suricata
decode-sll.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decodes Sll
31  */
32 
33 #include "suricata-common.h"
34 #include "decode.h"
35 #include "decode-sll.h"
36 #include "decode-events.h"
37 #include "util-debug.h"
38 
39 int DecodeSll(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq)
40 {
41  StatsIncr(tv, dtv->counter_sll);
42 
43  if (unlikely(len < SLL_HEADER_LEN)) {
45  return TM_ECODE_FAILED;
46  }
47 
48  SllHdr *sllh = (SllHdr *)pkt;
49  if (unlikely(sllh == NULL))
50  return TM_ECODE_FAILED;
51 
52  SCLogDebug("p %p pkt %p sll_protocol %04x", p, pkt, SCNtohs(sllh->sll_protocol));
53 
54  switch (SCNtohs(sllh->sll_protocol)) {
55  case ETHERNET_TYPE_IP:
56  if (unlikely(len > SLL_HEADER_LEN + USHRT_MAX)) {
57  return TM_ECODE_FAILED;
58  }
59  DecodeIPV4(tv, dtv, p, pkt + SLL_HEADER_LEN,
60  len - SLL_HEADER_LEN, pq);
61  break;
62  case ETHERNET_TYPE_IPV6:
63  if (unlikely(len > SLL_HEADER_LEN + USHRT_MAX)) {
64  return TM_ECODE_FAILED;
65  }
66  DecodeIPV6(tv, dtv, p, pkt + SLL_HEADER_LEN,
67  len - SLL_HEADER_LEN, pq);
68  break;
69  case ETHERNET_TYPE_VLAN:
70  DecodeVLAN(tv, dtv, p, pkt + SLL_HEADER_LEN,
71  len - SLL_HEADER_LEN, pq);
72  break;
73  default:
74  SCLogDebug("p %p pkt %p sll type %04x not supported", p,
75  pkt, SCNtohs(sllh->sll_protocol));
76  }
77 
78  return TM_ECODE_OK;
79 }
80 /**
81  * @}
82  */
#define SCLogDebug(...)
Definition: util-debug.h:335
#define SLL_HEADER_LEN
Definition: decode-sll.h:27
#define unlikely(expr)
Definition: util-optimize.h:35
#define ETHERNET_TYPE_VLAN
Definition: decode-vlan.h:31
int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-ipv4.c:532
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-ipv6.c:584
#define ETHERNET_TYPE_IP
Structure to hold thread specific data for all decode modules.
Definition: decode.h:632
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:163
int DecodeSll(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode-sll.c:39
int DecodeVLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode-vlan.c:62
#define SCNtohs(x)
uint16_t counter_sll
Definition: decode.h:655
uint8_t len
Per thread variable structure.
Definition: threadvars.h:57
#define ETHERNET_TYPE_IPV6
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:999