Go to the documentation of this file.
72 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
106 struct DetectionEngineThreadCtx_;
128 #define addr_data32 address.address_un_data32
129 #define addr_data16 address.address_un_data16
130 #define addr_data8 address.address_un_data8
131 #define addr_in6addr address.address_un_in6
133 #define COPY_ADDRESS(a, b) do { \
134 (b)->family = (a)->family; \
135 (b)->addr_data32[0] = (a)->addr_data32[0]; \
136 (b)->addr_data32[1] = (a)->addr_data32[1]; \
137 (b)->addr_data32[2] = (a)->addr_data32[2]; \
138 (b)->addr_data32[3] = (a)->addr_data32[3]; \
146 #define SET_IPV4_SRC_ADDR(p, a) do { \
147 (a)->family = AF_INET; \
148 (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
149 (a)->addr_data32[1] = 0; \
150 (a)->addr_data32[2] = 0; \
151 (a)->addr_data32[3] = 0; \
154 #define SET_IPV4_DST_ADDR(p, a) do { \
155 (a)->family = AF_INET; \
156 (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
157 (a)->addr_data32[1] = 0; \
158 (a)->addr_data32[2] = 0; \
159 (a)->addr_data32[3] = 0; \
163 #define CLEAR_ADDR(a) do { \
165 (a)->addr_data32[0] = 0; \
166 (a)->addr_data32[1] = 0; \
167 (a)->addr_data32[2] = 0; \
168 (a)->addr_data32[3] = 0; \
173 #define SET_IPV6_SRC_ADDR(p, a) do { \
174 (a)->family = AF_INET6; \
175 (a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \
176 (a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \
177 (a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \
178 (a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \
181 #define SET_IPV6_DST_ADDR(p, a) do { \
182 (a)->family = AF_INET6; \
183 (a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \
184 (a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \
185 (a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \
186 (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \
191 #define SET_TCP_SRC_PORT(pkt, prt) do { \
192 SET_PORT(TCP_GET_SRC_PORT((pkt)), *(prt)); \
195 #define SET_TCP_DST_PORT(pkt, prt) do { \
196 SET_PORT(TCP_GET_DST_PORT((pkt)), *(prt)); \
201 #define SET_UDP_SRC_PORT(pkt, prt) do { \
202 SET_PORT(UDP_GET_SRC_PORT((pkt)), *(prt)); \
204 #define SET_UDP_DST_PORT(pkt, prt) do { \
205 SET_PORT(UDP_GET_DST_PORT((pkt)), *(prt)); \
210 #define SET_SCTP_SRC_PORT(pkt, prt) do { \
211 SET_PORT(SCTP_GET_SRC_PORT((pkt)), *(prt)); \
214 #define SET_SCTP_DST_PORT(pkt, prt) do { \
215 SET_PORT(SCTP_GET_DST_PORT((pkt)), *(prt)); \
219 #define GET_IPV4_SRC_ADDR_U32(p) ((p)->src.addr_data32[0])
220 #define GET_IPV4_DST_ADDR_U32(p) ((p)->dst.addr_data32[0])
221 #define GET_IPV4_SRC_ADDR_PTR(p) ((p)->src.addr_data32)
222 #define GET_IPV4_DST_ADDR_PTR(p) ((p)->dst.addr_data32)
224 #define GET_IPV6_SRC_IN6ADDR(p) ((p)->src.addr_in6addr)
225 #define GET_IPV6_DST_IN6ADDR(p) ((p)->dst.addr_in6addr)
226 #define GET_IPV6_SRC_ADDR(p) ((p)->src.addr_data32)
227 #define GET_IPV6_DST_ADDR(p) ((p)->dst.addr_data32)
228 #define GET_TCP_SRC_PORT(p) ((p)->sp)
229 #define GET_TCP_DST_PORT(p) ((p)->dp)
231 #define GET_PKT_LEN(p) ((p)->pktlen)
232 #define GET_PKT_DATA(p) ((((p)->ext_pkt) == NULL ) ? (uint8_t *)((p) + 1) : (p)->ext_pkt)
233 #define GET_PKT_DIRECT_DATA(p) (uint8_t *)((p) + 1)
234 #define GET_PKT_DIRECT_MAX_SIZE(p) (default_packet_size)
236 #define SET_PKT_LEN(p, len) do { \
237 (p)->pktlen = (len); \
243 #define SET_PORT(v, p) ((p) = (v))
244 #define COPY_PORT(a,b) ((b) = (a))
246 #define CMP_ADDR(a1, a2) \
247 (((a1)->addr_data32[3] == (a2)->addr_data32[3] && \
248 (a1)->addr_data32[2] == (a2)->addr_data32[2] && \
249 (a1)->addr_data32[1] == (a2)->addr_data32[1] && \
250 (a1)->addr_data32[0] == (a2)->addr_data32[0]))
251 #define CMP_PORT(p1, p2) \
256 #define IP_GET_RAW_VER(pkt) ((((pkt)[0] & 0xf0) >> 4))
258 #define PKT_IS_IPV4(p) (((p)->ip4h != NULL))
259 #define PKT_IS_IPV6(p) (((p)->ip6h != NULL))
260 #define PKT_IS_TCP(p) (((p)->tcph != NULL))
261 #define PKT_IS_UDP(p) (((p)->udph != NULL))
262 #define PKT_IS_ICMPV4(p) (((p)->icmpv4h != NULL))
263 #define PKT_IS_ICMPV6(p) (((p)->icmpv6h != NULL))
264 #define PKT_IS_TOSERVER(p) (((p)->flowflags & FLOW_PKT_TOSERVER))
265 #define PKT_IS_TOCLIENT(p) (((p)->flowflags & FLOW_PKT_TOCLIENT))
267 #define IPH_IS_VALID(p) (PKT_IS_IPV4((p)) || PKT_IS_IPV6((p)))
270 #define IP_GET_IPPROTO(p) \
271 (p->proto ? p->proto : \
272 (PKT_IS_IPV4((p))? IPV4_GET_IPPROTO((p)) : (PKT_IS_IPV6((p))? IPV6_GET_L4PROTO((p)) : 0)))
287 #define PACKET_ALERT_FLAG_DROP_FLOW 0x01
289 #define PACKET_ALERT_FLAG_STATE_MATCH 0x02
291 #define PACKET_ALERT_FLAG_STREAM_MATCH 0x04
293 #define PACKET_ALERT_FLAG_TX 0x08
295 #define PACKET_ALERT_RATE_FILTER_MODIFIED 0x10
297 #define PACKET_ALERT_MAX 15
309 #define PACKET_ENGINE_EVENT_MAX 15
334 #ifdef PROFILE_LOCKING
478 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
483 WinDivertPacketVars windivert_v;
528 #define tcpvars l4vars.tcpvars
529 #define icmpv4vars l4vars.icmpv4vars
530 #define icmpv6vars l4vars.icmpv6vars
628 #define DEFAULT_MTU 1500
629 #define MINIMUM_MTU 68
631 #define DEFAULT_PACKET_SIZE (DEFAULT_MTU + ETHERNET_HEADER_LEN)
633 #define MAX_PAYLOAD_SIZE (IPV6_HEADER_LEN + 65536 + 28)
635 #define SIZE_OF_PACKET (default_packet_size + sizeof(Packet))
729 #define PACKET_CLEAR_L4VARS(p) do { \
730 memset(&(p)->l4vars, 0x00, sizeof((p)->l4vars)); \
736 #define PACKET_RESET_CHECKSUMS(p) do { \
737 (p)->level3_comp_csum = -1; \
738 (p)->level4_comp_csum = -1; \
742 #define PACKET_FREE_EXTDATA(p) do { \
743 if ((p)->ext_pkt) { \
744 if (!((p)->flags & PKT_ZERO_COPY)) { \
745 SCFree((p)->ext_pkt); \
747 (p)->ext_pkt = NULL; \
754 #define PACKET_INITIALIZE(p) { \
755 SCMutexInit(&(p)->tunnel_mutex, NULL); \
756 PACKET_RESET_CHECKSUMS((p)); \
757 (p)->livedev = NULL; \
760 #define PACKET_RELEASE_REFS(p) do { \
761 FlowDeReference(&((p)->flow)); \
762 HostDeReference(&((p)->host_src)); \
763 HostDeReference(&((p)->host_dst)); \
769 #define PACKET_REINIT(p) \
771 CLEAR_ADDR(&(p)->src); \
772 CLEAR_ADDR(&(p)->dst); \
776 (p)->recursion_level = 0; \
777 PACKET_FREE_EXTDATA((p)); \
778 (p)->flags = (p)->flags & PKT_ALLOC; \
779 (p)->flowflags = 0; \
781 (p)->vlan_id[0] = 0; \
782 (p)->vlan_id[1] = 0; \
784 (p)->ts.tv_sec = 0; \
785 (p)->ts.tv_usec = 0; \
788 if ((p)->pktvar != NULL) { \
789 PktVarFree((p)->pktvar); \
790 (p)->pktvar = NULL; \
793 if ((p)->ip4h != NULL) { \
794 CLEAR_IPV4_PACKET((p)); \
796 if ((p)->ip6h != NULL) { \
797 CLEAR_IPV6_PACKET((p)); \
799 if ((p)->tcph != NULL) { \
800 CLEAR_TCP_PACKET((p)); \
802 if ((p)->udph != NULL) { \
803 CLEAR_UDP_PACKET((p)); \
805 if ((p)->sctph != NULL) { \
806 CLEAR_SCTP_PACKET((p)); \
808 if ((p)->esph != NULL) { \
809 CLEAR_ESP_PACKET((p)); \
811 if ((p)->icmpv4h != NULL) { \
812 CLEAR_ICMPV4_PACKET((p)); \
814 if ((p)->icmpv6h != NULL) { \
815 CLEAR_ICMPV6_PACKET((p)); \
818 (p)->pppoesh = NULL; \
819 (p)->pppoedh = NULL; \
821 (p)->payload = NULL; \
822 (p)->payload_len = 0; \
823 (p)->BypassPacketsFlow = NULL; \
825 (p)->alerts.cnt = 0; \
826 (p)->alerts.drop.action = 0; \
828 (p)->tunnel_rtv_cnt = 0; \
829 (p)->tunnel_tpr_cnt = 0; \
830 (p)->events.cnt = 0; \
831 AppLayerDecoderEventsResetEvents((p)->app_layer_events); \
835 (p)->livedev = NULL; \
836 PACKET_RESET_CHECKSUMS((p)); \
837 PACKET_PROFILING_RESET((p)); \
839 p->nb_decoded_layers = 0; \
842 #define PACKET_RECYCLE(p) do { \
843 PACKET_RELEASE_REFS((p)); \
844 PACKET_REINIT((p)); \
850 #define PACKET_DESTRUCTOR(p) do { \
851 if ((p)->pktvar != NULL) { \
852 PktVarFree((p)->pktvar); \
854 PACKET_FREE_EXTDATA((p)); \
855 SCMutexDestroy(&(p)->tunnel_mutex); \
856 AppLayerDecoderEventsFreeEvents(&(p)->app_layer_events); \
857 PACKET_PROFILING_RESET((p)); \
865 #define PACKET_SET_ACTION(p, a) do { \
867 ((p)->root->action = a) : \
868 ((p)->action = a)); \
871 #define PACKET_ALERT(p) PACKET_SET_ACTION(p, ACTION_ALERT)
873 #define PACKET_ACCEPT(p) PACKET_SET_ACTION(p, ACTION_ACCEPT)
875 #define PACKET_DROP(p) PACKET_SET_ACTION(p, ACTION_DROP)
877 #define PACKET_REJECT(p) PACKET_SET_ACTION(p, (ACTION_REJECT|ACTION_DROP))
879 #define PACKET_REJECT_DST(p) PACKET_SET_ACTION(p, (ACTION_REJECT_DST|ACTION_DROP))
881 #define PACKET_REJECT_BOTH(p) PACKET_SET_ACTION(p, (ACTION_REJECT_BOTH|ACTION_DROP))
883 #define PACKET_PASS(p) PACKET_SET_ACTION(p, ACTION_PASS)
885 #define PACKET_TEST_ACTION(p, a) \
887 ((p)->root->action & a) : \
890 #define PACKET_UPDATE_ACTION(p, a) do { \
892 ((p)->root->action |= a) : \
893 ((p)->action |= a)); \
896 #define TUNNEL_INCR_PKT_RTV_NOLOCK(p) do { \
897 ((p)->root ? (p)->root->tunnel_rtv_cnt++ : (p)->tunnel_rtv_cnt++); \
900 #define TUNNEL_INCR_PKT_TPR(p) do { \
901 SCMutexLock((p)->root ? &(p)->root->tunnel_mutex : &(p)->tunnel_mutex); \
902 ((p)->root ? (p)->root->tunnel_tpr_cnt++ : (p)->tunnel_tpr_cnt++); \
903 SCMutexUnlock((p)->root ? &(p)->root->tunnel_mutex : &(p)->tunnel_mutex); \
906 #define TUNNEL_PKT_RTV(p) ((p)->root ? (p)->root->tunnel_rtv_cnt : (p)->tunnel_rtv_cnt)
907 #define TUNNEL_PKT_TPR(p) ((p)->root ? (p)->root->tunnel_tpr_cnt : (p)->tunnel_tpr_cnt)
909 #define IS_TUNNEL_PKT(p) (((p)->flags & PKT_TUNNEL))
910 #define SET_TUNNEL_PKT(p) ((p)->flags |= PKT_TUNNEL)
911 #define UNSET_TUNNEL_PKT(p) ((p)->flags &= ~PKT_TUNNEL)
912 #define IS_TUNNEL_ROOT_PKT(p) (IS_TUNNEL_PKT(p) && (p)->root == NULL)
914 #define IS_TUNNEL_PKT_VERDICTED(p) (((p)->flags & PKT_TUNNEL_VERDICTED))
915 #define SET_TUNNEL_PKT_VERDICTED(p) ((p)->flags |= PKT_TUNNEL_VERDICTED)
985 uint16_t hdrextlen, uint16_t plen,
986 uint16_t prev_hdrextlen);
992 const uint8_t *pkt, uint32_t
len);
1000 #define DecodeSetNoPayloadInspectionFlag(p) do { \
1001 (p)->flags |= PKT_NOPAYLOAD_INSPECTION; \
1004 #define DecodeUnsetNoPayloadInspectionFlag(p) do { \
1005 (p)->flags &= ~PKT_NOPAYLOAD_INSPECTION; \
1012 #define DecodeSetNoPacketInspectionFlag(p) do { \
1013 (p)->flags |= PKT_NOPACKET_INSPECTION; \
1015 #define DecodeUnsetNoPacketInspectionFlag(p) do { \
1016 (p)->flags &= ~PKT_NOPACKET_INSPECTION; \
1020 #define ENGINE_SET_EVENT(p, e) do { \
1021 SCLogDebug("p %p event %d", (p), e); \
1022 if ((p)->events.cnt < PACKET_ENGINE_EVENT_MAX) { \
1023 (p)->events.events[(p)->events.cnt] = e; \
1024 (p)->events.cnt++; \
1028 #define ENGINE_SET_INVALID_EVENT(p, e) do { \
1029 p->flags |= PKT_IS_INVALID; \
1030 ENGINE_SET_EVENT(p, e); \
1035 #define ENGINE_ISSET_EVENT(p, e) ({ \
1038 for (u = 0; u < (p)->events.cnt; u++) { \
1039 if ((p)->events.events[u] == (e)) { \
1047 #ifndef IPPROTO_IPIP
1048 #define IPPROTO_IPIP 4
1055 #ifndef IPPROTO_DCCP
1056 #define IPPROTO_DCCP 33
1063 #ifndef IPPROTO_SCTP
1064 #define IPPROTO_SCTP 132
1068 #define IPPROTO_MH 135
1073 #define IPPROTO_HIP 139
1076 #ifndef IPPROTO_SHIM6
1077 #define IPPROTO_SHIM6 140
1082 #define DLT_EN10MB 1
1086 #define DLT_C_HDLC 104
1104 #define LINKTYPE_NULL DLT_NULL
1105 #define LINKTYPE_ETHERNET DLT_EN10MB
1106 #define LINKTYPE_LINUX_SLL 113
1107 #define LINKTYPE_PPP 9
1108 #define LINKTYPE_RAW DLT_RAW
1111 #define LINKTYPE_RAW2 101
1112 #define LINKTYPE_IPV4 228
1113 #define LINKTYPE_GRE_OVER_IP 778
1114 #define LINKTYPE_CISCO_HDLC DLT_C_HDLC
1115 #define PPP_OVER_GRE 11
1116 #define VLAN_OVER_GRE 13
1119 #define PKT_NOPACKET_INSPECTION (1)
1120 #define PKT_NOPAYLOAD_INSPECTION (1<<2)
1121 #define PKT_ALLOC (1<<3)
1122 #define PKT_HAS_TAG (1<<4)
1123 #define PKT_STREAM_ADD (1<<5)
1124 #define PKT_STREAM_EST (1<<6)
1125 #define PKT_STREAM_EOF (1<<7)
1126 #define PKT_HAS_FLOW (1<<8)
1127 #define PKT_PSEUDO_STREAM_END (1<<9)
1128 #define PKT_STREAM_MODIFIED (1<<10)
1129 #define PKT_MARK_MODIFIED (1<<11)
1130 #define PKT_STREAM_NOPCAPLOG (1<<12)
1132 #define PKT_TUNNEL (1<<13)
1133 #define PKT_TUNNEL_VERDICTED (1<<14)
1135 #define PKT_IGNORE_CHECKSUM (1<<15)
1136 #define PKT_ZERO_COPY (1<<16)
1138 #define PKT_HOST_SRC_LOOKED_UP (1<<17)
1139 #define PKT_HOST_DST_LOOKED_UP (1<<18)
1141 #define PKT_IS_FRAGMENT (1<<19)
1142 #define PKT_IS_INVALID (1<<20)
1143 #define PKT_PROFILE (1<<21)
1147 #define PKT_WANTS_FLOW (1<<22)
1150 #define PKT_PROTO_DETECT_TS_DONE (1<<23)
1151 #define PKT_PROTO_DETECT_TC_DONE (1<<24)
1153 #define PKT_REBUILT_FRAGMENT (1<<25)
1155 #define PKT_DETECT_HAS_STREAMDATA (1<<26)
1157 #define PKT_PSEUDO_DETECTLOG_FLUSH (1<<27)
1161 #define PKT_STREAM_NO_EVENTS (1<<28)
1164 #define PKT_IS_PSEUDOPKT(p) \
1165 ((p)->flags & (PKT_PSEUDO_STREAM_END|PKT_PSEUDO_DETECTLOG_FLUSH))
1167 #define PKT_SET_SRC(p, src_val) ((p)->pkt_src = src_val)
1169 #define PKT_DEFAULT_MAX_DECODED_LAYERS 16
1172 static inline bool PacketIncreaseCheckLayers(
Packet *p)
1192 static inline bool VerdictTunnelPacket(
Packet *p)
1194 bool verdict =
true;
1198 SCLogDebug(
"tunnel: outstanding %u", outstanding);
1215 const int datalink,
Packet *p,
const uint8_t *data,
const uint32_t
len)
1240 "%"PRId32
" not yet supported", datalink);
1248 const uint16_t
proto,
Packet *p,
const uint8_t *data,
const uint32_t
len)
1252 uint16_t ip_len = (
len < USHRT_MAX) ? (uint16_t)
len : (uint16_t)USHRT_MAX;
1257 uint16_t ip_len = (
len < USHRT_MAX) ? (uint16_t)
len : (uint16_t)USHRT_MAX;
struct CaptureStats_ CaptureStats
#define ENGINE_SET_EVENT(p, e)
uint16_t counter_flow_get_used_eval_busy
uint16_t counter_defrag_ipv4_reassembled
thread_local uint64_t spin_lock_cnt
int DecodeIPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
int DecodeERSPAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
ERSPAN Type II.
int DecodeGeneve(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
uint16_t counter_flow_udp
uint16_t counter_ips_blocked
const struct Signature_ * s
void PacketFreeOrRelease(Packet *p)
Return a packet to where it was allocated.
