suricata
decode-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode IPv6
31  */
32 
33 #include "suricata-common.h"
34 #include "packet-queue.h"
35 #include "decode.h"
36 #include "decode-ipv6.h"
37 #include "decode-icmpv6.h"
38 #include "decode-events.h"
39 #include "defrag.h"
40 #include "pkt-var.h"
41 #include "util-debug.h"
42 #include "util-print.h"
43 #include "util-unittest.h"
44 #include "util-profiling.h"
45 #include "host.h"
46 
47 /**
48  * \brief Function to decode IPv4 in IPv6 packets
49  *
50  */
51 static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t plen)
52 {
53 
54  if (unlikely(plen < IPV4_HEADER_LEN)) {
55  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
56  return;
57  }
58  if (IP_GET_RAW_VER(pkt) == 4) {
59  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4);
60  if (tp != NULL) {
61  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
62  PacketEnqueueNoLock(&tv->decode_pq,tp);
63  StatsIncr(tv, dtv->counter_ipv4inipv6);
64  return;
65  }
66  } else {
67  ENGINE_SET_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER);
68  }
69  return;
70 }
71 
72 /**
73  * \brief Function to decode IPv6 in IPv6 packets
74  *
75  */
76 static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
77  const uint8_t *pkt, uint16_t plen)
78 {
79 
80  if (unlikely(plen < IPV6_HEADER_LEN)) {
81  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
82  return TM_ECODE_FAILED;
83  }
84  if (IP_GET_RAW_VER(pkt) == 6) {
85  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6);
86  if (tp != NULL) {
87  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
88  PacketEnqueueNoLock(&tv->decode_pq,tp);
89  StatsIncr(tv, dtv->counter_ipv6inipv6);
90  }
91  } else {
92  ENGINE_SET_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER);
93  }
94  return TM_ECODE_OK;
95 }
96 
97 #ifndef UNITTESTS // ugly, but we need this in defrag tests
98 static inline
99 #endif
100 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
101  uint16_t hdrextlen, uint16_t plen,
102  uint16_t prev_hdrextlen)
103 {
104  uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
105  int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
106 
107  p->ip6eh.fh_offset = frag_offset;
108  p->ip6eh.fh_more_frags_set = frag_morefrags ? true : false;
109  p->ip6eh.fh_nh = *pkt;
110 
111  uint32_t fh_id;
112  memcpy(&fh_id, pkt+4, 4);
113  p->ip6eh.fh_id = SCNtohl(fh_id);
114 
115  SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x",
116  p->ip6eh.fh_offset,
117  p->ip6eh.fh_more_frags_set ? "true" : "false",
118  p->ip6eh.fh_nh,
119  p->ip6eh.fh_id, p->ip6eh.fh_id);
120 
121  // store header offset, data offset
122  uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
123  uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
124  uint16_t data_len = plen - hdrextlen;
125 
126  p->ip6eh.fh_header_offset = frag_hdr_offset;
127  p->ip6eh.fh_data_offset = data_offset;
128  p->ip6eh.fh_data_len = data_len;
129 
130  /* if we have a prev hdr, store the type and offset of it */
131  if (prev_hdrextlen) {
132  p->ip6eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
133  }
134 
135  SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
136  p->ip6eh.fh_header_offset, p->ip6eh.fh_data_offset,
137  p->ip6eh.fh_data_len);
138 }
139 
140 static void
141 DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
142  const uint8_t *pkt, uint16_t len)
143 {
144  SCEnter();
145 
146  const uint8_t *orig_pkt = pkt;
147  uint8_t nh = IPV6_GET_NH(p); /* careful, 0 is actually a real type */
148  uint16_t hdrextlen = 0;
149  uint16_t plen = len;
150  char dstopts = 0;
151  char exthdr_fh_done = 0;
152  int hh = 0;
153  int rh = 0;
154  int ah = 0;
155 
156  while(1)
157  {
158  IPV6_SET_EXTHDRS_LEN(p, (len - plen));
159 
160  if (nh == IPPROTO_NONE) {
161  if (plen > 0) {
162  /* No upper layer, but we do have data. Suspicious. */
163  ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER);
164  }
165  SCReturn;
166  }
167 
168  if (plen < 2) { /* minimal needed in a hdr */
169  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
170  SCReturn;
171  }
172 
