decode/geneve: Add Geneve decoding functionality

These changes are in response to feature request 3063. Geneve is
very similar to VXLAN, but uses a slightly different encapsulation
scheme.

(cherry picked from commit ef9e532f0739a87ffc163ed5ffb3699ffa9aa07b)

diff --git a/src/Makefile.am b/src/Makefile.am
index 8999f5dac88314ac8f8b0b13931188cdbb712f6b..46902c0141798260d7a40e6cb2019859d3c7e0c3 100755 (executable)
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -65,6 +65,7 @@ decode-afl.c \
 decode-erspan.c decode-erspan.h \
 decode-ethernet.c decode-ethernet.h \
 decode-events.c decode-events.h \
+decode-geneve.c decode-geneve.h \
 decode-gre.c decode-gre.h \
 decode-icmpv4.c decode-icmpv4.h \
 decode-icmpv6.c decode-icmpv6.h \

diff --git a/src/decode-events.c b/src/decode-events.c
index 7bb48deef848400fff5d2959130abf47cdd35c5c..e8e206cefb25711154b4a5ace7e906dcbe3982b5 100644 (file)
--- a/src/decode-events.c
+++ b/src/decode-events.c
@@ -176,6 +176,9 @@ const struct DecodeEvents_ DEvents[] = {
     { "decoder.mpls.bad_label_reserved", MPLS_BAD_LABEL_RESERVED, },
     { "decoder.mpls.unknown_payload_type", MPLS_UNKNOWN_PAYLOAD_TYPE, },
 
+    /* Geneve events */
+    { "decoder.geneve.unknown_payload_type", GENEVE_UNKNOWN_PAYLOAD_TYPE, },
+
     /* ERSPAN events */
     { "decoder.erspan.header_too_small", ERSPAN_HEADER_TOO_SMALL, },
     { "decoder.erspan.unsupported_version", ERSPAN_UNSUPPORTED_VERSION, },

diff --git a/src/decode-events.h b/src/decode-events.h
index b9cceb679395ea4f2291d4807781cf1de59c871b..347fb5c15462119686f7f6274cbd67cd417613b6 100644 (file)
--- a/src/decode-events.h
+++ b/src/decode-events.h
@@ -183,6 +183,9 @@ enum {
     MPLS_BAD_LABEL_RESERVED,
     MPLS_UNKNOWN_PAYLOAD_TYPE,
 
+    /* Geneve events */
+    GENEVE_UNKNOWN_PAYLOAD_TYPE,
+
     /* ERSPAN events */
     ERSPAN_HEADER_TOO_SMALL,
     ERSPAN_UNSUPPORTED_VERSION,

diff --git a/src/decode-geneve.c b/src/decode-geneve.c
new file mode 100644 (file)
index 0000000..8970c52
--- /dev/null
+++ b/src/decode-geneve.c
@@ -0,0 +1,520 @@
+/* Copyright (C) 2020 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Ali Jad Khalil <jadkhal@amazon.com>
+ *
+ * Geneve tunneling scheme decoder.
+ *
+ * This implementation is based on the following specification doc:
+ * https://tools.ietf.org/html/draft-ietf-nvo3-geneve-16#section-3
+ */
+
+#include "suricata-common.h"
+#include "decode.h"
+#include "decode-geneve.h"
+#include "decode-events.h"
+
+#include "detect-engine-port.h"
+
+#include "flow.h"
+
+#include "util-unittest.h"
+#include "util-debug.h"
+
+#include "pkt-var.h"
+#include "util-profiling.h"
+#include "host.h"
+
+#define VALID_GENEVE_VERSIONS                   { 0 }
+#define GENEVE_VERSION(hdr_ptr)                 (hdr_ptr->ver_plus_len >> 6)
+#define GENEVE_RESERVED_FLAGS(hdr_ptr)          (hdr_ptr->flags & 0x3F)
+
+#define GENEVE_MIN_HEADER_LEN                   sizeof(GeneveHeader)
+#define GENEVE_TOTAL_OPT_LEN(hdr_ptr)           ((hdr_ptr->ver_plus_len & 0x3F) << 2)
+#define GENEVE_TOTAL_HEADER_LEN(hdr_ptr) \
+        (GENEVE_MIN_HEADER_LEN + GENEVE_TOTAL_OPT_LEN(hdr_ptr))
+
+#define GENEVE_MIN_SINGLE_OPT_LEN               sizeof(GeneveOption)
+#define GENEVE_SINGLE_OPT_LEN(option_ptr)       ((option_ptr->flags_plus_len & 0x1F) << 2)
+#define GENEVE_SINGLE_OPT_TOTAL_LEN(option_ptr) \
+        (GENEVE_MIN_SINGLE_OPT_LEN + GENEVE_SINGLE_OPT_LEN(option_ptr))
+
+#define GENEVE_MAX_PORTS                        4
+#define GENEVE_UNSET_PORT                       -1
+#define GENEVE_DEFAULT_PORT                     6081
+#define GENEVE_DEFAULT_PORT_S                   "6081"
+
+static bool g_geneve_enabled = true;
+static int g_geneve_ports_idx = 0;
+static int g_geneve_ports[GENEVE_MAX_PORTS] = { GENEVE_DEFAULT_PORT,
+        GENEVE_UNSET_PORT, GENEVE_UNSET_PORT, GENEVE_UNSET_PORT };
+
+/* Geneve structs based on diagrams from the following specification doc:
+ *    https://tools.ietf.org/html/draft-ietf-nvo3-geneve-16#section-3 */
+typedef struct GeneveOption_ {
+    uint16_t option_class;
+    uint8_t type;
+    uint8_t flags_plus_len;
+    uint8_t option_data[0];
+} GeneveOption;
+
+typedef struct GeneveHeader_ {
+    uint8_t ver_plus_len;
+    uint8_t flags;
+    uint16_t eth_type;
+    uint8_t vni[3];
+    uint8_t res;
+    GeneveOption options[0];
+} GeneveHeader;
+
+
+bool DecodeGeneveEnabledForPort(const uint16_t sp, const uint16_t dp)
+{
+    SCLogDebug("ports %u->%u ports %d %d %d %d", sp, dp,
+            g_geneve_ports[0], g_geneve_ports[1], g_geneve_ports[2], g_geneve_ports[3]);
+
+    if (g_geneve_enabled) {
+        for (int i = 0; i < g_geneve_ports_idx; i++) {
+            if (g_geneve_ports[i] == GENEVE_UNSET_PORT)
+                return false;
+
+            const int port = g_geneve_ports[i];
+            if (port == (const int)sp || port == (const int)dp)
+                return true;
+        }
+    }
+    return false;
+}
+
+static void DecodeGeneveConfigPorts(const char *pstr)
+{
+    SCLogDebug("parsing \'%s\'", pstr);
+
+    DetectPort *head = NULL;
+    DetectPortParse(NULL, &head, pstr);
+
+    g_geneve_ports_idx = 0;
+    for (DetectPort *p = head; p != NULL; p = p->next) {
+        if (g_geneve_ports_idx >= GENEVE_MAX_PORTS) {
+            SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY,
+                    "more than %d Geneve ports defined", GENEVE_MAX_PORTS);
+            break;
+        }
+        g_geneve_ports[g_geneve_ports_idx++] = (int)p->port;
+    }
+
+    DetectPortCleanupList(NULL, head);
+}
+
+void DecodeGeneveConfig(void)
+{
+    int enabled = 0;
+    if (ConfGetBool("decoder.geneve.enabled", &enabled) == 1) {
+        if (enabled) {
+            g_geneve_enabled = true;
+        } else {
+            g_geneve_enabled = false;
+        }
+    }
+
+    if (g_geneve_enabled) {
+        ConfNode *node = ConfGetNode("decoder.geneve.ports");
+        if (node && node->val) {
+            DecodeGeneveConfigPorts(node->val);
+        } else {
+            DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
+        }
+    }
+}
+
+static inline bool IsValidGeneveVersion(const GeneveHeader *geneve_hdr)
+{
+    const int valid_verisons[] = VALID_GENEVE_VERSIONS;
+    const int num_versions = sizeof(valid_verisons) / sizeof(int);
