aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

pcap-file: prep codebase for pcap_cnt move refactor

Browse Source 
For an easier review process, this is a two-step change process,
in which pcap_cnt is first accessed by functions-to-be, implemented
as simple macros.

In the follow-up commit, the actual refactor is implemented with the new
function. The old macros are deleted.

Ticket: 7835
pull/14673/head
Lukas Sismis 3 months ago committed by Victor Julien
parent f33f6e7ee5
commit 400328c3c3
42 changed files with 266 additions and 214 deletions
Show Stats Download Patch File Download Diff File

10
plugins/ndpi/ndpi.c
Unescape Escape View File

@ -191,18 +191,18 @@ static int DetectnDPIProtocolPacketMatch(
/*
if (s->type == SIG_TYPE_PDONLY &&
(p->flags & (PKT_PROTO_DETECT_TS_DONE | PKT_PROTO_DETECT_TC_DONE)) == 0) {
SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt);
SCLogDebug("packet %"PRIu64": flags not set", PcapPacketCntGet(p));
SCReturnInt(0);
}
*/
if (!flowctx->detection_completed) {
SCLogDebug("packet %" PRIu64 ": ndpi protocol not yet detected", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 ": ndpi protocol not yet detected", PcapPacketCntGet(p));
SCReturnInt(0);
}
if (f == NULL) {
SCLogDebug("packet %" PRIu64 ": no flow", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 ": no flow", PcapPacketCntGet(p));
SCReturnInt(0);
}
@ -318,12 +318,12 @@ static int DetectnDPIRiskPacketMatch(
SCEnter();
if (!flowctx->detection_completed) {
SCLogDebug("packet %" PRIu64 ": ndpi risks not yet detected", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 ": ndpi risks not yet detected", PcapPacketCntGet(p));
SCReturnInt(0);
}
if (f == NULL) {
SCLogDebug("packet %" PRIu64 ": no flow", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 ": no flow", PcapPacketCntGet(p));
SCReturnInt(0);
}

11
src/alert-debuglog.c
Unescape Escape View File

@ -167,8 +167,9 @@ static TmEcode AlertDebugLogger(ThreadVars *tv, const Packet *p, void *thread_da
MemBufferWriteString(aft->buffer, "+================\n"
"TIME: %s\n", timebuf);
if (p->pcap_cnt > 0) {
MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt);
uint64_t pcap_cnt = PcapPacketCntGet(p);
if (pcap_cnt > 0) {
MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %" PRIu64 "\n", pcap_cnt);
}
pkt_src_str = PktSrcToString(p->pkt_src);
MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str);
@ -327,9 +328,9 @@ static TmEcode AlertDebugLogDecoderEvent(ThreadVars *tv, const Packet *p, void *
MemBufferWriteString(aft->buffer,
"+================\n"
"TIME: %s\n", timebuf);
if (p->pcap_cnt > 0) {
MemBufferWriteString(aft->buffer,
"PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt);
uint64_t pcap_cnt = PcapPacketCntGet(p);
if (pcap_cnt > 0) {
MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %" PRIu64 "\n", pcap_cnt);
}
pkt_src_str = PktSrcToString(p->pkt_src);
MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str);

7
src/alert-fastlog.c
Unescape Escape View File

@ -179,9 +179,10 @@ int AlertFastLogger(ThreadVars *tv, void *data, const Packet *p)
pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio);
PrintBufferRawLineHex(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE,
GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32);
if (p->pcap_cnt != 0) {
PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE,
"] [pcap file packet: %"PRIu64"]\n", p->pcap_cnt);
uint64_t pcap_cnt = PcapPacketCntGet(p);
if (pcap_cnt != 0) {
PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE,
"] [pcap file packet: %" PRIu64 "]\n", pcap_cnt);
} else {
PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, "]\n");
}

7
src/alert-syslog.c
Unescape Escape View File

@ -343,9 +343,10 @@ static TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, const Packet *p, void *da
PrintRawLineHexBuf(temp_buf_pkt, sizeof(temp_buf_pkt), GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32);
strlcat(alert, temp_buf_pkt, sizeof(alert));
if (p->pcap_cnt != 0) {
snprintf(temp_buf_tail, sizeof(temp_buf_tail), "] [pcap file packet: %"PRIu64"]",
p->pcap_cnt);
uint64_t pcap_cnt = PcapPacketCntGet(p);
if (pcap_cnt != 0) {
snprintf(temp_buf_tail, sizeof(temp_buf_tail), "] [pcap file packet: %" PRIu64 "]",
pcap_cnt);
} else {
temp_buf_tail[0] = ']';
temp_buf_tail[1] = '\0';

5
src/app-layer.c
Unescape Escape View File

@ -657,8 +657,9 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx,
AppLayerIncFlowCounter(tv, f);
*alproto = *alproto_otherdir;
SCLogDebug("packet %"PRIu64": pd done(us %u them %u), parser called (r==%d), APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION set",
p->pcap_cnt, *alproto, *alproto_otherdir, r);
SCLogDebug("packet %" PRIu64 ": pd done(us %u them %u), parser called (r==%d), "
"APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION set",
PcapPacketCntGet(p), *alproto, *alproto_otherdir, r);
if (r < 0) {
goto parser_error;
}

8
src/decode.h
Unescape Escape View File

@ -1522,4 +1522,12 @@ static inline bool DecodeNetworkLayer(ThreadVars *tv, DecodeThreadVars *dtv,
return true;
}
// temporary macro to get pcap packet count to reduce the number of changes
// in the follow-up commit
#define PcapPacketCntGet(p) (p)->pcap_cnt
#define PcapPacketCntSet(p, cnt) \
do { \
(p)->pcap_cnt = (cnt); \
} while (0)
#endif /* SURICATA_DECODE_H */

4
src/defrag-hash.c
Unescape Escape View File

@ -469,8 +469,8 @@ static void DefragExceptionPolicyStatsIncr(
static DefragTracker *DefragTrackerGetNew(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
{
#ifdef DEBUG
if (g_eps_defrag_memcap != UINT64_MAX && g_eps_defrag_memcap == p->pcap_cnt) {
SCLogNotice("simulating memcap hit for packet %" PRIu64, p->pcap_cnt);
if (g_eps_defrag_memcap != UINT64_MAX && g_eps_defrag_memcap == PcapPacketCntGet(p)) {
SCLogNotice("simulating memcap hit for packet %" PRIu64, PcapPacketCntGet(p));
ExceptionPolicyApply(p, defrag_config.memcap_policy, PKT_DROP_REASON_DEFRAG_MEMCAP);
DefragExceptionPolicyStatsIncr(tv, dtv, defrag_config.memcap_policy);
return NULL;

2
src/defrag.c
Unescape Escape View File

@ -584,7 +584,7 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragTracker *tracker,
uint8_t ip6_nh_set_value = 0;
#ifdef DEBUG
uint64_t pcap_cnt = p->pcap_cnt;
uint64_t pcap_cnt = PcapPacketCntGet(p);
#endif
if (tracker->af == AF_INET) {

10
src/detect-app-layer-protocol.c
Unescape Escape View File

@ -65,13 +65,13 @@ static int DetectAppLayerProtocolPacketMatch(
/* if the sig is PD-only we only match when PD packet flags are set */
if (s->type == SIG_TYPE_PDONLY &&
(p->flags & (PKT_PROTO_DETECT_TS_DONE | PKT_PROTO_DETECT_TC_DONE)) == 0) {
SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 ": flags not set", PcapPacketCntGet(p));
SCReturnInt(0);
}
const Flow *f = p->flow;
if (f == NULL) {
SCLogDebug("packet %"PRIu64": no flow", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 ": no flow", PcapPacketCntGet(p));
SCReturnInt(0);
}
@ -289,17 +289,17 @@ PrefilterPacketAppProtoMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const vo
const PrefilterPacketHeaderCtx *ctx = pectx;
if (!PrefilterPacketHeaderExtraMatch(ctx, p)) {
SCLogDebug("packet %"PRIu64": extra match failed", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 ": extra match failed", PcapPacketCntGet(p));
SCReturn;
}
if (p->flow == NULL) {
SCLogDebug("packet %"PRIu64": no flow, no alproto", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 ": no flow, no alproto", PcapPacketCntGet(p));
SCReturn;
}
if ((p->flags & (PKT_PROTO_DETECT_TS_DONE|PKT_PROTO_DETECT_TC_DONE)) == 0) {
SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 ": flags not set", PcapPacketCntGet(p));
SCReturn;
}

2
src/detect-config.c
Unescape Escape View File

@ -187,7 +187,7 @@ static int ConfigApply(DetectEngineThreadCtx *det_ctx,
}
if (this_packet) {
SCLogDebug("packet logic here: %" PRIu64, p->pcap_cnt);
SCLogDebug("packet logic here: %" PRIu64, PcapPacketCntGet(p));
ConfigApplyPacket(p, config);
} else if (this_tx) {
SCLogDebug("tx logic here: tx_id %"PRIu64, det_ctx->tx_id);

