From: Victor Julien Date: Tue, 2 Apr 2024 08:18:57 +0000 (+0200) Subject: decode/ethernet: move ethh into L2 section X-Git-Tag: suricata-8.0.0-beta1~1371 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=54362d44db27c1833b481265c482e1a2ab666f73;p=thirdparty%2Fsuricata.git decode/ethernet: move ethh into L2 section L2 section similar to L3 and L4 sections. Ticket: #6938. --- diff --git a/src/decode-ethernet.c b/src/decode-ethernet.c index 62115b9fd4..5734f3bea7 100644 --- a/src/decode-ethernet.c +++ b/src/decode-ethernet.c @@ -54,12 +54,12 @@ int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, if (!PacketIncreaseCheckLayers(p)) { return TM_ECODE_FAILED; } - p->ethh = (EthernetHdr *)pkt; + EthernetHdr *ethh = PacketSetEthernet(p, pkt); - SCLogDebug("p %p pkt %p ether type %04x", p, pkt, SCNtohs(p->ethh->eth_type)); + SCLogDebug("p %p pkt %p ether type %04x", p, pkt, SCNtohs(ethh->eth_type)); - DecodeNetworkLayer(tv, dtv, SCNtohs(p->ethh->eth_type), p, - pkt + ETHERNET_HEADER_LEN, len - ETHERNET_HEADER_LEN); + DecodeNetworkLayer(tv, dtv, SCNtohs(ethh->eth_type), p, pkt + ETHERNET_HEADER_LEN, + len - ETHERNET_HEADER_LEN); return TM_ECODE_OK; } diff --git a/src/decode.h b/src/decode.h index 439937fb52..6569341544 100644 --- a/src/decode.h +++ b/src/decode.h @@ -400,6 +400,18 @@ enum PacketTunnelType { /* forward declaration since Packet struct definition requires this */ struct PacketQueue_; +enum PacketL2Types { + PACKET_L2_UNKNOWN = 0, + PACKET_L2_ETHERNET, +}; + +struct PacketL2 { + enum PacketL2Types type; + union L2Hdrs { + EthernetHdr *ethh; + } hdrs; +}; + enum PacketL3Types { PACKET_L3_UNKNOWN = 0, PACKET_L3_IPV4, @@ -568,9 +580,7 @@ typedef struct Packet_ /* pkt vars */ PktVar *pktvar; - /* header pointers */ - EthernetHdr *ethh; - + struct PacketL2 l2; struct PacketL3 l3; struct PacketL4 l4; @@ -728,6 +738,11 @@ static inline uint8_t PacketGetIPv4IPProto(const Packet *p) return 0; } +static inline bool PacketIsIPv6(const Packet *p) +{ + return p->l3.type == PACKET_L3_IPV6; +} + static inline const IPV6Hdr *PacketGetIPv6(const Packet *p) { DEBUG_VALIDATE_BUG_ON(!PacketIsIPv6(p)); @@ -742,9 +757,29 @@ static inline IPV6Hdr *PacketSetIPV6(Packet *p, const uint8_t *buf) return p->l3.hdrs.ip6h; } -static inline bool PacketIsIPv6(const Packet *p) +static inline void PacketClearL2(Packet *p) { - return p->l3.type == PACKET_L3_IPV6; + memset(&p->l2, 0, sizeof(p->l2)); +} + +/* Can be called multiple times, e.g. for DCE */ +static inline EthernetHdr *PacketSetEthernet(Packet *p, const uint8_t *buf) +{ + DEBUG_VALIDATE_BUG_ON(p->l2.type != PACKET_L2_UNKNOWN && p->l2.type != PACKET_L2_ETHERNET); + p->l2.type = PACKET_L2_ETHERNET; + p->l2.hdrs.ethh = (EthernetHdr *)buf; + return p->l2.hdrs.ethh; +} + +static inline const EthernetHdr *PacketGetEthernet(const Packet *p) +{ + DEBUG_VALIDATE_BUG_ON(p->l2.type != PACKET_L2_ETHERNET); + return p->l2.hdrs.ethh; +} + +static