suricata
decode.h
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  */
23 
24 #ifndef SURICATA_DECODE_H
25 #define SURICATA_DECODE_H
26 
27 //#define DBG_THREADS
28 #define COUNTERS
29 
30 #include "suricata-common.h"
31 #include "suricata-plugin.h"
32 #include "threadvars.h"
33 #include "util-debug.h"
34 #include "decode-events.h"
36 #include "util-datalink.h"
37 #ifdef PROFILING
38 #include "flow-worker.h"
39 #include "app-layer-protos.h"
40 #endif
41 
42 typedef enum {
50 
51 enum PktSrcEnum {
65 };
66 
67 #include "source-nflog.h"
68 #include "source-nfq.h"
69 #include "source-ipfw.h"
70 #include "source-pcap.h"
71 #include "source-af-packet.h"
72 #include "source-netmap.h"
73 #include "source-windivert.h"
74 #ifdef HAVE_DPDK
75 #include "source-dpdk.h"
76 #endif
77 #ifdef HAVE_AF_XDP
78 #include "source-af-xdp.h"
79 #endif
80 
81 #include "decode-ethernet.h"
82 #include "decode-gre.h"
83 #include "decode-ppp.h"
84 #include "decode-ipv4.h"
85 #include "decode-ipv6.h"
86 #include "decode-icmpv4.h"
87 #include "decode-icmpv6.h"
88 #include "decode-tcp.h"
89 #include "decode-udp.h"
90 #include "decode-sctp.h"
91 #include "decode-esp.h"
92 #include "decode-vlan.h"
93 #include "decode-mpls.h"
94 #include "decode-arp.h"
95 
96 #include "util-validate.h"
97 
98 /* for now a uint8_t is enough -- here in decode as it's part of the packet */
99 #define SignatureMask uint8_t
100 
101 /* forward declarations */
102 struct DetectionEngineThreadCtx_;
104 
105 struct PktPool_;
106 
107 /* declare these here as they are called from the
108  * PACKET_RECYCLE and PACKET_CLEANUP macro's. */
110 
111 /* Address */
112 typedef struct Address_ {
113  char family;
114  union {
115  uint32_t address_un_data32[4]; /* type-specific field */
116  uint16_t address_un_data16[8]; /* type-specific field */
117  uint8_t address_un_data8[16]; /* type-specific field */
118  struct in6_addr address_un_in6;
121 
122 #define addr_data32 address.address_un_data32
123 #define addr_data16 address.address_un_data16
124 #define addr_data8 address.address_un_data8
125 #define addr_in6addr address.address_un_in6
126 
127 #define COPY_ADDRESS(a, b) do { \
128  (b)->family = (a)->family; \
129  (b)->addr_data32[0] = (a)->addr_data32[0]; \
130  (b)->addr_data32[1] = (a)->addr_data32[1]; \
131  (b)->addr_data32[2] = (a)->addr_data32[2]; \
132  (b)->addr_data32[3] = (a)->addr_data32[3]; \
133  } while (0)
134 
135 /* Set the IPv4 addresses into the Addrs of the Packet.
136  * Make sure p->ip4h is initialized and validated.
137  *
138  * We set the rest of the struct to 0 so we can
139  * prevent using memset. */
140 #define SET_IPV4_SRC_ADDR(ip4h, a) \
141  do { \
142  (a)->family = AF_INET; \
143  (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_src.s_addr; \
144  (a)->addr_data32[1] = 0; \
145  (a)->addr_data32[2] = 0; \
146  (a)->addr_data32[3] = 0; \
147  } while (0)
148 
149 #define SET_IPV4_DST_ADDR(ip4h, a) \
150  do { \
151  (a)->family = AF_INET; \
152  (a)->addr_data32[0] = (uint32_t)(ip4h)->s_ip_dst.s_addr; \
153  (a)->addr_data32[1] = 0; \
154  (a)->addr_data32[2] = 0; \
155  (a)->addr_data32[3] = 0; \
156  } while (0)
157 
158 /* Set the IPv6 addresses into the Addrs of the Packet. */
159 #define SET_IPV6_SRC_ADDR(ip6h, a) \
160  do { \
161  (a)->family = AF_INET6; \
162  (a)->addr_data32[0] = (ip6h)->s_ip6_src[0]; \
163  (a)->addr_data32[1] = (ip6h)->s_ip6_src[1]; \
164  (a)->addr_data32[2] = (ip6h)->s_ip6_src[2]; \
165  (a)->addr_data32[3] = (ip6h)->s_ip6_src[3]; \
166  } while (0)
167 
168 #define SET_IPV6_DST_ADDR(ip6h, a) \
169  do { \
170  (a)->family = AF_INET6; \
171  (a)->addr_data32[0] = (ip6h)->s_ip6_dst[0]; \
172  (a)->addr_data32[1] = (ip6h)->s_ip6_dst[1]; \
173  (a)->addr_data32[2] = (ip6h)->s_ip6_dst[2]; \
174  (a)->addr_data32[3] = (ip6h)->s_ip6_dst[3]; \
175  } while (0)
176 
177 /* Set the TCP ports into the Ports of the Packet.
178  * Make sure p->tcph is initialized and validated. */
179 #define SET_TCP_SRC_PORT(pkt, prt) do { \
180  SET_PORT(TCP_GET_SRC_PORT((pkt)), *(prt)); \
181  } while (0)
182 
183 #define SET_TCP_DST_PORT(pkt, prt) do { \
184  SET_PORT(TCP_GET_DST_PORT((pkt)), *(prt)); \
185  } while (0)
186 
187 /* Set the UDP ports into the Ports of the Packet.
188  * Make sure p->udph is initialized and validated. */
189 #define SET_UDP_SRC_PORT(pkt, prt) do { \
190  SET_PORT(UDP_GET_SRC_PORT((pkt)), *(prt)); \
191  } while (0)
192 #define SET_UDP_DST_PORT(pkt, prt) do { \
193  SET_PORT(UDP_GET_DST_PORT((pkt)), *(prt)); \
194  } while (0)
195 
196 #define GET_IPV4_SRC_ADDR_U32(p) ((p)->src.addr_data32[0])
197 #define GET_IPV4_DST_ADDR_U32(p) ((p)->dst.addr_data32[0])
198 #define GET_IPV4_SRC_ADDR_PTR(p) ((p)->src.addr_data32)
199 #define GET_IPV4_DST_ADDR_PTR(p) ((p)->dst.addr_data32)
200 
201 #define GET_IPV6_SRC_IN6ADDR(p) ((p)->src.addr_in6addr)
202 #define GET_IPV6_DST_IN6ADDR(p) ((p)->dst.addr_in6addr)
203 #define GET_IPV6_SRC_ADDR(p) ((p)->src.addr_data32)
204 #define GET_IPV6_DST_ADDR(p) ((p)->dst.addr_data32)
205 #define GET_TCP_SRC_PORT(p) ((p)->sp)
206 #define GET_TCP_DST_PORT(p) ((p)->dp)
207 
208 #define GET_PKT_LEN(p) (p)->pktlen
209 #define GET_PKT_DATA(p) (((p)->ext_pkt == NULL) ? GET_PKT_DIRECT_DATA(p) : (p)->ext_pkt)
210 #define GET_PKT_DIRECT_DATA(p) (p)->pkt_data
211 #define GET_PKT_DIRECT_MAX_SIZE(p) (default_packet_size)
212 
213 #define SET_PKT_LEN(p, len) do { \
214  (p)->pktlen = (len); \
215  } while (0)
216 
217 /* Port is just a uint16_t */
218 typedef uint16_t Port;
219 #define SET_PORT(v, p) ((p) = (v))
220 #define COPY_PORT(a,b) ((b) = (a))
221 
222 #define CMP_ADDR(a1, a2) \
223  (((a1)->addr_data32[3] == (a2)->addr_data32[3] && \
224  (a1)->addr_data32[2] == (a2)->addr_data32[2] && \
225  (a1)->addr_data32[1] == (a2)->addr_data32[1] && \
226  (a1)->addr_data32[0] == (a2)->addr_data32[0]))
227 #define CMP_PORT(p1, p2) \
228  ((p1) == (p2))
229 
230 /*Given a packet pkt offset to the start of the ip header in a packet
231  *We determine the ip version. */
232 #define IP_GET_RAW_VER(pkt) ((((pkt)[0] & 0xf0) >> 4))
233 
234 #define PKT_IS_TCP(p) (((p)->tcph != NULL))
235 #define PKT_IS_UDP(p) (((p)->udph != NULL))
236 #define PKT_IS_ICMPV4(p) (((p)->icmpv4h != NULL))
237 #define PKT_IS_ICMPV6(p) (((p)->icmpv6h != NULL))
238 #define PKT_IS_TOSERVER(p) (((p)->flowflags & FLOW_PKT_TOSERVER))
239 #define PKT_IS_TOCLIENT(p) (((p)->flowflags & FLOW_PKT_TOCLIENT))
240 
242  char *json_string;
244 };
245 
246 /* structure to store the sids/gids/etc the detection engine
247  * found in this packet */
248 typedef struct PacketAlert_ {
249  SigIntId iid; /* Internal ID, used for sorting */
250  uint8_t action; /* Internal num, used for thresholding */
251  uint8_t flags;
252  const struct Signature_ *s;
253  uint64_t tx_id; /* Used for sorting */
254  int64_t frame_id;
257 
258 /**
259  * \defgroup PacketAlertFlags
260  *
261  * Available flags for PacketAlert.flags.
