suricata
decode-vxlan.c
Go to the documentation of this file.
1 /* Copyright (C) 2019-2021 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Henrik Kramshoej <hlk@kramse.org>
22  *
23  * VXLAN tunneling scheme decoder.
24  *
25  * This implementation is based on the following specification doc:
26  * https://tools.ietf.org/html/draft-mahalingam-dutt-dcops-vxlan-00
27  */
28 
29 #include "suricata-common.h"
30 #include "decode.h"
31 #include "decode-vxlan.h"
32 #include "decode-events.h"
33 
34 #include "detect.h"
35 #include "detect-engine-port.h"
36 
37 #include "flow.h"
38 
39 #include "util-validate.h"
40 #include "util-unittest.h"
41 #include "util-debug.h"
42 
43 #define VXLAN_HEADER_LEN sizeof(VXLANHeader)
44 
45 #define VXLAN_MAX_PORTS 4
46 #define VXLAN_UNSET_PORT -1
47 #define VXLAN_DEFAULT_PORT 4789
48 #define VXLAN_DEFAULT_PORT_S "4789"
49 
50 static bool g_vxlan_enabled = true;
51 static int g_vxlan_ports_idx = 0;
52 static int g_vxlan_ports[VXLAN_MAX_PORTS] = { VXLAN_DEFAULT_PORT, VXLAN_UNSET_PORT,
54 
55 typedef struct VXLANHeader_ {
56  uint8_t flags[2];
57  uint16_t gdp;
58  uint8_t vni[3];
59  uint8_t res;
61 
62 bool DecodeVXLANEnabledForPort(const uint16_t sp, const uint16_t dp)
63 {
64  SCLogDebug("ports %u->%u ports %d %d %d %d", sp, dp, g_vxlan_ports[0], g_vxlan_ports[1],
65  g_vxlan_ports[2], g_vxlan_ports[3]);
66 
67  if (g_vxlan_enabled) {
68  for (int i = 0; i < g_vxlan_ports_idx; i++) {
69  if (g_vxlan_ports[i] == VXLAN_UNSET_PORT)
70  return false;
71  const int port = g_vxlan_ports[i];
72  if (port == (const int)sp || port == (const int)dp)
73  return true;
74  }
75  }
76  return false;
77 }
78 
79 static void DecodeVXLANConfigPorts(const char *pstr)
80 {
81  SCLogDebug("parsing \'%s\'", pstr);
82 
83  DetectPort *head = NULL;
84  DetectPortParse(NULL, &head, pstr);
85 
86  g_vxlan_ports_idx = 0;
87  for (DetectPort *p = head; p != NULL; p = p->next) {
88  if (g_vxlan_ports_idx >= VXLAN_MAX_PORTS) {
89  SCLogWarning(SC_ERR_INVALID_YAML_CONF_ENTRY, "more than %d VXLAN ports defined",
91  break;
92  }
93  g_vxlan_ports[g_vxlan_ports_idx++] = (int)p->port;
94  }
95 
97 }
98 
100 {
101  int enabled = 0;
102  if (ConfGetBool("decoder.vxlan.enabled", &enabled) == 1) {
103  if (enabled) {
104  g_vxlan_enabled = true;
105  } else {
106  g_vxlan_enabled = false;
107  }
108  }
109 
110  if (g_vxlan_enabled) {
111  ConfNode *node = ConfGetNode("decoder.vxlan.ports");
112  if (node && node->val) {
113  DecodeVXLANConfigPorts(node->val);
114  } else {
115  DecodeVXLANConfigPorts(VXLAN_DEFAULT_PORT_S);
116  }
117  }
118 }
119 
120 /** \param pkt payload data directly above UDP header
121  * \param len length in bytes of pkt
122  */
124  const uint8_t *pkt, uint32_t len)
125 {
126  DEBUG_VALIDATE_BUG_ON(pkt == NULL);
127 
128  /* Initial packet validation */
129  if (unlikely(!g_vxlan_enabled))
130  return TM_ECODE_FAILED;
131 
132  if (len < (VXLAN_HEADER_LEN + sizeof(EthernetHdr)))
133  return TM_ECODE_FAILED;
134  if (!PacketIncreaseCheckLayers(p)) {
135  return TM_ECODE_FAILED;
136  }
137 
138  const VXLANHeader *vxlanh = (const VXLANHeader *)pkt;
139  if ((vxlanh->flags[0] & 0x08) == 0 || vxlanh->res != 0)
140  return TM_ECODE_FAILED;
141 
142 #if DEBUG
143  uint32_t vni = (vxlanh->vni[0] << 16) + (vxlanh->vni[1] << 8) + (vxlanh->vni[2]);
144  SCLogDebug("VXLAN vni %u", vni);
145 #endif
146 
147  /* Increment stats counter for VXLAN packets */
149 
150  EthernetHdr *ethh = (EthernetHdr *)(pkt + VXLAN_HEADER_LEN);
151  int decode_tunnel_proto = DECODE_TUNNEL_UNSET;
152 
153  /* Look at encapsulated Ethernet frame to get next protocol */
154  uint16_t eth_type = SCNtohs(ethh->eth_type);
155  SCLogDebug("VXLAN ethertype 0x%04x", eth_type);
156 
157  switch (eth_type) {
158  case ETHERNET_TYPE_ARP:
159  SCLogDebug("VXLAN found ARP");
160  break;
161  case ETHERNET_TYPE_IP:
162  SCLogDebug("VXLAN found IPv4");