173  switch(nh)
174  {
175  case IPPROTO_TCP:
176  IPV6_SET_L4PROTO(p,nh);
177  DecodeTCP(tv, dtv, p, pkt, plen);
178  SCReturn;
179 
180  case IPPROTO_UDP:
181  IPV6_SET_L4PROTO(p,nh);
182  DecodeUDP(tv, dtv, p, pkt, plen);
183  SCReturn;
184 
185  case IPPROTO_ICMPV6:
186  IPV6_SET_L4PROTO(p,nh);
187  DecodeICMPV6(tv, dtv, p, pkt, plen);
188  SCReturn;
189 
190  case IPPROTO_SCTP:
191  IPV6_SET_L4PROTO(p,nh);
192  DecodeSCTP(tv, dtv, p, pkt, plen);
193  SCReturn;
194 
195  case IPPROTO_ROUTING:
196  IPV6_SET_L4PROTO(p,nh);
197  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
198 
199  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
200 
201  if (hdrextlen > plen) {
202  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
203  SCReturn;
204  }
205 
206  if (rh) {
207  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH);
208  /* skip past this extension so we can continue parsing the rest
209  * of the packet */
210  nh = *pkt;
211  pkt += hdrextlen;
212  plen -= hdrextlen;
213  break;
214  }
215 
216  rh = 1;
217  IPV6_EXTHDR_SET_RH(p);
218 
219  uint8_t ip6rh_type = *(pkt + 2);
220  if (ip6rh_type == 0) {
221  ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0);
222  }
223  p->ip6eh.rh_type = ip6rh_type;
224 
225  nh = *pkt;
226  pkt += hdrextlen;
227  plen -= hdrextlen;
228  break;
229 
230  case IPPROTO_HOPOPTS:
231  case IPPROTO_DSTOPTS:
232  {
233  IPV6OptHAO hao_s, *hao = &hao_s;
234  IPV6OptRA ra_s, *ra = &ra_s;
235  IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
236  uint16_t optslen = 0;
237 
238  IPV6_SET_L4PROTO(p,nh);
239  hdrextlen = (*(pkt+1) + 1) << 3;
240  if (hdrextlen > plen) {
241  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
242  SCReturn;
243  }
244 
245  const uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
246 
247  /* point the pointers to right structures
248  * in Packet. */
249  if (nh == IPPROTO_HOPOPTS) {
250  if (hh) {
251  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH);
252  /* skip past this extension so we can continue parsing the rest
253  * of the packet */
254  nh = *pkt;
255  pkt += hdrextlen;
256  plen -= hdrextlen;
257  break;
258  }
259 
260  hh = 1;
261 
262  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
263  }
264  else if (nh == IPPROTO_DSTOPTS)
265  {
266  if (dstopts == 0) {
267  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
268  dstopts = 1;
269  } else if (dstopts == 1) {
270  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
271  dstopts = 2;
272  } else {
273  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH);
274  /* skip past this extension so we can continue parsing the rest
275  * of the packet */
276  nh = *pkt;
277  pkt += hdrextlen;
278  plen -= hdrextlen;
279  break;
280  }
281  }
282 
283  if (optslen > plen) {
284  /* since the packet is long enough (we checked
285  * plen against hdrlen, the optlen must be malformed. */
286  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
287  /* skip past this extension so we can continue parsing the rest
288  * of the packet */
289  nh = *pkt;
290  pkt += hdrextlen;
291  plen -= hdrextlen;
292  break;
293  }
294 /** \todo move into own function to loaded on demand */
295  uint16_t padn_cnt = 0;
296  uint16_t other_cnt = 0;
297  uint16_t offset = 0;
298  while(offset < optslen)
299  {
300  if (*ptr == IPV6OPT_PAD1)
301  {
302  padn_cnt++;
303  offset++;
304  ptr++;
305  continue;
306  }
307 
308  if (offset + 1 >= optslen) {
309  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
310  break;
311  }
312 
313  /* length field for each opt */
314  uint8_t ip6_optlen = *(ptr + 1);
315 
316  /* see if the optlen from the packet fits the total optslen */
317  if ((offset + 1 + ip6_optlen) > optslen) {
318  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
319  break;
320  }
321 
322  if (*ptr == IPV6OPT_PADN) /* PadN */
323  {
324  //printf("PadN option\n");
325  padn_cnt++;
326 
327  /* a zero padN len would be weird */
328  if (ip6_optlen == 0)
329  ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN);
330  }
331  else if (*ptr == IPV6OPT_RA) /* RA */
332  {
