Add a packet src for every packet generated inside suricata.

diff --git a/src/decode-gre.c b/src/decode-gre.c
index b7ae22915cfbc811b9d3c3bd491202943a08aad5..f390840b94b7bf9fd2665b198d1d786a77fdc039 100644 (file)
--- a/src/decode-gre.c
+++ b/src/decode-gre.c
@@ -201,6 +201,7 @@ void DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, u
                     Packet *tp = PacketPseudoPktSetup(p, pkt + header_len,
                             len - header_len, IPPROTO_IP);
                     if (tp != NULL) {
+                        PKT_SET_SRC(tp, PKT_SRC_DECODER_GRE);
                         DecodeTunnel(tv, dtv, tp, GET_PKT_DATA(tp),
                                 GET_PKT_LEN(tp), pq, IPPROTO_IP);
                         PacketEnqueue(pq,tp);
@@ -215,6 +216,7 @@ void DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, u
                     Packet *tp = PacketPseudoPktSetup(p, pkt + header_len,
                             len - header_len, PPP_OVER_GRE);
                     if (tp != NULL) {
+                        PKT_SET_SRC(tp, PKT_SRC_DECODER_GRE);
                         DecodeTunnel(tv, dtv, tp, GET_PKT_DATA(tp),
                                 GET_PKT_LEN(tp), pq, PPP_OVER_GRE);
                         PacketEnqueue(pq,tp);
@@ -229,6 +231,7 @@ void DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, u
                     Packet *tp = PacketPseudoPktSetup(p, pkt + header_len,
                             len - header_len, IPPROTO_IPV6);
                     if (tp != NULL) {
+                        PKT_SET_SRC(tp, PKT_SRC_DECODER_GRE);
                         DecodeTunnel(tv, dtv, tp, GET_PKT_DATA(tp),
                                 GET_PKT_LEN(tp), pq, IPPROTO_IPV6);
                         PacketEnqueue(pq,tp);
@@ -243,6 +246,7 @@ void DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, u
                     Packet *tp = PacketPseudoPktSetup(p, pkt + header_len,
                             len - header_len, VLAN_OVER_GRE);
                     if (tp != NULL) {
+                        PKT_SET_SRC(tp, PKT_SRC_DECODER_GRE);
                         DecodeTunnel(tv, dtv, tp, GET_PKT_DATA(tp),
                                 GET_PKT_LEN(tp), pq, VLAN_OVER_GRE);
                         PacketEnqueue(pq,tp);

diff --git a/src/decode-ipv4.c b/src/decode-ipv4.c
index 7dbaaf0192628bca225e1653194e8e9e830285e0..7c60bb974afbf05c63180cc20502e88fe10bb474 100644 (file)
--- a/src/decode-ipv4.c
+++ b/src/decode-ipv4.c
@@ -580,6 +580,7 @@ void DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt,
                             IPV4_GET_IPLEN(p) - IPV4_GET_HLEN(p),
                             IPV4_GET_IPPROTO(p));
                     if (tp != NULL) {
+                        PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV4);
                         /* send that to the Tunnel decoder */
                         DecodeTunnel(tv, dtv, tp, GET_PKT_DATA(tp),
                                 GET_PKT_LEN(tp), pq, IPV4_GET_IPPROTO(p));

diff --git a/src/decode-ipv6.c b/src/decode-ipv6.c
index 67e4ac6f097017d84f068db23933baef3b88fe48..23b6fb6c400d0b4a7e70fa2af99f82828f28ebf6 100644 (file)
--- a/src/decode-ipv6.c
+++ b/src/decode-ipv6.c
@@ -60,6 +60,7 @@ static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, u
         if (pq != NULL) {
             Packet *tp = PacketPseudoPktSetup(p, pkt, plen, IPPROTO_IP);
             if (tp != NULL) {
+                PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
                 DecodeTunnel(tv, dtv, tp, GET_PKT_DATA(tp),
                              GET_PKT_LEN(tp), pq, IPPROTO_IP);
                 PacketEnqueue(pq,tp);
@@ -88,6 +89,7 @@ static void DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uin
         if (pq != NULL) {
             Packet *tp = PacketPseudoPktSetup(p, pkt, plen, IPPROTO_IPV6);
             if (tp != NULL) {
+                PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
                 DecodeTunnel(tv, dtv, tp, GET_PKT_DATA(tp),
                              GET_PKT_LEN(tp), pq, IPPROTO_IP);
                 PacketEnqueue(pq,tp);

