suricata
decode-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode IPv6
31  */
32 
33 #include "suricata-common.h"
34 #include "decode-ipv6.h"
35 #include "decode.h"
36 #include "defrag.h"
37 #include "util-print.h"
38 #include "util-validate.h"
39 
40 /**
41  * \brief Function to decode IPv4 in IPv6 packets
42  *
43  */
44 static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t plen)
45 {
46 
47  if (unlikely(plen < IPV4_HEADER_LEN)) {
48  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
49  return;
50  }
51  if (IP_GET_RAW_VER(pkt) == 4) {
52  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4);
53  if (tp != NULL) {
54  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
55  PacketEnqueueNoLock(&tv->decode_pq,tp);
56  StatsIncr(tv, dtv->counter_ipv4inipv6);
57  return;
58  }
59  } else {
60  ENGINE_SET_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER);
61  }
62 }
63 
64 /**
65  * \brief Function to decode IPv6 in IPv6 packets
66  *
67  */
68 static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
69  const uint8_t *pkt, uint16_t plen)
70 {
71 
72  if (unlikely(plen < IPV6_HEADER_LEN)) {
73  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
74  return TM_ECODE_FAILED;
75  }
76  if (IP_GET_RAW_VER(pkt) == 6) {
77  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6);
78  if (tp != NULL) {
79  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
80  PacketEnqueueNoLock(&tv->decode_pq,tp);
81  StatsIncr(tv, dtv->counter_ipv6inipv6);
82  }
83  } else {
84  ENGINE_SET_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER);
85  }
86  return TM_ECODE_OK;
87 }
88 
89 #ifndef UNITTESTS // ugly, but we need this in defrag tests
90 static inline
91 #endif
92 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
93  uint16_t hdrextlen, uint16_t plen,
94  uint16_t prev_hdrextlen)
95 {
96  uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
97  int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
98 
99  p->l3.vars.ip6.eh.fh_offset = frag_offset;
100  p->l3.vars.ip6.eh.fh_more_frags_set = frag_morefrags ? true : false;
101  p->l3.vars.ip6.eh.fh_nh = *pkt;
102 
103  uint32_t fh_id;
104  memcpy(&fh_id, pkt+4, 4);
105  p->l3.vars.ip6.eh.fh_id = SCNtohl(fh_id);
106 
107  SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x", p->l3.vars.ip6.eh.fh_offset,
108  p->l3.vars.ip6.eh.fh_more_frags_set ? "true" : "false", p->l3.vars.ip6.eh.fh_nh,
109  p->l3.vars.ip6.eh.fh_id, p->l3.vars.ip6.eh.fh_id);
110 
111  // store header offset, data offset
112  uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
113  uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
114  uint16_t data_len = plen - hdrextlen;
115 
116  p->l3.vars.ip6.eh.fh_header_offset = frag_hdr_offset;
117  p->l3.vars.ip6.eh.fh_data_offset = data_offset;
118  p->l3.vars.ip6.eh.fh_data_len = data_len;
119 
120  /* if we have a prev hdr, store the type and offset of it */
121  if (prev_hdrextlen) {
122  p->l3.vars.ip6.eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
123  }
124 
125  SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
126  p->l3.vars.ip6.eh.fh_header_offset, p->l3.vars.ip6.eh.fh_data_offset,
127  p->l3.vars.ip6.eh.fh_data_len);
128 }
129 
130 static void DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const IPV6Hdr *ip6h,
131  const uint8_t *pkt, uint16_t len)
132 {
133  SCEnter();
134 
135  const uint8_t *orig_pkt = pkt;
136  uint8_t nh = IPV6_GET_RAW_NH(ip6h); /* careful, 0 is actually a real type */
137  uint16_t hdrextlen = 0;
138  uint16_t plen = len;
139  char dstopts = 0;
140  char exthdr_fh_done = 0;
141  int hh = 0;
142  int rh = 0;
143  int ah = 0;
144 
145  while(1)
146  {
147  IPV6_SET_EXTHDRS_LEN(p, (len - plen));
148 
149  if (nh == IPPROTO_NONE) {
150  if (plen > 0) {
151  /* No upper layer, but we do have data. Suspicious. */
152  ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER);
153  }
154  SCReturn;
155  }
156 
157  if (plen < 2) { /* minimal needed in a hdr */
158  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
159  SCReturn;
160  }
161 
162  switch(nh)
163  {
164  case IPPROTO_TCP:
165  IPV6_SET_L4PROTO(p,nh);
