From 400328c3c37deb14e82f2adaed2700d154e58d79 Mon Sep 17 00:00:00 2001 From: Lukas Sismis Date: Mon, 19 Jan 2026 15:44:27 +0100 Subject: [PATCH] pcap-file: prep codebase for pcap_cnt move refactor For an easier review process, this is a two-step change process, in which pcap_cnt is first accessed by functions-to-be, implemented as simple macros. In the follow-up commit, the actual refactor is implemented with the new function. The old macros are deleted. Ticket: 7835 --- plugins/ndpi/ndpi.c | 10 +- src/alert-debuglog.c | 11 +- src/alert-fastlog.c | 7 +- src/alert-syslog.c | 7 +- src/app-layer.c | 5 +- src/decode.h | 8 ++ src/defrag-hash.c | 4 +- src/defrag.c | 2 +- src/detect-app-layer-protocol.c | 10 +- src/detect-config.c | 2 +- src/detect-engine-alert.c | 14 +-- src/detect-engine-frame.c | 15 +-- src/detect-engine-payload.c | 4 +- src/detect-engine-prefilter.c | 2 +- src/detect-file-data.c | 2 +- src/detect-flowbits.c | 4 +- src/detect.c | 46 ++++---- src/flow-hash.c | 2 +- src/flow-worker.c | 33 +++--- src/flow.c | 2 +- src/log-tlsstore.c | 5 +- src/output-json-alert.c | 7 +- src/output-json.c | 5 +- src/output-tx.c | 16 +-- src/packet.c | 1 - src/stream-tcp-private.h | 4 +- src/stream-tcp-reassemble.c | 25 ++-- src/stream-tcp-sack.c | 6 +- src/stream-tcp.c | 148 +++++++++++++++--------- src/tests/detect-http-header.c | 12 +- src/tests/detect-tls-cert-fingerprint.c | 6 +- src/tests/detect-tls-cert-issuer.c | 6 +- src/tests/detect-tls-cert-serial.c | 6 +- src/tests/detect-tls-cert-subject.c | 6 +- src/tests/detect-tls-cert-validity.c | 18 +-- src/tests/detect-tls-certs.c | 6 +- src/tests/fuzz/fuzz_predefpcap_aware.c | 2 +- src/tests/fuzz/fuzz_sigpcap.c | 2 +- src/tests/fuzz/fuzz_sigpcap_aware.c | 2 +- src/util-exception-policy.c | 2 +- src/util-lua-packetlib.c | 2 +- src/util-profiling.c | 3 +- 42 files changed, 266 insertions(+), 214 deletions(-) diff --git a/plugins/ndpi/ndpi.c b/plugins/ndpi/ndpi.c index 2a6024061a..263225258a 100644 --- a/plugins/ndpi/ndpi.c +++ b/plugins/ndpi/ndpi.c @@ -191,18 +191,18 @@ static int DetectnDPIProtocolPacketMatch( /* if (s->type == SIG_TYPE_PDONLY && (p->flags & (PKT_PROTO_DETECT_TS_DONE | PKT_PROTO_DETECT_TC_DONE)) == 0) { - SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt); + SCLogDebug("packet %"PRIu64": flags not set", PcapPacketCntGet(p)); SCReturnInt(0); } */ if (!flowctx->detection_completed) { - SCLogDebug("packet %" PRIu64 ": ndpi protocol not yet detected", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 ": ndpi protocol not yet detected", PcapPacketCntGet(p)); SCReturnInt(0); } if (f == NULL) { - SCLogDebug("packet %" PRIu64 ": no flow", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 ": no flow", PcapPacketCntGet(p)); SCReturnInt(0); } @@ -318,12 +318,12 @@ static int DetectnDPIRiskPacketMatch( SCEnter(); if (!flowctx->detection_completed) { - SCLogDebug("packet %" PRIu64 ": ndpi risks not yet detected", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 ": ndpi risks not yet detected", PcapPacketCntGet(p)); SCReturnInt(0); } if (f == NULL) { - SCLogDebug("packet %" PRIu64 ": no flow", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 ": no flow", PcapPacketCntGet(p)); SCReturnInt(0); } diff --git a/src/alert-debuglog.c b/src/alert-debuglog.c index c050035e24..3d0d76e1d5 100644 --- a/src/alert-debuglog.c +++ b/src/alert-debuglog.c @@ -167,8 +167,9 @@ static TmEcode AlertDebugLogger(ThreadVars *tv, const Packet *p, void *thread_da MemBufferWriteString(aft->buffer, "+================\n" "TIME: %s\n", timebuf); - if (p->pcap_cnt > 0) { - MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt); + uint64_t pcap_cnt = PcapPacketCntGet(p); + if (pcap_cnt > 0) { + MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %" PRIu64 "\n", pcap_cnt); } pkt_src_str = PktSrcToString(p->pkt_src); MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str); @@ -327,9 +328,9 @@ static TmEcode AlertDebugLogDecoderEvent(ThreadVars *tv, const Packet *p, void * MemBufferWriteString(aft->buffer, "+================\n" "TIME: %s\n", timebuf); - if (p->pcap_cnt > 0) { - MemBufferWriteString(aft->buffer, - "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt); + uint64_t pcap_cnt = PcapPacketCntGet(p); + if (pcap_cnt > 0) { + MemBufferWriteString(aft->buffer, "PCAP PKT NUM: %" PRIu64 "\n", pcap_cnt); } pkt_src_str = PktSrcToString(p->pkt_src); MemBufferWriteString(aft->buffer, "PKT SRC: %s\n", pkt_src_str); diff --git a/src/alert-fastlog.c b/src/alert-fastlog.c index 061a11e855..9b11735d23 100644 --- a/src/alert-fastlog.c +++ b/src/alert-fastlog.c @@ -179,9 +179,10 @@ int AlertFastLogger(ThreadVars *tv, void *data, const Packet *p) pa->s->id, pa->s->rev, pa->s->msg, pa->s->class_msg, pa->s->prio); PrintBufferRawLineHex(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32); - if (p->pcap_cnt != 0) { - PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, - "] [pcap file packet: %"PRIu64"]\n", p->pcap_cnt); + uint64_t pcap_cnt = PcapPacketCntGet(p); + if (pcap_cnt != 0) { + PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, + "] [pcap file packet: %" PRIu64 "]\n", pcap_cnt); } else { PrintBufferData(alert_buffer, &size, MAX_FASTLOG_ALERT_SIZE, "]\n"); } diff --git a/src/alert-syslog.c b/src/alert-syslog.c index 5793df0695..68c6d56035 100644 --- a/src/alert-syslog.c +++ b/src/alert-syslog.c @@ -343,9 +343,10 @@ static TmEcode AlertSyslogDecoderEvent(ThreadVars *tv, const Packet *p, void *da PrintRawLineHexBuf(temp_buf_pkt, sizeof(temp_buf_pkt), GET_PKT_DATA(p), GET_PKT_LEN(p) < 32 ? GET_PKT_LEN(p) : 32); strlcat(alert, temp_buf_pkt, sizeof(alert)); - if (p->pcap_cnt != 0) { - snprintf(temp_buf_tail, sizeof(temp_buf_tail), "] [pcap file packet: %"PRIu64"]", - p->pcap_cnt); + uint64_t pcap_cnt = PcapPacketCntGet(p); + if (pcap_cnt != 0) { + snprintf(temp_buf_tail, sizeof(temp_buf_tail), "] [pcap file packet: %" PRIu64 "]", + pcap_cnt); } else { temp_buf_tail[0] = ']'; temp_buf_tail[1] = '\0'; diff --git a/src/app-layer.c b/src/app-layer.c index 8f1d3a8330..3237fb6396 100644 --- a/src/app-layer.c +++ b/src/app-layer.c @@ -657,8 +657,9 @@ static int TCPProtoDetect(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ctx, AppLayerIncFlowCounter(tv, f); *alproto = *alproto_otherdir; - SCLogDebug("packet %"PRIu64": pd done(us %u them %u), parser called (r==%d), APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION set", - p->pcap_cnt, *alproto, *alproto_otherdir, r); + SCLogDebug("packet %" PRIu64 ": pd done(us %u them %u), parser called (r==%d), " + "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION set", + PcapPacketCntGet(p), *alproto, *alproto_otherdir, r); if (r < 0) { goto parser_error; } diff --git a/src/decode.h b/src/decode.h index 6f240a75d4..229bebdc73 100644 --- a/src/decode.h +++ b/src/decode.h @@ -1522,4 +1522,12 @@ static inline bool DecodeNetworkLayer(ThreadVars *tv, DecodeThreadVars *dtv, return true; } +// temporary macro to get pcap packet count to reduce the number of changes +// in the follow-up commit +#define PcapPacketCntGet(p) (p)->pcap_cnt +#define PcapPacketCntSet(p, cnt) \ + do { \ + (p)->pcap_cnt = (cnt); \ + } while (0) + #endif /* SURICATA_DECODE_H */ diff --git a/src/defrag-hash.c b/src/defrag-hash.c index c8ac2ff4ff..846c51d3df 100644 --- a/src/defrag-hash.c +++ b/src/defrag-hash.c @@ -469,8 +469,8 @@ static void DefragExceptionPolicyStatsIncr( static DefragTracker *DefragTrackerGetNew(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p) { #ifdef DEBUG - if (g_eps_defrag_memcap != UINT64_MAX && g_eps_defrag_memcap == p->pcap_cnt) { - SCLogNotice("simulating memcap hit for packet %" PRIu64, p->pcap_cnt); + if (g_eps_defrag_memcap != UINT64_MAX && g_eps_defrag_memcap == PcapPacketCntGet(p)) { + SCLogNotice("simulating memcap hit for packet %" PRIu64, PcapPacketCntGet(p)); ExceptionPolicyApply(p, defrag_config.memcap_policy, PKT_DROP_REASON_DEFRAG_MEMCAP); DefragExceptionPolicyStatsIncr(tv, dtv, defrag_config.memcap_policy); return NULL; diff --git a/src/defrag.c b/src/defrag.c index 132677b568..04294d7e72 100644 --- a/src/defrag.c +++ b/src/defrag.c @@ -584,7 +584,7 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragTracker *tracker, uint8_t ip6_nh_set_value = 0; #ifdef DEBUG - uint64_t pcap_cnt = p->pcap_cnt; + uint64_t pcap_cnt = PcapPacketCntGet(p); #endif if (tracker->af == AF_INET) { diff --git a/src/detect-app-layer-protocol.c b/src/detect-app-layer-protocol.c index 46c8254960..9a78a005ab 100644 --- a/src/detect-app-layer-protocol.c +++ b/src/detect-app-layer-protocol.c @@ -65,13 +65,13 @@ static int DetectAppLayerProtocolPacketMatch( /* if the sig is PD-only we only match when PD packet flags are set */ if (s->type == SIG_TYPE_PDONLY && (p->flags & (PKT_PROTO_DETECT_TS_DONE | PKT_PROTO_DETECT_TC_DONE)) == 0) { - SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 ": flags not set", PcapPacketCntGet(p)); SCReturnInt(0); } const Flow *f = p->flow; if (f == NULL) { - SCLogDebug("packet %"PRIu64": no flow", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 ": no flow", PcapPacketCntGet(p)); SCReturnInt(0); } @@ -289,17 +289,17 @@ PrefilterPacketAppProtoMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const vo const PrefilterPacketHeaderCtx *ctx = pectx; if (!PrefilterPacketHeaderExtraMatch(ctx, p)) { - SCLogDebug("packet %"PRIu64": extra match failed", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 ": extra match failed", PcapPacketCntGet(p)); SCReturn; } if (p->flow == NULL) { - SCLogDebug("packet %"PRIu64": no flow, no alproto", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 ": no flow, no alproto", PcapPacketCntGet(p)); SCReturn; } if ((p->flags & (PKT_PROTO_DETECT_TS_DONE|PKT_PROTO_DETECT_TC_DONE)) == 0) { - SCLogDebug("packet %"PRIu64": flags not set", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 ": flags not set", PcapPacketCntGet(p)); SCReturn; } diff --git a/src/detect-config.c b/src/detect-config.c index 4841a9da06..7fa2f4f11c 100644 --- a/src/detect-config.c +++ b/src/detect-config.c @@ -187,7 +187,7 @@ static int ConfigApply(DetectEngineThreadCtx *det_ctx, } if (this_packet) { - SCLogDebug("packet logic here: %" PRIu64, p->pcap_cnt); + SCLogDebug("packet logic here: %" PRIu64, PcapPacketCntGet(p)); ConfigApplyPacket(p, config); } else if (this_tx) { SCLogDebug("tx logic here: tx_id %"PRIu64, det_ctx->tx_id); diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c index 76377e8fa2..4b2466d899 100644 --- a/src/detect-engine-alert.c +++ b/src/detect-engine-alert.c @@ -187,7 +187,7 @@ static inline void RuleActionToFlow(const uint8_t action, Flow *f) * \param pa packet alert struct -- match, including actions after thresholding (rate_filter) */ static void PacketApplySignatureActions(Packet *p, const Signature *s, const PacketAlert *pa) { - SCLogDebug("packet %" PRIu64 " sid %u action %02x alert_flags %02x", p->pcap_cnt, s->id, + SCLogDebug("packet %" PRIu64 " sid %u action %02x alert_flags %02x", PcapPacketCntGet(p), s->id, pa->action, pa->flags); /* REJECT also sets ACTION_DROP, just make it more visible with this check */ @@ -222,11 +222,11 @@ static void PacketApplySignatureActions(Packet *p, const Signature *s, const Pac // nothing to set in the packet } else if (pa->action & ACTION_ACCEPT) { const enum ActionScope as = pa->s->action_scope; - SCLogDebug("packet %" PRIu64 ": ACCEPT %u as:%u flags:%02x", p->pcap_cnt, s->id, as, - pa->flags); + SCLogDebug("packet %" PRIu64 ": ACCEPT %u as:%u flags:%02x", PcapPacketCntGet(p), s->id, + as, pa->flags); if (as == ACTION_SCOPE_PACKET || as == ACTION_SCOPE_FLOW || (pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_PACKET)) { - SCLogDebug("packet %" PRIu64 ": sid:%u ACCEPT", p->pcap_cnt, s->id); + SCLogDebug("packet %" PRIu64 ": sid:%u ACCEPT", PcapPacketCntGet(p), s->id); p->action |= ACTION_ACCEPT; } } else if (pa->action & (ACTION_ALERT | ACTION_CONFIG)) { @@ -464,7 +464,7 @@ static inline void FlowApplySignatureActions( if (pa->flags & PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW) { SCLogDebug("packet %" PRIu64 " sid %u action %02x alert_flags %02x (set " "PACKET_ALERT_FLAG_APPLY_ACTION_TO_FLOW)", - p->pcap_cnt, s->id, s->action, pa->flags); + PcapPacketCntGet(p), s->id, s->action, pa->flags); } } } @@ -523,8 +523,8 @@ static inline void PacketAlertFinalizeProcessQueue( } } } - SCLogDebug("packet %" PRIu64 ": i:%u sid:%u skip_action_set %s", p->pcap_cnt, i, s->id, - BOOL2STR(skip_action_set)); + SCLogDebug("packet %" PRIu64 ": i:%u sid:%u skip_action_set %s", PcapPacketCntGet(p), i, + s->id, BOOL2STR(skip_action_set)); if (!skip_action_set) { /* set actions on the flow */ FlowApplySignatureActions(p, pa, s, pa->flags); diff --git a/src/detect-engine-frame.c b/src/detect-engine-frame.c index 8423ff935f..d160674688 100644 --- a/src/detect-engine-frame.c +++ b/src/detect-engine-frame.c @@ -74,7 +74,7 @@ static void BufferSetupUdp(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buf void DetectRunPrefilterFrame(DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p, const Frames *frames, const Frame *frame, const AppProto alproto) { - SCLogDebug("pcap_cnt %" PRIu64, p->pcap_cnt); + SCLogDebug("pcap_cnt %" PRIu64, PcapPacketCntGet(p)); PrefilterEngine *engine = sgh->frame_engines; do { if ((engine->alproto == alproto || engine->alproto == ALPROTO_UNKNOWN) && @@ -151,7 +151,7 @@ static void PrefilterMpmFrame(DetectEngineThreadCtx *det_ctx, const void *pectx, const MpmCtx *mpm_ctx = ctx->mpm_ctx; SCLogDebug("packet:%" PRIu64 ", prefilter running on list %d -> frame field type %u", - p->pcap_cnt, ctx->list_id, frame->type); + PcapPacketCntGet(p), ctx->list_id, frame->type); if (p->proto == IPPROTO_UDP) { // TODO can we use single here? Could it conflict with TCP? InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, ctx->list_id, 0); @@ -198,7 +198,7 @@ static void PrefilterMpmFrame(DetectEngineThreadCtx *det_ctx, const void *pectx, } SCLogDebug("packet:%" PRIu64 ", prefilter done running on list %d -> frame field type %u; have %u matches", - p->pcap_cnt, ctx->list_id, frame->type, det_ctx->pmq.rule_id_array_cnt); + PcapPacketCntGet(p), ctx->list_id, frame->type, det_ctx->pmq.rule_id_array_cnt); } static void PrefilterMpmFrameFree(void *ptr) @@ -273,7 +273,7 @@ static void BufferSetupUdp(DetectEngineThreadCtx *det_ctx, InspectionBuffer *buf SCLogDebug("packet %" PRIu64 " -> frame %p/%" PRIi64 "/%s offset %" PRIu64 " type %u len %" PRIi64, - p->pcap_cnt, frame, frame->id, + PcapPacketCntGet(p), frame, frame->id, AppLayerParserGetFrameNameById(p->flow->proto, p->flow->alproto, frame->type), frame->offset, frame->type, frame->len); @@ -290,8 +290,8 @@ static int DetectFrameInspectUdp(DetectEngineThreadCtx *det_ctx, const DetectEngineTransforms *transforms, Packet *p, const Frames *_frames, const Frame *frame, const int list_id) { - SCLogDebug("packet:%" PRIu64 ", inspect: s:%p s->id:%u, transforms:%p", p->pcap_cnt, s, s->id, - transforms); + SCLogDebug("packet:%" PRIu64 ", inspect: s:%p s->id:%u, transforms:%p", PcapPacketCntGet(p), s, + s->id, transforms); // TODO can we use single here? Could it conflict with TCP? InspectionBuffer *buffer = InspectionBufferMultipleForListGet(det_ctx, list_id, 0); @@ -577,7 +577,8 @@ int DetectEngineInspectFrameBufferGeneric(DetectEngineThreadCtx *det_ctx, SCLogDebug("packet:%" PRIu64 ", frame->id:%" PRIu64 ", list:%d, transforms:%p, s:%p, s->id:%u, engine:%p", - p->pcap_cnt, frame->id, engine->sm_list, engine->v1.transforms, s, s->id, engine); + PcapPacketCntGet(p), frame->id, engine->sm_list, engine->v1.transforms, s, s->id, + engine); DEBUG_VALIDATE_BUG_ON(p->flow->protoctx == NULL); TcpSession *ssn = p->flow->protoctx; diff --git a/src/detect-engine-payload.c b/src/detect-engine-payload.c index 12628666e9..0a201cb1ab 100644 --- a/src/detect-engine-payload.c +++ b/src/detect-engine-payload.c @@ -333,8 +333,8 @@ uint8_t DetectEngineInspectStream(DetectEngineCtx *de_ctx, DetectEngineThreadCtx is_last = true; } - SCLogDebug("%s ran stream for sid %u on packet %"PRIu64" and we %s", - is_last? "LAST:" : "normal:", s->id, p->pcap_cnt, + SCLogDebug("%s ran stream for sid %u on packet %" PRIu64 " and we %s", + is_last ? "LAST:" : "normal:", s->id, PcapPacketCntGet(p), match ? "matched" : "didn't match"); if (match) { diff --git a/src/detect-engine-prefilter.c b/src/detect-engine-prefilter.c index d76f41a2b5..5a4124af18 100644 --- a/src/detect-engine-prefilter.c +++ b/src/detect-engine-prefilter.c @@ -104,7 +104,7 @@ void DetectRunPrefilterTx(DetectEngineThreadCtx *det_ctx, /* reset rule store */ det_ctx->pmq.rule_id_array_cnt = 0; - SCLogDebug("packet %" PRIu64 " tx %p progress %d tx->detect_progress %02x", p->pcap_cnt, + SCLogDebug("packet %" PRIu64 " tx %p progress %d tx->detect_progress %02x", PcapPacketCntGet(p), tx->tx_ptr, tx->tx_progress, tx->detect_progress); PrefilterEngine *engine = sgh->tx_engines; diff --git a/src/detect-file-data.c b/src/detect-file-data.c index cdc218f840..9f048eb7d7 100644 --- a/src/detect-file-data.c +++ b/src/detect-file-data.c @@ -558,7 +558,7 @@ static void PrefilterTxFiledata(DetectEngineThreadCtx *det_ctx, const void *pect local_file_id++; continue; } - SCLogDebug("[%" PRIu64 "] buffer size %u", p->pcap_cnt, buffer->inspect_len); + SCLogDebug("[%" PRIu64 "] buffer size %u", PcapPacketCntGet(p), buffer->inspect_len); if (buffer->inspect_len >= mpm_ctx->minlen) { uint32_t prev_rule_id_array_cnt = det_ctx->pmq.rule_id_array_cnt; diff --git a/src/detect-flowbits.c b/src/detect-flowbits.c index f8e3ae1c88..5de7a95274 100644 --- a/src/detect-flowbits.c +++ b/src/detect-flowbits.c @@ -977,7 +977,7 @@ static void PrefilterFlowbitFree(void *vctx) static void PrefilterFlowbitMatch(DetectEngineThreadCtx *det_ctx, Packet *p, const void *pectx) { struct PrefilterEngineFlowbits *ctx = (struct PrefilterEngineFlowbits *)pectx; - SCLogDebug("%" PRIu64 ": ctx %p", p->pcap_cnt, ctx); + SCLogDebug("%" PRIu64 ": ctx %p", PcapPacketCntGet(p), ctx); if (p->flow == NULL) { SCReturn; @@ -1013,7 +1013,7 @@ static void PrefilterFlowbitPostRuleMatch( DetectEngineThreadCtx *det_ctx, const void *pectx, Packet *p, Flow *f) { struct PrefilterEngineFlowbits *ctx = (struct PrefilterEngineFlowbits *)pectx; - SCLogDebug("%" PRIu64 ": ctx %p", p->pcap_cnt, ctx); + SCLogDebug("%" PRIu64 ": ctx %p", PcapPacketCntGet(p), ctx); if (p->flow == NULL) { SCReturn; diff --git a/src/detect.c b/src/detect.c index f2f9b227f2..ed89c108be 100644 --- a/src/detect.c +++ b/src/detect.c @@ -112,7 +112,7 @@ static void DetectRun(ThreadVars *th_v, Packet *p) { SCEnter(); - SCLogDebug("p->pcap_cnt %" PRIu64 " direction %s pkt_src %s", p->pcap_cnt, + SCLogDebug("PcapPacketCntGet(p) %" PRIu64 " direction %s pkt_src %s", PcapPacketCntGet(p), p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient") : "noflow", PktSrcToString(p->pkt_src)); @@ -158,7 +158,7 @@ static void DetectRun(ThreadVars *th_v, if (pflow && pflow->alstate && likely(pflow->proto == p->proto)) { if (p->proto == IPPROTO_TCP) { if ((p->flags & PKT_STREAM_EST) == 0) { - SCLogDebug("packet %" PRIu64 ": skip tcp non-established", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 ": skip tcp non-established", PcapPacketCntGet(p)); DetectRunAppendDefaultAccept(det_ctx, p); goto end; } @@ -178,7 +178,7 @@ static void DetectRun(ThreadVars *th_v, if (!PKT_IS_PSEUDOPKT(p) && p->app_update_direction == 0 && ((PKT_IS_TOSERVER(p) && (p->flow->flags & FLOW_TS_APP_UPDATED) == 0) || (PKT_IS_TOCLIENT(p) && (p->flow->flags & FLOW_TC_APP_UPDATED) == 0))) { - SCLogDebug("packet %" PRIu64 ": no app-layer update", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 ": no app-layer update", PcapPacketCntGet(p)); DetectRunAppendDefaultAccept(det_ctx, p); goto end; } @@ -195,7 +195,7 @@ static void DetectRun(ThreadVars *th_v, pflow, pflow->alparser, pflow->alstate, scratch.flow_flags, (scratch.sgh == NULL)); PACKET_PROFILING_DETECT_END(p, PROF_DETECT_TX_UPDATE); } else { - SCLogDebug("packet %" PRIu64 ": no flow / app-layer", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 ": no flow / app-layer", PcapPacketCntGet(p)); DetectRunAppendDefaultAccept(det_ctx, p); } @@ -212,7 +212,7 @@ static void DetectRunPacketHook(ThreadVars *th_v, const DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx, const SigGroupHead *sgh, Packet *p) { SCEnter(); - SCLogDebug("p->pcap_cnt %" PRIu64 " direction %s pkt_src %s", p->pcap_cnt, + SCLogDebug("PcapPacketCntGet(p) %" PRIu64 " direction %s pkt_src %s", PcapPacketCntGet(p), p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient") : "noflow", PktSrcToString(p->pkt_src)); @@ -697,7 +697,8 @@ static inline uint8_t DetectRulePacketRules(ThreadVars *const tv, } const uint8_t s_proto_flags = s->proto.flags; - SCLogDebug("packet %" PRIu64 ": inspecting signature id %" PRIu32 "", p->pcap_cnt, s->id); + SCLogDebug("packet %" PRIu64 ": inspecting signature id %" PRIu32 "", PcapPacketCntGet(p), + s->id); /* if we accept:hook'd the `packet_filter` hook, we skip the rest of the firewall rules. */ if (s->flags & SIG_FLAG_FIREWALL) { @@ -1044,8 +1045,8 @@ static inline void DetectRunPostRules(ThreadVars *tv, const DetectEngineCtx *de_ // TODO review packet src types here if (EngineModeIsFirewall() && !(p->action & ACTION_ACCEPT) && p->pkt_src == PKT_SRC_WIRE && scratch->default_action == ACTION_DROP) { - SCLogDebug("packet %" PRIu64 ": droppit as no ACCEPT set %02x (pkt %s)", p->pcap_cnt, - p->action, PktSrcToString(p->pkt_src)); + SCLogDebug("packet %" PRIu64 ": droppit as no ACCEPT set %02x (pkt %s)", + PcapPacketCntGet(p), p->action, PktSrcToString(p->pkt_src)); PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_DEFAULT_PACKET_POLICY); } } @@ -1679,7 +1680,7 @@ static bool ApplyAccept(Packet *p, const uint8_t flow_flags, const Signature *s, /* if there is no fw rule for the next progress value, * we invoke the default drop policy. */ if (fw_next_progress_missing) { - SCLogDebug("%" PRIu64 ": %s default drop for progress", p->pcap_cnt, + SCLogDebug("%" PRIu64 ": %s default drop for progress", PcapPacketCntGet(p), flow_flags & STREAM_TOSERVER ? "toserver" : "toclient"); PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_DEFAULT_APP_POLICY); p->flow->flags |= FLOW_ACTION_DROP; @@ -1725,7 +1726,7 @@ static void DetectRunTx(ThreadVars *tv, uint32_t tx_inspected = 0; const bool have_fw_rules = EngineModeIsFirewall(); - SCLogDebug("packet %" PRIu64, p->pcap_cnt); + SCLogDebug("packet %" PRIu64, PcapPacketCntGet(p)); while (1) { AppLayerGetTxIterTuple ires = IterFunc(ipproto, alproto, alstate, tx_id_min, total_txs, &state); @@ -1875,7 +1876,7 @@ static void DetectRunTx(ThreadVars *tv, uint32_t *inspect_flags = det_ctx->tx_candidates[i].flags; bool break_out_of_app_filter = false; - SCLogDebug("%" PRIu64 ": sid:%u: %s tx %u/%u/%u sig %u", p->pcap_cnt, s->id, + SCLogDebug("%" PRIu64 ": sid:%u: %s tx %u/%u/%u sig %u", PcapPacketCntGet(p), s->id, flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.tx_progress, tx.detect_progress, tx.detect_progress_orig, s->app_progress_hook); @@ -1996,7 +1997,7 @@ static void DetectRunTx(ThreadVars *tv, (s->flags & SIG_FLAG_FIREWALL) ? "firewall" : "regular", BOOL2STR(last_for_progress)); if (s->flags & SIG_FLAG_FIREWALL) { - SCLogDebug("%" PRIu64 ": %s default drop for progress", p->pcap_cnt, + SCLogDebug("%" PRIu64 ": %s default drop for progress", PcapPacketCntGet(p), flow_flags & STREAM_TOSERVER ? "toserver" : "toclient"); /* if this rule was the last for our progress state, and it didn't match, * we have to invoke the default drop policy. */ @@ -2055,7 +2056,7 @@ static void DetectRunTx(ThreadVars *tv, /* this side of the tx is done */ if (tx.tx_progress >= tx.tx_end_state) { - SCLogDebug("%" PRIu64 ": %s tx done", p->pcap_cnt, + SCLogDebug("%" PRIu64 ": %s tx done", PcapPacketCntGet(p), flow_flags & STREAM_TOSERVER ? "toserver" : "toclient"); const uint8_t inspected_flag = (flow_flags & STREAM_TOSERVER) ? APP_LAYER_TX_INSPECTED_TS @@ -2067,7 +2068,7 @@ static void DetectRunTx(ThreadVars *tv, } if (tx.detect_progress != tx.detect_progress_orig) { - SCLogDebug("%" PRIu64 ": %s tx state change %u -> %u", p->pcap_cnt, + SCLogDebug("%" PRIu64 ": %s tx state change %u -> %u", PcapPacketCntGet(p), flow_flags & STREAM_TOSERVER ? "toserver" : "toclient", tx.detect_progress_orig, tx.detect_progress); SCLogDebug("%p/%" PRIu64 " Storing new progress %02x (was %02x)", tx.tx_ptr, tx.tx_id, @@ -2085,10 +2086,10 @@ static void DetectRunTx(ThreadVars *tv, /* apply default policy if there were txs to inspect, we have fw rules and non of the rules * applied a policy. */ - SCLogDebug("packet %" PRIu64 ": tx_inspected %u fw_verdicted %u", p->pcap_cnt, tx_inspected, - fw_verdicted); + SCLogDebug("packet %" PRIu64 ": tx_inspected %u fw_verdicted %u", PcapPacketCntGet(p), + tx_inspected, fw_verdicted); if (tx_inspected && have_fw_rules && tx_inspected != fw_verdicted) { - SCLogDebug("%" PRIu64 ": %s default drop", p->pcap_cnt, + SCLogDebug("%" PRIu64 ": %s default drop", PcapPacketCntGet(p), flow_flags & STREAM_TOSERVER ? "toserver" : "toclient"); PacketDrop(p, ACTION_DROP, PKT_DROP_REASON_DEFAULT_APP_POLICY); p->flow->flags |= FLOW_ACTION_DROP; @@ -2112,7 +2113,7 @@ static void DetectRunFrames(ThreadVars *tv, DetectEngineCtx *de_ctx, DetectEngin ((PKT_IS_TOSERVER(p) && (f->flags & FLOW_TS_APP_UPDATED) == 0) || (PKT_IS_TOCLIENT(p) && (f->flags & FLOW_TC_APP_UPDATED) == 0))) { SCLogDebug("pcap_cnt %" PRIu64 ": %s: skip frame inspection for TCP w/o APP UPDATE", - p->pcap_cnt, PKT_IS_TOSERVER(p) ? "toserver" : "toclient"); + PcapPacketCntGet(p), PKT_IS_TOSERVER(p) ? "toserver" : "toclient"); return; } FramesContainer *frames_container = AppLayerFramesGetContainer(f); @@ -2284,8 +2285,9 @@ static void DetectFlow(ThreadVars *tv, AppLayerParserSetTransactionInspectId(f, f->alparser, f->alstate, flags, true); } } - SCLogDebug("p->pcap %"PRIu64": no detection on packet, " - "PKT_NOPACKET_INSPECTION is set", p->pcap_cnt); + SCLogDebug("p->pcap %" PRIu64 ": no detection on packet, " + "PKT_NOPACKET_INSPECTION is set", + PcapPacketCntGet(p)); return; } @@ -2312,7 +2314,7 @@ uint8_t DetectPreFlow(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet *p) const DetectEngineCtx *de_ctx = det_ctx->de_ctx; const SigGroupHead *sgh = de_ctx->pre_flow_sgh; - SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, p->pcap_cnt, sgh); + SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, PcapPacketCntGet(p), sgh); DetectRunPacketHook(tv, de_ctx, det_ctx, sgh, p); return p->action; } @@ -2323,7 +2325,7 @@ uint8_t DetectPreStream(ThreadVars *tv, DetectEngineThreadCtx *det_ctx, Packet * const int direction = (PKT_IS_TOCLIENT(p) != 0); const SigGroupHead *sgh = de_ctx->pre_stream_sgh[direction]; - SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, p->pcap_cnt, sgh); + SCLogDebug("thread id: %u, packet %" PRIu64 ", sgh %p", tv->id, PcapPacketCntGet(p), sgh); DetectRunPacketHook(tv, de_ctx, det_ctx, sgh, p); return p->action; } diff --git a/src/flow-hash.c b/src/flow-hash.c index ce143cf0a8..bd35848a1d 100644 --- a/src/flow-hash.c +++ b/src/flow-hash.c @@ -695,7 +695,7 @@ static Flow *FlowGetNew(ThreadVars *tv, FlowLookupStruct *fls, Packet *p) { const bool emerg = ((SC_ATOMIC_GET(flow_flags) & FLOW_EMERGENCY) != 0); #ifdef DEBUG - if (g_eps_flow_memcap != UINT64_MAX && g_eps_flow_memcap == p->pcap_cnt) { + if (g_eps_flow_memcap != UINT64_MAX && g_eps_flow_memcap == PcapPacketCntGet(p)) { NoFlowHandleIPS(tv, fls, p); StatsCounterIncr(&tv->stats, fls->dtv->counter_flow_memcap); return NULL; diff --git a/src/flow-worker.c b/src/flow-worker.c index 5178e309a0..8a4d73821b 100644 --- a/src/flow-worker.c +++ b/src/flow-worker.c @@ -395,10 +395,10 @@ static inline void FlowWorkerStreamTCPUpdate(ThreadVars *tv, FlowWorkerThreadDat } /* Packets here can safely access p->flow as it's locked */ - SCLogDebug("packet %"PRIu64": extra packets %u", p->pcap_cnt, fw->pq.len); + SCLogDebug("packet %" PRIu64 ": extra packets %u", PcapPacketCntGet(p), fw->pq.len); Packet *x; while ((x = PacketDequeueNoLock(&fw->pq))) { - SCLogDebug("packet %"PRIu64" extra packet %p", p->pcap_cnt, x); + SCLogDebug("packet %" PRIu64 " extra packet %p", PcapPacketCntGet(p), x); if (det_ctx != NULL) { FLOWWORKER_PROFILING_START(x, PROFILE_FLOWWORKER_DETECT); @@ -438,7 +438,8 @@ static void FlowWorkerFlowTimeout( { DEBUG_VALIDATE_BUG_ON(p->pkt_src != PKT_SRC_FFR); - SCLogDebug("packet %"PRIu64" is TCP. Direction %s", p->pcap_cnt, PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT"); + SCLogDebug("packet %" PRIu64 " is TCP. Direction %s", PcapPacketCntGet(p), + PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT"); DEBUG_VALIDATE_BUG_ON(!(p->flow && PacketIsTCP(p))); DEBUG_ASSERT_FLOW_LOCKED(p->flow); @@ -448,7 +449,7 @@ static void FlowWorkerFlowTimeout( PacketUpdateEngineEventCounters(tv, fw->dtv, p); /* handle Detect */ - SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 " calling Detect", PcapPacketCntGet(p)); if (det_ctx != NULL) { FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_DETECT); Detect(tv, p, det_ctx); @@ -520,37 +521,37 @@ static void PacketAppUpdate2FlowFlags(Packet *p) { switch ((enum StreamUpdateDir)p->app_update_direction) { case UPDATE_DIR_NONE: // NONE implies pseudo packet - SCLogDebug("pcap_cnt %" PRIu64 ", UPDATE_DIR_NONE", p->pcap_cnt); + SCLogDebug("pcap_cnt %" PRIu64 ", UPDATE_DIR_NONE", PcapPacketCntGet(p)); break; case UPDATE_DIR_PACKET: if (PKT_IS_TOSERVER(p)) { p->flow->flags |= FLOW_TS_APP_UPDATED; - SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED set", p->pcap_cnt); + SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED set", PcapPacketCntGet(p)); } else { p->flow->flags |= FLOW_TC_APP_UPDATED; - SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED set", p->pcap_cnt); + SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED set", PcapPacketCntGet(p)); } break; case UPDATE_DIR_BOTH: if (PKT_IS_TOSERVER(p)) { p->flow->flags |= FLOW_TS_APP_UPDATED | FLOW_TC_APP_UPDATE_NEXT; SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED|FLOW_TC_APP_UPDATE_NEXT set", - p->pcap_cnt); + PcapPacketCntGet(p)); } else { p->flow->flags |= FLOW_TC_APP_UPDATED | FLOW_TS_APP_UPDATE_NEXT; SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED|FLOW_TS_APP_UPDATE_NEXT set", - p->pcap_cnt); + PcapPacketCntGet(p)); } /* fall through */ case UPDATE_DIR_OPPOSING: if (PKT_IS_TOSERVER(p)) { p->flow->flags |= FLOW_TC_APP_UPDATED | FLOW_TS_APP_UPDATE_NEXT; SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TC_APP_UPDATED|FLOW_TS_APP_UPDATE_NEXT set", - p->pcap_cnt); + PcapPacketCntGet(p)); } else { p->flow->flags |= FLOW_TS_APP_UPDATED | FLOW_TC_APP_UPDATE_NEXT; SCLogDebug("pcap_cnt %" PRIu64 ", FLOW_TS_APP_UPDATED|FLOW_TC_APP_UPDATE_NEXT set", - p->pcap_cnt); + PcapPacketCntGet(p)); } break; } @@ -564,7 +565,7 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data) DEBUG_VALIDATE_BUG_ON(p == NULL); DEBUG_VALIDATE_BUG_ON(tv->flow_queue == NULL); - SCLogDebug("packet %"PRIu64, p->pcap_cnt); + SCLogDebug("packet %" PRIu64, PcapPacketCntGet(p)); if ((PKT_IS_FLUSHPKT(p))) { SCLogDebug("thread %s flushing", tv->printable_name); @@ -614,13 +615,13 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data) TimeSetByThread(tv->id, p->ts); } - SCLogDebug("packet %"PRIu64" has flow? %s", p->pcap_cnt, p->flow ? "yes" : "no"); + SCLogDebug("packet %" PRIu64 " has flow? %s", PcapPacketCntGet(p), p->flow ? "yes" : "no"); /* handle TCP and app layer */ if (p->flow) { SCLogDebug("packet %" PRIu64 ": direction %s FLOW_TS_APP_UPDATE_NEXT %s FLOW_TC_APP_UPDATE_NEXT %s", - p->pcap_cnt, PKT_IS_TOSERVER(p) ? "toserver" : "toclient", + PcapPacketCntGet(p), PKT_IS_TOSERVER(p) ? "toserver" : "toclient", BOOL2STR((p->flow->flags & FLOW_TS_APP_UPDATE_NEXT) != 0), BOOL2STR((p->flow->flags & FLOW_TC_APP_UPDATE_NEXT) != 0)); /* see if need to consider flags set by prev packets */ @@ -635,7 +636,7 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data) } if (PacketIsTCP(p)) { - SCLogDebug("packet %" PRIu64 " is TCP. Direction %s", p->pcap_cnt, + SCLogDebug("packet %" PRIu64 " is TCP. Direction %s", PcapPacketCntGet(p), PKT_IS_TOSERVER(p) ? "TOSERVER" : "TOCLIENT"); DEBUG_ASSERT_FLOW_LOCKED(p->flow); @@ -663,7 +664,7 @@ static TmEcode FlowWorker(ThreadVars *tv, Packet *p, void *data) /* handle Detect */ DEBUG_ASSERT_FLOW_LOCKED(p->flow); - SCLogDebug("packet %"PRIu64" calling Detect", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 " calling Detect", PcapPacketCntGet(p)); if (det_ctx != NULL) { FLOWWORKER_PROFILING_START(p, PROFILE_FLOWWORKER_DETECT); Detect(tv, p, det_ctx); diff --git a/src/flow.c b/src/flow.c index dd44a9083b..775e15d7be 100644 --- a/src/flow.c +++ b/src/flow.c @@ -423,7 +423,7 @@ static inline void FlowUpdateEthernet( */ void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars *dtv) { - SCLogDebug("packet %"PRIu64" -- flow %p", p->pcap_cnt, f); + SCLogDebug("packet %" PRIu64 " -- flow %p", PcapPacketCntGet(p), f); const int pkt_dir = FlowGetPacketDirection(f, p); #ifdef CAPTURE_OFFLOAD diff --git a/src/log-tlsstore.c b/src/log-tlsstore.c index 1724975f16..a15077aab7 100644 --- a/src/log-tlsstore.c +++ b/src/log-tlsstore.c @@ -217,8 +217,9 @@ static void LogTlsLogPem(LogTlsStoreLogThread *aft, const Packet *p, SSLState *s goto end_fwrite_fpmeta; if (fprintf(fpmeta, "TIME: %s\n", timebuf) < 0) goto end_fwrite_fpmeta; - if (p->pcap_cnt > 0) { - if (fprintf(fpmeta, "PCAP PKT NUM: %"PRIu64"\n", p->pcap_cnt) < 0) + uint64_t pcap_cnt = PcapPacketCntGet(p); + if (pcap_cnt > 0) { + if (fprintf(fpmeta, "PCAP PKT NUM: %" PRIu64 "\n", pcap_cnt) < 0) goto end_fwrite_fpmeta; } if (fprintf(fpmeta, "SRC IP: %s\n", srcip) < 0) diff --git a/src/output-json-alert.c b/src/output-json-alert.c index 25b0ee3780..e5ee355d7c 100644 --- a/src/output-json-alert.c +++ b/src/output-json-alert.c @@ -285,10 +285,8 @@ static void AlertJsonTunnel(const Packet *p, SCJsonBuilder *js) SCJbOpenObject(js, "tunnel"); enum PktSrcEnum pkt_src; - uint64_t pcap_cnt; JsonAddrInfo addr = json_addr_info_zero; JsonAddrInfoInit(p->root, 0, &addr); - pcap_cnt = p->root->pcap_cnt; pkt_src = p->root->pkt_src; SCJbSetString(js, "src_ip", addr.src_ip); @@ -298,6 +296,7 @@ static void AlertJsonTunnel(const Packet *p, SCJsonBuilder *js) SCJbSetString(js, "proto", addr.proto); SCJbSetUint(js, "depth", p->recursion_level); + uint64_t pcap_cnt = PcapPacketCntGet(p->root); if (pcap_cnt != 0) { SCJbSetUint(js, "pcap_cnt", pcap_cnt); } @@ -542,8 +541,8 @@ void EveAddVerdict(SCJsonBuilder *jb, const Packet *p, const uint8_t alert_actio SCJbOpenObject(jb, "verdict"); const uint8_t packet_action = PacketGetAction(p); - SCLogDebug("%" PRIu64 ": packet_action %02x alert_action %02x", p->pcap_cnt, packet_action, - alert_action); + SCLogDebug("%" PRIu64 ": packet_action %02x alert_action %02x", PcapPacketCntGet(p), + packet_action, alert_action); /* add verdict info */ if (packet_action & ACTION_REJECT_ANY) { // check rule to define type of reject packet sent diff --git a/src/output-json.c b/src/output-json.c index dfea4602c2..1b7464e35e 100644 --- a/src/output-json.c +++ b/src/output-json.c @@ -859,8 +859,9 @@ SCJsonBuilder *CreateEveHeader(const Packet *p, enum SCOutputJsonLogDirection di } /* pcap_cnt */ - if (p->pcap_cnt != 0) { - SCJbSetUint(js, "pcap_cnt", p->pcap_cnt); + uint64_t pcap_cnt = PcapPacketCntGet(p); + if (pcap_cnt != 0) { + SCJbSetUint(js, "pcap_cnt", pcap_cnt); } if (event_type) { diff --git a/src/output-tx.c b/src/output-tx.c index e13eb68f8f..7a1a6ca234 100644 --- a/src/output-tx.c +++ b/src/output-tx.c @@ -186,7 +186,7 @@ static inline void OutputTxLogFiles(ThreadVars *tv, OutputFileLoggerThreadData * if (ffc || ffc_opposing) SCLogDebug("pcap_cnt %" PRIu64 " flow %p tx %p tx_id %" PRIu64 " ffc %p ffc_opposing %p tx_complete %d", - p->pcap_cnt, f, tx, tx_id, ffc, ffc_opposing, tx_complete); + PcapPacketCntGet(p), f, tx, tx_id, ffc, ffc_opposing, tx_complete); if (ffc) { const bool file_close = ((p->flags & PKT_PSEUDO_STREAM_END)) | eof; @@ -234,7 +234,7 @@ static inline void OutputTxLogFiles(ThreadVars *tv, OutputFileLoggerThreadData * } else { SCLogDebug("pcap_cnt %" PRIu64 " flow %p tx %p tx_id %" PRIu64 " NOT SETTING FILE FLAGS ffc %p ffc_opposing %p tx_complete %d", - p->pcap_cnt, f, tx, tx_id, ffc, ffc_opposing, tx_complete); + PcapPacketCntGet(p), f, tx, tx_id, ffc, ffc_opposing, tx_complete); } } @@ -292,8 +292,8 @@ static void OutputTxLogCallLoggers(ThreadVars *tv, OutputTxLoggerThreadData *op_ if ((ctx->tx_logged_old & BIT_U32(logger->logger_id)) == 0) { SCLogDebug("alproto match %d, logging tx_id %" PRIu64, logger->alproto, tx_id); - SCLogDebug("pcap_cnt %" PRIu64 ", tx_id %" PRIu64 " logger %d. EOF %s", p->pcap_cnt, - tx_id, logger->logger_id, eof ? "true" : "false"); + SCLogDebug("pcap_cnt %" PRIu64 ", tx_id %" PRIu64 " logger %d. EOF %s", + PcapPacketCntGet(p), tx_id, logger->logger_id, eof ? "true" : "false"); if (eof) { SCLogDebug("EOF, so log now"); @@ -354,7 +354,7 @@ static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data) Flow * const f = p->flow; const uint8_t ipproto = f->proto; const AppProto alproto = f->alproto; - SCLogDebug("pcap_cnt %u tx logging %u/%s", (uint32_t)p->pcap_cnt, alproto, + SCLogDebug("pcap_cnt %u tx logging %u/%s", (uint32_t)PcapPacketCntGet(p), alproto, AppProtoToString(alproto)); const bool file_logging_active = (op_thread_data->file || op_thread_data->filedata); @@ -378,7 +378,7 @@ static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data) logger_expectation, LOGGER_FILE, LOGGER_FILEDATA); goto end; } - SCLogDebug("pcap_cnt %" PRIu64, p->pcap_cnt); + SCLogDebug("pcap_cnt %" PRIu64, PcapPacketCntGet(p)); const bool last_pseudo = (p->flowflags & FLOW_PKT_LAST_PSEUDO) != 0; const bool ts_eof = SCAppLayerParserStateIssetFlag(f->alparser, APP_LAYER_PARSER_EOF_TS) != 0; @@ -398,8 +398,8 @@ static TmEcode OutputTxLog(ThreadVars *tv, Packet *p, void *thread_data) const bool support_files = AppLayerParserSupportsFiles(ipproto, alproto); const uint8_t pkt_dir = STREAM_FLAGS_FOR_PACKET(p); - SCLogDebug("pcap_cnt %" PRIu64 ": tx_id %" PRIu64 " total_txs %" PRIu64, p->pcap_cnt, tx_id, - total_txs); + SCLogDebug("pcap_cnt %" PRIu64 ": tx_id %" PRIu64 " total_txs %" PRIu64, PcapPacketCntGet(p), + tx_id, total_txs); AppLayerGetTxIteratorFunc IterFunc = AppLayerGetTxIterator(ipproto, alproto); AppLayerGetTxIterState state; diff --git a/src/packet.c b/src/packet.c index 80bffc0005..67df4d6f1b 100644 --- a/src/packet.c +++ b/src/packet.c @@ -142,7 +142,6 @@ void PacketReinit(Packet *p) PacketAlertRecycle(p->alerts.alerts, p->alerts.cnt); p->alerts.cnt = 0; } - p->pcap_cnt = 0; p->tunnel_rtv_cnt = 0; p->tunnel_tpr_cnt = 0; p->events.cnt = 0; diff --git a/src/stream-tcp-private.h b/src/stream-tcp-private.h index d188904dd9..97b40b4eb5 100644 --- a/src/stream-tcp-private.h +++ b/src/stream-tcp-private.h @@ -272,9 +272,9 @@ enum TcpState { if ((p)->flags & PKT_STREAM_NO_EVENTS) { \ SCLogDebug("not setting event %d on pkt %p (%" PRIu64 "), " \ "stream in known bad condition", \ - (e), p, (p)->pcap_cnt); \ + (e), p, PcapPacketCntGet(p)); \ } else { \ - SCLogDebug("setting event %d on pkt %p (%" PRIu64 ")", (e), p, (p)->pcap_cnt); \ + SCLogDebug("setting event %d on pkt %p (%" PRIu64 ")", (e), p, PcapPacketCntGet(p)); \ ENGINE_SET_EVENT((p), (e)); \ p->l4.vars.tcp.stream_pkt_flags |= STREAM_PKT_FLAG_EVENTSET; \ } \ diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index ca044d88c7..6d9efa249d 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -1087,7 +1087,7 @@ static void GetSessionSize(TcpSession *ssn, Packet *p) size = GetStreamSize(&ssn->client); size += GetStreamSize(&ssn->server); - SCLogDebug("size %"PRIu64", packet %"PRIu64, size, p->pcap_cnt); + SCLogDebug("size %" PRIu64 ", packet %" PRIu64, size, PcapPacketCntGet(p)); } } #endif @@ -1196,7 +1196,7 @@ static inline bool CheckGap(TcpSession *ssn, TcpStream *stream, Packet *p) if (RB_EMPTY(&stream->sb.sbb_tree)) { SCLogDebug("packet %" PRIu64 ": no GAP. " "next_seq %u < last_ack %u, but no data in list", - p->pcap_cnt, stream->next_seq, stream->last_ack); + PcapPacketCntGet(p), stream->next_seq, stream->last_ack); return false; } const uint64_t next_seq_abs = @@ -1206,7 +1206,7 @@ static inline bool CheckGap(TcpSession *ssn, TcpStream *stream, Packet *p) /* ack'd data after the gap */ SCLogDebug("packet %" PRIu64 ": GAP. " "next_seq %u < last_ack %u, but ACK'd data beyond gap.", - p->pcap_cnt, stream->next_seq, stream->last_ack); + PcapPacketCntGet(p), stream->next_seq, stream->last_ack); return true; } } @@ -1214,12 +1214,12 @@ static inline bool CheckGap(TcpSession *ssn, TcpStream *stream, Packet *p) SCLogDebug("packet %" PRIu64 ": GAP! " "last_ack_abs %" PRIu64 " > app_progress %" PRIu64 ", " "but we have no data.", - p->pcap_cnt, last_ack_abs, app_progress); + PcapPacketCntGet(p), last_ack_abs, app_progress); return true; } - SCLogDebug("packet %"PRIu64": no GAP. " - "last_ack_abs %"PRIu64" <= app_progress %"PRIu64, - p->pcap_cnt, last_ack_abs, app_progress); + SCLogDebug("packet %" PRIu64 ": no GAP. " + "last_ack_abs %" PRIu64 " <= app_progress %" PRIu64, + PcapPacketCntGet(p), last_ack_abs, app_progress); return false; } @@ -1333,7 +1333,7 @@ static int ReassembleUpdateAppLayer(ThreadVars *tv, TcpReassemblyThreadCtx *ra_c mydata = NULL; mydata_len = 0; - SCLogDebug("%"PRIu64" got %p/%u", p->pcap_cnt, mydata, mydata_len); + SCLogDebug("%" PRIu64 " got %p/%u", PcapPacketCntGet(p), mydata, mydata_len); break; } DEBUG_VALIDATE_BUG_ON(mydata == NULL && mydata_len > 0); @@ -1579,8 +1579,9 @@ void StreamReassembleRawUpdateProgress(TcpSession *ssn, Packet *p, const uint64_ stream->flags &= ~STREAMTCP_STREAM_FLAG_TRIGGER_RAW; } else { - SCLogDebug("p->pcap_cnt %"PRIu64": progress %"PRIu64" app %"PRIu64" raw %"PRIu64" tcp win %"PRIu32, - p->pcap_cnt, progress, STREAM_APP_PROGRESS(stream), + SCLogDebug("PcapPacketCntGet(p) %" PRIu64 ": progress %" PRIu64 " app %" PRIu64 + " raw %" PRIu64 " tcp win %" PRIu32, + PcapPacketCntGet(p), progress, STREAM_APP_PROGRESS(stream), STREAM_RAW_PROGRESS(stream), stream->window); } @@ -2026,7 +2027,7 @@ int StreamTcpReassembleHandleSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ dir = UPDATE_DIR_BOTH; } else if ((ssn->flags & STREAMTCP_FLAG_ASYNC) != 0) { dir = UPDATE_DIR_PACKET; - SCLogDebug("%" PRIu64 ": ASYNC: UPDATE_DIR_PACKET", p->pcap_cnt); + SCLogDebug("%" PRIu64 ": ASYNC: UPDATE_DIR_PACKET", PcapPacketCntGet(p)); } /* handle ack received */ @@ -2071,7 +2072,7 @@ int StreamTcpReassembleHandleSegment(ThreadVars *tv, TcpReassemblyThreadCtx *ra_ SCReturnInt(-1); } - SCLogDebug("packet %"PRIu64" set PKT_STREAM_ADD", p->pcap_cnt); + SCLogDebug("packet %" PRIu64 " set PKT_STREAM_ADD", PcapPacketCntGet(p)); p->flags |= PKT_STREAM_ADD; } else { SCLogDebug("ssn %p / stream %p: not calling StreamTcpReassembleHandleSegmentHandleData:" diff --git a/src/stream-tcp-sack.c b/src/stream-tcp-sack.c index 5772b5898a..a1361a14bd 100644 --- a/src/stream-tcp-sack.c +++ b/src/stream-tcp-sack.c @@ -277,14 +277,14 @@ int StreamTcpSackUpdatePacket(TcpStream *stream, Packet *p) /* RFC 2883 D-SACK */ if (SEQ_LT(le, TCP_GET_RAW_ACK(tcph))) { - SCLogDebug("packet: %" PRIu64 ": D-SACK? %u-%u before ACK %u", p->pcap_cnt, le, re, - TCP_GET_RAW_ACK(tcph)); + SCLogDebug("packet: %" PRIu64 ": D-SACK? %u-%u before ACK %u", PcapPacketCntGet(p), le, + re, TCP_GET_RAW_ACK(tcph)); STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_DSACK); goto next; } else if (record == 1) { // 2nd record if (SEQ_GEQ(first_le, le) && SEQ_LEQ(first_re, re)) { SCLogDebug("packet: %" PRIu64 ": D-SACK? %u-%u inside 2nd range %u-%u ACK %u", - p->pcap_cnt, first_le, first_re, le, re, TCP_GET_RAW_ACK(tcph)); + PcapPacketCntGet(p), first_le, first_re, le, re, TCP_GET_RAW_ACK(tcph)); STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_DSACK); } goto next; diff --git a/src/stream-tcp.c b/src/stream-tcp.c index cfdb2a2df3..f7171fff2b 100644 --- a/src/stream-tcp.c +++ b/src/stream-tcp.c @@ -1797,14 +1797,14 @@ static inline bool StateSynSentValidateTimestamp(TcpSession *ssn, Packet *p) if (receiver_stream->last_ts != 0 && ts_echo != 0 && ts_echo != receiver_stream->last_ts) { - SCLogDebug("%" PRIu64 ": ssn %p: BAD TSECR echo %u recv %u", p->pcap_cnt, ssn, ts_echo, - receiver_stream->last_ts); + SCLogDebug("%" PRIu64 ": ssn %p: BAD TSECR echo %u recv %u", PcapPacketCntGet(p), ssn, + ts_echo, receiver_stream->last_ts); return false; } } else { if (receiver_stream->last_ts == 0 && ts_echo != 0) { - SCLogDebug("%" PRIu64 ": ssn %p: BAD TSECR echo %u recv %u", p->pcap_cnt, ssn, ts_echo, - receiver_stream->last_ts); + SCLogDebug("%" PRIu64 ": ssn %p: BAD TSECR echo %u recv %u", PcapPacketCntGet(p), ssn, + ts_echo, receiver_stream->last_ts); return false; } } @@ -1966,7 +1966,8 @@ static int StreamTcp3whsStoreSyn(TcpSession *ssn, Packet *p) if (ssn->queue_len > 0 && ssn->queue_len == stream_config.max_syn_queued) { DEBUG_VALIDATE_BUG_ON(ssn->queue == NULL); - SCLogDebug("%" PRIu64 ": ssn %p: =~ SYN queue limit reached, rotate", p->pcap_cnt, ssn); + SCLogDebug("%" PRIu64 ": ssn %p: =~ SYN queue limit reached, rotate", PcapPacketCntGet(p), + ssn); StreamTcpSetEvent(p, STREAM_3WHS_SYN_FLOOD); /* add to the list, evicting the oldest entry */ @@ -1995,8 +1996,8 @@ static int StreamTcp3whsStoreSyn(TcpSession *ssn, Packet *p) ssn->queue = q; } ssn->queue_len++; - SCLogDebug("%" PRIu64 ": ssn %p: =~ SYN with SEQ %u added (queue_len %u)", p->pcap_cnt, ssn, - q->seq, ssn->queue_len); + SCLogDebug("%" PRIu64 ": ssn %p: =~ SYN with SEQ %u added (queue_len %u)", PcapPacketCntGet(p), + ssn, q->seq, ssn->queue_len); return 0; } @@ -2050,7 +2051,8 @@ static inline bool StateSynSentCheckSynAck3Whs(TcpSession *ssn, Packet *p, const TcpStateQueue search; TcpStateQueueInitFromPktSynAck(p, &search); - SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK looking for SEQ %u", p->pcap_cnt, ssn, search.seq); + SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK looking for SEQ %u", PcapPacketCntGet(p), ssn, + search.seq); const TcpStateQueue *q = StreamTcp3whsFindSyn(ssn, &search, NULL, stream_config.liberal_timestamps); @@ -2100,7 +2102,8 @@ static inline bool StateSynSentCheckSynAckTFO(TcpSession *ssn, Packet *p, const TcpStateQueue search; TcpStateQueueInitFromPktSynAck(p, &search); - SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK looking for SEQ %u", p->pcap_cnt, ssn, search.seq); + SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK looking for SEQ %u", PcapPacketCntGet(p), ssn, + search.seq); const TcpStateQueue *q = StreamTcp3whsFindSyn(ssn, &search, NULL, stream_config.liberal_timestamps); @@ -2145,7 +2148,7 @@ static int StreamTcpPacketStateSynSent( /* common case: SYN/ACK from server to client */ if ((tcph->th_flags & (TH_SYN | TH_ACK)) == (TH_SYN | TH_ACK) && PKT_IS_TOCLIENT(p)) { SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK on SYN_SENT state for packet %" PRIu64, - p->pcap_cnt, ssn, p->pcap_cnt); + PcapPacketCntGet(p), ssn, PcapPacketCntGet(p)); /* if timestamps are liberal, allow a SYN/ACK with TS even if the SYN * had none (violates RFC 7323, see bug #4702). */ const bool ts_mismatch = @@ -2179,7 +2182,8 @@ static int StreamTcpPacketStateSynSent( StreamTcp3wsFreeQueue(ssn); StreamTcp3whsSynAckUpdate(ssn, p, /* no queue override */NULL); - SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK on SYN_SENT state: accepted", p->pcap_cnt, ssn); + SCLogDebug("%" PRIu64 ": ssn %p: SYN/ACK on SYN_SENT state: accepted", PcapPacketCntGet(p), + ssn); return 0; } else if ((tcph->th_flags & (TH_SYN | TH_ACK)) == (TH_SYN | TH_ACK) && PKT_IS_TOSERVER(p)) { @@ -2383,7 +2387,7 @@ static int StreamTcpPacketStateSynSent( StreamTcp3whsStoreSyn(ssn, p); SCLogDebug("ssn %p: Retransmitted SYN. Updating ssn from packet %" PRIu64 ". Stored previous state", - ssn, p->pcap_cnt); + ssn, PcapPacketCntGet(p)); } StreamTcp3whsStoreSynApplyToSsn(ssn, &syn_pkt); } @@ -3237,7 +3241,7 @@ static bool StreamTcpPacketIsZeroWindowProbeAck(const TcpSession *ssn, const Pac return false; if (TCP_GET_RAW_ACK(tcph) != rcv->last_ack) return false; - SCLogDebug("ssn %p: packet %" PRIu64 " is a Zero Window Probe ACK", ssn, p->pcap_cnt); + SCLogDebug("ssn %p: packet %" PRIu64 " is a Zero Window Probe ACK", ssn, PcapPacketCntGet(p)); return true; } @@ -3275,8 +3279,8 @@ static bool StreamTcpPacketIsDupAck(const TcpSession *ssn, const Packet *p) return false; SCLogDebug("ssn %p: packet:%" PRIu64 " seq:%u ack:%u win:%u snd %u:%u:%u rcv %u:%u:%u", ssn, - p->pcap_cnt, TCP_GET_RAW_SEQ(tcph), TCP_GET_RAW_ACK(tcph), pkt_win, snd->next_seq, - snd->last_ack, rcv->window, snd->next_seq, rcv->last_ack, rcv->window); + PcapPacketCntGet(p), TCP_GET_RAW_SEQ(tcph), TCP_GET_RAW_ACK(tcph), pkt_win, + snd->next_seq, snd->last_ack, rcv->window, snd->next_seq, rcv->last_ack, rcv->window); return true; } @@ -5270,8 +5274,9 @@ static void StreamTcpPacketCheckPostRst(TcpSession *ssn, Packet *p) } if (ostream->flags & STREAMTCP_STREAM_FLAG_RST_RECV) { - SCLogDebug("regular packet %"PRIu64" from same sender as " - "the previous RST. Looks like it injected!", p->pcap_cnt); + SCLogDebug("regular packet %" PRIu64 " from same sender as " + "the previous RST. Looks like it injected!", + PcapPacketCntGet(p)); ostream->flags &= ~STREAMTCP_STREAM_FLAG_RST_RECV; ssn->flags &= ~STREAMTCP_FLAG_CLOSED_BY_RST; StreamTcpSetEvent(p, STREAM_SUSPECTED_RST_INJECT); @@ -5314,7 +5319,7 @@ static int StreamTcpPacketIsKeepAlive(TcpSession *ssn, Packet *p) const uint32_t seq = TCP_GET_RAW_SEQ(tcph); const uint32_t ack = TCP_GET_RAW_ACK(tcph); if (ack == ostream->last_ack && seq == (stream->next_seq - 1)) { - SCLogDebug("packet is TCP keep-alive: %"PRIu64, p->pcap_cnt); + SCLogDebug("packet is TCP keep-alive: %" PRIu64, PcapPacketCntGet(p)); stream->flags |= STREAMTCP_STREAM_FLAG_KEEPALIVE; STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_KEEPALIVE); return 1; @@ -5363,7 +5368,7 @@ static int StreamTcpPacketIsKeepAliveACK(TcpSession *ssn, Packet *p) return 0; if ((ostream->flags & STREAMTCP_STREAM_FLAG_KEEPALIVE) && ack == ostream->last_ack && seq == stream->next_seq) { - SCLogDebug("packet is TCP keep-aliveACK: %"PRIu64, p->pcap_cnt); + SCLogDebug("packet is TCP keep-aliveACK: %" PRIu64, PcapPacketCntGet(p)); ostream->flags &= ~STREAMTCP_STREAM_FLAG_KEEPALIVE; STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_KEEPALIVEACK); return 1; @@ -5435,7 +5440,7 @@ static int StreamTcpPacketIsWindowUpdate(TcpSession *ssn, Packet *p) return 0; if (ack == ostream->last_ack && seq == stream->next_seq) { - SCLogDebug("packet is TCP window update: %"PRIu64, p->pcap_cnt); + SCLogDebug("packet is TCP window update: %" PRIu64, PcapPacketCntGet(p)); STREAM_PKT_FLAG_SET(p, STREAM_PKT_FLAG_WINDOWUPDATE); return 1; } @@ -5474,8 +5479,8 @@ static int StreamTcpPacketIsFinShutdownAck(TcpSession *ssn, Packet *p) seq = TCP_GET_RAW_SEQ(tcph); ack = TCP_GET_RAW_ACK(tcph); - SCLogDebug("%"PRIu64", seq %u ack %u stream->next_seq %u ostream->next_seq %u", - p->pcap_cnt, seq, ack, stream->next_seq, ostream->next_seq); + SCLogDebug("%" PRIu64 ", seq %u ack %u stream->next_seq %u ostream->next_seq %u", + PcapPacketCntGet(p), seq, ack, stream->next_seq, ostream->next_seq); if (SEQ_EQ(stream->next_seq + 1, seq) && SEQ_EQ(ack, ostream->next_seq + 1)) { return 1; @@ -5535,13 +5540,15 @@ static int StreamTcpPacketIsBadWindowUpdate(TcpSession *ssn, Packet *p) SEQ_GT(ack, ostream->next_seq) && SEQ_GT(seq, stream->next_seq)) { - SCLogDebug("%"PRIu64", pkt_win %u, stream win %u, diff %u, dsize %u", - p->pcap_cnt, pkt_win, ostream->window, diff, p->payload_len); - SCLogDebug("%"PRIu64", pkt_win %u, stream win %u", - p->pcap_cnt, pkt_win, ostream->window); - SCLogDebug("%"PRIu64", seq %u ack %u ostream->next_seq %u ostream->last_ack %u, ostream->next_win %u, diff %u (%u)", - p->pcap_cnt, seq, ack, ostream->next_seq, ostream->last_ack, ostream->next_win, - ostream->next_seq - ostream->last_ack, stream->next_seq - stream->last_ack); + SCLogDebug("%" PRIu64 ", pkt_win %u, stream win %u, diff %u, dsize %u", + PcapPacketCntGet(p), pkt_win, ostream->window, diff, p->payload_len); + SCLogDebug("%" PRIu64 ", pkt_win %u, stream win %u", PcapPacketCntGet(p), pkt_win, + ostream->window); + SCLogDebug("%" PRIu64 ", seq %u ack %u ostream->next_seq %u ostream->last_ack %u, " + "ostream->next_win %u, diff %u (%u)", + PcapPacketCntGet(p), seq, ack, ostream->next_seq, ostream->last_ack, + ostream->next_win, ostream->next_seq - ostream->last_ack, + stream->next_seq - stream->last_ack); /* get the expected window shrinking from looking at ack vs last_ack. * Observed a lot of just a little overrunning that value. So added some @@ -5673,7 +5680,7 @@ int StreamTcpPacket (ThreadVars *tv, Packet *p, StreamTcpThread *stt, DEBUG_ASSERT_FLOW_LOCKED(p->flow); - SCLogDebug("p->pcap_cnt %"PRIu64, p->pcap_cnt); + SCLogDebug("PcapPacketCntGet(p) %" PRIu64, PcapPacketCntGet(p)); TcpSession *ssn = (TcpSession *)p->flow->protoctx; const TCPHdr *tcph = PacketGetTCP(p); @@ -5898,7 +5905,7 @@ static inline int StreamTcpValidateChecksum(Packet *p) ret = 0; if (p->livedev) { (void) SC_ATOMIC_ADD(p->livedev->invalid_checksums, 1); - } else if (p->pcap_cnt) { + } else if (PcapPacketCntGet(p)) { PcapIncreaseInvalidChecksum(); } } @@ -5917,14 +5924,15 @@ static int TcpSessionPacketIsStreamStarter(const Packet *p) } if ((tcph->th_flags & (TH_SYN | TH_ACK)) == TH_SYN) { - SCLogDebug("packet %" PRIu64 " is a stream starter: %02x", p->pcap_cnt, tcph->th_flags); + SCLogDebug("packet %" PRIu64 " is a stream starter: %02x", PcapPacketCntGet(p), + tcph->th_flags); return 1; } if (stream_config.midstream || stream_config.async_oneside) { if ((tcph->th_flags & (TH_SYN | TH_ACK)) == (TH_SYN | TH_ACK)) { - SCLogDebug("packet %" PRIu64 " is a midstream stream starter: %02x", p->pcap_cnt, - tcph->th_flags); + SCLogDebug("packet %" PRIu64 " is a midstream stream starter: %02x", + PcapPacketCntGet(p), tcph->th_flags); return 1; } } @@ -5941,43 +5949,57 @@ static bool TcpSessionReuseDoneEnoughSyn(const Packet *p, const Flow *f, const T if (ssn == NULL) { /* most likely a flow that was picked up after the 3whs, or a flow that * does not have a session due to memcap issues. */ - SCLogDebug("steam starter packet %" PRIu64 ", ssn %p null. Reuse.", p->pcap_cnt, ssn); + SCLogDebug("stream starter packet %" PRIu64 ", ssn %p null. Reuse.", + PcapPacketCntGet(p), ssn); return true; } if (ssn->flags & STREAMTCP_FLAG_TFO_DATA_IGNORED) { - SCLogDebug("steam starter packet %" PRIu64 + SCLogDebug("stream starter packet %" PRIu64 ", ssn %p. STREAMTCP_FLAG_TFO_DATA_IGNORED set. Reuse.", - p->pcap_cnt, ssn); + PcapPacketCntGet(p), ssn); return true; } if (SEQ_EQ(ssn->client.isn, TCP_GET_RAW_SEQ(tcph))) { - SCLogDebug("steam starter packet %"PRIu64", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.", p->pcap_cnt, ssn); + SCLogDebug("stream starter packet %" PRIu64 + ", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.", + PcapPacketCntGet(p), ssn); return false; } if (ssn->state >= TCP_LAST_ACK) { - SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); + SCLogDebug("stream starter packet %" PRIu64 + ", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", + PcapPacketCntGet(p), ssn, ssn->state); return true; } else if (ssn->state == TCP_NONE) { - SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); + SCLogDebug("stream starter packet %" PRIu64 ", ssn %p state == TCP_NONE (%u). Reuse.", + PcapPacketCntGet(p), ssn, ssn->state); return true; } else { // < TCP_LAST_ACK - SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state); + SCLogDebug("stream starter packet %" PRIu64 + ", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", + PcapPacketCntGet(p), ssn, ssn->state); return false; } } else { if (ssn == NULL) { - SCLogDebug("steam starter packet %"PRIu64", ssn %p null. Reuse.", p->pcap_cnt, ssn); + SCLogDebug("stream starter packet %" PRIu64 ", ssn %p null. Reuse.", + PcapPacketCntGet(p), ssn); return true; } if (ssn->state >= TCP_LAST_ACK) { - SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); + SCLogDebug("stream starter packet %" PRIu64 + ", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", + PcapPacketCntGet(p), ssn, ssn->state); return true; } else if (ssn->state == TCP_NONE) { - SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); + SCLogDebug("stream starter packet %" PRIu64 ", ssn %p state == TCP_NONE (%u). Reuse.", + PcapPacketCntGet(p), ssn, ssn->state); return true; } else { // < TCP_LAST_ACK - SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state); + SCLogDebug("stream starter packet %" PRIu64 + ", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", + PcapPacketCntGet(p), ssn, ssn->state); return false; } } @@ -5995,37 +6017,51 @@ static bool TcpSessionReuseDoneEnoughSynAck(const Packet *p, const Flow *f, cons const TCPHdr *tcph = PacketGetTCP(p); if (FlowGetPacketDirection(f, p) == TOCLIENT) { if (ssn == NULL) { - SCLogDebug("steam starter packet %"PRIu64", ssn %p null. No reuse.", p->pcap_cnt, ssn); + SCLogDebug("stream starter packet %" PRIu64 ", ssn %p null. No reuse.", + PcapPacketCntGet(p), ssn); return false; } if (SEQ_EQ(ssn->server.isn, TCP_GET_RAW_SEQ(tcph))) { - SCLogDebug("steam starter packet %"PRIu64", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.", p->pcap_cnt, ssn); + SCLogDebug("stream starter packet %" PRIu64 + ", ssn %p. Packet SEQ == Stream ISN. Retransmission. Don't reuse.", + PcapPacketCntGet(p), ssn); return false; } if (ssn->state >= TCP_LAST_ACK) { - SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); + SCLogDebug("stream starter packet %" PRIu64 + ", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", + PcapPacketCntGet(p), ssn, ssn->state); return true; } else if (ssn->state == TCP_NONE) { - SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); + SCLogDebug("stream starter packet %" PRIu64 ", ssn %p state == TCP_NONE (%u). Reuse.", + PcapPacketCntGet(p), ssn, ssn->state); return true; } else { // < TCP_LAST_ACK - SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state); + SCLogDebug("stream starter packet %" PRIu64 + ", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", + PcapPacketCntGet(p), ssn, ssn->state); return false; } } else { if (ssn == NULL) { - SCLogDebug("steam starter packet %"PRIu64", ssn %p null. Reuse.", p->pcap_cnt, ssn); + SCLogDebug("stream starter packet %" PRIu64 ", ssn %p null. Reuse.", + PcapPacketCntGet(p), ssn); return true; } if (ssn->state >= TCP_LAST_ACK) { - SCLogDebug("steam starter packet %"PRIu64", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); + SCLogDebug("stream starter packet %" PRIu64 + ", ssn %p state >= TCP_LAST_ACK (%u). Reuse.", + PcapPacketCntGet(p), ssn, ssn->state); return true; } else if (ssn->state == TCP_NONE) { - SCLogDebug("steam starter packet %"PRIu64", ssn %p state == TCP_NONE (%u). Reuse.", p->pcap_cnt, ssn, ssn->state); + SCLogDebug("stream starter packet %" PRIu64 ", ssn %p state == TCP_NONE (%u). Reuse.", + PcapPacketCntGet(p), ssn, ssn->state); return true; } else { // < TCP_LAST_ACK - SCLogDebug("steam starter packet %"PRIu64", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", p->pcap_cnt, ssn, ssn->state); + SCLogDebug("stream starter packet %" PRIu64 + ", ssn %p state < TCP_LAST_ACK (%u). Don't reuse.", + PcapPacketCntGet(p), ssn, ssn->state); return false; } } @@ -6076,13 +6112,13 @@ TmEcode StreamTcp (ThreadVars *tv, Packet *p, void *data, PacketQueueNoLock *pq) StreamTcpThread *stt = (StreamTcpThread *)data; - SCLogDebug("p->pcap_cnt %" PRIu64 " direction %s pkt_src %s", p->pcap_cnt, + SCLogDebug("PcapPacketCntGet(p) %" PRIu64 " direction %s pkt_src %s", PcapPacketCntGet(p), p->flow ? (FlowGetPacketDirection(p->flow, p) == TOSERVER ? "toserver" : "toclient") : "noflow", PktSrcToString(p->pkt_src)); #ifdef DEBUG - t_pcapcnt = p->pcap_cnt; + t_pcapcnt = PcapPacketCntGet(p); #endif /* DEBUG */ if (!(PacketIsTCP(p))) { diff --git a/src/tests/detect-http-header.c b/src/tests/detect-http-header.c index 82dd7b507a..7aa6ddae98 100644 --- a/src/tests/detect-http-header.c +++ b/src/tests/detect-http-header.c @@ -4583,17 +4583,17 @@ static int DetectEngineHttpHeaderTest34(void) p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; - p1->pcap_cnt = 1; + PcapPacketCntSet(p1, 1); p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; - p2->pcap_cnt = 2; + PcapPacketCntSet(p2, 2); p3->flow = &f; p3->flowflags |= FLOW_PKT_TOSERVER; p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; - p3->pcap_cnt = 3; + PcapPacketCntSet(p3, 3); f.alproto = ALPROTO_HTTP1; StreamTcpInitConfig(true); @@ -4699,17 +4699,17 @@ static int DetectEngineHttpHeaderTest35(void) p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; p1->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; - p1->pcap_cnt = 1; + PcapPacketCntSet(p1, 1); p2->flow = &f; p2->flowflags |= FLOW_PKT_TOSERVER; p2->flowflags |= FLOW_PKT_ESTABLISHED; p2->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; - p2->pcap_cnt = 2; + PcapPacketCntSet(p2, 2); p3->flow = &f; p3->flowflags |= FLOW_PKT_TOSERVER; p3->flowflags |= FLOW_PKT_ESTABLISHED; p3->flags |= PKT_HAS_FLOW|PKT_STREAM_EST; - p3->pcap_cnt = 3; + PcapPacketCntSet(p3, 3); f.alproto = ALPROTO_HTTP1; StreamTcpInitConfig(true); diff --git a/src/tests/detect-tls-cert-fingerprint.c b/src/tests/detect-tls-cert-fingerprint.c index 049fb155a2..db6bf7966e 100644 --- a/src/tests/detect-tls-cert-fingerprint.c +++ b/src/tests/detect-tls-cert-fingerprint.c @@ -290,19 +290,19 @@ static int DetectTlsFingerprintTest02(void) p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; - p1->pcap_cnt = 1; + PcapPacketCntSet(p1, 1); p2->flow = &f; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; - p2->pcap_cnt = 2; + PcapPacketCntSet(p2, 2); p3->flow = &f; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_ESTABLISHED; - p3->pcap_cnt = 3; + PcapPacketCntSet(p3, 3); StreamTcpInitConfig(true); diff --git a/src/tests/detect-tls-cert-issuer.c b/src/tests/detect-tls-cert-issuer.c index c103d50ac8..2470f50e8d 100644 --- a/src/tests/detect-tls-cert-issuer.c +++ b/src/tests/detect-tls-cert-issuer.c @@ -290,19 +290,19 @@ static int DetectTlsIssuerTest02(void) p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; - p1->pcap_cnt = 1; + PcapPacketCntSet(p1, 1); p2->flow = &f; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; - p2->pcap_cnt = 2; + PcapPacketCntSet(p2, 2); p3->flow = &f; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_ESTABLISHED; - p3->pcap_cnt = 3; + PcapPacketCntSet(p3, 3); StreamTcpInitConfig(true); diff --git a/src/tests/detect-tls-cert-serial.c b/src/tests/detect-tls-cert-serial.c index 52f9f9f51b..960835d4a7 100644 --- a/src/tests/detect-tls-cert-serial.c +++ b/src/tests/detect-tls-cert-serial.c @@ -287,19 +287,19 @@ static int DetectTlsSerialTest02(void) p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; - p1->pcap_cnt = 1; + PcapPacketCntSet(p1, 1); p2->flow = &f; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; - p2->pcap_cnt = 2; + PcapPacketCntSet(p2, 2); p3->flow = &f; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_ESTABLISHED; - p3->pcap_cnt = 3; + PcapPacketCntSet(p3, 3); StreamTcpInitConfig(true); diff --git a/src/tests/detect-tls-cert-subject.c b/src/tests/detect-tls-cert-subject.c index 9f2b6c6fab..c3988b0992 100644 --- a/src/tests/detect-tls-cert-subject.c +++ b/src/tests/detect-tls-cert-subject.c @@ -290,19 +290,19 @@ static int DetectTlsSubjectTest02(void) p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; - p1->pcap_cnt = 1; + PcapPacketCntSet(p1, 1); p2->flow = &f; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; - p2->pcap_cnt = 2; + PcapPacketCntSet(p2, 2); p3->flow = &f; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_ESTABLISHED; - p3->pcap_cnt = 3; + PcapPacketCntSet(p3, 3); StreamTcpInitConfig(true); diff --git a/src/tests/detect-tls-cert-validity.c b/src/tests/detect-tls-cert-validity.c index 13d51c366b..80271e8e48 100644 --- a/src/tests/detect-tls-cert-validity.c +++ b/src/tests/detect-tls-cert-validity.c @@ -654,19 +654,19 @@ static int ValidityTestDetect01(void) p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; - p1->pcap_cnt = 1; + PcapPacketCntSet(p1, 1); p2->flow = &f; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; - p2->pcap_cnt = 2; + PcapPacketCntSet(p2, 2); p3->flow = &f; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_ESTABLISHED; - p3->pcap_cnt = 3; + PcapPacketCntSet(p3, 3); StreamTcpInitConfig(true); @@ -977,19 +977,19 @@ static int ExpiredTestDetect01(void) p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; - p1->pcap_cnt = 1; + PcapPacketCntSet(p1, 1); p2->flow = &f; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; - p2->pcap_cnt = 2; + PcapPacketCntSet(p2, 2); p3->flow = &f; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_ESTABLISHED; - p3->pcap_cnt = 3; + PcapPacketCntSet(p3, 3); f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */ @@ -1280,19 +1280,19 @@ static int ValidTestDetect01(void) p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; - p1->pcap_cnt = 1; + PcapPacketCntSet(p1, 1); p2->flow = &f; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; - p2->pcap_cnt = 2; + PcapPacketCntSet(p2, 2); p3->flow = &f; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_ESTABLISHED; - p3->pcap_cnt = 3; + PcapPacketCntSet(p3, 3); f.lastts = SCTIME_FROM_SECS(1474978656L); /* 2016-09-27 */ diff --git a/src/tests/detect-tls-certs.c b/src/tests/detect-tls-certs.c index edbad90f2a..c59b7d4c3f 100644 --- a/src/tests/detect-tls-certs.c +++ b/src/tests/detect-tls-certs.c @@ -286,19 +286,19 @@ static int DetectTlsCertsTest02(void) p1->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p1->flowflags |= FLOW_PKT_TOSERVER; p1->flowflags |= FLOW_PKT_ESTABLISHED; - p1->pcap_cnt = 1; + PcapPacketCntSet(p1, 1); p2->flow = &f; p2->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p2->flowflags |= FLOW_PKT_TOCLIENT; p2->flowflags |= FLOW_PKT_ESTABLISHED; - p2->pcap_cnt = 2; + PcapPacketCntSet(p2, 2); p3->flow = &f; p3->flags |= PKT_HAS_FLOW | PKT_STREAM_EST; p3->flowflags |= FLOW_PKT_TOCLIENT; p3->flowflags |= FLOW_PKT_ESTABLISHED; - p3->pcap_cnt = 3; + PcapPacketCntSet(p3, 3); StreamTcpInitConfig(true); diff --git a/src/tests/fuzz/fuzz_predefpcap_aware.c b/src/tests/fuzz/fuzz_predefpcap_aware.c index 4ac80098e3..43903b08b5 100644 --- a/src/tests/fuzz/fuzz_predefpcap_aware.c +++ b/src/tests/fuzz/fuzz_predefpcap_aware.c @@ -156,7 +156,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) p->ts = SCTIME_FROM_TIMEVAL(&header.ts); p->datalink = pkts.datalink; pcap_cnt++; - p->pcap_cnt = pcap_cnt; + PcapPacketCntSet(p, pcap_cnt); p->pkt_src = PKT_SRC_WIRE; } bail: diff --git a/src/tests/fuzz/fuzz_sigpcap.c b/src/tests/fuzz/fuzz_sigpcap.c index 2dc891bc80..a306a517e1 100644 --- a/src/tests/fuzz/fuzz_sigpcap.c +++ b/src/tests/fuzz/fuzz_sigpcap.c @@ -200,7 +200,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) p->datalink = pcap_datalink(pkts); p->pkt_src = PKT_SRC_WIRE; pcap_cnt++; - p->pcap_cnt = pcap_cnt; + PcapPacketCntSet(p, pcap_cnt); } bail: //close structure diff --git a/src/tests/fuzz/fuzz_sigpcap_aware.c b/src/tests/fuzz/fuzz_sigpcap_aware.c index c03507866e..0def38b759 100644 --- a/src/tests/fuzz/fuzz_sigpcap_aware.c +++ b/src/tests/fuzz/fuzz_sigpcap_aware.c @@ -196,7 +196,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) p->ts = SCTIME_FROM_TIMEVAL(&header.ts); p->datalink = pkts.datalink; pcap_cnt++; - p->pcap_cnt = pcap_cnt; + PcapPacketCntSet(p, pcap_cnt); } bail: PacketFree(p); diff --git a/src/util-exception-policy.c b/src/util-exception-policy.c index 1861bf9069..9befaf6c6b 100644 --- a/src/util-exception-policy.c +++ b/src/util-exception-policy.c @@ -137,7 +137,7 @@ enum ExceptionPolicy ExceptionPolicyTargetPolicy(uint8_t target_flag) void ExceptionPolicyApply(Packet *p, enum ExceptionPolicy policy, enum PacketDropReason drop_reason) { - SCLogDebug("start: pcap_cnt %" PRIu64 ", policy %u", p->pcap_cnt, policy); + SCLogDebug("start: pcap_cnt %" PRIu64 ", policy %u", PcapPacketCntGet(p), policy); if (p->flow) { p->flow->applied_exception_policy |= ExceptionPolicyFlag(drop_reason); } diff --git a/src/util-lua-packetlib.c b/src/util-lua-packetlib.c index 1d9621021a..6aaca0fc35 100644 --- a/src/util-lua-packetlib.c +++ b/src/util-lua-packetlib.c @@ -80,7 +80,7 @@ static int LuaPacketPcapCnt(lua_State *luastate) LUA_ERROR("failed to get packet"); } - lua_pushinteger(luastate, s->p->pcap_cnt); + lua_pushinteger(luastate, PcapPacketCntGet(s->p)); return 1; } diff --git a/src/util-profiling.c b/src/util-profiling.c index fb1f525cc8..6af51fcc23 100644 --- a/src/util-profiling.c +++ b/src/util-profiling.c @@ -790,8 +790,7 @@ void SCProfilingPrintPacketProfile(Packet *p) /* total cost from acquisition to return to packetpool */ uint64_t delta = p->profile->ticks_end - p->profile->ticks_start; - fprintf(packet_profile_csv_fp, "%"PRIu64",%"PRIu64",", - p->pcap_cnt, delta); + fprintf(packet_profile_csv_fp, "%" PRIu64 ",%" PRIu64 ",", PcapPacketCntGet(p), delta); for (int i = 0; i < TMM_SIZE; i++) { const PktProfilingTmmData *pdt = &p->profile->tmm[i];