From: Russ Combs <rucombs@cisco.com>
Date: Mon, 14 Sep 2015 11:49:03 +0000 (-0400)
Subject: return innermost proto for type of broken packets
X-Git-Tag: 3.0.0-233~832^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9ce8928bcccef95a1d3edf5b7067b9539b167e7a;p=thirdparty%2Fsnort3.git

return innermost proto for type of broken packets
capture id of grinder upon init to support above
---

diff --git a/src/managers/codec_manager.cc b/src/managers/codec_manager.cc
index 499283a22..220701ce8 100644
--- a/src/managers/codec_manager.cc
+++ b/src/managers/codec_manager.cc
@@ -49,6 +49,8 @@ std::array<uint8_t, max_protocol_id> CodecManager::s_proto_map {
 std::array<Codec*, UINT8_MAX> CodecManager::s_protocols {
     { 0 }
 };
+
+THREAD_LOCAL uint16_t CodecManager::grinder_id = 0;
 THREAD_LOCAL uint8_t CodecManager::grinder = 0;
 THREAD_LOCAL uint8_t CodecManager::max_layers = DEFAULT_LAYERMAX;
 
@@ -223,6 +225,10 @@ void CodecManager::thread_init(SnortConfig* sc)
                         s_protocols[grinder]->get_name(), cd->get_name(),
                         cd->get_name());
 
+                std::vector<uint16_t> ids;
+                s_protocols[i]->get_protocol_ids(ids);
+
+                grinder_id = ( ids.size() > 0 ) ? ids[0] : FINISHED_DECODE;
                 grinder = (uint8_t)i;
             }
         }
diff --git a/src/managers/codec_manager.h b/src/managers/codec_manager.h
index b08e6bf5f..6ce4e57ed 100644
--- a/src/managers/codec_manager.h
+++ b/src/managers/codec_manager.h
@@ -104,6 +104,8 @@ private:
     static std::vector<CodecApiWrapper> s_codecs;
     static std::array<uint8_t, max_protocol_id> s_proto_map;
     static std::array<Codec*, UINT8_MAX> s_protocols;
+
+    static THREAD_LOCAL uint16_t grinder_id;
     static THREAD_LOCAL uint8_t grinder;
     static THREAD_LOCAL uint8_t max_layers;
 
diff --git a/src/protocols/packet.cc b/src/protocols/packet.cc
index ac8d026ea..87769e28f 100644
--- a/src/protocols/packet.cc
+++ b/src/protocols/packet.cc
@@ -20,6 +20,7 @@
 #include <assert.h>
 
 #include "protocols/packet.h"
+#include "protocols/packet_manager.h"
 #include "protocols/protocol_ids.h"
 
 #if 0
@@ -119,17 +120,22 @@ const char* Packet::get_type() const
     case PktType::FILE:
         if ( proto_bits & PROTO_BIT__TCP )
             return "TCP";
+
         if ( proto_bits & PROTO_BIT__UDP )
             return "UDP";
+
         assert(false);
         return "Error";
 
     case PktType::NONE:
+        if ( num_layers > 0 )
+            return PacketManager::get_proto_name(layers[num_layers-1].prot_id);
+
+        assert(false);
         return "None";
 
     default:
-        assert(false);
-        return "Error";
+        break;
     }
     assert(false);
     return "Error";
diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc
index e8dd34528..87603fc11 100644
--- a/src/protocols/packet_manager.cc
+++ b/src/protocols/packet_manager.cc
@@ -189,8 +189,9 @@ void PacketManager::decode(
 {
     PROFILE_VARS;
     DecodeData unsure_encap_ptrs;
-    uint16_t prev_prot_id = FINISHED_DECODE;
+
     uint8_t mapped_prot = CodecManager::grinder;
+    uint16_t prev_prot_id = CodecManager::grinder_id;
 
     RawData raw(pkthdr, pkt);
     CodecData codec_data(FINISHED_DECODE);