suricata
decode-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode IPv6
31  */
32 
33 #include "suricata-common.h"
34 #include "packet-queue.h"
35 #include "decode.h"
36 #include "decode-ipv6.h"
37 #include "decode-icmpv6.h"
38 #include "decode-events.h"
39 #include "defrag.h"
40 #include "pkt-var.h"
41 #include "util-debug.h"
42 #include "util-print.h"
43 #include "util-unittest.h"
44 #include "util-profiling.h"
45 #include "host.h"
46 
47 /**
48  * \brief Function to decode IPv4 in IPv6 packets
49  *
50  */
51 static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t plen, PacketQueue *pq)
52 {
53 
54  if (unlikely(plen < IPV4_HEADER_LEN)) {
55  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
56  return;
57  }
58  if (IP_GET_RAW_VER(pkt) == 4) {
59  if (pq != NULL) {
60  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4, pq);
61  if (tp != NULL) {
62  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
63  /* add the tp to the packet queue. */
64  PacketEnqueue(pq,tp);
65  StatsIncr(tv, dtv->counter_ipv4inipv6);
66  return;
67  }
68  }
69  } else {
70  ENGINE_SET_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER);
71  }
72  return;
73 }
74 
75 /**
76  * \brief Function to decode IPv6 in IPv6 packets
77  *
78  */
79 static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
80  const uint8_t *pkt, uint16_t plen, PacketQueue *pq)
81 {
82 
83  if (unlikely(plen < IPV6_HEADER_LEN)) {
84  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
85  return TM_ECODE_FAILED;
86  }
87  if (IP_GET_RAW_VER(pkt) == 6) {
88  if (unlikely(pq != NULL)) {
89  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6, pq);
90  if (tp != NULL) {
91  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
92  PacketEnqueue(pq,tp);
93  StatsIncr(tv, dtv->counter_ipv6inipv6);
94  }
95  }
96  } else {
97  ENGINE_SET_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER);
98  }
99  return TM_ECODE_OK;
100 }
101 
102 #ifndef UNITTESTS // ugly, but we need this in defrag tests
103 static inline
104 #endif
105 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
106  uint16_t hdrextlen, uint16_t plen,
107  uint16_t prev_hdrextlen)
108 {
109  uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
110  int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
111 
112  p->ip6eh.fh_offset = frag_offset;
113  p->ip6eh.fh_more_frags_set = frag_morefrags ? TRUE : FALSE;
114  p->ip6eh.fh_nh = *pkt;
115 
116  uint32_t fh_id;
117  memcpy(&fh_id, pkt+4, 4);
118  p->ip6eh.fh_id = SCNtohl(fh_id);
119 
120  SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x",
121  p->ip6eh.fh_offset,
122  p->ip6eh.fh_more_frags_set ? "true" : "false",
123  p->ip6eh.fh_nh,
124  p->ip6eh.fh_id, p->ip6eh.fh_id);
125 
126  // store header offset, data offset
127  uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
128  uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
129  uint16_t data_len = plen - hdrextlen;
130 
131  p->ip6eh.fh_header_offset = frag_hdr_offset;
132  p->ip6eh.fh_data_offset = data_offset;
133  p->ip6eh.fh_data_len = data_len;
134 
135  /* if we have a prev hdr, store the type and offset of it */
136  if (prev_hdrextlen) {
137  p->ip6eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
138  }
139 
140  SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
141  p->ip6eh.fh_header_offset, p->ip6eh.fh_data_offset,
142  p->ip6eh.fh_data_len);
143 }
144 
145 static void
146 DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
147  const uint8_t *pkt, uint16_t len, PacketQueue *pq)
148 {
149  SCEnter();
150 
151  const uint8_t *orig_pkt = pkt;
152  uint8_t nh = IPV6_GET_NH(p); /* careful, 0 is actually a real type */
153  uint16_t hdrextlen = 0;
154  uint16_t plen = len;
155  char dstopts = 0;
156  char exthdr_fh_done = 0;
157  int hh = 0;
158  int rh = 0;
159  int eh = 0;
160  int ah = 0;
161 
162  while(1)
163  {
164  IPV6_SET_EXTHDRS_LEN(p, (len - plen));
165 
166  if (nh == IPPROTO_NONE) {
167  if (plen > 0) {
168  /* No upper layer, but we do have data. Suspicious. */
169  ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER);
170  }
171  SCReturn;
172  }
173 
174  if (plen < 2) { /* minimal needed in a hdr */
