suricata
decode.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __DECODE_H__
25 #define __DECODE_H__
26 
27 //#define DBG_THREADS
28 #define COUNTERS
29 
30 #include "suricata-common.h"
31 #include "threadvars.h"
32 #include "decode-events.h"
33 #include "flow-worker.h"
34 
35 #ifdef HAVE_NAPATECH
36 #include "util-napatech.h"
37 #endif /* HAVE_NAPATECH */
38 
39 
40 typedef enum {
47 
48 enum PktSrcEnum {
59 };
60 
61 #include "source-nflog.h"
62 #include "source-nfq.h"
63 #include "source-ipfw.h"
64 #include "source-pcap.h"
65 #include "source-af-packet.h"
66 #include "source-netmap.h"
67 #include "source-windivert.h"
68 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
69 #include "source-pfring.h"
70 #endif
71 
72 #include "action-globals.h"
73 
74 #include "decode-erspan.h"
75 #include "decode-ethernet.h"
76 #include "decode-gre.h"
77 #include "decode-ppp.h"
78 #include "decode-pppoe.h"
79 #include "decode-sll.h"
80 #include "decode-ipv4.h"
81 #include "decode-ipv6.h"
82 #include "decode-icmpv4.h"
83 #include "decode-icmpv6.h"
84 #include "decode-tcp.h"
85 #include "decode-udp.h"
86 #include "decode-sctp.h"
87 #include "decode-raw.h"
88 #include "decode-null.h"
89 #include "decode-vlan.h"
90 #include "decode-vxlan.h"
91 #include "decode-mpls.h"
92 
93 #include "detect-reference.h"
94 
95 #include "app-layer-protos.h"
96 
97 /* forward declarations */
98 struct DetectionEngineThreadCtx_;
100 
101 struct PktPool_;
102 
103 /* declare these here as they are called from the
104  * PACKET_RECYCLE and PACKET_CLEANUP macro's. */
108 
109 /* Address */
110 typedef struct Address_ {
111  char family;
112  union {
113  uint32_t address_un_data32[4]; /* type-specific field */
114  uint16_t address_un_data16[8]; /* type-specific field */
115  uint8_t address_un_data8[16]; /* type-specific field */
116  struct in6_addr address_un_in6;
117  } address;
118 } Address;
119 
120 #define addr_data32 address.address_un_data32
121 #define addr_data16 address.address_un_data16
122 #define addr_data8 address.address_un_data8
123 #define addr_in6addr address.address_un_in6
124 
125 #define COPY_ADDRESS(a, b) do { \
126  (b)->family = (a)->family; \
127  (b)->addr_data32[0] = (a)->addr_data32[0]; \
128  (b)->addr_data32[1] = (a)->addr_data32[1]; \
129  (b)->addr_data32[2] = (a)->addr_data32[2]; \
130  (b)->addr_data32[3] = (a)->addr_data32[3]; \
131  } while (0)
132 
133 /* Set the IPv4 addresses into the Addrs of the Packet.
134  * Make sure p->ip4h is initialized and validated.
135  *
136  * We set the rest of the struct to 0 so we can
137  * prevent using memset. */
138 #define SET_IPV4_SRC_ADDR(p, a) do { \
139  (a)->family = AF_INET; \
140  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
141  (a)->addr_data32[1] = 0; \
142  (a)->addr_data32[2] = 0; \
143  (a)->addr_data32[3] = 0; \
144  } while (0)
145 
146 #define SET_IPV4_DST_ADDR(p, a) do { \
147  (a)->family = AF_INET; \
148  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
149  (a)->addr_data32[1] = 0; \
150  (a)->addr_data32[2] = 0; \
151  (a)->addr_data32[3] = 0; \
152  } while (0)
153 
154 /* clear the address structure by setting all fields to 0 */
155 #define CLEAR_ADDR(a) do { \
156  (a)->family = 0; \
157  (a)->addr_data32[0] = 0; \
158  (a)->addr_data32[1] = 0; \
159  (a)->addr_data32[2] = 0; \
160  (a)->addr_data32[3] = 0; \
161  } while (0)
162 
163 /* Set the IPv6 addressesinto the Addrs of the Packet.
164  * Make sure p->ip6h is initialized and validated. */
165 #define SET_IPV6_SRC_ADDR(p, a) do { \
166  (a)->family = AF_INET6; \
167  (a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \
168  (a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \
169  (a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \
170  (a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \
171  } while (0)
172 
173 #define SET_IPV6_DST_ADDR(p, a) do { \
174  (a)->family = AF_INET6; \
175  (a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \
176  (a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \
177  (a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \
178  (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \
179  } while (0)
180 
181 /* Set the TCP ports into the Ports of the Packet.
182  * Make sure p->tcph is initialized and validated. */
183 #define SET_TCP_SRC_PORT(pkt, prt) do { \
184  SET_PORT(TCP_GET_SRC_PORT((pkt)), *(prt)); \
185  } while (0)
186 
187 #define SET_TCP_DST_PORT(pkt, prt) do { \
188  SET_PORT(TCP_GET_DST_PORT((pkt)), *(prt)); \
189  } while (0)
190 
191 /* Set the UDP ports into the Ports of the Packet.
192  * Make sure p->udph is initialized and validated. */
193 #define SET_UDP_SRC_PORT(pkt, prt) do { \
194  SET_PORT(UDP_GET_SRC_PORT((pkt)), *(prt)); \
195  } while (0)
196 #define SET_UDP_DST_PORT(pkt, prt) do { \
197  SET_PORT(UDP_GET_DST_PORT((pkt)), *(prt)); \
198  } while (0)
199 
200 /* Set the SCTP ports into the Ports of the Packet.
