aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

pcap-file: prep codebase for pcap_cnt move refactor

Browse Source 
For an easier review process, this is a two-step change process,
in which pcap_cnt is first accessed by functions-to-be, implemented
as simple macros.

In the follow-up commit, the actual refactor is implemented with the new
function. The old macros are deleted.

Ticket: 7835
pull/14673/head
Lukas Sismis 7 months ago committed by Victor Julien
parent f33f6e7ee5
commit 400328c3c3
42 changed files with 266 additions and 214 deletions
Show Stats Download Patch File Download Diff File

10
plugins/ndpi/ndpi.c
Unescape Escape View File

@ -191,18 +191,18 @@ static int DetectnDPIProtocolPacketMatch(
/* /*
if (s->type == SIG_TYPE_PDONLY && if (s->type == SIG_TYPE_PDONLY &&
(p->flags & (PKT_PROTO_DETECT_TS_DONE | PKT_PROTO_DETECT_TC_DONE)) == 0) { (p->flags & (PKT_PROTO_DETECT_TS_DONE | PKT_PROTO_DETECT_TC_DONE)) == 0) {
SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt); SCLogDebug("packet %"PRIu64": flags not set", PcapPacketCntGet(p));
SCReturnInt(0); SCReturnInt(0);
} }
*/ */
if (!flowctx->detection_completed) { if (!flowctx->detection_completed) {
SCLogDebug("packet %" PRIu64 ": ndpi protocol not yet detected", p->pcap_cnt); SCLogDebug("packet %" PRIu64 ": ndpi protocol not yet detected", PcapPacketCntGet(p));
SCReturnInt(0); SCReturnInt(0);
} }
if (f == NULL) { if (f == NULL) {
SCLogDebug("packet %" PRIu64 ": no flow", p->pcap_cnt); SCLogDebug("packet %" PRIu64 ": no flow", PcapPacketCntGet(p));
SCReturnInt(0); SCReturnInt(0);
} }
@ -318,12 +318,12 @@ static int DetectnDPIRiskPacketMatch(
SCEnter(); SCEnter();
if (!flowctx->detection_completed) { if (!flowctx->detection_completed) {
SCLogDebug("packet %" PRIu64 ": ndpi risks not yet detected", p->pcap_cnt); SCLogDebug("packet %" PRIu64 ": ndpi risks not yet detected", PcapPacketCntGet(p));
SCReturnInt(0); SCReturnInt(0);
} }
if (f == NULL) { if (f == NULL) {
SCLogDebug("packet %" PRIu64 ": no flow", p->pcap_cnt); SCLogDebug("packet %" PRIu64 ": no flow", PcapPacketCntGet(p));
SCReturnInt(0); SCReturnInt(0);
} }

11
src/alert-debuglog.c
Unescape Escape View File

@ -167,8 +167,9 @@ static TmEcode AlertDebugLogger(ThreadVars *tv, const Packet *p, void *thread_da
MemBufferWriteString(aft->buffer, "+================\n" MemBufferWriteString(aft->buffer, "+================\n"
"TIME: %s\n", timebuf); "TIME: %s\n", timebuf);
if (p->pcap_cnt > 0) { uint64_t pcap_cnt = PcapPacketCntGet(p);
MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt); if (pcap_cnt > 0) {
MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %" PRIu64 "\n", pcap_cnt);
} }
pkt_src_str = PktSrcToString(p->pkt_src); pkt_src_str = PktSrcToString(p->pkt_src);
MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str); MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str);
@ -327,9 +328,9 @@ static TmEcode AlertDebugLogDecoderEvent(ThreadVars *tv, const Packet *p, void *
MemBufferWriteString(aft->buffer, MemBufferWriteString(aft->buffer,
"+================\n" "+================\n"
"TIME: %s\n", timebuf); "TIME: %s\n", timebuf);
if (p->pcap_cnt > 0) { uint64_t pcap_cnt = PcapPacketCntGet(p);
MemBufferWriteString(aft->buffer, if (pcap_cnt > 0) {
"PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt); MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %" PRIu64 "\n", pcap_cnt);
} }
pkt_src_str = PktSrcToString(p->pkt_src); pkt_src_str = PktSrcToString(p->pkt_src);
MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str); MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str);

7
src/alert-fastlog.c
Unescape Escape View File

@ -179,9 +179,10 @@ int AlertFastLogger(ThreadVars *tv, void *data, const Packet *p)
pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio); pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio);
PrintBufferRawLineHex(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, PrintBufferRawLineHex(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE,
GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32); GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32);
if (p->pcap_cnt != 0) { uint64_t pcap_cnt = PcapPacketCntGet(p);
PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, if (pcap_cnt != 0) {
"] [pcap file packet: %"PRIu64"]\n", p->pcap_cnt); PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE,
"] [pcap file packet: %" PRIu64 "]\n", pcap_cnt);
} else { } else {
PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, "]\n"); PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, "]\n");
} }

7
src/alert-syslog.c
Unescape Escape View File

@ -343,9 +343,10 @@ static TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, const Packet *p, void *da
PrintRawLineHexBuf(temp_buf_pkt, sizeof(temp_buf_pkt), GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32); PrintRawLineHexBuf(temp_buf_pkt, sizeof(temp_buf_pkt), GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32);
strlcat(alert, temp_buf_pkt, sizeof(alert)); strlcat(alert, temp_buf_pkt, sizeof(alert));
if (p->pcap_cnt != 0) { uint64_t pcap_cnt = PcapPacketCntGet(p);
snprintf(temp_buf_tail, sizeof(temp_buf_tail), "] [pcap file packet: %"PRIu64"]", if (pcap_cnt != 0) {
p->pcap_cnt); snprintf(temp_buf_tail, sizeof(temp_buf_tail), "] [pcap file packet: %" PRIu64 "]",
pcap_cnt);
} else { } else {
temp_buf_tail[0] = ']'; temp_buf_tail[0] = ']';
temp_buf_tail[1] = '\0'; temp_buf_tail[1] = '\0';

5
src/app-layer.c
Unescape Escape View File

@ -657,8 +657,9 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
AppLayerIncFlowCounter(tv, f); AppLayerIncFlowCounter(tv, f);
*alproto = *alproto_otherdir; *alproto = *alproto_otherdir;
SCLogDebug("packet %"PRIu64": pd done(us %u them %u), parser called (r==%d), APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION set", SCLogDebug("packet %" PRIu64 ": pd done(us %u them %u), parser called (r==%d), "
p->pcap_cnt, *alproto, *alproto_otherdir, r); "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION set",
PcapPacketCntGet(p), *alproto, *alproto_otherdir, r);
if (r < 0) { if (r < 0) {
goto parser_error; goto parser_error;
} }

8
src/decode.h
Unescape Escape View File

@ -1522,4 +1522,12 @@ static inline bool DecodeNetworkLayer(ThreadVars *tv, DecodeThreadVars *dtv,
return true; return true;
} }
// temporary macro to get pcap packet count to reduce the number of changes
// in the follow-up commit
#define PcapPacketCntGet(p) (p)->pcap_cnt
#define PcapPacketCntSet(p, cnt) \
do { \
(p)->pcap_cnt = (cnt); \
} while (0)
#endif /* SURICATA_DECODE_H */ #endif /* SURICATA_DECODE_H */

4
src/defrag-hash.c
Unescape Escape View File

@ -469,8 +469,8 @@ static void DefragExceptionPolicyStatsIncr(
static DefragTracker *DefragTrackerGetNew(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p) static DefragTracker *DefragTrackerGetNew(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
{ {
#ifdef DEBUG #ifdef DEBUG
if (g_eps_defrag_memcap != UINT64_MAX && g_eps_defrag_memcap == p->pcap_cnt) { if (g_eps_defrag_memcap != UINT64_MAX && g_eps_defrag_memcap == PcapPacketCntGet(p)) {
SCLogNotice("simulating memcap hit for packet %" PRIu64, p->pcap_cnt); SCLogNotice("simulating memcap hit for packet %" PRIu64, PcapPacketCntGet(p));
ExceptionPolicyApply(p, defrag_config.memcap_policy, PKT_DROP_REASON_DEFRAG_MEMCAP); ExceptionPolicyApply(p, defrag_config.memcap_policy, PKT_DROP_REASON_DEFRAG_MEMCAP);
DefragExceptionPolicyStatsIncr(tv, dtv, defrag_config.memcap_policy); DefragExceptionPolicyStatsIncr(tv, dtv, defrag_config.memcap_policy);
return NULL; return NULL;

2
src/defrag.c
Unescape Escape View File

@ -584,7 +584,7 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragTracker *tracker,
uint8_t ip6_nh_set_value = 0; uint8_t ip6_nh_set_value = 0;
#ifdef DEBUG #ifdef DEBUG
uint64_t pcap_cnt = p->pcap_cnt; uint64_t pcap_cnt = PcapPacketCntGet(p);
#endif #endif
if (tracker->af == AF_INET) { if (tracker->af == AF_INET) {

10
src/detect-app-layer-protocol.c
Unescape Escape View File

@ -65,13 +65,13 @@ static int DetectAppLayerProtocolPacketMatch(
/* if the sig is PD-only we only match when PD packet flags are set */ /* if the sig is PD-only we only match when PD packet flags are set */
if (s->type == SIG_TYPE_PDONLY && if (s->type == SIG_TYPE_PDONLY &&
(p->flags & (PKT_PROTO_DETECT_TS_DONE | PKT_PROTO_DETECT_TC_DONE)) == 0) { (p->flags & (PKT_PROTO_DETECT_TS_DONE | PKT_PROTO_DETECT_TC_DONE)) == 0) {
SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt); SCLogDebug("packet %" PRIu64 ": flags not set", PcapPacketCntGet(p));
SCReturnInt(0); SCReturnInt(0);
} }
const Flow *f = p->flow; const Flow *f = p->flow;
if (f == NULL) { if (f == NULL) {
SCLogDebug("packet %"PRIu64": no flow", p->pcap_cnt); SCLogDebug("packet %" PRIu64 ": no flow", PcapPacketCntGet(p));
SCReturnInt(0); SCReturnInt(0);
} }
@ -289,17 +289,17 @@ PrefilterPacketAppProtoMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const vo
const PrefilterPacketHeaderCtx *ctx = pectx; const PrefilterPacketHeaderCtx *ctx = pectx;
if (!PrefilterPacketHeaderExtraMatch(ctx, p)) { if (!PrefilterPacketHeaderExtraMatch(ctx, p)) {
SCLogDebug("packet %"PRIu64": extra match failed", p->pcap_cnt); SCLogDebug("packet %" PRIu64 ": extra match failed", PcapPacketCntGet(p));
SCReturn; SCReturn;
} }
if (p->flow == NULL) { if (p->flow == NULL) {
SCLogDebug("packet %"PRIu64": no flow, no alproto", p->pcap_cnt); SCLogDebug("packet %" PRIu64 ": no flow, no alproto", PcapPacketCntGet(p));
SCReturn; SCReturn;
} }
if ((p->flags & (PKT_PROTO_DETECT_TS_DONE|PKT_PROTO_DETECT_TC_DONE)) == 0) { if ((p->flags & (PKT_PROTO_DETECT_TS_DONE|PKT_PROTO_DETECT_TC_DONE)) == 0) {
SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt); SCLogDebug("packet %" PRIu64 ": flags not set", PcapPacketCntGet(p));
SCReturn; SCReturn;
} }

2
src/detect-config.c
Unescape Escape View File

@ -187,7 +187,7 @@ static int ConfigApply(DetectEngineThreadCtx *det_ctx,
} }
if (this_packet) { if (this_packet) {
SCLogDebug("packet logic here: %" PRIu64, p->pcap_cnt); SCLogDebug("packet logic here: %" PRIu64, PcapPacketCntGet(p));
ConfigApplyPacket(p, config); ConfigApplyPacket(p, config);
} else if (this_tx) { } else if (this_tx) {
SCLogDebug("tx logic here: tx_id %"PRIu64, det_ctx->tx_id); SCLogDebug("tx logic here: tx_id %"PRIu64, det_ctx->tx_id);

