suricata
decode-vxlan.c
Go to the documentation of this file.
1 /* Copyright (C) 2019 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Henrik Kramshoej <hlk@kramse.org>
22  *
23  * VXLAN decoder.
24  */
25 
26 #include "suricata-common.h"
27 #include "decode.h"
28 #include "decode-vxlan.h"
29 #include "decode-events.h"
30 
31 #include "detect-engine-port.h"
32 
33 #include "flow.h"
34 
35 #include "util-unittest.h"
36 #include "util-debug.h"
37 
38 #include "pkt-var.h"
39 #include "util-profiling.h"
40 #include "host.h"
41 
42 #define VXLAN_HEADER_LEN 8
43 #define VXLAN_DEFAULT_PORT 4789
44 #define VXLAN_DEFAULT_PORT_S "4789"
45 
46 static bool g_vxlan_enabled = true;
47 static int g_vxlan_ports[4] = { VXLAN_DEFAULT_PORT, -1, -1, -1 };
48 static int g_vxlan_ports_idx = 0;
49 
50 bool DecodeVXLANEnabledForPort(const uint16_t sp, const uint16_t dp)
51 {
52  SCLogDebug("ports %u->%u ports %d %d %d %d", sp, dp,
53  g_vxlan_ports[0], g_vxlan_ports[1],
54  g_vxlan_ports[2], g_vxlan_ports[3]);
55 
56  if (g_vxlan_enabled) {
57  for (int i = 0; i < g_vxlan_ports_idx; i++) {
58  if (g_vxlan_ports[i] == -1)
59  return false;
60  const int port = g_vxlan_ports[i];
61  if (port == (const int)sp ||
62  port == (const int)dp)
63  return true;
64  }
65  }
66  return false;
67 }
68 
69 static void DecodeVXLANConfigPorts(const char *pstr)
70 {
71  SCLogDebug("parsing \'%s\'", pstr);
72 
73  DetectPort *head = NULL;
74  DetectPortParse(NULL, &head, pstr);
75 
76  g_vxlan_ports_idx = 0;
77  for (DetectPort *p = head; p != NULL; p = p->next) {
78  if (g_vxlan_ports_idx >= 4) {
80  "more than 4 VXLAN ports defined");
81  break;
82  }
83  g_vxlan_ports[g_vxlan_ports_idx++] = (int)p->port;
84  }
85  DetectPortCleanupList(NULL, head);
86 }
87 
89 {
90  int enabled = 0;
91  if (ConfGetBool("decoder.vxlan.enabled", &enabled) == 1) {
92  if (enabled) {
93  g_vxlan_enabled = true;
94  } else {
95  g_vxlan_enabled = false;
96  }
97  }
98 
99  if (g_vxlan_enabled) {
100  ConfNode *node = ConfGetNode("decoder.vxlan.ports");
101  if (node && node->val) {
102  DecodeVXLANConfigPorts(node->val);
103  } else {
104  DecodeVXLANConfigPorts(VXLAN_DEFAULT_PORT_S);
105  }
106  }
107 }
108 
109 typedef struct VXLANHeader_ {
110  uint8_t flags[2];
111  uint16_t gdp;
112  uint8_t vni[3];
113  uint8_t res;
114 } VXLANHeader;
115 
116 /** \param pkt payload data directly above UDP header
117  * \param len length in bytes of pkt
118  */
120  const uint8_t *pkt, uint32_t len, PacketQueue *pq)
121 {
122  if (unlikely(!g_vxlan_enabled))
123  return TM_ECODE_FAILED;
124 
125  if (len < (sizeof(VXLANHeader) + sizeof(EthernetHdr)))
126  return TM_ECODE_FAILED;
127 
128  const VXLANHeader *vxlanh = (const VXLANHeader *)pkt;
129  if ((vxlanh->flags[0] & 0x08) == 0 || vxlanh->res != 0) {
130  return TM_ECODE_FAILED;
131  }
132 
133 #if DEBUG
134  uint32_t vni = (vxlanh->vni[0] << 16) + (vxlanh->vni[1] << 8) + (vxlanh->vni[2]);
135  SCLogDebug("VXLAN vni %u", vni);
136 #endif
137 
138  StatsIncr(tv, dtv->counter_vxlan);
139 
140  /* VXLAN encapsulate Layer 2 in UDP, most likely IPv4 and IPv6 */
141 
142  EthernetHdr *ethh = (EthernetHdr *)(pkt + VXLAN_HEADER_LEN);
143  SCLogDebug("VXLAN ethertype 0x%04x", SCNtohs(ethh->eth_type));
144 
145  /* Best guess at inner packet. */
146  switch (SCNtohs(ethh->eth_type)) {
