {
763  DEvents[i].event_name, tv);
764  }
765  }
766 }
767 
769  const DecodeThreadVars *dtv, const Packet *p)
770 {
772  //StatsIncr(tv, dtv->counter_pkts_per_sec);
776 }
777 
778 /**
779  * \brief Debug print function for printing addresses
780  *
781  * \param Address object
782  *
783  * \todo IPv6
784  */
786 {
787  if (a == NULL)
788  return;
789 
790  switch (a->family) {
791  case AF_INET:
792  {
793  char s[16];
794  PrintInet(AF_INET, (const void *)&a->addr_data32[0], s, sizeof(s));
795  SCLogDebug("%s", s);
796  break;
797  }
798  }
799 }
800 
801 /** \brief Alloc and setup DecodeThreadVars */
803 {
804  DecodeThreadVars *dtv = NULL;
805 
806  if ((dtv = SCCalloc(1, sizeof(DecodeThreadVars))) == NULL)
807  return NULL;
808 
810 
812  SCLogError("initializing flow log API for thread failed");
814  return NULL;
815  }
816 
817  return dtv;
818 }
819 
821 {
822  if (dtv != NULL) {
823  if (dtv->app_tctx != NULL)
825 
826  if (dtv->output_flow_thread_data != NULL)
828 
829  SCFree(dtv);
830  }
831 }
832 
833 /**
834  * \brief Set data for Packet and set length when zero copy is used
835  *
836  * \param Pointer to the Packet to modify
837  * \param Pointer to the data
838  * \param Length of the data
839  */
840 inline int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
841 {
842  SET_PKT_LEN(p, pktlen);
843  if (unlikely(!pktdata)) {
844  return -1;
845  }
846  // ext_pkt cannot be const (because we sometimes copy)
847  p->ext_pkt = (uint8_t *) pktdata;
848  p->flags |= PKT_ZERO_COPY;
849 
850  return 0;
851 }
852 
853 const char *PktSrcToString(enum PktSrcEnum pkt_src)
854 {
855  const char *pkt_src_str = NULL;
856  switch (pkt_src) {
857  case PKT_SRC_WIRE:
858  pkt_src_str = "wire/pcap";
859  break;
860  case PKT_SRC_DECODER_GRE:
861  pkt_src_str = "gre tunnel";
862  break;
864  pkt_src_str = "ipv4 tunnel";
865  break;
867  pkt_src_str = "ipv6 tunnel";
868  break;
870  pkt_src_str = "teredo tunnel";
871  break;
872  case PKT_SRC_DEFRAG:
873  pkt_src_str = "defrag";
874  break;
876  pkt_src_str = "stream (detect/log)";
877  break;
878  case PKT_SRC_FFR:
879  pkt_src_str = "stream (flow timeout)";
880  break;
882  pkt_src_str = "geneve encapsulation";
883  break;
885  pkt_src_str = "vxlan encapsulation";
886  break;
888  pkt_src_str = "detect reload flush";
889  break;
891  pkt_src_str = "capture timeout flush";
892  break;
894  pkt_src_str = "shutdown flush";
895  break;
896  }
897  DEBUG_VALIDATE_BUG_ON(pkt_src_str == NULL);
898  return pkt_src_str;
899 }
900 
902 {
903  switch (r) {
905  return "decode error";
907  return "defrag error";
909  return "defrag memcap";
911  return "flow memcap";
913  return "flow drop";
915  return "stream error";
917  return "stream memcap";
919  return "stream midstream";
921  return "stream urgent";
923  return "stream reassembly";
925  return "applayer error";
927  return "applayer memcap";
929  return "rules";
931  return "threshold detection_filter";
933  return "nfq error";
935  return "tunnel packet drop";
937  return "default packet policy";
939  return "default app policy";
941  return "pre stream hook";
943  return "pre flow hook";
945  case PKT_DROP_REASON_MAX:
946  return NULL;
947  }
948  return NULL;
949 }
950 
951 static const char *PacketDropReasonToJsonString(enum PacketDropReason r)
952 {
953  switch (r) {
955  return "ips.drop_reason.decode_error";
957  return "ips.drop_reason.defrag_error";
959  return "ips.drop_reason.defrag_memcap";
961  return "ips.drop_reason.flow_memcap";
963  return "ips.drop_reason.flow_drop";
965  return "ips.drop_reason.stream_error";
967  return "ips.drop_reason.stream_memcap";
969  return "ips.drop_reason.stream_midstream";
971  return "ips.drop_reason.stream_urgent";
973  return "ips.drop_reason.stream_reassembly";
975  return "ips.drop_reason.applayer_error";
977  return "ips.drop_reason.applayer_memcap";
979  return "ips.drop_reason.rules";