14
src/detect-engine-alert.c
Unescape Escape View File

@ -187,7 +187,7 @@ static inline void RuleActionToFlow(const uint8_t action, Flow *f)
* \param pa packet alert struct -- match, including actions after thresholding (rate_filter) */ * \param pa packet alert struct -- match, including actions after thresholding (rate_filter) */
static void PacketApplySignatureActions(Packet *p, const Signature *s, const PacketAlert *pa) static void PacketApplySignatureActions(Packet *p, const Signature *s, const PacketAlert *pa)
{ {
SCLogDebug("packet %" PRIu64 " sid %u action %02x alert_flags %02x", p->pcap_cnt, s->id, SCLogDebug("packet %" PRIu64 " sid %u action %02x alert_flags %02x", PcapPacketCntGet(p), s->id,
pa->action, pa->flags); pa->action, pa->flags);
/* REJECT also sets ACTION_DROP, just make it more visible with this check */ /* REJECT also sets ACTION_DROP, just make it more visible with this check */
@ -222,11 +222,11 @@ static void PacketApplySignatureActions(Packet *p, const Signature *s, const Pac
// nothing to set in the packet // nothing to set in the packet
} else if (pa->action & ACTION_ACCEPT) { } else if (pa->action & ACTION_ACCEPT) {
const enum ActionScope as = pa->s->action_scope; const enum ActionScope as = pa->s->action_scope;
SCLogDebug("packet %" PRIu64 ": ACCEPT %u as:%u flags:%02x", p->pcap_cnt, s->id, as, SCLogDebug("packet %" PRIu64 ": ACCEPT %u as:%u flags:%02x", PcapPacketCntGet(p), s->id,
pa->flags); as, pa->flags);
if (as == ACTION_SCOPE_PACKET || as == ACTION_SCOPE_FLOW || if (as == ACTION_SCOPE_PACKET || as == ACTION_SCOPE_FLOW ||
(pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET)) { (pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET)) {
SCLogDebug("packet %" PRIu64 ": sid:%u ACCEPT", p->pcap_cnt, s->id); SCLogDebug("packet %" PRIu64 ": sid:%u ACCEPT", PcapPacketCntGet(p), s->id);
p->action |= ACTION_ACCEPT; p->action |= ACTION_ACCEPT;
} }
} else if (pa->action & (ACTION_ALERT | ACTION_CONFIG)) { } else if (pa->action & (ACTION_ALERT | ACTION_CONFIG)) {
@ -464,7 +464,7 @@ static inline void FlowApplySignatureActions(
if (pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW) { if (pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW) {
SCLogDebug("packet %" PRIu64 " sid %u action %02x alert_flags %02x (set " SCLogDebug("packet %" PRIu64 " sid %u action %02x alert_flags %02x (set "
"PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW)", "PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW)",
p->pcap_cnt, s->id, s->action, pa->flags); PcapPacketCntGet(p), s->id, s->action, pa->flags);
} }
} }
} }
@ -523,8 +523,8 @@ static inline void PacketAlertFinalizeProcessQueue(
} }
} }
} }
SCLogDebug("packet %" PRIu64 ": i:%u sid:%u skip_action_set %s", p->pcap_cnt, i, s->id, SCLogDebug("packet %" PRIu64 ": i:%u sid:%u skip_action_set %s", PcapPacketCntGet(p), i,
BOOL2STR(skip_action_set)); s->id, BOOL2STR(skip_action_set));
if (!skip_action_set) { if (!skip_action_set) {
/* set actions on the flow */ /* set actions on the flow */
FlowApplySignatureActions(p, pa, s, pa->flags); FlowApplySignatureActions(p, pa, s, pa->flags);

15
src/detect-engine-frame.c
Unescape Escape View File

@ -74,7 +74,7 @@ static void BufferSetupUdp(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buf
void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p,
const Frames *frames, const Frame *frame, const AppProto alproto) const Frames *frames, const Frame *frame, const AppProto alproto)
{ {
SCLogDebug("pcap_cnt %" PRIu64, p->pcap_cnt); SCLogDebug("pcap_cnt %" PRIu64, PcapPacketCntGet(p));
PrefilterEngine *engine = sgh->frame_engines; PrefilterEngine *engine = sgh->frame_engines;
do { do {
if ((engine->alproto == alproto || engine->alproto == ALPROTO_UNKNOWN) && if ((engine->alproto == alproto || engine->alproto == ALPROTO_UNKNOWN) &&
@ -151,7 +151,7 @@ static void PrefilterMpmFrame(DetectEngineThreadCtx *det_ctx, const void *pectx,
const MpmCtx *mpm_ctx = ctx->mpm_ctx; const MpmCtx *mpm_ctx = ctx->mpm_ctx;
SCLogDebug("packet:%" PRIu64 ", prefilter running on list %d -> frame field type %u", SCLogDebug("packet:%" PRIu64 ", prefilter running on list %d -> frame field type %u",
p->pcap_cnt, ctx->list_id, frame->type); PcapPacketCntGet(p), ctx->list_id, frame->type);
if (p->proto == IPPROTO_UDP) { if (p->proto == IPPROTO_UDP) {
// TODO can we use single here? Could it conflict with TCP? // TODO can we use single here? Could it conflict with TCP?
InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, ctx->list_id, 0); InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, ctx->list_id, 0);
@ -198,7 +198,7 @@ static void PrefilterMpmFrame(DetectEngineThreadCtx *det_ctx, const void *pectx,
} }
SCLogDebug("packet:%" PRIu64 SCLogDebug("packet:%" PRIu64
", prefilter done running on list %d -> frame field type %u; have %u matches", ", prefilter done running on list %d -> frame field type %u; have %u matches",
p->pcap_cnt, ctx->list_id, frame->type, det_ctx->pmq.rule_id_array_cnt); PcapPacketCntGet(p), ctx->list_id, frame->type, det_ctx->pmq.rule_id_array_cnt);
} }
static void PrefilterMpmFrameFree(void *ptr) static void PrefilterMpmFrameFree(void *ptr)
@ -273,7 +273,7 @@ static void BufferSetupUdp(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buf
SCLogDebug("packet %" PRIu64 " -> frame %p/%" PRIi64 "/%s offset %" PRIu64 SCLogDebug("packet %" PRIu64 " -> frame %p/%" PRIi64 "/%s offset %" PRIu64
" type %u len %" PRIi64, " type %u len %" PRIi64,
p->pcap_cnt, frame, frame->id, PcapPacketCntGet(p), frame, frame->id,
AppLayerParserGetFrameNameById(p->flow->proto, p->flow->alproto, frame->type), AppLayerParserGetFrameNameById(p->flow->proto, p->flow->alproto, frame->type),
frame->offset, frame->type, frame->len); frame->offset, frame->type, frame->len);
@ -290,8 +290,8 @@ static int DetectFrameInspectUdp(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, Packet *p, const Frames *_frames, const DetectEngineTransforms *transforms, Packet *p, const Frames *_frames,
const Frame *frame, const int list_id) const Frame *frame, const int list_id)
{ {
SCLogDebug("packet:%" PRIu64 ", inspect: s:%p s->id:%u, transforms:%p", p->pcap_cnt, s, s->id, SCLogDebug("packet:%" PRIu64 ", inspect: s:%p s->id:%u, transforms:%p", PcapPacketCntGet(p), s,
transforms); s->id, transforms);
// TODO can we use single here? Could it conflict with TCP? // TODO can we use single here? Could it conflict with TCP?
InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, list_id, 0); InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, list_id, 0);
@ -577,7 +577,8 @@ int DetectEngineInspectFrameBufferGeneric(DetectEngineThreadCtx *det_ctx,
SCLogDebug("packet:%" PRIu64 ", frame->id:%" PRIu64 SCLogDebug("packet:%" PRIu64 ", frame->id:%" PRIu64
", list:%d, transforms:%p, s:%p, s->id:%u, engine:%p", ", list:%d, transforms:%p, s:%p, s->id:%u, engine:%p",
p->pcap_cnt, frame->id, engine->sm_list, engine->v1.transforms, s, s->id, engine); PcapPacketCntGet(p), frame->id, engine->sm_list, engine->v1.transforms, s, s->id,
engine);
DEBUG_VALIDATE_BUG_ON(p->flow->protoctx == NULL); DEBUG_VALIDATE_BUG_ON(p->flow->protoctx == NULL);
TcpSession *ssn = p->flow->protoctx; TcpSession *ssn = p->flow->protoctx;

4
src/detect-engine-payload.c
Unescape Escape View File

@ -333,8 +333,8 @@ uint8_t DetectEngineInspectStream(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
is_last = true; is_last = true;
} }
SCLogDebug("%s ran stream for sid %u on packet %"PRIu64" and we %s", SCLogDebug("%s ran stream for sid %u on packet %" PRIu64 " and we %s",
is_last? "LAST:" : "normal:", s->id, p->pcap_cnt, is_last ? "LAST:" : "normal:", s->id, PcapPacketCntGet(p),
match ? "matched" : "didn't match"); match ? "matched" : "didn't match");
if (match) { if (match) {

2
src/detect-engine-prefilter.c
Unescape Escape View File

@ -104,7 +104,7 @@ void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx,
/* reset rule store */ /* reset rule store */
det_ctx->pmq.rule_id_array_cnt = 0; det_ctx->pmq.rule_id_array_cnt = 0;
SCLogDebug("packet %" PRIu64 " tx %p progress %d tx->detect_progress %02x", p->pcap_cnt, SCLogDebug("packet %" PRIu64 " tx %p progress %d tx->detect_progress %02x", PcapPacketCntGet(p),
tx->tx_ptr, tx->tx_progress, tx->detect_progress); tx->tx_ptr, tx->tx_progress, tx->detect_progress);
PrefilterEngine *engine = sgh->tx_engines; PrefilterEngine *engine = sgh->tx_engines;

2
src/detect-file-data.c
Unescape Escape View File

@ -558,7 +558,7 @@ static void PrefilterTxFiledata(DetectEngineThreadCtx *det_ctx, const void *pect
local_file_id++; local_file_id++;
continue; continue;
} }
SCLogDebug("[%" PRIu64 "] buffer size %u", p->pcap_cnt, buffer->inspect_len); SCLogDebug("[%" PRIu64 "] buffer size %u", PcapPacketCntGet(p), buffer->inspect_len);
if (buffer->inspect_len >= mpm_ctx->minlen) { if (buffer->inspect_len >= mpm_ctx->minlen) {
uint32_t prev_rule_id_array_cnt = det_ctx->pmq.rule_id_array_cnt; uint32_t prev_rule_id_array_cnt = det_ctx->pmq.rule_id_array_cnt;

4
src/detect-flowbits.c
Unescape Escape View File

@ -977,7 +977,7 @@ static void PrefilterFlowbitFree(void *vctx)
static void PrefilterFlowbitMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) static void PrefilterFlowbitMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
{ {
struct PrefilterEngineFlowbits *ctx = (struct PrefilterEngineFlowbits *)pectx; struct PrefilterEngineFlowbits *ctx = (struct PrefilterEngineFlowbits *)pectx;
SCLogDebug("%" PRIu64 ": ctx %p", p->pcap_cnt, ctx); SCLogDebug("%" PRIu64 ": ctx %p", PcapPacketCntGet(p), ctx);
if (p->flow == NULL) { if (p->flow == NULL) {
SCReturn; SCReturn;
@ -1013,7 +1013,7 @@ static void PrefilterFlowbitPostRuleMatch(
DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f) DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f)
{ {
struct PrefilterEngineFlowbits *ctx = (struct PrefilterEngineFlowbits *)pectx; struct PrefilterEngineFlowbits *ctx = (struct PrefilterEngineFlowbits *)pectx;
SCLogDebug("%" PRIu64 ": ctx %p", p->pcap_cnt, ctx); SCLogDebug("%" PRIu64 ": ctx %p", PcapPacketCntGet(p), ctx);
if (p->flow == NULL) { if (p->flow == NULL) {
SCReturn; SCReturn;

