Should be rather easy to add support for GRE tunnels now.
This is implemented in topic/jsiwek/gre in just the bro repo.
Would it hurt to add that? Looks like it's just another length adjustment if present?
It involves parsing a list of variable length fields, which should be easy, but I'd rather not add that code unless a pcap to test against is found (which may be hard since the use of it is deprecated).