+    const uint8_t cur_version = GENEVE_VERSION(geneve_hdr);
+
+    for (int i = 0; i < num_versions; i++) {
+        if (valid_verisons[i] == cur_version)
+            return true;
+    }
+
+    return false;
+}
+
+/* Performs a check to ensure that option lens add up to total length specified in the fixed header */
+static inline bool IsHeaderLengthConsistentWithOptions(const GeneveHeader *geneve_hdr)
+{
+    uint8_t *geneve_opt_ptr = (uint8_t *)geneve_hdr->options;
+    int remaining_hdr_len = GENEVE_TOTAL_OPT_LEN(geneve_hdr);
+
+    while (remaining_hdr_len > 0) {
+        const GeneveOption *cur_opt = (const GeneveOption *)geneve_opt_ptr;
+        const uint8_t cur_option_len = GENEVE_SINGLE_OPT_TOTAL_LEN(cur_opt);
+
+        geneve_opt_ptr += cur_option_len;
+        remaining_hdr_len -= cur_option_len;  /* cur_option_len will always be between 4-128, inclusive */
+    }
+
+    return (remaining_hdr_len == 0);
+}
+
+/** \param pkt payload data directly above UDP header
+ *  \param len length in bytes of pkt
+ */
+int DecodeGeneve(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
+        const uint8_t *pkt, uint32_t len, PacketQueue *pq)
+{
+    const GeneveHeader *geneve_hdr = (const GeneveHeader *)pkt;
+
+    uint16_t eth_type, geneve_hdr_len;
+    int decode_tunnel_proto = DECODE_TUNNEL_UNSET;
+
+    /* General Geneve packet validation */
+    if (unlikely(!g_geneve_enabled))
+        return TM_ECODE_FAILED;
+
+    if (unlikely(len < GENEVE_MIN_HEADER_LEN))
+        return TM_ECODE_FAILED;
+
+    /* Specific Geneve header field validation */
+    geneve_hdr_len = GENEVE_TOTAL_HEADER_LEN(geneve_hdr);
+    if (len < geneve_hdr_len)
+        return TM_ECODE_FAILED;
+
+    if (!IsValidGeneveVersion(geneve_hdr))
+        return TM_ECODE_FAILED;
+
+    if (GENEVE_RESERVED_FLAGS(geneve_hdr) != 0 || geneve_hdr->res != 0)
+        return TM_ECODE_FAILED;
+
+    if (!IsHeaderLengthConsistentWithOptions(geneve_hdr))
+        return TM_ECODE_FAILED;
+
+#if DEBUG
+    /* Print the VNI for debugging purposes */
+    uint32_t vni = (geneve_hdr->vni[0] << 16) + (geneve_hdr->vni[1] << 8) + (geneve_hdr->vni[2]);
+    SCLogDebug("Geneve vni %u", vni);
+#endif
+
+    /* Increment stats counter for Geneve packets */
+    StatsIncr(tv, dtv->counter_geneve);
+
+    /* Determine first protocol encapsulated after Geneve header */
+    eth_type = SCNtohs(geneve_hdr->eth_type);
+    SCLogDebug("Geneve ethertype 0x%04x", eth_type);
+
+    switch (eth_type) {
+        case ETHERNET_TYPE_IP:
+            SCLogDebug("Geneve found IPv4");
+            decode_tunnel_proto = DECODE_TUNNEL_IPV4;
+            break;
+        case ETHERNET_TYPE_IPV6:
+            SCLogDebug("Geneve found IPv6");
+            decode_tunnel_proto = DECODE_TUNNEL_IPV6;
+            break;
+        case ETHERNET_TYPE_BRIDGE:
+            SCLogDebug("Geneve found Ethernet");
+            decode_tunnel_proto = DECODE_TUNNEL_ETHERNET;
+            break;
+        case ETHERNET_TYPE_ARP:
+            SCLogDebug("Geneve found ARP");
+            break;
+        default:
+            SCLogDebug("Geneve found unsupported Ethertype - expected IPv4, IPv6, ARP, or Ethernet");
+            ENGINE_SET_INVALID_EVENT(p, GENEVE_UNKNOWN_PAYLOAD_TYPE);
+    }
+
+    /* Set-up and process inner packet if it is a supported ethertype */
+    if (decode_tunnel_proto != DECODE_TUNNEL_UNSET) {
+        Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt + geneve_hdr_len,
+                len - geneve_hdr_len, decode_tunnel_proto, pq);
+
+        if (tp != NULL) {
+            PKT_SET_SRC(tp, PKT_SRC_DECODER_GENEVE);
+            PacketEnqueue(pq, tp);
+        }
+    }
+
+    return TM_ECODE_OK;
+}
+
+#ifdef UNITTESTS
+
+/**
+ * \test DecodeGeneveTest01 tests a good Geneve header with 16-bytes of options.
+ * Contains a Ethernet+IPv6 DHCP request packet.
+ */
+static int DecodeGeneveTest01(void)
+{
+    uint8_t raw_geneve[] = {
+        0x32, 0x10, 0x17, 0xc1, 0x00, 0xc1, 0x87, 0x51, /* UDP header */
+        0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
+        0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
+        0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
+        0x33, 0x33, 0x00, 0x01, 0x00, 0x02, /* inner destination MAC */
+        0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, /* inner source MAC */
+        0x86, 0xdd, /* type is IPv6 0x86dd */
