aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Implements counters for the decode module

Browse Source
remotes/origin/master-1.0.x
Anoop Saldanha 16 years ago committed by Victor Julien
parent fb68d1c658
commit d0e70309c0
11 changed files with 59 additions and 14 deletions
Show Stats Download Patch File Download Diff File

4
src/decode-ethernet.c
Unescape Escape View File

@ -6,6 +6,8 @@
void DecodeEthernet(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len, PacketQueue *pq)
{
PerfCounterIncr(COUNTER_DECODER_ETH, t->pca);
if (len < ETHERNET_HEADER_LEN) {
DECODER_SET_EVENT(p,ETHERNET_PKT_TOO_SMALL);
return;
@ -21,11 +23,9 @@ void DecodeEthernet(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len, Pack
if (ntohs(ethh->eth_type) == ETHERNET_TYPE_IP) {
//printf("DecodeEthernet ip4\n");
PerfCounterIncr(COUNTER_DECODER_IPV4, t->pca);
DecodeIPV4(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN, pq);
} else if(ntohs(ethh->eth_type) == ETHERNET_TYPE_IPV6) {
//printf("DecodeEthernet ip6\n");
PerfCounterIncr(COUNTER_DECODER_IPV6, t->pca);
DecodeIPV6(t, p, pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN);
}

2
src/decode-icmpv4.c
Unescape Escape View File

@ -7,6 +7,8 @@ void DecodeICMPV4(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len )
{
p->icmpv4h = (ICMPV4Hdr *)pkt;
PerfCounterIncr(COUNTER_DECODER_ICMPV4, t->pca);
if (len < ICMPV4_HEADER_LEN) {
return;
}

2
src/decode-icmpv6.c
Unescape Escape View File

@ -7,6 +7,8 @@ void DecodeICMPV6(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len)
{
p->icmpv6h = (ICMPV6Hdr *)pkt;
PerfCounterIncr(COUNTER_DECODER_ICMPV6, t->pca);
if (len < ICMPV6_HEADER_LEN) {
return;
}

7
src/decode-ipv4.c
Unescape Escape View File

@ -53,6 +53,8 @@ void DecodeIPV4(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len, PacketQu
{
int ret;
PerfCounterIncr(COUNTER_DECODER_IPV4, t->pca);
/* reset the decoder cache flags */
IPV4_CACHE_INIT(p);
@ -86,27 +88,22 @@ void DecodeIPV4(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len, PacketQu
case IPPROTO_IP:
/* check PPP VJ uncompressed packets and decode tcp dummy */
if(p->ppph != NULL && ntohs(p->ppph->protocol) == PPP_VJ_UCOMP) {
return(DecodeTCP(t, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p)));
}
break;
case IPPROTO_TCP:
PerfCounterIncr(COUNTER_DECODER_TCP, t->pca);
return(DecodeTCP(t, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p)));
break;
case IPPROTO_UDP:
//printf("DecodeIPV4: next layer is UDP\n");
PerfCounterIncr(COUNTER_DECODER_UDP, t->pca);
return(DecodeUDP(t, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p)));
break;
case IPPROTO_ICMP:
//printf("DecodeIPV4: next layer is ICMP\n");
PerfCounterIncr(COUNTER_DECODER_ICMPV4, t->pca);
return(DecodeICMPV4(t, p, pkt + IPV4_GET_HLEN(p), IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p)));
break;
case IPPROTO_IPV6:
{
PerfCounterIncr(COUNTER_DECODER_ICMPV6, t->pca);
if (pq != NULL) {
//printf("DecodeIPV4: next layer is IPV6\n");
//printf("DecodeIPV4: we are p %p\n", p);

2
src/decode-ipv6.c
Unescape Escape View File

@ -362,6 +362,8 @@ void DecodeIPV6(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len)
{
int ret;
PerfCounterIncr(COUNTER_DECODER_IPV6, t->pca);
IPV6_CACHE_INIT(p);
/* do the actual decoding */

2
src/decode-ppp.c
Unescape Escape View File

@ -13,6 +13,8 @@
void DecodePPP(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len, PacketQueue *pq)
{
PerfCounterIncr(COUNTER_DECODER_PPP, t->pca);
if(len < PPP_HEADER_LEN) {
DECODER_SET_EVENT(p,PPP_PKT_TOO_SMALL);
return;

2
src/decode-sll.c
Unescape Escape View File

@ -6,6 +6,8 @@
void DecodeSll(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len, PacketQueue *pq)
{
PerfCounterIncr(COUNTER_DECODER_SLL, t->pca);
if (len < SLL_HEADER_LEN) {
DECODER_SET_EVENT(p,SLL_PKT_TOO_SMALL);
return;

2
src/decode-tcp.c
Unescape Escape View File

@ -136,6 +136,8 @@ static int DecodeTCPPacket(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t le
void DecodeTCP(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len)
{
PerfCounterIncr(COUNTER_DECODER_TCP, t->pca);
if (DecodeTCPPacket(t, p,pkt,len) < 0)
return;

2
src/decode-udp.c
Unescape Escape View File

@ -38,6 +38,8 @@ static int DecodeUDPPacket(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t le
void DecodeUDP(ThreadVars *t, Packet *p, u_int8_t *pkt, u_int16_t len)
{
PerfCounterIncr(COUNTER_DECODER_UDP, t->pca);
if (DecodeUDPPacket(t, p,pkt,len) < 0)
return;

41
src/source-pcap-file.c
Unescape Escape View File

@ -50,6 +50,7 @@ void ReceivePcapFileThreadExitStats(ThreadVars *, void *);
int ReceivePcapFileThreadDeinit(ThreadVars *, void *);
int DecodePcapFile(ThreadVars *, Packet *, void *, PacketQueue *);
int DecodePcapFileThreadInit(ThreadVars *, void *, void **);
void TmModuleReceivePcapFileRegister (void) {
tmm_modules[TMM_RECEIVEPCAPFILE].name = "ReceivePcapFile";
@ -62,7 +63,7 @@ void TmModuleReceivePcapFileRegister (void) {
void TmModuleDecodePcapFileRegister (void) {
tmm_modules[TMM_DECODEPCAPFILE].name = "DecodePcapFile";
tmm_modules[TMM_DECODEPCAPFILE].Init = NULL;
tmm_modules[TMM_DECODEPCAPFILE].Init = DecodePcapFileThreadInit;
tmm_modules[TMM_DECODEPCAPFILE].Func = DecodePcapFile;
tmm_modules[TMM_DECODEPCAPFILE].ExitPrintStats = NULL;
tmm_modules[TMM_DECODEPCAPFILE].Deinit = NULL;
@ -162,11 +163,47 @@ int ReceivePcapFileThreadDeinit(ThreadVars *tv, void *data) {
return 0;
}
int DecodePcapFile(ThreadVars *t, Packet *p, void *data, PacketQueue *pq) {
int DecodePcapFile(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
{
PerfCounterIncr(COUNTER_DECODER_PKTS, t->pca);
PerfCounterAdd(COUNTER_DECODER_BYTES, t->pca, p->pktlen);
/* call the decoder */
pcap_g.Decoder(t,p,p->pkt,p->pktlen,pq);
return 0;
}
int DecodePcapFileThreadInit(ThreadVars *tv, void *initdata, void **data)
{
PerfRegisterCounter("decoder.pkts", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx);
PerfRegisterCounter("decoder.bytes", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx);
PerfRegisterCounter("decoder.ipv4", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx);
PerfRegisterCounter("decoder.ipv6", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx);
PerfRegisterCounter("decoder.ethernet", "DecodePcapFile", TYPE_UINT64,
"NULL", &tv->pctx);
PerfRegisterCounter("decoder.sll", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx);
PerfRegisterCounter("decoder.tcp", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx);
PerfRegisterCounter("decoder.udp", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx);
PerfRegisterCounter("decoder.icmpv4", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx);
PerfRegisterCounter("decoder.icmpv6", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx);
PerfRegisterCounter("decoder.ppp", "DecodePcapFile", TYPE_UINT64, "NULL",
&tv->pctx);
tv->pca = PerfGetAllCountersArray(&tv->pctx);
PerfAddToClubbedTMTable("DecodePcapFile", &tv->pctx);
return 0;
}
/* eof */

7
src/source-pcap.c
Unescape Escape View File

@ -283,23 +283,20 @@ int ReceivePcapThreadDeinit(ThreadVars *tv, void *data) {
* \param data pointer that gets cast into PcapThreadVars for ptv
* \param pq pointer to the current PacketQueue
*/
int DecodePcap(ThreadVars *t, Packet *p, void *data, PacketQueue *pq) {
int DecodePcap(ThreadVars *t, Packet *p, void *data, PacketQueue *pq)
{
PerfCounterIncr(COUNTER_DECODER_PKTS, t->pca);
PerfCounterAdd(COUNTER_DECODER_BYTES, t->pca, p->pktlen);
/* call the decoder */
switch(p->pcap_v.datalink) {
case LINKTYPE_LINUX_SLL:
PerfCounterIncr(COUNTER_DECODER_SLL, t->pca);
DecodeSll(t,p,p->pkt,p->pktlen,pq);
break;
case LINKTYPE_ETHERNET:
PerfCounterIncr(COUNTER_DECODER_ETH, t->pca);
DecodeEthernet(t,p,p->pkt,p->pktlen,pq);
break;
case LINKTYPE_PPP:
PerfCounterIncr(COUNTER_DECODER_PPP, t->pca);
DecodePPP(t,p,p->pkt,p->pktlen,pq);
break;
default:

Write Preview
Loading…
Cancel
Save