201  * Make sure p->sctph is initialized and validated. */
202 #define SET_SCTP_SRC_PORT(pkt, prt) do { \
203  SET_PORT(SCTP_GET_SRC_PORT((pkt)), *(prt)); \
204  } while (0)
205 
206 #define SET_SCTP_DST_PORT(pkt, prt) do { \
207  SET_PORT(SCTP_GET_DST_PORT((pkt)), *(prt)); \
208  } while (0)
209 
210 
211 
212 #define GET_IPV4_SRC_ADDR_U32(p) ((p)->src.addr_data32[0])
213 #define GET_IPV4_DST_ADDR_U32(p) ((p)->dst.addr_data32[0])
214 #define GET_IPV4_SRC_ADDR_PTR(p) ((p)->src.addr_data32)
215 #define GET_IPV4_DST_ADDR_PTR(p) ((p)->dst.addr_data32)
216 
217 #define GET_IPV6_SRC_IN6ADDR(p) ((p)->src.addr_in6addr)
218 #define GET_IPV6_DST_IN6ADDR(p) ((p)->dst.addr_in6addr)
219 #define GET_IPV6_SRC_ADDR(p) ((p)->src.addr_data32)
220 #define GET_IPV6_DST_ADDR(p) ((p)->dst.addr_data32)
221 #define GET_TCP_SRC_PORT(p) ((p)->sp)
222 #define GET_TCP_DST_PORT(p) ((p)->dp)
223 
224 #define GET_PKT_LEN(p) ((p)->pktlen)
225 #define GET_PKT_DATA(p) ((((p)->ext_pkt) == NULL ) ? (uint8_t *)((p) + 1) : (p)->ext_pkt)
226 #define GET_PKT_DIRECT_DATA(p) (uint8_t *)((p) + 1)
227 #define GET_PKT_DIRECT_MAX_SIZE(p) (default_packet_size)
228 
229 #define SET_PKT_LEN(p, len) do { \
230  (p)->pktlen = (len); \
231  } while (0)
232 
233 
234 /* Port is just a uint16_t */
235 typedef uint16_t Port;
236 #define SET_PORT(v, p) ((p) = (v))
237 #define COPY_PORT(a,b) ((b) = (a))
238 
239 #define CMP_ADDR(a1, a2) \
240  (((a1)->addr_data32[3] == (a2)->addr_data32[3] && \
241  (a1)->addr_data32[2] == (a2)->addr_data32[2] && \
242  (a1)->addr_data32[1] == (a2)->addr_data32[1] && \
243  (a1)->addr_data32[0] == (a2)->addr_data32[0]))
244 #define CMP_PORT(p1, p2) \
245  ((p1) == (p2))
246 
247 /*Given a packet pkt offset to the start of the ip header in a packet
248  *We determine the ip version. */
249 #define IP_GET_RAW_VER(pkt) ((((pkt)[0] & 0xf0) >> 4))
250 
251 #define PKT_IS_IPV4(p) (((p)->ip4h != NULL))
252 #define PKT_IS_IPV6(p) (((p)->ip6h != NULL))
253 #define PKT_IS_TCP(p) (((p)->tcph != NULL))
254 #define PKT_IS_UDP(p) (((p)->udph != NULL))
255 #define PKT_IS_ICMPV4(p) (((p)->icmpv4h != NULL))
256 #define PKT_IS_ICMPV6(p) (((p)->icmpv6h != NULL))
257 #define PKT_IS_TOSERVER(p) (((p)->flowflags & FLOW_PKT_TOSERVER))
258 #define PKT_IS_TOCLIENT(p) (((p)->flowflags & FLOW_PKT_TOCLIENT))
259 
260 #define IPH_IS_VALID(p) (PKT_IS_IPV4((p)) || PKT_IS_IPV6((p)))
261 
262 /* Retrieve proto regardless of IP version */
263 #define IP_GET_IPPROTO(p) \
264  (p->proto ? p->proto : \
265  (PKT_IS_IPV4((p))? IPV4_GET_IPPROTO((p)) : (PKT_IS_IPV6((p))? IPV6_GET_L4PROTO((p)) : 0)))
266 
267 /* structure to store the sids/gids/etc the detection engine
268  * found in this packet */
269 typedef struct PacketAlert_ {
270  SigIntId num; /* Internal num, used for sorting */
271  uint8_t action; /* Internal num, used for sorting */
272  uint8_t flags;
273  const struct Signature_ *s;
274  uint64_t tx_id;
275 } PacketAlert;
276 
277 /** After processing an alert by the thresholding module, if at
278  * last it gets triggered, we might want to stick the drop action to
279  * the flow on IPS mode */
280 #define PACKET_ALERT_FLAG_DROP_FLOW 0x01
281 /** alert was generated based on state */
282 #define PACKET_ALERT_FLAG_STATE_MATCH 0x02
283 /** alert was generated based on stream */
284 #define PACKET_ALERT_FLAG_STREAM_MATCH 0x04
285 /** alert is in a tx, tx_id set */
286 #define PACKET_ALERT_FLAG_TX 0x08
287 /** action was changed by rate_filter */
288 #define PACKET_ALERT_RATE_FILTER_MODIFIED 0x10
289 
290 #define PACKET_ALERT_MAX 15
291 
292 typedef struct PacketAlerts_ {
293  uint16_t cnt;
295  /* single pa used when we're dropping,
296  * so we can log it out in the drop log. */
298 } PacketAlerts;
299 
300 /** number of decoder events we support per packet. Power of 2 minus 1
301  * for memory layout */
302 #define PACKET_ENGINE_EVENT_MAX 15
303 
304 /** data structure to store decoder, defrag and stream events */
305 typedef struct PacketEngineEvents_ {
306  uint8_t cnt; /**< number of events */
307  uint8_t events[PACKET_ENGINE_EVENT_MAX]; /**< array of events */
309 
310 typedef struct PktVar_ {
311  uint32_t id;
312  struct PktVar_ *next; /* right now just implement this as a list,
313  * in the long run we have thing of something
314  * faster. */
315  uint16_t key_len;
316  uint16_t value_len;
317  uint8_t *key;
318  uint8_t *value;
319 } PktVar;
320 
321 #ifdef PROFILING
322 
323 /** \brief Per TMM stats storage */
324 typedef struct PktProfilingTmmData_ {
325  uint64_t ticks_start;
326  uint64_t ticks_end;
327 #ifdef PROFILE_LOCKING
328  uint64_t mutex_lock_cnt;
329  uint64_t mutex_lock_wait_ticks;
330  uint64_t mutex_lock_contention;
331  uint64_t spin_lock_cnt;
332  uint64_t spin_lock_wait_ticks;
333  uint64_t spin_lock_contention;
334  uint64_t rww_lock_cnt;
335  uint64_t rww_lock_wait_ticks;
336  uint64_t rww_lock_contention;
337  uint64_t rwr_lock_cnt;
338  uint64_t rwr_lock_wait_ticks;
339  uint64_t rwr_lock_contention;
340 #endif
342 
343 typedef struct PktProfilingData_ {
344  uint64_t ticks_start;
345  uint64_t ticks_end;
347 
348 typedef struct PktProfilingDetectData_ {
349  uint64_t ticks_start;
350  uint64_t ticks_end;
351  uint64_t ticks_spent;
353 
354 typedef struct PktProfilingAppData_ {
355  uint64_t ticks_spent;
357 
358 typedef struct PktProfilingLoggerData_ {
359  uint64_t ticks_start;
360  uint64_t ticks_end;
361  uint64_t ticks_spent;
363 
365  uint64_t ticks_spent;
367 
370  uint32_t size; /**< array size */
372 
373 /** \brief Per pkt stats storage */
374 typedef struct PktProfiling_ {
375  uint64_t ticks_start;
376  uint64_t ticks_end;
377 
383  uint64_t proto_detect;
384 } PktProfiling;
385 
386 #endif /* PROFILING */
387 
388 /* forward declartion since Packet struct definition requires this */
389 struct PacketQueue_;
390 
391 /* sizes of the members:
392  * src: 17 bytes
393  * dst: 17 bytes
394  * sp/type: 1 byte
395  * dp/code: 1 byte
396  * proto: 1 byte
397  * recurs: 1 byte
398  *
399  * sum of above: 38 bytes
400  *
401  * flow ptr: 4/8 bytes
402  * flags: 1 byte
403  * flowflags: 1 byte
404  *
405  * sum of above 44/48 bytes
406  */
407 typedef struct Packet_
408 {
409  /* Addresses, Ports and protocol
410  * these are on top so we can use
411  * the Packet as a hash key */
414  union {
416  // icmp type and code of this packet
417  struct {
418  uint8_t type;
419  uint8_t code;
420  } icmp_s;
421  };
422  union {
424  // icmp type and code of the expected counterpart (for flows)
425  struct {
426  uint8_t type;
427  uint8_t code;
428  } icmp_d;
429  };
430  uint8_t proto;
431  /* make sure we can't be attacked on when the tunneled packet
432  * has the exact same tuple as the lower levels */
434 
435  uint16_t vlan_id[2];
436  uint8_t vlan_idx;
437 
438  /* flow */
439  uint8_t flowflags;
440  /* coccinelle: Packet:flowflags:FLOW_PKT_ */
441 
442  /* Pkt Flags */
443  uint32_t flags;
444 
445  struct Flow_ *flow;
446 
447  /* raw hash value for looking up the flow, will need to modulated to the
448  * hash size still */
449  uint32_t flow_hash;
450 
451  struct timeval ts;
452 
453  union {
454  /* nfq stuff */
455 #ifdef HAVE_NFLOG
456  NFLOGPacketVars nflog_v;
457 #endif /* HAVE_NFLOG */
458 #ifdef NFQ
460 #endif /* NFQ */
461 #ifdef IPFW
463 #endif /* IPFW */
464 #ifdef AF_PACKET
465  AFPPacketVars afp_v;
466 #endif
467 #ifdef HAVE_NETMAP
468  NetmapPacketVars netmap_v;
469 #endif
470 #ifdef HAVE_PFRING
471 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
472  PfringPacketVars pfring_v;
473 #endif
474 #endif
475 #ifdef WINDIVERT
476  WinDivertPacketVars windivert_v;
477 #endif /* WINDIVERT */
478 
479  /** libpcap vars: shared by Pcap Live mode and Pcap File mode */
481  };
482 
483  /** The release function for packet structure and data */
484  void (*ReleasePacket)(struct Packet_ *);
485  /** The function triggering bypass the flow in the capture method.
