suricata
decode-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode IPv6
31  */
32 
33 #include "suricata-common.h"
34 #include "decode-ipv6.h"
35 #include "decode.h"
36 #include "defrag.h"
37 #include "util-print.h"
38 #include "util-validate.h"
39 
40 /**
41  * \brief Function to decode IPv4 in IPv6 packets
42  *
43  */
44 static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t plen)
45 {
46 
47  if (unlikely(plen < IPV4_HEADER_LEN)) {
48  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
49  return;
50  }
51  if (IP_GET_RAW_VER(pkt) == 4) {
52  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4);
53  if (tp != NULL) {
54  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
55  PacketEnqueueNoLock(&tv->decode_pq,tp);
56  StatsIncr(tv, dtv->counter_ipv4inipv6);
57  return;
58  }
59  } else {
60  ENGINE_SET_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER);
61  }
62  return;
63 }
64 
65 /**
66  * \brief Function to decode IPv6 in IPv6 packets
67  *
68  */
69 static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
70  const uint8_t *pkt, uint16_t plen)
71 {
72 
73  if (unlikely(plen < IPV6_HEADER_LEN)) {
74  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
75  return TM_ECODE_FAILED;
76  }
77  if (IP_GET_RAW_VER(pkt) == 6) {
78  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6);
79  if (tp != NULL) {
80  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
81  PacketEnqueueNoLock(&tv->decode_pq,tp);
82  StatsIncr(tv, dtv->counter_ipv6inipv6);
83  }
84  } else {
85  ENGINE_SET_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER);
86  }
87  return TM_ECODE_OK;
88 }
89 
90 #ifndef UNITTESTS // ugly, but we need this in defrag tests
91 static inline
92 #endif
93 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
94  uint16_t hdrextlen, uint16_t plen,
95  uint16_t prev_hdrextlen)
96 {
97  uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
98  int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
99 
100  p->l3.vars.ip6.eh.fh_offset = frag_offset;
101  p->l3.vars.ip6.eh.fh_more_frags_set = frag_morefrags ? true : false;
102  p->l3.vars.ip6.eh.fh_nh = *pkt;
103 
104  uint32_t fh_id;
105  memcpy(&fh_id, pkt+4, 4);
106  p->l3.vars.ip6.eh.fh_id = SCNtohl(fh_id);
107 
108  SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x", p->l3.vars.ip6.eh.fh_offset,
109  p->l3.vars.ip6.eh.fh_more_frags_set ? "true" : "false", p->l3.vars.ip6.eh.fh_nh,
110  p->l3.vars.ip6.eh.fh_id, p->l3.vars.ip6.eh.fh_id);
111 
112  // store header offset, data offset
113  uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
114  uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
115  uint16_t data_len = plen - hdrextlen;
116 
117  p->l3.vars.ip6.eh.fh_header_offset = frag_hdr_offset;
118  p->l3.vars.ip6.eh.fh_data_offset = data_offset;
119  p->l3.vars.ip6.eh.fh_data_len = data_len;
120 
121  /* if we have a prev hdr, store the type and offset of it */
122  if (prev_hdrextlen) {
123  p->l3.vars.ip6.eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
124  }
125 
126  SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
127  p->l3.vars.ip6.eh.fh_header_offset, p->l3.vars.ip6.eh.fh_data_offset,
128  p->l3.vars.ip6.eh.fh_data_len);
129 }
130 
131 static void DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const IPV6Hdr *ip6h,
132  const uint8_t *pkt, uint16_t len)
133 {
134  SCEnter();
135 
136  const uint8_t *orig_pkt = pkt;
137  uint8_t nh = IPV6_GET_RAW_NH(ip6h); /* careful, 0 is actually a real type */
138  uint16_t hdrextlen = 0;
139  uint16_t plen = len;
140  char dstopts = 0;
141  char exthdr_fh_done = 0;
142  int hh = 0;
143  int rh = 0;
144  int ah = 0;
145 
146  while(1)
147  {
148  IPV6_SET_EXTHDRS_LEN(p, (len - plen));
149 
150  if (nh == IPPROTO_NONE) {
151  if (plen > 0) {
152  /* No upper layer, but we do have data. Suspicious. */
153  ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER);
154  }
155  SCReturn;
156  }
157 
158  if (plen < 2) { /* minimal needed in a hdr */
159  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
160  SCReturn;
161  }
162 
163  switch(nh)
164  {
165  case IPPROTO_TCP:
166  IPV6_SET_L4PROTO(p,nh);