46
src/detect.c
Unescape Escape View File

@ -112,7 +112,7 @@ static void DetectRun(ThreadVars *th_v,
Packet *p) Packet *p)
{ {
SCEnter(); SCEnter();
SCLogDebug("p->pcap_cnt %" PRIu64 " direction %s pkt_src %s", p->pcap_cnt, SCLogDebug("PcapPacketCntGet(p) %" PRIu64 " direction %s pkt_src %s", PcapPacketCntGet(p),
p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient") p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient")
: "noflow", : "noflow",
PktSrcToString(p->pkt_src)); PktSrcToString(p->pkt_src));
@ -158,7 +158,7 @@ static void DetectRun(ThreadVars *th_v,
if (pflow && pflow->alstate && likely(pflow->proto == p->proto)) { if (pflow && pflow->alstate && likely(pflow->proto == p->proto)) {
if (p->proto == IPPROTO_TCP) { if (p->proto == IPPROTO_TCP) {
if ((p->flags & PKT_STREAM_EST) == 0) { if ((p->flags & PKT_STREAM_EST) == 0) {
SCLogDebug("packet %" PRIu64 ": skip tcp non-established", p->pcap_cnt); SCLogDebug("packet %" PRIu64 ": skip tcp non-established", PcapPacketCntGet(p));
DetectRunAppendDefaultAccept(det_ctx, p); DetectRunAppendDefaultAccept(det_ctx, p);
goto end; goto end;
} }
@ -178,7 +178,7 @@ static void DetectRun(ThreadVars *th_v,
if (!PKT_IS_PSEUDOPKT(p) && p->app_update_direction == 0 && if (!PKT_IS_PSEUDOPKT(p) && p->app_update_direction == 0 &&
((PKT_IS_TOSERVER(p) && (p->flow->flags & FLOW_TS_APP_UPDATED) == 0) || ((PKT_IS_TOSERVER(p) && (p->flow->flags & FLOW_TS_APP_UPDATED) == 0) ||
(PKT_IS_TOCLIENT(p) && (p->flow->flags & FLOW_TC_APP_UPDATED) == 0))) { (PKT_IS_TOCLIENT(p) && (p->flow->flags & FLOW_TC_APP_UPDATED) == 0))) {
SCLogDebug("packet %" PRIu64 ": no app-layer update", p->pcap_cnt); SCLogDebug("packet %" PRIu64 ": no app-layer update", PcapPacketCntGet(p));
DetectRunAppendDefaultAccept(det_ctx, p); DetectRunAppendDefaultAccept(det_ctx, p);
goto end; goto end;
} }
@ -195,7 +195,7 @@ static void DetectRun(ThreadVars *th_v,
pflow, pflow->alparser, pflow->alstate, scratch.flow_flags, (scratch.sgh == NULL)); pflow, pflow->alparser, pflow->alstate, scratch.flow_flags, (scratch.sgh == NULL));
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX_UPDATE); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX_UPDATE);
} else { } else {
SCLogDebug("packet %" PRIu64 ": no flow / app-layer", p->pcap_cnt); SCLogDebug("packet %" PRIu64 ": no flow / app-layer", PcapPacketCntGet(p));
DetectRunAppendDefaultAccept(det_ctx, p); DetectRunAppendDefaultAccept(det_ctx, p);
} }
@ -212,7 +212,7 @@ static void DetectRunPacketHook(ThreadVars *th_v, const DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p) DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p)
{ {
SCEnter(); SCEnter();
SCLogDebug("p->pcap_cnt %" PRIu64 " direction %s pkt_src %s", p->pcap_cnt, SCLogDebug("PcapPacketCntGet(p) %" PRIu64 " direction %s pkt_src %s", PcapPacketCntGet(p),
p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient") p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient")
: "noflow", : "noflow",
PktSrcToString(p->pkt_src)); PktSrcToString(p->pkt_src));
@ -697,7 +697,8 @@ static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
} }
const uint8_t s_proto_flags = s->proto.flags; const uint8_t s_proto_flags = s->proto.flags;
SCLogDebug("packet %" PRIu64 ": inspecting signature id %" PRIu32 "", p->pcap_cnt, s->id); SCLogDebug("packet %" PRIu64 ": inspecting signature id %" PRIu32 "", PcapPacketCntGet(p),
s->id);
/* if we accept:hook'd the `packet_filter` hook, we skip the rest of the firewall rules. */ /* if we accept:hook'd the `packet_filter` hook, we skip the rest of the firewall rules. */
if (s->flags & SIG_FLAG_FIREWALL) { if (s->flags & SIG_FLAG_FIREWALL) {
@ -1044,8 +1045,8 @@ static inline void DetectRunPostRules(ThreadVars *tv, const DetectEngineCtx *de_
// TODO review packet src types here // TODO review packet src types here
if (EngineModeIsFirewall() && !(p->action & ACTION_ACCEPT) && p->pkt_src == PKT_SRC_WIRE && if (EngineModeIsFirewall() && !(p->action & ACTION_ACCEPT) && p->pkt_src == PKT_SRC_WIRE &&
scratch->default_action == ACTION_DROP) { scratch->default_action == ACTION_DROP) {
SCLogDebug("packet %" PRIu64 ": droppit as no ACCEPT set %02x (pkt %s)", p->pcap_cnt, SCLogDebug("packet %" PRIu64 ": droppit as no ACCEPT set %02x (pkt %s)",
p->action, PktSrcToString(p->pkt_src)); PcapPacketCntGet(p), p->action, PktSrcToString(p->pkt_src));
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_DEFAULT_PACKET_POLICY); PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_DEFAULT_PACKET_POLICY);
} }
} }
@ -1679,7 +1680,7 @@ static bool ApplyAccept(Packet *p, const uint8_t flow_flags, const Signature *s,
/* if there is no fw rule for the next progress value, /* if there is no fw rule for the next progress value,
* we invoke the default drop policy. */ * we invoke the default drop policy. */
if (fw_next_progress_missing) { if (fw_next_progress_missing) {
SCLogDebug("%" PRIu64 ": %s default drop for progress", p->pcap_cnt, SCLogDebug("%" PRIu64 ": %s default drop for progress", PcapPacketCntGet(p),
flow_flags & STREAM_TOSERVER ? "toserver" : "toclient"); flow_flags & STREAM_TOSERVER ? "toserver" : "toclient");
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_DEFAULT_APP_POLICY); PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_DEFAULT_APP_POLICY);
p->flow->flags |= FLOW_ACTION_DROP; p->flow->flags |= FLOW_ACTION_DROP;
@ -1725,7 +1726,7 @@ static void DetectRunTx(ThreadVars *tv,
uint32_t tx_inspected = 0; uint32_t tx_inspected = 0;
const bool have_fw_rules = EngineModeIsFirewall(); const bool have_fw_rules = EngineModeIsFirewall();
SCLogDebug("packet %" PRIu64, p->pcap_cnt); SCLogDebug("packet %" PRIu64, PcapPacketCntGet(p));
while (1) { while (1) {
AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, tx_id_min, total_txs, &state); AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, tx_id_min, total_txs, &state);
@ -1875,7 +1876,7 @@ static void DetectRunTx(ThreadVars *tv,
uint32_t *inspect_flags = det_ctx->tx_candidates[i].flags; uint32_t *inspect_flags = det_ctx->tx_candidates[i].flags;
bool break_out_of_app_filter = false; bool break_out_of_app_filter = false;
SCLogDebug("%" PRIu64 ": sid:%u: %s tx %u/%u/%u sig %u", p->pcap_cnt, s->id, SCLogDebug("%" PRIu64 ": sid:%u: %s tx %u/%u/%u sig %u", PcapPacketCntGet(p), s->id,
flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.tx_progress, flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.tx_progress,
tx.detect_progress, tx.detect_progress_orig, s->app_progress_hook); tx.detect_progress, tx.detect_progress_orig, s->app_progress_hook);
@ -1996,7 +1997,7 @@ static void DetectRunTx(ThreadVars *tv,
(s->flags & SIG_FLAG_FIREWALL) ? "firewall" : "regular", (s->flags & SIG_FLAG_FIREWALL) ? "firewall" : "regular",
BOOL2STR(last_for_progress)); BOOL2STR(last_for_progress));
if (s->flags & SIG_FLAG_FIREWALL) { if (s->flags & SIG_FLAG_FIREWALL) {
SCLogDebug("%" PRIu64 ": %s default drop for progress", p->pcap_cnt, SCLogDebug("%" PRIu64 ": %s default drop for progress", PcapPacketCntGet(p),
flow_flags & STREAM_TOSERVER ? "toserver" : "toclient"); flow_flags & STREAM_TOSERVER ? "toserver" : "toclient");
/* if this rule was the last for our progress state, and it didn't match, /* if this rule was the last for our progress state, and it didn't match,
* we have to invoke the default drop policy. */ * we have to invoke the default drop policy. */
@ -2055,7 +2056,7 @@ static void DetectRunTx(ThreadVars *tv,
/* this side of the tx is done */ /* this side of the tx is done */
if (tx.tx_progress >= tx.tx_end_state) { if (tx.tx_progress >= tx.tx_end_state) {
SCLogDebug("%" PRIu64 ": %s tx done", p->pcap_cnt, SCLogDebug("%" PRIu64 ": %s tx done", PcapPacketCntGet(p),
flow_flags & STREAM_TOSERVER ? "toserver" : "toclient"); flow_flags & STREAM_TOSERVER ? "toserver" : "toclient");
const uint8_t inspected_flag = (flow_flags & STREAM_TOSERVER) const uint8_t inspected_flag = (flow_flags & STREAM_TOSERVER)
? APP_LAYER_TX_INSPECTED_TS ? APP_LAYER_TX_INSPECTED_TS
@ -2067,7 +2068,7 @@ static void DetectRunTx(ThreadVars *tv,
} }
if (tx.detect_progress != tx.detect_progress_orig) { if (tx.detect_progress != tx.detect_progress_orig) {
SCLogDebug("%" PRIu64 ": %s tx state change %u -> %u", p->pcap_cnt, SCLogDebug("%" PRIu64 ": %s tx state change %u -> %u", PcapPacketCntGet(p),
flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.detect_progress_orig, flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.detect_progress_orig,
tx.detect_progress); tx.detect_progress);
SCLogDebug("%p/%" PRIu64 " Storing new progress %02x (was %02x)", tx.tx_ptr, tx.tx_id, SCLogDebug("%p/%" PRIu64 " Storing new progress %02x (was %02x)", tx.tx_ptr, tx.tx_id,
@ -2085,10 +2086,10 @@ static void DetectRunTx(ThreadVars *tv,
/* apply default policy if there were txs to inspect, we have fw rules and non of the rules /* apply default policy if there were txs to inspect, we have fw rules and non of the rules
* applied a policy. */ * applied a policy. */
SCLogDebug("packet %" PRIu64 ": tx_inspected %u fw_verdicted %u", p->pcap_cnt, tx_inspected, SCLogDebug("packet %" PRIu64 ": tx_inspected %u fw_verdicted %u", PcapPacketCntGet(p),
fw_verdicted); tx_inspected, fw_verdicted);
if (tx_inspected && have_fw_rules && tx_inspected != fw_verdicted) { if (tx_inspected && have_fw_rules && tx_inspected != fw_verdicted) {
SCLogDebug("%" PRIu64 ": %s default drop", p->pcap_cnt, SCLogDebug("%" PRIu64 ": %s default drop", PcapPacketCntGet(p),
flow_flags & STREAM_TOSERVER ? "toserver" : "toclient"); flow_flags & STREAM_TOSERVER ? "toserver" : "toclient");
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_DEFAULT_APP_POLICY); PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_DEFAULT_APP_POLICY);
p->flow->flags |= FLOW_ACTION_DROP; p->flow->flags |= FLOW_ACTION_DROP;
@ -2112,7 +2113,7 @@ static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngin
((PKT_IS_TOSERVER(p) && (f->flags & FLOW_TS_APP_UPDATED) == 0) || ((PKT_IS_TOSERVER(p) && (f->flags & FLOW_TS_APP_UPDATED) == 0) ||
(PKT_IS_TOCLIENT(p) && (f->flags & FLOW_TC_APP_UPDATED) == 0))) { (PKT_IS_TOCLIENT(p) && (f->flags & FLOW_TC_APP_UPDATED) == 0))) {
SCLogDebug("pcap_cnt %" PRIu64 ": %s: skip frame inspection for TCP w/o APP UPDATE", SCLogDebug("pcap_cnt %" PRIu64 ": %s: skip frame inspection for TCP w/o APP UPDATE",
p->pcap_cnt, PKT_IS_TOSERVER(p) ? "toserver" : "toclient"); PcapPacketCntGet(p), PKT_IS_TOSERVER(p) ? "toserver" : "toclient");
return; return;
} }
FramesContainer *frames_container = AppLayerFramesGetContainer(f); FramesContainer *frames_container = AppLayerFramesGetContainer(f);
@ -2284,8 +2285,9 @@ static void DetectFlow(ThreadVars *tv,
AppLayerParserSetTransactionInspectId(f, f->alparser, f->alstate, flags, true); AppLayerParserSetTransactionInspectId(f, f->alparser, f->alstate, flags, true);
} }
} }
SCLogDebug("p->pcap %"PRIu64": no detection on packet, " SCLogDebug("p->pcap %" PRIu64 ": no detection on packet, "
"PKT_NOPACKET_INSPECTION is set", p->pcap_cnt); "PKT_NOPACKET_INSPECTION is set",
PcapPacketCntGet(p));
return; return;
} }
@ -2312,7 +2314,7 @@ uint8_t DetectPreFlow(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p)
const DetectEngineCtx *de_ctx = det_ctx->de_ctx; const DetectEngineCtx *de_ctx = det_ctx->de_ctx;
const SigGroupHead *sgh = de_ctx->pre_flow_sgh; const SigGroupHead *sgh = de_ctx->pre_flow_sgh;
SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, p->pcap_cnt, sgh); SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, PcapPacketCntGet(p), sgh);
DetectRunPacketHook(tv, de_ctx, det_ctx, sgh, p); DetectRunPacketHook(tv, de_ctx, det_ctx, sgh, p);
return p->action; return p->action;
} }
@ -2323,7 +2325,7 @@ uint8_t DetectPreStream(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *
const int direction = (PKT_IS_TOCLIENT(p) != 0); const int direction = (PKT_IS_TOCLIENT(p) != 0);
const SigGroupHead *sgh = de_ctx->pre_stream_sgh[direction]; const SigGroupHead *sgh = de_ctx->pre_stream_sgh[direction];
SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, p->pcap_cnt, sgh); SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, PcapPacketCntGet(p), sgh);
DetectRunPacketHook(tv, de_ctx, det_ctx, sgh, p); DetectRunPacketHook(tv, de_ctx, det_ctx, sgh, p);
return p->action; return p->action;
} }

