suricata
|
#include "suricata-common.h"
#include "suricata-plugin.h"
#include "threadvars.h"
#include "util-debug.h"
#include "decode-events.h"
#include "util-exception-policy-types.h"
#include "flow-worker.h"
#include "app-layer-protos.h"
#include "source-nflog.h"
#include "source-nfq.h"
#include "source-ipfw.h"
#include "source-pcap.h"
#include "source-af-packet.h"
#include "source-netmap.h"
#include "source-windivert.h"
#include "decode-ethernet.h"
#include "decode-gre.h"
#include "decode-ppp.h"
#include "decode-ipv4.h"
#include "decode-ipv6.h"
#include "decode-icmpv4.h"
#include "decode-icmpv6.h"
#include "decode-tcp.h"
#include "decode-udp.h"
#include "decode-sctp.h"
#include "decode-esp.h"
#include "decode-vlan.h"
#include "decode-mpls.h"
#include "decode-arp.h"
#include "util-validate.h"
Go to the source code of this file.
Data Structures | |
struct | Address_ |
struct | PacketAlert_ |
struct | PacketAlerts_ |
struct | PacketEngineEvents_ |
struct | PktVar_ |
struct | PktProfilingTmmData_ |
Per TMM stats storage. More... | |
struct | PktProfilingData_ |
struct | PktProfilingDetectData_ |
struct | PktProfilingAppData_ |
struct | PktProfilingLoggerData_ |
struct | PktProfiling_ |
Per pkt stats storage. More... | |
struct | PacketL2 |
union | PacketL2::L2Hdrs |
struct | PacketL3 |
union | PacketL3::Hdrs |
struct | PacketL4 |
union | PacketL4::L4Hdrs |
union | PacketL4::L4Vars |
struct | Packet_ |
struct | DecodeThreadVars_ |
Structure to hold thread specific data for all decode modules. More... | |
Typedefs | |
typedef struct AppLayerThreadCtx_ | AppLayerThreadCtx |
typedef struct AppLayerDecoderEvents_ | AppLayerDecoderEvents |
typedef struct Address_ | Address |
typedef uint16_t | Port |
typedef struct PacketAlert_ | PacketAlert |
typedef struct PacketAlerts_ | PacketAlerts |
typedef struct PacketEngineEvents_ | PacketEngineEvents |
typedef struct PktVar_ | PktVar |
typedef struct PktProfilingTmmData_ | PktProfilingTmmData |
Per TMM stats storage. More... | |
typedef struct PktProfilingData_ | PktProfilingData |
typedef struct PktProfilingDetectData_ | PktProfilingDetectData |
typedef struct PktProfilingAppData_ | PktProfilingAppData |
typedef struct PktProfilingLoggerData_ | PktProfilingLoggerData |
typedef struct PktProfiling_ | PktProfiling |
Per pkt stats storage. More... | |
typedef struct Packet_ | Packet |
typedef struct DecodeThreadVars_ | DecodeThreadVars |
Structure to hold thread specific data for all decode modules. More... | |
typedef int(* | DecoderFunc) (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len) |
Functions | |
PacketAlert * | PacketAlertCreate (void) |
Initialize PacketAlerts with dynamic alerts array size. More... | |
void | PacketAlertFree (PacketAlert *pa) |
void | CaptureStatsUpdate (ThreadVars *tv, const Packet *p) |
void | CaptureStatsSetup (ThreadVars *tv) |
Packet * | PacketTunnelPktSetup (ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto) |
Setup a pseudo packet (tunnel) More... | |
Packet * | PacketDefragPktSetup (Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto) |
Setup a pseudo packet (reassembled frags) More... | |
void | PacketDefragPktSetupParent (Packet *parent) |
inform defrag "parent" that a pseudo packet is now associated to it. More... | |
void | DecodeRegisterPerfCounters (DecodeThreadVars *, ThreadVars *) |
Packet * | PacketGetFromQueueOrAlloc (void) |
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packet that is free'd again after processing. More... | |
Packet * | PacketGetFromAlloc (void) |
Get a malloced packet. More... | |
void | PacketDecodeFinalize (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p) |
Finalize decoding of a packet. More... | |
void | PacketUpdateEngineEventCounters (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p) |
void | PacketFree (Packet *p) |
Return a malloced packet. More... | |
void | PacketFreeOrRelease (Packet *p) |
Return a packet to where it was allocated. More... | |