167  DecodeTCP(tv, dtv, p, pkt, plen);
168  SCReturn;
169 
170  case IPPROTO_UDP:
171  IPV6_SET_L4PROTO(p,nh);
172  DecodeUDP(tv, dtv, p, pkt, plen);
173  SCReturn;
174 
175  case IPPROTO_ICMPV6:
176  IPV6_SET_L4PROTO(p,nh);
177  DecodeICMPV6(tv, dtv, p, pkt, plen);
178  SCReturn;
179 
180  case IPPROTO_SCTP:
181  IPV6_SET_L4PROTO(p,nh);
182  DecodeSCTP(tv, dtv, p, pkt, plen);
183  SCReturn;
184 
185  case IPPROTO_ROUTING:
186  IPV6_SET_L4PROTO(p,nh);
187  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
188 
189  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
190 
191  if (hdrextlen > plen) {
192  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
193  SCReturn;
194  }
195 
196  if (rh) {
197  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH);
198  /* skip past this extension so we can continue parsing the rest
199  * of the packet */
200  nh = *pkt;
201  pkt += hdrextlen;
202  plen -= hdrextlen;
203  break;
204  }
205 
206  rh = 1;
207  IPV6_EXTHDR_SET_RH(p);
208 
209  uint8_t ip6rh_type = *(pkt + 2);
210  if (ip6rh_type == 0) {
211  ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0);
212  }
213  p->l3.vars.ip6.eh.rh_type = ip6rh_type;
214 
215  nh = *pkt;
216  pkt += hdrextlen;
217  plen -= hdrextlen;
218  break;
219 
220  case IPPROTO_HOPOPTS:
221  case IPPROTO_DSTOPTS:
222  {
223  IPV6OptHAO hao_s, *hao = &hao_s;
224  IPV6OptRA ra_s, *ra = &ra_s;
225  IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
226  uint16_t optslen = 0;
227 
228  IPV6_SET_L4PROTO(p,nh);
229  hdrextlen = (uint16_t)((*(pkt + 1) + 1) << 3);
230  if (hdrextlen > plen) {
231  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
232  SCReturn;
233  }
234 
235  const uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
236 
237  /* point the pointers to right structures
238  * in Packet. */
239  if (nh == IPPROTO_HOPOPTS) {
240  if (hh) {
241  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH);
242  /* skip past this extension so we can continue parsing the rest
243  * of the packet */
244  nh = *pkt;
245  pkt += hdrextlen;
246  plen -= hdrextlen;
247  break;
248  }
249 
250  hh = 1;
251 
252  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
253  }
254  else if (nh == IPPROTO_DSTOPTS)
255  {
256  if (dstopts == 0) {
257  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
258  dstopts = 1;
259  } else if (dstopts == 1) {
260  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
261  dstopts = 2;
262  } else {
263  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH);
264  /* skip past this extension so we can continue parsing the rest
265  * of the packet */
266  nh = *pkt;
267  pkt += hdrextlen;
268  plen -= hdrextlen;
269  break;
270  }
271  }
272 
273  if (optslen > plen) {
274  /* since the packet is long enough (we checked
275  * plen against hdrlen, the optlen must be malformed. */
276  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
277  /* skip past this extension so we can continue parsing the rest
278  * of the packet */
279  nh = *pkt;
280  pkt += hdrextlen;
281  plen -= hdrextlen;
282  break;
283  }
284 /** \todo move into own function to loaded on demand */
285  uint16_t padn_cnt = 0;
286  uint16_t other_cnt = 0;
287  uint16_t offset = 0;
288  while(offset < optslen)
289  {
290  if (*ptr == IPV6OPT_PAD1)
291  {
292  padn_cnt++;
293  offset++;
294  ptr++;
295  continue;
296  }
297 
298  if (offset + 1 >= optslen) {
299  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
300  break;
301  }
302 
303  /* length field for each opt */
304  uint8_t ip6_optlen = *(ptr + 1);
305 
306  /* see if the optlen from the packet fits the total optslen */
307  if ((offset + 1 + ip6_optlen) > optslen) {
308  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
309  break;
310  }
311 
312  if (*ptr == IPV6OPT_PADN) /* PadN */
313  {
314  //printf("PadN option\n");
315  padn_cnt++;
316 
317  /* a zero padN len would be weird */
318  if (ip6_optlen == 0)
319  ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN);
320  }
321  else if (*ptr == IPV6OPT_RA) /* RA */
322  {
323  ra->ip6ra_type = *(ptr);
324  ra->ip6ra_len = ip6_optlen;
325 
