Go to the documentation of this file.
24 #ifndef SURICATA_DECODE_H
25 #define SURICATA_DECODE_H
99 #define SignatureMask uint8_t
102 struct DetectionEngineThreadCtx_;
122 #define addr_data32 address.address_un_data32
123 #define addr_data16 address.address_un_data16
124 #define addr_data8 address.address_un_data8
125 #define addr_in6addr address.address_un_in6
127 #define COPY_ADDRESS(a, b) do { \
128 (b)->family = (a)->family; \
129 (b)->addr_data32[0] = (a)->addr_data32[0]; \
130 (b)->addr_data32[1] = (a)->addr_data32[1]; \
131 (b)->addr_data32[2] = (a)->addr_data32[2]; \
132 (b)->addr_data32[3] = (a)->addr_data32[3]; \
140 #define SET_IPV4_SRC_ADDR(ip4h, a) \
142 (a)->family = AF_INET; \
143 (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_src.s_addr; \
144 (a)->addr_data32[1] = 0; \
145 (a)->addr_data32[2] = 0; \
146 (a)->addr_data32[3] = 0; \
149 #define SET_IPV4_DST_ADDR(ip4h, a) \
151 (a)->family = AF_INET; \
152 (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_dst.s_addr; \
153 (a)->addr_data32[1] = 0; \
154 (a)->addr_data32[2] = 0; \
155 (a)->addr_data32[3] = 0; \
159 #define SET_IPV6_SRC_ADDR(ip6h, a) \
161 (a)->family = AF_INET6; \
162 (a)->addr_data32[0] = (ip6h)->s_ip6_src[0]; \
163 (a)->addr_data32[1] = (ip6h)->s_ip6_src[1]; \
164 (a)->addr_data32[2] = (ip6h)->s_ip6_src[2]; \
165 (a)->addr_data32[3] = (ip6h)->s_ip6_src[3]; \
168 #define SET_IPV6_DST_ADDR(ip6h, a) \
170 (a)->family = AF_INET6; \
171 (a)->addr_data32[0] = (ip6h)->s_ip6_dst[0]; \
172 (a)->addr_data32[1] = (ip6h)->s_ip6_dst[1]; \
173 (a)->addr_data32[2] = (ip6h)->s_ip6_dst[2]; \
174 (a)->addr_data32[3] = (ip6h)->s_ip6_dst[3]; \
179 #define SET_TCP_SRC_PORT(pkt, prt) do { \
180 SET_PORT(TCP_GET_SRC_PORT((pkt)), *(prt)); \
183 #define SET_TCP_DST_PORT(pkt, prt) do { \
184 SET_PORT(TCP_GET_DST_PORT((pkt)), *(prt)); \
189 #define SET_UDP_SRC_PORT(pkt, prt) do { \
190 SET_PORT(UDP_GET_SRC_PORT((pkt)), *(prt)); \
192 #define SET_UDP_DST_PORT(pkt, prt) do { \
193 SET_PORT(UDP_GET_DST_PORT((pkt)), *(prt)); \
196 #define GET_IPV4_SRC_ADDR_U32(p) ((p)->src.addr_data32[0])
197 #define GET_IPV4_DST_ADDR_U32(p) ((p)->dst.addr_data32[0])
198 #define GET_IPV4_SRC_ADDR_PTR(p) ((p)->src.addr_data32)
199 #define GET_IPV4_DST_ADDR_PTR(p) ((p)->dst.addr_data32)
201 #define GET_IPV6_SRC_IN6ADDR(p) ((p)->src.addr_in6addr)
202 #define GET_IPV6_DST_IN6ADDR(p) ((p)->dst.addr_in6addr)
203 #define GET_IPV6_SRC_ADDR(p) ((p)->src.addr_data32)
204 #define GET_IPV6_DST_ADDR(p) ((p)->dst.addr_data32)
205 #define GET_TCP_SRC_PORT(p) ((p)->sp)
206 #define GET_TCP_DST_PORT(p) ((p)->dp)
208 #define GET_PKT_LEN(p) (p)->pktlen
209 #define GET_PKT_DATA(p) (((p)->ext_pkt == NULL) ? GET_PKT_DIRECT_DATA(p) : (p)->ext_pkt)
210 #define GET_PKT_DIRECT_DATA(p) (p)->pkt_data
211 #define GET_PKT_DIRECT_MAX_SIZE(p) (default_packet_size)
213 #define SET_PKT_LEN(p, len) do { \