981  return "ips.drop_reason.threshold_detection_filter";
983  return "ips.drop_reason.nfq_error";
985  return "ips.drop_reason.tunnel_packet_drop";
987  return "ips.drop_reason.default_packet_policy";
989  return "ips.drop_reason.default_app_policy";
991  return "ips.drop_reason.pre_stream_hook";
993  return "ips.drop_reason.pre_flow_hook";
995  case PKT_DROP_REASON_MAX:
996  return NULL;
997  }
998  return NULL;
999 }
1000 
1001 typedef struct CaptureStats_ {
1006 
1009 
1011 
1013 {
1014  if (!EngineModeIsIPS() || PKT_IS_PSEUDOPKT(p))
1015  return;
1016 
1020  } else if (unlikely(PacketCheckAction(p, ACTION_DROP))) {
1022  } else if (unlikely(p->flags & PKT_STREAM_MODIFIED)) {
1024  } else {
1026  }
1029  }
1030 }
1031 
1033 {
1034  if (EngineModeIsIPS()) {
1036  s->counter_ips_accepted = StatsRegisterCounter("ips.accepted", tv);
1037  s->counter_ips_blocked = StatsRegisterCounter("ips.blocked", tv);
1038  s->counter_ips_rejected = StatsRegisterCounter("ips.rejected", tv);
1039  s->counter_ips_replaced = StatsRegisterCounter("ips.replaced", tv);
1040  for (int i = PKT_DROP_REASON_NOT_SET; i < PKT_DROP_REASON_MAX; i++) {
1041  const char *name = PacketDropReasonToJsonString(i);
1042  if (name != NULL)
1044  }
1045  }
1046 }
1047 
1049 {
1054  intmax_t value = 0;
1055  if (SCConfGetInt("decoder.max-layers", &value) == 1) {
1056  if (value < 0 || value > UINT8_MAX) {
1057  SCLogWarning("Invalid value for decoder.max-layers");
1058  } else {
1059  decoder_max_layers = (uint8_t)value;
1060  }
1061  }
1063 }
1064 
1066 {
1067  intmax_t max = 0;
1068  if (SCConfGetInt("packet-alert-max", &max) == 1) {
1069  if (max <= 0 || max > UINT8_MAX) {
1070  SCLogWarning("Invalid value for packet-alert-max, default value set instead");
1071  } else {
1072  packet_alert_max = (uint16_t)max;
1073  }
1074  }
1075  SCLogDebug("detect->packet_alert_max set to %d", packet_alert_max);
1076 }
1077 
1078 /**
1079  * @}
1080  */
PacketCheckAction
bool PacketCheckAction(const Packet *p, const uint8_t a)
Definition: packet.c:49
DecodeThreadVars_::counter_flow_get_used_eval_busy
uint16_t counter_flow_get_used_eval_busy
Definition: decode.h:1042
PKT_DROP_REASON_DEFRAG_MEMCAP
@ PKT_DROP_REASON_DEFRAG_MEMCAP
Definition: decode.h:384
PKT_DROP_REASON_DEFRAG_ERROR
@ PKT_DROP_REASON_DEFRAG_ERROR
Definition: decode.h:383
PKT_DROP_REASON_STREAM_PRE_HOOK
@ PKT_DROP_REASON_STREAM_PRE_HOOK
Definition: decode.h:400
DecodeThreadVars_::counter_defrag_ipv4_reassembled
uint16_t counter_defrag_ipv4_reassembled
Definition: decode.h:1017
util-hash-string.h
PKT_DROP_REASON_RULES_THRESHOLD
@ PKT_DROP_REASON_RULES_THRESHOLD
Definition: decode.h:390
DecodeThreadVars_::counter_ethertype_unknown
uint16_t counter_ethertype_unknown
Definition: decode.h:990
DecodeThreadVars_::counter_flow_udp
uint16_t counter_flow_udp
Definition: decode.h:1034
len
uint8_t len
Definition: app-layer-dnp3.h:2
DecodeThreadVars_::counter_bytes
uint16_t counter_bytes
Definition: decode.h:969
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:1105
CaptureStats_::counter_ips_blocked
uint16_t counter_ips_blocked
Definition: decode.c:1003
decode-erspan.h
decode-vxlan.h
DecodeThreadVars_::counter_eth
uint16_t counter_eth
Definition: decode.h:977
DecodeThreadVars_::counter_flow_active
uint16_t counter_flow_active
Definition: decode.h:1032
OutputFlowLogThreadInit
TmEcode OutputFlowLogThreadInit(ThreadVars *tv, void **data)
thread init for the flow logger This will run the thread init functions for the individual registered...
Definition: output-flow.c:123
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:166
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
DecodeERSPAN
int DecodeERSPAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
ERSPAN Type II.
Definition: decode-erspan.c:76
PacketFreeOrRelease
void PacketFreeOrRelease(Packet *p)
Return a packet to where it was allocated.
