Set packet invalid flag during decoding.

This patch set a new value in pkt->flag to signal that a packet is
invalid during decoding. The patch has been obtained via a coccinelle
transformation.

diff --git a/src/decode-ethernet.c b/src/decode-ethernet.c
index 37e6d405f5eddcd2f038f3a68f01cb5585d3d1b4..88c309a2dab5f5b5031e8887b26f22101b44ef5f 100644 (file)
--- a/src/decode-ethernet.c
+++ b/src/decode-ethernet.c
@@ -43,7 +43,7 @@ int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pk
     SCPerfCounterIncr(dtv->counter_eth, tv->sc_perf_pca);
 
     if (unlikely(len < ETHERNET_HEADER_LEN)) {
-        ENGINE_SET_EVENT(p,ETHERNET_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, ETHERNET_PKT_TOO_SMALL);
         return TM_ECODE_FAILED;
     }
 

diff --git a/src/decode-gre.c b/src/decode-gre.c
index 27df7f4a97a8f75d8130dbaa21383790f50eae01..8888e790048c3e8124d53daa210ca22cbfa204e1 100644 (file)
--- a/src/decode-gre.c
+++ b/src/decode-gre.c
@@ -51,7 +51,7 @@ int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
     SCPerfCounterIncr(dtv->counter_gre, tv->sc_perf_pca);
 
     if(len < GRE_HDR_LEN)    {
-        ENGINE_SET_EVENT(p,GRE_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, GRE_PKT_TOO_SMALL);
         return TM_ECODE_FAILED;
     }
 
@@ -76,12 +76,12 @@ int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
              */
 
             if (GRE_FLAG_ISSET_RECUR(p->greh)) {
-                ENGINE_SET_EVENT(p,GRE_VERSION0_RECUR);
+                ENGINE_SET_INVALID_EVENT(p, GRE_VERSION0_RECUR);
                 return TM_ECODE_OK;
             }
 
             if (GREV1_FLAG_ISSET_FLAGS(p->greh))   {
-                ENGINE_SET_EVENT(p,GRE_VERSION0_FLAGS);
+                ENGINE_SET_INVALID_EVENT(p, GRE_VERSION0_FLAGS);
                 return TM_ECODE_OK;
             }
 
@@ -97,7 +97,7 @@ int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
                 header_len += GRE_CHKSUM_LEN + GRE_OFFSET_LEN;
 
             if (header_len > len)   {
-                ENGINE_SET_EVENT(p,GRE_VERSION0_HDR_TOO_BIG);
+                ENGINE_SET_INVALID_EVENT(p, GRE_VERSION0_HDR_TOO_BIG);
                 return TM_ECODE_OK;
             }
 
@@ -106,7 +106,8 @@ int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
                 while (1)
                 {
                     if ((header_len + GRE_SRE_HDR_LEN) > len) {
-                        ENGINE_SET_EVENT(p, GRE_VERSION0_MALFORMED_SRE_HDR);
+                        ENGINE_SET_INVALID_EVENT(p,
+                                                 GRE_VERSION0_MALFORMED_SRE_HDR);
                         return TM_ECODE_OK;
                     }
 
@@ -119,7 +120,8 @@ int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
 
                     header_len += gsre->sre_length;
                     if (header_len > len) {
-                        ENGINE_SET_EVENT(p, GRE_VERSION0_MALFORMED_SRE_HDR);
+                        ENGINE_SET_INVALID_EVENT(p,
+                                                 GRE_VERSION0_MALFORMED_SRE_HDR);
                         return TM_ECODE_OK;
                     }
                 }
@@ -138,37 +140,37 @@ int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
              */
 
             if (GRE_FLAG_ISSET_CHKSUM(p->greh))    {
-                ENGINE_SET_EVENT(p,GRE_VERSION1_CHKSUM);
+                ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_CHKSUM);
                 return TM_ECODE_OK;
             }
 
             if (GRE_FLAG_ISSET_ROUTE(p->greh)) {
-                ENGINE_SET_EVENT(p,GRE_VERSION1_ROUTE);
+                ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_ROUTE);
                 return TM_ECODE_OK;
             }
 
             if (GRE_FLAG_ISSET_SSR(p->greh))   {
-                ENGINE_SET_EVENT(p,GRE_VERSION1_SSR);
+                ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_SSR);
                 return TM_ECODE_OK;
             }
 