14
src/detect-engine-alert.c
Unescape Escape View File

@ -187,7 +187,7 @@ static inline void RuleActionToFlow(const uint8_t action, Flow *f)
* \param pa packet alert struct -- match, including actions after thresholding (rate_filter) */
static void PacketApplySignatureActions(Packet *p, const Signature *s, const PacketAlert *pa)
{
SCLogDebug("packet %" PRIu64 " sid %u action %02x alert_flags %02x", p->pcap_cnt, s->id,
SCLogDebug("packet %" PRIu64 " sid %u action %02x alert_flags %02x", PcapPacketCntGet(p), s->id,
pa->action, pa->flags);
/* REJECT also sets ACTION_DROP, just make it more visible with this check */
@ -222,11 +222,11 @@ static void PacketApplySignatureActions(Packet *p, const Signature *s, const Pac
// nothing to set in the packet
} else if (pa->action & ACTION_ACCEPT) {
const enum ActionScope as = pa->s->action_scope;
SCLogDebug("packet %" PRIu64 ": ACCEPT %u as:%u flags:%02x", p->pcap_cnt, s->id, as,
pa->flags);
SCLogDebug("packet %" PRIu64 ": ACCEPT %u as:%u flags:%02x", PcapPacketCntGet(p), s->id,
as, pa->flags);
if (as == ACTION_SCOPE_PACKET || as == ACTION_SCOPE_FLOW ||
(pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET)) {
SCLogDebug("packet %" PRIu64 ": sid:%u ACCEPT", p->pcap_cnt, s->id);
SCLogDebug("packet %" PRIu64 ": sid:%u ACCEPT", PcapPacketCntGet(p), s->id);
p->action |= ACTION_ACCEPT;
}
} else if (pa->action & (ACTION_ALERT | ACTION_CONFIG)) {
@ -464,7 +464,7 @@ static inline void FlowApplySignatureActions(
if (pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW) {
SCLogDebug("packet %" PRIu64 " sid %u action %02x alert_flags %02x (set "
"PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW)",
p->pcap_cnt, s->id, s->action, pa->flags);
PcapPacketCntGet(p), s->id, s->action, pa->flags);
}
}
}
@ -523,8 +523,8 @@ static inline void PacketAlertFinalizeProcessQueue(
}
}
}
SCLogDebug("packet %" PRIu64 ": i:%u sid:%u skip_action_set %s", p->pcap_cnt, i, s->id,
BOOL2STR(skip_action_set));
SCLogDebug("packet %" PRIu64 ": i:%u sid:%u skip_action_set %s", PcapPacketCntGet(p), i,
s->id, BOOL2STR(skip_action_set));
if (!skip_action_set) {
/* set actions on the flow */
FlowApplySignatureActions(p, pa, s, pa->flags);

15
src/detect-engine-frame.c
Unescape Escape View File

@ -74,7 +74,7 @@ static void BufferSetupUdp(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buf
void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p,
const Frames *frames, const Frame *frame, const AppProto alproto)
{
SCLogDebug("pcap_cnt %" PRIu64, p->pcap_cnt);
SCLogDebug("pcap_cnt %" PRIu64, PcapPacketCntGet(p));
PrefilterEngine *engine = sgh->frame_engines;
do {
if ((engine->alproto == alproto || engine->alproto == ALPROTO_UNKNOWN) &&
@ -151,7 +151,7 @@ static void PrefilterMpmFrame(DetectEngineThreadCtx *det_ctx, const void *pectx,
const MpmCtx *mpm_ctx = ctx->mpm_ctx;
SCLogDebug("packet:%" PRIu64 ", prefilter running on list %d -> frame field type %u",
p->pcap_cnt, ctx->list_id, frame->type);
PcapPacketCntGet(p), ctx->list_id, frame->type);
if (p->proto == IPPROTO_UDP) {
// TODO can we use single here? Could it conflict with TCP?
InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, ctx->list_id, 0);
@ -198,7 +198,7 @@ static void PrefilterMpmFrame(DetectEngineThreadCtx *det_ctx, const void *pectx,
}
SCLogDebug("packet:%" PRIu64
", prefilter done running on list %d -> frame field type %u; have %u matches",
p->pcap_cnt, ctx->list_id, frame->type, det_ctx->pmq.rule_id_array_cnt);
PcapPacketCntGet(p), ctx->list_id, frame->type, det_ctx->pmq.rule_id_array_cnt);
}
static void PrefilterMpmFrameFree(void *ptr)
@ -273,7 +273,7 @@ static void BufferSetupUdp(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buf
SCLogDebug("packet %" PRIu64 " -> frame %p/%" PRIi64 "/%s offset %" PRIu64
" type %u len %" PRIi64,
p->pcap_cnt, frame, frame->id,
PcapPacketCntGet(p), frame, frame->id,
AppLayerParserGetFrameNameById(p->flow->proto, p->flow->alproto, frame->type),
frame->offset, frame->type, frame->len);
@ -290,8 +290,8 @@ static int DetectFrameInspectUdp(DetectEngineThreadCtx *det_ctx,
const DetectEngineTransforms *transforms, Packet *p, const Frames *_frames,
const Frame *frame, const int list_id)
{
SCLogDebug("packet:%" PRIu64 ", inspect: s:%p s->id:%u, transforms:%p", p->pcap_cnt, s, s->id,
transforms);
SCLogDebug("packet:%" PRIu64 ", inspect: s:%p s->id:%u, transforms:%p", PcapPacketCntGet(p), s,
s->id, transforms);
// TODO can we use single here? Could it conflict with TCP?
InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, list_id, 0);
@ -577,7 +577,8 @@ int DetectEngineInspectFrameBufferGeneric(DetectEngineThreadCtx *det_ctx,
SCLogDebug("packet:%" PRIu64 ", frame->id:%" PRIu64
", list:%d, transforms:%p, s:%p, s->id:%u, engine:%p",
p->pcap_cnt, frame->id, engine->sm_list, engine->v1.transforms, s, s->id, engine);
PcapPacketCntGet(p), frame->id, engine->sm_list, engine->v1.transforms, s, s->id,
engine);
DEBUG_VALIDATE_BUG_ON(p->flow->protoctx == NULL);
TcpSession *ssn = p->flow->protoctx;

4
src/detect-engine-payload.c
Unescape Escape View File

@ -333,8 +333,8 @@ uint8_t DetectEngineInspectStream(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
is_last = true;
}
SCLogDebug("%s ran stream for sid %u on packet %"PRIu64" and we %s",
is_last? "LAST:" : "normal:", s->id, p->pcap_cnt,
SCLogDebug("%s ran stream for sid %u on packet %" PRIu64 " and we %s",
is_last ? "LAST:" : "normal:", s->id, PcapPacketCntGet(p),
match ? "matched" : "didn't match");
if (match) {

2
src/detect-engine-prefilter.c
Unescape Escape View File

@ -104,7 +104,7 @@ void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx,
/* reset rule store */
det_ctx->pmq.rule_id_array_cnt = 0;
SCLogDebug("packet %" PRIu64 " tx %p progress %d tx->detect_progress %02x", p->pcap_cnt,
SCLogDebug("packet %" PRIu64 " tx %p progress %d tx->detect_progress %02x", PcapPacketCntGet(p),
tx->tx_ptr, tx->tx_progress, tx->detect_progress);
PrefilterEngine *engine = sgh->tx_engines;

2
src/detect-file-data.c
Unescape Escape View File

@ -558,7 +558,7 @@ static void PrefilterTxFiledata(DetectEngineThreadCtx *det_ctx, const void *pect
local_file_id++;
continue;
}
SCLogDebug("[%" PRIu64 "] buffer size %u", p->pcap_cnt, buffer->inspect_len);
SCLogDebug("[%" PRIu64 "] buffer size %u", PcapPacketCntGet(p), buffer->inspect_len);
if (buffer->inspect_len >= mpm_ctx->minlen) {
uint32_t prev_rule_id_array_cnt = det_ctx->pmq.rule_id_array_cnt;

4
src/detect-flowbits.c
Unescape Escape View File

@ -977,7 +977,7 @@ static void PrefilterFlowbitFree(void *vctx)
static void PrefilterFlowbitMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx)
{
struct PrefilterEngineFlowbits *ctx = (struct PrefilterEngineFlowbits *)pectx;
SCLogDebug("%" PRIu64 ": ctx %p", p->pcap_cnt, ctx);
SCLogDebug("%" PRIu64 ": ctx %p", PcapPacketCntGet(p), ctx);
if (p->flow == NULL) {
SCReturn;
@ -1013,7 +1013,7 @@ static void PrefilterFlowbitPostRuleMatch(
DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f)
{
struct PrefilterEngineFlowbits *ctx = (struct PrefilterEngineFlowbits *)pectx;
SCLogDebug("%" PRIu64 ": ctx %p", p->pcap_cnt, ctx);
SCLogDebug("%" PRIu64 ": ctx %p", PcapPacketCntGet(p), ctx);
if (p->flow == NULL) {
SCReturn;

