From 88bccfb80ef48d38cf31b99965ecf0e81774a14c Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 21 Feb 2020 16:07:57 +0100 Subject: [PATCH] decode: create linklayer entry point Make AF_PACKET and PCAP mode use it. --- src/decode.h | 28 ++++++++++++++++++++++++++++ src/source-af-packet.c | 22 +--------------------- src/source-pcap.c | 25 +------------------------ 3 files changed, 30 insertions(+), 45 deletions(-) diff --git a/src/decode.h b/src/decode.h index 0787707d1c..408944858b 100644 --- a/src/decode.h +++ b/src/decode.h @@ -1149,5 +1149,33 @@ static inline bool VerdictTunnelPacket(Packet *p) return verdict; } +static inline void DecodeLinkLayer(ThreadVars *tv, DecodeThreadVars *dtv, + const int datalink, Packet *p, const uint8_t *data, const uint32_t len) +{ + /* call the decoder */ + switch (datalink) { + case LINKTYPE_ETHERNET: + DecodeEthernet(tv, dtv, p, data, len); + break; + case LINKTYPE_LINUX_SLL: + DecodeSll(tv, dtv, p, data, len); + break; + case LINKTYPE_PPP: + DecodePPP(tv, dtv, p, data, len); + break; + case LINKTYPE_RAW: + case LINKTYPE_GRE_OVER_IP: + DecodeRaw(tv, dtv, p, data, len); + break; + case LINKTYPE_NULL: + DecodeNull(tv, dtv, p, data, len); + break; + default: + SCLogError(SC_ERR_DATALINK_UNIMPLEMENTED, "datalink type " + "%"PRId32" not yet supported", datalink); + break; + } +} + #endif /* __DECODE_H__ */ diff --git a/src/source-af-packet.c b/src/source-af-packet.c index 98657ab21f..e64af60b81 100644 --- a/src/source-af-packet.c +++ b/src/source-af-packet.c @@ -2898,27 +2898,7 @@ TmEcode DecodeAFP(ThreadVars *tv, Packet *p, void *data) } /* call the decoder */ - switch (p->datalink) { - case LINKTYPE_ETHERNET: - DecodeEthernet(tv, dtv, p,GET_PKT_DATA(p), GET_PKT_LEN(p)); - break; - case LINKTYPE_LINUX_SLL: - DecodeSll(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p)); - break; - case LINKTYPE_PPP: - DecodePPP(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p)); - break; - case LINKTYPE_RAW: - case LINKTYPE_GRE_OVER_IP: - DecodeRaw(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p)); - break; - case LINKTYPE_NULL: - DecodeNull(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p)); - break; - default: - SCLogError(SC_ERR_DATALINK_UNIMPLEMENTED, "Error: datalink type %" PRId32 " not yet supported in module DecodeAFP", p->datalink); - break; - } + DecodeLinkLayer(tv, dtv, p->datalink, p, GET_PKT_DATA(p), GET_PKT_LEN(p)); PacketDecodeFinalize(tv, dtv, p); diff --git a/src/source-pcap.c b/src/source-pcap.c index ee23429c5b..6fdc417ab2 100644 --- a/src/source-pcap.c +++ b/src/source-pcap.c @@ -550,30 +550,7 @@ static TmEcode DecodePcap(ThreadVars *tv, Packet *p, void *data) /* update counters */ DecodeUpdatePacketCounters(tv, dtv, p); - /* call the decoder */ - switch(p->datalink) { - case LINKTYPE_LINUX_SLL: - DecodeSll(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p)); - break; - case LINKTYPE_ETHERNET: - DecodeEthernet(tv, dtv, p,GET_PKT_DATA(p), GET_PKT_LEN(p)); - break; - case LINKTYPE_PPP: - DecodePPP(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p)); - break; - case LINKTYPE_RAW: - case LINKTYPE_GRE_OVER_IP: - DecodeRaw(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p)); - break; - case LINKTYPE_NULL: - DecodeNull(tv, dtv, p, GET_PKT_DATA(p), GET_PKT_LEN(p)); - break; - default: - SCLogError(SC_ERR_DATALINK_UNIMPLEMENTED, "Error: datalink " - "type %" PRId32 " not yet supported in module " - "DecodePcap", p->datalink); - break; - } + DecodeLinkLayer(tv, dtv, p->datalink, p, GET_PKT_DATA(p), GET_PKT_LEN(p)); PacketDecodeFinalize(tv, dtv, p); -- 2.47.2