326  if (ip6_optlen < sizeof(ra->ip6ra_value)) {
327  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
328  break;
329  }
330 
331  memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
332  ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
333  //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
334  // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
335  other_cnt++;
336  }
337  else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
338  {
339  jumbo->ip6j_type = *(ptr);
340  jumbo->ip6j_len = ip6_optlen;
341 
342  if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
343  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
344  break;
345  }
346 
347  memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
348  jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
349  //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
350  // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
351  }
352  else if (*ptr == IPV6OPT_HAO) /* HAO */
353  {
354  hao->ip6hao_type = *(ptr);
355  hao->ip6hao_len = ip6_optlen;
356 
357  if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
358  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
359  break;
360  }
361 
362  memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa));
363  //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ",
364  // hao->ip6hao_type, hao->ip6hao_len);
365  //char addr_buf[46];
366  //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa),
367  // addr_buf,sizeof(addr_buf));
368  //printf("home addr %s\n", addr_buf);
369  other_cnt++;
370  } else {
371  if (nh == IPPROTO_HOPOPTS)
372  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT);
373  else
374  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT);
375 
376  other_cnt++;
377  }
378  uint16_t optlen = (*(ptr + 1) + 2);
379  ptr += optlen; /* +2 for opt type and opt len fields */
380  offset += optlen;
381  }
382  /* flag packets that have only padding */
383  if (padn_cnt > 0 && other_cnt == 0) {
384  if (nh == IPPROTO_HOPOPTS)
385  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING);
386  else
387  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING);
388  }
389 
390  nh = *pkt;
391  pkt += hdrextlen;
392  plen -= hdrextlen;
393  break;
394  }
395 
396  case IPPROTO_FRAGMENT:
397  {
398  IPV6_SET_L4PROTO(p,nh);
399  /* store the offset of this extension into the packet
400  * past the ipv6 header. We use it in defrag for creating
401  * a defragmented packet without the frag header */
402  if (exthdr_fh_done == 0) {
403  DEBUG_VALIDATE_BUG_ON(pkt - orig_pkt > UINT16_MAX);
404  p->l3.vars.ip6.eh.fh_offset = (uint16_t)(pkt - orig_pkt);
405  exthdr_fh_done = 1;
406  }
407 
408  uint16_t prev_hdrextlen = hdrextlen;
409  hdrextlen = sizeof(IPV6FragHdr);
410  if (hdrextlen > plen) {
411  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
412  SCReturn;
413  }
414 
415  /* for the frag header, the length field is reserved */
416  if (*(pkt + 1) != 0) {
417  ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD);
418  /* non fatal, lets try to continue */
419  }
420 
421  if (IPV6_EXTHDR_ISSET_FH(p)) {
422  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH);
423  nh = *pkt;
424  pkt += hdrextlen;
425  plen -= hdrextlen;
426  break;
427  }
428 
429  /* set the header flag first */
430  IPV6_EXTHDR_SET_FH(p);
431 
432  /* parse the header and setup the vars */
433  DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
434 
435  /* if FH has offset 0 and no more fragments are coming, we
436  * parse this packet further right away, no defrag will be
437  * needed. It is a useless FH then though, so we do set an
438  * decoder event. */
439  if (p->l3.vars.ip6.eh.fh_more_frags_set == 0 && p->l3.vars.ip6.eh.fh_offset == 0) {
440  ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH);
441 
442  nh = *pkt;
443  pkt += hdrextlen;
444  plen -= hdrextlen;
445  break;
446  }
447  if (p->l3.vars.ip6.eh.fh_more_frags_set != 0 && plen % 8 != 0) {
448  // cf https://datatracker.ietf.org/doc/html/rfc2460#section-4.5
449  // each, except possibly the last ("rightmost") one,
450  // being an integer multiple of 8 octets long.
