suricata
packet.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "packet.h"
19 #include "pkt-var.h"
20 #include "flow.h"
21 #include "host.h"
22 #include "util-profiling.h"
23 #include "util-validate.h"
24 #include "action-globals.h"
25 #include "app-layer-events.h"
26 
27 /** \brief issue drop action
28  *
29  * Set drop (+reject) flags in both current and root packet.
30  *
31  * \param action action bit flags. Must be limited to ACTION_DROP_REJECT|ACTION_ALERT
32  */
33 void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
34 {
36 
38  p->drop_reason = (uint8_t)r;
39 
40  if (p->root) {
41  p->root->action |= action;
44  }
45  }
46  p->action |= action;
47 }
48 
49 bool PacketCheckAction(const Packet *p, const uint8_t a)
50 {
51  if (likely(p->root == NULL)) {
52  return (p->action & a) != 0;
53  } else {
54  /* check against both */
55  const uint8_t actions = p->action | p->root->action;
56  return (actions & a) != 0;
57  }
58 }
59 
60 /**
61  * \brief Initialize a packet structure for use.
62  */
64 {
67  p->livedev = NULL;
68 }
69 
71 {
72  FlowDeReference(&p->flow);
75 }
76 
77 /**
78  * \brief Recycle a packet structure for reuse.
79  */
81 {
82 /* clear the address structure by setting all fields to 0 */
83 #define CLEAR_ADDR(a) \
84  do { \
85  (a)->family = 0; \
86  (a)->addr_data32[0] = 0; \
87  (a)->addr_data32[1] = 0; \
88  (a)->addr_data32[2] = 0; \
89  (a)->addr_data32[3] = 0; \
90  } while (0)
91 
92  CLEAR_ADDR(&p->src);
93  CLEAR_ADDR(&p->dst);
94  p->sp = 0;
95  p->dp = 0;
96  p->proto = 0;
97  p->recursion_level = 0;
99  p->app_update_direction = 0;
100  p->sig_mask = 0;
101  p->pkt_hooks = 0;
102  p->flags = 0;
103  p->flowflags = 0;
104  p->pkt_src = 0;
105  p->vlan_id[0] = 0;
106  p->vlan_id[1] = 0;
107  p->vlan_idx = 0;
108  p->ttype = PacketTunnelNone;
109  SCTIME_INIT(p->ts);
110  p->datalink = 0;
111  p->drop_reason = 0;
112 #define PACKET_RESET_ACTION(p) (p)->action = 0
114  if (p->pktvar != NULL) {
115  PktVarFree(p->pktvar);
116  p->pktvar = NULL;
117  }
118  PacketClearL2(p);
119  PacketClearL3(p);
120  PacketClearL4(p);
121  p->payload = NULL;
122  p->payload_len = 0;
123  p->BypassPacketsFlow = NULL;
124 #define RESET_PKT_LEN(p) ((p)->pktlen = 0)
125  RESET_PKT_LEN(p);
126  p->alerts.cnt = 0;
127  p->alerts.discarded = 0;
128  p->alerts.suppressed = 0;
129  p->alerts.drop.action = 0;
130  p->pcap_cnt = 0;
131  p->tunnel_rtv_cnt = 0;
132  p->tunnel_tpr_cnt = 0;
133  p->events.cnt = 0;
135  p->next = NULL;
136  p->prev = NULL;
137  p->tunnel_verdicted = false;
138  p->root = NULL;
139  p->livedev = NULL;
141  p->tenant_id = 0;
142  p->nb_decoded_layers = 0;
143 }
144 
146 {
148  PacketReinit(p);
149 }
150 
151 /**
152  * \brief Cleanup a packet so that we can free it. No memset needed..
153  */
155 {
157  if (p->pktvar != NULL) {
158  PktVarFree(p->pktvar);
159  }
165 }
166 
168 {
170 }
171 
172 inline void SCPacketSetLiveDevice(Packet *p, LiveDevice *device)
173 {
174  p->livedev = device;
175 }
176 
177 inline void SCPacketSetDatalink(Packet *p, int datalink)
178 {
179  p->datalink = datalink;
180 }
181 
183 {
184  p->ts = ts;
185 }
186 
187 inline void SCPacketSetSource(Packet *p, enum PktSrcEnum source)
188 {
189  p->pkt_src = (uint8_t)source;
190 }
PacketCheckAction
bool PacketCheckAction(const Packet *p, const uint8_t a)
Definition: packet.c:49
HostDeReference
#define HostDeReference(src_h_ptr)
Definition: host.h:124
host.h
Packet_::proto
uint8_t proto
Definition: decode.h:506
ts
uint64_t ts
Definition: source-erf-file.c:55
SCSpinDestroy
#define SCSpinDestroy
Definition: threads-debug.h:239
Packet_::host_src
struct Host_ * host_src
Definition: decode.h:605
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:609
SCPacketSetLiveDevice
void SCPacketSetLiveDevice(Packet *p, LiveDevice *device)
Set a packets live device.
Definition: packet.c:172
Packet_::payload
uint8_t * payload
Definition: decode.h:588
PacketAlerts_::cnt
uint16_t cnt
Definition: decode.h:273
action-globals.h
Packet_::flags
uint32_t flags
Definition: decode.h:527
PacketRecycle
void PacketRecycle(Packet *p)
Definition: packet.c:145
Packet_::action
uint8_t action
Definition: decode.h:592
PacketAlertCreate
PacketAlert * PacketAlertCreate(void)
Initialize PacketAlerts with dynamic alerts array size.
Definition: decode.c:140
Packet_::vlan_idx
uint8_t vlan_idx
Definition: decode.h:512
RESET_PKT_LEN
#define RESET_PKT_LEN(p)
Packet_::tunnel_verdicted
bool tunnel_verdicted
Definition: decode.h:633
Packet_::persistent
struct Packet_::@30 persistent
LiveDevice_
Definition: util-device.h:41
PacketReleaseRefs
void PacketReleaseRefs(Packet *p)
Definition: packet.c:70
PacketAlerts_::alerts
PacketAlert * alerts
Definition: decode.h:276
AppLayerDecoderEventsFreeEvents
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
Definition: app-layer-events.c:136
Packet_::sig_mask
SignatureMask sig_mask
Definition: decode.h:521
PacketAlerts_::drop
PacketAlert drop
Definition: decode.h:279
ACTION_DROP_REJECT
#define ACTION_DROP_REJECT
Definition: action-globals.h:40
AppLayerDecoderEventsResetEvents
void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events)
Definition: app-layer-events.c:127
Packet_::host_dst
struct Host_ * host_dst
Definition: decode.h:606
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:515
Packet_::BypassPacketsFlow
int(* BypassPacketsFlow)(struct Packet_ *)
Definition: decode.h:577
PacketDropReason
PacketDropReason
Definition: decode.h:365
CLEAR_ADDR
#define CLEAR_ADDR(a)
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:589
Packet_::alerts
PacketAlerts alerts
Definition: decode.h:603
Packet_::tunnel_tpr_cnt
uint16_t tunnel_tpr_cnt
Definition: decode.h:645
Packet_::app_layer_events
AppLayerDecoderEvents * app_layer_events
Definition: decode.h:615
PacketAlertFree
void PacketAlertFree(PacketAlert *pa)
Definition: decode.c:148
Packet_::events
PacketEngineEvents events
Definition: decode.h:613
SCPacketSetSource
void SCPacketSetSource(Packet *p, enum PktSrcEnum source)
Set packet source.
Definition: packet.c:187
PacketAlert_::action
uint8_t action
Definition: decode.h:245
Packet_::datalink
int datalink
Definition: decode.h:622
PacketReinit
void PacketReinit(Packet *p)
Recycle a packet structure for reuse.
Definition: packet.c:80
Packet_::pktvar
PktVar * pktvar
Definition: decode.h:580
Packet_::tunnel_lock
SCSpinlock tunnel_lock
Definition: decode.h:666
Packet_::ts
SCTime_t ts
Definition: decode.h:538
SCTIME_INIT
#define SCTIME_INIT(t)
Definition: util-time.h:45
PktSrcEnum
PktSrcEnum
Definition: decode.h:51
PKT_DROP_REASON_NOT_SET
@ PKT_DROP_REASON_NOT_SET
Definition: decode.h:366
Packet_::prev
struct Packet_ * prev
Definition: decode.h:619
PacketDestructor
void PacketDestructor(Packet *p)
Cleanup a packet so that we can free it. No memset needed..
Definition: packet.c:154
Packet_::tunnel_rtv_cnt
uint16_t tunnel_rtv_cnt
Definition: decode.h:643
pkt-var.h
Packet_::sp
Port sp
Definition: decode.h:491
PacketAlerts_::discarded
uint16_t discarded
Definition: decode.h:274
Packet_::pkt_hooks
uint16_t pkt_hooks
Definition: decode.h:524
PACKET_RESET_ACTION
#define PACKET_RESET_ACTION(p)
util-profiling.h
ACTION_ALERT
#define ACTION_ALERT
Definition: action-globals.h:29
Packet_
Definition: decode.h:484
SCPacketSetTime
void SCPacketSetTime(Packet *p, SCTime_t ts)
Set the timestamp for a packet.
Definition: packet.c:182
SCTime_t
Definition: util-time.h:40
Packet_::livedev
struct LiveDevice_ * livedev
Definition: decode.h:601
PacketTunnelNone
@ PacketTunnelNone
Definition: decode.h:389
Packet_::nb_decoded_layers
uint8_t nb_decoded_layers
Definition: decode.h:627
PACKET_FREE_EXTDATA
#define PACKET_FREE_EXTDATA(p)
Definition: decode.h:1048
Packet_::ReleasePacket
void(* ReleasePacket)(struct Packet_ *)
Definition: decode.h:574
Packet_::tenant_id
uint32_t tenant_id
Definition: decode.h:648
Packet_::flow
struct Flow_ * flow
Definition: decode.h:529
PKT_DROP_REASON_INNER_PACKET
@ PKT_DROP_REASON_INNER_PACKET
Definition: decode.h:382
packet.h
Packet_::app_update_direction
uint8_t app_update_direction
Definition: decode.h:518
SCPacketSetReleasePacket
void SCPacketSetReleasePacket(Packet *p, void(*ReleasePacket)(Packet *p))
Set a packet release function.
Definition: packet.c:167
Packet_::ttype
enum PacketTunnelType ttype
Definition: decode.h:536
app-layer-events.h
util-validate.h
PACKET_PROFILING_RESET
#define PACKET_PROFILING_RESET(p)
Definition: util-profiling.h:161
SCSpinInit
#define SCSpinInit
Definition: threads-debug.h:238
Packet_::next
struct Packet_ * next
Definition: decode.h:618
Packet_::root
struct Packet_ * root
Definition: decode.h:636
PacketAlerts_::suppressed
uint16_t suppressed
Definition: decode.h:275
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:594
Packet_::recursion_level
uint8_t recursion_level
Definition: decode.h:509
PktVarFree
void PktVarFree(PktVar *pv)
Definition: pkt-var.c:111
PacketDrop
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
Definition: packet.c:33
Packet_::drop_reason
uint8_t drop_reason
Definition: decode.h:630
Packet_::dst
Address dst
Definition: decode.h:489
SCPacketSetDatalink
void SCPacketSetDatalink(Packet *p, int datalink)
Set a packets data link type.
Definition: packet.c:177
Packet_::vlan_id
uint16_t vlan_id[VLAN_MAX_LAYERS]
Definition: decode.h:511
likely
#define likely(expr)
Definition: util-optimize.h:32
flow.h
PacketInit
void PacketInit(Packet *p)
Initialize a packet structure for use.
Definition: packet.c:63
Packet_::dp
Port dp
Definition: decode.h:499
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
Packet_::src
Address src
Definition: decode.h:488
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:292