             if (GRE_FLAG_ISSET_RECUR(p->greh)) {
-                ENGINE_SET_EVENT(p,GRE_VERSION1_RECUR);
+                ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_RECUR);
                 return TM_ECODE_OK;
             }
 
             if (GREV1_FLAG_ISSET_FLAGS(p->greh))   {
-                ENGINE_SET_EVENT(p,GRE_VERSION1_FLAGS);
+                ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_FLAGS);
                 return TM_ECODE_OK;
             }
 
             if (GRE_GET_PROTO(p->greh) != GRE_PROTO_PPP)  {
-                ENGINE_SET_EVENT(p,GRE_VERSION1_WRONG_PROTOCOL);
+                ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_WRONG_PROTOCOL);
                 return TM_ECODE_OK;
             }
 
             if (!(GRE_FLAG_ISSET_KY(p->greh))) {
-                ENGINE_SET_EVENT(p,GRE_VERSION1_NO_KEY);
+                ENGINE_SET_INVALID_EVENT(p,GRE_VERSION1_NO_KEY);
                 return TM_ECODE_OK;
             }
 
@@ -183,13 +185,13 @@ int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
                 header_len += GREV1_ACK_LEN;
 
             if (header_len > len)   {
-                ENGINE_SET_EVENT(p,GRE_VERSION1_HDR_TOO_BIG);
+                ENGINE_SET_INVALID_EVENT(p, GRE_VERSION1_HDR_TOO_BIG);
                 return TM_ECODE_OK;
             }
 
             break;
         default:
-            ENGINE_SET_EVENT(p,GRE_WRONG_VERSION);
+            ENGINE_SET_INVALID_EVENT(p, GRE_WRONG_VERSION);
             return TM_ECODE_OK;
     }
 

diff --git a/src/decode-icmpv4.c b/src/decode-icmpv4.c
index 930296947a0176d5e66194d5640573e2c55a1f61..e810d50b1a7a3542a6c033144eaeff39f27691b4 100644 (file)
--- a/src/decode-icmpv4.c
+++ b/src/decode-icmpv4.c
@@ -52,7 +52,7 @@ void DecodePartialIPV4( Packet* p, uint8_t* partial_packet, uint16_t len )
     /** Check the sizes, the header must fit at least */
     if (len < IPV4_HEADER_LEN) {
         SCLogDebug("DecodePartialIPV4: ICMPV4_IPV4_TRUNC_PKT");
-        ENGINE_SET_EVENT(p, ICMPV4_IPV4_TRUNC_PKT);
+        ENGINE_SET_INVALID_EVENT(p, ICMPV4_IPV4_TRUNC_PKT);
         return;
     }
 
@@ -63,7 +63,7 @@ void DecodePartialIPV4( Packet* p, uint8_t* partial_packet, uint16_t len )
         /** Check the embedded version */
         SCLogDebug("DecodePartialIPV4: ICMPv4 contains Unknown IPV4 version "
                    "ICMPV4_IPV4_UNKNOWN_VER");
-        ENGINE_SET_EVENT(p, ICMPV4_IPV4_UNKNOWN_VER);
+        ENGINE_SET_INVALID_EVENT(p, ICMPV4_IPV4_UNKNOWN_VER);
         return;
     }
 
@@ -156,7 +156,7 @@ int DecodeICMPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt,
     SCPerfCounterIncr(dtv->counter_icmpv4, tv->sc_perf_pca);
 
     if (len < ICMPV4_HEADER_LEN) {
-        ENGINE_SET_EVENT(p,ICMPV4_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, ICMPV4_PKT_TOO_SMALL);
         return TM_ECODE_FAILED;
     }
 

diff --git a/src/decode-icmpv6.c b/src/decode-icmpv6.c
index 12ecfa2b558f14445b77214a7f7e3835c6a8ddb2..de8b1eb96592cab351a2725ab13d8758cb6c4684 100644 (file)
--- a/src/decode-icmpv6.c
+++ b/src/decode-icmpv6.c
@@ -61,7 +61,7 @@ void DecodePartialIPV6(Packet *p, uint8_t *partial_packet, uint16_t len )
     /** Check the sizes, the header must fit at least */
     if (len < IPV6_HEADER_LEN) {
         SCLogDebug("ICMPV6_IPV6_TRUNC_PKT");
-        ENGINE_SET_EVENT(p, ICMPV6_IPV6_TRUNC_PKT);
+        ENGINE_SET_INVALID_EVENT(p, ICMPV6_IPV6_TRUNC_PKT);
         return;
     }
 
