Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add support for gre decapsulation (#1442) #1921

Merged
merged 2 commits into from
Apr 4, 2023
Merged

add support for gre decapsulation (#1442) #1921

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5ffff1b
add support for gre decapsulation (#1442)
mmaatuq Mar 28, 2023
94b02f7
incorporate notes on PR #1921
mmaatuq Mar 29, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
97 changes: 97 additions & 0 deletions example/reader_util.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1791,6 +1791,78 @@ static inline u_int ndpi_skip_vxlan(u_int16_t ip_offset, u_int16_t ip_len){
return ip_offset + ip_len + sizeof(struct ndpi_udphdr) + sizeof(struct ndpi_vxlanhdr);
}

static uint32_t ndpi_is_valid_gre_tunnel(const struct pcap_pkthdr *header,
const u_char *packet, const u_int16_t ip_offset,
const u_int16_t ip_len){
IvanNardi marked this conversation as resolved.
Show resolved Hide resolved
if(header->caplen < ip_offset + ip_len + sizeof(struct ndpi_gre_basehdr))
return 0; /* Too short for GRE header*/
uint32_t offset = ip_offset + ip_len;
struct ndpi_gre_basehdr *grehdr = (struct ndpi_gre_basehdr*)&packet[offset];
offset += sizeof(struct ndpi_gre_basehdr);
/*
rfc-1701
The GRE flags are encoded in the first two octets. Bit 0 is the
most significant bit, bit 15 is the least significant bit. Bits
13 through 15 are reserved for the Version field. Bits 5 through
12 are reserved for future use and MUST be transmitted as zero.
*/
if(NDPI_GRE_IS_FLAGS(grehdr->flags))
return 0;
if(NDPI_GRE_IS_REC(grehdr->flags))
return 0;
/*GRE rfc 2890 that update 1701*/
if((grehdr->flags & NDPI_GRE_VERSION) == NDPI_GRE_VERSION_0){
if(NDPI_GRE_IS_CSUM(grehdr->flags)){
if(header->caplen < offset + 4)
return 0;
/*checksum field and offset field*/
offset += 4;
}
if(NDPI_GRE_IS_KEY(grehdr->flags)){
if(header->caplen < offset + 4)
return 0;
offset += 4;
}
if(NDPI_GRE_IS_SEQ(grehdr->flags)){
if(header->caplen < offset + 4)
return 0;
offset += 4;
}
}
/*rfc-2637 section 4.1 enhanced gre*/
else if((grehdr->flags & NDPI_GRE_VERSION) == NDPI_GRE_VERSION_1){
if(NDPI_GRE_IS_CSUM(grehdr->flags))
return 0;
if(NDPI_GRE_IS_ROUTING(grehdr->flags))
return 0;
if(!NDPI_GRE_IS_KEY(grehdr->flags))
return 0;
if(NDPI_GRE_IS_STRICT(grehdr->flags))
return 0;
if(grehdr->protocol != NDPI_GRE_PROTO_PPP)
return 0;
/*key field*/
if(header->caplen < offset + 4)
return 0;
offset += 4;
if(NDPI_GRE_IS_SEQ(grehdr->flags)){
if(header->caplen < offset + 4)
return 0;
offset += 4;
}
if(NDPI_GRE_IS_ACK(grehdr->flags)){
if(header->caplen < offset + 4)
return 0;
offset += 4;
}
}
/*support only ver 0, 1*/
else{
return 0;
}
return offset;
}

/* ****************************************************** */

struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow,
Expand Down Expand Up @@ -2296,6 +2368,31 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow,
}
}
}
else if(workflow->prefs.decode_tunnels && (proto == IPPROTO_GRE)){
if(header->caplen < ip_offset + ip_len + sizeof(struct ndpi_gre_basehdr))
return(nproto); /* Too short for GRE header*/
u_int32_t offset = 0;
if((offset = ndpi_is_valid_gre_tunnel(header, packet, ip_offset, ip_len))){
tunnel_type = ndpi_gre_tunnel;
struct ndpi_gre_basehdr *grehdr = (struct ndpi_gre_basehdr*)&packet[ip_offset + ip_len];
if(grehdr->protocol == ntohs(0x0800) || grehdr->protocol == ntohs(0x86DD)){
IvanNardi marked this conversation as resolved.
Show resolved Hide resolved
ip_offset = offset;
goto iph_check;
}
// ppp protocol
else if(grehdr->protocol == NDPI_GRE_PROTO_PPP) {
ip_offset = offset + NDPI_PPP_HDRLEN;
goto iph_check;
}
else{
IvanNardi marked this conversation as resolved.
Show resolved Hide resolved
eth_offset = offset;
goto datalink_check;
}
}
else{
return(nproto);
}
}

