aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

new registration functions for the stats api, with local thread storage for counter ids

Browse Source
remotes/origin/master-1.0.x
Anoop Saldanha 17 years ago committed by Victor Julien
parent d67eec918f
commit 244f5d547a
22 changed files with 480 additions and 270 deletions
Show Stats Download Patch File Download Diff File

197
src/counters.c
Unescape Escape View File

@ -201,16 +201,16 @@ void * PerfWakeupThread(void *arg)
*
* \param cname Counter name to be registered
* \param tm_name Thread module name
* \param tid Thread id running this module instance
* \param type Datatype of this counter variable
* \param desc Description of this counter
* \param pctx PerfContext for this tm-tv instance
* \param type_q Qualifier describing the counter to be registered
*
* \retval the counter id
*/
uint32_t PerfRegisterCounter(char *cname, char *tm_name, int type,
char *desc, PerfContext *pctx, int type_q,
int disp)
static u_int64_t PerfRegisterQualifiedCounter(char *cname, char *tm_name,
int type, char *desc,
PerfContext *pctx, int type_q)
{
PerfCounter **head = &pctx->head;
PerfCounter *temp = NULL;
@ -302,11 +302,91 @@ uint32_t PerfRegisterCounter(char *cname, char *tm_name, int type,
pc->type_q = type_q;
pc->disp = disp;
pc->disp = 1;
return pc->id;
}
u_int64_t PerfTVRegisterCounter(char *cname, struct ThreadVars_ *tv, int type,
char *desc)
{
return PerfRegisterQualifiedCounter(cname, tv->name, type, desc,
&tv->pctx, TYPE_Q_NORMAL);
}
u_int64_t PerfTVRegisterAvgCounter(char *cname, struct ThreadVars_ *tv,
int type, char *desc)
{
return PerfRegisterQualifiedCounter(cname, tv->name, type, desc,
&tv->pctx, TYPE_Q_AVERAGE);
}
u_int64_t PerfTVRegisterMaxCounter(char *cname, struct ThreadVars_ *tv,
int type, char *desc)
{
return PerfRegisterQualifiedCounter(cname, tv->name, type, desc,
&tv->pctx, TYPE_Q_MAXIMUM);
}
u_int64_t PerfRegisterCounter(char *cname, char *tm_name, int type, char *desc,
PerfContext *pctx)
{
return PerfRegisterQualifiedCounter(cname, tm_name, type, desc,
pctx, TYPE_Q_NORMAL);
}
u_int64_t PerfRegisterAvgCounter(char *cname, char *tm_name, int type,
char *desc, PerfContext *pctx)
{
return PerfRegisterQualifiedCounter(cname, tm_name, type, desc,
pctx, TYPE_Q_AVERAGE);
}
u_int64_t PerfRegisterMaxCounter(char *cname, char *tm_name, int type,
char *desc, PerfContext *pctx)
{
return PerfRegisterQualifiedCounter(cname, tm_name, type, desc,
pctx, TYPE_Q_MAXIMUM);
}
/**
* \brief Allows the user the set whether the counter identified with the id
* should be displayed or not in the output
*
* \param id Id of the counter
* \param pctx Pointer to the PerfContext in which the counter exists
* \param disp Holds a 0 or a non-zero value, based on whether the counter
* should be displayed or not in the output
*
* \retval 1 on success, 0 on failure
*/
int PerfCounterDisplay(u_int64_t id, PerfContext *pctx, int disp)
{
PerfCounter *pc = NULL;
if (pctx == NULL) {
#ifdef DEBUG
printf("pctx null inside PerfCounterDisplay\n");
#endif
return 0;
}
if ( (id < 1) || (id > pctx->curr_id) ) {
#ifdef DEBUG
printf("counter with the id %d doesn't exist in this tm instance", id);
#endif
return 0;
}
pc = pctx->head;
while(pc->id != id)
pc = pc->next;
pc->disp = (disp != 0);
return 1;
}
/**
* \brief Increments the local counter
*
@ -457,14 +537,14 @@ inline void PerfCounterSetUI64(uint64_t id, PerfCounterArray *pca,
if (pca->head[id].pc->type_q & TYPE_Q_MAXIMUM) {
if (x > pca->head[id].ui64_cnt)
pca->head[id].ui64_cnt = x;
} else if (pca->head[id].pc->type_q & TYPE_Q_NONE)
} else if (pca->head[id].pc->type_q & TYPE_Q_NORMAL)
pca->head[id].ui64_cnt = x;
break;
case TYPE_DOUBLE:
if (pca->head[id].pc->type_q & TYPE_Q_MAXIMUM) {
if (x > pca->head[id].d_cnt)
pca->head[id].d_cnt = x;
} else if (pca->head[id].pc->type_q & TYPE_Q_NONE)
} else if (pca->head[id].pc->type_q & TYPE_Q_NORMAL)
pca->head[id].d_cnt = x;
break;
}
@ -507,14 +587,14 @@ inline void PerfCounterSetDouble(uint64_t id, PerfCounterArray *pca,
if (pca->head[id].pc->type_q & TYPE_Q_MAXIMUM) {
if (x > pca->head[id].ui64_cnt)
pca->head[id].ui64_cnt = x;
} else if (pca->head[id].pc->type_q & TYPE_Q_NONE)
} else if (pca->head[id].pc->type_q & TYPE_Q_NORMAL)
pca->head[id].ui64_cnt = x;
break;
case TYPE_DOUBLE:
if (pca->head[id].pc->type_q & TYPE_Q_MAXIMUM) {
if (x > pca->head[id].d_cnt)
pca->head[id].d_cnt = x;
} else if (pca->head[id].pc->type_q & TYPE_Q_NONE)
} else if (pca->head[id].pc->type_q & TYPE_Q_NORMAL)
pca->head[id].d_cnt = x;
break;
}
@ -534,8 +614,10 @@ inline void PerfCounterSetDouble(uint64_t id, PerfCounterArray *pca,
*
* \param tm_name Name of the tm to be added to the table
* \param pctx PerfContext associated with the TM tm_name
*
* \retval 1 on success, 0 on failure
*/
void PerfAddToClubbedTMTable(char *tm_name, PerfContext *pctx)
int PerfAddToClubbedTMTable(char *tm_name, PerfContext *pctx)
{
PerfClubTMInst *pctmi = NULL;
PerfClubTMInst *prev = NULL;
@ -543,6 +625,13 @@ void PerfAddToClubbedTMTable(char *tm_name, PerfContext *pctx)
PerfContext **hpctx;
int i = 0;
if (tm_name == NULL || pctx == NULL) {
#ifdef DEBUG
printf("Supplied argument(s) to PerfAddToClubbedTMTable NULL\n");
#endif
return 0;
}
pthread_mutex_lock(&perf_op_ctx->pctmi_lock);
pctmi = perf_op_ctx->pctmi;
@ -575,7 +664,7 @@ void PerfAddToClubbedTMTable(char *tm_name, PerfContext *pctx)
prev->next = temp;
pthread_mutex_unlock(&perf_op_ctx->pctmi_lock);
return;
return 1;
}
hpctx = pctmi->head;
@ -584,7 +673,7 @@ void PerfAddToClubbedTMTable(char *tm_name, PerfContext *pctx)
continue;
pthread_mutex_unlock(&perf_op_ctx->pctmi_lock);
return;