333  ra->ip6ra_type = *(ptr);
334  ra->ip6ra_len = ip6_optlen;
335 
336  if (ip6_optlen < sizeof(ra->ip6ra_value)) {
337  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
338  break;
339  }
340 
341  memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
342  ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
343  //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
344  // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
345  other_cnt++;
346  }
347  else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
348  {
349  jumbo->ip6j_type = *(ptr);
350  jumbo->ip6j_len = ip6_optlen;
351 
352  if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
353  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
354  break;
355  }
356 
357  memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
358  jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
359  //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
360  // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
361  }
362  else if (*ptr == IPV6OPT_HAO) /* HAO */
363  {
364  hao->ip6hao_type = *(ptr);
365  hao->ip6hao_len = ip6_optlen;
366 
367  if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
368  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
369  break;
370  }
371 
372  memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa));
373  //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ",
374  // hao->ip6hao_type, hao->ip6hao_len);
375  //char addr_buf[46];
376  //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa),
377  // addr_buf,sizeof(addr_buf));
378  //printf("home addr %s\n", addr_buf);
379  other_cnt++;
380  } else {
381  if (nh == IPPROTO_HOPOPTS)
382  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT);
383  else
384  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT);
385 
386  other_cnt++;
387  }
388  uint16_t optlen = (*(ptr + 1) + 2);
389  ptr += optlen; /* +2 for opt type and opt len fields */
390  offset += optlen;
391  }
392  /* flag packets that have only padding */
393  if (padn_cnt > 0 && other_cnt == 0) {
394  if (nh == IPPROTO_HOPOPTS)
395  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING);
396  else
397  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING);
398  }
399 
400  nh = *pkt;
401  pkt += hdrextlen;
402  plen -= hdrextlen;
403  break;
404  }
405 
406  case IPPROTO_FRAGMENT:
407  {
408  IPV6_SET_L4PROTO(p,nh);
409  /* store the offset of this extension into the packet
410  * past the ipv6 header. We use it in defrag for creating
411  * a defragmented packet without the frag header */
412  if (exthdr_fh_done == 0) {
413  p->ip6eh.fh_offset = pkt - orig_pkt;
414  exthdr_fh_done = 1;
415  }
416 
417  uint16_t prev_hdrextlen = hdrextlen;
418  hdrextlen = sizeof(IPV6FragHdr);
419  if (hdrextlen > plen) {
420  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
421  SCReturn;
422  }
423 
424  /* for the frag header, the length field is reserved */
425  if (*(pkt + 1) != 0) {
426  ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD);
427  /* non fatal, lets try to continue */
428  }
429 
430  if (IPV6_EXTHDR_ISSET_FH(p)) {
431  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH);
432  nh = *pkt;
433  pkt += hdrextlen;
434  plen -= hdrextlen;
435  break;
436  }
437 
438  /* set the header flag first */
439  IPV6_EXTHDR_SET_FH(p);
440 
441  /* parse the header and setup the vars */
442  DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
443 
444  /* if FH has offset 0 and no more fragments are coming, we
445  * parse this packet further right away, no defrag will be
446  * needed. It is a useless FH then though, so we do set an
447  * decoder event. */
448  if (p->ip6eh.fh_more_frags_set == 0 && p->ip6eh.fh_offset == 0) {
449  ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH);
450 
451  nh = *pkt;
452  pkt += hdrextlen;
453  plen -= hdrextlen;
454  break;
455  }
456  if (p->ip6eh.fh_more_frags_set != 0 && plen % 8 != 0) {
457  // cf https://datatracker.ietf.org/doc/html/rfc2460#section-4.5
458  // each, except possibly the last ("rightmost") one,
459  // being an integer multiple of 8 octets long.