diff --git a/src/decode-teredo.c b/src/decode-teredo.c
index 844b365b76d1e586113e61c4e84f6f7f7b78a12b..87265349f64493568813534d424342c53a7fa42c 100644 (file)
--- a/src/decode-teredo.c
+++ b/src/decode-teredo.c
@@ -88,6 +88,7 @@ int DecodeTeredo(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt,
                 Packet *tp = PacketPseudoPktSetup(p, start, blen,
                                                   IPPROTO_IPV6);
                 if (tp != NULL) {
+                    PKT_SET_SRC(tp, PKT_SRC_DECODER_TEREDO);
                     /* send that to the Tunnel decoder */
                     DecodeTunnel(tv, dtv, tp, GET_PKT_DATA(tp), GET_PKT_LEN(tp),
                                  pq, IPPROTO_IPV6);

diff --git a/src/decode.h b/src/decode.h
index b2a9b8fd6569856aaafd2d74f88aa53d8a291237..a514e7fa4e04d69ce49011e91c64f2534376a17f 100644 (file)
--- a/src/decode.h
+++ b/src/decode.h
@@ -39,6 +39,18 @@ typedef enum {
     CHECKSUM_VALIDATION_KERNEL,
 } ChecksumValidationMode;
 
+enum {
+    PKT_SRC_WIRE = 1,
+    PKT_SRC_DECODER_GRE,
+    PKT_SRC_DECODER_IPV4,
+    PKT_SRC_DECODER_IPV6,
+    PKT_SRC_DECODER_TEREDO,
+    PKT_SRC_DEFRAG,
+    PKT_SRC_STREAM_TCP_STREAM_END_PSEUDO,
+    PKT_SRC_FFR_V2,
+    PKT_SRC_FFR_SHUTDOWN,
+};
+
 #include "source-nfq.h"
 #include "source-ipfw.h"
 #include "source-pcap.h"
@@ -489,6 +501,8 @@ typedef struct Packet_
     uint16_t mpm_offsets[CUDA_MAX_PAYLOAD_SIZE + 1];
 #endif
 
+    uint8_t pkt_src;
+
 #ifdef PROFILING
     PktProfiling profile;
 #endif
@@ -676,6 +690,7 @@ typedef struct DecodeThreadVars_
         (p)->root = NULL;                       \
         (p)->livedev = NULL;                    \
         (p)->ReleaseData = NULL;                \
+        (p)->pkt_src = 0;                       \
         PACKET_RESET_CHECKSUMS((p));            \
         PACKET_PROFILING_RESET((p));            \
     } while (0)
@@ -922,5 +937,7 @@ void AddressDebugPrint(Address *);
 /** \brief return 1 if the packet is a pseudo packet */
 #define PKT_IS_PSEUDOPKT(p) ((p)->flags & PKT_PSEUDO_STREAM_END)
 
+#define PKT_SET_SRC(p, src_val) ((p)->pkt_src = src_val)
+
 #endif /* __DECODE_H__ */
 

diff --git a/src/defrag.c b/src/defrag.c
index cb8fba25a0fc4bcdfa8911a5a25b7aa568b792db..74757be063755a4d1993c275e9ff7ccfe004223b 100644 (file)
--- a/src/defrag.c
+++ b/src/defrag.c
@@ -289,6 +289,7 @@ Defrag4Reassemble(ThreadVars *tv, DefragTracker *tracker, Packet *p)
                    "fragmentation re-assembly, dumping fragments.");
         goto remove_tracker;
     }
+    PKT_SET_SRC(rp, PKT_SRC_DEFRAG);
     rp->recursion_level = p->recursion_level;
 
     int fragmentable_offset = 0;
@@ -402,6 +403,7 @@ Defrag6Reassemble(ThreadVars *tv, DefragTracker *tracker, Packet *p)
                 "fragmentation re-assembly, dumping fragments.");
         goto remove_tracker;
     }
+    PKT_SET_SRC(rp, PKT_SRC_DEFRAG);
 
     int fragmentable_offset = 0;
     int fragmentable_len = 0;