486  * Return 1 for success and 0 on error */
487  int (*BypassPacketsFlow)(struct Packet_ *);
488 
489  /* pkt vars */
491 
492  /* header pointers */
493  EthernetHdr *ethh;
494 
495  /* Checksum for IP packets. */
497  /* Check sum for TCP, UDP or ICMP packets */
499 
501 
503 
504  /* IPv4 and IPv6 are mutually exclusive */
505  union {
507  struct {
510  };
511  };
512  /* Can only be one of TCP, UDP, ICMP at any given time */
513  union {
517  } l4vars;
518 #define tcpvars l4vars.tcpvars
519 #define icmpv4vars l4vars.icmpv4vars
520 #define icmpv6vars l4vars.icmpv6vars
521 
522  TCPHdr *tcph;
523 
524  UDPHdr *udph;
525 
526  SCTPHdr *sctph;
527 
528  ICMPV4Hdr *icmpv4h;
529 
531 
532  PPPHdr *ppph;
534  PPPOEDiscoveryHdr *pppoedh;
535 
536  GREHdr *greh;
537 
538  /* ptr to the payload of the packet
539  * with it's length. */
540  uint8_t *payload;
541  uint16_t payload_len;
542 
543  /* IPS action to take */
544  uint8_t action;
545 
546  uint8_t pkt_src;
547 
548  /* storage: set to pointer to heap and extended via allocation if necessary */
549  uint32_t pktlen;
550  uint8_t *ext_pkt;
551 
552  /* Incoming interface */
554 
556 
557  struct Host_ *host_src;
558  struct Host_ *host_dst;
559 
560  /** packet number in the pcap file, matches wireshark */
561  uint64_t pcap_cnt;
562 
563 
564  /* engine events */
566 
568 
569  /* double linked list ptrs */
570  struct Packet_ *next;
571  struct Packet_ *prev;
572 
573  /** data linktype in host order */
574  int datalink;
575 
576  /* tunnel/encapsulation handling */
577  struct Packet_ *root; /* in case of tunnel this is a ptr
578  * to the 'real' packet, the one we
579  * need to set the verdict on --
580  * It should always point to the lowest
581  * packet in a encapsulated packet */
582 
583  /** mutex to protect access to:
584  * - tunnel_rtv_cnt
585  * - tunnel_tpr_cnt
586  */
588  /* ready to set verdict counter, only set in root */
589  uint16_t tunnel_rtv_cnt;
590  /* tunnel packet ref count */
591  uint16_t tunnel_tpr_cnt;
592 
593  /** tenant id for this packet, if any. If 0 then no tenant was assigned. */
594  uint32_t tenant_id;
595 
596  /* The Packet pool from which this packet was allocated. Used when returning
597  * the packet to its owner's stack. If NULL, then allocated with malloc.
598  */
599  struct PktPool_ *pool;
600 
601 #ifdef PROFILING
603 #endif
604 #ifdef HAVE_NAPATECH
606 #endif
607 } Packet;
608 
609 /** highest mtu of the interfaces we monitor */
610 extern int g_default_mtu;
611 #define DEFAULT_MTU 1500
612 #define MINIMUM_MTU 68 /**< ipv4 minimum: rfc791 */
613 
614 #define DEFAULT_PACKET_SIZE (DEFAULT_MTU + ETHERNET_HEADER_LEN)
615 /* storage: maximum ip packet size + link header */
616 #define MAX_PAYLOAD_SIZE (IPV6_HEADER_LEN + 65536 + 28)
618 #define SIZE_OF_PACKET (default_packet_size + sizeof(Packet))
619 
620 typedef struct PacketQueue_ {
623  uint32_t len;
624 #ifdef DBG_PERF
625  uint32_t dbg_maxlen;
626 #endif /* DBG_PERF */
629 } PacketQueue;
630 
631 /** \brief Structure to hold thread specific data for all decode modules */
632 typedef struct DecodeThreadVars_
633 {
634  /** Specific context for udp protocol detection (here atm) */
636 
637  /** stats/counters */
638  uint16_t counter_pkts;
639  uint16_t counter_bytes;
642 
643  uint16_t counter_invalid;
644 
645  uint16_t counter_eth;
646  uint16_t counter_ipv4;
647  uint16_t counter_ipv6;
648  uint16_t counter_tcp;
649  uint16_t counter_udp;
650  uint16_t counter_icmpv4;
651  uint16_t counter_icmpv6;
652 
653  uint16_t counter_sll;
654  uint16_t counter_raw;
655  uint16_t counter_null;
656  uint16_t counter_sctp;
657  uint16_t counter_ppp;
658  uint16_t counter_gre;
659  uint16_t counter_vlan;
661  uint16_t counter_vxlan;
663  uint16_t counter_pppoe;
664  uint16_t counter_teredo;
665  uint16_t counter_mpls;
668  uint16_t counter_erspan;
669 
670  /** frag stats - defrag runs in the context of the decoder. */
678 
680 
685 
686  uint16_t counter_engine_events[DECODE_EVENT_MAX];
687 
688  /* thread data for flow logging api: only used at forced
689  * flow recycle during lookups */
691 
693 
694 typedef struct CaptureStats_ {
695 
700 
701 } CaptureStats;
702 
703 void CaptureStatsUpdate(ThreadVars *tv, CaptureStats *s, const Packet *p);
705 
706 #define PACKET_CLEAR_L4VARS(p) do { \
707  memset(&(p)->l4vars, 0x00, sizeof((p)->l4vars)); \
708  } while (0)
709 
710 /**
711  * \brief reset these to -1(indicates that the packet is fresh from the queue)
712  */
713 #define PACKET_RESET_CHECKSUMS(p) do { \
714  (p)->level3_comp_csum = -1; \
715  (p)->level4_comp_csum = -1; \
716  } while (0)
717 
718 /* if p uses extended data, free them */
719 #define PACKET_FREE_EXTDATA(p) do { \
720  if ((p)->ext_pkt) { \
721  if (!((p)->flags & PKT_ZERO_COPY)) { \
722  SCFree((p)->ext_pkt); \
723  } \
724  (p)->ext_pkt = NULL; \
725  } \
726  } while(0)
727 
728 /**
729  * \brief Initialize a packet structure for use.
