decode: add config option to disable teredo

Ticket #744.

diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst
index 4aea0d27f751b1510596ab088e11f8f65f07ebac..e69859c0f7be47cd65703fc1f8b7c4ab84dcef46 100644 (file)
--- a/doc/userguide/configuration/suricata-yaml.rst
+++ b/doc/userguide/configuration/suricata-yaml.rst
@@ -2235,6 +2235,23 @@ unlimited.
         # Stream reassembly size for modbus, default is 0
         stream-depth: 0
 
+Decoder
+-------
+
+Teredo
+~~~~~~
+
+The Teredo decoder can be disabled. It is enabled by default.
+
+::
+
+    decoder:
+      # Teredo decoder is known to not be completely accurate
+      # it will sometimes detect non-teredo as teredo.
+      teredo:
+        enabled: true
+
+
 Advanced Options
 ----------------
 

diff --git a/src/decode-teredo.c b/src/decode-teredo.c
index 531946c89b4d065d9ac6d6f3cd8bafa3d2dc65e9..6739c24b59a3ff45c393a2fc064d7f7aa298382f 100644 (file)
--- a/src/decode-teredo.c
+++ b/src/decode-teredo.c
@@ -37,9 +37,24 @@
 #include "decode-ipv6.h"
 #include "decode-teredo.h"
 #include "util-debug.h"
+#include "conf.h"
 
 #define TEREDO_ORIG_INDICATION_LENGTH    8
 
+static bool g_teredo_enabled = true;
+
+void DecodeTeredoConfig(void)
+{
+    int enabled = 0;
+    if (ConfGetBool("decoder.teredo.enabled", &enabled) == 1) {
+        if (enabled) {
+            g_teredo_enabled = true;
+        } else {
+            g_teredo_enabled = false;
+        }
+    }
+}
+
 /**
  * \brief Function to decode Teredo packets
  *
@@ -47,6 +62,8 @@
  */
 int DecodeTeredo(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
 {
+    if (!g_teredo_enabled)
+        return TM_ECODE_FAILED;
 
     uint8_t *start = pkt;
 

diff --git a/src/decode-teredo.h b/src/decode-teredo.h
index 142d13c207f7a2cf046e5be77ddc17a277b6a884..a5a31c79e2f594872fedb09bc3666a3f0ab20684 100644 (file)
--- a/src/decode-teredo.h
+++ b/src/decode-teredo.h
@@ -15,5 +15,11 @@
  * 02110-1301, USA.
  */
 
+#ifndef __DECODE_TEREDO_H__
+#define __DECODE_TEREDO_H__
+
 int DecodeTeredo(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
                  uint8_t *pkt, uint16_t len, PacketQueue *pq);
+void DecodeTeredoConfig(void);
+
+#endif

diff --git a/src/decode.c b/src/decode.c
index 3c128edacd8068a84c41d7e8ba1d746d75e659d9..85d0ca9915aa8e6024a1de45dfcb0d4b39d89581 100644 (file)
--- a/src/decode.c
+++ b/src/decode.c
@@ -51,6 +51,7 @@
 #include "suricata.h"
 #include "conf.h"
 #include "decode.h"
+#include "decode-teredo.h"
 #include "util-debug.h"
 #include "util-mem.h"
 #include "app-layer-detect-proto.h"
@@ -608,6 +609,11 @@ void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s)
     s->counter_ips_replaced = StatsRegisterCounter("ips.replaced", tv);
 }
 
+void DecodeGlobalConfig(void)
+{
+    DecodeTeredoConfig();
+}
+
 /**
  * @}
  */

diff --git a/src/decode.h b/src/decode.h
index 0a4e5cb7ca37d47826331841e356a0d77f08f306..64a416ce3dd60d57a0cc993aaf0f03188548b157 100644 (file)
--- a/src/decode.h
+++ b/src/decode.h
@@ -959,6 +959,7 @@ typedef int (*DecoderFunc)(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
 int DecoderParseDataFromFile(char *filename, DecoderFunc Decoder);
 int DecoderParseDataFromFileSerie(char *fileprefix, DecoderFunc Decoder);
 #endif
+void DecodeGlobalConfig(void);
 
 /** \brief Set the No payload inspection Flag for the packet.
  *

diff --git a/src/suricata.c b/src/suricata.c
index 9a2bc53fdbaa4187e3ccf25f557f67f0b5c79a61..25a62c56f0e5033c8a3be0204a9145117e3ec5ff 100644 (file)
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -2726,6 +2726,8 @@ static int PostConfLoadedSetup(SCInstance *suri)
 
     CoredumpLoadConfig();
 
+    DecodeGlobalConfig();
+
     PreRunInit(suri->run_mode);
 
     SCReturnInt(TM_ECODE_OK);

diff --git a/suricata.yaml.in b/suricata.yaml.in
index 590ad3b9e2c5e8de8b3f911e269cba92aefb27e8..6645edd9b2181d4843d9885710c8d44f9373b488 100644 (file)
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -1261,6 +1261,14 @@ host:
 #  prealloc: 1000
 #  memcap: 32mb
 
+# Decoder settings
+
+decoder:
+  # Teredo decoder is known to not be completely accurate
+  # it will sometimes detect non-teredo as teredo.
+  teredo:
+    enabled: true
+
 
 ##
 ## Performance tuning and profiling