+        0x60, 0x00, 0x00, 0x00, 0x00, 0x6b, 0x11, 0x01, /* IPv6 hdr */
+        0xfe, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x0a, 0x00, 0x27, 0xff, 0xfe, 0xfe, 0x8f, 0x95,
+        0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x02,
+        0x02, 0x22, 0x02, 0x23, 0x00, 0x6b, 0x9c, 0xfb, /* UDP src port 546 */
+        0x03, 0x49, 0x17, 0x4e, 0x00, 0x01, 0x00, 0x0e, /* DHCP request payload */
+        0x00, 0x01, 0x00, 0x01, 0x1c, 0x39, 0xcf, 0x88,
+        0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, 0x00, 0x02,
+        0x00, 0x0e, 0x00, 0x01, 0x00, 0x01, 0x1c, 0x38,
+        0x25, 0xe8, 0x08, 0x00, 0x27, 0xd4, 0x10, 0xbb,
+        0x00, 0x06, 0x00, 0x04, 0x00, 0x17, 0x00, 0x18,
+        0x00, 0x08, 0x00, 0x02, 0x00, 0x00, 0x00, 0x19,
+        0x00, 0x29, 0x27, 0xfe, 0x8f, 0x95, 0x00, 0x00,
+        0x0e, 0x10, 0x00, 0x00, 0x15, 0x18, 0x00, 0x1a,
+        0x00, 0x19, 0x00, 0x00, 0x1c, 0x20, 0x00, 0x00,
+        0x1d, 0x4c, 0x40, 0x20, 0x01, 0x00, 0x00, 0x00,
+        0x00, 0xfe, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00
+    };
+
+    Packet *p = PacketGetFromAlloc();
+    FAIL_IF_NULL(p);
+    ThreadVars tv;
+    DecodeThreadVars dtv;
+    PacketQueue pq;
+
+    DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
+
+    memset(&tv, 0, sizeof(ThreadVars));
+    memset(p, 0, SIZE_OF_PACKET);
+    memset(&dtv, 0, sizeof(DecodeThreadVars));
+    memset(&pq, 0, sizeof(PacketQueue));
+
+    FlowInitConfig(FLOW_QUIET);
+    DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve), &pq);
+
+    FAIL_IF(p->udph == NULL);
+    FAIL_IF(pq.top == NULL);
+
+    Packet *tp = PacketDequeue(&pq);
+    FAIL_IF(tp->udph == NULL);
+    FAIL_IF_NOT(tp->sp == 546);
+
+    FlowShutdown();
+    PacketFree(p);
+    PacketFree(tp);
+    PASS;
+}
+
+/**
+ * \test DecodeGeneveTest02 tests a good Geneve header with 16-bytes of options.
+ * Contains a IPv4 DNS request packet.
+ */
+static int DecodeGeneveTest02(void)
+{
+    uint8_t raw_geneve[] = {
+        0x32, 0x10, 0x17, 0xc1, 0x00, 0x3c, 0x87, 0x51, /* UDP header */
+        0x04, 0x00, 0x08, 0x00, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
+        0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
+        0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
+        0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
+        0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06,
+        0x00, 0x35, 0x30, 0x39, 0x00, 0x08, 0x98, 0xe4 /* UDP probe src port 53 */
+    };
+
+    Packet *p = PacketGetFromAlloc();
+    FAIL_IF_NULL(p);
+    ThreadVars tv;
+    DecodeThreadVars dtv;
+    PacketQueue pq;
+
+    DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
+
+    memset(&tv, 0, sizeof(ThreadVars));
+    memset(p, 0, SIZE_OF_PACKET);
+    memset(&dtv, 0, sizeof(DecodeThreadVars));
+    memset(&pq, 0, sizeof(PacketQueue));
+
+    FlowInitConfig(FLOW_QUIET);
+    DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve), &pq);
+
+    FAIL_IF(p->udph == NULL);
+    FAIL_IF(pq.top == NULL);
+
+    Packet *tp = PacketDequeue(&pq);
+    FAIL_IF(tp->udph == NULL);
+    FAIL_IF_NOT(tp->sp == 53);
+
+    FlowShutdown();
+    PacketFree(p);
+    PacketFree(tp);
+    PASS;
+}
+
+/**
+ * \test DecodeGeneveTest03 tests a good Geneve header with 16-bytes of options.
+ * Contains a IPv4 DNS request packet with a VLAN tag after the Ethernet frame.
+ * In practice, this probably won't be used but it should be support either way.
+ */
+static int DecodeGeneveTest03(void)
+{
+    uint8_t raw_geneve[] = {
+        0x32, 0x10, 0x17, 0xc1, 0x00, 0x4e, 0x87, 0x51, /* UDP header */
+        0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
+        0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
+        0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
+        0x33, 0x33, 0x00, 0x01, 0x00, 0x02, /* inner destination MAC */
+        0x08, 0x00, 0x27, 0xfe, 0x8f, 0x95, /* inner source MAC */
+        0x81, 0x00, 0x00, 0xad, /* 802.1Q VLAN tag */
+        0x08, 0x00, /* type is IPv4 0x0800 */
+        0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
+        0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06,
+        0x00, 0x35, 0x30, 0x39, 0x00, 0x08, 0x98, 0xe4 /* UDP probe src port 53 */
+    };
+
+    Packet *p = PacketGetFromAlloc();
+    FAIL_IF_NULL(p);
+    ThreadVars tv;
+    DecodeThreadVars dtv;
+    PacketQueue pq;
+
+    DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
+
+    memset(&tv, 0, sizeof(ThreadVars));
+    memset(p, 0, SIZE_OF_PACKET);
+    memset(&dtv, 0, sizeof(DecodeThreadVars));
+    memset(&pq, 0, sizeof(PacketQueue));
+
+    FlowInitConfig(FLOW_QUIET);
+    DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve), &pq);
+
+    FAIL_IF(p->udph == NULL);
+    FAIL_IF(pq.top == NULL);
+
+    Packet *tp = PacketDequeue(&pq);
+    FAIL_IF(tp->udph == NULL);
+    FAIL_IF_NOT(tp->sp == 53);
+
+    FlowShutdown();
+    PacketFree(p);
+    PacketFree(tp);
+    PASS;
+}
+
+/**
+ * \test DecodeGeneveTest04 tests default port disabled by the config.
+ */
+static int DecodeGeneveTest04(void)
+{
+    uint8_t raw_geneve[] = {
+        0x32, 0x10, 0x17, 0xc1, 0x00, 0x4a, 0x87, 0x51, /* UDP header */
+        0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
+        0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
+        0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
+        0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
+        0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
+        0x08, 0x00, /* type is IPv4 0x0800 */
+        0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
+        0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06,
+        0x00, 0x35, 0x30, 0x39, 0x00, 0x08, 0x98, 0xe4 /* UDP probe src port 53 */
+    };
+
+    Packet *p = PacketGetFromAlloc();
+    FAIL_IF_NULL(p);
+    ThreadVars tv;
+    DecodeThreadVars dtv;
+    PacketQueue pq;
+
+    DecodeGeneveConfigPorts("1");  /* Set Suricata to use a non-default port for Geneve*/
+
+    memset(&tv, 0, sizeof(ThreadVars));
+    memset(p, 0, SIZE_OF_PACKET);
+    memset(&dtv, 0, sizeof(DecodeThreadVars));
+    memset(&pq, 0, sizeof(PacketQueue));
+
+    FlowInitConfig(FLOW_QUIET);
+    DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve), &pq);
+
+    FAIL_IF(p->udph == NULL);
+    FAIL_IF(pq.top != NULL);  /* Geneve packet should not have been processed */
+
+    DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);  /* Reset Geneve port list for future calls */
+    FlowShutdown();
+    PacketFree(p);
+    PASS;
+}
+
+
+/**
+ * \test DecodeGeneveTest05 tests if Geneve header has inconsistent option len values.
+ */
+static int DecodeGeneveTest05(void)
+{
+    uint8_t raw_geneve[] = {
+        0x32, 0x10, 0x17, 0xc1, 0x00, 0x4a, 0x87, 0x51, /* UDP header */
+        0x04, 0x00, 0x65, 0x58, 0x00, 0x00, 0x25, 0x00, /* Geneve fixed header */
+        0x01, 0x08, 0x00, 0x04, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
+        0x01, 0x08, 0x00, 0x01, 0x11, 0x11, 0x11, 0x11, /* Geneve variable options */
+        0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
+        0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
+        0x08, 0x00, /* type is IPv4 0x0800 */
+        0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11, /* IPv4 hdr */
+        0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06,
+        0x00, 0x35, 0x30, 0x39, 0x00, 0x08, 0x98, 0xe4 /* UDP probe src port 53 */
+    };
+
+    Packet *p = PacketGetFromAlloc();
+    FAIL_IF_NULL(p);
+    ThreadVars tv;
+    DecodeThreadVars dtv;
+    PacketQueue pq;
+
+    DecodeGeneveConfigPorts(GENEVE_DEFAULT_PORT_S);
+
+    memset(&tv, 0, sizeof(ThreadVars));
+    memset(p, 0, SIZE_OF_PACKET);
+    memset(&dtv, 0, sizeof(DecodeThreadVars));
+    memset(&pq, 0, sizeof(PacketQueue));
+
+    FlowInitConfig(FLOW_QUIET);
+    DecodeUDP(&tv, &dtv, p, raw_geneve, sizeof(raw_geneve), &pq);
+
+    FAIL_IF(p->udph == NULL);
+    FAIL_IF(pq.top != NULL);  /* Geneve packet should not have been processed */
+
+    FlowShutdown();
+    PacketFree(p);
+    PASS;
+}
+#endif /* UNITTESTS */
+
+void DecodeGeneveRegisterTests(void)
+{
+#ifdef UNITTESTS
+    UtRegisterTest("DecodeGeneveTest01 -- Ethernet+IPv6 DHCP Request",
+            DecodeGeneveTest01);
+    UtRegisterTest("DecodeGeneveTest02 -- IPv4 DNS Request",
+           DecodeGeneveTest02);
+    UtRegisterTest("DecodeGeneveTest03 -- VLAN+IPv4 DNS Request",
+           DecodeGeneveTest03);
+    UtRegisterTest("DecodeGeneveTest04 -- Non-standard port configuration",
+           DecodeGeneveTest04);
+    UtRegisterTest("DecodeGeneveTest05 -- Inconsistent Geneve hdr option lens",
+           DecodeGeneveTest05);
+#endif /* UNITTESTS */
+}