262  *
263  * @{
264  */
265 /** flag to indicate the rule action (drop/pass) needs to be applied to the flow */
266 #define PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW BIT_U8(0)
267 /** alert was generated based on state */
268 #define PACKET_ALERT_FLAG_STATE_MATCH BIT_U8(1)
269 /** alert was generated based on stream */
270 #define PACKET_ALERT_FLAG_STREAM_MATCH BIT_U8(2)
271 /** alert is in a tx, tx_id set */
272 #define PACKET_ALERT_FLAG_TX BIT_U8(3)
273 /** action was changed by rate_filter */
274 #define PACKET_ALERT_FLAG_RATE_FILTER_MODIFIED BIT_U8(4)
275 /** alert is in a frame, frame_id set */
276 #define PACKET_ALERT_FLAG_FRAME BIT_U8(5)
277 /** alert in a tx was forced */
278 #define PACKET_ALERT_FLAG_TX_GUESSED BIT_U8(6)
279 /** accept should be applied to packet */
280 #define PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET BIT_U8(7)
281 /** @} */
282 
283 extern uint16_t packet_alert_max;
284 #define PACKET_ALERT_MAX 15
285 
286 typedef struct PacketAlerts_ {
287  uint16_t cnt;
288  uint16_t discarded;
289  uint16_t suppressed;
291  /* single pa used when we're dropping,
292  * so we can log it out in the drop log. */
295 
297 void PacketAlertRecycle(PacketAlert *pa_array, uint16_t cnt);
298 
299 void PacketAlertFree(PacketAlert *pa);
300 
301 /** number of decoder events we support per packet. Power of 2 minus 1
302  * for memory layout */
303 #define PACKET_ENGINE_EVENT_MAX 15
304 
305 /** data structure to store decoder, defrag and stream events */
306 typedef struct PacketEngineEvents_ {
307  uint8_t cnt; /**< number of events */
308  uint8_t events[PACKET_ENGINE_EVENT_MAX]; /**< array of events */
310 
311 typedef struct PktVar_ {
312  uint32_t id;
313  struct PktVar_ *next; /* right now just implement this as a list,
314  * in the long run we have thing of something
315  * faster. */
316  uint16_t key_len;
317  uint16_t value_len;
318  uint8_t *key;
319  uint8_t *value;
321 
322 #ifdef PROFILING
323 
324 /** \brief Per TMM stats storage */
325 typedef struct PktProfilingTmmData_ {
326  uint64_t ticks_start;
327  uint64_t ticks_end;
328 #ifdef PROFILE_LOCKING
329  uint64_t mutex_lock_cnt;
330  uint64_t mutex_lock_wait_ticks;
331  uint64_t mutex_lock_contention;
332  uint64_t spin_lock_cnt;
333  uint64_t spin_lock_wait_ticks;
334  uint64_t spin_lock_contention;
335  uint64_t rww_lock_cnt;
336  uint64_t rww_lock_wait_ticks;
337  uint64_t rww_lock_contention;
338  uint64_t rwr_lock_cnt;
339  uint64_t rwr_lock_wait_ticks;
340  uint64_t rwr_lock_contention;
341 #endif
343 
344 typedef struct PktProfilingData_ {
345  uint64_t ticks_start;
346  uint64_t ticks_end;
348 
349 typedef struct PktProfilingDetectData_ {
350  uint64_t ticks_start;
351  uint64_t ticks_end;
352  uint64_t ticks_spent;
354 
355 typedef struct PktProfilingAppData_ {
356  uint64_t ticks_spent;
358 
359 typedef struct PktProfilingLoggerData_ {
360  uint64_t ticks_start;
361  uint64_t ticks_end;
362  uint64_t ticks_spent;
364 
365 /** \brief Per pkt stats storage */
366 typedef struct PktProfiling_ {
367  uint64_t ticks_start;
368  uint64_t ticks_end;
369 
374  uint64_t proto_detect;
377 
378 #endif /* PROFILING */
379 
390  PKT_DROP_REASON_RULES_THRESHOLD, /**< detection_filter in action */
396  PKT_DROP_REASON_NFQ_ERROR, /**< no nfq verdict, must be error */
397  PKT_DROP_REASON_INNER_PACKET, /**< drop issued by inner (tunnel) packet */
398  PKT_DROP_REASON_DEFAULT_PACKET_POLICY, /**< drop issued by default packet policy */
399  PKT_DROP_REASON_DEFAULT_APP_POLICY, /**< drop issued by default app policy */
400  PKT_DROP_REASON_STREAM_PRE_HOOK, /**< drop issued in the pre_stream hook */
401  PKT_DROP_REASON_FLOW_PRE_HOOK, /**< drop issued in the pre_flow hook */
403 };
404 
409 };
410 
411 /* forward declaration since Packet struct definition requires this */
412 struct PacketQueue_;
413 
417 };
418 
419 struct PacketL2 {
420  enum PacketL2Types type;
421  union L2Hdrs {
422  EthernetHdr *ethh;
423  } hdrs;
424 };
425 
431 };
432 
433 struct PacketL3 {
434  enum PacketL3Types type;
435  /* Checksum for IP packets. */
436  bool csum_set;
437  uint16_t csum;
438  union Hdrs {
441  ARPHdr *arph;
442  } hdrs;
443  /* IPv4 and IPv6 are mutually exclusive */
444  union {
446  struct {
449  } ip6;
450  } vars;
451 };
452 
462 };
463 
464 struct PacketL4 {
465  enum PacketL4Types type;
466  bool csum_set;
467  uint16_t csum;
468  union L4Hdrs {
473  SCTPHdr *sctph;
474  GREHdr *greh;
475  ESPHdr *esph;
476  } hdrs;
477  union L4Vars {
481  } vars;
482 };
483 
484 /* sizes of the members:
485  * src: 17 bytes
486  * dst: 17 bytes
487  * sp/type: 1 byte
488  * dp/code: 1 byte
489  * proto: 1 byte
490  * recurs: 1 byte
491  *
492  * sum of above: 38 bytes
493  *
494  * flow ptr: 4/8 bytes
495  * flags: 1 byte
496  * flowflags: 1 byte
497  *
498  * sum of above 44/48 bytes
499  */
500 typedef struct Packet_
501 {
502  /* Addresses, Ports and protocol
503  * these are on top so we can use
504  * the Packet as a hash key */
507  union {
509  // icmp type and code of this packet
510  struct {
511  uint8_t type;
512  uint8_t code;
514  };
515  union {
517  // icmp type and code of the expected counterpart (for flows)
518  struct {
519  uint8_t type;
520  uint8_t code;
522  };
523  uint8_t proto;
524  /* make sure we can't be attacked on when the tunneled packet
525  * has the exact same tuple as the lower levels */
527 
529  uint8_t vlan_idx;
530 
531  /* flow */
532  uint8_t flowflags;
533  /* coccinelle: Packet:flowflags:FLOW_PKT_ */
534 
535  uint8_t app_update_direction; // enum StreamUpdateDir
536 
537  /** sig mask flags this packet has, used in signature matching */
539 
540  /** bit flags of SignatureHookPkt values this packet should trigger */
541  uint16_t pkt_hooks;
542 
543  /* Pkt Flags */
544  uint32_t flags;
545 
546  struct Flow_ *flow;
547 
548  /* raw hash value for looking up the flow, will need to modulated to the
549  * hash size still */
550  uint32_t flow_hash;
551 
552  /* tunnel type: none, root or child */
553  enum PacketTunnelType ttype;
554 
556 
557  union {
558  /* nfq stuff */
559 #ifdef HAVE_NFLOG
560  NFLOGPacketVars nflog_v;
561 #endif /* HAVE_NFLOG */
562 #ifdef NFQ
564 #endif /* NFQ */
565 #ifdef IPFW
567 #endif /* IPFW */
568 #ifdef AF_PACKET
569  AFPPacketVars afp_v;
570 #endif
571 #ifdef HAVE_NETMAP
572  NetmapPacketVars netmap_v;
573 #endif
574 #ifdef WINDIVERT
575  WinDivertPacketVars windivert_v;
576 #endif /* WINDIVERT */
577 #ifdef HAVE_DPDK
578  DPDKPacketVars dpdk_v;
579 #endif
580 #ifdef HAVE_AF_XDP
581  AFXDPPacketVars afxdp_v;
582 #endif
583  /* A chunk of memory that a plugin can use for its packet vars. */
585 
586  /** libpcap vars: shared by Pcap Live mode and Pcap File mode */
588  };
589 
590  /** The release function for packet structure and data */
591  void (*ReleasePacket)(struct Packet_ *);
592  /** The function triggering bypass the flow in the capture method.
593  * Return 1 for success and 0 on error */
594  int (*BypassPacketsFlow)(struct Packet_ *);
595 
596  /* pkt vars */
598 
599  struct PacketL2 l2;
600  struct PacketL3 l3;
601  struct PacketL4 l4;
602 
603  /* ptr to the payload of the packet
604  * with it's length. */
605  uint8_t *payload;
606  uint16_t payload_len;
607 
608  /* IPS action to take */
609  uint8_t action;
610 
611  uint8_t pkt_src;
612 
613  /* storage: set to pointer to heap and extended via allocation if necessary */
614  uint32_t pktlen;
615  uint8_t *ext_pkt;
616 
617  /* Incoming interface */
619 
621 
622  struct Host_ *host_src;
623  struct Host_ *host_dst;
624 
625  /** packet number in the pcap file, matches wireshark */
626  uint64_t pcap_cnt;
627 
628 
629  /* engine events */
631 
633 
634  /* double linked list ptrs */
635  struct Packet_ *next;
636  struct Packet_ *prev;
637 
638  /** data linktype in host order */
639  int datalink;
640 
641  /* count decoded layers of packet : too many layers
642  * cause issues with performance and stability (stack exhaustion)
643  */
645 
646  /* enum PacketDropReason::PKT_DROP_REASON_* as uint8_t for compactness */
647  uint8_t drop_reason;
648 
649  /** has verdict on this tunneled packet been issued? */
651 
652  /* tunnel/encapsulation handling */
653  struct Packet_ *root; /* in case of tunnel this is a ptr
654  * to the 'real' packet, the one we
655  * need to set the verdict on --
656  * It should always point to the lowest
657  * packet in a encapsulated packet */
658 
659  /* ready to set verdict counter, only set in root */
660  uint16_t tunnel_rtv_cnt;
661  /* tunnel packet ref count */
662  uint16_t tunnel_tpr_cnt;
663 
664  /** tenant id for this packet, if any. If 0 then no tenant was assigned. */
665  uint32_t tenant_id;
666 
667  /* The Packet pool from which this packet was allocated. Used when returning
668  * the packet to its owner's stack. If NULL, then allocated with malloc.
669  */
670  struct PktPool_ *pool;
671 
672 #ifdef PROFILING
674 #endif
675  /* things in the packet that live beyond a reinit */
676  struct {
677  /** lock to protect access to:
678  * - tunnel_rtv_cnt
679  * - tunnel_tpr_cnt
680  * - tunnel_verdicted
681  * - nfq_v.mark (if p->ttype != PacketTunnelNone)
682  */
685 
686  /** flex array accessor to allocated packet data. Size of the additional
687  * data is `default_packet_size`. If this is insufficient,
688  * Packet::ext_pkt will be used instead. */
689  uint8_t pkt_data[];
691 
692 static inline bool PacketIsIPv4(const Packet *p);
693 static inline bool PacketIsIPv6(const Packet *p);
694 
695 /** highest mtu of the interfaces we monitor */
696 #define DEFAULT_MTU 1500
697 #define MINIMUM_MTU 68 /**< ipv4 minimum: rfc791 */
698 
699 #define DEFAULT_PACKET_SIZE (DEFAULT_MTU + ETHERNET_HEADER_LEN)
700 /* storage: maximum ip packet size + link header */
701 #define MAX_PAYLOAD_SIZE (IPV6_HEADER_LEN + 65536 + 28)
702 extern uint32_t default_packet_size;
703 #define SIZE_OF_PACKET (default_packet_size + sizeof(Packet))
704 
705 static inline bool PacketIsIPv4(const Packet *p)
706 {
707  return p->l3.type == PACKET_L3_IPV4;
708 }
709 
710 static inline const IPV4Hdr *PacketGetIPv4(const Packet *p)
711 {
712  DEBUG_VALIDATE_BUG_ON(!PacketIsIPv4(p));
713  return p->l3.hdrs.ip4h;
714 }
715 
716 static inline IPV4Hdr *PacketSetIPV4(Packet *p, const uint8_t *buf)
717 {
719  p->l3.type = PACKET_L3_IPV4;
720  p->l3.hdrs.ip4h = (IPV4Hdr *)buf;
721  return p->l3.hdrs.ip4h;
722 }
723 
724 /* Retrieve proto regardless of IP version */
725 static inline uint8_t PacketGetIPProto(const Packet *p)
726 {
727  if (p->proto != 0) {
728  return p->proto;
729  }
730  if (PacketIsIPv4(p)) {
731  const IPV4Hdr *hdr = PacketGetIPv4(p);
732  return IPV4_GET_RAW_IPPROTO(hdr);
733  } else if (PacketIsIPv6(p)) {
734  return IPV6_GET_L4PROTO(p);
735  }
736  return 0;
737 }
738 
739 static inline uint8_t PacketGetIPv4IPProto(const Packet *p)
740 {
741  if (PacketGetIPv4(p)) {
742  const IPV4Hdr *hdr = PacketGetIPv4(p);
743  return IPV4_GET_RAW_IPPROTO(hdr);
744  }
745  return 0;
746 }
747 
748 static inline const IPV6Hdr *PacketGetIPv6(const Packet *p)
749 {
750  DEBUG_VALIDATE_BUG_ON(!PacketIsIPv6(p));
751  return p->l3.hdrs.ip6h;
752 }
753 
754 static inline IPV6Hdr *PacketSetIPV6(Packet *p, const uint8_t *buf)
755 {
757  p->l3.type = PACKET_L3_IPV6;
758  p->l3.hdrs.ip6h = (IPV6Hdr *)buf;
759  return p->l3.hdrs.ip6h;
760 }
761 
762 static inline bool PacketIsIPv6(const Packet *p)
763 {
764  return p->l3.type == PACKET_L3_IPV6;
765 }
766 
767 static inline void PacketClearL2(Packet *p)
768 {
769  memset(&p->l2, 0, sizeof(p->l2));
770 }
771 
772 /* Can be called multiple times, e.g. for DCE */
773 static inline EthernetHdr *PacketSetEthernet(Packet *p, const uint8_t *buf)
774 {
777  p->l2.hdrs.ethh = (EthernetHdr *)buf;
778  return p->l2.hdrs.ethh;
779 }
780 
781 static inline const EthernetHdr *PacketGetEthernet(const Packet *p)
782 {
784  return p->l2.hdrs.ethh;
785 }
786 
787 static inline bool PacketIsEthernet(const Packet *p)
788 {
789  return p->l2.type == PACKET_L2_ETHERNET;
790 }
791 
792 static inline void PacketClearL3(Packet *p)
793 {
794  memset(&p->l3, 0, sizeof(p->l3));
795 }
796 
797 static inline void PacketClearL4(Packet *p)
798 {
799  memset(&p->l4, 0, sizeof(p->l4));
800 }
801 
802 static inline TCPHdr *PacketSetTCP(Packet *p, const uint8_t *buf)
803 {
805  p->l4.type = PACKET_L4_TCP;
806  p->l4.hdrs.tcph = (TCPHdr *)buf;
807  return p->l4.hdrs.tcph;
808 }
809 
810 static inline const TCPHdr *PacketGetTCP(const Packet *p)
811 {
813  return p->l4.hdrs.tcph;
814 }
815 
816 static inline bool PacketIsTCP(const Packet *p)
817 {
818  return p->l4.type == PACKET_L4_TCP;
819 }
820 
821 static inline UDPHdr *PacketSetUDP(Packet *p, const uint8_t *buf)
822 {
824  p->l4.type = PACKET_L4_UDP;
825  p->l4.hdrs.udph = (UDPHdr *)buf;
826  return p->l4.hdrs.udph;
827 }
828 
829 static inline const UDPHdr *PacketGetUDP(const Packet *p)
830 {
832  return p->l4.hdrs.udph;
833 }
834 
835 static inline bool PacketIsUDP(const Packet *p)
836 {
837  return p->l4.type == PACKET_L4_UDP;
838 }
839 
840 static inline ICMPV4Hdr *PacketSetICMPv4(Packet *p, const uint8_t *buf)
841 {
843  p->l4.type = PACKET_L4_ICMPV4;
844  p->l4.hdrs.icmpv4h = (ICMPV4Hdr *)buf;
845  return p->l4.hdrs.icmpv4h;
846 }
847 
848 static inline const ICMPV4Hdr *PacketGetICMPv4(const Packet *p)
849 {
851  return p->l4.hdrs.icmpv4h;
852 }
853 
854 static inline bool PacketIsICMPv4(const Packet *p)
855 {
856  return p->l4.type == PACKET_L4_ICMPV4;
857 }
858 
859 static inline const IPV4Hdr *PacketGetICMPv4EmbIPv4(const Packet *p)
860 {
861  const uint8_t *start = (const uint8_t *)PacketGetICMPv4(p);
862  const uint8_t *ip = start + p->l4.vars.icmpv4.emb_ip4h_offset;
863  return (const IPV4Hdr *)ip;
864 }
865 
866 static inline ICMPV6Hdr *PacketSetICMPv6(Packet *p, const uint8_t *buf)
867 {
869  p->l4.type = PACKET_L4_ICMPV6;
870  p->l4.hdrs.icmpv6h = (ICMPV6Hdr *)buf;
871  return p->l4.hdrs.icmpv6h;
872 }
873 
874 static inline const ICMPV6Hdr *PacketGetICMPv6(const Packet *p)
875 {
877  return p->l4.hdrs.icmpv6h;
878 }
879 
880 static inline bool PacketIsICMPv6(const Packet *p)
881 {
882  return p->l4.type == PACKET_L4_ICMPV6;
883 }
884 
885 static inline SCTPHdr *PacketSetSCTP(Packet *p, const uint8_t *buf)
886 {
888  p->l4.type = PACKET_L4_SCTP;
889  p->l4.hdrs.sctph = (SCTPHdr *)buf;
890  return p->l4.hdrs.sctph;
891 }
892 
893 static inline const SCTPHdr *PacketGetSCTP(const Packet *p)
894 {
896  return p->l4.hdrs.sctph;
897 }
898 
899 static inline bool PacketIsSCTP(const Packet *p)
900 {
901  return p->l4.type == PACKET_L4_SCTP;
902 }
903 
904 static inline GREHdr *PacketSetGRE(Packet *p, const uint8_t *buf)
905 {
907  p->l4.type = PACKET_L4_GRE;
908  p->l4.hdrs.greh = (GREHdr *)buf;
909  return p->l4.hdrs.greh;
910 }
911 
912 static inline const GREHdr *PacketGetGRE(const Packet *p)
913 {
915  return p->l4.hdrs.greh;
916 }
917 
918 static inline bool PacketIsGRE(const Packet *p)
919 {
920  return p->l4.type == PACKET_L4_GRE;
921 }
922 
923 static inline ESPHdr *PacketSetESP(Packet *p, const uint8_t *buf)
924 {
926  p->l4.type = PACKET_L4_ESP;
927  p->l4.hdrs.esph = (ESPHdr *)buf;
928  return p->l4.hdrs.esph;
929 }
930 
931 static inline const ESPHdr *PacketGetESP(const Packet *p)
932 {
934  return p->l4.hdrs.esph;
935 }
936 
937 static inline bool PacketIsESP(const Packet *p)
938 {
939  return p->l4.type == PACKET_L4_ESP;
940 }
941 
942 static inline const ARPHdr *PacketGetARP(const Packet *p)
943 {
945  return p->l3.hdrs.arph;
946 }
947 
948 static inline ARPHdr *PacketSetARP(Packet *p, const uint8_t *buf)
949 {
951  p->l3.type = PACKET_L3_ARP;
952  p->l3.hdrs.arph = (ARPHdr *)buf;
953  return p->l3.hdrs.arph;
954 }
955 
956 static inline bool PacketIsARP(const Packet *p)
957 {
958  return p->l3.type == PACKET_L3_ARP;
959 }
960 
961 /** \brief Structure to hold thread specific data for all decode modules */
962 typedef struct DecodeThreadVars_
963 {
964  /** Specific context for udp protocol detection (here atm) */
966 
967  /** stats/counters */
968  uint16_t counter_pkts;
969  uint16_t counter_bytes;
974 
975  uint16_t counter_invalid;
976 
977  uint16_t counter_eth;
978  uint16_t counter_chdlc;
979  uint16_t counter_ipv4;
980  uint16_t counter_ipv6;
981  uint16_t counter_tcp;
982  uint16_t counter_tcp_syn;
984  uint16_t counter_tcp_rst;
985  uint16_t counter_tcp_urg;
986  uint16_t counter_udp;
987  uint16_t counter_icmpv4;
988  uint16_t counter_icmpv6;
989  uint16_t counter_arp;
991 
992  uint16_t counter_sll;
993  uint16_t counter_sll2;
994  uint16_t counter_raw;
995  uint16_t counter_null;
996  uint16_t counter_sctp;
997  uint16_t counter_esp;
998  uint16_t counter_ppp;
999  uint16_t counter_geneve;
1000  uint16_t counter_gre;
1001  uint16_t counter_vlan;
1004  uint16_t counter_vxlan;
1005  uint16_t counter_vntag;
1007  uint16_t counter_pppoe;
1008  uint16_t counter_teredo;
1009  uint16_t counter_mpls;
1012  uint16_t counter_erspan;
1013  uint16_t counter_nsh;
1014 
1015  /** frag stats - defrag runs in the context of the decoder. */
1026 
1029 
1044 
1049 
1051 
1052  /* thread data for flow logging api: only used at forced
1053  * flow recycle during lookups */
1055 
1057 
1058 void CaptureStatsUpdate(ThreadVars *tv, const Packet *p);
1060 
1061 #define PACKET_CLEAR_L4VARS(p) do { \
1062  memset(&(p)->l4vars, 0x00, sizeof((p)->l4vars)); \
1063  } while (0)
1064 
1065 /* if p uses extended data, free them */
1066 #define PACKET_FREE_EXTDATA(p) do { \
1067  if ((p)->ext_pkt) { \
1068  if (!((p)->flags & PKT_ZERO_COPY)) { \
1069  SCFree((p)->ext_pkt); \
1070  } \
1071  (p)->ext_pkt = NULL; \
1072  } \
1073  } while(0)
1074 
1075 #define TUNNEL_INCR_PKT_RTV_NOLOCK(p) do { \
1076  ((p)->root ? (p)->root->tunnel_rtv_cnt++ : (p)->tunnel_rtv_cnt++); \
1077  } while (0)
1078 
1079 static inline void TUNNEL_INCR_PKT_TPR(Packet *p)
1080 {
1081  Packet *rp = p->root ? p->root : p;
1083  rp->tunnel_tpr_cnt++;
1085 }
1086 
1087 #define TUNNEL_PKT_RTV(p) ((p)->root ? (p)->root->tunnel_rtv_cnt : (p)->tunnel_rtv_cnt)
1088 #define TUNNEL_PKT_TPR(p) ((p)->root ? (p)->root->tunnel_tpr_cnt : (p)->tunnel_tpr_cnt)
1090 static inline bool PacketTunnelIsVerdicted(const Packet *p)
1091 {
1092  return p->tunnel_verdicted;
1093 }
1094 static inline void PacketTunnelSetVerdicted(Packet *p)
1095 {
1096  p->tunnel_verdicted = true;
1097 }
1098 
1106  DECODE_TUNNEL_IPV6_TEREDO, /**< separate protocol for stricter error handling */
1111 };
1112 
1114  const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto);
1115 Packet *PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto);
1116 void PacketDefragPktSetupParent(Packet *parent);
1119 Packet *PacketGetFromAlloc(void);
1122  DecodeThreadVars *dtv, Packet *p);
1123 void PacketFree(Packet *p);
1124 void PacketFreeOrRelease(Packet *p);
1125 int PacketCallocExtPkt(Packet *p, int datalen);
1126 int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen);
1127 int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen);
1128 int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen);
1129 const char *PktSrcToString(enum PktSrcEnum pkt_src);
1130 void PacketBypassCallback(Packet *p);
1131 void PacketSwap(Packet *p);
1132 
1136  const DecodeThreadVars *dtv, const Packet *p);
1137 const char *PacketDropReasonToString(enum PacketDropReason r);
1138 
1139 /* decoder functions */
1140 int DecodeEthernet(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1141 int DecodeSll(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1142 int DecodeSll2(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1143 int DecodePPP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1144 int DecodePPPOESession(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1145 int DecodePPPOEDiscovery(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1146 int DecodeNull(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1147 int DecodeRaw(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1148 int DecodeIPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
1149 int DecodeIPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
1150 int DecodeICMPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1151 int DecodeICMPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1152 int DecodeTCP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
1153 int DecodeUDP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
1154 int DecodeSCTP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
1155 int DecodeESP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t);
1156 int DecodeGRE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1157 int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1158 int DecodeVNTag(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1159 int DecodeIEEE8021ah(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1160 int DecodeGeneve(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1161 int DecodeVXLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1162 int DecodeMPLS(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1163 int DecodeERSPAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1164 int DecodeERSPANTypeI(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1165 int DecodeCHDLC(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1166 int DecodeTEMPLATE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1167 int DecodeNSH(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1168 int DecodeARP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
1169 
1170 #ifdef UNITTESTS
1171 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
1172  uint16_t hdrextlen, uint16_t plen,
1173  uint16_t prev_hdrextlen);
1174 #endif
1175 
1176 void AddressDebugPrint(Address *);
1177 
1179  const uint8_t *pkt, uint32_t len);
1180 void DecodeGlobalConfig(void);
1181 void PacketAlertGetMaxConfig(void);
1182 void DecodeUnregisterCounters(void);
1183 
1184 #define ENGINE_SET_EVENT(p, e) do { \
1185  SCLogDebug("p %p event %d", (p), e); \
1186  if ((p)->events.cnt < PACKET_ENGINE_EVENT_MAX) { \
1187  (p)->events.events[(p)->events.cnt] = e; \
1188  (p)->events.cnt++; \
1189  } \
1190 } while(0)
1191 
1192 #define ENGINE_SET_INVALID_EVENT(p, e) do { \
1193  p->flags |= PKT_IS_INVALID; \
1194  ENGINE_SET_EVENT(p, e); \
1195 } while(0)
1196 
1197 #define ENGINE_ISSET_EVENT(p, e) ({ \
1198  int r = 0; \
1199  uint8_t u; \
1200  for (u = 0; u < (p)->events.cnt; u++) { \
1201  if ((p)->events.events[u] == (e)) { \
1202  r = 1; \
1203  break; \
1204  } \
1205  } \
1206  r; \
1207 })
1208 
1209 #ifndef IPPROTO_IPIP
1210 #define IPPROTO_IPIP 4
1211 #endif
1212 
1213 /* older libcs don't contain a def for IPPROTO_DCCP
1214  * inside of <netinet/in.h>
1215  * if it isn't defined let's define it here.
1216  */
1217 #ifndef IPPROTO_DCCP
1218 #define IPPROTO_DCCP 33
1219 #endif
1220 
1221 /* older libcs don't contain a def for IPPROTO_SCTP
1222  * inside of <netinet/in.h>
1223  * if it isn't defined let's define it here.
1224  */
1225 #ifndef IPPROTO_SCTP
1226 #define IPPROTO_SCTP 132
1227 #endif
1228 
1229 #ifndef IPPROTO_MH
1230 #define IPPROTO_MH 135
1231 #endif
1232 
1233 /* Host Identity Protocol (rfc 5201) */
1234 #ifndef IPPROTO_HIP
1235 #define IPPROTO_HIP 139
1236 #endif
1237 
1238 #ifndef IPPROTO_SHIM6
1239 #define IPPROTO_SHIM6 140
1240 #endif
1241 
1242 /* Packet Flags */
1243 
1244 /** Flag to indicate that packet header or contents should not be inspected */
1245 #define PKT_NOPACKET_INSPECTION BIT_U32(0)
1246 /** Packet has a PPP_VJ_UCOMP header */
1247 #define PKT_PPP_VJ_UCOMP BIT_U32(1)
1249 /** Flag to indicate that packet contents should not be inspected */
1250 #define PKT_NOPAYLOAD_INSPECTION BIT_U32(2)
1252 /** set if PacketAlerts may contain json context data */
1253 #define PKT_ALERT_CTX_USED BIT_U32(3)
1255 /** Packet has matched a tag */
1256 #define PKT_HAS_TAG BIT_U32(4)
1257 /** Packet payload was added to reassembled stream */
1258 #define PKT_STREAM_ADD BIT_U32(5)
1259 /** Packet is part of established stream */
1260 #define PKT_STREAM_EST BIT_U32(6)
1262 // vacancy
1263 
1264 #define PKT_HAS_FLOW BIT_U32(8)
1265 /** Pseudo packet to end the stream */
1266 #define PKT_PSEUDO_STREAM_END BIT_U32(9)
1267 /** Packet is modified by the stream engine, we need to recalc the csum and \
1268  reinject/replace */
1269 #define PKT_STREAM_MODIFIED BIT_U32(10)
1271 // vacancy
1272 
1273 /** Exclude packet from pcap logging as it's part of a stream that has reassembly \
1274  depth reached. */
1275 #define PKT_STREAM_NOPCAPLOG BIT_U32(12)
1277 // vacancy 2x
1278 
1279 /** Packet checksum is not computed (TX packet for example) */
1280 #define PKT_IGNORE_CHECKSUM BIT_U32(15)
1281 /** Packet comes from zero copy (ext_pkt must not be freed) */
1282 #define PKT_ZERO_COPY BIT_U32(16)
1284 #define PKT_HOST_SRC_LOOKED_UP BIT_U32(17)
1285 #define PKT_HOST_DST_LOOKED_UP BIT_U32(18)
1287 /** Packet is a fragment */
1288 #define PKT_IS_FRAGMENT BIT_U32(19)
1289 #define PKT_IS_INVALID BIT_U32(20)
1290 #define PKT_PROFILE BIT_U32(21)
1292 /** indication by decoder that it feels the packet should be handled by
1293  * flow engine: Packet::flow_hash will be set */
1294 #define PKT_WANTS_FLOW BIT_U32(22)
1296 /** protocol detection done */
1297 #define PKT_PROTO_DETECT_TS_DONE BIT_U32(23)
1298 #define PKT_PROTO_DETECT_TC_DONE BIT_U32(24)
1300 #define PKT_REBUILT_FRAGMENT \
1301  BIT_U32(25) /**< Packet is rebuilt from \
1302  * fragments. */
1303 #define PKT_DETECT_HAS_STREAMDATA \
1304  BIT_U32(26) /**< Set by Detect() if raw stream data is available. */
1306 #define PKT_PSEUDO_DETECTLOG_FLUSH BIT_U32(27) /**< Detect/log flush for protocol upgrade */
1308 /** Packet is part of stream in known bad condition (loss, wrong thread),
1309  * so flag it for not setting stream events */
1310 #define PKT_STREAM_NO_EVENTS BIT_U32(28)
1312 /** We had no alert on flow before this packet */
1313 #define PKT_FIRST_ALERTS BIT_U32(29)
1314 #define PKT_FIRST_TAG BIT_U32(30)
1316 #define PKT_PSEUDO_LOG_FLUSH BIT_U32(31) /**< Detect/log flush for protocol upgrade */
1318 /** \brief return 1 if the packet is a pseudo packet */
1319 #define PKT_IS_PSEUDOPKT(p) \
1320  ((p)->flags & (PKT_PSEUDO_STREAM_END|PKT_PSEUDO_DETECTLOG_FLUSH))
1321 #define PKT_IS_FLUSHPKT(p) ((p)->flags & (PKT_PSEUDO_LOG_FLUSH))
1323 #define PKT_SET_SRC(p, src_val) ((p)->pkt_src = src_val)
1325 #define PKT_DEFAULT_MAX_DECODED_LAYERS 16
1326 extern uint8_t decoder_max_layers;
1327 
1328 static inline bool PacketIncreaseCheckLayers(Packet *p)
1329 {
1330  p->nb_decoded_layers++;
1333  return false;
1334  }
1335  return true;
1336 }
1337 
1338 /** \brief Set the No payload inspection Flag for the packet.
1339  *
1340  * \param p Packet to set the flag in
1341  */
1342 static inline void DecodeSetNoPayloadInspectionFlag(Packet *p)
1343 {
1345 }
1346 
1347 /** \brief Set the No packet inspection Flag for the packet.
1348  *
1349  * \param p Packet to set the flag in
1350  */
1351 static inline void DecodeSetNoPacketInspectionFlag(Packet *p)
1352 {
1354 }
1355 
1356 static inline bool PacketIsTunnelRoot(const Packet *p)
1357 {
1358  return (p->ttype == PacketTunnelRoot);
1359 }
1360 
1361 static inline bool PacketIsTunnelChild(const Packet *p)
1362 {
1363  return (p->ttype == PacketTunnelChild);
1364 }
1365 
1366 static inline bool PacketIsTunnel(const Packet *p)
1367 {
1368  return (p->ttype != PacketTunnelNone);
1369 }
1370 
1371 static inline bool PacketIsNotTunnel(const Packet *p)
1372 {
1373  return (p->ttype == PacketTunnelNone);
1374 }
1375 
1376 static inline bool VerdictTunnelPacketInternal(const Packet *p)
1377 {
1378  const uint16_t outstanding = TUNNEL_PKT_TPR(p) - TUNNEL_PKT_RTV(p);
1379  SCLogDebug("tunnel: outstanding %u", outstanding);
1380 
1381  /* if there are packets outstanding, we won't verdict this one */
1382  if (PacketIsTunnelRoot(p) && !PacketTunnelIsVerdicted(p) && !outstanding) {
1383  SCLogDebug("root %p: verdict", p);
1384  return true;
1385 
1386  } else if (PacketIsTunnelChild(p) && outstanding == 1 && p->root &&
1387  PacketTunnelIsVerdicted(p->root)) {
1388  SCLogDebug("tunnel %p: verdict", p);
1389  return true;
1390 
1391  } else {
1392  return false;
1393  }
1394 }
1395 
1396 /** \brief return true if *this* packet needs to trigger a verdict.
1397  *
1398  * If we have the root packet, and we have none outstanding,
1399  * we can verdict now.
1400  *
1401  * If we have a upper layer packet, it's the only one and root
1402  * is already processed, we can verdict now.
1403  *
1404  * Otherwise, a future packet will issue the verdict.
1405  */
1406 static inline bool VerdictTunnelPacket(Packet *p)
1407 {
1408  bool verdict;
1410  SCSpinLock(lock);
1411  verdict = VerdictTunnelPacketInternal(p);
1412  SCSpinUnlock(lock);
1413  return verdict;
1414 }
1415 
1416 static inline void DecodeLinkLayer(ThreadVars *tv, DecodeThreadVars *dtv,
1417  const int datalink, Packet *p, const uint8_t *data, const uint32_t len)
1418 {
1419  /* call the decoder */
1420  switch (datalink) {
1421  case LINKTYPE_ETHERNET:
1422  DecodeEthernet(tv, dtv, p, data, len);
1423  break;
1424  case LINKTYPE_LINUX_SLL:
1425  DecodeSll(tv, dtv, p, data, len);
1426  break;
1427  case LINKTYPE_LINUX_SLL2:
1428  DecodeSll2(tv, dtv, p, data, len);
1429  break;
1430  case LINKTYPE_PPP:
1431  DecodePPP(tv, dtv, p, data, len);
1432  break;
1433  case LINKTYPE_RAW:
1434  case LINKTYPE_GRE_OVER_IP:
1435  DecodeRaw(tv, dtv, p, data, len);
1436  break;
1437  case LINKTYPE_NULL:
1438  DecodeNull(tv, dtv, p, data, len);
1439  break;
1440  case LINKTYPE_CISCO_HDLC:
1441  DecodeCHDLC(tv, dtv, p, data, len);
1442  break;
1443  default:
1444  SCLogError("datalink type "
1445  "%" PRId32 " not yet supported",
1446  datalink);
1447  break;
1448  }
1449 }
1450 
1451 /** \brief decode network layer
1452  * \retval bool true if successful, false if unknown */
1453 static inline bool DecodeNetworkLayer(ThreadVars *tv, DecodeThreadVars *dtv,
1454  const uint16_t proto, Packet *p, const uint8_t *data, const uint32_t len)
1455 {
1456  switch (proto) {
1457  case ETHERNET_TYPE_IP: {
1458  uint16_t ip_len = (len < USHRT_MAX) ? (uint16_t)len : (uint16_t)USHRT_MAX;
1459  DecodeIPV4(tv, dtv, p, data, ip_len);
1460  break;
1461  }
1462  case ETHERNET_TYPE_IPV6: {
1463  uint16_t ip_len = (len < USHRT_MAX) ? (uint16_t)len : (uint16_t)USHRT_MAX;
1464  DecodeIPV6(tv, dtv, p, data, ip_len);
1465  break;
1466  }
1468  DecodePPPOESession(tv, dtv, p, data, len);
1469  break;
1471  DecodePPPOEDiscovery(tv, dtv, p, data, len);
1472  break;
1473  case ETHERNET_TYPE_VLAN:
1474  case ETHERNET_TYPE_8021AD:
1476  if (p->vlan_idx > VLAN_MAX_LAYER_IDX) {
1478  } else {
1479  DecodeVLAN(tv, dtv, p, data, len);
1480  }
1481  break;
1482  case ETHERNET_TYPE_8021AH:
1483  DecodeIEEE8021ah(tv, dtv, p, data, len);
1484  break;
1485  case ETHERNET_TYPE_ARP:
1486  DecodeARP(tv, dtv, p, data, len);
1487  break;
1490  DecodeMPLS(tv, dtv, p, data, len);
1491  break;
1492  case ETHERNET_TYPE_DCE:
1495  } else {
1496  // DCE layer is ethernet + 2 bytes, followed by another ethernet
1497  DecodeEthernet(tv, dtv, p, data + 2, len - 2);
1498  }
1499  break;
1500  case ETHERNET_TYPE_VNTAG:
1501  DecodeVNTag(tv, dtv, p, data, len);
1502  break;
1503  case ETHERNET_TYPE_NSH:
1504  DecodeNSH(tv, dtv, p, data, len);
1505  break;
1506  default:
1507  SCLogDebug("unknown ether type: %" PRIx16 "", proto);
1510  return false;
1511  }
1512  return true;
1513 }
1514 
1515 #endif /* SURICATA_DECODE_H */
PacketL4::csum_set
bool csum_set
Definition: decode.h:466
PACKET_L4_GRE
@ PACKET_L4_GRE
Definition: decode.h:460
suricata-plugin.h
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:1184
DecodeThreadVars_::counter_flow_get_used_eval_busy
uint16_t counter_flow_get_used_eval_busy
Definition: decode.h:1042
PKT_DROP_REASON_DEFRAG_MEMCAP
@ PKT_DROP_REASON_DEFRAG_MEMCAP
Definition: decode.h:384
PKT_DROP_REASON_DEFRAG_ERROR
@ PKT_DROP_REASON_DEFRAG_ERROR
Definition: decode.h:383
decode-ethernet.h
PacketL3::ip6
struct PacketL3::@31::@32 ip6
decode-tcp.h
PKT_DROP_REASON_STREAM_PRE_HOOK
@ PKT_DROP_REASON_STREAM_PRE_HOOK
Definition: decode.h:400
DecodeThreadVars_::counter_defrag_ipv4_reassembled
uint16_t counter_defrag_ipv4_reassembled
Definition: decode.h:1017
Packet_::proto
uint8_t proto
Definition: decode.h:523
spin_lock_cnt
thread_local uint64_t spin_lock_cnt
PKT_DROP_REASON_RULES_THRESHOLD
@ PKT_DROP_REASON_RULES_THRESHOLD
Definition: decode.h:390
DecodeIPV6
int DecodeIPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-ipv6.c:560
DecodeERSPAN
int DecodeERSPAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
ERSPAN Type II.
