Improve ERSPAN Type III support

Added check for the optional sub-header in ERSPAN Type III as well
as additional truncation checks to the GRE parsing logic in general.
Also added a unit test for ERSPAN Type II.

CHANGES

@@ -1,4 +1,10 @@
 
+2.6-86 | 2019-01-17 18:03:10 -0600
+
+  * Improve ERSPAN Type III support (Jon Siwek, Corelight)
+
+  * Implement ERSPAN type II and ERSPAN type III support (Stu H)
+
 2.6-82 | 2019-01-17 14:09:29 -0600
 
   * Change doc/ subdir into a git submodule (Jon Siwek, Corelight)

VERSION

@@ -1 +1 @@
-2.6-82
+2.6-86

src/Sessions.cc

@@ -544,27 +544,66 @@ void NetSessions::DoNextPacket(double t, const Packet* pkt, const IP_Hdr* ip_hdr
 
 		if ( gre_version == 0 )
 			{
-			if ( proto_typ == 0x6558 && len > gre_len + 14 )
+			if ( proto_typ == 0x6558 )
 				{
 				// transparent ethernet bridging
-				eth_len = 14;
+				if ( len > gre_len + 14 )
-				proto_typ = ntohs(*((uint16*)(data + gre_len + 12)));
+					{
+					eth_len = 14;
+					proto_typ = ntohs(*((uint16*)(data + gre_len + eth_len - 2)));
+					}
+				else
+					{
+					Weird("truncated_GRE", ip_hdr, encapsulation);
+					return;
+					}
 				}
 
-			if ( proto_typ == 0x88be && len > gre_len + 14 + 8)
+			else if ( proto_typ == 0x88be )
 				{
 				// ERSPAN type II
-				erspan_len = 8;
+				if ( len > gre_len + 14 + 8 )
-				eth_len = 14;
+					{
-				proto_typ = ntohs(*((uint16*)(data + gre_len + 20)));
+					erspan_len = 8;
+					eth_len = 14;
+					proto_typ = ntohs(*((uint16*)(data + gre_len + erspan_len + eth_len - 2)));
+					}
+				else
+					{
+					Weird("truncated_GRE", ip_hdr, encapsulation);
+					return;
+					}
 				}
 
-			if ( proto_typ == 0x22eb && len > gre_len + 14 + 12)
+			else if ( proto_typ == 0x22eb )
 				{
 				// ERSPAN type III
-				erspan_len = 12;
+				if ( len > gre_len + 14 + 12 )
-				eth_len = 14;
+					{
-				proto_typ = ntohs(*((uint16*)(data + gre_len + 24)));
+					erspan_len = 12;
+					eth_len = 14;
+
+					auto flags = data + erspan_len - 1;
+					bool have_opt_header = ((*flags & 0x01) == 0x01);
+
+					if ( have_opt_header  )
+						{
+						if ( len > gre_len + erspan_len + 8 + eth_len )
+							erspan_len += 8;
+						else
+							{
+							Weird("truncated_GRE", ip_hdr, encapsulation);
+							return;
+							}
+						}
+
+					proto_typ = ntohs(*((uint16*)(data + gre_len + erspan_len + eth_len - 2)));
+					}
+				else
+					{
+					Weird("truncated_GRE", ip_hdr, encapsulation);
+					return;
+					}
 				}
 
 			if ( proto_typ == 0x0800 )

testing/btest/Baseline/core.erspanII/conn.log

@@ -0,0 +1,10 @@
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	conn
+#open	2019-01-17-23-57-23
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	proto	service	duration	orig_bytes	resp_bytes	conn_state	local_orig	local_resp	missed_bytes	history	orig_pkts	orig_ip_bytes	resp_pkts	resp_ip_bytes	tunnel_parents
+#types	time	string	addr	port	addr	port	enum	string	interval	count	count	string	bool	bool	count	string	count	count	count	count	set[string]
+1402723255.667881	ClEkJM2Vm5giqnMf4h	23.0.0.2	8	23.0.0.3	0	icmp	-	0.001727	144	144	OTH	-	-	0	-	2	200	2	200	CHhAvVGS1DHFjwGM9
+#close	2019-01-17-23-57-23

testing/btest/Baseline/core.erspanII/tunnel.log

@@ -0,0 +1,10 @@
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	tunnel
+#open	2019-01-17-23-57-23
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	tunnel_type	action
+#types	time	string	addr	port	addr	port	enum	enum
+1402723255.667881	CHhAvVGS1DHFjwGM9	2.2.2.2	0	1.1.1.1	0	Tunnel::GRE	Tunnel::DISCOVER
+#close	2019-01-17-23-57-23

testing/btest/core/erspanII.bro

@@ -0,0 +1,6 @@
+# @TEST-EXEC: bro -C -b -r $TRACES/erspanII.pcap %INPUT
+# @TEST-EXEC: btest-diff tunnel.log
+# @TEST-EXEC: btest-diff conn.log
+
+@load base/frameworks/tunnels
+@load base/protocols/conn