@@ -72,7 +72,7 @@ void DecodePartialIPV6(Packet *p, uint8_t *partial_packet, uint16_t len )
     {
         SCLogDebug("ICMPv6 contains Unknown IPV6 version "
                 "ICMPV6_IPV6_UNKNOWN_VER");
-        ENGINE_SET_EVENT(p, ICMPV6_IPV6_UNKNOWN_VER);
+        ENGINE_SET_INVALID_EVENT(p, ICMPV6_IPV6_UNKNOWN_VER);
         return;
     }
 
@@ -172,7 +172,7 @@ int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
 
     if (len < ICMPV6_HEADER_LEN) {
         SCLogDebug("ICMPV6_PKT_TOO_SMALL");
-        ENGINE_SET_EVENT(p, ICMPV6_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, ICMPV6_PKT_TOO_SMALL);
         return TM_ECODE_FAILED;
     }
 

diff --git a/src/decode-ipv4.c b/src/decode-ipv4.c
index e1442fa9d7e3f94ab626f5eaa62adc8ebb4d7caa..4b18fada8e024186081f951e64b9fc6234952c78 100644 (file)
--- a/src/decode-ipv4.c
+++ b/src/decode-ipv4.c
@@ -59,33 +59,33 @@ static int IPV4OptValidateGeneric(Packet *p, const IPV4Opt *o) {
         /* See: RFC 4782 */
         case IPV4_OPT_QS:
             if (p->IPV4_OPTS[p->IPV4_OPTS_CNT].len < IPV4_OPT_QS_MIN) {
-                ENGINE_SET_EVENT(p,IPV4_OPT_INVALID_LEN);
+                ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN);
                 return -1;
             }
             break;
         /* See: RFC 1108 */
         case IPV4_OPT_SEC:
             if (p->IPV4_OPTS[p->IPV4_OPTS_CNT].len != IPV4_OPT_SEC_LEN) {
-                ENGINE_SET_EVENT(p,IPV4_OPT_INVALID_LEN);
+                ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN);
                 return -1;
             }
             break;
         case IPV4_OPT_SID:
             if (p->IPV4_OPTS[p->IPV4_OPTS_CNT].len != IPV4_OPT_SID_LEN) {
-                ENGINE_SET_EVENT(p,IPV4_OPT_INVALID_LEN);
+                ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN);
                 return -1;
             }
             break;
         /* See: RFC 2113 */
         case IPV4_OPT_RTRALT:
             if (p->IPV4_OPTS[p->IPV4_OPTS_CNT].len != IPV4_OPT_RTRALT_LEN) {
-                ENGINE_SET_EVENT(p,IPV4_OPT_INVALID_LEN);
+                ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN);
                 return -1;
             }
             break;
         default:
             /* Should never get here unless there is a coding error */
-            ENGINE_SET_EVENT(p,IPV4_OPT_UNKNOWN);
+            ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_UNKNOWN);
             return -1;
     }
 
@@ -103,13 +103,13 @@ static int IPV4OptValidateRoute(Packet *p, const IPV4Opt *o) {
 
     /* Check length */
     if (unlikely(o->len < IPV4_OPT_ROUTE_MIN)) {
-        ENGINE_SET_EVENT(p,IPV4_OPT_INVALID_LEN);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN);
         return -1;
     }
 
     /* Data is required */
     if (unlikely(o->data == NULL)) {
-        ENGINE_SET_EVENT(p,IPV4_OPT_MALFORMED);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED);
         return -1;
     }
     ptr = *o->data;
@@ -119,7 +119,7 @@ static int IPV4OptValidateRoute(Packet *p, const IPV4Opt *o) {
      * past option length.
      */
     if (unlikely((ptr < 4) || (ptr % 4) || (ptr > o->len + 1))) {
-        ENGINE_SET_EVENT(p,IPV4_OPT_MALFORMED);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED);
         return -1;
     }
 
@@ -140,20 +140,20 @@ static int IPV4OptValidateTimestamp(Packet *p, const IPV4Opt *o) {
 
