pfring: add warning for stripped vlan header case

According to PF_RING upstream the vlan header should never be stripped
from the packet PF_RING feeds to Suricata. But upstream also indicated
keeping the check would be a good "safety check".

So in addition to the check, add a warning that warns once (per thread
for implementation simplicity) if the vlan hdr does appear to be stripped
after all.

diff --git a/src/source-pfring.c b/src/source-pfring.c
index 719b54958b1603e33b3e149e638fb4ce9ff539de..9dd547a72c20bc784d8bd78c18097f91bd3ab861 100644 (file)
--- a/src/source-pfring.c
+++ b/src/source-pfring.c
@@ -165,6 +165,8 @@ typedef struct PfringThreadVars_
     char *bpf_filter;
 
      ChecksumValidationMode checksum_mode;
+
+    bool vlan_hdr_warned;
 } PfringThreadVars;
 
 /**
@@ -267,6 +269,12 @@ static inline void PfringProcessPacket(void *user, struct pfring_pkthdr *h, Pack
         p->vlan_id[0] = h->extended_hdr.parsed_pkt.vlan_id & 0x0fff;
         p->vlan_idx = 1;
         p->vlanh[0] = NULL;
+
+        if (!ptv->vlan_hdr_warned) {
+            SCLogWarning(SC_ERR_PF_RING_VLAN, "no VLAN header in the raw "
+                    "packet. See #2355.");
+            ptv->vlan_hdr_warned = true;
+        }
     }
 
     switch (ptv->checksum_mode) {

diff --git a/src/util-error.c b/src/util-error.c
index c8ad0cf42a8d475bba0f106192ac418c9e98e6be..34777cc179ab0268d34bdf6a332a7fac3f4bec7e 100644 (file)
--- a/src/util-error.c
+++ b/src/util-error.c
@@ -342,6 +342,7 @@ const char * SCErrorToString(SCError err)
         CASE_CODE (SC_WARN_EVENT_DROPPED);
         CASE_CODE (SC_ERR_NO_REDIS_ASYNC);
         CASE_CODE (SC_ERR_REDIS_CONFIG);
+        CASE_CODE (SC_ERR_PF_RING_VLAN);
     }
 
     return "UNKNOWN_ERROR";

diff --git a/src/util-error.h b/src/util-error.h
index 94f67d14b253290cfabdfa03c905ada2f258599c..4fe73304710bec4074a7d2de00b14398a8c96bb0 100644 (file)
--- a/src/util-error.h
+++ b/src/util-error.h
@@ -331,7 +331,8 @@ typedef enum {
     SC_WARN_LOG_CF_TOO_MANY_NODES,
     SC_WARN_EVENT_DROPPED,
     SC_ERR_NO_REDIS_ASYNC,
-    SC_ERR_REDIS_CONFIG
+    SC_ERR_REDIS_CONFIG,
+    SC_ERR_PF_RING_VLAN,
 } SCError;
 
 const char *SCErrorToString(SCError);