/* process the packet */
return(packet_processing(workflow, time_ms, vlan_id, tunnel_type, iph, iph6,
Expand Down
34 changes: 34 additions & 0 deletions src/include/ndpi_typedefs.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ typedef enum {
ndpi_tzsp_tunnel,
ndpi_l2tp_tunnel,
ndpi_vxlan_tunnel,
ndpi_gre_tunnel,
} ndpi_packet_tunnel;

/*
Expand Down Expand Up @@ -536,6 +537,39 @@ struct ndpi_vxlanhdr {
u_int8_t reserved;
} PACK_OFF;


#define NDPI_GRE_CSUM ntohs(0x8000)
#define NDPI_GRE_ROUTING ntohs(0x4000)
#define NDPI_GRE_KEY ntohs(0x2000)
#define NDPI_GRE_SEQ ntohs(0x1000)
#define NDPI_GRE_STRICT ntohs(0x0800)
#define NDPI_GRE_REC ntohs(0x0700)
#define NDPI_GRE_ACK ntohs(0x0080)
#define NDPI_GRE_FLAGS ntohs(0x00f8)
#define NDPI_GRE_VERSION ntohs(0x0007)

#define NDPI_GRE_IS_CSUM(f) ((f) & NDPI_GRE_CSUM)
#define NDPI_GRE_IS_ROUTING(f) ((f) & NDPI_GRE_ROUTING)
#define NDPI_GRE_IS_KEY(f) ((f) & NDPI_GRE_KEY)
#define NDPI_GRE_IS_SEQ(f) ((f) & NDPI_GRE_SEQ)
#define NDPI_GRE_IS_STRICT(f) ((f) & NDPI_GRE_STRICT)
#define NDPI_GRE_IS_REC(f) ((f) & NDPI_GRE_REC)
#define NDPI_GRE_IS_FLAGS(f) ((f) & NDPI_GRE_FLAGS)
#define NDPI_GRE_IS_ACK(f) ((f) & NDPI_GRE_ACK)

#define NDPI_GRE_VERSION_0 ntohs(0x0000)
#define NDPI_GRE_VERSION_1 ntohs(0x0001)
IvanNardi marked this conversation as resolved.
Show resolved Hide resolved
#define NDPI_GRE_PROTO_PPP ntohs(0x880b)
#define NDPI_GRE_PPTP_KEY_MASK ntohs(0xffff)
#define NDPI_PPP_HDRLEN 4 /* octets for standard ppp header */

/* +++++++++++++++++++++++ GRE basic header +++++++++++++++++++++++ */
PACK_ON
struct ndpi_gre_basehdr {
uint16_t flags;
uint16_t protocol;
}PACK_OFF;
IvanNardi marked this conversation as resolved.
Show resolved Hide resolved

/* ************************************************************ */

/**
Expand Down
4 changes: 4 additions & 0 deletions src/lib/ndpi_utils.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1645,6 +1645,10 @@ const char* ndpi_tunnel2str(ndpi_packet_tunnel tt) {
case ndpi_vxlan_tunnel:
return("VXLAN");
break;

case ndpi_gre_tunnel:
return("GRE");
break;
}

return("");
Expand Down
Binary file added tests/pcap/gre_sip.pcapng
View file
Open in desktop
Binary file not shown.
Binary file added tests/pcap/gre_v0.pcapng
View file
Open in desktop
Binary file not shown.
6 changes: 3 additions & 3 deletions tests/result/gre_no_options.pcapng.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,9 @@ Automa tls cert: 0/0 (search/found)
Automa risk mask: 0/0 (search/found)
Automa common alpns: 0/0 (search/found)
Patricia risk mask: 2/0 (search/found)
Patricia risk: 2/0 (search/found)
Patricia risk: 0/0 (search/found)
Patricia protocols: 2/0 (search/found)

GRE 2 276 1
ICMP 2 276 1

1 GRE 203.0.113.1:0 <-> 192.0.2.2:0 [proto: 80/GRE][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/138 bytes <-> 1 pkts/138 bytes][Goodput ratio: 0/0][0.00 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
1 ICMP 10.1.2.1:0 <-> 10.1.2.2:0 [proto: GRE:81/ICMP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/138 bytes <-> 1 pkts/138 bytes][Goodput ratio: 52/52][0.00 sec][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
25 changes: 25 additions & 0 deletions tests/result/gre_sip.pcapng.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
Guessed flow protos: 0

DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence DPI : 1 (flows)
Num dissector calls: 1 (1.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
LRU cache stun_zoom: 0/0/0 (insert/search/found)
Automa host: 0/0 (search/found)
Automa domain: 0/0 (search/found)
Automa tls cert: 0/0 (search/found)
Automa risk mask: 0/0 (search/found)
Automa common alpns: 0/0 (search/found)
Patricia risk mask: 2/0 (search/found)
Patricia risk: 2/0 (search/found)
Patricia protocols: 2/0 (search/found)

SIP 1 506 1

1 UDP 212.83.179.0:5097 -> 192.200.144.148:5060 [VLAN: 1][proto: GRE:100/SIP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: VoIP/10][1 pkts/506 bytes -> 0 pkts/0 bytes][Goodput ratio: 81/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (OPTIONS sip)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
35 changes: 35 additions & 0 deletions tests/result/gre_v0.pcapng.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
Guessed flow protos: 1

DPI Packets (TCP): 9 (9.00 pkts/flow)
DPI Packets (UDP): 5 (1.25 pkts/flow)
DPI Packets (other): 1 (1.00 pkts/flow)
Confidence DPI : 6 (flows)
Num dissector calls: 6 (1.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
LRU cache stun_zoom: 0/0/0 (insert/search/found)
Automa host: 2/0 (search/found)
Automa domain: 2/0 (search/found)
Automa tls cert: 0/0 (search/found)
Automa risk mask: 0/0 (search/found)
Automa common alpns: 0/0 (search/found)
Patricia risk mask: 12/0 (search/found)
Patricia risk: 6/0 (search/found)
Patricia protocols: 12/0 (search/found)

DNS 2 198 1
NTP 6 684 3
ICMP 10 1230 1
SSH 22 4619 1

1 TCP 66.59.111.190:40264 <-> 172.28.2.3:22 [proto: GRE:92/SSH][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 9][cat: RemoteAccess/12][12 pkts/2040 bytes <-> 10 pkts/2579 bytes][Goodput ratio: 47/65][3.16 sec][Hostname/SNI: SSH-1.99-OpenSSH_3.1p1][bytes ratio: -0.117 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/37 336/74 2422/189 740/51][Pkt Len c2s/s2c min/avg/max/stddev: 90/90 170/258 578/826 167/260][Risk: ** SSH Obsolete Cli Vers/Cipher **** SSH Obsolete Ser Vers/Cipher **][Risk Score: 150][HASSH-C: 5EF6678A6B060094834599CA16581B05][Server: SSH-2.0-OpenSSH_3.6.1p1][HASSH-S: 6E3242D64766F4154C11858BBD654415][Plen Bins: 37,0,0,0,0,0,0,0,0,0,0,0,0,25,0,25,0,0,0,0,0,0,0,12,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
2 ICMP 66.59.111.190:0 <-> 172.28.2.3:0 [proto: GRE:81/ICMP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: Network/14][4 pkts/488 bytes <-> 6 pkts/742 bytes][Goodput ratio: 46/47][23.31 sec][bytes ratio: -0.207 (Download)][IAT c2s/s2c min/avg/max/stddev: 1000/927 1000/4632 1001/15252 0/5534][Pkt Len c2s/s2c min/avg/max/stddev: 122/122 122/124 122/127 0/2][PLAIN TEXT (gleeble5)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
3 UDP 66.59.111.190:123 <-> 18.26.4.105:123 [proto: GRE:9/NTP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/114 bytes <-> 1 pkts/114 bytes][Goodput ratio: 42/42][0.07 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
4 UDP 66.59.111.190:123 <-> 66.59.111.182:123 [proto: GRE:9/NTP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/114 bytes <-> 1 pkts/114 bytes][Goodput ratio: 42/42][0.06 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
5 UDP 66.59.111.190:123 <-> 129.170.17.4:123 [proto: GRE:9/NTP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: System/18][1 pkts/114 bytes <-> 1 pkts/114 bytes][Goodput ratio: 42/42][0.07 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
6 UDP 66.59.111.190:37675 -> 172.28.2.3:53 [proto: GRE:5/DNS][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 2][cat: Network/14][2 pkts/198 bytes -> 0 pkts/0 bytes][Goodput ratio: 33/0][5.00 sec][Hostname/SNI: www.gleeble.org][::][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (gleeble)][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]