packet: track outgoing livedev id

src/decode.h

@@ -620,6 +620,8 @@ typedef struct Packet_
 
     /* Incoming interface */
     uint16_t livedev_id;
+    /* Outgoing interface (bridge modes) */
+    uint16_t livedev_dst_id;
 
     PacketAlerts alerts;
 

src/packet.c

@@ -75,6 +75,7 @@ void PacketInit(Packet *p)
     SCSpinInit(&p->persistent.tunnel_lock, 0);
     p->alerts.alerts = PacketAlertCreate();
     p->livedev_id = 0;
+    p->livedev_dst_id = 0;
 }
 
 void PacketReleaseRefs(Packet *p)
@@ -151,6 +152,7 @@ void PacketReinit(Packet *p)
     p->tunnel_verdicted = false;
     p->root = NULL;
     p->livedev_id = 0;
+    p->livedev_dst_id = 0;
     PACKET_PROFILING_RESET(p);
     p->tenant_id = 0;
     p->nb_decoded_layers = 0;

src/source-af-packet.c

@@ -507,6 +507,10 @@ static TmEcode AFPPeersListAdd(AFPThreadVars *ptv)
     (void)SC_ATOMIC_SET(peer->sock_usage, 0);
     (void)SC_ATOMIC_SET(peer->state, AFP_STATE_DOWN);
     strlcpy(peer->iface, ptv->iface, AFP_IFACE_NAME_LENGTH);
+
+    peer->livedev_id = LiveDeviceGetId(ptv->livedev);
+    SCLogDebug("mpeer livedev id %u (%s)", peer->livedev_id, peer->iface);
+
     ptv->mpeer = peer;
     /* add element to iface list */
     TAILQ_INSERT_TAIL(&peerslist.peers, peer, next);
@@ -799,6 +803,11 @@ static void AFPReadFromRingSetupPacket(
     p->afp_v.copy_mode = ptv->copy_mode;
     p->afp_v.peer = (p->afp_v.copy_mode == AFP_COPY_MODE_NONE) ? NULL : ptv->mpeer->peer;
 
+    if (p->afp_v.copy_mode != AFP_COPY_MODE_NONE) {
+        p->afp_v.peer = ptv->mpeer->peer;
+        p->livedev_dst_id = ptv->mpeer->peer->livedev_id;
+    }
+
     /* Timestamp */
     p->ts = (SCTime_t){ .secs = h.h2->tp_sec, .usecs = h.h2->tp_nsec / 1000 };
     SCLogDebug("pktlen: %" PRIu32 " (pkt %p, pkt data %p)", GET_PKT_LEN(p), p, GET_PKT_DATA(p));

src/source-af-packet.h

@@ -138,6 +138,7 @@ typedef struct AFPPeer_ {
     SC_ATOMIC_DECLARE(uint64_t, send_errors);
     int turn; /**< Field used to store initialisation order. */
     SC_ATOMIC_DECLARE(uint8_t, state);
+    uint16_t livedev_id; /**< livedev id for this interface */
     struct AFPPeer_ *peer;
     TAILQ_ENTRY(AFPPeer_) next;
     char iface[AFP_IFACE_NAME_LENGTH];