suricata
decode.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2023 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __DECODE_H__
25 #define __DECODE_H__
26 
27 //#define DBG_THREADS
28 #define COUNTERS
29 
30 #include "suricata-common.h"
31 #include "suricata-plugin.h"
32 #include "threadvars.h"
33 #include "util-debug.h"
34 #include "decode-events.h"
35 #ifdef PROFILING
36 #include "flow-worker.h"
37 #include "app-layer-protos.h"
38 #endif
39 
40 #ifdef HAVE_NAPATECH
41 #include "util-napatech.h"
42 #endif /* HAVE_NAPATECH */
43 
44 typedef enum {
52 
53 enum PktSrcEnum {
67 };
68 
69 #include "source-nflog.h"
70 #include "source-nfq.h"
71 #include "source-ipfw.h"
72 #include "source-pcap.h"
73 #include "source-af-packet.h"
74 #include "source-netmap.h"
75 #include "source-windivert.h"
76 #ifdef HAVE_DPDK
77 #include "source-dpdk.h"
78 #endif
79 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
80 #include "source-pfring.h"
81 #endif
82 #ifdef HAVE_AF_XDP
83 #include "source-af-xdp.h"
84 #endif
85 
86 #include "decode-ethernet.h"
87 #include "decode-gre.h"
88 #include "decode-ppp.h"
89 #include "decode-pppoe.h"
90 #include "decode-ipv4.h"
91 #include "decode-ipv6.h"
92 #include "decode-icmpv4.h"
93 #include "decode-icmpv6.h"
94 #include "decode-tcp.h"
95 #include "decode-udp.h"
96 #include "decode-sctp.h"
97 #include "decode-esp.h"
98 #include "decode-vlan.h"
99 #include "decode-mpls.h"
100 
101 
102 /* forward declarations */
103 struct DetectionEngineThreadCtx_;
105 
106 struct PktPool_;
107 
108 /* declare these here as they are called from the
109  * PACKET_RECYCLE and PACKET_CLEANUP macro's. */
113 
114 /* Address */
115 typedef struct Address_ {
116  char family;
117  union {
118  uint32_t address_un_data32[4]; /* type-specific field */
119  uint16_t address_un_data16[8]; /* type-specific field */
120  uint8_t address_un_data8[16]; /* type-specific field */
121  struct in6_addr address_un_in6;
124 
125 #define addr_data32 address.address_un_data32
126 #define addr_data16 address.address_un_data16
127 #define addr_data8 address.address_un_data8
128 #define addr_in6addr address.address_un_in6
129 
130 #define COPY_ADDRESS(a, b) do { \
131  (b)->family = (a)->family; \
132  (b)->addr_data32[0] = (a)->addr_data32[0]; \
133  (b)->addr_data32[1] = (a)->addr_data32[1]; \
134  (b)->addr_data32[2] = (a)->addr_data32[2]; \
135  (b)->addr_data32[3] = (a)->addr_data32[3]; \
136  } while (0)
137 
138 /* Set the IPv4 addresses into the Addrs of the Packet.
139  * Make sure p->ip4h is initialized and validated.
140  *
141  * We set the rest of the struct to 0 so we can
142  * prevent using memset. */
143 #define SET_IPV4_SRC_ADDR(p, a) do { \
144  (a)->family = AF_INET; \
145  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
146  (a)->addr_data32[1] = 0; \
147  (a)->addr_data32[2] = 0; \
148  (a)->addr_data32[3] = 0; \
149  } while (0)
150 
151 #define SET_IPV4_DST_ADDR(p, a) do { \
152  (a)->family = AF_INET; \
153  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
154  (a)->addr_data32[1] = 0; \
155  (a)->addr_data32[2] = 0; \
156  (a)->addr_data32[3] = 0; \
157  } while (0)
158 
159 /* Set the IPv6 addresses into the Addrs of the Packet.
160  * Make sure p->ip6h is initialized and validated. */
161 #define SET_IPV6_SRC_ADDR(p, a) do { \
162  (a)->family = AF_INET6; \
163  (a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \
164  (a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \
165  (a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \
166  (a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \
167  } while (0)
168 
169 #define SET_IPV6_DST_ADDR(p, a) do { \
170  (a)->family = AF_INET6; \
171  (a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \
172  (a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \
173  (a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \
174  (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \
175  } while (0)
176 
177 /* Set the TCP ports into the Ports of the Packet.
178  * Make sure p->tcph is initialized and validated. */
179 #define SET_TCP_SRC_PORT(pkt, prt) do { \
180  SET_PORT(TCP_GET_SRC_PORT((pkt)), *(prt)); \
181  } while (0)
182 
183 #define SET_TCP_DST_PORT(pkt, prt) do { \
184  SET_PORT(TCP_GET_DST_PORT((pkt)), *(prt)); \
185  } while (0)
186 
187 /* Set the UDP ports into the Ports of the Packet.
188  * Make sure p->udph is initialized and validated. */
189 #define SET_UDP_SRC_PORT(pkt, prt) do { \
190  SET_PORT(UDP_GET_SRC_PORT((pkt)), *(prt)); \
191  } while (0)
192 #define SET_UDP_DST_PORT(pkt, prt) do { \
193  SET_PORT(UDP_GET_DST_PORT((pkt)), *(prt)); \
194  } while (0)
195 
196 /* Set the SCTP ports into the Ports of the Packet.
197  * Make sure p->sctph is initialized and validated. */
198 #define SET_SCTP_SRC_PORT(pkt, prt) do { \
199  SET_PORT(SCTP_GET_SRC_PORT((pkt)), *(prt)); \
200  } while (0)
201 
202 #define SET_SCTP_DST_PORT(pkt, prt) do { \
203  SET_PORT(SCTP_GET_DST_PORT((pkt)), *(prt)); \
204  } while (0)
205 
206 
207 #define GET_IPV4_SRC_ADDR_U32(p) ((p)->src.addr_data32[0])
208 #define GET_IPV4_DST_ADDR_U32(p) ((p)->dst.addr_data32[0])
209 #define GET_IPV4_SRC_ADDR_PTR(p) ((p)->src.addr_data32)
210 #define GET_IPV4_DST_ADDR_PTR(p) ((p)->dst.addr_data32)
211 
212 #define GET_IPV6_SRC_IN6ADDR(p) ((p)->src.addr_in6addr)
213 #define GET_IPV6_DST_IN6ADDR(p) ((p)->dst.addr_in6addr)
214 #define GET_IPV6_SRC_ADDR(p) ((p)->src.addr_data32)
215 #define GET_IPV6_DST_ADDR(p) ((p)->dst.addr_data32)
216 #define GET_TCP_SRC_PORT(p) ((p)->sp)
217 #define GET_TCP_DST_PORT(p) ((p)->dp)
218 
219 #define GET_PKT_LEN(p) (p)->pktlen
220 #define GET_PKT_DATA(p) (((p)->ext_pkt == NULL) ? GET_PKT_DIRECT_DATA(p) : (p)->ext_pkt)
221 #define GET_PKT_DIRECT_DATA(p) (p)->pkt_data
222 #define GET_PKT_DIRECT_MAX_SIZE(p) (default_packet_size)
223 
224 #define SET_PKT_LEN(p, len) do { \
225  (p)->pktlen = (len); \
226  } while (0)
227 
228 /* Port is just a uint16_t */
229 typedef uint16_t Port;
230 #define SET_PORT(v, p) ((p) = (v))
231 #define COPY_PORT(a,b) ((b) = (a))
232 
233 #define CMP_ADDR(a1, a2) \
234  (((a1)->addr_data32[3] == (a2)->addr_data32[3] && \
235  (a1)->addr_data32[2] == (a2)->addr_data32[2] && \
236  (a1)->addr_data32[1] == (a2)->addr_data32[1] && \
237  (a1)->addr_data32[0] == (a2)->addr_data32[0]))
238 #define CMP_PORT(p1, p2) \
239  ((p1) == (p2))
240 
241 /*Given a packet pkt offset to the start of the ip header in a packet
242  *We determine the ip version. */
243 #define IP_GET_RAW_VER(pkt) ((((pkt)[0] & 0xf0) >> 4))
244 
245 #define PKT_IS_IPV4(p) (((p)->ip4h != NULL))
246 #define PKT_IS_IPV6(p) (((p)->ip6h != NULL))
247 #define PKT_IS_TCP(p) (((p)->tcph != NULL))
248 #define PKT_IS_UDP(p) (((p)->udph != NULL))
249 #define PKT_IS_ICMPV4(p) (((p)->icmpv4h != NULL))
250 #define PKT_IS_ICMPV6(p) (((p)->icmpv6h != NULL))
251 #define PKT_IS_TOSERVER(p) (((p)->flowflags & FLOW_PKT_TOSERVER))
252 #define PKT_IS_TOCLIENT(p) (((p)->flowflags & FLOW_PKT_TOCLIENT))
253 
254 #define IPH_IS_VALID(p) (PKT_IS_IPV4((p)) || PKT_IS_IPV6((p)))
255 
256 /* Retrieve proto regardless of IP version */
257 #define IP_GET_IPPROTO(p) \
258  (p->proto ? p->proto : \
259  (PKT_IS_IPV4((p))? IPV4_GET_IPPROTO((p)) : (PKT_IS_IPV6((p))? IPV6_GET_L4PROTO((p)) : 0)))
260 
261 /* structure to store the sids/gids/etc the detection engine
262  * found in this packet */
263 typedef struct PacketAlert_ {
264  SigIntId num; /* Internal num, used for sorting */
265  uint8_t action; /* Internal num, used for thresholding */
266  uint8_t flags;
267  const struct Signature_ *s;
268  uint64_t tx_id; /* Used for sorting */
269  int64_t frame_id;
271 
272 /* flag to indicate the rule action (drop/pass) needs to be applied to the flow */
273 #define PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW 0x1
274 /** alert was generated based on state */
275 #define PACKET_ALERT_FLAG_STATE_MATCH 0x02
276 /** alert was generated based on stream */
277 #define PACKET_ALERT_FLAG_STREAM_MATCH 0x04
278 /** alert is in a tx, tx_id set */
279 #define PACKET_ALERT_FLAG_TX 0x08
280 /** action was changed by rate_filter */
281 #define PACKET_ALERT_RATE_FILTER_MODIFIED 0x10
282 /** alert is in a frame, frame_id set */
283 #define PACKET_ALERT_FLAG_FRAME 0x20
284 
285 extern uint16_t packet_alert_max;
286 #define PACKET_ALERT_MAX 15
287 
288 typedef struct PacketAlerts_ {
289  uint16_t cnt;
290  uint16_t discarded;
291  uint16_t suppressed;
293  /* single pa used when we're dropping,
294  * so we can log it out in the drop log. */
297 
299 
300 void PacketAlertFree(PacketAlert *pa);
301 
302 /** number of decoder events we support per packet. Power of 2 minus 1
303  * for memory layout */
304 #define PACKET_ENGINE_EVENT_MAX 15
305 
306 /** data structure to store decoder, defrag and stream events */
307 typedef struct PacketEngineEvents_ {
308  uint8_t cnt; /**< number of events */
309  uint8_t events[PACKET_ENGINE_EVENT_MAX]; /**< array of events */
311 
312 typedef struct PktVar_ {
313  uint32_t id;
314  struct PktVar_ *next; /* right now just implement this as a list,
315  * in the long run we have thing of something
316  * faster. */
317  uint16_t key_len;
318  uint16_t value_len;
319  uint8_t *key;
320  uint8_t *value;
322 
323 #ifdef PROFILING
324 
325 /** \brief Per TMM stats storage */
326 typedef struct PktProfilingTmmData_ {
327  uint64_t ticks_start;
328  uint64_t ticks_end;
329 #ifdef PROFILE_LOCKING
330  uint64_t mutex_lock_cnt;
331  uint64_t mutex_lock_wait_ticks;
332  uint64_t mutex_lock_contention;
333  uint64_t spin_lock_cnt;
334  uint64_t spin_lock_wait_ticks;
335  uint64_t spin_lock_contention;
336  uint64_t rww_lock_cnt;
337  uint64_t rww_lock_wait_ticks;
338  uint64_t rww_lock_contention;
339  uint64_t rwr_lock_cnt;
340  uint64_t rwr_lock_wait_ticks;
341  uint64_t rwr_lock_contention;
342 #endif
344 
345 typedef struct PktProfilingData_ {
346  uint64_t ticks_start;
347  uint64_t ticks_end;
349 
350 typedef struct PktProfilingDetectData_ {
351  uint64_t ticks_start;
352  uint64_t ticks_end;
353  uint64_t ticks_spent;
355 
356 typedef struct PktProfilingAppData_ {
357  uint64_t ticks_spent;
359 
360 typedef struct PktProfilingLoggerData_ {
361  uint64_t ticks_start;
362  uint64_t ticks_end;
363  uint64_t ticks_spent;
365 
367  uint64_t ticks_spent;
369 
372  uint32_t size; /**< array size */
374 
375 /** \brief Per pkt stats storage */
376 typedef struct PktProfiling_ {
377  uint64_t ticks_start;
378  uint64_t ticks_end;
379 
385  uint64_t proto_detect;
387 
388 #endif /* PROFILING */
389 
400  PKT_DROP_REASON_RULES_THRESHOLD, /**< detection_filter in action */
405  PKT_DROP_REASON_NFQ_ERROR, /**< no nfq verdict, must be error */
406  PKT_DROP_REASON_INNER_PACKET, /**< drop issued by inner (tunnel) packet */
408 };
409 
410 /* forward declaration since Packet struct definition requires this */
411 struct PacketQueue_;
412 
413 /* sizes of the members:
414  * src: 17 bytes
415  * dst: 17 bytes
416  * sp/type: 1 byte
417  * dp/code: 1 byte
418  * proto: 1 byte
419  * recurs: 1 byte
420  *
421  * sum of above: 38 bytes
422  *
423  * flow ptr: 4/8 bytes
424  * flags: 1 byte
425  * flowflags: 1 byte
426  *
427  * sum of above 44/48 bytes
428  */
429 typedef struct Packet_
430 {
431  /* Addresses, Ports and protocol
432  * these are on top so we can use
433  * the Packet as a hash key */
436  union {
438  // icmp type and code of this packet
439  struct {
440  uint8_t type;
441  uint8_t code;
443  };
444  union {
446  // icmp type and code of the expected counterpart (for flows)
447  struct {
448  uint8_t type;
449  uint8_t code;
451  };
452  uint8_t proto;
453  /* make sure we can't be attacked on when the tunneled packet
454  * has the exact same tuple as the lower levels */
456 
458  uint8_t vlan_idx;
459 
460  /* flow */
461  uint8_t flowflags;
462  /* coccinelle: Packet:flowflags:FLOW_PKT_ */
463 
464  uint8_t app_update_direction; // enum StreamUpdateDir
465 
466  /* Pkt Flags */
467  uint32_t flags;
468 
469  struct Flow_ *flow;
470 
471  /* raw hash value for looking up the flow, will need to modulated to the
472  * hash size still */
473  uint32_t flow_hash;
474 
476 
477  union {
478  /* nfq stuff */
479 #ifdef HAVE_NFLOG
480  NFLOGPacketVars nflog_v;
481 #endif /* HAVE_NFLOG */
482 #ifdef NFQ
484 #endif /* NFQ */
485 #ifdef IPFW
487 #endif /* IPFW */
488 #ifdef AF_PACKET
489  AFPPacketVars afp_v;
490 #endif
491 #ifdef HAVE_NETMAP
492  NetmapPacketVars netmap_v;
493 #endif
494 #ifdef HAVE_PFRING
495 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
496  PfringPacketVars pfring_v;
497 #endif
498 #endif
499 #ifdef WINDIVERT
500  WinDivertPacketVars windivert_v;
501 #endif /* WINDIVERT */
502 #ifdef HAVE_DPDK
503  DPDKPacketVars dpdk_v;
504 #endif
505 #ifdef HAVE_NAPATECH
507 #endif
508 #ifdef HAVE_AF_XDP
509  AFXDPPacketVars afxdp_v;
510 #endif
511  /* A chunk of memory that a plugin can use for its packet vars. */
513 
514  /** libpcap vars: shared by Pcap Live mode and Pcap File mode */
516  };
517 
518  /** The release function for packet structure and data */
519  void (*ReleasePacket)(struct Packet_ *);
520  /** The function triggering bypass the flow in the capture method.
521  * Return 1 for success and 0 on error */
522  int (*BypassPacketsFlow)(struct Packet_ *);
523 
524  /* pkt vars */
526 
527  /* header pointers */
528  EthernetHdr *ethh;
529 
530  /* Checksum for IP packets. */
532  /* Check sum for TCP, UDP or ICMP packets */
534 
536 
538 
539  /* IPv4 and IPv6 are mutually exclusive */
540  union {
542  struct {
545  };
546  };
547  /* Can only be one of TCP, UDP, ICMP at any given time */
548  union {
553 #define tcpvars l4vars.tcpvars
554 #define icmpv4vars l4vars.icmpv4vars
555 #define icmpv6vars l4vars.icmpv6vars
556 
557  TCPHdr *tcph;
558 
559  UDPHdr *udph;
560 
561  SCTPHdr *sctph;
562 
563  ESPHdr *esph;
564 
565  ICMPV4Hdr *icmpv4h;
566 
568 
569  PPPHdr *ppph;
571  PPPOEDiscoveryHdr *pppoedh;
572 
573  GREHdr *greh;
574 
575  /* ptr to the payload of the packet
576  * with it's length. */
577  uint8_t *payload;
578  uint16_t payload_len;
579 
580  /* IPS action to take */
581  uint8_t action;
582 
583  uint8_t pkt_src;
584 
585  /* storage: set to pointer to heap and extended via allocation if necessary */
586  uint32_t pktlen;
587  uint8_t *ext_pkt;
588 
589  /* Incoming interface */
591 
593 
594  struct Host_ *host_src;
595  struct Host_ *host_dst;
596 
597  /** packet number in the pcap file, matches wireshark */
598  uint64_t pcap_cnt;
599 
600 
601  /* engine events */
603 
605 
606  /* double linked list ptrs */
607  struct Packet_ *next;
608  struct Packet_ *prev;
609 
610  /** data linktype in host order */
611  int datalink;
612 
613  /* count decoded layers of packet : too many layers
614  * cause issues with performance and stability (stack exhaustion)
615  */
617 
618  /* enum PacketDropReason::PKT_DROP_REASON_* as uint8_t for compactness */
619  uint8_t drop_reason;
620 
621  /* tunnel/encapsulation handling */
622  struct Packet_ *root; /* in case of tunnel this is a ptr
623  * to the 'real' packet, the one we
624  * need to set the verdict on --
625  * It should always point to the lowest
626  * packet in a encapsulated packet */
627 
628  /* ready to set verdict counter, only set in root */
629  uint16_t tunnel_rtv_cnt;
630  /* tunnel packet ref count */
631  uint16_t tunnel_tpr_cnt;
632 
633  /** tenant id for this packet, if any. If 0 then no tenant was assigned. */
634  uint32_t tenant_id;
635 
636  /* The Packet pool from which this packet was allocated. Used when returning
637  * the packet to its owner's stack. If NULL, then allocated with malloc.
638  */
639  struct PktPool_ *pool;
640 
641 #ifdef PROFILING
643 #endif
644  /* things in the packet that live beyond a reinit */
645  struct {
646  /** lock to protect access to:
647  * - tunnel_rtv_cnt
648  * - tunnel_tpr_cnt
649  * - nfq_v.mark
650  * - flags
651  */
654 
655  /** flex array accessor to allocated packet data. Size of the additional
656  * data is `default_packet_size`. If this is insufficient,
657  * Packet::ext_pkt will be used instead. */
658  uint8_t pkt_data[];
660 
661 /** highest mtu of the interfaces we monitor */
662 #define DEFAULT_MTU 1500
663 #define MINIMUM_MTU 68 /**< ipv4 minimum: rfc791 */
664 
665 #define DEFAULT_PACKET_SIZE (DEFAULT_MTU + ETHERNET_HEADER_LEN)
666 /* storage: maximum ip packet size + link header */
667 #define MAX_PAYLOAD_SIZE (IPV6_HEADER_LEN + 65536 + 28)
668 extern uint32_t default_packet_size;
669 #define SIZE_OF_PACKET (default_packet_size + sizeof(Packet))
670 
671 /** \brief Structure to hold thread specific data for all decode modules */
672 typedef struct DecodeThreadVars_
673 {
674  /** Specific context for udp protocol detection (here atm) */
676 
677  /** stats/counters */
678  uint16_t counter_pkts;
679  uint16_t counter_bytes;
684 
685  uint16_t counter_invalid;
686 
687  uint16_t counter_eth;
688  uint16_t counter_chdlc;
689  uint16_t counter_ipv4;
690  uint16_t counter_ipv6;
691  uint16_t counter_tcp;
692  uint16_t counter_tcp_syn;
694  uint16_t counter_tcp_rst;
695  uint16_t counter_udp;
696  uint16_t counter_icmpv4;
697  uint16_t counter_icmpv6;
698  uint16_t counter_arp;
700 
701  uint16_t counter_sll;
702  uint16_t counter_raw;
703  uint16_t counter_null;
704  uint16_t counter_sctp;
705  uint16_t counter_esp;
706  uint16_t counter_ppp;
707  uint16_t counter_geneve;
708  uint16_t counter_gre;
709  uint16_t counter_vlan;
712  uint16_t counter_vxlan;
713  uint16_t counter_vntag;
715  uint16_t counter_pppoe;
716  uint16_t counter_teredo;
717  uint16_t counter_mpls;
720  uint16_t counter_erspan;
721  uint16_t counter_nsh;
722 
723  /** frag stats - defrag runs in the context of the decoder. */
729 
731 
745 
750 
752 
753  /* thread data for flow logging api: only used at forced
754  * flow recycle during lookups */
756 
758 
759 void CaptureStatsUpdate(ThreadVars *tv, const Packet *p);
761 
762 #define PACKET_CLEAR_L4VARS(p) do { \
763  memset(&(p)->l4vars, 0x00, sizeof((p)->l4vars)); \
764  } while (0)
765 
766 /**
767  * \brief reset these to -1(indicates that the packet is fresh from the queue)
768  */
769 #define PACKET_RESET_CHECKSUMS(p) do { \
770  (p)->level3_comp_csum = -1; \
771  (p)->level4_comp_csum = -1; \
772  } while (0)
773 
774 /* if p uses extended data, free them */
775 #define PACKET_FREE_EXTDATA(p) do { \
776  if ((p)->ext_pkt) { \
777  if (!((p)->flags & PKT_ZERO_COPY)) { \
778  SCFree((p)->ext_pkt); \
779  } \
780  (p)->ext_pkt = NULL; \
781  } \
782  } while(0)
783 
784 #define TUNNEL_INCR_PKT_RTV_NOLOCK(p) do { \
785  ((p)->root ? (p)->root->tunnel_rtv_cnt++ : (p)->tunnel_rtv_cnt++); \
786  } while (0)
787 
788 static inline void TUNNEL_INCR_PKT_TPR(Packet *p)
789 {
790  Packet *rp = p->root ? p->root : p;
792  rp->tunnel_tpr_cnt++;
794 }
795 
796 #define TUNNEL_PKT_RTV(p) ((p)->root ? (p)->root->tunnel_rtv_cnt : (p)->tunnel_rtv_cnt)
797 #define TUNNEL_PKT_TPR(p) ((p)->root ? (p)->root->tunnel_tpr_cnt : (p)->tunnel_tpr_cnt)
798 
799 #define IS_TUNNEL_PKT(p) (((p)->flags & PKT_TUNNEL))
800 #define SET_TUNNEL_PKT(p) ((p)->flags |= PKT_TUNNEL)
801 #define UNSET_TUNNEL_PKT(p) ((p)->flags &= ~PKT_TUNNEL)
802 #define IS_TUNNEL_ROOT_PKT(p) (IS_TUNNEL_PKT(p) && (p)->root == NULL)
803 
804 #define IS_TUNNEL_PKT_VERDICTED(p) (((p)->flags & PKT_TUNNEL_VERDICTED))
805 #define SET_TUNNEL_PKT_VERDICTED(p) ((p)->flags |= PKT_TUNNEL_VERDICTED)
806 
814  DECODE_TUNNEL_IPV6_TEREDO, /**< separate protocol for stricter error handling */
818 };
819 
821  const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto);
822 Packet *PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto);
823 void PacketDefragPktSetupParent(Packet *parent);
830 void PacketFree(Packet *p);
831 void PacketFreeOrRelease(Packet *p);
832 int PacketCallocExtPkt(Packet *p, int datalen);
833 int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen);
834 int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen);
835 int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen);
836 const char *PktSrcToString(enum PktSrcEnum pkt_src);
838 void PacketSwap(Packet *p);
839 
843  const DecodeThreadVars *dtv, const Packet *p);
844 const char *PacketDropReasonToString(enum PacketDropReason r);
845 
846 /* decoder functions */
847 int DecodeEthernet(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
848 int DecodeSll(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
849 int DecodePPP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
850 int DecodePPPOESession(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
851 int DecodePPPOEDiscovery(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
852 int DecodeNull(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
853 int DecodeRaw(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
854 int DecodeIPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
855 int DecodeIPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
856 int DecodeICMPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
857 int DecodeICMPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
858 int DecodeTCP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
859 int DecodeUDP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
860 int DecodeSCTP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
861 int DecodeESP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
862 int DecodeGRE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
863 int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
864 int DecodeVNTag(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
865 int DecodeIEEE8021ah(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
866 int DecodeGeneve(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
867 int DecodeVXLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
868 int DecodeMPLS(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
869 int DecodeERSPAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
870 int DecodeERSPANTypeI(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
871 int DecodeCHDLC(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
872 int DecodeTEMPLATE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
873 int DecodeNSH(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
874 
875 #ifdef UNITTESTS
876 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
877  uint16_t hdrextlen, uint16_t plen,
878  uint16_t prev_hdrextlen);
879 #endif
880 
881 void AddressDebugPrint(Address *);
882 
884  const uint8_t *pkt, uint32_t len);
885 void DecodeGlobalConfig(void);
886 void PacketAlertGetMaxConfig(void);
887 void DecodeUnregisterCounters(void);
888 
889 #define ENGINE_SET_EVENT(p, e) do { \
890  SCLogDebug("p %p event %d", (p), e); \
891  if ((p)->events.cnt < PACKET_ENGINE_EVENT_MAX) { \
892  (p)->events.events[(p)->events.cnt] = e; \
893  (p)->events.cnt++; \
894  } \
895 } while(0)
896 
897 #define ENGINE_SET_INVALID_EVENT(p, e) do { \
898  p->flags |= PKT_IS_INVALID; \
899  ENGINE_SET_EVENT(p, e); \
900 } while(0)
901 
902 
903 
904 #define ENGINE_ISSET_EVENT(p, e) ({ \
905  int r = 0; \
906  uint8_t u; \
907  for (u = 0; u < (p)->events.cnt; u++) { \
908  if ((p)->events.events[u] == (e)) { \
909  r = 1; \
910  break; \
911  } \
912  } \
913  r; \
914 })
915 
916 #ifndef IPPROTO_IPIP
917 #define IPPROTO_IPIP 4
918 #endif
919 
920 /* older libcs don't contain a def for IPPROTO_DCCP
921  * inside of <netinet/in.h>
922  * if it isn't defined let's define it here.
923  */
924 #ifndef IPPROTO_DCCP
925 #define IPPROTO_DCCP 33
926 #endif
927 
928 /* older libcs don't contain a def for IPPROTO_SCTP
929  * inside of <netinet/in.h>
930  * if it isn't defined let's define it here.
931  */
932 #ifndef IPPROTO_SCTP
933 #define IPPROTO_SCTP 132
934 #endif
935 
936 #ifndef IPPROTO_MH
937 #define IPPROTO_MH 135
938 #endif
939 
940 /* Host Identity Protocol (rfc 5201) */
941 #ifndef IPPROTO_HIP
942 #define IPPROTO_HIP 139
943 #endif
944 
945 #ifndef IPPROTO_SHIM6
946 #define IPPROTO_SHIM6 140
947 #endif
948 
949 /* pcap provides this, but we don't want to depend on libpcap */
950 #ifndef DLT_EN10MB
951 #define DLT_EN10MB 1
952 #endif
953 
954 #ifndef DLT_C_HDLC
955 #define DLT_C_HDLC 104
956 #endif
957 
958 /* taken from pcap's bpf.h */
959 #ifndef DLT_RAW
960 #ifdef __OpenBSD__
961 #define DLT_RAW 14 /* raw IP */
962 #else
963 #define DLT_RAW 12 /* raw IP */
964 #endif
965 #endif
966 
967 #ifndef DLT_NULL
968 #define DLT_NULL 0
969 #endif
970 
971 /** libpcap shows us the way to linktype codes
972  * \todo we need more & maybe put them in a separate file? */
973 #define LINKTYPE_NULL DLT_NULL
974 #define LINKTYPE_ETHERNET DLT_EN10MB
975 #define LINKTYPE_LINUX_SLL 113
976 #define LINKTYPE_PPP 9
977 #define LINKTYPE_RAW DLT_RAW
978 /* http://www.tcpdump.org/linktypes.html defines DLT_RAW as 101, yet others don't.
979  * Libpcap on at least OpenBSD returns 101 as datalink type for RAW pcaps though. */
980 #define LINKTYPE_RAW2 101
981 #define LINKTYPE_IPV4 228
982 #define LINKTYPE_GRE_OVER_IP 778
983 #define LINKTYPE_CISCO_HDLC DLT_C_HDLC
984 #define PPP_OVER_GRE 11
985 #define VLAN_OVER_GRE 13
986 
987 /* Packet Flags */
988 
989 /** Flag to indicate that packet header or contents should not be inspected */
990 #define PKT_NOPACKET_INSPECTION BIT_U32(0)
991 // vacancy
992 
993 /** Flag to indicate that packet contents should not be inspected */
994 #define PKT_NOPAYLOAD_INSPECTION BIT_U32(2)
995 // vacancy
996 
997 /** Packet has matched a tag */
998 #define PKT_HAS_TAG BIT_U32(4)
999 /** Packet payload was added to reassembled stream */
1000 #define PKT_STREAM_ADD BIT_U32(5)
1001 /** Packet is part of established stream */
1002 #define PKT_STREAM_EST BIT_U32(6)
1003 /** Stream is in eof state */
1004 #define PKT_STREAM_EOF BIT_U32(7)
1005 #define PKT_HAS_FLOW BIT_U32(8)
1006 /** Pseudo packet to end the stream */
1007 #define PKT_PSEUDO_STREAM_END BIT_U32(9)
1008 /** Packet is modified by the stream engine, we need to recalc the csum and \
1009  reinject/replace */
1010 #define PKT_STREAM_MODIFIED BIT_U32(10)
1011 /** Packet mark is modified */
1012 #define PKT_MARK_MODIFIED BIT_U32(11)
1013 /** Exclude packet from pcap logging as it's part of a stream that has reassembly \
1014  depth reached. */
1015 #define PKT_STREAM_NOPCAPLOG BIT_U32(12)
1017 #define PKT_TUNNEL BIT_U32(13)
1018 #define PKT_TUNNEL_VERDICTED BIT_U32(14)
1020 /** Packet checksum is not computed (TX packet for example) */
1021 #define PKT_IGNORE_CHECKSUM BIT_U32(15)
1022 /** Packet comes from zero copy (ext_pkt must not be freed) */
1023 #define PKT_ZERO_COPY BIT_U32(16)
1025 #define PKT_HOST_SRC_LOOKED_UP BIT_U32(17)
1026 #define PKT_HOST_DST_LOOKED_UP BIT_U32(18)
1028 /** Packet is a fragment */
1029 #define PKT_IS_FRAGMENT BIT_U32(19)
1030 #define PKT_IS_INVALID BIT_U32(20)
1031 #define PKT_PROFILE BIT_U32(21)
1033 /** indication by decoder that it feels the packet should be handled by
1034  * flow engine: Packet::flow_hash will be set */
1035 #define PKT_WANTS_FLOW BIT_U32(22)
1037 /** protocol detection done */
1038 #define PKT_PROTO_DETECT_TS_DONE BIT_U32(23)
1039 #define PKT_PROTO_DETECT_TC_DONE BIT_U32(24)
1041 #define PKT_REBUILT_FRAGMENT \
1042  BIT_U32(25) /**< Packet is rebuilt from \
1043  * fragments. */
1044 #define PKT_DETECT_HAS_STREAMDATA \
1045  BIT_U32(26) /**< Set by Detect() if raw stream data is available. */
1047 #define PKT_PSEUDO_DETECTLOG_FLUSH BIT_U32(27) /**< Detect/log flush for protocol upgrade */
1049 /** Packet is part of stream in known bad condition (loss, wrong thread),
1050  * so flag it for not setting stream events */
1051 #define PKT_STREAM_NO_EVENTS BIT_U32(28)
1053 /** We had no alert on flow before this packet */
1054 #define PKT_FIRST_ALERTS BIT_U32(29)
1055 #define PKT_FIRST_TAG BIT_U32(30)
1057 /** \brief return 1 if the packet is a pseudo packet */
1058 #define PKT_IS_PSEUDOPKT(p) \
1059  ((p)->flags & (PKT_PSEUDO_STREAM_END|PKT_PSEUDO_DETECTLOG_FLUSH))
1060 
1061 #define PKT_SET_SRC(p, src_val) ((p)->pkt_src = src_val)
1063 #define PKT_DEFAULT_MAX_DECODED_LAYERS 16
1064 extern uint8_t decoder_max_layers;
1065 
1066 static inline bool PacketIncreaseCheckLayers(Packet *p)
1067 {
1068  p->nb_decoded_layers++;
1071  return false;
1072  }
1073  return true;
1074 }
1075 
1076 /** \brief Set the No payload inspection Flag for the packet.
1077  *
1078  * \param p Packet to set the flag in
1079  */
1080 static inline void DecodeSetNoPayloadInspectionFlag(Packet *p)
1081 {
1083 }
1084 
1085 /** \brief Set the No packet inspection Flag for the packet.
1086  *
1087  * \param p Packet to set the flag in
1088  */
1089 static inline void DecodeSetNoPacketInspectionFlag(Packet *p)
1090 {
1092 }
1093 
1094 /** \brief return true if *this* packet needs to trigger a verdict.
1095  *
1096  * If we have the root packet, and we have none outstanding,
1097  * we can verdict now.
1098  *
1099  * If we have a upper layer packet, it's the only one and root
1100  * is already processed, we can verdict now.
1101  *
1102  * Otherwise, a future packet will issue the verdict.
1103  */
1104 static inline bool VerdictTunnelPacket(Packet *p)
1105 {
1106  bool verdict = true;
1108  SCSpinLock(lock);
1109  const uint16_t outstanding = TUNNEL_PKT_TPR(p) - TUNNEL_PKT_RTV(p);
1110  SCLogDebug("tunnel: outstanding %u", outstanding);
1111 
1112  /* if there are packets outstanding, we won't verdict this one */
1113  if (IS_TUNNEL_ROOT_PKT(p) && !IS_TUNNEL_PKT_VERDICTED(p) && !outstanding) {
1114  // verdict
1115  SCLogDebug("root %p: verdict", p);
1116  } else if (!IS_TUNNEL_ROOT_PKT(p) && outstanding == 1 && p->root && IS_TUNNEL_PKT_VERDICTED(p->root)) {
1117  // verdict
1118  SCLogDebug("tunnel %p: verdict", p);
1119  } else {
1120  verdict = false;
1121  }
1122  SCSpinUnlock(lock);
1123  return verdict;
1124 }
1125 
1126 static inline void DecodeLinkLayer(ThreadVars *tv, DecodeThreadVars *dtv,
1127  const int datalink, Packet *p, const uint8_t *data, const uint32_t len)
1128 {
1129  /* call the decoder */
1130  switch (datalink) {
1131  case LINKTYPE_ETHERNET:
1132  DecodeEthernet(tv, dtv, p, data, len);
1133  break;
1134  case LINKTYPE_LINUX_SLL:
1135  DecodeSll(tv, dtv, p, data, len);
1136  break;
1137  case LINKTYPE_PPP:
1138  DecodePPP(tv, dtv, p, data, len);
1139  break;
1140  case LINKTYPE_RAW:
1141  case LINKTYPE_GRE_OVER_IP:
1142  DecodeRaw(tv, dtv, p, data, len);
1143  break;
1144  case LINKTYPE_NULL:
1145  DecodeNull(tv, dtv, p, data, len);
1146  break;
1147  case LINKTYPE_CISCO_HDLC:
1148  DecodeCHDLC(tv, dtv, p, data, len);
1149  break;
1150  default:
1151  SCLogError("datalink type "
1152  "%" PRId32 " not yet supported",
1153  datalink);
1154  break;
1155  }
1156 }
1157 
1158 /** \brief decode network layer
1159  * \retval bool true if successful, false if unknown */
1160 static inline bool DecodeNetworkLayer(ThreadVars *tv, DecodeThreadVars *dtv,
1161  const uint16_t proto, Packet *p, const uint8_t *data, const uint32_t len)
1162 {
1163  switch (proto) {
1164  case ETHERNET_TYPE_IP: {
1165  uint16_t ip_len = (len < USHRT_MAX) ? (uint16_t)len : (uint16_t)USHRT_MAX;
1166  DecodeIPV4(tv, dtv, p, data, ip_len);
1167  break;
1168  }
1169  case ETHERNET_TYPE_IPV6: {
1170  uint16_t ip_len = (len < USHRT_MAX) ? (uint16_t)len : (uint16_t)USHRT_MAX;
1171  DecodeIPV6(tv, dtv, p, data, ip_len);
1172  break;
1173  }
1175  DecodePPPOESession(tv, dtv, p, data, len);
1176  break;
1178  DecodePPPOEDiscovery(tv, dtv, p, data, len);
1179  break;
1180  case ETHERNET_TYPE_VLAN:
1181  case ETHERNET_TYPE_8021AD:
1183  if (p->vlan_idx > VLAN_MAX_LAYER_IDX) {
1185  } else {
1186  DecodeVLAN(tv, dtv, p, data, len);
1187  }
1188  break;
1189  case ETHERNET_TYPE_8021AH:
1190  DecodeIEEE8021ah(tv, dtv, p, data, len);
1191  break;
1192  case ETHERNET_TYPE_ARP:
1194  break;
1197  DecodeMPLS(tv, dtv, p, data, len);
1198  break;
1199  case ETHERNET_TYPE_DCE:
1202  } else {
1203  // DCE layer is ethernet + 2 bytes, followed by another ethernet
1204  DecodeEthernet(tv, dtv, p, data + 2, len - 2);
1205  }
1206  break;
1207  case ETHERNET_TYPE_VNTAG:
1208  DecodeVNTag(tv, dtv, p, data, len);
1209  break;
1210  case ETHERNET_TYPE_NSH:
1211  DecodeNSH(tv, dtv, p, data, len);
1212  break;
1213  default:
1214  SCLogDebug("unknown ether type: %" PRIx16 "", proto);
1216  return false;
1217  }
1218  return true;
1219 }
1220 
1221 #endif /* __DECODE_H__ */
suricata-plugin.h
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:889
DecodeThreadVars_::counter_flow_get_used_eval_busy
uint16_t counter_flow_get_used_eval_busy
Definition: decode.h:743
PKT_DROP_REASON_DEFRAG_MEMCAP
@ PKT_DROP_REASON_DEFRAG_MEMCAP
Definition: decode.h:394
Packet_::greh
GREHdr * greh
Definition: decode.h:573
PKT_DROP_REASON_DEFRAG_ERROR
@ PKT_DROP_REASON_DEFRAG_ERROR
Definition: decode.h:393
decode-ethernet.h
decode-tcp.h
DecodeThreadVars_::counter_defrag_ipv4_reassembled
uint16_t counter_defrag_ipv4_reassembled
Definition: decode.h:725
Packet_::proto
uint8_t proto
Definition: decode.h:452
spin_lock_cnt
thread_local uint64_t spin_lock_cnt
PKT_DROP_REASON_RULES_THRESHOLD
@ PKT_DROP_REASON_RULES_THRESHOLD
Definition: decode.h:400
DecodeIPV6
int DecodeIPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-ipv6.c:564
DecodeERSPAN
int DecodeERSPAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
ERSPAN Type II.
Definition: decode-erspan.c:75
DecodeGeneve
int DecodeGeneve(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-geneve.c:185
source-nflog.h
DecodeThreadVars_::counter_ethertype_unknown
uint16_t counter_ethertype_unknown
Definition: decode.h:699
decode-mpls.h
DecodeThreadVars_::counter_flow_udp
uint16_t counter_flow_udp
Definition: decode.h:736
len
uint8_t len
Definition: app-layer-dnp3.h:2
DecodeThreadVars_::counter_bytes
uint16_t counter_bytes
Definition: decode.h:679
VLAN_HEADER_TOO_MANY_LAYERS
@ VLAN_HEADER_TOO_MANY_LAYERS
Definition: decode-events.h:147
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:813
source-pcap.h
PktProfilingData_::ticks_end
uint64_t ticks_end
Definition: decode.h:347
Packet_::icmp_s
struct Packet_::@31::@41 icmp_s
PacketAlert_::s
const struct Signature_ * s
Definition: decode.h:267
DecodeThreadVars_::counter_eth
uint16_t counter_eth
Definition: decode.h:687
IPV4Vars_
Definition: decode-ipv4.h:174
DecodeThreadVars_::counter_flow_active
uint16_t counter_flow_active
Definition: decode.h:734
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:167
CHECKSUM_VALIDATION_OFFLOAD
@ CHECKSUM_VALIDATION_OFFLOAD
Definition: decode.h:50
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
Packet_::sctph
SCTPHdr * sctph
Definition: decode.h:561
NapatechPacketVars_
Definition: util-napatech.h:30
Packet_::code
uint8_t code
Definition: decode.h:441
PacketFreeOrRelease
void PacketFreeOrRelease(Packet *p)
Return a packet to where it was allocated.
Definition: decode.c:191
PLUGIN_VAR_SIZE
#define PLUGIN_VAR_SIZE
Definition: suricata-plugin.h:30
DecodeThreadVars_::counter_flow_icmp4
uint16_t counter_flow_icmp4
Definition: decode.h:737
DecodeThreadVars_::counter_vxlan
uint16_t counter_vxlan
Definition: decode.h:712
DecodeThreadVars_::counter_max_pkt_size
uint16_t counter_max_pkt_size
Definition: decode.h:681
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:292
decode-pppoe.h
PacketBypassCallback
void PacketBypassCallback(Packet *p)
Definition: decode.c:443
DecodeSCTP
int DecodeSCTP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-sctp.c:66
ICMPV4Vars_
Definition: decode-icmpv4.h:183
Packet_::persistent
struct Packet_::@40 persistent
DecodeThreadVars_::counter_avg_pkt_size
uint16_t counter_avg_pkt_size
Definition: decode.h:680
PktProfiling_
Per pkt stats storage.
Definition: decode.h:376
Address_::address_un_data16
uint16_t address_un_data16[8]
Definition: decode.h:119
PktProfilingPrefilterData_::engines
PktProfilingPrefilterEngine * engines
Definition: decode.h:371
DecodePPP
int DecodePPP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-ppp.c:44
Address_::address_un_in6
struct in6_addr address_un_in6
Definition: decode.h:121
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
PKT_DROP_REASON_STREAM_MEMCAP
@ PKT_DROP_REASON_STREAM_MEMCAP
Definition: decode.h:402
PktProfilingTmmData_
Per TMM stats storage.
Definition: decode.h:326
IPV6ExtHdrs_
Definition: decode-ipv6.h:215
PktPool_
Definition: tmqh-packetpool.h:43
Packet_::host_src
struct Host_ * host_src
Definition: decode.h:594
PKT_DROP_REASON_FLOW_MEMCAP
@ PKT_DROP_REASON_FLOW_MEMCAP
Definition: decode.h:395
PPPOESessionHdr_
Definition: decode-pppoe.h:37
CaptureStatsSetup
void CaptureStatsSetup(ThreadVars *tv)
Definition: decode.c:898
PacketDropReasonToString
const char * PacketDropReasonToString(enum PacketDropReason r)
Definition: decode.c:787
PacketEngineEvents_::events
uint8_t events[PACKET_ENGINE_EVENT_MAX]
Definition: decode.h:309
DECODE_TUNNEL_IPV6_TEREDO
@ DECODE_TUNNEL_IPV6_TEREDO
Definition: decode.h:814
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
PKT_SRC_SHUTDOWN_FLUSH
@ PKT_SRC_SHUTDOWN_FLUSH
Definition: decode.h:66
DecodeEthernet
int DecodeEthernet(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-ethernet.c:42
rwr_lock_cnt
thread_local uint64_t rwr_lock_cnt
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:598
PktProfiling_::ticks_end
uint64_t ticks_end
Definition: decode.h:378
TCPVars_
Definition: decode-tcp.h:155
AddressDebugPrint
void AddressDebugPrint(Address *)
Debug print function for printing addresses.
Definition: decode.c:671
PKT_SRC_DECODER_IPV4
@ PKT_SRC_DECODER_IPV4
Definition: decode.h:56
DecodeThreadVars_::counter_flow_spare_sync_avg
uint16_t counter_flow_spare_sync_avg
Definition: decode.h:749
PacketDefragPktSetup
Packet * PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto)
Setup a pseudo packet (reassembled frags)
Definition: decode.c:389
PacketQueue_
simple fifo queue for packets with mutex and cond Calling the mutex or triggering the cond is respons...
Definition: packet-queue.h:49
Packet_::payload
uint8_t * payload
Definition: decode.h:577
PacketAlerts_::cnt
uint16_t cnt
Definition: decode.h:289
ETHERNET_TYPE_IPV6
#define ETHERNET_TYPE_IPV6
Definition: decode-ethernet.h:39
PKT_SRC_CAPTURE_TIMEOUT
@ PKT_SRC_CAPTURE_TIMEOUT
Definition: decode.h:64
DecodeUDP
int DecodeUDP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-udp.c:75
Packet_::flags
uint32_t flags
Definition: decode.h:467
Packet_::l4vars
union Packet_::@39 l4vars
decode-udp.h
Packet_::action
uint8_t action
Definition: decode.h:581
PacketAlertCreate
PacketAlert * PacketAlertCreate(void)
Initialize PacketAlerts with dynamic alerts array size.
Definition: decode.c:83
PktProfilingDetectData
struct PktProfilingDetectData_ PktProfilingDetectData
DecodeThreadVars_::counter_vntag
uint16_t counter_vntag
Definition: decode.h:713
Packet_::vlan_idx
uint8_t vlan_idx
Definition: decode.h:458
Flow_
Flow data structure.
Definition: flow.h:350
DecodeThreadVars_::counter_flow_get_used_eval
uint16_t counter_flow_get_used_eval
Definition: decode.h:741
LiveDevice_
Definition: util-device.h:50
PROF_DETECT_SIZE
@ PROF_DETECT_SIZE
Definition: suricata-common.h:456
PktVar_::next
struct PktVar_ * next
Definition: decode.h:314
DecoderFunc
int(* DecoderFunc)(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode.h:883
PktProfilingTmmData_::ticks_end
uint64_t ticks_end
Definition: decode.h:328
Packet_::ipfw_v
IPFWPacketVars ipfw_v
Definition: decode.h:486
Packet_::pool
struct PktPool_ * pool
Definition: decode.h:639
Packet_::ip4vars
IPV4Vars ip4vars
Definition: decode.h:541
IS_TUNNEL_ROOT_PKT
#define IS_TUNNEL_ROOT_PKT(p)
Definition: decode.h:802
DecodeThreadVars_::counter_tcp_synack
uint16_t counter_tcp_synack
Definition: decode.h:693
CHECKSUM_VALIDATION_RXONLY
@ CHECKSUM_VALIDATION_RXONLY
Definition: decode.h:48
Packet_::ip6vars
IPV6Vars ip6vars
Definition: decode.h:543
PKT_DROP_REASON_MAX
@ PKT_DROP_REASON_MAX
Definition: decode.h:407
PKT_DROP_REASON_STREAM_REASSEMBLY
@ PKT_DROP_REASON_STREAM_REASSEMBLY
Definition: decode.h:404
Packet_::icmp_d
struct Packet_::@33::@42 icmp_d
DECODE_TUNNEL_ERSPANI
@ DECODE_TUNNEL_ERSPANI
Definition: decode.h:810
PacketAlerts_::alerts
PacketAlert * alerts
Definition: decode.h:292
LINKTYPE_LINUX_SLL
#define LINKTYPE_LINUX_SLL
Definition: decode.h:975
PktProfilingTmmData
struct PktProfilingTmmData_ PktProfilingTmmData
Per TMM stats storage.
DecodeThreadVars_::counter_teredo
uint16_t counter_teredo
Definition: decode.h:716
DecodeThreadVars_::counter_erspan
uint16_t counter_erspan
Definition: decode.h:720
PacketCopyDataOffset
int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
Copy data to Packet payload at given offset.
Definition: decode.c:250
DecodeVXLAN
int DecodeVXLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-vxlan.c:122
AppLayerDecoderEventsResetEvents
void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events)
Definition: app-layer-events.c:124
Packet_::pppoesh
PPPOESessionHdr * pppoesh
Definition: decode.h:570
DecodeThreadVars_::counter_raw
uint16_t counter_raw
Definition: decode.h:702
DecodeThreadVars
struct DecodeThreadVars_ DecodeThreadVars
Structure to hold thread specific data for all decode modules.
PktProfilingPrefilterData_
Definition: decode.h:370
SCSpinLock
#define SCSpinLock
Definition: threads-debug.h:235
PacketAlerts_::drop
PacketAlert drop
Definition: decode.h:295
DecodeVNTag
int DecodeVNTag(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-vntag.c:52
Address_
Definition: decode.h:115
CHECKSUM_VALIDATION_DISABLE
@ CHECKSUM_VALIDATION_DISABLE
Definition: decode.h:45
DecodeThreadVars_::counter_arp
uint16_t counter_arp
Definition: decode.h:698
DecodeThreadVars_::counter_flow_tcp
uint16_t counter_flow_tcp
Definition: decode.h:735
CHECKSUM_VALIDATION_KERNEL
@ CHECKSUM_VALIDATION_KERNEL
Definition: decode.h:49
PacketDecodeFinalize
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:147
Address_::address_un_data32
uint32_t address_un_data32[4]
Definition: decode.h:118
Packet_::tcpvars
TCPVars tcpvars
Definition: decode.h:549
proto
uint8_t proto
Definition: decode-template.h:0
PKT_NOPAYLOAD_INSPECTION
#define PKT_NOPAYLOAD_INSPECTION
Definition: decode.h:994
PacketAlertGetMaxConfig
void PacketAlertGetMaxConfig(void)
Definition: decode.c:931
DecodeICMPV6
int DecodeICMPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:178
PktProfilingDetectData_::ticks_end
uint64_t ticks_end
Definition: decode.h:352
decoder_max_layers
uint8_t decoder_max_layers
Definition: decode.c:76
DecodeThreadVars_::counter_tcp_active_sessions
uint16_t counter_tcp_active_sessions
Definition: decode.h:732
PacketAlert
struct PacketAlert_ PacketAlert
Packet_::host_dst
struct Host_ * host_dst
Definition: decode.h:595
PktProfilingLoggerData
struct PktProfilingLoggerData_ PktProfilingLoggerData
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:461
PktProfilingPrefilterEngine
struct PktProfilingPrefilterEngine_ PktProfilingPrefilterEngine
Packet_::BypassPacketsFlow
int(* BypassPacketsFlow)(struct Packet_ *)
Definition: decode.h:522
ALPROTO_MAX
@ ALPROTO_MAX
Definition: app-layer-protos.h:75
PacketDropReason
PacketDropReason
Definition: decode.h:390
DecodeThreadVars_::counter_max_mac_addrs_src
uint16_t counter_max_mac_addrs_src
Definition: decode.h:682
PktProfiling_::app
PktProfilingAppData app[ALPROTO_MAX]
Definition: decode.h:382
PktProfiling_::ticks_start
uint64_t ticks_start
Definition: decode.h:377
DecodeUnregisterCounters
void DecodeUnregisterCounters(void)
Definition: decode.c:515
rww_lock_contention
thread_local uint64_t rww_lock_contention
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:578
DecodeThreadVars_::counter_flow_get_used
uint16_t counter_flow_get_used
Definition: decode.h:740
Packet_::alerts
PacketAlerts alerts
Definition: decode.h:592
Packet_::tunnel_tpr_cnt
uint16_t tunnel_tpr_cnt
Definition: decode.h:631
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:35
Packet_::app_layer_events
AppLayerDecoderEvents * app_layer_events
Definition: decode.h:604
Packet_::events
PacketEngineEvents events
Definition: decode.h:602
PacketAlertFree
void PacketAlertFree(PacketAlert *pa)
Definition: decode.c:91
ETHERNET_TYPE_8021QINQ
#define ETHERNET_TYPE_8021QINQ
Definition: decode-ethernet.h:47
DecodeThreadVars_::counter_flow_spare_sync_empty
uint16_t counter_flow_spare_sync_empty
Definition: decode.h:747
PktProfilingAppData_::ticks_spent
uint64_t ticks_spent
Definition: decode.h:357
DecodeThreadVars_::counter_flow_tcp_reuse
uint16_t counter_flow_tcp_reuse
Definition: decode.h:739
DecodeRaw
int DecodeRaw(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-raw.c:42
PacketAlert_::tx_id
uint64_t tx_id
Definition: decode.h:268
rwr_lock_contention
thread_local uint64_t rwr_lock_contention
LINKTYPE_NULL
#define LINKTYPE_NULL
Definition: decode.h:973
DECODE_TUNNEL_NSH
@ DECODE_TUNNEL_NSH
Definition: decode.h:816
DecodeThreadVars_::counter_flow_total
uint16_t counter_flow_total
Definition: decode.h:733
PacketAlert_::action
uint8_t action
Definition: decode.h:265
Packet_::datalink
int datalink
Definition: decode.h:611
Packet_::profile
PktProfiling * profile
Definition: decode.h:642
spin_lock_wait_ticks
thread_local uint64_t spin_lock_wait_ticks
CHECKSUM_VALIDATION_ENABLE
@ CHECKSUM_VALIDATION_ENABLE
Definition: decode.h:46
lock
HRLOCK_TYPE lock
Definition: host.h:0
decode-gre.h
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *, ThreadVars *)
Definition: decode.c:525
Packet_::level3_comp_csum
int32_t level3_comp_csum
Definition: decode.h:531
DecodeThreadVars_::counter_flow_spare_sync
uint16_t counter_flow_spare_sync
Definition: decode.h:746
DECODE_TUNNEL_ERSPANII
@ DECODE_TUNNEL_ERSPANII
Definition: decode.h:809
CHECKSUM_VALIDATION_AUTO
@ CHECKSUM_VALIDATION_AUTO
Definition: decode.h:47
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:719
Packet_::pktlen
uint32_t pktlen
Definition: decode.h:586
decode-ipv6.h
TUNNEL_PKT_TPR
#define TUNNEL_PKT_TPR(p)
Definition: decode.h:797
Packet_::level4_comp_csum
int32_t level4_comp_csum
Definition: decode.h:533
util-debug.h
DecodeThreadVars_::counter_flow_get_used_failed
uint16_t counter_flow_get_used_failed
Definition: decode.h:744
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:54
source-nfq.h
Packet_::pktvar
PktVar * pktvar
Definition: decode.h:525
DPDKPacketVars_
per packet DPDK vars
Definition: source-dpdk.h:85
DecodeThreadVars_::counter_icmpv4
uint16_t counter_icmpv4
Definition: decode.h:696
DecodeThreadVars_::counter_ppp
uint16_t counter_ppp
Definition: decode.h:706
ETHERNET_TYPE_8021AD
#define ETHERNET_TYPE_8021AD
Definition: decode-ethernet.h:43
PacketAlert_::num
SigIntId num
Definition: decode.h:264
Packet_::tunnel_lock
SCSpinlock tunnel_lock
Definition: decode.h:652
Packet_::ts
SCTime_t ts
Definition: decode.h:475
PKT_DROP_REASON_APPLAYER_ERROR
@ PKT_DROP_REASON_APPLAYER_ERROR
Definition: decode.h:397
PacketSwap
void PacketSwap(Packet *p)
switch direction of a packet
Definition: decode.c:490
DecodeMPLS
int DecodeMPLS(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-mpls.c:49
DecodeThreadVars_::counter_tcp_rst
uint16_t counter_tcp_rst
Definition: decode.h:694
AppLayerThreadCtx_
This is for the app layer in general and it contains per thread context relevant to both the alpd and...
Definition: app-layer.c:56
PktSrcEnum
PktSrcEnum
Definition: decode.h:53
PKT_DROP_REASON_NOT_SET
@ PKT_DROP_REASON_NOT_SET
Definition: decode.h:391
flow-worker.h
PktVar_::value
uint8_t * value
Definition: decode.h:320
PktProfilingAppData
struct PktProfilingAppData_ PktProfilingAppData
DecodeTunnelProto
DecodeTunnelProto
Definition: decode.h:807
Packet_::prev
struct Packet_ * prev
Definition: decode.h:608
Packet
struct Packet_ Packet
decode-ppp.h
Packet_::pcap_v
PcapPacketVars pcap_v
Definition: decode.h:515
CaptureStatsUpdate
void CaptureStatsUpdate(ThreadVars *tv, const Packet *p)
Definition: decode.c:878
IS_TUNNEL_PKT_VERDICTED
#define IS_TUNNEL_PKT_VERDICTED(p)
Definition: decode.h:804
PKT_SRC_DECODER_TEREDO
@ PKT_SRC_DECODER_TEREDO
Definition: decode.h:58
DecodeTEMPLATE
int DecodeTEMPLATE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode TEMPLATE packets.
Definition: decode-template.c:51
Packet_::tunnel_rtv_cnt
uint16_t tunnel_rtv_cnt
Definition: decode.h:629
DecodeVLAN
int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-vlan.c:54
DecodeESP
int DecodeESP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Function to decode IPSEC-ESP packets.
Definition: decode-esp.c:64
rww_lock_cnt
thread_local uint64_t rww_lock_cnt
Packet_::ethh
EthernetHdr * ethh
Definition: decode.h:528
DecodeNSH
int DecodeNSH(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode NSH packets.
Definition: decode-nsh.c:46
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
mutex_lock_contention
thread_local uint64_t mutex_lock_contention
spin_lock_contention
thread_local uint64_t spin_lock_contention
PktProfilingData_
Definition: decode.h:345
DECODE_TUNNEL_PPP
@ DECODE_TUNNEL_PPP
Definition: decode.h:815
Packet_::sp
Port sp
Definition: decode.h:437
DCE_PKT_TOO_SMALL
@ DCE_PKT_TOO_SMALL
Definition: decode-events.h:207
PktProfiling_::logger
PktProfilingLoggerData logger[LOGGER_SIZE]
Definition: decode.h:384
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:134
SCSpinUnlock
#define SCSpinUnlock
Definition: threads-debug.h:237
PktSrcToString
const char * PktSrcToString(enum PktSrcEnum pkt_src)
Definition: decode.c:739
PktVar
struct PktVar_ PktVar
DecodeThreadVars_::counter_vlan_qinq
uint16_t counter_vlan_qinq
Definition: decode.h:710
IPV6Vars_
get the highest proto/next header field we know
Definition: decode-ipv6.h:104
LINKTYPE_GRE_OVER_IP
#define LINKTYPE_GRE_OVER_IP
Definition: decode.h:982
LINKTYPE_PPP
#define LINKTYPE_PPP
Definition: decode.h:976
PktProfilingDetectData_
Definition: decode.h:350
PktVar_::key
uint8_t * key
Definition: decode.h:319
decode-icmpv6.h
PacketAlerts_::discarded
uint16_t discarded
Definition: decode.h:290
source-pfring.h
DecodeSll
int DecodeSll(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-sll.c:41
PKT_DROP_REASON_RULES
@ PKT_DROP_REASON_RULES
Definition: decode.h:399
LOGGER_SIZE
@ LOGGER_SIZE
Definition: suricata-common.h:493
PacketCallocExtPkt
int PacketCallocExtPkt(Packet *p, int datalen)
Definition: decode.c:224
Address_::address
union Address_::@30 address
Address
struct Address_ Address
AppLayerDecoderEventsFreeEvents
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
Definition: app-layer-events.c:133
ETHERNET_TYPE_MPLS_UNICAST
#define ETHERNET_TYPE_MPLS_UNICAST
Definition: decode-mpls.h:29
PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
@ PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
Definition: decode.h:61
DECODE_TUNNEL_VLAN
@ DECODE_TUNNEL_VLAN
Definition: decode.h:811
Packet_::icmpv6h
ICMPV6Hdr * icmpv6h
Definition: decode.h:567
util-napatech.h
ETHERNET_TYPE_PPPOE_DISC
#define ETHERNET_TYPE_PPPOE_DISC
Definition: decode-ethernet.h:41
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:57
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:430
DecodeThreadVars_::counter_nsh
uint16_t counter_nsh
Definition: decode.h:721
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:812
DecodeThreadVars_::app_tctx
AppLayerThreadCtx * app_tctx
Definition: decode.h:675
decode-icmpv4.h
DecodeThreadVars_::counter_sll
uint16_t counter_sll
Definition: decode.h:701
source-ipfw.h
Address_::address_un_data8
uint8_t address_un_data8[16]
Definition: decode.h:120
TMM_SIZE
@ TMM_SIZE
Definition: tm-threads-common.h:79
PacketEngineEvents_
Definition: decode.h:307
source-netmap.h
Packet_::ip4h
IPV4Hdr * ip4h
Definition: decode.h:535
PKT_DROP_REASON_STREAM_ERROR
@ PKT_DROP_REASON_STREAM_ERROR
Definition: decode.h:401
Port
uint16_t Port
Definition: decode.h:229
DecodeThreadVars_::counter_sctp
uint16_t counter_sctp
Definition: decode.h:704
SCTime_t
Definition: util-time.h:40
Packet_::livedev
struct LiveDevice_ * livedev
Definition: decode.h:590
source-windivert.h
DecodeThreadVars_::counter_invalid
uint16_t counter_invalid
Definition: decode.h:685
ETHERNET_TYPE_VNTAG
#define ETHERNET_TYPE_VNTAG
Definition: decode-ethernet.h:51
DecodeThreadVars_::counter_ieee8021ah
uint16_t counter_ieee8021ah
Definition: decode.h:714
rww_lock_wait_ticks
thread_local uint64_t rww_lock_wait_ticks
DecodeTCP
int DecodeTCP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-tcp.c:248
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:718
ETHERNET_TYPE_NSH
#define ETHERNET_TYPE_NSH
Definition: decode-ethernet.h:50
DecodeThreadVars_::counter_vlan
uint16_t counter_vlan
Definition: decode.h:709
DECODE_TUNNEL_ETHERNET
@ DECODE_TUNNEL_ETHERNET
Definition: decode.h:808
DecodeThreadVars_::counter_tcp
uint16_t counter_tcp
Definition: decode.h:691
ETHERNET_TYPE_DCE
#define ETHERNET_TYPE_DCE
Definition: decode-ethernet.h:49
AFXDPPacketVars_
per packet AF_XDP vars
Definition: source-af-xdp.h:54
DecodeThreadVars_::counter_pkts
uint16_t counter_pkts
Definition: decode.h:678
rwr_lock_wait_ticks
thread_local uint64_t rwr_lock_wait_ticks
decode-events.h
PktProfilingPrefilterEngine_
Definition: decode.h:366
PktProfilingData_::ticks_start
uint64_t ticks_start
Definition: decode.h:346
DecodeNull
int DecodeNull(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-null.c:51
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
DecodeIPV4
int DecodeIPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-ipv4.c:520
PacketAlert_::frame_id
int64_t frame_id
Definition: decode.h:269
PktProfilingPrefilterData
struct PktProfilingPrefilterData_ PktProfilingPrefilterData
Packet_::ntpv
NapatechPacketVars ntpv
Definition: decode.h:506
decode-vlan.h
IPV4Hdr_
Definition: decode-ipv4.h:72
default_packet_size
uint32_t default_packet_size
Definition: decode.c:72
LINKTYPE_RAW
#define LINKTYPE_RAW
Definition: decode.h:977
Packet_::nb_decoded_layers
uint8_t nb_decoded_layers
Definition: decode.h:616
PacketAlert_::flags
uint8_t flags
Definition: decode.h:266
PKT_SRC_DECODER_GENEVE
@ PKT_SRC_DECODER_GENEVE
Definition: decode.h:65
decode-ipv4.h
DecodeThreadVars_::counter_chdlc
uint16_t counter_chdlc
Definition: decode.h:688
Packet_::ppph
PPPHdr * ppph
Definition: decode.h:569
Packet_::nfq_v
NFQPacketVars nfq_v
Definition: decode.h:483
ICMPV6Hdr_
Definition: decode-icmpv6.h:144
PktProfiling_::detect
PktProfilingDetectData detect[PROF_DETECT_SIZE]
Definition: decode.h:383
Packet_::icmpv4vars
ICMPV4Vars icmpv4vars
Definition: decode.h:550
Packet_::ReleasePacket
void(* ReleasePacket)(struct Packet_ *)
Definition: decode.h:519
Packet_::tenant_id
uint32_t tenant_id
Definition: decode.h:634
Packet_::flow
struct Flow_ * flow
Definition: decode.h:469
DecodeGRE
int DecodeGRE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode GRE packets.
Definition: decode-gre.c:47
ICMPV6Vars_
Definition: decode-icmpv6.h:161
PKT_DROP_REASON_INNER_PACKET
@ PKT_DROP_REASON_INNER_PACKET
Definition: decode.h:406
PktProfiling
struct PktProfiling_ PktProfiling
Per pkt stats storage.
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *, DecodeThreadVars *)
Definition: decode.c:706
IPFWPacketVars_
Definition: source-ipfw.h:32
source-dpdk.h
PktProfilingLoggerData_::ticks_end
uint64_t ticks_end
Definition: decode.h:362
PktProfilingPrefilterEngine_::ticks_spent
uint64_t ticks_spent
Definition: decode.h:367
DecodeThreadVars_::counter_flow_spare_sync_incomplete
uint16_t counter_flow_spare_sync_incomplete
Definition: decode.h:748
PKT_DROP_REASON_APPLAYER_MEMCAP
@ PKT_DROP_REASON_APPLAYER_MEMCAP
Definition: decode.h:398
DecodeGlobalConfig
void DecodeGlobalConfig(void)
Definition: decode.c:914
ChecksumValidationMode
ChecksumValidationMode
Definition: decode.h:44
suricata-common.h
PKT_SRC_FFR
@ PKT_SRC_FFR
Definition: decode.h:60
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:93
ETHERNET_TYPE_8021AH
#define ETHERNET_TYPE_8021AH
Definition: decode-ethernet.h:44
NFQPacketVars_
Definition: source-nfq.h:40
DecodeThreadVars_::counter_flow_icmp6
uint16_t counter_flow_icmp6
Definition: decode.h:738
Packet_::tcph
TCPHdr * tcph
Definition: decode.h:557
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:690
PROFILE_FLOWWORKER_SIZE
@ PROFILE_FLOWWORKER_SIZE
Definition: flow-worker.h:29
source-af-xdp.h
ETHERNET_DCE_HEADER_LEN
#define ETHERNET_DCE_HEADER_LEN
Definition: decode-ethernet.h:30
DecodeThreadVars_::counter_gre
uint16_t counter_gre
Definition: decode.h:708
DecodeThreadVars_::counter_esp
uint16_t counter_esp
Definition: decode.h:705
Packet_::ext_pkt
uint8_t * ext_pkt
Definition: decode.h:587
PacketAlerts
struct PacketAlerts_ PacketAlerts
DecodeICMPV4
int DecodeICMPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main ICMPv4 decoding function.
Definition: decode-icmpv4.c:156
Packet_::app_update_direction
uint8_t app_update_direction
Definition: decode.h:464
decode-esp.h
PKT_DROP_REASON_NFQ_ERROR
@ PKT_DROP_REASON_NFQ_ERROR
Definition: decode.h:405
DecodeThreadVars_::counter_defrag_ipv6_reassembled
uint16_t counter_defrag_ipv6_reassembled
Definition: decode.h:727
DecodeThreadVars_::counter_udp
uint16_t counter_udp
Definition: decode.h:695
GENERIC_TOO_MANY_LAYERS
@ GENERIC_TOO_MANY_LAYERS
Definition: decode-events.h:221
PacketUpdateEngineEventCounters
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Definition: decode.c:154
VLAN_MAX_LAYERS
#define VLAN_MAX_LAYERS
Definition: decode-vlan.h:51
decode-sctp.h
PKT_SRC_DEFRAG
@ PKT_SRC_DEFRAG
Definition: decode.h:59
Packet_::icmpv4h
ICMPV4Hdr * icmpv4h
Definition: decode.h:565
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
PfringPacketVars_
per packet Pfring vars
Definition: source-pfring.h:60
NetmapPacketVars_
Definition: source-netmap.h:71
DecodeThreadVars_::counter_ipv4
uint16_t counter_ipv4
Definition: decode.h:689
threadvars.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:173
TUNNEL_PKT_RTV
#define TUNNEL_PKT_RTV(p)
Definition: decode.h:796
source-af-packet.h
PKT_SRC_DECODER_VXLAN
@ PKT_SRC_DECODER_VXLAN
Definition: decode.h:62
mutex_lock_wait_ticks
thread_local uint64_t mutex_lock_wait_ticks
Packet_::next
struct Packet_ * next
Definition: decode.h:607
Packet_::flow_hash
uint32_t flow_hash
Definition: decode.h:473
Packet_::root
struct Packet_ * root
Definition: decode.h:622
DecodeThreadVars_::counter_pppoe
uint16_t counter_pppoe
Definition: decode.h:715
PacketAlerts_::suppressed
uint16_t suppressed
Definition: decode.h:291
PktProfilingPrefilterData_::size
uint32_t size
Definition: decode.h:372
DecodeThreadVars_::counter_mpls
uint16_t counter_mpls
Definition: decode.h:717
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:261
PKT_SRC_DETECT_RELOAD_FLUSH
@ PKT_SRC_DETECT_RELOAD_FLUSH
Definition: decode.h:63
PktProfilingData
struct PktProfilingData_ PktProfilingData
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:583
ETHERNET_TYPE_PPPOE_SESS
#define ETHERNET_TYPE_PPPOE_SESS
Definition: decode-ethernet.h:42
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:673
PACKET_ENGINE_EVENT_MAX
#define PACKET_ENGINE_EVENT_MAX
Definition: decode.h:304
Packet_::recursion_level
uint8_t recursion_level
Definition: decode.h:455
PktProfilingLoggerData_
Definition: decode.h:360
PktProfiling_::tmm
PktProfilingTmmData tmm[TMM_SIZE]
Definition: decode.h:380
Signature_
Signature container.
Definition: detect.h:592
DecodeThreadVars_::output_flow_thread_data
void * output_flow_thread_data
Definition: decode.h:755
DecodeThreadVars_::counter_geneve
uint16_t counter_geneve
Definition: decode.h:707
ETHERNET_TYPE_ARP
#define ETHERNET_TYPE_ARP
Definition: decode-ethernet.h:35
DecodeThreadVars_::counter_max_mac_addrs_dst
uint16_t counter_max_mac_addrs_dst
Definition: decode.h:683
Packet_::pppoedh
PPPOEDiscoveryHdr * pppoedh
Definition: decode.h:571
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *)
Alloc and setup DecodeThreadVars.
Definition: decode.c:688
DecodeThreadVars_::counter_defrag_max_hit
uint16_t counter_defrag_max_hit
Definition: decode.h:728
PacketSetData
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
Definition: decode.c:726
DecodeThreadVars_::counter_vlan_qinqinq
uint16_t counter_vlan_qinqinq
Definition: decode.h:711
SCSpinlock
#define SCSpinlock
Definition: threads-debug.h:234
VLAN_MAX_LAYER_IDX
#define VLAN_MAX_LAYER_IDX
Definition: decode-vlan.h:52
LINKTYPE_CISCO_HDLC
#define LINKTYPE_CISCO_HDLC
Definition: decode.h:983
PktVar_::value_len
uint16_t value_len
Definition: decode.h:318
app-layer-protos.h
DecodeThreadVars_::counter_null
uint16_t counter_null
Definition: decode.h:703
DecodeThreadVars_::counter_icmpv6
uint16_t counter_icmpv6
Definition: decode.h:697
Packet_::udph
UDPHdr * udph
Definition: decode.h:559
PcapPacketVars_
Definition: source-pcap.h:36
Packet_::drop_reason
uint8_t drop_reason
Definition: decode.h:619
Address_::family
char family
Definition: decode.h:116
Packet_::dst
Address dst
Definition: decode.h:435
PKT_SRC_DECODER_GRE
@ PKT_SRC_DECODER_GRE
Definition: decode.h:55
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:897
PktProfilingTmmData_::ticks_start
uint64_t ticks_start
Definition: decode.h:327
PacketAlert_
Definition: decode.h:263
PktProfilingLoggerData_::ticks_spent
uint64_t ticks_spent
Definition: decode.h:363
DecodeThreadVars_::counter_flow_memcap
uint16_t counter_flow_memcap
Definition: decode.h:730
ETHERNET_TYPE_VLAN
#define ETHERNET_TYPE_VLAN
Definition: decode-vlan.h:31
DecodeThreadVars_::counter_defrag_ipv6_fragments
uint16_t counter_defrag_ipv6_fragments
Definition: decode.h:726
PKT_NOPACKET_INSPECTION
#define PKT_NOPACKET_INSPECTION
Definition: decode.h:990
PktVar_
Definition: decode.h:312
AFPPacketVars_
per packet AF_PACKET vars
Definition: source-af-packet.h:144
Packet_::pkt_data
uint8_t pkt_data[]
Definition: decode.h:658
PacketEngineEvents
struct PacketEngineEvents_ PacketEngineEvents
packet_alert_max
uint16_t packet_alert_max
Definition: decode.c:77
Packet_::vlan_id
uint16_t vlan_id[VLAN_MAX_LAYERS]
Definition: decode.h:457
DecodeIEEE8021ah
int DecodeIEEE8021ah(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
PktProfilingDetectData_::ticks_start
uint64_t ticks_start
Definition: decode.h:351
PacketDefragPktSetupParent
void PacketDefragPktSetupParent(Packet *parent)
inform defrag "parent" that a pseudo packet is now associated to it.
Definition: decode.c:426
DecodeThreadVars_::counter_tcp_syn
uint16_t counter_tcp_syn
Definition: decode.h:692
Packet_::plugin_v
uint8_t plugin_v[PLUGIN_VAR_SIZE]
Definition: decode.h:512
Packet_::ip6h
IPV6Hdr * ip6h
Definition: decode.h:537
Packet_::icmpv6vars
ICMPV6Vars icmpv6vars
Definition: decode.h:551
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:308
PktProfiling_::flowworker
PktProfilingData flowworker[PROFILE_FLOWWORKER_SIZE]
Definition: decode.h:381
mutex_lock_cnt
thread_local uint64_t mutex_lock_cnt
NFLOGPacketVars_
Definition: source-nflog.h:55
PKT_DROP_REASON_STREAM_MIDSTREAM
@ PKT_DROP_REASON_STREAM_MIDSTREAM
Definition: decode.h:403
SigIntId
#define SigIntId
Definition: suricata-common.h:315
PacketAlerts_
Definition: decode.h:288
Packet_::dp
Port dp
Definition: decode.h:445
PktVar_::key_len
uint16_t key_len
Definition: decode.h:317
PktProfilingAppData_
Definition: decode.h:356
Host_
Definition: host.h:58
Packet_::esph
ESPHdr * esph
Definition: decode.h:563
DecodeThreadVars_::counter_flow_get_used_eval_reject
uint16_t counter_flow_get_used_eval_reject
Definition: decode.h:742
PktProfiling_::proto_detect
uint64_t proto_detect
Definition: decode.h:385
DecodePPPOESession
int DecodePPPOESession(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main decoding function for PPPOE Session packets.
Definition: decode-pppoe.c:130
ETHERNET_TYPE_MPLS_MULTICAST
#define ETHERNET_TYPE_MPLS_MULTICAST
Definition: decode-mpls.h:30
Packet_::type
uint8_t type
Definition: decode.h:440
ETHERNET_TYPE_IP
#define ETHERNET_TYPE_IP
Definition: decode-ethernet.h:34
AppLayerDecoderEvents_::events
uint8_t * events
Definition: app-layer-events.h:37
DECODE_TUNNEL_UNSET
@ DECODE_TUNNEL_UNSET
Definition: decode.h:817
PacketGetFromQueueOrAlloc
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:208
PktProfilingLoggerData_::ticks_start
uint64_t ticks_start
Definition: decode.h:361
PKT_DROP_REASON_FLOW_DROP
@ PKT_DROP_REASON_FLOW_DROP
Definition: decode.h:396
Packet_::src
Address src
Definition: decode.h:434
DecodeERSPANTypeI
int DecodeERSPANTypeI(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
ERSPAN Type I.
Definition: decode-erspan.c:64
DecodeCHDLC
int DecodeCHDLC(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-chdlc.c:42
DecodeUpdatePacketCounters
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:654
DecodeThreadVars_::counter_engine_events
uint16_t counter_engine_events[DECODE_EVENT_MAX]
Definition: decode.h:751
LINKTYPE_ETHERNET
#define LINKTYPE_ETHERNET
Definition: decode.h:974
Packet_::ip6eh
IPV6ExtHdrs ip6eh
Definition: decode.h:544
PktProfilingDetectData_::ticks_spent
uint64_t ticks_spent
Definition: decode.h:353
PktVar_::id
uint32_t id
Definition: decode.h:313
DECODE_EVENT_MAX
@ DECODE_EVENT_MAX
Definition: decode-events.h:301
PKT_DROP_REASON_DECODE_ERROR
@ PKT_DROP_REASON_DECODE_ERROR
Definition: decode.h:392
DecodeThreadVars_::counter_defrag_ipv4_fragments
uint16_t counter_defrag_ipv4_fragments
Definition: decode.h:724
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:308
DecodePPPOEDiscovery
int DecodePPPOEDiscovery(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main decoding function for PPPOE Discovery packets.
Definition: decode-pppoe.c:50