diff --git a/src/decode-geneve.h b/src/decode-geneve.h
new file mode 100644 (file)
index 0000000..3c1cb23
--- /dev/null
+++ b/src/decode-geneve.h
@@ -0,0 +1,33 @@
+/* Copyright (C) 2020 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Ali Jad Khalil <jadkhal@amazon.com>
+ *
+ * Geneve decoder.
+ */
+
+#ifndef __DECODE_GENEVE_H__
+#define __DECODE_GENEVE_H__
+
+void DecodeGeneveRegisterTests(void);
+void DecodeGeneveConfig(void);
+bool DecodeGeneveEnabledForPort(const uint16_t sp, const uint16_t dp);
+
+#endif /* !__DECODE_GENEVE_H__ */

diff --git a/src/decode-udp.c b/src/decode-udp.c
index 7dfbbfb1afc83bb990dde87ba1adbdd7b31eb11e..ab5299676f373f01f10207e9526c503be7d6310c 100644 (file)
--- a/src/decode-udp.c
+++ b/src/decode-udp.c
@@ -32,6 +32,7 @@
 
 #include "suricata-common.h"
 #include "decode.h"
+#include "decode-geneve.h"
 #include "decode-udp.h"
 #include "decode-teredo.h"
 #include "decode-vxlan.h"
@@ -92,6 +93,15 @@ int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
         return TM_ECODE_OK;
     }
 
