From 23850bec36ecc24e5bd33561318e4853a3cdd68f Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Sat, 28 Dec 2019 09:44:56 -0500 Subject: [PATCH] decode: Handle ERSPAN Type I (cherry picked from commit aec4e9a032855a710d71a4c397affcdce5351b39) (cherry picked from commit 237964a6ee7862f783b15c1e7ce469ca1edd3b01) --- src/decode-erspan.c | 22 ++++++++++++++++++---- src/decode-gre.c | 12 ++++++++++-- src/decode.c | 6 ++++-- src/decode.h | 7 +++++-- 4 files changed, 37 insertions(+), 10 deletions(-) diff --git a/src/decode-erspan.c b/src/decode-erspan.c index 53f43fa240..fb7cb69dad 100644 --- a/src/decode-erspan.c +++ b/src/decode-erspan.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2015 Open Information Security Foundation +/* Copyright (C) 2020 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -27,7 +27,7 @@ * * \author Victor Julien * - * Decodes ERSPAN + * Decodes ERSPAN Types I and II */ #include "suricata-common.h" @@ -40,10 +40,24 @@ #include "util-debug.h" /** - * \brief Function to decode ERSPAN packets + * \brief Functions to decode ERSPAN Type I and II packets */ -int DecodeERSPAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq) +/** + * \brief ERSPAN Type I + */ +int DecodeERSPANTypeI(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, + uint8_t *pkt, uint32_t len, PacketQueue *pq) +{ + StatsIncr(tv, dtv->counter_erspan); + + return DecodeEthernet(tv, dtv, p, pkt, len, pq); +} + +/** + * \brief ERSPAN Type II + */ +int DecodeERSPANTypeII(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq) { StatsIncr(tv, dtv->counter_erspan); diff --git a/src/decode-gre.c b/src/decode-gre.c index 45dbc240ca..75b148e685 100644 --- a/src/decode-gre.c +++ b/src/decode-gre.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2007-2013 Open Information Security Foundation +/* Copyright (C) 2007-2020 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -252,8 +252,16 @@ int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, ui case ETHERNET_TYPE_ERSPAN: { if (pq != NULL) { + // Determine if it's Type I or Type II based on the flags in the GRE header. + // Type I: 0|0|0|0|0|00000|000000000|00000 + // Type II: 0|0|0|1|0|00000|000000000|00000 + // Seq Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt + header_len, - len - header_len, DECODE_TUNNEL_ERSPAN, pq); + len - header_len, + GRE_FLAG_ISSET_SQ(p->greh) == 0 ? + DECODE_TUNNEL_ERSPANI : + DECODE_TUNNEL_ERSPANII, + pq); if (tp != NULL) { PKT_SET_SRC(tp, PKT_SRC_DECODER_GRE); PacketEnqueue(pq,tp); diff --git a/src/decode.c b/src/decode.c index 4d5dafe60f..f897c96241 100644 --- a/src/decode.c +++ b/src/decode.c @@ -87,8 +87,10 @@ int DecodeTunnel(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, return DecodeVLAN(tv, dtv, p, pkt, len, pq); case DECODE_TUNNEL_ETHERNET: return DecodeEthernet(tv, dtv, p, pkt, len, pq); - case DECODE_TUNNEL_ERSPAN: - return DecodeERSPAN(tv, dtv, p, pkt, len, pq); + case DECODE_TUNNEL_ERSPANII: + return DecodeERSPANTypeII(tv, dtv, p, pkt, len, pq); + case DECODE_TUNNEL_ERSPANI: + return DecodeERSPANTypeI(tv, dtv, p, pkt, len, pq); default: SCLogDebug("FIXME: DecodeTunnel: protocol %" PRIu32 " not supported.", proto); break; diff --git a/src/decode.h b/src/decode.h index 094b157b21..a606be65c9 100644 --- a/src/decode.h +++ b/src/decode.h @@ -1,4 +1,4 @@ -/* Copyright (C) 2007-2013 Open Information Security Foundation +/* Copyright (C) 2007-2020 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -905,7 +905,8 @@ void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s); enum DecodeTunnelProto { DECODE_TUNNEL_ETHERNET, - DECODE_TUNNEL_ERSPAN, + DECODE_TUNNEL_ERSPANII, + DECODE_TUNNEL_ERSPANI, DECODE_TUNNEL_VLAN, DECODE_TUNNEL_IPV4, DECODE_TUNNEL_IPV6, @@ -958,6 +959,8 @@ int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, int DecodeVXLAN(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *); int DecodeMPLS(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *); int DecodeERSPAN(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *); +int DecodeERSPANTypeII(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *); +int DecodeERSPANTypeI(ThreadVars *, DecodeThreadVars *, Packet *, uint8_t *, uint32_t, PacketQueue *); int DecodeTEMPLATE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t, PacketQueue *); #ifdef UNITTESTS