detect: add vlan keyword - v11

[AkakiAlice]

Ticket: #1065

Contribution style:

• I have read the contributing guide lines at
  https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html

Our Contribution agreements:

• I have signed the Open Information Security Foundation contribution agreement at
  https://suricata.io/about/contribution-agreement/ (note: this is only required once)

Changes (if applicable):

• I have updated the User Guide (in doc/userguide/) to reflect the changes made
• I have updated the JSON schema (in etc/schema.json) to reflect all logging changes
  (including schema descriptions)
• I have created a ticket at
  https://redmine.openinfosecfoundation.org/projects/suricata/issues

Link to ticket: https://redmine.openinfosecfoundation.org/issues/1065

Description:

• introduce vlan.id and vlan.layers keywords

Changes:

• rename public rust functions rs_detect_vlan_id_free and rs_detect_vlan_id_parse to SCDetectVlanIdFree and SCDetectVlanIdParse

SV_BRANCH=OISF/suricata-verify#2222
Previous PR: #12374

[catenacyber]

Approved previous PR and the diff looks good to fix the nit by Victor

[codecov]

Codecov Report

Attention: Patch coverage is 88.66397% with 28 lines in your changes missing coverage. Please review.

Project coverage is 82.49%. Comparing base (05853fb) to head (b315022).
Report is 7 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #12386      +/-   ##
==========================================
+ Coverage   82.46%   82.49%   +0.02%     
==========================================
  Files         914      916       +2     
  Lines      258316   258563     +247     
==========================================
+ Hits       213030   213295     +265     
+ Misses      45286    45268      -18     

Flag	Coverage Δ
fuzzcorpus	60.33% <13.42%> (-0.05%)	⬇️
livemode	19.39% <13.42%> (-0.01%)	⬇️
pcap	44.28% <13.42%> (-0.06%)	⬇️
suricata-verify	63.29% <78.37%> (+0.02%)	⬆️
unittests	58.05% <55.46%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

WARNING:

field	baseline	test	%
	SURI_TLPR1_stats_chk
.uptime	651	624	95.85%

Pipeline 24188

[victorjulien]

Haven't looked at why, but in my FreeBSD 13 builder, this fails to build:

  CC       detect-vlan.o
detect-vlan.c:33:14: error: use of undeclared identifier 'DETECT_VLAN_ID_ANY'; did you mean 'DETECT_VLAN_ID'?
   33 |         case DETECT_VLAN_ID_ANY:
      |              ^~~~~~~~~~~~~~~~~~
      |              DETECT_VLAN_ID
./detect-engine-register.h:336:5: note: 'DETECT_VLAN_ID' declared here
  336 |     DETECT_VLAN_ID,
      |     ^
detect-vlan.c:40:14: error: use of undeclared identifier 'DETECT_VLAN_ID_ALL'; did you mean 'DETECT_VLAN_ID'?
   40 |         case DETECT_VLAN_ID_ALL:
      |              ^~~~~~~~~~~~~~~~~~
      |              DETECT_VLAN_ID
./detect-engine-register.h:336:5: note: 'DETECT_VLAN_ID' declared here
  336 |     DETECT_VLAN_ID,
      |     ^
detect-vlan.c:40:14: error: overflow converting case value to switch condition type (269 to 13) [-Werror,-Wswitch]
   40 |         case DETECT_VLAN_ID_ALL:
      |              ^
detect-vlan.c:33:14: error: overflow converting case value to switch condition type (269 to 13) [-Werror,-Wswitch]
   33 |         case DETECT_VLAN_ID_ANY:
      |              ^
detect-vlan.c:40:14: error: duplicate case value 'DETECT_VLAN_ID'
   40 |         case DETECT_VLAN_ID_ALL:
      |              ^
detect-vlan.c:33:14: note: previous case defined here
   33 |         case DETECT_VLAN_ID_ANY:
      |              ^
5 errors generated.

[victorjulien]

Hmm the rust/gen/rust-bindings.h file doesn't have the definitions, it seems:

$ grep VLAN rust/gen/rust-bindings.h 
     * Layer can be DETECT_VLAN_ID_ANY to match with any vlan layer
     * DETECT_VLAN_ID_ALL to match if all layers match, or an integer
     * within the range -VLAN_MAX_LAYERS to VLAN_MAX_LAYERS-1 for indexing.

[victorjulien]

It seems it is using a local cbindgen, which appears to be out of date. Trying again after updating it.

[victorjulien]

Ok, it works now. Sorry for the noise.

[victorjulien]

Merged in #12393, thanks!