From 4c07af44509da3730de8e9a604415961953caca7 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Sat, 24 Apr 2021 15:38:16 -0400 Subject: [PATCH] decode/events: VNTAG decoder events (cherry picked from commit 1ddad0a0d610265baea902387eb40d7012c8c841) --- rules/decoder-events.rules | 5 +++-- src/decode-events.c | 10 ++++++++++ src/decode-events.h | 4 ++++ 3 files changed, 17 insertions(+), 2 deletions(-) diff --git a/rules/decoder-events.rules b/rules/decoder-events.rules index 661fb13a1e..965c9c137f 100644 --- a/rules/decoder-events.rules +++ b/rules/decoder-events.rules @@ -97,6 +97,8 @@ alert pkthdr any any -> any any (msg:"SURICATA VLAN header too small "; decode-e alert pkthdr any any -> any any (msg:"SURICATA VLAN unknown type"; decode-event:vlan.unknown_type; classtype:protocol-command-decode; sid:2200067; rev:2;) # more than 2 vlan layers in the packet alert pkthdr any any -> any any (msg:"SURICATA VLAN too many layers"; decode-event:vlan.too_many_layers; classtype:protocol-command-decode; sid:2200091; rev:2;) +alert pkthdr any any -> any any (msg:"SURICATA VNTAG header too small"; decode-event:vntag.header_too_small; classtype:protocol-command-decode; sid:2200117; rev:1;) +alert pkthdr any any -> any any (msg:"SURICATA VNTAG unknown type"; decode-event:vntag.unknown_type; classtype:protocol-command-decode; sid:2200118; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IEEE802.1AH header too small"; decode-event:ieee8021ah.header_too_small; classtype:protocol-command-decode; sid:2200112; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA IP raw invalid IP version "; decode-event:ipraw.invalid_ip_version; classtype:protocol-command-decode; sid:2200068; rev:2;) @@ -113,7 +115,6 @@ alert icmp any any -> any any (msg:"SURICATA ICMPv4 invalid checksum"; icmpv4-cs alert tcp any any -> any any (msg:"SURICATA TCPv6 invalid checksum"; tcpv6-csum:invalid; classtype:protocol-command-decode; sid:2200077; rev:2;) alert udp any any -> any any (msg:"SURICATA UDPv6 invalid checksum"; udpv6-csum:invalid; classtype:protocol-command-decode; sid:2200078; rev:2;) alert icmp any any -> any any (msg:"SURICATA ICMPv6 invalid checksum"; icmpv6-csum:invalid; classtype:protocol-command-decode; sid:2200079; rev:2;) - # IPv4 in IPv6 rules alert pkthdr any any -> any any (msg:"SURICATA IPv4-in-IPv6 packet too short"; decode-event:ipv6.ipv4_in_ipv6_too_small; classtype:protocol-command-decode; sid:2200082; rev:2;) alert pkthdr any any -> any any (msg:"SURICATA IPv4-in-IPv6 invalid protocol"; decode-event:ipv6.ipv4_in_ipv6_wrong_version; classtype:protocol-command-decode; sid:2200083; rev:2;) @@ -148,5 +149,5 @@ alert pkthdr any any -> any any (msg:"SURICATA CHDLC packet too small"; decode-e alert pkthdr any any -> any any (msg:"SURICATA packet with too many layers"; decode-event:too_many_layers; classtype:protocol-command-decode; sid:2200116; rev:1;) -# next sid is 2200117 +# next sid is 2200119 diff --git a/src/decode-events.c b/src/decode-events.c index 4f23197ee5..45006db755 100644 --- a/src/decode-events.c +++ b/src/decode-events.c @@ -403,6 +403,16 @@ const struct DecodeEvents_ DEvents[] = { IEEE8021AH_HEADER_TOO_SMALL, }, + /* VNTAG EVENTS */ + { + "decoder.vntag.header_too_small", + VNTAG_HEADER_TOO_SMALL, + }, + { + "decoder.vntag.unknown_type", + VNTAG_UNKNOWN_TYPE, + }, + /* RAW EVENTS */ { "decoder.ipraw.invalid_ip_version", diff --git a/src/decode-events.h b/src/decode-events.h index aae54e1291..07b3f7b095 100644 --- a/src/decode-events.h +++ b/src/decode-events.h @@ -147,6 +147,10 @@ enum { IEEE8021AH_HEADER_TOO_SMALL, + /* VNTAG EVENTS */ + VNTAG_HEADER_TOO_SMALL, /**< vntag header smaller than minimum size */ + VNTAG_UNKNOWN_TYPE, /**< vntag unknown type */ + /* RAW EVENTS */ IPRAW_INVALID_IPV, /**< invalid ip version in ip raw */ -- 2.47.2