     /* Check length */
     if (unlikely(o->len < IPV4_OPT_TS_MIN)) {
-        ENGINE_SET_EVENT(p,IPV4_OPT_INVALID_LEN);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN);
         return -1;
     }
 
     /* Data is required */
     if (unlikely(o->data == NULL)) {
-        ENGINE_SET_EVENT(p,IPV4_OPT_MALFORMED);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED);
         return -1;
     }
     ptr = *o->data;
 
     /* We need the flag to determine what is in the option payload */
     if (unlikely(ptr < 5)) {
-        ENGINE_SET_EVENT(p,IPV4_OPT_MALFORMED);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED);
         return -1;
     }
     flag = *(o->data + 3) & 0x00ff;
@@ -166,7 +166,7 @@ static int IPV4OptValidateTimestamp(Packet *p, const IPV4Opt *o) {
      * and cannot extend past option length.
      */
     if (unlikely(((ptr - 5) % rec_size) || (ptr > o->len + 1))) {
-        ENGINE_SET_EVENT(p,IPV4_OPT_MALFORMED);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED);
         return -1;
     }
 
@@ -187,13 +187,13 @@ static int IPV4OptValidateCIPSO(Packet *p, const IPV4Opt *o) {
 
     /* Check length */
     if (unlikely(o->len < IPV4_OPT_CIPSO_MIN)) {
-        ENGINE_SET_EVENT(p,IPV4_OPT_INVALID_LEN);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN);
         return -1;
     }
 
     /* Data is required */
     if (unlikely(o->data == NULL)) {
-        ENGINE_SET_EVENT(p,IPV4_OPT_MALFORMED);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED);
         return -1;
     }
 //    doi = *o->data;
@@ -222,7 +222,7 @@ static int IPV4OptValidateCIPSO(Packet *p, const IPV4Opt *o) {
         /* Tag header must fit within option length */
         if (unlikely(len < 2)) {
             //printf("CIPSO tag header too large %" PRIu16 " < 2\n", len);
-            ENGINE_SET_EVENT(p,IPV4_OPT_MALFORMED);
+            ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED);
             return -1;
         }
 
@@ -233,7 +233,7 @@ static int IPV4OptValidateCIPSO(Packet *p, const IPV4Opt *o) {
         /* Tag length must fit within the option length */
         if (unlikely(tlen > len)) {
             //printf("CIPSO tag len too large %" PRIu8 " > %" PRIu16 "\n", tlen, len);
-            ENGINE_SET_EVENT(p,IPV4_OPT_MALFORMED);
+            ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED);
             return -1;
         }
 
@@ -246,7 +246,7 @@ static int IPV4OptValidateCIPSO(Packet *p, const IPV4Opt *o) {
                 /* Tag is at least 4 and at most the remainder of option len */
                 if (unlikely((tlen < 4) || (tlen > len))) {
                     //printf("CIPSO tag %" PRIu8 " bad tlen=%" PRIu8 " len=%" PRIu8 "\n", ttype, tlen, len);
-                    ENGINE_SET_EVENT(p,IPV4_OPT_MALFORMED);
+                    ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED);
                     return -1;
                 }
 
@@ -255,7 +255,7 @@ static int IPV4OptValidateCIPSO(Packet *p, const IPV4Opt *o) {
                  */
                 if (unlikely((ttype != 7) && (*tag != 0))) {
                     //printf("CIPSO tag %" PRIu8 " ao=%" PRIu8 "\n", ttype, tlen);
-                    ENGINE_SET_EVENT(p,IPV4_OPT_MALFORMED);
+                    ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED);
                     return -1;
                 }
 
@@ -267,11 +267,11 @@ static int IPV4OptValidateCIPSO(Packet *p, const IPV4Opt *o) {
             case 0:
                 /* Tag type 0 is reserved and thus invalid */
                 /** \todo Wireshark marks this a padding, but spec says reserved. */
-                ENGINE_SET_EVENT(p,IPV4_OPT_MALFORMED);
+                ENGINE_SET_INVALID_EVENT(p,IPV4_OPT_MALFORMED);
                 return -1;
             default:
                 //printf("CIPSO tag %" PRIu8 " unknown tag\n", ttype);
-                ENGINE_SET_EVENT(p,IPV4_OPT_MALFORMED);
+                ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_MALFORMED);
                 /** \todo May not want to return error here on unknown tag type (at least not for 3|4) */
                 return -1;
         }
@@ -333,7 +333,7 @@ static int DecodeIPV4Options(Packet *p, uint8_t *pkt, uint16_t len)
 