163  decode_tunnel_proto = DECODE_TUNNEL_IPV4;
164  break;
165  case ETHERNET_TYPE_IPV6:
166  SCLogDebug("VXLAN found IPv6");
167  decode_tunnel_proto = DECODE_TUNNEL_IPV6;
168  break;
169  case ETHERNET_TYPE_VLAN:
172  SCLogDebug("VXLAN found VLAN");
173  decode_tunnel_proto = DECODE_TUNNEL_VLAN;
174  break;
175  default:
176  SCLogDebug("VXLAN found unsupported Ethertype - expected IPv4, IPv6, VLAN, or ARP");
178  }
179 
180  /* Set-up and process inner packet if it is a supported ethertype */
181  if (decode_tunnel_proto != DECODE_TUNNEL_UNSET) {
183  len - (VXLAN_HEADER_LEN + ETHERNET_HEADER_LEN), decode_tunnel_proto);
184  if (tp != NULL) {
187  }
188  }
189 
190  return TM_ECODE_OK;
191 }
192 
193 #ifdef UNITTESTS
194 
195 /**
196  * \test DecodeVXLANTest01 test a good vxlan header.
197  * Contains a DNS request packet.
198  */
199 static int DecodeVXLANtest01 (void)
200 {
201  uint8_t raw_vxlan[] = {
202  0x12, 0xb5, 0x12, 0xb5, 0x00, 0x3a, 0x87, 0x51, /* UDP header */
203  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x25, 0x00, /* VXLAN header */
204  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
205  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
206  0x08, 0x00, /* another IPv4 0x0800 */
207  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11,
208  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, /* IPv4 hdr */
209  0x00, 0x35, 0x30, 0x39, 0x00, 0x08, 0x98, 0xe4 /* UDP probe src port 53 */
210  };
211  Packet *p = PacketGetFromAlloc();
212  FAIL_IF_NULL(p);
213  ThreadVars tv;
215  memset(&tv, 0, sizeof(ThreadVars));
216  memset(&dtv, 0, sizeof(DecodeThreadVars));
217 
218  DecodeVXLANConfigPorts(VXLAN_DEFAULT_PORT_S);
220 
221  DecodeUDP(&tv, &dtv, p, raw_vxlan, sizeof(raw_vxlan));
222  FAIL_IF(p->udph == NULL);
223  FAIL_IF(tv.decode_pq.top == NULL);
224 
226  FAIL_IF(tp->udph == NULL);
227  FAIL_IF_NOT(tp->sp == 53);
228 
229  FlowShutdown();
230  PacketFree(p);
232  PASS;
233 }
234 
235 /**
236  * \test DecodeVXLANtest02 tests default port disabled by the config.
237  */
238 static int DecodeVXLANtest02 (void)
239 {
240  uint8_t raw_vxlan[] = {
241  0x12, 0xb5, 0x12, 0xb5, 0x00, 0x3a, 0x87, 0x51, /* UDP header */
242  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x25, 0x00, /* VXLAN header */
243  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
244  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
245  0x08, 0x00, /* another IPv4 0x0800 */
246  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11,
247  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, /* IPv4 hdr */
248  0x00, 0x35, 0x30, 0x39, 0x00, 0x08, 0x98, 0xe4 /* UDP probe src port 53 */
249  };
250  Packet *p = PacketGetFromAlloc();
251  FAIL_IF_NULL(p);
252  ThreadVars tv;
254  memset(&tv, 0, sizeof(ThreadVars));
255  memset(&dtv, 0, sizeof(DecodeThreadVars));
256 
257  DecodeVXLANConfigPorts("1");
259 
260  DecodeUDP(&tv, &dtv, p, raw_vxlan, sizeof(raw_vxlan));
261  FAIL_IF(p->udph == NULL);
262  FAIL_IF(tv.decode_pq.top != NULL);
263 
264  DecodeVXLANConfigPorts(VXLAN_DEFAULT_PORT_S); /* reset */
265  FlowShutdown();
266  PacketFree(p);
267  PASS;
268 }
269 #endif /* UNITTESTS */
270 
272 {
273 #ifdef UNITTESTS
274  UtRegisterTest("DecodeVXLANtest01",
275  DecodeVXLANtest01);
276  UtRegisterTest("DecodeVXLANtest02",
277  DecodeVXLANtest02);
278 #endif /* UNITTESTS */
279 }
VXLANHeader_
Definition: decode-vxlan.c:55
VXLAN_UNSET_PORT
#define VXLAN_UNSET_PORT
Definition: decode-vxlan.c:46
len
uint8_t len
Definition: app-layer-dnp3.h:2
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:804
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
decode-vxlan.h
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:167
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
PacketFreeOrRelease
void PacketFreeOrRelease(Packet *p)
Return a packet to where it was allocated.
Definition: decode.c:191
DecodeThreadVars_::counter_vxlan
uint16_t counter_vxlan
Definition: decode.h:692
ConfNode_::val
char * val
Definition: conf.h:34
ConfGetBool
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
Definition: conf.c:473
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:296
ETHERNET_TYPE_IPV6
#define ETHERNET_TYPE_IPV6
Definition: decode-ethernet.h:39
ConfGetNode
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:176
VXLAN_HEADER_LEN
#define VXLAN_HEADER_LEN
Definition: decode-vxlan.c:43
DecodeVXLANEnabledForPort
bool DecodeVXLANEnabledForPort(const uint16_t sp, const uint16_t dp)
Definition: decode-vxlan.c:62
VXLANHeader_::flags
uint8_t flags[2]
Definition: decode-vxlan.c:56
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:83
DecodeVXLANConfig
void DecodeVXLANConfig(void)
Definition: decode-vxlan.c:99
util-unittest.h
VXLAN_MAX_PORTS
#define VXLAN_MAX_PORTS
Definition: decode-vxlan.c:45
ETHERNET_TYPE_8021QINQ
#define ETHERNET_TYPE_8021QINQ
Definition: decode-ethernet.h:47
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:82
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1055
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:543
DetectPortParse
int DetectPortParse(const DetectEngineCtx *de_ctx, DetectPort **head, const char *str)
Function for parsing port strings.
Definition: detect-engine-port.c:1247
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
ETHERNET_TYPE_8021AD
#define ETHERNET_TYPE_8021AD
Definition: decode-ethernet.h:43
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:206
VXLAN_DEFAULT_PORT
#define VXLAN_DEFAULT_PORT
Definition: decode-vxlan.c:47
detect.h
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
Packet_::sp
Port sp
Definition: decode.h:432
eth_type
uint16_t eth_type
Definition: decode-ethernet.h:2
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:134
detect-engine-port.h
DetectPort_
Port structure for detection engine.
Definition: detect.h:180
VXLAN_UNKNOWN_PAYLOAD_TYPE
@ VXLAN_UNKNOWN_PAYLOAD_TYPE
Definition: decode-events.h:195
DECODE_TUNNEL_VLAN
@ DECODE_TUNNEL_VLAN
Definition: decode.h:802
Packet_
Definition: decode.h:425
VXLANHeader
struct VXLANHeader_ VXLANHeader
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:803
ETHERNET_HEADER_LEN
#define ETHERNET_HEADER_LEN
Definition: decode-ethernet.h:27
DecodeVXLAN
int DecodeVXLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Definition: decode-vxlan.c:123
SC_ERR_INVALID_YAML_CONF_ENTRY
@ SC_ERR_INVALID_YAML_CONF_ENTRY
Definition: util-error.h:169
decode-events.h
Flow_::next
struct Flow_ * next
Definition: flow.h:407
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:167
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:403
suricata-common.h
PacketQueueNoLock_::top
struct Packet_ * top
Definition: packet-queue.h:35
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:690
VXLANHeader_::vni
uint8_t vni[3]
Definition: decode-vxlan.c:58
VXLANHeader_::res
uint8_t res
Definition: decode-vxlan.c:59
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
VXLANHeader_::gdp
uint16_t gdp
Definition: decode-vxlan.c:57
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:173
PKT_SRC_DECODER_VXLAN
@ PKT_SRC_DECODER_VXLAN
Definition: decode.h:62
DecodeVXLANRegisterTests
void DecodeVXLANRegisterTests(void)
Definition: decode-vxlan.c:271
head
Flow * head
Definition: flow-hash.h:1
SCLogWarning
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:242
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:659
ConfNode_
Definition: conf.h:32
ETHERNET_TYPE_ARP
#define ETHERNET_TYPE_ARP
Definition: decode-ethernet.h:35
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:111
Packet_::udph
UDPHdr * udph
Definition: decode.h:549
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:888
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:40
ETHERNET_TYPE_VLAN
#define ETHERNET_TYPE_VLAN
Definition: decode-vlan.h:31
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:308
VXLAN_DEFAULT_PORT_S
#define VXLAN_DEFAULT_PORT_S
Definition: decode-vxlan.c:48
flow.h
ETHERNET_TYPE_IP
#define ETHERNET_TYPE_IP
Definition: decode-ethernet.h:34
DetectPortCleanupList
void DetectPortCleanupList(const DetectEngineCtx *de_ctx, DetectPort *head)
Free a DetectPort list and each of its members.
Definition: detect-engine-port.c:121
DECODE_TUNNEL_UNSET
@ DECODE_TUNNEL_UNSET
Definition: decode.h:808
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111