166  DecodeTCP(tv, dtv, p, pkt, plen);
167  SCReturn;
168 
169  case IPPROTO_UDP:
170  IPV6_SET_L4PROTO(p,nh);
171  DecodeUDP(tv, dtv, p, pkt, plen);
172  SCReturn;
173 
174  case IPPROTO_ICMPV6:
175  IPV6_SET_L4PROTO(p,nh);
176  DecodeICMPV6(tv, dtv, p, pkt, plen);
177  SCReturn;
178 
179  case IPPROTO_SCTP:
180  IPV6_SET_L4PROTO(p,nh);
181  DecodeSCTP(tv, dtv, p, pkt, plen);
182  SCReturn;
183 
184  case IPPROTO_ROUTING:
185  IPV6_SET_L4PROTO(p,nh);
186  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
187 
188  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
189 
190  if (hdrextlen > plen) {
191  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
192  SCReturn;
193  }
194 
195  if (rh) {
196  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH);
197  /* skip past this extension so we can continue parsing the rest
198  * of the packet */
199  nh = *pkt;
200  pkt += hdrextlen;
201  plen -= hdrextlen;
202  break;
203  }
204 
205  rh = 1;
206  IPV6_EXTHDR_SET_RH(p);
207 
208  uint8_t ip6rh_type = *(pkt + 2);
209  if (ip6rh_type == 0) {
210  ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0);
211  }
212  p->l3.vars.ip6.eh.rh_type = ip6rh_type;
213 
214  nh = *pkt;
215  pkt += hdrextlen;
216  plen -= hdrextlen;
217  break;
218 
219  case IPPROTO_HOPOPTS:
220  case IPPROTO_DSTOPTS:
221  {
222  IPV6OptHAO hao_s, *hao = &hao_s;
223  IPV6OptRA ra_s, *ra = &ra_s;
224  IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
225  uint16_t optslen = 0;
226 
227  IPV6_SET_L4PROTO(p,nh);
228  hdrextlen = (uint16_t)((*(pkt + 1) + 1) << 3);
229  if (hdrextlen > plen) {
230  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
231  SCReturn;
232  }
233 
234  const uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
235 
236  /* point the pointers to right structures
237  * in Packet. */
238  if (nh == IPPROTO_HOPOPTS) {
239  if (hh) {
240  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH);
241  /* skip past this extension so we can continue parsing the rest
242  * of the packet */
243  nh = *pkt;
244  pkt += hdrextlen;
245  plen -= hdrextlen;
246  break;
247  }
248 
249  hh = 1;
250 
251  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
252  }
253  else if (nh == IPPROTO_DSTOPTS)
254  {
255  if (dstopts == 0) {
256  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
257  dstopts = 1;
258  } else if (dstopts == 1) {
259  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
260  dstopts = 2;
261  } else {
262  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH);
263  /* skip past this extension so we can continue parsing the rest
264  * of the packet */
265  nh = *pkt;
266  pkt += hdrextlen;
267  plen -= hdrextlen;
268  break;
269  }
270  }
271 
272  if (optslen > plen) {
273  /* since the packet is long enough (we checked
274  * plen against hdrlen, the optlen must be malformed. */
275  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
276  /* skip past this extension so we can continue parsing the rest
277  * of the packet */
278  nh = *pkt;
279  pkt += hdrextlen;
280  plen -= hdrextlen;
281  break;
282  }
283 /** \todo move into own function to loaded on demand */
284  uint16_t padn_cnt = 0;
285  uint16_t other_cnt = 0;
286  uint16_t offset = 0;
287  while(offset < optslen)
288  {
289  if (*ptr == IPV6OPT_PAD1)
290  {
291  padn_cnt++;
292  offset++;
293  ptr++;
294  continue;
295  }
296 
297  if (offset + 1 >= optslen) {
298  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
299  break;
300  }
301 
302  /* length field for each opt */
303  uint8_t ip6_optlen = *(ptr + 1);
304 
305  /* see if the optlen from the packet fits the total optslen */
306  if ((offset + 1 + ip6_optlen) > optslen) {
307  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
308  break;
309  }
310 
311  if (*ptr == IPV6OPT_PADN) /* PadN */
312  {
313  //printf("PadN option\n");
314  padn_cnt++;
315 
316  /* a zero padN len would be weird */
317  if (ip6_optlen == 0)
318  ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN);
319  }
320  else if (*ptr == IPV6OPT_RA) /* RA */
321  {
322  ra->ip6ra_type = *(ptr);
323  ra->ip6ra_len = ip6_optlen;
324 
