decoder/l2tp: initial implementation of decoder

doc/userguide/configuration/suricata-yaml.rst

@@ -2993,6 +2993,17 @@ see :doc:`../performance/packet-profiling`.
 Decoder
 -------
 
+L2TP
+~~~~~
+
+The L2TP decoder can be disabled. It is enabled by default and uses UDP port 1701.
+
+::
+    decoder:
+      l2tp:
+        enabled: true
+        ports: $L2TP_PORTS # syntax: '[1701, 2193]'
+
 Teredo
 ~~~~~~
 

etc/schema.json

@@ -6709,6 +6709,28 @@
                                         }
                                     }
                                 },
+                                "l2tp": {
+                                    "type": "object",
+                                    "additionalProperties": false,
+                                    "properties": {
+                                        "pkt_too_small": {
+                                            "type": "integer",
+                                            "description": "Number of L2TPv3 packets with the header length too small"
+                                        },
+                                        "invalid_version": {
+                                            "type": "integer",
+                                            "description": "Number of L2TP packets with an invalid version"
+                                        },
+                                        "unknown_payload_type": {
+                                            "type": "integer",
+                                            "description": "Number of L2TPv3 packets with an unknown inner L2 type"
+                                        },
+                                        "invalid_ip_proto": {
+                                            "type": "integer",
+                                            "description": "Number of L2TP packets with an invalid IP Protocol"
+                                        }
+                                    }
+                                },
                                 "ltnull": {
                                     "type": "object",
                                     "additionalProperties": false,
@@ -6962,6 +6984,14 @@
                             "type": "integer",
                             "description": "Number of IPv6 in IPv6 packets decoded"
                         },
+                        "l2tp": {
+                            "type": "integer",
+                            "description": "Number of L2TPv3 packets decoded"
+                        },
+                        "l2tp_unsupported": {
+                            "type": "integer",
+                            "description": "Number of L2TPv1/2 packets decoded"
+                        },
                         "max_mac_addrs_dst": {
                             "type": "integer",
                             "description": "Maximum  amount of destination MAC addresses seen per flow (only if ethernet header logging enabled)"

src/Makefile.am

@@ -75,6 +75,7 @@ noinst_HEADERS = \
 	decode-icmpv6.h \
 	decode-ipv4.h \
 	decode-ipv6.h \
+	decode-l2tp.h \
 	decode-mpls.h \
 	decode-nsh.h \
 	decode-ppp.h \
@@ -674,6 +675,7 @@ libsuricata_c_a_SOURCES = \
 	decode-icmpv6.c \
 	decode-ipv4.c \
 	decode-ipv6.c \
+	decode-l2tp.c \
 	decode-mpls.c \
 	decode-nsh.c \
 	decode-null.c \

src/decode-events.c

@@ -934,5 +934,23 @@ const struct DecodeEvents_ DEvents[] = {
             ARP_UNSUPPORTED_OPCODE,
     },
 
+    /* L2TP EVENTS */
+    {
+            "decoder.l2tp.pkt_too_small",
+            L2TP_PKT_TOO_SMALL,
+    },
+    {
+            "decoder.l2tp.invalid_version",
+            L2TP_INVALID_VER,
+    },
+    {
+            "decoder.l2tp.unknown_payload_type",
+            L2TP_UNKNOWN_PAYLOAD_TYPE,
+    },
+    {
+            "decoder.l2tp.invalid_ip_proto",
+            L2TP_INVALID_IP_PROTO,
+    },
+
     { NULL, 0 },
 };

src/decode-events.h

@@ -318,6 +318,12 @@ enum {
     ARP_INVALID_PROTOCOL_SIZE, /**< arp proto size is not 4 */
     ARP_UNSUPPORTED_OPCODE,    /**< arp opcode is not listed */
 
+    /* L2TP EVENTS */
+    L2TP_PKT_TOO_SMALL,        /**< l2tp packet smaller than minimum size */
+    L2TP_INVALID_VER,          /**< l2tp packet version is not 1,2 or 3 */
+    L2TP_UNKNOWN_PAYLOAD_TYPE, /**< l2tp packet is missing a trailing ethernet header */
+    L2TP_INVALID_IP_PROTO,     /**< l2tp packet IPPROTO is not L2TP or UDP */
+
     /* should always be last! */
     DECODE_EVENT_MAX,
 };

src/decode-ipv4.c

@@ -580,6 +580,9 @@ int DecodeIPV4(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
         case IPPROTO_ESP:
             DecodeESP(tv, dtv, p, data, data_len);
             break;
+        case IPPROTO_L2TP:
+            DecodeL2TP(tv, dtv, p, data, data_len);
+            break;
         case IPPROTO_IPV6: {
             /* spawn off tunnel packet */
             Packet *tp = PacketTunnelPktSetup(tv, dtv, p, data, data_len, DECODE_TUNNEL_IPV6);

src/decode-ipv6.c

@@ -605,6 +605,10 @@ int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *
             IPV6_SET_L4PROTO(p, IPPROTO_GRE);
             DecodeGRE(tv, dtv, p, data, data_len);
             break;
+        case IPPROTO_L2TP:
+            IPV6_SET_L4PROTO(p, IPPROTO_L2TP);
+            DecodeL2TP(tv, dtv, p, data, data_len);
+            break;
         case IPPROTO_FRAGMENT:
         case IPPROTO_HOPOPTS:
         case IPPROTO_ROUTING: