OISF/suricata
1
0
Fork 0
mirror of https://github.com/OISF/suricata.git synced 2026-10-11 22:09:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

decode/etag: ETag 802.1BR decoder

Browse Source 
Ticket: #3953.
This commit is contained in:
Fupeng Zhao
2025-09-20 09:08:37 +02:00
committed by Victor Julien
parent cb9ab951b9
commit e79d735374
12 changed files with 247 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/userguide/rules/decode-layer.rst
+1
View File
@@ -36,6 +36,7 @@ the following ethertype values::
ETHERNET_TYPE_MPLS_UNICAST
ETHERNET_TYPE_MPLS_MULTICAST
ETHERNET_TYPE_DCE
ETHERNET_TYPE_ETAG
ETHERNET_TYPE_VNTAG
ETHERNET_TYPE_NSH
ETHERNET_TYPE_PPOE_SESS
etc/schema.json
+16
View File
@@ -6235,6 +6235,10 @@
"type": "integer",
"description": "Number of ESP packets decoded"
},
"etag": {
"type": "integer",
"description": "Number of ETAG packets decoded"
},
"ethernet": {
"type": "integer",
"description": "Number of Ethernet packets decoded"
@@ -6337,6 +6341,18 @@
}
}
},
"etag": {
"type": "object",
"additionalProperties": false,
"properties": {
"header_too_small": {
"type": "integer"
},
"unknown_type": {
"type": "integer"
}
}
},
"ethernet": {
"type": "object",
"additionalProperties": false,
rules/decoder-events.rules
+3 -1
View File
@@ -102,6 +102,8 @@ alert pkthdr any any -> any any (msg:"SURICATA VLAN too many layers"; decode-eve
alert pkthdr any any -> any any (msg:"SURICATA VNTAG header too small"; decode-event:vntag.header_too_small; classtype:protocol-command-decode; sid:2200117; rev:1;)
alert pkthdr any any -> any any (msg:"SURICATA VNTAG unknown type"; decode-event:vntag.unknown_type; classtype:protocol-command-decode; sid:2200118; rev:1;)
alert pkthdr any any -> any any (msg:"SURICATA IEEE802.1AH header too small"; decode-event:ieee8021ah.header_too_small; classtype:protocol-command-decode; sid:2200112; rev:1;)
alert pkthdr any any -> any any (msg:"SURICATA ETAG header too small"; decode-event:etag.header_too_small; classtype:protocol-command-decode; sid:2200123; rev:1;)
alert pkthdr any any -> any any (msg:"SURICATA ETAG unknown type"; decode-event:etag.unknown_type; classtype:protocol-command-decode; sid:2200124; rev:1;)
alert pkthdr any any -> any any (msg:"SURICATA IP raw invalid IP version "; decode-event:ipraw.invalid_ip_version; classtype:protocol-command-decode; sid:2200068; rev:2;)
alert pkthdr any any -> any any (msg:"SURICATA FRAG IPv4 Packet size too large"; decode-event:ipv4.frag_pkt_too_large; classtype:protocol-command-decode; sid:2200069; rev:3;)
@@ -155,5 +157,5 @@ alert pkthdr any any -> any any (msg:"SURICATA packet with too many layers"; dec
# Capture events.
alert pkthdr any any -> any any (msg:"SURICATA AF-PACKET truncated packet"; decode-event:afpacket.trunc_pkt; classtype:protocol-command-decode; sid:2200122; rev:1;)
# next sid is 2200123
# next sid is 2200125
src/Makefile.am
+2
View File
@@ -66,6 +66,7 @@ noinst_HEADERS = \
decode-chdlc.h \
decode-erspan.h \
decode-esp.h \
decode-etag.h \
decode-ethernet.h \
decode-events.h \
decode-geneve.h \
@@ -666,6 +667,7 @@ libsuricata_c_a_SOURCES = \
decode-chdlc.c \
decode-erspan.c \
decode-esp.c \
decode-etag.c \
decode-ethernet.c \
decode-events.c \
decode-geneve.c \
src/decode-etag.c
+161
View File
@@ -0,0 +1,161 @@
/* Copyright (C) 2025 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \ingroup decode
*
* @{
*/
/**
* \file
*
* \author Fupeng Zhao <[email protected]>
*
* Decode 802.1BR E-Tag headers
*
* This implementation is based on the following specification doc:
* https://www.scribd.com/document/262742673/802-1BR-2012-pdf
*/
#include "suricata-common.h"
#include "decode-etag.h"
#include "decode.h"
#include "decode-events.h"
#include "util-validate.h"
#include "util-unittest.h"
#include "util-debug.h"
int DecodeETag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
{
DEBUG_VALIDATE_BUG_ON(pkt == NULL);
StatsIncr(tv, dtv->counter_etag);
if (len < ETAG_HEADER_LEN) {
ENGINE_SET_INVALID_EVENT(p, ETAG_HEADER_TOO_SMALL);
return TM_ECODE_FAILED;
}
if (!PacketIncreaseCheckLayers(p)) {
return TM_ECODE_FAILED;
}
const ETagHdr *etag_hdr = (const ETagHdr *)pkt;
uint16_t proto = SCNtohs(etag_hdr->protocol);
if (DecodeNetworkLayer(tv, dtv, proto, p, pkt + ETAG_HEADER_LEN, len - ETAG_HEADER_LEN) ==
false) {
ENGINE_SET_INVALID_EVENT(p, ETAG_UNKNOWN_TYPE);
return TM_ECODE_FAILED;
}
return TM_ECODE_OK;
}
#ifdef UNITTESTS
#include "util-unittest-helper.h"
#include "packet.h"
/**
* \test DecodeETagTest01 test if etag header is too small.
