suricata
Packet decoding

Code in charge of protocol decoding. More...

Files

file  decode-erspan.c
 
file  decode-ethernet.c
 
file  decode-gre.c
 
file  decode-icmpv4.c
 
file  decode-icmpv6.c
 
file  decode-ipv4.c
 
file  decode-ipv6.c
 
file  decode-null.c
 
file  decode-ppp.c
 
file  decode-pppoe.c
 
file  decode-raw.c
 
file  decode-sctp.c
 
file  decode-sll.c
 
file  decode-tcp.c
 
file  decode-template.c
 
file  decode-teredo.c
 
file  decode-udp.c
 
file  decode-vlan.c
 
file  decode.c
 

Functions

int DecodeTunnel (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq, enum DecodeTunnelProto proto)
 
void PacketFree (Packet *p)
 Return a malloced packet. More...
 
void PacketDecodeFinalize (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
 Finalize decoding of a packet. More...
 
PacketPacketGetFromAlloc (void)
 Get a malloced packet. More...
 
void PacketFreeOrRelease (Packet *p)
 Return a packet to where it was allocated. More...
 
PacketPacketGetFromQueueOrAlloc (void)
 Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packet that is free'd again after processing. More...
 
int PacketCallocExtPkt (Packet *p, int datalen)
 
int PacketCopyDataOffset (Packet *p, int offset, uint8_t *data, int datalen)
 Copy data to Packet payload at given offset. More...
 
int PacketCopyData (Packet *p, uint8_t *pktdata, int pktlen)
 Copy data to Packet payload and set packet length. More...
 
PacketPacketTunnelPktSetup (ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, uint8_t *pkt, uint16_t len, enum DecodeTunnelProto proto, PacketQueue *pq)
 Setup a pseudo packet (tunnel) More...
 
PacketPacketDefragPktSetup (Packet *parent, uint8_t *pkt, uint16_t len, uint8_t proto)
 Setup a pseudo packet (reassembled frags) More...
 
void PacketDefragPktSetupParent (Packet *parent)
 inform defrag "parent" that a pseudo packet is now assosiated to it. More...
 
void PacketBypassCallback (Packet *p)
 
void DecodeRegisterPerfCounters (DecodeThreadVars *dtv, ThreadVars *tv)
 
void DecodeUpdatePacketCounters (ThreadVars *tv, const DecodeThreadVars *dtv, const Packet *p)
 
void AddressDebugPrint (Address *a)
 Debug print function for printing addresses. More...
 
DecodeThreadVarsDecodeThreadVarsAlloc (ThreadVars *tv)
 Alloc and setup DecodeThreadVars. More...
 
void DecodeThreadVarsFree (ThreadVars *tv, DecodeThreadVars *dtv)
 
int PacketSetData (Packet *p, uint8_t *pktdata, int pktlen)
 Set data for Packet and set length when zeo copy is used. More...
 
const char * PktSrcToString (enum PktSrcEnum pkt_src)
 
void CaptureStatsUpdate (ThreadVars *tv, CaptureStats *s, const Packet *p)
 
void CaptureStatsSetup (ThreadVars *tv, CaptureStats *s)
 
void DecodeGlobalConfig (void)
 

Detailed Description

Code in charge of protocol decoding.

The task of decoding packets is made in different files and as Suricata is supporting encapsulation there is a potential recursivity in the call.

For each protocol a DecodePROTO function is provided. For example we have DecodeIPV4() for IPv4 and DecodePPP() for PPP.

These functions have all a pkt and and a len argument which are respectively a pointer to the protocol data and the length of this protocol data.

Attention
The pkt parameter must point to the effective data because it will be used later to set per protocol pointer like Packet::tcph

Function Documentation

◆ AddressDebugPrint()

void AddressDebugPrint ( Address a)

Debug print function for printing addresses.

Parameters
Addressobject
Todo:
IPv6

Definition at line 482 of file decode.c.

References Address_::family, PrintInet(), and SCLogDebug.

Here is the call graph for this function:

◆ CaptureStatsSetup()

void CaptureStatsSetup ( ThreadVars tv,
CaptureStats s 
)

Definition at line 605 of file decode.c.