175  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
176  SCReturn;
177  }
178 
179  switch(nh)
180  {
181  case IPPROTO_TCP:
182  IPV6_SET_L4PROTO(p,nh);
183  DecodeTCP(tv, dtv, p, pkt, plen, pq);
184  SCReturn;
185 
186  case IPPROTO_UDP:
187  IPV6_SET_L4PROTO(p,nh);
188  DecodeUDP(tv, dtv, p, pkt, plen, pq);
189  SCReturn;
190 
191  case IPPROTO_ICMPV6:
192  IPV6_SET_L4PROTO(p,nh);
193  DecodeICMPV6(tv, dtv, p, pkt, plen, pq);
194  SCReturn;
195 
196  case IPPROTO_SCTP:
197  IPV6_SET_L4PROTO(p,nh);
198  DecodeSCTP(tv, dtv, p, pkt, plen, pq);
199  SCReturn;
200 
201  case IPPROTO_ROUTING:
202  IPV6_SET_L4PROTO(p,nh);
203  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
204 
205  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
206 
207  if (hdrextlen > plen) {
208  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
209  SCReturn;
210  }
211 
212  if (rh) {
213  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH);
214  /* skip past this extension so we can continue parsing the rest
215  * of the packet */
216  nh = *pkt;
217  pkt += hdrextlen;
218  plen -= hdrextlen;
219  break;
220  }
221 
222  rh = 1;
223  IPV6_EXTHDR_SET_RH(p);
224 
225  uint8_t ip6rh_type = *(pkt + 2);
226  if (ip6rh_type == 0) {
227  ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0);
228  }
229  p->ip6eh.rh_type = ip6rh_type;
230 
231  nh = *pkt;
232  pkt += hdrextlen;
233  plen -= hdrextlen;
234  break;
235 
236  case IPPROTO_HOPOPTS:
237  case IPPROTO_DSTOPTS:
238  {
239  IPV6OptHAO hao_s, *hao = &hao_s;
240  IPV6OptRA ra_s, *ra = &ra_s;
241  IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
242  uint16_t optslen = 0;
243 
244  IPV6_SET_L4PROTO(p,nh);
245  hdrextlen = (*(pkt+1) + 1) << 3;
246  if (hdrextlen > plen) {
247  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
248  SCReturn;
249  }
250 
251  const uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
252 
253  /* point the pointers to right structures
254  * in Packet. */
255  if (nh == IPPROTO_HOPOPTS) {
256  if (hh) {
257  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH);
258  /* skip past this extension so we can continue parsing the rest
259  * of the packet */
260  nh = *pkt;
261  pkt += hdrextlen;
262  plen -= hdrextlen;
263  break;
264  }
265 
266  hh = 1;
267 
268  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
269  }
270  else if (nh == IPPROTO_DSTOPTS)
271  {
272  if (dstopts == 0) {
273  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
274  dstopts = 1;
275  } else if (dstopts == 1) {
276  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
277  dstopts = 2;
278  } else {
279  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH);
280  /* skip past this extension so we can continue parsing the rest
281  * of the packet */
282  nh = *pkt;
283  pkt += hdrextlen;
284  plen -= hdrextlen;
285  break;
286  }
287  }
288 
289  if (optslen > plen) {
290  /* since the packet is long enough (we checked
291  * plen against hdrlen, the optlen must be malformed. */
292  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
293  /* skip past this extension so we can continue parsing the rest
294  * of the packet */
295  nh = *pkt;
296  pkt += hdrextlen;
297  plen -= hdrextlen;
298  break;
299  }
300 /** \todo move into own function to loaded on demand */
301  uint16_t padn_cnt = 0;
302  uint16_t other_cnt = 0;
303  uint16_t offset = 0;
304  while(offset < optslen)
305  {
306  if (*ptr == IPV6OPT_PAD1)
307  {
308  padn_cnt++;
309  offset++;
310  ptr++;
311  continue;
312  }
313 
314  if (offset + 1 >= optslen) {
315  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
316  break;
317  }
318 
319  /* length field for each opt */
320  uint8_t ip6_optlen = *(ptr + 1);
321 
322  /* see if the optlen from the packet fits the total optslen */
323  if ((offset + 1 + ip6_optlen) > optslen) {
324  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
325  break;
326  }
327 
328  if (*ptr == IPV6OPT_PADN) /* PadN */
329  {
330  //printf("PadN option\n");
331  padn_cnt++;
332 
333  /* a zero padN len would be weird */
334  if (ip6_optlen == 0)
335  ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN);