46
src/detect.c
Unescape Escape View File

@ -112,7 +112,7 @@ static void DetectRun(ThreadVars *th_v,
Packet *p)
{
SCEnter();
SCLogDebug("p->pcap_cnt %" PRIu64 " direction %s pkt_src %s", p->pcap_cnt,
SCLogDebug("PcapPacketCntGet(p) %" PRIu64 " direction %s pkt_src %s", PcapPacketCntGet(p),
p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient")
: "noflow",
PktSrcToString(p->pkt_src));
@ -158,7 +158,7 @@ static void DetectRun(ThreadVars *th_v,
if (pflow && pflow->alstate && likely(pflow->proto == p->proto)) {
if (p->proto == IPPROTO_TCP) {
if ((p->flags & PKT_STREAM_EST) == 0) {
SCLogDebug("packet %" PRIu64 ": skip tcp non-established", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 ": skip tcp non-established", PcapPacketCntGet(p));
DetectRunAppendDefaultAccept(det_ctx, p);
goto end;
}
@ -178,7 +178,7 @@ static void DetectRun(ThreadVars *th_v,
if (!PKT_IS_PSEUDOPKT(p) && p->app_update_direction == 0 &&
((PKT_IS_TOSERVER(p) && (p->flow->flags & FLOW_TS_APP_UPDATED) == 0) ||
(PKT_IS_TOCLIENT(p) && (p->flow->flags & FLOW_TC_APP_UPDATED) == 0))) {
SCLogDebug("packet %" PRIu64 ": no app-layer update", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 ": no app-layer update", PcapPacketCntGet(p));
DetectRunAppendDefaultAccept(det_ctx, p);
goto end;
}
@ -195,7 +195,7 @@ static void DetectRun(ThreadVars *th_v,
pflow, pflow->alparser, pflow->alstate, scratch.flow_flags, (scratch.sgh == NULL));
PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX_UPDATE);
} else {
SCLogDebug("packet %" PRIu64 ": no flow / app-layer", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 ": no flow / app-layer", PcapPacketCntGet(p));
DetectRunAppendDefaultAccept(det_ctx, p);
}
@ -212,7 +212,7 @@ static void DetectRunPacketHook(ThreadVars *th_v, const DetectEngineCtx *de_ctx,
DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p)
{
SCEnter();
SCLogDebug("p->pcap_cnt %" PRIu64 " direction %s pkt_src %s", p->pcap_cnt,
SCLogDebug("PcapPacketCntGet(p) %" PRIu64 " direction %s pkt_src %s", PcapPacketCntGet(p),
p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient")
: "noflow",
PktSrcToString(p->pkt_src));
@ -697,7 +697,8 @@ static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
}
const uint8_t s_proto_flags = s->proto.flags;
SCLogDebug("packet %" PRIu64 ": inspecting signature id %" PRIu32 "", p->pcap_cnt, s->id);
SCLogDebug("packet %" PRIu64 ": inspecting signature id %" PRIu32 "", PcapPacketCntGet(p),
s->id);
/* if we accept:hook'd the `packet_filter` hook, we skip the rest of the firewall rules. */
if (s->flags & SIG_FLAG_FIREWALL) {
@ -1044,8 +1045,8 @@ static inline void DetectRunPostRules(ThreadVars *tv, const DetectEngineCtx *de_
// TODO review packet src types here
if (EngineModeIsFirewall() && !(p->action & ACTION_ACCEPT) && p->pkt_src == PKT_SRC_WIRE &&
scratch->default_action == ACTION_DROP) {
SCLogDebug("packet %" PRIu64 ": droppit as no ACCEPT set %02x (pkt %s)", p->pcap_cnt,
p->action, PktSrcToString(p->pkt_src));
SCLogDebug("packet %" PRIu64 ": droppit as no ACCEPT set %02x (pkt %s)",
PcapPacketCntGet(p), p->action, PktSrcToString(p->pkt_src));
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_DEFAULT_PACKET_POLICY);
}
}
@ -1679,7 +1680,7 @@ static bool ApplyAccept(Packet *p, const uint8_t flow_flags, const Signature *s,
/* if there is no fw rule for the next progress value,
* we invoke the default drop policy. */
if (fw_next_progress_missing) {
SCLogDebug("%" PRIu64 ": %s default drop for progress", p->pcap_cnt,
SCLogDebug("%" PRIu64 ": %s default drop for progress", PcapPacketCntGet(p),
flow_flags & STREAM_TOSERVER ? "toserver" : "toclient");
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_DEFAULT_APP_POLICY);
p->flow->flags |= FLOW_ACTION_DROP;
@ -1725,7 +1726,7 @@ static void DetectRunTx(ThreadVars *tv,
uint32_t tx_inspected = 0;
const bool have_fw_rules = EngineModeIsFirewall();
SCLogDebug("packet %" PRIu64, p->pcap_cnt);
SCLogDebug("packet %" PRIu64, PcapPacketCntGet(p));
while (1) {
AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, tx_id_min, total_txs, &state);
@ -1875,7 +1876,7 @@ static void DetectRunTx(ThreadVars *tv,
uint32_t *inspect_flags = det_ctx->tx_candidates[i].flags;
bool break_out_of_app_filter = false;
SCLogDebug("%" PRIu64 ": sid:%u: %s tx %u/%u/%u sig %u", p->pcap_cnt, s->id,
SCLogDebug("%" PRIu64 ": sid:%u: %s tx %u/%u/%u sig %u", PcapPacketCntGet(p), s->id,
flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.tx_progress,
tx.detect_progress, tx.detect_progress_orig, s->app_progress_hook);
@ -1996,7 +1997,7 @@ static void DetectRunTx(ThreadVars *tv,
(s->flags & SIG_FLAG_FIREWALL) ? "firewall" : "regular",
BOOL2STR(last_for_progress));
if (s->flags & SIG_FLAG_FIREWALL) {
SCLogDebug("%" PRIu64 ": %s default drop for progress", p->pcap_cnt,
SCLogDebug("%" PRIu64 ": %s default drop for progress", PcapPacketCntGet(p),
flow_flags & STREAM_TOSERVER ? "toserver" : "toclient");
/* if this rule was the last for our progress state, and it didn't match,
* we have to invoke the default drop policy. */
@ -2055,7 +2056,7 @@ static void DetectRunTx(ThreadVars *tv,
/* this side of the tx is done */
if (tx.tx_progress >= tx.tx_end_state) {
SCLogDebug("%" PRIu64 ": %s tx done", p->pcap_cnt,
SCLogDebug("%" PRIu64 ": %s tx done", PcapPacketCntGet(p),
flow_flags & STREAM_TOSERVER ? "toserver" : "toclient");
const uint8_t inspected_flag = (flow_flags & STREAM_TOSERVER)
? APP_LAYER_TX_INSPECTED_TS
@ -2067,7 +2068,7 @@ static void DetectRunTx(ThreadVars *tv,
}
if (tx.detect_progress != tx.detect_progress_orig) {
SCLogDebug("%" PRIu64 ": %s tx state change %u -> %u", p->pcap_cnt,
SCLogDebug("%" PRIu64 ": %s tx state change %u -> %u", PcapPacketCntGet(p),
flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.detect_progress_orig,
tx.detect_progress);
SCLogDebug("%p/%" PRIu64 " Storing new progress %02x (was %02x)", tx.tx_ptr, tx.tx_id,
@ -2085,10 +2086,10 @@ static void DetectRunTx(ThreadVars *tv,
/* apply default policy if there were txs to inspect, we have fw rules and non of the rules
* applied a policy. */
SCLogDebug("packet %" PRIu64 ": tx_inspected %u fw_verdicted %u", p->pcap_cnt, tx_inspected,
fw_verdicted);
SCLogDebug("packet %" PRIu64 ": tx_inspected %u fw_verdicted %u", PcapPacketCntGet(p),
tx_inspected, fw_verdicted);
if (tx_inspected && have_fw_rules && tx_inspected != fw_verdicted) {
SCLogDebug("%" PRIu64 ": %s default drop", p->pcap_cnt,
SCLogDebug("%" PRIu64 ": %s default drop", PcapPacketCntGet(p),
flow_flags & STREAM_TOSERVER ? "toserver" : "toclient");
PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_DEFAULT_APP_POLICY);
p->flow->flags |= FLOW_ACTION_DROP;
@ -2112,7 +2113,7 @@ static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngin
((PKT_IS_TOSERVER(p) && (f->flags & FLOW_TS_APP_UPDATED) == 0) ||
(PKT_IS_TOCLIENT(p) && (f->flags & FLOW_TC_APP_UPDATED) == 0))) {
SCLogDebug("pcap_cnt %" PRIu64 ": %s: skip frame inspection for TCP w/o APP UPDATE",
p->pcap_cnt, PKT_IS_TOSERVER(p) ? "toserver" : "toclient");
PcapPacketCntGet(p), PKT_IS_TOSERVER(p) ? "toserver" : "toclient");
return;
}
FramesContainer *frames_container = AppLayerFramesGetContainer(f);
@ -2284,8 +2285,9 @@ static void DetectFlow(ThreadVars *tv,
AppLayerParserSetTransactionInspectId(f, f->alparser, f->alstate, flags, true);
}
}
SCLogDebug("p->pcap %"PRIu64": no detection on packet, "
"PKT_NOPACKET_INSPECTION is set", p->pcap_cnt);
SCLogDebug("p->pcap %" PRIu64 ": no detection on packet, "
"PKT_NOPACKET_INSPECTION is set",
PcapPacketCntGet(p));
return;
}
@ -2312,7 +2314,7 @@ uint8_t DetectPreFlow(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p)
const DetectEngineCtx *de_ctx = det_ctx->de_ctx;
const SigGroupHead *sgh = de_ctx->pre_flow_sgh;
SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, p->pcap_cnt, sgh);
SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, PcapPacketCntGet(p), sgh);
DetectRunPacketHook(tv, de_ctx, det_ctx, sgh, p);
return p->action;
}
@ -2323,7 +2325,7 @@ uint8_t DetectPreStream(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *
const int direction = (PKT_IS_TOCLIENT(p) != 0);
const SigGroupHead *sgh = de_ctx->pre_stream_sgh[direction];
SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, p->pcap_cnt, sgh);
SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, PcapPacketCntGet(p), sgh);
DetectRunPacketHook(tv, de_ctx, det_ctx, sgh, p);
return p->action;
}