2
src/flow-hash.c
Unescape Escape View File

@ -695,7 +695,7 @@ static Flow *FlowGetNew(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
{ {
const bool emerg = ((SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY) != 0); const bool emerg = ((SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY) != 0);
#ifdef DEBUG #ifdef DEBUG
if (g_eps_flow_memcap != UINT64_MAX && g_eps_flow_memcap == p->pcap_cnt) { if (g_eps_flow_memcap != UINT64_MAX && g_eps_flow_memcap == PcapPacketCntGet(p)) {
NoFlowHandleIPS(tv, fls, p); NoFlowHandleIPS(tv, fls, p);
StatsCounterIncr(&tv->stats, fls->dtv->counter_flow_memcap); StatsCounterIncr(&tv->stats, fls->dtv->counter_flow_memcap);
return NULL; return NULL;

33
src/flow-worker.c
Unescape Escape View File

@ -395,10 +395,10 @@ static inline void FlowWorkerStreamTCPUpdate(ThreadVars *tv, FlowWorkerThreadDat
} }
/* Packets here can safely access p->flow as it's locked */ /* Packets here can safely access p->flow as it's locked */
SCLogDebug("packet %"PRIu64": extra packets %u", p->pcap_cnt, fw->pq.len); SCLogDebug("packet %" PRIu64 ": extra packets %u", PcapPacketCntGet(p), fw->pq.len);
Packet *x; Packet *x;
while ((x = PacketDequeueNoLock(&fw->pq))) { while ((x = PacketDequeueNoLock(&fw->pq))) {
SCLogDebug("packet %"PRIu64" extra packet %p", p->pcap_cnt, x); SCLogDebug("packet %" PRIu64 " extra packet %p", PcapPacketCntGet(p), x);
if (det_ctx != NULL) { if (det_ctx != NULL) {
FLOWWORKER_PROFILING_START(x, PROFILE_FLOWWORKER_DETECT); FLOWWORKER_PROFILING_START(x, PROFILE_FLOWWORKER_DETECT);
@ -438,7 +438,8 @@ static void FlowWorkerFlowTimeout(
{ {
DEBUG_VALIDATE_BUG_ON(p->pkt_src != PKT_SRC_FFR); DEBUG_VALIDATE_BUG_ON(p->pkt_src != PKT_SRC_FFR);
SCLogDebug("packet %"PRIu64" is TCP. Direction %s", p->pcap_cnt, PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT"); SCLogDebug("packet %" PRIu64 " is TCP. Direction %s", PcapPacketCntGet(p),
PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT");
DEBUG_VALIDATE_BUG_ON(!(p->flow && PacketIsTCP(p))); DEBUG_VALIDATE_BUG_ON(!(p->flow && PacketIsTCP(p)));
DEBUG_ASSERT_FLOW_LOCKED(p->flow); DEBUG_ASSERT_FLOW_LOCKED(p->flow);
@ -448,7 +449,7 @@ static void FlowWorkerFlowTimeout(
PacketUpdateEngineEventCounters(tv, fw->dtv, p); PacketUpdateEngineEventCounters(tv, fw->dtv, p);
/* handle Detect */ /* handle Detect */
SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt); SCLogDebug("packet %" PRIu64 " calling Detect", PcapPacketCntGet(p));
if (det_ctx != NULL) { if (det_ctx != NULL) {
FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_DETECT); FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_DETECT);
Detect(tv, p, det_ctx); Detect(tv, p, det_ctx);
@ -520,37 +521,37 @@ static void PacketAppUpdate2FlowFlags(Packet *p)
{ {
switch ((enum StreamUpdateDir)p->app_update_direction) { switch ((enum StreamUpdateDir)p->app_update_direction) {
case UPDATE_DIR_NONE: // NONE implies pseudo packet case UPDATE_DIR_NONE: // NONE implies pseudo packet
SCLogDebug("pcap_cnt %" PRIu64 ", UPDATE_DIR_NONE", p->pcap_cnt); SCLogDebug("pcap_cnt %" PRIu64 ", UPDATE_DIR_NONE", PcapPacketCntGet(p));
break; break;
case UPDATE_DIR_PACKET: case UPDATE_DIR_PACKET:
if (PKT_IS_TOSERVER(p)) { if (PKT_IS_TOSERVER(p)) {
p->flow->flags |= FLOW_TS_APP_UPDATED; p->flow->flags |= FLOW_TS_APP_UPDATED;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED set", p->pcap_cnt); SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED set", PcapPacketCntGet(p));
} else { } else {
p->flow->flags |= FLOW_TC_APP_UPDATED; p->flow->flags |= FLOW_TC_APP_UPDATED;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED set", p->pcap_cnt); SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED set", PcapPacketCntGet(p));
} }
break; break;
case UPDATE_DIR_BOTH: case UPDATE_DIR_BOTH:
if (PKT_IS_TOSERVER(p)) { if (PKT_IS_TOSERVER(p)) {
p->flow->flags |= FLOW_TS_APP_UPDATED | FLOW_TC_APP_UPDATE_NEXT; p->flow->flags |= FLOW_TS_APP_UPDATED | FLOW_TC_APP_UPDATE_NEXT;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED|FLOW_TC_APP_UPDATE_NEXT set", SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED|FLOW_TC_APP_UPDATE_NEXT set",
p->pcap_cnt); PcapPacketCntGet(p));
} else { } else {
p->flow->flags |= FLOW_TC_APP_UPDATED | FLOW_TS_APP_UPDATE_NEXT; p->flow->flags |= FLOW_TC_APP_UPDATED | FLOW_TS_APP_UPDATE_NEXT;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED|FLOW_TS_APP_UPDATE_NEXT set", SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED|FLOW_TS_APP_UPDATE_NEXT set",
p->pcap_cnt); PcapPacketCntGet(p));
} }
/* fall through */ /* fall through */
case UPDATE_DIR_OPPOSING: case UPDATE_DIR_OPPOSING:
if (PKT_IS_TOSERVER(p)) { if (PKT_IS_TOSERVER(p)) {
p->flow->flags |= FLOW_TC_APP_UPDATED | FLOW_TS_APP_UPDATE_NEXT; p->flow->flags |= FLOW_TC_APP_UPDATED | FLOW_TS_APP_UPDATE_NEXT;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED|FLOW_TS_APP_UPDATE_NEXT set", SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED|FLOW_TS_APP_UPDATE_NEXT set",
p->pcap_cnt); PcapPacketCntGet(p));
} else { } else {
p->flow->flags |= FLOW_TS_APP_UPDATED | FLOW_TC_APP_UPDATE_NEXT; p->flow->flags |= FLOW_TS_APP_UPDATED | FLOW_TC_APP_UPDATE_NEXT;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED|FLOW_TC_APP_UPDATE_NEXT set", SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED|FLOW_TC_APP_UPDATE_NEXT set",
p->pcap_cnt); PcapPacketCntGet(p));
} }
break; break;
} }
@ -564,7 +565,7 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data)
DEBUG_VALIDATE_BUG_ON(p == NULL); DEBUG_VALIDATE_BUG_ON(p == NULL);
DEBUG_VALIDATE_BUG_ON(tv->flow_queue == NULL); DEBUG_VALIDATE_BUG_ON(tv->flow_queue == NULL);
SCLogDebug("packet %"PRIu64, p->pcap_cnt); SCLogDebug("packet %" PRIu64, PcapPacketCntGet(p));
if ((PKT_IS_FLUSHPKT(p))) { if ((PKT_IS_FLUSHPKT(p))) {
SCLogDebug("thread %s flushing", tv->printable_name); SCLogDebug("thread %s flushing", tv->printable_name);
@ -614,13 +615,13 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data)
TimeSetByThread(tv->id, p->ts); TimeSetByThread(tv->id, p->ts);
} }
SCLogDebug("packet %"PRIu64" has flow? %s", p->pcap_cnt, p->flow ? "yes" : "no"); SCLogDebug("packet %" PRIu64 " has flow? %s", PcapPacketCntGet(p), p->flow ? "yes" : "no");
/* handle TCP and app layer */ /* handle TCP and app layer */
if (p->flow) { if (p->flow) {
SCLogDebug("packet %" PRIu64 SCLogDebug("packet %" PRIu64
": direction %s FLOW_TS_APP_UPDATE_NEXT %s FLOW_TC_APP_UPDATE_NEXT %s", ": direction %s FLOW_TS_APP_UPDATE_NEXT %s FLOW_TC_APP_UPDATE_NEXT %s",
p->pcap_cnt, PKT_IS_TOSERVER(p) ? "toserver" : "toclient", PcapPacketCntGet(p), PKT_IS_TOSERVER(p) ? "toserver" : "toclient",
BOOL2STR((p->flow->flags & FLOW_TS_APP_UPDATE_NEXT) != 0), BOOL2STR((p->flow->flags & FLOW_TS_APP_UPDATE_NEXT) != 0),
BOOL2STR((p->flow->flags & FLOW_TC_APP_UPDATE_NEXT) != 0)); BOOL2STR((p->flow->flags & FLOW_TC_APP_UPDATE_NEXT) != 0));
/* see if need to consider flags set by prev packets */ /* see if need to consider flags set by prev packets */
@ -635,7 +636,7 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data)
} }
if (PacketIsTCP(p)) { if (PacketIsTCP(p)) {
SCLogDebug("packet %" PRIu64 " is TCP. Direction %s", p->pcap_cnt, SCLogDebug("packet %" PRIu64 " is TCP. Direction %s", PcapPacketCntGet(p),
PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT"); PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT");
DEBUG_ASSERT_FLOW_LOCKED(p->flow); DEBUG_ASSERT_FLOW_LOCKED(p->flow);
@ -663,7 +664,7 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data)
/* handle Detect */ /* handle Detect */
DEBUG_ASSERT_FLOW_LOCKED(p->flow); DEBUG_ASSERT_FLOW_LOCKED(p->flow);
SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt); SCLogDebug("packet %" PRIu64 " calling Detect", PcapPacketCntGet(p));
if (det_ctx != NULL) { if (det_ctx != NULL) {
FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_DETECT); FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_DETECT);
Detect(tv, p, det_ctx); Detect(tv, p, det_ctx);

2
src/flow.c
Unescape Escape View File

@ -423,7 +423,7 @@ static inline void FlowUpdateEthernet(
*/ */
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv) void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
{ {
SCLogDebug("packet %"PRIu64" -- flow %p", p->pcap_cnt, f); SCLogDebug("packet %" PRIu64 " -- flow %p", PcapPacketCntGet(p), f);
const int pkt_dir = FlowGetPacketDirection(f, p); const int pkt_dir = FlowGetPacketDirection(f, p);
#ifdef CAPTURE_OFFLOAD #ifdef CAPTURE_OFFLOAD

5
src/log-tlsstore.c
Unescape Escape View File

@ -217,8 +217,9 @@ static void LogTlsLogPem(LogTlsStoreLogThread *aft, const Packet *p, SSLState *s
goto end_fwrite_fpmeta; goto end_fwrite_fpmeta;
if (fprintf(fpmeta, "TIME: %s\n", timebuf) < 0) if (fprintf(fpmeta, "TIME: %s\n", timebuf) < 0)
goto end_fwrite_fpmeta; goto end_fwrite_fpmeta;
if (p->pcap_cnt > 0) { uint64_t pcap_cnt = PcapPacketCntGet(p);
if (fprintf(fpmeta, "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt) < 0) if (pcap_cnt > 0) {
if (fprintf(fpmeta, "PCAP PKT NUM: %" PRIu64 "\n", pcap_cnt) < 0)
goto end_fwrite_fpmeta; goto end_fwrite_fpmeta;
} }
if (fprintf(fpmeta, "SRC IP: %s\n", srcip) < 0) if (fprintf(fpmeta, "SRC IP: %s\n", srcip) < 0)

