suricata
decode-ethernet.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2014 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode Ethernet
31  */
32 
33 #include "suricata-common.h"
34 #include "decode.h"
35 #include "decode-ethernet.h"
36 #include "decode-events.h"
37 
38 #include "util-unittest.h"
39 #include "util-debug.h"
40 
42  const uint8_t *pkt, uint32_t len)
43 {
45 
48  return TM_ECODE_FAILED;
49  }
50 
51  p->ethh = (EthernetHdr *)pkt;
52  if (unlikely(p->ethh == NULL))
53  return TM_ECODE_FAILED;
54 
55  SCLogDebug("p %p pkt %p ether type %04x", p, pkt, SCNtohs(p->ethh->eth_type));
56 
57  DecodeNetworkLayer(tv, dtv, SCNtohs(p->ethh->eth_type), p,
59 
60  return TM_ECODE_OK;
61 }
62 
63 #ifdef UNITTESTS
64 /** DecodeEthernettest01
65  * \brief Valid Ethernet packet
66  * \retval 0 Expected test value
67  */
68 static int DecodeEthernetTest01 (void)
69 {
70  /* ICMP packet wrapped in PPPOE */
71  uint8_t raw_eth[] = {
72  0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
73  0x94, 0x56, 0x00, 0x01, 0x88, 0x64, 0x11, 0x00,
74  0x00, 0x01, 0x00, 0x68, 0x00, 0x21, 0x45, 0xc0,
75  0x00, 0x64, 0x00, 0x1e, 0x00, 0x00, 0xff, 0x01,
76  0xa7, 0x78, 0x0a, 0x00, 0x00, 0x02, 0x0a, 0x00,
77  0x00, 0x01, 0x08, 0x00, 0x4a, 0x61, 0x00, 0x06,
78  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f,
79  0x3b, 0xd4, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
80  0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
81  0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
82  0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
83  0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
84  0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
85  0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
86  0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
87  0xab, 0xcd };
88 
90  if (unlikely(p == NULL))
91  return 0;
92  ThreadVars tv;
94 
95  memset(&dtv, 0, sizeof(DecodeThreadVars));
96  memset(&tv, 0, sizeof(ThreadVars));
97  memset(p, 0, SIZE_OF_PACKET);
98 
99  DecodeEthernet(&tv, &dtv, p, raw_eth, sizeof(raw_eth));
100 
101  SCFree(p);
102  return 1;
103 }
104 
105 /**
106  * Test a DCE ethernet frame that is too small.
107  */
108 static int DecodeEthernetTestDceTooSmall(void)
109 {
110  uint8_t raw_eth[] = {
111  0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
112  0x94, 0x56, 0x00, 0x01, 0x89, 0x03,
113  };
114 
116  FAIL_IF_NULL(p);
117  ThreadVars tv;
119 
120  memset(&dtv, 0, sizeof(DecodeThreadVars));
121  memset(&tv, 0, sizeof(ThreadVars));
122  memset(p, 0, SIZE_OF_PACKET);
123 
124  DecodeEthernet(&tv, &dtv, p, raw_eth, sizeof(raw_eth));
125 
127 
128  SCFree(p);
129  PASS;
130 }
131 
132 /**
133  * Test that a DCE ethernet frame, followed by data that is too small
134  * for an ethernet header.
135  *
136  * Redmine issue:
137  * https://redmine.openinfosecfoundation.org/issues/2887
138  */
139 static int DecodeEthernetTestDceNextTooSmall(void)
140 {
141  uint8_t raw_eth[] = {
142  0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
143  0x94, 0x56, 0x00, 0x01, 0x89, 0x03, //0x88, 0x64,
144 
145  0x00, 0x00,
146 
147  0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
148  0x94, 0x56, 0x00, 0x01,
149  };
150 
152  FAIL_IF_NULL(p);
153  ThreadVars tv;
155 
156  memset(&dtv, 0, sizeof(DecodeThreadVars));
157  memset(&tv, 0, sizeof(ThreadVars));
158  memset(p, 0, SIZE_OF_PACKET);
159 
160  DecodeEthernet(&tv, &dtv, p, raw_eth, sizeof(raw_eth));
161 
163 
164  SCFree(p);
165  PASS;
166 }
167 
168 #endif /* UNITTESTS */
169 
170 
171 /**
172  * \brief Registers Ethernet unit tests
173  * \todo More Ethernet tests
174  */
176 {
177 #ifdef UNITTESTS
178  UtRegisterTest("DecodeEthernetTest01", DecodeEthernetTest01);
179  UtRegisterTest("DecodeEthernetTestDceNextTooSmall",
180  DecodeEthernetTestDceNextTooSmall);
181  UtRegisterTest("DecodeEthernetTestDceTooSmall",
182  DecodeEthernetTestDceTooSmall);
183 #endif /* UNITTESTS */
184 }
185 /**
186  * @}
187  */
decode-ethernet.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
DecodeThreadVars_::counter_eth
uint16_t counter_eth
Definition: decode.h:637
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
DCE_PKT_TOO_SMALL
@ DCE_PKT_TOO_SMALL
Definition: decode-events.h:192
ETHERNET_PKT_TOO_SMALL
@ ETHERNET_PKT_TOO_SMALL
Definition: decode-events.h:111
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:996
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:79
util-unittest.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:78
DecodeEthernetRegisterTests
void DecodeEthernetRegisterTests(void)
Registers Ethernet unit tests.
Definition: decode-ethernet.c:175
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
Packet_::ethh
EthernetHdr * ethh
Definition: decode.h:496
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
SIZE_OF_PACKET
#define SIZE_OF_PACKET
Definition: decode.h:621
Packet_
Definition: decode.h:411
ETHERNET_HEADER_LEN
#define ETHERNET_HEADER_LEN
Definition: decode-ethernet.h:27
decode-events.h
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:398
suricata-common.h
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
SCMalloc
#define SCMalloc(sz)
Definition: util-mem.h:47
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:625
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:989
DecodeEthernet
int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-ethernet.c:41