OISF/suricata
1
0
Fork 0
mirror of https://github.com/OISF/suricata.git synced 2026-10-11 22:09:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

detect: add track pkthdr as any l2 protocol

Browse Source 
To indicate it's not just like `alert ip`.
This commit is contained in:
Victor Julien
2026-03-31 05:34:16 +00:00
parent 61a7f47a69
commit b983ce64ef
3 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/detect-engine-build.c
+2 -1
View File
@@ -1962,7 +1962,8 @@ int SigPrepareStage2(DetectEngineCtx *de_ctx)
}
/* add ethernet sigs and decoder events to the ethernet sgh */
if ((s->type == SIG_TYPE_PKT && SigIsEthernetAddToNonIP(s)) || s->type == SIG_TYPE_DEONLY) {
if ((s->type == SIG_TYPE_PKT && SigIsEthernetAddToNonIP(s)) || s->type == SIG_TYPE_DEONLY ||
(s->init_data->proto.flags & DETECT_PROTO_L2_ANY)) {
// ethernet
SCLogNotice("rule: %u: add to non-IP", s->id);
DetectEngineAddEthernetSig(de_ctx, s);
src/detect-engine-proto.c
+3 -3
View File
@@ -65,7 +65,7 @@ struct {
{ "ipv6", 0, 0, DETECT_PROTO_IPV6 | DETECT_PROTO_ANY, },
{ "ip6", 0, 0, DETECT_PROTO_IPV6 | DETECT_PROTO_ANY, },
{ "ip", 0, 0, DETECT_PROTO_ANY, },
{ "pkthdr", 0, 0, DETECT_PROTO_ANY, },
{ "pkthdr", 0, 0, DETECT_PROTO_L2_ANY, },
{ "ether", 0, 0, DETECT_PROTO_ETHERNET, },
{ "arp", 0, 0, DETECT_PROTO_ARP | DETECT_PROTO_ETHERNET, },
// clang-format on
@@ -114,7 +114,7 @@ int DetectProtoParse(DetectProto *dp, const char *str)
* \retval 1 protocol is in the set */
int DetectProtoContainsProto(const DetectProto *dp, int proto)
{
if (dp == NULL || dp->flags & DETECT_PROTO_ANY)
if (dp == NULL || dp->flags & (DETECT_PROTO_ANY | DETECT_PROTO_L2_ANY))
return 1;
if (dp->proto[proto / 8] & (1<<(proto % 8)))
@@ -132,7 +132,7 @@ int DetectProtoContainsProto(const DetectProto *dp, int proto)
* \retval true protocol is in the set */
bool DetectProtoHasExplicitProto(const DetectProto *dp, const uint8_t proto)
{
if (dp == NULL || dp->flags & DETECT_PROTO_ANY)
if (dp == NULL || dp->flags & (DETECT_PROTO_ANY | DETECT_PROTO_L2_ANY))
return false;
return ((dp->proto[proto / 8] & (1 << (proto % 8))));
src/detect-engine-proto.h
+1
View File
@@ -32,6 +32,7 @@
#define DETECT_PROTO_IPV6 BIT_U8(4) /**< IPv6 only */
#define DETECT_PROTO_ETHERNET BIT_U8(5) /**< Like ANY, but for Ethernet */
#define DETECT_PROTO_ARP BIT_U8(6) /**< ARP packets over for Ethernet, can have VLAN(s) in between */
#define DETECT_PROTO_L2_ANY BIT_U8(7) /**< Like ANY, but for any L2 proto. */
// clang-format on
typedef struct DetectProto_ {