+    /* Handle Geneve if configured */
+    if (DecodeGeneveEnabledForPort(p->sp, p->dp) &&
+            unlikely(DecodeGeneve(tv, dtv, p, p->payload, p->payload_len, pq) == TM_ECODE_OK)) {
+        /* Here we have a Geneve packet and don't need to handle app
+         * layer */
+        FlowSetupPacket(p);
+        return TM_ECODE_OK;
+    }
+
     /* Handle VXLAN if configured */
     if (DecodeVXLANEnabledForPort(p->sp, p->dp) &&
             unlikely(DecodeVXLAN(tv, dtv, p, p->payload, p->payload_len, pq) == TM_ECODE_OK)) {

diff --git a/src/decode.c b/src/decode.c
index 67c5a49aa3efbd01a013e096a5fd5b4e3b8bad6d..09c4c61e26c55abf2c172c20473af28b83c8a131 100644 (file)
--- a/src/decode.c
+++ b/src/decode.c
@@ -494,6 +494,7 @@ void DecodeRegisterPerfCounters(DecodeThreadVars *dtv, ThreadVars *tv)
     dtv->counter_icmpv6 = StatsRegisterCounter("decoder.icmpv6", tv);
     dtv->counter_ppp = StatsRegisterCounter("decoder.ppp", tv);
     dtv->counter_pppoe = StatsRegisterCounter("decoder.pppoe", tv);
+    dtv->counter_geneve = StatsRegisterCounter("decoder.geneve", tv);
     dtv->counter_gre = StatsRegisterCounter("decoder.gre", tv);
     dtv->counter_vlan = StatsRegisterCounter("decoder.vlan", tv);
     dtv->counter_vlan_qinq = StatsRegisterCounter("decoder.vlan_qinq", tv);
@@ -694,6 +695,9 @@ const char *PktSrcToString(enum PktSrcEnum pkt_src)
         case PKT_SRC_FFR:
             pkt_src_str = "stream (flow timeout)";
             break;
+        case PKT_SRC_DECODER_GENEVE:
+            pkt_src_str = "geneve encapsulation";
+            break;
         case PKT_SRC_DECODER_VXLAN:
             pkt_src_str = "vxlan encapsulation";
             break;
@@ -731,6 +735,7 @@ void CaptureStatsSetup(ThreadVars *tv, CaptureStats *s)
 void DecodeGlobalConfig(void)
 {
     DecodeTeredoConfig();
+    DecodeGeneveConfig();
     DecodeVXLANConfig();
     DecodeERSPANConfig();
 }

