From: Josh <jrosenba@cisco.com>
Date: Fri, 3 Oct 2014 16:40:44 +0000 (-0500)
Subject: undoing FlowKey PktType functions
X-Git-Tag: 3.0.0-233~1397^2~19^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7d859690c4ff6fd5f9aae70e13bf15948cd40646;p=thirdparty%2Fsnort3.git

undoing FlowKey PktType functions
---

diff --git a/src/detection/detect.cc b/src/detection/detect.cc
index 8d3e2dafa..d4a38595f 100644
--- a/src/detection/detect.cc
+++ b/src/detection/detect.cc
@@ -327,7 +327,7 @@ bool Detect(Packet * p)
     int curr_layer = p->num_layers - 1;
     uint8_t ip_proto; // set in function
 
-    while (p->ip_proto_next(curr_layer, ip_proto))
+    while (p->get_ip_proto_next(curr_layer, ip_proto))
     {
         if (snort_conf->ip_proto_array[ip_proto])
         {
diff --git a/src/flow/expect_cache.cc b/src/flow/expect_cache.cc
index 0dfa49d5b..c6261009b 100644
--- a/src/flow/expect_cache.cc
+++ b/src/flow/expect_cache.cc
@@ -129,13 +129,13 @@ struct ExpectKey
     bool set(
         const sfip_t *cliIP, uint16_t cliPort,
         const sfip_t *srvIP, uint16_t srvPort,
-        PktType proto);
+        uint8_t proto);
 };
 
 inline bool ExpectKey::set(
     const sfip_t *cliIP, uint16_t cliPort,
     const sfip_t *srvIP, uint16_t srvPort,
-    PktType proto )
+    uint8_t proto )
 {
     bool reverse;
     SFIP_RET rval = sfip_compare(cliIP, srvIP);
@@ -346,7 +346,7 @@ ExpectCache::~ExpectCache ()
 int ExpectCache::add_flow(
     const sfip_t *cliIP, uint16_t cliPort,
     const sfip_t *srvIP, uint16_t srvPort,
-    PktType protocol, char direction,
+    uint8_t protocol, char direction,
     FlowData* fd, int16_t appId)
 {
     assert( !cliPort || !srvPort );
@@ -392,7 +392,7 @@ bool ExpectCache::is_expected(Packet* p)
     const sfip_t *dstIP = p->ptrs.ip_api.get_dst();
 
     ExpectKey key;
-    bool reversed_key = key.set(dstIP, p->ptrs.dp, srcIP, p->ptrs.sp, p->type());
+    bool reversed_key = key.set(dstIP, p->ptrs.dp, srcIP, p->ptrs.sp, p->get_ip_proto_next());
 
     uint16_t port1;
     uint16_t port2;
diff --git a/src/flow/expect_cache.h b/src/flow/expect_cache.h
index c05e3326e..fc2940457 100644
--- a/src/flow/expect_cache.h
+++ b/src/flow/expect_cache.h
@@ -21,7 +21,6 @@
 #ifndef EXPECT_CACHE_H
 #define EXPECT_CACHE_H
 
-#include "framework/codec.h"
 #include "sfip/sfip_t.h"
 
 class FlowData;
@@ -36,7 +35,7 @@ public:
     int add_flow(
         const sfip_t *cliIP, uint16_t cliPort,
         const sfip_t *srvIP, uint16_t srvPort,
-        PktType protocol, char direction,
+        uint8_t protocol, char direction,
         FlowData*, int16_t appId = 0);
 
     bool is_expected(Packet*);
diff --git a/src/flow/flow.h b/src/flow/flow.h
index 7b3d9f66a..c5e9c2b9c 100644
--- a/src/flow/flow.h
+++ b/src/flow/flow.h
@@ -207,7 +207,8 @@ public:  // FIXIT-M privatize if possible
     const FlowKey* key;
     class Session* session;
     StreamFlowData* flowdata;
-    PktType protocol;
+    uint8_t ip_proto; // FIXIT-M  -- do we need both of these?
+    PktType protocol; // ^^
 
     // these fields are always set; not zeroed
     Flow* prev, * next;
diff --git a/src/flow/flow_control.cc b/src/flow/flow_control.cc
index 3adbb0b5a..d13dcd81f 100644
--- a/src/flow/flow_control.cc
+++ b/src/flow/flow_control.cc
@@ -70,14 +70,14 @@ static THREAD_LOCAL PegCount udp_count = 0;
 static THREAD_LOCAL PegCount icmp_count = 0;
 static THREAD_LOCAL PegCount ip_count = 0;
 