uint16_t counter_flow_icmp4
uint16_t counter_max_pkt_size
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
void PacketBypassCallback(Packet *p)
int DecodeSCTP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
uint16_t counter_avg_pkt_size
uint16_t address_un_data16[8]
PktProfilingPrefilterEngine * engines
int DecodePPP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
struct in6_addr address_un_in6
uint8_t events[PACKET_ENGINE_EVENT_MAX]
@ DECODE_TUNNEL_IPV6_TEREDO
int DecodeEthernet(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
thread_local uint64_t rwr_lock_cnt
void AddressDebugPrint(Address *)
Debug print function for printing addresses.
uint16_t counter_flow_spare_sync_avg
Packet * PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto)
Setup a pseudo packet (reassembled frags)
PacketAlert alerts[PACKET_ALERT_MAX]
simple fifo queue for packets with mutex and cond Calling the mutex or triggering the cond is respons...
#define ETHERNET_TYPE_IPV6
@ PKT_SRC_CAPTURE_TIMEOUT
int DecodeUDP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
struct PktProfilingDetectData_ PktProfilingDetectData
uint16_t counter_flow_get_used_eval
int(* DecoderFunc)(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
#define IS_TUNNEL_ROOT_PKT(p)
@ CHECKSUM_VALIDATION_RXONLY
#define LINKTYPE_LINUX_SLL
struct PktProfilingTmmData_ PktProfilingTmmData
Per TMM stats storage.
int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
Copy data to Packet payload at given offset.
int DecodeVXLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events)
@ VLAN_HEADER_TOO_MANY_LAYERS
PPPOESessionHdr * pppoesh
struct DecodeThreadVars_ DecodeThreadVars
Structure to hold thread specific data for all decode modules.
@ CHECKSUM_VALIDATION_DISABLE
uint16_t counter_flow_tcp
@ CHECKSUM_VALIDATION_KERNEL
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
uint32_t address_un_data32[4]
int DecodeICMPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Decode ICMPV6 packets and fill the Packet with the decoded info.
uint8_t decoder_max_layers
struct PacketAlert_ PacketAlert
struct PktProfilingLoggerData_ PktProfilingLoggerData
struct PktProfilingPrefilterEngine_ PktProfilingPrefilterEngine
int(* BypassPacketsFlow)(struct Packet_ *)
uint16_t counter_max_mac_addrs_src
PktProfilingAppData app[ALPROTO_MAX]
void DecodeUnregisterCounters(void)
thread_local uint64_t rww_lock_contention
uint16_t counter_flow_get_used
Data structure to store app layer decoder events.
AppLayerDecoderEvents * app_layer_events
PacketEngineEvents events
#define ETHERNET_TYPE_8021QINQ
uint16_t counter_flow_spare_sync_empty
uint16_t counter_flow_tcp_reuse
int DecodeRaw(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
thread_local uint64_t rwr_lock_contention
thread_local uint64_t spin_lock_wait_ticks
@ CHECKSUM_VALIDATION_ENABLE
void DecodeRegisterPerfCounters(DecodeThreadVars *, ThreadVars *)
uint16_t counter_flow_spare_sync
@ CHECKSUM_VALIDATION_AUTO
uint16_t counter_ipv6inipv6
#define TUNNEL_PKT_TPR(p)
uint16_t counter_flow_get_used_failed
uint16_t counter_ips_rejected
#define ETHERNET_TYPE_8021AD
struct Packet_::@39::@48 icmp_s
#define SCMutexUnlock(mut)
void PacketSwap(Packet *p)
switch direction of a packet
int DecodeMPLS(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
This is for the app layer in general and it contains per thread context relevant to both the alpd and...
struct PktProfilingAppData_ PktProfilingAppData
#define IS_TUNNEL_PKT_VERDICTED(p)
void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s)
int DecodeTEMPLATE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode TEMPLATE packets.
int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
int DecodeESP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Function to decode IPSEC-ESP packets.
thread_local uint64_t rww_lock_cnt
int DecodeNSH(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode NSH packets.
