suricata
decode.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2020 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef __DECODE_H__
25 #define __DECODE_H__
26 
27 //#define DBG_THREADS
28 #define COUNTERS
29 
30 #include "suricata-common.h"
31 #include "suricata-plugin.h"
32 #include "threadvars.h"
33 #include "util-debug.h"
34 #include "decode-events.h"
35 #include "flow-worker.h"
36 
37 #ifdef HAVE_NAPATECH
38 #include "util-napatech.h"
39 #endif /* HAVE_NAPATECH */
40 
41 
42 typedef enum {
49 
50 enum PktSrcEnum {
63 };
64 
65 #include "source-nflog.h"
66 #include "source-nfq.h"
67 #include "source-ipfw.h"
68 #include "source-pcap.h"
69 #include "source-af-packet.h"
70 #include "source-netmap.h"
71 #include "source-windivert.h"
72 #ifdef HAVE_DPDK
73 #include "source-dpdk.h"
74 #endif
75 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
76 #include "source-pfring.h"
77 #endif
78 
79 #include "action-globals.h"
80 
81 #include "decode-erspan.h"
82 #include "decode-ethernet.h"
83 #include "decode-chdlc.h"
84 #include "decode-gre.h"
85 #include "decode-geneve.h"
86 #include "decode-ppp.h"
87 #include "decode-pppoe.h"
88 #include "decode-sll.h"
89 #include "decode-ipv4.h"
90 #include "decode-ipv6.h"
91 #include "decode-icmpv4.h"
92 #include "decode-icmpv6.h"
93 #include "decode-tcp.h"
94 #include "decode-udp.h"
95 #include "decode-sctp.h"
96 #include "decode-esp.h"
97 #include "decode-raw.h"
98 #include "decode-null.h"
99 #include "decode-vlan.h"
100 #include "decode-vntag.h"
101 #include "decode-vxlan.h"
102 #include "decode-mpls.h"
103 #include "decode-nsh.h"
104 
105 #include "detect-reference.h"
106 
107 #include "app-layer-protos.h"
108 
109 /* forward declarations */
110 struct DetectionEngineThreadCtx_;
112 
113 struct PktPool_;
114 
115 /* declare these here as they are called from the
116  * PACKET_RECYCLE and PACKET_CLEANUP macro's. */
120 
121 /* Address */
122 typedef struct Address_ {
123  char family;
124  union {
125  uint32_t address_un_data32[4]; /* type-specific field */
126  uint16_t address_un_data16[8]; /* type-specific field */
127  uint8_t address_un_data8[16]; /* type-specific field */
128  struct in6_addr address_un_in6;
131 
132 #define addr_data32 address.address_un_data32
133 #define addr_data16 address.address_un_data16
134 #define addr_data8 address.address_un_data8
135 #define addr_in6addr address.address_un_in6
136 
137 #define COPY_ADDRESS(a, b) do { \
138  (b)->family = (a)->family; \
139  (b)->addr_data32[0] = (a)->addr_data32[0]; \
140  (b)->addr_data32[1] = (a)->addr_data32[1]; \
141  (b)->addr_data32[2] = (a)->addr_data32[2]; \
142  (b)->addr_data32[3] = (a)->addr_data32[3]; \
143  } while (0)
144 
145 /* Set the IPv4 addresses into the Addrs of the Packet.
146  * Make sure p->ip4h is initialized and validated.
147  *
148  * We set the rest of the struct to 0 so we can
149  * prevent using memset. */
150 #define SET_IPV4_SRC_ADDR(p, a) do { \
151  (a)->family = AF_INET; \
152  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_src.s_addr; \
153  (a)->addr_data32[1] = 0; \
154  (a)->addr_data32[2] = 0; \
155  (a)->addr_data32[3] = 0; \
156  } while (0)
157 
158 #define SET_IPV4_DST_ADDR(p, a) do { \
159  (a)->family = AF_INET; \
160  (a)->addr_data32[0] = (uint32_t)(p)->ip4h->s_ip_dst.s_addr; \
161  (a)->addr_data32[1] = 0; \
162  (a)->addr_data32[2] = 0; \
163  (a)->addr_data32[3] = 0; \
164  } while (0)
165 
166 /* clear the address structure by setting all fields to 0 */
167 #define CLEAR_ADDR(a) do { \
168  (a)->family = 0; \
169  (a)->addr_data32[0] = 0; \
170  (a)->addr_data32[1] = 0; \
171  (a)->addr_data32[2] = 0; \
172  (a)->addr_data32[3] = 0; \
173  } while (0)
174 
175 /* Set the IPv6 addresses into the Addrs of the Packet.
176  * Make sure p->ip6h is initialized and validated. */
177 #define SET_IPV6_SRC_ADDR(p, a) do { \
178  (a)->family = AF_INET6; \
179  (a)->addr_data32[0] = (p)->ip6h->s_ip6_src[0]; \
180  (a)->addr_data32[1] = (p)->ip6h->s_ip6_src[1]; \
181  (a)->addr_data32[2] = (p)->ip6h->s_ip6_src[2]; \
182  (a)->addr_data32[3] = (p)->ip6h->s_ip6_src[3]; \
183  } while (0)
184 
185 #define SET_IPV6_DST_ADDR(p, a) do { \
186  (a)->family = AF_INET6; \
187  (a)->addr_data32[0] = (p)->ip6h->s_ip6_dst[0]; \
188  (a)->addr_data32[1] = (p)->ip6h->s_ip6_dst[1]; \
189  (a)->addr_data32[2] = (p)->ip6h->s_ip6_dst[2]; \
190  (a)->addr_data32[3] = (p)->ip6h->s_ip6_dst[3]; \
191  } while (0)
192 
193 /* Set the TCP ports into the Ports of the Packet.
194  * Make sure p->tcph is initialized and validated. */
195 #define SET_TCP_SRC_PORT(pkt, prt) do { \
196  SET_PORT(TCP_GET_SRC_PORT((pkt)), *(prt)); \
197  } while (0)
198 
199 #define SET_TCP_DST_PORT(pkt, prt) do { \
200  SET_PORT(TCP_GET_DST_PORT((pkt)), *(prt)); \
201  } while (0)
202 
203 /* Set the UDP ports into the Ports of the Packet.
204  * Make sure p->udph is initialized and validated. */
205 #define SET_UDP_SRC_PORT(pkt, prt) do { \
206  SET_PORT(UDP_GET_SRC_PORT((pkt)), *(prt)); \
207  } while (0)
208 #define SET_UDP_DST_PORT(pkt, prt) do { \
209  SET_PORT(UDP_GET_DST_PORT((pkt)), *(prt)); \
210  } while (0)
211 
212 /* Set the SCTP ports into the Ports of the Packet.
213  * Make sure p->sctph is initialized and validated. */
214 #define SET_SCTP_SRC_PORT(pkt, prt) do { \
215  SET_PORT(SCTP_GET_SRC_PORT((pkt)), *(prt)); \
216  } while (0)
217 
218 #define SET_SCTP_DST_PORT(pkt, prt) do { \
219  SET_PORT(SCTP_GET_DST_PORT((pkt)), *(prt)); \
220  } while (0)
221 
222 
223 #define GET_IPV4_SRC_ADDR_U32(p) ((p)->src.addr_data32[0])
224 #define GET_IPV4_DST_ADDR_U32(p) ((p)->dst.addr_data32[0])
225 #define GET_IPV4_SRC_ADDR_PTR(p) ((p)->src.addr_data32)
226 #define GET_IPV4_DST_ADDR_PTR(p) ((p)->dst.addr_data32)
227 
228 #define GET_IPV6_SRC_IN6ADDR(p) ((p)->src.addr_in6addr)
229 #define GET_IPV6_DST_IN6ADDR(p) ((p)->dst.addr_in6addr)
230 #define GET_IPV6_SRC_ADDR(p) ((p)->src.addr_data32)
231 #define GET_IPV6_DST_ADDR(p) ((p)->dst.addr_data32)
232 #define GET_TCP_SRC_PORT(p) ((p)->sp)
233 #define GET_TCP_DST_PORT(p) ((p)->dp)
234 
235 #define GET_PKT_LEN(p) ((p)->pktlen)
236 #define GET_PKT_DATA(p) ((((p)->ext_pkt) == NULL ) ? (uint8_t *)((p) + 1) : (p)->ext_pkt)
237 #define GET_PKT_DIRECT_DATA(p) (uint8_t *)((p) + 1)
238 #define GET_PKT_DIRECT_MAX_SIZE(p) (default_packet_size)
239 
240 #define SET_PKT_LEN(p, len) do { \
241  (p)->pktlen = (len); \
242  } while (0)
243 
244 
245 /* Port is just a uint16_t */
246 typedef uint16_t Port;
247 #define SET_PORT(v, p) ((p) = (v))
248 #define COPY_PORT(a,b) ((b) = (a))
249 
250 #define CMP_ADDR(a1, a2) \
251  (((a1)->addr_data32[3] == (a2)->addr_data32[3] && \
252  (a1)->addr_data32[2] == (a2)->addr_data32[2] && \
253  (a1)->addr_data32[1] == (a2)->addr_data32[1] && \
254  (a1)->addr_data32[0] == (a2)->addr_data32[0]))
255 #define CMP_PORT(p1, p2) \
256  ((p1) == (p2))
257 
258 /*Given a packet pkt offset to the start of the ip header in a packet
259  *We determine the ip version. */
260 #define IP_GET_RAW_VER(pkt) ((((pkt)[0] & 0xf0) >> 4))
261 
262 #define PKT_IS_IPV4(p) (((p)->ip4h != NULL))
263 #define PKT_IS_IPV6(p) (((p)->ip6h != NULL))
264 #define PKT_IS_TCP(p) (((p)->tcph != NULL))
265 #define PKT_IS_UDP(p) (((p)->udph != NULL))
266 #define PKT_IS_ICMPV4(p) (((p)->icmpv4h != NULL))
267 #define PKT_IS_ICMPV6(p) (((p)->icmpv6h != NULL))
268 #define PKT_IS_TOSERVER(p) (((p)->flowflags & FLOW_PKT_TOSERVER))
269 #define PKT_IS_TOCLIENT(p) (((p)->flowflags & FLOW_PKT_TOCLIENT))
270 
271 #define IPH_IS_VALID(p) (PKT_IS_IPV4((p)) || PKT_IS_IPV6((p)))
272 
273 /* Retrieve proto regardless of IP version */
274 #define IP_GET_IPPROTO(p) \
275  (p->proto ? p->proto : \
