OISF/suricata
1
0
Fork 0
mirror of https://github.com/OISF/suricata.git synced 2026-10-11 22:09:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

respond/reject: guard Ethernet setup against non-Ethernet packets

Browse Source 
When running with --reject-dev in autofp mode, the libnet context is
cached thread-locally and t_inject_mode is latched to LIBNET_LINK on the
first reject for an Ethernet packet. Subsequent rejects from different
interfaces that hit the fast path reuse the cached ctx but incorrectly
still call SetupEthernet(), which dereferences PacketGetEthernet() causing
a crash.

To address this check for if a packet is ethernet in all entry points.

Ticket: #8832.
This commit is contained in:
Victor Julien
2026-09-10 19:39:07 +02:00
committed by Victor Julien
parent f93d40bade
commit 4ca3ec5918
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/respond-reject-libnet11.c
+6 -4
View File
@@ -249,6 +249,8 @@ static inline int BuildIPv6(libnet_t *c, Libnet11Packet *lpacket, const uint8_t
static inline void SetupEthernet(Packet *p, Libnet11Packet *lpacket, enum RejectDirection dir)
{
if (!PacketIsEthernet(p))
return;
const EthernetHdr *ethh = PacketGetEthernet(p);
switch (dir) {
case REJECT_DIR_SRC:
@@ -328,7 +330,7 @@ int RejectSendLibnet11IPv4TCP(ThreadVars *tv, Packet *p, void *data, enum Reject
if (BuildIPv4(c, &lpacket, IPPROTO_TCP) < 0)
goto cleanup;
if (t_inject_mode == LIBNET_LINK) {
if (t_inject_mode == LIBNET_LINK && PacketIsEthernet(p)) {
SetupEthernet(p, &lpacket, dir);
if (p->vlan_idx == 1) {
@@ -405,7 +407,7 @@ int RejectSendLibnet11IPv4ICMP(ThreadVars *tv, Packet *p, void *data, enum Rejec
if (BuildIPv4(c, &lpacket, IPPROTO_ICMP) < 0)
goto cleanup;
if (t_inject_mode == LIBNET_LINK) {
if (t_inject_mode == LIBNET_LINK && PacketIsEthernet(p)) {
SetupEthernet(p, &lpacket, dir);
if (p->vlan_idx == 1) {
@@ -470,7 +472,7 @@ int RejectSendLibnet11IPv6TCP(ThreadVars *tv, Packet *p, void *data, enum Reject
if (BuildIPv6(c, &lpacket, IPPROTO_TCP) < 0)
goto cleanup;
if (t_inject_mode == LIBNET_LINK) {
if (t_inject_mode == LIBNET_LINK && PacketIsEthernet(p)) {
SetupEthernet(p, &lpacket, dir);
if (p->vlan_idx == 1) {
if (BuildEthernetVLAN(c, &lpacket, ETHERNET_TYPE_IPV6, p->vlan_id[0]) < 0)
@@ -547,7 +549,7 @@ int RejectSendLibnet11IPv6ICMP(ThreadVars *tv, Packet *p, void *data, enum Rejec
if (BuildIPv6(c, &lpacket, IPPROTO_ICMPV6) < 0)
goto cleanup;
if (t_inject_mode == LIBNET_LINK) {
if (t_inject_mode == LIBNET_LINK && PacketIsEthernet(p)) {
SetupEthernet(p, &lpacket, dir);
if (p->vlan_idx == 1) {
if (BuildEthernetVLAN(c, &lpacket, ETHERNET_TYPE_IPV6, p->vlan_id[0]) < 0)