References CaptureStats_::counter_ips_accepted, CaptureStats_::counter_ips_blocked, CaptureStats_::counter_ips_rejected, CaptureStats_::counter_ips_replaced, and StatsRegisterCounter().

Referenced by VerdictNFQThreadInit().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ CaptureStatsUpdate()

void CaptureStatsUpdate ( ThreadVars tv,
CaptureStats s,
const Packet p 
)

◆ DecodeGlobalConfig()

void DecodeGlobalConfig ( void  )

Definition at line 613 of file decode.c.

References DecodeTeredoConfig().

Here is the call graph for this function:

◆ DecodeRegisterPerfCounters()

void DecodeRegisterPerfCounters ( DecodeThreadVars dtv,
ThreadVars tv 
)

Definition at line 403 of file decode.c.

References BUG_ON, code, DecodeThreadVars_::counter_avg_pkt_size, DecodeThreadVars_::counter_bytes, DecodeThreadVars_::counter_defrag_ipv4_fragments, DecodeThreadVars_::counter_defrag_ipv4_reassembled, DecodeThreadVars_::counter_defrag_ipv4_timeouts, DecodeThreadVars_::counter_defrag_ipv6_fragments, DecodeThreadVars_::counter_defrag_ipv6_reassembled, DecodeThreadVars_::counter_defrag_ipv6_timeouts, DecodeThreadVars_::counter_defrag_max_hit, DecodeThreadVars_::counter_erspan, DecodeThreadVars_::counter_eth, DecodeThreadVars_::counter_flow_icmp4, DecodeThreadVars_::counter_flow_icmp6, DecodeThreadVars_::counter_flow_memcap, DecodeThreadVars_::counter_flow_tcp, DecodeThreadVars_::counter_flow_udp, DecodeThreadVars_::counter_gre, DecodeThreadVars_::counter_icmpv4, DecodeThreadVars_::counter_icmpv6, DecodeThreadVars_::counter_ieee8021ah, DecodeThreadVars_::counter_invalid, DecodeThreadVars_::counter_invalid_events, DecodeThreadVars_::counter_ipv4, DecodeThreadVars_::counter_ipv4inipv6, DecodeThreadVars_::counter_ipv6, DecodeThreadVars_::counter_ipv6inipv6, DecodeThreadVars_::counter_max_pkt_size, DecodeThreadVars_::counter_mpls, DecodeThreadVars_::counter_null, DecodeThreadVars_::counter_pkts, DecodeThreadVars_::counter_ppp, DecodeThreadVars_::counter_pppoe, DecodeThreadVars_::counter_raw, DecodeThreadVars_::counter_sctp, DecodeThreadVars_::counter_sll, DecodeThreadVars_::counter_tcp, DecodeThreadVars_::counter_teredo, DecodeThreadVars_::counter_udp, DecodeThreadVars_::counter_vlan, DecodeThreadVars_::counter_vlan_qinq, DECODE_EVENT_PACKET_MAX, DEvents, StatsRegisterAvgCounter(), StatsRegisterCounter(), and StatsRegisterMaxCounter().

Referenced by DecodeAFPThreadInit(), DecodeErfDagThreadInit(), DecodeErfFileThreadInit(), DecodeIPFWThreadInit(), DecodeNFQThreadInit(), DecodePcapFileThreadInit(), DecodePcapThreadInit(), DecodePfringThreadInit(), and NapatechDecodeThreadInit().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DecodeThreadVarsAlloc()

◆ DecodeThreadVarsFree()

◆ DecodeTunnel()

int DecodeTunnel ( ThreadVars tv,
DecodeThreadVars dtv,
Packet p,
uint8_t *  pkt,
uint16_t  len,
PacketQueue pq,
enum DecodeTunnelProto  proto 
)

Definition at line 70 of file decode.c.

References DECODE_TUNNEL_ERSPAN, DECODE_TUNNEL_ETHERNET, DECODE_TUNNEL_IPV4, DECODE_TUNNEL_IPV6, DECODE_TUNNEL_PPP, DECODE_TUNNEL_VLAN, DecodeERSPAN(), DecodeEthernet(), DecodeIPV4(), DecodeIPV6(), DecodePPP(), DecodeVLAN(), SCLogInfo, and TM_ECODE_OK.

