23374838686

Committed 21 Mar 2026 07:29AM UTC coverage: 59.341% (-20.0%) from 79.315%

Build # 23374838686

Build Type

Pull #15075

github

Committed by

web-flow

Commit Message

Merge 90b4e834f into 6587e363a

Pull Request Pull Request #15075: Stack 8001 v16.4

Coverage Stats

38 of 70 new or added lines in 10 files covered. (54.29%)

34165 existing lines in 563 files now uncovered.

119621 of 201584 relevant lines covered (59.34%)

650666.92 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

88.89

/src/decode-ethernet.c

/* Copyright (C) 2007-2021 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

/**
 * \ingroup decode
 *
 * @{
 */


/**
 * \file
 *
 * \author Victor Julien <victor@inliniac.net>
 *
 * Decode Ethernet
 */

#include "suricata-common.h"
#include "decode.h"
#include "decode-ethernet.h"
#include "decode-events.h"

#include "util-validate.h"
#include "util-unittest.h"
#include "util-debug.h"

int DecodeEthernet(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
                   const uint8_t *pkt, uint32_t len)
{
    DEBUG_VALIDATE_BUG_ON(pkt == NULL);

    StatsCounterIncr(&tv->stats, dtv->counter_eth);

    if (unlikely(len < ETHERNET_HEADER_LEN)) {
        ENGINE_SET_INVALID_EVENT(p, ETHERNET_PKT_TOO_SMALL);
        return TM_ECODE_FAILED;
    }

    if (!PacketIncreaseCheckLayers(p)) {
        return TM_ECODE_FAILED;
    }
    EthernetHdr *ethh = PacketSetEthernet(p, pkt);

    SCLogDebug("p %p pkt %p ether type %04x", p, pkt, SCNtohs(ethh->eth_type));

    DecodeNetworkLayer(tv, dtv, SCNtohs(ethh->eth_type), p, pkt + ETHERNET_HEADER_LEN,
            len - ETHERNET_HEADER_LEN);

    return TM_ECODE_OK;
}

#ifdef UNITTESTS
/** DecodeEthernettest01
 *  \brief Valid Ethernet packet
 *  \retval 0 Expected test value
 */
static int DecodeEthernetTest01 (void)
{
    /* ICMP packet wrapped in PPPOE */
    uint8_t raw_eth[] = {
        0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
        0x94, 0x56, 0x00, 0x01, 0x88, 0x64, 0x11, 0x00,
        0x00, 0x01, 0x00, 0x68, 0x00, 0x21, 0x45, 0xc0,
        0x00, 0x64, 0x00, 0x1e, 0x00, 0x00, 0xff, 0x01,
        0xa7, 0x78, 0x0a, 0x00, 0x00, 0x02, 0x0a, 0x00,
        0x00, 0x01, 0x08, 0x00, 0x4a, 0x61, 0x00, 0x06,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f,
        0x3b, 0xd4, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
        0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
        0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
        0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
        0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
        0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
        0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
        0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
        0xab, 0xcd };

    Packet *p = PacketGetFromAlloc();
    if (unlikely(p == NULL))
        return 0;
    ThreadVars tv;
    DecodeThreadVars dtv;

    memset(&dtv, 0, sizeof(DecodeThreadVars));
    memset(&tv,  0, sizeof(ThreadVars));

    DecodeEthernet(&tv, &dtv, p, raw_eth, sizeof(raw_eth));

    PacketFree(p);
    return 1;
}

/**
 * Test a DCE ethernet frame that is too small.
 */
static int DecodeEthernetTestDceTooSmall(void)
{
    uint8_t raw_eth[] = {
        0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
        0x94, 0x56, 0x00, 0x01, 0x89, 0x03,
    };

    Packet *p = PacketGetFromAlloc();
    FAIL_IF_NULL(p);
    ThreadVars tv;
    DecodeThreadVars dtv;

    memset(&dtv, 0, sizeof(DecodeThreadVars));
    memset(&tv,  0, sizeof(ThreadVars));

    DecodeEthernet(&tv, &dtv, p, raw_eth, sizeof(raw_eth));

    FAIL_IF_NOT(ENGINE_ISSET_EVENT(p, DCE_PKT_TOO_SMALL));

