Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

GH-1389: Skip VN-Tag headers

Browse source
This commit is contained in:
Tim Wojtulewicz 2021-02-01 14:18:24 -07:00
parent dacdf5424b
commit f53448ccc9
15 changed files with 126 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
scripts/base/packet-protocols/__load__.zeek
View file

@ -14,3 +14,4 @@
@load base/packet-protocols/mpls
@load base/packet-protocols/gre
@load base/packet-protocols/iptunnel
@load base/packet-protocols/vntag

1
scripts/base/packet-protocols/ethernet/main.zeek
View file

@ -20,4 +20,5 @@ event zeek_init() &priority=20
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x88A8, PacketAnalyzer::ANALYZER_VLAN);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x9100, PacketAnalyzer::ANALYZER_VLAN);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x8864, PacketAnalyzer::ANALYZER_PPPOE);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 0x8926, PacketAnalyzer::ANALYZER_VNTAG);
}

1
scripts/base/packet-protocols/vntag/__load__.zeek Normal file
View file

@ -0,0 +1 @@
@load ./main

8
scripts/base/packet-protocols/vntag/main.zeek Normal file
View file

@ -0,0 +1,8 @@
module PacketAnalyzer::VNTAG;
event zeek_init() &priority=20
{
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VNTAG, 0x8100, PacketAnalyzer::ANALYZER_VLAN);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VNTAG, 0x88A8, PacketAnalyzer::ANALYZER_VLAN);
PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VNTAG, 0x9100, PacketAnalyzer::ANALYZER_VLAN);
}

1
src/packet_analysis/protocol/CMakeLists.txt
View file

@ -17,3 +17,4 @@ add_subdirectory(arp)
add_subdirectory(ip)
add_subdirectory(gre)
add_subdirectory(iptunnel)
add_subdirectory(vntag)

8
src/packet_analysis/protocol/vntag/CMakeLists.txt Normal file
View file

@ -0,0 +1,8 @@
include(ZeekPlugin)
include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR} ${CMAKE_CURRENT_BINARY_DIR})
zeek_plugin_begin(PacketAnalyzer VNTag)
zeek_plugin_cc(VNTag.cc Plugin.cc)
zeek_plugin_end()

24
src/packet_analysis/protocol/vntag/Plugin.cc Normal file
View file

@ -0,0 +1,24 @@
// See the file "COPYING" in the main distribution directory for copyright.
#include "zeek/plugin/Plugin.h"
#include "zeek/packet_analysis/Component.h"
#include "zeek/packet_analysis/protocol/vntag/VNTag.h"
namespace zeek::plugin::Zeek_VNTag {
class Plugin : public zeek::plugin::Plugin {
public:
zeek::plugin::Configuration Configure()
{
AddComponent(new zeek::packet_analysis::Component("VNTag",
zeek::packet_analysis::VNTag::VNTagAnalyzer::Instantiate));
zeek::plugin::Configuration config;
config.name = "Zeek::VNTag";
config.description = "VNTag packet analyzer";
return config;
}
} plugin;
}

23
src/packet_analysis/protocol/vntag/VNTag.cc Normal file
View file

@ -0,0 +1,23 @@
// See the file "COPYING" in the main distribution directory for copyright.
#include "zeek/packet_analysis/protocol/vntag/VNTag.h"
using namespace zeek::packet_analysis::VNTag;
VNTagAnalyzer::VNTagAnalyzer()
: zeek::packet_analysis::Analyzer("VNTag")
{
}
bool VNTagAnalyzer::AnalyzePacket(size_t len, const uint8_t* data, Packet* packet)
{
if ( 6 >= len )
{
Weird("truncated_vntag_header", packet);
return false;
}
uint32_t protocol = ((data[4] << 8u) + data[5]);
// Skip the VNTag header
return ForwardPacket(len - 6, data + 6, packet, protocol);
}

23
src/packet_analysis/protocol/vntag/VNTag.h Normal file
View file

@ -0,0 +1,23 @@
// See the file "COPYING" in the main distribution directory for copyright.
#pragma once
#include "zeek/packet_analysis/Analyzer.h"
#include "zeek/packet_analysis/Component.h"
namespace zeek::packet_analysis::VNTag {
class VNTagAnalyzer : public Analyzer {
public:
VNTagAnalyzer();
~VNTagAnalyzer() override = default;
bool AnalyzePacket(size_t len, const uint8_t* data, Packet* packet) override;
static zeek::packet_analysis::AnalyzerPtr Instantiate()
{
return std::make_shared<VNTagAnalyzer>();
}
};
}

13
testing/btest/Baseline/core.vntag/unknown_protocols.log Normal file
View file

@ -0,0 +1,13 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path unknown_protocols
#open XXXX-XX-XX-XX-XX-XX
#fields ts analyzer protocol_id first_bytes
#types time string string string
XXXXXXXXXX.XXXXXX IP 0xfd 1b794b175fac06aba658
XXXXXXXXXX.XXXXXX IP 0xfd 9d6c1f9e20274bb66385
XXXXXXXXXX.XXXXXX IP 0xfd 06ffb64ded001f65f818
#close XXXX-XX-XX-XX-XX-XX

2
testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log
View file

@ -54,6 +54,8 @@ scripts/base/init-bare.zeek
scripts/base/packet-protocols/gre/main.zeek
scripts/base/packet-protocols/iptunnel/__load__.zeek
scripts/base/packet-protocols/iptunnel/main.zeek
scripts/base/packet-protocols/vntag/__load__.zeek
scripts/base/packet-protocols/vntag/main.zeek
scripts/base/init-frameworks-and-bifs.zeek
scripts/base/frameworks/logging/__load__.zeek
scripts/base/frameworks/logging/main.zeek

2
testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
View file

@ -54,6 +54,8 @@ scripts/base/init-bare.zeek
scripts/base/packet-protocols/gre/main.zeek
scripts/base/packet-protocols/iptunnel/__load__.zeek
scripts/base/packet-protocols/iptunnel/main.zeek
scripts/base/packet-protocols/vntag/__load__.zeek
scripts/base/packet-protocols/vntag/main.zeek
scripts/base/init-frameworks-and-bifs.zeek
scripts/base/frameworks/logging/__load__.zeek
scripts/base/frameworks/logging/main.zeek

15
testing/btest/Baseline/plugins.hooks/output
View file

@ -562,6 +562,7 @@
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 34887, PacketAnalyzer::ANALYZER_MPLS)) -> <no result>
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 34916, PacketAnalyzer::ANALYZER_PPPOE)) -> <no result>
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 34984, PacketAnalyzer::ANALYZER_VLAN)) -> <no result>
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 35110, PacketAnalyzer::ANALYZER_VNTAG)) -> <no result>
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 37120, PacketAnalyzer::ANALYZER_VLAN)) -> <no result>
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_IEEE802_11, 2048, PacketAnalyzer::ANALYZER_IP)) -> <no result>
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_IEEE802_11, 2054, PacketAnalyzer::ANALYZER_ARP)) -> <no result>
@ -601,6 +602,9 @@
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_VLAN, 34525, PacketAnalyzer::ANALYZER_IP)) -> <no result>
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_VLAN, 34887, PacketAnalyzer::ANALYZER_MPLS)) -> <no result>
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_VLAN, 34916, PacketAnalyzer::ANALYZER_PPPOE)) -> <no result>
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_VNTAG, 33024, PacketAnalyzer::ANALYZER_VLAN)) -> <no result>
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_VNTAG, 34984, PacketAnalyzer::ANALYZER_VLAN)) -> <no result>
0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_VNTAG, 37120, PacketAnalyzer::ANALYZER_VLAN)) -> <no result>
0.000000 MetaHookPost CallFunction(PacketFilter::build, <frame>, ()) -> <no result>
0.000000 MetaHookPost CallFunction(PacketFilter::combine_filters, <frame>, (ip or not ip, and, )) -> <no result>
0.000000 MetaHookPost CallFunction(PacketFilter::install, <frame>, ()) -> <no result>
@ -976,6 +980,7 @@
0.000000 MetaHookPost LoadFile(0, base<...>/utils, <...>/utils.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/version, <...>/version.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/vlan, <...>/vlan) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/vntag, <...>/vntag) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/weird, <...>/weird.zeek) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/x509, <...>/x509) -> -1
0.000000 MetaHookPost LoadFile(0, base<...>/xmpp, <...>/xmpp) -> -1
@ -1560,6 +1565,7 @@
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 34887, PacketAnalyzer::ANALYZER_MPLS))
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 34916, PacketAnalyzer::ANALYZER_PPPOE))
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 34984, PacketAnalyzer::ANALYZER_VLAN))
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 35110, PacketAnalyzer::ANALYZER_VNTAG))
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_ETHERNET, 37120, PacketAnalyzer::ANALYZER_VLAN))
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_IEEE802_11, 2048, PacketAnalyzer::ANALYZER_IP))
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_IEEE802_11, 2054, PacketAnalyzer::ANALYZER_ARP))
@ -1599,6 +1605,9 @@
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_VLAN, 34525, PacketAnalyzer::ANALYZER_IP))
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_VLAN, 34887, PacketAnalyzer::ANALYZER_MPLS))
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_VLAN, 34916, PacketAnalyzer::ANALYZER_PPPOE))
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_VNTAG, 33024, PacketAnalyzer::ANALYZER_VLAN))
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_VNTAG, 34984, PacketAnalyzer::ANALYZER_VLAN))
0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, <frame>, (PacketAnalyzer::ANALYZER_VNTAG, 37120, PacketAnalyzer::ANALYZER_VLAN))
0.000000 MetaHookPre CallFunction(PacketFilter::build, <frame>, ())
0.000000 MetaHookPre CallFunction(PacketFilter::combine_filters, <frame>, (ip or not ip, and, ))
0.000000 MetaHookPre CallFunction(PacketFilter::install, <frame>, ())
@ -1974,6 +1983,7 @@
0.000000 MetaHookPre LoadFile(0, base<...>/utils, <...>/utils.zeek)
0.000000 MetaHookPre LoadFile(0, base<...>/version, <...>/version.zeek)
0.000000 MetaHookPre LoadFile(0, base<...>/vlan, <...>/vlan)
0.000000 MetaHookPre LoadFile(0, base<...>/vntag, <...>/vntag)
0.000000 MetaHookPre LoadFile(0, base<...>/weird, <...>/weird.zeek)
0.000000 MetaHookPre LoadFile(0, base<...>/x509, <...>/x509)
0.000000 MetaHookPre LoadFile(0, base<...>/xmpp, <...>/xmpp)
@ -2557,6 +2567,7 @@
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 34887, PacketAnalyzer::ANALYZER_MPLS)
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 34916, PacketAnalyzer::ANALYZER_PPPOE)
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 34984, PacketAnalyzer::ANALYZER_VLAN)
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 35110, PacketAnalyzer::ANALYZER_VNTAG)
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 37120, PacketAnalyzer::ANALYZER_VLAN)
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IEEE802_11, 2048, PacketAnalyzer::ANALYZER_IP)
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IEEE802_11, 2054, PacketAnalyzer::ANALYZER_ARP)
@ -2596,6 +2607,9 @@
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 34525, PacketAnalyzer::ANALYZER_IP)
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 34887, PacketAnalyzer::ANALYZER_MPLS)
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 34916, PacketAnalyzer::ANALYZER_PPPOE)
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VNTAG, 33024, PacketAnalyzer::ANALYZER_VLAN)
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VNTAG, 34984, PacketAnalyzer::ANALYZER_VLAN)
0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VNTAG, 37120, PacketAnalyzer::ANALYZER_VLAN)
0.000000 | HookCallFunction PacketFilter::build()
0.000000 | HookCallFunction PacketFilter::combine_filters(ip or not ip, and, )
0.000000 | HookCallFunction PacketFilter::install()
@ -2983,6 +2997,7 @@
0.000000 | HookLoadFile base<...>/utils <...>/utils.zeek
0.000000 | HookLoadFile base<...>/version <...>/version.zeek
0.000000 | HookLoadFile base<...>/vlan <...>/vlan
0.000000 | HookLoadFile base<...>/vntag <...>/vntag
0.000000 | HookLoadFile base<...>/weird <...>/weird.zeek
0.000000 | HookLoadFile base<...>/x509 <...>/x509
0.000000 | HookLoadFile base<...>/xmpp <...>/xmpp

BIN
testing/btest/Traces/vntag.pcap Normal file
View file

Binary file not shown.

4
testing/btest/core/vntag.zeek Normal file
View file

@ -0,0 +1,4 @@
# @TEST-EXEC: zeek -C -r $TRACES/vntag.pcap %INPUT
# @TEST-EXEC: btest-diff unknown_protocols.log
@load policy/misc/unknown-protocols