diff --git a/src/flow-timeout.c b/src/flow-timeout.c
index c3b15cc119dae8bf86cc8f94484dc96848d176d0..ed4b59eccabae3482eb9478f61d7ce16686eadec 100644 (file)
--- a/src/flow-timeout.c
+++ b/src/flow-timeout.c
@@ -364,6 +364,7 @@ int FlowForceReassemblyForFlowV2(Flow *f, int server, int client)
         if (p1 == NULL) {
             return 1;
         }
+        PKT_SET_SRC(p1, PKT_SRC_FFR_V2);
 
         if (server == 1) {
             p2 = FlowForceReassemblyPseudoPacketGet(0, f, ssn, 0);
@@ -372,6 +373,7 @@ int FlowForceReassemblyForFlowV2(Flow *f, int server, int client)
                 TmqhOutputPacketpool(NULL, p1);
                 return 1;
             }
+            PKT_SET_SRC(p2, PKT_SRC_FFR_V2);
 
             p3 = FlowForceReassemblyPseudoPacketGet(1, f, ssn, 1);
             if (p3 == NULL) {
@@ -381,6 +383,7 @@ int FlowForceReassemblyForFlowV2(Flow *f, int server, int client)
                 TmqhOutputPacketpool(NULL, p2);
                 return 1;
             }
+            PKT_SET_SRC(p3, PKT_SRC_FFR_V2);
         } else {
             p2 = FlowForceReassemblyPseudoPacketGet(0, f, ssn, 1);
             if (p2 == NULL) {
@@ -388,6 +391,7 @@ int FlowForceReassemblyForFlowV2(Flow *f, int server, int client)
                 TmqhOutputPacketpool(NULL, p1);
                 return 1;
             }
+            PKT_SET_SRC(p2, PKT_SRC_FFR_V2);
         }
 
     } else if (client == 2) {
@@ -396,6 +400,7 @@ int FlowForceReassemblyForFlowV2(Flow *f, int server, int client)
             if (p1 == NULL) {
                 return 1;
             }
+            PKT_SET_SRC(p1, PKT_SRC_FFR_V2);
 
             p2 = FlowForceReassemblyPseudoPacketGet(1, f, ssn, 1);
             if (p2 == NULL) {
@@ -403,11 +408,13 @@ int FlowForceReassemblyForFlowV2(Flow *f, int server, int client)
                 TmqhOutputPacketpool(NULL, p1);
                 return 1;
             }
+            PKT_SET_SRC(p2, PKT_SRC_FFR_V2);
         } else {
             p1 = FlowForceReassemblyPseudoPacketGet(0, f, ssn, 1);
             if (p1 == NULL) {
                 return 1;
             }
+            PKT_SET_SRC(p1, PKT_SRC_FFR_V2);
 
             if (server == 2) {
                 p2 = FlowForceReassemblyPseudoPacketGet(1, f, ssn, 1);
@@ -416,6 +423,7 @@ int FlowForceReassemblyForFlowV2(Flow *f, int server, int client)
                     TmqhOutputPacketpool(NULL, p1);
                     return 1;
                 }
+                PKT_SET_SRC(p2, PKT_SRC_FFR_V2);
             }
         }
 
@@ -425,6 +433,7 @@ int FlowForceReassemblyForFlowV2(Flow *f, int server, int client)
             if (p1 == NULL) {
                 return 1;
             }
+            PKT_SET_SRC(p1, PKT_SRC_FFR_V2);
 
             p2 = FlowForceReassemblyPseudoPacketGet(1, f, ssn, 1);
             if (p2 == NULL) {
@@ -432,11 +441,13 @@ int FlowForceReassemblyForFlowV2(Flow *f, int server, int client)
                 TmqhOutputPacketpool(NULL, p1);
                 return 1;
             }
+            PKT_SET_SRC(p2, PKT_SRC_FFR_V2);
         } else if (server == 2) {
             p1 = FlowForceReassemblyPseudoPacketGet(1, f, ssn, 1);
             if (p1 == NULL) {
                 return 1;
             }
+            PKT_SET_SRC(p1, PKT_SRC_FFR_V2);
         } else {
             /* impossible */
             BUG_ON(1);
@@ -568,6 +579,7 @@ static inline void FlowForceReassemblyForHash(void)
                     FBLOCK_UNLOCK(fb);
                     return;
                 }
+                PKT_SET_SRC(p, PKT_SRC_FFR_SHUTDOWN);
 