2
src/flow-hash.c
Unescape Escape View File

@ -695,7 +695,7 @@ static Flow *FlowGetNew(ThreadVars *tv, FlowLookupStruct *fls, Packet *p)
{
const bool emerg = ((SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY) != 0);
#ifdef DEBUG
if (g_eps_flow_memcap != UINT64_MAX && g_eps_flow_memcap == p->pcap_cnt) {
if (g_eps_flow_memcap != UINT64_MAX && g_eps_flow_memcap == PcapPacketCntGet(p)) {
NoFlowHandleIPS(tv, fls, p);
StatsCounterIncr(&tv->stats, fls->dtv->counter_flow_memcap);
return NULL;

33
src/flow-worker.c
Unescape Escape View File

@ -395,10 +395,10 @@ static inline void FlowWorkerStreamTCPUpdate(ThreadVars *tv, FlowWorkerThreadDat
}
/* Packets here can safely access p->flow as it's locked */
SCLogDebug("packet %"PRIu64": extra packets %u", p->pcap_cnt, fw->pq.len);
SCLogDebug("packet %" PRIu64 ": extra packets %u", PcapPacketCntGet(p), fw->pq.len);
Packet *x;
while ((x = PacketDequeueNoLock(&fw->pq))) {
SCLogDebug("packet %"PRIu64" extra packet %p", p->pcap_cnt, x);
SCLogDebug("packet %" PRIu64 " extra packet %p", PcapPacketCntGet(p), x);
if (det_ctx != NULL) {
FLOWWORKER_PROFILING_START(x, PROFILE_FLOWWORKER_DETECT);
@ -438,7 +438,8 @@ static void FlowWorkerFlowTimeout(
{
DEBUG_VALIDATE_BUG_ON(p->pkt_src != PKT_SRC_FFR);
SCLogDebug("packet %"PRIu64" is TCP. Direction %s", p->pcap_cnt, PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT");
SCLogDebug("packet %" PRIu64 " is TCP. Direction %s", PcapPacketCntGet(p),
PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT");
DEBUG_VALIDATE_BUG_ON(!(p->flow && PacketIsTCP(p)));
DEBUG_ASSERT_FLOW_LOCKED(p->flow);
@ -448,7 +449,7 @@ static void FlowWorkerFlowTimeout(
PacketUpdateEngineEventCounters(tv, fw->dtv, p);
/* handle Detect */
SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 " calling Detect", PcapPacketCntGet(p));
if (det_ctx != NULL) {
FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_DETECT);
Detect(tv, p, det_ctx);
@ -520,37 +521,37 @@ static void PacketAppUpdate2FlowFlags(Packet *p)
{
switch ((enum StreamUpdateDir)p->app_update_direction) {
case UPDATE_DIR_NONE: // NONE implies pseudo packet
SCLogDebug("pcap_cnt %" PRIu64 ", UPDATE_DIR_NONE", p->pcap_cnt);
SCLogDebug("pcap_cnt %" PRIu64 ", UPDATE_DIR_NONE", PcapPacketCntGet(p));
break;
case UPDATE_DIR_PACKET:
if (PKT_IS_TOSERVER(p)) {
p->flow->flags |= FLOW_TS_APP_UPDATED;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED set", p->pcap_cnt);
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED set", PcapPacketCntGet(p));
} else {
p->flow->flags |= FLOW_TC_APP_UPDATED;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED set", p->pcap_cnt);
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED set", PcapPacketCntGet(p));
}
break;
case UPDATE_DIR_BOTH:
if (PKT_IS_TOSERVER(p)) {
p->flow->flags |= FLOW_TS_APP_UPDATED | FLOW_TC_APP_UPDATE_NEXT;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED|FLOW_TC_APP_UPDATE_NEXT set",
p->pcap_cnt);
PcapPacketCntGet(p));
} else {
p->flow->flags |= FLOW_TC_APP_UPDATED | FLOW_TS_APP_UPDATE_NEXT;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED|FLOW_TS_APP_UPDATE_NEXT set",
p->pcap_cnt);
PcapPacketCntGet(p));
}
/* fall through */
case UPDATE_DIR_OPPOSING:
if (PKT_IS_TOSERVER(p)) {
p->flow->flags |= FLOW_TC_APP_UPDATED | FLOW_TS_APP_UPDATE_NEXT;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED|FLOW_TS_APP_UPDATE_NEXT set",
p->pcap_cnt);
PcapPacketCntGet(p));
} else {
p->flow->flags |= FLOW_TS_APP_UPDATED | FLOW_TC_APP_UPDATE_NEXT;
SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED|FLOW_TC_APP_UPDATE_NEXT set",
p->pcap_cnt);
PcapPacketCntGet(p));
}
break;
}
@ -564,7 +565,7 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data)
DEBUG_VALIDATE_BUG_ON(p == NULL);
DEBUG_VALIDATE_BUG_ON(tv->flow_queue == NULL);
SCLogDebug("packet %"PRIu64, p->pcap_cnt);
SCLogDebug("packet %" PRIu64, PcapPacketCntGet(p));
if ((PKT_IS_FLUSHPKT(p))) {
SCLogDebug("thread %s flushing", tv->printable_name);
@ -614,13 +615,13 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data)
TimeSetByThread(tv->id, p->ts);
}
SCLogDebug("packet %"PRIu64" has flow? %s", p->pcap_cnt, p->flow ? "yes" : "no");
SCLogDebug("packet %" PRIu64 " has flow? %s", PcapPacketCntGet(p), p->flow ? "yes" : "no");
/* handle TCP and app layer */
if (p->flow) {
SCLogDebug("packet %" PRIu64
": direction %s FLOW_TS_APP_UPDATE_NEXT %s FLOW_TC_APP_UPDATE_NEXT %s",
p->pcap_cnt, PKT_IS_TOSERVER(p) ? "toserver" : "toclient",
PcapPacketCntGet(p), PKT_IS_TOSERVER(p) ? "toserver" : "toclient",
BOOL2STR((p->flow->flags & FLOW_TS_APP_UPDATE_NEXT) != 0),
BOOL2STR((p->flow->flags & FLOW_TC_APP_UPDATE_NEXT) != 0));
/* see if need to consider flags set by prev packets */
@ -635,7 +636,7 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data)
}
if (PacketIsTCP(p)) {
SCLogDebug("packet %" PRIu64 " is TCP. Direction %s", p->pcap_cnt,
SCLogDebug("packet %" PRIu64 " is TCP. Direction %s", PcapPacketCntGet(p),
PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT");
DEBUG_ASSERT_FLOW_LOCKED(p->flow);
@ -663,7 +664,7 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data)
/* handle Detect */
DEBUG_ASSERT_FLOW_LOCKED(p->flow);
SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 " calling Detect", PcapPacketCntGet(p));
if (det_ctx != NULL) {
FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_DETECT);
Detect(tv, p, det_ctx);

2
src/flow.c
Unescape Escape View File

@ -423,7 +423,7 @@ static inline void FlowUpdateEthernet(
*/
void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv)
{
SCLogDebug("packet %"PRIu64" -- flow %p", p->pcap_cnt, f);
SCLogDebug("packet %" PRIu64 " -- flow %p", PcapPacketCntGet(p), f);
const int pkt_dir = FlowGetPacketDirection(f, p);
#ifdef CAPTURE_OFFLOAD

5
src/log-tlsstore.c
Unescape Escape View File

@ -217,8 +217,9 @@ static void LogTlsLogPem(LogTlsStoreLogThread *aft, const Packet *p, SSLState *s
goto end_fwrite_fpmeta;
if (fprintf(fpmeta, "TIME: %s\n", timebuf) < 0)
goto end_fwrite_fpmeta;
if (p->pcap_cnt > 0) {
if (fprintf(fpmeta, "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt) < 0)
uint64_t pcap_cnt = PcapPacketCntGet(p);
if (pcap_cnt > 0) {
if (fprintf(fpmeta, "PCAP PKT NUM: %" PRIu64 "\n", pcap_cnt) < 0)
goto end_fwrite_fpmeta;
}
if (fprintf(fpmeta, "SRC IP: %s\n", srcip) < 0)

7
src/output-json-alert.c
Unescape Escape View File

@ -285,10 +285,8 @@ static void AlertJsonTunnel(const Packet *p, SCJsonBuilder *js)
SCJbOpenObject(js, "tunnel");
enum PktSrcEnum pkt_src;
uint64_t pcap_cnt;
JsonAddrInfo addr = json_addr_info_zero;
JsonAddrInfoInit(p->root, 0, &addr);
pcap_cnt = p->root->pcap_cnt;
pkt_src = p->root->pkt_src;
SCJbSetString(js, "src_ip", addr.src_ip);
@ -298,6 +296,7 @@ static void AlertJsonTunnel(const Packet *p, SCJsonBuilder *js)
SCJbSetString(js, "proto", addr.proto);
SCJbSetUint(js, "depth", p->recursion_level);
uint64_t pcap_cnt = PcapPacketCntGet(p->root);
if (pcap_cnt != 0) {
SCJbSetUint(js, "pcap_cnt", pcap_cnt);
}
@ -542,8 +541,8 @@ void EveAddVerdict(SCJsonBuilder *jb, const Packet *p, const uint8_t alert_actio
SCJbOpenObject(jb, "verdict");
const uint8_t packet_action = PacketGetAction(p);
SCLogDebug("%" PRIu64 ": packet_action %02x alert_action %02x", p->pcap_cnt, packet_action,
alert_action);
SCLogDebug("%" PRIu64 ": packet_action %02x alert_action %02x", PcapPacketCntGet(p),
packet_action, alert_action);
/* add verdict info */
if (packet_action & ACTION_REJECT_ANY) {
// check rule to define type of reject packet sent

