Skip to content

Igmp/v4 #14901

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
victorjulien wants to merge 12 commits into from
Closed

Igmp/v4 #14901

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
398f173
decoder/igmp: initial decoder support for IGMP
victorjulien Feb 10, 2026
48cb458
detect/proto: add igmp support
victorjulien Feb 10, 2026
9350444
detect/csum: add igmp-csum keyword to match checksum
victorjulien Feb 10, 2026
6a55bb3
detect/ipopts: add qs and rtralt options
victorjulien Feb 10, 2026
fc57166
decoder/igmp: detect RGMP (RFC 3488)
victorjulien Feb 10, 2026
141a166
detect: add igmp.hdr keyword
victorjulien Feb 11, 2026
d47a77b
detect: add igmp.type keyword
victorjulien Feb 11, 2026
b4754f2
detect/tcp.flags: minor code cleanup
victorjulien Feb 11, 2026
8c1dbda
eve/igmp: add schema support for alert records
victorjulien Feb 11, 2026
332dee2
decoder/igmp: add decoder events
victorjulien Feb 11, 2026
562560d
doc/userguide: add missing ipopts values
victorjulien Feb 12, 2026
2b23e1c
doc/userguide: add igmp keyword docs
victorjulien Feb 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 59 additions & 0 deletions doc/userguide/rules/header-keywords.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,9 @@ esec IP Extended Security
lsrr Loose Source Routing
ssrr Strict Source Routing
satid Stream Identifier
qs Quick-Start
rtralt Router Alert
cipso Commercial Security
any any IP options are set
========= =============================

Expand Down Expand Up @@ -793,3 +796,59 @@ Example rule:
.. container:: example-rule

alert ip $EXTERNAL_NET any -> $HOME_NET any (:example-rule-emphasis:`icmpv6.mtu:<1280;` sid:1234; rev:5;)


IGMP keywords
-------------

The Internet Group Management Protocol (IGMP) is the protocol used by IPv4
systems to report their IP multicast group memberships to neighboring
multicast routers [RFC 9776].

Additionally, the RGMP protocol is a dialect of IGMP. The keywords below
also apply to RGMP. RGMP is defined in RFC 3488.

igmp.hdr
^^^^^^^^

Sticky buffer to match on the whole IGMP header.

Example rule:

.. container:: example-rule

alert igmp any any -> any any (:example-rule-emphasis:`igmp.hdr; content:"|22|"; startswith;` sid:1234; rev:5;)


igmp.type
^^^^^^^^^

Match on the IGMP type field.

``igmp.type`` uses an :ref:`unsigned 8-bit integer <rules-integer-keywords>`.

Format::

igmp.type:0x11;


Example rule:

.. container:: example-rule

alert igmp any any -> any any (:example-rule-emphasis:`igmp.type:0x22;` sid:1234; rev:5;)


igmp-csum
^^^^^^^^^

Match on the validity of the checksum field.

Format::

igmp-csum:valid;
igmp-csum:invalid;

.. container:: example-rule

alert igmp any any -> any any (:example-rule-emphasis:`igmp-csum:invalid;` sid:1234; rev:5;)
57 changes: 57 additions & 0 deletions etc/schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2545,6 +2545,23 @@
]
}
},
"igmp": {
"type": "object",
"additionalProperties": false,
"properties": {
"type": {
"type": "integer",
"suricata": {
"keywords": [
"igmp.type"
]
}
},
"version": {
"type": "integer"
}
}
},
"ike": {
"type": "object",
"additionalProperties": false,
Expand Down Expand Up @@ -5106,6 +5123,20 @@
},
"optional": true
},
"rgmp": {
"type": "object",
"additionalProperties": false,
"properties": {
"type": {
"type": "integer",
"suricata": {
"keywords": [
"igmp.type"
]
}
}
}
},
"rpc": {
"type": "object",
"additionalProperties": false,
Expand Down Expand Up @@ -6619,6 +6650,28 @@
}
}
},
"igmp": {
"type": "object",
"additionalProperties": false,
"properties": {
"invalid_type": {
"type": "integer",
"description": "invalid IGMP type"
},
Comment on lines +6657 to +6660
Copy link
Member

@jasonish jasonish Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this actually exist?

Copy link
Member Author

@victorjulien victorjulien Feb 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oops no, left over from earlier version

"malformed": {
"type": "integer",
"description": "IGMP with malformed data"
},
"pkt_too_small": {
"type": "integer",
"description": "IGMP packets too small to fit a IGMP header"
},
"v3_pkt_too_small": {
"type": "integer",
"description": "IGMPv3 packets too small to fit a IGMP header"
}
}
},
"ipraw": {
"type": "object",
"additionalProperties": false,
Expand Down Expand Up @@ -7058,6 +7111,10 @@
"type": "integer",
"description": "Number of IEEE802.1ah packets decoded"
},
"igmp": {
"type": "integer",
"description": "Number of IGMP packets decoded"
},
"invalid": {
"type": "integer",
"description": "Number of invalid packets decoded"
Expand Down
9 changes: 8 additions & 1 deletion rules/decoder-events.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,8 @@ alert icmp any any -> any any (msg:"SURICATA ICMPv4 invalid checksum"; icmpv4-cs
alert tcp any any -> any any (msg:"SURICATA TCPv6 invalid checksum"; tcpv6-csum:invalid; classtype:protocol-command-decode; sid:2200077; rev:2;)
alert udp any any -> any any (msg:"SURICATA UDPv6 invalid checksum"; udpv6-csum:invalid; classtype:protocol-command-decode; sid:2200078; rev:2;)
alert icmp any any -> any any (msg:"SURICATA ICMPv6 invalid checksum"; icmpv6-csum:invalid; classtype:protocol-command-decode; sid:2200079; rev:2;)
alert igmp any any -> any any (msg:"SURICATA IGMP invalid checksum"; igmp-csum:invalid; classtype:protocol-command-decode; sid:2200126; rev:1;)