                 if (stream_pseudo_pkt_detect_prev_TV != NULL) {
                     stream_pseudo_pkt_detect_prev_TV->
@@ -598,6 +610,7 @@ static inline void FlowForceReassemblyForHash(void)
                     FBLOCK_UNLOCK(fb);
                     return;
                 }
+                PKT_SET_SRC(p, PKT_SRC_FFR_SHUTDOWN);
 
                 if (stream_pseudo_pkt_detect_prev_TV != NULL) {
                     stream_pseudo_pkt_detect_prev_TV->
@@ -624,6 +637,7 @@ static inline void FlowForceReassemblyForHash(void)
         FBLOCK_UNLOCK(fb);
     }
 
+    PKT_SET_SRC(reassemble_p, PKT_SRC_FFR_SHUTDOWN);
     TmqhOutputPacketpool(NULL, reassemble_p);
     return;
 }

diff --git a/src/source-af-packet.c b/src/source-af-packet.c
index ccff2cd468e6cde69f4f822f43a450f7dd70369b..9cd8687680cb755b82b5f30b8ab0069cbe1e83d3 100644 (file)
--- a/src/source-af-packet.c
+++ b/src/source-af-packet.c
@@ -523,6 +523,7 @@ int AFPRead(AFPThreadVars *ptv)
     if (p == NULL) {
         SCReturnInt(AFP_FAILURE);
     }
+    PKT_SET_SRC(p, PKT_SRC_WIRE);
 
     /* get timestamp of packet via ioctl */
     if (ioctl(ptv->socket, SIOCGSTAMP, &p->ts) == -1) {
@@ -718,6 +719,7 @@ int AFPReadFromRing(AFPThreadVars *ptv)
         if (p == NULL) {
             SCReturnInt(AFP_FAILURE);
         }
+        PKT_SET_SRC(p, PKT_SRC_WIRE);
 
         /* Suricata will treat packet so telling it is busy, this
          * status will be reset to 0 (ie TP_STATUS_KERNEL) in the release

diff --git a/src/source-erf-dag.c b/src/source-erf-dag.c
index 150d21723bbf675e246630d8faa6251b2ed30010..5ba67a1ef3cb6b45bc48b2bdcdc3f4e15f27e9d0 100644 (file)
--- a/src/source-erf-dag.c
+++ b/src/source-erf-dag.c
@@ -481,6 +481,7 @@ static inline TmEcode ProcessErfDagRecord(ErfDagThreadVars *ewtn, char *prec)
             ewtn->dagstream, ewtn->dagname);
         SCReturnInt(TM_ECODE_FAILED);
     }
+    PKT_SET_SRC(p, PKT_SRC_WIRE);
 
     SET_PKT_LEN(p, wlen);
     p->datalink = LINKTYPE_ETHERNET;

diff --git a/src/source-erf-file.c b/src/source-erf-file.c
index 44c3642fef5e251262a9ddcea34d0898de86eb48..eb4ae4b9dedf8af5ed48b3fb71ca9b29d96fba99 100644 (file)
--- a/src/source-erf-file.c
+++ b/src/source-erf-file.c
@@ -135,6 +135,7 @@ TmEcode ReceiveErfFileLoop(ThreadVars *tv, void *data, void *slot)
             EngineStop();
             SCReturnInt(TM_ECODE_FAILED);
         }
+        PKT_SET_SRC(p, PKT_SRC_WIRE);
 
         if (ReadErfRecord(tv, p, data) != TM_ECODE_OK) {
             TmqhOutputPacketpool(etv->tv, p);

diff --git a/src/source-ipfw.c b/src/source-ipfw.c
index 573ef5d7e73da16f40a29db0f28a1121a6ccbe8c..66f66808b69c69b3b8c91c69c7b3556370cd4625 100644 (file)
--- a/src/source-ipfw.c
+++ b/src/source-ipfw.c
@@ -373,6 +373,7 @@ TmEcode ReceiveIPFWLoop(ThreadVars *tv, void *data, void *slot)
         if (p == NULL) {
             SCReturnInt(TM_ECODE_FAILED);
         }
+        PKT_SET_SRC(p, PKT_SRC_WIRE);
 