-PegCount FlowControl::get_flow_count(PktType proto)
+PegCount FlowControl::get_flow_count(uint8_t proto)
 {
     switch ( proto )
     {
-    case PktType::TCP:  return tcp_count;
-    case PktType::UDP:  return udp_count;
-    case PktType::ICMP: return icmp_count;
-    case PktType::IP:   return ip_count;
+    case IPPROTO_TCP:  return tcp_count;
+    case IPPROTO_UDP:  return udp_count;
+    case IPPROTO_ICMP: return icmp_count;
+    case IPPROTO_IP:   return ip_count;
     default:            return 0;
     }
 }
@@ -92,15 +92,15 @@ void FlowControl::clear_flow_counts()
 // cache foo
 //-------------------------------------------------------------------------
 
-inline FlowCache* FlowControl::get_cache (PktType proto)
+inline FlowCache* FlowControl::get_cache (uint8_t proto)
 {
     switch ( proto )
     {
-    case PktType::TCP:  return tcp_cache;
-    case PktType::UDP:  return udp_cache;
-    case PktType::ICMP: return icmp_cache;
-    case PktType::IP:   return ip_cache;
-    default:            return nullptr;
+    case IPPROTO_TCP:    return tcp_cache;
+    case IPPROTO_UDP:    return udp_cache;
+    case IPPROTO_ICMP:   return icmp_cache;
+    case IPPROTO_IP:     return ip_cache;
+    default:              return nullptr;
     }
 }
 
@@ -141,13 +141,13 @@ void FlowControl::delete_flow (const FlowKey* key)
 
 void FlowControl::delete_flow (Flow* flow, const char* why)
 {
-    FlowCache* cache = get_cache(flow->protocol);
+    FlowCache* cache = get_cache(flow->ip_proto);
 
     if ( cache )
         cache->release(flow, why);
 }
 
-void FlowControl::purge_flows (PktType proto)
+void FlowControl::purge_flows (uint8_t proto)
 {
     FlowCache* cache = get_cache(proto);
 
@@ -155,7 +155,7 @@ void FlowControl::purge_flows (PktType proto)
         cache->purge();
 }
 
-void FlowControl::prune_flows (PktType proto, Packet* p)
+void FlowControl::prune_flows (uint8_t proto, Packet* p)
 {
     FlowCache* cache = get_cache(proto);
 
@@ -189,7 +189,7 @@ void FlowControl::timeout_flows(uint32_t flowCount, time_t cur_time)
     Active_Resume();
 }
 
-uint32_t FlowControl::max_flows(PktType proto)
+uint32_t FlowControl::max_flows(uint8_t proto)
 {
     FlowCache* cache = get_cache(proto);
 
@@ -199,7 +199,7 @@ uint32_t FlowControl::max_flows(PktType proto)
     return 0;
 }
 
-void FlowControl::get_prunes (PktType proto, PegCount& prunes)
+void FlowControl::get_prunes (uint8_t proto, PegCount& prunes)
 {
     FlowCache* cache = get_cache(proto);
 
@@ -207,7 +207,7 @@ void FlowControl::get_prunes (PktType proto, PegCount& prunes)
         prunes = cache->get_prunes();
 }
 
-void FlowControl::reset_prunes (PktType proto)
+void FlowControl::reset_prunes (uint8_t proto)
 {
     FlowCache* cache = get_cache(proto);
 
@@ -225,7 +225,7 @@ void FlowControl::set_key(FlowKey* key, Packet* p)
     uint32_t mplsId;
     uint16_t vlanId;
     uint16_t addressSpaceId;
-    PktType proto = p->type();
+    uint8_t proto = p->get_ip_proto_next();
 
     if ( p->proto_bits & PROTO_BIT__VLAN )
         vlanId = layer::get_vlan_layer(p)->vid();
@@ -248,16 +248,11 @@ void FlowControl::set_key(FlowKey* key, Packet* p)
         key->init(ip_api.get_src(), ip_api.get_dst(), ip_api.id(),
             proto, vlanId, mplsId, addressSpaceId);
     }
-    else if (proto == PktType::ICMP)
+    else if (proto == IPPROTO_ICMP)
     {
         key->init(ip_api.get_src(), p->ptrs.icmph->type, ip_api.get_dst(), 0,
             proto, vlanId, mplsId, addressSpaceId);
     }
-    else if (proto == PktType::IP)
-    {
-        key->init(ip_api.get_src(), ip_api.proto(), ip_api.get_dst(), p->ptrs.dp,
-            proto, vlanId, mplsId, addressSpaceId);
-    }
     else
     {
         key->init(ip_api.get_src(), p->ptrs.sp, ip_api.get_dst(), p->ptrs.dp,
@@ -548,7 +543,7 @@ char FlowControl::expected_flow (Flow* flow, Packet* p)
 int FlowControl::add_expected(
     const sfip_t *srcIP, uint16_t srcPort,
     const sfip_t *dstIP, uint16_t dstPort,
-    PktType protocol, char direction,
+    uint8_t protocol, char direction,
     FlowData* fd)
 {
     return exp_cache->add_flow(
@@ -558,7 +553,7 @@ int FlowControl::add_expected(
 int FlowControl::add_expected(
     const sfip_t *srcIP, uint16_t srcPort,
     const sfip_t *dstIP, uint16_t dstPort,
-    PktType protocol, int16_t appId,
+    uint8_t protocol, int16_t appId,
     FlowData* fd)
 {
     return exp_cache->add_flow(
diff --git a/src/flow/flow_control.h b/src/flow/flow_control.h
index cc81f551d..20c5b91c5 100644
--- a/src/flow/flow_control.h
+++ b/src/flow/flow_control.h
@@ -57,8 +57,8 @@ public:
 
     void delete_flow(const FlowKey*);
     void delete_flow(Flow*, const char* why);
-    void purge_flows(PktType proto);
-    void prune_flows(PktType proto, Packet*);
+    void purge_flows(uint8_t proto);
+    void prune_flows(uint8_t proto, Packet*);
     void timeout_flows(uint32_t flowCount, time_t cur_time);
 
     char expected_flow (Flow*, Packet*);
@@ -67,24 +67,24 @@ public:
     int add_expected(
         const sfip_t *srcIP, uint16_t srcPort,
         const sfip_t *dstIP, uint16_t dstPort,
-        PktType protocol, char direction,
+        uint8_t protocol, char direction,
         FlowData*);
 
     int add_expected(
         const sfip_t *srcIP, uint16_t srcPort,
         const sfip_t *dstIP, uint16_t dstPort,
-        PktType protocol, int16_t appId,
+        uint8_t protocol, int16_t appId,
         FlowData*);
 
-    uint32_t max_flows(PktType proto);
-    void get_prunes(PktType proto, PegCount&);
-    void reset_prunes(PktType proto);
+    uint32_t max_flows(uint8_t proto);
+    void get_prunes(uint8_t proto, PegCount&);
+    void reset_prunes(uint8_t proto);
 
-    PegCount get_flow_count(PktType);
+    PegCount get_flow_count(uint8_t);
     void clear_flow_counts();
 
 private:
-    class FlowCache* get_cache(PktType);
+    class FlowCache* get_cache(uint8_t);
     void set_key(FlowKey*, Packet*);
 
     unsigned process(FlowCache*, Packet*);
diff --git a/src/flow/flow_key.cc b/src/flow/flow_key.cc
index e5ec3136f..3d834cc90 100644
--- a/src/flow/flow_key.cc
+++ b/src/flow/flow_key.cc
@@ -39,12 +39,12 @@
 inline void FlowKey::init4(
     const sfip_t *srcIP, uint16_t srcPort,
     const sfip_t *dstIP, uint16_t dstPort,
-    PktType proto, uint32_t mplsId, bool order)
+    uint8_t proto, uint32_t mplsId, bool order)
 {
     const uint32_t *src;
     const uint32_t *dst;
 
-    if ( proto ==  PktType::ICMP )
+    if ( proto ==  IPPROTO_ICMP )
     {
         if (srcPort == ICMP_ECHOREPLY)
         {
@@ -100,31 +100,11 @@ inline void FlowKey::init4(
 inline void FlowKey::init6(
     const sfip_t *srcIP, uint16_t srcPort,
     const sfip_t *dstIP, uint16_t dstPort,
-    PktType proto, uint32_t mplsId, bool order)
+    uint8_t proto, uint32_t mplsId, bool order)
 {
     const sfip_t *src;
     const sfip_t *dst;
 
-    if (proto == PktType::ICMP)
-    {
-        // FIXIT-M J  Need to determine specific protocol
-        if ( srcPort == ICMP_ECHOREPLY )
-        {
-            dstPort = ICMP_ECHO; /* Treat ICMP echo reply the same as request */
-            srcPort = 0;
-        }
-        else if (srcPort == icmp::Icmp6Types::REPLY_6)
-        {
-            dstPort = icmp::Icmp6Types::ECHO_6; /* Treat ICMPv6 echo reply the same as request */
-            srcPort = 0;
-        }
-        else /* otherwise, every ICMP type gets different key */
-        {
-            dstPort = 0;
-        }
-    }
-
-#if 0 /* FIXIT-M J  Delete after this has been proven to work */
     if ( proto == IPPROTO_ICMP )
     {
             if (srcPort == ICMP_ECHOREPLY)
@@ -149,7 +129,6 @@ inline void FlowKey::init6(
             dstPort = 0;
         }
     }
-#endif
 
     src = srcIP;
     dst = dstIP;
@@ -193,7 +172,7 @@ inline void FlowKey::init6(
 void FlowKey::init(
     const sfip_t *srcIP, uint16_t srcPort,
     const sfip_t *dstIP, uint16_t dstPort,
-    PktType proto, uint16_t vlan,
+    uint8_t proto, uint16_t vlan,
     uint32_t mplsId, uint16_t addrSpaceId)
 {
     /* Because the key is going to be used for hash lookups,
@@ -229,7 +208,7 @@ void FlowKey::init(
 
 void FlowKey::init(
     const sfip_t *srcIP, const sfip_t *dstIP,
-    uint32_t id, PktType proto, uint16_t vlan,
+    uint32_t id, uint8_t proto, uint16_t vlan,
     uint32_t mplsId, uint16_t addrSpaceId)
 {
     // to avoid confusing 2 different datagrams or confusing a datagram
@@ -246,7 +225,7 @@ void FlowKey::init(
     else
     {
         version = 6;
-        protocol = PktType::UNKNOWN;
+        protocol = 0;
         init6(srcIP, srcPort, dstIP, dstPort, proto, mplsId, false);
     }
 
diff --git a/src/flow/flow_key.h b/src/flow/flow_key.h
index e881cb21a..055ab84e9 100644
--- a/src/flow/flow_key.h
+++ b/src/flow/flow_key.h
@@ -26,7 +26,6 @@
 #include "main/snort_types.h"
 #include "hash/sfhashfcn.h"
 #include "sfip/sfip_t.h"
-#include "framework/codec.h"
 
 struct FlowKey
 {
@@ -35,7 +34,7 @@ struct FlowKey
     uint16_t   port_l; /* Low Port - 0 if ICMP */
     uint16_t   port_h; /* High Port - 0 if ICMP */
     uint16_t   vlan_tag;
-    PktType    protocol;
+    uint8_t    protocol;
     uint8_t    version;
     uint32_t   mplsLabel; /* MPLS label */
     uint16_t   addressSpaceId;
@@ -44,12 +43,12 @@ struct FlowKey
     void init(
         const sfip_t *srcIP, uint16_t srcPort,
         const sfip_t *dstIP, uint16_t dstPort,
-        PktType proto, uint16_t vlan,
+        uint8_t proto, uint16_t vlan,
         uint32_t mplsId, uint16_t addrSpaceId);
 
     void init(
         const sfip_t *srcIP, const sfip_t *dstIP,
-        uint32_t id, PktType proto, uint16_t vlan,
+        uint32_t id, uint8_t proto, uint16_t vlan,
         uint32_t mplsId, uint16_t addrSpaceId);
 
     // XXX If this data structure changes size, compare must be updated!
@@ -60,12 +59,12 @@ private:
     void init4(
         const sfip_t *srcIP, uint16_t srcPort,
         const sfip_t *dstIP, uint16_t dstPort,
-        PktType proto, uint32_t mplsId, bool order = true);
+        uint8_t proto, uint32_t mplsId, bool order = true);
 
     void init6(
         const sfip_t *srcIP, uint16_t srcPort,
         const sfip_t *dstIP, uint16_t dstPort,
-        PktType proto, uint32_t mplsId, bool order = true);
+        uint8_t proto, uint32_t mplsId, bool order = true);
 
 };
 
diff --git a/src/ips_options/ips_ip_proto.cc b/src/ips_options/ips_ip_proto.cc
index 719ba37b7..e947e1c03 100644
--- a/src/ips_options/ips_ip_proto.cc
+++ b/src/ips_options/ips_ip_proto.cc
@@ -132,7 +132,7 @@ int IpProtoOption::eval(Cursor&, Packet *p)
 
     MODULE_PROFILE_START(ipProtoPerfStats);
 
-    const uint8_t ip_proto = p->ip_proto_next();
+    const uint8_t ip_proto = p->get_ip_proto_next();
 
     switch (ipd->comparison_flag)
     {
diff --git a/src/loggers/alert_fast.cc b/src/loggers/alert_fast.cc
index 3780d1f0e..ac15d5bb7 100644
--- a/src/loggers/alert_fast.cc
+++ b/src/loggers/alert_fast.cc
@@ -241,7 +241,7 @@ void FastLogger::alert(Packet *p, const char *msg, Event *event)
     if (p->has_ip())
     {
         LogPriorityData(fast_log, event, 0);
-        TextLog_Print(fast_log, "{%s} ", protocol_names[p->ip_proto_next()]);
+        TextLog_Print(fast_log, "{%s} ", protocol_names[p->get_ip_proto_next()]);
         LogIpAddrs(fast_log, p);
     }
 
diff --git a/src/loggers/alert_sf_socket.cc b/src/loggers/alert_sf_socket.cc
index 443d37a7b..0a9f55a8d 100644
--- a/src/loggers/alert_sf_socket.cc
+++ b/src/loggers/alert_sf_socket.cc
@@ -316,7 +316,7 @@ void load_sar(Packet *packet, Event *event, SnortActionRequest& sar)
     //   and only 1st 8 used for ip4
     sar.src_ip =  ntohl(packet->ptrs.ip_api.get_src()->ip32[0]);
     sar.dest_ip = ntohl(packet->ptrs.ip_api.get_dst()->ip32[0]);
-    sar.protocol = packet->ip_proto_next();
+    sar.protocol = packet->get_ip_proto_next();
 
     if(packet->is_tcp() || packet->is_udp())
     {
diff --git a/src/loggers/alert_syslog.cc b/src/loggers/alert_syslog.cc
index a14d823fa..2d29746e6 100644
--- a/src/loggers/alert_syslog.cc
+++ b/src/loggers/alert_syslog.cc
@@ -241,7 +241,7 @@ static void AlertSyslog(
                     "<%s> ", PRINT_INTERFACE(DAQ_GetInterfaceSpec()));
         }
 
-        uint16_t proto = p->ip_proto_next();
+        uint16_t proto = p->get_ip_proto_next();
         if (protocol_names[proto] != NULL)
         {
             SnortSnprintfAppend(event_string, sizeof(event_string),
diff --git a/src/loggers/unified2.cc b/src/loggers/unified2.cc
index 9f1f4ecbd..e004fe8cb 100644
--- a/src/loggers/unified2.cc
+++ b/src/loggers/unified2.cc
@@ -272,7 +272,7 @@ static void _AlertIP4_v2(Packet *p, const char*, Unified2Config *config, Event *
             }
             else
             {
-                alertdata.protocol = p->ip_proto_next();
+                alertdata.protocol = p->get_ip_proto_next();
 
                 if ( p->type() == PktType::ICMP)
                 {
@@ -383,7 +383,7 @@ static void _AlertIP6_v2(Packet *p, const char*, Unified2Config *config, Event *
             }
             else
             {
-                alertdata.protocol = p->ip_proto_next();
+                alertdata.protocol = p->get_ip_proto_next();
 
                 if ( p->type() == PktType::ICMP)
                 {
diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc
index 965160dea..893e8a719 100644
--- a/src/network_inspectors/port_scan/port_scan.cc
+++ b/src/network_inspectors/port_scan/port_scan.cc
@@ -377,7 +377,7 @@ static int MakePortscanPkt(PS_PKT *ps_pkt, PS_PROTO *proto, int proto_type,
             g_tmp_pkt->ps_proto = IPPROTO_IP;
             break;
         case PS_PROTO_OPEN_PORT:
-            g_tmp_pkt->ps_proto = p->ip_proto_next();
+            g_tmp_pkt->ps_proto = p->get_ip_proto_next();
             break;
         default:
             return -1;
diff --git a/src/protocols/packet.cc b/src/protocols/packet.cc
index cdeb31e7a..78f0bde9a 100644
--- a/src/protocols/packet.cc
+++ b/src/protocols/packet.cc
@@ -42,7 +42,7 @@ static inline bool is_ip_protocol(const uint16_t proto)
         return false;
     }
 }
-
+#if 0
 uint8_t Packet::ip_proto_next() const
 {
     if (is_ip4())
@@ -78,8 +78,9 @@ uint8_t Packet::ip_proto_next() const
 
     return IPPROTO_ID_RESERVED;
 }
+#endif
 
-bool Packet::ip_proto_next(int &lyr, uint8_t& proto) const
+bool Packet::get_ip_proto_next(int &lyr, uint8_t& proto) const
 {
     if (lyr < 0)
         return false;
diff --git a/src/protocols/packet.h b/src/protocols/packet.h
index 822689619..2df8449de 100644
--- a/src/protocols/packet.h
+++ b/src/protocols/packet.h
@@ -153,6 +153,7 @@ struct SO_PUBLIC Packet
 
     uint16_t alt_dsize;         /* the dsize of a packet before munging (used for log)*/
     uint8_t num_layers;         /* index into layers for next encap */
+    uint8_t ip_proto_next; /* the protocol ID after IP and all IP6 extension */
 
 
     // nothing after this point is zeroed ...
@@ -216,7 +217,8 @@ struct SO_PUBLIC Packet
      *     eth::ip4::udp::teredo::ip6::hop_opts::ipv6_routing::tcp
      * this function return 6 == IPPROTO_TCP == IPPROTO_ID_TCP
      */
-    uint8_t ip_proto_next() const;
+    inline uint8_t get_ip_proto_next() const
+    { return ip_proto_next; }
 