             /* Option length is too big for packet */
             if (unlikely(*(pkt+1) > plen)) {
-                ENGINE_SET_EVENT(p,IPV4_OPT_INVALID_LEN);
+                ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN);
                 return -1;
             }
 
@@ -353,7 +353,7 @@ static int DecodeIPV4Options(Packet *p, uint8_t *pkt, uint16_t len)
              * Also check for invalid lengths 0 and 1. */
             if (unlikely(p->IPV4_OPTS[p->IPV4_OPTS_CNT].len > plen ||
                          p->IPV4_OPTS[p->IPV4_OPTS_CNT].len < 2)) {
-                ENGINE_SET_EVENT(p,IPV4_OPT_INVALID_LEN);
+                ENGINE_SET_INVALID_EVENT(p, IPV4_OPT_INVALID_LEN);
                 return -1;
             }
 
@@ -473,30 +473,30 @@ static int DecodeIPV4Options(Packet *p, uint8_t *pkt, uint16_t len)
 static int DecodeIPV4Packet(Packet *p, uint8_t *pkt, uint16_t len)
 {
     if (unlikely(len < IPV4_HEADER_LEN)) {
-        ENGINE_SET_EVENT(p,IPV4_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_PKT_TOO_SMALL);
         return -1;
     }
 
     if (unlikely(IP_GET_RAW_VER(pkt) != 4)) {
         SCLogDebug("wrong ip version %" PRIu8 "",IP_GET_RAW_VER(pkt));
-        ENGINE_SET_EVENT(p,IPV4_WRONG_IP_VER);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_WRONG_IP_VER);
         return -1;
     }
 
     p->ip4h = (IPV4Hdr *)pkt;
 
     if (unlikely(IPV4_GET_HLEN(p) < IPV4_HEADER_LEN)) {
-        ENGINE_SET_EVENT(p,IPV4_HLEN_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_HLEN_TOO_SMALL);
         return -1;
     }
 
     if (unlikely(IPV4_GET_IPLEN(p) < IPV4_GET_HLEN(p))) {
-        ENGINE_SET_EVENT(p,IPV4_IPLEN_SMALLER_THAN_HLEN);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_IPLEN_SMALLER_THAN_HLEN);
         return -1;
     }
 
     if (unlikely(len < IPV4_GET_IPLEN(p))) {
-        ENGINE_SET_EVENT(p,IPV4_TRUNC_PKT);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_TRUNC_PKT);
         return -1;
     }
 

diff --git a/src/decode-ipv6.c b/src/decode-ipv6.c
index 95fe2cd781e824687de743c707c5568b52204882..7e08c0eb27a9e08fadea175f5aff254da7e27665 100644 (file)
--- a/src/decode-ipv6.c
+++ b/src/decode-ipv6.c
@@ -55,7 +55,7 @@ static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, u
 {
 
     if (unlikely(plen < IPV4_HEADER_LEN)) {
-        ENGINE_SET_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
         return;
     }
     if (IP_GET_RAW_VER(pkt) == 4) {
@@ -83,7 +83,7 @@ static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint
 {
 
     if (unlikely(plen < IPV6_HEADER_LEN)) {
-        ENGINE_SET_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
         return TM_ECODE_FAILED;
     }
     if (IP_GET_RAW_VER(pkt) == 6) {
@@ -506,7 +506,7 @@ static int DecodeIPV6Packet (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, u
 
     if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
         SCLogDebug("wrong ip version %" PRIu8 "",IP_GET_RAW_VER(pkt));
-        ENGINE_SET_EVENT(p,IPV6_WRONG_IP_VER);
+        ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
         return -1;
     }
 
@@ -514,7 +514,7 @@ static int DecodeIPV6Packet (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, u
 
     if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_PLEN(p))))
     {
-        ENGINE_SET_EVENT(p,IPV6_TRUNC_PKT);
+        ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
         return -1;
     }
 

diff --git a/src/decode-ppp.c b/src/decode-ppp.c
index 0abe2e7a3d89a992a0b04774f18bb182b583f44a..4a4aad985e537a093e6410f7791e70cec6253473 100644 (file)
--- a/src/decode-ppp.c
+++ b/src/decode-ppp.c
@@ -45,7 +45,7 @@ int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
     SCPerfCounterIncr(dtv->counter_ppp, tv->sc_perf_pca);
 
     if (unlikely(len < PPP_HEADER_LEN)) {
-        ENGINE_SET_EVENT(p,PPP_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, PPP_PKT_TOO_SMALL);
         return TM_ECODE_FAILED;
     }
 