451  ENGINE_SET_EVENT(p, IPV6_FRAG_INVALID_LENGTH);
452  }
453 
454  /* the rest is parsed upon reassembly */
455  p->flags |= PKT_IS_FRAGMENT;
456  SCReturn;
457  }
458  case IPPROTO_ESP:
459  {
460  IPV6_SET_L4PROTO(p,nh);
461  DecodeESP(tv, dtv, p, pkt, plen);
462  SCReturn;
463  }
464  case IPPROTO_AH:
465  {
466  IPV6_SET_L4PROTO(p,nh);
467  /* we need the header as a minimum */
468  hdrextlen = sizeof(IPV6AuthHdr);
469  /* the payload len field is the number of extra 4 byte fields,
470  * IPV6AuthHdr already contains the first */
471  if (*(pkt+1) > 0)
472  hdrextlen += ((*(pkt+1) - 1) * 4);
473 
474  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
475 
476  if (hdrextlen > plen) {
477  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
478  SCReturn;
479  }
480 
481  IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
482  if (ahhdr->ip6ah_reserved != 0x0000) {
483  ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL);
484  }
485 
486  if (ah) {
487  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH);
488  nh = *pkt;
489  pkt += hdrextlen;
490  plen -= hdrextlen;
491  break;
492  }
493 
494  ah = 1;
495 
496  nh = *pkt;
497  pkt += hdrextlen;
498  plen -= hdrextlen;
499  break;
500  }
501  case IPPROTO_IPIP:
502  IPV6_SET_L4PROTO(p,nh);
503  DecodeIPv4inIPv6(tv, dtv, p, pkt, plen);
504  SCReturn;
505  /* none, last header */
506  case IPPROTO_NONE:
507  IPV6_SET_L4PROTO(p,nh);
508  SCReturn;
509  case IPPROTO_ICMP:
510  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
511  SCReturn;
512  /* no parsing yet, just skip it */
513  case IPPROTO_MH:
514  case IPPROTO_HIP:
515  case IPPROTO_SHIM6:
516  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
517  if (hdrextlen > plen) {
518  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
519  SCReturn;
520  }
521  nh = *pkt;
522  pkt += hdrextlen;
523  plen -= hdrextlen;
524  break;
525  default:
526  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
527  IPV6_SET_L4PROTO(p,nh);
528  SCReturn;
529  }
530  }
531 
532  SCReturn;
533 }
534 
535 static const IPV6Hdr *DecodeIPV6Packet(
536  ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
537 {
538  if (unlikely(len < IPV6_HEADER_LEN)) {
539  return NULL;
540  }
541 
542  if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
543  SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
544  ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
545  return NULL;
546  }
547 
548  const IPV6Hdr *ip6h = PacketSetIPV6(p, pkt);
549 
550  if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_RAW_PLEN(ip6h)))) {
551  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
552  return NULL;
553  }
554 
555  SET_IPV6_SRC_ADDR(ip6h, &p->src);
556  SET_IPV6_DST_ADDR(ip6h, &p->dst);
557 
558  return ip6h;
559 }
560 
561 int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
562 {
563  StatsIncr(tv, dtv->counter_ipv6);
564 
565  if (!PacketIncreaseCheckLayers(p)) {
566  return TM_ECODE_FAILED;
567  }
568  /* do the actual decoding */
569  const IPV6Hdr *ip6h = DecodeIPV6Packet(tv, dtv, p, pkt, len);
570  if (unlikely(ip6h == NULL)) {
571  PacketClearL3(p);
572  return TM_ECODE_FAILED;
573  }
574  p->proto = IPV6_GET_RAW_NH(ip6h);
575 
576 #ifdef DEBUG
577  if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
578  /* debug print */
579  char s[46], d[46];
580  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
581  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
582  SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32
583  " PLEN: %" PRIu32 " HLIM: %" PRIu32 "",
584  s, d, IPV6_GET_RAW_CLASS(ip6h), IPV6_GET_RAW_FLOW(ip6h), IPV6_GET_RAW_NH(ip6h),
585  IPV6_GET_RAW_PLEN(ip6h), IPV6_GET_RAW_HLIM(ip6h));
586  }
587 #endif /* DEBUG */
588  const uint8_t *data = pkt + IPV6_HEADER_LEN;
589  const uint16_t data_len = IPV6_GET_RAW_PLEN(ip6h);
590 
591  /* now process the Ext headers and/or the L4 Layer */
592  switch (IPV6_GET_RAW_NH(ip6h)) {
593  case IPPROTO_TCP:
594  IPV6_SET_L4PROTO (p, IPPROTO_TCP);
595  DecodeTCP(tv, dtv, p, data, data_len);
596  return TM_ECODE_OK;
597  case IPPROTO_UDP:
598  IPV6_SET_L4PROTO (p, IPPROTO_UDP);
599  DecodeUDP(tv, dtv, p, data, data_len);
600  return TM_ECODE_OK;
601  case IPPROTO_ICMPV6:
602  IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
603  DecodeICMPV6(tv, dtv, p, data, data_len);
604  return TM_ECODE_OK;
605  case IPPROTO_SCTP:
606  IPV6_SET_L4PROTO (p, IPPROTO_SCTP);
607  DecodeSCTP(tv, dtv, p, data, data_len);
608  return TM_ECODE_OK;
609  case IPPROTO_IPIP:
610  IPV6_SET_L4PROTO(p, IPPROTO_IPIP);
611  DecodeIPv4inIPv6(tv, dtv, p, data, data_len);
612  return TM_ECODE_OK;
613  case IPPROTO_IPV6:
614  DecodeIP6inIP6(tv, dtv, p, data, data_len);
615  return TM_ECODE_OK;
616  case IPPROTO_GRE:
617  IPV6_SET_L4PROTO(p, IPPROTO_GRE);
618  DecodeGRE(tv, dtv, p, data, data_len);
619  break;
620  case IPPROTO_FRAGMENT:
621  case IPPROTO_HOPOPTS:
622  case IPPROTO_ROUTING:
623  case IPPROTO_NONE:
624  case IPPROTO_DSTOPTS:
625  case IPPROTO_AH:
626  case IPPROTO_ESP:
627  case IPPROTO_MH:
628  case IPPROTO_HIP:
629  case IPPROTO_SHIM6:
630  DecodeIPV6ExtHdrs(tv, dtv, p, ip6h, data, data_len);
631  break;
632  case IPPROTO_ICMP:
633  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
634  break;
635  default:
636  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
637  IPV6_SET_L4PROTO(p, IPV6_GET_RAW_NH(ip6h));
638  break;
639  }
640  p->proto = IPV6_GET_L4PROTO (p);
641 
642  /* Pass to defragger if a fragment. */
643  if (IPV6_EXTHDR_ISSET_FH(p)) {
644  Packet *rp = Defrag(tv, dtv, p);
645  if (rp != NULL) {
646  PacketEnqueueNoLock(&tv->decode_pq,rp);
647  }
648  }
649 
650  return TM_ECODE_OK;
651 }
652 
653 #ifdef UNITTESTS
654 #include "util-unittest-helper.h"
655 #include "packet.h"
656 
657 /**
658  * \test fragment decoding
659  */
660 static int DecodeIPV6FragTest01 (void)
661 {
662 
663  uint8_t raw_frag1[] = {
664  0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
665  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
666  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
667  0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
668  0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
669  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
670  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
671  0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
672  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
673  0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
674  0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
675  0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
676  0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
677  0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
678  0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
679  0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
680  0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
681  0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
682  0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
683  0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
684  0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
685  0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
686  0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
687  0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
688  0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
689  0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
690  0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
691  0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
692  0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
693  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
694  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
695  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
696  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
697  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
698  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
699  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
700  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
701  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
702  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
703  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
704  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
705  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
706  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
707  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
708  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
748  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
749  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
750  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
751  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
752  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
753  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
754  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
755  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
756  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
757  };
758  uint8_t raw_frag2[] = {
759  0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
760  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
761  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
762  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
763  0x20, 0x20, 0x20, 0x20,
764  };
765  Packet *pkt;
766  Packet *p1 = PacketGetFromAlloc();
767  if (unlikely(p1 == NULL))
768  return 0;
769  Packet *p2 = PacketGetFromAlloc();
770  if (unlikely(p2 == NULL)) {
771  SCFree(p1);
772  return 0;
773  }
774  ThreadVars tv;
775  DecodeThreadVars dtv;
776  int result = 0;
777 
778  FlowInitConfig(FLOW_QUIET);
779  DefragInit();
780 
781  memset(&tv, 0, sizeof(ThreadVars));
782  memset(&dtv, 0, sizeof(DecodeThreadVars));