336  }
337  else if (*ptr == IPV6OPT_RA) /* RA */
338  {
339  ra->ip6ra_type = *(ptr);
340  ra->ip6ra_len = ip6_optlen;
341 
342  if (ip6_optlen < sizeof(ra->ip6ra_value)) {
343  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
344  break;
345  }
346 
347  memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
348  ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
349  //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
350  // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
351  other_cnt++;
352  }
353  else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
354  {
355  jumbo->ip6j_type = *(ptr);
356  jumbo->ip6j_len = ip6_optlen;
357 
358  if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
359  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
360  break;
361  }
362 
363  memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
364  jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
365  //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
366  // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
367  }
368  else if (*ptr == IPV6OPT_HAO) /* HAO */
369  {
370  hao->ip6hao_type = *(ptr);
371  hao->ip6hao_len = ip6_optlen;
372 
373  if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
374  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
375  break;
376  }
377 
378  memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa));
379  //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ",
380  // hao->ip6hao_type, hao->ip6hao_len);
381  //char addr_buf[46];
382  //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa),
383  // addr_buf,sizeof(addr_buf));
384  //printf("home addr %s\n", addr_buf);
385  other_cnt++;
386  } else {
387  if (nh == IPPROTO_HOPOPTS)
388  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT);
389  else
390  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT);
391 
392  other_cnt++;
393  }
394  uint16_t optlen = (*(ptr + 1) + 2);
395  ptr += optlen; /* +2 for opt type and opt len fields */
396  offset += optlen;
397  }
398  /* flag packets that have only padding */
399  if (padn_cnt > 0 && other_cnt == 0) {
400  if (nh == IPPROTO_HOPOPTS)
401  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING);
402  else
403  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING);
404  }
405 
406  nh = *pkt;
407  pkt += hdrextlen;
408  plen -= hdrextlen;
409  break;
410  }
411 
412  case IPPROTO_FRAGMENT:
413  {
414  IPV6_SET_L4PROTO(p,nh);
415  /* store the offset of this extension into the packet
416  * past the ipv6 header. We use it in defrag for creating
417  * a defragmented packet without the frag header */
418  if (exthdr_fh_done == 0) {
419  p->ip6eh.fh_offset = pkt - orig_pkt;
420  exthdr_fh_done = 1;
421  }
422 
423  uint16_t prev_hdrextlen = hdrextlen;
424  hdrextlen = sizeof(IPV6FragHdr);
425  if (hdrextlen > plen) {
426  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
427  SCReturn;
428  }
429 
430  /* for the frag header, the length field is reserved */
431  if (*(pkt + 1) != 0) {
432  ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD);
433  /* non fatal, lets try to continue */
434  }
435 
436  if (IPV6_EXTHDR_ISSET_FH(p)) {
437  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH);
438  nh = *pkt;
439  pkt += hdrextlen;
440  plen -= hdrextlen;
441  break;
442  }
443 
444  /* set the header flag first */
445  IPV6_EXTHDR_SET_FH(p);
446 
447  /* parse the header and setup the vars */
448  DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
449 
450  /* if FH has offset 0 and no more fragments are coming, we
451  * parse this packet further right away, no defrag will be
452  * needed. It is a useless FH then though, so we do set an
453  * decoder event. */
454  if (p->ip6eh.fh_more_frags_set == 0 && p->ip6eh.fh_offset == 0) {
455  ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH);
456 
457  nh = *pkt;
458  pkt += hdrextlen;
459  plen -= hdrextlen;
460  break;
461  }
462 
463  /* the rest is parsed upon reassembly */
464  p->flags |= PKT_IS_FRAGMENT;
465  SCReturn;
466  }
467  case IPPROTO_ESP:
468  {
469  IPV6_SET_L4PROTO(p,nh);
470  hdrextlen = sizeof(IPV6EspHdr);
471  if (hdrextlen > plen) {
472  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
473  SCReturn;
474  }
475 
476  if (eh) {
477  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_EH);
478  SCReturn;
479  }
480 
481  eh = 1;
482 
483  nh = IPPROTO_NONE;
484  pkt += hdrextlen;
485  plen -= hdrextlen;
486  break;
487  }
488  case IPPROTO_AH:
489  {
490  IPV6_SET_L4PROTO(p,nh);
491  /* we need the header as a minimum */
492  hdrextlen = sizeof(IPV6AuthHdr);
493  /* the payload len field is the number of extra 4 byte fields,
494  * IPV6AuthHdr already contains the first */
495  if (*(pkt+1) > 0)
496  hdrextlen += ((*(pkt+1) - 1) * 4);
497 
498  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
499 
500  if (hdrextlen > plen) {
501  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
502  SCReturn;
503  }
504 
505  IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
506  if (ahhdr->ip6ah_reserved != 0x0000) {
507  ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL);
508  }
509 
510  if (ah) {
511  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH);
512  nh = *pkt;
513  pkt += hdrextlen;
514  plen -= hdrextlen;
515  break;
516  }
517 
518  ah = 1;
519 
520  nh = *pkt;
521  pkt += hdrextlen;
522  plen -= hdrextlen;
523  break;
524  }
525  case IPPROTO_IPIP:
526  IPV6_SET_L4PROTO(p,nh);
527  DecodeIPv4inIPv6(tv, dtv, p, pkt, plen, pq);
528  SCReturn;
529  /* none, last header */
530  case IPPROTO_NONE:
531  IPV6_SET_L4PROTO(p,nh);
532  SCReturn;
533  case IPPROTO_ICMP:
534  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
535  SCReturn;
536  /* no parsing yet, just skip it */
537  case IPPROTO_MH:
538  case IPPROTO_HIP:
539  case IPPROTO_SHIM6:
540  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
541  if (hdrextlen > plen) {
542  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
543  SCReturn;
544  }
545  nh = *pkt;
546  pkt += hdrextlen;
547  plen -= hdrextlen;
548  break;
549  default:
550  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
551  IPV6_SET_L4PROTO(p,nh);
552  SCReturn;
553  }
554  }
555 
556  SCReturn;
557 }
558 
559 static int DecodeIPV6Packet (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
560 {
561  if (unlikely(len < IPV6_HEADER_LEN)) {
562  return -1;
563  }
564 
565  if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
566  SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
567  ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
568  return -1;
569  }
570 
571  p->ip6h = (IPV6Hdr *)pkt;
572 
573  if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_PLEN(p))))
574  {
575  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
576  return -1;
577  }
578 
579  SET_IPV6_SRC_ADDR(p,&p->src);
580  SET_IPV6_DST_ADDR(p,&p->dst);
581 
582  return 0;
583 }
584 
585 int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len, PacketQueue *pq)
586 {
587  StatsIncr(tv, dtv->counter_ipv6);
588 
589  /* do the actual decoding */
590  int ret = DecodeIPV6Packet (tv, dtv, p, pkt, len);
591  if (unlikely(ret < 0)) {
592  p->ip6h = NULL;
593  return TM_ECODE_FAILED;
594  }
595 
596 #ifdef DEBUG
597  if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
598  /* debug print */
599  char s[46], d[46];
600  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
601  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
602  SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32 " PLEN: %" PRIu32 " HLIM: %" PRIu32 "", s,d,
603  IPV6_GET_CLASS(p), IPV6_GET_FLOW(p), IPV6_GET_NH(p), IPV6_GET_PLEN(p),
604  IPV6_GET_HLIM(p));
605  }
606 #endif /* DEBUG */
607 
608  /* now process the Ext headers and/or the L4 Layer */
609  switch(IPV6_GET_NH(p)) {
610  case IPPROTO_TCP:
611  IPV6_SET_L4PROTO (p, IPPROTO_TCP);
612  DecodeTCP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
613  return TM_ECODE_OK;
614  case IPPROTO_UDP:
615  IPV6_SET_L4PROTO (p, IPPROTO_UDP);
616  DecodeUDP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
617  return TM_ECODE_OK;
618  case IPPROTO_ICMPV6:
619  IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
620  DecodeICMPV6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
621  return TM_ECODE_OK;
622  case IPPROTO_SCTP:
623  IPV6_SET_L4PROTO (p, IPPROTO_SCTP);
624  DecodeSCTP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
625  return TM_ECODE_OK;
626  case IPPROTO_IPIP:
627  IPV6_SET_L4PROTO(p, IPPROTO_IPIP);
628  DecodeIPv4inIPv6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
629  return TM_ECODE_OK;
630  case IPPROTO_IPV6:
631  DecodeIP6inIP6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
632  return TM_ECODE_OK;
633  case IPPROTO_GRE:
634  DecodeGRE(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
635  break;
636  case IPPROTO_FRAGMENT:
637  case IPPROTO_HOPOPTS:
638  case IPPROTO_ROUTING:
639  case IPPROTO_NONE:
640  case IPPROTO_DSTOPTS:
641  case IPPROTO_AH:
642  case IPPROTO_ESP:
643  case IPPROTO_MH:
644  case IPPROTO_HIP:
645  case IPPROTO_SHIM6:
646  DecodeIPV6ExtHdrs(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
647  break;
648  case IPPROTO_ICMP:
649  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
650  break;
651  default:
652  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
653  IPV6_SET_L4PROTO (p, IPV6_GET_NH(p));
654  break;
655  }
656  p->proto = IPV6_GET_L4PROTO (p);
657 
658  /* Pass to defragger if a fragment. */
659  if (IPV6_EXTHDR_ISSET_FH(p)) {
660  Packet *rp = Defrag(tv, dtv, p, pq);
661  if (rp != NULL) {
662  PacketEnqueue(pq,rp);
663  }
664  }
665 
666  return TM_ECODE_OK;
667 }
668 
669 #ifdef UNITTESTS
670 
671 /**
672  * \test fragment decoding
673  */
674 static int DecodeIPV6FragTest01 (void)
675 {
676 
677  uint8_t raw_frag1[] = {
678  0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
679  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
680  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
681  0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
682  0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
683  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
684  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
685  0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
686  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
687  0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
688  0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
689  0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
690  0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
691  0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
692  0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
693  0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
694  0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
695  0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
696  0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
697  0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
698  0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
699  0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
700  0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
701  0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
702  0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
703  0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
704  0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
705  0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
706  0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
707  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
708  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
748  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
749  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
750  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
751  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
752  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
753  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
754  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
755  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
756  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
757  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
758  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
759  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
760  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
761  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