7
src/output-json-alert.c
Unescape Escape View File

@ -285,10 +285,8 @@ static void AlertJsonTunnel(const Packet *p, SCJsonBuilder *js)
SCJbOpenObject(js, "tunnel"); SCJbOpenObject(js, "tunnel");
enum PktSrcEnum pkt_src; enum PktSrcEnum pkt_src;
uint64_t pcap_cnt;
JsonAddrInfo addr = json_addr_info_zero; JsonAddrInfo addr = json_addr_info_zero;
JsonAddrInfoInit(p->root, 0, &addr); JsonAddrInfoInit(p->root, 0, &addr);
pcap_cnt = p->root->pcap_cnt;
pkt_src = p->root->pkt_src; pkt_src = p->root->pkt_src;
SCJbSetString(js, "src_ip", addr.src_ip); SCJbSetString(js, "src_ip", addr.src_ip);
@ -298,6 +296,7 @@ static void AlertJsonTunnel(const Packet *p, SCJsonBuilder *js)
SCJbSetString(js, "proto", addr.proto); SCJbSetString(js, "proto", addr.proto);
SCJbSetUint(js, "depth", p->recursion_level); SCJbSetUint(js, "depth", p->recursion_level);
uint64_t pcap_cnt = PcapPacketCntGet(p->root);
if (pcap_cnt != 0) { if (pcap_cnt != 0) {
SCJbSetUint(js, "pcap_cnt", pcap_cnt); SCJbSetUint(js, "pcap_cnt", pcap_cnt);
} }
@ -542,8 +541,8 @@ void EveAddVerdict(SCJsonBuilder *jb, const Packet *p, const uint8_t alert_actio
SCJbOpenObject(jb, "verdict"); SCJbOpenObject(jb, "verdict");
const uint8_t packet_action = PacketGetAction(p); const uint8_t packet_action = PacketGetAction(p);
SCLogDebug("%" PRIu64 ": packet_action %02x alert_action %02x", p->pcap_cnt, packet_action, SCLogDebug("%" PRIu64 ": packet_action %02x alert_action %02x", PcapPacketCntGet(p),
alert_action); packet_action, alert_action);
/* add verdict info */ /* add verdict info */
if (packet_action & ACTION_REJECT_ANY) { if (packet_action & ACTION_REJECT_ANY) {
// check rule to define type of reject packet sent // check rule to define type of reject packet sent

5
src/output-json.c
Unescape Escape View File

@ -859,8 +859,9 @@ SCJsonBuilder *CreateEveHeader(const Packet *p, enum SCOutputJsonLogDirection di
} }
/* pcap_cnt */ /* pcap_cnt */
if (p->pcap_cnt != 0) { uint64_t pcap_cnt = PcapPacketCntGet(p);
SCJbSetUint(js, "pcap_cnt", p->pcap_cnt); if (pcap_cnt != 0) {
SCJbSetUint(js, "pcap_cnt", pcap_cnt);
} }
if (event_type) { if (event_type) {

16
src/output-tx.c
Unescape Escape View File

@ -186,7 +186,7 @@ static inline void OutputTxLogFiles(ThreadVars *tv, OutputFileLoggerThreadData *
if (ffc || ffc_opposing) if (ffc || ffc_opposing)
SCLogDebug("pcap_cnt %" PRIu64 " flow %p tx %p tx_id %" PRIu64 SCLogDebug("pcap_cnt %" PRIu64 " flow %p tx %p tx_id %" PRIu64
" ffc %p ffc_opposing %p tx_complete %d", " ffc %p ffc_opposing %p tx_complete %d",
p->pcap_cnt, f, tx, tx_id, ffc, ffc_opposing, tx_complete); PcapPacketCntGet(p), f, tx, tx_id, ffc, ffc_opposing, tx_complete);
if (ffc) { if (ffc) {
const bool file_close = ((p->flags & PKT_PSEUDO_STREAM_END)) | eof; const bool file_close = ((p->flags & PKT_PSEUDO_STREAM_END)) | eof;
@ -234,7 +234,7 @@ static inline void OutputTxLogFiles(ThreadVars *tv, OutputFileLoggerThreadData *
} else { } else {
SCLogDebug("pcap_cnt %" PRIu64 " flow %p tx %p tx_id %" PRIu64 SCLogDebug("pcap_cnt %" PRIu64 " flow %p tx %p tx_id %" PRIu64
" NOT SETTING FILE FLAGS ffc %p ffc_opposing %p tx_complete %d", " NOT SETTING FILE FLAGS ffc %p ffc_opposing %p tx_complete %d",
p->pcap_cnt, f, tx, tx_id, ffc, ffc_opposing, tx_complete); PcapPacketCntGet(p), f, tx, tx_id, ffc, ffc_opposing, tx_complete);
} }
} }
@ -292,8 +292,8 @@ static void OutputTxLogCallLoggers(ThreadVars *tv, OutputTxLoggerThreadData *op_
if ((ctx->tx_logged_old & BIT_U32(logger->logger_id)) == 0) { if ((ctx->tx_logged_old & BIT_U32(logger->logger_id)) == 0) {
SCLogDebug("alproto match %d, logging tx_id %" PRIu64, logger->alproto, tx_id); SCLogDebug("alproto match %d, logging tx_id %" PRIu64, logger->alproto, tx_id);
SCLogDebug("pcap_cnt %" PRIu64 ", tx_id %" PRIu64 " logger %d. EOF %s", p->pcap_cnt, SCLogDebug("pcap_cnt %" PRIu64 ", tx_id %" PRIu64 " logger %d. EOF %s",
tx_id, logger->logger_id, eof ? "true" : "false"); PcapPacketCntGet(p), tx_id, logger->logger_id, eof ? "true" : "false");
if (eof) { if (eof) {
SCLogDebug("EOF, so log now"); SCLogDebug("EOF, so log now");
@ -354,7 +354,7 @@ static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data)
Flow * const f = p->flow; Flow * const f = p->flow;
const uint8_t ipproto = f->proto; const uint8_t ipproto = f->proto;
const AppProto alproto = f->alproto; const AppProto alproto = f->alproto;
SCLogDebug("pcap_cnt %u tx logging %u/%s", (uint32_t)p->pcap_cnt, alproto, SCLogDebug("pcap_cnt %u tx logging %u/%s", (uint32_t)PcapPacketCntGet(p), alproto,
AppProtoToString(alproto)); AppProtoToString(alproto));
const bool file_logging_active = (op_thread_data->file || op_thread_data->filedata); const bool file_logging_active = (op_thread_data->file || op_thread_data->filedata);
@ -378,7 +378,7 @@ static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data)
logger_expectation, LOGGER_FILE, LOGGER_FILEDATA); logger_expectation, LOGGER_FILE, LOGGER_FILEDATA);
goto end; goto end;
} }
SCLogDebug("pcap_cnt %" PRIu64, p->pcap_cnt); SCLogDebug("pcap_cnt %" PRIu64, PcapPacketCntGet(p));
const bool last_pseudo = (p->flowflags & FLOW_PKT_LAST_PSEUDO) != 0; const bool last_pseudo = (p->flowflags & FLOW_PKT_LAST_PSEUDO) != 0;
const bool ts_eof = SCAppLayerParserStateIssetFlag(f->alparser, APP_LAYER_PARSER_EOF_TS) != 0; const bool ts_eof = SCAppLayerParserStateIssetFlag(f->alparser, APP_LAYER_PARSER_EOF_TS) != 0;
@ -398,8 +398,8 @@ static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data)
const bool support_files = AppLayerParserSupportsFiles(ipproto, alproto); const bool support_files = AppLayerParserSupportsFiles(ipproto, alproto);
const uint8_t pkt_dir = STREAM_FLAGS_FOR_PACKET(p); const uint8_t pkt_dir = STREAM_FLAGS_FOR_PACKET(p);
SCLogDebug("pcap_cnt %" PRIu64 ": tx_id %" PRIu64 " total_txs %" PRIu64, p->pcap_cnt, tx_id, SCLogDebug("pcap_cnt %" PRIu64 ": tx_id %" PRIu64 " total_txs %" PRIu64, PcapPacketCntGet(p),
total_txs); tx_id, total_txs);
AppLayerGetTxIteratorFunc IterFunc = AppLayerGetTxIterator(ipproto, alproto); AppLayerGetTxIteratorFunc IterFunc = AppLayerGetTxIterator(ipproto, alproto);
AppLayerGetTxIterState state; AppLayerGetTxIterState state;

1
src/packet.c
Unescape Escape View File

@ -142,7 +142,6 @@ void PacketReinit(Packet *p)
PacketAlertRecycle(p->alerts.alerts, p->alerts.cnt); PacketAlertRecycle(p->alerts.alerts, p->alerts.cnt);
p->alerts.cnt = 0; p->alerts.cnt = 0;
} }
p->pcap_cnt = 0;
p->tunnel_rtv_cnt = 0; p->tunnel_rtv_cnt = 0;
p->tunnel_tpr_cnt = 0; p->tunnel_tpr_cnt = 0;
p->events.cnt = 0; p->events.cnt = 0;

4
src/stream-tcp-private.h
Unescape Escape View File

@ -272,9 +272,9 @@ enum TcpState {
if ((p)->flags & PKT_STREAM_NO_EVENTS) { \ if ((p)->flags & PKT_STREAM_NO_EVENTS) { \
SCLogDebug("not setting event %d on pkt %p (%" PRIu64 "), " \ SCLogDebug("not setting event %d on pkt %p (%" PRIu64 "), " \
"stream in known bad condition", \ "stream in known bad condition", \
(e), p, (p)->pcap_cnt); \ (e), p, PcapPacketCntGet(p)); \
} else { \ } else { \
SCLogDebug("setting event %d on pkt %p (%" PRIu64 ")", (e), p, (p)->pcap_cnt); \ SCLogDebug("setting event %d on pkt %p (%" PRIu64 ")", (e), p, PcapPacketCntGet(p)); \
ENGINE_SET_EVENT((p), (e)); \ ENGINE_SET_EVENT((p), (e)); \
p->l4.vars.tcp.stream_pkt_flags |= STREAM_PKT_FLAG_EVENTSET; \ p->l4.vars.tcp.stream_pkt_flags |= STREAM_PKT_FLAG_EVENTSET; \
} \ } \

25
src/stream-tcp-reassemble.c
Unescape Escape View File

@ -1087,7 +1087,7 @@ static void GetSessionSize(TcpSession *ssn, Packet *p)
size = GetStreamSize(&ssn->client); size = GetStreamSize(&ssn->client);
size += GetStreamSize(&ssn->server); size += GetStreamSize(&ssn->server);
SCLogDebug("size %"PRIu64", packet %"PRIu64, size, p->pcap_cnt); SCLogDebug("size %" PRIu64 ", packet %" PRIu64, size, PcapPacketCntGet(p));
} }
} }
#endif #endif
@ -1196,7 +1196,7 @@ static inline bool CheckGap(TcpSession *ssn, TcpStream *stream, Packet *p)
if (RB_EMPTY(&stream->sb.sbb_tree)) { if (RB_EMPTY(&stream->sb.sbb_tree)) {
SCLogDebug("packet %" PRIu64 ": no GAP. " SCLogDebug("packet %" PRIu64 ": no GAP. "
"next_seq %u < last_ack %u, but no data in list", "next_seq %u < last_ack %u, but no data in list",
p->pcap_cnt, stream->next_seq, stream->last_ack); PcapPacketCntGet(p), stream->next_seq, stream->last_ack);
return false; return false;
} }
const uint64_t next_seq_abs = const uint64_t next_seq_abs =
@ -1206,7 +1206,7 @@ static inline bool CheckGap(TcpSession *ssn, TcpStream *stream, Packet *p)
/* ack'd data after the gap */ /* ack'd data after the gap */
SCLogDebug("packet %" PRIu64 ": GAP. " SCLogDebug("packet %" PRIu64 ": GAP. "
"next_seq %u < last_ack %u, but ACK'd data beyond gap.", "next_seq %u < last_ack %u, but ACK'd data beyond gap.",
p->pcap_cnt, stream->next_seq, stream->last_ack); PcapPacketCntGet(p), stream->next_seq, stream->last_ack);
return true; return true;
} }
} }
@ -1214,12 +1214,12 @@ static inline bool CheckGap(TcpSession *ssn, TcpStream *stream, Packet *p)
SCLogDebug("packet %" PRIu64 ": GAP! " SCLogDebug("packet %" PRIu64 ": GAP! "
"last_ack_abs %" PRIu64 " > app_progress %" PRIu64 ", " "last_ack_abs %" PRIu64 " > app_progress %" PRIu64 ", "
"but we have no data.", "but we have no data.",
p->pcap_cnt, last_ack_abs, app_progress); PcapPacketCntGet(p), last_ack_abs, app_progress);
return true; return true;
} }
SCLogDebug("packet %"PRIu64": no GAP. " SCLogDebug("packet %" PRIu64 ": no GAP. "
"last_ack_abs %"PRIu64" <= app_progress %"PRIu64, "last_ack_abs %" PRIu64 " <= app_progress %" PRIu64,
p->pcap_cnt, last_ack_abs, app_progress); PcapPacketCntGet(p), last_ack_abs, app_progress);
return false; return false;
} }
@ -1333,7 +1333,7 @@ static int ReassembleUpdateAppLayer(ThreadVars *tv, TcpReassemblyThreadCtx *ra_c
mydata = NULL; mydata = NULL;
mydata_len = 0; mydata_len = 0;
SCLogDebug("%"PRIu64" got %p/%u", p->pcap_cnt, mydata, mydata_len); SCLogDebug("%" PRIu64 " got %p/%u", PcapPacketCntGet(p), mydata, mydata_len);
break; break;
} }
DEBUG_VALIDATE_BUG_ON(mydata == NULL && mydata_len > 0); DEBUG_VALIDATE_BUG_ON(mydata == NULL && mydata_len > 0);
@ -1579,8 +1579,9 @@ void StreamReassembleRawUpdateProgress(TcpSession *ssn, Packet *p, const uint64_
stream->flags &= ~STREAMTCP_STREAM_FLAG_TRIGGER_RAW; stream->flags &= ~STREAMTCP_STREAM_FLAG_TRIGGER_RAW;
} else { } else {
SCLogDebug("p->pcap_cnt %"PRIu64": progress %"PRIu64" app %"PRIu64" raw %"PRIu64" tcp win %"PRIu32, SCLogDebug("PcapPacketCntGet(p) %" PRIu64 ": progress %" PRIu64 " app %" PRIu64
p->pcap_cnt, progress, STREAM_APP_PROGRESS(stream), " raw %" PRIu64 " tcp win %" PRIu32,
PcapPacketCntGet(p), progress, STREAM_APP_PROGRESS(stream),
STREAM_RAW_PROGRESS(stream), stream->window); STREAM_RAW_PROGRESS(stream), stream->window);
} }
@ -2026,7 +2027,7 @@ int StreamTcpReassembleHandleSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_
dir = UPDATE_DIR_BOTH; dir = UPDATE_DIR_BOTH;
} else if ((ssn->flags & STREAMTCP_FLAG_ASYNC) != 0) { } else if ((ssn->flags & STREAMTCP_FLAG_ASYNC) != 0) {
dir = UPDATE_DIR_PACKET; dir = UPDATE_DIR_PACKET;
SCLogDebug("%" PRIu64 ": ASYNC: UPDATE_DIR_PACKET", p->pcap_cnt); SCLogDebug("%" PRIu64 ": ASYNC: UPDATE_DIR_PACKET", PcapPacketCntGet(p));
} }
/* handle ack received */ /* handle ack received */
@ -2071,7 +2072,7 @@ int StreamTcpReassembleHandleSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_
SCReturnInt(-1); SCReturnInt(-1);
} }
SCLogDebug("packet %"PRIu64" set PKT_STREAM_ADD", p->pcap_cnt); SCLogDebug("packet %" PRIu64 " set PKT_STREAM_ADD", PcapPacketCntGet(p));
p->flags |= PKT_STREAM_ADD; p->flags |= PKT_STREAM_ADD;
} else { } else {
SCLogDebug("ssn %p / stream %p: not calling StreamTcpReassembleHandleSegmentHandleData:" SCLogDebug("ssn %p / stream %p: not calling StreamTcpReassembleHandleSegmentHandleData:"

6
src/stream-tcp-sack.c
Unescape Escape View File

@ -277,14 +277,14 @@ int StreamTcpSackUpdatePacket(TcpStream *stream, Packet *p)
/* RFC 2883 D-SACK */ /* RFC 2883 D-SACK */
if (SEQ_LT(le, TCP_GET_RAW_ACK(tcph))) { if (SEQ_LT(le, TCP_GET_RAW_ACK(tcph))) {
SCLogDebug("packet: %" PRIu64 ": D-SACK? %u-%u before ACK %u", p->pcap_cnt, le, re, SCLogDebug("packet: %" PRIu64 ": D-SACK? %u-%u before ACK %u", PcapPacketCntGet(p), le,
TCP_GET_RAW_ACK(tcph)); re, TCP_GET_RAW_ACK(tcph));
STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_DSACK); STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_DSACK);
goto next; goto next;
} else if (record == 1) { // 2nd record } else if (record == 1) { // 2nd record
if (SEQ_GEQ(first_le, le) && SEQ_LEQ(first_re, re)) { if (SEQ_GEQ(first_le, le) && SEQ_LEQ(first_re, re)) {
SCLogDebug("packet: %" PRIu64 ": D-SACK? %u-%u inside 2nd range %u-%u ACK %u", SCLogDebug("packet: %" PRIu64 ": D-SACK? %u-%u inside 2nd range %u-%u ACK %u",
p->pcap_cnt, first_le, first_re, le, re, TCP_GET_RAW_ACK(tcph)); PcapPacketCntGet(p), first_le, first_re, le, re, TCP_GET_RAW_ACK(tcph));
STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_DSACK); STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_DSACK);
} }
goto next; goto next;

148
src/stream-tcp.c
Unescape Escape View File

@ -1797,14 +1797,14 @@ static inline bool StateSynSentValidateTimestamp(TcpSession *ssn, Packet *p)
if (receiver_stream->last_ts != 0 && ts_echo != 0 && if (receiver_stream->last_ts != 0 && ts_echo != 0 &&
ts_echo != receiver_stream->last_ts) ts_echo != receiver_stream->last_ts)
{ {
SCLogDebug("%" PRIu64 ": ssn %p: BAD TSECR echo %u recv %u", p->pcap_cnt, ssn, ts_echo, SCLogDebug("%" PRIu64 ": ssn %p: BAD TSECR echo %u recv %u", PcapPacketCntGet(p), ssn,
receiver_stream->last_ts); ts_echo, receiver_stream->last_ts);
return false; return false;
} }
} else { } else {
if (receiver_stream->last_ts == 0 && ts_echo != 0) { if (receiver_stream->last_ts == 0 && ts_echo != 0) {
SCLogDebug("%" PRIu64 ": ssn %p: BAD TSECR echo %u recv %u", p->pcap_cnt, ssn, ts_echo, SCLogDebug("%" PRIu64 ": ssn %p: BAD TSECR echo %u recv %u", PcapPacketCntGet(p), ssn,
receiver_stream->last_ts); ts_echo, receiver_stream->last_ts);
return false; return false;
} }
} }
@ -1966,7 +1966,8 @@ static int StreamTcp3whsStoreSyn(TcpSession *ssn, Packet *p)
if (ssn->queue_len > 0 && ssn->queue_len == stream_config.max_syn_queued) { if (ssn->queue_len > 0 && ssn->queue_len == stream_config.max_syn_queued) {
DEBUG_VALIDATE_BUG_ON(ssn->queue == NULL); DEBUG_VALIDATE_BUG_ON(ssn->queue == NULL);
SCLogDebug("%" PRIu64 ": ssn %p: =~ SYN queue limit reached, rotate", p->pcap_cnt, ssn); SCLogDebug("%" PRIu64 ": ssn %p: =~ SYN queue limit reached, rotate", PcapPacketCntGet(p),
ssn);
StreamTcpSetEvent(p, STREAM_3WHS_SYN_FLOOD); StreamTcpSetEvent(p, STREAM_3WHS_SYN_FLOOD);
/* add to the list, evicting the oldest entry */ /* add to the list, evicting the oldest entry */
@ -1995,8 +1996,8 @@ static int StreamTcp3whsStoreSyn(TcpSession *ssn, Packet *p)
ssn->queue = q; ssn->queue = q;
} }
ssn->queue_len++; ssn->queue_len++;
SCLogDebug("%" PRIu64 ": ssn %p: =~ SYN with SEQ %u added (queue_len %u)", p->pcap_cnt, ssn, SCLogDebug("%" PRIu64 ": ssn %p: =~ SYN with SEQ %u added (queue_len %u)", PcapPacketCntGet(p),
q->seq, ssn->queue_len); ssn, q->seq, ssn->queue_len);
return 0; return 0;
} }
@ -2050,7 +2051,8 @@ static inline bool StateSynSentCheckSynAck3Whs(TcpSession *ssn, Packet *p, const
TcpStateQueue search; TcpStateQueue search;
TcpStateQueueInitFromPktSynAck(p, &search); TcpStateQueueInitFromPktSynAck(p, &search);
SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK looking for SEQ %u", p->pcap_cnt, ssn, search.seq); SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK looking for SEQ %u", PcapPacketCntGet(p), ssn,
search.seq);
const TcpStateQueue *q = const TcpStateQueue *q =
StreamTcp3whsFindSyn(ssn, &search, NULL, stream_config.liberal_timestamps); StreamTcp3whsFindSyn(ssn, &search, NULL, stream_config.liberal_timestamps);
@ -2100,7 +2102,8 @@ static inline bool StateSynSentCheckSynAckTFO(TcpSession *ssn, Packet *p, const
TcpStateQueue search; TcpStateQueue search;
TcpStateQueueInitFromPktSynAck(p, &search); TcpStateQueueInitFromPktSynAck(p, &search);
SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK looking for SEQ %u", p->pcap_cnt, ssn, search.seq); SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK looking for SEQ %u", PcapPacketCntGet(p), ssn,
search.seq);
const TcpStateQueue *q = const TcpStateQueue *q =
StreamTcp3whsFindSyn(ssn, &search, NULL, stream_config.liberal_timestamps); StreamTcp3whsFindSyn(ssn, &search, NULL, stream_config.liberal_timestamps);
@ -2145,7 +2148,7 @@ static int StreamTcpPacketStateSynSent(
/* common case: SYN/ACK from server to client */ /* common case: SYN/ACK from server to client */
if ((tcph->th_flags & (TH_SYN | TH_ACK)) == (TH_SYN | TH_ACK) && PKT_IS_TOCLIENT(p)) { if ((tcph->th_flags & (TH_SYN | TH_ACK)) == (TH_SYN | TH_ACK) && PKT_IS_TOCLIENT(p)) {
SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK on SYN_SENT state for packet %" PRIu64, SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK on SYN_SENT state for packet %" PRIu64,
p->pcap_cnt, ssn, p->pcap_cnt); PcapPacketCntGet(p), ssn, PcapPacketCntGet(p));
/* if timestamps are liberal, allow a SYN/ACK with TS even if the SYN /* if timestamps are liberal, allow a SYN/ACK with TS even if the SYN
* had none (violates RFC 7323, see bug #4702). */ * had none (violates RFC 7323, see bug #4702). */
const bool ts_mismatch = const bool ts_mismatch =
@ -2179,7 +2182,8 @@ static int StreamTcpPacketStateSynSent(
StreamTcp3wsFreeQueue(ssn); StreamTcp3wsFreeQueue(ssn);
StreamTcp3whsSynAckUpdate(ssn, p, /* no queue override */NULL); StreamTcp3whsSynAckUpdate(ssn, p, /* no queue override */NULL);
SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK on SYN_SENT state: accepted", p->pcap_cnt, ssn); SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK on SYN_SENT state: accepted", PcapPacketCntGet(p),
ssn);
return 0; return 0;
} else if ((tcph->th_flags & (TH_SYN | TH_ACK)) == (TH_SYN | TH_ACK) && PKT_IS_TOSERVER(p)) { } else if ((tcph->th_flags & (TH_SYN | TH_ACK)) == (TH_SYN | TH_ACK) && PKT_IS_TOSERVER(p)) {
@ -2383,7 +2387,7 @@ static int StreamTcpPacketStateSynSent(
StreamTcp3whsStoreSyn(ssn, p); StreamTcp3whsStoreSyn(ssn, p);
SCLogDebug("ssn %p: Retransmitted SYN. Updating ssn from packet %" PRIu64 SCLogDebug("ssn %p: Retransmitted SYN. Updating ssn from packet %" PRIu64
". Stored previous state", ". Stored previous state",
ssn, p->pcap_cnt); ssn, PcapPacketCntGet(p));
} }
StreamTcp3whsStoreSynApplyToSsn(ssn, &syn_pkt); StreamTcp3whsStoreSynApplyToSsn(ssn, &syn_pkt);
} }
@ -3237,7 +3241,7 @@ static bool StreamTcpPacketIsZeroWindowProbeAck(const TcpSession *ssn, const Pac
return false; return false;
if (TCP_GET_RAW_ACK(tcph) != rcv->last_ack) if (TCP_GET_RAW_ACK(tcph) != rcv->last_ack)
return false; return false;
SCLogDebug("ssn %p: packet %" PRIu64 " is a Zero Window Probe ACK", ssn, p->pcap_cnt); SCLogDebug("ssn %p: packet %" PRIu64 " is a Zero Window Probe ACK", ssn, PcapPacketCntGet(p));
return true; return true;
} }
@ -3275,8 +3279,8 @@ static bool StreamTcpPacketIsDupAck(const TcpSession *ssn, const Packet *p)
return false; return false;
SCLogDebug("ssn %p: packet:%" PRIu64 " seq:%u ack:%u win:%u snd %u:%u:%u rcv %u:%u:%u", ssn, SCLogDebug("ssn %p: packet:%" PRIu64 " seq:%u ack:%u win:%u snd %u:%u:%u rcv %u:%u:%u", ssn,
p->pcap_cnt, TCP_GET_RAW_SEQ(tcph), TCP_GET_RAW_ACK(tcph), pkt_win, snd->next_seq, PcapPacketCntGet(p), TCP_GET_RAW_SEQ(tcph), TCP_GET_RAW_ACK(tcph), pkt_win,
snd->last_ack, rcv->window, snd->next_seq, rcv->last_ack, rcv->window); snd->next_seq, snd->last_ack, rcv->window, snd->next_seq, rcv->last_ack, rcv->window);
return true; return true;
} }
@ -5270,8 +5274,9 @@ static void StreamTcpPacketCheckPostRst(TcpSession *ssn, Packet *p)
} }
if (ostream->flags & STREAMTCP_STREAM_FLAG_RST_RECV) { if (ostream->flags & STREAMTCP_STREAM_FLAG_RST_RECV) {
SCLogDebug("regular packet %"PRIu64" from same sender as " SCLogDebug("regular packet %" PRIu64 " from same sender as "
"the previous RST. Looks like it injected!", p->pcap_cnt); "the previous RST. Looks like it injected!",
PcapPacketCntGet(p));
ostream->flags &= ~STREAMTCP_STREAM_FLAG_RST_RECV; ostream->flags &= ~STREAMTCP_STREAM_FLAG_RST_RECV;
ssn->flags &= ~STREAMTCP_FLAG_CLOSED_BY_RST; ssn->flags &= ~STREAMTCP_FLAG_CLOSED_BY_RST;
StreamTcpSetEvent(p, STREAM_SUSPECTED_RST_INJECT); StreamTcpSetEvent(p, STREAM_SUSPECTED_RST_INJECT);
@ -5314,7 +5319,7 @@ static int StreamTcpPacketIsKeepAlive(TcpSession *ssn, Packet *p)
const uint32_t seq = TCP_GET_RAW_SEQ(tcph); const uint32_t seq = TCP_GET_RAW_SEQ(tcph);
const uint32_t ack = TCP_GET_RAW_ACK(tcph); const uint32_t ack = TCP_GET_RAW_ACK(tcph);
if (ack == ostream->last_ack && seq == (stream->next_seq - 1)) { if (ack == ostream->last_ack && seq == (stream->next_seq - 1)) {
SCLogDebug("packet is TCP keep-alive: %"PRIu64, p->pcap_cnt); SCLogDebug("packet is TCP keep-alive: %" PRIu64, PcapPacketCntGet(p));
stream->flags |= STREAMTCP_STREAM_FLAG_KEEPALIVE; stream->flags |= STREAMTCP_STREAM_FLAG_KEEPALIVE;
STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_KEEPALIVE); STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_KEEPALIVE);
return 1; return 1;
@ -5363,7 +5368,7 @@ static int StreamTcpPacketIsKeepAliveACK(TcpSession *ssn, Packet *p)
return 0; return 0;
if ((ostream->flags & STREAMTCP_STREAM_FLAG_KEEPALIVE) && ack == ostream->last_ack && seq == stream->next_seq) { if ((ostream->flags & STREAMTCP_STREAM_FLAG_KEEPALIVE) && ack == ostream->last_ack && seq == stream->next_seq) {
SCLogDebug("packet is TCP keep-aliveACK: %"PRIu64, p->pcap_cnt); SCLogDebug("packet is TCP keep-aliveACK: %" PRIu64, PcapPacketCntGet(p));
ostream->flags &= ~STREAMTCP_STREAM_FLAG_KEEPALIVE; ostream->flags &= ~STREAMTCP_STREAM_FLAG_KEEPALIVE;
STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_KEEPALIVEACK); STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_KEEPALIVEACK);
return 1; return 1;
@ -5435,7 +5440,7 @@ static int StreamTcpPacketIsWindowUpdate(TcpSession *ssn, Packet *p)
return 0; return 0;
if (ack == ostream->last_ack && seq == stream->next_seq) { if (ack == ostream->last_ack && seq == stream->next_seq) {
SCLogDebug("packet is TCP window update: %"PRIu64, p->pcap_cnt); SCLogDebug("packet is TCP window update: %" PRIu64, PcapPacketCntGet(p));
STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_WINDOWUPDATE); STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_WINDOWUPDATE);
return 1; return 1;
} }
@ -5474,8 +5479,8 @@ static int StreamTcpPacketIsFinShutdownAck(TcpSession *ssn, Packet *p)
seq = TCP_GET_RAW_SEQ(tcph); seq = TCP_GET_RAW_SEQ(tcph);
ack = TCP_GET_RAW_ACK(tcph); ack = TCP_GET_RAW_ACK(tcph);
SCLogDebug("%"PRIu64", seq %u ack %u stream->next_seq %u ostream->next_seq %u", SCLogDebug("%" PRIu64 ", seq %u ack %u stream->next_seq %u ostream->next_seq %u",
p->pcap_cnt, seq, ack, stream->next_seq, ostream->next_seq); PcapPacketCntGet(p), seq, ack, stream->next_seq, ostream->next_seq);
if (SEQ_EQ(stream->next_seq + 1, seq) && SEQ_EQ(ack, ostream->next_seq + 1)) { if (SEQ_EQ(stream->next_seq + 1, seq) && SEQ_EQ(ack, ostream->next_seq + 1)) {
return 1; return 1;
@ -5535,13 +5540,15 @@ static int StreamTcpPacketIsBadWindowUpdate(TcpSession *ssn, Packet *p)
SEQ_GT(ack, ostream->next_seq) && SEQ_GT(ack, ostream->next_seq) &&
SEQ_GT(seq, stream->next_seq)) SEQ_GT(seq, stream->next_seq))
{ {
SCLogDebug("%"PRIu64", pkt_win %u, stream win %u, diff %u, dsize %u", SCLogDebug("%" PRIu64 ", pkt_win %u, stream win %u, diff %u, dsize %u",
p->pcap_cnt, pkt_win, ostream->window, diff, p->payload_len); PcapPacketCntGet(p), pkt_win, ostream->window, diff, p->payload_len);
SCLogDebug("%"PRIu64", pkt_win %u, stream win %u", SCLogDebug("%" PRIu64 ", pkt_win %u, stream win %u", PcapPacketCntGet(p), pkt_win,
p->pcap_cnt, pkt_win, ostream->window); ostream->window);
SCLogDebug("%"PRIu64", seq %u ack %u ostream->next_seq %u ostream->last_ack %u, ostream->next_win %u, diff %u (%u)", SCLogDebug("%" PRIu64 ", seq %u ack %u ostream->next_seq %u ostream->last_ack %u, "
p->pcap_cnt, seq, ack, ostream->next_seq, ostream->last_ack, ostream->next_win, "ostream->next_win %u, diff %u (%u)",
ostream->next_seq - ostream->last_ack, stream->next_seq - stream->last_ack); PcapPacketCntGet(p), seq, ack, ostream->next_seq, ostream->last_ack,
ostream->next_win, ostream->next_seq - ostream->last_ack,
stream->next_seq - stream->last_ack);
/* get the expected window shrinking from looking at ack vs last_ack. /* get the expected window shrinking from looking at ack vs last_ack.
* Observed a lot of just a little overrunning that value. So added some * Observed a lot of just a little overrunning that value. So added some
@ -5673,7 +5680,7 @@ int StreamTcpPacket (ThreadVars *tv, Packet *p, StreamTcpThread *stt,
DEBUG_ASSERT_FLOW_LOCKED(p->flow); DEBUG_ASSERT_FLOW_LOCKED(p->flow);
SCLogDebug("p->pcap_cnt %"PRIu64, p->pcap_cnt); SCLogDebug("PcapPacketCntGet(p) %" PRIu64, PcapPacketCntGet(p));
TcpSession *ssn = (TcpSession *)p->flow->protoctx; TcpSession *ssn = (TcpSession *)p->flow->protoctx;
const TCPHdr *tcph = PacketGetTCP(p); const TCPHdr *tcph = PacketGetTCP(p);
@ -5898,7 +5905,7 @@ static inline int StreamTcpValidateChecksum(Packet *p)
ret = 0; ret = 0;
if (p->livedev) { if (p->livedev) {
(void) SC_ATOMIC_ADD(p->livedev->invalid_checksums, 1); (void) SC_ATOMIC_ADD(p->livedev->invalid_checksums, 1);
} else if (p->pcap_cnt) { } else if (PcapPacketCntGet(p)) {
PcapIncreaseInvalidChecksum(); PcapIncreaseInvalidChecksum();
} }
} }
@ -5917,14 +5924,15 @@ static int TcpSessionPacketIsStreamStarter(const Packet *p)
} }
if ((tcph->th_flags & (TH_SYN | TH_ACK)) == TH_SYN) { if ((tcph->th_flags & (TH_SYN | TH_ACK)) == TH_SYN) {
SCLogDebug("packet %" PRIu64 " is a stream starter: %02x", p->pcap_cnt, tcph->th_flags); SCLogDebug("packet %" PRIu64 " is a stream starter: %02x", PcapPacketCntGet(p),
tcph->th_flags);
return 1; return 1;
} }
if (stream_config.midstream || stream_config.async_oneside) { if (stream_config.midstream || stream_config.async_oneside) {
if ((tcph->th_flags & (TH_SYN | TH_ACK)) == (TH_SYN | TH_ACK)) { if ((tcph->th_flags & (TH_SYN | TH_ACK)) == (TH_SYN | TH_ACK)) {
SCLogDebug("packet %" PRIu64 " is a midstream stream starter: %02x", p->pcap_cnt, SCLogDebug("packet %" PRIu64 " is a midstream stream starter: %02x",
tcph->th_flags); PcapPacketCntGet(p), tcph->th_flags);
return 1; return 1;
} }
} }
@ -5941,43 +5949,57 @@ static bool TcpSessionReuseDoneEnoughSyn(const Packet *p, const Flow *f, const T
if (ssn == NULL) { if (ssn == NULL) {
/* most likely a flow that was picked up after the 3whs, or a flow that /* most likely a flow that was picked up after the 3whs, or a flow that
* does not have a session due to memcap issues. */ * does not have a session due to memcap issues. */
SCLogDebug("steam starter packet %" PRIu64 ", ssn %p null. Reuse.", p->pcap_cnt, ssn); SCLogDebug("stream starter packet %" PRIu64 ", ssn %p null. Reuse.",
PcapPacketCntGet(p), ssn);
return true; return true;
} }
if (ssn->flags & STREAMTCP_FLAG_TFO_DATA_IGNORED) { if (ssn->flags & STREAMTCP_FLAG_TFO_DATA_IGNORED) {
SCLogDebug("steam starter packet %" PRIu64 SCLogDebug("stream starter packet %" PRIu64
", ssn %p. STREAMTCP_FLAG_TFO_DATA_IGNORED set. Reuse.", ", ssn %p. STREAMTCP_FLAG_TFO_DATA_IGNORED set. Reuse.",
p->pcap_cnt, ssn); PcapPacketCntGet(p), ssn);
return true; return true;
} }
if (SEQ_EQ(ssn->client.isn, TCP_GET_RAW_SEQ(tcph))) { if (SEQ_EQ(ssn->client.isn, TCP_GET_RAW_SEQ(tcph))) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.", p->pcap_cnt, ssn); SCLogDebug("stream starter packet %" PRIu64
", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.",
PcapPacketCntGet(p), ssn);
return false; return false;
} }
if (ssn->state >= TCP_LAST_ACK) { if (ssn->state >= TCP_LAST_ACK) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); SCLogDebug("stream starter packet %" PRIu64
", ssn %p state >= TCP_LAST_ACK (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true; return true;
} else if (ssn->state == TCP_NONE) { } else if (ssn->state == TCP_NONE) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); SCLogDebug("stream starter packet %" PRIu64 ", ssn %p state == TCP_NONE (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true; return true;
} else { // < TCP_LAST_ACK } else { // < TCP_LAST_ACK
SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state); SCLogDebug("stream starter packet %" PRIu64
", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return false; return false;
} }
} else { } else {
if (ssn == NULL) { if (ssn == NULL) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p null. Reuse.", p->pcap_cnt, ssn); SCLogDebug("stream starter packet %" PRIu64 ", ssn %p null. Reuse.",
PcapPacketCntGet(p), ssn);
return true; return true;
} }
if (ssn->state >= TCP_LAST_ACK) { if (ssn->state >= TCP_LAST_ACK) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); SCLogDebug("stream starter packet %" PRIu64
", ssn %p state >= TCP_LAST_ACK (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true; return true;
} else if (ssn->state == TCP_NONE) { } else if (ssn->state == TCP_NONE) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); SCLogDebug("stream starter packet %" PRIu64 ", ssn %p state == TCP_NONE (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true; return true;
} else { // < TCP_LAST_ACK } else { // < TCP_LAST_ACK
SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state); SCLogDebug("stream starter packet %" PRIu64
", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return false; return false;
} }
} }
@ -5995,37 +6017,51 @@ static bool TcpSessionReuseDoneEnoughSynAck(const Packet *p, const Flow *f, cons
const TCPHdr *tcph = PacketGetTCP(p); const TCPHdr *tcph = PacketGetTCP(p);
if (FlowGetPacketDirection(f, p) == TOCLIENT) { if (FlowGetPacketDirection(f, p) == TOCLIENT) {
if (ssn == NULL) { if (ssn == NULL) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p null. No reuse.", p->pcap_cnt, ssn); SCLogDebug("stream starter packet %" PRIu64 ", ssn %p null. No reuse.",
PcapPacketCntGet(p), ssn);
return false; return false;
} }
if (SEQ_EQ(ssn->server.isn, TCP_GET_RAW_SEQ(tcph))) { if (SEQ_EQ(ssn->server.isn, TCP_GET_RAW_SEQ(tcph))) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.", p->pcap_cnt, ssn); SCLogDebug("stream starter packet %" PRIu64
", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.",
PcapPacketCntGet(p), ssn);
return false; return false;
} }
if (ssn->state >= TCP_LAST_ACK) { if (ssn->state >= TCP_LAST_ACK) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); SCLogDebug("stream starter packet %" PRIu64
", ssn %p state >= TCP_LAST_ACK (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true; return true;
} else if (ssn->state == TCP_NONE) { } else if (ssn->state == TCP_NONE) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); SCLogDebug("stream starter packet %" PRIu64 ", ssn %p state == TCP_NONE (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true; return true;
} else { // < TCP_LAST_ACK } else { // < TCP_LAST_ACK
SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state); SCLogDebug("stream starter packet %" PRIu64
", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return false; return false;
} }
} else { } else {
if (ssn == NULL) { if (ssn == NULL) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p null. Reuse.", p->pcap_cnt, ssn); SCLogDebug("stream starter packet %" PRIu64 ", ssn %p null. Reuse.",
PcapPacketCntGet(p), ssn);
return true; return true;
} }
if (ssn->state >= TCP_LAST_ACK) { if (ssn->state >= TCP_LAST_ACK) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); SCLogDebug("stream starter packet %" PRIu64
", ssn %p state >= TCP_LAST_ACK (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true; return true;
} else if (ssn->state == TCP_NONE) { } else if (ssn->state == TCP_NONE) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); SCLogDebug("stream starter packet %" PRIu64 ", ssn %p state == TCP_NONE (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true; return true;
} else { // < TCP_LAST_ACK } else { // < TCP_LAST_ACK
SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state); SCLogDebug("stream starter packet %" PRIu64
", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return false; return false;
} }
} }
@ -6076,13 +6112,13 @@ TmEcode StreamTcp (ThreadVars *tv, Packet *p, void *data, PacketQueueNoLock *pq)
StreamTcpThread *stt = (StreamTcpThread *)data; StreamTcpThread *stt = (StreamTcpThread *)data;
SCLogDebug("p->pcap_cnt %" PRIu64 " direction %s pkt_src %s", p->pcap_cnt, SCLogDebug("PcapPacketCntGet(p) %" PRIu64 " direction %s pkt_src %s", PcapPacketCntGet(p),
p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient") p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient")
: "noflow", : "noflow",
PktSrcToString(p->pkt_src)); PktSrcToString(p->pkt_src));
#ifdef DEBUG #ifdef DEBUG
t_pcapcnt = p->pcap_cnt; t_pcapcnt = PcapPacketCntGet(p);
#endif /* DEBUG */ #endif /* DEBUG */
if (!(PacketIsTCP(p))) { if (!(PacketIsTCP(p))) {

