suricata
decode-vntag.c
Go to the documentation of this file.
1 /* Copyright (C) 2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 /**
25  * \file
26  *
27  * \author Jeff Lucovsky <jeff@lucovsky.org>
28  *
29  * Decode VNTag 802.1Qbh
30  */
31 
32 #include "suricata-common.h"
33 #include "decode.h"
34 #include "decode-vntag.h"
35 #include "decode-events.h"
36 
37 #include "flow.h"
38 
39 #include "util-validate.h"
40 #include "util-unittest.h"
41 #include "util-debug.h"
42 
43 #include "pkt-var.h"
44 #include "util-profiling.h"
45 #include "host.h"
46 
47 /**
48  * \internal
49  * \brief this function is used to decode 802.1Qbh packets
50  *
51  * \param tv pointer to the thread vars
52  * \param dtv pointer code thread vars
53  * \param p pointer to the packet struct
54  * \param pkt pointer to the raw packet
55  * \param len packet len
56  *
57  */
58 int DecodeVNTag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
59 {
60  DEBUG_VALIDATE_BUG_ON(pkt == NULL);
61 
63 
64  if (len < VNTAG_HEADER_LEN) {
66  return TM_ECODE_FAILED;
67  }
68 
69  if (!PacketIncreaseCheckLayers(p)) {
70  return TM_ECODE_FAILED;
71  }
72 
73  VNTagHdr *vntag_hdr = (VNTagHdr *)pkt;
74 
75  uint16_t proto = GET_VNTAG_PROTO(vntag_hdr);
76 
77  SCLogDebug("p %p pkt %p protocol %04x DIR %d PTR %d DEST %d LOOPED: %d VERSION: %d SRC: %d "
78  "Len: %" PRIu32 "",
79  p, pkt, proto, GET_VNTAG_DIR(vntag_hdr), GET_VNTAG_PTR(vntag_hdr),
80  GET_VNTAG_DEST(vntag_hdr), GET_VNTAG_LOOPED(vntag_hdr), GET_VNTAG_VERSION(vntag_hdr),
81  GET_VNTAG_SRC(vntag_hdr), len);
82 
83  if (DecodeNetworkLayer(tv, dtv, proto, p, pkt + VNTAG_HEADER_LEN, len - VNTAG_HEADER_LEN) ==
84  false) {
86  return TM_ECODE_FAILED;
87  }
88  return TM_ECODE_OK;
89 }
90 
91 #ifdef UNITTESTS
92 
93 /**
94  * \test DecodeVNTagTest01 test if vntag header is too small.
95  *
96  */
97 static int DecodeVNTagtest01(void)
98 {
99  uint8_t raw_vntag[] = { 0x00, 0x20, 0x08 };
100  Packet *p = PacketGetFromAlloc();
101  FAIL_IF_NULL(p);
102 
103  ThreadVars tv;
105 
106  memset(&tv, 0, sizeof(ThreadVars));
107  memset(&dtv, 0, sizeof(DecodeThreadVars));
108 
109  FAIL_IF(TM_ECODE_OK == DecodeVNTag(&tv, &dtv, p, raw_vntag, sizeof(raw_vntag)));
110 
112  PacketFree(p);
113  PASS;
114 }
115 
116 /**
117  * \test DecodeVNTagt02 test if vntag header has unknown type.
118  *
119  */
120 static int DecodeVNTagtest02(void)
121 {
122  uint8_t raw_vntag[] = { 0x00, 0x00, 0x00, 0x00, 0xFF, 0x00, 0x00, 0x0b, 0x08, 0x00, 0x45, 0x00,
123  0x00, 0x64, 0xac, 0xe6, 0x00, 0x00, 0xff, 0xfd, 0x08, 0xb3, 0x01, 0x01, 0x01, 0x01, 0x01,
124  0x01, 0x02, 0x01, 0xe5, 0xa3, 0x95, 0x5c, 0x5d, 0x82, 0x50, 0x24, 0x6f, 0x56, 0xac, 0xf4,
125  0xf9, 0x9b, 0x28, 0x6a, 0x03, 0xb5, 0xab, 0x15, 0xfe, 0x6c, 0xab, 0x98, 0x0c, 0x4e, 0xcc,
126  0xf4, 0xd1, 0x5b, 0x22, 0x0b, 0x81, 0x39, 0x08, 0xb3, 0xcf, 0xc2, 0x6b, 0x90, 0xe1, 0xcc,
127  0xe6, 0x4f, 0x5f, 0xa0, 0xb6, 0xa8, 0x93, 0x38, 0x8a, 0x17, 0xac, 0x6e, 0x3b, 0xbc, 0xad,
128  0x67, 0xad, 0xfc, 0x91, 0xf0, 0x16, 0x9d, 0xe2, 0xe1, 0xdf, 0x4f, 0x8c, 0xcb, 0xd3, 0xdc,
129  0xd9, 0xed, 0x3c, 0x0c, 0x92, 0xad, 0x8b, 0xf0, 0x2c, 0x2d, 0x55, 0x41 };
130 
131  Packet *p = PacketGetFromAlloc();
132  FAIL_IF_NULL(p);
133  ThreadVars tv;
135 
136  memset(&tv, 0, sizeof(ThreadVars));
137  memset(&dtv, 0, sizeof(DecodeThreadVars));
138 
139  FAIL_IF_NOT(TM_ECODE_OK != DecodeVNTag(&tv, &dtv, p, raw_vntag, sizeof(raw_vntag)));
140  PacketFree(p);
141  PASS;
142 }
143 
144 /**
145  * \test DecodeVNTagTest03 test a good vntag header.
