mirror of
https://github.com/zeek/zeek.git
synced 2025-10-15 13:08:20 +00:00
Merge remote-tracking branch 'origin/topic/timw/1125-gre-aruba'
* origin/topic/timw/1125-gre-aruba: GH-1125: Support GRE ARUBA headers Fix ethertype for ARP in Geneve forwarding rules
This commit is contained in:
Tim Wojtulewicz
commit
b64a700838
9 changed files with 57 additions and 15 deletions
6
CHANGES
6
CHANGES
|
|
@ -1,3 +1,9 @@
|
|||
4.2.0-dev.428 | 2021-12-09 14:58:53 -0700
|
||||
|
||||
* GH-1125: Support GRE ARUBA headers (Tim Wojtulewicz, Corelight)
|
||||
|
||||
* Fix ethertype for ARP in Geneve forwarding rules (Tim Wojtulewicz, Corelight)
|
||||
|
||||
4.2.0-dev.425 | 2021-12-09 13:45:17 -0800
|
||||
|
||||
* Add LogAscii::json_include_unset_fields flag to control unset field rendering (Christian Kreibich, Corelight)
|
||||
|
|
|
|||
2
VERSION
2
VERSION
|
|
@ -1 +1 @@
|
|||
4.2.0-dev.425
|
||||
4.2.0-dev.428
|
||||
|
|
|
|||
|
|
@ -23,5 +23,5 @@ event zeek_init() &priority=20
|
|||
# Some additional mappings for protocols that we already handle natively.
|
||||
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_GENEVE, 0x0800, PacketAnalyzer::ANALYZER_IP);
|
||||
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_GENEVE, 0x08DD, PacketAnalyzer::ANALYZER_IP);
|
||||
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_GENEVE, 0x0808, PacketAnalyzer::ANALYZER_ARP);
|
||||
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_GENEVE, 0x0806, PacketAnalyzer::ANALYZER_ARP);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -85,7 +85,6 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
|
|||
{
|
||||
eth_len = 14;
|
||||
gre_link_type = DLT_EN10MB;
|
||||
proto_typ = ntohs(*((uint16_t*)(data + gre_len + eth_len - 2)));
|
||||
}
|
||||
else
|
||||
{
|
||||
|
|
@ -113,7 +112,6 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
|
|||
return false;
|
||||
}
|
||||
}
|
||||
proto_typ = ntohs(*((uint16_t*)(data + gre_len + erspan_len + eth_len - 2)));
|
||||
}
|
||||
else
|
||||
{
|
||||
|
|
@ -144,8 +142,32 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
|
|||
return false;
|
||||
}
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
Weird("truncated_GRE", packet);
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
proto_typ = ntohs(*((uint16_t*)(data + gre_len + erspan_len + eth_len - 2)));
|
||||
else if ( proto_typ == 0x8200 )
|
||||
{
|
||||
// ARUBA. Following headers seem like they're always a 26-byte 802.11 QoS header, then
|
||||
// an 8-byte LLC header, then IPv4. There's very little in the way of documentation
|
||||
// for ARUBA's header format. This is all based on the one sample file we have that
|
||||
// contains it.
|
||||
if ( len > gre_len + 34 )
|
||||
{
|
||||
gre_link_type = DLT_EN10MB;
|
||||
erspan_len = 34;
|
||||
|
||||
// TODO: fix this, but it's gonna require quite a bit more surgery to the GRE
|
||||
// analyzer to make it more independent from the IPTunnel analyzer.
|
||||
// Setting gre_version to 1 here tricks the IPTunnel analyzer into treating the
|
||||
// first header as IP instead of Ethernet which it does by default when
|
||||
// gre_version is 0.
|
||||
gre_version = 1;
|
||||
proto = (data[gre_len + 34] & 0xF0) >> 4;
|
||||
}
|
||||
else
|
||||
{
|
||||
|
|
@ -187,7 +209,7 @@ bool GREAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
|
|||
return false;
|
||||
}
|
||||
|
||||
if ( gre_version == 1 )
|
||||
if ( gre_version == 1 && proto_typ != 0x8200 )
|
||||
{
|
||||
uint16_t ppp_proto = ntohs(*((uint16_t*)(data + gre_len + 2)));
|
||||
|
||||
|
|
|
|||
|
|
@ -84,13 +84,12 @@ bool IPTunnelAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* pa
|
|||
tunnel_it->second.second = zeek::run_state::network_time;
|
||||
|
||||
if ( gre_version == 0 )
|
||||
ProcessEncapsulatedPacket(run_state::processing_start_time, packet, len, len, data,
|
||||
gre_link_type, packet->encap, ip_tunnels[tunnel_idx].first);
|
||||
return ProcessEncapsulatedPacket(run_state::processing_start_time, packet, len, len, data,
|
||||
gre_link_type, packet->encap,
|
||||
ip_tunnels[tunnel_idx].first);
|
||||
else
|
||||
ProcessEncapsulatedPacket(run_state::processing_start_time, packet, inner, packet->encap,
|
||||
ip_tunnels[tunnel_idx].first);
|
||||
|
||||
return true;
|
||||
return ProcessEncapsulatedPacket(run_state::processing_start_time, packet, inner,
|
||||
packet->encap, ip_tunnels[tunnel_idx].first);
|
||||
}
|
||||
|
||||
/**
|
||||
|
|
|
|||
11
testing/btest/Baseline/core.tunnels.gre-aruba/tunnel.log
Normal file
11
testing/btest/Baseline/core.tunnels.gre-aruba/tunnel.log
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
||||
#separator \x09
|
||||
#set_separator ,
|
||||
#empty_field (empty)
|
||||
#unset_field -
|
||||
#path tunnel
|
||||
#open XXXX-XX-XX-XX-XX-XX
|
||||
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p tunnel_type action
|
||||
#types time string addr port addr port enum enum
|
||||
XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 10.3.34.171 0 10.33.10.23 0 Tunnel::GRE Tunnel::DISCOVER
|
||||
#close XXXX-XX-XX-XX-XX-XX
|
||||
|
|
@ -594,7 +594,7 @@
|
|||
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 35110, PacketAnalyzer::ANALYZER_VNTAG)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 37120, PacketAnalyzer::ANALYZER_VLAN)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_GENEVE, 2048, PacketAnalyzer::ANALYZER_IP)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_GENEVE, 2056, PacketAnalyzer::ANALYZER_ARP)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_GENEVE, 2054, PacketAnalyzer::ANALYZER_ARP)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_GENEVE, 2269, PacketAnalyzer::ANALYZER_IP)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_GENEVE, 25944, PacketAnalyzer::ANALYZER_ETHERNET)) -> <no result>
|
||||
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_IEEE802_11, 2048, PacketAnalyzer::ANALYZER_IP)) -> <no result>
|
||||
|
|
@ -2051,7 +2051,7 @@
|
|||
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 35110, PacketAnalyzer::ANALYZER_VNTAG))
|
||||
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 37120, PacketAnalyzer::ANALYZER_VLAN))
|
||||
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_GENEVE, 2048, PacketAnalyzer::ANALYZER_IP))
|
||||
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_GENEVE, 2056, PacketAnalyzer::ANALYZER_ARP))
|
||||
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_GENEVE, 2054, PacketAnalyzer::ANALYZER_ARP))
|
||||
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_GENEVE, 2269, PacketAnalyzer::ANALYZER_IP))
|
||||
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_GENEVE, 25944, PacketAnalyzer::ANALYZER_ETHERNET))
|
||||
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_IEEE802_11, 2048, PacketAnalyzer::ANALYZER_IP))
|
||||
|
|
@ -3507,7 +3507,7 @@
|
|||
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 35110, PacketAnalyzer::ANALYZER_VNTAG)
|
||||
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 37120, PacketAnalyzer::ANALYZER_VLAN)
|
||||
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_GENEVE, 2048, PacketAnalyzer::ANALYZER_IP)
|
||||
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_GENEVE, 2056, PacketAnalyzer::ANALYZER_ARP)
|
||||
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_GENEVE, 2054, PacketAnalyzer::ANALYZER_ARP)
|
||||
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_GENEVE, 2269, PacketAnalyzer::ANALYZER_IP)
|
||||
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_GENEVE, 25944, PacketAnalyzer::ANALYZER_ETHERNET)
|
||||
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IEEE802_11, 2048, PacketAnalyzer::ANALYZER_IP)
|
||||
|
|
|
|||
BIN
testing/btest/Traces/tunnels/gre-aruba.pcap
Normal file
BIN
testing/btest/Traces/tunnels/gre-aruba.pcap
Normal file
Binary file not shown.
4
testing/btest/core/tunnels/gre-aruba.zeek
Normal file
4
testing/btest/core/tunnels/gre-aruba.zeek
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
# @TEST-EXEC: zeek -C -b -r $TRACES/tunnels/gre-aruba.pcap %INPUT
|
||||
# @TEST-EXEC: btest-diff tunnel.log
|
||||
|
||||
@load base/frameworks/tunnels
|
||||
Loading…
Add table
Add a link
Reference in a new issue