diff --git a/src/decode.h b/src/decode.h
index 1c16114c7607d0973a53407ff97148dbc2d02f37..bda7a6e03f2902251260a5e16f49609de4604880 100644 (file)
--- a/src/decode.h
+++ b/src/decode.h
@@ -57,6 +57,7 @@ enum PktSrcEnum {
     PKT_SRC_DECODER_VXLAN,
     PKT_SRC_DETECT_RELOAD_FLUSH,
     PKT_SRC_CAPTURE_TIMEOUT,
+    PKT_SRC_DECODER_GENEVE,
 };
 
 #include "source-nflog.h"
@@ -75,6 +76,7 @@ enum PktSrcEnum {
 #include "decode-erspan.h"
 #include "decode-ethernet.h"
 #include "decode-gre.h"
+#include "decode-geneve.h"
 #include "decode-ppp.h"
 #include "decode-pppoe.h"
 #include "decode-sll.h"
@@ -656,6 +658,7 @@ typedef struct DecodeThreadVars_
     uint16_t counter_null;
     uint16_t counter_sctp;
     uint16_t counter_ppp;
+    uint16_t counter_geneve;
     uint16_t counter_gre;
     uint16_t counter_vlan;
     uint16_t counter_vlan_qinq;
@@ -896,6 +899,7 @@ enum DecodeTunnelProto {
     DECODE_TUNNEL_IPV6,
     DECODE_TUNNEL_IPV6_TEREDO,  /**< separate protocol for stricter error handling */
     DECODE_TUNNEL_PPP,
+    DECODE_TUNNEL_UNSET
 };
 
 Packet *PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent,
@@ -942,6 +946,7 @@ int DecodeSCTP(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint
 int DecodeGRE(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t, PacketQueue *);
 int DecodeVLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t, PacketQueue *);
 int DecodeVXLAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t, PacketQueue *);
+int DecodeGeneve(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t, PacketQueue *);
 int DecodeMPLS(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t, PacketQueue *);
 int DecodeERSPAN(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t, PacketQueue *);
 int DecodeERSPANTypeII(ThreadVars *, DecodeThreadVars *, Packet *, const uint8_t *, uint32_t, PacketQueue *);

diff --git a/src/runmode-unittests.c b/src/runmode-unittests.c
index 792e6f5c8d470145426da856711e74416a770dcd..55489a41cf589327931d62083e6b845a001331bf 100644 (file)
--- a/src/runmode-unittests.c
+++ b/src/runmode-unittests.c
@@ -148,6 +148,7 @@ static void RegisterUnittests(void)
     DecodeEthernetRegisterTests();
     DecodePPPRegisterTests();
     DecodeVLANRegisterTests();
+    DecodeGeneveRegisterTests();
     DecodeVXLANRegisterTests();
     DecodeRawRegisterTests();
     DecodePPPOERegisterTests();

diff --git a/suricata.yaml.in b/suricata.yaml.in
index f0f8ce035f82bb67f99be253ddef60229e861019..d4935c0a12aecb63fcf80e378de50c48c692c709 100644 (file)
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -44,6 +44,7 @@ vars:
     MODBUS_PORTS: 502
     FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
     FTP_PORTS: 21
+    GENEVE_PORTS: 6081
     VXLAN_PORTS: 4789
     TEREDO_PORTS: 3544