730  */
731 #define PACKET_INITIALIZE(p) { \
732  SCMutexInit(&(p)->tunnel_mutex, NULL); \
733  PACKET_RESET_CHECKSUMS((p)); \
734  (p)->livedev = NULL; \
735 }
736 
737 #define PACKET_RELEASE_REFS(p) do { \
738  FlowDeReference(&((p)->flow)); \
739  HostDeReference(&((p)->host_src)); \
740  HostDeReference(&((p)->host_dst)); \
741  } while (0)
742 
743 /**
744  * \brief Recycle a packet structure for reuse.
745  */
746 #define PACKET_REINIT(p) do { \
747  CLEAR_ADDR(&(p)->src); \
748  CLEAR_ADDR(&(p)->dst); \
749  (p)->sp = 0; \
750  (p)->dp = 0; \
751  (p)->proto = 0; \
752  (p)->recursion_level = 0; \
753  PACKET_FREE_EXTDATA((p)); \
754  (p)->flags = (p)->flags & PKT_ALLOC; \
755  (p)->flowflags = 0; \
756  (p)->pkt_src = 0; \
757  (p)->vlan_id[0] = 0; \
758  (p)->vlan_id[1] = 0; \
759  (p)->vlan_idx = 0; \
760  (p)->ts.tv_sec = 0; \
761  (p)->ts.tv_usec = 0; \
762  (p)->datalink = 0; \
763  (p)->action = 0; \
764  if ((p)->pktvar != NULL) { \
765  PktVarFree((p)->pktvar); \
766  (p)->pktvar = NULL; \
767  } \
768  (p)->ethh = NULL; \
769  if ((p)->ip4h != NULL) { \
770  CLEAR_IPV4_PACKET((p)); \
771  } \
772  if ((p)->ip6h != NULL) { \
773  CLEAR_IPV6_PACKET((p)); \
774  } \
775  if ((p)->tcph != NULL) { \
776  CLEAR_TCP_PACKET((p)); \
777  } \
778  if ((p)->udph != NULL) { \
779  CLEAR_UDP_PACKET((p)); \
780  } \
781  if ((p)->sctph != NULL) { \
782  CLEAR_SCTP_PACKET((p)); \
783  } \
784  if ((p)->icmpv4h != NULL) { \
785  CLEAR_ICMPV4_PACKET((p)); \
786  } \
787  if ((p)->icmpv6h != NULL) { \
788  CLEAR_ICMPV6_PACKET((p)); \
789  } \
790  (p)->ppph = NULL; \
791  (p)->pppoesh = NULL; \
792  (p)->pppoedh = NULL; \
793  (p)->greh = NULL; \
794  (p)->payload = NULL; \
795  (p)->payload_len = 0; \
796  (p)->BypassPacketsFlow = NULL; \
797  (p)->pktlen = 0; \
798  (p)->alerts.cnt = 0; \
799  (p)->alerts.drop.action = 0; \
800  (p)->pcap_cnt = 0; \
801  (p)->tunnel_rtv_cnt = 0; \
802  (p)->tunnel_tpr_cnt = 0; \
803  (p)->events.cnt = 0; \
804  AppLayerDecoderEventsResetEvents((p)->app_layer_events); \
805  (p)->next = NULL; \
806  (p)->prev = NULL; \
807  (p)->root = NULL; \
808  (p)->livedev = NULL; \
809  PACKET_RESET_CHECKSUMS((p)); \
810  PACKET_PROFILING_RESET((p)); \
811  p->tenant_id = 0; \
812  } while (0)
813 
814 #define PACKET_RECYCLE(p) do { \
815  PACKET_RELEASE_REFS((p)); \
816  PACKET_REINIT((p)); \
817  } while (0)
818 
819 /**
820  * \brief Cleanup a packet so that we can free it. No memset needed..
821  */
822 #define PACKET_DESTRUCTOR(p) do { \
823  if ((p)->pktvar != NULL) { \
824  PktVarFree((p)->pktvar); \
825  } \
826  PACKET_FREE_EXTDATA((p)); \
827  SCMutexDestroy(&(p)->tunnel_mutex); \
828  AppLayerDecoderEventsFreeEvents(&(p)->app_layer_events); \
829  PACKET_PROFILING_RESET((p)); \
830  } while (0)
831 
832 
833 /* macro's for setting the action
834  * handle the case of a root packet
835  * for tunnels */
836 
837 #define PACKET_SET_ACTION(p, a) do { \
838  ((p)->root ? \
839  ((p)->root->action = a) : \
840  ((p)->action = a)); \
841 } while (0)
842 
843 #define PACKET_ALERT(p) PACKET_SET_ACTION(p, ACTION_ALERT)
844 
845 #define PACKET_ACCEPT(p) PACKET_SET_ACTION(p, ACTION_ACCEPT)
846 
847 #define PACKET_DROP(p) PACKET_SET_ACTION(p, ACTION_DROP)
848 
849 #define PACKET_REJECT(p) PACKET_SET_ACTION(p, (ACTION_REJECT|ACTION_DROP))
850 
851 #define PACKET_REJECT_DST(p) PACKET_SET_ACTION(p, (ACTION_REJECT_DST|ACTION_DROP))
852 
853 #define PACKET_REJECT_BOTH(p) PACKET_SET_ACTION(p, (ACTION_REJECT_BOTH|ACTION_DROP))
854 
855 #define PACKET_PASS(p) PACKET_SET_ACTION(p, ACTION_PASS)
856 
857 #define PACKET_TEST_ACTION(p, a) \
858  ((p)->root ? \
859  ((p)->root->action & a) : \
860  ((p)->action & a))
861 
862 #define PACKET_UPDATE_ACTION(p, a) do { \
863  ((p)->root ? \
864  ((p)->root->action |= a) : \
865  ((p)->action |= a)); \
866 } while (0)
867 
868 #define TUNNEL_INCR_PKT_RTV_NOLOCK(p) do { \
869  ((p)->root ? (p)->root->tunnel_rtv_cnt++ : (p)->tunnel_rtv_cnt++); \
870  } while (0)
871 
872 #define TUNNEL_INCR_PKT_TPR(p) do { \
873  SCMutexLock((p)->root ? &(p)->root->tunnel_mutex : &(p)->tunnel_mutex); \
874  ((p)->root ? (p)->root->tunnel_tpr_cnt++ : (p)->tunnel_tpr_cnt++); \
875  SCMutexUnlock((p)->root ? &(p)->root->tunnel_mutex : &(p)->tunnel_mutex); \
876  } while (0)
877 
878 #define TUNNEL_PKT_RTV(p) ((p)->root ? (p)->root->tunnel_rtv_cnt : (p)->tunnel_rtv_cnt)
879 #define TUNNEL_PKT_TPR(p) ((p)->root ? (p)->root->tunnel_tpr_cnt : (p)->tunnel_tpr_cnt)
880 
881 #define IS_TUNNEL_PKT(p) (((p)->flags & PKT_TUNNEL))
882 #define SET_TUNNEL_PKT(p) ((p)->flags |= PKT_TUNNEL)
883 #define UNSET_TUNNEL_PKT(p) ((p)->flags &= ~PKT_TUNNEL)
884 #define IS_TUNNEL_ROOT_PKT(p) (IS_TUNNEL_PKT(p) && (p)->root == NULL)
885 
886 #define IS_TUNNEL_PKT_VERDICTED(p) (((p)->flags & PKT_TUNNEL_VERDICTED))
887 #define SET_TUNNEL_PKT_VERDICTED(p) ((p)->flags |= PKT_TUNNEL_VERDICTED)
888 
895  DECODE_TUNNEL_IPV6_TEREDO, /**< separate protocol for stricter error handling */
897 };
898 
900  uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto, PacketQueue *pq);
901 Packet *PacketDefragPktSetup(Packet *parent, uint8_t *pkt, uint32_t len, uint8_t proto);
902 void PacketDefragPktSetupParent(Packet *parent);
908  DecodeThreadVars *dtv, Packet *p);
909 void PacketFree(Packet *p);
910 void PacketFreeOrRelease(Packet *p);
911 int PacketCallocExtPkt(Packet *p, int datalen);
912 int PacketCopyData(Packet *p, uint8_t *pktdata, uint32_t pktlen);
913 int PacketSetData(Packet *p, uint8_t *pktdata, uint32_t pktlen);
914 int PacketCopyDataOffset(Packet *p, uint32_t offset, uint8_t *data, uint32_t datalen);
915 const char *PktSrcToString(enum PktSrcEnum pkt_src);
917 void PacketSwap(Packet *p);
918 
922  const DecodeThreadVars *dtv, const Packet *p);
923 
924 /* decoder functions */
925 int DecodeEthernet(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
926 int DecodeSll(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
927 int DecodePPP(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
928 int DecodePPPOESession(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
929 int DecodePPPOEDiscovery(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
930 int DecodeTunnel(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *, enum DecodeTunnelProto) __attribute__ ((warn_unused_result));
931 int DecodeNull(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
932 int DecodeRaw(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
933 int DecodeIPV4(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
934 int DecodeIPV6(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
935 int DecodeICMPV4(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
936 int DecodeICMPV6(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
937 int DecodeTCP(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
938 int DecodeUDP(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
939 int DecodeSCTP(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
940 int DecodeGRE(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
941 int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
942 int DecodeVXLAN(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
943 int DecodeMPLS(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
944 int DecodeERSPAN(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *);
945 int DecodeTEMPLATE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t, PacketQueue *);
946 
947 #ifdef UNITTESTS
948 void DecodeIPV6FragHeader(Packet *p, uint8_t *pkt,
949  uint16_t hdrextlen, uint16_t plen,
950  uint16_t prev_hdrextlen);
951 #endif
952 
953 void AddressDebugPrint(Address *);
954 
955 #ifdef AFLFUZZ_DECODER
956 typedef int (*DecoderFunc)(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
957  uint8_t *pkt, uint32_t len, PacketQueue *pq);
958 
959 int DecoderParseDataFromFile(char *filename, DecoderFunc Decoder);
960 int DecoderParseDataFromFileSerie(char *fileprefix, DecoderFunc Decoder);
961 #endif
962 void DecodeGlobalConfig(void);
963 void DecodeUnregisterCounters(void);
964 
965 /** \brief Set the No payload inspection Flag for the packet.
966  *
967  * \param p Packet to set the flag in
968  */
969 #define DecodeSetNoPayloadInspectionFlag(p) do { \
970  (p)->flags |= PKT_NOPAYLOAD_INSPECTION; \
971  } while (0)
972 
973 #define DecodeUnsetNoPayloadInspectionFlag(p) do { \
974  (p)->flags &= ~PKT_NOPAYLOAD_INSPECTION; \
975  } while (0)
976 
977 /** \brief Set the No packet inspection Flag for the packet.
978  *
979  * \param p Packet to set the flag in
980  */
981 #define DecodeSetNoPacketInspectionFlag(p) do { \
982  (p)->flags |= PKT_NOPACKET_INSPECTION; \
983  } while (0)
984 #define DecodeUnsetNoPacketInspectionFlag(p) do { \
985  (p)->flags &= ~PKT_NOPACKET_INSPECTION; \
986  } while (0)
987 
988 
989 #define ENGINE_SET_EVENT(p, e) do { \
990  SCLogDebug("p %p event %d", (p), e); \
991  if ((p)->events.cnt < PACKET_ENGINE_EVENT_MAX) { \
992  (p)->events.events[(p)->events.cnt] = e; \
993  (p)->events.cnt++; \
994  } \
995 } while(0)
996 
997 #define ENGINE_SET_INVALID_EVENT(p, e) do { \
998  p->flags |= PKT_IS_INVALID; \
999  ENGINE_SET_EVENT(p, e); \
1000 } while(0)
1001 
1002 
1003 
1004 #define ENGINE_ISSET_EVENT(p, e) ({ \
1005  int r = 0; \
1006  uint8_t u; \
1007  for (u = 0; u < (p)->events.cnt; u++) { \
1008  if ((p)->events.events[u] == (e)) { \
1009  r = 1; \
1010  break; \
1011  } \
1012  } \
1013  r; \
1014 })
1015 
1016 #ifndef IPPROTO_IPIP
1017 #define IPPROTO_IPIP 4
1018 #endif
1019 
1020 /* older libcs don't contain a def for IPPROTO_DCCP
1021  * inside of <netinet/in.h>
1022  * if it isn't defined let's define it here.
1023  */
1024 #ifndef IPPROTO_DCCP
1025 #define IPPROTO_DCCP 33
1026 #endif
1027 
1028 /* older libcs don't contain a def for IPPROTO_SCTP
1029  * inside of <netinet/in.h>
1030  * if it isn't defined let's define it here.
1031  */
1032 #ifndef IPPROTO_SCTP
1033 #define IPPROTO_SCTP 132
1034 #endif
1035 
1036 #ifndef IPPROTO_MH
1037 #define IPPROTO_MH 135
1038 #endif
1039 
1040 /* Host Identity Protocol (rfc 5201) */
1041 #ifndef IPPROTO_HIP
1042 #define IPPROTO_HIP 139
1043 #endif
1044 
1045 #ifndef IPPROTO_SHIM6
1046 #define IPPROTO_SHIM6 140
1047 #endif
1048 
1049 /* pcap provides this, but we don't want to depend on libpcap */
1050 #ifndef DLT_EN10MB
1051 #define DLT_EN10MB 1
1052 #endif
1053 
1054 /* taken from pcap's bpf.h */
1055 #ifndef DLT_RAW
1056 #ifdef __OpenBSD__
1057 #define DLT_RAW 14 /* raw IP */
1058 #else
1059 #define DLT_RAW 12 /* raw IP */
1060 #endif
1061 #endif
1062 
1063 #ifndef DLT_NULL
1064 #define DLT_NULL 0
1065 #endif
1066 
1067 /** libpcap shows us the way to linktype codes
1068  * \todo we need more & maybe put them in a separate file? */
1069 #define LINKTYPE_NULL DLT_NULL
1070 #define LINKTYPE_ETHERNET DLT_EN10MB
1071 #define LINKTYPE_LINUX_SLL 113
1072 #define LINKTYPE_PPP 9
1073 #define LINKTYPE_RAW DLT_RAW
1074 /* http://www.tcpdump.org/linktypes.html defines DLT_RAW as 101, yet others don't.