147  case ETHERNET_TYPE_ARP:
148  SCLogDebug("VXLAN found ARP");
149  break;
150  case ETHERNET_TYPE_IP:
151  SCLogDebug("VXLAN found IPv4");
152  if (pq != NULL) {
155  if (tp != NULL) {
157  PacketEnqueue(pq, tp);
158  }
159  }
160  break;
161  case ETHERNET_TYPE_IPV6:
162  SCLogDebug("VXLAN found IPv6");
163  if (pq != NULL) {
166  if (tp != NULL) {
168  PacketEnqueue(pq, tp);
169  }
170  }
171  break;
172  default:
173  SCLogDebug("VXLAN found no known Ethertype - only checks for IPv4, IPv6, ARP");
174  /* ENGINE_SET_INVALID_EVENT(p, VXLAN_UNKNOWN_PAYLOAD_TYPE);*/
175  break;
176  }
177 
178  return TM_ECODE_OK;
179 }
180 
181 #ifdef UNITTESTS
182 
183 /**
184  * \test DecodeVXLANTest01 test a good vxlan header.
185  * Contains a DNS request packet
186  */
187 static int DecodeVXLANtest01 (void)
188 {
189  uint8_t raw_vxlan[] = {
190  0x12, 0xb5, 0x12, 0xb5, 0x00, 0x3a, 0x87, 0x51, /* UDP header */
191  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x25, 0x00, /* VXLAN header */
192  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
193  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
194  0x08, 0x00, /* another IPv4 0x0800 */
195  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11,
196  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, /* IPv4 hdr */
197  0x00, 0x35, 0x30, 0x39, 0x00, 0x08, 0x98, 0xe4 /* UDP probe src port 53 */
198  };
199  Packet *p = PacketGetFromAlloc();
200  FAIL_IF_NULL(p);
201  ThreadVars tv;
202  DecodeThreadVars dtv;
203  PacketQueue pq;
204 
205  DecodeVXLANConfigPorts("4789");
206 
207  memset(&pq, 0, sizeof(PacketQueue));
208  memset(&tv, 0, sizeof(ThreadVars));
209  memset(p, 0, SIZE_OF_PACKET);
210  memset(&dtv, 0, sizeof(DecodeThreadVars));
211 
213  DecodeUDP(&tv, &dtv, p, raw_vxlan, sizeof(raw_vxlan), &pq);
214 
215  FAIL_IF(p->udph == NULL);
216  FAIL_IF(pq.top == NULL);
217  Packet *tp = PacketDequeue(&pq);
218  FAIL_IF(tp->udph == NULL);
219  FAIL_IF_NOT(tp->sp == 53);
220 
221  FlowShutdown();
222  PacketFree(p);
223  PacketFree(tp);
224  PASS;
225 }
226 
227 /**
228  * \test test port disabled in config
229  */
230 static int DecodeVXLANtest02 (void)
231 {
232  uint8_t raw_vxlan[] = {
233  0x12, 0xb5, 0x12, 0xb5, 0x00, 0x3a, 0x87, 0x51, /* UDP header */
234  0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x25, 0x00, /* VXLAN header */
235  0x10, 0x00, 0x00, 0x0c, 0x01, 0x00, /* inner destination MAC */
236  0x00, 0x51, 0x52, 0xb3, 0x54, 0xe5, /* inner source MAC */
237  0x08, 0x00, /* another IPv4 0x0800 */
238  0x45, 0x00, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x00, 0x40, 0x11,
239  0x44, 0x45, 0x0a, 0x60, 0x00, 0x0a, 0xb9, 0x1b, 0x73, 0x06, /* IPv4 hdr */
240  0x00, 0x35, 0x30, 0x39, 0x00, 0x08, 0x98, 0xe4 /* UDP probe src port 53 */
241  };
242  Packet *p = PacketGetFromAlloc();
243  FAIL_IF_NULL(p);
244  ThreadVars tv;
245  DecodeThreadVars dtv;
246  PacketQueue pq;
247 
248  DecodeVXLANConfigPorts("1");
249 
250  memset(&pq, 0, sizeof(PacketQueue));
251  memset(&tv, 0, sizeof(ThreadVars));
252  memset(p, 0, SIZE_OF_PACKET);
253  memset(&dtv, 0, sizeof(DecodeThreadVars));
254 
256  DecodeUDP(&tv, &dtv, p, raw_vxlan, sizeof(raw_vxlan), &pq);
257 
258  FAIL_IF(p->udph == NULL);
259  FAIL_IF(pq.top != NULL);
260 
261  DecodeVXLANConfigPorts("4789"); /* reset */
262  FlowShutdown();
