decode/ppp: remove ppph check in favor of flag

As we now support variable size headers, we can't use the old pointer.

Replace with a flag.

diff --git a/src/decode-ipv4.c b/src/decode-ipv4.c
index 92d0c6ecfd5c85a49a9fec68309b5639642af5d3..c1bb9cce4731887956f3b932c08b37619bc8a646 100644 (file)
--- a/src/decode-ipv4.c
+++ b/src/decode-ipv4.c
@@ -601,7 +601,7 @@ int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
             }
         case IPPROTO_IP:
             /* check PPP VJ uncompressed packets and decode tcp dummy */
-            if(p->ppph != NULL && SCNtohs(p->ppph->protocol) == PPP_VJ_UCOMP)    {
+            if (p->flags & PKT_PPP_VJ_UCOMP) {
                 DecodeTCP(tv, dtv, p, pkt + IPV4_GET_HLEN(p),
                           IPV4_GET_IPLEN(p) -  IPV4_GET_HLEN(p));
             }

diff --git a/src/decode-ppp.c b/src/decode-ppp.c
index 6507bc0a6ee9618c8ba97f278abfc0cc1b106d98..a05c4c3edd2f7995067ea9ef2cf8792536e96bf8 100644 (file)
--- a/src/decode-ppp.c
+++ b/src/decode-ppp.c
@@ -75,6 +75,7 @@ static int DecodePPPCompressedProto(ThreadVars *tv, DecodeThreadVars *dtv, Packe
             }
 
             if (likely(IPV4_GET_RAW_VER((IPV4Hdr *)(pkt + data_offset)) == 4)) {
+                p->flags |= PKT_PPP_VJ_UCOMP;
                 return DecodeIPV4(tv, dtv, p, pkt + data_offset, (uint16_t)(len - data_offset));
             } else
                 return TM_ECODE_FAILED;

diff --git a/src/decode.h b/src/decode.h
index b6b7d38b667e003284018f3d71bad20e496915e1..a591c7e3f534b49c718c62342ebd8b7ae43e7035 100644 (file)
--- a/src/decode.h
+++ b/src/decode.h
@@ -1005,7 +1005,8 @@ void DecodeUnregisterCounters(void);
 
 /** Flag to indicate that packet header or contents should not be inspected */
 #define PKT_NOPACKET_INSPECTION BIT_U32(0)
-// vacancy
+/** Packet has a PPP_VJ_UCOMP header */
+#define PKT_PPP_VJ_UCOMP BIT_U32(1)
 
 /** Flag to indicate that packet contents should not be inspected */
 #define PKT_NOPAYLOAD_INSPECTION BIT_U32(2)