suricata
decode-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode IPv6
31  */
32 
33 #include "suricata-common.h"
34 #include "packet-queue.h"
35 #include "decode.h"
36 #include "decode-ipv6.h"
37 #include "decode-icmpv6.h"
38 #include "decode-events.h"
39 #include "defrag.h"
40 #include "pkt-var.h"
41 #include "util-debug.h"
42 #include "util-print.h"
43 #include "util-unittest.h"
44 #include "util-profiling.h"
45 #include "host.h"
46 
47 /**
48  * \brief Function to decode IPv4 in IPv6 packets
49  *
50  */
51 static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t plen)
52 {
53 
54  if (unlikely(plen < IPV4_HEADER_LEN)) {
55  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
56  return;
57  }
58  if (IP_GET_RAW_VER(pkt) == 4) {
59  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4);
60  if (tp != NULL) {
61  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
62  PacketEnqueueNoLock(&tv->decode_pq,tp);
63  StatsIncr(tv, dtv->counter_ipv4inipv6);
64  return;
65  }
66  } else {
67  ENGINE_SET_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER);
68  }
69  return;
70 }
71 
72 /**
73  * \brief Function to decode IPv6 in IPv6 packets
74  *
75  */
76 static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
77  const uint8_t *pkt, uint16_t plen)
78 {
79 
80  if (unlikely(plen < IPV6_HEADER_LEN)) {
81  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
82  return TM_ECODE_FAILED;
83  }
84  if (IP_GET_RAW_VER(pkt) == 6) {
85  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6);
86  if (tp != NULL) {
87  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
88  PacketEnqueueNoLock(&tv->decode_pq,tp);
89  StatsIncr(tv, dtv->counter_ipv6inipv6);
90  }
91  } else {
92  ENGINE_SET_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER);
93  }
94  return TM_ECODE_OK;
95 }
96 
97 #ifndef UNITTESTS // ugly, but we need this in defrag tests
98 static inline
99 #endif
100 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
101  uint16_t hdrextlen, uint16_t plen,
102  uint16_t prev_hdrextlen)
103 {
104  uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
105  int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
106 
107  p->ip6eh.fh_offset = frag_offset;
108  p->ip6eh.fh_more_frags_set = frag_morefrags ? TRUE : FALSE;
109  p->ip6eh.fh_nh = *pkt;
110 
111  uint32_t fh_id;
112  memcpy(&fh_id, pkt+4, 4);
113  p->ip6eh.fh_id = SCNtohl(fh_id);
114 
115  SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x",
116  p->ip6eh.fh_offset,
117  p->ip6eh.fh_more_frags_set ? "true" : "false",
118  p->ip6eh.fh_nh,
119  p->ip6eh.fh_id, p->ip6eh.fh_id);
120 
121  // store header offset, data offset
122  uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
123  uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
124  uint16_t data_len = plen - hdrextlen;
125 
126  p->ip6eh.fh_header_offset = frag_hdr_offset;
127  p->ip6eh.fh_data_offset = data_offset;
128  p->ip6eh.fh_data_len = data_len;
129 
130  /* if we have a prev hdr, store the type and offset of it */
131  if (prev_hdrextlen) {
132  p->ip6eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
133  }
134 
135  SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
136  p->ip6eh.fh_header_offset, p->ip6eh.fh_data_offset,
137  p->ip6eh.fh_data_len);
138 }
139 
140 static void
141 DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
142  const uint8_t *pkt, uint16_t len)
143 {
144  SCEnter();
145 
146  const uint8_t *orig_pkt = pkt;
147  uint8_t nh = IPV6_GET_NH(p); /* careful, 0 is actually a real type */
148  uint16_t hdrextlen = 0;
149  uint16_t plen = len;
150  char dstopts = 0;
151  char exthdr_fh_done = 0;
152  int hh = 0;
153  int rh = 0;
154  int ah = 0;
155 
156  while(1)
157  {
158  IPV6_SET_EXTHDRS_LEN(p, (len - plen));
159 
160  if (nh == IPPROTO_NONE) {
161  if (plen > 0) {
162  /* No upper layer, but we do have data. Suspicious. */
163  ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER);
164  }
165  SCReturn;
166  }
167 
168  if (plen < 2) { /* minimal needed in a hdr */
169  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
170  SCReturn;
171  }
172 
173  switch(nh)
174  {
175  case IPPROTO_TCP:
176  IPV6_SET_L4PROTO(p,nh);
177  DecodeTCP(tv, dtv, p, pkt, plen);
178  SCReturn;
179 
180  case IPPROTO_UDP:
181  IPV6_SET_L4PROTO(p,nh);
182  DecodeUDP(tv, dtv, p, pkt, plen);
183  SCReturn;
184 
185  case IPPROTO_ICMPV6:
186  IPV6_SET_L4PROTO(p,nh);
187  DecodeICMPV6(tv, dtv, p, pkt, plen);
188  SCReturn;
189 
190  case IPPROTO_SCTP:
191  IPV6_SET_L4PROTO(p,nh);
192  DecodeSCTP(tv, dtv, p, pkt, plen);
193  SCReturn;
194 
195  case IPPROTO_ROUTING:
196  IPV6_SET_L4PROTO(p,nh);
197  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
198 
199  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
200 
201  if (hdrextlen > plen) {
202  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
203  SCReturn;
204  }
205 
206  if (rh) {
207  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH);
208  /* skip past this extension so we can continue parsing the rest
209  * of the packet */
210  nh = *pkt;
211  pkt += hdrextlen;
212  plen -= hdrextlen;
213  break;
214  }
215 
216  rh = 1;
217  IPV6_EXTHDR_SET_RH(p);
218 
219  uint8_t ip6rh_type = *(pkt + 2);
220  if (ip6rh_type == 0) {
221  ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0);
222  }
223  p->ip6eh.rh_type = ip6rh_type;
224 
225  nh = *pkt;
226  pkt += hdrextlen;
227  plen -= hdrextlen;
228  break;
229 
230  case IPPROTO_HOPOPTS:
231  case IPPROTO_DSTOPTS:
232  {
233  IPV6OptHAO hao_s, *hao = &hao_s;
234  IPV6OptRA ra_s, *ra = &ra_s;
235  IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
236  uint16_t optslen = 0;
237 
238  IPV6_SET_L4PROTO(p,nh);
239  hdrextlen = (*(pkt+1) + 1) << 3;
240  if (hdrextlen > plen) {
241  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
242  SCReturn;
243  }
244 
245  const uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
246 
247  /* point the pointers to right structures
248  * in Packet. */
249  if (nh == IPPROTO_HOPOPTS) {
250  if (hh) {
251  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH);
252  /* skip past this extension so we can continue parsing the rest
253  * of the packet */
254  nh = *pkt;
255  pkt += hdrextlen;
256  plen -= hdrextlen;
257  break;
258  }
259 
260  hh = 1;
261 
262  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
263  }
264  else if (nh == IPPROTO_DSTOPTS)
265  {
266  if (dstopts == 0) {
267  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
268  dstopts = 1;
269  } else if (dstopts == 1) {
270  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
271  dstopts = 2;
272  } else {
273  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH);
274  /* skip past this extension so we can continue parsing the rest
275  * of the packet */
276  nh = *pkt;
277  pkt += hdrextlen;
278  plen -= hdrextlen;
279  break;
280  }
281  }
282 
283  if (optslen > plen) {
284  /* since the packet is long enough (we checked
285  * plen against hdrlen, the optlen must be malformed. */
286  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
287  /* skip past this extension so we can continue parsing the rest
288  * of the packet */
289  nh = *pkt;
290  pkt += hdrextlen;
291  plen -= hdrextlen;
292  break;
293  }
294 /** \todo move into own function to loaded on demand */
295  uint16_t padn_cnt = 0;
296  uint16_t other_cnt = 0;
297  uint16_t offset = 0;
298  while(offset < optslen)
299  {
300  if (*ptr == IPV6OPT_PAD1)
301  {
302  padn_cnt++;
303  offset++;
304  ptr++;
305  continue;
306  }
307 
308  if (offset + 1 >= optslen) {
309  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
310  break;
311  }
312 
313  /* length field for each opt */
314  uint8_t ip6_optlen = *(ptr + 1);
315 
316  /* see if the optlen from the packet fits the total optslen */
317  if ((offset + 1 + ip6_optlen) > optslen) {
318  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
319  break;
320  }
321 
322  if (*ptr == IPV6OPT_PADN) /* PadN */
323  {
324  //printf("PadN option\n");
325  padn_cnt++;
326 
327  /* a zero padN len would be weird */
328  if (ip6_optlen == 0)
329  ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN);
330  }
331  else if (*ptr == IPV6OPT_RA) /* RA */
332  {
333  ra->ip6ra_type = *(ptr);
334  ra->ip6ra_len = ip6_optlen;
335 
336  if (ip6_optlen < sizeof(ra->ip6ra_value)) {
337  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
338  break;
339  }
340 
341  memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
342  ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
343  //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
344  // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
345  other_cnt++;
346  }
347  else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
348  {
349  jumbo->ip6j_type = *(ptr);
350  jumbo->ip6j_len = ip6_optlen;
351 
352  if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
353  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
354  break;
355  }
356 
357  memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
358  jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
359  //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
360  // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
361  }
362  else if (*ptr == IPV6OPT_HAO) /* HAO */
363  {
364  hao->ip6hao_type = *(ptr);
365  hao->ip6hao_len = ip6_optlen;
366 
367  if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
368  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
369  break;
370  }
371 
372  memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa));
373  //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ",
374  // hao->ip6hao_type, hao->ip6hao_len);
375  //char addr_buf[46];
376  //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa),
377  // addr_buf,sizeof(addr_buf));
378  //printf("home addr %s\n", addr_buf);
379  other_cnt++;
380  } else {
381  if (nh == IPPROTO_HOPOPTS)
382  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT);
383  else
384  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT);
385 
386  other_cnt++;
387  }
388  uint16_t optlen = (*(ptr + 1) + 2);
389  ptr += optlen; /* +2 for opt type and opt len fields */
390  offset += optlen;
391  }
392  /* flag packets that have only padding */
393  if (padn_cnt > 0 && other_cnt == 0) {
394  if (nh == IPPROTO_HOPOPTS)
395  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING);
396  else
397  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING);
398  }
399 
400  nh = *pkt;
401  pkt += hdrextlen;
402  plen -= hdrextlen;
403  break;
404  }
405 
406  case IPPROTO_FRAGMENT:
407  {
408  IPV6_SET_L4PROTO(p,nh);
409  /* store the offset of this extension into the packet
410  * past the ipv6 header. We use it in defrag for creating
411  * a defragmented packet without the frag header */
412  if (exthdr_fh_done == 0) {
413  p->ip6eh.fh_offset = pkt - orig_pkt;
414  exthdr_fh_done = 1;
415  }
416 
417  uint16_t prev_hdrextlen = hdrextlen;
418  hdrextlen = sizeof(IPV6FragHdr);
419  if (hdrextlen > plen) {
420  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
421  SCReturn;
422  }
423 
424  /* for the frag header, the length field is reserved */
425  if (*(pkt + 1) != 0) {
426  ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD);
427  /* non fatal, lets try to continue */
428  }
429 
430  if (IPV6_EXTHDR_ISSET_FH(p)) {
431  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH);
432  nh = *pkt;
433  pkt += hdrextlen;
434  plen -= hdrextlen;
435  break;
436  }
437 
438  /* set the header flag first */
439  IPV6_EXTHDR_SET_FH(p);
440 
441  /* parse the header and setup the vars */
442  DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
443 
444  /* if FH has offset 0 and no more fragments are coming, we
445  * parse this packet further right away, no defrag will be
446  * needed. It is a useless FH then though, so we do set an
447  * decoder event. */
448  if (p->ip6eh.fh_more_frags_set == 0 && p->ip6eh.fh_offset == 0) {
449  ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH);
450 
451  nh = *pkt;
452  pkt += hdrextlen;
453  plen -= hdrextlen;
454  break;
455  }
456 
457  /* the rest is parsed upon reassembly */
458  p->flags |= PKT_IS_FRAGMENT;
459  SCReturn;
460  }
461  case IPPROTO_ESP:
462  {
463  IPV6_SET_L4PROTO(p,nh);
464  DecodeESP(tv, dtv, p, pkt, plen);
465  SCReturn;
466  }
467  case IPPROTO_AH:
468  {
469  IPV6_SET_L4PROTO(p,nh);
470  /* we need the header as a minimum */
471  hdrextlen = sizeof(IPV6AuthHdr);
472  /* the payload len field is the number of extra 4 byte fields,
473  * IPV6AuthHdr already contains the first */
474  if (*(pkt+1) > 0)
475  hdrextlen += ((*(pkt+1) - 1) * 4);
476 
477  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
478 
479  if (hdrextlen > plen) {
480  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
481  SCReturn;
482  }
483 
484  IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
485  if (ahhdr->ip6ah_reserved != 0x0000) {
486  ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL);
487  }
488 
489  if (ah) {
490  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH);
491  nh = *pkt;
492  pkt += hdrextlen;
493  plen -= hdrextlen;
494  break;
495  }
496 
497  ah = 1;
498 
499  nh = *pkt;
500  pkt += hdrextlen;
501  plen -= hdrextlen;
502  break;
503  }
504  case IPPROTO_IPIP:
505  IPV6_SET_L4PROTO(p,nh);
506  DecodeIPv4inIPv6(tv, dtv, p, pkt, plen);
507  SCReturn;
508  /* none, last header */
509  case IPPROTO_NONE:
510  IPV6_SET_L4PROTO(p,nh);
511  SCReturn;
512  case IPPROTO_ICMP:
513  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
514  SCReturn;
515  /* no parsing yet, just skip it */
516  case IPPROTO_MH:
517  case IPPROTO_HIP:
518  case IPPROTO_SHIM6:
519  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
520  if (hdrextlen > plen) {
521  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
522  SCReturn;
523  }
524  nh = *pkt;
525  pkt += hdrextlen;
526  plen -= hdrextlen;
527  break;
528  default:
529  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
530  IPV6_SET_L4PROTO(p,nh);
531  SCReturn;
532  }
533  }
534 
535  SCReturn;
536 }
537 
538 static int DecodeIPV6Packet (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
539 {
540  if (unlikely(len < IPV6_HEADER_LEN)) {
541  return -1;
542  }
543 
544  if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
545  SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
546  ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
547  return -1;
548  }
549 
550  p->ip6h = (IPV6Hdr *)pkt;
551 
552  if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_PLEN(p))))
553  {
554  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
555  return -1;
556  }
557 
558  SET_IPV6_SRC_ADDR(p,&p->src);
559  SET_IPV6_DST_ADDR(p,&p->dst);
560 
561  return 0;
562 }
563 
564 int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
565 {
566  StatsIncr(tv, dtv->counter_ipv6);
567 
568  /* do the actual decoding */
569  int ret = DecodeIPV6Packet (tv, dtv, p, pkt, len);
570  if (unlikely(ret < 0)) {
571  CLEAR_IPV6_PACKET(p);
572  return TM_ECODE_FAILED;
573  }
574 
575 #ifdef DEBUG
576  if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
577  /* debug print */
578  char s[46], d[46];
579  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
580  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
581  SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32 " PLEN: %" PRIu32 " HLIM: %" PRIu32 "", s,d,
582  IPV6_GET_CLASS(p), IPV6_GET_FLOW(p), IPV6_GET_NH(p), IPV6_GET_PLEN(p),
583  IPV6_GET_HLIM(p));
584  }
585 #endif /* DEBUG */
586 
587  /* now process the Ext headers and/or the L4 Layer */
588  switch(IPV6_GET_NH(p)) {
589  case IPPROTO_TCP:
590  IPV6_SET_L4PROTO (p, IPPROTO_TCP);
591  DecodeTCP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
592  return TM_ECODE_OK;
593  case IPPROTO_UDP:
594  IPV6_SET_L4PROTO (p, IPPROTO_UDP);
595  DecodeUDP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
596  return TM_ECODE_OK;
597  case IPPROTO_ICMPV6:
598  IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
599  DecodeICMPV6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
600  return TM_ECODE_OK;
601  case IPPROTO_SCTP:
602  IPV6_SET_L4PROTO (p, IPPROTO_SCTP);
603  DecodeSCTP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
604  return TM_ECODE_OK;
605  case IPPROTO_IPIP:
606  IPV6_SET_L4PROTO(p, IPPROTO_IPIP);
607  DecodeIPv4inIPv6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
608  return TM_ECODE_OK;
609  case IPPROTO_IPV6:
610  DecodeIP6inIP6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
611  return TM_ECODE_OK;
612  case IPPROTO_GRE:
613  DecodeGRE(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
614  break;
615  case IPPROTO_FRAGMENT:
616  case IPPROTO_HOPOPTS:
617  case IPPROTO_ROUTING:
618  case IPPROTO_NONE:
619  case IPPROTO_DSTOPTS:
620  case IPPROTO_AH:
621  case IPPROTO_ESP:
622  case IPPROTO_MH:
623  case IPPROTO_HIP:
624  case IPPROTO_SHIM6:
625  DecodeIPV6ExtHdrs(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
626  break;
627  case IPPROTO_ICMP:
628  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
629  break;
630  default:
631  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
632  IPV6_SET_L4PROTO (p, IPV6_GET_NH(p));
633  break;
634  }
635  p->proto = IPV6_GET_L4PROTO (p);
636 
637  /* Pass to defragger if a fragment. */
638  if (IPV6_EXTHDR_ISSET_FH(p)) {
639  Packet *rp = Defrag(tv, dtv, p);
640  if (rp != NULL) {
641  PacketEnqueueNoLock(&tv->decode_pq,rp);
642  }
643  }
644 
645  return TM_ECODE_OK;
646 }
647 
648 #ifdef UNITTESTS
649 
650 /**
651  * \test fragment decoding
652  */
653 static int DecodeIPV6FragTest01 (void)
