decode/ethertype: Event on unknown ethertype

[jlucovsky]

Continuation of #11546

Issue: 7129

Create a decode/engine event if unknown ethertypes are observed.

Link to ticket: https://redmine.openinfosecfoundation.org/issues/7129

Describe changes:

• Add an event created when unknown ethertypes are observed
• Update schema with event counter
• Add rule for event.

Updates

• Formatting fixup.

Provide values to any of the below to override the defaults.

• To use an LibHTP, Suricata-Verify or Suricata-Update pull request,
  link to the pull request in the respective _BRANCH variable.
• Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#1954
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.48%. Comparing base (7f6c963) to head (91dc08d).
Report is 34 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #11557      +/-   ##
==========================================
- Coverage   82.51%   82.48%   -0.03%     
==========================================
  Files         923      923              
  Lines      248732   248739       +7     
==========================================
- Hits       205232   205164      -68     
- Misses      43500    43575      +75     

Flag	Coverage Δ
fuzzcorpus	60.64% <100.00%> (+0.24%)	⬆️
livemode	18.64% <100.00%> (+0.01%)	⬆️
pcap	44.01% <100.00%> (-0.08%)	⬇️
suricata-verify	61.67% <100.00%> (-0.09%)	⬇️
unittests	59.06% <75.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

Information: QA ran without warnings.

Pipeline 21726

[catenacyber]

A rebase should get CI green...

How could we get the unknown ether type logged ?

[jlucovsky]

A rebase should get CI green...

How could we get the unknown ether type logged ?

I'll rebase.

We could probably sample the occurrences and log every Nth unknown ethertype since this is on the packet path.

Thoughts on that?

[jlucovsky]

Continued in #11632

[jasonish]

How could we get the unknown ether type logged ?

We have an ether object in eve, we should add a type it. Its not logged by default though. Also if you enable packet logging, this should log the alerting packet, that would have the ethertype as well.