flow: swap MACs when flow direction is swapped

When FlowSwap() reverses the direction of a flow, the MAC address sets
stored in the flow also need to be swapped to maintain consistency with
the new direction. Previously, MAC addresses were not swapped along with
other flow properties like packet/byte counters.

Ticket #8172

src/flow.c

@@ -269,6 +269,13 @@ void FlowSwap(Flow *f)
 
     SWAP_VARS(uint32_t, f->todstpktcnt, f->tosrcpktcnt);
     SWAP_VARS(uint64_t, f->todstbytecnt, f->tosrcbytecnt);
+
+    if (MacSetFlowStorageEnabled()) {
+        MacSet *ms = FlowGetStorageById(f, MacSetGetFlowStorageID());
+        if (ms != NULL) {
+            MacSetSwap(ms);
+        }
+    }
 }
 
 /**

src/util-macset.c

@@ -292,6 +292,29 @@ void MacSetFree(MacSet *ms)
     (void)SC_ATOMIC_SUB(flow_memuse, total_free);
 }
 
+void MacSetSwap(MacSet *ms)
+{
+    if (ms == NULL)
+        return;
+
+    MacAddr tmp_single;
+    memcpy(tmp_single, ms->singles[0], sizeof(MacAddr));
+    memcpy(ms->singles[0], ms->singles[1], sizeof(MacAddr));
+    memcpy(ms->singles[1], tmp_single, sizeof(MacAddr));
+
+    MacSetState tmp_state = ms->state[0];
+    ms->state[0] = ms->state[1];
+    ms->state[1] = tmp_state;
+
+    MacAddr *tmp_buf = ms->buf[0];
+    ms->buf[0] = ms->buf[1];
+    ms->buf[1] = tmp_buf;
+
+    int tmp_last = ms->last[0];
+    ms->last[0] = ms->last[1];
+    ms->last[1] = tmp_last;
+}
+
 #ifdef UNITTESTS
 
 static int CheckTest1Membership(uint8_t *addr, MacSetSide side, void *data)

src/util-macset.h

@@ -41,6 +41,7 @@ void MacSetFree(MacSet *);
 void MacSetRegisterFlowStorage(void);
 FlowStorageId MacSetGetFlowStorageID(void);
 bool MacSetFlowStorageEnabled(void);
+void MacSetSwap(MacSet *);
 void MacSetRegisterTests(void);
 
 #endif /* SURICATA_UTIL_MACSET_H */