Bug #4571: Unable to trigger rule by content in case of IPv4 in IPv4 incapsulation - Suricata - Open Information Security Foundation

Actions

Bug #4571

open

Unable to trigger rule by content in case of IPv4 in IPv4 incapsulation

Added by Kirill Krotov almost 4 years ago. Updated 2 days ago.

Status:

Assigned

Priority:

Normal

Assignee:

Target version:

Affected Versions:

6.0.3, git master

Effort:

Difficulty:

Label:

Description

Suricata do able detect packets by conent in case of incapsulation. Detection by content works in following cases:

IPv4
IPv6
IPv4 over IPv6
IPv6 over IPv4
IPv6 over IPv6

But it doesn't work with tunnels IPv4 over IPv4 and it seems for me like a bug.

I have used following rule:

alert tcp any any -> any any (msg:"found"; content: "hello"; sid:1;)

With set of pcap files.

Files

Download all files

ipv6.pcap (126 Bytes) ipv6.pcap		Kirill Krotov, 08/02/2021 02:17 PM
ipv6_over_ipv6.pcap (166 Bytes) ipv6_over_ipv6.pcap		Kirill Krotov, 08/02/2021 02:17 PM
ipv6_over_ipv4.pcap (146 Bytes) ipv6_over_ipv4.pcap		Kirill Krotov, 08/02/2021 02:17 PM
ipv4.pcap (106 Bytes) ipv4.pcap		Kirill Krotov, 08/02/2021 02:17 PM
ipv4_over_ipv6.pcap (146 Bytes) ipv4_over_ipv6.pcap		Kirill Krotov, 08/02/2021 02:17 PM
ipv4_over_ipv4.pcap (166 Bytes) ipv4_over_ipv4.pcap	this doesn't work	Kirill Krotov, 08/02/2021 02:17 PM

Related issues 1 (1 open — 0 closed)

Actions

#1

Updated by Philippe Antoine almost 2 years ago

Assignee set to OISF Dev
Target version set to 8.0.0-beta1

Actions

#2

Updated by Victor Julien 3 months ago

Status changed from New to Assigned
Assignee changed from OISF Dev to Victor Julien
Priority changed from Normal to Low
Target version changed from 8.0.0-beta1 to 8.0.0-rc1

Actions

#3

Updated by Philippe Antoine 2 days ago

Related to Bug #7725: decode/ipv4: missing ip-in-ip case handling added

Actions

#4

Updated by Philippe Antoine 2 days ago

@Juliana Fajardini Reichow is this the same as #7725 ?

Actions

#5

Updated by Juliana Fajardini Reichow 2 days ago · Edited

Philippe Antoine wrote in #note-4:

@Juliana Fajardini Reichow is this the same as #7725 ?

Looks like it, I'll see if it makes sense to add some more SV tests with the pcap here.

Actions

#6

Updated by Victor Julien 2 days ago

Priority changed from Low to Normal
Target version changed from 8.0.0-rc1 to 9.0.0-beta1

Actions

#7

Updated by Juliana Fajardini Reichow 2 days ago

SV PR: https://github.com/OISF/suricata-verify/pull/2546

Seems to me that this one is closed by #7725

Actions

Also available in: Atom PDF