return 1;
}
pctmi->head = realloc(pctmi->head, (pctmi->size + 1) *
@ -604,7 +693,7 @@ void PerfAddToClubbedTMTable(char *tm_name, PerfContext *pctx)
pthread_mutex_unlock(&perf_op_ctx->pctmi_lock);
return;
return 1;
}
@ -705,7 +794,7 @@ PerfCounterArray * PerfGetAllCountersArray(PerfContext *pctx)
*
* \retval 1 on success, 0 on failure
*/
int PerfUpdateCounter(char *cname, char *tm_name, uint32_t id, void *value,
int PerfUpdateCounter(char *cname, char *tm_name, u_int64_t id, void *value,
PerfContext *pctx)
{
PerfCounter *pc = NULL;
@ -1101,7 +1190,7 @@ void PerfReleasePCA(PerfCounterArray *pca)
}
//------------------------------------Unit_Tests------------------------------------
//------------------------------------Unit_Tests--------------------------------
static int PerfTestCounterReg01()
@ -1110,7 +1199,7 @@ static int PerfTestCounterReg01()
memset(&pctx, 0, sizeof(PerfContext));
return PerfRegisterCounter("t1", "c1", 5, NULL, &pctx, TYPE_Q_NONE, 1);
return PerfRegisterCounter("t1", "c1", 5, NULL, &pctx);
}
static int PerfTestCounterReg02()
@ -1119,8 +1208,7 @@ static int PerfTestCounterReg02()
memset(&pctx, 0, sizeof(PerfContext));
return PerfRegisterCounter(NULL, NULL, TYPE_UINT64, NULL, &pctx,
TYPE_Q_NONE, 1);
return PerfRegisterCounter(NULL, NULL, TYPE_UINT64, NULL, &pctx);
}
static int PerfTestCounterReg03()
@ -1130,8 +1218,7 @@ static int PerfTestCounterReg03()
memset(&pctx, 0, sizeof(PerfContext));
result = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &pctx,
TYPE_Q_NONE, 1);
result = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &pctx);
PerfReleasePerfCounterS(pctx.head);
@ -1145,12 +1232,11 @@ static int PerfTestCounterReg04()
memset(&pctx, 0, sizeof(PerfContext));
PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &pctx);
PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &pctx);
PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &pctx);
result = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &pctx,
TYPE_Q_NONE, 1);
result = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &pctx);
PerfReleasePerfCounterS(pctx.head);
@ -1164,8 +1250,7 @@ static int PerfTestGetCntArray05()
memset(&tv, 0, sizeof(ThreadVars));
id = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
tv.pca = PerfGetAllCountersArray(NULL);
@ -1180,8 +1265,7 @@ static int PerfTestGetCntArray06()
memset(&tv, 0, sizeof(ThreadVars));
id = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
tv.pca = PerfGetAllCountersArray(&tv.pctx);
@ -1203,10 +1287,8 @@ static int PerfTestCntArraySize07()
pca = (PerfCounterArray *)&tv.pca;
PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx, TYPE_Q_NONE,
1);
PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx, TYPE_Q_NONE,
1);
PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx);
pca = PerfGetAllCountersArray(&tv.pctx);
@ -1230,8 +1312,7 @@ static int PerfTestUpdateCounter08()
memset(&tv, 0, sizeof(ThreadVars));
id = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
pca = PerfGetAllCountersArray(&tv.pctx);
@ -1255,16 +1336,11 @@ static int PerfTestUpdateCounter09()
memset(&tv, 0, sizeof(ThreadVars));
id1 = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
PerfRegisterCounter("t4", "c4", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id2 = PerfRegisterCounter("t5", "c5", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id1 = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx);
PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &tv.pctx);
PerfRegisterCounter("t4", "c4", TYPE_UINT64, NULL, &tv.pctx);
id2 = PerfRegisterCounter("t5", "c5", TYPE_UINT64, NULL, &tv.pctx);
pca = PerfGetAllCountersArray(&tv.pctx);
@ -1290,12 +1366,10 @@ static int PerfTestUpdateGlobalCounter10()
memset(&tv, 0, sizeof(ThreadVars));
id1 = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id2 = PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id3 = PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id1 = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
id2 = PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx);
id3 = PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &tv.pctx);
pca = PerfGetAllCountersArray(&tv.pctx);
PerfCounterIncr(id1, pca);
@ -1331,14 +1405,10 @@ static int PerfTestCounterValues11()
memset(&tv, 0, sizeof(ThreadVars));
id1 = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id2 = PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id3 = PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id4 = PerfRegisterCounter("t4", "c4", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_NONE, 1);
id1 = PerfRegisterCounter("t1", "c1", TYPE_UINT64, NULL, &tv.pctx);
id2 = PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx);
id3 = PerfRegisterCounter("t3", "c3", TYPE_UINT64, NULL, &tv.pctx);
id4 = PerfRegisterCounter("t4", "c4", TYPE_UINT64, NULL, &tv.pctx);
pca = PerfGetAllCountersArray(&tv.pctx);
@ -1391,10 +1461,8 @@ static int PerfTestAverageQual12()
memset(&tv, 0, sizeof(ThreadVars));
id1 = PerfRegisterCounter("t1", "c1", TYPE_DOUBLE, NULL, &tv.pctx,
TYPE_Q_AVERAGE, 1);
id2 = PerfRegisterCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx,
TYPE_Q_AVERAGE, 1);
id1 = PerfRegisterAvgCounter("t1", "c1", TYPE_DOUBLE, NULL, &tv.pctx);
id2 = PerfRegisterAvgCounter("t2", "c2", TYPE_UINT64, NULL, &tv.pctx);
pca = PerfGetAllCountersArray(&tv.pctx);
@ -1442,8 +1510,7 @@ static int PerfTestMaxQual13()
memset(&tv, 0, sizeof(ThreadVars));
id1 = PerfRegisterCounter("t1", "c1", TYPE_DOUBLE, NULL, &tv.pctx,
TYPE_Q_MAXIMUM, 1);
id1 = PerfRegisterMaxCounter("t1", "c1", TYPE_DOUBLE, NULL, &tv.pctx);
p = tv.pctx.head->value->cvalue;

48
src/counters.h
Unescape Escape View File

@ -5,6 +5,8 @@
#ifndef __COUNTERS_H__
#define __COUNTERS_H__
/* forward declaration of the ThreadVars structure */
struct ThreadVars_;
/* Time interval for syncing the local counters with the global ones */
#define WUT_TTS 3
@ -21,7 +23,7 @@ enum {
/* Qualifier for the counter */
enum {
TYPE_Q_NONE = 0x01,
TYPE_Q_NORMAL = 0x01,
TYPE_Q_AVERAGE = 0x02,
TYPE_Q_MAXIMUM = 0x04,
TYPE_Q_TIMEBASED = 0x08,
@ -36,20 +38,20 @@ enum {
IFACE_SYSLOG,
};
typedef struct _PerfCounterName {
typedef struct PerfCounterName_ {
char *cname;
char *tm_name;
pthread_t tid;
} PerfCounterName;
typedef struct _PerfCounterValue {
typedef struct PerfCounterValue_ {
void *cvalue;
uint32_t size;
uint32_t type;
} PerfCounterValue;
/* Container to hold the counter variable */
typedef struct _PerfCounter {
typedef struct PerfCounter_ {
PerfCounterName *name;
PerfCounterValue *value;
@ -68,11 +70,11 @@ typedef struct _PerfCounter {
int type_q;
/* the next perfcounter for this tv's tm instance */
struct _PerfCounter *next;
struct PerfCounter_ *next;
} PerfCounter;
/* Holds the Perf Context for a ThreadVars instance */
typedef struct _PerfContext {
typedef struct PerfContext_ {
PerfCounter *head;
/* flag set by the wakeup thread, to inform the client threads to sync */
@ -84,7 +86,7 @@ typedef struct _PerfContext {
} PerfContext;
/* PerfCounterArray(PCA) Node*/
typedef struct _PCAElem {
typedef struct PCAElem_ {
PerfCounter *pc;
uint64_t id;
union {
@ -100,7 +102,7 @@ typedef struct _PCAElem {
} PCAElem;
/* The PerfCounterArray */
typedef struct _PerfCounterArray {
typedef struct PerfCounterArray_ {
/* points to the array holding PCAElems */
PCAElem *head;
@ -110,17 +112,17 @@ typedef struct _PerfCounterArray {
/* Holds multiple instances of the same TM together, used when the stats
* have to be clubbed based on TM, before being sent out*/
typedef struct _PerfClubTMInst {
typedef struct PerfClubTMInst_ {
char *tm_name;
PerfContext **head;
uint32_t size;
struct _PerfClubTMInst *next;
struct PerfClubTMInst_ *next;
} PerfClubTMInst;
/* Holds the output interface context for the counter api */
typedef struct _PerfOPIfaceContext {
typedef struct PerfOPIfaceContext_ {
uint32_t iface;
char *file;
@ -143,8 +145,23 @@ void * PerfMgmtThread(void *);
void * PerfWakeupThread(void *);
uint32_t PerfRegisterCounter(char *, char *, int, char *, PerfContext *, int,
int);
u_int64_t PerfTVRegisterCounter(char *, struct ThreadVars_ *, int, char *);
u_int64_t PerfTVRegisterAvgCounter(char *, struct ThreadVars_ *, int, char *);
u_int64_t PerfTVRegisterMaxCounter(char *, struct ThreadVars_ *, int, char *);
u_int64_t PerfTVRegisterIntervalCounter(char *, struct ThreadVars_ *, int, char *);
u_int64_t PerfRegisterCounter(char *, char *, int, char *, PerfContext *);
u_int64_t PerfRegisterAvgCounter(char *, char *, int, char *, PerfContext *);
u_int64_t PerfRegisterMaxCounter(char *, char *, int, char *, PerfContext *);
u_int64_t PerfRegisterIntervalCounter(char *, char *, int, char *, PerfContext *);
int PerfCounterDisplay(u_int64_t, PerfContext *, int);
inline void PerfCounterIncr(uint64_t, PerfCounterArray *);
@ -156,7 +173,7 @@ inline void PerfCounterSetUI64(uint64_t, PerfCounterArray *, uint64_t);
inline void PerfCounterSetDouble(uint64_t, PerfCounterArray *, double);
void PerfAddToClubbedTMTable(char *, PerfContext *);
int PerfAddToClubbedTMTable(char *, PerfContext *);
PerfCounterArray * PerfGetCounterArrayRange(uint32_t, uint32_t,
PerfContext *);
@ -164,8 +181,7 @@ PerfCounterArray * PerfGetCounterArrayRange(uint32_t, uint32_t,
PerfCounterArray * PerfGetAllCountersArray(PerfContext *);
int PerfUpdateCounter(char *, char *, uint32_t, void *,
PerfContext *);
int PerfUpdateCounter(char *, char *, uint64_t, void *, PerfContext *);
int PerfUpdateCounterArray(PerfCounterArray *, PerfContext *, int);

17
src/decode-ethernet.c
Unescape Escape View File

@ -4,9 +4,12 @@
#include "decode-ethernet.h"
#include "decode-events.h"
void DecodeEthernet(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
void DecodeEthernet(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
PacketQueue *pq, void *data)
{
PerfCounterIncr(COUNTER_DECODER_ETH, t->pca);
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_eth, t->pca);
if (len < ETHERNET_HEADER_LEN) {
DECODER_SET_EVENT(p,ETHERNET_PKT_TOO_SMALL);
@ -23,14 +26,16 @@ void DecodeEthernet(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, Packet
if (ntohs(ethh->eth_type) == ETHERNET_TYPE_IP) {
//printf("DecodeEthernet ip4\n");
DecodeIPV4(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN, pq);
DecodeIPV4(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN,
pq, data);
} else if(ntohs(ethh->eth_type) == ETHERNET_TYPE_IPV6) {
//printf("DecodeEthernet ip6\n");
DecodeIPV6(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN);
DecodeIPV6(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN,
data);
} else if(ntohs(ethh->eth_type) == ETHERNET_TYPE_PPPoE_SESS) {
//printf("DecodeEthernet PPPoE\n");
PerfCounterIncr(COUNTER_DECODER_PPPOE, t->pca);
DecodePPPoE(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN, pq);
DecodePPPoE(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN,
pq, data);
}
return;

25
src/decode-icmpv4.c
Unescape Escape View File

@ -8,11 +8,14 @@
/** DecodeICMPV4
* \brief Main ICMPv4 decoding function
*/
void DecodeICMPV4(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
void DecodeICMPV4(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
void *data)
{
p->icmpv4h = (ICMPV4Hdr *)pkt;
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_icmpv4, t->pca);
PerfCounterIncr(COUNTER_DECODER_ICMPV4, t->pca);
p->icmpv4h = (ICMPV4Hdr *)pkt;
if (len < ICMPV4_HEADER_LEN) {
return;
@ -43,11 +46,13 @@ static int DecodeICMPV4test01(void) {
0xab };
Packet p;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4));
DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4), &dtv);
return 0;
}
@ -66,11 +71,13 @@ static int DecodeICMPV4test02(void) {
0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f };
Packet p;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4));
DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4), &dtv);
return 0;
}
@ -87,11 +94,13 @@ static int DecodeICMPV4test03(void) {
0x00, 0x28, 0x7c, 0xdd };
Packet p;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4));
DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4), &dtv);
return 0;
}
@ -110,11 +119,13 @@ static int DecodeICMPV4test04(void) {
0x02, 0x04, 0x05, 0x8a, 0x04, 0x02, 0x08, 0x0a };
Packet p;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4));
DecodeICMPV4(&tv, &p, raw_icmpv4, sizeof(raw_icmpv4), &dtv);
return 0;
}

9
src/decode-icmpv6.c
Unescape Escape View File

@ -4,11 +4,14 @@
#include "decode.h"
#include "decode-icmpv6.h"
void DecodeICMPV6(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
void DecodeICMPV6(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
void *data)
{
p->icmpv6h = (ICMPV6Hdr *)pkt;
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_icmpv6, t->pca);
PerfCounterIncr(COUNTER_DECODER_ICMPV6, t->pca);
p->icmpv6h = (ICMPV6Hdr *)pkt;
if (len < ICMPV6_HEADER_LEN) {
return;

20
src/decode-ipv4.c
Unescape Escape View File

@ -54,11 +54,13 @@ static int DecodeIPV4Packet(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len
return 0;
}
void DecodeIPV4(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
void DecodeIPV4(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
PacketQueue *pq, void *data)
{
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
int ret;
PerfCounterIncr(COUNTER_DECODER_IPV4, t->pca);
PerfCounterIncr(dtv->counter_ipv4, t->pca);
/* reset the decoder cache flags */
IPV4_CACHE_INIT(p);
@ -93,19 +95,23 @@ void DecodeIPV4(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueu
case IPPROTO_IP:
/* check PPP VJ uncompressed packets and decode tcp dummy */
if(p->ppph != NULL && ntohs(p->ppph->protocol) == PPP_VJ_UCOMP) {
return(DecodeTCP(t, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p)));
return(DecodeTCP(t, p, pkt + IPV4_GET_HLEN(p),
IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), data));
}
break;
case IPPROTO_TCP:
return(DecodeTCP(t, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p)));
return(DecodeTCP(t, p, pkt + IPV4_GET_HLEN(p),
IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), data));
break;
case IPPROTO_UDP:
//printf("DecodeIPV4: next layer is UDP\n");
return(DecodeUDP(t, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p)));
return(DecodeUDP(t, p, pkt + IPV4_GET_HLEN(p),
IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), data));
break;
case IPPROTO_ICMP:
//printf("DecodeIPV4: next layer is ICMP\n");
return(DecodeICMPV4(t, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p)));
return(DecodeICMPV4(t, p, pkt + IPV4_GET_HLEN(p),
IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p), data));
break;
case IPPROTO_IPV6:
{
@ -118,7 +124,7 @@ void DecodeIPV4(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueu
//printf("DecodeIPV4: tunnel is tp %p\n", tp);
/* send that to the Tunnel decoder */
DecodeTunnel(t, tp, tp->pkt, tp->pktlen, pq);
DecodeTunnel(t, tp, tp->pkt, tp->pktlen, pq, data);
/* add the tp to the packet queue. */
PacketEnqueue(pq,tp);

27
src/decode-ipv6.c
Unescape Escape View File

@ -10,7 +10,8 @@
#define IPV6_EH_CNT ip6eh.ip6_exthdrs_cnt
static void
DecodeIPV6ExtHdrs(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
DecodeIPV6ExtHdrs(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
void *data)
{
uint8_t *orig_pkt = pkt;
uint8_t nh;
@ -31,17 +32,17 @@ DecodeIPV6ExtHdrs(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
{
case IPPROTO_TCP:
IPV6_SET_L4PROTO(p,nh);
DecodeTCP(t, p, pkt, plen);
DecodeTCP(t, p, pkt, plen, data);
return;
case IPPROTO_UDP:
IPV6_SET_L4PROTO(p,nh);
DecodeUDP(t, p, pkt, plen);
DecodeUDP(t, p, pkt, plen, data);
return;
case IPPROTO_ICMPV6:
IPV6_SET_L4PROTO(p,nh);
DecodeICMPV6(t, p, pkt, plen);
DecodeICMPV6(t, p, pkt, plen, data);
return;
case IPPROTO_ROUTING:
@ -360,11 +361,13 @@ static int DecodeIPV6Packet (ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t le
return 0;
}
void DecodeIPV6(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
void DecodeIPV6(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
void *data)
{
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
int ret;
PerfCounterIncr(COUNTER_DECODER_IPV6, t->pca);
PerfCounterIncr(dtv->counter_ipv6, t->pca);
IPV6_CACHE_INIT(p);
@ -386,13 +389,16 @@ void DecodeIPV6(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
/* now process the Ext headers and/or the L4 Layer */
switch(IPV6_GET_NH(p)) {
case IPPROTO_TCP:
return(DecodeTCP(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p)));
return(DecodeTCP(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p),
data));
break;
case IPPROTO_UDP:
return(DecodeUDP(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p)));
return(DecodeUDP(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p),
data));
break;
case IPPROTO_ICMPV6:
return(DecodeICMPV6(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p)));
return(DecodeICMPV6(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p),
data));
break;
case IPPROTO_FRAGMENT:
case IPPROTO_HOPOPTS:
@ -401,7 +407,8 @@ void DecodeIPV6(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
case IPPROTO_DSTOPTS:
case IPPROTO_AH:
case IPPROTO_ESP:
DecodeIPV6ExtHdrs(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
DecodeIPV6ExtHdrs(t, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p),
data);
break;
}

31
src/decode-ppp.c
Unescape Escape View File

@ -11,9 +11,12 @@
#include "util-unittest.h"
void DecodePPP(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
void DecodePPP(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
PacketQueue *pq, void *data)
{
PerfCounterIncr(COUNTER_DECODER_PPP, t->pca);
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_ppp, t->pca);
if(len < PPP_HEADER_LEN) {
DECODER_SET_EVENT(p,PPP_PKT_TOO_SMALL);
@ -69,7 +72,8 @@ void DecodePPP(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue
}
if(IPV4_GET_RAW_VER((IPV4Hdr *)(pkt + PPP_HEADER_LEN)) == 4) {
DecodeIPV4(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, pq );
DecodeIPV4(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, pq,
data);
}
break;
@ -79,7 +83,8 @@ void DecodePPP(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue
return;
}
DecodeIPV4(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, pq );
DecodeIPV4(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, pq,
data);
break;
/* PPP IPv6 was not tested */
@ -89,7 +94,7 @@ void DecodePPP(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue
return;
}
DecodeIPV6(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN);
DecodeIPV6(t, p, pkt + PPP_HEADER_LEN, len - PPP_HEADER_LEN, data);
break;
default:
@ -113,11 +118,13 @@ static int DecodePPPtest01 (void) {
uint8_t raw_ppp[] = { 0xff, 0x03, 0x00, 0x21, 0x45, 0xc0, 0x00 };
Packet p;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL);
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL, &dtv);
/* Function my returns here with expected value */
@ -140,11 +147,13 @@ static int DecodePPPtest02 (void) {
0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 };
Packet p;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL);
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL, &dtv);
/* Function must returns here */
@ -169,13 +178,15 @@ static int DecodePPPtest03 (void) {
0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 };
Packet p;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
FlowInitConfig(FLOW_QUIET);
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL);
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL, &dtv);
FlowShutdown();
@ -217,13 +228,15 @@ static int DecodePPPtest04 (void) {
0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 };
Packet p;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
FlowInitConfig(FLOW_QUIET);
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL);
DecodePPP(&tv, &p, raw_ppp, sizeof(raw_ppp), NULL, &dtv);
FlowShutdown();

19
src/decode-pppoe.c
Unescape Escape View File

@ -19,9 +19,12 @@
/**
* \brief Main decoding function for PPPoE packets
*/
void DecodePPPoE(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
void DecodePPPoE(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len,
PacketQueue *pq, void *data)
{
PerfCounterIncr(COUNTER_DECODER_PPPOE, t->pca);
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_pppoe, t->pca);
if (len < PPPOE_HEADER_LEN) {
DECODER_SET_EVENT(p, PPPOE_PKT_TOO_SMALL);
@ -39,8 +42,8 @@ void DecodePPPoE(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQue
if (ntohs(p->pppoeh->pppoe_length) > 0) {
/* decode contained PPP packet */
PerfCounterIncr(COUNTER_DECODER_PPP, t->pca);
DecodePPP(t, p, pkt + PPPOE_HEADER_LEN, len - PPPOE_HEADER_LEN, pq);
DecodePPP(t, p, pkt + PPPOE_HEADER_LEN, len - PPPOE_HEADER_LEN, pq,
data);
}
}
@ -57,11 +60,13 @@ static int DecodePPPoEtest01 (void) {
uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x00, 0x00 };
Packet p;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodePPPoE(&tv, &p, raw_pppoe, sizeof(raw_pppoe), NULL);
DecodePPPoE(&tv, &p, raw_pppoe, sizeof(raw_pppoe), NULL, &dtv);
if(DECODER_ISSET_EVENT(&p,PPPOE_PKT_TOO_SMALL)) {
return 1;
@ -95,11 +100,13 @@ static int DecodePPPoEtest02 (void) {
Packet p;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodePPPoE(&tv, &p, raw_pppoe, sizeof(raw_pppoe), NULL);
DecodePPPoE(&tv, &p, raw_pppoe, sizeof(raw_pppoe), NULL, &dtv);
if(DECODER_ISSET_EVENT(&p,PPPOE_PKT_TOO_SMALL)) {
return 1;

11
src/decode-sll.c
Unescape Escape View File

@ -4,9 +4,12 @@
#include "decode-sll.h"
#include "decode-events.h"
void DecodeSll(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
void DecodeSll(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
PacketQueue *pq, void *data)
{
PerfCounterIncr(COUNTER_DECODER_SLL, t->pca);
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_sll, t->pca);
if (len < SLL_HEADER_LEN) {
DECODER_SET_EVENT(p,SLL_PKT_TOO_SMALL);
@ -23,10 +26,10 @@ void DecodeSll(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue
if (ntohs(sllh->sll_protocol) == ETHERNET_TYPE_IP) {
//printf("DecodeSll ip4\n");
DecodeIPV4(t, p, pkt + SLL_HEADER_LEN, len - SLL_HEADER_LEN, pq);
DecodeIPV4(t, p, pkt + SLL_HEADER_LEN, len - SLL_HEADER_LEN, pq, data);
} else if(ntohs(sllh->sll_protocol) == ETHERNET_TYPE_IPV6) {
//printf("DecodeSll ip6\n");
DecodeIPV6(t, p, pkt + SLL_HEADER_LEN, len - SLL_HEADER_LEN);
DecodeIPV6(t, p, pkt + SLL_HEADER_LEN, len - SLL_HEADER_LEN, data);
}
}

7
src/decode-tcp.c
Unescape Escape View File

@ -135,9 +135,12 @@ static int DecodeTCPPacket(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
return 0;
}
void DecodeTCP(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
void DecodeTCP(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
void *data)
{
PerfCounterIncr(COUNTER_DECODER_TCP, t->pca);
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_tcp, t->pca);
if (DecodeTCPPacket(t, p,pkt,len) < 0)
return;

7
src/decode-udp.c
Unescape Escape View File

@ -37,9 +37,12 @@ static int DecodeUDPPacket(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
return 0;
}
void DecodeUDP(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
void DecodeUDP(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
void *data)
{
PerfCounterIncr(COUNTER_DECODER_UDP, t->pca);
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_udp, t->pca);
if (DecodeUDPPacket(t, p,pkt,len) < 0)
return;

9
src/decode.c
Unescape Escape View File

@ -5,15 +5,18 @@
#include "eidps-common.h"
#include "decode.h"
void DecodeTunnel(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
void DecodeTunnel(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len,
PacketQueue *pq, void *data)
{
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
switch (p->tunnel_proto) {
case IPPROTO_IP:
return DecodeIPV4(t, p, pkt, len, pq);
return DecodeIPV4(t, p, pkt, len, pq, data);
break;
case IPPROTO_IPV6:
//printf("DecodeTunnel: IPv6 packet\n");
return DecodeIPV6(t, p, pkt, len);
return DecodeIPV6(t, p, pkt, len, data);
break;
default:
printf("FIXME: DecodeTunnel: protocol %" PRIu32 " not supported.\n", p->tunnel_proto);

51
src/decode.h
Unescape Escape View File

@ -299,6 +299,27 @@ typedef struct PacketQueue_ {
#endif /* DBG_PERF */
} PacketQueue;
/* Generic structure to hold user data for all decode modules */
typedef struct DecodeThreadVars_
{
/* counters */
u_int64_t counter_pkts;
u_int64_t counter_bytes;
u_int64_t counter_ipv4;
u_int64_t counter_ipv6;
u_int64_t counter_eth;
u_int64_t counter_sll;
u_int64_t counter_tcp;
u_int64_t counter_udp;
u_int64_t counter_icmpv4;
u_int64_t counter_icmpv6;
u_int64_t counter_ppp;
u_int64_t counter_pppoe;
u_int64_t counter_avg_pkt_size;
u_int64_t counter_max_pkt_size;
ThreadVars *tv;
} DecodeThreadVars;
/* clear key vars so we don't need to call the expensive
* memset or bzero
@ -376,18 +397,24 @@ typedef struct PacketQueue_ {
/* decoder functions */
void DecodeEthernet(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
void DecodeSll(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
void DecodePPP(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
void DecodePPPoE(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
void DecodeTunnel(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
void DecodeIPV4(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
void DecodeIPV6(ThreadVars *, Packet *, uint8_t *, uint16_t);
void DecodeICMPV4(ThreadVars *, Packet *, uint8_t *, uint16_t);
void DecodeICMPV6(ThreadVars *, Packet *, uint8_t *, uint16_t);
void DecodeTCP(ThreadVars *, Packet *, uint8_t *, uint16_t);
void DecodeUDP(ThreadVars *, Packet *, uint8_t *, uint16_t);
void DecodeHTTP(ThreadVars *, Packet *, uint8_t *, uint16_t);
void DecodeEthernet(ThreadVars *, Packet *, u_int8_t *, u_int16_t,
PacketQueue *, void *);
void DecodeSll(ThreadVars *, Packet *, u_int8_t *, u_int16_t, PacketQueue *,
void *);
void DecodePPP(ThreadVars *, Packet *, u_int8_t *, u_int16_t, PacketQueue *,
void *);
void DecodePPPoE(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *,
void *);
void DecodeTunnel(ThreadVars *, Packet *, u_int8_t *, u_int16_t, PacketQueue *,
void *);
void DecodeIPV4(ThreadVars *, Packet *, u_int8_t *, u_int16_t, PacketQueue *,
void *);
void DecodeIPV6(ThreadVars *, Packet *, u_int8_t *, u_int16_t, void *);
void DecodeICMPV4(ThreadVars *, Packet *, u_int8_t *, u_int16_t, void *);
void DecodeICMPV6(ThreadVars *, Packet *, u_int8_t *, u_int16_t, void *);
void DecodeTCP(ThreadVars *, Packet *, u_int8_t *, u_int16_t, void *);
void DecodeUDP(ThreadVars *, Packet *, u_int8_t *, u_int16_t, void *);
void DecodeHTTP(ThreadVars *, Packet *, u_int8_t *, u_int16_t);
Packet *SetupPkt (void);
Packet *TunnelPktSetup(ThreadVars *, Packet *, uint8_t *, uint16_t, uint8_t);

7
src/detect-engine-mpm.c
Unescape Escape View File

@ -839,6 +839,13 @@ int PatternMatcherThreadInit(ThreadVars *t, void *initdata, void **data) {
/* IP-ONLY */
DetectEngineIPOnlyThreadInit(de_ctx,&pmt->io_ctx);
pmt->counter_alerts = PerfTVRegisterCounter("detect.alert", t, TYPE_UINT64,
"NULL");
t->pca = PerfGetAllCountersArray(&t->pctx);
PerfAddToClubbedTMTable(t->name, &t->pctx);
*data = (void *)pmt;
//printf("PatternMatcherThreadInit: data %p pmt %p\n", *data, pmt);
return 0;

9
src/detect.c
Unescape Escape View File

@ -581,20 +581,13 @@ int Detect(ThreadVars *t, Packet *p, void *data, PacketQueue *pq) {
return 0;
}
// PerfCounterIncr(COUNTER_DETECT_ALERTS, t->pca);
// PerfCounterIncr(pmt->counter_alerts, t->pca);
return 1;
}
int DetectThreadInit(ThreadVars *t, void *initdata, void **data)
{
PerfRegisterCounter("detect.alert", "Detect", TYPE_UINT64, "NULL",
&t->pctx, TYPE_Q_NONE, 1);
t->pca = PerfGetAllCountersArray(&t->pctx);
PerfAddToClubbedTMTable("Detect", &t->pctx);
return PatternMatcherThreadInit(t,initdata,data);
}

2
src/detect.h
Unescape Escape View File

@ -178,6 +178,8 @@ typedef struct PatternMatcherThread_ {
uint32_t pkts_uri_scanned4;
uint32_t pkts_uri_searched4;
u_int64_t counter_alerts;
DetectEngineIPOnlyThreadCtx io_ctx;
} PatternMatcherThread;

69
src/source-nfq.c
Unescape Escape View File

@ -455,6 +455,8 @@ int VerdictNFQ(ThreadVars *tv, Packet *p, void *data, PacketQueue *pq) {
*/
int DecodeNFQ(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
{
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
IPV4Hdr *ip4h = (IPV4Hdr *)p->pkt;
IPV6Hdr *ip6h = (IPV6Hdr *)p->pkt;
@ -462,15 +464,15 @@ int DecodeNFQ(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
printf("DecodeNFQ\n");
#endif
PerfCounterIncr(COUNTER_DECODER_PKTS, t->pca);
PerfCounterAddUI64(COUNTER_DECODER_BYTES, t->pca, p->pktlen);
PerfCounterIncr(dtv->counter_pkts, t->pca);
PerfCounterAddUI64(dtv->counter_bytes, t->pca, p->pktlen);
if (IPV4_GET_RAW_VER(ip4h) == 4) {
printf("DecodeNFQ ip4\n");
DecodeIPV4(t, p, p->pkt, p->pktlen, pq);
DecodeIPV4(t, p, p->pkt, p->pktlen, pq, data);
} else if(IPV6_GET_RAW_VER(ip6h) == 6) {
printf("DecodeNFQ ip6\n");
DecodeIPV6(t, p, p->pkt, p->pktlen);
DecodeIPV6(t, p, p->pkt, p->pktlen, data);
} else {
printf("DecodeNFQ %02x\n", *p->pkt);
}
@ -480,32 +482,45 @@ int DecodeNFQ(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
int DecodeNFQThreadInit(ThreadVars *tv, void *initdata, void **data)
{
PerfRegisterCounter("decoder.pkts", "DecodeNFQ", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.bytes", "DecodeNFQ", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ipv4", "DecodeNFQ", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ipv6", "DecodeNFQ", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ethernet", "DecodeNFQ", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.sll", "DecodeNFQ", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.tcp", "DecodeNFQ", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.udp", "DecodeNFQ", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.icmpv4", "DecodeNFQ", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.icmpv6", "DecodeNFQ", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ppp", "DecodeNFQ", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
DecodeThreadVars *dtv = NULL;
if ( (dtv = malloc(sizeof(DecodeThreadVars))) == NULL) {
printf("Error Allocating memory\n");
return -1;
}
memset(dtv, 0, sizeof(DecodeThreadVars));
dtv->tv = tv;
/* register counters */
dtv->counter_pkts = PerfTVRegisterCounter("decoder.pkts", tv,
TYPE_UINT64, "NULL");
dtv->counter_bytes = PerfTVRegisterCounter("decoder.bytes", tv,
TYPE_UINT64, "NULL");
dtv->counter_ipv4 = PerfTVRegisterCounter("decoder.ipv4", tv,
TYPE_UINT64, "NULL");
dtv->counter_ipv6 = PerfTVRegisterCounter("decoder.ipv6", tv,
TYPE_UINT64, "NULL");
dtv->counter_eth = PerfTVRegisterCounter("decoder.ethernet", tv,
TYPE_UINT64, "NULL");
dtv->counter_sll = PerfTVRegisterCounter("decoder.sll", tv,
TYPE_UINT64, "NULL");
dtv->counter_tcp = PerfTVRegisterCounter("decoder.tcp", tv,
TYPE_UINT64, "NULL");
dtv->counter_udp = PerfTVRegisterCounter("decoder.udp", tv,
TYPE_UINT64, "NULL");
dtv->counter_icmpv4 = PerfTVRegisterCounter("decoder.icmpv4", tv,
TYPE_UINT64, "NULL");
dtv->counter_icmpv6 = PerfTVRegisterCounter("decoder.icmpv6", tv,
TYPE_UINT64, "NULL");
dtv->counter_ppp = PerfTVRegisterCounter("decoder.ppp", tv,
TYPE_UINT64, "NULL");
tv->pca = PerfGetAllCountersArray(&tv->pctx);
PerfAddToClubbedTMTable("DecodeNFQ", &tv->pctx);
PerfAddToClubbedTMTable(tv->name, &tv->pctx);
*data = (void *)dtv;
return 0;
}

71
src/source-pcap-file.c
Unescape Escape View File

@ -33,7 +33,8 @@
typedef struct PcapFileGlobalVars_ {
pcap_t *pcap_handle;
void (*Decoder)(ThreadVars *, Packet *, uint8_t *, uint16_t, PacketQueue *);
void (*Decoder)(ThreadVars *, Packet *, u_int8_t *, u_int16_t,
PacketQueue *, void *);
} PcapFileGlobalVars;
typedef struct PcapFileThreadVars_
@ -171,42 +172,58 @@ int ReceivePcapFileThreadDeinit(ThreadVars *tv, void *data) {
int DecodePcapFile(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
{
PerfCounterIncr(COUNTER_DECODER_PKTS, t->pca);
PerfCounterAddUI64(COUNTER_DECODER_BYTES, t->pca, p->pktlen);
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_pkts, t->pca);
PerfCounterAddUI64(dtv->counter_bytes, t->pca, p->pktlen);
/* call the decoder */
pcap_g.Decoder(t,p,p->pkt,p->pktlen,pq);
pcap_g.Decoder(t, p, p->pkt, p->pktlen, pq, data);
return 0;
}
int DecodePcapFileThreadInit(ThreadVars *tv, void *initdata, void **data)
{
PerfRegisterCounter("decoder.pkts", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.bytes", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ipv4", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ipv6", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ethernet", "DecodePcapFile", TYPE_UINT64,
"NULL", &tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.sll", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.tcp", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.udp", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.icmpv4", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.icmpv6", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ppp", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
DecodeThreadVars *dtv = NULL;
if ( (dtv = malloc(sizeof(DecodeThreadVars))) == NULL) {
printf("Error Allocating memory\n");
return -1;
}
memset(dtv, 0, sizeof(DecodeThreadVars));
dtv->tv = tv;
/* register counters */
dtv->counter_pkts = PerfTVRegisterCounter("decoder.pkts", tv,
TYPE_UINT64, "NULL");
dtv->counter_bytes = PerfTVRegisterCounter("decoder.bytes", tv,
TYPE_UINT64, "NULL");
dtv->counter_ipv4 = PerfTVRegisterCounter("decoder.ipv4", tv,
TYPE_UINT64, "NULL");
dtv->counter_ipv6 = PerfTVRegisterCounter("decoder.ipv6", tv,
TYPE_UINT64, "NULL");
dtv->counter_eth = PerfTVRegisterCounter("decoder.ethernet", tv,
TYPE_UINT64, "NULL");
dtv->counter_sll = PerfTVRegisterCounter("decoder.sll", tv,
TYPE_UINT64, "NULL");
dtv->counter_tcp = PerfTVRegisterCounter("decoder.tcp", tv,
TYPE_UINT64, "NULL");
dtv->counter_udp = PerfTVRegisterCounter("decoder.udp", tv,
TYPE_UINT64, "NULL");
dtv->counter_icmpv4 = PerfTVRegisterCounter("decoder.icmpv4", tv,
TYPE_UINT64, "NULL");
dtv->counter_icmpv6 = PerfTVRegisterCounter("decoder.icmpv6", tv,
TYPE_UINT64, "NULL");
dtv->counter_ppp = PerfTVRegisterCounter("decoder.ppp", tv,
TYPE_UINT64, "NULL");
tv->pca = PerfGetAllCountersArray(&tv->pctx);
PerfAddToClubbedTMTable("DecodePcapFile", &tv->pctx);
PerfAddToClubbedTMTable(tv->name, &tv->pctx);
*data = (void *)dtv;
return 0;
}

88
src/source-pcap.c
Unescape Escape View File

@ -291,21 +291,24 @@ int ReceivePcapThreadDeinit(ThreadVars *tv, void *data) {
*/
int DecodePcap(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
{
PerfCounterIncr(COUNTER_DECODER_PKTS, t->pca);
PerfCounterAddUI64(COUNTER_DECODER_BYTES, t->pca, p->pktlen);
PerfCounterAddUI64(COUNTER_DECODER_AVG_PKT_SIZE, t->pca, p->pktlen);
PerfCounterSetUI64(COUNTER_DECODER_MAX_PKT_SIZE, t->pca, p->pktlen);
DecodeThreadVars *dtv = (DecodeThreadVars *)data;
PerfCounterIncr(dtv->counter_pkts, t->pca);
PerfCounterAddUI64(dtv->counter_bytes, t->pca, p->pktlen);
PerfCounterAddUI64(dtv->counter_avg_pkt_size, t->pca, p->pktlen);
PerfCounterSetUI64(dtv->counter_max_pkt_size, t->pca, p->pktlen);
/* call the decoder */
switch(p->pcap_v.datalink) {
case LINKTYPE_LINUX_SLL:
DecodeSll(t,p,p->pkt,p->pktlen,pq);
DecodeSll(t, p, p->pkt, p->pktlen, pq, data);
break;
case LINKTYPE_ETHERNET:
DecodeEthernet(t,p,p->pkt,p->pktlen,pq);
DecodeEthernet(t, p,p->pkt, p->pktlen, pq, data);
break;
case LINKTYPE_PPP:
DecodePPP(t,p,p->pkt,p->pktlen,pq);
DecodePPP(t, p, p->pkt, p->pktlen, pq, data);
break;
default:
printf("Error: datalink type %" PRId32 " not yet supported in module DecodePcap.\n", p->pcap_v.datalink);
@ -317,38 +320,51 @@ int DecodePcap(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
int DecodePcapThreadInit(ThreadVars *tv, void *initdata, void **data)
{
PerfRegisterCounter("decoder.pkts", "DecodePcap", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.bytes", "DecodePcap", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ipv4", "DecodePcap", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ipv6", "DecodePcap", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ethernet", "DecodePcap", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.sll", "DecodePcap", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.tcp", "DecodePcap", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.udp", "DecodePcap", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.icmpv4", "DecodePcap", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.icmpv6", "DecodePcap", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.ppp", "DecodePcap", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
PerfRegisterCounter("decoder.avg_pkt_size", "DecodePcap", TYPE_DOUBLE, "NULL",
&tv->pctx, TYPE_Q_AVERAGE, 1);
PerfRegisterCounter("decoder.max_pkt_size", "DecodePcap", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_MAXIMUM, 1);
PerfRegisterCounter("decoder.pppoe", "DecodePcap", TYPE_UINT64, "NULL",
&tv->pctx, TYPE_Q_NONE, 1);
DecodeThreadVars *dtv = NULL;
if ( (dtv = malloc(sizeof(DecodeThreadVars))) == NULL) {
printf("Error Allocating memory\n");
return -1;
}
memset(dtv, 0, sizeof(DecodeThreadVars));
dtv->tv = tv;
/* register counters */
dtv->counter_pkts = PerfTVRegisterCounter("decoder.pkts", tv,
TYPE_UINT64, "NULL");
dtv->counter_bytes = PerfTVRegisterCounter("decoder.bytes", tv,
TYPE_UINT64, "NULL");
dtv->counter_ipv4 = PerfTVRegisterCounter("decoder.ipv4", tv,
TYPE_UINT64, "NULL");
dtv->counter_ipv6 = PerfTVRegisterCounter("decoder.ipv6", tv,
TYPE_UINT64, "NULL");
dtv->counter_eth = PerfTVRegisterCounter("decoder.ethernet", tv,
TYPE_UINT64, "NULL");
dtv->counter_sll = PerfTVRegisterCounter("decoder.sll", tv,
TYPE_UINT64, "NULL");
dtv->counter_tcp = PerfTVRegisterCounter("decoder.tcp", tv,
TYPE_UINT64, "NULL");
dtv->counter_udp = PerfTVRegisterCounter("decoder.udp", tv,
TYPE_UINT64, "NULL");
dtv->counter_icmpv4 = PerfTVRegisterCounter("decoder.icmpv4", tv,
TYPE_UINT64, "NULL");
dtv->counter_icmpv6 = PerfTVRegisterCounter("decoder.icmpv6", tv,
TYPE_UINT64, "NULL");
dtv->counter_ppp = PerfTVRegisterCounter("decoder.ppp", tv,
TYPE_UINT64, "NULL");
dtv->counter_avg_pkt_size = PerfTVRegisterAvgCounter("decoder.avg_pkt_size", tv,
TYPE_DOUBLE, "NULL");
dtv->counter_max_pkt_size = PerfTVRegisterMaxCounter("decoder.max_pkt_size", tv,
TYPE_UINT64, "NULL");
dtv->counter_pppoe = PerfTVRegisterCounter("decoder.pppoe", tv, TYPE_UINT64,
"NULL");
tv->pca = PerfGetAllCountersArray(&tv->pctx);
PerfAddToClubbedTMTable("DecodePcap", &tv->pctx);
PerfAddToClubbedTMTable(tv->name, &tv->pctx);
*data = (void *)dtv;
return 0;
}

16
src/source-pcap.h
Unescape Escape View File

@ -11,22 +11,6 @@ void TmModuleDecodePcapRegister (void);
#define LIBPCAP_COPYWAIT 500
#define LIBPCAP_PROMISC 1
// The counter ids. In case you can't recollect the ids, use the counter name
#define COUNTER_DECODER_PKTS 1
#define COUNTER_DECODER_BYTES 2
#define COUNTER_DECODER_IPV4 3
#define COUNTER_DECODER_IPV6 4
#define COUNTER_DECODER_ETH 5
#define COUNTER_DECODER_SLL 6
#define COUNTER_DECODER_TCP 7
#define COUNTER_DECODER_UDP 8
#define COUNTER_DECODER_ICMPV4 9
#define COUNTER_DECODER_ICMPV6 10
#define COUNTER_DECODER_PPP 11
#define COUNTER_DECODER_AVG_PKT_SIZE 12
#define COUNTER_DECODER_MAX_PKT_SIZE 13
#define COUNTER_DECODER_PPPOE 14
/* per packet Pcap vars */
typedef struct PcapPacketVars_
{

10
src/stream-tcp.c
Unescape Escape View File

@ -54,6 +54,8 @@ static pthread_mutex_t ssn_pool_mutex;
typedef struct StreamTcpThread_ {
u_int64_t pkts;
u_int64_t counter_tcp_streams;
} StreamTcpThread;
void TmModuleStreamTcpRegister (void) {
@ -1205,7 +1207,7 @@ int StreamTcp (ThreadVars *tv, Packet *p, void *data, PacketQueue *pq)
{
StreamTcpThread *stt = (StreamTcpThread *)data;
//PerfCounterAddUI64(COUNTER_STREAMTCP_STREAMS, tv->pca, a);
// PerfCounterAddUI64(stt->counter_tcp_streams, tv->pca, a);
if (!(PKT_IS_TCP(p)))
return 0;
@ -1245,12 +1247,12 @@ int StreamTcpThreadInit(ThreadVars *t, void *initdata, void **data)
*data = (void *)stt;
PerfRegisterCounter("streamTcp.tcp_streams", "StreamTcp", TYPE_DOUBLE, "NULL",
&t->pctx, TYPE_Q_AVERAGE, 1);
stt->counter_tcp_streams = PerfTVRegisterAvgCounter("streamTcp.tcp_streams",
t, TYPE_DOUBLE, "NULL");
t->pca = PerfGetAllCountersArray(&t->pctx);
PerfAddToClubbedTMTable("StreamTcp", &t->pctx);
PerfAddToClubbedTMTable(t->name, &t->pctx);
return 0;
}

Write Preview
Loading…
Cancel
Save