Per thread variable structure.
thread_local uint64_t mutex_lock_contention
thread_local uint64_t spin_lock_contention
PktProfilingLoggerData logger[LOGGER_SIZE]
void PacketFree(Packet *p)
Return a malloced packet.
const char * PktSrcToString(enum PktSrcEnum pkt_src)
uint16_t counter_vlan_qinq
get the highest proto/next header field we know
#define LINKTYPE_GRE_OVER_IP
int DecodeSll(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
uint16_t counter_defrag_ipv6_timeouts
int PacketCallocExtPkt(Packet *p, int datalen)
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
#define ETHERNET_TYPE_MPLS_UNICAST
@ PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
#define ETHERNET_TYPE_PPPOE_DISC
uint16_t counter_ips_accepted
AppLayerThreadCtx * app_tctx
uint16_t counter_defrag_ipv4_timeouts
uint8_t address_un_data8[16]
struct LiveDevice_ * livedev
uint16_t counter_ieee8021ah
thread_local uint64_t rww_lock_wait_ticks
int DecodeTCP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
uint16_t counter_ipv4inipv6
union Packet_::@47 l4vars
#define ETHERNET_TYPE_NSH
#define ETHERNET_TYPE_DCE
thread_local uint64_t rwr_lock_wait_ticks
int DecodeNull(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
int DecodeIPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
struct PktProfilingPrefilterData_ PktProfilingPrefilterData
uint32_t default_packet_size
uint8_t nb_decoded_layers
PktProfilingDetectData detect[PROF_DETECT_SIZE]
void(* ReleasePacket)(struct Packet_ *)
int DecodeGRE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode GRE packets.
struct PktProfiling_ PktProfiling
Per pkt stats storage.
void DecodeThreadVarsFree(ThreadVars *, DecodeThreadVars *)
uint16_t counter_flow_spare_sync_incomplete
void DecodeGlobalConfig(void)
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
#define ETHERNET_TYPE_8021AH
uint16_t counter_flow_icmp6
@ PROFILE_FLOWWORKER_SIZE
uint16_t counter_ips_replaced
#define ETHERNET_DCE_HEADER_LEN
struct PacketAlerts_ PacketAlerts
int DecodeICMPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main ICMPv4 decoding function.
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
uint16_t counter_defrag_ipv6_reassembled
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
void CaptureStatsUpdate(ThreadVars *tv, CaptureStats *s, const Packet *p)
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
#define TUNNEL_PKT_RTV(p)
thread_local uint64_t mutex_lock_wait_ticks
@ PKT_SRC_DETECT_RELOAD_FLUSH
struct PktProfilingData_ PktProfilingData
#define ETHERNET_TYPE_PPPOE_SESS
Structure to hold thread specific data for all decode modules.
#define PACKET_ENGINE_EVENT_MAX
PktProfilingTmmData tmm[TMM_SIZE]
void * output_flow_thread_data
#define ETHERNET_TYPE_ARP
uint16_t counter_max_mac_addrs_dst
PPPOEDiscoveryHdr * pppoedh
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *)
Alloc and setup DecodeThreadVars.
uint16_t counter_defrag_max_hit
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
@ SC_ERR_DATALINK_UNIMPLEMENTED
#define LINKTYPE_CISCO_HDLC
@ GENERIC_TOO_MANY_LAYERS
#define ENGINE_SET_INVALID_EVENT(p, e)
uint16_t counter_flow_memcap
#define ETHERNET_TYPE_VLAN
struct Packet_::@41::@49 icmp_d
uint16_t counter_defrag_ipv6_fragments
per packet AF_PACKET vars
struct PacketEngineEvents_ PacketEngineEvents
int DecodeIEEE8021ah(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
union Address_::@38 address
void PacketDefragPktSetupParent(Packet *parent)
inform defrag "parent" that a pseudo packet is now associated to it.
uint8_t plugin_v[PLUGIN_VAR_SIZE]
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
PktProfilingData flowworker[PROFILE_FLOWWORKER_SIZE]
thread_local uint64_t mutex_lock_cnt
uint16_t counter_flow_get_used_eval_reject
int DecodePPPOESession(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main decoding function for PPPOE Session packets.
#define ETHERNET_TYPE_MPLS_MULTICAST
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
int DecodeERSPANTypeI(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
ERSPAN Type I.
int DecodeCHDLC(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
uint16_t counter_engine_events[DECODE_EVENT_MAX]
#define LINKTYPE_ETHERNET
uint16_t counter_defrag_ipv4_fragments
int DecodePPPOEDiscovery(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main decoding function for PPPOE Discovery packets.