276  (PKT_IS_IPV4((p))? IPV4_GET_IPPROTO((p)) : (PKT_IS_IPV6((p))? IPV6_GET_L4PROTO((p)) : 0)))
277 
278 /* structure to store the sids/gids/etc the detection engine
279  * found in this packet */
280 typedef struct PacketAlert_ {
281  SigIntId num; /* Internal num, used for sorting */
282  uint8_t action; /* Internal num, used for sorting */
283  uint8_t flags;
284  const struct Signature_ *s;
285  uint64_t tx_id;
287 
288 /* flag to indicate the rule action (drop/pass) needs to be applied to the flow */
289 #define PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW 0x1
290 /** alert was generated based on state */
291 #define PACKET_ALERT_FLAG_STATE_MATCH 0x02
292 /** alert was generated based on stream */
293 #define PACKET_ALERT_FLAG_STREAM_MATCH 0x04
294 /** alert is in a tx, tx_id set */
295 #define PACKET_ALERT_FLAG_TX 0x08
296 /** action was changed by rate_filter */
297 #define PACKET_ALERT_RATE_FILTER_MODIFIED 0x10
298 
299 #define PACKET_ALERT_MAX 15
300 
301 typedef struct PacketAlerts_ {
302  uint16_t cnt;
304  /* single pa used when we're dropping,
305  * so we can log it out in the drop log. */
308 
309 /** number of decoder events we support per packet. Power of 2 minus 1
310  * for memory layout */
311 #define PACKET_ENGINE_EVENT_MAX 15
312 
313 /** data structure to store decoder, defrag and stream events */
314 typedef struct PacketEngineEvents_ {
315  uint8_t cnt; /**< number of events */
316  uint8_t events[PACKET_ENGINE_EVENT_MAX]; /**< array of events */
318 
319 typedef struct PktVar_ {
320  uint32_t id;
321  struct PktVar_ *next; /* right now just implement this as a list,
322  * in the long run we have thing of something
323  * faster. */
324  uint16_t key_len;
325  uint16_t value_len;
326  uint8_t *key;
327  uint8_t *value;
329 
330 #ifdef PROFILING
331 
332 /** \brief Per TMM stats storage */
333 typedef struct PktProfilingTmmData_ {
334  uint64_t ticks_start;
335  uint64_t ticks_end;
336 #ifdef PROFILE_LOCKING
337  uint64_t mutex_lock_cnt;
338  uint64_t mutex_lock_wait_ticks;
339  uint64_t mutex_lock_contention;
340  uint64_t spin_lock_cnt;
341  uint64_t spin_lock_wait_ticks;
342  uint64_t spin_lock_contention;
343  uint64_t rww_lock_cnt;
344  uint64_t rww_lock_wait_ticks;
345  uint64_t rww_lock_contention;
346  uint64_t rwr_lock_cnt;
347  uint64_t rwr_lock_wait_ticks;
348  uint64_t rwr_lock_contention;
349 #endif
351 
352 typedef struct PktProfilingData_ {
353  uint64_t ticks_start;
354  uint64_t ticks_end;
356 
357 typedef struct PktProfilingDetectData_ {
358  uint64_t ticks_start;
359  uint64_t ticks_end;
360  uint64_t ticks_spent;
362 
363 typedef struct PktProfilingAppData_ {
364  uint64_t ticks_spent;
366 
367 typedef struct PktProfilingLoggerData_ {
368  uint64_t ticks_start;
369  uint64_t ticks_end;
370  uint64_t ticks_spent;
372 
374  uint64_t ticks_spent;
376 
379  uint32_t size; /**< array size */
381 
382 /** \brief Per pkt stats storage */
383 typedef struct PktProfiling_ {
384  uint64_t ticks_start;
385  uint64_t ticks_end;
386 
392  uint64_t proto_detect;
394 
395 #endif /* PROFILING */
396 
397 /* forward declaration since Packet struct definition requires this */
398 struct PacketQueue_;
399 
400 /* sizes of the members:
401  * src: 17 bytes
402  * dst: 17 bytes
403  * sp/type: 1 byte
404  * dp/code: 1 byte
405  * proto: 1 byte
406  * recurs: 1 byte
407  *
408  * sum of above: 38 bytes
409  *
410  * flow ptr: 4/8 bytes
411  * flags: 1 byte
412  * flowflags: 1 byte
413  *
414  * sum of above 44/48 bytes
415  */
416 typedef struct Packet_
417 {
418  /* Addresses, Ports and protocol
419  * these are on top so we can use
420  * the Packet as a hash key */
423  union {
425  // icmp type and code of this packet
426  struct {
427  uint8_t type;
428  uint8_t code;
430  };
431  union {
433  // icmp type and code of the expected counterpart (for flows)
434  struct {
435  uint8_t type;
436  uint8_t code;
438  };
439  uint8_t proto;
440  /* make sure we can't be attacked on when the tunneled packet
441  * has the exact same tuple as the lower levels */
443 
444  uint16_t vlan_id[2];
445  uint8_t vlan_idx;
446 
447  /* flow */
448  uint8_t flowflags;
449  /* coccinelle: Packet:flowflags:FLOW_PKT_ */
450 
451  /* Pkt Flags */
452  uint32_t flags;
453 
454  struct Flow_ *flow;
455 
456  /* raw hash value for looking up the flow, will need to modulated to the
457  * hash size still */
458  uint32_t flow_hash;
459 
460  struct timeval ts;
461 
462  union {
463  /* nfq stuff */
464 #ifdef HAVE_NFLOG
465  NFLOGPacketVars nflog_v;
466 #endif /* HAVE_NFLOG */
467 #ifdef NFQ
469 #endif /* NFQ */
470 #ifdef IPFW
472 #endif /* IPFW */
473 #ifdef AF_PACKET
474  AFPPacketVars afp_v;
475 #endif
476 #ifdef HAVE_NETMAP
477  NetmapPacketVars netmap_v;
478 #endif
479 #ifdef HAVE_PFRING
480 #ifdef HAVE_PF_RING_FLOW_OFFLOAD
481  PfringPacketVars pfring_v;
482 #endif
483 #endif
484 #ifdef WINDIVERT
485  WinDivertPacketVars windivert_v;
486 #endif /* WINDIVERT */
487 #ifdef HAVE_DPDK
488  DPDKPacketVars dpdk_v;
489 #endif
490 
491  /* A chunk of memory that a plugin can use for its packet vars. */
493 
494  /** libpcap vars: shared by Pcap Live mode and Pcap File mode */
496  };
497 
498  /** The release function for packet structure and data */
499  void (*ReleasePacket)(struct Packet_ *);
500  /** The function triggering bypass the flow in the capture method.
501  * Return 1 for success and 0 on error */
502  int (*BypassPacketsFlow)(struct Packet_ *);
503 
504  /* pkt vars */
506 
507  /* header pointers */
508  EthernetHdr *ethh;
509 
510  /* Checksum for IP packets. */
512  /* Check sum for TCP, UDP or ICMP packets */
514 
516 
518 
519  /* IPv4 and IPv6 are mutually exclusive */
520  union {
522  struct {
525  };
526  };
527  /* Can only be one of TCP, UDP, ICMP at any given time */
528  union {
533 #define tcpvars l4vars.tcpvars
534 #define icmpv4vars l4vars.icmpv4vars
535 #define icmpv6vars l4vars.icmpv6vars
536 
537  TCPHdr *tcph;
538 
539  UDPHdr *udph;
540 
541  SCTPHdr *sctph;
542 
543  ESPHdr *esph;
544 
545  ICMPV4Hdr *icmpv4h;
546 
548 
549  PPPHdr *ppph;
551  PPPOEDiscoveryHdr *pppoedh;
552 
553  GREHdr *greh;
554 
555  /* ptr to the payload of the packet
556  * with it's length. */
557  uint8_t *payload;
558  uint16_t payload_len;
559 
560  /* IPS action to take */
561  uint8_t action;
562 
563  uint8_t pkt_src;
564 
565  /* storage: set to pointer to heap and extended via allocation if necessary */
566  uint32_t pktlen;
567  uint8_t *ext_pkt;
568 
569  /* Incoming interface */
571 
573 
574  struct Host_ *host_src;
575  struct Host_ *host_dst;
576 
577  /** packet number in the pcap file, matches wireshark */
578  uint64_t pcap_cnt;
579 
580 
581  /* engine events */
583 
585 
586  /* double linked list ptrs */
587  struct Packet_ *next;
588  struct Packet_ *prev;
589 
590  /** data linktype in host order */
591  int datalink;
592 
593  /* tunnel/encapsulation handling */
594  struct Packet_ *root; /* in case of tunnel this is a ptr
595  * to the 'real' packet, the one we
596  * need to set the verdict on --
597  * It should always point to the lowest
598  * packet in a encapsulated packet */
599 
600  /** mutex to protect access to:
601  * - tunnel_rtv_cnt
602  * - tunnel_tpr_cnt
603  */
605  /* ready to set verdict counter, only set in root */
606  uint16_t tunnel_rtv_cnt;
607  /* tunnel packet ref count */
608  uint16_t tunnel_tpr_cnt;
609 
610  /** tenant id for this packet, if any. If 0 then no tenant was assigned. */
611  uint32_t tenant_id;
612 
613  /* The Packet pool from which this packet was allocated. Used when returning
614  * the packet to its owner's stack. If NULL, then allocated with malloc.