int | PacketCallocExtPkt (Packet *p, int datalen) |
int | PacketCopyData (Packet *p, const uint8_t *pktdata, uint32_t pktlen) |
Copy data to Packet payload and set packet length. More... | |
int | PacketSetData (Packet *p, const uint8_t *pktdata, uint32_t pktlen) |
Set data for Packet and set length when zero copy is used. More... | |
int | PacketCopyDataOffset (Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen) |
Copy data to Packet payload at given offset. More... | |
const char * | PktSrcToString (enum PktSrcEnum pkt_src) |
void | PacketBypassCallback (Packet *p) |
void | PacketSwap (Packet *p) |
switch direction of a packet More... | |
DecodeThreadVars * | DecodeThreadVarsAlloc (ThreadVars *) |
Alloc and setup DecodeThreadVars. More... | |
void | DecodeThreadVarsFree (ThreadVars *, DecodeThreadVars *) |
void | DecodeUpdatePacketCounters (ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p) |
const char * | PacketDropReasonToString (enum PacketDropReason r) |
int | DecodeEthernet (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
int | DecodeSll (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
int | DecodePPP (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
int | DecodePPPOESession (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
Main decoding function for PPPOE Session packets. More... | |
int | DecodePPPOEDiscovery (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
Main decoding function for PPPOE Discovery packets. More... | |
int | DecodeNull (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
int | DecodeRaw (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
int | DecodeIPV4 (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t) |
int | DecodeIPV6 (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t) |
int | DecodeICMPV4 (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
Main ICMPv4 decoding function. More... | |
int | DecodeICMPV6 (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
Decode ICMPV6 packets and fill the Packet with the decoded info. More... | |
int | DecodeTCP (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t) |
int | DecodeUDP (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t) |
int | DecodeSCTP (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t) |
int | DecodeESP (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t) |
Function to decode IPSEC-ESP packets. More... | |
int | DecodeGRE (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
Function to decode GRE packets. More... | |
int | DecodeVLAN (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
int | DecodeVNTag (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
int | DecodeIEEE8021ah (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
int | DecodeGeneve (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
int | DecodeVXLAN (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
int | DecodeMPLS (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
int | DecodeERSPAN (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
ERSPAN Type II. More... | |
int | DecodeERSPANTypeI (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
ERSPAN Type I. More... | |
int | DecodeCHDLC (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
int | DecodeTEMPLATE (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
Function to decode TEMPLATE packets. More... | |
int | DecodeNSH (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
Function to decode NSH packets. More... | |
int | DecodeARP (ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t) |
void | DecodeIPV6FragHeader (Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen) |
void | AddressDebugPrint (Address *) |
Debug print function for printing addresses. More... | |
void | DecodeGlobalConfig (void) |
void | PacketAlertGetMaxConfig (void) |
void | DecodeUnregisterCounters (void) |
Variables | |
uint16_t | packet_alert_max |
uint32_t | default_packet_size |
uint8_t | decoder_max_layers |
Definition in file decode.h.