654 {
655 
656  uint8_t raw_frag1[] = {
657  0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
658  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
659  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
660  0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
661  0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
662  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
663  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
664  0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
665  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
666  0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
667  0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
668  0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
669  0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
670  0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
671  0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
672  0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
673  0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
674  0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
675  0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
676  0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
677  0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
678  0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
679  0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
680  0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
681  0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
682  0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
683  0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
684  0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
685  0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
686  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
687  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
688  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
689  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
690  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
691  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
692  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
693  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
694  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
695  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
696  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
697  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
698  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
699  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
700  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
701  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
702  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
703  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
704  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
705  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
706  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
707  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
708  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
748  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
749  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
750  };
751  uint8_t raw_frag2[] = {
752  0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
753  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
754  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
755  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
756  0x20, 0x20, 0x20, 0x20,
757  };
758  Packet *pkt;
759  Packet *p1 = PacketGetFromAlloc();
760  if (unlikely(p1 == NULL))
761  return 0;
762  Packet *p2 = PacketGetFromAlloc();
763  if (unlikely(p2 == NULL)) {
764  SCFree(p1);
765  return 0;
766  }
767  ThreadVars tv;
768  DecodeThreadVars dtv;
769  int result = 0;
770 
771  FlowInitConfig(FLOW_QUIET);
772  DefragInit();
773 
774  memset(&tv, 0, sizeof(ThreadVars));
775  memset(&dtv, 0, sizeof(DecodeThreadVars));
776 
777  PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
778  PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
779 
780  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
781 
782  if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
783  printf("ipv6 frag header not detected: ");
784  goto end;
785  }
786 
787  DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2));
788 