783 
784  PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
785  PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
786 
787  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
788 
789  if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
790  printf("ipv6 frag header not detected: ");
791  goto end;
792  }
793 
794  DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2));
795 
796  if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
797  printf("ipv6 frag header not detected: ");
798  goto end;
799  }
800 
801  if (tv.decode_pq.len != 1) {
802  printf("no reassembled packet: ");
803  goto end;
804  }
805 
806  result = 1;
807 end:
808  PacketRecycle(p1);
809  PacketRecycle(p2);
810  SCFree(p1);
811  SCFree(p2);
812  pkt = PacketDequeueNoLock(&tv.decode_pq);
813  while (pkt != NULL) {
814  PacketRecycle(pkt);
815  SCFree(pkt);
816  pkt = PacketDequeueNoLock(&tv.decode_pq);
817  }
818  DefragDestroy();
819  FlowShutdown();
820  return result;
821 }
822 
823 /**
824  * \test routing header decode
825  */
826 static int DecodeIPV6RouteTest01 (void)
827 {
828  uint8_t raw_pkt1[] = {
829  0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
830  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
831  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
832  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
833  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
834  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
835 
836  0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
837  0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
838  0xfa, 0x87, 0x00, 0x00,
839  };
840  Packet *p1 = PacketGetFromAlloc();
841  FAIL_IF(unlikely(p1 == NULL));
842  ThreadVars tv;
843  DecodeThreadVars dtv;
844 
845  FlowInitConfig(FLOW_QUIET);
846 
847  memset(&tv, 0, sizeof(ThreadVars));
848  memset(&dtv, 0, sizeof(DecodeThreadVars));
849 
850  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
851 
852  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
853 
854  FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1)));
855  FAIL_IF(p1->l3.vars.ip6.eh.rh_type != 0);
856  PacketRecycle(p1);
857  SCFree(p1);
858  FlowShutdown();
859  PASS;
860 }
861 
862 /**
863  * \test HOP header decode
864  */
865 static int DecodeIPV6HopTest01 (void)
866 {
867  uint8_t raw_pkt1[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x01, 0xfe, 0x80, 0x00, 0x00,
868  0x00, 0x00, 0x00, 0x00, 0x02, 0x0f, 0xfe, 0xff, 0xfe, 0x98, 0x3d, 0x01, 0xff, 0x02, 0x00,
869  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x3a, 0x00,
870  0xff, /* 0xff is a nonsense opt */
871  0x02, 0x00, 0x00, 0x00, 0x00, 0x82, 0x00, 0x1c, 0x6f, 0x27, 0x10, 0x00, 0x00, 0x00, 0x00,
872  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
873  Packet *p1 = PacketGetFromAlloc();
874  FAIL_IF(unlikely(p1 == NULL));
875  ThreadVars tv;
876  DecodeThreadVars dtv;
877 
878  FlowInitConfig(FLOW_QUIET);
879 
880  memset(&tv, 0, sizeof(ThreadVars));
881  memset(&dtv, 0, sizeof(DecodeThreadVars));
882 
883  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
884 
885  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
886 
887  FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
888 
889  PacketRecycle(p1);
890  SCFree(p1);
891  FlowShutdown();
892  PASS;
893 }
894 
895 #endif /* UNITTESTS */
896 
897 /**
898  * \brief this function registers unit tests for IPV6 decoder
899  */
900 
901 void DecodeIPV6RegisterTests(void)
902 {
903 #ifdef UNITTESTS
904  UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
905  UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
906  UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
907 #endif /* UNITTESTS */
908 }
909 
910 /**
911  * @}
912  */
IPV6_FRAG_INVALID_LENGTH
@ IPV6_FRAG_INVALID_LENGTH
Definition: decode-events.h:173
IPV4_IN_IPV6_WRONG_IP_VER
@ IPV4_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:181
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:1168
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1127
PacketL3::ip6
struct PacketL3::@31::@32 ip6
Packet_::proto
uint8_t proto
Definition: decode.h:513
len
uint8_t len
Definition: app-layer-dnp3.h:2
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:1090
IPV6_GET_RAW_PLEN
#define IPV6_GET_RAW_PLEN(ip6h)
Definition: decode-ipv6.h:66
IPV4_IN_IPV6_PKT_TOO_SMALL
@ IPV4_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:180
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:167
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
IPV6_GET_RAW_HLIM
#define IPV6_GET_RAW_HLIM(ip6h)
Definition: decode-ipv6.h:67
IPV6_GET_RAW_NH
#define IPV6_GET_RAW_NH(ip6h)
Definition: decode-ipv6.h:65
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:351
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DecodeESP
int DecodeESP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Function to decode IPSEC-ESP packets.