Definition: decode.c:276
DecodeThreadVars_::counter_flow_icmp4
uint16_t counter_flow_icmp4
Definition: decode.h:1035
DecodeThreadVars_::counter_vxlan
uint16_t counter_vxlan
Definition: decode.h:1004
DecodeThreadVars_::counter_max_pkt_size
uint16_t counter_max_pkt_size
Definition: decode.h:971
DecodePPP
int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-ppp.c:174
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:377
PacketBypassCallback
void PacketBypassCallback(Packet *p)
Definition: decode.c:530
PKT_IS_PSEUDOPKT
#define PKT_IS_PSEUDOPKT(p)
return 1 if the packet is a pseudo packet
Definition: decode.h:1319
DecodeThreadVars_::counter_avg_pkt_size
uint16_t counter_avg_pkt_size
Definition: decode.h:970
DecodeERSPANConfig
void DecodeERSPANConfig(void)
Functions to decode ERSPAN Type I and II packets.
Definition: decode-erspan.c:53
PacketPoolReturnPacket
void PacketPoolReturnPacket(Packet *p)
Return packet to Packet pool.
Definition: tmqh-packetpool.c:177
GetFlowBypassInfoID
FlowStorageId GetFlowBypassInfoID(void)
Definition: flow-util.c:222
FlowBypassInfo_
Definition: flow.h:529
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
PKT_DROP_REASON_STREAM_MEMCAP
@ PKT_DROP_REASON_STREAM_MEMCAP
Definition: decode.h:392
DecodeNSH
int DecodeNSH(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode NSH packets.
Definition: decode-nsh.c:46
PKT_DROP_REASON_FLOW_MEMCAP
@ PKT_DROP_REASON_FLOW_MEMCAP
Definition: decode.h:385
DecodeTeredoConfig
void DecodeTeredoConfig(void)
Definition: decode-teredo.c:104
CaptureStatsSetup
void CaptureStatsSetup(ThreadVars *tv)
Definition: decode.c:1032
PacketDropReasonToString
const char * PacketDropReasonToString(enum PacketDropReason r)
Definition: decode.c:901
PacketEngineEvents_::events
uint8_t events[PACKET_ENGINE_EVENT_MAX]
Definition: decode.h:308
CaptureStats_
Definition: decode.c:1001
PKT_STREAM_MODIFIED
#define PKT_STREAM_MODIFIED
Definition: decode.h:1269
DECODE_TUNNEL_IPV6_TEREDO
@ DECODE_TUNNEL_IPV6_TEREDO
Definition: decode.h:1106
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:275
PKT_SRC_SHUTDOWN_FLUSH
@ PKT_SRC_SHUTDOWN_FLUSH
Definition: decode.h:64
AddressDebugPrint
void AddressDebugPrint(Address *a)
Debug print function for printing addresses.
Definition: decode.c:785
PKT_SRC_DECODER_IPV4
@ PKT_SRC_DECODER_IPV4
Definition: decode.h:54
DecodeThreadVars_::counter_flow_spare_sync_avg
uint16_t counter_flow_spare_sync_avg
Definition: decode.h:1048
PacketDefragPktSetup
Packet * PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto)
Setup a pseudo packet (reassembled frags)
Definition: decode.c:473
stats_stream_events
bool stats_stream_events
Definition: counters.c:104
PKT_ZERO_COPY
#define PKT_ZERO_COPY
Definition: decode.h:1282
PKT_SRC_CAPTURE_TIMEOUT
@ PKT_SRC_CAPTURE_TIMEOUT
Definition: decode.h:62
action-globals.h
Packet_::flags
uint32_t flags
Definition: decode.h:544
PacketAlertCreate
PacketAlert * PacketAlertCreate(void)
Initialize PacketAlerts with dynamic alerts array size.
Definition: decode.c:140
DecodeThreadVars_::counter_vntag
uint16_t counter_vntag
Definition: decode.h:1005
Packet_::vlan_idx
uint8_t vlan_idx
Definition: decode.h:529
DecodeThreadVars_::counter_flow_get_used_eval
uint16_t counter_flow_get_used_eval
Definition: decode.h:1040
util-hash.h
ExceptionPolicyStatsSetts_
Definition: util-exception-policy-types.h:56
CaptureStats
struct CaptureStats_ CaptureStats
StatsSetUI64
void StatsSetUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Sets a value of type double to the local counter.
Definition: counters.c:207
DECODE_EVENT_PACKET_MAX
@ DECODE_EVENT_PACKET_MAX
Definition: decode-events.h:231
PKT_DROP_REASON_FLOW_PRE_HOOK
@ PKT_DROP_REASON_FLOW_PRE_HOOK
Definition: decode.h:401
Packet_::pool
struct PktPool_ * pool
Definition: decode.h:670
DecodeThreadVars_::counter_tcp_synack
uint16_t counter_tcp_synack
Definition: decode.h:983
PKT_DROP_REASON_MAX
@ PKT_DROP_REASON_MAX
Definition: decode.h:402
PKT_DROP_REASON_STREAM_REASSEMBLY
@ PKT_DROP_REASON_STREAM_REASSEMBLY
Definition: decode.h:394
DECODE_TUNNEL_ERSPANI
@ DECODE_TUNNEL_ERSPANI
Definition: decode.h:1102
DecodeThreadVars_::counter_teredo
uint16_t counter_teredo
Definition: decode.h:1008
DecodeThreadVars_::counter_erspan
uint16_t counter_erspan
Definition: decode.h:1012
PacketCopyDataOffset
int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
Copy data to Packet payload at given offset.
