Improve ERSPAN Type III support

Added check for the optional sub-header in ERSPAN Type III as well
as additional truncation checks to the GRE parsing logic in general.
Also added a unit test for ERSPAN Type II.
This commit is contained in:
Jon Siwek 2019-01-17 18:03:10 -06:00
parent 995e67147a
commit 5618b21cca
7 changed files with 83 additions and 12 deletions

View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path conn
#open 2019-01-17-23-57-23
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
1402723255.667881 ClEkJM2Vm5giqnMf4h 23.0.0.2 8 23.0.0.3 0 icmp - 0.001727 144 144 OTH - - 0 - 2 200 2 200 CHhAvVGS1DHFjwGM9
#close 2019-01-17-23-57-23

View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path tunnel
#open 2019-01-17-23-57-23
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
#types time string addr port addr port enum enum
1402723255.667881 CHhAvVGS1DHFjwGM9 2.2.2.2 0 1.1.1.1 0 Tunnel::GRE Tunnel::DISCOVER
#close 2019-01-17-23-57-23

Binary file not shown.

View file

@ -0,0 +1,6 @@
# @TEST-EXEC: bro -C -b -r $TRACES/erspanII.pcap %INPUT
# @TEST-EXEC: btest-diff tunnel.log
# @TEST-EXEC: btest-diff conn.log
@load base/frameworks/tunnels
@load base/protocols/conn