Definition: decode-erspan.c:76
DecodeGeneve
int DecodeGeneve(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-geneve.c:185
source-nflog.h
DecodeThreadVars_::counter_ethertype_unknown
uint16_t counter_ethertype_unknown
Definition: decode.h:990
decode-mpls.h
DecodeThreadVars_::counter_flow_udp
uint16_t counter_flow_udp
Definition: decode.h:1034
len
uint8_t len
Definition: app-layer-dnp3.h:2
DecodeThreadVars_::counter_bytes
uint16_t counter_bytes
Definition: decode.h:969
VLAN_HEADER_TOO_MANY_LAYERS
@ VLAN_HEADER_TOO_MANY_LAYERS
Definition: decode-events.h:154
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:1105
source-pcap.h
PktProfilingData_::ticks_end
uint64_t ticks_end
Definition: decode.h:346
PacketAlert_::s
const struct Signature_ * s
Definition: decode.h:252
DecodeThreadVars_::counter_eth
uint16_t counter_eth
Definition: decode.h:977
IPV4Vars_
Definition: decode-ipv4.h:130
DecodeThreadVars_::counter_flow_active
uint16_t counter_flow_active
Definition: decode.h:1032
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:166
CHECKSUM_VALIDATION_OFFLOAD
@ CHECKSUM_VALIDATION_OFFLOAD
Definition: decode.h:48
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
Packet_::code
uint8_t code
Definition: decode.h:512
PacketFreeOrRelease
void PacketFreeOrRelease(Packet *p)
Return a packet to where it was allocated.
Definition: decode.c:276
IPV4_GET_RAW_IPPROTO
#define IPV4_GET_RAW_IPPROTO(ip4h)
Definition: decode-ipv4.h:103
PacketL4Types
PacketL4Types
Definition: decode.h:453
PLUGIN_VAR_SIZE
#define PLUGIN_VAR_SIZE
Definition: suricata-plugin.h:31
DecodeThreadVars_::counter_flow_icmp4
uint16_t counter_flow_icmp4
Definition: decode.h:1035
DecodeThreadVars_::counter_vxlan
uint16_t counter_vxlan
Definition: decode.h:1004
DecodeThreadVars_::counter_max_pkt_size
uint16_t counter_max_pkt_size
Definition: decode.h:971
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:377
PacketBypassCallback
void PacketBypassCallback(Packet *p)
Definition: decode.c:530
DecodeSCTP
int DecodeSCTP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-sctp.c:62
ICMPV4Vars_
Definition: decode-icmpv4.h:183
DecodeThreadVars_::counter_avg_pkt_size
uint16_t counter_avg_pkt_size
Definition: decode.h:970
PktProfiling_
Per pkt stats storage.
Definition: decode.h:366
Address_::address_un_data16
uint16_t address_un_data16[8]
Definition: decode.h:116
DecodePPP
int DecodePPP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-ppp.c:174
DecodeARP
int DecodeARP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-arp.c:29
Address_::address_un_in6
struct in6_addr address_un_in6
Definition: decode.h:118
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
PacketL3
Definition: decode.h:433
PKT_DROP_REASON_STREAM_MEMCAP
@ PKT_DROP_REASON_STREAM_MEMCAP
Definition: decode.h:392
PktProfilingTmmData_
Per TMM stats storage.
Definition: decode.h:325
IPV6ExtHdrs_
Definition: decode-ipv6.h:150
PktPool_
Definition: tmqh-packetpool.h:43
Packet_::host_src
struct Host_ * host_src
Definition: decode.h:622
PKT_DROP_REASON_FLOW_MEMCAP
@ PKT_DROP_REASON_FLOW_MEMCAP
Definition: decode.h:385
PACKET_L2_ETHERNET
@ PACKET_L2_ETHERNET
Definition: decode.h:416
CaptureStatsSetup
void CaptureStatsSetup(ThreadVars *tv)
Definition: decode.c:1032
PacketDropReasonToString
const char * PacketDropReasonToString(enum PacketDropReason r)
Definition: decode.c:901
PacketEngineEvents_::events
uint8_t events[PACKET_ENGINE_EVENT_MAX]
Definition: decode.h:308
DECODE_TUNNEL_IPV6_TEREDO
@ DECODE_TUNNEL_IPV6_TEREDO
Definition: decode.h:1106
PacketL4::csum
uint16_t csum
Definition: decode.h:467
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:275
PACKET_L4_UNKNOWN
@ PACKET_L4_UNKNOWN
Definition: decode.h:454
PKT_SRC_SHUTDOWN_FLUSH
@ PKT_SRC_SHUTDOWN_FLUSH
Definition: decode.h:64
DecodeEthernet
int DecodeEthernet(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-ethernet.c:42
rwr_lock_cnt
thread_local uint64_t rwr_lock_cnt
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:626
PktProfiling_::ticks_end
uint64_t ticks_end
Definition: decode.h:368
TCPVars_
Definition: decode-tcp.h:162
AddressDebugPrint
void AddressDebugPrint(Address *)
Debug print function for printing addresses.
Definition: decode.c:785
PKT_SRC_DECODER_IPV4
@ PKT_SRC_DECODER_IPV4
Definition: decode.h:54
DecodeThreadVars_::counter_flow_spare_sync_avg
uint16_t counter_flow_spare_sync_avg
Definition: decode.h:1048
PacketDefragPktSetup
Packet * PacketDefragPktSetup(Packet *parent, const uint8_t *pkt, uint32_t len, uint8_t proto)
Setup a pseudo packet (reassembled frags)
Definition: decode.c:473
PacketQueue_
simple fifo queue for packets with mutex and cond Calling the mutex or triggering the cond is respons...
Definition: packet-queue.h:49
Packet_::payload
uint8_t * payload
Definition: decode.h:605
PacketAlerts_::cnt
uint16_t cnt
Definition: decode.h:287
ETHERNET_TYPE_IPV6
#define ETHERNET_TYPE_IPV6
Definition: decode-ethernet.h:39
PKT_SRC_CAPTURE_TIMEOUT
@ PKT_SRC_CAPTURE_TIMEOUT
Definition: decode.h:62
DecodeUDP
int DecodeUDP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-udp.c:75
Packet_::flags
uint32_t flags
Definition: decode.h:544
decode-udp.h
Packet_::action
uint8_t action
Definition: decode.h:609
PacketAlertCreate
PacketAlert * PacketAlertCreate(void)
Initialize PacketAlerts with dynamic alerts array size.
Definition: decode.c:140
PktProfilingDetectData
struct PktProfilingDetectData_ PktProfilingDetectData
DecodeThreadVars_::counter_vntag
uint16_t counter_vntag
Definition: decode.h:1005
PacketL4::L4Hdrs::udph
UDPHdr * udph
Definition: decode.h:470
Packet_::vlan_idx
uint8_t vlan_idx
Definition: decode.h:529
Flow_
Flow data structure.
Definition: flow.h:356
Packet_::tunnel_verdicted
bool tunnel_verdicted
Definition: decode.h:650
DecodeThreadVars_::counter_flow_get_used_eval
uint16_t counter_flow_get_used_eval
Definition: decode.h:1040
PacketL4::L4Hdrs::greh
GREHdr * greh
Definition: decode.h:474
LiveDevice_
Definition: util-device-private.h:32
PROF_DETECT_SIZE
@ PROF_DETECT_SIZE
Definition: suricata-common.h:473
PktVar_::next
struct PktVar_ * next
Definition: decode.h:313
DecoderFunc
int(* DecoderFunc)(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode.h:1178
PktProfilingTmmData_::ticks_end
uint64_t ticks_end
Definition: decode.h:327
Packet_::ipfw_v
IPFWPacketVars ipfw_v
Definition: decode.h:566
PKT_DROP_REASON_FLOW_PRE_HOOK
@ PKT_DROP_REASON_FLOW_PRE_HOOK
Definition: decode.h:401
Packet_::pool
struct PktPool_ * pool
Definition: decode.h:670
DecodeThreadVars_::counter_tcp_synack
uint16_t counter_tcp_synack
Definition: decode.h:983
CHECKSUM_VALIDATION_RXONLY
@ CHECKSUM_VALIDATION_RXONLY
Definition: decode.h:46
PktProfiling_::app
PktProfilingAppData app[]
Definition: decode.h:375
PACKET_L3_IPV4
@ PACKET_L3_IPV4
Definition: decode.h:428
PKT_DROP_REASON_MAX
@ PKT_DROP_REASON_MAX
Definition: decode.h:402
PKT_DROP_REASON_STREAM_REASSEMBLY
@ PKT_DROP_REASON_STREAM_REASSEMBLY
Definition: decode.h:394
DECODE_TUNNEL_ERSPANI
@ DECODE_TUNNEL_ERSPANI
Definition: decode.h:1102
PacketAlerts_::alerts
PacketAlert * alerts
Definition: decode.h:290
PktProfilingTmmData
struct PktProfilingTmmData_ PktProfilingTmmData
Per TMM stats storage.
DecodeThreadVars_::counter_teredo
uint16_t counter_teredo
Definition: decode.h:1008
DecodeThreadVars_::counter_erspan
uint16_t counter_erspan
Definition: decode.h:1012
PacketCopyDataOffset
int PacketCopyDataOffset(Packet *p, uint32_t offset, const uint8_t *data, uint32_t datalen)
Copy data to Packet payload at given offset.
Definition: decode.c:335
DecodeVXLAN
int DecodeVXLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-vxlan.c:122
util-exception-policy-types.h
PacketL3::hdrs
union PacketL3::Hdrs hdrs
DecodeThreadVars_::counter_raw
uint16_t counter_raw
Definition: decode.h:994
DecodeThreadVars
struct DecodeThreadVars_ DecodeThreadVars
Structure to hold thread specific data for all decode modules.
PacketL2::type
enum PacketL2Types type
Definition: decode.h:420
Packet_::sig_mask
SignatureMask sig_mask
Definition: decode.h:538
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:75
SCSpinLock
#define SCSpinLock
Definition: threads-debug.h:235
Packet_::persistent
struct Packet_::@39 persistent
PacketAlerts_::drop
PacketAlert drop
Definition: decode.h:293
DecodeVNTag
int DecodeVNTag(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-vntag.c:52
Address_
Definition: decode.h:112
PacketL3::Hdrs
Definition: decode.h:438
CHECKSUM_VALIDATION_DISABLE
@ CHECKSUM_VALIDATION_DISABLE
Definition: decode.h:43
DecodeThreadVars_::counter_arp
uint16_t counter_arp
Definition: decode.h:989
DecodeThreadVars_::counter_flow_tcp
uint16_t counter_flow_tcp
Definition: decode.h:1033
PacketL3::Hdrs::arph
ARPHdr * arph
Definition: decode.h:441
CHECKSUM_VALIDATION_KERNEL
@ CHECKSUM_VALIDATION_KERNEL
Definition: decode.h:47
PacketDecodeFinalize
void PacketDecodeFinalize(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Finalize decoding of a packet.
Definition: decode.c:232
Address_::address_un_data32
uint32_t address_un_data32[4]
Definition: decode.h:115
proto
uint8_t proto
Definition: decode-template.h:0
PKT_NOPAYLOAD_INSPECTION
#define PKT_NOPAYLOAD_INSPECTION
Definition: decode.h:1250
PacketAlertGetMaxConfig
void PacketAlertGetMaxConfig(void)
Definition: decode.c:1065
DecodeICMPV6
int DecodeICMPV6(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:177
PktProfilingDetectData_::ticks_end
uint64_t ticks_end
Definition: decode.h:351
decoder_max_layers
uint8_t decoder_max_layers
Definition: decode.c:81
Packet_::icmp_s
struct Packet_::@33::@40 icmp_s
DecodeThreadVars_::counter_tcp_active_sessions
uint16_t counter_tcp_active_sessions
Definition: decode.h:1030
PacketAlert
struct PacketAlert_ PacketAlert
Packet_::host_dst
struct Host_ * host_dst
Definition: decode.h:623
PktProfilingLoggerData
struct PktProfilingLoggerData_ PktProfilingLoggerData
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:532
PacketL3::Hdrs::ip4h
IPV4Hdr * ip4h
Definition: decode.h:439
Packet_::BypassPacketsFlow
int(* BypassPacketsFlow)(struct Packet_ *)
Definition: decode.h:594
PacketDropReason
PacketDropReason
Definition: decode.h:380
DecodeThreadVars_::counter_max_mac_addrs_src
uint16_t counter_max_mac_addrs_src
Definition: decode.h:972
PktProfiling_::ticks_start
uint64_t ticks_start
Definition: decode.h:367
DecodeUnregisterCounters
void DecodeUnregisterCounters(void)
Definition: decode.c:602
rww_lock_contention
thread_local uint64_t rww_lock_contention
PACKET_L2_UNKNOWN
@ PACKET_L2_UNKNOWN
Definition: decode.h:415
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:606
DecodeThreadVars_::counter_flow_get_used
uint16_t counter_flow_get_used
Definition: decode.h:1039
Packet_::alerts
PacketAlerts alerts
Definition: decode.h:620
Packet_::tunnel_tpr_cnt
uint16_t tunnel_tpr_cnt
Definition: decode.h:662
PacketTunnelChild
@ PacketTunnelChild
Definition: decode.h:408
AppLayerDecoderEvents_
Data structure to store app layer decoder events.
Definition: app-layer-events.h:36
Packet_::app_layer_events
AppLayerDecoderEvents * app_layer_events
Definition: decode.h:632
Packet_::events
PacketEngineEvents events
Definition: decode.h:630
PacketAlertFree
void PacketAlertFree(PacketAlert *pa)
Definition: decode.c:165
PacketL4::L4Hdrs
Definition: decode.h:468
PacketL2::L2Hdrs
Definition: decode.h:421
ETHERNET_TYPE_8021QINQ
#define ETHERNET_TYPE_8021QINQ
Definition: decode-ethernet.h:47
PacketTunnelType
PacketTunnelType
Definition: decode.h:405
DecodeThreadVars_::counter_sll2
uint16_t counter_sll2
Definition: decode.h:993
DecodeThreadVars_::counter_flow_spare_sync_empty
uint16_t counter_flow_spare_sync_empty
Definition: decode.h:1046
PktProfilingAppData_::ticks_spent
uint64_t ticks_spent
Definition: decode.h:356
ICMPV4Vars_::emb_ip4h_offset
uint16_t emb_ip4h_offset
Definition: decode-icmpv4.h:184
DecodeThreadVars_::counter_flow_tcp_reuse
uint16_t counter_flow_tcp_reuse
Definition: decode.h:1037
DecodeRaw
int DecodeRaw(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-raw.c:42
PacketAlert_::tx_id
uint64_t tx_id
Definition: decode.h:253
PKT_DROP_REASON_STREAM_URG
@ PKT_DROP_REASON_STREAM_URG
Definition: decode.h:395
rwr_lock_contention
thread_local uint64_t rwr_lock_contention
DECODE_TUNNEL_NSH
@ DECODE_TUNNEL_NSH
Definition: decode.h:1108
DecodeThreadVars_::counter_flow_total
uint16_t counter_flow_total
Definition: decode.h:1031
PacketAlert_::action
uint8_t action
Definition: decode.h:250
PacketL2Types
PacketL2Types
Definition: decode.h:414
PacketL3::Hdrs::ip6h
IPV6Hdr * ip6h
Definition: decode.h:440
Packet_::datalink
int datalink
Definition: decode.h:639
Packet_::profile
PktProfiling * profile
Definition: decode.h:673
PACKET_L3_UNKNOWN
@ PACKET_L3_UNKNOWN
Definition: decode.h:427
spin_lock_wait_ticks
thread_local uint64_t spin_lock_wait_ticks
CHECKSUM_VALIDATION_ENABLE
@ CHECKSUM_VALIDATION_ENABLE
Definition: decode.h:44
lock
HRLOCK_TYPE lock
Definition: host.h:0
decode-gre.h
DecodeRegisterPerfCounters
void DecodeRegisterPerfCounters(DecodeThreadVars *, ThreadVars *)
Definition: decode.c:628
DecodeThreadVars_::counter_flow_spare_sync
uint16_t counter_flow_spare_sync
Definition: decode.h:1045
DECODE_TUNNEL_ERSPANII
@ DECODE_TUNNEL_ERSPANII
Definition: decode.h:1101
DecodeThreadVars_::counter_defrag_tracker_timeout
uint16_t counter_defrag_tracker_timeout
Definition: decode.h:1024
CHECKSUM_VALIDATION_AUTO
@ CHECKSUM_VALIDATION_AUTO
Definition: decode.h:45
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:1011
Packet_::pktlen
uint32_t pktlen
Definition: decode.h:614
decode-ipv6.h
PACKET_L4_TCP
@ PACKET_L4_TCP
Definition: decode.h:455
PacketAlert_::json_info
struct PacketContextData * json_info
Definition: decode.h:255
PKT_DROP_REASON_DEFAULT_APP_POLICY
@ PKT_DROP_REASON_DEFAULT_APP_POLICY
Definition: decode.h:399
PACKET_L4_SCTP
@ PACKET_L4_SCTP
Definition: decode.h:459
TUNNEL_PKT_TPR
#define TUNNEL_PKT_TPR(p)
Definition: decode.h:1088
util-debug.h
DecodeThreadVars_::counter_flow_get_used_failed
uint16_t counter_flow_get_used_failed
Definition: decode.h:1043
PKT_SRC_WIRE
@ PKT_SRC_WIRE
Definition: decode.h:52
source-nfq.h
Packet_::pktvar
PktVar * pktvar
Definition: decode.h:597
ExceptionPolicyCounters_
Definition: util-exception-policy-types.h:51
DPDKPacketVars_
per packet DPDK vars
Definition: source-dpdk.h:94
DecodeThreadVars_::counter_icmpv4
uint16_t counter_icmpv4
Definition: decode.h:987
DecodeThreadVars_::counter_ppp
uint16_t counter_ppp
Definition: decode.h:998
ETHERNET_TYPE_8021AD
#define ETHERNET_TYPE_8021AD
Definition: decode-ethernet.h:43
PacketL4::L4Vars::icmpv4
ICMPV4Vars icmpv4
Definition: decode.h:479
Packet_::tunnel_lock
SCSpinlock tunnel_lock
Definition: decode.h:683
Packet_::ts
SCTime_t ts
Definition: decode.h:555
PKT_DROP_REASON_APPLAYER_ERROR
@ PKT_DROP_REASON_APPLAYER_ERROR
Definition: decode.h:387
PacketSwap
void PacketSwap(Packet *p)
switch direction of a packet
Definition: decode.c:577
DecodeMPLS
int DecodeMPLS(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-mpls.c:49
DecodeThreadVars_::counter_tcp_rst
uint16_t counter_tcp_rst
Definition: decode.h:984
AppLayerThreadCtx_
This is for the app layer in general and it contains per thread context relevant to both the alpd and...
Definition: app-layer.c:59
PktSrcEnum
PktSrcEnum
Definition: decode.h:51
PKT_DROP_REASON_NOT_SET
@ PKT_DROP_REASON_NOT_SET
Definition: decode.h:381
flow-worker.h
PktVar_::value
uint8_t * value
Definition: decode.h:319
PktProfilingAppData
struct PktProfilingAppData_ PktProfilingAppData
DecodeTunnelProto
DecodeTunnelProto
Definition: decode.h:1099
Packet_::prev
struct Packet_ * prev
Definition: decode.h:636
Packet
struct Packet_ Packet
decode-ppp.h
Packet_::pcap_v
PcapPacketVars pcap_v
Definition: decode.h:587
CaptureStatsUpdate
void CaptureStatsUpdate(ThreadVars *tv, const Packet *p)
Definition: decode.c:1012
PKT_SRC_DECODER_TEREDO
@ PKT_SRC_DECODER_TEREDO
Definition: decode.h:56
DecodeTEMPLATE
int DecodeTEMPLATE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode TEMPLATE packets.
Definition: decode-template.c:51
PacketL4::L4Hdrs::esph
ESPHdr * esph
Definition: decode.h:475
Packet_::tunnel_rtv_cnt
uint16_t tunnel_rtv_cnt
Definition: decode.h:660
DecodeVLAN
int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-vlan.c:54
DecodeESP
int DecodeESP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Function to decode IPSEC-ESP packets.
Definition: decode-esp.c:64
rww_lock_cnt
thread_local uint64_t rww_lock_cnt
DecodeNSH
int DecodeNSH(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode NSH packets.