    PacketFree(p);
    PASS;
}

/**
 * Test that a DCE ethernet frame, followed by data that is too small
 * for an ethernet header.
 *
 * Redmine issue:
 * https://redmine.openinfosecfoundation.org/issues/2887
 */
static int DecodeEthernetTestDceNextTooSmall(void)
{
    uint8_t raw_eth[] = {
        0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
        0x94, 0x56, 0x00, 0x01, 0x89, 0x03, //0x88, 0x64,

        0x00, 0x00,

        0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
        0x94, 0x56, 0x00, 0x01,
    };

    Packet *p = PacketGetFromAlloc();
    FAIL_IF_NULL(p);
    ThreadVars tv;
    DecodeThreadVars dtv;

    memset(&dtv, 0, sizeof(DecodeThreadVars));
    memset(&tv,  0, sizeof(ThreadVars));

    DecodeEthernet(&tv, &dtv, p, raw_eth, sizeof(raw_eth));

    FAIL_IF_NOT(ENGINE_ISSET_EVENT(p, DCE_PKT_TOO_SMALL));

    PacketFree(p);
    PASS;
}

#endif /* UNITTESTS */


/**
 * \brief Registers Ethernet unit tests
 * \todo More Ethernet tests
 */
void DecodeEthernetRegisterTests(void)
{
#ifdef UNITTESTS
    UtRegisterTest("DecodeEthernetTest01", DecodeEthernetTest01);
    UtRegisterTest("DecodeEthernetTestDceNextTooSmall",
            DecodeEthernetTestDceNextTooSmall);
    UtRegisterTest("DecodeEthernetTestDceTooSmall",
            DecodeEthernetTestDceTooSmall);
#endif /* UNITTESTS */
}
/**
 * @}
 */