762  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
763  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
764  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
765  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
766  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
767  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
768  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
769  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
770  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
771  };
772  uint8_t raw_frag2[] = {
773  0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
774  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
775  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
776  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
777  0x20, 0x20, 0x20, 0x20,
778  };
779  Packet *pkt;
780  Packet *p1 = PacketGetFromAlloc();
781  if (unlikely(p1 == NULL))
782  return 0;
783  Packet *p2 = PacketGetFromAlloc();
784  if (unlikely(p2 == NULL)) {
785  SCFree(p1);
786  return 0;
787  }
788  ThreadVars tv;
789  DecodeThreadVars dtv;
790  int result = 0;
791  PacketQueue pq;
792 
793  FlowInitConfig(FLOW_QUIET);
794  DefragInit();
795 
796  memset(&pq, 0, sizeof(PacketQueue));
797  memset(&tv, 0, sizeof(ThreadVars));
798  memset(&dtv, 0, sizeof(DecodeThreadVars));
799 
800  PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
801  PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
802 
803  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq);
804 
805  if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
806  printf("ipv6 frag header not detected: ");
807  goto end;
808  }
809 
810  DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2), &pq);
811 
812  if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
813  printf("ipv6 frag header not detected: ");
814  goto end;
815  }
816 
817  if (pq.len != 1) {
818  printf("no reassembled packet: ");
819  goto end;
820  }
821 
822  result = 1;
823 end:
824  PACKET_RECYCLE(p1);
825  PACKET_RECYCLE(p2);
826  SCFree(p1);
827  SCFree(p2);
828  pkt = PacketDequeue(&pq);
829  while (pkt != NULL) {
830  PACKET_RECYCLE(pkt);
831  SCFree(pkt);
832  pkt = PacketDequeue(&pq);
833  }
834  DefragDestroy();
835  FlowShutdown();
836  return result;
837 }
838 
839 /**
840  * \test routing header decode
841  */
842 static int DecodeIPV6RouteTest01 (void)
843 {
844  uint8_t raw_pkt1[] = {
845  0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
846  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
847  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
848  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
849  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
850  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
851 
852  0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
853  0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
854  0xfa, 0x87, 0x00, 0x00,
855  };
856  Packet *p1 = PacketGetFromAlloc();
857  FAIL_IF(unlikely(p1 == NULL));
858  ThreadVars tv;
859  DecodeThreadVars dtv;
860  PacketQueue pq;
861 
862  FlowInitConfig(FLOW_QUIET);
863 
864  memset(&pq, 0, sizeof(PacketQueue));
865  memset(&tv, 0, sizeof(ThreadVars));
866  memset(&dtv, 0, sizeof(DecodeThreadVars));
867 
868  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
869 
870  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq);
871 
872  FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1)));
873  FAIL_IF (p1->ip6eh.rh_type != 0);
874  PACKET_RECYCLE(p1);
875  SCFree(p1);
876  FlowShutdown();
877  PASS;
878 }
879 
880 /**
881  * \test HOP header decode
882  */
883 static int DecodeIPV6HopTest01 (void)
884 {
885  uint8_t raw_pkt1[] = {
886  0x60,0x00,0x00,0x00,0x00,0x20,0x00,0x01,0xfe,0x80,0x00,0x00,0x00,0x00,0x00,0x00,
887  0x02,0x0f,0xfe,0xff,0xfe,0x98,0x3d,0x01,0xff,0x02,0x00,0x00,0x00,0x00,0x00,0x00,
888  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x3a,0x00,0xff, /* 0xff is a nonsene opt */
889  0x02,0x00,0x00,0x00,0x00,
890  0x82,0x00,0x1c,0x6f,0x27,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
891  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
892  };
893  Packet *p1 = PacketGetFromAlloc();
894  FAIL_IF(unlikely(p1 == NULL));
895  ThreadVars tv;
896  DecodeThreadVars dtv;
897  PacketQueue pq;
898 
899  FlowInitConfig(FLOW_QUIET);
900 
901  memset(&pq, 0, sizeof(PacketQueue));
902  memset(&tv, 0, sizeof(ThreadVars));
903  memset(&dtv, 0, sizeof(DecodeThreadVars));
904 
905  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
906 
907  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq);
908 
909  FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
910 
911  PACKET_RECYCLE(p1);
912  SCFree(p1);
913  FlowShutdown();
914  PASS;
915 }
916 
917 #endif /* UNITTESTS */
918 
919 /**
920  * \brief this function registers unit tests for IPV6 decoder
921  */
922 
923 void DecodeIPV6RegisterTests(void)
924 {
925 #ifdef UNITTESTS
926  UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
927  UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
928  UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
929 #endif /* UNITTESTS */
930 }
931 
932 /**
933  * @}
934  */
IPV6OPT_RA
#define IPV6OPT_RA
Definition: decode-ipv6.h:164
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto, PacketQueue *pq)
Setup a pseudo packet (tunnel)
Definition: decode.c:275
IPV6_EXTHDR_SET_RH
#define IPV6_EXTHDR_SET_RH(p)
Definition: decode-ipv6.h:240
IPV6Hdr_
Definition: decode-ipv6.h:31
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:993
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:335
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:1008
IPV6OptHAO_::ip6hao_len
uint8_t ip6hao_len
Definition: decode-ipv6.h:172
FALSE
#define FALSE
Definition: suricata-common.h:34
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
IPV6OptHAO_::ip6hao_hoa
struct in6_addr ip6hao_hoa
Definition: decode-ipv6.h:173
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1109
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
offset
uint64_t offset
Definition: util-streaming-buffer.h:1478
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:38
Packet_::dst
Address dst
Definition: decode.h:414
IPV6OPT_JUMBO
#define IPV6OPT_JUMBO
Definition: decode-ipv6.h:165
PacketQueue_
Definition: decode.h:621
PACKET_RECYCLE
#define PACKET_RECYCLE(p)
Definition: decode.h:815
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1090
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:667
TRUE
#define TRUE
Definition: suricata-common.h:33
DecodeGRE
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, PacketQueue *pq)
Function to decode GRE packets.
Definition: decode-gre.c:46
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:624
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1136
IPPROTO_GRE
#define IPPROTO_GRE
Definition: decode-gre.h:30
IPV6OptRA_::ip6ra_type
uint8_t ip6ra_type
Definition: decode-ipv6.h:179
IPV6_SET_EXTHDRS_LEN
#define IPV6_SET_EXTHDRS_LEN(p, len)
Definition: decode-ipv6.h:73
Packet_::ip6h
IPV6Hdr * ip6h
Definition: decode.h:503
IPV6_GET_PLEN
#define IPV6_GET_PLEN(p)
Definition: decode-ipv6.h:88
Packet_::proto
uint8_t proto
Definition: decode.h:431
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:221
DecodeSCTP
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-sctp.c:62
IPV6ExtHdrs_::fh_data_len
uint16_t fh_data_len
Definition: decode-ipv6.h:228
Packet_::ip6eh
IPV6ExtHdrs ip6eh
Definition: decode.h:510
DecodeICMPV6
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len, PacketQueue *pq)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:189
IPV6ExtHdrs_::fh_nh
uint8_t fh_nh
Definition: decode-ipv6.h:221
PacketQueue_::len
uint32_t len
Definition: decode.h:624
SET_IPV6_SRC_ADDR
#define SET_IPV6_SRC_ADDR(p, a)
Definition: decode.h:166
IPV6OptRA_::ip6ra_value
uint16_t ip6ra_value
Definition: decode-ipv6.h:181
IPV6_EXTHDR_SET_FH
#define IPV6_EXTHDR_SET_FH(p)
Definition: decode-ipv6.h:238
IPV6ExtHdrs_::fh_header_offset
uint16_t fh_header_offset
Definition: decode-ipv6.h:226
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:668
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
IPV6_GET_FLOW
#define IPV6_GET_FLOW(p)
Definition: decode-ipv6.h:84
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:633
SCEnter
#define SCEnter(...)
