suricata
decode-sll.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decodes Sll
31  */
32 
33 #include "suricata-common.h"
34 #include "decode.h"
35 #include "decode-sll.h"
36 #include "decode-events.h"
37 #include "util-debug.h"
38 
40  const uint8_t *pkt, uint32_t len, PacketQueue *pq)
41 {
42  StatsIncr(tv, dtv->counter_sll);
43 
44  if (unlikely(len < SLL_HEADER_LEN)) {
46  return TM_ECODE_FAILED;
47  }
48 
49  SllHdr *sllh = (SllHdr *)pkt;
50  if (unlikely(sllh == NULL))
51  return TM_ECODE_FAILED;
52 
53  SCLogDebug("p %p pkt %p sll_protocol %04x", p, pkt, SCNtohs(sllh->sll_protocol));
54 
55  switch (SCNtohs(sllh->sll_protocol)) {
56  case ETHERNET_TYPE_IP:
57  if (unlikely(len > SLL_HEADER_LEN + USHRT_MAX)) {
58  return TM_ECODE_FAILED;
59  }
60  DecodeIPV4(tv, dtv, p, pkt + SLL_HEADER_LEN,
61  len - SLL_HEADER_LEN, pq);
62  break;
63  case ETHERNET_TYPE_IPV6:
64  if (unlikely(len > SLL_HEADER_LEN + USHRT_MAX)) {
65  return TM_ECODE_FAILED;
66  }
67  DecodeIPV6(tv, dtv, p, pkt + SLL_HEADER_LEN,
68  len - SLL_HEADER_LEN, pq);
69  break;
70  case ETHERNET_TYPE_VLAN:
71  DecodeVLAN(tv, dtv, p, pkt + SLL_HEADER_LEN,
72  len - SLL_HEADER_LEN, pq);
73  break;
74  default:
75  SCLogDebug("p %p pkt %p sll type %04x not supported", p,
76  pkt, SCNtohs(sllh->sll_protocol));
77  }
78 
79  return TM_ECODE_OK;
80 }
81 /**
82  * @}
83  */
#define SCLogDebug(...)
Definition: util-debug.h:335
#define SLL_HEADER_LEN
Definition: decode-sll.h:27
#define unlikely(expr)
Definition: util-optimize.h:35
int DecodeSll(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode-sll.c:39
#define ETHERNET_TYPE_VLAN
Definition: decode-vlan.h:31
#define ETHERNET_TYPE_IP
int DecodeVLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode-vlan.c:62
Structure to hold thread specific data for all decode modules.
Definition: decode.h:632
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:168
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-ipv6.c:585
#define SCNtohs(x)
int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-ipv4.c:532
uint16_t counter_sll
Definition: decode.h:653
uint8_t len
Per thread variable structure.
Definition: threadvars.h:57
#define ETHERNET_TYPE_IPV6
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1000