325  if (ip6_optlen < sizeof(ra->ip6ra_value)) {
326  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
327  break;
328  }
329 
330  memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
331  ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
332  //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
333  // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
334  other_cnt++;
335  }
336  else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
337  {
338  jumbo->ip6j_type = *(ptr);
339  jumbo->ip6j_len = ip6_optlen;
340 
341  if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
342  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
343  break;
344  }
345 
346  memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
347  jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
348  //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
349  // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
350  }
351  else if (*ptr == IPV6OPT_HAO) /* HAO */
352  {
353  hao->ip6hao_type = *(ptr);
354  hao->ip6hao_len = ip6_optlen;
355 
356  if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
357  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
358  break;
359  }
360 
361  memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa));
362  //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ",
363  // hao->ip6hao_type, hao->ip6hao_len);
364  //char addr_buf[46];
365  //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa),
366  // addr_buf,sizeof(addr_buf));
367  //printf("home addr %s\n", addr_buf);
368  other_cnt++;
369  } else {
370  if (nh == IPPROTO_HOPOPTS)
371  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT);
372  else
373  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT);
374 
375  other_cnt++;
376  }
377  uint16_t optlen = (*(ptr + 1) + 2);
378  ptr += optlen; /* +2 for opt type and opt len fields */
379  offset += optlen;
380  }
381  /* flag packets that have only padding */
382  if (padn_cnt > 0 && other_cnt == 0) {
383  if (nh == IPPROTO_HOPOPTS)
384  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING);
385  else
386  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING);
387  }
388 
389  nh = *pkt;
390  pkt += hdrextlen;
391  plen -= hdrextlen;
392  break;
393  }
394 
395  case IPPROTO_FRAGMENT:
396  {
397  IPV6_SET_L4PROTO(p,nh);
398  /* store the offset of this extension into the packet
399  * past the ipv6 header. We use it in defrag for creating
400  * a defragmented packet without the frag header */
401  if (exthdr_fh_done == 0) {
402  DEBUG_VALIDATE_BUG_ON(pkt - orig_pkt > UINT16_MAX);
403  p->l3.vars.ip6.eh.fh_offset = (uint16_t)(pkt - orig_pkt);
404  exthdr_fh_done = 1;
405  }
406 
407  uint16_t prev_hdrextlen = hdrextlen;
408  hdrextlen = sizeof(IPV6FragHdr);
409  if (hdrextlen > plen) {
410  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
411  SCReturn;
412  }
413 
414  /* for the frag header, the length field is reserved */
415  if (*(pkt + 1) != 0) {
416  ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD);
417  /* non fatal, lets try to continue */
418  }
419 
420  if (IPV6_EXTHDR_ISSET_FH(p)) {
421  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH);
422  nh = *pkt;
423  pkt += hdrextlen;
424  plen -= hdrextlen;
425  break;
426  }
427 
428  /* set the header flag first */
429  IPV6_EXTHDR_SET_FH(p);
430 
431  /* parse the header and setup the vars */
432  DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
433 
434  /* if FH has offset 0 and no more fragments are coming, we
435  * parse this packet further right away, no defrag will be
436  * needed. It is a useless FH then though, so we do set an
437  * decoder event. */
438  if (p->l3.vars.ip6.eh.fh_more_frags_set == 0 && p->l3.vars.ip6.eh.fh_offset == 0) {
439  ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH);
440 
441  nh = *pkt;
442  pkt += hdrextlen;
443  plen -= hdrextlen;
444  break;
445  }
446  if (p->l3.vars.ip6.eh.fh_more_frags_set != 0 && plen % 8 != 0) {
447  // cf https://datatracker.ietf.org/doc/html/rfc2460#section-4.5
448  // each, except possibly the last ("rightmost") one,
449  // being an integer multiple of 8 octets long.