inline bool PacketIsEthernet(const Packet *p) +{ + return p->l2.type == PACKET_L2_ETHERNET; } static inline void PacketClearL3(Packet *p) diff --git a/src/flow.c b/src/flow.c index 5f23ac8f51..a088b4d770 100644 --- a/src/flow.c +++ b/src/flow.c @@ -357,10 +357,11 @@ static inline void FlowUpdateTtlTC(Flow *f, Packet *p, uint8_t ttl) f->max_ttl_toclient = MAX(f->max_ttl_toclient, ttl); } -static inline void FlowUpdateEthernet(ThreadVars *tv, DecodeThreadVars *dtv, - Flow *f, EthernetHdr *ethh, bool toserver) +static inline void FlowUpdateEthernet( + ThreadVars *tv, DecodeThreadVars *dtv, Flow *f, const Packet *p, bool toserver) { - if (ethh && MacSetFlowStorageEnabled()) { + if (PacketIsEthernet(p) && MacSetFlowStorageEnabled()) { + const EthernetHdr *ethh = PacketGetEthernet(p); MacSet *ms = FlowGetStorageById(f, MacSetGetFlowStorageID()); if (ms != NULL) { if (toserver) { @@ -435,7 +436,7 @@ void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars f->flags &= ~FLOW_PROTO_DETECT_TS_DONE; p->flags |= PKT_PROTO_DETECT_TS_DONE; } - FlowUpdateEthernet(tv, dtv, f, p->ethh, true); + FlowUpdateEthernet(tv, dtv, f, p, true); /* update flow's ttl fields if needed */ if (PacketIsIPv4(p)) { const IPV4Hdr *ip4h = PacketGetIPv4(p); @@ -459,7 +460,7 @@ void FlowHandlePacketUpdate(Flow *f, Packet *p, ThreadVars *tv, DecodeThreadVars f->flags &= ~FLOW_PROTO_DETECT_TC_DONE; p->flags |= PKT_PROTO_DETECT_TC_DONE; } - FlowUpdateEthernet(tv, dtv, f, p->ethh, false); + FlowUpdateEthernet(tv, dtv, f, p, false); /* update flow's ttl fields if needed */ if (PacketIsIPv4(p)) { const IPV4Hdr *ip4h = PacketGetIPv4(p); diff --git a/src/output-json.c b/src/output-json.c index 8ab78150be..6709657269 100644 --- a/src/output-json.c +++ b/src/output-json.c @@ -738,10 +738,11 @@ static int CreateJSONEther(JsonBuilder *js, const Packet *p, const Flow *f) { if (p != NULL) { /* this is a packet context, so we need to add scalar fields */ - if (p->ethh != NULL) { + if (PacketIsEthernet(p)) { + const EthernetHdr *ethh = PacketGetEthernet(p); jb_open_object(js, "ether"); - uint8_t *src = p->ethh->eth_src; - uint8_t *dst = p->ethh->eth_dst; + const uint8_t *src = ethh->eth_src; + const uint8_t *dst = ethh->eth_dst; JSONFormatAndAddMACAddr(js, "src_mac", src, false); JSONFormatAndAddMACAddr(js, "dest_mac", dst, false); jb_close(js); diff --git a/src/packet.c b/src/packet.c index 76c636f53f..de04aa59a8 100644 --- a/src/packet.c +++ b/src/packet.c @@ -112,7 +112,7 @@ void PacketReinit(Packet *p) PktVarFree(p->pktvar); p->pktvar = NULL; } - p->ethh = NULL; + PacketClearL2(p); PacketClearL3(p); PacketClearL4(p); if (p->tcph != NULL) { diff --git a/src/respond-reject-libnet11.c b/src/respond-reject-libnet11.c index 7b9d34d5a9..f53715654d 100644 --- a/src/respond-reject-libnet11.c +++ b/src/respond-reject-libnet11.c @@ -80,7 +80,7 @@ typedef struct Libnet11Packet_ { uint32_t src4, dst4; uint16_t