@@ -60,7 +60,7 @@ int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
     {
         case PPP_VJ_UCOMP:
             if (unlikely(len < (PPP_HEADER_LEN + IPV4_HEADER_LEN))) {
-                ENGINE_SET_EVENT(p,PPPVJU_PKT_TOO_SMALL);
+                ENGINE_SET_INVALID_EVENT(p,PPPVJU_PKT_TOO_SMALL);
                 p->ppph = NULL;
                 return TM_ECODE_FAILED;
             }
@@ -73,7 +73,7 @@ int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
 
         case PPP_IP:
             if (unlikely(len < (PPP_HEADER_LEN + IPV4_HEADER_LEN))) {
-                ENGINE_SET_EVENT(p,PPPIPV4_PKT_TOO_SMALL);
+                ENGINE_SET_INVALID_EVENT(p,PPPIPV4_PKT_TOO_SMALL);
                 p->ppph = NULL;
                 return TM_ECODE_FAILED;
             }
@@ -83,7 +83,7 @@ int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
             /* PPP IPv6 was not tested */
         case PPP_IPV6:
             if (unlikely(len < (PPP_HEADER_LEN + IPV6_HEADER_LEN))) {
-                ENGINE_SET_EVENT(p,PPPIPV6_PKT_TOO_SMALL);
+                ENGINE_SET_INVALID_EVENT(p,PPPIPV6_PKT_TOO_SMALL);
                 p->ppph = NULL;
                 return TM_ECODE_FAILED;
             }
@@ -123,7 +123,7 @@ int DecodePPP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
 
         default:
             SCLogDebug("unknown PPP protocol: %" PRIx32 "",ntohs(p->ppph->protocol));
-            ENGINE_SET_EVENT(p,PPP_WRONG_TYPE);
+            ENGINE_SET_INVALID_EVENT(p, PPP_WRONG_TYPE);
             return TM_ECODE_OK;
     }
 

diff --git a/src/decode-pppoe.c b/src/decode-pppoe.c
index 82543f72fc998e16776c3a92cf58a722f264add0..01785be4fabf967eea43cbec8d44a1d6af4cc93a 100644 (file)
--- a/src/decode-pppoe.c
+++ b/src/decode-pppoe.c
@@ -52,7 +52,7 @@ int DecodePPPOEDiscovery(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8
     SCPerfCounterIncr(dtv->counter_pppoe, tv->sc_perf_pca);
 
     if (len < PPPOE_DISCOVERY_HEADER_MIN_LEN) {
-        ENGINE_SET_EVENT(p, PPPOE_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, PPPOE_PKT_TOO_SMALL);
         return TM_ECODE_FAILED;
     }
 
@@ -75,7 +75,7 @@ int DecodePPPOEDiscovery(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8
             break;
         default:
             SCLogDebug("unknown PPPOE code: 0x%0"PRIX8"", p->pppoedh->pppoe_code);
-            ENGINE_SET_EVENT(p,PPPOE_WRONG_CODE);
+            ENGINE_SET_INVALID_EVENT(p, PPPOE_WRONG_CODE);
             return TM_ECODE_OK;
     }
 
@@ -92,7 +92,7 @@ int DecodePPPOEDiscovery(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8
 
     if (pppoe_length > packet_length) {
         SCLogDebug("malformed PPPOE tags");
-        ENGINE_SET_EVENT(p,PPPOE_MALFORMED_TAGS);
+        ENGINE_SET_INVALID_EVENT(p, PPPOE_MALFORMED_TAGS);
         return TM_ECODE_OK;
     }
 
@@ -131,7 +131,7 @@ int DecodePPPOESession(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t
     SCPerfCounterIncr(dtv->counter_pppoe, tv->sc_perf_pca);
 
     if (len < PPPOE_SESSION_HEADER_LEN) {
-        ENGINE_SET_EVENT(p, PPPOE_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, PPPOE_PKT_TOO_SMALL);
         return TM_ECODE_FAILED;
     }
 
