ipv6: set event on unsupported nh

If a next header / protocol is encountered that we can't handle (yet)
set an event. Disabled the rule by default.

    decode-event:ipv6.unknown_next_header;

diff --git a/rules/decoder-events.rules b/rules/decoder-events.rules
index 779d6ed30e96d591983709947388857852c75860..5d77928283112ae7476e82fd2c0589905dedcdb8 100644 (file)
--- a/rules/decoder-events.rules
+++ b/rules/decoder-events.rules
@@ -43,6 +43,8 @@ alert ipv6 any any -> any any (msg:"SURICATA zero length padN option"; decode-ev
 alert ipv6 any any -> any any (msg:"SURICATA reserved field in Frag Header not zero"; decode-event:ipv6.fh_non_zero_reserved_field; sid:2200095; rev:1;)
 # Data after the 'none' header (59) is suspicious.
 alert ipv6 any any -> any any (msg:"SURICATA data after none (59) header"; decode-event:ipv6.data_after_none_header; sid:2200096; rev:1;)
+# unknown/unsupported next header / protocol. Valid protocols are not yet supported, so disabling by default
+#alert ipv6 any any -> any any (msg:"SURICATA unknown next header / protocol"; decode-event:ipv6.unknown_next_header; sid:2200097; rev:1;)
 alert ipv6 any any -> any any (msg:"SURICATA IPv6 with ICMPv4 header"; decode-event:ipv6.icmpv4; sid:2200090; rev:1;)
 alert pkthdr any any -> any any (msg:"SURICATA ICMPv4 packet too small"; decode-event:icmpv4.pkt_too_small; sid:2200023; rev:1;)
 alert pkthdr any any -> any any (msg:"SURICATA ICMPv4 unknown type"; decode-event:icmpv4.unknown_type; sid:2200024; rev:1;)
@@ -114,5 +116,5 @@ alert pkthdr any any -> any any (msg:"SURICATA IPv4-in-IPv6 invalid protocol"; d
 alert pkthdr any any -> any any (msg:"SURICATA IPv6-in-IPv6 packet too short"; decode-event:ipv6.ipv6_in_ipv6_too_small; sid:2200084; rev:1;)
 alert pkthdr any any -> any any (msg:"SURICATA IPv6-in-IPv6 invalid protocol"; decode-event:ipv6.ipv6_in_ipv6_wrong_version; sid:2200085; rev:1;)
 
-# next sid is 2200097
+# next sid is 2200098
 

diff --git a/src/decode-events.h b/src/decode-events.h
index 1eceb8af7a7a6c97bd91da6f23f8a6597162a36b..ceb8c640138e1541eca084980dd25419f2d2da99 100644 (file)
--- a/src/decode-events.h
+++ b/src/decode-events.h
@@ -84,6 +84,7 @@ enum {
     IPV6_FH_NON_ZERO_RES_FIELD,     /**< reserved field not zero */
     IPV6_DATA_AFTER_NONE_HEADER,    /**< data after 'none' (59) header */
 
+    IPV6_UNKNOWN_NEXT_HEADER,       /**< unknown/unsupported next header */
     IPV6_WITH_ICMPV4,               /**< IPv6 packet with ICMPv4 header */
 
     /* TCP EVENTS */

diff --git a/src/decode-ipv6.c b/src/decode-ipv6.c
index 5424765f837c95702220204dcf55fa994f801ba2..3bbbc5a9cd8c4038b33921b3b8b04c37739e6555 100644 (file)
--- a/src/decode-ipv6.c
+++ b/src/decode-ipv6.c
@@ -562,6 +562,7 @@ DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt
                 plen -= hdrextlen;
                 break;
             default:
+                ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
                 IPV6_SET_L4PROTO(p,nh);
                 SCReturn;
         }
@@ -662,6 +663,7 @@ int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, u
             ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
             break;
         default:
+            ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
             IPV6_SET_L4PROTO (p, IPV6_GET_NH(p));
             break;
     }

diff --git a/src/detect-engine-event.h b/src/detect-engine-event.h
index 288956ddf327cc1f638cfd2d64ade6bd73bcb1ae..5b42f6e7439961285f68a6c3d4cd9ae345f64ff5 100644 (file)
--- a/src/detect-engine-event.h
+++ b/src/detect-engine-event.h
@@ -93,6 +93,7 @@ struct DetectEngineEvents_ {
     { "ipv6.zero_len_padn", IPV6_EXTHDR_ZERO_LEN_PADN, },
     { "ipv6.fh_non_zero_reserved_field", IPV6_FH_NON_ZERO_RES_FIELD, },
     { "ipv6.data_after_none_header", IPV6_DATA_AFTER_NONE_HEADER, },
+    { "ipv6.unknown_next_header", IPV6_UNKNOWN_NEXT_HEADER, },
     { "ipv6.icmpv4", IPV6_WITH_ICMPV4, },
 
     /* TCP EVENTS */