5
src/output-json.c
Unescape Escape View File

@ -859,8 +859,9 @@ SCJsonBuilder *CreateEveHeader(const Packet *p, enum SCOutputJsonLogDirection di
}
/* pcap_cnt */
if (p->pcap_cnt != 0) {
SCJbSetUint(js, "pcap_cnt", p->pcap_cnt);
uint64_t pcap_cnt = PcapPacketCntGet(p);
if (pcap_cnt != 0) {
SCJbSetUint(js, "pcap_cnt", pcap_cnt);
}
if (event_type) {

16
src/output-tx.c
Unescape Escape View File

@ -186,7 +186,7 @@ static inline void OutputTxLogFiles(ThreadVars *tv, OutputFileLoggerThreadData *
if (ffc || ffc_opposing)
SCLogDebug("pcap_cnt %" PRIu64 " flow %p tx %p tx_id %" PRIu64
" ffc %p ffc_opposing %p tx_complete %d",
p->pcap_cnt, f, tx, tx_id, ffc, ffc_opposing, tx_complete);
PcapPacketCntGet(p), f, tx, tx_id, ffc, ffc_opposing, tx_complete);
if (ffc) {
const bool file_close = ((p->flags & PKT_PSEUDO_STREAM_END)) | eof;
@ -234,7 +234,7 @@ static inline void OutputTxLogFiles(ThreadVars *tv, OutputFileLoggerThreadData *
} else {
SCLogDebug("pcap_cnt %" PRIu64 " flow %p tx %p tx_id %" PRIu64
" NOT SETTING FILE FLAGS ffc %p ffc_opposing %p tx_complete %d",
p->pcap_cnt, f, tx, tx_id, ffc, ffc_opposing, tx_complete);
PcapPacketCntGet(p), f, tx, tx_id, ffc, ffc_opposing, tx_complete);
}
}
@ -292,8 +292,8 @@ static void OutputTxLogCallLoggers(ThreadVars *tv, OutputTxLoggerThreadData *op_
if ((ctx->tx_logged_old & BIT_U32(logger->logger_id)) == 0) {
SCLogDebug("alproto match %d, logging tx_id %" PRIu64, logger->alproto, tx_id);
SCLogDebug("pcap_cnt %" PRIu64 ", tx_id %" PRIu64 " logger %d. EOF %s", p->pcap_cnt,
tx_id, logger->logger_id, eof ? "true" : "false");
SCLogDebug("pcap_cnt %" PRIu64 ", tx_id %" PRIu64 " logger %d. EOF %s",
PcapPacketCntGet(p), tx_id, logger->logger_id, eof ? "true" : "false");
if (eof) {
SCLogDebug("EOF, so log now");
@ -354,7 +354,7 @@ static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data)
Flow * const f = p->flow;
const uint8_t ipproto = f->proto;
const AppProto alproto = f->alproto;
SCLogDebug("pcap_cnt %u tx logging %u/%s", (uint32_t)p->pcap_cnt, alproto,
SCLogDebug("pcap_cnt %u tx logging %u/%s", (uint32_t)PcapPacketCntGet(p), alproto,
AppProtoToString(alproto));
const bool file_logging_active = (op_thread_data->file || op_thread_data->filedata);
@ -378,7 +378,7 @@ static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data)
logger_expectation, LOGGER_FILE, LOGGER_FILEDATA);
goto end;
}
SCLogDebug("pcap_cnt %" PRIu64, p->pcap_cnt);
SCLogDebug("pcap_cnt %" PRIu64, PcapPacketCntGet(p));
const bool last_pseudo = (p->flowflags & FLOW_PKT_LAST_PSEUDO) != 0;
const bool ts_eof = SCAppLayerParserStateIssetFlag(f->alparser, APP_LAYER_PARSER_EOF_TS) != 0;
@ -398,8 +398,8 @@ static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data)
const bool support_files = AppLayerParserSupportsFiles(ipproto, alproto);
const uint8_t pkt_dir = STREAM_FLAGS_FOR_PACKET(p);
SCLogDebug("pcap_cnt %" PRIu64 ": tx_id %" PRIu64 " total_txs %" PRIu64, p->pcap_cnt, tx_id,
total_txs);
SCLogDebug("pcap_cnt %" PRIu64 ": tx_id %" PRIu64 " total_txs %" PRIu64, PcapPacketCntGet(p),
tx_id, total_txs);
AppLayerGetTxIteratorFunc IterFunc = AppLayerGetTxIterator(ipproto, alproto);
AppLayerGetTxIterState state;

1
src/packet.c
Unescape Escape View File

@ -142,7 +142,6 @@ void PacketReinit(Packet *p)
PacketAlertRecycle(p->alerts.alerts, p->alerts.cnt);
p->alerts.cnt = 0;
}
p->pcap_cnt = 0;
p->tunnel_rtv_cnt = 0;
p->tunnel_tpr_cnt = 0;
p->events.cnt = 0;

4
src/stream-tcp-private.h
Unescape Escape View File

@ -272,9 +272,9 @@ enum TcpState {
if ((p)->flags & PKT_STREAM_NO_EVENTS) { \
SCLogDebug("not setting event %d on pkt %p (%" PRIu64 "), " \
"stream in known bad condition", \
(e), p, (p)->pcap_cnt); \
(e), p, PcapPacketCntGet(p)); \
} else { \
SCLogDebug("setting event %d on pkt %p (%" PRIu64 ")", (e), p, (p)->pcap_cnt); \
SCLogDebug("setting event %d on pkt %p (%" PRIu64 ")", (e), p, PcapPacketCntGet(p)); \
ENGINE_SET_EVENT((p), (e)); \
p->l4.vars.tcp.stream_pkt_flags |= STREAM_PKT_FLAG_EVENTSET; \
} \

25
src/stream-tcp-reassemble.c
Unescape Escape View File

@ -1087,7 +1087,7 @@ static void GetSessionSize(TcpSession *ssn, Packet *p)
size = GetStreamSize(&ssn->client);
size += GetStreamSize(&ssn->server);
SCLogDebug("size %"PRIu64", packet %"PRIu64, size, p->pcap_cnt);
SCLogDebug("size %" PRIu64 ", packet %" PRIu64, size, PcapPacketCntGet(p));
}
}
#endif
@ -1196,7 +1196,7 @@ static inline bool CheckGap(TcpSession *ssn, TcpStream *stream, Packet *p)
if (RB_EMPTY(&stream->sb.sbb_tree)) {
SCLogDebug("packet %" PRIu64 ": no GAP. "
"next_seq %u < last_ack %u, but no data in list",
p->pcap_cnt, stream->next_seq, stream->last_ack);
PcapPacketCntGet(p), stream->next_seq, stream->last_ack);
return false;
}
const uint64_t next_seq_abs =
@ -1206,7 +1206,7 @@ static inline bool CheckGap(TcpSession *ssn, TcpStream *stream, Packet *p)
/* ack'd data after the gap */
SCLogDebug("packet %" PRIu64 ": GAP. "
"next_seq %u < last_ack %u, but ACK'd data beyond gap.",
p->pcap_cnt, stream->next_seq, stream->last_ack);
PcapPacketCntGet(p), stream->next_seq, stream->last_ack);
return true;
}
}
@ -1214,12 +1214,12 @@ static inline bool CheckGap(TcpSession *ssn, TcpStream *stream, Packet *p)
SCLogDebug("packet %" PRIu64 ": GAP! "
"last_ack_abs %" PRIu64 " > app_progress %" PRIu64 ", "
"but we have no data.",
p->pcap_cnt, last_ack_abs, app_progress);
PcapPacketCntGet(p), last_ack_abs, app_progress);
return true;
}
SCLogDebug("packet %"PRIu64": no GAP. "
"last_ack_abs %"PRIu64" <= app_progress %"PRIu64,
p->pcap_cnt, last_ack_abs, app_progress);
SCLogDebug("packet %" PRIu64 ": no GAP. "
"last_ack_abs %" PRIu64 " <= app_progress %" PRIu64,
PcapPacketCntGet(p), last_ack_abs, app_progress);
return false;
}
@ -1333,7 +1333,7 @@ static int ReassembleUpdateAppLayer(ThreadVars *tv, TcpReassemblyThreadCtx *ra_c
mydata = NULL;
mydata_len = 0;
SCLogDebug("%"PRIu64" got %p/%u", p->pcap_cnt, mydata, mydata_len);
SCLogDebug("%" PRIu64 " got %p/%u", PcapPacketCntGet(p), mydata, mydata_len);
break;
}
DEBUG_VALIDATE_BUG_ON(mydata == NULL && mydata_len > 0);
@ -1579,8 +1579,9 @@ void StreamReassembleRawUpdateProgress(TcpSession *ssn, Packet *p, const uint64_
stream->flags &= ~STREAMTCP_STREAM_FLAG_TRIGGER_RAW;
} else {
SCLogDebug("p->pcap_cnt %"PRIu64": progress %"PRIu64" app %"PRIu64" raw %"PRIu64" tcp win %"PRIu32,
p->pcap_cnt, progress, STREAM_APP_PROGRESS(stream),
SCLogDebug("PcapPacketCntGet(p) %" PRIu64 ": progress %" PRIu64 " app %" PRIu64
" raw %" PRIu64 " tcp win %" PRIu32,
PcapPacketCntGet(p), progress, STREAM_APP_PROGRESS(stream),
STREAM_RAW_PROGRESS(stream), stream->window);
}
@ -2026,7 +2027,7 @@ int StreamTcpReassembleHandleSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_
dir = UPDATE_DIR_BOTH;
} else if ((ssn->flags & STREAMTCP_FLAG_ASYNC) != 0) {
dir = UPDATE_DIR_PACKET;
SCLogDebug("%" PRIu64 ": ASYNC: UPDATE_DIR_PACKET", p->pcap_cnt);
SCLogDebug("%" PRIu64 ": ASYNC: UPDATE_DIR_PACKET", PcapPacketCntGet(p));
}
/* handle ack received */
@ -2071,7 +2072,7 @@ int StreamTcpReassembleHandleSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_
SCReturnInt(-1);
}
SCLogDebug("packet %"PRIu64" set PKT_STREAM_ADD", p->pcap_cnt);
SCLogDebug("packet %" PRIu64 " set PKT_STREAM_ADD", PcapPacketCntGet(p));
p->flags |= PKT_STREAM_ADD;
} else {
SCLogDebug("ssn %p / stream %p: not calling StreamTcpReassembleHandleSegmentHandleData:"

6
src/stream-tcp-sack.c
Unescape Escape View File

@ -277,14 +277,14 @@ int StreamTcpSackUpdatePacket(TcpStream *stream, Packet *p)
/* RFC 2883 D-SACK */
if (SEQ_LT(le, TCP_GET_RAW_ACK(tcph))) {
SCLogDebug("packet: %" PRIu64 ": D-SACK? %u-%u before ACK %u", p->pcap_cnt, le, re,
TCP_GET_RAW_ACK(tcph));
SCLogDebug("packet: %" PRIu64 ": D-SACK? %u-%u before ACK %u", PcapPacketCntGet(p), le,
re, TCP_GET_RAW_ACK(tcph));
STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_DSACK);
goto next;
} else if (record == 1) { // 2nd record
if (SEQ_GEQ(first_le, le) && SEQ_LEQ(first_re, re)) {
SCLogDebug("packet: %" PRIu64 ": D-SACK? %u-%u inside 2nd range %u-%u ACK %u",
p->pcap_cnt, first_le, first_re, le, re, TCP_GET_RAW_ACK(tcph));
PcapPacketCntGet(p), first_le, first_re, le, re, TCP_GET_RAW_ACK(tcph));
STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_DSACK);
}
goto next;

148
src/stream-tcp.c
Unescape Escape View File

@ -1797,14 +1797,14 @@ static inline bool StateSynSentValidateTimestamp(TcpSession *ssn, Packet *p)
if (receiver_stream->last_ts != 0 && ts_echo != 0 &&
ts_echo != receiver_stream->last_ts)
{
SCLogDebug("%" PRIu64 ": ssn %p: BAD TSECR echo %u recv %u", p->pcap_cnt, ssn, ts_echo,
receiver_stream->last_ts);
SCLogDebug("%" PRIu64 ": ssn %p: BAD TSECR echo %u recv %u", PcapPacketCntGet(p), ssn,
ts_echo, receiver_stream->last_ts);
return false;
}
} else {
if (receiver_stream->last_ts == 0 && ts_echo != 0) {
SCLogDebug("%" PRIu64 ": ssn %p: BAD TSECR echo %u recv %u", p->pcap_cnt, ssn, ts_echo,
receiver_stream->last_ts);
SCLogDebug("%" PRIu64 ": ssn %p: BAD TSECR echo %u recv %u", PcapPacketCntGet(p), ssn,
ts_echo, receiver_stream->last_ts);
return false;
}
}
@ -1966,7 +1966,8 @@ static int StreamTcp3whsStoreSyn(TcpSession *ssn, Packet *p)
if (ssn->queue_len > 0 && ssn->queue_len == stream_config.max_syn_queued) {
DEBUG_VALIDATE_BUG_ON(ssn->queue == NULL);
SCLogDebug("%" PRIu64 ": ssn %p: =~ SYN queue limit reached, rotate", p->pcap_cnt, ssn);
SCLogDebug("%" PRIu64 ": ssn %p: =~ SYN queue limit reached, rotate", PcapPacketCntGet(p),
ssn);
StreamTcpSetEvent(p, STREAM_3WHS_SYN_FLOOD);
/* add to the list, evicting the oldest entry */
@ -1995,8 +1996,8 @@ static int StreamTcp3whsStoreSyn(TcpSession *ssn, Packet *p)
ssn->queue = q;
}
ssn->queue_len++;
SCLogDebug("%" PRIu64 ": ssn %p: =~ SYN with SEQ %u added (queue_len %u)", p->pcap_cnt, ssn,
q->seq, ssn->queue_len);
SCLogDebug("%" PRIu64 ": ssn %p: =~ SYN with SEQ %u added (queue_len %u)", PcapPacketCntGet(p),
ssn, q->seq, ssn->queue_len);
return 0;
}
@ -2050,7 +2051,8 @@ static inline bool StateSynSentCheckSynAck3Whs(TcpSession *ssn, Packet *p, const
TcpStateQueue search;
TcpStateQueueInitFromPktSynAck(p, &search);
SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK looking for SEQ %u", p->pcap_cnt, ssn, search.seq);
SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK looking for SEQ %u", PcapPacketCntGet(p), ssn,
search.seq);
const TcpStateQueue *q =
StreamTcp3whsFindSyn(ssn, &search, NULL, stream_config.liberal_timestamps);
@ -2100,7 +2102,8 @@ static inline bool StateSynSentCheckSynAckTFO(TcpSession *ssn, Packet *p, const
TcpStateQueue search;
TcpStateQueueInitFromPktSynAck(p, &search);
SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK looking for SEQ %u", p->pcap_cnt, ssn, search.seq);
SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK looking for SEQ %u", PcapPacketCntGet(p), ssn,
search.seq);
const TcpStateQueue *q =
StreamTcp3whsFindSyn(ssn, &search, NULL, stream_config.liberal_timestamps);
@ -2145,7 +2148,7 @@ static int StreamTcpPacketStateSynSent(
/* common case: SYN/ACK from server to client */
if ((tcph->th_flags & (TH_SYN | TH_ACK)) == (TH_SYN | TH_ACK) && PKT_IS_TOCLIENT(p)) {
SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK on SYN_SENT state for packet %" PRIu64,
p->pcap_cnt, ssn, p->pcap_cnt);
PcapPacketCntGet(p), ssn, PcapPacketCntGet(p));
/* if timestamps are liberal, allow a SYN/ACK with TS even if the SYN
* had none (violates RFC 7323, see bug #4702). */
const bool ts_mismatch =
@ -2179,7 +2182,8 @@ static int StreamTcpPacketStateSynSent(
StreamTcp3wsFreeQueue(ssn);
StreamTcp3whsSynAckUpdate(ssn, p, /* no queue override */NULL);
SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK on SYN_SENT state: accepted", p->pcap_cnt, ssn);
SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK on SYN_SENT state: accepted", PcapPacketCntGet(p),
ssn);
return 0;
} else if ((tcph->th_flags & (TH_SYN | TH_ACK)) == (TH_SYN | TH_ACK) && PKT_IS_TOSERVER(p)) {
@ -2383,7 +2387,7 @@ static int StreamTcpPacketStateSynSent(
StreamTcp3whsStoreSyn(ssn, p);
SCLogDebug("ssn %p: Retransmitted SYN. Updating ssn from packet %" PRIu64
". Stored previous state",
ssn, p->pcap_cnt);
ssn, PcapPacketCntGet(p));
}
StreamTcp3whsStoreSynApplyToSsn(ssn, &syn_pkt);
}
@ -3237,7 +3241,7 @@ static bool StreamTcpPacketIsZeroWindowProbeAck(const TcpSession *ssn, const Pac
return false;
if (TCP_GET_RAW_ACK(tcph) != rcv->last_ack)
return false;
SCLogDebug("ssn %p: packet %" PRIu64 " is a Zero Window Probe ACK", ssn, p->pcap_cnt);
SCLogDebug("ssn %p: packet %" PRIu64 " is a Zero Window Probe ACK", ssn, PcapPacketCntGet(p));
return true;
}
@ -3275,8 +3279,8 @@ static bool StreamTcpPacketIsDupAck(const TcpSession *ssn, const Packet *p)
return false;
SCLogDebug("ssn %p: packet:%" PRIu64 " seq:%u ack:%u win:%u snd %u:%u:%u rcv %u:%u:%u", ssn,
p->pcap_cnt, TCP_GET_RAW_SEQ(tcph), TCP_GET_RAW_ACK(tcph), pkt_win, snd->next_seq,
snd->last_ack, rcv->window, snd->next_seq, rcv->last_ack, rcv->window);
PcapPacketCntGet(p), TCP_GET_RAW_SEQ(tcph), TCP_GET_RAW_ACK(tcph), pkt_win,
snd->next_seq, snd->last_ack, rcv->window, snd->next_seq, rcv->last_ack, rcv->window);
return true;
}
@ -5270,8 +5274,9 @@ static void StreamTcpPacketCheckPostRst(TcpSession *ssn, Packet *p)
}
if (ostream->flags & STREAMTCP_STREAM_FLAG_RST_RECV) {
SCLogDebug("regular packet %"PRIu64" from same sender as "
"the previous RST. Looks like it injected!", p->pcap_cnt);
SCLogDebug("regular packet %" PRIu64 " from same sender as "
"the previous RST. Looks like it injected!",
PcapPacketCntGet(p));
ostream->flags &= ~STREAMTCP_STREAM_FLAG_RST_RECV;
ssn->flags &= ~STREAMTCP_FLAG_CLOSED_BY_RST;
StreamTcpSetEvent(p, STREAM_SUSPECTED_RST_INJECT);
@ -5314,7 +5319,7 @@ static int StreamTcpPacketIsKeepAlive(TcpSession *ssn, Packet *p)
const uint32_t seq = TCP_GET_RAW_SEQ(tcph);
const uint32_t ack = TCP_GET_RAW_ACK(tcph);
if (ack == ostream->last_ack && seq == (stream->next_seq - 1)) {
SCLogDebug("packet is TCP keep-alive: %"PRIu64, p->pcap_cnt);
SCLogDebug("packet is TCP keep-alive: %" PRIu64, PcapPacketCntGet(p));
stream->flags |= STREAMTCP_STREAM_FLAG_KEEPALIVE;
STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_KEEPALIVE);
return 1;
@ -5363,7 +5368,7 @@ static int StreamTcpPacketIsKeepAliveACK(TcpSession *ssn, Packet *p)
return 0;
if ((ostream->flags & STREAMTCP_STREAM_FLAG_KEEPALIVE) && ack == ostream->last_ack && seq == stream->next_seq) {
SCLogDebug("packet is TCP keep-aliveACK: %"PRIu64, p->pcap_cnt);
SCLogDebug("packet is TCP keep-aliveACK: %" PRIu64, PcapPacketCntGet(p));
ostream->flags &= ~STREAMTCP_STREAM_FLAG_KEEPALIVE;
STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_KEEPALIVEACK);
return 1;
@ -5435,7 +5440,7 @@ static int StreamTcpPacketIsWindowUpdate(TcpSession *ssn, Packet *p)
return 0;
if (ack == ostream->last_ack && seq == stream->next_seq) {
SCLogDebug("packet is TCP window update: %"PRIu64, p->pcap_cnt);
SCLogDebug("packet is TCP window update: %" PRIu64, PcapPacketCntGet(p));
STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_WINDOWUPDATE);
return 1;
}
@ -5474,8 +5479,8 @@ static int StreamTcpPacketIsFinShutdownAck(TcpSession *ssn, Packet *p)
seq = TCP_GET_RAW_SEQ(tcph);
ack = TCP_GET_RAW_ACK(tcph);
SCLogDebug("%"PRIu64", seq %u ack %u stream->next_seq %u ostream->next_seq %u",
p->pcap_cnt, seq, ack, stream->next_seq, ostream->next_seq);
SCLogDebug("%" PRIu64 ", seq %u ack %u stream->next_seq %u ostream->next_seq %u",
PcapPacketCntGet(p), seq, ack, stream->next_seq, ostream->next_seq);
if (SEQ_EQ(stream->next_seq + 1, seq) && SEQ_EQ(ack, ostream->next_seq + 1)) {
return 1;
@ -5535,13 +5540,15 @@ static int StreamTcpPacketIsBadWindowUpdate(TcpSession *ssn, Packet *p)
SEQ_GT(ack, ostream->next_seq) &&
SEQ_GT(seq, stream->next_seq))
{
SCLogDebug("%"PRIu64", pkt_win %u, stream win %u, diff %u, dsize %u",
p->pcap_cnt, pkt_win, ostream->window, diff, p->payload_len);
SCLogDebug("%"PRIu64", pkt_win %u, stream win %u",
p->pcap_cnt, pkt_win, ostream->window);
SCLogDebug("%"PRIu64", seq %u ack %u ostream->next_seq %u ostream->last_ack %u, ostream->next_win %u, diff %u (%u)",
p->pcap_cnt, seq, ack, ostream->next_seq, ostream->last_ack, ostream->next_win,
ostream->next_seq - ostream->last_ack, stream->next_seq - stream->last_ack);
SCLogDebug("%" PRIu64 ", pkt_win %u, stream win %u, diff %u, dsize %u",
PcapPacketCntGet(p), pkt_win, ostream->window, diff, p->payload_len);
SCLogDebug("%" PRIu64 ", pkt_win %u, stream win %u", PcapPacketCntGet(p), pkt_win,
ostream->window);
SCLogDebug("%" PRIu64 ", seq %u ack %u ostream->next_seq %u ostream->last_ack %u, "
"ostream->next_win %u, diff %u (%u)",
PcapPacketCntGet(p), seq, ack, ostream->next_seq, ostream->last_ack,
ostream->next_win, ostream->next_seq - ostream->last_ack,
stream->next_seq - stream->last_ack);
/* get the expected window shrinking from looking at ack vs last_ack.
* Observed a lot of just a little overrunning that value. So added some
@ -5673,7 +5680,7 @@ int StreamTcpPacket (ThreadVars *tv, Packet *p, StreamTcpThread *stt,
DEBUG_ASSERT_FLOW_LOCKED(p->flow);
SCLogDebug("p->pcap_cnt %"PRIu64, p->pcap_cnt);
SCLogDebug("PcapPacketCntGet(p) %" PRIu64, PcapPacketCntGet(p));
TcpSession *ssn = (TcpSession *)p->flow->protoctx;
const TCPHdr *tcph = PacketGetTCP(p);
@ -5898,7 +5905,7 @@ static inline int StreamTcpValidateChecksum(Packet *p)
ret = 0;
if (p->livedev) {
(void) SC_ATOMIC_ADD(p->livedev->invalid_checksums, 1);
} else if (p->pcap_cnt) {
} else if (PcapPacketCntGet(p)) {
PcapIncreaseInvalidChecksum();
}
}
@ -5917,14 +5924,15 @@ static int TcpSessionPacketIsStreamStarter(const Packet *p)
}
if ((tcph->th_flags & (TH_SYN | TH_ACK)) == TH_SYN) {
SCLogDebug("packet %" PRIu64 " is a stream starter: %02x", p->pcap_cnt, tcph->th_flags);
SCLogDebug("packet %" PRIu64 " is a stream starter: %02x", PcapPacketCntGet(p),
tcph->th_flags);
return 1;
}
if (stream_config.midstream || stream_config.async_oneside) {
if ((tcph->th_flags & (TH_SYN | TH_ACK)) == (TH_SYN | TH_ACK)) {
SCLogDebug("packet %" PRIu64 " is a midstream stream starter: %02x", p->pcap_cnt,
tcph->th_flags);
SCLogDebug("packet %" PRIu64 " is a midstream stream starter: %02x",
PcapPacketCntGet(p), tcph->th_flags);
return 1;
}
}
@ -5941,43 +5949,57 @@ static bool TcpSessionReuseDoneEnoughSyn(const Packet *p, const Flow *f, const T
if (ssn == NULL) {
/* most likely a flow that was picked up after the 3whs, or a flow that
* does not have a session due to memcap issues. */
SCLogDebug("steam starter packet %" PRIu64 ", ssn %p null. Reuse.", p->pcap_cnt, ssn);
SCLogDebug("stream starter packet %" PRIu64 ", ssn %p null. Reuse.",
PcapPacketCntGet(p), ssn);
return true;
}
if (ssn->flags & STREAMTCP_FLAG_TFO_DATA_IGNORED) {
SCLogDebug("steam starter packet %" PRIu64
SCLogDebug("stream starter packet %" PRIu64
", ssn %p. STREAMTCP_FLAG_TFO_DATA_IGNORED set. Reuse.",
p->pcap_cnt, ssn);
PcapPacketCntGet(p), ssn);
return true;
}
if (SEQ_EQ(ssn->client.isn, TCP_GET_RAW_SEQ(tcph))) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.", p->pcap_cnt, ssn);
SCLogDebug("stream starter packet %" PRIu64
", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.",
PcapPacketCntGet(p), ssn);
return false;
}
if (ssn->state >= TCP_LAST_ACK) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state);
SCLogDebug("stream starter packet %" PRIu64
", ssn %p state >= TCP_LAST_ACK (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true;
} else if (ssn->state == TCP_NONE) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state);
SCLogDebug("stream starter packet %" PRIu64 ", ssn %p state == TCP_NONE (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true;
} else { // < TCP_LAST_ACK
SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state);
SCLogDebug("stream starter packet %" PRIu64
", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return false;
}
} else {
if (ssn == NULL) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p null. Reuse.", p->pcap_cnt, ssn);
SCLogDebug("stream starter packet %" PRIu64 ", ssn %p null. Reuse.",
PcapPacketCntGet(p), ssn);
return true;
}
if (ssn->state >= TCP_LAST_ACK) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state);
SCLogDebug("stream starter packet %" PRIu64
", ssn %p state >= TCP_LAST_ACK (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true;
} else if (ssn->state == TCP_NONE) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state);
SCLogDebug("stream starter packet %" PRIu64 ", ssn %p state == TCP_NONE (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true;
} else { // < TCP_LAST_ACK
SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state);
SCLogDebug("stream starter packet %" PRIu64
", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return false;
}
}
@ -5995,37 +6017,51 @@ static bool TcpSessionReuseDoneEnoughSynAck(const Packet *p, const Flow *f, cons
const TCPHdr *tcph = PacketGetTCP(p);
if (FlowGetPacketDirection(f, p) == TOCLIENT) {
if (ssn == NULL) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p null. No reuse.", p->pcap_cnt, ssn);
SCLogDebug("stream starter packet %" PRIu64 ", ssn %p null. No reuse.",
PcapPacketCntGet(p), ssn);
return false;
}
if (SEQ_EQ(ssn->server.isn, TCP_GET_RAW_SEQ(tcph))) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.", p->pcap_cnt, ssn);
SCLogDebug("stream starter packet %" PRIu64
", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.",
PcapPacketCntGet(p), ssn);
return false;
}
if (ssn->state >= TCP_LAST_ACK) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state);
SCLogDebug("stream starter packet %" PRIu64
", ssn %p state >= TCP_LAST_ACK (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true;
} else if (ssn->state == TCP_NONE) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state);
SCLogDebug("stream starter packet %" PRIu64 ", ssn %p state == TCP_NONE (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true;
} else { // < TCP_LAST_ACK
SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state);
SCLogDebug("stream starter packet %" PRIu64
", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return false;
}
} else {
if (ssn == NULL) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p null. Reuse.", p->pcap_cnt, ssn);
SCLogDebug("stream starter packet %" PRIu64 ", ssn %p null. Reuse.",
PcapPacketCntGet(p), ssn);
return true;
}
if (ssn->state >= TCP_LAST_ACK) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state);
SCLogDebug("stream starter packet %" PRIu64
", ssn %p state >= TCP_LAST_ACK (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true;
} else if (ssn->state == TCP_NONE) {
SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state);
SCLogDebug("stream starter packet %" PRIu64 ", ssn %p state == TCP_NONE (%u). Reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return true;
} else { // < TCP_LAST_ACK
SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state);
SCLogDebug("stream starter packet %" PRIu64
", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.",
PcapPacketCntGet(p), ssn, ssn->state);
return false;
}
}
@ -6076,13 +6112,13 @@ TmEcode StreamTcp (ThreadVars *tv, Packet *p, void *data, PacketQueueNoLock *pq)
StreamTcpThread *stt = (StreamTcpThread *)data;
SCLogDebug("p->pcap_cnt %" PRIu64 " direction %s pkt_src %s", p->pcap_cnt,
SCLogDebug("PcapPacketCntGet(p) %" PRIu64 " direction %s pkt_src %s", PcapPacketCntGet(p),
p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient")
: "noflow",
PktSrcToString(p->pkt_src));
#ifdef DEBUG
t_pcapcnt = p->pcap_cnt;
t_pcapcnt = PcapPacketCntGet(p);
#endif /* DEBUG */
if (!(PacketIsTCP(p))) {

12
src/tests/detect-http-header.c
Unescape Escape View File

@ -4583,17 +4583,17 @@ static int DetectEngineHttpHeaderTest34(void)
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p1->pcap_cnt = 1;
PcapPacketCntSet(p1, 1);
p2->flow = &f;
p2->flowflags |= FLOW_PKT_TOSERVER;
p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p2->pcap_cnt = 2;
PcapPacketCntSet(p2, 2);
p3->flow = &f;
p3->flowflags |= FLOW_PKT_TOSERVER;
p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p3->pcap_cnt = 3;
PcapPacketCntSet(p3, 3);
f.alproto = ALPROTO_HTTP1;
StreamTcpInitConfig(true);
@ -4699,17 +4699,17 @@ static int DetectEngineHttpHeaderTest35(void)
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p1->pcap_cnt = 1;
PcapPacketCntSet(p1, 1);
p2->flow = &f;
p2->flowflags |= FLOW_PKT_TOSERVER;
p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p2->pcap_cnt = 2;
PcapPacketCntSet(p2, 2);
p3->flow = &f;
p3->flowflags |= FLOW_PKT_TOSERVER;
p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->flags |= PKT_HAS_FLOW|PKT_STREAM_EST;
p3->pcap_cnt = 3;
PcapPacketCntSet(p3, 3);
f.alproto = ALPROTO_HTTP1;
StreamTcpInitConfig(true);

6
src/tests/detect-tls-cert-fingerprint.c
Unescape Escape View File

@ -290,19 +290,19 @@ static int DetectTlsFingerprintTest02(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1;
PcapPacketCntSet(p1, 1);
p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2;
PcapPacketCntSet(p2, 2);
p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3;
PcapPacketCntSet(p3, 3);
StreamTcpInitConfig(true);

6
src/tests/detect-tls-cert-issuer.c
Unescape Escape View File

@ -290,19 +290,19 @@ static int DetectTlsIssuerTest02(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1;
PcapPacketCntSet(p1, 1);
p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2;
PcapPacketCntSet(p2, 2);
p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3;
PcapPacketCntSet(p3, 3);
StreamTcpInitConfig(true);

6
src/tests/detect-tls-cert-serial.c
Unescape Escape View File

@ -287,19 +287,19 @@ static int DetectTlsSerialTest02(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1;
PcapPacketCntSet(p1, 1);
p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2;
PcapPacketCntSet(p2, 2);
p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3;
PcapPacketCntSet(p3, 3);
StreamTcpInitConfig(true);

6
src/tests/detect-tls-cert-subject.c
Unescape Escape View File

@ -290,19 +290,19 @@ static int DetectTlsSubjectTest02(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1;
PcapPacketCntSet(p1, 1);
p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2;
PcapPacketCntSet(p2, 2);
p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3;
PcapPacketCntSet(p3, 3);
StreamTcpInitConfig(true);

18
src/tests/detect-tls-cert-validity.c
Unescape Escape View File

@ -654,19 +654,19 @@ static int ValidityTestDetect01(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1;
PcapPacketCntSet(p1, 1);
p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2;
PcapPacketCntSet(p2, 2);
p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3;
PcapPacketCntSet(p3, 3);
StreamTcpInitConfig(true);
@ -977,19 +977,19 @@ static int ExpiredTestDetect01(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1;
PcapPacketCntSet(p1, 1);
p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2;
PcapPacketCntSet(p2, 2);
p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3;
PcapPacketCntSet(p3, 3);
f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */
@ -1280,19 +1280,19 @@ static int ValidTestDetect01(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1;
PcapPacketCntSet(p1, 1);
p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2;
PcapPacketCntSet(p2, 2);
p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3;
PcapPacketCntSet(p3, 3);
f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */

6
src/tests/detect-tls-certs.c
Unescape Escape View File

@ -286,19 +286,19 @@ static int DetectTlsCertsTest02(void)
p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p1->flowflags |= FLOW_PKT_TOSERVER;
p1->flowflags |= FLOW_PKT_ESTABLISHED;
p1->pcap_cnt = 1;
PcapPacketCntSet(p1, 1);
p2->flow = &f;
p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p2->flowflags |= FLOW_PKT_TOCLIENT;
p2->flowflags |= FLOW_PKT_ESTABLISHED;
p2->pcap_cnt = 2;
PcapPacketCntSet(p2, 2);
p3->flow = &f;
p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST;
p3->flowflags |= FLOW_PKT_TOCLIENT;
p3->flowflags |= FLOW_PKT_ESTABLISHED;
p3->pcap_cnt = 3;
PcapPacketCntSet(p3, 3);
StreamTcpInitConfig(true);

2
src/tests/fuzz/fuzz_predefpcap_aware.c
Unescape Escape View File

@ -156,7 +156,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
p->ts = SCTIME_FROM_TIMEVAL(&header.ts);
p->datalink = pkts.datalink;
pcap_cnt++;
p->pcap_cnt = pcap_cnt;
PcapPacketCntSet(p, pcap_cnt);
p->pkt_src = PKT_SRC_WIRE;
}
bail:

2
src/tests/fuzz/fuzz_sigpcap.c
Unescape Escape View File

@ -200,7 +200,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
p->datalink = pcap_datalink(pkts);
p->pkt_src = PKT_SRC_WIRE;
pcap_cnt++;
p->pcap_cnt = pcap_cnt;
PcapPacketCntSet(p, pcap_cnt);
}
bail:
//close structure

2
src/tests/fuzz/fuzz_sigpcap_aware.c
Unescape Escape View File

@ -196,7 +196,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size)
p->ts = SCTIME_FROM_TIMEVAL(&header.ts);
p->datalink = pkts.datalink;
pcap_cnt++;
p->pcap_cnt = pcap_cnt;
PcapPacketCntSet(p, pcap_cnt);
}
bail:
PacketFree(p);

2
src/util-exception-policy.c
Unescape Escape View File

@ -137,7 +137,7 @@ enum ExceptionPolicy ExceptionPolicyTargetPolicy(uint8_t target_flag)
void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDropReason drop_reason)
{
SCLogDebug("start: pcap_cnt %" PRIu64 ", policy %u", p->pcap_cnt, policy);
SCLogDebug("start: pcap_cnt %" PRIu64 ", policy %u", PcapPacketCntGet(p), policy);
if (p->flow) {
p->flow->applied_exception_policy |= ExceptionPolicyFlag(drop_reason);
}

2
src/util-lua-packetlib.c
Unescape Escape View File

@ -80,7 +80,7 @@ static int LuaPacketPcapCnt(lua_State *luastate)
LUA_ERROR("failed to get packet");
}
lua_pushinteger(luastate, s->p->pcap_cnt);
lua_pushinteger(luastate, PcapPacketCntGet(s->p));
return 1;
}

3
src/util-profiling.c
Unescape Escape View File

@ -790,8 +790,7 @@ void SCProfilingPrintPacketProfile(Packet *p)
/* total cost from acquisition to return to packetpool */
uint64_t delta = p->profile->ticks_end - p->profile->ticks_start;
fprintf(packet_profile_csv_fp, "%"PRIu64",%"PRIu64",",
p->pcap_cnt, delta);
fprintf(packet_profile_csv_fp, "%" PRIu64 ",%" PRIu64 ",", PcapPacketCntGet(p), delta);
for (int i = 0; i < TMM_SIZE; i++) {
const PktProfilingTmmData *pdt = &p->profile->tmm[i];

Write Preview
Loading…
Cancel
Save