1075  * Libpcap on at least OpenBSD returns 101 as datalink type for RAW pcaps though. */
1076 #define LINKTYPE_RAW2 101
1077 #define LINKTYPE_IPV4 228
1078 #define LINKTYPE_GRE_OVER_IP 778
1079 #define PPP_OVER_GRE 11
1080 #define VLAN_OVER_GRE 13
1081 
1082 /*Packet Flags*/
1083 #define PKT_NOPACKET_INSPECTION (1) /**< Flag to indicate that packet header or contents should not be inspected*/
1084 #define PKT_NOPAYLOAD_INSPECTION (1<<2) /**< Flag to indicate that packet contents should not be inspected*/
1085 #define PKT_ALLOC (1<<3) /**< Packet was alloc'd this run, needs to be freed */
1086 #define PKT_HAS_TAG (1<<4) /**< Packet has matched a tag */
1087 #define PKT_STREAM_ADD (1<<5) /**< Packet payload was added to reassembled stream */
1088 #define PKT_STREAM_EST (1<<6) /**< Packet is part of establised stream */
1089 #define PKT_STREAM_EOF (1<<7) /**< Stream is in eof state */
1090 #define PKT_HAS_FLOW (1<<8)
1091 #define PKT_PSEUDO_STREAM_END (1<<9) /**< Pseudo packet to end the stream */
1092 #define PKT_STREAM_MODIFIED (1<<10) /**< Packet is modified by the stream engine, we need to recalc the csum and reinject/replace */
1093 #define PKT_MARK_MODIFIED (1<<11) /**< Packet mark is modified */
1094 #define PKT_STREAM_NOPCAPLOG (1<<12) /**< Exclude packet from pcap logging as it's part of a stream that has reassembly depth reached. */
1095 
1096 #define PKT_TUNNEL (1<<13)
1097 #define PKT_TUNNEL_VERDICTED (1<<14)
1098 
1099 #define PKT_IGNORE_CHECKSUM (1<<15) /**< Packet checksum is not computed (TX packet for example) */
1100 #define PKT_ZERO_COPY (1<<16) /**< Packet comes from zero copy (ext_pkt must not be freed) */
1101 
1102 #define PKT_HOST_SRC_LOOKED_UP (1<<17)
1103 #define PKT_HOST_DST_LOOKED_UP (1<<18)
1104 
1105 #define PKT_IS_FRAGMENT (1<<19) /**< Packet is a fragment */
1106 #define PKT_IS_INVALID (1<<20)
1107 #define PKT_PROFILE (1<<21)
1108 
1109 /** indication by decoder that it feels the packet should be handled by
1110  * flow engine: Packet::flow_hash will be set */
1111 #define PKT_WANTS_FLOW (1<<22)
1112 
1113 /** protocol detection done */
1114 #define PKT_PROTO_DETECT_TS_DONE (1<<23)
1115 #define PKT_PROTO_DETECT_TC_DONE (1<<24)
1116 
1117 #define PKT_REBUILT_FRAGMENT (1<<25) /**< Packet is rebuilt from
1118  * fragments. */
1119 #define PKT_DETECT_HAS_STREAMDATA (1<<26) /**< Set by Detect() if raw stream data is available. */
1121 #define PKT_PSEUDO_DETECTLOG_FLUSH (1<<27) /**< Detect/log flush for protocol upgrade */
1123 /** Packet is part of stream in known bad condition (loss, wrong thread),
1124  * so flag it for not setting stream events */
1125 #define PKT_STREAM_NO_EVENTS (1<<28)
1127 /** \brief return 1 if the packet is a pseudo packet */
1128 #define PKT_IS_PSEUDOPKT(p) \
1129  ((p)->flags & (PKT_PSEUDO_STREAM_END|PKT_PSEUDO_DETECTLOG_FLUSH))
1130 
1131 #define PKT_SET_SRC(p, src_val) ((p)->pkt_src = src_val)
1133 /** \brief return true if *this* packet needs to trigger a verdict.
1134  *
1135  * If we have the root packet, and we have none outstanding,
1136  * we can verdict now.
1137  *
1138  * If we have a upper layer packet, it's the only one and root
1139  * is already processed, we can verdict now.
1140  *
1141  * Otherwise, a future packet will issue the verdict.
1142  */
1143 static inline bool VerdictTunnelPacket(Packet *p)
1144 {
1145  bool verdict = true;
1146  SCMutex *m = p->root ? &p->root->tunnel_mutex : &p->tunnel_mutex;
1147  SCMutexLock(m);
1148  const uint16_t outstanding = TUNNEL_PKT_TPR(p) - TUNNEL_PKT_RTV(p);
1149  SCLogDebug("tunnel: outstanding %u", outstanding);
1150 
1151  /* if there are packets outstanding, we won't verdict this one */
1152  if (IS_TUNNEL_ROOT_PKT(p) && !IS_TUNNEL_PKT_VERDICTED(p) && !outstanding) {
1153  // verdict
1154  SCLogDebug("root %p: verdict", p);
1155  } else if (!IS_TUNNEL_ROOT_PKT(p) && outstanding == 1 && p->root && IS_TUNNEL_PKT_VERDICTED(p->root)) {
1156  // verdict
1157  SCLogDebug("tunnel %p: verdict", p);
1158  } else {
1159  verdict = false;
1160  }
1161  SCMutexUnlock(m);
1162  return verdict;
1163 }
1164 
1165 #endif /* __DECODE_H__ */
1166 
uint16_t counter_max_pkt_size
Definition: decode.h:641
EthernetHdr * ethh
Definition: decode.h:493
uint16_t counter_ips_rejected
Definition: decode.h:698
#define SCMutex
uint16_t counter_defrag_ipv6_reassembled
Definition: decode.h:675
void PacketDefragPktSetupParent(Packet *parent)
inform defrag "parent" that a pseudo packet is now assosiated to it.
Definition: decode.c:387
IPV4Vars ip4vars
Definition: decode.h:506
int DecodeMPLS(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Definition: decode-mpls.c:47
UDPHdr * udph
Definition: decode.h:524
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *)
Alloc and setup DecodeThreadVars.
Definition: decode.c:605
#define SCLogDebug(...)