146  *
147  */
148 static int DecodeVNTagtest03(void)
149 {
150  uint8_t raw_vntag[] = { 0x00, 0x00, 0x00, 0x00, 0x81, 0x00, 0x00, 0x0b, 0x08, 0x00, 0x45, 0x00,
151  0x00, 0x64, 0xac, 0xe6, 0x00, 0x00, 0xff, 0xfd, 0x08, 0xb3, 0x01, 0x01, 0x01, 0x01, 0x01,
152  0x01, 0x02, 0x01, 0xe5, 0xa3, 0x95, 0x5c, 0x5d, 0x82, 0x50, 0x24, 0x6f, 0x56, 0xac, 0xf4,
153  0xf9, 0x9b, 0x28, 0x6a, 0x03, 0xb5, 0xab, 0x15, 0xfe, 0x6c, 0xab, 0x98, 0x0c, 0x4e, 0xcc,
154  0xf4, 0xd1, 0x5b, 0x22, 0x0b, 0x81, 0x39, 0x08, 0xb3, 0xcf, 0xc2, 0x6b, 0x90, 0xe1, 0xcc,
155  0xe6, 0x4f, 0x5f, 0xa0, 0xb6, 0xa8, 0x93, 0x38, 0x8a, 0x17, 0xac, 0x6e, 0x3b, 0xbc, 0xad,
156  0x67, 0xad, 0xfc, 0x91, 0xf0, 0x16, 0x9d, 0xe2, 0xe1, 0xdf, 0x4f, 0x8c, 0xcb, 0xd3, 0xdc,
157  0xd9, 0xed, 0x3c, 0x0c, 0x92, 0xad, 0x8b, 0xf0, 0x2c, 0x2d, 0x55, 0x41 };
158 
159  Packet *p = PacketGetFromAlloc();
160  FAIL_IF_NULL(p);
161 
162  ThreadVars tv = { 0 };
163  DecodeThreadVars dtv = { 0 };
164 
166 
167  FAIL_IF(TM_ECODE_OK != DecodeVNTag(&tv, &dtv, p, raw_vntag, sizeof(raw_vntag)));
168 
169  PACKET_RECYCLE(p);
170  FlowShutdown();
171  PacketFree(p);
172  PASS;
173 }
174 #endif /* UNITTESTS */
175 
177 {
178 #ifdef UNITTESTS
179  UtRegisterTest("DecodeVNTagtest01", DecodeVNTagtest01);
180  UtRegisterTest("DecodeVNTagtest02", DecodeVNTagtest02);
181  UtRegisterTest("DecodeVNTagtest03", DecodeVNTagtest03);
182 #endif /* UNITTESTS */
183 }
184 
185 /**
186  * @}
187  */
host.h
len
uint8_t len
Definition: app-layer-dnp3.h:2
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
VNTAG_UNKNOWN_TYPE
@ VNTAG_UNKNOWN_TYPE
Definition: decode-events.h:152
GET_VNTAG_VERSION
#define GET_VNTAG_VERSION(vntagh)
Definition: decode-vntag.h:33
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:1074
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
DecodeThreadVars_::counter_vntag
uint16_t counter_vntag
Definition: decode.h:688
proto
uint8_t proto
Definition: decode-template.h:0
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:83
util-unittest.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:82
GET_VNTAG_SRC
#define GET_VNTAG_SRC(vntagh)
Definition: decode-vntag.h:34
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:523
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
GET_VNTAG_PROTO
#define GET_VNTAG_PROTO(vntagh)
Definition: decode-vntag.h:35
DecodeVNTag
int DecodeVNTag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-vntag.c:58
DecodeVNTagRegisterTests
void DecodeVNTagRegisterTests(void)
Definition: decode-vntag.c:176
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
pkt-var.h
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:134
util-profiling.h
Packet_
Definition: decode.h:427
GET_VNTAG_DEST
#define GET_VNTAG_DEST(vntagh)
Definition: decode-vntag.h:31
GET_VNTAG_LOOPED
#define GET_VNTAG_LOOPED(vntagh)
Definition: decode-vntag.h:32
VNTAG_HEADER_TOO_SMALL
@ VNTAG_HEADER_TOO_SMALL
Definition: decode-events.h:151
decode-events.h
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
suricata-common.h
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:667
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:173
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:654
GET_VNTAG_DIR
#define GET_VNTAG_DIR(vntagh)
Definition: decode-vntag.h:29
VNTAG_HEADER_LEN
#define VNTAG_HEADER_LEN
Definition: decode-vntag.h:44
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1067
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:42
flow.h
decode-vntag.h
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
PACKET_RECYCLE
#define PACKET_RECYCLE(p)
Definition: decode.h:862
GET_VNTAG_PTR
#define GET_VNTAG_PTR(vntagh)
Definition: decode-vntag.h:30