450  ENGINE_SET_EVENT(p, IPV6_FRAG_INVALID_LENGTH);
451  }
452 
453  /* the rest is parsed upon reassembly */
454  p->flags |= PKT_IS_FRAGMENT;
455  SCReturn;
456  }
457  case IPPROTO_ESP:
458  {
459  IPV6_SET_L4PROTO(p,nh);
460  DecodeESP(tv, dtv, p, pkt, plen);
461  SCReturn;
462  }
463  case IPPROTO_AH:
464  {
465  IPV6_SET_L4PROTO(p,nh);
466  /* we need the header as a minimum */
467  hdrextlen = sizeof(IPV6AuthHdr);
468  /* the payload len field is the number of extra 4 byte fields,
469  * IPV6AuthHdr already contains the first */
470  if (*(pkt+1) > 0)
471  hdrextlen += ((*(pkt+1) - 1) * 4);
472 
473  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
474 
475  if (hdrextlen > plen) {
476  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
477  SCReturn;
478  }
479 
480  IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
481  if (ahhdr->ip6ah_reserved != 0x0000) {
482  ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL);
483  }
484 
485  if (ah) {
486  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH);
487  nh = *pkt;
488  pkt += hdrextlen;
489  plen -= hdrextlen;
490  break;
491  }
492 
493  ah = 1;
494 
495  nh = *pkt;
496  pkt += hdrextlen;
497  plen -= hdrextlen;
498  break;
499  }
500  case IPPROTO_IPIP:
501  IPV6_SET_L4PROTO(p,nh);
502  DecodeIPv4inIPv6(tv, dtv, p, pkt, plen);
503  SCReturn;
504  /* none, last header */
505  case IPPROTO_NONE:
506  IPV6_SET_L4PROTO(p,nh);
507  SCReturn;
508  case IPPROTO_ICMP:
509  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
510  SCReturn;
511  /* no parsing yet, just skip it */
512  case IPPROTO_MH:
513  case IPPROTO_HIP:
514  case IPPROTO_SHIM6:
515  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
516  if (hdrextlen > plen) {
517  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
518  SCReturn;
519  }
520  nh = *pkt;
521  pkt += hdrextlen;
522  plen -= hdrextlen;
523  break;
524  default:
525  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
526  IPV6_SET_L4PROTO(p,nh);
527  SCReturn;
528  }
529  }
530 
531  SCReturn;
532 }
533 
534 static const IPV6Hdr *DecodeIPV6Packet(
535  ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
536 {
537  if (unlikely(len < IPV6_HEADER_LEN)) {
538  return NULL;
539  }
540 
541  if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
542  SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
543  ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
544  return NULL;
545  }
546 
547  const IPV6Hdr *ip6h = PacketSetIPV6(p, pkt);
548 
549  if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_RAW_PLEN(ip6h)))) {
550  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
551  return NULL;
552  }
553 
554  SET_IPV6_SRC_ADDR(ip6h, &p->src);
555  SET_IPV6_DST_ADDR(ip6h, &p->dst);
556 
557  return ip6h;
558 }
559 
560 int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
561 {
562  StatsIncr(tv, dtv->counter_ipv6);
563 
564  if (!PacketIncreaseCheckLayers(p)) {
565  return TM_ECODE_FAILED;
566  }
567  /* do the actual decoding */
568  const IPV6Hdr *ip6h = DecodeIPV6Packet(tv, dtv, p, pkt, len);
569  if (unlikely(ip6h == NULL)) {
570  PacketClearL3(p);
571  return TM_ECODE_FAILED;
572  }
573  p->proto = IPV6_GET_RAW_NH(ip6h);
574 
575 #ifdef DEBUG
576  if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
577  /* debug print */
578  char s[46], d[46];
579  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
580  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
581  SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32
582  " PLEN: %" PRIu32 " HLIM: %" PRIu32 "",
583  s, d, IPV6_GET_RAW_CLASS(ip6h), IPV6_GET_RAW_FLOW(ip6h), IPV6_GET_RAW_NH(ip6h),
584  IPV6_GET_RAW_PLEN(ip6h), IPV6_GET_RAW_HLIM(ip6h));
585  }
586 #endif /* DEBUG */
587  const uint8_t *data = pkt + IPV6_HEADER_LEN;
588  const uint16_t data_len = IPV6_GET_RAW_PLEN(ip6h);
589 
590  /* now process the Ext headers and/or the L4 Layer */
591  switch (IPV6_GET_RAW_NH(ip6h)) {
592  case IPPROTO_TCP:
593  IPV6_SET_L4PROTO (p, IPPROTO_TCP);
594  DecodeTCP(tv, dtv, p, data, data_len);
595  return TM_ECODE_OK;
596  case IPPROTO_UDP:
597  IPV6_SET_L4PROTO (p, IPPROTO_UDP);
598  DecodeUDP(tv, dtv, p, data, data_len);
599  return TM_ECODE_OK;
600  case IPPROTO_ICMPV6:
601  IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
602  DecodeICMPV6(tv, dtv, p, data, data_len);
603  return TM_ECODE_OK;
604  case IPPROTO_SCTP:
605  IPV6_SET_L4PROTO (p, IPPROTO_SCTP);
606  DecodeSCTP(tv, dtv, p, data, data_len);
607  return TM_ECODE_OK;
608  case IPPROTO_IPIP:
609  IPV6_SET_L4PROTO(p, IPPROTO_IPIP);
610  DecodeIPv4inIPv6(tv, dtv, p, data, data_len);
611  return TM_ECODE_OK;
612  case IPPROTO_IPV6:
613  DecodeIP6inIP6(tv, dtv, p, data, data_len);
614  return TM_ECODE_OK;
615  case IPPROTO_GRE:
616  IPV6_SET_L4PROTO(p, IPPROTO_GRE);
617  DecodeGRE(tv, dtv, p, data, data_len);
618  break;
619  case IPPROTO_FRAGMENT:
620  case IPPROTO_HOPOPTS:
621  case IPPROTO_ROUTING:
622  case IPPROTO_NONE:
623  case IPPROTO_DSTOPTS:
624  case IPPROTO_AH:
625  case IPPROTO_ESP:
626  case IPPROTO_MH:
627  case IPPROTO_HIP:
628  case IPPROTO_SHIM6:
629  DecodeIPV6ExtHdrs(tv, dtv, p, ip6h, data, data_len);
630  break;
631  case IPPROTO_ICMP:
632  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
633  break;
634  default:
635  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
636  IPV6_SET_L4PROTO(p, IPV6_GET_RAW_NH(ip6h));
637  break;
638  }
639  p->proto = IPV6_GET_L4PROTO (p);
640 
641  /* Pass to defragger if a fragment. */
642  if (IPV6_EXTHDR_ISSET_FH(p)) {
643  Packet *rp = Defrag(tv, dtv, p);
644  if (rp != NULL) {
645  PacketEnqueueNoLock(&tv->decode_pq,rp);
646  }
647  }
648 
649  return TM_ECODE_OK;
650 }
651 
652 #ifdef UNITTESTS
653 #include "util-unittest-helper.h"
654 #include "packet.h"
655 
656 /**
657  * \test fragment decoding
658  */
659 static int DecodeIPV6FragTest01 (void)
660 {
661 
662  uint8_t raw_frag1[] = {
663  0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
664  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
665  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
666  0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
667  0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
668  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
669  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
670  0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
671  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
672  0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
673  0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
674  0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
675  0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
676  0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
677  0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
678  0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
679  0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
680  0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
681  0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
682  0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
683  0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
684  0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
685  0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
686  0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
687  0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
688  0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
689  0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
690  0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
691  0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
692  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
693  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
694  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
695  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
696  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
697  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
698  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
699  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
700  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
701  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
702  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
703  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
704  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
705  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
706  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
707  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
708  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
748  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
749  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
750  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
751  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
752  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
753  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
754  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
755  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
756  };
757  uint8_t raw_frag2[] = {
758  0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
759  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
760  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
761  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
762  0x20, 0x20, 0x20, 0x20,
763  };
764  Packet *pkt;
765  Packet *p1 = PacketGetFromAlloc();
766  if (unlikely(p1 == NULL))
767  return 0;
768  Packet *p2 = PacketGetFromAlloc();
769  if (unlikely(p2 == NULL)) {
770  SCFree(p1);
771  return 0;
772  }
773  ThreadVars tv;
774  DecodeThreadVars dtv;
775  int result = 0;
776 
777  FlowInitConfig(FLOW_QUIET);
778  DefragInit();
779 
780  memset(&tv, 0, sizeof(ThreadVars));
781  memset(&dtv, 0, sizeof(DecodeThreadVars));
782 