1	/* Copyright (C) 2007-2021 Open Information Security Foundation
2	*
3	* You can copy, redistribute or modify this Program under the terms of
4	* the GNU General Public License version 2 as published by the Free
5	* Software Foundation.
6	*
7	* This program is distributed in the hope that it will be useful,
8	* but WITHOUT ANY WARRANTY; without even the implied warranty of
9	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10	* GNU General Public License for more details.
11	*
12	* You should have received a copy of the GNU General Public License
13	* version 2 along with this program; if not, write to the Free Software
14	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15	* 02110-1301, USA.
16	*/
17
18	/**
19	* \ingroup decode
20	*
21	* @{
22	*/
23
24
25	/**
26	* \file
27	*
28	* \author Victor Julien <victor@inliniac.net>
29	*
30	* Decode Ethernet
31	*/
32
33	#include "suricata-common.h"
34	#include "decode.h"
35	#include "decode-ethernet.h"
36	#include "decode-events.h"
37
38	#include "util-validate.h"
39	#include "util-unittest.h"
40	#include "util-debug.h"
41
42	int DecodeEthernet(ThreadVars tv, DecodeThreadVars dtv, Packet *p,
43	const uint8_t *pkt, uint32_t len)
44	{	1,528,050✔
45	DEBUG_VALIDATE_BUG_ON(pkt == NULL);	1,528,050✔
46
47	StatsCounterIncr(&tv->stats, dtv->counter_eth);	1,528,050✔
48
49	if (unlikely(len < ETHERNET_HEADER_LEN)) {	1,528,050✔
50	ENGINE_SET_INVALID_EVENT(p, ETHERNET_PKT_TOO_SMALL);	125,789✔
51	return TM_ECODE_FAILED;	125,789✔
52	}	125,789✔
53
54	if (!PacketIncreaseCheckLayers(p)) {	1,402,261✔
55	return TM_ECODE_FAILED;	206✔
56	}	206✔
57	EthernetHdr *ethh = PacketSetEthernet(p, pkt);	1,402,055✔
58
59	SCLogDebug("p %p pkt %p ether type %04x", p, pkt, SCNtohs(ethh->eth_type));	1,402,055✔
60
61	DecodeNetworkLayer(tv, dtv, SCNtohs(ethh->eth_type), p, pkt + ETHERNET_HEADER_LEN,	1,402,055✔
62	len - ETHERNET_HEADER_LEN);	1,402,055✔
63
64	return TM_ECODE_OK;	1,402,055✔
65	}	1,402,261✔
66
67	#ifdef UNITTESTS
68	/** DecodeEthernettest01
69	* \brief Valid Ethernet packet
70	* \retval 0 Expected test value
71	*/
72	static int DecodeEthernetTest01 (void)
73	{
74	/* ICMP packet wrapped in PPPOE */
75	uint8_t raw_eth[] = {
76	0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
77	0x94, 0x56, 0x00, 0x01, 0x88, 0x64, 0x11, 0x00,
78	0x00, 0x01, 0x00, 0x68, 0x00, 0x21, 0x45, 0xc0,
79	0x00, 0x64, 0x00, 0x1e, 0x00, 0x00, 0xff, 0x01,
80	0xa7, 0x78, 0x0a, 0x00, 0x00, 0x02, 0x0a, 0x00,
81	0x00, 0x01, 0x08, 0x00, 0x4a, 0x61, 0x00, 0x06,
82	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f,
83	0x3b, 0xd4, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
84	0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
85	0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
86	0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
87	0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
88	0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
89	0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
90	0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
91	0xab, 0xcd };
92
93	Packet *p = PacketGetFromAlloc();
94	if (unlikely(p == NULL))
95	return 0;
96	ThreadVars tv;
97	DecodeThreadVars dtv;
98
99	memset(&dtv, 0, sizeof(DecodeThreadVars));
100	memset(&tv, 0, sizeof(ThreadVars));
101
102	DecodeEthernet(&tv, &dtv, p, raw_eth, sizeof(raw_eth));
103
104	PacketFree(p);
105	return 1;
106	}
107
108	/**
109	* Test a DCE ethernet frame that is too small.
110	*/
111	static int DecodeEthernetTestDceTooSmall(void)
112	{
113	uint8_t raw_eth[] = {
114	0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
115	0x94, 0x56, 0x00, 0x01, 0x89, 0x03,
116	};
117
118	Packet *p = PacketGetFromAlloc();
119	FAIL_IF_NULL(p);
120	ThreadVars tv;
121	DecodeThreadVars dtv;
122
123	memset(&dtv, 0, sizeof(DecodeThreadVars));
124	memset(&tv, 0, sizeof(ThreadVars));
125
126	DecodeEthernet(&tv, &dtv, p, raw_eth, sizeof(raw_eth));
127
128	FAIL_IF_NOT(ENGINE_ISSET_EVENT(p, DCE_PKT_TOO_SMALL));
129
130	PacketFree(p);
131	PASS;
132	}
133
134	/**
135	* Test that a DCE ethernet frame, followed by data that is too small
136	* for an ethernet header.
137	*
138	* Redmine issue:
139	* https://redmine.openinfosecfoundation.org/issues/2887
140	*/
141	static int DecodeEthernetTestDceNextTooSmall(void)
142	{
143	uint8_t raw_eth[] = {
144	0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
145	0x94, 0x56, 0x00, 0x01, 0x89, 0x03, //0x88, 0x64,
146
147	0x00, 0x00,
148
149	0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
150	0x94, 0x56, 0x00, 0x01,
151	};
152
153	Packet *p = PacketGetFromAlloc();
154	FAIL_IF_NULL(p);
155	ThreadVars tv;
156	DecodeThreadVars dtv;
157
158	memset(&dtv, 0, sizeof(DecodeThreadVars));
159	memset(&tv, 0, sizeof(ThreadVars));
160
161	DecodeEthernet(&tv, &dtv, p, raw_eth, sizeof(raw_eth));
162
163	FAIL_IF_NOT(ENGINE_ISSET_EVENT(p, DCE_PKT_TOO_SMALL));
164
165	PacketFree(p);
166	PASS;
167	}
168
169	#endif /* UNITTESTS */
170
171
172	/**
173	* \brief Registers Ethernet unit tests
174	* \todo More Ethernet tests
175	*/
176	void DecodeEthernetRegisterTests(void)
UNCOV 177	{	×
178	#ifdef UNITTESTS
179	UtRegisterTest("DecodeEthernetTest01", DecodeEthernetTest01);
180	UtRegisterTest("DecodeEthernetTestDceNextTooSmall",
181	DecodeEthernetTestDceNextTooSmall);
182	UtRegisterTest("DecodeEthernetTestDceTooSmall",
183	DecodeEthernetTestDceTooSmall);
184	#endif /* UNITTESTS */
UNCOV 185	}	×
186	/**
187	* @}
188	*/

OISF / suricata / 23374838686

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous