From 267599aebadbe6642cfea575ad823037497000bd Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Mon, 16 Jul 2012 12:16:37 +0200 Subject: [PATCH] Teredo tunnel supports This patch should fix #480 by adding the support of Teredo tunnel. The IPv6 content of the tunnel will be parsed in a similar way as what is done the GRE tunnel. Signatures will then be matched on the IPv6 content. --- src/Makefile.am | 1 + src/decode-teredo.c | 102 ++++++++++++++++++++++++++++++++++++++++++++ src/decode-teredo.h | 19 +++++++++ src/decode-udp.c | 3 ++ 4 files changed, 125 insertions(+) create mode 100644 src/decode-teredo.c create mode 100644 src/decode-teredo.h diff --git a/src/Makefile.am b/src/Makefile.am index 5f5e34534a2a..cdb6c22d675a 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -34,6 +34,7 @@ decode-ethernet.c decode-ethernet.h \ decode-vlan.c decode-vlan.h \ decode-sll.c decode-sll.h \ decode-gre.c decode-gre.h \ +decode-teredo.c decode-teredo.h \ decode-ppp.c decode-ppp.h \ decode-pppoe.c decode-pppoe.h \ decode-ipv4.c decode-ipv4.h \ diff --git a/src/decode-teredo.c b/src/decode-teredo.c new file mode 100644 index 000000000000..9300fac9ce11 --- /dev/null +++ b/src/decode-teredo.c @@ -0,0 +1,102 @@ +/* Copyright (C) 2012 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +/** + * \ingroup decode + * + * @{ + */ + + +/** + * \file + * + * \author Eric Leblond + * + * Decode Teredo Tunneling protocol + */ + +#include "suricata-common.h" +#include "decode.h" +#include "decode-ipv6.h" +#include "util-debug.h" + +/** + * \brief Function to decode Teredo packets + * + * \retval 0 if packet is not a Teredo packet, 1 if it is + */ +int DecodeTeredo(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq) +{ + + unsigned char *start = p->payload; + + /* Is this packet to short to contain an IPv6 packet ? */ + if (UDP_GET_LEN(p) < UDP_HEADER_LEN + IPV6_HEADER_LEN) + return 0; + + /* Teredo encapsulate IPv6 in UDP and can add some custom message + * part before the IPv6 packet. Here we iter on the messages to get + * on the IPv6 packet. */ + while (start[0] == 0x0) { + switch (p->payload[1]) { + /* origin indication: compatible with tunnel */ + case 0x0: + if (UDP_GET_LEN(p) >= 8 + UDP_HEADER_LEN + IPV6_HEADER_LEN) + start = p->payload + 8; + else + return 0; + break; + /* authentication: negotiation not real tunnel */ + case 0x1: + return 0; + /* this case is not possible in Teredo: not that protocol */ + default: + return 0; + } + } + + if (IP_GET_RAW_VER(start) == 6) { + IPV6Hdr *thdr = (IPV6Hdr *)start; + /* This does looks like Teredo protocol, let's pray together */ + if (UDP_GET_LEN(p) == UDP_HEADER_LEN + IPV6_HEADER_LEN + + IPV6_GET_RAW_PLEN(thdr) + (start - p->payload)) { + if (pq != NULL) { + /* spawn off tunnel packet */ + Packet *tp = PacketPseudoPktSetup(p, start, + IPV4_GET_IPLEN(p) - (start - p->payload), + IPPROTO_IPV6); + if (tp != NULL) { + /* send that to the Tunnel decoder */ + DecodeTunnel(tv, dtv, tp, GET_PKT_DATA(tp), + GET_PKT_LEN(tp), pq, IPPROTO_IPV6); + + /* add the tp to the packet queue. */ + PacketEnqueue(pq,tp); + } + return 1; + } + } + return 0; + } + + return 0; +} + +/** + * @} + */ diff --git a/src/decode-teredo.h b/src/decode-teredo.h new file mode 100644 index 000000000000..142d13c207f7 --- /dev/null +++ b/src/decode-teredo.h @@ -0,0 +1,19 @@ +/* Copyright (C) 2012 Open Information Security Foundation + * + * You can copy, redistribute or modify this Program under the terms of + * the GNU General Public License version 2 as published by the Free + * Software Foundation. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * version 2 along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA + * 02110-1301, USA. + */ + +int DecodeTeredo(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, + uint8_t *pkt, uint16_t len, PacketQueue *pq); diff --git a/src/decode-udp.c b/src/decode-udp.c index f9483d812669..04d54dcb62c3 100644 --- a/src/decode-udp.c +++ b/src/decode-udp.c @@ -33,6 +33,7 @@ #include "suricata-common.h" #include "decode.h" #include "decode-udp.h" +#include "decode-teredo.h" #include "decode-events.h" #include "util-unittest.h" #include "util-debug.h" @@ -81,6 +82,8 @@ void DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, u SCLogDebug("UDP sp: %" PRIu32 " -> dp: %" PRIu32 " - HLEN: %" PRIu32 " LEN: %" PRIu32 "", UDP_GET_SRC_PORT(p), UDP_GET_DST_PORT(p), UDP_HEADER_LEN, p->payload_len); + (void) DecodeTeredo(tv, dtv, p, pkt, len, pq); + /* Flow is an integral part of us */ FlowHandlePacket(tv, p);