615  */
616  struct PktPool_ *pool;
617 
618  /* count decoded layers of packet : too many layers
619  * cause issues with performance and stability (stack exhaustion)
620  */
622 
623 #ifdef PROFILING
625 #endif
626 #ifdef HAVE_NAPATECH
628 #endif
630 
631 /** highest mtu of the interfaces we monitor */
632 extern int g_default_mtu;
633 #define DEFAULT_MTU 1500
634 #define MINIMUM_MTU 68 /**< ipv4 minimum: rfc791 */
635 
636 #define DEFAULT_PACKET_SIZE (DEFAULT_MTU + ETHERNET_HEADER_LEN)
637 /* storage: maximum ip packet size + link header */
638 #define MAX_PAYLOAD_SIZE (IPV6_HEADER_LEN + 65536 + 28)
639 extern uint32_t default_packet_size;
640 #define SIZE_OF_PACKET (default_packet_size + sizeof(Packet))
641 
642 /** \brief Structure to hold thread specific data for all decode modules */
643 typedef struct DecodeThreadVars_
644 {
645  /** Specific context for udp protocol detection (here atm) */
647 
648  /** stats/counters */
649  uint16_t counter_pkts;
650  uint16_t counter_bytes;
655 
656  uint16_t counter_invalid;
657 
658  uint16_t counter_eth;
659  uint16_t counter_chdlc;
660  uint16_t counter_ipv4;
661  uint16_t counter_ipv6;
662  uint16_t counter_tcp;
663  uint16_t counter_udp;
664  uint16_t counter_icmpv4;
665  uint16_t counter_icmpv6;
666 
667  uint16_t counter_sll;
668  uint16_t counter_raw;
669  uint16_t counter_null;
670  uint16_t counter_sctp;
671  uint16_t counter_esp;
672  uint16_t counter_ppp;
673  uint16_t counter_geneve;
674  uint16_t counter_gre;
675  uint16_t counter_vlan;
677  uint16_t counter_vxlan;
678  uint16_t counter_vntag;
680  uint16_t counter_pppoe;
681  uint16_t counter_teredo;
682  uint16_t counter_mpls;
685  uint16_t counter_erspan;
686  uint16_t counter_nsh;
687 
688  /** frag stats - defrag runs in the context of the decoder. */
696 
698 
709 
714 
716 
717  /* thread data for flow logging api: only used at forced
718  * flow recycle during lookups */
720 
722 
723 typedef struct CaptureStats_ {
724 
729 
731 
732 void CaptureStatsUpdate(ThreadVars *tv, CaptureStats *s, const Packet *p);
734 
735 #define PACKET_CLEAR_L4VARS(p) do { \
736  memset(&(p)->l4vars, 0x00, sizeof((p)->l4vars)); \
737  } while (0)
738 
739 /**
740  * \brief reset these to -1(indicates that the packet is fresh from the queue)
741  */
742 #define PACKET_RESET_CHECKSUMS(p) do { \
743  (p)->level3_comp_csum = -1; \
744  (p)->level4_comp_csum = -1; \
745  } while (0)
746 
747 /* if p uses extended data, free them */
748 #define PACKET_FREE_EXTDATA(p) do { \
749  if ((p)->ext_pkt) { \
750  if (!((p)->flags & PKT_ZERO_COPY)) { \
751  SCFree((p)->ext_pkt); \
752  } \
753  (p)->ext_pkt = NULL; \
754  } \
755  } while(0)
756 
757 /**
758  * \brief Initialize a packet structure for use.
759  */
760 #define PACKET_INITIALIZE(p) { \
761  SCMutexInit(&(p)->tunnel_mutex, NULL); \
762  PACKET_RESET_CHECKSUMS((p)); \
763  (p)->livedev = NULL; \
764 }
765 
766 #define PACKET_RELEASE_REFS(p) do { \
767  FlowDeReference(&((p)->flow)); \
768  HostDeReference(&((p)->host_src)); \
769  HostDeReference(&((p)->host_dst)); \
770  } while (0)
771 
772 /**
773  * \brief Recycle a packet structure for reuse.
774  */
775 #define PACKET_REINIT(p) \
776  do { \
777  CLEAR_ADDR(&(p)->src); \
778  CLEAR_ADDR(&(p)->dst); \
779  (p)->sp = 0; \
780  (p)->dp = 0; \
781  (p)->proto = 0; \
782  (p)->recursion_level = 0; \
783  PACKET_FREE_EXTDATA((p)); \
784  (p)->flags = (p)->flags & PKT_ALLOC; \
785  (p)->flowflags = 0; \
786  (p)->pkt_src = 0; \
787  (p)->vlan_id[0] = 0; \
788  (p)->vlan_id[1] = 0; \
789  (p)->vlan_idx = 0; \
790  (p)->ts.tv_sec = 0; \
791  (p)->ts.tv_usec = 0; \
792  (p)->datalink = 0; \
793  (p)->action = 0; \
794  if ((p)->pktvar != NULL) { \
795  PktVarFree((p)->pktvar); \
796  (p)->pktvar = NULL; \
797  } \
798  (p)->ethh = NULL; \
799  if ((p)->ip4h != NULL) { \
800  CLEAR_IPV4_PACKET((p)); \
801  } \
802  if ((p)->ip6h != NULL) { \
803  CLEAR_IPV6_PACKET((p)); \
804  } \
805  if ((p)->tcph != NULL) { \
806  CLEAR_TCP_PACKET((p)); \
807  } \
808  if ((p)->udph != NULL) { \
809  CLEAR_UDP_PACKET((p)); \
810  } \
811  if ((p)->sctph != NULL) { \
812  CLEAR_SCTP_PACKET((p)); \
813  } \
814  if ((p)->esph != NULL) { \
815  CLEAR_ESP_PACKET((p)); \
816  } \
817  if ((p)->icmpv4h != NULL) { \
818  CLEAR_ICMPV4_PACKET((p)); \
819  } \
820  if ((p)->icmpv6h != NULL) { \
821  CLEAR_ICMPV6_PACKET((p)); \
822  } \
823  (p)->ppph = NULL; \
824  (p)->pppoesh = NULL; \
825  (p)->pppoedh = NULL; \
826  (p)->greh = NULL; \
827  (p)->payload = NULL; \
828  (p)->payload_len = 0; \
829  (p)->BypassPacketsFlow = NULL; \
830  (p)->pktlen = 0; \
831  (p)->alerts.cnt = 0; \
832  (p)->alerts.drop.action = 0; \
833  (p)->pcap_cnt = 0; \
834  (p)->tunnel_rtv_cnt = 0; \
835  (p)->tunnel_tpr_cnt = 0; \
836  (p)->events.cnt = 0; \
837  AppLayerDecoderEventsResetEvents((p)->app_layer_events); \
838  (p)->next = NULL; \
839  (p)->prev = NULL; \
840  (p)->root = NULL; \
841  (p)->livedev = NULL; \
842  PACKET_RESET_CHECKSUMS((p)); \
843  PACKET_PROFILING_RESET((p)); \
844  p->tenant_id = 0; \
845  p->nb_decoded_layers = 0; \
846  } while (0)
847 
848 #define PACKET_RECYCLE(p) do { \
849  PACKET_RELEASE_REFS((p)); \
850  PACKET_REINIT((p)); \
851  } while (0)
852 
853 /**
854  * \brief Cleanup a packet so that we can free it. No memset needed..
855  */
856 #define PACKET_DESTRUCTOR(p) do { \
857  if ((p)->pktvar != NULL) { \
858  PktVarFree((p)->pktvar); \
859  } \
860  PACKET_FREE_EXTDATA((p)); \
861  SCMutexDestroy(&(p)->tunnel_mutex); \
862  AppLayerDecoderEventsFreeEvents(&(p)->app_layer_events); \
863  PACKET_PROFILING_RESET((p)); \
864  } while (0)
865 
866 
867 /* macro's for setting the action
868  * handle the case of a root packet
869  * for tunnels */
870 
871 #define PACKET_SET_ACTION(p, a) (p)->action = (a)
872 
873 static inline void PacketSetAction(Packet *p, const uint8_t a)
874 {
875  if (likely(p->root == NULL)) {
876  PACKET_SET_ACTION(p, a);
877  } else {
878  PACKET_SET_ACTION(p->root, a);
879  }
880 }
881 
882 #define PACKET_ALERT(p) PACKET_SET_ACTION(p, ACTION_ALERT)
883 
884 #define PACKET_ACCEPT(p) PACKET_SET_ACTION(p, ACTION_ACCEPT)
885 
886 #define PACKET_DROP(p) PACKET_SET_ACTION(p, ACTION_DROP)
887 
888 #define PACKET_REJECT(p) PACKET_SET_ACTION(p, (ACTION_REJECT|ACTION_DROP))
889 
890 #define PACKET_REJECT_DST(p) PACKET_SET_ACTION(p, (ACTION_REJECT_DST|ACTION_DROP))
891 
892 #define PACKET_REJECT_BOTH(p) PACKET_SET_ACTION(p, (ACTION_REJECT_BOTH|ACTION_DROP))
893 
894 #define PACKET_PASS(p) PACKET_SET_ACTION(p, ACTION_PASS)
895 
896 #define PACKET_TEST_ACTION(p, a) (p)->action &(a)
897 
898 static inline uint8_t PacketTestAction(const Packet *p, const uint8_t a)
899 {
900  if (likely(p->root == NULL)) {
901  return PACKET_TEST_ACTION(p, a);
902  } else {
903  return PACKET_TEST_ACTION(p->root, a);
904  }
905 }
906 
907 #define PACKET_UPDATE_ACTION(p, a) (p)->action |= (a)
908 static inline void PacketUpdateAction(Packet *p, const uint8_t a)
909 {
910  if (likely(p->root == NULL)) {
911  PACKET_UPDATE_ACTION(p, a);
912  } else {
913  PACKET_UPDATE_ACTION(p->root, a);
914  }
915 }
916 
917 #define TUNNEL_INCR_PKT_RTV_NOLOCK(p) do { \
918  ((p)->root ? (p)->root->tunnel_rtv_cnt++ : (p)->tunnel_rtv_cnt++); \
919  } while (0)
920 
921 #define TUNNEL_INCR_PKT_TPR(p) do { \
922  SCMutexLock((p)->root ? &(p)->root->tunnel_mutex : &(p)->tunnel_mutex); \
923  ((p)->root ? (p)->root->tunnel_tpr_cnt++ : (p)->tunnel_tpr_cnt++); \
924  SCMutexUnlock((p)->root ? &(p)->root->tunnel_mutex : &(p)->tunnel_mutex); \
925  } while (0)
926 
927 #define TUNNEL_PKT_RTV(p) ((p)->root ? (p)->root->tunnel_rtv_cnt : (p)->tunnel_rtv_cnt)
928 #define TUNNEL_PKT_TPR(p) ((p)->root ? (p)->root->tunnel_tpr_cnt : (p)->tunnel_tpr_cnt)
929 
930 #define IS_TUNNEL_PKT(p) (((p)->flags & PKT_TUNNEL))
931 #define SET_TUNNEL_PKT(p) ((p)->flags |= PKT_TUNNEL)
932 #define UNSET_TUNNEL_PKT(p) ((p)->flags &= ~PKT_TUNNEL)
933 #define IS_TUNNEL_ROOT_PKT(p) (IS_TUNNEL_PKT(p) && (p)->root == NULL)
934 
935 #define IS_TUNNEL_PKT_VERDICTED(p) (((p)->flags & PKT_TUNNEL_VERDICTED))
936 #define SET_TUNNEL_PKT_VERDICTED(p) ((p)->flags |= PKT_TUNNEL_VERDICTED)
937 
945  DECODE_TUNNEL_IPV6_TEREDO, /**< separate protocol for stricter error handling */
949 };
950 
952  const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto);
953 Packet *PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto);
954 void PacketDefragPktSetupParent(Packet *parent);
961 void PacketFree(Packet *p);
962 void PacketFreeOrRelease(Packet *p);
963 int PacketCallocExtPkt(Packet *p, int datalen);
964 int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen);
965 int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen);
966 int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen);
967 const char *PktSrcToString(enum PktSrcEnum pkt_src);
969 void PacketSwap(Packet *p);
970 
974  const DecodeThreadVars *dtv, const Packet *p);
975 
976 /* decoder functions */
977 int DecodeEthernet(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
978 int DecodeSll(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
979 int DecodePPP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
980 int DecodePPPOESession(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
981 int DecodePPPOEDiscovery(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
982 int DecodeNull(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
983 int DecodeRaw(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
984 int DecodeIPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
985 int DecodeIPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
986 int DecodeICMPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
987 int DecodeICMPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
988 int DecodeTCP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
989 int DecodeUDP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
990 int DecodeSCTP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
991 int DecodeESP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
992 int DecodeGRE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
993 int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
994 int DecodeVNTag(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
995 int DecodeIEEE8021ah(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
996 int DecodeGeneve(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
997 int DecodeVXLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
998 int DecodeMPLS(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
999 int DecodeERSPAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1000 int DecodeERSPANTypeI(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1001 int DecodeCHDLC(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1002 int DecodeTEMPLATE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1003 int DecodeNSH(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1004 
1005 #ifdef UNITTESTS
1006 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
1007  uint16_t hdrextlen, uint16_t plen,
1008  uint16_t prev_hdrextlen);
1009 #endif
1010 
1011 void AddressDebugPrint(Address *);
1012 
1014  const uint8_t *pkt, uint32_t len);
1015 void DecodeGlobalConfig(void);
1016 void DecodeUnregisterCounters(void);
1017 
1018 /** \brief Set the No payload inspection Flag for the packet.