Definition: decode-esp.c:64
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:1183
ip6rh_type
uint8_t ip6rh_type
Definition: decode-ipv6.h:3
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
IPV6_DSTOPTS_UNKNOWN_OPT
@ IPV6_DSTOPTS_UNKNOWN_OPT
Definition: decode-events.h:82
IPV6OptRA_::ip6ra_value
uint16_t ip6ra_value
Definition: decode-ipv6.h:154
IPV6OptHAO_::ip6hao_hoa
struct in6_addr ip6hao_hoa
Definition: decode-ipv6.h:146
IPV6_EXTHDR_ISSET_FH
#define IPV6_EXTHDR_ISSET_FH(p)
Definition: decode-ipv6.h:212
IPV6OPT_HAO
#define IPV6OPT_HAO
Definition: decode-ipv6.h:139
Packet_::flags
uint32_t flags
Definition: decode.h:528
PacketRecycle
void PacketRecycle(Packet *p)
Definition: packet.c:142
IPV6_GET_RAW_CLASS
#define IPV6_GET_RAW_CLASS(ip6h)
Definition: decode-ipv6.h:63
IPV6OPT_PADN
#define IPV6OPT_PADN
Definition: decode-ipv6.h:136
IPV6_EXTHDR_USELESS_FH
@ IPV6_EXTHDR_USELESS_FH
Definition: decode-events.h:69
IPV6OPT_RA
#define IPV6OPT_RA
Definition: decode-ipv6.h:137
IPV6_EXTHDR_SET_FH
#define IPV6_EXTHDR_SET_FH(p)
Definition: decode-ipv6.h:211
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:75
IPPROTO_GRE
#define IPPROTO_GRE
Definition: decode-gre.h:30
IP_GET_RAW_VER
#define IP_GET_RAW_VER(pkt)
Definition: decode.h:237
IPV6_SET_L4PROTO
#define IPV6_SET_L4PROTO(p, proto)
Definition: decode-ipv6.h:72
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
IPV6_EXTHDR_DUPL_HH
@ IPV6_EXTHDR_DUPL_HH
Definition: decode-events.h:71
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:209
IPV6_IN_IPV6_PKT_TOO_SMALL
@ IPV6_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:184
IPV6_IN_IPV6_WRONG_IP_VER
@ IPV6_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:185
DecodeSCTP
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-sctp.c:62
util-unittest-helper.h
IPV6_HOPOPTS_ONLY_PADDING
@ IPV6_HOPOPTS_ONLY_PADDING
Definition: decode-events.h:81
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
IPV6OptHAO_::ip6hao_len
uint8_t ip6hao_len
Definition: decode-ipv6.h:145
IPV6OPT_JUMBO
#define IPV6OPT_JUMBO
Definition: decode-ipv6.h:138
IPV6_DATA_AFTER_NONE_HEADER
@ IPV6_DATA_AFTER_NONE_HEADER
Definition: decode-events.h:88
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1342
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:527
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:1001
IPV6_FH_NON_ZERO_RES_FIELD
@ IPV6_FH_NON_ZERO_RES_FIELD
Definition: decode-events.h:87
decode-ipv6.h
IPV6_UNKNOWN_NEXT_HEADER
@ IPV6_UNKNOWN_NEXT_HEADER
Definition: decode-events.h:90
decode.h
IPPROTO_SHIM6
#define IPPROTO_SHIM6
Definition: decode.h:1225
IPV6_TRUNC_EXTHDR
@ IPV6_TRUNC_EXTHDR
Definition: decode-events.h:67
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
IPV6_TRUNC_PKT
@ IPV6_TRUNC_PKT
Definition: decode-events.h:66
IPV6_EXTHDR_DUPL_FH
@ IPV6_EXTHDR_DUPL_FH
Definition: decode-events.h:68
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:208
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1310
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:93
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:214
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:241
DecodeGRE
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode GRE packets.