Definition: decode.c:335
DecodeThreadVars_::counter_raw
uint16_t counter_raw
Definition: decode.h:994
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
FLOW_PKT_TOSERVER
#define FLOW_PKT_TOSERVER
Definition: flow.h:233
HashTable_
Definition: util-hash.h:35
ACTION_REJECT_ANY
#define ACTION_REJECT_ANY
Definition: action-globals.h:38
Address_
Definition: decode.h:112
flow_memcap_eps_stats
ExceptionPolicyStatsSetts flow_memcap_eps_stats
Definition: decode.c:112
DecodeARP
int DecodeARP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-arp.c:29
DecodeThreadVars_::counter_arp
uint16_t counter_arp
Definition: decode.h:989
DecodeThreadVars_::counter_flow_tcp
uint16_t counter_flow_tcp
Definition: decode.h:1033
SCMUTEX_INITIALIZER
#define SCMUTEX_INITIALIZER
Definition: threads-debug.h:121
PacketDecodeFinalize
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:232
proto
uint8_t proto
Definition: decode-template.h:0
PacketAlertGetMaxConfig
void PacketAlertGetMaxConfig(void)
Definition: decode.c:1065
decoder_max_layers
uint8_t decoder_max_layers
Definition: decode.c:81
DecodeThreadVars_::counter_tcp_active_sessions
uint16_t counter_tcp_active_sessions
Definition: decode.h:1030
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:532
StringHashCompareFunc
char StringHashCompareFunc(void *data1, uint16_t datalen1, void *data2, uint16_t datalen2)
Definition: util-hash-string.c:38
Packet_::BypassPacketsFlow
int(* BypassPacketsFlow)(struct Packet_ *)
Definition: decode.h:594
TmqhOutputPacketpool
void TmqhOutputPacketpool(ThreadVars *t, Packet *p)
Definition: tmqh-packetpool.c:314
DecodeVXLANConfig
void DecodeVXLANConfig(void)
Definition: decode-vxlan.c:98
PacketDropReason
PacketDropReason
Definition: decode.h:380
DecodeThreadVars_::counter_max_mac_addrs_src
uint16_t counter_max_mac_addrs_src
Definition: decode.h:972
DecodeUnregisterCounters
void DecodeUnregisterCounters(void)
Definition: decode.c:602
GET_PKT_DIRECT_MAX_SIZE
#define GET_PKT_DIRECT_MAX_SIZE(p)
Definition: decode.h:211
DecodeThreadVars_::counter_flow_get_used
uint16_t counter_flow_get_used
Definition: decode.h:1039
PacketTunnelChild
@ PacketTunnelChild
Definition: decode.h:408
tmqh-packetpool.h
StringHashFunc
uint32_t StringHashFunc(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash-string.c:33
Packet_::events
PacketEngineEvents events
Definition: decode.h:630
PacketAlertFree
void PacketAlertFree(PacketAlert *pa_array)
Definition: decode.c:165
DecodeThreadVars_::counter_sll2
uint16_t counter_sll2
Definition: decode.h:993
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:81
HashTableFree
void HashTableFree(HashTable *ht)
Definition: util-hash.c:78
DecodeThreadVars_::counter_flow_spare_sync_empty
uint16_t counter_flow_spare_sync_empty
Definition: decode.h:1046
Flow_::flow_state
FlowStateType flow_state
Definition: flow.h:412
DecodeThreadVars_::counter_flow_tcp_reuse
uint16_t counter_flow_tcp_reuse
Definition: decode.h:1037
PKT_DROP_REASON_STREAM_URG
@ PKT_DROP_REASON_STREAM_URG
Definition: decode.h:395
DECODE_TUNNEL_NSH
@ DECODE_TUNNEL_NSH
Definition: decode.h:1108
DecodeThreadVars_::counter_flow_total
uint16_t counter_flow_total
Definition: decode.h:1031
Packet_::datalink
int datalink
Definition: decode.h:639
PKT_DEFAULT_MAX_DECODED_LAYERS
#define PKT_DEFAULT_MAX_DECODED_LAYERS
Definition: decode.h:1325
stats_decoder_events_prefix
const char * stats_decoder_events_prefix
Definition: counters.c:102
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
Definition: decode.c:628
DecodeThreadVars_::counter_flow_spare_sync
uint16_t counter_flow_spare_sync
Definition: decode.h:1045
DECODE_TUNNEL_ERSPANII
@ DECODE_TUNNEL_ERSPANII
Definition: decode.h:1101
DecodeThreadVars_::counter_defrag_tracker_timeout
uint16_t counter_defrag_tracker_timeout
Definition: decode.h:1024
SET_PKT_LEN
#define SET_PKT_LEN(p, len)
Definition: decode.h:213
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:1011
StatsRegisterMaxCounter
uint16_t StatsRegisterMaxCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the maximum of all the values assigned to it.
