From: russ <russ@localhost.localdomain>
Date: Wed, 21 Oct 2015 16:26:07 +0000 (-0400)
Subject: revert packet manager change for gtp and have the gtp codec track multi encap with... 
X-Git-Tag: 3.0.0-233~776
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5f95dfb57a72dc0c33d2452d242aa84ef347fa44;p=thirdparty%2Fsnort3.git

revert packet manager change for gtp and have the gtp codec track multi encap with decode flags instead
---

diff --git a/src/codecs/misc/cd_gtp.cc b/src/codecs/misc/cd_gtp.cc
index 709678f4a..636916d08 100644
--- a/src/codecs/misc/cd_gtp.cc
+++ b/src/codecs/misc/cd_gtp.cc
@@ -85,7 +85,7 @@ void GtpCodec::get_protocol_ids(std::vector<uint16_t>& v)
     v.push_back(PROTO_GTP);
 }
 
-bool GtpCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
+bool GtpCodec::decode(const RawData& raw, CodecData& codec, DecodeData& dd)
 {
     uint8_t next_hdr_type;
     uint8_t version;
@@ -191,11 +191,12 @@ bool GtpCodec::decode(const RawData& raw, CodecData& codec, DecodeData&)
         Active::set_tunnel_bypass();
 
     codec.lyr_len = len;
+    codec.proto_bits |= PROTO_BIT__GTP;
 
-    if ( codec.proto_bits & PROTO_BIT__GTP )
+    if ( dd.decode_flags & DECODE_GTP )
         codec_event(codec, DECODE_GTP_MULTIPLE_ENCAPSULATION);
     else
-        codec.proto_bits |= PROTO_BIT__GTP;
+        dd.decode_flags |= DECODE_GTP;
 
     if (raw.len > 0)
     {
diff --git a/src/framework/decode_data.h b/src/framework/decode_data.h
index 0541be14b..5a203945f 100644
--- a/src/framework/decode_data.h
+++ b/src/framework/decode_data.h
@@ -80,6 +80,7 @@ enum DecodeFlags : std::uint16_t
     DECODE_C2S =            0x0100,  // user - client to server
     DECODE_SOF =            0x0200,  // user - start of flow
     DECODE_EOF =            0x0400,  // user - end of flow
+    DECODE_GTP =            0x0800,  // gtp encap
 };
 
 // FIXIT-L make this an enum!!
diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc
index e5c469b61..844190009 100644
--- a/src/protocols/packet_manager.cc
+++ b/src/protocols/packet_manager.cc
@@ -272,9 +272,11 @@ void PacketManager::decode(
         assert(curr_lyr_len <= raw.len);
         raw.len -= curr_lyr_len;
         raw.data += curr_lyr_len;
+        p->proto_bits |= codec_data.proto_bits;
         codec_data.next_prot_id = FINISHED_DECODE;
         codec_data.lyr_len = 0;
         codec_data.invalid_bytes = 0;
+        codec_data.proto_bits = 0;
     }
 
     DebugFormat(DEBUG_DECODE, "Codec %s (protocol_id: %hu: ip header"