From: Josh <jrosenba@cisco.com>
Date: Tue, 4 Nov 2014 21:44:43 +0000 (-0600)
Subject: tweaking a Packet function so it makes logical sense
X-Git-Tag: 3.0.0-233~1265^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=86a4168ca99714f354d1fa8d048b35788baee852;p=thirdparty%2Fsnort3.git

tweaking a Packet function so it makes logical sense
---

diff --git a/src/detection/detect.cc b/src/detection/detect.cc
index 9f548740f..435aee7fb 100644
--- a/src/detection/detect.cc
+++ b/src/detection/detect.cc
@@ -323,7 +323,7 @@ bool Detect(Packet * p)
     //          Instead, we should only perform detect on that
     //          layer!!
 
-    int curr_layer = p->num_layers - 1;
+    uint8_t curr_layer = 0;
     uint8_t ip_proto; // set in function
 
     while (p->get_ip_proto_next(curr_layer, ip_proto))
diff --git a/src/protocols/layer.cc b/src/protocols/layer.cc
index 2ff30e898..c7983cf7a 100644
--- a/src/protocols/layer.cc
+++ b/src/protocols/layer.cc
@@ -81,24 +81,6 @@ static inline const uint8_t* find_inner_layer(const Layer* lyr,
     return nullptr;
 }
 
-static inline bool is_ip6_extension(const uint8_t proto)
-{
-    switch(proto)
-    {
-    case IPPROTO_ID_HOPOPTS:
-    case IPPROTO_ID_DSTOPTS:
-    case IPPROTO_ID_ROUTING:
-    case IPPROTO_ID_FRAGMENT:
-    case IPPROTO_ID_AUTH:
-    case IPPROTO_ID_ESP:
-    case IPPROTO_ID_MOBILITY:
-    case IPPROTO_ID_NONEXT:
-        return true;
-    default:
-        return false;
-    }
-}
-
 void set_packet_pointer(const Packet* const curr_pkt)
 { p = curr_pkt; }
 
diff --git a/src/protocols/packet.cc b/src/protocols/packet.cc
index 971d53184..3a2c65c6a 100644
--- a/src/protocols/packet.cc
+++ b/src/protocols/packet.cc
@@ -22,27 +22,6 @@
 #include "protocols/protocol_ids.h"
 
 
-static inline bool is_ip_protocol(const uint16_t proto)
-{
-    switch(proto)
-    {
-    case IPPROTO_ID_HOPOPTS:
-    case IPPROTO_ID_DSTOPTS:
-    case IPPROTO_ID_ROUTING:
-    case IPPROTO_ID_FRAGMENT:
-    case IPPROTO_ID_AUTH:
-    case IPPROTO_ID_ESP:
-    case IPPROTO_ID_MOBILITY:
-    case IPPROTO_ID_IPIP:
-    case IPPROTO_ID_IPV6:
-    case ETHERTYPE_IPV4:
-    case ETHERTYPE_IPV6:
-        return true;
-    default:
-        return false;
-    }
-}
-
 #if 0
 uint8_t Packet::ip_proto_next() const
 {
@@ -81,27 +60,36 @@ uint8_t Packet::ip_proto_next() const
 }
 #endif
 
-// FIXIT-L J  --  this loop will be changed to go from the outside
-//                  to search inward. Every location which uses this
-//                  must be changed!
-bool Packet::get_ip_proto_next(int &lyr, uint8_t& proto) const
+bool Packet::get_ip_proto_next(uint8_t &lyr, uint8_t& proto) const
 {
-    if (lyr < 0)
+    if (lyr < 0 || lyr > num_layers)
         return false;
 
-    // lyr[0] will always return false
-    // -- this logic will be updated during fix.
-    while (is_ip_protocol(layers[lyr].prot_id))
-        --lyr;
-
-    while (lyr >= 0)
+    while (lyr < num_layers)
     {
-        if (is_ip_protocol(layers[lyr].prot_id))
-            return true;
-        else
-            proto = layers[lyr].prot_id;
+        switch(layers[lyr].prot_id)
+        {
+        case IPPROTO_ID_IPIP:
+        case IPPROTO_ID_IPV6:
+        case ETHERTYPE_IPV4:
+        case ETHERTYPE_IPV6:
+            // move past this IP layer and any IPv6 extensions.
+            while (++lyr < num_layers && is_ip6_extension(layers[lyr].prot_id));
+
+            if (lyr >= num_layers)
+            {
+                return false;
+            }
+            else
+            {
+                proto = layers[lyr].prot_id;
+                return true;
+            }
+
+        default:
+            ++lyr;
+        }
 
-        --lyr;
     }
 
     return false;
diff --git a/src/protocols/packet.h b/src/protocols/packet.h
index e9c881b50..4daee8fa7 100644
--- a/src/protocols/packet.h
+++ b/src/protocols/packet.h
@@ -218,19 +218,20 @@ struct SO_PUBLIC Packet
      * NOTE: Will only return protocols of validly decoded layers.
      *
      * PARAMS:
-     *          lyr - zero based layer from which to start searching outward.
-     *                  will always point to an IP protocol or IP extension.
+     *          lyr - zero based layer from which to start searching inward.
+     *                  will always point to the layer after an IP header or
+     *                  IPv6 extension.
      *          proto - the ip_proto (read above) for the next, outermost IP layer
      * EXAMPLE:
      *
      * uint8_t ip_proto;
-     * int lyr = p->num_layers - 1;
+     * int lyr = 0
      * while ( ip_proto_next(lyr, ip_proto))
      * {
      *    ....
      * }
      */
-    bool get_ip_proto_next(int &lyr, uint8_t& proto) const;
+    bool get_ip_proto_next(uint8_t &lyr, uint8_t& proto) const;
 
     inline void reset()
     {
diff --git a/src/protocols/protocol_ids.h b/src/protocols/protocol_ids.h
index a18956321..485ecd692 100644
--- a/src/protocols/protocol_ids.h
+++ b/src/protocols/protocol_ids.h
@@ -98,4 +98,22 @@ constexpr uint16_t ETHERTYPE_PPP = 0x880B;
 constexpr uint16_t ETHERTYPE_EAPOL = 0x888e;
 
 
+static inline bool is_ip6_extension(const uint8_t proto)
+{
+    switch(proto)
+    {
+    case IPPROTO_ID_HOPOPTS:
+    case IPPROTO_ID_DSTOPTS:
+    case IPPROTO_ID_ROUTING:
+    case IPPROTO_ID_FRAGMENT:
+    case IPPROTO_ID_AUTH:
+    case IPPROTO_ID_ESP:
+    case IPPROTO_ID_MOBILITY:
+    case IPPROTO_ID_NONEXT:
+        return true;
+    default:
+        return false;
+    }
+}
+
 #endif