Project

General

Profile

Actions

Feature #933

open

add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules

Added by Peter Manev about 8 years ago. Updated over 2 years ago.

Status:
New
Priority:
Normal
Target version:
Effort:
low
Difficulty:
medium
Label:

Description

Using Suricata 1.4.5 and beta.

Three pcaps attached -
AbnormalOrderIPv6NonRFC2460Recommended.pcap
AbnormalOrderIPv6HopByHopNotFirst.pcap
AbnormalOrderIPv6HopByHopNotFirst-2.pcap

RFC2460 recommends the order in which they should be chained in an IPv6 packet:
1. IPv6 main header
2. Hop-by-Hop Options header (if present, it MUST be the first one following the main/regular header)
3. Destination Options header
4. Routing header
5. Fragment header
6. Authentication header
7. Encapsulating Security Payload header
8. Destination Options header
9. Upper-layer header
The only MUST requirement is that the Hop-by-Hop EH has to be the first one.

Ref: http://www.ietf.org/rfc/rfc2460.txt

The above mentioned pcaps (attached) mimic the opposite of the recommendations and requirements of the RFC2460

In AbnormalOrderIPv6NonRFC2460Recommended.pcap - the Extension Headers are not ordered as recommended in RFC2460

In AbnormalOrderIPv6HopByHopNotFirst.pcap - the Hop By Hop extension header is present and not first after the main/regular header.
In AbnormalOrderIPv6HopByHopNotFirst-2.pcap - the Hop By Hop extension header is present and not first after the main/regular header.

Currently Suricata does not alert in those cases where the order of EH is against the recommended by RFC2460. It could be helpful to include such a rule.


Files

Actions #1

Updated by Victor Julien about 8 years ago

  • Assignee set to OISF Dev
  • Target version set to 2.0rc2
Actions #2

Updated by Anoop Saldanha about 8 years ago

  • Assignee changed from OISF Dev to Anoop Saldanha
Actions #3

Updated by Victor Julien almost 8 years ago

  • Status changed from New to Assigned
  • Priority changed from Normal to Low
  • Target version changed from 2.0rc2 to 2.0beta2
Actions #4

Updated by Victor Julien almost 8 years ago

  • Status changed from Assigned to New
  • Assignee changed from Anoop Saldanha to OISF Dev
  • Target version changed from 2.0beta2 to 3.0RC2
Actions #5

Updated by Victor Julien over 6 years ago

  • Target version changed from 3.0RC2 to 70
Actions #6

Updated by Victor Julien about 3 years ago

  • Assignee changed from OISF Dev to Anonymous
  • Priority changed from Low to Normal
  • Target version changed from 70 to TBD
  • Effort set to low
  • Difficulty set to medium
Actions #7

Updated by Andreas Herz over 2 years ago

  • Assignee set to Community Ticket
Actions

Also available in: Atom PDF