suricata
decode-vntag.c
Go to the documentation of this file.
1 /* Copyright (C) 2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 /**
25  * \file
26  *
27  * \author Jeff Lucovsky <jeff@lucovsky.org>
28  *
29  * Decode VNTag 802.1Qbh
30  */
31 
32 #include "suricata-common.h"
33 #include "decode.h"
34 #include "decode-vntag.h"
35 #include "decode-events.h"
36 
37 #include "flow.h"
38 
39 #include "util-unittest.h"
40 #include "util-debug.h"
41 
42 #include "pkt-var.h"
43 #include "util-profiling.h"
44 #include "host.h"
45 
46 /**
47  * \internal
48  * \brief this function is used to decode 802.1Qbh packets
49  *
50  * \param tv pointer to the thread vars
51  * \param dtv pointer code thread vars
52  * \param p pointer to the packet struct
53  * \param pkt pointer to the raw packet
54  * \param len packet len
55  * \param pq pointer to the packet queue
56  *
57  */
58 int DecodeVNTag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
59 {
61 
62  if (len < VNTAG_HEADER_LEN) {
64  return TM_ECODE_FAILED;
65  }
66 
67  if (!PacketIncreaseCheckLayers(p)) {
68  return TM_ECODE_FAILED;
69  }
70 
71  VNTagHdr *vntag_hdr = (VNTagHdr *)pkt;
72  if (vntag_hdr == NULL)
73  return TM_ECODE_FAILED;
74 
75  uint16_t proto = GET_VNTAG_PROTO(vntag_hdr);
76 
77  SCLogDebug("p %p pkt %p protocol %04x DIR %d PTR %d DEST %d LOOPED: %d VERSION: %d SRC: %d "
78  "Len: %" PRIu32 "",
79  p, pkt, proto, GET_VNTAG_DIR(vntag_hdr), GET_VNTAG_PTR(vntag_hdr),
80  GET_VNTAG_DEST(vntag_hdr), GET_VNTAG_LOOPED(vntag_hdr), GET_VNTAG_VERSION(vntag_hdr),
81  GET_VNTAG_SRC(vntag_hdr), len);
82 
83  if (DecodeNetworkLayer(tv, dtv, proto, p, pkt + VNTAG_HEADER_LEN, len - VNTAG_HEADER_LEN) ==
84  false) {
86  return TM_ECODE_FAILED;
87  }
88  return TM_ECODE_OK;
89 }
90 
91 #ifdef UNITTESTS
92 
93 /**
94  * \test DecodeVNTagTest01 test if vntag header is too small.
95  *
96  * \retval 1 on success
97  * \retval 0 on failure
98  */
99 static int DecodeVNTagtest01(void)
100 {
101  uint8_t raw_vntag[] = { 0x00, 0x20, 0x08 };
102  Packet *p = PacketGetFromAlloc();
103  FAIL_IF_NULL(p);
104 
105  ThreadVars tv;
107 
108  memset(&tv, 0, sizeof(ThreadVars));
109  memset(&dtv, 0, sizeof(DecodeThreadVars));
110 
111  FAIL_IF(TM_ECODE_OK == DecodeVNTag(&tv, &dtv, p, raw_vntag, sizeof(raw_vntag)));
112 
114 }
115 
116 /**
117  * \test DecodeVNTagt02 test if vntag header has unknown type.
118  *
119  * \retval 1 on success
120  * \retval 0 on failure
121  */
122 static int DecodeVNTagtest02(void)
123 {
124  uint8_t raw_vntag[] = { 0x00, 0x00, 0x00, 0x00, 0xFF, 0x00, 0x00, 0x0b, 0x08, 0x00, 0x45, 0x00,
125  0x00, 0x64, 0xac, 0xe6, 0x00, 0x00, 0xff, 0xfd, 0x08, 0xb3, 0x01, 0x01, 0x01, 0x01, 0x01,
126  0x01, 0x02, 0x01, 0xe5, 0xa3, 0x95, 0x5c, 0x5d, 0x82, 0x50, 0x24, 0x6f, 0x56, 0xac, 0xf4,
127  0xf9, 0x9b, 0x28, 0x6a, 0x03, 0xb5, 0xab, 0x15, 0xfe, 0x6c, 0xab, 0x98, 0x0c, 0x4e, 0xcc,
128  0xf4, 0xd1, 0x5b, 0x22, 0x0b, 0x81, 0x39, 0x08, 0xb3, 0xcf, 0xc2, 0x6b, 0x90, 0xe1, 0xcc,
129  0xe6, 0x4f, 0x5f, 0xa0, 0xb6, 0xa8, 0x93, 0x38, 0x8a, 0x17, 0xac, 0x6e, 0x3b, 0xbc, 0xad,
130  0x67, 0xad, 0xfc, 0x91, 0xf0, 0x16, 0x9d, 0xe2, 0xe1, 0xdf, 0x4f, 0x8c, 0xcb, 0xd3, 0xdc,
131  0xd9, 0xed, 0x3c, 0x0c, 0x92, 0xad, 0x8b, 0xf0, 0x2c, 0x2d, 0x55, 0x41 };
132 
133  Packet *p = PacketGetFromAlloc();
134  FAIL_IF_NULL(p);
135  ThreadVars tv;
137 
138  memset(&tv, 0, sizeof(ThreadVars));
139  memset(&dtv, 0, sizeof(DecodeThreadVars));
140 
141  PASS_IF(TM_ECODE_OK != DecodeVNTag(&tv, &dtv, p, raw_vntag, sizeof(raw_vntag)));
142 }
143 
144 /**
145  * \test DecodeVNTagTest03 test a good vntag header.