@@ -183,7 +183,7 @@ int DecodePPPOESession(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t
             case PPP_VJ_UCOMP:
 
                 if(len < (PPPOE_SESSION_HEADER_LEN + IPV4_HEADER_LEN))    {
-                    ENGINE_SET_EVENT(p,PPPVJU_PKT_TOO_SMALL);
+                    ENGINE_SET_INVALID_EVENT(p, PPPVJU_PKT_TOO_SMALL);
                     return TM_ECODE_OK;
                 }
 
@@ -194,7 +194,7 @@ int DecodePPPOESession(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t
 
             case PPP_IP:
                 if(len < (PPPOE_SESSION_HEADER_LEN + IPV4_HEADER_LEN))    {
-                    ENGINE_SET_EVENT(p,PPPIPV4_PKT_TOO_SMALL);
+                    ENGINE_SET_INVALID_EVENT(p, PPPIPV4_PKT_TOO_SMALL);
                     return TM_ECODE_OK;
                 }
 
@@ -204,7 +204,7 @@ int DecodePPPOESession(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t
             /* PPP IPv6 was not tested */
             case PPP_IPV6:
                 if(len < (PPPOE_SESSION_HEADER_LEN + IPV6_HEADER_LEN))    {
-                    ENGINE_SET_EVENT(p,PPPIPV6_PKT_TOO_SMALL);
+                    ENGINE_SET_INVALID_EVENT(p, PPPIPV6_PKT_TOO_SMALL);
                     return TM_ECODE_OK;
                 }
 
@@ -213,7 +213,7 @@ int DecodePPPOESession(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t
 
             default:
                 SCLogDebug("unknown PPP protocol: %" PRIx32 "",ntohs(p->ppph->protocol));
-                ENGINE_SET_EVENT(p,PPP_WRONG_TYPE);
+                ENGINE_SET_INVALID_EVENT(p, PPP_WRONG_TYPE);
                 return TM_ECODE_OK;
         }
     }

diff --git a/src/decode-raw.c b/src/decode-raw.c
index e88aa76d35d2f7b7650f1aa4c7094ba0f6cb1c4e..4998ad9bcf654ac3b4dc6af96c86ef162bf3d380 100644 (file)
--- a/src/decode-raw.c
+++ b/src/decode-raw.c
@@ -49,7 +49,7 @@ int DecodeRaw(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
 
     /* If it is ipv4 or ipv6 it should at least be the size of ipv4 */
     if (unlikely(len < IPV4_HEADER_LEN)) {
-        ENGINE_SET_EVENT(p,IPV4_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, IPV4_PKT_TOO_SMALL);
         return TM_ECODE_FAILED;
     }
 

diff --git a/src/decode-sctp.c b/src/decode-sctp.c
index 81b6ef6282253fe70d0bca245eae27424cc1e49c..178ed8bd699d8c19a45be7db95f8d51353a101be 100644 (file)
--- a/src/decode-sctp.c
+++ b/src/decode-sctp.c
@@ -42,7 +42,7 @@
 static int DecodeSCTPPacket(ThreadVars *tv, Packet *p, uint8_t *pkt, uint16_t len)
 {
     if (unlikely(len < SCTP_HEADER_LEN)) {
-        ENGINE_SET_EVENT(p, SCTP_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, SCTP_PKT_TOO_SMALL);
         return -1;
     }
 

diff --git a/src/decode-sll.c b/src/decode-sll.c
index f3e9c9e750ab16d5603cea9b2cbf948eb75944d7..5bfc63cf56fdcb535f765319b5ba8a4e5dacdf67 100644 (file)
--- a/src/decode-sll.c
+++ b/src/decode-sll.c
@@ -41,7 +41,7 @@ int DecodeSll(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui
     SCPerfCounterIncr(dtv->counter_sll, tv->sc_perf_pca);
 
     if (unlikely(len < SLL_HEADER_LEN)) {
-        ENGINE_SET_EVENT(p,SLL_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, SLL_PKT_TOO_SMALL);
         return TM_ECODE_FAILED;
     }
 

