tweaking a Packet function so it makes logical sense

diff --git a/src/detection/detect.cc b/src/detection/detect.cc
index 9f548740fd6574b1761e990a3d09db6bbca392db..435aee7fb55239fc3ab1d95136a814e44e4ed001 100644 (file)
--- a/src/detection/detect.cc
+++ b/src/detection/detect.cc
@@ -323,7 +323,7 @@ bool Detect(Packet * p)
     //          Instead, we should only perform detect on that
     //          layer!!
 
-    int curr_layer = p->num_layers - 1;
+    uint8_t curr_layer = 0;
     uint8_t ip_proto; // set in function
 
     while (p->get_ip_proto_next(curr_layer, ip_proto))

diff --git a/src/protocols/layer.cc b/src/protocols/layer.cc
index 2ff30e8984849bfdb4f4705cea62d2b53dc8bf91..c7983cf7ad96e2a887fb0adead066b3af9163822 100644 (file)
--- a/src/protocols/layer.cc
+++ b/src/protocols/layer.cc
@@ -81,24 +81,6 @@ static inline const uint8_t* find_inner_layer(const Layer* lyr,
     return nullptr;
 }
 
-static inline bool is_ip6_extension(const uint8_t proto)
-{
-    switch(proto)
-    {
-    case IPPROTO_ID_HOPOPTS:
-    case IPPROTO_ID_DSTOPTS:
-    case IPPROTO_ID_ROUTING:
-    case IPPROTO_ID_FRAGMENT:
-    case IPPROTO_ID_AUTH:
-    case IPPROTO_ID_ESP:
-    case IPPROTO_ID_MOBILITY:
-    case IPPROTO_ID_NONEXT:
-        return true;
-    default:
-        return false;
-    }
-}
-
 void set_packet_pointer(const Packet* const curr_pkt)
 { p = curr_pkt; }
 

diff --git a/src/protocols/packet.cc b/src/protocols/packet.cc
index 971d5318449daed5aaac0f7ebad22a8964550264..3a2c65c6a32b0907c6e490e17205d8a9ca43bf88 100644 (file)
--- a/src/protocols/packet.cc
+++ b/src/protocols/packet.cc
@@ -22,27 +22,6 @@
 #include "protocols/protocol_ids.h"
 
 
-static inline bool is_ip_protocol(const uint16_t proto)
-{
-    switch(proto)
-    {
-    case IPPROTO_ID_HOPOPTS:
-    case IPPROTO_ID_DSTOPTS:
-    case IPPROTO_ID_ROUTING:
-    case IPPROTO_ID_FRAGMENT:
-    case IPPROTO_ID_AUTH:
-    case IPPROTO_ID_ESP:
-    case IPPROTO_ID_MOBILITY:
-    case IPPROTO_ID_IPIP:
-    case IPPROTO_ID_IPV6:
-    case ETHERTYPE_IPV4:
-    case ETHERTYPE_IPV6:
-        return true;
-    default:
-        return false;
-    }
-}
-
 #if 0
 uint8_t Packet::ip_proto_next() const
 {
@@ -81,27 +60,36 @@ uint8_t Packet::ip_proto_next() const
 }
 #endif
 
-// FIXIT-L J  --  this loop will be changed to go from the outside
-//                  to search inward. Every location which uses this
-//                  must be changed!
-bool Packet::get_ip_proto_next(int &lyr, uint8_t& proto) const
+bool Packet::get_ip_proto_next(uint8_t &lyr, uint8_t& proto) const
 {
-    if (lyr < 0)
+    if (lyr < 0 || lyr > num_layers)
         return false;
 
-    // lyr[0] will always return false
-    // -- this logic will be updated during fix.
-    while (is_ip_protocol(layers[lyr].prot_id))
-        --lyr;
-
-    while (lyr >= 0)
+    while (lyr < num_layers)
     {
-        if (is_ip_protocol(layers[lyr].prot_id))
-            return true;
-        else
-            proto = layers[lyr].prot_id;
+        switch(layers[lyr].prot_id)
+        {
+        case IPPROTO_ID_IPIP:
+        case IPPROTO_ID_IPV6:
+        case ETHERTYPE_IPV4:
+        case ETHERTYPE_IPV6:
+            // move past this IP layer and any IPv6 extensions.
+            while (++lyr < num_layers && is_ip6_extension(layers[lyr].prot_id));
+
+            if (lyr >= num_layers)
+            {
+                return false;
+            }
+            else
+            {
+                proto = layers[lyr].prot_id;
+                return true;
+            }
+
+        default:
+            ++lyr;
+        }
 
-        --lyr;
     }
 
     return false;

diff --git a/src/protocols/packet.h b/src/protocols/packet.h
index e9c881b5051897677de6a289726126fd4dd8658a..4daee8fa7859cdf71350dadc5ff38fa5dac37dfe 100644 (file)
--- a/src/protocols/packet.h
+++ b/src/protocols/packet.h
@@ -218,19 +218,20 @@ struct SO_PUBLIC Packet
      * NOTE: Will only return protocols of validly decoded layers.
      *
      * PARAMS:
-     *          lyr - zero based layer from which to start searching outward.
-     *                  will always point to an IP protocol or IP extension.
+     *          lyr - zero based layer from which to start searching inward.
+     *                  will always point to the layer after an IP header or
+     *                  IPv6 extension.
      *          proto - the ip_proto (read above) for the next, outermost IP layer
      * EXAMPLE:
      *
      * uint8_t ip_proto;
-     * int lyr = p->num_layers - 1;
+     * int lyr = 0
      * while ( ip_proto_next(lyr, ip_proto))
      * {
      *    ....
      * }
      */
-    bool get_ip_proto_next(int &lyr, uint8_t& proto) const;
+    bool get_ip_proto_next(uint8_t &lyr, uint8_t& proto) const;
 
     inline void reset()
     {

diff --git a/src/protocols/protocol_ids.h b/src/protocols/protocol_ids.h
index a189563215fc778d63884a0ad13c9953cb92480f..485ecd692536485fab486504eba8bb9d7240c269 100644 (file)
--- a/src/protocols/protocol_ids.h
+++ b/src/protocols/protocol_ids.h
@@ -98,4 +98,22 @@ constexpr uint16_t ETHERTYPE_PPP = 0x880B;
 constexpr uint16_t ETHERTYPE_EAPOL = 0x888e;
 
 
+static inline bool is_ip6_extension(const uint8_t proto)
+{
+    switch(proto)
+    {
+    case IPPROTO_ID_HOPOPTS:
+    case IPPROTO_ID_DSTOPTS:
+    case IPPROTO_ID_ROUTING:
+    case IPPROTO_ID_FRAGMENT:
+    case IPPROTO_ID_AUTH:
+    case IPPROTO_ID_ESP:
+    case IPPROTO_ID_MOBILITY:
+    case IPPROTO_ID_NONEXT:
+        return true;
+    default:
+        return false;
+    }
+}
+
 #endif