diff --git a/scripts/base/packet-protocols/__load__.zeek b/scripts/base/packet-protocols/__load__.zeek index 08905878bd..0dbb22e676 100644 --- a/scripts/base/packet-protocols/__load__.zeek +++ b/scripts/base/packet-protocols/__load__.zeek @@ -15,6 +15,7 @@ @load base/packet-protocols/pppoe @load base/packet-protocols/vlan @load base/packet-protocols/mpls +@load base/packet-protocols/pbb @load base/packet-protocols/vntag @load base/packet-protocols/udp @load base/packet-protocols/tcp diff --git a/scripts/base/packet-protocols/ethernet/main.zeek b/scripts/base/packet-protocols/ethernet/main.zeek index 75191a2c8a..7c19b7bfa7 100644 --- a/scripts/base/packet-protocols/ethernet/main.zeek +++ b/scripts/base/packet-protocols/ethernet/main.zeek @@ -12,6 +12,7 @@ export { event zeek_init() &priority=20 { PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x8847, PacketAnalyzer::ANALYZER_MPLS); + PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x88E7, PacketAnalyzer::ANALYZER_PBB); PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x0800, PacketAnalyzer::ANALYZER_IP); PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x86DD, PacketAnalyzer::ANALYZER_IP); PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x0806, PacketAnalyzer::ANALYZER_ARP); @@ -21,4 +22,4 @@ event zeek_init() &priority=20 PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x9100, PacketAnalyzer::ANALYZER_VLAN); PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x8864, PacketAnalyzer::ANALYZER_PPPOE); PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x8926, PacketAnalyzer::ANALYZER_VNTAG); - } \ No newline at end of file + } diff --git a/scripts/base/packet-protocols/pbb/__load__.zeek b/scripts/base/packet-protocols/pbb/__load__.zeek new file mode 100644 index 0000000000..d551be57d3 --- /dev/null +++ b/scripts/base/packet-protocols/pbb/__load__.zeek @@ -0,0 +1 @@ +@load ./main \ No newline at end of file diff --git a/scripts/base/packet-protocols/pbb/main.zeek b/scripts/base/packet-protocols/pbb/main.zeek new file mode 100644 index 0000000000..930148a8a2 --- /dev/null +++ b/scripts/base/packet-protocols/pbb/main.zeek @@ -0,0 +1,11 @@ +module PacketAnalyzer::PBB; + +event zeek_init() &priority=20 + { + PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_PBB, 0x0800, PacketAnalyzer::ANALYZER_IP); + PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_PBB, 0x86DD, PacketAnalyzer::ANALYZER_IP); + PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_PBB, 0x0806, PacketAnalyzer::ANALYZER_ARP); + PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_PBB, 0x8035, PacketAnalyzer::ANALYZER_ARP); + PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_PBB, 0x8100, PacketAnalyzer::ANALYZER_VLAN); + PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_PBB, 0x8864, PacketAnalyzer::ANALYZER_PPPOE); + } diff --git a/scripts/base/packet-protocols/vlan/main.zeek b/scripts/base/packet-protocols/vlan/main.zeek index 7e18bc3506..3cde704333 100644 --- a/scripts/base/packet-protocols/vlan/main.zeek +++ b/scripts/base/packet-protocols/vlan/main.zeek @@ -3,6 +3,7 @@ module PacketAnalyzer::VLAN; event zeek_init() &priority=20 { PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 0x8847, PacketAnalyzer::ANALYZER_MPLS); + PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 0x88E7, PacketAnalyzer::ANALYZER_PBB); PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 0x0800, PacketAnalyzer::ANALYZER_IP); PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 