Definition: counters.c:992
FLOW_STATE_LOCAL_BYPASSED
@ FLOW_STATE_LOCAL_BYPASSED
Definition: flow.h:507
PacketAlert_::json_info
struct PacketContextData * json_info
Definition: decode.h:255
PKT_DROP_REASON_DEFAULT_APP_POLICY
@ PKT_DROP_REASON_DEFAULT_APP_POLICY
Definition: decode.h:399
decode.h
util-debug.h
DecodeThreadVars_::counter_flow_get_used_failed
uint16_t counter_flow_get_used_failed
Definition: decode.h:1043
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:52
CaptureStats_::counter_ips_rejected
uint16_t counter_ips_rejected
Definition: decode.c:1004
PKT_IS_TOSERVER
#define PKT_IS_TOSERVER(p)
Definition: decode.h:238
DecodeThreadVars_::counter_icmpv4
uint16_t counter_icmpv4
Definition: decode.h:987
DecodeThreadVars_::counter_ppp
uint16_t counter_ppp
Definition: decode.h:998
DecodeERSPANTypeI
int DecodeERSPANTypeI(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
ERSPAN Type I.
Definition: decode-erspan.c:65
DEvents
const struct DecodeEvents_ DEvents[]
Definition: decode-events.c:29
Packet_::ts
SCTime_t ts
Definition: decode.h:555
PKT_DROP_REASON_APPLAYER_ERROR
@ PKT_DROP_REASON_APPLAYER_ERROR
Definition: decode.h:387
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
PacketSwap
void PacketSwap(Packet *p)
switch direction of a packet
Definition: decode.c:577
util-exception-policy.h
DecodeThreadVars_::counter_tcp_rst
uint16_t counter_tcp_rst
Definition: decode.h:984
PktSrcEnum
PktSrcEnum
Definition: decode.h:51
PKT_DROP_REASON_NOT_SET
@ PKT_DROP_REASON_NOT_SET
Definition: decode.h:381
SCConfGetInt
int SCConfGetInt(const char *name, intmax_t *val)
Retrieve a configuration value as an integer.
Definition: conf.c:414
DecodeTunnelProto
DecodeTunnelProto
Definition: decode.h:1099
PacketDestructor
void PacketDestructor(Packet *p)
Cleanup a packet so that we can free it. No memset needed..
Definition: packet.c:159
CaptureStatsUpdate
void CaptureStatsUpdate(ThreadVars *tv, const Packet *p)
Definition: decode.c:1012
util-print.h
PKT_SRC_DECODER_TEREDO
@ PKT_SRC_DECODER_TEREDO
Definition: decode.h:56
SCEnter
#define SCEnter(...)
Definition: util-debug.h:277
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:209
ExceptionPolicySetStatsCounters
void ExceptionPolicySetStatsCounters(ThreadVars *tv, ExceptionPolicyCounters *counter, ExceptionPolicyStatsSetts *setting, enum ExceptionPolicy conf_policy, const char *default_str, bool(*isExceptionPolicyValid)(enum ExceptionPolicy))
Definition: util-exception-policy.c:366
HashTableLookup
void * HashTableLookup(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:183
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:231
DECODE_TUNNEL_PPP
@ DECODE_TUNNEL_PPP
Definition: decode.h:1107
PacketContextData
Definition: decode.h:241
FLOW_PKT_TOCLIENT_FIRST
#define FLOW_PKT_TOCLIENT_FIRST
Definition: flow.h:237
FlowSetStorageById
int FlowSetStorageById(Flow *f, FlowStorageId id, void *ptr)
Definition: flow-storage.c:45
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:219
PktSrcToString
const char * PktSrcToString(enum PktSrcEnum pkt_src)
Definition: decode.c:853
ExceptionPolicyStatsSetts_::valid_settings_ids
bool valid_settings_ids[EXCEPTION_POLICY_MAX]
Definition: util-exception-policy-types.h:58
DecodeThreadVars_::counter_vlan_qinq
uint16_t counter_vlan_qinq
Definition: decode.h:1002
DecodeThreadVars_::counter_defrag_tracker_hard_reuse
uint16_t counter_defrag_tracker_hard_reuse
Definition: decode.h:1023
SCLogWarning
#define SCLogWarning(...)
Macro used to log WARNING messages.
