return innermost proto for type of broken packets

capture id of grinder upon init to support above

diff --git a/src/managers/codec_manager.cc b/src/managers/codec_manager.cc
index 499283a22083bd6c480f3f8f803151e1c0571954..220701ce8f35e5662bacae6efe85e0b77c5cb63d 100644 (file)
--- a/src/managers/codec_manager.cc
+++ b/src/managers/codec_manager.cc
@@ -49,6 +49,8 @@ std::array<uint8_t, max_protocol_id> CodecManager::s_proto_map {
 std::array<Codec*, UINT8_MAX> CodecManager::s_protocols {
     { 0 }
 };
+
+THREAD_LOCAL uint16_t CodecManager::grinder_id = 0;
 THREAD_LOCAL uint8_t CodecManager::grinder = 0;
 THREAD_LOCAL uint8_t CodecManager::max_layers = DEFAULT_LAYERMAX;
 
@@ -223,6 +225,10 @@ void CodecManager::thread_init(SnortConfig* sc)
                         s_protocols[grinder]->get_name(), cd->get_name(),
                         cd->get_name());
 
+                std::vector<uint16_t> ids;
+                s_protocols[i]->get_protocol_ids(ids);
+
+                grinder_id = ( ids.size() > 0 ) ? ids[0] : FINISHED_DECODE;
                 grinder = (uint8_t)i;
             }
         }

diff --git a/src/managers/codec_manager.h b/src/managers/codec_manager.h
index b08e6bf5f7e4443ddb1ad6eda49a1c466a1fe4c6..6ce4e57edf30fbd96f569e345b8fffada53b8750 100644 (file)
--- a/src/managers/codec_manager.h
+++ b/src/managers/codec_manager.h
@@ -104,6 +104,8 @@ private:
     static std::vector<CodecApiWrapper> s_codecs;
     static std::array<uint8_t, max_protocol_id> s_proto_map;
     static std::array<Codec*, UINT8_MAX> s_protocols;
+
+    static THREAD_LOCAL uint16_t grinder_id;
     static THREAD_LOCAL uint8_t grinder;
     static THREAD_LOCAL uint8_t max_layers;
 

diff --git a/src/protocols/packet.cc b/src/protocols/packet.cc
index ac8d026eae48e1a6d98960e85c5f7099c67f1318..87769e28f2847bc45d7a5fd06334cfe01c01db02 100644 (file)
--- a/src/protocols/packet.cc
+++ b/src/protocols/packet.cc
@@ -20,6 +20,7 @@
 #include <assert.h>
 
 #include "protocols/packet.h"
+#include "protocols/packet_manager.h"
 #include "protocols/protocol_ids.h"
 
 #if 0
@@ -119,17 +120,22 @@ const char* Packet::get_type() const
     case PktType::FILE:
         if ( proto_bits & PROTO_BIT__TCP )
             return "TCP";
+
         if ( proto_bits & PROTO_BIT__UDP )
             return "UDP";
+
         assert(false);
         return "Error";
 
     case PktType::NONE:
+        if ( num_layers > 0 )
+            return PacketManager::get_proto_name(layers[num_layers-1].prot_id);
+
+        assert(false);
         return "None";
 
     default:
-        assert(false);
-        return "Error";
+        break;
     }
     assert(false);
     return "Error";

diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc
index e8dd345286b5faa481861c3f6661bb8b6ad67e4f..87603fc119b0ae295d039a783999074f3de2e1eb 100644 (file)
--- a/src/protocols/packet_manager.cc
+++ b/src/protocols/packet_manager.cc
@@ -189,8 +189,9 @@ void PacketManager::decode(
 {
     PROFILE_VARS;
     DecodeData unsure_encap_ptrs;
-    uint16_t prev_prot_id = FINISHED_DECODE;
+
     uint8_t mapped_prot = CodecManager::grinder;
+    uint16_t prev_prot_id = CodecManager::grinder_id;
 
     RawData raw(pkthdr, pkt);
     CodecData codec_data(FINISHED_DECODE);