789  if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
790  printf("ipv6 frag header not detected: ");
791  goto end;
792  }
793 
794  if (tv.decode_pq.len != 1) {
795  printf("no reassembled packet: ");
796  goto end;
797  }
798 
799  result = 1;
800 end:
801  PACKET_RECYCLE(p1);
802  PACKET_RECYCLE(p2);
803  SCFree(p1);
804  SCFree(p2);
805  pkt = PacketDequeueNoLock(&tv.decode_pq);
806  while (pkt != NULL) {
807  PACKET_RECYCLE(pkt);
808  SCFree(pkt);
809  pkt = PacketDequeueNoLock(&tv.decode_pq);
810  }
811  DefragDestroy();
812  FlowShutdown();
813  return result;
814 }
815 
816 /**
817  * \test routing header decode
818  */
819 static int DecodeIPV6RouteTest01 (void)
820 {
821  uint8_t raw_pkt1[] = {
822  0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
823  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
824  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
825  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
826  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
827  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
828 
829  0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
830  0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
831  0xfa, 0x87, 0x00, 0x00,
832  };
833  Packet *p1 = PacketGetFromAlloc();
834  FAIL_IF(unlikely(p1 == NULL));
835  ThreadVars tv;
836  DecodeThreadVars dtv;
837 
838  FlowInitConfig(FLOW_QUIET);
839 
840  memset(&tv, 0, sizeof(ThreadVars));
841  memset(&dtv, 0, sizeof(DecodeThreadVars));
842 
843  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
844 
845  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
846 
847  FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1)));
848  FAIL_IF (p1->ip6eh.rh_type != 0);
849  PACKET_RECYCLE(p1);
850  SCFree(p1);
851  FlowShutdown();
852  PASS;
853 }
854 
855 /**
856  * \test HOP header decode
857  */
858 static int DecodeIPV6HopTest01 (void)
859 {
860  uint8_t raw_pkt1[] = {
861  0x60,0x00,0x00,0x00,0x00,0x20,0x00,0x01,0xfe,0x80,0x00,0x00,0x00,0x00,0x00,0x00,
862  0x02,0x0f,0xfe,0xff,0xfe,0x98,0x3d,0x01,0xff,0x02,0x00,0x00,0x00,0x00,0x00,0x00,
863  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x3a,0x00,0xff, /* 0xff is a nonsene opt */
864  0x02,0x00,0x00,0x00,0x00,
865  0x82,0x00,0x1c,0x6f,0x27,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
866  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
867  };
868  Packet *p1 = PacketGetFromAlloc();
869  FAIL_IF(unlikely(p1 == NULL));
870  ThreadVars tv;
871  DecodeThreadVars dtv;
872 
873  FlowInitConfig(FLOW_QUIET);
874 
875  memset(&tv, 0, sizeof(ThreadVars));
876  memset(&dtv, 0, sizeof(DecodeThreadVars));
877 
878  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
879 
880  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
881 
882  FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
883 
884  PACKET_RECYCLE(p1);
885  SCFree(p1);
886  FlowShutdown();
887  PASS;
888 }
889 
890 #endif /* UNITTESTS */
891 
892 /**
893  * \brief this function registers unit tests for IPV6 decoder
894  */
895 
896 void DecodeIPV6RegisterTests(void)
897 {
898 #ifdef UNITTESTS
899  UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
900  UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
901  UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
902 #endif /* UNITTESTS */
903 }
904 
905 /**
906  * @}
907  */
IPV6_EXTHDR_DUPL_HH
@ IPV6_EXTHDR_DUPL_HH
Definition: decode-events.h:71
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:1015
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1085
host.h
IPV6ExtHdrs_::fh_data_offset
uint16_t fh_data_offset
Definition: decode-ipv6.h:227
Packet_::proto
uint8_t proto
Definition: decode.h:437
IPV6_EXTHDR_USELESS_FH
@ IPV6_EXTHDR_USELESS_FH
Definition: decode-events.h:69
len
uint8_t len
Definition: app-layer-dnp3.h:2
IPV6_DATA_AFTER_NONE_HEADER
@ IPV6_DATA_AFTER_NONE_HEADER
Definition: decode-events.h:88
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:917
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
IPV6_TRUNC_PKT
@ IPV6_TRUNC_PKT
Definition: decode-events.h:66
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:265
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
IPV6_WITH_ICMPV4
@ IPV6_WITH_ICMPV4
Definition: decode-events.h:91
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DecodeESP
int DecodeESP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Function to decode IPSEC-ESP packets.