460  ENGINE_SET_EVENT(p, IPV6_FRAG_INVALID_LENGTH);
461  }
462 
463  /* the rest is parsed upon reassembly */
464  p->flags |= PKT_IS_FRAGMENT;
465  SCReturn;
466  }
467  case IPPROTO_ESP:
468  {
469  IPV6_SET_L4PROTO(p,nh);
470  DecodeESP(tv, dtv, p, pkt, plen);
471  SCReturn;
472  }
473  case IPPROTO_AH:
474  {
475  IPV6_SET_L4PROTO(p,nh);
476  /* we need the header as a minimum */
477  hdrextlen = sizeof(IPV6AuthHdr);
478  /* the payload len field is the number of extra 4 byte fields,
479  * IPV6AuthHdr already contains the first */
480  if (*(pkt+1) > 0)
481  hdrextlen += ((*(pkt+1) - 1) * 4);
482 
483  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
484 
485  if (hdrextlen > plen) {
486  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
487  SCReturn;
488  }
489 
490  IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
491  if (ahhdr->ip6ah_reserved != 0x0000) {
492  ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL);
493  }
494 
495  if (ah) {
496  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH);
497  nh = *pkt;
498  pkt += hdrextlen;
499  plen -= hdrextlen;
500  break;
501  }
502 
503  ah = 1;
504 
505  nh = *pkt;
506  pkt += hdrextlen;
507  plen -= hdrextlen;
508  break;
509  }
510  case IPPROTO_IPIP:
511  IPV6_SET_L4PROTO(p,nh);
512  DecodeIPv4inIPv6(tv, dtv, p, pkt, plen);
513  SCReturn;
514  /* none, last header */
515  case IPPROTO_NONE:
516  IPV6_SET_L4PROTO(p,nh);
517  SCReturn;
518  case IPPROTO_ICMP:
519  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
520  SCReturn;
521  /* no parsing yet, just skip it */
522  case IPPROTO_MH:
523  case IPPROTO_HIP:
524  case IPPROTO_SHIM6:
525  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
526  if (hdrextlen > plen) {
527  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
528  SCReturn;
529  }
530  nh = *pkt;
531  pkt += hdrextlen;
532  plen -= hdrextlen;
533  break;
534  default:
535  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
536  IPV6_SET_L4PROTO(p,nh);
537  SCReturn;
538  }
539  }
540 
541  SCReturn;
542 }
543 
544 static int DecodeIPV6Packet (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
545 {
546  if (unlikely(len < IPV6_HEADER_LEN)) {
547  return -1;
548  }
549 
550  if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
551  SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
552  ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
553  return -1;
554  }
555 
556  p->ip6h = (IPV6Hdr *)pkt;
557 
558  if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_PLEN(p))))
559  {
560  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
561  return -1;
562  }
563 
564  SET_IPV6_SRC_ADDR(p,&p->src);
565  SET_IPV6_DST_ADDR(p,&p->dst);
566 
567  return 0;
568 }
569 
570 int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
571 {
572  StatsIncr(tv, dtv->counter_ipv6);
573 
574  if (!PacketIncreaseCheckLayers(p)) {
575  return TM_ECODE_FAILED;
576  }
577  /* do the actual decoding */
578  int ret = DecodeIPV6Packet (tv, dtv, p, pkt, len);
579  if (unlikely(ret < 0)) {
580  CLEAR_IPV6_PACKET(p);
581  return TM_ECODE_FAILED;
582  }
583 
584 #ifdef DEBUG
585  if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
586  /* debug print */
587  char s[46], d[46];
588  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
589  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
590  SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32 " PLEN: %" PRIu32 " HLIM: %" PRIu32 "", s,d,
591  IPV6_GET_CLASS(p), IPV6_GET_FLOW(p), IPV6_GET_NH(p), IPV6_GET_PLEN(p),
592  IPV6_GET_HLIM(p));
593  }
594 #endif /* DEBUG */
595 
596  /* now process the Ext headers and/or the L4 Layer */
597  switch(IPV6_GET_NH(p)) {
598  case IPPROTO_TCP:
599  IPV6_SET_L4PROTO (p, IPPROTO_TCP);
600  DecodeTCP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
601  return TM_ECODE_OK;
602  case IPPROTO_UDP:
603  IPV6_SET_L4PROTO (p, IPPROTO_UDP);
604  DecodeUDP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
605  return TM_ECODE_OK;
606  case IPPROTO_ICMPV6:
607  IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
608  DecodeICMPV6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
609  return TM_ECODE_OK;
610  case IPPROTO_SCTP:
611  IPV6_SET_L4PROTO (p, IPPROTO_SCTP);
612  DecodeSCTP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
613  return TM_ECODE_OK;
614  case IPPROTO_IPIP:
615  IPV6_SET_L4PROTO(p, IPPROTO_IPIP);
616  DecodeIPv4inIPv6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
617  return TM_ECODE_OK;
618  case IPPROTO_IPV6:
619  DecodeIP6inIP6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
620  return TM_ECODE_OK;
621  case IPPROTO_GRE:
622  DecodeGRE(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
623  break;
624  case IPPROTO_FRAGMENT:
625  case IPPROTO_HOPOPTS:
626  case IPPROTO_ROUTING:
627  case IPPROTO_NONE:
628  case IPPROTO_DSTOPTS:
629  case IPPROTO_AH:
630  case IPPROTO_ESP:
631  case IPPROTO_MH:
632  case IPPROTO_HIP:
633  case IPPROTO_SHIM6:
634  DecodeIPV6ExtHdrs(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
635  break;
636  case IPPROTO_ICMP:
637  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
638  break;
639  default:
640  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
641  IPV6_SET_L4PROTO (p, IPV6_GET_NH(p));
642  break;
643  }
644  p->proto = IPV6_GET_L4PROTO (p);
645 
646  /* Pass to defragger if a fragment. */
647  if (IPV6_EXTHDR_ISSET_FH(p)) {
648  Packet *rp = Defrag(tv, dtv, p);
649  if (rp != NULL) {
650  PacketEnqueueNoLock(&tv->decode_pq,rp);
651  }
652  }
653 
654  return TM_ECODE_OK;
655 }
656 
657 #ifdef UNITTESTS
658 
659 /**
660  * \test fragment decoding
661  */
662 static int DecodeIPV6FragTest01 (void)
663 {
664 
665  uint8_t raw_frag1[] = {
666  0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
667  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
668  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
669  0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
670  0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
671  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
672  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
673  0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
674  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
675  0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
676  0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
677  0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
678  0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
679  0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
680  0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
681  0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
682  0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
683  0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
684  0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
685  0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
686  0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
687  0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
688  0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
689  0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
690  0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
691  0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
692  0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
693  0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
694  0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
695  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
696  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
697  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
698  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
699  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
700  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
701  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
702  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
703  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
704  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
705  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
706  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
707  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
708  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
748  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
749  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
750  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
751  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
752  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
753  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
754  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
755  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
756  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
757  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
758  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
759  };
760  uint8_t raw_frag2[] = {
761  0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
762  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
763  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
764  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
765  0x20, 0x20, 0x20, 0x20,
766  };
767  Packet *pkt;
768  Packet *p1 = PacketGetFromAlloc();
769  if (unlikely(p1 == NULL))
770  return 0;
771  Packet *p2 = PacketGetFromAlloc();
772  if (unlikely(p2 == NULL)) {
773  SCFree(p1);
774  return 0;
775  }
776  ThreadVars tv;
777  DecodeThreadVars dtv;
778  int result = 0;
779 
780  FlowInitConfig(FLOW_QUIET);
781  DefragInit();
782 