Definition: util-debug.h:255
HashTableAdd
int HashTableAdd(HashTable *ht, void *data, uint16_t datalen)
Definition: util-hash.c:104
SIZE_OF_PACKET
#define SIZE_OF_PACKET
Definition: decode.h:703
StringHashFreeFunc
void StringHashFreeFunc(void *data)
Definition: util-hash-string.c:51
BUG_ON
#define BUG_ON(x)
Definition: suricata-common.h:317
PKT_DROP_REASON_RULES
@ PKT_DROP_REASON_RULES
Definition: decode.h:389
util-profiling.h
PacketCallocExtPkt
int PacketCallocExtPkt(Packet *p, int datalen)
Definition: decode.c:309
PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
@ PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
Definition: decode.h:59
DECODE_TUNNEL_VLAN
@ DECODE_TUNNEL_VLAN
Definition: decode.h:1103
DecodeThreadVars_::counter_tcp_urg
uint16_t counter_tcp_urg
Definition: decode.h:985
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:55
CaptureStats_::counter_ips_accepted
uint16_t counter_ips_accepted
Definition: decode.c:1002
Packet_
Definition: decode.h:501
DecodeThreadVars_::counter_nsh
uint16_t counter_nsh
Definition: decode.h:1013
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:560
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:1104
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:208
DecodeThreadVars_::app_tctx
AppLayerThreadCtx * app_tctx
Definition: decode.h:965
decode-teredo.h
DecodeThreadVars_::counter_sll
uint16_t counter_sll
Definition: decode.h:992
PKT_DROP_REASON_STREAM_ERROR
@ PKT_DROP_REASON_STREAM_ERROR
Definition: decode.h:391
DecodeThreadVars_::counter_sctp
uint16_t counter_sctp
Definition: decode.h:996
Packet_::livedev
struct LiveDevice_ * livedev
Definition: decode.h:618
DecodeThreadVars_::counter_invalid
uint16_t counter_invalid
Definition: decode.h:975
name
const char * name
Definition: tm-threads.c:2163
DecodeThreadVars_::counter_ieee8021ah
uint16_t counter_ieee8021ah
Definition: decode.h:1006
SCReturnPtr
#define SCReturnPtr(x, type)
Definition: util-debug.h:293
AppLayerGetCtxThread
AppLayerThreadCtx * AppLayerGetCtxThread(void)
Creates a new app layer thread context.
Definition: app-layer.c:1108
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:1010
FLOW_PKT_TOCLIENT
#define FLOW_PKT_TOCLIENT
Definition: flow.h:234
DecodeThreadVars_::counter_vlan
uint16_t counter_vlan
Definition: decode.h:1001
DECODE_TUNNEL_ETHERNET
@ DECODE_TUNNEL_ETHERNET
Definition: decode.h:1100
DecodeThreadVars_::counter_tcp
uint16_t counter_tcp
Definition: decode.h:981
FlowGetStorageById
void * FlowGetStorageById(const Flow *f, FlowStorageId id)
Definition: flow-storage.c:40
DecodeThreadVars_::counter_pkts
uint16_t counter_pkts
Definition: decode.h:968
FlowUpdateState
void FlowUpdateState(Flow *f, const enum FlowState s)
Definition: flow.c:1162
PacketTunnelNone
@ PacketTunnelNone
Definition: decode.h:406
PKT_DROP_REASON_DEFAULT_PACKET_POLICY
@ PKT_DROP_REASON_DEFAULT_PACKET_POLICY
Definition: decode.h:398
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
DecodeThreadVars_::counter_defrag_memcap_eps
ExceptionPolicyCounters counter_defrag_memcap_eps
Definition: decode.h:1025
default_packet_size
uint32_t default_packet_size
Definition: decode.c:77
Packet_::nb_decoded_layers
uint8_t nb_decoded_layers
Definition: decode.h:644
PKT_SRC_DECODER_GENEVE
@ PKT_SRC_DECODER_GENEVE
Definition: decode.h:63
DecodeThreadVars_::counter_chdlc
uint16_t counter_chdlc
Definition: decode.h:978
Packet_::ReleasePacket
void(* ReleasePacket)(struct Packet_ *)
Definition: decode.h:591
flow-storage.h
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
Packet_::flow
struct Flow_ * flow
Definition: decode.h:546
Packet_::tenant_id
uint32_t tenant_id
Definition: decode.h:665
PKT_DROP_REASON_INNER_PACKET
@ PKT_DROP_REASON_INNER_PACKET
Definition: decode.h:397
FlowGetMemcapExceptionPolicy
enum ExceptionPolicy FlowGetMemcapExceptionPolicy(void)
Definition: flow.c:134
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *tv, DecodeThreadVars *dtv)
Definition: decode.c:820
DecodeThreadVars_::counter_flow_spare_sync_incomplete
uint16_t counter_flow_spare_sync_incomplete
Definition: decode.h:1047
PKT_DROP_REASON_APPLAYER_MEMCAP
@ PKT_DROP_REASON_APPLAYER_MEMCAP
Definition: decode.h:388
DecodeGlobalConfig
void DecodeGlobalConfig(void)
Definition: decode.c:1048
suricata-common.h
PKT_SRC_FFR
@ PKT_SRC_FFR
Definition: decode.h:58
decode-arp.h
DecodeThreadVars_::counter_flow_icmp6
uint16_t counter_flow_icmp6
Definition: decode.h:1036
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:980
packet.h
CaptureStats_::counter_ips_replaced
uint16_t counter_ips_replaced
Definition: decode.c:1005
DecodeThreadVars_::counter_gre
uint16_t counter_gre
Definition: decode.h:1000
ACTION_DROP
#define ACTION_DROP
Definition: action-globals.h:30
DecodeThreadVars_::counter_esp
uint16_t counter_esp
Definition: decode.h:997
Packet_::ext_pkt
uint8_t * ext_pkt
Definition: decode.h:615
PKT_DROP_REASON_NFQ_ERROR
@ PKT_DROP_REASON_NFQ_ERROR
Definition: decode.h:396
DecodeThreadVars_::counter_defrag_no_frags
uint16_t counter_defrag_no_frags
Definition: decode.h:1021
DecodeThreadVars_::counter_defrag_ipv6_reassembled
uint16_t counter_defrag_ipv6_reassembled
Definition: decode.h:1019
DecodeThreadVars_::counter_udp
uint16_t counter_udp
Definition: decode.h:986
GENERIC_TOO_MANY_LAYERS
@ GENERIC_TOO_MANY_LAYERS
Definition: decode-events.h:228
Packet_::ttype
enum PacketTunnelType ttype
Definition: decode.h:553
PacketUpdateEngineEventCounters
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Definition: decode.c:239
SCStrdup
#define SCStrdup(s)
Definition: util-mem.h:56
CaptureStats_::counter_drop_reason
uint16_t counter_drop_reason[PKT_DROP_REASON_MAX]
Definition: decode.c:1007
DecodeThreadVars_::counter_flow_memcap_eps
ExceptionPolicyCounters counter_flow_memcap_eps
Definition: decode.h:1028
FatalError
#define FatalError(...)