Definition: util-debug.h:337
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:105
IP_GET_RAW_VER
#define IP_GET_RAW_VER(pkt)
Definition: decode.h:250
IPV6_GET_CLASS
#define IPV6_GET_CLASS(p)
Definition: decode-ipv6.h:82
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:168
IPV6OptJumbo_::ip6j_len
uint8_t ip6j_len
Definition: decode-ipv6.h:188
DecodeIPV6RegisterTests
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
Definition: decode-ipv6.c:923
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:267
IPV6_GET_NH
#define IPV6_GET_NH(p)
Definition: decode-ipv6.h:86
DecodeTCP
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-tcp.c:234
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:374
Packet_
Definition: decode.h:408
IPV6OptJumbo_::ip6j_type
uint8_t ip6j_type
Definition: decode-ipv6.h:187
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:648
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:93
DefragInit
void DefragInit(void)
Definition: defrag.c:1068
IPV6ExtHdrs_::fh_more_frags_set
_Bool fh_more_frags_set
Definition: decode-ipv6.h:220
IPV6_SET_L4PROTO
#define IPV6_SET_L4PROTO(p, proto)
Definition: decode-ipv6.h:72
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:220
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-ipv6.c:585
IPV6_HEADER_LEN
#define IPV6_HEADER_LEN
Definition: decode-ipv6.h:27
SCFree
#define SCFree(a)
Definition: util-mem.h:322
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:375
Defrag
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, PacketQueue *pq)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:1022
IPV6OptHAO_
Definition: decode-ipv6.h:169
IPV6ExtHdrs_::rh_type
uint8_t rh_type
Definition: decode-ipv6.h:217
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:670
IPV6_EXTHDR_ISSET_FH
#define IPV6_EXTHDR_ISSET_FH(p)
Definition: decode-ipv6.h:239
IPV6OPT_PADN
#define IPV6OPT_PADN
Definition: decode-ipv6.h:163
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:226
PacketDequeue
Packet * PacketDequeue(PacketQueue *q)
Definition: packet-queue.c:167
IPV6OPT_PAD1
#define IPV6OPT_PAD1
Definition: decode-ipv6.h:162
IPV6OptJumbo_::ip6j_payload_len
uint32_t ip6j_payload_len
Definition: decode-ipv6.h:189
IPV6OptHAO_::ip6hao_type
uint8_t ip6hao_type
Definition: decode-ipv6.h:171
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:259
IPV6ExtHdrs_::fh_offset
uint16_t fh_offset
Definition: decode-ipv6.h:233
SCReturn
#define SCReturn
Definition: util-debug.h:339
len
uint8_t len
Definition: app-layer-dnp3.h:2649
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
SET_IPV6_DST_ADDR
#define SET_IPV6_DST_ADDR(p, a)
Definition: decode.h:174
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-udp.c:74
IPV6ExtHdrs_::fh_data_offset
uint16_t fh_data_offset
Definition: decode-ipv6.h:227
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:225
IPV6ExtHdrs_::fh_prev_hdr_offset
uint16_t fh_prev_hdr_offset
Definition: decode-ipv6.h:224
IPV6OptRA_::ip6ra_len
uint8_t ip6ra_len
Definition: decode-ipv6.h:180
Packet_::flags
uint32_t flags
Definition: decode.h:444
IPV6ExtHdrs_::fh_id
uint32_t fh_id
Definition: decode-ipv6.h:234
ip6rh_type
uint8_t ip6rh_type
Definition: decode-ipv6.h:927
IPV6OptRA_
Definition: decode-ipv6.h:177
IPV4_HEADER_LEN
#define IPV4_HEADER_LEN
Definition: decode-ipv4.h:28
IPV6_EXTHDR_ISSET_RH
#define IPV6_EXTHDR_ISSET_RH(p)
Definition: decode-ipv6.h:241
PacketEnqueue
void PacketEnqueue(PacketQueue *q, Packet *p)
Definition: packet-queue.c:139
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1001
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:141
Packet_::src
Address src
Definition: decode.h:413
IPV6OPT_HAO
#define IPV6OPT_HAO
Definition: decode-ipv6.h:166
FlowInitConfig
void FlowInitConfig(char quiet)
initialize the configuration
Definition: flow.c:515
IPV6OptJumbo_
Definition: decode-ipv6.h:185