static int DecodeUDPPacket(ThreadVars *t, Packet *p, uint8_t *pkt, uint16_t len) { if (unlikely(len < UDP_HEADER_LEN)) { ENGINE_SET_INVALID_EVENT(p, UDP_HLEN_TOO_SMALL); return -1; } p->udph = (UDPHdr *)pkt; if (unlikely(len < UDP_GET_LEN(p))) { ENGINE_SET_INVALID_EVENT(p, UDP_PKT_TOO_SMALL); return -1; } if (unlikely(len != UDP_GET_LEN(p))) { ENGINE_SET_INVALID_EVENT(p, UDP_HLEN_INVALID); return -1; } SET_UDP_SRC_PORT(p,&p->sp); SET_UDP_DST_PORT(p,&p->dp); p->payload = pkt + UDP_HEADER_LEN; p->payload_len = len - UDP_HEADER_LEN; p->proto = IPPROTO_UDP; return 0; }
/* initialize the flow from the first packet * we see from it. */ void FlowInit(Flow *f, const Packet *p) { SCEnter(); SCLogDebug("flow %p", f); f->proto = p->proto; f->recursion_level = p->recursion_level; f->vlan_id[0] = p->vlan_id[0]; f->vlan_id[1] = p->vlan_id[1]; if (PKT_IS_IPV4(p)) { FLOW_SET_IPV4_SRC_ADDR_FROM_PACKET(p, &f->src); FLOW_SET_IPV4_DST_ADDR_FROM_PACKET(p, &f->dst); f->flags |= FLOW_IPV4; } else if (PKT_IS_IPV6(p)) { FLOW_SET_IPV6_SRC_ADDR_FROM_PACKET(p, &f->src); FLOW_SET_IPV6_DST_ADDR_FROM_PACKET(p, &f->dst); f->flags |= FLOW_IPV6; } #ifdef DEBUG /* XXX handle default */ else { printf("FIXME: %s:%s:%" PRId32 "\n", __FILE__, __FUNCTION__, __LINE__); } #endif if (p->tcph != NULL) { /* XXX MACRO */ SET_TCP_SRC_PORT(p,&f->sp); SET_TCP_DST_PORT(p,&f->dp); } else if (p->udph != NULL) { /* XXX MACRO */ SET_UDP_SRC_PORT(p,&f->sp); SET_UDP_DST_PORT(p,&f->dp); } else if (p->icmpv4h != NULL) { f->type = p->type; f->code = p->code; } else if (p->icmpv6h != NULL) { f->type = p->type; f->code = p->code; } else if (p->sctph != NULL) { /* XXX MACRO */ SET_SCTP_SRC_PORT(p,&f->sp); SET_SCTP_DST_PORT(p,&f->dp); } /* XXX handle default */ #ifdef DEBUG else { printf("FIXME: %s:%s:%" PRId32 "\n", __FILE__, __FUNCTION__, __LINE__); } #endif COPY_TIMESTAMP(&p->ts, &f->startts); f->protomap = FlowGetProtoMapping(f->proto); SCReturn; }