214 (p)->pktlen = (len); \
219 #define SET_PORT(v, p) ((p) = (v))
220 #define COPY_PORT(a,b) ((b) = (a))
222 #define CMP_ADDR(a1, a2) \
223 (((a1)->addr_data32[3] == (a2)->addr_data32[3] && \
224 (a1)->addr_data32[2] == (a2)->addr_data32[2] && \
225 (a1)->addr_data32[1] == (a2)->addr_data32[1] && \
226 (a1)->addr_data32[0] == (a2)->addr_data32[0]))
227 #define CMP_PORT(p1, p2) \
232 #define IP_GET_RAW_VER(pkt) ((((pkt)[0] & 0xf0) >> 4))
234 #define PKT_IS_TCP(p) (((p)->tcph != NULL))
235 #define PKT_IS_UDP(p) (((p)->udph != NULL))
236 #define PKT_IS_ICMPV4(p) (((p)->icmpv4h != NULL))
237 #define PKT_IS_ICMPV6(p) (((p)->icmpv6h != NULL))
238 #define PKT_IS_TOSERVER(p) (((p)->flowflags & FLOW_PKT_TOSERVER))
239 #define PKT_IS_TOCLIENT(p) (((p)->flowflags & FLOW_PKT_TOCLIENT))
253 #define PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW 0x1
255 #define PACKET_ALERT_FLAG_STATE_MATCH 0x02
257 #define PACKET_ALERT_FLAG_STREAM_MATCH 0x04
259 #define PACKET_ALERT_FLAG_TX 0x08
261 #define PACKET_ALERT_RATE_FILTER_MODIFIED 0x10
263 #define PACKET_ALERT_FLAG_FRAME 0x20
265 #define PACKET_ALERT_FLAG_TX_GUESSED 0x40
267 #define PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET 0x80
270 #define PACKET_ALERT_MAX 15
288 #define PACKET_ENGINE_EVENT_MAX 15
313 #ifdef PROFILE_LOCKING
558 WinDivertPacketVars windivert_v;
675 static inline bool PacketIsIPv4(
const Packet *p);
676 static inline bool PacketIsIPv6(
const Packet *p);
679 #define DEFAULT_MTU 1500
680 #define MINIMUM_MTU 68
682 #define DEFAULT_PACKET_SIZE (DEFAULT_MTU + ETHERNET_HEADER_LEN)
684 #define MAX_PAYLOAD_SIZE (IPV6_HEADER_LEN + 65536 + 28)
686 #define SIZE_OF_PACKET (default_packet_size + sizeof(Packet))
688 static inline bool PacketIsIPv4(
const Packet *p)
699 static inline IPV4Hdr *PacketSetIPV4(
Packet *p,
const uint8_t *buf)
708 static inline uint8_t PacketGetIPProto(
const Packet *p)
713 if (PacketIsIPv4(p)) {
714 const IPV4Hdr *hdr = PacketGetIPv4(p);
716 }
else if (PacketIsIPv6(p)) {
722 static inline uint8_t PacketGetIPv4IPProto(
const Packet *p)
724 if (PacketGetIPv4(p)) {
725 const IPV4Hdr *hdr = PacketGetIPv4(p);
737 static inline IPV6Hdr *PacketSetIPV6(
Packet *p,
const uint8_t *buf)
745 static inline bool PacketIsIPv6(
const Packet *p)
750 static inline void PacketClearL2(
Packet *p)
752 memset(&p->
l2, 0,
sizeof(p->
l2));
756 static inline EthernetHdr *PacketSetEthernet(
Packet *p,
const uint8_t *buf)
764 static inline const EthernetHdr *PacketGetEthernet(
const Packet *p)
770 static inline bool PacketIsEthernet(
const Packet *p)
775 static inline void PacketClearL3(
Packet *p)
777 memset(&p->
l3, 0,
sizeof(p->
l3));
780 static inline void PacketClearL4(
Packet *p)
782 memset(&p->
l4, 0,
sizeof(p->
l4));
785 static inline TCPHdr *PacketSetTCP(
Packet *p,
const uint8_t *buf)
793 static inline const TCPHdr *PacketGetTCP(
