Mpls fixes v4

src/decode-events.c

@@ -175,6 +175,7 @@ const struct DecodeEvents_ DEvents[] = {
     { "decoder.mpls.bad_label_implicit_null", MPLS_BAD_LABEL_IMPLICIT_NULL, },
     { "decoder.mpls.bad_label_reserved", MPLS_BAD_LABEL_RESERVED, },
     { "decoder.mpls.unknown_payload_type", MPLS_UNKNOWN_PAYLOAD_TYPE, },
+    { "decoder.mpls.too_many_layers", MPLS_HEADER_TOO_MANY_LAYERS, },
 
     /* ERSPAN events */
     { "decoder.erspan.header_too_small", ERSPAN_HEADER_TOO_SMALL, },

src/decode-events.h

@@ -182,6 +182,7 @@ enum {
     MPLS_BAD_LABEL_IMPLICIT_NULL,
     MPLS_BAD_LABEL_RESERVED,
     MPLS_UNKNOWN_PAYLOAD_TYPE,
+    MPLS_HEADER_TOO_MANY_LAYERS,
 
     /* ERSPAN events */
     ERSPAN_HEADER_TOO_SMALL,

src/decode-mpls.c

@@ -61,6 +61,14 @@ int DecodeMPLS(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
         memcpy(&shim, pkt, sizeof(shim));
         pkt += MPLS_HEADER_LEN;
         len -= MPLS_HEADER_LEN;
+
+        if (p->mpls_idx >= MPLS_MAX_LABEL_DEPTH) {
+            ENGINE_SET_EVENT(p, MPLS_HEADER_TOO_MANY_LAYERS);
+            return TM_ECODE_FAILED;
+        }
+
+        p->mpls_id[p->mpls_idx] = MPLS_LABEL(shim);
+        p->mpls_idx ++;
     } while (MPLS_BOTTOM(shim) == 0);
 
     label = MPLS_LABEL(shim);

src/decode-mpls.h

@@ -29,6 +29,9 @@
 #define ETHERNET_TYPE_MPLS_UNICAST   0x8847
 #define ETHERNET_TYPE_MPLS_MULTICAST 0x8848
 
+/** MPLS max label depth */
+#define MPLS_MAX_LABEL_DEPTH 6
+
 void DecodeMPLSRegisterTests(void);
 
 #endif /* !__DECODE_MPLS_H__ */

src/decode-vlan.c

@@ -130,6 +130,11 @@ int DecodeVLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
             break;
         case ETHERNET_TYPE_ARP:
             break;
+        case ETHERNET_TYPE_MPLS_UNICAST:
+        case ETHERNET_TYPE_MPLS_MULTICAST:
+            DecodeMPLS(tv, dtv, p, pkt + VLAN_HEADER_LEN,
+                       len - VLAN_HEADER_LEN, pq);
+            break;
         default:
             SCLogDebug("unknown VLAN type: %" PRIx32 "", proto);
             ENGINE_SET_INVALID_EVENT(p, VLAN_UNKNOWN_TYPE);

src/decode.h

@@ -435,6 +435,9 @@ typedef struct Packet_
     uint16_t vlan_id[2];
     uint8_t vlan_idx;
 
+    uint32_t mpls_id[MPLS_MAX_LABEL_DEPTH];
+    uint8_t mpls_idx;
+
     /* flow */
     uint8_t flowflags;
     /* coccinelle: Packet:flowflags:FLOW_PKT_ */
@@ -757,6 +760,13 @@ void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s);
         (p)->vlan_id[0] = 0;                    \
         (p)->vlan_id[1] = 0;                    \
         (p)->vlan_idx = 0;                      \
+        (p)->mpls_id[0] = 0;                    \
+        (p)->mpls_id[1] = 0;                    \
+        (p)->mpls_id[2] = 0;                    \
+        (p)->mpls_id[3] = 0;                    \
+        (p)->mpls_id[4] = 0;                    \
+        (p)->mpls_id[5] = 0;                    \
+        (p)->mpls_idx = 0;                      \
         (p)->ts.tv_sec = 0;                     \
         (p)->ts.tv_usec = 0;                    \
         (p)->datalink = 0;                      \

src/output-json.c

@@ -754,6 +754,19 @@ json_t *CreateJSONHeader(const Packet *p, enum OutputJsonLogDirection dir,
         }
     }
 
+    /* mpls */
+    if (p->mpls_idx > 0) {
+        json_t *js_mpls;
+        js_mpls = json_array();
+        if (likely(js_mpls != NULL)) {
+            for (uint8_t i = 0; i < p->mpls_idx; i++) {
+                json_array_append_new(js_mpls, json_integer(p->mpls_id[i]));
+            }
+
+            json_object_set_new(js, "mpls", js_mpls);
+        }
+    }
+
     /* 5-tuple */
     JsonFiveTuple(p, dir, js);