#define CMP_ADDR | ( | a1, | |
a2 | |||
) |
#define COPY_ADDRESS | ( | a, | |
b | |||
) |
#define DEFAULT_MTU 1500 |
#define DEFAULT_PACKET_SIZE (DEFAULT_MTU + ETHERNET_HEADER_LEN) |
#define ENGINE_ISSET_EVENT | ( | p, | |
e | |||
) |
#define ENGINE_SET_EVENT | ( | p, | |
e | |||
) |
#define ENGINE_SET_INVALID_EVENT | ( | p, | |
e | |||
) |
#define GET_IPV4_DST_ADDR_PTR | ( | p | ) | ((p)->dst.addr_data32) |
#define GET_IPV4_DST_ADDR_U32 | ( | p | ) | ((p)->dst.addr_data32[0]) |
#define GET_IPV4_SRC_ADDR_PTR | ( | p | ) | ((p)->src.addr_data32) |
#define GET_IPV4_SRC_ADDR_U32 | ( | p | ) | ((p)->src.addr_data32[0]) |
#define GET_IPV6_DST_ADDR | ( | p | ) | ((p)->dst.addr_data32) |
#define GET_IPV6_DST_IN6ADDR | ( | p | ) | ((p)->dst.addr_in6addr) |
#define GET_IPV6_SRC_ADDR | ( | p | ) | ((p)->src.addr_data32) |
#define GET_IPV6_SRC_IN6ADDR | ( | p | ) | ((p)->src.addr_in6addr) |
#define GET_PKT_DATA | ( | p | ) | (((p)->ext_pkt == NULL) ? GET_PKT_DIRECT_DATA(p) : (p)->ext_pkt) |
#define GET_PKT_DIRECT_MAX_SIZE | ( | p | ) | (default_packet_size) |
#define LINKTYPE_CISCO_HDLC DLT_C_HDLC |
#define LINKTYPE_ETHERNET DLT_EN10MB |
#define LINKTYPE_NULL DLT_NULL |
#define MAX_PAYLOAD_SIZE (IPV6_HEADER_LEN + 65536 + 28) |
#define PACKET_ALERT_FLAG_FRAME 0x20 |
#define PACKET_ALERT_FLAG_STATE_MATCH 0x02 |
#define PACKET_ALERT_FLAG_STREAM_MATCH 0x04 |
#define PACKET_ALERT_FLAG_TX 0x08 |
#define PACKET_ALERT_FLAG_TX_GUESSED 0x040 |
#define PACKET_ALERT_RATE_FILTER_MODIFIED 0x10 |
#define PACKET_CLEAR_L4VARS | ( | p | ) |
#define PACKET_ENGINE_EVENT_MAX 15 |
#define PACKET_FREE_EXTDATA | ( | p | ) |
#define PKT_DETECT_HAS_STREAMDATA BIT_U32(26) |
#define PKT_FIRST_ALERTS BIT_U32(29) |
#define PKT_IGNORE_CHECKSUM BIT_U32(15) |
#define PKT_IS_PSEUDOPKT | ( | p | ) | ((p)->flags & (PKT_PSEUDO_STREAM_END|PKT_PSEUDO_DETECTLOG_FLUSH)) |
#define PKT_IS_TOCLIENT | ( | p | ) | (((p)->flowflags & FLOW_PKT_TOCLIENT)) |
#define PKT_IS_TOSERVER | ( | p | ) | (((p)->flowflags & FLOW_PKT_TOSERVER)) |
#define PKT_NOPACKET_INSPECTION BIT_U32(0) |
#define PKT_NOPAYLOAD_INSPECTION BIT_U32(2) |
#define PKT_PPP_VJ_UCOMP BIT_U32(1) |
#define PKT_PROTO_DETECT_TS_DONE BIT_U32(23) |
#define PKT_PSEUDO_DETECTLOG_FLUSH BIT_U32(27) |
#define PKT_PSEUDO_STREAM_END BIT_U32(9) |
#define PKT_REBUILT_FRAGMENT BIT_U32(25) |
#define PKT_SET_SRC | ( | p, | |
src_val | |||
) | ((p)->pkt_src = src_val) |
#define PKT_STREAM_ADD BIT_U32(5) |
#define PKT_STREAM_EST BIT_U32(6) |
#define PKT_STREAM_MODIFIED BIT_U32(10) |
#define PKT_STREAM_NO_EVENTS BIT_U32(28) |
#define PKT_STREAM_NOPCAPLOG BIT_U32(12) |
#define PKT_WANTS_FLOW BIT_U32(22) |
indication by decoder that it feels the packet should be handled by flow engine: Packet::flow_hash will be set
#define PKT_ZERO_COPY BIT_U32(16) |
#define SET_IPV4_DST_ADDR | ( | ip4h, | |
a | |||
) |
#define SET_IPV4_SRC_ADDR | ( | ip4h, | |
a | |||
) |
#define SET_IPV6_DST_ADDR | ( | ip6h, | |
a | |||
) |
#define SET_IPV6_SRC_ADDR | ( | ip6h, | |
a | |||
) |
#define SET_PKT_LEN | ( | p, | |
len | |||
) |
#define SET_TCP_DST_PORT | ( | pkt, | |
prt | |||
) |
#define SET_TCP_SRC_PORT | ( | pkt, | |
prt | |||
) |
#define SET_UDP_DST_PORT | ( | pkt, | |
prt | |||
) |
#define SET_UDP_SRC_PORT | ( | pkt, | |
prt | |||
) |
#define SIZE_OF_PACKET (default_packet_size + sizeof(Packet)) |
#define TUNNEL_INCR_PKT_RTV_NOLOCK | ( | p | ) |
#define TUNNEL_PKT_RTV | ( | p | ) | ((p)->root ? (p)->root->tunnel_rtv_cnt : (p)->tunnel_rtv_cnt) |
#define TUNNEL_PKT_TPR | ( | p | ) | ((p)->root ? (p)->root->tunnel_tpr_cnt : (p)->tunnel_tpr_cnt) |
typedef struct AppLayerDecoderEvents_ AppLayerDecoderEvents |
typedef struct AppLayerThreadCtx_ AppLayerThreadCtx |
typedef int(* DecoderFunc) (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len) |
typedef struct DecodeThreadVars_ DecodeThreadVars |
Structure to hold thread specific data for all decode modules.
typedef struct PacketAlert_ PacketAlert |
typedef struct PacketAlerts_ PacketAlerts |
typedef struct PacketEngineEvents_ PacketEngineEvents |
data structure to store decoder, defrag and stream events
typedef struct PktProfiling_ PktProfiling |
Per pkt stats storage.
typedef struct PktProfilingAppData_ PktProfilingAppData |
typedef struct PktProfilingData_ PktProfilingData |
typedef struct PktProfilingDetectData_ PktProfilingDetectData |
typedef struct PktProfilingLoggerData_ PktProfilingLoggerData |
typedef struct PktProfilingTmmData_ PktProfilingTmmData |
Per TMM stats storage.
enum DecodeTunnelProto |
enum PacketDropReason |
enum PacketL2Types |
enum PacketL3Types |
enum PacketL4Types |
enum PacketTunnelType |
enum PktSrcEnum |
int DecodeARP | ( | ThreadVars * | tv, |
DecodeThreadVars * | dtv, | ||
Packet * | p, | ||
const uint8_t * | pkt, | ||
uint32_t | len | ||
) |
Definition at line 29 of file decode-arp.c.
References ARP_HEADER_MIN_LEN, ARP_PKT_TOO_SMALL, DecodeThreadVars_::counter_arp, dtv, ENGINE_SET_INVALID_EVENT, len, StatsIncr(), TM_ECODE_FAILED, tv, and unlikely.
int DecodeCHDLC | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
Definition at line 42 of file decode-chdlc.c.
References CHDLC_HEADER_LEN, CHDLC_PKT_TOO_SMALL, DecodeThreadVars_::counter_chdlc, DEBUG_VALIDATE_BUG_ON, dtv, ENGINE_SET_INVALID_EVENT, len, StatsIncr(), TM_ECODE_FAILED, tv, and unlikely.
Referenced by ValidateLinkType().
int DecodeERSPAN | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
ERSPAN Type II.
Definition at line 76 of file decode-erspan.c.
References DecodeThreadVars_::counter_erspan, DEBUG_VALIDATE_BUG_ON, dtv, ENGINE_SET_EVENT, ERSPAN_HEADER_TOO_SMALL, len, StatsIncr(), TM_ECODE_FAILED, and tv.
int DecodeERSPANTypeI | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
ERSPAN Type I.
Definition at line 65 of file decode-erspan.c.
References DecodeThreadVars_::counter_erspan, DecodeEthernet(), dtv, len, StatsIncr(), and tv.
int DecodeESP | ( | ThreadVars * | tv, |
DecodeThreadVars * | dtv, | ||
Packet * | p, | ||
const uint8_t * | pkt, | ||
uint16_t | len | ||
) |
Function to decode IPSEC-ESP packets.
tv | thread vars |
dtv | decoder thread vars |
p | packet |
pkt | raw packet data |
len | length in bytes of pkt array |
TM_ECODE_OK | or TM_ECODE_FAILED on serious error |
Definition at line 64 of file decode-esp.c.
References DecodeThreadVars_::counter_esp, DEBUG_VALIDATE_BUG_ON, dtv, StatsIncr(), and tv.
int DecodeEthernet | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
Definition at line 42 of file decode-ethernet.c.
References DecodeThreadVars_::counter_eth, DEBUG_VALIDATE_BUG_ON, dtv, ENGINE_SET_INVALID_EVENT, ETHERNET_HEADER_LEN, ETHERNET_PKT_TOO_SMALL, len, StatsIncr(), TM_ECODE_FAILED, tv, and unlikely.
Referenced by DecodeErfDag(), DecodeERSPANTypeI(), UTHBuildPacketFromEth(), and ValidateLinkType().
int DecodeGeneve | ( | ThreadVars * | tv, |
DecodeThreadVars * | dtv, | ||
Packet * | p, | ||
const uint8_t * | pkt, | ||
uint32_t | len | ||
) |
pkt | payload data directly above UDP header |
len | length in bytes of pkt |
Definition at line 185 of file decode-geneve.c.
References DEBUG_VALIDATE_BUG_ON, DECODE_TUNNEL_UNSET, eth_type, and unlikely.
int DecodeGRE | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
Function to decode GRE packets.
Definition at line 47 of file decode-gre.c.
References DecodeThreadVars_::counter_gre, DEBUG_VALIDATE_BUG_ON, dtv, ENGINE_SET_INVALID_EVENT, GRE_HDR_LEN, GRE_PKT_TOO_SMALL, len, StatsIncr(), TM_ECODE_FAILED, and tv.
int DecodeICMPV4 | ( | ThreadVars * | tv, |
DecodeThreadVars * | dtv, | ||
Packet * | p, | ||
const uint8_t * | pkt, | ||
uint32_t | len | ||
) |
Main ICMPv4 decoding function.
DecodeICMPV4
Definition at line 143 of file decode-icmpv4.c.
References DecodeThreadVars_::counter_icmpv4, dtv, ENGINE_SET_INVALID_EVENT, ICMPV4_HEADER_LEN, ICMPV4_PKT_TOO_SMALL, len, StatsIncr(), TM_ECODE_FAILED, and tv.
int DecodeICMPV6 | ( | ThreadVars * | tv, |
DecodeThreadVars * | dtv, | ||
Packet * | p, | ||
const uint8_t * | pkt, | ||
uint32_t | len | ||
) |
Decode ICMPV6 packets and fill the Packet with the decoded info.
tv | Pointer to the thread variables |
dtv | Pointer to the decode thread variables |
p | Pointer to the packet we are filling |
pkt | Pointer to the raw packet buffer |
len | the len of the rest of the packet not processed yet |
void | No return value |
Definition at line 177 of file decode-icmpv6.c.
int DecodeIEEE8021ah | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
int DecodeIPV4 | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint16_t | |||
) |
Definition at line 520 of file decode-ipv4.c.
References DecodeThreadVars_::counter_ipv4, dtv, len, SCLogDebug, StatsIncr(), and tv.
Referenced by DecodeNull(), DecodePPPOESession(), and DecodeRaw().
int DecodeIPV6 | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint16_t | |||
) |
Definition at line 560 of file decode-ipv6.c.
References DecodeThreadVars_::counter_ipv6, dtv, StatsIncr(), and tv.
Referenced by DecodeNull(), DecodePPPOESession(), and DecodeRaw().
void DecodeIPV6FragHeader | ( | Packet * | p, |
const uint8_t * | pkt, | ||
uint16_t | hdrextlen, | ||
uint16_t | plen, | ||
uint16_t | prev_hdrextlen | ||
) |
Definition at line 92 of file decode-ipv6.c.
References GET_PKT_DATA, PacketL3::ip6, Packet_::l3, SCLogDebug, SCNtohl, and PacketL3::vars.
int DecodeMPLS | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
Definition at line 49 of file decode-mpls.c.
References DecodeThreadVars_::counter_mpls, DEBUG_VALIDATE_BUG_ON, dtv, StatsIncr(), and tv.
int DecodeNSH | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
Function to decode NSH packets.
Definition at line 46 of file decode-nsh.c.
References DecodeThreadVars_::counter_nsh, DEBUG_VALIDATE_BUG_ON, dtv, ENGINE_SET_INVALID_EVENT, len, NSH_HEADER_TOO_SMALL, StatsIncr(), TM_ECODE_FAILED, and tv.
int DecodeNull | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
Definition at line 51 of file decode-null.c.
References AF_INET6_BSD, AF_INET6_DARWIN, AF_INET6_FREEBSD, AF_INET6_LINUX, AF_INET6_SOLARIS, AF_INET6_WINSOCK, DecodeThreadVars_::counter_null, DEBUG_VALIDATE_BUG_ON, DecodeIPV4(), DecodeIPV6(), dtv, ENGINE_SET_EVENT, ENGINE_SET_INVALID_EVENT, GET_PKT_DATA, GET_PKT_LEN, HDR_SIZE, len, LTNULL_PKT_TOO_SMALL, LTNULL_UNSUPPORTED_TYPE, SCLogDebug, StatsIncr(), TM_ECODE_FAILED, TM_ECODE_OK, tv, type, and unlikely.
Referenced by ValidateLinkType().
int DecodePPP | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
Definition at line 174 of file decode-ppp.c.
References DecodeThreadVars_::counter_ppp, DEBUG_VALIDATE_BUG_ON, dtv, ENGINE_SET_INVALID_EVENT, len, PPP_PKT_TOO_SMALL, proto_size, StatsIncr(), TM_ECODE_FAILED, tv, and unlikely.
Referenced by ValidateLinkType().
int DecodePPPOEDiscovery | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
Main decoding function for PPPOE Discovery packets.
Definition at line 50 of file decode-pppoe.c.
References DecodeThreadVars_::counter_pppoe, DEBUG_VALIDATE_BUG_ON, dtv, ENGINE_SET_INVALID_EVENT, len, PPPOE_CODE_PADI, PPPOE_CODE_PADO, PPPOE_CODE_PADR, PPPOE_CODE_PADS, PPPOE_CODE_PADT, PPPOE_DISCOVERY_HEADER_MIN_LEN, pppoe_length, PPPOE_MALFORMED_TAGS, PPPOE_PKT_TOO_SMALL, PPPOE_WRONG_CODE, SCLogDebug, SCNtohs, StatsIncr(), TM_ECODE_FAILED, TM_ECODE_OK, and tv.
int DecodePPPOESession | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
Main decoding function for PPPOE Session packets.
Definition at line 124 of file decode-pppoe.c.
References DecodeThreadVars_::counter_pppoe, DEBUG_VALIDATE_BUG_ON, DecodeIPV4(), DecodeIPV6(), dtv, ENGINE_SET_EVENT, ENGINE_SET_INVALID_EVENT, IPV4_GET_RAW_VER, IPV4_HEADER_LEN, IPV6_HEADER_LEN, len, PPP_APPLE, PPP_APPLECP, PPP_BRPDU, PPP_CHAP, PPP_DECNET, PPP_DECNETCP, PPP_HELLO, PPP_IP, PPP_IPCP, PPP_IPV6, PPP_IPV6CP, PPP_IPX, PPP_IPXCP, PPP_LCP, PPP_LQM, PPP_LUXCOM, PPP_MPLS_MCAST, PPP_MPLS_UCAST, PPP_MPLSCP, PPP_NS, PPP_NSCP, PPP_OSI, PPP_OSICP, PPP_PAP, PPP_SNS, PPP_STII, PPP_STIICP, PPP_UNSUP_PROTO, PPP_VINES, PPP_VINESCP, PPP_VJ_COMP, PPP_VJ_UCOMP, PPP_WRONG_TYPE, PPPIPV4_PKT_TOO_SMALL, PPPIPV6_PKT_TOO_SMALL, PPPOESessionHdr_::pppoe_code, PPPOESessionHdr_::pppoe_length, PPPOE_PKT_TOO_SMALL, PPPOE_SESSION_GET_TYPE, PPPOE_SESSION_GET_VERSION, PPPOE_SESSION_HEADER_MIN_LEN, PPPVJU_PKT_TOO_SMALL, PPPOESessionHdr_::protocol, SCLogDebug, SCNtohs, PPPOESessionHdr_::session_id, StatsIncr(), TM_ECODE_FAILED, TM_ECODE_OK, tv, and unlikely.
int DecodeRaw | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
Definition at line 42 of file decode-raw.c.
