suricata
decode-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode IPv6
31  */
32 
33 #include "suricata-common.h"
34 #include "packet-queue.h"
35 #include "decode.h"
36 #include "decode-ipv6.h"
37 #include "decode-icmpv6.h"
38 #include "decode-events.h"
39 #include "defrag.h"
40 #include "pkt-var.h"
41 #include "util-debug.h"
42 #include "util-print.h"
43 #include "util-unittest.h"
44 #include "util-profiling.h"
45 #include "util-validate.h"
46 #include "host.h"
47 
48 /**
49  * \brief Function to decode IPv4 in IPv6 packets
50  *
51  */
52 static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t plen)
53 {
54 
55  if (unlikely(plen < IPV4_HEADER_LEN)) {
56  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
57  return;
58  }
59  if (IP_GET_RAW_VER(pkt) == 4) {
60  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4);
61  if (tp != NULL) {
62  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
63  PacketEnqueueNoLock(&tv->decode_pq,tp);
64  StatsIncr(tv, dtv->counter_ipv4inipv6);
65  return;
66  }
67  } else {
68  ENGINE_SET_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER);
69  }
70  return;
71 }
72 
73 /**
74  * \brief Function to decode IPv6 in IPv6 packets
75  *
76  */
77 static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
78  const uint8_t *pkt, uint16_t plen)
79 {
80 
81  if (unlikely(plen < IPV6_HEADER_LEN)) {
82  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
83  return TM_ECODE_FAILED;
84  }
85  if (IP_GET_RAW_VER(pkt) == 6) {
86  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6);
87  if (tp != NULL) {
88  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
89  PacketEnqueueNoLock(&tv->decode_pq,tp);
90  StatsIncr(tv, dtv->counter_ipv6inipv6);
91  }
92  } else {
93  ENGINE_SET_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER);
94  }
95  return TM_ECODE_OK;
96 }
97 
98 #ifndef UNITTESTS // ugly, but we need this in defrag tests
99 static inline
100 #endif
101 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
102  uint16_t hdrextlen, uint16_t plen,
103  uint16_t prev_hdrextlen)
104 {
105  uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
106  int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
107 
108  p->ip6eh.fh_offset = frag_offset;
109  p->ip6eh.fh_more_frags_set = frag_morefrags ? true : false;
110  p->ip6eh.fh_nh = *pkt;
111 
112  uint32_t fh_id;
113  memcpy(&fh_id, pkt+4, 4);
114  p->ip6eh.fh_id = SCNtohl(fh_id);
115 
116  SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x",
117  p->ip6eh.fh_offset,
118  p->ip6eh.fh_more_frags_set ? "true" : "false",
119  p->ip6eh.fh_nh,
120  p->ip6eh.fh_id, p->ip6eh.fh_id);
121 
122  // store header offset, data offset
123  uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
124  uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
125  uint16_t data_len = plen - hdrextlen;
126 
127  p->ip6eh.fh_header_offset = frag_hdr_offset;
128  p->ip6eh.fh_data_offset = data_offset;
129  p->ip6eh.fh_data_len = data_len;
130 
131  /* if we have a prev hdr, store the type and offset of it */
132  if (prev_hdrextlen) {
133  p->ip6eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
134  }
135 
136  SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
137  p->ip6eh.fh_header_offset, p->ip6eh.fh_data_offset,
138  p->ip6eh.fh_data_len);
139 }
140 
141 static void
142 DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
143  const uint8_t *pkt, uint16_t len)
144 {
145  SCEnter();
146 
147  const uint8_t *orig_pkt = pkt;
148  uint8_t nh = IPV6_GET_NH(p); /* careful, 0 is actually a real type */
149  uint16_t hdrextlen = 0;
150  uint16_t plen = len;
151  char dstopts = 0;
152  char exthdr_fh_done = 0;
153  int hh = 0;
154  int rh = 0;
155  int ah = 0;
156 
157  while(1)
158  {
159  IPV6_SET_EXTHDRS_LEN(p, (len - plen));
160 
161  if (nh == IPPROTO_NONE) {
162  if (plen > 0) {
163  /* No upper layer, but we do have data. Suspicious. */
164  ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER);
165  }
166  SCReturn;
167  }
168 
169  if (plen < 2) { /* minimal needed in a hdr */
170  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
171  SCReturn;
172  }
173 
174  switch(nh)
175  {
176  case IPPROTO_TCP:
177  IPV6_SET_L4PROTO(p,nh);
178  DecodeTCP(tv, dtv, p, pkt, plen);
179  SCReturn;
180 
181  case IPPROTO_UDP:
182  IPV6_SET_L4PROTO(p,nh);
183  DecodeUDP(tv, dtv, p, pkt, plen);
184  SCReturn;
185 
186  case IPPROTO_ICMPV6:
187  IPV6_SET_L4PROTO(p,nh);
188  DecodeICMPV6(tv, dtv, p, pkt, plen);
189  SCReturn;
190 
191  case IPPROTO_SCTP:
192  IPV6_SET_L4PROTO(p,nh);
193  DecodeSCTP(tv, dtv, p, pkt, plen);
194  SCReturn;
195 
196  case IPPROTO_ROUTING:
197  IPV6_SET_L4PROTO(p,nh);
198  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
199 
200  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
201 
202  if (hdrextlen > plen) {
203  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
204  SCReturn;
205  }
206 
207  if (rh) {
208  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH);
209  /* skip past this extension so we can continue parsing the rest
210  * of the packet */
211  nh = *pkt;
212  pkt += hdrextlen;
213  plen -= hdrextlen;
214  break;
215  }
216 
217  rh = 1;
218  IPV6_EXTHDR_SET_RH(p);
219 
220  uint8_t ip6rh_type = *(pkt + 2);
221  if (ip6rh_type == 0) {
222  ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0);
223  }
224  p->ip6eh.rh_type = ip6rh_type;
225 
226  nh = *pkt;
227  pkt += hdrextlen;
228  plen -= hdrextlen;
229  break;
230 
231  case IPPROTO_HOPOPTS:
232  case IPPROTO_DSTOPTS:
233  {
234  IPV6OptHAO hao_s, *hao = &hao_s;
235  IPV6OptRA ra_s, *ra = &ra_s;
236  IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
237  uint16_t optslen = 0;
238 
239  IPV6_SET_L4PROTO(p,nh);
240  hdrextlen = (uint16_t)((*(pkt + 1) + 1) << 3);
241  if (hdrextlen > plen) {
242  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
243  SCReturn;
244  }
245 
246  const uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
247 
248  /* point the pointers to right structures
249  * in Packet. */
250  if (nh == IPPROTO_HOPOPTS) {
251  if (hh) {
252  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH);
253  /* skip past this extension so we can continue parsing the rest
254  * of the packet */
255  nh = *pkt;
256  pkt += hdrextlen;
257  plen -= hdrextlen;
258  break;
259  }
260 
261  hh = 1;
262 
263  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
264  }
265  else if (nh == IPPROTO_DSTOPTS)
266  {
267  if (dstopts == 0) {
268  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
269  dstopts = 1;
270  } else if (dstopts == 1) {
271  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
272  dstopts = 2;
273  } else {
274  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH);
275  /* skip past this extension so we can continue parsing the rest
276  * of the packet */
277  nh = *pkt;
278  pkt += hdrextlen;
279  plen -= hdrextlen;
280  break;
281  }
282  }
283 
284  if (optslen > plen) {
285  /* since the packet is long enough (we checked
286  * plen against hdrlen, the optlen must be malformed. */
287  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
288  /* skip past this extension so we can continue parsing the rest
289  * of the packet */
290  nh = *pkt;
291  pkt += hdrextlen;
292  plen -= hdrextlen;
293  break;
294  }
295 /** \todo move into own function to loaded on demand */
296  uint16_t padn_cnt = 0;
297  uint16_t other_cnt = 0;
298  uint16_t offset = 0;
299  while(offset < optslen)
300  {
301  if (*ptr == IPV6OPT_PAD1)
302  {
303  padn_cnt++;
304  offset++;
305  ptr++;
306  continue;
307  }
308 
309  if (offset + 1 >= optslen) {
310  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
311  break;
312  }
313 
314  /* length field for each opt */
315  uint8_t ip6_optlen = *(ptr + 1);
316 
317  /* see if the optlen from the packet fits the total optslen */
318  if ((offset + 1 + ip6_optlen) > optslen) {
319  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
320  break;
321  }
322 
323  if (*ptr == IPV6OPT_PADN) /* PadN */
324  {
325  //printf("PadN option\n");
326  padn_cnt++;
327 
328  /* a zero padN len would be weird */
329  if (ip6_optlen == 0)
330  ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN);
331  }
332  else if (*ptr == IPV6OPT_RA) /* RA */
333  {
334  ra->ip6ra_type = *(ptr);
335  ra->ip6ra_len = ip6_optlen;
336 
337  if (ip6_optlen < sizeof(ra->ip6ra_value)) {
338  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
339  break;
340  }
341 
342  memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
343  ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
344  //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
345  // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
346  other_cnt++;
347  }
348  else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
349  {
350  jumbo->ip6j_type = *(ptr);
351  jumbo->ip6j_len = ip6_optlen;
352 
353  if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
354  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
355  break;
356  }
357 
358  memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
359  jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
360  //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
361  // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
362  }
363  else if (*ptr == IPV6OPT_HAO) /* HAO */
364  {
365  hao->ip6hao_type = *(ptr);
366  hao->ip6hao_len = ip6_optlen;
367 
368  if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
369  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
370  break;
371  }
372 
373  memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa));
374  //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ",
375  // hao->ip6hao_type, hao->ip6hao_len);
376  //char addr_buf[46];
377  //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa),
378  // addr_buf,sizeof(addr_buf));
379  //printf("home addr %s\n", addr_buf);
380  other_cnt++;
381  } else {
382  if (nh == IPPROTO_HOPOPTS)
383  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT);
384  else
385  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT);
386 
387  other_cnt++;
388  }
389  uint16_t optlen = (*(ptr + 1) + 2);
390  ptr += optlen; /* +2 for opt type and opt len fields */
391  offset += optlen;
392  }
393  /* flag packets that have only padding */
394  if (padn_cnt > 0 && other_cnt == 0) {
395  if (nh == IPPROTO_HOPOPTS)
396  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING);
397  else
398  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING);
399  }
400 
401  nh = *pkt;
402  pkt += hdrextlen;
403  plen -= hdrextlen;
404  break;
405  }
406 
407  case IPPROTO_FRAGMENT:
408  {
409  IPV6_SET_L4PROTO(p,nh);
410  /* store the offset of this extension into the packet
411  * past the ipv6 header. We use it in defrag for creating
412  * a defragmented packet without the frag header */
413  if (exthdr_fh_done == 0) {
414  DEBUG_VALIDATE_BUG_ON(pkt - orig_pkt > UINT16_MAX);
415  p->ip6eh.fh_offset = (uint16_t)(pkt - orig_pkt);
416  exthdr_fh_done = 1;
417  }
418 
419  uint16_t prev_hdrextlen = hdrextlen;
420  hdrextlen = sizeof(IPV6FragHdr);
421  if (hdrextlen > plen) {
422  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
423  SCReturn;
424  }
425 
426  /* for the frag header, the length field is reserved */
427  if (*(pkt + 1) != 0) {
428  ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD);
429  /* non fatal, lets try to continue */
430  }
431 
432  if (IPV6_EXTHDR_ISSET_FH(p)) {
433  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH);
434  nh = *pkt;
435  pkt += hdrextlen;
436  plen -= hdrextlen;
437  break;
438  }
439 
440  /* set the header flag first */
441  IPV6_EXTHDR_SET_FH(p);
442 
443  /* parse the header and setup the vars */
444  DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
445 
446  /* if FH has offset 0 and no more fragments are coming, we
447  * parse this packet further right away, no defrag will be
448  * needed. It is a useless FH then though, so we do set an
449  * decoder event. */
450  if (p->ip6eh.fh_more_frags_set == 0 && p->ip6eh.fh_offset == 0) {
451  ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH);
452 
453  nh = *pkt;
454  pkt += hdrextlen;
455  plen -= hdrextlen;
456  break;
457  }
458  if (p->ip6eh.fh_more_frags_set != 0 && plen % 8 != 0) {
459  // cf https://datatracker.ietf.org/doc/html/rfc2460#section-4.5
460  // each, except possibly the last ("rightmost") one,
461  // being an integer multiple of 8 octets long.