     /* Similar to above. However, this function
      * can be called in a loop to get all of the ip_proto's.
@@ -234,7 +236,7 @@ struct SO_PUBLIC Packet
      *    ....
      * }
      */
-    bool ip_proto_next(int &lyr, uint8_t& proto) const;
+    bool get_ip_proto_next(int &lyr, uint8_t& proto) const;
 
     inline void reset()
     {
diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc
index 7d6aeed30..cf74cf542 100644
--- a/src/protocols/packet_manager.cc
+++ b/src/protocols/packet_manager.cc
@@ -224,7 +224,10 @@ void PacketManager::decode(
         }
 
         if (codec_data.proto_bits & (PROTO_BIT__IP | PROTO_BIT__IP6_EXT))
+        {
             fpEvalIpProtoOnlyRules(p, codec_data.next_prot_id);
+            p->ip_proto_next = codec_data.next_prot_id;
+        }
 
         // internal statistics and record keeping
         push_layer(p, prev_prot_id, raw.data, codec_data.lyr_len);
diff --git a/src/service_inspectors/ftp_telnet/pp_ftp.cc b/src/service_inspectors/ftp_telnet/pp_ftp.cc
index 985f0fc83..406e2e138 100644
--- a/src/service_inspectors/ftp_telnet/pp_ftp.cc
+++ b/src/service_inspectors/ftp_telnet/pp_ftp.cc
@@ -1147,7 +1147,7 @@ static int do_stateful_checks(FTP_SESSION *session, Packet *p,
                                 result = stream.set_application_protocol_id_expected(
                                     &session->clientIP, session->clientPort,
                                     &session->serverIP, session->serverPort,
-                                    p->type(), ftp_data_app_id, fd);
+                                    p->get_ip_proto_next(), ftp_data_app_id, fd);
 
                                 if (result < 0)
                                     delete fd;
@@ -1159,7 +1159,7 @@ static int do_stateful_checks(FTP_SESSION *session, Packet *p,
                                 stream.ignore_session(
                                     &session->clientIP, session->clientPort,
                                     &session->serverIP, session->serverPort,
-                                    p->type(), FtpDataFlowData::flow_id,
+                                    p->get_ip_proto_next(), FtpDataFlowData::flow_id,
                                     SSN_DIR_BOTH);
                             }
                         }
@@ -1218,7 +1218,7 @@ static int do_stateful_checks(FTP_SESSION *session, Packet *p,
                             result = stream.set_application_protocol_id_expected(
                                 &session->clientIP, session->clientPort,
                                 &session->serverIP, session->serverPort,
-                                p->type(), ftp_data_app_id, fd);
+                                p->get_ip_proto_next(), ftp_data_app_id, fd);
 
                             if (result < 0)
                                 delete fd;
@@ -1230,7 +1230,7 @@ static int do_stateful_checks(FTP_SESSION *session, Packet *p,
                             stream.ignore_session(
                                 &session->clientIP, session->clientPort,
                                 &session->serverIP, session->serverPort,
-                                p->type(), FtpDataFlowData::flow_id,
+                                p->get_ip_proto_next(), FtpDataFlowData::flow_id,
                                 SSN_DIR_BOTH);
                         }
                     }
diff --git a/src/stream/base/stream_base.cc b/src/stream/base/stream_base.cc
index 1738f6849..0310bbe49 100644
--- a/src/stream/base/stream_base.cc
+++ b/src/stream/base/stream_base.cc
@@ -80,10 +80,10 @@ static const char* base_pegs[] =
 
 void base_sum()
 {   
-    t_stats.tcp = flow_con->get_flow_count(PktType::TCP);
-    t_stats.udp = flow_con->get_flow_count(PktType::UDP);
-    t_stats.icmp = flow_con->get_flow_count(PktType::ICMP);
-    t_stats.ip = flow_con->get_flow_count(PktType::IP);
+    t_stats.tcp = flow_con->get_flow_count(IPPROTO_TCP);
+    t_stats.udp = flow_con->get_flow_count(IPPROTO_UDP);
+    t_stats.icmp = flow_con->get_flow_count(IPPROTO_ICMP);
+    t_stats.ip = flow_con->get_flow_count(IPPROTO_IP);
 
     sum_stats((PegCount*)&g_stats, (PegCount*)&t_stats,
         array_size(base_pegs));
@@ -184,10 +184,10 @@ void StreamBase::tinit()
 
 void StreamBase::tterm()
 {
-    flow_con->purge_flows(PktType::TCP);
-    flow_con->purge_flows(PktType::UDP);
-    flow_con->purge_flows(PktType::ICMP);
-    flow_con->purge_flows(PktType::IP);
+    flow_con->purge_flows(IPPROTO_TCP);
+    flow_con->purge_flows(IPPROTO_UDP);
+    flow_con->purge_flows(IPPROTO_ICMP);
+    flow_con->purge_flows(IPPROTO_IP);
 