Definition: util-debug.h:335
void CaptureStatsUpdate(ThreadVars *tv, CaptureStats *s, const Packet *p)
Definition: decode.c:694
uint16_t counter_ieee8021ah
Definition: decode.h:662
uint64_t ticks_start
Definition: decode.h:344
int(* BypassPacketsFlow)(struct Packet_ *)
Definition: decode.h:487
struct Flow_ * flow
Definition: decode.h:445
__thread uint64_t rww_lock_contention
struct PktVar_ * next
Definition: decode.h:312
IPFWPacketVars ipfw_v
Definition: decode.h:462
int32_t level4_comp_csum
Definition: decode.h:498
#define IS_TUNNEL_ROOT_PKT(p)
Definition: decode.h:884
AppLayerDecoderEvents * app_layer_events
Definition: decode.h:567
SCCondT cond_q
Definition: decode.h:628
struct PktProfilingTmmData_ PktProfilingTmmData
Per TMM stats storage.
uint8_t address_un_data8[16]
Definition: decode.h:115
#define PACKET_ALERT_MAX
Definition: decode.h:290
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:115
struct PacketEngineEvents_ PacketEngineEvents
uint16_t counter_bytes
Definition: decode.h:639
int DecodeVXLAN(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Definition: decode-vxlan.c:119
int DecodePPP(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Definition: decode-ppp.c:43
uint8_t type
Definition: decode.h:418
uint16_t counter_eth
Definition: decode.h:645
Per pkt stats storage.
Definition: decode.h:374
uint16_t counter_null
Definition: decode.h:655
Port sp
Definition: decode.h:415
void DecodeRegisterPerfCounters(DecodeThreadVars *, ThreadVars *)
Definition: decode.c:465
PktSrcEnum
Definition: decode.h:48
struct Packet_ * next
Definition: decode.h:570
uint64_t ticks_spent
Definition: decode.h:361
Port dp
Definition: decode.h:423
ICMPV4Hdr * icmpv4h
Definition: decode.h:528
uint16_t counter_vlan_qinq
Definition: decode.h:660
uint8_t action
Definition: decode.h:271
int DecodeRaw(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Definition: decode-raw.c:46
uint64_t offset
Address dst
Definition: decode.h:413
uint16_t counter_defrag_ipv6_timeouts
Definition: decode.h:676
struct PktVar_ PktVar
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:102
int DecodeUDP(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *)
Definition: decode-udp.c:74
__thread uint64_t spin_lock_wait_ticks
uint16_t counter_defrag_ipv4_timeouts
Definition: decode.h:673
uint64_t ticks_start
Definition: decode.h:349
uint16_t counter_ipv4
Definition: decode.h:646
void DecodeIPV6FragHeader(Packet *p, uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:104
int DecodeTCP(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *)
Definition: decode-tcp.c:199
uint64_t pcap_cnt
Definition: decode.h:561
uint8_t * ext_pkt
Definition: decode.h:550
struct PktProfilingPrefilterData_ PktProfilingPrefilterData
__thread uint64_t spin_lock_contention
struct PktProfilingDetectData_ PktProfilingDetectData
void DecodeGlobalConfig(void)
Definition: decode.c:715
ICMPV6Vars icmpv6vars
Definition: decode.h:516
uint16_t key_len
Definition: decode.h:315
TCPHdr * tcph
Definition: decode.h:522
uint16_t counter_ipv4inipv6
Definition: decode.h:666
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:177
SCTPHdr * sctph
Definition: decode.h:526
Signature container.
Definition: detect.h:517
#define SCMutexLock(mut)
uint16_t counter_teredo
Definition: decode.h:664
__thread uint64_t rwr_lock_wait_ticks
void PacketFreeOrRelease(Packet *p)
Return a packet to where it was allocated.
Definition: decode.c:162
enum @32 __attribute__
DNP3 application header.
struct Host_ * host_src
Definition: decode.h:557
uint16_t counter_vlan
Definition: decode.h:659
uint16_t counter_erspan
Definition: decode.h:668
SigIntId num
Definition: decode.h:270
struct PktPool_ * pool
Definition: decode.h:599
uint64_t ticks_start
Definition: decode.h:325
#define IS_TUNNEL_PKT_VERDICTED(p)
Definition: decode.h:886
uint16_t counter_raw
Definition: decode.h:654
uint16_t counter_pkts
Definition: decode.h:638
#define SCCondT
uint16_t counter_flow_udp
Definition: decode.h:682
struct PktProfilingAppData_ PktProfilingAppData
void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events)
int(* Decoder)(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
uint16_t counter_flow_tcp
Definition: decode.h:681
const struct Signature_ * s
Definition: decode.h:273
uint16_t counter_avg_pkt_size
Definition: decode.h:640
uint16_t counter_defrag_ipv6_fragments
Definition: decode.h:674
PktVar * pktvar
Definition: decode.h:490
void AddressDebugPrint(Address *)
Debug print function for printing addresses.
Definition: decode.c:588
Data structure to store app layer decoder events.
uint64_t ticks_end
Definition: decode.h:376
#define SCMutexUnlock(mut)
IPV6Hdr * ip6h
Definition: decode.h:502
struct PacketAlerts_ PacketAlerts
ICMPV6Hdr * icmpv6h
Definition: decode.h:530
char family
Definition: decode.h:111
int DecodeICMPV4(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Main ICMPv4 decoding function.
uint16_t value_len
Definition: decode.h:316
int datalink
Definition: decode.h:574
uint8_t proto
Definition: decode.h:430
IPV6ExtHdrs ip6eh
Definition: decode.h:509
uint64_t ticks_spent
Definition: decode.h:351
struct PktProfilingPrefilterEngine_ PktProfilingPrefilterEngine
uint32_t len
Definition: decode.h:623
struct PktProfilingData_ PktProfilingData
PPPHdr * ppph
Definition: decode.h:532
uint8_t recursion_level
Definition: decode.h:433
uint8_t type
PPPOESessionHdr * pppoesh
Definition: decode.h:533
AppLayerThreadCtx * app_tctx
Definition: decode.h:635
int DecodeSll(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Definition: decode-sll.c:39
uint16_t counter_ipv6inipv6
Definition: decode.h:667
struct PktProfilingLoggerData_ PktProfilingLoggerData
int DecodeIPV6(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *)
Definition: decode-ipv6.c:583
struct PktProfiling_ PktProfiling
Per pkt stats storage.
Structure to hold thread specific data for all decode modules.
Definition: decode.h:632
__thread uint64_t mutex_lock_wait_ticks
uint16_t counter_mpls
Definition: decode.h:665
struct PacketAlert_ PacketAlert
DecodeTunnelProto
Definition: decode.h:889
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
uint16_t counter_icmpv4
Definition: decode.h:650
struct Host_ * host_dst
Definition: decode.h:558
uint16_t counter_tcp
Definition: decode.h:648
uint8_t flowflags
Definition: decode.h:439
void PacketBypassCallback(Packet *p)
Definition: decode.c:401
int DecodeNull(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Definition: decode-null.c:48
PacketEngineEvents events
Definition: decode.h:565
Packet * top
Definition: decode.h:621
void * output_flow_thread_data
Definition: decode.h:690
#define TUNNEL_PKT_TPR(p)
Definition: decode.h:879
uint64_t proto_detect
Definition: decode.h:383
struct CaptureStats_ CaptureStats
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Definition: decode.c:122
void PacketSwap(Packet *p)
switch direction of a packet
Definition: decode.c:430
uint16_t counter_ips_accepted
Definition: decode.h:696
uint16_t counter_ips_blocked
Definition: decode.h:697
uint16_t counter_flow_icmp4
Definition: decode.h:683
uint8_t proto
uint32_t pktlen
Definition: decode.h:549
uint16_t Port
Definition: decode.h:235
uint8_t pkt_src
Definition: decode.h:546
uint64_t tx_id
Definition: decode.h:274
uint64_t ticks_spent
Definition: decode.h:355
uint16_t counter_flow_memcap
Definition: decode.h:679
union Address_::@40 address
int DecodeEthernet(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
uint16_t counter_ipv6
Definition: decode.h:647
__thread uint64_t mutex_lock_contention
__thread uint64_t rwr_lock_cnt
PPPOEDiscoveryHdr * pppoedh
Definition: decode.h:534
struct Packet_ Packet
int DecodePPPOESession(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Main decoding function for PPPOE Session packets.
Definition: decode-pppoe.c:129
Packet * bot
Definition: decode.h:622
int DecodeIPV4(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *)
Definition: decode-ipv4.c:532
IPV4Hdr * ip4h
Definition: decode.h:500
int PacketCopyDataOffset(Packet *p, uint32_t offset, uint8_t *data, uint32_t datalen)
Copy data to Packet payload at given offset.
Definition: decode.c:218
uint8_t vlan_idx
Definition: decode.h:436
#define TUNNEL_PKT_RTV(p)
Definition: decode.h:878
Per TMM stats storage.
Definition: decode.h:324
uint64_t ticks_end
Definition: decode.h:345
uint32_t id
Definition: decode.h:311
uint16_t counter_invalid
Definition: decode.h:643
uint16_t address_un_data16[8]
Definition: decode.h:114
struct in6_addr address_un_in6
Definition: decode.h:116
int DecodeTunnel(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *, enum DecodeTunnelProto) __attribute__((warn_unused_result))
Definition: decode.c:75
uint8_t code
Definition: decode.h:419
int DecodeTEMPLATE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t, PacketQueue *)
Function to decode TEMPLATE packets.
uint16_t counter_sctp
Definition: decode.h:656
SCMutex tunnel_mutex
Definition: decode.h:587
uint16_t tunnel_tpr_cnt
Definition: decode.h:591
struct Address_ Address
int PacketSetData(Packet *p, uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zeo copy is used.
Definition: decode.c:644
uint16_t counter_ppp
Definition: decode.h:657
struct DecodeThreadVars_ DecodeThreadVars
Structure to hold thread specific data for all decode modules.
uint8_t * key
Definition: decode.h:317
IPV6Vars ip6vars
Definition: decode.h:508
Definition: host.h:58
uint16_t tunnel_rtv_cnt
Definition: decode.h:589
uint8_t * value
Definition: decode.h:318
uint32_t address_un_data32[4]
Definition: decode.h:113
uint8_t flags
Definition: decode.h:272
int32_t level3_comp_csum
Definition: decode.h:496
int DecodeICMPV6(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Decode ICMPV6 packets and fill the Packet with the decoded info.
uint16_t counter_ips_replaced
Definition: decode.h:699
PacketAlert drop
Definition: decode.h:297
uint32_t default_packet_size
Definition: decode.h:617
PktProfiling * profile
Definition: decode.h:602
int PacketCallocExtPkt(Packet *p, int datalen)
Definition: decode.c:192
uint64_t ticks_end
Definition: decode.h:326
uint64_t ts
struct Packet_ * prev
Definition: decode.h:571
uint16_t counter_icmpv6
Definition: decode.h:651
__thread uint64_t rwr_lock_contention
__thread uint64_t rww_lock_cnt
const char * PktSrcToString(enum PktSrcEnum pkt_src)
Definition: decode.c:656
uint16_t counter_gre
Definition: decode.h:658
SCMutex m
Definition: flow-hash.h:105
__thread uint64_t rww_lock_wait_ticks
uint16_t counter_udp
Definition: decode.h:649
per packet Pfring vars
Definition: source-pfring.h:61
get the highest proto/next header field we know
Definition: decode-ipv6.h:103
uint16_t counter_flow_icmp6
Definition: decode.h:684
ChecksumValidationMode
Definition: decode.h:40
PacketAlerts alerts
Definition: decode.h:555
struct PacketQueue_ PacketQueue
int g_default_mtu
Definition: suricata.c:224
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:571
int DecodeERSPAN(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Function to decode ERSPAN packets.
Definition: decode-erspan.c:46
#define PACKET_ENGINE_EVENT_MAX
Definition: decode.h:302
NapatechPacketVars ntpv
Definition: decode.h:605
int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Definition: decode-vlan.c:62
uint64_t ticks_start
Definition: decode.h:375
uint16_t counter_sll
Definition: decode.h:653
void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s)
Definition: decode.c:707
NFQPacketVars nfq_v
Definition: decode.h:459
uint16_t cnt
Definition: decode.h:293
TCPVars tcpvars
Definition: decode.h:514
uint16_t counter_pppoe
Definition: decode.h:663
struct LiveDevice_ * livedev
Definition: decode.h:553
uint32_t tenant_id
Definition: decode.h:594
uint32_t flow_hash
Definition: decode.h:449
uint8_t len
Per thread variable structure.
Definition: threadvars.h:57
__thread uint64_t mutex_lock_cnt
uint8_t code
uint16_t counter_defrag_ipv4_fragments
Definition: decode.h:671
uint32_t flags
Definition: decode.h:443
This is for the app layer in general and it contains per thread context relevant to both the alpd and...
Definition: app-layer.c:57
uint16_t payload_len
Definition: decode.h:541
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto, PacketQueue *pq)
Setup a pseudo packet (tunnel)
Definition: decode.c:275
void DecodeThreadVarsFree(ThreadVars *, DecodeThreadVars *)
Definition: decode.c:624
uint16_t counter_defrag_max_hit
Definition: decode.h:677
per packet AF_PACKET vars
PktProfilingPrefilterEngine * engines
Definition: decode.h:369
PcapPacketVars pcap_v
Definition: decode.h:480
uint16_t counter_defrag_ipv4_reassembled
Definition: decode.h:672
int DecodePPPOEDiscovery(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Main decoding function for PPPOE Discovery packets.
Definition: decode-pppoe.c:50
Flow data structure.
Definition: flow.h:325
GREHdr * greh
Definition: decode.h:536
uint8_t * payload
Definition: decode.h:540
int PacketCopyData(Packet *p, uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:259
#define SigIntId
int DecodeGRE(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *)
Function to decode GRE packets.
Definition: decode-gre.c:46
int DecodeSCTP(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *)
Definition: decode-sctp.c:62
ICMPV4Vars icmpv4vars
Definition: decode.h:515
Packet * PacketDefragPktSetup(Packet *parent, uint8_t *pkt, uint32_t len, uint8_t proto)
Setup a pseudo packet (reassembled frags)
Definition: decode.c:349
__thread uint64_t spin_lock_cnt
void DecodeUnregisterCounters(void)
Definition: decode.c:455
SCMutex mutex_q
Definition: decode.h:627
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:141
Address src
Definition: decode.h:412
uint64_t ticks_start
Definition: decode.h:359
struct Packet_ * root
Definition: decode.h:577
uint16_t counter_vxlan
Definition: decode.h:661
uint8_t action
Definition: decode.h:544