783  memset(&tv, 0, sizeof(ThreadVars));
784  memset(&dtv, 0, sizeof(DecodeThreadVars));
785 
786  PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
787  PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
788 
789  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
790 
791  if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
792  printf("ipv6 frag header not detected: ");
793  goto end;
794  }
795 
796  DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2));
797 
798  if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
799  printf("ipv6 frag header not detected: ");
800  goto end;
801  }
802 
803  if (tv.decode_pq.len != 1) {
804  printf("no reassembled packet: ");
805  goto end;
806  }
807 
808  result = 1;
809 end:
810  PACKET_RECYCLE(p1);
811  PACKET_RECYCLE(p2);
812  SCFree(p1);
813  SCFree(p2);
814  pkt = PacketDequeueNoLock(&tv.decode_pq);
815  while (pkt != NULL) {
816  PACKET_RECYCLE(pkt);
817  SCFree(pkt);
818  pkt = PacketDequeueNoLock(&tv.decode_pq);
819  }
820  DefragDestroy();
821  FlowShutdown();
822  return result;
823 }
824 
825 /**
826  * \test routing header decode
827  */
828 static int DecodeIPV6RouteTest01 (void)
829 {
830  uint8_t raw_pkt1[] = {
831  0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
832  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
833  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
834  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
835  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
836  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
837 
838  0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
839  0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
840  0xfa, 0x87, 0x00, 0x00,
841  };
842  Packet *p1 = PacketGetFromAlloc();
843  FAIL_IF(unlikely(p1 == NULL));
844  ThreadVars tv;
845  DecodeThreadVars dtv;
846 
847  FlowInitConfig(FLOW_QUIET);
848 
849  memset(&tv, 0, sizeof(ThreadVars));
850  memset(&dtv, 0, sizeof(DecodeThreadVars));
851 
852  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
853 
854  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
855 
856  FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1)));
857  FAIL_IF (p1->ip6eh.rh_type != 0);
858  PACKET_RECYCLE(p1);
859  SCFree(p1);
860  FlowShutdown();
861  PASS;
862 }
863 
864 /**
865  * \test HOP header decode
866  */
867 static int DecodeIPV6HopTest01 (void)
868 {
869  uint8_t raw_pkt1[] = {
870  0x60,0x00,0x00,0x00,0x00,0x20,0x00,0x01,0xfe,0x80,0x00,0x00,0x00,0x00,0x00,0x00,
871  0x02,0x0f,0xfe,0xff,0xfe,0x98,0x3d,0x01,0xff,0x02,0x00,0x00,0x00,0x00,0x00,0x00,
872  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x3a,0x00,0xff, /* 0xff is a nonsene opt */
873  0x02,0x00,0x00,0x00,0x00,
874  0x82,0x00,0x1c,0x6f,0x27,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
875  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
876  };
877  Packet *p1 = PacketGetFromAlloc();
878  FAIL_IF(unlikely(p1 == NULL));
879  ThreadVars tv;
880  DecodeThreadVars dtv;
881 
882  FlowInitConfig(FLOW_QUIET);
883 
884  memset(&tv, 0, sizeof(ThreadVars));
885  memset(&dtv, 0, sizeof(DecodeThreadVars));
886 
887  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
888 
889  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
890 
891  FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
892 
893  PACKET_RECYCLE(p1);
894  SCFree(p1);
895  FlowShutdown();
896  PASS;
897 }
898 
899 #endif /* UNITTESTS */
900 
901 /**
902  * \brief this function registers unit tests for IPV6 decoder
903  */
904 
905 void DecodeIPV6RegisterTests(void)
906 {
907 #ifdef UNITTESTS
908  UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
909  UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
910  UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
911 #endif /* UNITTESTS */
912 }
913 
914 /**
915  * @}
916  */
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:1045
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1074
host.h
IPV6ExtHdrs_::fh_data_offset
uint16_t fh_data_offset
Definition: decode-ipv6.h:227
Packet_::proto
uint8_t proto
Definition: decode.h:442
len
uint8_t len
Definition: app-layer-dnp3.h:2
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:947
IPV6_EXTHDR_DUPL_DH
@ IPV6_EXTHDR_DUPL_DH
Definition: decode-events.h:72
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:273
IPV6_EXTHDR_INVALID_OPTLEN
@ IPV6_EXTHDR_INVALID_OPTLEN
Definition: decode-events.h:76
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
IPV6_EXTHDR_USELESS_FH
@ IPV6_EXTHDR_USELESS_FH
Definition: decode-events.h:69
IPV6_EXTHDR_DUPL_RH
@ IPV6_EXTHDR_DUPL_RH
Definition: decode-events.h:70
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DecodeESP
int DecodeESP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Function to decode IPSEC-ESP packets.
Definition: decode-esp.c:64
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:1060
ip6rh_type
uint8_t ip6rh_type
Definition: decode-ipv6.h:3
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
IPV6OptRA_::ip6ra_value
uint16_t ip6ra_value
Definition: decode-ipv6.h:181
IPV6OptHAO_::ip6hao_hoa
struct in6_addr ip6hao_hoa
Definition: decode-ipv6.h:173
IPV6_EXTHDR_ISSET_FH
#define IPV6_EXTHDR_ISSET_FH(p)
Definition: decode-ipv6.h:239
SET_IPV6_DST_ADDR
#define SET_IPV6_DST_ADDR(p, a)
Definition: decode.h:185
IPV6ExtHdrs_::fh_nh
uint8_t fh_nh
Definition: decode-ipv6.h:221
IPV6OPT_HAO
#define IPV6OPT_HAO
Definition: decode-ipv6.h:166
Packet_::flags
uint32_t flags
Definition: decode.h:455
IPV6_DSTOPTS_UNKNOWN_OPT
@ IPV6_DSTOPTS_UNKNOWN_OPT
Definition: decode-events.h:82
IPV6OPT_PADN
#define IPV6OPT_PADN
Definition: decode-ipv6.h:163
IPV6_UNKNOWN_NEXT_HEADER
@ IPV6_UNKNOWN_NEXT_HEADER
Definition: decode-events.h:90
packet-queue.h
IPV6OPT_RA
#define IPV6OPT_RA
Definition: decode-ipv6.h:164
IPV6_DATA_AFTER_NONE_HEADER
@ IPV6_DATA_AFTER_NONE_HEADER
Definition: decode-events.h:88
IPV6_EXTHDR_SET_FH
#define IPV6_EXTHDR_SET_FH(p)
Definition: decode-ipv6.h:238
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:93
IPPROTO_GRE
#define IPPROTO_GRE
Definition: decode-gre.h:30
IPV6_FRAG_INVALID_LENGTH
@ IPV6_FRAG_INVALID_LENGTH
Definition: decode-events.h:172
IP_GET_RAW_VER
#define IP_GET_RAW_VER(pkt)
Definition: decode.h:260
IPV6_EXTHDR_DUPL_HH
@ IPV6_EXTHDR_DUPL_HH
Definition: decode-events.h:71
IPV6_SET_L4PROTO
#define IPV6_SET_L4PROTO(p, proto)
Definition: decode-ipv6.h:72
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:83
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:231
util-unittest.h
DecodeSCTP
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-sctp.c:66
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:82
IPV6ExtHdrs_::fh_id
uint32_t fh_id
Definition: decode-ipv6.h:234
IPV6OptHAO_::ip6hao_len
uint8_t ip6hao_len
Definition: decode-ipv6.h:172
IPV4_IN_IPV6_WRONG_IP_VER
@ IPV4_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:180
IPV6_GET_PLEN
#define IPV6_GET_PLEN(p)
Definition: decode-ipv6.h:88
CLEAR_IPV6_PACKET
#define CLEAR_IPV6_PACKET(p)
Definition: decode-ipv6.h:111
IPV6OPT_JUMBO
#define IPV6OPT_JUMBO
Definition: decode-ipv6.h:165
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1213
IPV6_EXTHDR_RH_TYPE_0
@ IPV6_EXTHDR_RH_TYPE_0
Definition: decode-events.h:85
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:523
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:687
IPV6_HOPOPTS_ONLY_PADDING
@ IPV6_HOPOPTS_ONLY_PADDING
Definition: decode-events.h:81
decode-ipv6.h
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
IPV6_TRUNC_EXTHDR
@ IPV6_TRUNC_EXTHDR
Definition: decode-events.h:67
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:206
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1185
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:100
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:236
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:272
pkt-var.h
IPV6ExtHdrs_::fh_more_frags_set
bool fh_more_frags_set
Definition: decode-ipv6.h:220
SET_IPV6_SRC_ADDR
#define SET_IPV6_SRC_ADDR(p, a)
Definition: decode.h:177
DecodeGRE
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode GRE packets.
Definition: decode-gre.c:47
decode-icmpv6.h
IPV6_GET_NH
#define IPV6_GET_NH(p)
Definition: decode-ipv6.h:86
util-profiling.h
SCReturn
#define SCReturn
Definition: util-debug.h:302
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:54
IPV6Hdr_
Definition: decode-ipv6.h:32
IPV6_EXTHDR_ZERO_LEN_PADN
@ IPV6_EXTHDR_ZERO_LEN_PADN
Definition: decode-events.h:86
Packet_
Definition: decode.h:420
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:570
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:946
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:235
IPV6ExtHdrs_::fh_offset
uint16_t fh_offset
Definition: decode-ipv6.h:233
IPV6_WITH_ICMPV4
@ IPV6_WITH_ICMPV4
Definition: decode-events.h:91
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:686
defrag.h
IPV6_EXTHDR_ISSET_RH
#define IPV6_EXTHDR_ISSET_RH(p)
Definition: decode-ipv6.h:241
IPV6_EXTHDR_DUPL_AH
@ IPV6_EXTHDR_DUPL_AH
Definition: decode-events.h:73
IPV6OptRA_
Definition: decode-ipv6.h:178
IPV6ExtHdrs_::fh_data_len
uint16_t fh_data_len
Definition: decode-ipv6.h:228
IPV6_IN_IPV6_PKT_TOO_SMALL
@ IPV6_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:183
IPV6_EXTHDR_DUPL_FH
@ IPV6_EXTHDR_DUPL_FH
Definition: decode-events.h:68
IPV6OptJumbo_::ip6j_payload_len
uint32_t ip6j_payload_len
Definition: decode-ipv6.h:189
decode-events.h
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
DecodeTCP
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-tcp.c:251
IPV6_IN_IPV6_WRONG_IP_VER
@ IPV6_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:184
IPV6_GET_FLOW
#define IPV6_GET_FLOW(p)
Definition: decode-ipv6.h:84
IPV6_HOPOPTS_UNKNOWN_OPT
@ IPV6_HOPOPTS_UNKNOWN_OPT
Definition: decode-events.h:80
IPV6_FH_NON_ZERO_RES_FIELD
@ IPV6_FH_NON_ZERO_RES_FIELD
Definition: decode-events.h:87
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:167
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
IPV6_GET_CLASS
#define IPV6_GET_CLASS(p)
Definition: decode-ipv6.h:82
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:395
DecodeICMPV6
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:188
suricata-common.h
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:664
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:651
IPV4_HEADER_LEN
#define IPV4_HEADER_LEN
Definition: decode-ipv4.h:28
IPV6OptHAO_::ip6hao_type
uint8_t ip6hao_type
Definition: decode-ipv6.h:171
IPV4_IN_IPV6_PKT_TOO_SMALL
@ IPV4_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:179
IPV6ExtHdrs_::fh_header_offset
uint16_t fh_header_offset
Definition: decode-ipv6.h:226
IPV6ExtHdrs_::fh_prev_hdr_offset
uint16_t fh_prev_hdr_offset
Definition: decode-ipv6.h:224
IPV6_WRONG_IP_VER
@ IPV6_WRONG_IP_VER
Definition: decode-events.h:77
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:151
PacketQueueNoLock_::len
uint32_t len
Definition: packet-queue.h:35
IPV6_SET_EXTHDRS_LEN
#define IPV6_SET_EXTHDRS_LEN(p, len)
Definition: decode-ipv6.h:73
IPV6OptRA_::ip6ra_len
uint8_t ip6ra_len
Definition: decode-ipv6.h:180
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:230
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:394
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:647
IPV6_TRUNC_PKT
@ IPV6_TRUNC_PKT
Definition: decode-events.h:66
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:110
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
IPV6OptJumbo_
Definition: decode-ipv6.h:186
IPV6OptRA_::ip6ra_type
uint8_t ip6ra_type
Definition: decode-ipv6.h:179
IPV6OptJumbo_::ip6j_len
uint8_t ip6j_len
Definition: decode-ipv6.h:188
Packet_::dst
Address dst
Definition: decode.h:425
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1053
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:42
IPV6OptJumbo_::ip6j_type
uint8_t ip6j_type
Definition: decode-ipv6.h:187
IPV6_HEADER_LEN
#define IPV6_HEADER_LEN
Definition: decode-ipv6.h:27
IPV6ExtHdrs_::rh_type
uint8_t rh_type
Definition: decode-ipv6.h:217
Packet_::ip6h
IPV6Hdr * ip6h
Definition: decode.h:520
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:289
Defrag
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:1007
IPV6_EXTHDR_AH_RES_NOT_NULL
@ IPV6_EXTHDR_AH_RES_NOT_NULL
Definition: decode-events.h:78
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:656
DecodeIPV6RegisterTests
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
Definition: decode-ipv6.c:905
IPV6OptHAO_
Definition: decode-ipv6.h:170
Packet_::src
Address src
Definition: decode.h:424
IPV6_DSTOPTS_ONLY_PADDING
@ IPV6_DSTOPTS_ONLY_PADDING
Definition: decode-events.h:83
DefragInit
void DefragInit(void)
Definition: defrag.c:1053
PACKET_RECYCLE
#define PACKET_RECYCLE(p)
Definition: decode.h:851
IPV6_EXTHDR_SET_RH
#define IPV6_EXTHDR_SET_RH(p)
Definition: decode-ipv6.h:240
Packet_::ip6eh
IPV6ExtHdrs ip6eh
Definition: decode.h:527
IPV6OPT_PAD1
#define IPV6OPT_PAD1
Definition: decode-ipv6.h:162