     delete flow_con;
     flow_con = nullptr;
diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc
index 56d88821d..8e40d0186 100644
--- a/src/stream/icmp/icmp_session.cc
+++ b/src/stream/icmp/icmp_session.cc
@@ -93,7 +93,7 @@ static int ProcessIcmpUnreach(Packet *p)
     /* Get IP/TCP/UDP/ICMP session from original protocol/port info
      * embedded in the ICMP Unreach message.
      */
-    skey.protocol = p->type();
+    skey.protocol = p->get_ip_proto_next();
     src = iph.get_src();
     dst = iph.get_dst();
 
@@ -154,7 +154,7 @@ static int ProcessIcmpUnreach(Packet *p)
     else
         skey.vlan_tag = 0;
 
-    switch (skey.protocol)
+    switch (p->type())
     {
     case PktType::TCP:
         /* Lookup a TCP session */
@@ -268,6 +268,6 @@ void icmp_stats()
 void icmp_reset()
 {
     memset(&icmpStats, 0, sizeof(icmpStats));
-    flow_con->reset_prunes(PktType::ICMP);
+    flow_con->reset_prunes(IPPROTO_ICMP);
 }
 
diff --git a/src/stream/ip/ip_defrag.cc b/src/stream/ip/ip_defrag.cc
index a71802cb9..6a46fb096 100644
--- a/src/stream/ip/ip_defrag.cc
+++ b/src/stream/ip/ip_defrag.cc
@@ -1366,7 +1366,7 @@ void Defrag::process(Packet* p, FragTracker* ft)
      *    a rebuilt packet later.  So don't process it further.
      */
     if ((frag_offset != 0) ||
-        ((p->ip_proto_next() != IPPROTO_UDP) && (p->ptrs.decode_flags & DECODE_MF)))
+        ((p->get_ip_proto_next() != IPPROTO_UDP) && (p->ptrs.decode_flags & DECODE_MF)))
     {
         DisableDetect(p);
     }
@@ -1503,7 +1503,7 @@ void Defrag::process(Packet* p, FragTracker* ft)
             FragRebuild(ft, p);
 
             if (frag_offset != 0 ||
-                (p->ip_proto_next() != IPPROTO_UDP && ft->frag_flags & FRAG_REBUILT))
+                (p->get_ip_proto_next() != IPPROTO_UDP && ft->frag_flags & FRAG_REBUILT))
             {
                 /* Need to reset some things here because the
                  * rebuilt packet will have reset the do_detect
@@ -2357,7 +2357,7 @@ int Defrag::new_tracker(Packet *p, FragTracker* ft)
     {
         if(mem_in_use > FRAG_MEMCAP)
         {
-            flow_con->prune_flows(PktType::IP, p);
+            flow_con->prune_flows(IPPROTO_IP, p);
         }
 
         f = (Fragment *) SnortAlloc(sizeof(Fragment));
@@ -2506,7 +2506,7 @@ int Defrag::add_frag_node(FragTracker *ft,
     {
         if(mem_in_use > FRAG_MEMCAP)
         {
-            flow_con->prune_flows(PktType::IP, p);
+            flow_con->prune_flows(IPPROTO_IP, p);
         }
 
         /*
@@ -2593,7 +2593,7 @@ int Defrag::dup_frag_node(
     {
         if(mem_in_use > FRAG_MEMCAP)
         {
-            flow_con->prune_flows(PktType::IP, p);
+            flow_con->prune_flows(IPPROTO_IP, p);
         }
 