sp, dp; uint16_t len; - uint8_t *smac, *dmac; + const uint8_t *smac, *dmac; } Libnet11Packet; static inline libnet_t *GetCtx(const Packet *p, int injection_type) @@ -236,15 +236,16 @@ static inline int BuildIPv6(libnet_t *c, Libnet11Packet *lpacket, const uint8_t static inline void SetupEthernet(Packet *p, Libnet11Packet *lpacket, enum RejectDirection dir) { + const EthernetHdr *ethh = PacketGetEthernet(p); switch (dir) { case REJECT_DIR_SRC: - lpacket->smac = p->ethh->eth_dst; - lpacket->dmac = p->ethh->eth_src; + lpacket->smac = ethh->eth_dst; + lpacket->dmac = ethh->eth_src; break; case REJECT_DIR_DST: default: - lpacket->smac = p->ethh->eth_src; - lpacket->dmac = p->ethh->eth_dst; + lpacket->smac = ethh->eth_src; + lpacket->dmac = ethh->eth_dst; break; } } diff --git a/src/runmode-unittests.c b/src/runmode-unittests.c index fb5b4f1bc0..30d2021bfc 100644 --- a/src/runmode-unittests.c +++ b/src/runmode-unittests.c @@ -112,6 +112,7 @@ #include "decode-raw.h" #include "decode-vntag.h" #include "decode-vxlan.h" +#include "decode-pppoe.h" #include "output-json-stats.h" diff --git a/src/source-af-packet.c b/src/source-af-packet.c index 2018fe9eba..bf9602e42c 100644 --- a/src/source-af-packet.c +++ b/src/source-af-packet.c @@ -659,17 +659,18 @@ static void AFPWritePacket(Packet *p, int version) } } - if (p->ethh == NULL) { + if (!PacketIsEthernet(p)) { SCLogWarning("packet should have an ethernet header"); return; } + const EthernetHdr *ethh = PacketGetEthernet(p); /* Index of the network device */ socket_address.sll_ifindex = SC_ATOMIC_GET(p->afp_v.peer->if_idx); /* Address length*/ socket_address.sll_halen = ETH_ALEN; /* Destination MAC */ - memcpy(socket_address.sll_addr, p->ethh, 6); + memcpy(socket_address.sll_addr, ethh, 6); /* Send packet, locking the socket if necessary */ if (p->afp_v.peer->flags & AFP_SOCK_PROTECT) @@ -2684,7 +2685,7 @@ static void UpdateRawDataForVLANHdr(Packet *p) /* update the packet raw data pointer to start at the new offset */ (void)PacketSetData(p, pstart, plen); /* update ethernet header pointer to point to the new start of the data */ - p->ethh = (void *)pstart; + p->l2.hdrs.ethh = (void *)pstart; } } diff --git a/src/tests/detect.c b/src/tests/detect.c index 7a150d4a57..5919e44bc7 100644 --- a/src/tests/detect.c +++ b/src/tests/detect.c @@ -3073,7 +3073,7 @@ static int SigTest38(void) } SET_PKT_LEN(p1, ethlen + ipv4len + tcplen + buflen); - p1->ethh = (EthernetHdr *)raw_eth; + PacketSetEthernet(p1, raw_eth); PacketSetIPV4(p1, raw_ipv4); p1->tcph = (TCPHdr *)raw_tcp; p1->src.family = AF_INET; @@ -3188,7 +3188,7 @@ static int SigTest39(void) FAIL_IF(PacketCopyDataOffset(p1, ethlen + ipv4len + tcplen, buf, buflen) == -1); SET_PKT_LEN(p1, ethlen + ipv4len + tcplen + buflen); - p1->ethh = (EthernetHdr *)raw_eth; + PacketSetEthernet(p1, raw_eth); PacketSetIPV4(p1, raw_ipv4); p1->tcph = (TCPHdr *)raw_tcp; p1->src.family = AF_INET;