1019  *
1020  * \param p Packet to set the flag in
1021  */
1022 #define DecodeSetNoPayloadInspectionFlag(p) do { \
1023  (p)->flags |= PKT_NOPAYLOAD_INSPECTION; \
1024  } while (0)
1025 
1026 #define DecodeUnsetNoPayloadInspectionFlag(p) do { \
1027  (p)->flags &= ~PKT_NOPAYLOAD_INSPECTION; \
1028  } while (0)
1029 
1030 /** \brief Set the No packet inspection Flag for the packet.
1031  *
1032  * \param p Packet to set the flag in
1033  */
1034 #define DecodeSetNoPacketInspectionFlag(p) do { \
1035  (p)->flags |= PKT_NOPACKET_INSPECTION; \
1036  } while (0)
1037 #define DecodeUnsetNoPacketInspectionFlag(p) do { \
1038  (p)->flags &= ~PKT_NOPACKET_INSPECTION; \
1039  } while (0)
1040 
1041 
1042 #define ENGINE_SET_EVENT(p, e) do { \
1043  SCLogDebug("p %p event %d", (p), e); \
1044  if ((p)->events.cnt < PACKET_ENGINE_EVENT_MAX) { \
1045  (p)->events.events[(p)->events.cnt] = e; \
1046  (p)->events.cnt++; \
1047  } \
1048 } while(0)
1049 
1050 #define ENGINE_SET_INVALID_EVENT(p, e) do { \
1051  p->flags |= PKT_IS_INVALID; \
1052  ENGINE_SET_EVENT(p, e); \
1053 } while(0)
1054 
1055 
1056 
1057 #define ENGINE_ISSET_EVENT(p, e) ({ \
1058  int r = 0; \
1059  uint8_t u; \
1060  for (u = 0; u < (p)->events.cnt; u++) { \
1061  if ((p)->events.events[u] == (e)) { \
1062  r = 1; \
1063  break; \
1064  } \
1065  } \
1066  r; \
1067 })
1068 
1069 #ifndef IPPROTO_IPIP
1070 #define IPPROTO_IPIP 4
1071 #endif
1072 
1073 /* older libcs don't contain a def for IPPROTO_DCCP
1074  * inside of <netinet/in.h>
1075  * if it isn't defined let's define it here.
1076  */
1077 #ifndef IPPROTO_DCCP
1078 #define IPPROTO_DCCP 33
1079 #endif
1080 
1081 /* older libcs don't contain a def for IPPROTO_SCTP
1082  * inside of <netinet/in.h>
1083  * if it isn't defined let's define it here.
1084  */
1085 #ifndef IPPROTO_SCTP
1086 #define IPPROTO_SCTP 132
1087 #endif
1088 
1089 #ifndef IPPROTO_MH
1090 #define IPPROTO_MH 135
1091 #endif
1092 
1093 /* Host Identity Protocol (rfc 5201) */
1094 #ifndef IPPROTO_HIP
1095 #define IPPROTO_HIP 139
1096 #endif
1097 
1098 #ifndef IPPROTO_SHIM6
1099 #define IPPROTO_SHIM6 140
1100 #endif
1101 
1102 /* pcap provides this, but we don't want to depend on libpcap */
1103 #ifndef DLT_EN10MB
1104 #define DLT_EN10MB 1
1105 #endif
1106 
1107 #ifndef DLT_C_HDLC
1108 #define DLT_C_HDLC 104
1109 #endif
1110 
1111 /* taken from pcap's bpf.h */
1112 #ifndef DLT_RAW
1113 #ifdef __OpenBSD__
1114 #define DLT_RAW 14 /* raw IP */
1115 #else
1116 #define DLT_RAW 12 /* raw IP */
1117 #endif
1118 #endif
1119 
1120 #ifndef DLT_NULL
1121 #define DLT_NULL 0
1122 #endif
1123 
1124 /** libpcap shows us the way to linktype codes
1125  * \todo we need more & maybe put them in a separate file? */
1126 #define LINKTYPE_NULL DLT_NULL
1127 #define LINKTYPE_ETHERNET DLT_EN10MB
1128 #define LINKTYPE_LINUX_SLL 113
1129 #define LINKTYPE_PPP 9
1130 #define LINKTYPE_RAW DLT_RAW
1131 /* http://www.tcpdump.org/linktypes.html defines DLT_RAW as 101, yet others don't.
1132  * Libpcap on at least OpenBSD returns 101 as datalink type for RAW pcaps though. */
1133 #define LINKTYPE_RAW2 101
1134 #define LINKTYPE_IPV4 228
1135 #define LINKTYPE_GRE_OVER_IP 778
1136 #define LINKTYPE_CISCO_HDLC DLT_C_HDLC
1137 #define PPP_OVER_GRE 11
1138 #define VLAN_OVER_GRE 13
1140 /* Packet Flags */
1141 
1142 /** Flag to indicate that packet header or contents should not be inspected */
1143 #define PKT_NOPACKET_INSPECTION BIT_U32(0)
1144 // vacancy
1145 
1146 /** Flag to indicate that packet contents should not be inspected */
1147 #define PKT_NOPAYLOAD_INSPECTION BIT_U32(2)
1148 /** Packet was alloc'd this run, needs to be freed */
1149 #define PKT_ALLOC BIT_U32(3)
1150 /** Packet has matched a tag */
1151 #define PKT_HAS_TAG BIT_U32(4)
1152 /** Packet payload was added to reassembled stream */
1153 #define PKT_STREAM_ADD BIT_U32(5)
1154 /** Packet is part of established stream */
1155 #define PKT_STREAM_EST BIT_U32(6)
1156 /** Stream is in eof state */
1157 #define PKT_STREAM_EOF BIT_U32(7)
1158 #define PKT_HAS_FLOW BIT_U32(8)
1159 /** Pseudo packet to end the stream */
1160 #define PKT_PSEUDO_STREAM_END BIT_U32(9)
1161 /** Packet is modified by the stream engine, we need to recalc the csum and \
1162  reinject/replace */
1163 #define PKT_STREAM_MODIFIED BIT_U32(10)
1164 /** Packet mark is modified */
1165 #define PKT_MARK_MODIFIED BIT_U32(11)
1166 /** Exclude packet from pcap logging as it's part of a stream that has reassembly \
1167  depth reached. */
1168 #define PKT_STREAM_NOPCAPLOG BIT_U32(12)
1170 #define PKT_TUNNEL BIT_U32(13)
1171 #define PKT_TUNNEL_VERDICTED BIT_U32(14)
1173 /** Packet checksum is not computed (TX packet for example) */
1174 #define PKT_IGNORE_CHECKSUM BIT_U32(15)
1175 /** Packet comes from zero copy (ext_pkt must not be freed) */
1176 #define PKT_ZERO_COPY BIT_U32(16)
1178 #define PKT_HOST_SRC_LOOKED_UP BIT_U32(17)
1179 #define PKT_HOST_DST_LOOKED_UP BIT_U32(18)
1181 /** Packet is a fragment */
1182 #define PKT_IS_FRAGMENT BIT_U32(19)
1183 #define PKT_IS_INVALID BIT_U32(20)
1184 #define PKT_PROFILE BIT_U32(21)
1186 /** indication by decoder that it feels the packet should be handled by
1187  * flow engine: Packet::flow_hash will be set */
1188 #define PKT_WANTS_FLOW BIT_U32(22)
1190 /** protocol detection done */
1191 #define PKT_PROTO_DETECT_TS_DONE BIT_U32(23)
1192 #define PKT_PROTO_DETECT_TC_DONE BIT_U32(24)
1194 #define PKT_REBUILT_FRAGMENT \
1195  BIT_U32(25) /**< Packet is rebuilt from \
1196  * fragments. */
1197 #define PKT_DETECT_HAS_STREAMDATA \
1198  BIT_U32(26) /**< Set by Detect() if raw stream data is available. */
1200 #define PKT_PSEUDO_DETECTLOG_FLUSH BIT_U32(27) /**< Detect/log flush for protocol upgrade */
1202 /** Packet is part of stream in known bad condition (loss, wrong thread),
1203  * so flag it for not setting stream events */
1204 #define PKT_STREAM_NO_EVENTS BIT_U32(28)
1206 /** \brief return 1 if the packet is a pseudo packet */
1207 #define PKT_IS_PSEUDOPKT(p) \
1208  ((p)->flags & (PKT_PSEUDO_STREAM_END|PKT_PSEUDO_DETECTLOG_FLUSH))
1209 
1210 #define PKT_SET_SRC(p, src_val) ((p)->pkt_src = src_val)
1212 #define PKT_DEFAULT_MAX_DECODED_LAYERS 16
1213 extern uint8_t decoder_max_layers;
1214 
1215 static inline bool PacketIncreaseCheckLayers(Packet *p)
1216 {
1217  p->nb_decoded_layers++;
1220  return false;
1221  }
1222  return true;
1223 }
1224 
1225 /** \brief return true if *this* packet needs to trigger a verdict.