Definition: decode-gre.c:47
IPV6_EXTHDR_DUPL_RH
@ IPV6_EXTHDR_DUPL_RH
Definition: decode-events.h:70
IPV6_EXTHDR_AH_RES_NOT_NULL
@ IPV6_EXTHDR_AH_RES_NOT_NULL
Definition: decode-events.h:78
SET_IPV6_SRC_ADDR
#define SET_IPV6_SRC_ADDR(ip6h, a)
Definition: decode.h:164
SCReturn
#define SCReturn
Definition: util-debug.h:273
IPV6_EXTHDR_RH_TYPE_0
@ IPV6_EXTHDR_RH_TYPE_0
Definition: decode-events.h:85
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:58
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:491
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:561
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:1089
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:213
PacketL3::vars
union PacketL3::@31 vars
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:1000
IPPROTO_HIP
#define IPPROTO_HIP
Definition: decode.h:1221
IPV6_EXTHDR_DUPL_DH
@ IPV6_EXTHDR_DUPL_DH
Definition: decode-events.h:72
defrag.h
IPV6_EXTHDR_ISSET_RH
#define IPV6_EXTHDR_ISSET_RH(p)
Definition: decode-ipv6.h:214
IPV6OptRA_
Definition: decode-ipv6.h:151
IPV6OptJumbo_::ip6j_payload_len
uint32_t ip6j_payload_len
Definition: decode-ipv6.h:162
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
DecodeTCP
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-tcp.c:270
IPV6_DSTOPTS_ONLY_PADDING
@ IPV6_DSTOPTS_ONLY_PADDING
Definition: decode-events.h:83
IPV6_EXTHDR_ZERO_LEN_PADN
@ IPV6_EXTHDR_ZERO_LEN_PADN
Definition: decode-events.h:86
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:168
IPPROTO_IPIP
#define IPPROTO_IPIP
Definition: decode.h:1196
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:414
DecodeICMPV6
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:179
suricata-common.h
IPV6_WRONG_IP_VER
@ IPV6_WRONG_IP_VER
Definition: decode-events.h:77
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:972
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:675
IPV4_HEADER_LEN
#define IPV4_HEADER_LEN
Definition: decode-ipv4.h:28
IPV6OptHAO_::ip6hao_type
uint8_t ip6hao_type
Definition: decode-ipv6.h:144
packet.h
IPV6_GET_RAW_FLOW
#define IPV6_GET_RAW_FLOW(ip6h)
Definition: decode-ipv6.h:64
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:232
PacketQueueNoLock_::len
uint32_t len
Definition: packet-queue.h:37
IPV6_SET_EXTHDRS_LEN
#define IPV6_SET_EXTHDRS_LEN(p, len)
Definition: decode-ipv6.h:73
Packet_::l3
struct PacketL3 l3
Definition: decode.h:592
IPV6OptRA_::ip6ra_len
uint8_t ip6ra_len
Definition: decode-ipv6.h:153
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:208
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:413
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:955
IPV6_EXTHDR_DUPL_AH
@ IPV6_EXTHDR_DUPL_AH
Definition: decode-events.h:73
IPV6_WITH_ICMPV4
@ IPV6_WITH_ICMPV4
Definition: decode-events.h:91
IPPROTO_MH
#define IPPROTO_MH
Definition: decode.h:1216
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:111
IPV6OptJumbo_
Definition: decode-ipv6.h:159
IPV6OptRA_::ip6ra_type
uint8_t ip6ra_type
Definition: decode-ipv6.h:152
IPV6OptJumbo_::ip6j_len
uint8_t ip6j_len
Definition: decode-ipv6.h:161
Packet_::dst
Address dst
Definition: decode.h:496
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1176
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:42
IPV6OptJumbo_::ip6j_type
uint8_t ip6j_type
Definition: decode-ipv6.h:160
IPV6_HEADER_LEN
#define IPV6_HEADER_LEN
Definition: decode-ipv6.h:27
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:1212
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:367
Defrag
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:1058
SET_IPV6_DST_ADDR
#define SET_IPV6_DST_ADDR(ip6h, a)
Definition: decode.h:173
IPV6_EXTHDR_INVALID_OPTLEN
@ IPV6_EXTHDR_INVALID_OPTLEN
Definition: decode-events.h:76
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:771
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
DecodeIPV6RegisterTests
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
Definition: decode-ipv6.c:901
IPV6OptHAO_
Definition: decode-ipv6.h:143
Packet_::src
Address src
Definition: decode.h:495
DefragInit
void DefragInit(void)
Definition: defrag.c:1107
IPV6_EXTHDR_SET_RH
#define IPV6_EXTHDR_SET_RH(p)
Definition: decode-ipv6.h:213
IPV6_HOPOPTS_UNKNOWN_OPT
@ IPV6_HOPOPTS_UNKNOWN_OPT
Definition: decode-events.h:80
IPV6OPT_PAD1
#define IPV6OPT_PAD1
Definition: decode-ipv6.h:135