Definition: decode-esp.c:60
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:1030
ip6rh_type
uint8_t ip6rh_type
Definition: decode-ipv6.h:3
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
IPV6OptRA_::ip6ra_value
uint16_t ip6ra_value
Definition: decode-ipv6.h:181
IPV6OptHAO_::ip6hao_hoa
struct in6_addr ip6hao_hoa
Definition: decode-ipv6.h:173
IPV6_EXTHDR_ISSET_FH
#define IPV6_EXTHDR_ISSET_FH(p)
Definition: decode-ipv6.h:239
SET_IPV6_DST_ADDR
#define SET_IPV6_DST_ADDR(p, a)
Definition: decode.h:181
IPV6ExtHdrs_::fh_nh
uint8_t fh_nh
Definition: decode-ipv6.h:221
IPV6OPT_HAO
#define IPV6OPT_HAO
Definition: decode-ipv6.h:166
Packet_::flags
uint32_t flags
Definition: decode.h:450
IPV6OPT_PADN
#define IPV6OPT_PADN
Definition: decode-ipv6.h:163
FlowInitConfig
void FlowInitConfig(char quiet)
initialize the configuration
Definition: flow.c:516
packet-queue.h
IPV6OPT_RA
#define IPV6OPT_RA
Definition: decode-ipv6.h:164
IPV4_IN_IPV6_WRONG_IP_VER
@ IPV4_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:175
IPV6_EXTHDR_SET_FH
#define IPV6_EXTHDR_SET_FH(p)
Definition: decode-ipv6.h:238
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:93
IPPROTO_GRE
#define IPPROTO_GRE
Definition: decode-gre.h:30
IPV6_UNKNOWN_NEXT_HEADER
@ IPV6_UNKNOWN_NEXT_HEADER
Definition: decode-events.h:90
IP_GET_RAW_VER
#define IP_GET_RAW_VER(pkt)
Definition: decode.h:256
IPV6_EXTHDR_RH_TYPE_0
@ IPV6_EXTHDR_RH_TYPE_0
Definition: decode-events.h:85
IPV6_SET_L4PROTO
#define IPV6_SET_L4PROTO(p, proto)
Definition: decode-ipv6.h:72
IPV6_EXTHDR_DUPL_FH
@ IPV6_EXTHDR_DUPL_FH
Definition: decode-events.h:68
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:81
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:227
util-unittest.h
IPV6_FH_NON_ZERO_RES_FIELD
@ IPV6_FH_NON_ZERO_RES_FIELD
Definition: decode-events.h:87
DecodeSCTP
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-sctp.c:62
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:80
IPV6ExtHdrs_::fh_id
uint32_t fh_id
Definition: decode-ipv6.h:234
IPV6OptHAO_::ip6hao_len
uint8_t ip6hao_len
Definition: decode-ipv6.h:172
IPV6_GET_PLEN
#define IPV6_GET_PLEN(p)
Definition: decode-ipv6.h:88
CLEAR_IPV6_PACKET
#define CLEAR_IPV6_PACKET(p)
Definition: decode-ipv6.h:111
IPV6_IN_IPV6_WRONG_IP_VER
@ IPV6_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:179
IPV6OPT_JUMBO
#define IPV6OPT_JUMBO
Definition: decode-ipv6.h:165
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1162
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:673
decode-ipv6.h
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:206
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1136
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:100
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:232
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
IPV6_WRONG_IP_VER
@ IPV6_WRONG_IP_VER
Definition: decode-events.h:77
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:271
pkt-var.h
IPV6ExtHdrs_::fh_more_frags_set
bool fh_more_frags_set
Definition: decode-ipv6.h:220
IPV6_EXTHDR_AH_RES_NOT_NULL
@ IPV6_EXTHDR_AH_RES_NOT_NULL
Definition: decode-events.h:78
SET_IPV6_SRC_ADDR
#define SET_IPV6_SRC_ADDR(p, a)
Definition: decode.h:173
DecodeGRE
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode GRE packets.
Definition: decode-gre.c:46
decode-icmpv6.h
IPV6_EXTHDR_INVALID_OPTLEN
@ IPV6_EXTHDR_INVALID_OPTLEN
Definition: decode-events.h:76
IPV6_GET_NH
#define IPV6_GET_NH(p)
Definition: decode-ipv6.h:86
IPV6_IN_IPV6_PKT_TOO_SMALL
@ IPV6_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:178
TRUE
#define TRUE
Definition: suricata-common.h:33
IPV6_HOPOPTS_UNKNOWN_OPT
@ IPV6_HOPOPTS_UNKNOWN_OPT
Definition: decode-events.h:80
util-profiling.h
FALSE
#define FALSE
Definition: suricata-common.h:34
IPV6_EXTHDR_DUPL_DH
@ IPV6_EXTHDR_DUPL_DH
Definition: decode-events.h:72
SCReturn
#define SCReturn
Definition: util-debug.h:302
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:54
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:415
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:564
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:916
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:231
IPV6ExtHdrs_::fh_offset
uint16_t fh_offset
Definition: decode-ipv6.h:233
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:672
defrag.h
IPV6_EXTHDR_DUPL_RH
@ IPV6_EXTHDR_DUPL_RH
Definition: decode-events.h:70
IPV6_EXTHDR_ISSET_RH
#define IPV6_EXTHDR_ISSET_RH(p)
Definition: decode-ipv6.h:241
IPV6OptRA_
Definition: decode-ipv6.h:178
IPV6ExtHdrs_::fh_data_len
uint16_t fh_data_len
Definition: decode-ipv6.h:228
IPV6_EXTHDR_DUPL_AH
@ IPV6_EXTHDR_DUPL_AH
Definition: decode-events.h:73
IPV6OptJumbo_::ip6j_payload_len
uint32_t ip6j_payload_len
Definition: decode-ipv6.h:189
decode-events.h
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
DecodeTCP
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-tcp.c:231
IPV6_GET_FLOW
#define IPV6_GET_FLOW(p)
Definition: decode-ipv6.h:84
IPV4_IN_IPV6_PKT_TOO_SMALL
@ IPV4_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:174
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:167
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
IPV6_GET_CLASS
#define IPV6_GET_CLASS(p)
Definition: decode-ipv6.h:82
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:395
DecodeICMPV6
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:188
suricata-common.h
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:651
IPV6_DSTOPTS_ONLY_PADDING
@ IPV6_DSTOPTS_ONLY_PADDING
Definition: decode-events.h:83
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:644
IPV4_HEADER_LEN
#define IPV4_HEADER_LEN
Definition: decode-ipv4.h:28
IPV6OptHAO_::ip6hao_type
uint8_t ip6hao_type
Definition: decode-ipv6.h:171
IPV6ExtHdrs_::fh_header_offset
uint16_t fh_header_offset
Definition: decode-ipv6.h:226
IPV6ExtHdrs_::fh_prev_hdr_offset
uint16_t fh_prev_hdr_offset
Definition: decode-ipv6.h:224
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:146
PacketQueueNoLock_::len
uint32_t len
Definition: packet-queue.h:35
IPV6_SET_EXTHDRS_LEN
#define IPV6_SET_EXTHDRS_LEN(p, len)
Definition: decode-ipv6.h:73
IPV6OptRA_::ip6ra_len
uint8_t ip6ra_len
Definition: decode-ipv6.h:180
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:226
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:394
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:634
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:110
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
IPV6OptJumbo_
Definition: decode-ipv6.h:186
IPV6OptRA_::ip6ra_type
uint8_t ip6ra_type
Definition: decode-ipv6.h:179
IPV6OptJumbo_::ip6j_len
uint8_t ip6j_len
Definition: decode-ipv6.h:188
Packet_::dst
Address dst
Definition: decode.h:420
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1023
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:39
IPV6OptJumbo_::ip6j_type
uint8_t ip6j_type
Definition: decode-ipv6.h:187
IPV6_HOPOPTS_ONLY_PADDING
@ IPV6_HOPOPTS_ONLY_PADDING
Definition: decode-events.h:81
IPV6_TRUNC_EXTHDR
@ IPV6_TRUNC_EXTHDR
Definition: decode-events.h:67
IPV6_HEADER_LEN
#define IPV6_HEADER_LEN
Definition: decode-ipv6.h:27
IPV6ExtHdrs_::rh_type
uint8_t rh_type
Definition: decode-ipv6.h:217
Packet_::ip6h
IPV6Hdr * ip6h
Definition: decode.h:512
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:281
Defrag
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:1018
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:662
DecodeIPV6RegisterTests
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
Definition: decode-ipv6.c:896
IPV6OptHAO_
Definition: decode-ipv6.h:170
Packet_::src
Address src
Definition: decode.h:419
DefragInit
void DefragInit(void)
Definition: defrag.c:1064
PACKET_RECYCLE
#define PACKET_RECYCLE(p)
Definition: decode.h:836
IPV6_EXTHDR_SET_RH
#define IPV6_EXTHDR_SET_RH(p)
Definition: decode-ipv6.h:240
Packet_::ip6eh
IPV6ExtHdrs ip6eh
Definition: decode.h:519
IPV6_DSTOPTS_UNKNOWN_OPT
@ IPV6_DSTOPTS_UNKNOWN_OPT
Definition: decode-events.h:82
IPV6OPT_PAD1
#define IPV6OPT_PAD1
Definition: decode-ipv6.h:162
IPV6_EXTHDR_ZERO_LEN_PADN
@ IPV6_EXTHDR_ZERO_LEN_PADN
Definition: decode-events.h:86