783  PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
784  PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
785 
786  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
787 
788  if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
789  printf("ipv6 frag header not detected: ");
790  goto end;
791  }
792 
793  DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2));
794 
795  if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
796  printf("ipv6 frag header not detected: ");
797  goto end;
798  }
799 
800  if (tv.decode_pq.len != 1) {
801  printf("no reassembled packet: ");
802  goto end;
803  }
804 
805  result = 1;
806 end:
807  PacketRecycle(p1);
808  PacketRecycle(p2);
809  SCFree(p1);
810  SCFree(p2);
811  pkt = PacketDequeueNoLock(&tv.decode_pq);
812  while (pkt != NULL) {
813  PacketRecycle(pkt);
814  SCFree(pkt);
815  pkt = PacketDequeueNoLock(&tv.decode_pq);
816  }
817  DefragDestroy();
818  FlowShutdown();
819  return result;
820 }
821 
822 /**
823  * \test routing header decode
824  */
825 static int DecodeIPV6RouteTest01 (void)
826 {
827  uint8_t raw_pkt1[] = {
828  0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
829  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
830  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
831  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
832  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
833  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
834 
835  0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
836  0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
837  0xfa, 0x87, 0x00, 0x00,
838  };
839  Packet *p1 = PacketGetFromAlloc();
840  FAIL_IF(unlikely(p1 == NULL));
841  ThreadVars tv;
842  DecodeThreadVars dtv;
843 
844  FlowInitConfig(FLOW_QUIET);
845 
846  memset(&tv, 0, sizeof(ThreadVars));
847  memset(&dtv, 0, sizeof(DecodeThreadVars));
848 
849  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
850 
851  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
852 
853  FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1)));
854  FAIL_IF(p1->l3.vars.ip6.eh.rh_type != 0);
855  PacketRecycle(p1);
856  SCFree(p1);
857  FlowShutdown();
858  PASS;
859 }
860 
861 /**
862  * \test HOP header decode
863  */
864 static int DecodeIPV6HopTest01 (void)
865 {
866  uint8_t raw_pkt1[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x01, 0xfe, 0x80, 0x00, 0x00,
867  0x00, 0x00, 0x00, 0x00, 0x02, 0x0f, 0xfe, 0xff, 0xfe, 0x98, 0x3d, 0x01, 0xff, 0x02, 0x00,
868  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x3a, 0x00,
869  0xff, /* 0xff is a nonsense opt */
870  0x02, 0x00, 0x00, 0x00, 0x00, 0x82, 0x00, 0x1c, 0x6f, 0x27, 0x10, 0x00, 0x00, 0x00, 0x00,
871  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
872  Packet *p1 = PacketGetFromAlloc();
873  FAIL_IF(unlikely(p1 == NULL));
874  ThreadVars tv;
875  DecodeThreadVars dtv;
876 
877  FlowInitConfig(FLOW_QUIET);
878 
879  memset(&tv, 0, sizeof(ThreadVars));
880  memset(&dtv, 0, sizeof(DecodeThreadVars));
881 
882  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
883 
884  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
885 
886  FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
887 
888  PacketRecycle(p1);
889  SCFree(p1);
890  FlowShutdown();
891  PASS;
892 }
893 
894 #endif /* UNITTESTS */
895 
896 /**
897  * \brief this function registers unit tests for IPV6 decoder
898  */
899 
900 void DecodeIPV6RegisterTests(void)
901 {
902 #ifdef UNITTESTS
903  UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
904  UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
905  UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
906 #endif /* UNITTESTS */
907 }
908 
909 /**
910  * @}
911  */
IPV6_HOPOPTS_ONLY_PADDING
@ IPV6_HOPOPTS_ONLY_PADDING
Definition: decode-events.h:84
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:1173
IPV6_EXTHDR_DUPL_FH
@ IPV6_EXTHDR_DUPL_FH
Definition: decode-events.h:71
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1129
Packet_::proto
uint8_t proto
Definition: decode.h:514
IPV6_EXTHDR_DUPL_RH
@ IPV6_EXTHDR_DUPL_RH
Definition: decode-events.h:73
len
uint8_t len
Definition: app-layer-dnp3.h:2
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:1095
IPV6_GET_RAW_PLEN
#define IPV6_GET_RAW_PLEN(ip6h)
Definition: decode-ipv6.h:66
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:166
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
IPV4_IN_IPV6_PKT_TOO_SMALL
@ IPV4_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:184
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
IPV6_GET_RAW_HLIM
#define IPV6_GET_RAW_HLIM(ip6h)
Definition: decode-ipv6.h:67
IPV6_GET_RAW_NH
#define IPV6_GET_RAW_NH(ip6h)
Definition: decode-ipv6.h:65
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:351
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DecodeESP
int DecodeESP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Function to decode IPSEC-ESP packets.
Definition: decode-esp.c:64
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:1186
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
IPV6OptRA_::ip6ra_value
uint16_t ip6ra_value
Definition: decode-ipv6.h:138
IPV6OptHAO_::ip6hao_hoa
struct in6_addr ip6hao_hoa
Definition: decode-ipv6.h:130
IPV6_EXTHDR_ISSET_FH
#define IPV6_EXTHDR_ISSET_FH(p)
Definition: decode-ipv6.h:174
IPV6OPT_HAO
#define IPV6OPT_HAO
Definition: decode-ipv6.h:123
Packet_::flags
uint32_t flags
Definition: decode.h:535
PacketRecycle
void PacketRecycle(Packet *p)
Definition: packet.c:145
IPV6_GET_RAW_CLASS
#define IPV6_GET_RAW_CLASS(ip6h)
Definition: decode-ipv6.h:63
IPV6OPT_PADN
#define IPV6OPT_PADN
Definition: decode-ipv6.h:120
IPV4_IN_IPV6_WRONG_IP_VER
@ IPV4_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:185
IPV6_TRUNC_EXTHDR
@ IPV6_TRUNC_EXTHDR
Definition: decode-events.h:70
IPV6OPT_RA
#define IPV6OPT_RA
Definition: decode-ipv6.h:121
IPV6_EXTHDR_SET_FH
#define IPV6_EXTHDR_SET_FH(p)
Definition: decode-ipv6.h:173
IPV6_DSTOPTS_ONLY_PADDING
@ IPV6_DSTOPTS_ONLY_PADDING
Definition: decode-events.h:86
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:75
IPPROTO_GRE
#define IPPROTO_GRE
Definition: decode-gre.h:30
IP_GET_RAW_VER
#define IP_GET_RAW_VER(pkt)
Definition: decode.h:232
IPV6_SET_L4PROTO
#define IPV6_SET_L4PROTO(p, proto)
Definition: decode-ipv6.h:72
PacketL3::vars
union PacketL3::@22 vars
IPV6_FH_NON_ZERO_RES_FIELD
@ IPV6_FH_NON_ZERO_RES_FIELD
Definition: decode-events.h:90
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:82
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:204
DecodeSCTP
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-sctp.c:62
util-unittest-helper.h
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:81
IPV6OptHAO_::ip6hao_len
uint8_t ip6hao_len
Definition: decode-ipv6.h:129
IPV6OPT_JUMBO
#define IPV6OPT_JUMBO
Definition: decode-ipv6.h:122
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1309
IPV6_TRUNC_PKT
@ IPV6_TRUNC_PKT
Definition: decode-events.h:69
IPV6_DATA_AFTER_NONE_HEADER
@ IPV6_DATA_AFTER_NONE_HEADER
Definition: decode-events.h:91
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:546
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:1001
IPV6_FRAG_INVALID_LENGTH
@ IPV6_FRAG_INVALID_LENGTH
Definition: decode-events.h:177
decode-ipv6.h
decode.h
IPPROTO_SHIM6
#define IPPROTO_SHIM6
Definition: decode.h:1228
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:208
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1274
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:92
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:209
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:231
IPV6_EXTHDR_INVALID_OPTLEN
@ IPV6_EXTHDR_INVALID_OPTLEN
Definition: decode-events.h:79
IPV6_EXTHDR_AH_RES_NOT_NULL
@ IPV6_EXTHDR_AH_RES_NOT_NULL
Definition: decode-events.h:81
IPV6_EXTHDR_DUPL_DH
@ IPV6_EXTHDR_DUPL_DH
Definition: decode-events.h:75
DecodeGRE
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode GRE packets.
