suricata
packet.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2022 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 #include "packet.h"
19 #include "pkt-var.h"
20 #include "flow.h"
21 #include "host.h"
22 #include "util-profiling.h"
23 #include "util-validate.h"
24 #include "action-globals.h"
25 
26 /** \brief issue drop action
27  *
28  * Set drop (+reject) flags in both current and root packet.
29  *
30  * \param action action bit flags. Must be limited to ACTION_DROP_REJECT
31  */
32 void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
33 {
35 
37  p->drop_reason = (uint8_t)r;
38 
39  if (p->root) {
40  p->root->action |= action;
43  }
44  }
45  p->action |= action;
46 }
47 
48 bool PacketCheckAction(const Packet *p, const uint8_t a)
49 {
50  if (likely(p->root == NULL)) {
51  return (p->action & a) != 0;
52  } else {
53  /* check against both */
54  const uint8_t actions = p->action | p->root->action;
55  return (actions & a) != 0;
56  }
57 }
58 
59 /**
60  * \brief Initialize a packet structure for use.
61  */
63 {
67  p->livedev = NULL;
68 }
69 
71 {
72  FlowDeReference(&p->flow);
75 }
76 
77 /**
78  * \brief Recycle a packet structure for reuse.
79  */
81 {
82 /* clear the address structure by setting all fields to 0 */
83 #define CLEAR_ADDR(a) \
84  do { \
85  (a)->family = 0; \
86  (a)->addr_data32[0] = 0; \
87  (a)->addr_data32[1] = 0; \
88  (a)->addr_data32[2] = 0; \
89  (a)->addr_data32[3] = 0; \
90  } while (0)
91 
92  CLEAR_ADDR(&p->src);
93  CLEAR_ADDR(&p->dst);
94  p->sp = 0;
95  p->dp = 0;
96  p->proto = 0;
97  p->recursion_level = 0;
99  p->flags = 0;
100  p->flowflags = 0;
101  p->pkt_src = 0;
102  p->vlan_id[0] = 0;
103  p->vlan_id[1] = 0;
104  p->vlan_idx = 0;
105  p->ts.tv_sec = 0;
106  p->ts.tv_usec = 0;
107  p->datalink = 0;
108  p->drop_reason = 0;
109 #define PACKET_RESET_ACTION(p) (p)->action = 0
111  if (p->pktvar != NULL) {
112  PktVarFree(p->pktvar);
113  p->pktvar = NULL;
114  }
115  p->ethh = NULL;
116  if (p->ip4h != NULL) {
118  }
119  if (p->ip6h != NULL) {
121  }
122  if (p->tcph != NULL) {
123  CLEAR_TCP_PACKET(p);
124  }
125  if (p->udph != NULL) {
126  CLEAR_UDP_PACKET(p);
127  }
128  if (p->sctph != NULL) {
130  }
131  if (p->esph != NULL) {
132  CLEAR_ESP_PACKET(p);
133  }
134  if (p->icmpv4h != NULL) {
136  }
137  if (p->icmpv6h != NULL) {
139  }
140  p->ppph = NULL;
141  p->pppoesh = NULL;
142  p->pppoedh = NULL;
143  p->greh = NULL;
144  p->payload = NULL;
145  p->payload_len = 0;
146  p->BypassPacketsFlow = NULL;
147 #define RESET_PKT_LEN(p) ((p)->pktlen = 0)
148  RESET_PKT_LEN(p);
149  p->alerts.cnt = 0;
150  p->alerts.discarded = 0;
151  p->alerts.suppressed = 0;
152  p->alerts.drop.action = 0;
153  p->pcap_cnt = 0;
154  p->tunnel_rtv_cnt = 0;
155  p->tunnel_tpr_cnt = 0;
156  p->events.cnt = 0;
158  p->next = NULL;
159  p->prev = NULL;
160  p->root = NULL;
161  p->livedev = NULL;
164  p->tenant_id = 0;
165  p->nb_decoded_layers = 0;
166 }
167 
169 {
171  PacketReinit(p);
172 }
173 
174 /**
175  * \brief Cleanup a packet so that we can free it. No memset needed..
176  */
178 {
180  if (p->pktvar != NULL) {
181  PktVarFree(p->pktvar);
182  }
188 }
PacketCheckAction
bool PacketCheckAction(const Packet *p, const uint8_t a)
Definition: packet.c:48
HostDeReference
#define HostDeReference(src_h_ptr)
Definition: host.h:124
Packet_::greh
GREHdr * greh
Definition: decode.h:569
host.h
Packet_::proto
uint8_t proto
Definition: decode.h:450
SCSpinDestroy
#define SCSpinDestroy
Definition: threads-debug.h:239
Packet_::sctph
SCTPHdr * sctph
Definition: decode.h:557
PACKET_RESET_CHECKSUMS
#define PACKET_RESET_CHECKSUMS(p)
reset these to -1(indicates that the packet is fresh from the queue)
Definition: decode.h:766
Packet_::vlan_id
uint16_t vlan_id[2]
Definition: decode.h:455
Packet_::host_src
struct Host_ * host_src
Definition: decode.h:590
Packet_::pcap_cnt
uint64_t pcap_cnt
Definition: decode.h:594
Packet_::payload
uint8_t * payload
Definition: decode.h:573
PacketAlerts_::cnt
uint16_t cnt
Definition: decode.h:289
action-globals.h
Packet_::flags
uint32_t flags
Definition: decode.h:463
PacketRecycle
void PacketRecycle(Packet *p)
Definition: packet.c:168
Packet_::action
uint8_t action
Definition: decode.h:577
PacketAlertCreate
PacketAlert * PacketAlertCreate(void)
Initialize PacketAlerts with dynamic alerts array size.
Definition: decode.c:83
Packet_::vlan_idx
uint8_t vlan_idx
Definition: decode.h:456
RESET_PKT_LEN
#define RESET_PKT_LEN(p)
PacketReleaseRefs
void PacketReleaseRefs(Packet *p)
Definition: packet.c:70
PacketAlerts_::alerts
PacketAlert * alerts
Definition: decode.h:292
Packet_::pppoesh
PPPOESessionHdr * pppoesh
Definition: decode.h:566
AppLayerDecoderEventsFreeEvents
void AppLayerDecoderEventsFreeEvents(AppLayerDecoderEvents **events)
Definition: app-layer-events.c:132
PacketAlerts_::drop
PacketAlert drop
Definition: decode.h:295
ACTION_DROP_REJECT
#define ACTION_DROP_REJECT
Definition: action-globals.h:39
AppLayerDecoderEventsResetEvents
void AppLayerDecoderEventsResetEvents(AppLayerDecoderEvents *events)
Definition: app-layer-events.c:123
Packet_::host_dst
struct Host_ * host_dst
Definition: decode.h:591
Packet_::flowflags
uint8_t flowflags
Definition: decode.h:459
Packet_::BypassPacketsFlow
int(* BypassPacketsFlow)(struct Packet_ *)
Definition: decode.h:518
PacketDropReason
PacketDropReason
Definition: decode.h:390
CLEAR_ADDR
#define CLEAR_ADDR(a)
Packet_::payload_len
uint16_t payload_len
Definition: decode.h:574
CLEAR_ICMPV4_PACKET
#define CLEAR_ICMPV4_PACKET(p)
Definition: decode-icmpv4.h:224
Packet_::alerts
PacketAlerts alerts
Definition: decode.h:588
Packet_::tunnel_tpr_cnt
uint16_t tunnel_tpr_cnt
Definition: decode.h:627
Packet_::app_layer_events
AppLayerDecoderEvents * app_layer_events
Definition: decode.h:600
PacketAlertFree
void PacketAlertFree(PacketAlert *pa)
Definition: decode.c:91
Packet_::events
PacketEngineEvents events
Definition: decode.h:598
CLEAR_IPV6_PACKET
#define CLEAR_IPV6_PACKET(p)
Definition: decode-ipv6.h:111
PacketAlert_::action
uint8_t action
Definition: decode.h:265
Packet_::datalink
int datalink
Definition: decode.h:607
PacketReinit
void PacketReinit(Packet *p)
Recycle a packet structure for reuse.
Definition: packet.c:80
Packet_::pktvar
PktVar * pktvar
Definition: decode.h:521
Packet_::tunnel_lock
SCSpinlock tunnel_lock
Definition: decode.h:648
PKT_DROP_REASON_NOT_SET
@ PKT_DROP_REASON_NOT_SET
Definition: decode.h:391
Packet_::prev
struct Packet_ * prev
Definition: decode.h:604
PacketDestructor
void PacketDestructor(Packet *p)
Cleanup a packet so that we can free it. No memset needed..
Definition: packet.c:177
Packet_::tunnel_rtv_cnt
uint16_t tunnel_rtv_cnt
Definition: decode.h:625
Packet_::ethh
EthernetHdr * ethh
Definition: decode.h:524
pkt-var.h
Packet_::sp
Port sp
Definition: decode.h:435
CLEAR_ICMPV6_PACKET
#define CLEAR_ICMPV6_PACKET(p)
Definition: decode-icmpv6.h:186
PacketAlerts_::discarded
uint16_t discarded
Definition: decode.h:290
PACKET_RESET_ACTION
#define PACKET_RESET_ACTION(p)
util-profiling.h
Packet_::icmpv6h
ICMPV6Hdr * icmpv6h
Definition: decode.h:563
Packet_
Definition: decode.h:428
Packet_::ip4h
IPV4Hdr * ip4h
Definition: decode.h:531
Packet_::livedev
struct LiveDevice_ * livedev
Definition: decode.h:586
Packet_::persistent
struct Packet_::@41 persistent
Packet_::nb_decoded_layers
uint8_t nb_decoded_layers
Definition: decode.h:612
PACKET_FREE_EXTDATA
#define PACKET_FREE_EXTDATA(p)
Definition: decode.h:772
Packet_::ppph
PPPHdr * ppph
Definition: decode.h:565
Packet_::tenant_id
uint32_t tenant_id
Definition: decode.h:630
Packet_::flow
struct Flow_ * flow
Definition: decode.h:465
PKT_DROP_REASON_INNER_PACKET
@ PKT_DROP_REASON_INNER_PACKET
Definition: decode.h:405
Packet_::ts
struct timeval ts
Definition: decode.h:471
Packet_::tcph
TCPHdr * tcph
Definition: decode.h:553
packet.h
CLEAR_TCP_PACKET
#define CLEAR_TCP_PACKET(p)
Definition: decode-tcp.h:169
Packet_::icmpv4h
ICMPV4Hdr * icmpv4h
Definition: decode.h:561
util-validate.h
PACKET_PROFILING_RESET
#define PACKET_PROFILING_RESET(p)
Definition: util-profiling.h:181
SCSpinInit
#define SCSpinInit
Definition: threads-debug.h:238
Packet_::next
struct Packet_ * next
Definition: decode.h:603
Packet_::root
struct Packet_ * root
Definition: decode.h:618
PacketAlerts_::suppressed
uint16_t suppressed
Definition: decode.h:291
Packet_::pkt_src
uint8_t pkt_src
Definition: decode.h:579
Packet_::recursion_level
uint8_t recursion_level
Definition: decode.h:453
PktVarFree
void PktVarFree(PktVar *pv)
Definition: pkt-var.c:111
Packet_::pppoedh
PPPOEDiscoveryHdr * pppoedh
Definition: decode.h:567
PacketDrop
void PacketDrop(Packet *p, const uint8_t action, enum PacketDropReason r)
issue drop action
Definition: packet.c:32
Packet_::udph
UDPHdr * udph
Definition: decode.h:555
Packet_::drop_reason
uint8_t drop_reason
Definition: decode.h:615
Packet_::dst
Address dst
Definition: decode.h:433
CLEAR_UDP_PACKET
#define CLEAR_UDP_PACKET(p)
Definition: decode-udp.h:49
likely
#define likely(expr)
Definition: util-optimize.h:32
Packet_::ip6h
IPV6Hdr * ip6h
Definition: decode.h:533
flow.h
PacketInit
void PacketInit(Packet *p)
Initialize a packet structure for use.
Definition: packet.c:62
Packet_::dp
Port dp
Definition: decode.h:443
CLEAR_SCTP_PACKET
#define CLEAR_SCTP_PACKET(p)
Definition: decode-sctp.h:45
Packet_::esph
ESPHdr * esph
Definition: decode.h:559
CLEAR_ESP_PACKET
#define CLEAR_ESP_PACKET(p)
Definition: decode-esp.h:43
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
Packet_::src
Address src
Definition: decode.h:432
CLEAR_IPV4_PACKET
#define CLEAR_IPV4_PACKET(p)
Definition: decode-ipv4.h:151
PacketEngineEvents_::cnt
uint8_t cnt
Definition: decode.h:308