Geneve feature 3063 v1

[alijkhalil]

Make sure these boxes are signed before submitting your Pull Request -- thank you.

• I have read the contributing guide lines at https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Contributing
• I have signed the Open Information Security Foundation contribution agreement at https://suricata-ids.org/about/contribution-agreement/
• I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/3063

Describe changes:

• Added Geneve decoding functionality and associated unit tests
• Refactored similar encapsulation modes (e.g. vxlan, teredo) to match Geneve

Testing:

• New unit tests
• Geneve pcap files randomly found online
• Actual AWS internal Geneve encapsulated traffic

PRScript output (if applicable):

#suricata-verify-pr:
#suricata-verify-repo:
#suricata-verify-branch:
#suricata-update-pr:
#suricata-update-repo:
#suricata-update-branch:
#libhtp-pr:
#libhtp-repo:
#libhtp-branch:

[jasonish]

Can you provide a pcap? Or even better, a suricata-verify test? Thanks!

[alijkhalil]

I've attached a super simple geneve pcap below as a compressed file. (You can uncompress it with: tar xzf geneve.pcap.gz). I did not use the suricata-verify utility and instead used both my new unit tests and manual integration testing to confirm correctness of my changes.

geneve.pcap.gz

[victorjulien]

Merged in #5361, thanks a lot for your contribution!