263  PacketFree(p);
264  PASS;
265 }
266 #endif /* UNITTESTS */
267 
269 {
270 #ifdef UNITTESTS
271  UtRegisterTest("DecodeVXLANtest01",
272  DecodeVXLANtest01);
273  UtRegisterTest("DecodeVXLANtest02",
274  DecodeVXLANtest02);
275 #endif /* UNITTESTS */
276 }
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto, PacketQueue *pq)
Setup a pseudo packet (tunnel)
Definition: decode.c:275
UDPHdr * udph
Definition: decode.h:524
#define SCLogDebug(...)
Definition: util-debug.h:335
#define PASS
Pass the test.
#define unlikely(expr)
Definition: util-optimize.h:35
int ConfGetBool(const char *name, int *val)
Retrieve a configuration value as an boolen.
Definition: conf.c:517
Port sp
Definition: decode.h:415
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
#define FLOW_QUIET
Definition: flow.h:38
struct VXLANHeader_ VXLANHeader
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:102
char * val
Definition: conf.h:34
uint8_t vni[3]
Definition: decode-vxlan.c:112
Flow * head
Definition: flow-hash.h:102
void DecodeVXLANRegisterTests(void)
Definition: decode-vxlan.c:268
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1135
#define SIZE_OF_PACKET
Definition: decode.h:618
int DecodeVXLAN(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, PacketQueue *pq)
Definition: decode-vxlan.c:119
#define ETHERNET_TYPE_ARP
#define ETHERNET_TYPE_IP
#define VXLAN_DEFAULT_PORT_S
Definition: decode-vxlan.c:44
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Structure to hold thread specific data for all decode modules.
Definition: decode.h:632
Packet * top
Definition: decode.h:621
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:163
uint8_t flags[2]
Definition: decode-vxlan.c:110
void DetectPortCleanupList(const DetectEngineCtx *de_ctx, DetectPort *head)
Free a DetectPort list and each of its members.
#define SCLogWarning(err_code,...)
Macro used to log WARNING messages.
Definition: util-debug.h:281
#define ETHERNET_HEADER_LEN
#define VXLAN_HEADER_LEN
Definition: decode-vxlan.c:42
Definition: conf.h:32
#define SCNtohs(x)
bool DecodeVXLANEnabledForPort(const uint16_t sp, const uint16_t dp)
Definition: decode-vxlan.c:50
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:670
struct DetectPort_ * next
Definition: detect.h:201
ConfNode * ConfGetNode(const char *name)
Get a ConfNode by name.
Definition: conf.c:176
Packet * PacketDequeue(PacketQueue *q)
Definition: packet-queue.c:167
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
void DecodeVXLANConfig(void)
Definition: decode-vxlan.c:88
uint8_t len
Per thread variable structure.
Definition: threadvars.h:57
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-udp.c:74
#define ETHERNET_TYPE_IPV6
int DetectPortParse(const DetectEngineCtx *de_ctx, DetectPort **head, const char *str)
Function for parsing port strings.
Port structure for detection engine.
Definition: detect.h:187
#define FAIL_IF_NOT(expr)
Fail a test if expression to true.
Definition: util-unittest.h:82
void PacketEnqueue(PacketQueue *q, Packet *p)
Definition: packet-queue.c:139
uint16_t gdp
Definition: decode-vxlan.c:111
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:141
#define VXLAN_DEFAULT_PORT
Definition: decode-vxlan.c:43
uint16_t counter_vxlan
Definition: decode.h:661
void FlowInitConfig(char quiet)
initialize the configuration
Definition: flow.c:515