1226  *
1227  * If we have the root packet, and we have none outstanding,
1228  * we can verdict now.
1229  *
1230  * If we have a upper layer packet, it's the only one and root
1231  * is already processed, we can verdict now.
1232  *
1233  * Otherwise, a future packet will issue the verdict.
1234  */
1235 static inline bool VerdictTunnelPacket(Packet *p)
1236 {
1237  bool verdict = true;
1238  SCMutex *m = p->root ? &p->root->tunnel_mutex : &p->tunnel_mutex;
1239  SCMutexLock(m);
1240  const uint16_t outstanding = TUNNEL_PKT_TPR(p) - TUNNEL_PKT_RTV(p);
1241  SCLogDebug("tunnel: outstanding %u", outstanding);
1242 
1243  /* if there are packets outstanding, we won't verdict this one */
1244  if (IS_TUNNEL_ROOT_PKT(p) && !IS_TUNNEL_PKT_VERDICTED(p) && !outstanding) {
1245  // verdict
1246  SCLogDebug("root %p: verdict", p);
1247  } else if (!IS_TUNNEL_ROOT_PKT(p) && outstanding == 1 && p->root && IS_TUNNEL_PKT_VERDICTED(p->root)) {
1248  // verdict
1249  SCLogDebug("tunnel %p: verdict", p);
1250  } else {
1251  verdict = false;
1252  }
1253  SCMutexUnlock(m);
1254  return verdict;
1255 }
1256 
1257 static inline void DecodeLinkLayer(ThreadVars *tv, DecodeThreadVars *dtv,
1258  const int datalink, Packet *p, const uint8_t *data, const uint32_t len)
1259 {
1260  /* call the decoder */
1261  switch (datalink) {
1262  case LINKTYPE_ETHERNET:
1263  DecodeEthernet(tv, dtv, p, data, len);
1264  break;
1265  case LINKTYPE_LINUX_SLL:
1266  DecodeSll(tv, dtv, p, data, len);
1267  break;
1268  case LINKTYPE_PPP:
1269  DecodePPP(tv, dtv, p, data, len);
1270  break;
1271  case LINKTYPE_RAW:
1272  case LINKTYPE_GRE_OVER_IP:
1273  DecodeRaw(tv, dtv, p, data, len);
1274  break;
1275  case LINKTYPE_NULL:
1276  DecodeNull(tv, dtv, p, data, len);
1277  break;
1278  case LINKTYPE_CISCO_HDLC:
1279  DecodeCHDLC(tv, dtv, p, data, len);
1280  break;
1281  default:
1282  SCLogError(SC_ERR_DATALINK_UNIMPLEMENTED, "datalink type "
1283  "%"PRId32" not yet supported", datalink);
1284  break;
1285  }
1286 }
1287 
1288 /** \brief decode network layer
1289  * \retval bool true if successful, false if unknown */
1290 static inline bool DecodeNetworkLayer(ThreadVars *tv, DecodeThreadVars *dtv,
1291  const uint16_t proto, Packet *p, const uint8_t *data, const uint32_t len)
1292 {
1293  switch (proto) {
1294  case ETHERNET_TYPE_IP: {
1295  uint16_t ip_len = (len < USHRT_MAX) ? (uint16_t)len : (uint16_t)USHRT_MAX;
1296  DecodeIPV4(tv, dtv, p, data, ip_len);
1297  break;
1298  }
1299  case ETHERNET_TYPE_IPV6: {
1300  uint16_t ip_len = (len < USHRT_MAX) ? (uint16_t)len : (uint16_t)USHRT_MAX;
1301  DecodeIPV6(tv, dtv, p, data, ip_len);
1302  break;
1303  }
1305  DecodePPPOESession(tv, dtv, p, data, len);
1306  break;
1308  DecodePPPOEDiscovery(tv, dtv, p, data, len);
1309  break;
1310  case ETHERNET_TYPE_VLAN:
1311  case ETHERNET_TYPE_8021AD:
1313  if (p->vlan_idx >= 2) {
1315  } else {
1316  DecodeVLAN(tv, dtv, p, data, len);
1317  }
1318  break;
1319  case ETHERNET_TYPE_8021AH:
1320  DecodeIEEE8021ah(tv, dtv, p, data, len);
1321  break;
1322  case ETHERNET_TYPE_ARP:
1323  break;
1326  DecodeMPLS(tv, dtv, p, data, len);
1327  break;
1328  case ETHERNET_TYPE_DCE:
1331  } else {
1332  DecodeEthernet(tv, dtv, p, data, len);
1333  }
1334  break;
1335  case ETHERNET_TYPE_VNTAG:
1336  DecodeVNTag(tv, dtv, p, data, len);
1337  break;
1338  case ETHERNET_TYPE_NSH:
1339  DecodeNSH(tv, dtv, p, data, len);
1340  break;
1341  default:
1342  SCLogDebug("unknown ether type: %" PRIx16 "", proto);
1343  return false;
1344  }
1345  return true;
1346 }
1347 
1348 #endif /* __DECODE_H__ */
CaptureStats
struct CaptureStats_ CaptureStats
suricata-plugin.h
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:1042
DecodeThreadVars_::counter_flow_get_used_eval_busy
uint16_t counter_flow_get_used_eval_busy
Definition: decode.h:707
Packet_::greh
GREHdr * greh
Definition: decode.h:553
Packet_::icmp_d
struct Packet_::@34::@42 icmp_d
decode-ethernet.h
decode-raw.h
decode-tcp.h
DecodeThreadVars_::counter_defrag_ipv4_reassembled
uint16_t counter_defrag_ipv4_reassembled
Definition: decode.h:690
Packet_::proto
uint8_t proto
Definition: decode.h:439
spin_lock_cnt
thread_local uint64_t spin_lock_cnt
DecodeIPV6
int DecodeIPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-ipv6.c:570
DecodeERSPAN
int DecodeERSPAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
ERSPAN Type II.
Definition: decode-erspan.c:76
DecodeGeneve
int DecodeGeneve(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-geneve.c:185
source-nflog.h
decode-mpls.h
DecodeThreadVars_::counter_flow_udp
uint16_t counter_flow_udp
Definition: decode.h:700
len
uint8_t len
Definition: app-layer-dnp3.h:2
DecodeThreadVars_::counter_bytes
uint16_t counter_bytes
Definition: decode.h:650
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:944
source-pcap.h
CaptureStats_::counter_ips_blocked
uint16_t counter_ips_blocked
Definition: decode.h:726
PktProfilingData_::ticks_end
uint64_t ticks_end
Definition: decode.h:354
decode-erspan.h
decode-vxlan.h
PACKET_SET_ACTION
#define PACKET_SET_ACTION(p, a)
Definition: decode.h:871
PacketAlert_::s
const struct Signature_ * s
Definition: decode.h:284
DecodeThreadVars_::counter_eth
uint16_t counter_eth
Definition: decode.h:658
IPV4Vars_
Definition: decode-ipv4.h:173
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
Packet_::sctph
SCTPHdr * sctph
Definition: decode.h:541
NapatechPacketVars_
Definition: util-napatech.h:30
Packet_::code
uint8_t code
Definition: decode.h:428
PacketFreeOrRelease
void PacketFreeOrRelease(Packet *p)
Return a packet to where it was allocated.
Definition: decode.c:172
PLUGIN_VAR_SIZE
#define PLUGIN_VAR_SIZE
Definition: suricata-plugin.h:30
DecodeThreadVars_::counter_flow_icmp4
uint16_t counter_flow_icmp4
Definition: decode.h:701
DecodeThreadVars_::counter_vxlan
uint16_t counter_vxlan
Definition: decode.h:677
DecodeThreadVars_::counter_max_pkt_size
uint16_t counter_max_pkt_size
Definition: decode.h:652
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:273
decode-pppoe.h
Packet_::vlan_id
uint16_t vlan_id[2]
Definition: decode.h:444
PacketBypassCallback
void PacketBypassCallback(Packet *p)
Definition: decode.c:419
DecodeSCTP
int DecodeSCTP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-sctp.c:66
ICMPV4Vars_
Definition: decode-icmpv4.h:185
DecodeThreadVars_::counter_avg_pkt_size
uint16_t counter_avg_pkt_size
Definition: decode.h:651
PktProfiling_
Per pkt stats storage.
Definition: decode.h:383
Address_::address_un_data16
uint16_t address_un_data16[8]
Definition: decode.h:126
PktProfilingPrefilterData_::engines
PktProfilingPrefilterEngine * engines
Definition: decode.h:378
DecodePPP
int DecodePPP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-ppp.c:44
Address_::address_un_in6
struct in6_addr address_un_in6
Definition: decode.h:128
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
PktProfilingTmmData_
Per TMM stats storage.
Definition: decode.h:333
IPV6ExtHdrs_
Definition: decode-ipv6.h:215
PktPool_
Definition: tmqh-packetpool.h:40
Packet_::host_src
struct Host_ * host_src
Definition: decode.h:574
Packet_::icmp_s
struct Packet_::@32::@41 icmp_s
PPPOESessionHdr_
Definition: decode-pppoe.h:38
PacketEngineEvents_::events
uint8_t events[PACKET_ENGINE_EVENT_MAX]
Definition: decode.h:316
CaptureStats_
Definition: decode.h:723
DECODE_TUNNEL_IPV6_TEREDO
@ DECODE_TUNNEL_IPV6_TEREDO
Definition: decode.h:945
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
DecodeEthernet
int DecodeEthernet(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-ethernet.c:42
rwr_lock_cnt
thread_local uint64_t rwr_lock_cnt
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:578
PktProfiling_::ticks_end
uint64_t ticks_end
Definition: decode.h:385
TCPVars_
Definition: decode-tcp.h:155
AddressDebugPrint
void AddressDebugPrint(Address *)
Debug print function for printing addresses.