Definition: util-debug.h:510
decode-geneve.h
PacketContextData::next
struct PacketContextData * next
Definition: decode.h:243
PKT_SRC_DEFRAG
@ PKT_SRC_DEFRAG
Definition: decode.h:57
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
DecodeThreadVars_::counter_ipv4
uint16_t counter_ipv4
Definition: decode.h:979
PACKET_PROFILING_START
#define PACKET_PROFILING_START(p)
Definition: util-profiling.h:73
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:258
defrag_memcap_eps_stats
ExceptionPolicyStatsSetts defrag_memcap_eps_stats
Definition: decode.c:86
PKT_SRC_DECODER_VXLAN
@ PKT_SRC_DECODER_VXLAN
Definition: decode.h:60
StatsAddUI64
void StatsAddUI64(ThreadVars *tv, uint16_t id, uint64_t x)
Adds a value of type uint64_t to the local counter.
Definition: counters.c:146
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
PACKET_ALERT_MAX
#define PACKET_ALERT_MAX
Definition: decode.h:284
Packet_::root
struct Packet_ * root
Definition: decode.h:653
DecodeThreadVars_::counter_pppoe
uint16_t counter_pppoe
Definition: decode.h:1007
DecodeThreadVars_::counter_mpls
uint16_t counter_mpls
Definition: decode.h:1009
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:267
OutputFlowLogThreadDeinit
TmEcode OutputFlowLogThreadDeinit(ThreadVars *tv, void *thread_data)
Definition: output-flow.c:163
PKT_SRC_DETECT_RELOAD_FLUSH
@ PKT_SRC_DETECT_RELOAD_FLUSH
Definition: decode.h:61
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:963
MAX_PAYLOAD_SIZE
#define MAX_PAYLOAD_SIZE
Definition: decode.h:701
ExceptionPolicyStatsSetts_::valid_settings_ips
bool valid_settings_ips[EXCEPTION_POLICY_MAX]
Definition: util-exception-policy-types.h:59
AppLayerDestroyCtxThread
void AppLayerDestroyCtxThread(AppLayerThreadCtx *app_tctx)
Destroys the context created by AppLayerGetCtxThread().
Definition: app-layer.c:1129
DecodeThreadVars_::counter_flow_elephant
uint16_t counter_flow_elephant
Definition: decode.h:1038
Packet_::recursion_level
uint8_t recursion_level
Definition: decode.h:526
DecodeThreadVars_::output_flow_thread_data
void * output_flow_thread_data
Definition: decode.h:1054
DecodeThreadVars_::counter_geneve
uint16_t counter_geneve
Definition: decode.h:999
DecodeThreadVars_::counter_max_mac_addrs_dst
uint16_t counter_max_mac_addrs_dst
Definition: decode.h:973
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *tv)
Alloc and setup DecodeThreadVars.
Definition: decode.c:802
DecodeThreadVars_::counter_defrag_max_hit
uint16_t counter_defrag_max_hit
Definition: decode.h:1020
WARN_UNUSED
#define WARN_UNUSED
Definition: bindgen.h:32
HashTableInit
HashTable * HashTableInit(uint32_t size, uint32_t(*Hash)(struct HashTable_ *, void *, uint16_t), char(*Compare)(void *, uint16_t, void *, uint16_t), void(*Free)(void *))
Definition: util-hash.c:35
PacketSetData
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
Definition: decode.c:840
PacketPoolGetPacket
Packet * PacketPoolGetPacket(void)
Get a new packet from the packet pool.