         /*
diff --git a/src/stream/stream_api.cc b/src/stream/stream_api.cc
index ac0c0c624..e5ef7ef16 100644
--- a/src/stream/stream_api.cc
+++ b/src/stream/stream_api.cc
@@ -91,7 +91,7 @@ void Stream::delete_session(const FlowKey* key)
 Flow* Stream::get_session_ptr_from_ip_port(
     const sfip_t *srcIP, uint16_t srcPort,
     const sfip_t *dstIP, uint16_t dstPort,
-    PktType ip_protocol, uint16_t vlan, uint32_t mplsId,
+    uint8_t ip_protocol, uint16_t vlan, uint32_t mplsId,
     uint16_t addressSpaceId)
 {
     FlowKey key;
@@ -115,7 +115,7 @@ void Stream::populate_session_key(Packet *p, FlowKey *key)
     key->init(
         p->ptrs.ip_api.get_src(), p->ptrs.sp,
         p->ptrs.ip_api.get_dst(), p->ptrs.dp,
-        p->type(),
+        p->get_ip_proto_next(),
         // if the vlan protocol bit is defined, vlan layer gauranteed to exist
         (p->proto_bits & PROTO_BIT__VLAN) ? layer::get_vlan_layer(p)->vid() : 0,
         (p->proto_bits & PROTO_BIT__MPLS) ? p->ptrs.mplsHdr.label : 0,
@@ -148,7 +148,7 @@ FlowData* Stream::get_application_data_from_key(
 FlowData* Stream::get_application_data_from_ip_port(
     const sfip_t *srcIP, uint16_t srcPort,
     const sfip_t *dstIP, uint16_t dstPort,
-    PktType ip_protocol, uint16_t vlan, uint32_t mplsId,
+    uint8_t ip_protocol, uint16_t vlan, uint32_t mplsId,
     uint16_t addressSpaceID, unsigned flow_id)
 {
     Flow* flow;
@@ -182,7 +182,7 @@ void Stream::check_session_closed(Packet* p)
 int Stream::ignore_session(
     const sfip_t *srcIP, uint16_t srcPort,
     const sfip_t *dstIP, uint16_t dstPort,
-    PktType protocol, char direction,
+    uint8_t protocol, char direction,
     uint32_t flow_id)
 {
     assert(flow_con);
@@ -376,7 +376,7 @@ void Stream::init_active_response(Packet* p, Flow* flow)
 int Stream::set_application_protocol_id_expected(
     const sfip_t *srcIP, uint16_t srcPort,
     const sfip_t *dstIP, uint16_t dstPort,
-    PktType protocol, int16_t appId,
+    uint8_t protocol, int16_t appId,
     FlowData* fd) 
 {
     assert(flow_con);
diff --git a/src/stream/stream_api.h b/src/stream/stream_api.h
index f943345e6..5dc67cb62 100644
--- a/src/stream/stream_api.h
+++ b/src/stream/stream_api.h
@@ -113,7 +113,7 @@ public:
      */
     int ignore_session(
         const sfip_t *addr1, uint16_t p1, const sfip_t *addr2, uint16_t p2,
-        PktType proto, char dir, uint32_t ppId);
+        uint8_t proto, char dir, uint32_t ppId);
 
     /* Resume inspection for session.
      */
@@ -241,7 +241,7 @@ public:
      *     -1 on failure
      */
     int set_application_protocol_id_expected(
-        const sfip_t *a1, uint16_t p1, const sfip_t *a2, uint16_t p2, PktType proto,
+        const sfip_t *a1, uint16_t p1, const sfip_t *a2, uint16_t p2, uint8_t proto,
         int16_t appId, FlowData*);
 
     /** Retrieve application session data based on the lookup tuples for
@@ -252,7 +252,7 @@ public:
      *     Application Data reference (pointer)
      */
     static FlowData* get_application_data_from_ip_port(
-        const sfip_t *a1, uint16_t p1, const sfip_t *a2, uint16_t p2, PktType proto,
+        const sfip_t *a1, uint16_t p1, const sfip_t *a2, uint16_t p2, uint8_t    proto,
         uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId, unsigned flow_id);
 
     /*  Get the application data from the session key
@@ -276,7 +276,7 @@ public:
      *     Stream session pointer
      */
     static Flow* get_session_ptr_from_ip_port(
-        const sfip_t *a1, uint16_t p1, const sfip_t *a2, uint16_t p2, PktType proto,
+        const sfip_t *a1, uint16_t p1, const sfip_t *a2, uint16_t p2, uint8_t proto,
         uint16_t vlanId, uint32_t mplsId, uint16_t addrSpaceId);
 
     /* Delete the session if it is in the closed session state.
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index b3bd84ee0..e5dee3541 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -3028,7 +3028,7 @@ static inline StreamSegment* SegmentAlloc (
             tcp_memcap->dealloc(size);
             return NULL;
         }
-        flow_con->prune_flows(PktType::TCP, p);
+        flow_con->prune_flows(IPPROTO_TCP, p);
     }
 
     ss = (StreamSegment*)SnortAlloc(size);
@@ -6760,7 +6760,7 @@ int TcpSession::process(Packet *p)
 
 void tcp_reset()
 {
-    flow_con->reset_prunes(PktType::TCP);
+    flow_con->reset_prunes(IPPROTO_TCP);
 }
 
 void tcp_show(StreamTcpConfig* tcp_config)
diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc
index d452b70ae..0fd90d412 100644
--- a/src/stream/udp/udp_session.cc
+++ b/src/stream/udp/udp_session.cc
@@ -237,6 +237,6 @@ void udp_stats()
 
 void udp_reset()
 {
-    flow_con->reset_prunes(PktType::UDP);
+    flow_con->reset_prunes(IPPROTO_UDP);
 }