146  *
147  * \retval 1 on success
148  * \retval 0 on failure
149  */
150 static int DecodeVNTagtest03(void)
151 {
152  uint8_t raw_vntag[] = { 0x00, 0x00, 0x00, 0x00, 0x81, 0x00, 0x00, 0x0b, 0x08, 0x00, 0x45, 0x00,
153  0x00, 0x64, 0xac, 0xe6, 0x00, 0x00, 0xff, 0xfd, 0x08, 0xb3, 0x01, 0x01, 0x01, 0x01, 0x01,
154  0x01, 0x02, 0x01, 0xe5, 0xa3, 0x95, 0x5c, 0x5d, 0x82, 0x50, 0x24, 0x6f, 0x56, 0xac, 0xf4,
155  0xf9, 0x9b, 0x28, 0x6a, 0x03, 0xb5, 0xab, 0x15, 0xfe, 0x6c, 0xab, 0x98, 0x0c, 0x4e, 0xcc,
156  0xf4, 0xd1, 0x5b, 0x22, 0x0b, 0x81, 0x39, 0x08, 0xb3, 0xcf, 0xc2, 0x6b, 0x90, 0xe1, 0xcc,
157  0xe6, 0x4f, 0x5f, 0xa0, 0xb6, 0xa8, 0x93, 0x38, 0x8a, 0x17, 0xac, 0x6e, 0x3b, 0xbc, 0xad,
158  0x67, 0xad, 0xfc, 0x91, 0xf0, 0x16, 0x9d, 0xe2, 0xe1, 0xdf, 0x4f, 0x8c, 0xcb, 0xd3, 0xdc,
159  0xd9, 0xed, 0x3c, 0x0c, 0x92, 0xad, 0x8b, 0xf0, 0x2c, 0x2d, 0x55, 0x41 };
160 
161  Packet *p = PacketGetFromAlloc();
162  FAIL_IF_NULL(p);
163 
164  ThreadVars tv = { 0 };
165  DecodeThreadVars dtv = { 0 };
166 
168 
169  FAIL_IF(TM_ECODE_OK != DecodeVNTag(&tv, &dtv, p, raw_vntag, sizeof(raw_vntag)));
170 
171  PACKET_RECYCLE(p);
172  FlowShutdown();
173  SCFree(p);
174 
175  PASS;
176 }
177 #endif /* UNITTESTS */
178 
180 {
181 #ifdef UNITTESTS
182  UtRegisterTest("DecodeVNTagtest01", DecodeVNTagtest01);
183  UtRegisterTest("DecodeVNTagtest02", DecodeVNTagtest02);
184  UtRegisterTest("DecodeVNTagtest03", DecodeVNTagtest03);
185 #endif /* UNITTESTS */
186 }
187 
188 /**
189  * @}
190  */
host.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
GET_VNTAG_VERSION
#define GET_VNTAG_VERSION(vntagh)
Definition: decode-vntag.h:33
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:1038
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
DecodeThreadVars_::counter_vntag
uint16_t counter_vntag
Definition: decode.h:674
proto
uint8_t proto
Definition: decode-template.h:0
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
util-unittest.h
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
GET_VNTAG_SRC
#define GET_VNTAG_SRC(vntagh)
Definition: decode-vntag.h:34
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:516
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
GET_VNTAG_PROTO
#define GET_VNTAG_PROTO(vntagh)
Definition: decode-vntag.h:35
DecodeVNTag
int DecodeVNTag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-vntag.c:58
DecodeVNTagRegisterTests
void DecodeVNTagRegisterTests(void)
Definition: decode-vntag.c:179
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
pkt-var.h
VNTAG_HEADER_TOO_SMALL
@ VNTAG_HEADER_TOO_SMALL
Definition: decode-events.h:151
util-profiling.h
Packet_
Definition: decode.h:416
PASS_IF
#define PASS_IF(expr)
Pass the test if expression evaluates to true.
Definition: util-unittest.h:117
GET_VNTAG_DEST
#define GET_VNTAG_DEST(vntagh)
Definition: decode-vntag.h:31
GET_VNTAG_LOOPED
#define GET_VNTAG_LOOPED(vntagh)
Definition: decode-vntag.h:32
decode-events.h
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
suricata-common.h
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:644
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:150
SCFree
#define SCFree(p)
Definition: util-mem.h:61
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:640
GET_VNTAG_DIR
#define GET_VNTAG_DIR(vntagh)
Definition: decode-vntag.h:29
VNTAG_HEADER_LEN
#define VNTAG_HEADER_LEN
Definition: decode-vntag.h:44
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1031
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:42
VNTAG_UNKNOWN_TYPE
@ VNTAG_UNKNOWN_TYPE
Definition: decode-events.h:152
flow.h
decode-vntag.h
PACKET_RECYCLE
#define PACKET_RECYCLE(p)
Definition: decode.h:844
GET_VNTAG_PTR
#define GET_VNTAG_PTR(vntagh)
Definition: decode-vntag.h:30