Referenced by PacketTunnelPktSetup().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ DecodeUpdatePacketCounters()

void DecodeUpdatePacketCounters ( ThreadVars tv,
const DecodeThreadVars dtv,
const Packet p 
)

◆ PacketBypassCallback()

void PacketBypassCallback ( Packet p)

Definition at line 386 of file decode.c.

References Packet_::BypassPacketsFlow, Packet_::flow, FLOW_STATE_CAPTURE_BYPASSED, FLOW_STATE_LOCAL_BYPASSED, FlowUpdateState(), and SC_ATOMIC_GET.

Here is the call graph for this function:

◆ PacketCallocExtPkt()

int PacketCallocExtPkt ( Packet p,
int  datalen 
)
inline

Definition at line 185 of file decode.c.

References Packet_::ext_pkt, SCCalloc, SET_PKT_LEN, and unlikely.

◆ PacketCopyData()

int PacketCopyData ( Packet p,
uint8_t *  pktdata,
int  pktlen 
)
inline

Copy data to Packet payload and set packet length.

Parameters
Pointerto the Packet to modify
Pointerto the data to copy
Lengthof the data to copy

Definition at line 248 of file decode.c.

References PacketCopyDataOffset(), and SET_PKT_LEN.

Referenced by PacketDefragPktSetup(), PacketTunnelPktSetup(), ReceiveIPFWLoop(), and StreamTcpPseudoSetup().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ PacketCopyDataOffset()

int PacketCopyDataOffset ( Packet p,
int  offset,
uint8_t *  data,
int  datalen 
)
inline

Copy data to Packet payload at given offset.

This function copies data/payload to a Packet. It uses the space allocated at Packet creation (pointed by Packet::pkt) or allocate some memory (pointed by Packet::ext_pkt) if the data size is to big to fit in initial space (of size default_packet_size).

Parameters
Pointerto the Packet to modify
Offsetof the copy relatively to payload of Packet
Pointerto the data to copy
Lengthof the data to copy

Definition at line 211 of file decode.c.

References default_packet_size, Packet_::ext_pkt, GET_PKT_DIRECT_DATA, GET_PKT_DIRECT_MAX_SIZE, MAX_PAYLOAD_SIZE, SCMalloc, SET_PKT_LEN, and unlikely.

Referenced by PacketCopyData(), and UTHBuildPacketReal().

Here is the caller graph for this function:

◆ PacketDecodeFinalize()

void PacketDecodeFinalize ( ThreadVars tv,
DecodeThreadVars dtv,
Packet p 
)

Finalize decoding of a packet.

This function needs to be call at the end of decode functions when decoding has been succesful.

Definition at line 110 of file decode.c.

References PacketEngineEvents_::cnt, DecodeThreadVars_::counter_invalid, DecodeThreadVars_::counter_invalid_events, EVENT_IS_DECODER_PACKET_ERROR, PacketEngineEvents_::events, Packet_::events, Packet_::flags, PKT_IS_INVALID, and StatsIncr().

Referenced by DecodeAFP(), DecodeErfDag(), DecodeErfFile(), DecodeIPFW(), DecodeNFQ(), DecodePcap(), DecodePfring(), and NapatechDecode().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ PacketDefragPktSetup()

Packet* PacketDefragPktSetup ( Packet parent,
uint8_t *  pkt,
uint16_t  len,
uint8_t  proto 
)

Setup a pseudo packet (reassembled frags)

Difference with PacketPseudoPktSetup is that this func doesn't increment the recursion level. It needs to be on the same level as the frags because we run the flow engine against this and we need to get the same flow.

Parameters
parentparent packet for this pseudo pkt
pktraw packet data
lenpacket data length
protoprotocol of the tunneled packet
Return values
pthe pseudo packet or NULL if out of memory

Definition at line 334 of file decode.c.

References Packet_::datalink, PacketCopyData(), PacketGetFromQueueOrAlloc(), Packet_::recursion_level, Packet_::root, SCEnter, SCReturnPtr, SET_TUNNEL_PKT, Packet_::tenant_id, Packet_::ts, unlikely, Packet_::vlan_id, and Packet_::vlan_idx.

Here is the call graph for this function:

◆ PacketDefragPktSetupParent()

void PacketDefragPktSetupParent ( Packet parent)

inform defrag "parent" that a pseudo packet is now assosiated to it.

Definition at line 372 of file decode.c.

References DecodeSetNoPayloadInspectionFlag, SET_TUNNEL_PKT, and TUNNEL_INCR_PKT_TPR.

◆ PacketFree()

void PacketFree ( Packet p)

Return a malloced packet.

Definition at line 96 of file decode.c.

References PACKET_DESTRUCTOR, and SCFree.

Referenced by PacketFreeOrRelease(), and PacketGetFromAlloc().

Here is the caller graph for this function:

◆ PacketFreeOrRelease()

void PacketFreeOrRelease ( Packet p)

Return a packet to where it was allocated.

Definition at line 155 of file decode.c.

References Packet_::flags, PacketFree(), PacketPoolReturnPacket(), and PKT_ALLOC.

Here is the call graph for this function:

◆ PacketGetFromAlloc()

Packet* PacketGetFromAlloc ( void  )

Get a malloced packet.

Return values
ppacket, NULL on error

Definition at line 134 of file decode.c.

References Packet_::flags, PACKET_INITIALIZE, PACKET_PROFILING_START, PacketFree(), PKT_ALLOC, Packet_::ReleasePacket, SCLogDebug, SCMalloc, SIZE_OF_PACKET, and unlikely.

Referenced by PacketGetFromQueueOrAlloc(), UTHBuildPacketArrayFromEth(), UTHBuildPacketFromEth(), UTHBuildPacketIPV6Real(), and UTHBuildPacketReal().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ PacketGetFromQueueOrAlloc()

Packet* PacketGetFromQueueOrAlloc ( void  )

Get a packet. We try to get a packet from the packetpool first, but if that is empty we alloc a packet that is free'd again after processing.

Return values
ppacket, NULL on error

Definition at line 170 of file decode.c.

References PACKET_PROFILING_START, PacketGetFromAlloc(), and PacketPoolGetPacket().

Referenced by NapatechPacketLoopZC(), PacketDefragPktSetup(), PacketTunnelPktSetup(), ReceiveErfFileLoop(), ReceiveIPFWLoop(), ReceivePfringLoop(), and StreamTcpPseudoSetup().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ PacketSetData()

int PacketSetData ( Packet p,
uint8_t *  pktdata,
int  pktlen 
)
inline

Set data for Packet and set length when zeo copy is used.

Parameters
Pointerto the Packet to modify
Pointerto the data
Lengthof the data

Definition at line 545 of file decode.c.

References Packet_::ext_pkt, Packet_::flags, PKT_ZERO_COPY, SET_PKT_LEN, and unlikely.

Referenced by ReceivePfringLoop().

Here is the caller graph for this function:

◆ PacketTunnelPktSetup()

Packet* PacketTunnelPktSetup ( ThreadVars tv,
DecodeThreadVars dtv,
Packet parent,
uint8_t *  pkt,
uint16_t  len,
enum DecodeTunnelProto  proto,
PacketQueue pq 
)

Setup a pseudo packet (tunnel)

Parameters
parentparent packet for this pseudo pkt
pktraw packet data
lenpacket data length
protoprotocol of the tunneled packet
Return values
pthe pseudo packet or NULL if out of memory

Definition at line 264 of file decode.c.

References Packet_::datalink, DecodeSetNoPayloadInspectionFlag, DecodeTunnel(), GET_PKT_DATA, GET_PKT_LEN, PacketCopyData(), PacketGetFromQueueOrAlloc(), Packet_::recursion_level, Packet_::root, SCEnter, SCReturnPtr, SET_TUNNEL_PKT, Packet_::tenant_id, TM_ECODE_OK, TmqhOutputPacketpool(), Packet_::ts, TUNNEL_INCR_PKT_TPR, unlikely, and UNSET_TUNNEL_PKT.

Referenced by DecodeGRE().

Here is the call graph for this function:
Here is the caller graph for this function:

◆ PktSrcToString()