0x86DD, PacketAnalyzer::ANALYZER_IP); PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 0x0806, PacketAnalyzer::ANALYZER_ARP); diff --git a/src/packet_analysis/protocol/CMakeLists.txt b/src/packet_analysis/protocol/CMakeLists.txt index 63f8c03928..832049c2bd 100644 --- a/src/packet_analysis/protocol/CMakeLists.txt +++ b/src/packet_analysis/protocol/CMakeLists.txt @@ -11,6 +11,7 @@ add_subdirectory(ieee802_11_radio) add_subdirectory(fddi) add_subdirectory(nflog) add_subdirectory(mpls) +add_subdirectory(pbb) add_subdirectory(linux_sll) add_subdirectory(linux_sll2) diff --git a/src/packet_analysis/protocol/pbb/CMakeLists.txt b/src/packet_analysis/protocol/pbb/CMakeLists.txt new file mode 100644 index 0000000000..cee71edd44 --- /dev/null +++ b/src/packet_analysis/protocol/pbb/CMakeLists.txt @@ -0,0 +1,8 @@ + +include(ZeekPlugin) + +include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DIR}) + +zeek_plugin_begin(PacketAnalyzer PBB) +zeek_plugin_cc(PBB.cc Plugin.cc) +zeek_plugin_end() diff --git a/src/packet_analysis/protocol/pbb/PBB.cc b/src/packet_analysis/protocol/pbb/PBB.cc new file mode 100644 index 0000000000..5b0927f6eb --- /dev/null +++ b/src/packet_analysis/protocol/pbb/PBB.cc @@ -0,0 +1,23 @@ +// See the file "COPYING" in the main distribution directory for copyright. + +#include "zeek/packet_analysis/protocol/pbb/PBB.h" + +using namespace zeek::packet_analysis::PBB; + +PBBAnalyzer::PBBAnalyzer() : zeek::packet_analysis::Analyzer("PBB") { } + +bool PBBAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet) + { + const uint8_t pbb_header_len = 18; + const uint8_t etype_offset = pbb_header_len - 2; + if ( pbb_header_len >= len ) + { + Weird("truncated_PBB_header", packet); + return false; + } + + uint32_t protocol = ((data[etype_offset] << 8u) + data[etype_offset+1]); + packet->eth_type = protocol; + // Skip the PBB header + return ForwardPacket(len - pbb_header_len, data + pbb_header_len, packet, protocol); + } diff --git a/src/packet_analysis/protocol/pbb/PBB.h b/src/packet_analysis/protocol/pbb/PBB.h new file mode 100644 index 0000000000..da7181b580 --- /dev/null +++ b/src/packet_analysis/protocol/pbb/PBB.h @@ -0,0 +1,25 @@ +// See the file "COPYING" in the main distribution directory for copyright. + +#pragma once + +#include "zeek/packet_analysis/Analyzer.h" +#include "zeek/packet_analysis/Component.h" + +namespace zeek::packet_analysis::PBB + { + +class PBBAnalyzer : public Analyzer + { +public: + PBBAnalyzer(); + ~PBBAnalyzer() override = default; + + bool AnalyzePacket(size_t len, const uint8_t* data, Packet* packet) override; + + static zeek::packet_analysis::AnalyzerPtr Instantiate() + { + return std::make_shared(); + } + }; + + } diff --git a/src/packet_analysis/protocol/pbb/Plugin.cc b/src/packet_analysis/protocol/pbb/Plugin.cc new file mode 100644 index 0000000000..1b61c76c8e --- /dev/null +++ b/src/packet_analysis/protocol/pbb/Plugin.cc @@ -0,0 +1,27 @@ +// See the file "COPYING" in the main distribution directory for copyright. + +#include "zeek/plugin/Plugin.h" + +#include "zeek/packet_analysis/Component.h" +#include "zeek/packet_analysis/protocol/pbb/PBB.h" + +namespace zeek::plugin::Zeek_PBB + { + +class Plugin : public zeek::plugin::Plugin + { +public: + zeek::plugin::Configuration Configure() + { + AddComponent(new zeek::packet_analysis::Component( + "PBB", zeek::packet_analysis::PBB::PBBAnalyzer::Instantiate)); + + zeek::plugin::Configuration config; + config.name = "Zeek::PBB"; + config.description = "PBB packet analyzer"; + return config; + } + + } plugin; + + }