Definition: decode-gre.c:47
IPV6_DSTOPTS_UNKNOWN_OPT
@ IPV6_DSTOPTS_UNKNOWN_OPT
Definition: decode-events.h:85
SET_IPV6_SRC_ADDR
#define SET_IPV6_SRC_ADDR(ip6h, a)
Definition: decode.h:159
SCReturn
#define SCReturn
Definition: util-debug.h:273
IPV6_IN_IPV6_PKT_TOO_SMALL
@ IPV6_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:188
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:55
IPV6_EXTHDR_DUPL_AH
@ IPV6_EXTHDR_DUPL_AH
Definition: decode-events.h:76
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:492
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:560
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:1094
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:208
IPV6_WRONG_IP_VER
@ IPV6_WRONG_IP_VER
Definition: decode-events.h:80
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:1000
IPPROTO_HIP
#define IPPROTO_HIP
Definition: decode.h:1224
defrag.h
IPV6_EXTHDR_ISSET_RH
#define IPV6_EXTHDR_ISSET_RH(p)
Definition: decode-ipv6.h:176
IPV6OptRA_
Definition: decode-ipv6.h:135
IPV6OptJumbo_::ip6j_payload_len
uint32_t ip6j_payload_len
Definition: decode-ipv6.h:146
IPV6_EXTHDR_USELESS_FH
@ IPV6_EXTHDR_USELESS_FH
Definition: decode-events.h:72
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
DecodeTCP
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-tcp.c:273
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:168
IPV6_EXTHDR_DUPL_HH
@ IPV6_EXTHDR_DUPL_HH
Definition: decode-events.h:74
IPPROTO_IPIP
#define IPPROTO_IPIP
Definition: decode.h:1199
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:431
DecodeICMPV6
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:177
suricata-common.h
IPV6_EXTHDR_RH_TYPE_0
@ IPV6_EXTHDR_RH_TYPE_0
Definition: decode-events.h:88
IPV6_EXTHDR_ZERO_LEN_PADN
@ IPV6_EXTHDR_ZERO_LEN_PADN
Definition: decode-events.h:89
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:971
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:690
IPV4_HEADER_LEN
#define IPV4_HEADER_LEN
Definition: decode-ipv4.h:28
IPV6OptHAO_::ip6hao_type
uint8_t ip6hao_type
Definition: decode-ipv6.h:128
packet.h
IPV6_GET_RAW_FLOW
#define IPV6_GET_RAW_FLOW(ip6h)
Definition: decode-ipv6.h:64
IPV6_UNKNOWN_NEXT_HEADER
@ IPV6_UNKNOWN_NEXT_HEADER
Definition: decode-events.h:93
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:232
PacketQueueNoLock_::len
uint32_t len
Definition: packet-queue.h:37
IPV6_WITH_ICMPV4
@ IPV6_WITH_ICMPV4
Definition: decode-events.h:94
IPV6_SET_EXTHDRS_LEN
#define IPV6_SET_EXTHDRS_LEN(p, len)
Definition: decode-ipv6.h:73
Packet_::l3
struct PacketL3 l3
Definition: decode.h:591
PacketL3::ip6
struct PacketL3::@22::@23 ip6
IPV6OptRA_::ip6ra_len
uint8_t ip6ra_len
Definition: decode-ipv6.h:137
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:203
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:430
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:954
IPPROTO_MH
#define IPPROTO_MH
Definition: decode.h:1219
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:112
IPV6OptJumbo_
Definition: decode-ipv6.h:143
IPV6OptRA_::ip6ra_type
uint8_t ip6ra_type
Definition: decode-ipv6.h:136
IPV6OptJumbo_::ip6j_len
uint8_t ip6j_len
Definition: decode-ipv6.h:145
Packet_::dst
Address dst
Definition: decode.h:497
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1181
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:43
IPV6OptJumbo_::ip6j_type
uint8_t ip6j_type
Definition: decode-ipv6.h:144
IPV6_HEADER_LEN
#define IPV6_HEADER_LEN
Definition: decode-ipv6.h:27
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:1215
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:367
IPV6_IN_IPV6_WRONG_IP_VER
@ IPV6_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:189
Defrag
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:1063
SET_IPV6_DST_ADDR
#define SET_IPV6_DST_ADDR(ip6h, a)
Definition: decode.h:168
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:767
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
DecodeIPV6RegisterTests
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
Definition: decode-ipv6.c:900
IPV6OptHAO_
Definition: decode-ipv6.h:127
Packet_::src
Address src
Definition: decode.h:496
IPV6_HOPOPTS_UNKNOWN_OPT
@ IPV6_HOPOPTS_UNKNOWN_OPT
Definition: decode-events.h:83
DefragInit
void DefragInit(void)
Definition: defrag.c:1109
IPV6_EXTHDR_SET_RH
#define IPV6_EXTHDR_SET_RH(p)
Definition: decode-ipv6.h:175
IPV6OPT_PAD1
#define IPV6OPT_PAD1
Definition: decode-ipv6.h:119