References DecodeThreadVars_::counter_raw, DEBUG_VALIDATE_BUG_ON, DecodeIPV4(), DecodeIPV6(), dtv, ENGINE_SET_EVENT, ENGINE_SET_INVALID_EVENT, GET_PKT_DATA, GET_PKT_LEN, IP_GET_RAW_VER, IPRAW_INVALID_IPV, IPV4_HEADER_LEN, IPV4_PKT_TOO_SMALL, len, SCLogDebug, StatsIncr(), TM_ECODE_FAILED, TM_ECODE_OK, tv, and unlikely.
Referenced by ValidateLinkType().
int DecodeSCTP | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint16_t | |||
) |
Definition at line 62 of file decode-sctp.c.
References DecodeThreadVars_::counter_sctp, dtv, StatsIncr(), tv, and unlikely.
int DecodeSll | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
Definition at line 41 of file decode-sll.c.
References DecodeThreadVars_::counter_sll, DEBUG_VALIDATE_BUG_ON, dtv, ENGINE_SET_INVALID_EVENT, len, SLL_HEADER_LEN, SLL_PKT_TOO_SMALL, StatsIncr(), TM_ECODE_FAILED, tv, and unlikely.
Referenced by ValidateLinkType().
int DecodeTCP | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint16_t | |||
) |
Definition at line 270 of file decode-tcp.c.
References DecodeThreadVars_::counter_tcp, dtv, StatsIncr(), tv, and unlikely.
int DecodeTEMPLATE | ( | ThreadVars * | tv, |
DecodeThreadVars * | dtv, | ||
Packet * | p, | ||
const uint8_t * | pkt, | ||
uint32_t | len | ||
) |
Function to decode TEMPLATE packets.
tv | thread vars |
dtv | decoder thread vars |
p | packet |
pkt | raw packet data |
len | length in bytes of pkt array |
TM_ECODE_OK | or TM_ECODE_FAILED on serious error |
Definition at line 51 of file decode-template.c.
References DEBUG_VALIDATE_BUG_ON, len, and TM_ECODE_FAILED.
int DecodeUDP | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint16_t | |||
) |
Definition at line 75 of file decode-udp.c.
References DecodeThreadVars_::counter_udp, dtv, StatsIncr(), tv, and unlikely.
int DecodeVLAN | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
Definition at line 54 of file decode-vlan.c.
References DecodeThreadVars_::counter_vlan, DecodeThreadVars_::counter_vlan_qinq, DecodeThreadVars_::counter_vlan_qinqinq, DEBUG_VALIDATE_BUG_ON, dtv, ENGINE_SET_INVALID_EVENT, len, proto, StatsIncr(), TM_ECODE_FAILED, tv, VLAN_HEADER_LEN, VLAN_HEADER_TOO_SMALL, and Packet_::vlan_idx.
int DecodeVNTag | ( | ThreadVars * | , |
DecodeThreadVars * | , | ||
Packet * | , | ||
const uint8_t * | , | ||
uint32_t | |||
) |
Definition at line 52 of file decode-vntag.c.
References DecodeThreadVars_::counter_vntag, DEBUG_VALIDATE_BUG_ON, dtv, ENGINE_SET_INVALID_EVENT, len, StatsIncr(), TM_ECODE_FAILED, tv, VNTAG_HEADER_LEN, and VNTAG_HEADER_TOO_SMALL.
int DecodeVXLAN | ( | ThreadVars * | tv, |
DecodeThreadVars * | dtv, | ||
Packet * | p, | ||
const uint8_t * | pkt, | ||
uint32_t | len | ||
) |
pkt | payload data directly above UDP header |
len | length in bytes of pkt |
Definition at line 122 of file decode-vxlan.c.
References DEBUG_VALIDATE_BUG_ON, and unlikely.