# IPv4 in IPv6 rules
alert pkthdr any any -> any any (msg:"SURICATA IPv4-in-IPv6 packet too short"; decode-event:ipv6.ipv4_in_ipv6_too_small; classtype:protocol-command-decode; sid:2200082; rev:2;)
alert pkthdr any any -> any any (msg:"SURICATA IPv4-in-IPv6 invalid protocol"; decode-event:ipv6.ipv4_in_ipv6_wrong_version; classtype:protocol-command-decode; sid:2200083; rev:2;)
Expand Down Expand Up @@ -157,6 +159,11 @@ alert pkthdr any any -> any any (msg:"SURICATA packet with too many layers"; dec
# Capture events.
alert pkthdr any any -> any any (msg:"SURICATA AF-PACKET truncated packet"; decode-event:afpacket.trunc_pkt; classtype:protocol-command-decode; sid:2200122; rev:1;)

# IGMP
alert igmp any any -> any any (msg:"SURICATA IGMP packet too small"; decode-event:igmp.pkt_too_small; classtype:protocol-command-decode; sid:2200127; rev:1;)
alert igmp any any -> any any (msg:"SURICATA IGMPv3 packet too small"; decode-event:igmp.v3_pkt_too_small; classtype:protocol-command-decode; sid:2200128; rev:1;)
alert igmp any any -> any any (msg:"SURICATA IGMP malformed packet"; decode-event:igmp.malformed; classtype:protocol-command-decode; sid:2200129; rev:1;)

alert ipv4 any any -> any any (msg:"SURICATA IPv4 unknown protocol"; decode-event:ipv4.unknown_protocol; threshold: type limit, track by_src, seconds 60, count 1;classtype:protocol-command-decode; sid:2200125;)
# next sid is 2200126
# next sid is 2200130

7 changes: 7 additions & 0 deletions src/Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,7 @@ noinst_HEADERS = \
decode-gre.h \
decode-icmpv4.h \
decode-icmpv6.h \
decode-igmp.h \
decode-ipv4.h \
decode-ipv6.h \
decode-mpls.h \
Expand Down Expand Up @@ -227,6 +228,8 @@ noinst_HEADERS = \
detect-icmpv6hdr.h \
detect-icode.h \
detect-id.h \
detect-igmphdr.h \
detect-igmp-type.h \
detect-ipaddr.h \
detect-ipopts.h \
detect-ipproto.h \
Expand Down Expand Up @@ -651,6 +654,7 @@ libsuricata_c_a_SOURCES = \
decode-gre.c \
decode-icmpv4.c \
decode-icmpv6.c \
decode-igmp.c \
decode-ipv4.c \
decode-ipv6.c \
decode-mpls.c \
Expand Down Expand Up @@ -804,6 +808,8 @@ libsuricata_c_a_SOURCES = \
detect-icmpv6hdr.c \
detect-icode.c \
detect-id.c \
detect-igmphdr.c \
detect-igmp-type.c \
detect-ipaddr.c \
detect-ipopts.c \
detect-ipproto.c \
Expand Down Expand Up @@ -1172,6 +1178,7 @@ EXTRA_DIST = \
tests/detect-http2.c \
tests/detect-icmpv6-mtu.c \
tests/detect-icmpv6hdr.c \
tests/detect-igmphdr.c \
tests/detect-template.c \
tests/detect-transform-pcrexform.c \
tests/detect-ttl.c \
Expand Down
14 changes: 14 additions & 0 deletions src/decode-events.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -614,6 +614,20 @@ const struct DecodeEvents_ DEvents[] = {
NSH_UNKNOWN_PAYLOAD,
},

/* IGMP events */
{
"decoder.igmp.pkt_too_small",
IGMP_PKT_TOO_SMALL,
},
{
"decoder.igmp.v3_pkt_too_small",
IGMP_V3_PKT_TOO_SMALL,
},
{
"decoder.igmp.malformed",
IGMP_MALFORMED,
},

/* GENERIC EVENTS */
{
"decoder.too_many_layers",
Expand Down
5 changes: 5 additions & 0 deletions src/decode-events.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -229,6 +229,11 @@ enum {
NSH_UNSUPPORTED_TYPE,
NSH_UNKNOWN_PAYLOAD,

/* IGMP events */
IGMP_PKT_TOO_SMALL, /**< packet too small to fit the basic IGMP header */
IGMP_V3_PKT_TOO_SMALL, /**< packet too small to fit the IGMPv3 header */
IGMP_MALFORMED,

/* generic events */
GENERIC_TOO_MANY_LAYERS,

Expand Down
Loading
Loading