Definition: decode-nsh.c:46
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
mutex_lock_contention
thread_local uint64_t mutex_lock_contention
spin_lock_contention
thread_local uint64_t spin_lock_contention
PktProfilingData_
Definition: decode.h:344
PacketL4::L4Vars::tcp
TCPVars tcp
Definition: decode.h:478
DECODE_TUNNEL_PPP
@ DECODE_TUNNEL_PPP
Definition: decode.h:1107
Packet_::sp
Port sp
Definition: decode.h:508
DCE_PKT_TOO_SMALL
@ DCE_PKT_TOO_SMALL
Definition: decode-events.h:214
PktProfiling_::logger
PktProfilingLoggerData logger[LOGGER_SIZE]
Definition: decode.h:373
PacketContextData
Definition: decode.h:241
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:219
SCSpinUnlock
#define SCSpinUnlock
Definition: threads-debug.h:237
PktSrcToString
const char * PktSrcToString(enum PktSrcEnum pkt_src)
Definition: decode.c:853
PktVar
struct PktVar_ PktVar
DecodeThreadVars_::counter_vlan_qinq
uint16_t counter_vlan_qinq
Definition: decode.h:1002
IPV6Vars_
get the highest proto/next header field we know
Definition: decode-ipv6.h:84
DecodeThreadVars_::counter_defrag_tracker_hard_reuse
uint16_t counter_defrag_tracker_hard_reuse
Definition: decode.h:1023
PktProfilingDetectData_
Definition: decode.h:349
PktVar_::key
uint8_t * key
Definition: decode.h:318
decode-icmpv6.h
PacketAlerts_::discarded
uint16_t discarded
Definition: decode.h:288
Packet_::pkt_hooks
uint16_t pkt_hooks
Definition: decode.h:541
DecodeSll
int DecodeSll(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-sll.c:41
PKT_DROP_REASON_RULES
@ PKT_DROP_REASON_RULES
Definition: decode.h:389
PacketL4::L4Hdrs::icmpv4h
ICMPV4Hdr * icmpv4h
Definition: decode.h:471
LOGGER_SIZE
@ LOGGER_SIZE
Definition: suricata-common.h:518
PacketCallocExtPkt
int PacketCallocExtPkt(Packet *p, int datalen)
Definition: decode.c:309
Address_::address
union Address_::@30 address
Address
struct Address_ Address
ETHERNET_TYPE_MPLS_UNICAST
#define ETHERNET_TYPE_MPLS_UNICAST
Definition: decode-mpls.h:29
PACKET_L3_ARP
@ PACKET_L3_ARP
Definition: decode.h:430
PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
@ PKT_SRC_STREAM_TCP_DETECTLOG_FLUSH
Definition: decode.h:59
DECODE_TUNNEL_VLAN
@ DECODE_TUNNEL_VLAN
Definition: decode.h:1103
ETHERNET_TYPE_PPPOE_DISC
#define ETHERNET_TYPE_PPPOE_DISC
Definition: decode-ethernet.h:41
DecodeThreadVars_::counter_tcp_urg
uint16_t counter_tcp_urg
Definition: decode.h:985
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:55
PACKET_L4_UDP
@ PACKET_L4_UDP
Definition: decode.h:456
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:501
DecodeThreadVars_::counter_nsh
uint16_t counter_nsh
Definition: decode.h:1013
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:1104
DecodeThreadVars_::app_tctx
AppLayerThreadCtx * app_tctx
Definition: decode.h:965
decode-icmpv4.h
ICMPV4Hdr_
Definition: decode-icmpv4.h:165
Packet_::l4
struct PacketL4 l4
Definition: decode.h:601
DecodeThreadVars_::counter_sll
uint16_t counter_sll
Definition: decode.h:992
source-ipfw.h
Address_::address_un_data8
uint8_t address_un_data8[16]
Definition: decode.h:117
TMM_SIZE
@ TMM_SIZE
Definition: tm-threads-common.h:76
PacketEngineEvents_
Definition: decode.h:306
source-netmap.h
PACKET_L4_ESP
@ PACKET_L4_ESP
Definition: decode.h:461
PacketL3::ip4
IPV4Vars ip4
Definition: decode.h:445
PKT_DROP_REASON_STREAM_ERROR
@ PKT_DROP_REASON_STREAM_ERROR
Definition: decode.h:391
Port
uint16_t Port
Definition: decode.h:218
DecodeThreadVars_::counter_sctp
uint16_t counter_sctp
Definition: decode.h:996
SCTime_t
Definition: util-time.h:40
Packet_::livedev
struct LiveDevice_ * livedev
Definition: decode.h:618
source-windivert.h
DecodeThreadVars_::counter_invalid
uint16_t counter_invalid
Definition: decode.h:975
PacketL3::vars
union PacketL3::@31 vars
ETHERNET_TYPE_VNTAG
#define ETHERNET_TYPE_VNTAG
Definition: decode-ethernet.h:51
DecodeThreadVars_::counter_ieee8021ah
uint16_t counter_ieee8021ah
Definition: decode.h:1006
rww_lock_wait_ticks
thread_local uint64_t rww_lock_wait_ticks
DecodeTCP
int DecodeTCP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-tcp.c:273
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:1010
PacketAlert_::iid
SigIntId iid
Definition: decode.h:249
ETHERNET_TYPE_NSH
#define ETHERNET_TYPE_NSH
Definition: decode-ethernet.h:50
PacketL4::L4Hdrs::sctph
SCTPHdr * sctph
Definition: decode.h:473
PacketL2::L2Hdrs::ethh
EthernetHdr * ethh
Definition: decode.h:422
DecodeThreadVars_::counter_vlan
uint16_t counter_vlan
Definition: decode.h:1001
PacketL2
Definition: decode.h:419
DECODE_TUNNEL_ETHERNET
@ DECODE_TUNNEL_ETHERNET
Definition: decode.h:1100
DecodeThreadVars_::counter_tcp
uint16_t counter_tcp
Definition: decode.h:981
ETHERNET_TYPE_DCE
#define ETHERNET_TYPE_DCE
Definition: decode-ethernet.h:49
AFXDPPacketVars_
per packet AF_XDP vars
Definition: source-af-xdp.h:54
DecodeThreadVars_::counter_pkts
uint16_t counter_pkts
Definition: decode.h:968
rwr_lock_wait_ticks
thread_local uint64_t rwr_lock_wait_ticks
PacketTunnelNone
@ PacketTunnelNone
Definition: decode.h:406
decode-events.h
PktProfilingData_::ticks_start
uint64_t ticks_start
Definition: decode.h:345
PKT_DROP_REASON_DEFAULT_PACKET_POLICY
@ PKT_DROP_REASON_DEFAULT_PACKET_POLICY
Definition: decode.h:398
DecodeNull
int DecodeNull(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-null.c:51
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
DecodeIPV4
int DecodeIPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint16_t)
Definition: decode-ipv4.c:520
DecodeThreadVars_::counter_defrag_memcap_eps
ExceptionPolicyCounters counter_defrag_memcap_eps
Definition: decode.h:1025
PacketAlert_::frame_id
int64_t frame_id
Definition: decode.h:254
PacketL3::csum_set
bool csum_set
Definition: decode.h:436
decode-vlan.h
IPV4Hdr_
Definition: decode-ipv4.h:72
default_packet_size
uint32_t default_packet_size
Definition: decode.c:77
Packet_::l2
struct PacketL2 l2
Definition: decode.h:599
Packet_::nb_decoded_layers
uint8_t nb_decoded_layers
Definition: decode.h:644
PacketAlert_::flags
uint8_t flags
Definition: decode.h:251
PKT_SRC_DECODER_GENEVE
@ PKT_SRC_DECODER_GENEVE
Definition: decode.h:63
PacketL3::eh
IPV6ExtHdrs eh
Definition: decode.h:448
decode-ipv4.h
DecodeThreadVars_::counter_chdlc
uint16_t counter_chdlc
Definition: decode.h:978
PacketL3::type
enum PacketL3Types type
Definition: decode.h:434
Packet_::nfq_v
NFQPacketVars nfq_v
Definition: decode.h:563
ICMPV6Hdr_
Definition: decode-icmpv6.h:129
PktProfiling_::detect
PktProfilingDetectData detect[PROF_DETECT_SIZE]
Definition: decode.h:372
Packet_::ReleasePacket
void(* ReleasePacket)(struct Packet_ *)
Definition: decode.h:591
cnt
uint32_t cnt
Definition: tmqh-packetpool.h:7
Packet_::tenant_id
uint32_t tenant_id
Definition: decode.h:665
Packet_::flow
struct Flow_ * flow
Definition: decode.h:546
ETHERNET_UNKNOWN_ETHERTYPE
@ ETHERNET_UNKNOWN_ETHERTYPE
Definition: decode-events.h:119
DecodeGRE
int DecodeGRE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Function to decode GRE packets.
Definition: decode-gre.c:47
ICMPV6Vars_
Definition: decode-icmpv6.h:146
PKT_DROP_REASON_INNER_PACKET
@ PKT_DROP_REASON_INNER_PACKET
Definition: decode.h:397
PktProfiling
struct PktProfiling_ PktProfiling
Per pkt stats storage.
PacketL4::type
enum PacketL4Types type
Definition: decode.h:465
DecodeThreadVarsFree
void DecodeThreadVarsFree(ThreadVars *, DecodeThreadVars *)
Definition: decode.c:820
IPFWPacketVars_
Definition: source-ipfw.h:32
source-dpdk.h
PktProfilingLoggerData_::ticks_end
uint64_t ticks_end
Definition: decode.h:361
PacketL4::L4Hdrs::icmpv6h
ICMPV6Hdr * icmpv6h
Definition: decode.h:472
DecodeThreadVars_::counter_flow_spare_sync_incomplete
uint16_t counter_flow_spare_sync_incomplete
Definition: decode.h:1047
PKT_DROP_REASON_APPLAYER_MEMCAP
@ PKT_DROP_REASON_APPLAYER_MEMCAP
Definition: decode.h:388
DecodeGlobalConfig
void DecodeGlobalConfig(void)
Definition: decode.c:1048
ChecksumValidationMode
ChecksumValidationMode
Definition: decode.h:42
suricata-common.h
PKT_SRC_FFR
@ PKT_SRC_FFR
Definition: decode.h:58
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:92
ETHERNET_TYPE_8021AH
#define ETHERNET_TYPE_8021AH
Definition: decode-ethernet.h:44
decode-arp.h
NFQPacketVars_
Definition: source-nfq.h:40
PacketL4::L4Vars
Definition: decode.h:477
DecodeThreadVars_::counter_flow_icmp6
uint16_t counter_flow_icmp6
Definition: decode.h:1036
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:980
PROFILE_FLOWWORKER_SIZE
@ PROFILE_FLOWWORKER_SIZE
Definition: flow-worker.h:29
source-af-xdp.h
ETHERNET_DCE_HEADER_LEN
#define ETHERNET_DCE_HEADER_LEN
Definition: decode-ethernet.h:30
DecodeThreadVars_::counter_gre
uint16_t counter_gre
Definition: decode.h:1000
PacketL3Types
PacketL3Types
Definition: decode.h:426
DecodeThreadVars_::counter_esp
uint16_t counter_esp
Definition: decode.h:997
Packet_::ext_pkt
uint8_t * ext_pkt
Definition: decode.h:615
PacketAlerts
struct PacketAlerts_ PacketAlerts
DecodeICMPV4
int DecodeICMPV4(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main ICMPv4 decoding function.
Definition: decode-icmpv4.c:143
Packet_::app_update_direction
uint8_t app_update_direction
Definition: decode.h:535
decode-esp.h
PKT_DROP_REASON_NFQ_ERROR
@ PKT_DROP_REASON_NFQ_ERROR
Definition: decode.h:396
DecodeThreadVars_::counter_defrag_no_frags
uint16_t counter_defrag_no_frags
Definition: decode.h:1021
DecodeThreadVars_::counter_defrag_ipv6_reassembled
uint16_t counter_defrag_ipv6_reassembled
Definition: decode.h:1019
DecodeThreadVars_::counter_udp
uint16_t counter_udp
Definition: decode.h:986
GENERIC_TOO_MANY_LAYERS
@ GENERIC_TOO_MANY_LAYERS
Definition: decode-events.h:228
Packet_::ttype
enum PacketTunnelType ttype
Definition: decode.h:553
Packet_::icmp_d
struct Packet_::@35::@41 icmp_d
PacketUpdateEngineEventCounters
void PacketUpdateEngineEventCounters(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Definition: decode.c:239
VLAN_MAX_LAYERS
#define VLAN_MAX_LAYERS
Definition: decode-vlan.h:51
DecodeThreadVars_::counter_flow_memcap_eps
ExceptionPolicyCounters counter_flow_memcap_eps
Definition: decode.h:1028
UDPHdr_
Definition: decode-udp.h:42
decode-sctp.h
PacketContextData::next
struct PacketContextData * next
Definition: decode.h:243
PKT_SRC_DEFRAG
@ PKT_SRC_DEFRAG
Definition: decode.h:57
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
NetmapPacketVars_
Definition: source-netmap.h:71
DecodeThreadVars_::counter_ipv4
uint16_t counter_ipv4
Definition: decode.h:979
PACKET_L4_ICMPV6
@ PACKET_L4_ICMPV6
Definition: decode.h:458
threadvars.h
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:258
TUNNEL_PKT_RTV
#define TUNNEL_PKT_RTV(p)
Definition: decode.h:1087
source-af-packet.h
PKT_SRC_DECODER_VXLAN
@ PKT_SRC_DECODER_VXLAN
Definition: decode.h:60
mutex_lock_wait_ticks
thread_local uint64_t mutex_lock_wait_ticks
Packet_::next
struct Packet_ * next
Definition: decode.h:635
Packet_::flow_hash
uint32_t flow_hash
Definition: decode.h:550
PacketL4::L4Hdrs::tcph
TCPHdr * tcph
Definition: decode.h:469
PACKET_L4_ICMPV4
@ PACKET_L4_ICMPV4
Definition: decode.h:457
Packet_::l3
struct PacketL3 l3
Definition: decode.h:600
Packet_::root
struct Packet_ * root
Definition: decode.h:653
DecodeThreadVars_::counter_pppoe
uint16_t counter_pppoe
Definition: decode.h:1007
PacketAlerts_::suppressed
uint16_t suppressed
Definition: decode.h:289
DecodeThreadVars_::counter_mpls
uint16_t counter_mpls
Definition: decode.h:1009
SCLogError
#define SCLogError(...)
Macro used to log ERROR messages.
Definition: util-debug.h:267
PKT_SRC_DETECT_RELOAD_FLUSH
@ PKT_SRC_DETECT_RELOAD_FLUSH
Definition: decode.h:61
PktProfilingData
struct PktProfilingData_ PktProfilingData
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:611
ETHERNET_TYPE_PPPOE_SESS
#define ETHERNET_TYPE_PPPOE_SESS
Definition: decode-ethernet.h:42
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:963
PACKET_ENGINE_EVENT_MAX
#define PACKET_ENGINE_EVENT_MAX
Definition: decode.h:303
PACKET_L3_IPV6
@ PACKET_L3_IPV6
Definition: decode.h:429
DecodeThreadVars_::counter_flow_elephant
uint16_t counter_flow_elephant
Definition: decode.h:1038
Packet_::recursion_level
uint8_t recursion_level
Definition: decode.h:526
PktProfilingLoggerData_
Definition: decode.h:359
PktProfiling_::tmm
PktProfilingTmmData tmm[TMM_SIZE]
Definition: decode.h:370
Signature_
Signature container.
Definition: detect.h:668
DecodeThreadVars_::output_flow_thread_data
void * output_flow_thread_data
Definition: decode.h:1054
DecodeThreadVars_::counter_geneve
uint16_t counter_geneve
Definition: decode.h:999
ETHERNET_TYPE_ARP
#define ETHERNET_TYPE_ARP
Definition: decode-ethernet.h:35
DecodeThreadVars_::counter_max_mac_addrs_dst
uint16_t counter_max_mac_addrs_dst
Definition: decode.h:973
DecodeThreadVarsAlloc
DecodeThreadVars * DecodeThreadVarsAlloc(ThreadVars *)
Alloc and setup DecodeThreadVars.
Definition: decode.c:802
DecodeThreadVars_::counter_defrag_max_hit
uint16_t counter_defrag_max_hit
Definition: decode.h:1020
PacketSetData
int PacketSetData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Set data for Packet and set length when zero copy is used.
Definition: decode.c:840
PacketL4::hdrs
union PacketL4::L4Hdrs hdrs
DecodeThreadVars_::counter_vlan_qinqinq
uint16_t counter_vlan_qinqinq
Definition: decode.h:1003
SCSpinlock
#define SCSpinlock
Definition: threads-debug.h:234
VLAN_MAX_LAYER_IDX
#define VLAN_MAX_LAYER_IDX
Definition: decode-vlan.h:52
PktVar_::value_len
uint16_t value_len
Definition: decode.h:317
PacketL2::hdrs
union PacketL2::L2Hdrs hdrs
app-layer-protos.h
DecodeThreadVars_::counter_null
uint16_t counter_null
Definition: decode.h:995
DecodeThreadVars_::counter_icmpv6
uint16_t counter_icmpv6
Definition: decode.h:988
PcapPacketVars_
Definition: source-pcap.h:36
PacketL3::csum
uint16_t csum
Definition: decode.h:437
Packet_::drop_reason
uint8_t drop_reason
Definition: decode.h:647
Address_::family
char family
Definition: decode.h:113
Packet_::dst
Address dst
Definition: decode.h:506
PKT_SRC_DECODER_GRE
@ PKT_SRC_DECODER_GRE
Definition: decode.h:53
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1192
PktProfilingTmmData_::ticks_start
uint64_t ticks_start
Definition: decode.h:326
PacketAlert_
Definition: decode.h:248
PktProfilingLoggerData_::ticks_spent
uint64_t ticks_spent
Definition: decode.h:362
DecodeThreadVars_::counter_flow_memcap
uint16_t counter_flow_memcap
Definition: decode.h:1027
ETHERNET_TYPE_VLAN
#define ETHERNET_TYPE_VLAN
Definition: decode-vlan.h:31
DecodeThreadVars_::counter_defrag_ipv6_fragments
uint16_t counter_defrag_ipv6_fragments
Definition: decode.h:1018
PKT_NOPACKET_INSPECTION
#define PKT_NOPACKET_INSPECTION
Definition: decode.h:1245
PktVar_
Definition: decode.h:311
PacketTunnelRoot
@ PacketTunnelRoot
Definition: decode.h:407
AFPPacketVars_
per packet AF_PACKET vars
Definition: source-af-packet.h:154
Packet_::pkt_data
uint8_t pkt_data[]
Definition: decode.h:689
PacketAlertRecycle
void PacketAlertRecycle(PacketAlert *pa_array, uint16_t cnt)
Definition: decode.c:148
PacketEngineEvents
struct PacketEngineEvents_ PacketEngineEvents
packet_alert_max
uint16_t packet_alert_max
Definition: decode.c:82
Packet_::vlan_id
uint16_t vlan_id[VLAN_MAX_LAYERS]
Definition: decode.h:528
DecodeIEEE8021ah
int DecodeIEEE8021ah(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
PktProfilingDetectData_::ticks_start
uint64_t ticks_start
Definition: decode.h:350
DECODE_TUNNEL_ARP
@ DECODE_TUNNEL_ARP
Definition: decode.h:1109
PacketContextData::json_string
char * json_string
Definition: decode.h:242
PacketL4
Definition: decode.h:464
PacketDefragPktSetupParent
void PacketDefragPktSetupParent(Packet *parent)
inform defrag "parent" that a pseudo packet is now associated to it.
Definition: decode.c:512
DecodeThreadVars_::counter_tcp_syn
uint16_t counter_tcp_syn
Definition: decode.h:982
DecodeSll2
int DecodeSll2(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-sll2.c:40
Packet_::plugin_v
uint8_t plugin_v[PLUGIN_VAR_SIZE]
Definition: decode.h:584
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:393
PktProfiling_::flowworker
PktProfilingData flowworker[PROFILE_FLOWWORKER_SIZE]
Definition: decode.h:371
mutex_lock_cnt
thread_local uint64_t mutex_lock_cnt
NFLOGPacketVars_
Definition: source-nflog.h:55
PacketL4::L4Vars::icmpv6
ICMPV6Vars icmpv6
Definition: decode.h:480
PKT_DROP_REASON_STREAM_MIDSTREAM
@ PKT_DROP_REASON_STREAM_MIDSTREAM
Definition: decode.h:393
SigIntId
#define SigIntId
Definition: suricata-common.h:332
PacketAlerts_
Definition: decode.h:286
Packet_::dp
Port dp
Definition: decode.h:516
PktVar_::key_len
uint16_t key_len
Definition: decode.h:316
PktProfilingAppData_
Definition: decode.h:355
Host_
Definition: host.h:58
DecodeThreadVars_::counter_flow_get_used_eval_reject
uint16_t counter_flow_get_used_eval_reject
Definition: decode.h:1041
PktProfiling_::proto_detect
uint64_t proto_detect
Definition: decode.h:374
DecodePPPOESession
int DecodePPPOESession(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main decoding function for PPPOE Session packets.
Definition: decode-pppoe.c:124
ETHERNET_TYPE_MPLS_MULTICAST
#define ETHERNET_TYPE_MPLS_MULTICAST
Definition: decode-mpls.h:30
Packet_::type
uint8_t type
Definition: decode.h:511
ETHERNET_TYPE_IP
#define ETHERNET_TYPE_IP
Definition: decode-ethernet.h:34
DECODE_TUNNEL_UNSET
@ DECODE_TUNNEL_UNSET
Definition: decode.h:1110
PacketGetFromQueueOrAlloc
Packet * PacketGetFromQueueOrAlloc(void)
Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packe...
Definition: decode.c:293
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
PacketL3::v
IPV6Vars v
Definition: decode.h:447
PktProfilingLoggerData_::ticks_start
uint64_t ticks_start
Definition: decode.h:360
PKT_DROP_REASON_FLOW_DROP
@ PKT_DROP_REASON_FLOW_DROP
Definition: decode.h:386
TCPHdr_
Definition: decode-tcp.h:149
Packet_::src
Address src
Definition: decode.h:505
PacketL4::vars
union PacketL4::L4Vars vars
DecodeERSPANTypeI
int DecodeERSPANTypeI(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
ERSPAN Type I.
Definition: decode-erspan.c:65
DecodeCHDLC
int DecodeCHDLC(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Definition: decode-chdlc.c:42
DecodeUpdatePacketCounters
void DecodeUpdatePacketCounters(ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
Definition: decode.c:768
DecodeThreadVars_::counter_engine_events
uint16_t counter_engine_events[DECODE_EVENT_MAX]
Definition: decode.h:1050
DecodeThreadVars_::counter_defrag_tracker_soft_reuse
uint16_t counter_defrag_tracker_soft_reuse
Definition: decode.h:1022
PktProfilingDetectData_::ticks_spent
uint64_t ticks_spent
Definition: decode.h:352
PktVar_::id
uint32_t id
Definition: decode.h:312
DECODE_EVENT_MAX
@ DECODE_EVENT_MAX
Definition: decode-events.h:318
SignatureMask
#define SignatureMask
Definition: decode.h:99
PKT_DROP_REASON_DECODE_ERROR
@ PKT_DROP_REASON_DECODE_ERROR
Definition: decode.h:382
DecodeThreadVars_::counter_defrag_ipv4_fragments
uint16_t counter_defrag_ipv4_fragments
Definition: decode.h:1016
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:307
DecodePPPOEDiscovery
int DecodePPPOEDiscovery(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t)
Main decoding function for PPPOE Discovery packets.
Definition: decode-pppoe.c:50