const Packet *p)
799 static inline bool PacketIsTCP(
const Packet *p)
804 static inline UDPHdr *PacketSetUDP(
Packet *p,
const uint8_t *buf)
812 static inline const UDPHdr *PacketGetUDP(
const Packet *p)
818 static inline bool PacketIsUDP(
const Packet *p)
823 static inline ICMPV4Hdr *PacketSetICMPv4(
Packet *p,
const uint8_t *buf)
837 static inline bool PacketIsICMPv4(
const Packet *p)
842 static inline const IPV4Hdr *PacketGetICMPv4EmbIPv4(
const Packet *p)
844 const uint8_t *start = (
const uint8_t *)PacketGetICMPv4(p);
849 static inline ICMPV6Hdr *PacketSetICMPv6(
Packet *p,
const uint8_t *buf)
863 static inline bool PacketIsICMPv6(
const Packet *p)
868 static inline SCTPHdr *PacketSetSCTP(
Packet *p,
const uint8_t *buf)
876 static inline const SCTPHdr *PacketGetSCTP(
const Packet *p)
882 static inline bool PacketIsSCTP(
const Packet *p)
887 static inline GREHdr *PacketSetGRE(
Packet *p,
const uint8_t *buf)
895 static inline const GREHdr *PacketGetGRE(
const Packet *p)
901 static inline bool PacketIsGRE(
const Packet *p)
906 static inline ESPHdr *PacketSetESP(
Packet *p,
const uint8_t *buf)
914 static inline const ESPHdr *PacketGetESP(
const Packet *p)
920 static inline bool PacketIsESP(
const Packet *p)
925 static inline const ARPHdr *PacketGetARP(
const Packet *p)
931 static inline ARPHdr *PacketSetARP(
Packet *p,
const uint8_t *buf)
939 static inline bool PacketIsARP(
const Packet *p)
1043 #define PACKET_CLEAR_L4VARS(p) do { \
1044 memset(&(p)->l4vars, 0x00, sizeof((p)->l4vars)); \
1048 #define PACKET_FREE_EXTDATA(p) do { \
1049 if ((p)->ext_pkt) { \
1050 if (!((p)->flags & PKT_ZERO_COPY)) { \
1051 SCFree((p)->ext_pkt); \
1053 (p)->ext_pkt = NULL; \
1057 #define TUNNEL_INCR_PKT_RTV_NOLOCK(p) do { \
1058 ((p)->root ? (p)->root->tunnel_rtv_cnt++ : (p)->tunnel_rtv_cnt++); \
1061 static inline void TUNNEL_INCR_PKT_TPR(
Packet *p)
1069 #define TUNNEL_PKT_RTV(p) ((p)->root ? (p)->root->tunnel_rtv_cnt : (p)->tunnel_rtv_cnt)
1070 #define TUNNEL_PKT_TPR(p) ((p)->root ? (p)->root->tunnel_tpr_cnt : (p)->tunnel_tpr_cnt)
1072 static inline bool PacketTunnelIsVerdicted(
const Packet *p)
1076 static inline void PacketTunnelSetVerdicted(
Packet *p)
1153 uint16_t hdrextlen, uint16_t plen,
1154 uint16_t prev_hdrextlen);
1160 const uint8_t *pkt, uint32_t
len);
1165 #define ENGINE_SET_EVENT(p, e) do { \
1166 SCLogDebug("p %p event %d", (p), e); \
1167 if ((p)->events.cnt < PACKET_ENGINE_EVENT_MAX) { \
1168 (p)->events.events[(p)->events.cnt] = e; \
1169 (p)->events.cnt++; \
1173 #define ENGINE_SET_INVALID_EVENT(p, e) do { \
1174 p->flags |= PKT_IS_INVALID; \
1175 ENGINE_SET_EVENT(p, e); \
1178 #define ENGINE_ISSET_EVENT(p, e) ({ \
1181 for (u = 0; u < (p)->events.cnt; u++) { \
1182 if ((p)->events.events[u] == (e)) { \
1190 #ifndef IPPROTO_IPIP
1191 #define IPPROTO_IPIP 4
1198 #ifndef IPPROTO_DCCP
1199 #define IPPROTO_DCCP 33
1206 #ifndef IPPROTO_SCTP
1207 #define IPPROTO_SCTP 132
1211 #define IPPROTO_MH 135
1216 #define IPPROTO_HIP 139
1219 #ifndef IPPROTO_SHIM6
1220 #define IPPROTO_SHIM6 140
1226 #define PKT_NOPACKET_INSPECTION BIT_U32(0)
1228 #define PKT_PPP_VJ_UCOMP BIT_U32(1)
1231 #define PKT_NOPAYLOAD_INSPECTION BIT_U32(2)
1235 #define PKT_HAS_TAG BIT_U32(4)
1237 #define PKT_STREAM_ADD BIT_U32(5)
1239 #define PKT_STREAM_EST BIT_U32(6)
1241 #define PKT_STREAM_EOF BIT_U32(7)
1242 #define PKT_HAS_FLOW BIT_U32(8)
1244 #define PKT_PSEUDO_STREAM_END BIT_U32(9)
1247 #define PKT_STREAM_MODIFIED BIT_U32(10)
1253 #define PKT_STREAM_NOPCAPLOG BIT_U32(12)
1258 #define PKT_IGNORE_CHECKSUM BIT_U32(15)
1260 #define PKT_ZERO_COPY BIT_U32(16)
1262 #define PKT_HOST_SRC_LOOKED_UP BIT_U32(17)
1263 #define PKT_HOST_DST_LOOKED_UP BIT_U32(18)
1266 #define PKT_IS_FRAGMENT BIT_U32(19)
1267 #define PKT_IS_INVALID BIT_U32(20)
1268 #define PKT_PROFILE BIT_U32(21)
1272 #define PKT_WANTS_FLOW BIT_U32(22)
1275 #define PKT_PROTO_DETECT_TS_DONE BIT_U32(23)
1276 #define PKT_PROTO_DETECT_TC_DONE BIT_U32(24)
1278 #define PKT_REBUILT_FRAGMENT \
1281 #define PKT_DETECT_HAS_STREAMDATA \
1284 #define PKT_PSEUDO_DETECTLOG_FLUSH BIT_U32(27)
1288 #define PKT_STREAM_NO_EVENTS BIT_U32(28)
1291 #define PKT_FIRST_ALERTS BIT_U32(29)
1292 #define PKT_FIRST_TAG BIT_U32(30)
1294 #define PKT_PSEUDO_LOG_FLUSH BIT_U32(31)
1297 #define PKT_IS_PSEUDOPKT(p) \
1298 ((p)->flags & (PKT_PSEUDO_STREAM_END|PKT_PSEUDO_DETECTLOG_FLUSH))
1299 #define PKT_IS_FLUSHPKT(p) ((p)->flags & (PKT_PSEUDO_LOG_FLUSH))
1301 #define PKT_SET_SRC(p, src_val) ((p)->pkt_src = src_val)
1303 #define PKT_DEFAULT_MAX_DECODED_LAYERS 16
1306 static inline bool PacketIncreaseCheckLayers(
Packet *p)
1320 static inline void DecodeSetNoPayloadInspectionFlag(
Packet *p)
1329 static inline void DecodeSetNoPacketInspectionFlag(
Packet *p)
1334 static inline bool PacketIsTunnelRoot(
const Packet *p)
1339 static inline bool PacketIsTunnelChild(
const Packet *p)
1344 static inline bool PacketIsTunnel(
const Packet *p)
1349 static inline bool PacketIsNotTunnel(
const Packet *p)
1354 static inline bool VerdictTunnelPacketInternal(
const Packet *p)
1357 SCLogDebug(
"tunnel: outstanding %u", outstanding);
1360 if (PacketIsTunnelRoot(p) && !PacketTunnelIsVerdicted(p) && !outstanding) {
1364 }
else if (PacketIsTunnelChild(p) && outstanding == 1 && p->
root &&
1365 PacketTunnelIsVerdicted(p->
root)) {
1384 static inline bool VerdictTunnelPacket(
Packet *p)
1389 verdict = VerdictTunnelPacketInternal(p);
1395 const int datalink,
Packet *p,
const uint8_t *data,
const uint32_t
len)
1420 "%" PRId32
" not yet supported",
1429 const uint16_t
proto,
Packet *p,
const uint8_t *data,
const uint32_t
len)
1433 uint16_t ip_len = (
len < USHRT_MAX) ? (uint16_t)
len : (uint16_t)USHRT_MAX;
1438 uint16_t ip_len = (
len < USHRT_MAX) ? (uint16_t)
len : (uint16_t)USHRT_MAX;
#define ENGINE_SET_EVENT(p, e)
uint16_t counter_flow_get_used_eval_busy
struct Packet_::@24::@31 icmp_s
@ PKT_DROP_REASON_DEFRAG_MEMCAP
@ PKT_DROP_REASON_DEFRAG_ERROR
uint16_t counter_defrag_ipv4_reassembled
thread_local uint64_t spin_lock_cnt
@ PKT_DROP_REASON_RULES_THRESHOLD
int DecodeIPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
int DecodeERSPAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
ERSPAN Type II.
int DecodeGeneve(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
uint16_t counter_ethertype_unknown
uint16_t counter_flow_udp
const struct Signature_ * s
uint16_t counter_flow_active
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
@ CHECKSUM_VALIDATION_OFFLOAD
void PacketFreeOrRelease(Packet *p)
Return a packet to where it was allocated.
#define IPV4_GET_RAW_IPPROTO(ip4h)
uint16_t counter_flow_icmp4
uint16_t counter_max_pkt_size
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
void PacketBypassCallback(Packet *p)
int DecodeSCTP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
uint16_t counter_avg_pkt_size
uint16_t address_un_data16[8]
int DecodePPP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
int DecodeARP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
struct in6_addr address_un_in6
@ PKT_DROP_REASON_STREAM_MEMCAP
@ PKT_DROP_REASON_FLOW_MEMCAP
void CaptureStatsSetup(ThreadVars *tv)
const char * PacketDropReasonToString(enum PacketDropReason r)
uint8_t events[PACKET_ENGINE_EVENT_MAX]
@ DECODE_TUNNEL_IPV6_TEREDO
int DecodeEthernet(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
thread_local uint64_t rwr_lock_cnt
void AddressDebugPrint(Address *)
Debug print function for printing addresses.
uint16_t counter_flow_spare_sync_avg
Packet * PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto)
Setup a pseudo packet (reassembled frags)
simple fifo queue for packets with mutex and cond Calling the mutex or triggering the cond is respons...
#define ETHERNET_TYPE_IPV6
@ PKT_SRC_CAPTURE_TIMEOUT
int DecodeUDP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
PacketAlert * PacketAlertCreate(void)
Initialize PacketAlerts with dynamic alerts array size.
struct PktProfilingDetectData_ PktProfilingDetectData
uint16_t counter_flow_get_used_eval
struct Packet_::@30 persistent
int(* DecoderFunc)(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
uint16_t counter_tcp_synack
@ CHECKSUM_VALIDATION_RXONLY
PktProfilingAppData app[]
@ PKT_DROP_REASON_STREAM_REASSEMBLY
struct PktProfilingTmmData_ PktProfilingTmmData
Per TMM stats storage.
int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
Copy data to Packet payload at given offset.
int DecodeVXLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
union PacketL3::Hdrs hdrs
struct DecodeThreadVars_ DecodeThreadVars
Structure to hold thread specific data for all decode modules.
#define LINKTYPE_GRE_OVER_IP
#define IPV6_GET_L4PROTO(p)
int DecodeVNTag(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
@ CHECKSUM_VALIDATION_DISABLE
uint16_t counter_flow_tcp
@ CHECKSUM_VALIDATION_KERNEL
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
uint32_t address_un_data32[4]
#define PKT_NOPAYLOAD_INSPECTION
void PacketAlertGetMaxConfig(void)
int DecodeICMPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Decode ICMPV6 packets and fill the Packet with the decoded info.
uint8_t decoder_max_layers
uint16_t counter_tcp_active_sessions
struct PacketAlert_ PacketAlert
struct PktProfilingLoggerData_ PktProfilingLoggerData
int(* BypassPacketsFlow)(struct Packet_ *)
uint16_t counter_max_mac_addrs_src
void DecodeUnregisterCounters(void)
thread_local uint64_t rww_lock_contention
uint16_t counter_flow_get_used
Data structure to store app layer decoder events.
AppLayerDecoderEvents * app_layer_events
PacketEngineEvents events
void PacketAlertFree(PacketAlert *pa)
#define ETHERNET_TYPE_8021QINQ
uint16_t counter_flow_spare_sync_empty
uint16_t counter_flow_tcp_reuse
int DecodeRaw(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
@ PKT_DROP_REASON_STREAM_URG
thread_local uint64_t rwr_lock_contention
uint16_t counter_flow_total
thread_local uint64_t spin_lock_wait_ticks
@ CHECKSUM_VALIDATION_ENABLE
void DecodeRegisterPerfCounters(DecodeThreadVars *, ThreadVars *)
uint16_t counter_flow_spare_sync
uint16_t counter_defrag_tracker_timeout
@ CHECKSUM_VALIDATION_AUTO
uint16_t counter_ipv6inipv6
@ PKT_DROP_REASON_DEFAULT_APP_POLICY
#define TUNNEL_PKT_TPR(p)
uint16_t counter_flow_get_used_failed
#define ETHERNET_TYPE_8021AD
@ PKT_DROP_REASON_APPLAYER_ERROR
void PacketSwap(Packet *p)
switch direction of a packet
int DecodeMPLS(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
This is for the app layer in general and it contains per thread context relevant to both the alpd and...
@ PKT_DROP_REASON_NOT_SET
struct PktProfilingAppData_ PktProfilingAppData
void CaptureStatsUpdate(ThreadVars *tv, const Packet *p)
int DecodeTEMPLATE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode TEMPLATE packets.
int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
int DecodeESP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Function to decode IPSEC-ESP packets.
thread_local uint64_t rww_lock_cnt
int DecodeNSH(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode NSH packets.
Per thread variable structure.
thread_local uint64_t mutex_lock_contention
thread_local uint64_t spin_lock_contention
PktProfilingLoggerData logger[LOGGER_SIZE]
void PacketFree(Packet *p)
Return a malloced packet.
const char * PktSrcToString(enum PktSrcEnum pkt_src)
uint16_t counter_vlan_qinq
get the highest proto/next header field we know
uint16_t counter_defrag_tracker_hard_reuse
int DecodeSll(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
int PacketCallocExtPkt(Packet *p, int datalen)
#define ETHERNET_TYPE_MPLS_UNICAST
@ PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
#define ETHERNET_TYPE_PPPOE_DISC
AppLayerThreadCtx * app_tctx
uint8_t address_un_data8[16]
@ PKT_DROP_REASON_STREAM_ERROR
struct LiveDevice_ * livedev
#define ETHERNET_TYPE_VNTAG
uint16_t counter_ieee8021ah
thread_local uint64_t rww_lock_wait_ticks
int DecodeTCP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
uint16_t counter_ipv4inipv6
#define ETHERNET_TYPE_NSH
#define ETHERNET_TYPE_DCE
thread_local uint64_t rwr_lock_wait_ticks
@ PKT_DROP_REASON_DEFAULT_PACKET_POLICY
int DecodeNull(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
int DecodeIPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
ExceptionPolicyCounters counter_defrag_memcap_eps
uint32_t default_packet_size
uint8_t nb_decoded_layers
PktProfilingDetectData detect[PROF_DETECT_SIZE]
void(* ReleasePacket)(struct Packet_ *)
int DecodeGRE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode GRE packets.
@ ETHERNET_UNKNOWN_ETHERTYPE
@ PKT_DROP_REASON_INNER_PACKET
struct PktProfiling_ PktProfiling
Per pkt stats storage.
@ VLAN_HEADER_TOO_MANY_LAYERS
void DecodeThreadVarsFree(ThreadVars *, DecodeThreadVars *)
uint16_t counter_flow_spare_sync_incomplete
@ PKT_DROP_REASON_APPLAYER_MEMCAP
void DecodeGlobalConfig(void)
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
#define ETHERNET_TYPE_8021AH
uint16_t counter_flow_icmp6
@ PROFILE_FLOWWORKER_SIZE
#define ETHERNET_DCE_HEADER_LEN
struct PacketAlerts_ PacketAlerts
int DecodeICMPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main ICMPv4 decoding function.
uint8_t app_update_direction
@ PKT_DROP_REASON_NFQ_ERROR
uint16_t counter_defrag_no_frags
uint16_t counter_defrag_ipv6_reassembled
enum PacketTunnelType ttype
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
ExceptionPolicyCounters counter_flow_memcap_eps
@ GENERIC_TOO_MANY_LAYERS
struct Packet_::@26::@32 icmp_d
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
#define TUNNEL_PKT_RTV(p)
thread_local uint64_t mutex_lock_wait_ticks
struct PacketL3::@22::@23 ip6
#define SCLogError(...)
Macro used to log ERROR messages.
@ PKT_SRC_DETECT_RELOAD_FLUSH
struct PktProfilingData_ PktProfilingData
#define ETHERNET_TYPE_PPPOE_SESS
Structure to hold thread specific data for all decode modules.
#define PACKET_ENGINE_EVENT_MAX
#define LINKTYPE_LINUX_SLL
uint16_t counter_flow_elephant
PktProfilingTmmData tmm[TMM_SIZE]
void * output_flow_thread_data
#define ETHERNET_TYPE_ARP
uint16_t counter_max_mac_addrs_dst
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *)
Alloc and setup DecodeThreadVars.
uint16_t counter_defrag_max_hit
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
union Address_::@21 address
union PacketL4::L4Hdrs hdrs
uint16_t counter_vlan_qinqinq
#define VLAN_MAX_LAYER_IDX
#define LINKTYPE_ETHERNET
union PacketL2::L2Hdrs hdrs
#define ENGINE_SET_INVALID_EVENT(p, e)
uint16_t counter_flow_memcap
#define ETHERNET_TYPE_VLAN
uint16_t counter_defrag_ipv6_fragments
#define PKT_NOPACKET_INSPECTION
per packet AF_PACKET vars
struct PacketEngineEvents_ PacketEngineEvents
uint16_t packet_alert_max
uint16_t vlan_id[VLAN_MAX_LAYERS]
int DecodeIEEE8021ah(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
void PacketDefragPktSetupParent(Packet *parent)
inform defrag "parent" that a pseudo packet is now associated to it.
uint8_t plugin_v[PLUGIN_VAR_SIZE]
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
PktProfilingData flowworker[PROFILE_FLOWWORKER_SIZE]
thread_local uint64_t mutex_lock_cnt
@ PKT_DROP_REASON_STREAM_MIDSTREAM
uint16_t counter_flow_get_used_eval_reject
int DecodePPPOESession(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main decoding function for PPPOE Session packets.
#define ETHERNET_TYPE_MPLS_MULTICAST
#define LINKTYPE_CISCO_HDLC
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
#define DEBUG_VALIDATE_BUG_ON(exp)
@ PKT_DROP_REASON_FLOW_DROP
union PacketL4::L4Vars vars
int DecodeERSPANTypeI(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
ERSPAN Type I.
int DecodeCHDLC(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
uint16_t counter_engine_events[DECODE_EVENT_MAX]
uint16_t counter_defrag_tracker_soft_reuse
@ PKT_DROP_REASON_DECODE_ERROR
uint16_t counter_defrag_ipv4_fragments
int DecodePPPOEDiscovery(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main decoding function for PPPOE Discovery packets.