*/
static int DecodeETagTest01(void)
{
uint8_t raw_etag[] = { 0x00, 0x20, 0x08 };
Packet *p = PacketGetFromAlloc();
FAIL_IF_NULL(p);
ThreadVars tv = { 0 };
DecodeThreadVars dtv = { 0 };
FAIL_IF(TM_ECODE_OK == DecodeETag(&tv, &dtv, p, raw_etag, sizeof(raw_etag)));
FAIL_IF_NOT(ENGINE_ISSET_EVENT(p, ETAG_HEADER_TOO_SMALL));
PacketFree(p);
PASS;
}
/**
* \test DecodeETagTest02 test if etag header has unknown type.
*/
static int DecodeETagTest02(void)
{
uint8_t raw_etag[] = { 0x10, 0x00, 0x00, 0xd8, 0x00, 0x00, 0xFF, 0x00, 0x45, 0x00, 0x00, 0x34,
0x3B, 0x09, 0x40, 0x00, 0x7F, 0x06, 0x2E, 0x3A, 0xC0, 0xA8, 0x01, 0x2C, 0xC0, 0xA8, 0x10,
0x04, 0x00, 0x19, 0x29, 0x2B, 0x3E, 0xE9, 0x31, 0x81, 0x20, 0x04, 0x4B, 0x9A, 0x80, 0x10,
0x3E, 0xB8, 0x8E, 0x3C, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0A, 0x5F, 0x3E, 0xE4, 0xAA, 0x63,
0x0E, 0x6B, 0x03, 0x07, 0x69 };
Packet *p = PacketGetFromAlloc();
FAIL_IF_NULL(p);
ThreadVars tv = { 0 };
DecodeThreadVars dtv = { 0 };
FAIL_IF_NOT(TM_ECODE_OK != DecodeETag(&tv, &dtv, p, raw_etag, sizeof(raw_etag)));
FAIL_IF_NOT(ENGINE_ISSET_EVENT(p, ETAG_UNKNOWN_TYPE));
PacketFree(p);
PASS;
}
/**
* \test DecodeETagTest03 test a good etag header.
*/
static int DecodeETagTest03(void)
{
uint8_t raw_etag[] = { 0x10, 0x00, 0x00, 0xd8, 0x00, 0x00, 0x08, 0x00, 0x45, 0x00, 0x00, 0x34,
0x3B, 0x09, 0x40, 0x00, 0x7F, 0x06, 0x2E, 0x3A, 0xC0, 0xA8, 0x01, 0x2C, 0xC0, 0xA8, 0x10,
0x04, 0x00, 0x19, 0x29, 0x2B, 0x3E, 0xE9, 0x31, 0x81, 0x20, 0x04, 0x4B, 0x9A, 0x80, 0x10,
0x3E, 0xB8, 0x8E, 0x3C, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0A, 0x5F, 0x3E, 0xE4, 0xAA, 0x63,
0x0E, 0x6B, 0x03, 0x07, 0x69 };
Packet *p = PacketGetFromAlloc();
FAIL_IF_NULL(p);
ThreadVars tv = { 0 };
DecodeThreadVars dtv = { 0 };
FlowInitConfig(FLOW_QUIET);
FAIL_IF(TM_ECODE_OK != DecodeETag(&tv, &dtv, p, raw_etag, sizeof(raw_etag)));
PacketRecycle(p);
FlowShutdown();
PacketFree(p);
PASS;
}
#endif /* UNITTESTS */
void DecodeETagRegisterTests(void)
{
#ifdef UNITTESTS
UtRegisterTest("DecodeETagTest01", DecodeETagTest01);
UtRegisterTest("DecodeETagTest02", DecodeETagTest02);
UtRegisterTest("DecodeETagTest03", DecodeETagTest03);
#endif
}
/**
* @}
*/
src/decode-etag.h
+41
View File
@@ -0,0 +1,41 @@
/* Copyright (C) 2025 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Fupeng Zhao <[email protected]>
*/
#ifndef SURICATA_DECODE_ETAG_H
#define SURICATA_DECODE_ETAG_H
/** E-Tag header struct */
typedef struct ETagHdr_ {
uint16_t pcp_dei_ingress_base;
uint16_t resv_grp_ecid_base;
uint8_t ingress_ecid_ext;
uint8_t ecid_ext;
uint16_t protocol; /**< next protocol */
} __attribute__((__packed__)) ETagHdr;
/** E-Tag header length */
#define ETAG_HEADER_LEN 8
void DecodeETagRegisterTests(void);
#endif /* SURICATA_DECODE_ETAG_H */
src/decode-ethernet.h
+1
View File
@@ -48,6 +48,7 @@
#define ETHERNET_TYPE_ERSPAN 0x88BE
#define ETHERNET_TYPE_DCE 0x8903 /* Data center ethernet,
* Cisco Fabric Path */
#define ETHERNET_TYPE_ETAG 0x893F /* 802.1BR */
#define ETHERNET_TYPE_NSH 0x894F
#define ETHERNET_TYPE_VNTAG 0x8926 /* 802.1Qbh */
src/decode-events.c
+10
View File
@@ -432,6 +432,16 @@ const struct DecodeEvents_ DEvents[] = {
VNTAG_UNKNOWN_TYPE,
},
/* ETAG EVENTS */
{
"decoder.etag.header_too_small",
ETAG_HEADER_TOO_SMALL,
},
{
"decoder.etag.unknown_type",
ETAG_UNKNOWN_TYPE,
},
/* RAW EVENTS */
{
"decoder.ipraw.invalid_ip_version",
src/decode-events.h
+4
View File
@@ -159,6 +159,10 @@ enum {
VNTAG_HEADER_TOO_SMALL, /**< vntag header smaller than minimum size */
VNTAG_UNKNOWN_TYPE, /**< vntag unknown type */
/* ETAG EVENTS */
ETAG_HEADER_TOO_SMALL, /**< etag header smaller than minimum size */
ETAG_UNKNOWN_TYPE, /**< etag unknown type */
/* RAW EVENTS */
IPRAW_INVALID_IPV, /**< invalid ip version in ip raw */
src/decode.c
+1
View File
@@ -662,6 +662,7 @@ void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
dtv->counter_vlan_qinqinq = StatsRegisterCounter("decoder.vlan_qinqinq", tv);
dtv->counter_vxlan = StatsRegisterCounter("decoder.vxlan", tv);
dtv->counter_vntag = StatsRegisterCounter("decoder.vntag", tv);
dtv->counter_etag = StatsRegisterCounter("decoder.etag", tv);
dtv->counter_ieee8021ah = StatsRegisterCounter("decoder.ieee8021ah", tv);
dtv->counter_teredo = StatsRegisterCounter("decoder.teredo", tv);
dtv->counter_ipv4inipv4 = StatsRegisterCounter("decoder.ipv4_in_ipv4", tv);
src/decode.h
+5
View File
@@ -1003,6 +1003,7 @@ typedef struct DecodeThreadVars_
uint16_t counter_vlan_qinqinq;
uint16_t counter_vxlan;
uint16_t counter_vntag;
uint16_t counter_etag;
uint16_t counter_ieee8021ah;
uint16_t counter_pppoe;
uint16_t counter_teredo;
@@ -1158,6 +1159,7 @@ int DecodeESP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint1
int DecodeGRE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
int DecodeVNTag(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
int DecodeETag(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
int DecodeIEEE8021ah(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
int DecodeGeneve(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
int DecodeVXLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t);
@@ -1499,6 +1501,9 @@ static inline bool DecodeNetworkLayer(ThreadVars *tv, DecodeThreadVars *dtv,
DecodeEthernet(tv, dtv, p, data + 2, len - 2);
}
break;
case ETHERNET_TYPE_ETAG:
DecodeETag(tv, dtv, p, data, len);
break;
case ETHERNET_TYPE_VNTAG:
DecodeVNTag(tv, dtv, p, data, len);
break;
src/runmode-unittests.c
+2
View File
@@ -112,6 +112,7 @@
#include "decode-nsh.h"
#include "decode-pppoe.h"
#include "decode-raw.h"
#include "decode-etag.h"
#include "decode-vntag.h"
#include "decode-vxlan.h"
#include "decode-pppoe.h"
@@ -152,6 +153,7 @@ static void RegisterUnittests(void)
DecodeCHDLCRegisterTests();
DecodePPPRegisterTests();
DecodeVLANRegisterTests();
DecodeETagRegisterTests();
DecodeVNTagRegisterTests();
DecodeGeneveRegisterTests();
DecodeVXLANRegisterTests();