diff --git a/src/decode-tcp.c b/src/decode-tcp.c
index 3fcbddd5a34a804b0c160ab36e1ec82f5f1742c3..11ba600f33fdf93c1fba93c57e0f1efdf5d8c5be 100644 (file)
--- a/src/decode-tcp.c
+++ b/src/decode-tcp.c
@@ -64,7 +64,7 @@ static int DecodeTCPOptions(Packet *p, uint8_t *pkt, uint16_t len)
              * so here the len of the specific option must be bad.
              * Also check for invalid lengths 0 and 1. */
             if (unlikely(*(pkt+1) > plen || *(pkt+1) < 2)) {
-                ENGINE_SET_EVENT(p,TCP_OPT_INVALID_LEN);
+                ENGINE_SET_INVALID_EVENT(p, TCP_OPT_INVALID_LEN);
                 return -1;
             }
 
@@ -151,7 +151,7 @@ static int DecodeTCPOptions(Packet *p, uint8_t *pkt, uint16_t len)
 static int DecodeTCPPacket(ThreadVars *tv, Packet *p, uint8_t *pkt, uint16_t len)
 {
     if (unlikely(len < TCP_HEADER_LEN)) {
-        ENGINE_SET_EVENT(p, TCP_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, TCP_PKT_TOO_SMALL);
         return -1;
     }
 
@@ -159,13 +159,13 @@ static int DecodeTCPPacket(ThreadVars *tv, Packet *p, uint8_t *pkt, uint16_t len
 
     uint8_t hlen = TCP_GET_HLEN(p);
     if (unlikely(len < hlen)) {
-        ENGINE_SET_EVENT(p, TCP_HLEN_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, TCP_HLEN_TOO_SMALL);
         return -1;
     }
 
     uint8_t tcp_opt_len = hlen - TCP_HEADER_LEN;
     if (unlikely(tcp_opt_len > TCP_OPTLENMAX)) {
-        ENGINE_SET_EVENT(p, TCP_INVALID_OPTLEN);
+        ENGINE_SET_INVALID_EVENT(p, TCP_INVALID_OPTLEN);
         return -1;
     }
 

diff --git a/src/decode-udp.c b/src/decode-udp.c
index a8e953eab073684531a53837ba530fc517cbc67d..4dca5f1baf72d5de79066aea8c483879748d32b7 100644 (file)
--- a/src/decode-udp.c
+++ b/src/decode-udp.c
@@ -43,19 +43,19 @@
 static int DecodeUDPPacket(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len)
 {
     if (unlikely(len < UDP_HEADER_LEN)) {
-        ENGINE_SET_EVENT(p, UDP_HLEN_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, UDP_HLEN_TOO_SMALL);
         return -1;
     }
 
     p->udph = (UDPHdr *)pkt;
 
     if (unlikely(len < UDP_GET_LEN(p))) {
-        ENGINE_SET_EVENT(p, UDP_PKT_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, UDP_PKT_TOO_SMALL);
         return -1;
     }
 
     if (unlikely(len != UDP_GET_LEN(p))) {
-        ENGINE_SET_EVENT(p, UDP_HLEN_INVALID);
+        ENGINE_SET_INVALID_EVENT(p, UDP_HLEN_INVALID);
         return -1;
     }
 

diff --git a/src/decode-vlan.c b/src/decode-vlan.c
index 1b347be7deab4f94744ebaae940ddf0569bde8fd..0756966612e063f5e409665a836f877a1cc7af9b 100644 (file)
--- a/src/decode-vlan.c
+++ b/src/decode-vlan.c
@@ -63,7 +63,7 @@ int DecodeVLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, u
     SCPerfCounterIncr(dtv->counter_vlan, tv->sc_perf_pca);
 
     if(len < VLAN_HEADER_LEN)    {
-        ENGINE_SET_EVENT(p,VLAN_HEADER_TOO_SMALL);
+        ENGINE_SET_INVALID_EVENT(p, VLAN_HEADER_TOO_SMALL);
         return TM_ECODE_FAILED;
     }
     if (p->vlan_idx >= 2) {
@@ -115,7 +115,7 @@ int DecodeVLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, u
             break;
         default:
             SCLogDebug("unknown VLAN type: %" PRIx32 "", proto);
-            ENGINE_SET_EVENT(p,VLAN_UNKNOWN_TYPE);
+            ENGINE_SET_INVALID_EVENT(p, VLAN_UNKNOWN_TYPE);
             return TM_ECODE_OK;
     }