Definition: tmqh-packetpool.c:127
DecodeThreadVars_::counter_vlan_qinqinq
uint16_t counter_vlan_qinqinq
Definition: decode.h:1003
GET_PKT_DIRECT_DATA
#define GET_PKT_DIRECT_DATA(p)
Definition: decode.h:210
DecodeThreadVars_::counter_null
uint16_t counter_null
Definition: decode.h:995
t_capture_stats
thread_local CaptureStats t_capture_stats
Definition: decode.c:1010
DecodeThreadVars_::counter_icmpv6
uint16_t counter_icmpv6
Definition: decode.h:988
EngineModeIsIPS
int EngineModeIsIPS(void)
Definition: suricata.c:242
defrag-hash.h
Packet_::drop_reason
uint8_t drop_reason
Definition: decode.h:647
Address_::family
char family
Definition: decode.h:113
PKT_SRC_DECODER_GRE
@ PKT_SRC_DECODER_GRE
Definition: decode.h:53
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1192
PacketAlert_
Definition: decode.h:248
DecodeGeneveConfig
void DecodeGeneveConfig(void)
Definition: decode-geneve.c:128
DecodeThreadVars_::counter_flow_memcap
uint16_t counter_flow_memcap
Definition: decode.h:1027
DecodeThreadVars_::counter_defrag_ipv6_fragments
uint16_t counter_defrag_ipv6_fragments
Definition: decode.h:1018
PacketTunnelRoot
@ PacketTunnelRoot
Definition: decode.h:407
PacketAlertRecycle
void PacketAlertRecycle(PacketAlert *pa_array, uint16_t cnt)
Definition: decode.c:148
packet_alert_max
uint16_t packet_alert_max
Definition: decode.c:82
Packet_::vlan_id
uint16_t vlan_id[VLAN_MAX_LAYERS]
Definition: decode.h:528
DECODE_TUNNEL_ARP
@ DECODE_TUNNEL_ARP
Definition: decode.h:1109
likely
#define likely(expr)
Definition: util-optimize.h:32
PacketContextData::json_string
char * json_string
Definition: decode.h:242
StatsRegisterAvgCounter
uint16_t StatsRegisterAvgCounter(const char *name, struct ThreadVars_ *tv)
Registers a counter, whose value holds the average of all the values assigned to it.
Definition: counters.c:972
PacketDefragPktSetupParent
void PacketDefragPktSetupParent(Packet *parent)
inform defrag "parent" that a pseudo packet is now associated to it.
Definition: decode.c:512
DecodeThreadVars_::counter_tcp_syn
uint16_t counter_tcp_syn
Definition: decode.h:982
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:393
stats_decoder_events
bool stats_decoder_events
Definition: counters.c:101
flow.h
PKT_DROP_REASON_STREAM_MIDSTREAM
@ PKT_DROP_REASON_STREAM_MIDSTREAM
Definition: decode.h:393
DecodeIPV4
int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv4.c:520
PacketInit
void PacketInit(Packet *p)
Initialize a packet structure for use.
Definition: packet.c:63
ExceptionPolicy
ExceptionPolicy
Definition: util-exception-policy-types.h:25
StatsRegisterCounter
uint16_t StatsRegisterCounter(const char *name, struct ThreadVars_ *tv)
Registers a normal, unqualified counter.
Definition: counters.c:952
SCCalloc
#define SCCalloc(nm, sz)
Definition: util-mem.h:53
DecodeThreadVars_::counter_flow_get_used_eval_reject
uint16_t counter_flow_get_used_eval_reject
Definition: decode.h:1041
DecodeVLAN
int DecodeVLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-vlan.c:54
FLOW_PKT_TOSERVER_FIRST
#define FLOW_PKT_TOSERVER_FIRST
Definition: flow.h:236
DefragGetMemcapExceptionPolicy
enum ExceptionPolicy DefragGetMemcapExceptionPolicy(void)
Definition: defrag-hash.c:80
SCMutex
#define SCMutex
Definition: threads-debug.h:114
PacketGetFromQueueOrAlloc
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:293
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
DecodeEthernet
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-ethernet.c:42
PKT_DROP_REASON_FLOW_DROP
@ PKT_DROP_REASON_FLOW_DROP
Definition: decode.h:386
PKT_IS_INVALID
#define PKT_IS_INVALID
Definition: decode.h:1289
DecodeUpdatePacketCounters
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:768
DecodeThreadVars_::counter_engine_events
uint16_t counter_engine_events[DECODE_EVENT_MAX]
Definition: decode.h:1050
output.h
DecodeThreadVars_::counter_defrag_tracker_soft_reuse
uint16_t counter_defrag_tracker_soft_reuse
Definition: decode.h:1022
DECODE_EVENT_MAX
@ DECODE_EVENT_MAX
Definition: decode-events.h:318
app-layer.h
PKT_DROP_REASON_DECODE_ERROR
@ PKT_DROP_REASON_DECODE_ERROR
Definition: decode.h:382
DecodeThreadVars_::counter_defrag_ipv4_fragments
uint16_t counter_defrag_ipv4_fragments
Definition: decode.h:1016
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:307