decode: add stats counters for ipv4/ipv6 over ipv4

These existed for ipv6 over ipv6, and ipv4 over ipv6, but not for the
ipv4 counterpart.

Task #7758

(backported from cbe621fb09b837af3e4adaa0e45fed1607a5288d)

diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst
index 45a20b5355b7f495e3c715a561bfb667cf74a464..50d54ec97fa5b2229546a3f8874f7bda577d9fb4 100644 (file)
--- a/doc/userguide/configuration/suricata-yaml.rst
+++ b/doc/userguide/configuration/suricata-yaml.rst
@@ -2799,6 +2799,8 @@ set the parent flow for packets, when the engine sees such IP-in-IP packets. Thi
 option can be enabled regardless of enabled the ipip tunneling.
 As this may impact signature matching and flow tracking, these are disabled by default.
 
+The stats counter `decoder.ipv4_in_ipv4` is associated with this setting.
+
 ::
 
    # IP-in-IP tunneling for ipv4 over ipv4 handling.

diff --git a/etc/schema.json b/etc/schema.json
index 28a535ff0d19cc6102f06f8b9b2422a59c731f44..f848e2508e5bfa42eabd73c69717c734d8c6a205 100644 (file)
--- a/etc/schema.json
+++ b/etc/schema.json
@@ -4222,14 +4222,24 @@
                         "ipv4": {
                             "type": "integer"
                         },
+                        "ipv4_in_ipv4": {
+                            "type": "integer",
+                            "description": "Number of IP-in-IP packets seen for ipv4-ipv4"
+                        },
                         "ipv4_in_ipv6": {
-                            "type": "integer"
+                            "type": "integer",
+                            "description": "Number of IP-in-IP packets seen for ipv4-ipv6"
                         },
                         "ipv6": {
                             "type": "integer"
                         },
+                        "ipv6_in_ipv4": {
+                            "type": "integer",
+                            "description": "Number of IP-in-IP packets seen for ipv6-ipv4"
+                        },
                         "ipv6_in_ipv6": {
-                            "type": "integer"
+                            "type": "integer",
+                            "description": "Number of IP-in-IP packets seen for ipv6-ipv6"
                         },
                         "max_mac_addrs_dst": {
                             "type": "integer"

diff --git a/src/decode-ipv4.c b/src/decode-ipv4.c
index 03c78a76437ec58c729cf37472d7f133aec63183..b111ad8ccd9f8b117af09e58f5add7740cf95fe2 100644 (file)
--- a/src/decode-ipv4.c
+++ b/src/decode-ipv4.c
@@ -618,6 +618,7 @@ int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
                 if (tp != NULL) {
                     PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV4);
                     PacketEnqueueNoLock(&tv->decode_pq, tp);
+                    StatsIncr(tv, dtv->counter_ipv4inipv4);
                 }
             }
             if (g_ipv4_ipip_parent_flow_enabled) {
@@ -634,6 +635,7 @@ int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
                 if (tp != NULL) {
                     PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV4);
                     PacketEnqueueNoLock(&tv->decode_pq,tp);
+                    StatsIncr(tv, dtv->counter_ipv6inipv4);
                 }
                 FlowSetupPacket(p);
                 break;

diff --git a/src/decode.c b/src/decode.c
index f28f7e137f7d68158042363b9bfa544474b48059..ab09abf85e3164092486d12fdcd9622e98caf6e8 100644 (file)
--- a/src/decode.c
+++ b/src/decode.c
@@ -559,6 +559,8 @@ void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
     dtv->counter_vntag = StatsRegisterCounter("decoder.vntag", tv);
     dtv->counter_ieee8021ah = StatsRegisterCounter("decoder.ieee8021ah", tv);
     dtv->counter_teredo = StatsRegisterCounter("decoder.teredo", tv);
+    dtv->counter_ipv4inipv4 = StatsRegisterCounter("decoder.ipv4_in_ipv4", tv);
+    dtv->counter_ipv6inipv4 = StatsRegisterCounter("decoder.ipv6_in_ipv4", tv);
     dtv->counter_ipv4inipv6 = StatsRegisterCounter("decoder.ipv4_in_ipv6", tv);
     dtv->counter_ipv6inipv6 = StatsRegisterCounter("decoder.ipv6_in_ipv6", tv);
     dtv->counter_mpls = StatsRegisterCounter("decoder.mpls", tv);

diff --git a/src/decode.h b/src/decode.h
index b8c475c2785fdc4dcae667987e736bcbc50af715..b0a119a787bc43d21d569ce9a386fe136038e249 100644 (file)
--- a/src/decode.h
+++ b/src/decode.h
@@ -713,6 +713,8 @@ typedef struct DecodeThreadVars_
     uint16_t counter_pppoe;
     uint16_t counter_teredo;
     uint16_t counter_mpls;
+    uint16_t counter_ipv4inipv4;
+    uint16_t counter_ipv6inipv4;
     uint16_t counter_ipv4inipv6;
     uint16_t counter_ipv6inipv6;
     uint16_t counter_erspan;