suricata
decode-vntag.c
Go to the documentation of this file.
1 /* Copyright (C) 2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 /**
25  * \file
26  *
27  * \author Jeff Lucovsky <jeff@lucovsky.org>
28  *
29  * Decode VNTag 802.1Qbh
30  */
31 
32 #include "suricata-common.h"
33 #include "decode.h"
34 #include "decode-vntag.h"
35 #include "decode-events.h"
36 
37 #include "flow.h"
38 
39 #include "util-validate.h"
40 #include "util-unittest.h"
41 #include "util-debug.h"
42 
43 #include "pkt-var.h"
44 #include "util-profiling.h"
45 #include "host.h"
46 
47 /**
48  * \internal
49  * \brief this function is used to decode 802.1Qbh packets
50  *
51  * \param tv pointer to the thread vars
52  * \param dtv pointer code thread vars
53  * \param p pointer to the packet struct
54  * \param pkt pointer to the raw packet
55  * \param len packet len
56  *
57  */
58 int DecodeVNTag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
59 {
60  DEBUG_VALIDATE_BUG_ON(pkt == NULL);
61 
63 
64  if (len < VNTAG_HEADER_LEN) {
66  return TM_ECODE_FAILED;
67  }
68 
69  if (!PacketIncreaseCheckLayers(p)) {
70  return TM_ECODE_FAILED;
71  }
72 
73  VNTagHdr *vntag_hdr = (VNTagHdr *)pkt;
74 
75  uint16_t proto = GET_VNTAG_PROTO(vntag_hdr);
76 
77  SCLogDebug("p %p pkt %p protocol %04x DIR %d PTR %d DEST %d LOOPED: %d VERSION: %d SRC: %d "
78  "Len: %" PRIu32 "",
79  p, pkt, proto, GET_VNTAG_DIR(vntag_hdr), GET_VNTAG_PTR(vntag_hdr),
80  GET_VNTAG_DEST(vntag_hdr), GET_VNTAG_LOOPED(vntag_hdr), GET_VNTAG_VERSION(vntag_hdr),
81  GET_VNTAG_SRC(vntag_hdr), len);
82 
83  if (DecodeNetworkLayer(tv, dtv, proto, p, pkt + VNTAG_HEADER_LEN, len - VNTAG_HEADER_LEN) ==
84  false) {
86  return TM_ECODE_FAILED;
87  }
88  return TM_ECODE_OK;
89 }
90 
91 #ifdef UNITTESTS
92 
93 /**
94  * \test DecodeVNTagTest01 test if vntag header is too small.
95  *
96  */
97 static int DecodeVNTagtest01(void)
98 {
99  uint8_t raw_vntag[] = { 0x00, 0x20, 0x08 };
100  Packet *p = PacketGetFromAlloc();
101  FAIL_IF_NULL(p);
102 
103  ThreadVars tv;
105 
106  memset(&tv, 0, sizeof(ThreadVars));
107  memset(&dtv, 0, sizeof(DecodeThreadVars));
108 
109  FAIL_IF(TM_ECODE_OK == DecodeVNTag(&tv, &dtv, p, raw_vntag, sizeof(raw_vntag)));
110 
112  PASS;
113 }
114 
115 /**
116  * \test DecodeVNTagt02 test if vntag header has unknown type.
117  *
118  */
119 static int DecodeVNTagtest02(void)
120 {
121  uint8_t raw_vntag[] = { 0x00, 0x00, 0x00, 0x00, 0xFF, 0x00, 0x00, 0x0b, 0x08, 0x00, 0x45, 0x00,
122  0x00, 0x64, 0xac, 0xe6, 0x00, 0x00, 0xff, 0xfd, 0x08, 0xb3, 0x01, 0x01, 0x01, 0x01, 0x01,
123  0x01, 0x02, 0x01, 0xe5, 0xa3, 0x95, 0x5c, 0x5d, 0x82, 0x50, 0x24, 0x6f, 0x56, 0xac, 0xf4,
124  0xf9, 0x9b, 0x28, 0x6a, 0x03, 0xb5, 0xab, 0x15, 0xfe, 0x6c, 0xab, 0x98, 0x0c, 0x4e, 0xcc,
125  0xf4, 0xd1, 0x5b, 0x22, 0x0b, 0x81, 0x39, 0x08, 0xb3, 0xcf, 0xc2, 0x6b, 0x90, 0xe1, 0xcc,
126  0xe6, 0x4f, 0x5f, 0xa0, 0xb6, 0xa8, 0x93, 0x38, 0x8a, 0x17, 0xac, 0x6e, 0x3b, 0xbc, 0xad,
127  0x67, 0xad, 0xfc, 0x91, 0xf0, 0x16, 0x9d, 0xe2, 0xe1, 0xdf, 0x4f, 0x8c, 0xcb, 0xd3, 0xdc,
128  0xd9, 0xed, 0x3c, 0x0c, 0x92, 0xad, 0x8b, 0xf0, 0x2c, 0x2d, 0x55, 0x41 };
129 
130  Packet *p = PacketGetFromAlloc();
131  FAIL_IF_NULL(p);
132  ThreadVars tv;
134 
135  memset(&tv, 0, sizeof(ThreadVars));
136  memset(&dtv, 0, sizeof(DecodeThreadVars));
137 
138  FAIL_IF_NOT(TM_ECODE_OK != DecodeVNTag(&tv, &dtv, p, raw_vntag, sizeof(raw_vntag)));
139  PASS;
140 }
141 
142 /**
143  * \test DecodeVNTagTest03 test a good vntag header.
144  *
145  */
146 static int DecodeVNTagtest03(void)
147 {
148  uint8_t raw_vntag[] = { 0x00, 0x00, 0x00, 0x00, 0x81, 0x00, 0x00, 0x0b, 0x08, 0x00, 0x45, 0x00,
149  0x00, 0x64, 0xac, 0xe6, 0x00, 0x00, 0xff, 0xfd, 0x08, 0xb3, 0x01, 0x01, 0x01, 0x01, 0x01,
150  0x01, 0x02, 0x01, 0xe5, 0xa3, 0x95, 0x5c, 0x5d, 0x82, 0x50, 0x24, 0x6f, 0x56, 0xac, 0xf4,
151  0xf9, 0x9b, 0x28, 0x6a, 0x03, 0xb5, 0xab, 0x15, 0xfe, 0x6c, 0xab, 0x98, 0x0c, 0x4e, 0xcc,
152  0xf4, 0xd1, 0x5b, 0x22, 0x0b, 0x81, 0x39, 0x08, 0xb3, 0xcf, 0xc2, 0x6b, 0x90, 0xe1, 0xcc,
153  0xe6, 0x4f, 0x5f, 0xa0, 0xb6, 0xa8, 0x93, 0x38, 0x8a, 0x17, 0xac, 0x6e, 0x3b, 0xbc, 0xad,
154  0x67, 0xad, 0xfc, 0x91, 0xf0, 0x16, 0x9d, 0xe2, 0xe1, 0xdf, 0x4f, 0x8c, 0xcb, 0xd3, 0xdc,
155  0xd9, 0xed, 0x3c, 0x0c, 0x92, 0xad, 0x8b, 0xf0, 0x2c, 0x2d, 0x55, 0x41 };
156 
157  Packet *p = PacketGetFromAlloc();
158  FAIL_IF_NULL(p);
159 
160  ThreadVars tv = { 0 };
161  DecodeThreadVars dtv = { 0 };
162 
164 
165  FAIL_IF(TM_ECODE_OK != DecodeVNTag(&tv, &dtv, p, raw_vntag, sizeof(raw_vntag)));
166 
167  PACKET_RECYCLE(p);
168  FlowShutdown();
169  SCFree(p);
170 
171  PASS;
172 }
173 #endif /* UNITTESTS */
174 
176 {
177 #ifdef UNITTESTS
178  UtRegisterTest("DecodeVNTagtest01", DecodeVNTagtest01);
179  UtRegisterTest("DecodeVNTagtest02", DecodeVNTagtest02);
180  UtRegisterTest("DecodeVNTagtest03", DecodeVNTagtest03);
181 #endif /* UNITTESTS */
182 }
183 
184 /**
185  * @}
186  */
host.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
GET_VNTAG_VERSION
#define GET_VNTAG_VERSION(vntagh)
Definition: decode-vntag.h:33
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:1051
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
DecodeThreadVars_::counter_vntag
uint16_t counter_vntag
Definition: decode.h:672
proto
uint8_t proto
Definition: decode-template.h:0
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
util-unittest.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
GET_VNTAG_SRC
#define GET_VNTAG_SRC(vntagh)
Definition: decode-vntag.h:34
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:523
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
GET_VNTAG_PROTO
#define GET_VNTAG_PROTO(vntagh)
Definition: decode-vntag.h:35
DecodeVNTag
int DecodeVNTag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-vntag.c:58
DecodeVNTagRegisterTests
void DecodeVNTagRegisterTests(void)
Definition: decode-vntag.c:175
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
pkt-var.h
VNTAG_HEADER_TOO_SMALL
@ VNTAG_HEADER_TOO_SMALL
Definition: decode-events.h:151
util-profiling.h
Packet_
Definition: decode.h:414
GET_VNTAG_DEST
#define GET_VNTAG_DEST(vntagh)
Definition: decode-vntag.h:31
GET_VNTAG_LOOPED
#define GET_VNTAG_LOOPED(vntagh)
Definition: decode-vntag.h:32
decode-events.h
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
suricata-common.h
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:651
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:151
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:638
GET_VNTAG_DIR
#define GET_VNTAG_DIR(vntagh)
Definition: decode-vntag.h:29
VNTAG_HEADER_LEN
#define VNTAG_HEADER_LEN
Definition: decode-vntag.h:44
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1044
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:42
VNTAG_UNKNOWN_TYPE
@ VNTAG_UNKNOWN_TYPE
Definition: decode-events.h:152
flow.h
decode-vntag.h
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
PACKET_RECYCLE
#define PACKET_RECYCLE(p)
Definition: decode.h:842
GET_VNTAG_PTR
#define GET_VNTAG_PTR(vntagh)
Definition: decode-vntag.h:30