12
src/tests/detect-http-header.c
Unescape Escape View File

@ -4583,17 +4583,17 @@ static int DetectEngineHttpHeaderTest34(void)
p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p1->pcap_cnt = 1; PcapPacketCntSet(p1, 1);
p2->flow = &f; p2->flow = &f;
p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_TOSERVER;
p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p2->pcap_cnt = 2; PcapPacketCntSet(p2, 2);
p3->flow = &f; p3->flow = &f;
p3->flowflags |= FLOW_PKT_TOSERVER; p3->flowflags |= FLOW_PKT_TOSERVER;
p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p3->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p3->pcap_cnt = 3; PcapPacketCntSet(p3, 3);
f.alproto = ALPROTO_HTTP1; f.alproto = ALPROTO_HTTP1;
StreamTcpInitConfig(true); StreamTcpInitConfig(true);
@ -4699,17 +4699,17 @@ static int DetectEngineHttpHeaderTest35(void)
p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p1->pcap_cnt = 1; PcapPacketCntSet(p1, 1);
p2->flow = &f; p2->flow = &f;
p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_TOSERVER;
p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p2->pcap_cnt = 2; PcapPacketCntSet(p2, 2);
p3->flow = &f; p3->flow = &f;
p3->flowflags |= FLOW_PKT_TOSERVER; p3->flowflags |= FLOW_PKT_TOSERVER;
p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; p3->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p3->pcap_cnt = 3; PcapPacketCntSet(p3, 3);
f.alproto = ALPROTO_HTTP1; f.alproto = ALPROTO_HTTP1;
StreamTcpInitConfig(true); StreamTcpInitConfig(true);

6
src/tests/detect-tls-cert-fingerprint.c
Unescape Escape View File

@ -290,19 +290,19 @@ static int DetectTlsFingerprintTest02(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1; PcapPacketCntSet(p1, 1);
p2->flow = &f; p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2; PcapPacketCntSet(p2, 2);
p3->flow = &f; p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3; PcapPacketCntSet(p3, 3);
StreamTcpInitConfig(true); StreamTcpInitConfig(true);

6
src/tests/detect-tls-cert-issuer.c
Unescape Escape View File

@ -290,19 +290,19 @@ static int DetectTlsIssuerTest02(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1; PcapPacketCntSet(p1, 1);
p2->flow = &f; p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2; PcapPacketCntSet(p2, 2);
p3->flow = &f; p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3; PcapPacketCntSet(p3, 3);
StreamTcpInitConfig(true); StreamTcpInitConfig(true);

6
src/tests/detect-tls-cert-serial.c
Unescape Escape View File

@ -287,19 +287,19 @@ static int DetectTlsSerialTest02(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1; PcapPacketCntSet(p1, 1);
p2->flow = &f; p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2; PcapPacketCntSet(p2, 2);
p3->flow = &f; p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3; PcapPacketCntSet(p3, 3);
StreamTcpInitConfig(true); StreamTcpInitConfig(true);

6
src/tests/detect-tls-cert-subject.c
Unescape Escape View File

@ -290,19 +290,19 @@ static int DetectTlsSubjectTest02(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1; PcapPacketCntSet(p1, 1);
p2->flow = &f; p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2; PcapPacketCntSet(p2, 2);
p3->flow = &f; p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3; PcapPacketCntSet(p3, 3);
StreamTcpInitConfig(true); StreamTcpInitConfig(true);

18
src/tests/detect-tls-cert-validity.c
Unescape Escape View File

@ -654,19 +654,19 @@ static int ValidityTestDetect01(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1; PcapPacketCntSet(p1, 1);
p2->flow = &f; p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2; PcapPacketCntSet(p2, 2);
p3->flow = &f; p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3; PcapPacketCntSet(p3, 3);
StreamTcpInitConfig(true); StreamTcpInitConfig(true);
@ -977,19 +977,19 @@ static int ExpiredTestDetect01(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1; PcapPacketCntSet(p1, 1);
p2->flow = &f; p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2; PcapPacketCntSet(p2, 2);
p3->flow = &f; p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3; PcapPacketCntSet(p3, 3);
f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */ f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */
@ -1280,19 +1280,19 @@ static int ValidTestDetect01(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1; PcapPacketCntSet(p1, 1);
p2->flow = &f; p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2; PcapPacketCntSet(p2, 2);
p3->flow = &f; p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3; PcapPacketCntSet(p3, 3);
f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */ f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */

6
src/tests/detect-tls-certs.c
Unescape Escape View File

@ -286,19 +286,19 @@ static int DetectTlsCertsTest02(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1; PcapPacketCntSet(p1, 1);
p2->flow = &f; p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2; PcapPacketCntSet(p2, 2);
p3->flow = &f; p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3; PcapPacketCntSet(p3, 3);
StreamTcpInitConfig(true); StreamTcpInitConfig(true);

2
src/tests/fuzz/fuzz_predefpcap_aware.c
Unescape Escape View File

@ -156,7 +156,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
p->ts = SCTIME_FROM_TIMEVAL(&header.ts); p->ts = SCTIME_FROM_TIMEVAL(&header.ts);
p->datalink = pkts.datalink; p->datalink = pkts.datalink;
pcap_cnt++; pcap_cnt++;
p->pcap_cnt = pcap_cnt; PcapPacketCntSet(p, pcap_cnt);
p->pkt_src = PKT_SRC_WIRE; p->pkt_src = PKT_SRC_WIRE;
} }
bail: bail:

2
src/tests/fuzz/fuzz_sigpcap.c
Unescape Escape View File

@ -200,7 +200,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
p->datalink = pcap_datalink(pkts); p->datalink = pcap_datalink(pkts);
p->pkt_src = PKT_SRC_WIRE; p->pkt_src = PKT_SRC_WIRE;
pcap_cnt++; pcap_cnt++;
p->pcap_cnt = pcap_cnt; PcapPacketCntSet(p, pcap_cnt);
} }
bail: bail:
//close structure //close structure

2
src/tests/fuzz/fuzz_sigpcap_aware.c
Unescape Escape View File

@ -196,7 +196,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
p->ts = SCTIME_FROM_TIMEVAL(&header.ts); p->ts = SCTIME_FROM_TIMEVAL(&header.ts);
p->datalink = pkts.datalink; p->datalink = pkts.datalink;
pcap_cnt++; pcap_cnt++;
p->pcap_cnt = pcap_cnt; PcapPacketCntSet(p, pcap_cnt);
} }
bail: bail:
PacketFree(p); PacketFree(p);

2
src/util-exception-policy.c
Unescape Escape View File

@ -137,7 +137,7 @@ enum ExceptionPolicy ExceptionPolicyTargetPolicy(uint8_t target_flag)
void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDropReason drop_reason) void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDropReason drop_reason)
{ {
SCLogDebug("start: pcap_cnt %" PRIu64 ", policy %u", p->pcap_cnt, policy); SCLogDebug("start: pcap_cnt %" PRIu64 ", policy %u", PcapPacketCntGet(p), policy);
if (p->flow) { if (p->flow) {
p->flow->applied_exception_policy |= ExceptionPolicyFlag(drop_reason); p->flow->applied_exception_policy |= ExceptionPolicyFlag(drop_reason);
} }

2
src/util-lua-packetlib.c
Unescape Escape View File

@ -80,7 +80,7 @@ static int LuaPacketPcapCnt(lua_State *luastate)
LUA_ERROR("failed to get packet"); LUA_ERROR("failed to get packet");
} }
lua_pushinteger(luastate, s->p->pcap_cnt); lua_pushinteger(luastate, PcapPacketCntGet(s->p));
return 1; return 1;
} }

3
src/util-profiling.c
Unescape Escape View File

@ -790,8 +790,7 @@ void SCProfilingPrintPacketProfile(Packet *p)
/* total cost from acquisition to return to packetpool */ /* total cost from acquisition to return to packetpool */
uint64_t delta = p->profile->ticks_end - p->profile->ticks_start; uint64_t delta = p->profile->ticks_end - p->profile->ticks_start;
fprintf(packet_profile_csv_fp, "%"PRIu64",%"PRIu64",", fprintf(packet_profile_csv_fp, "%" PRIu64 ",%" PRIu64 ",", PcapPacketCntGet(p), delta);
p->pcap_cnt, delta);
for (int i = 0; i < TMM_SIZE; i++) { for (int i = 0; i < TMM_SIZE; i++) {
const PktProfilingTmmData *pdt = &p->profile->tmm[i]; const PktProfilingTmmData *pdt = &p->profile->tmm[i];

Write Preview
Loading…
Cancel
Save