         SCLogDebug("Received Packet Len: %d", pktlen);
 

diff --git a/src/source-napatech.c b/src/source-napatech.c
index 56c37e84b6346c97dff6963a82130450ff678848..c12eae09ce4340d1d0b3d3a53ba66eca3edf8ffe 100644 (file)
--- a/src/source-napatech.c
+++ b/src/source-napatech.c
@@ -244,6 +244,7 @@ TmEcode NapatechFeedLoop(ThreadVars *tv, void *data, void *slot)
         if (unlikely(p == NULL)) {
             SCReturnInt(TM_ECODE_FAILED);
         }
+        PKT_SET_SRC(p, PKT_SRC_WIRE);
 
         p->ts.tv_sec = header->ts.tv_sec;
         p->ts.tv_usec = header->ts.tv_usec;

diff --git a/src/source-nfq.c b/src/source-nfq.c
index 373842fc9608dde3f954658f19807830313d3def..8120c7cc99a51a634964f8538e94f261acebe239 100644 (file)
--- a/src/source-nfq.c
+++ b/src/source-nfq.c
@@ -379,6 +379,7 @@ static int NFQCallBack(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
     if (p == NULL) {
         return -1;
     }
+    PKT_SET_SRC(p, PKT_SRC_WIRE);
 
     p->nfq_v.nfq_index = ntv->nfq_index;
     ret = NFQSetupPkt(p, qh, (void *)nfa);

diff --git a/src/source-pcap-file.c b/src/source-pcap-file.c
index e23e620b028e460b6651993e71afae86cbd1eafb..be864dd324826b15fe2531912ec9823ebff9df5b 100644 (file)
--- a/src/source-pcap-file.c
+++ b/src/source-pcap-file.c
@@ -127,6 +127,7 @@ void PcapFileCallbackLoop(char *user, struct pcap_pkthdr *h, u_char *pkt) {
     }
     PACKET_PROFILING_TMM_START(p, TMM_RECEIVEPCAPFILE);
 
+    PKT_SET_SRC(p, PKT_SRC_WIRE);
     p->ts.tv_sec = h->ts.tv_sec;
     p->ts.tv_usec = h->ts.tv_usec;
     SCLogDebug("p->ts.tv_sec %"PRIuMAX"", (uintmax_t)p->ts.tv_sec);

diff --git a/src/source-pcap.c b/src/source-pcap.c
index bb7cda15935967df59bfb2779bc1fdc1a27a3632..c0e0bec778bb0b02e7cd2494b96e58351f113192 100644 (file)
--- a/src/source-pcap.c
+++ b/src/source-pcap.c
@@ -210,6 +210,7 @@ void PcapCallbackLoop(char *user, struct pcap_pkthdr *h, u_char *pkt) {
         SCReturn;
     }
 
+    PKT_SET_SRC(p, PKT_SRC_WIRE);
     p->ts.tv_sec = h->ts.tv_sec;
     p->ts.tv_usec = h->ts.tv_usec;
     SCLogDebug("p->ts.tv_sec %"PRIuMAX"", (uintmax_t)p->ts.tv_sec);

diff --git a/src/source-pfring.c b/src/source-pfring.c
index 63a7bc9d068d1cac5965bf7b449da59f8f57baed..f8bf8c2ac1118ab0cc8a372eb7115566499fa7a1 100644 (file)
--- a/src/source-pfring.c
+++ b/src/source-pfring.c
@@ -270,6 +270,7 @@ TmEcode ReceivePfringLoop(ThreadVars *tv, void *data, void *slot)
         if (p == NULL) {
             SCReturnInt(TM_ECODE_FAILED);
         }
+        PKT_SET_SRC(p, PKT_SRC_WIRE);
 
         /* Some flavours of PF_RING may fail to set timestamp - see PF-RING-enabled libpcap code*/
         hdr.ts.tv_sec = hdr.ts.tv_usec = 0;

diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index 55cfde7d158e36af064a867737ae61ca3b9f250b..dbc6ab85c5e6fb161118ebb83b121a6b4e6b3244 100644 (file)
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -4577,6 +4577,7 @@ void StreamTcpPseudoPacketCreateStreamEndPacket(Packet *p, TcpSession *ssn, Pack
         SCLogDebug("The packet received from packet allocation is NULL");
         SCReturn;
     }
+    PKT_SET_SRC(np, PKT_SRC_STREAM_TCP_STREAM_END_PSEUDO);
 
     /* Setup the IP and TCP headers */
     StreamTcpPseudoPacketSetupHeader(np,p);