Definition: decode.c:636
PKT_SRC_DECODER_IPV4
@ PKT_SRC_DECODER_IPV4
Definition: decode.h:53
DecodeThreadVars_::counter_flow_spare_sync_avg
uint16_t counter_flow_spare_sync_avg
Definition: decode.h:713
PacketDefragPktSetup
Packet * PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto)
Setup a pseudo packet (reassembled frags)
Definition: decode.c:363
PacketAlerts_::alerts
PacketAlert alerts[PACKET_ALERT_MAX]
Definition: decode.h:303
PacketQueue_
simple fifo queue for packets with mutex and cond Calling the mutex or triggering the cond is respons...
Definition: packet-queue.h:47
Packet_::payload
uint8_t * payload
Definition: decode.h:557
PacketAlerts_::cnt
uint16_t cnt
Definition: decode.h:302
GENERIC_TOO_MANY_LAYERS
@ GENERIC_TOO_MANY_LAYERS
Definition: decode-events.h:220
ETHERNET_TYPE_IPV6
#define ETHERNET_TYPE_IPV6
Definition: decode-ethernet.h:39
PKT_SRC_CAPTURE_TIMEOUT
@ PKT_SRC_CAPTURE_TIMEOUT
Definition: decode.h:61
DecodeUDP
int DecodeUDP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-udp.c:75
action-globals.h
Packet_::flags
uint32_t flags
Definition: decode.h:452
decode-udp.h
Packet_::action
uint8_t action
Definition: decode.h:561
PktProfilingDetectData
struct PktProfilingDetectData_ PktProfilingDetectData
decode-null.h
DecodeThreadVars_::counter_vntag
uint16_t counter_vntag
Definition: decode.h:678
Packet_::vlan_idx
uint8_t vlan_idx
Definition: decode.h:445
Flow_
Flow data structure.
Definition: flow.h:353
DecodeThreadVars_::counter_flow_get_used_eval
uint16_t counter_flow_get_used_eval
Definition: decode.h:705
LiveDevice_
Definition: util-device.h:40
PROF_DETECT_SIZE
@ PROF_DETECT_SIZE
Definition: suricata-common.h:432
PktVar_::next
struct PktVar_ * next
Definition: decode.h:321
DecoderFunc
int(* DecoderFunc)(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode.h:1013
PktProfilingTmmData_::ticks_end
uint64_t ticks_end
Definition: decode.h:335
Packet_::ipfw_v
IPFWPacketVars ipfw_v
Definition: decode.h:471
Packet_::pool
struct PktPool_ * pool
Definition: decode.h:616
Packet_::ip4vars
IPV4Vars ip4vars
Definition: decode.h:521
IS_TUNNEL_ROOT_PKT
#define IS_TUNNEL_ROOT_PKT(p)
Definition: decode.h:933
CHECKSUM_VALIDATION_RXONLY
@ CHECKSUM_VALIDATION_RXONLY
Definition: decode.h:46
Packet_::ip6vars
IPV6Vars ip6vars
Definition: decode.h:523
DECODE_TUNNEL_ERSPANI
@ DECODE_TUNNEL_ERSPANI
Definition: decode.h:941
LINKTYPE_LINUX_SLL
#define LINKTYPE_LINUX_SLL
Definition: decode.h:1128
PktProfilingTmmData
struct PktProfilingTmmData_ PktProfilingTmmData
Per TMM stats storage.
DecodeThreadVars_::counter_teredo
uint16_t counter_teredo
Definition: decode.h:681
DecodeThreadVars_::counter_erspan
uint16_t counter_erspan
Definition: decode.h:685
PacketCopyDataOffset
int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
Copy data to Packet payload at given offset.
Definition: decode.c:231
DecodeVXLAN
int DecodeVXLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-vxlan.c:126
AppLayerDecoderEventsResetEvents
void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events)
Definition: app-layer-events.c:141
Packet_::pppoesh
PPPOESessionHdr * pppoesh
Definition: decode.h:550
DecodeThreadVars_::counter_raw
uint16_t counter_raw
Definition: decode.h:668
SCMutexLock
#define SCMutexLock(mut)
Definition: threads-debug.h:117
DecodeThreadVars
struct DecodeThreadVars_ DecodeThreadVars
Structure to hold thread specific data for all decode modules.
PktProfilingPrefilterData_
Definition: decode.h:377
PacketAlerts_::drop
PacketAlert drop
Definition: decode.h:306
DecodeVNTag
int DecodeVNTag(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-vntag.c:58
Address_
Definition: decode.h:122
CHECKSUM_VALIDATION_DISABLE
@ CHECKSUM_VALIDATION_DISABLE
Definition: decode.h:43
DecodeThreadVars_::counter_flow_tcp
uint16_t counter_flow_tcp
Definition: decode.h:699
CHECKSUM_VALIDATION_KERNEL
@ CHECKSUM_VALIDATION_KERNEL
Definition: decode.h:47
PacketDecodeFinalize
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:125
Address_::address_un_data32
uint32_t address_un_data32[4]
Definition: decode.h:125
Packet_::tcpvars
TCPVars tcpvars
Definition: decode.h:529
proto
uint8_t proto
Definition: decode-template.h:0
m
SCMutex m
Definition: flow-hash.h:6
DecodeICMPV6
int DecodeICMPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:188
PktProfilingDetectData_::ticks_end
uint64_t ticks_end
Definition: decode.h:359
decoder_max_layers
uint8_t decoder_max_layers
Definition: decode.c:76
PacketAlert
struct PacketAlert_ PacketAlert
Packet_::host_dst
struct Host_ * host_dst
Definition: decode.h:575
PktProfilingLoggerData
struct PktProfilingLoggerData_ PktProfilingLoggerData
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:448
PktProfilingPrefilterEngine
struct PktProfilingPrefilterEngine_ PktProfilingPrefilterEngine
Packet_::BypassPacketsFlow
int(* BypassPacketsFlow)(struct Packet_ *)
Definition: decode.h:502
ALPROTO_MAX
@ ALPROTO_MAX
Definition: app-layer-protos.h:72
DecodeThreadVars_::counter_max_mac_addrs_src
uint16_t counter_max_mac_addrs_src
Definition: decode.h:653
PktProfiling_::app
PktProfilingAppData app[ALPROTO_MAX]
Definition: decode.h:389
PktProfiling_::ticks_start
uint64_t ticks_start
Definition: decode.h:384
DecodeUnregisterCounters
void DecodeUnregisterCounters(void)
Definition: decode.c:485
rww_lock_contention
thread_local uint64_t rww_lock_contention
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:558
DecodeThreadVars_::counter_flow_get_used
uint16_t counter_flow_get_used
Definition: decode.h:704
Packet_::alerts
PacketAlerts alerts
Definition: decode.h:572
Packet_::tunnel_tpr_cnt
uint16_t tunnel_tpr_cnt
Definition: decode.h:608
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:34
Packet_::app_layer_events
AppLayerDecoderEvents * app_layer_events
Definition: decode.h:584
Packet_::events
PacketEngineEvents events
Definition: decode.h:582
ETHERNET_TYPE_8021QINQ
#define ETHERNET_TYPE_8021QINQ
Definition: decode-ethernet.h:47
DecodeThreadVars_::counter_flow_spare_sync_empty
uint16_t counter_flow_spare_sync_empty
Definition: decode.h:711
PktProfilingAppData_::ticks_spent
uint64_t ticks_spent
Definition: decode.h:364
DecodeThreadVars_::counter_flow_tcp_reuse
uint16_t counter_flow_tcp_reuse
Definition: decode.h:703
DecodeRaw
int DecodeRaw(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-raw.c:47
PacketAlert_::tx_id
uint64_t tx_id
Definition: decode.h:285
rwr_lock_contention
thread_local uint64_t rwr_lock_contention
LINKTYPE_NULL
#define LINKTYPE_NULL
Definition: decode.h:1126
DECODE_TUNNEL_NSH
@ DECODE_TUNNEL_NSH
Definition: decode.h:947
PacketAlert_::action
uint8_t action
Definition: decode.h:282
VLAN_HEADER_TOO_MANY_LAYERS
@ VLAN_HEADER_TOO_MANY_LAYERS
Definition: decode-events.h:146
detect-reference.h
Packet_::datalink
int datalink
Definition: decode.h:591
Packet_::profile
PktProfiling * profile
Definition: decode.h:624
spin_lock_wait_ticks
thread_local uint64_t spin_lock_wait_ticks
CHECKSUM_VALIDATION_ENABLE
@ CHECKSUM_VALIDATION_ENABLE
Definition: decode.h:44
decode-gre.h
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *, ThreadVars *)
Definition: decode.c:495
Packet_::level3_comp_csum
int32_t level3_comp_csum
Definition: decode.h:511
DecodeThreadVars_::counter_flow_spare_sync
uint16_t counter_flow_spare_sync
Definition: decode.h:710
DECODE_TUNNEL_ERSPANII
@ DECODE_TUNNEL_ERSPANII
Definition: decode.h:940
CHECKSUM_VALIDATION_AUTO
@ CHECKSUM_VALIDATION_AUTO
Definition: decode.h:45
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:684
Packet_::pktlen
uint32_t pktlen
Definition: decode.h:566
decode-ipv6.h
TUNNEL_PKT_TPR
#define TUNNEL_PKT_TPR(p)
Definition: decode.h:928
Packet_::level4_comp_csum
int32_t level4_comp_csum
Definition: decode.h:513
util-debug.h
DecodeThreadVars_::counter_flow_get_used_failed
uint16_t counter_flow_get_used_failed
Definition: decode.h:708
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:51
source-nfq.h
Packet_::pktvar
PktVar * pktvar
Definition: decode.h:505
CaptureStats_::counter_ips_rejected
uint16_t counter_ips_rejected
Definition: decode.h:727
DPDKPacketVars_
per packet DPDK vars
Definition: source-dpdk.h:78
DecodeThreadVars_::counter_icmpv4
uint16_t counter_icmpv4
Definition: decode.h:664
DecodeThreadVars_::counter_ppp
uint16_t counter_ppp
Definition: decode.h:672
ETHERNET_TYPE_8021AD
#define ETHERNET_TYPE_8021AD
Definition: decode-ethernet.h:43
PacketAlert_::num
SigIntId num
Definition: decode.h:281
SCMutexUnlock
#define SCMutexUnlock(mut)
Definition: threads-debug.h:119
PacketSwap
void PacketSwap(Packet *p)
switch direction of a packet
Definition: decode.c:460
DecodeMPLS
int DecodeMPLS(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-mpls.c:49
AppLayerThreadCtx_
This is for the app layer in general and it contains per thread context relevant to both the alpd and...
Definition: app-layer.c:56
PktSrcEnum
PktSrcEnum
Definition: decode.h:50
flow-worker.h
PktVar_::value
uint8_t * value
Definition: decode.h:327
PktProfilingAppData
struct PktProfilingAppData_ PktProfilingAppData
DecodeTunnelProto
DecodeTunnelProto
Definition: decode.h:938
Packet_::prev
struct Packet_ * prev
Definition: decode.h:588
Packet
struct Packet_ Packet
decode-ppp.h
Packet_::pcap_v
PcapPacketVars pcap_v
Definition: decode.h:495
IS_TUNNEL_PKT_VERDICTED
#define IS_TUNNEL_PKT_VERDICTED(p)
Definition: decode.h:935
CaptureStatsSetup
void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s)
Definition: decode.c:762
PKT_SRC_DECODER_TEREDO
@ PKT_SRC_DECODER_TEREDO
Definition: decode.h:55
DecodeTEMPLATE
int DecodeTEMPLATE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode TEMPLATE packets.
Definition: decode-template.c:51
Packet_::tunnel_rtv_cnt
uint16_t tunnel_rtv_cnt
Definition: decode.h:606
DecodeVLAN
int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-vlan.c:60
DecodeESP
int DecodeESP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Function to decode IPSEC-ESP packets.
Definition: decode-esp.c:64
rww_lock_cnt
thread_local uint64_t rww_lock_cnt
Packet_::ethh
EthernetHdr * ethh
Definition: decode.h:508
DecodeNSH
int DecodeNSH(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode NSH packets.
Definition: decode-nsh.c:46
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
mutex_lock_contention
thread_local uint64_t mutex_lock_contention
spin_lock_contention
thread_local uint64_t spin_lock_contention
PktProfilingData_
Definition: decode.h:352
DECODE_TUNNEL_PPP
@ DECODE_TUNNEL_PPP
Definition: decode.h:946
Packet_::sp
Port sp
Definition: decode.h:424
PktProfiling_::logger
PktProfilingLoggerData logger[LOGGER_SIZE]
Definition: decode.h:391
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:112
PktSrcToString
const char * PktSrcToString(enum PktSrcEnum pkt_src)
Definition: decode.c:705
PktVar
struct PktVar_ PktVar
DecodeThreadVars_::counter_vlan_qinq
uint16_t counter_vlan_qinq
Definition: decode.h:676
IPV6Vars_
get the highest proto/next header field we know
Definition: decode-ipv6.h:104
LINKTYPE_GRE_OVER_IP
#define LINKTYPE_GRE_OVER_IP
Definition: decode.h:1135
LINKTYPE_PPP
#define LINKTYPE_PPP
Definition: decode.h:1129
PktProfilingDetectData_
Definition: decode.h:357
PktVar_::key
uint8_t * key
Definition: decode.h:326
decode-icmpv6.h
source-pfring.h
DecodeSll
int DecodeSll(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-sll.c:41
DecodeThreadVars_::counter_defrag_ipv6_timeouts
uint16_t counter_defrag_ipv6_timeouts
Definition: decode.h:694
LOGGER_SIZE
@ LOGGER_SIZE
Definition: suricata-common.h:488
PacketCallocExtPkt
int PacketCallocExtPkt(Packet *p, int datalen)
Definition: decode.c:205
Address
struct Address_ Address
AppLayerDecoderEventsFreeEvents
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
Definition: app-layer-events.c:148
ETHERNET_TYPE_MPLS_UNICAST
#define ETHERNET_TYPE_MPLS_UNICAST
Definition: decode-mpls.h:29
PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
@ PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
Definition: decode.h:58
DECODE_TUNNEL_VLAN
@ DECODE_TUNNEL_VLAN
Definition: decode.h:942
Packet_::icmpv6h
ICMPV6Hdr * icmpv6h
Definition: decode.h:547
util-napatech.h
ETHERNET_TYPE_PPPOE_DISC
#define ETHERNET_TYPE_PPPOE_DISC
Definition: decode-ethernet.h:41
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:54
CaptureStats_::counter_ips_accepted
uint16_t counter_ips_accepted
Definition: decode.h:725
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:417
DecodeThreadVars_::counter_nsh
uint16_t counter_nsh
Definition: decode.h:686
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:943
decode-sll.h
DecodeThreadVars_::app_tctx
AppLayerThreadCtx * app_tctx
Definition: decode.h:646
DecodeThreadVars_::counter_defrag_ipv4_timeouts
uint16_t counter_defrag_ipv4_timeouts
Definition: decode.h:691
decode-icmpv4.h
DecodeThreadVars_::counter_sll
uint16_t counter_sll
Definition: decode.h:667
source-ipfw.h
Address_::address_un_data8
uint8_t address_un_data8[16]
Definition: decode.h:127
TMM_SIZE
@ TMM_SIZE
Definition: tm-threads-common.h:77
PacketEngineEvents_
Definition: decode.h:314
source-netmap.h
Packet_::ip4h
IPV4Hdr * ip4h
Definition: decode.h:515
Port
uint16_t Port
Definition: decode.h:246
DecodeThreadVars_::counter_sctp
uint16_t counter_sctp
Definition: decode.h:670
Packet_::livedev
struct LiveDevice_ * livedev
Definition: decode.h:570
source-windivert.h
DecodeThreadVars_::counter_invalid
uint16_t counter_invalid
Definition: decode.h:656
ETHERNET_TYPE_VNTAG
#define ETHERNET_TYPE_VNTAG
Definition: decode-ethernet.h:51
DecodeThreadVars_::counter_ieee8021ah
uint16_t counter_ieee8021ah
Definition: decode.h:679
decode-nsh.h
rww_lock_wait_ticks
thread_local uint64_t rww_lock_wait_ticks
DecodeTCP
int DecodeTCP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-tcp.c:251
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:683
ETHERNET_TYPE_NSH
#define ETHERNET_TYPE_NSH
Definition: decode-ethernet.h:50
Address_::address
union Address_::@31 address
DecodeThreadVars_::counter_vlan
uint16_t counter_vlan
Definition: decode.h:675
DECODE_TUNNEL_ETHERNET
@ DECODE_TUNNEL_ETHERNET
Definition: decode.h:939
DecodeThreadVars_::counter_tcp
uint16_t counter_tcp
Definition: decode.h:662
ETHERNET_TYPE_DCE
#define ETHERNET_TYPE_DCE
Definition: decode-ethernet.h:49
DecodeThreadVars_::counter_pkts
uint16_t counter_pkts
Definition: decode.h:649
rwr_lock_wait_ticks
thread_local uint64_t rwr_lock_wait_ticks
Packet_::l4vars
union Packet_::@40 l4vars
decode-events.h
PktProfilingPrefilterEngine_
Definition: decode.h:373
PktProfilingData_::ticks_start
uint64_t ticks_start
Definition: decode.h:353
DecodeNull
int DecodeNull(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-null.c:56
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
DecodeIPV4
int DecodeIPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-ipv4.c:517
PktProfilingPrefilterData
struct PktProfilingPrefilterData_ PktProfilingPrefilterData
Packet_::ntpv
NapatechPacketVars ntpv
Definition: decode.h:627
decode-vlan.h
IPV4Hdr_
Definition: decode-ipv4.h:71
default_packet_size
uint32_t default_packet_size
Definition: decode.c:72
LINKTYPE_RAW
#define LINKTYPE_RAW
Definition: decode.h:1130
PACKET_UPDATE_ACTION
#define PACKET_UPDATE_ACTION(p, a)
Definition: decode.h:907
Packet_::nb_decoded_layers
uint8_t nb_decoded_layers
Definition: decode.h:621
PacketAlert_::flags
uint8_t flags
Definition: decode.h:283
PKT_SRC_DECODER_GENEVE
@ PKT_SRC_DECODER_GENEVE
Definition: decode.h:62
decode-ipv4.h
DecodeThreadVars_::counter_chdlc
uint16_t counter_chdlc
Definition: decode.h:659
Packet_::ppph
PPPHdr * ppph
Definition: decode.h:549
Packet_::nfq_v
NFQPacketVars nfq_v
Definition: decode.h:468
ICMPV6Hdr_
Definition: decode-icmpv6.h:145
PktProfiling_::detect
PktProfilingDetectData detect[PROF_DETECT_SIZE]
Definition: decode.h:390
Packet_::icmpv4vars
ICMPV4Vars icmpv4vars
Definition: decode.h:530
Packet_::ReleasePacket
void(* ReleasePacket)(struct Packet_ *)
Definition: decode.h:499
Packet_::tenant_id
uint32_t tenant_id
Definition: decode.h:611
Packet_::flow
struct Flow_ * flow
Definition: decode.h:454
DecodeGRE
int DecodeGRE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode GRE packets.
Definition: decode-gre.c:47
ICMPV6Vars_
Definition: decode-icmpv6.h:162
PktProfiling
struct PktProfiling_ PktProfiling
Per pkt stats storage.
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *, DecodeThreadVars *)
Definition: decode.c:672
IPFWPacketVars_
Definition: source-ipfw.h:32
source-dpdk.h
PktProfilingLoggerData_::ticks_end
uint64_t ticks_end
Definition: decode.h:369
PktProfilingPrefilterEngine_::ticks_spent
uint64_t ticks_spent
Definition: decode.h:374
DecodeThreadVars_::counter_flow_spare_sync_incomplete
uint16_t counter_flow_spare_sync_incomplete
Definition: decode.h:712
Packet_::ts
struct timeval ts
Definition: decode.h:460
DecodeGlobalConfig
void DecodeGlobalConfig(void)
Definition: decode.c:770
ChecksumValidationMode
ChecksumValidationMode
Definition: decode.h:42
suricata-common.h
PKT_SRC_FFR
@ PKT_SRC_FFR
Definition: decode.h:57
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:100
ETHERNET_TYPE_8021AH
#define ETHERNET_TYPE_8021AH
Definition: decode-ethernet.h:44
NFQPacketVars_
Definition: source-nfq.h:40
DecodeThreadVars_::counter_flow_icmp6
uint16_t counter_flow_icmp6
Definition: decode.h:702
Packet_::tcph
TCPHdr * tcph
Definition: decode.h:537
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:661
PROFILE_FLOWWORKER_SIZE
@ PROFILE_FLOWWORKER_SIZE
Definition: flow-worker.h:29
CaptureStats_::counter_ips_replaced
uint16_t counter_ips_replaced
Definition: decode.h:728
ETHERNET_DCE_HEADER_LEN
#define ETHERNET_DCE_HEADER_LEN
Definition: decode-ethernet.h:30
DecodeThreadVars_::counter_gre
uint16_t counter_gre
Definition: decode.h:674
DecodeThreadVars_::counter_esp
uint16_t counter_esp
Definition: decode.h:671
Packet_::ext_pkt
uint8_t * ext_pkt
Definition: decode.h:567
PacketAlerts
struct PacketAlerts_ PacketAlerts
DecodeICMPV4
int DecodeICMPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main ICMPv4 decoding function.
Definition: decode-icmpv4.c:155
decode-esp.h
SCLogError
#define SCLogError(err_code,...)
Macro used to log ERROR messages.
Definition: util-debug.h:257
DecodeThreadVars_::counter_defrag_ipv6_reassembled
uint16_t counter_defrag_ipv6_reassembled
Definition: decode.h:693
DecodeThreadVars_::counter_udp
uint16_t counter_udp
Definition: decode.h:663
PacketUpdateEngineEventCounters
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Definition: decode.c:132
DECODE_EVENT_MAX
@ DECODE_EVENT_MAX
Definition: decode-events.h:291
decode-sctp.h
decode-geneve.h
CaptureStatsUpdate
void CaptureStatsUpdate(ThreadVars *tv, CaptureStats *s, const Packet *p)
Definition: decode.c:749
PKT_SRC_DEFRAG
@ PKT_SRC_DEFRAG
Definition: decode.h:56
Packet_::icmpv4h
ICMPV4Hdr * icmpv4h
Definition: decode.h:545
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
PfringPacketVars_
per packet Pfring vars
Definition: source-pfring.h:60
NetmapPacketVars_
Definition: source-netmap.h:71
DecodeThreadVars_::counter_ipv4
uint16_t counter_ipv4
Definition: decode.h:660
threadvars.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:151
TUNNEL_PKT_RTV
#define TUNNEL_PKT_RTV(p)
Definition: decode.h:927
source-af-packet.h
PKT_SRC_DECODER_VXLAN
@ PKT_SRC_DECODER_VXLAN
Definition: decode.h:59
mutex_lock_wait_ticks
thread_local uint64_t mutex_lock_wait_ticks
DCE_PKT_TOO_SMALL
@ DCE_PKT_TOO_SMALL
Definition: decode-events.h:206
Packet_::next
struct Packet_ * next
Definition: decode.h:587
Packet_::flow_hash
uint32_t flow_hash
Definition: decode.h:458
PACKET_ALERT_MAX
#define PACKET_ALERT_MAX
Definition: decode.h:299
Packet_::root
struct Packet_ * root
Definition: decode.h:594
DecodeThreadVars_::counter_pppoe
uint16_t counter_pppoe
Definition: decode.h:680
PktProfilingPrefilterData_::size
uint32_t size
Definition: decode.h:379
DecodeThreadVars_::counter_mpls
uint16_t counter_mpls
Definition: decode.h:682
PKT_SRC_DETECT_RELOAD_FLUSH
@ PKT_SRC_DETECT_RELOAD_FLUSH
Definition: decode.h:60
PktProfilingData
struct PktProfilingData_ PktProfilingData
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:563
ETHERNET_TYPE_PPPOE_SESS
#define ETHERNET_TYPE_PPPOE_SESS
Definition: decode-ethernet.h:42
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:644
PACKET_ENGINE_EVENT_MAX
#define PACKET_ENGINE_EVENT_MAX
Definition: decode.h:311
Packet_::recursion_level
uint8_t recursion_level
Definition: decode.h:442
PktProfilingLoggerData_
Definition: decode.h:367
PktProfiling_::tmm
PktProfilingTmmData tmm[TMM_SIZE]
Definition: decode.h:387
Signature_
Signature container.
Definition: detect.h:517
DecodeThreadVars_::output_flow_thread_data
void * output_flow_thread_data
Definition: decode.h:719
DecodeThreadVars_::counter_geneve
uint16_t counter_geneve
Definition: decode.h:673
ETHERNET_TYPE_ARP
#define ETHERNET_TYPE_ARP
Definition: decode-ethernet.h:35
DecodeThreadVars_::counter_max_mac_addrs_dst
uint16_t counter_max_mac_addrs_dst
Definition: decode.h:654
Packet_::pppoedh
PPPOEDiscoveryHdr * pppoedh
Definition: decode.h:551
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *)
Alloc and setup DecodeThreadVars.
Definition: decode.c:653
DecodeThreadVars_::counter_defrag_max_hit
uint16_t counter_defrag_max_hit
Definition: decode.h:695
PacketSetData
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
Definition: decode.c:692
decode-chdlc.h
SC_ERR_DATALINK_UNIMPLEMENTED
@ SC_ERR_DATALINK_UNIMPLEMENTED
Definition: util-error.h:68
LINKTYPE_CISCO_HDLC
#define LINKTYPE_CISCO_HDLC
Definition: decode.h:1136
PktVar_::value_len
uint16_t value_len
Definition: decode.h:325
app-layer-protos.h
DecodeThreadVars_::counter_null
uint16_t counter_null
Definition: decode.h:669
DecodeThreadVars_::counter_icmpv6
uint16_t counter_icmpv6
Definition: decode.h:665
Packet_::udph
UDPHdr * udph
Definition: decode.h:539
PcapPacketVars_
Definition: source-pcap.h:36
Address_::family
char family
Definition: decode.h:123
Packet_::dst
Address dst
Definition: decode.h:422
PKT_SRC_DECODER_GRE
@ PKT_SRC_DECODER_GRE
Definition: decode.h:52
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1050
PktProfilingTmmData_::ticks_start
uint64_t ticks_start
Definition: decode.h:334
PacketAlert_
Definition: decode.h:280
PktProfilingLoggerData_::ticks_spent
uint64_t ticks_spent
Definition: decode.h:370
DecodeThreadVars_::counter_flow_memcap
uint16_t counter_flow_memcap
Definition: decode.h:697
ETHERNET_TYPE_VLAN
#define ETHERNET_TYPE_VLAN
Definition: decode-vlan.h:31
DecodeThreadVars_::counter_defrag_ipv6_fragments
uint16_t counter_defrag_ipv6_fragments
Definition: decode.h:692
PktVar_
Definition: decode.h:319
AFPPacketVars_
per packet AF_PACKET vars
Definition: source-af-packet.h:144
PacketEngineEvents
struct PacketEngineEvents_ PacketEngineEvents
DecodeIEEE8021ah
int DecodeIEEE8021ah(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
PktProfilingDetectData_::ticks_start
uint64_t ticks_start
Definition: decode.h:358
likely
#define likely(expr)
Definition: util-optimize.h:32
PacketDefragPktSetupParent
void PacketDefragPktSetupParent(Packet *parent)
inform defrag "parent" that a pseudo packet is now associated to it.
Definition: decode.c:402
Packet_::plugin_v
uint8_t plugin_v[PLUGIN_VAR_SIZE]
Definition: decode.h:492
Packet_::ip6h
IPV6Hdr * ip6h
Definition: decode.h:517
Packet_::icmpv6vars
ICMPV6Vars icmpv6vars
Definition: decode.h:531
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:289
PktProfiling_::flowworker
PktProfilingData flowworker[PROFILE_FLOWWORKER_SIZE]
Definition: decode.h:388
mutex_lock_cnt
thread_local uint64_t mutex_lock_cnt
NFLOGPacketVars_
Definition: source-nflog.h:55
SigIntId
#define SigIntId
Definition: suricata-common.h:296
PacketAlerts_
Definition: decode.h:301
decode-vntag.h
Packet_::dp
Port dp
Definition: decode.h:432
PktVar_::key_len
uint16_t key_len
Definition: decode.h:324
PktProfilingAppData_
Definition: decode.h:363
Host_
Definition: host.h:58
Packet_::esph
ESPHdr * esph
Definition: decode.h:543
g_default_mtu
int g_default_mtu
Definition: suricata.c:223
DecodeThreadVars_::counter_flow_get_used_eval_reject
uint16_t counter_flow_get_used_eval_reject
Definition: decode.h:706
PktProfiling_::proto_detect
uint64_t proto_detect
Definition: decode.h:392
DecodePPPOESession
int DecodePPPOESession(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main decoding function for PPPOE Session packets.
Definition: decode-pppoe.c:131
ETHERNET_TYPE_MPLS_MULTICAST
#define ETHERNET_TYPE_MPLS_MULTICAST
Definition: decode-mpls.h:30
Packet_::type
uint8_t type
Definition: decode.h:427
ETHERNET_TYPE_IP
#define ETHERNET_TYPE_IP
Definition: decode-ethernet.h:34
AppLayerDecoderEvents_::events
uint8_t * events
Definition: app-layer-events.h:36
SCMutex
#define SCMutex
Definition: threads-debug.h:114
DECODE_TUNNEL_UNSET
@ DECODE_TUNNEL_UNSET
Definition: decode.h:948
PacketGetFromQueueOrAlloc
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:189
PktProfilingLoggerData_::ticks_start
uint64_t ticks_start
Definition: decode.h:368
Packet_::src
Address src
Definition: decode.h:421
DecodeERSPANTypeI
int DecodeERSPANTypeI(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
ERSPAN Type I.
Definition: decode-erspan.c:65
DecodeCHDLC
int DecodeCHDLC(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-chdlc.c:42
DecodeUpdatePacketCounters
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:619
DecodeThreadVars_::counter_engine_events
uint16_t counter_engine_events[DECODE_EVENT_MAX]
Definition: decode.h:715
Packet_::tunnel_mutex
SCMutex tunnel_mutex
Definition: decode.h:604
LINKTYPE_ETHERNET
#define LINKTYPE_ETHERNET
Definition: decode.h:1127
Packet_::ip6eh
IPV6ExtHdrs ip6eh
Definition: decode.h:524
PktProfilingDetectData_::ticks_spent
uint64_t ticks_spent
Definition: decode.h:360
PktVar_::id
uint32_t id
Definition: decode.h:320
PACKET_TEST_ACTION
#define PACKET_TEST_ACTION(p, a)
Definition: decode.h:896
DecodeThreadVars_::counter_defrag_ipv4_fragments
uint16_t counter_defrag_ipv4_fragments
Definition: decode.h:689
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:315
DecodePPPOEDiscovery
int DecodePPPOEDiscovery(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main decoding function for PPPOE Discovery packets.
Definition: decode-pppoe.c:51