defrag: add some events relative to defragmentation

OISF · Aug 22, 2012 · fd32159 · fd32159
1 parent d2aa040
commit fd32159
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/src/decode-events.h b/src/decode-events.h
@@ -191,6 +191,11 @@ enum {
     IPV4_FRAG_OVERLAP,
     IPV6_FRAG_PKT_TOO_LARGE,
     IPV6_FRAG_OVERLAP,
+    IPV4_FRAG_TOO_LARGE,
+    IPV6_FRAG_TOO_LARGE,
+    /* Fragment ignored due to internal error */
+    IPV4_FRAG_IGNORED,
+    IPV6_FRAG_IGNORED,
 
     /* IPv4 in IPv6 events */
     IPV4_IN_IPV6_PKT_TOO_SMALL,

diff --git a/src/defrag.c b/src/defrag.c
@@ -932,6 +932,11 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragContext *dc,
 
 insert:
     if (data_len - ltrim <= 0) {
+        if (af == AF_INET) {
+            ENGINE_SET_EVENT(p, IPV4_FRAG_TOO_LARGE);
+        } else {
+            ENGINE_SET_EVENT(p, IPV6_FRAG_TOO_LARGE);
+        }
         goto done;
     }
 
@@ -940,13 +945,23 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragContext *dc,
     Frag *new = PoolGet(dc->frag_pool);
     SCMutexUnlock(&dc->frag_pool_lock);
     if (new == NULL) {
+        if (af == AF_INET) {
+            ENGINE_SET_EVENT(p, IPV4_FRAG_IGNORED);
+        } else {
+            ENGINE_SET_EVENT(p, IPV6_FRAG_IGNORED);
+        }
         goto done;
     }
     new->pkt = SCMalloc(GET_PKT_LEN(p));
     if (new->pkt == NULL) {
         SCMutexLock(&dc->frag_pool_lock);
         PoolReturn(dc->frag_pool, new);
         SCMutexUnlock(&dc->frag_pool_lock);
+        if (af == AF_INET) {
+            ENGINE_SET_EVENT(p, IPV4_FRAG_IGNORED);
+        } else {
+            ENGINE_SET_EVENT(p, IPV6_FRAG_IGNORED);
+        }
         goto done;
     }
     memcpy(new->pkt, GET_PKT_DATA(p) + ltrim, GET_PKT_LEN(p) - ltrim);