462  ENGINE_SET_EVENT(p, IPV6_FRAG_INVALID_LENGTH);
463  }
464 
465  /* the rest is parsed upon reassembly */
466  p->flags |= PKT_IS_FRAGMENT;
467  SCReturn;
468  }
469  case IPPROTO_ESP:
470  {
471  IPV6_SET_L4PROTO(p,nh);
472  DecodeESP(tv, dtv, p, pkt, plen);
473  SCReturn;
474  }
475  case IPPROTO_AH:
476  {
477  IPV6_SET_L4PROTO(p,nh);
478  /* we need the header as a minimum */
479  hdrextlen = sizeof(IPV6AuthHdr);
480  /* the payload len field is the number of extra 4 byte fields,
481  * IPV6AuthHdr already contains the first */
482  if (*(pkt+1) > 0)
483  hdrextlen += ((*(pkt+1) - 1) * 4);
484 
485  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
486 
487  if (hdrextlen > plen) {
488  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
489  SCReturn;
490  }
491 
492  IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
493  if (ahhdr->ip6ah_reserved != 0x0000) {
494  ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL);
495  }
496 
497  if (ah) {
498  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH);
499  nh = *pkt;
500  pkt += hdrextlen;
501  plen -= hdrextlen;
502  break;
503  }
504 
505  ah = 1;
506 
507  nh = *pkt;
508  pkt += hdrextlen;
509  plen -= hdrextlen;
510  break;
511  }
512  case IPPROTO_IPIP:
513  IPV6_SET_L4PROTO(p,nh);
514  DecodeIPv4inIPv6(tv, dtv, p, pkt, plen);
515  SCReturn;
516  /* none, last header */
517  case IPPROTO_NONE:
518  IPV6_SET_L4PROTO(p,nh);
519  SCReturn;
520  case IPPROTO_ICMP:
521  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
522  SCReturn;
523  /* no parsing yet, just skip it */
524  case IPPROTO_MH:
525  case IPPROTO_HIP:
526  case IPPROTO_SHIM6:
527  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
528  if (hdrextlen > plen) {
529  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
530  SCReturn;
531  }
532  nh = *pkt;
533  pkt += hdrextlen;
534  plen -= hdrextlen;
535  break;
536  default:
537  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
538  IPV6_SET_L4PROTO(p,nh);
539  SCReturn;
540  }
541  }
542 
543  SCReturn;
544 }
545 
546 static int DecodeIPV6Packet (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
547 {
548  if (unlikely(len < IPV6_HEADER_LEN)) {
549  return -1;
550  }
551 
552  if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
553  SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
554  ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
555  return -1;
556  }
557 
558  p->ip6h = (IPV6Hdr *)pkt;
559 
560  if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_PLEN(p))))
561  {
562  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
563  return -1;
564  }
565 
566  SET_IPV6_SRC_ADDR(p,&p->src);
567  SET_IPV6_DST_ADDR(p,&p->dst);
568 
569  return 0;
570 }
571 
572 int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
573 {
574  StatsIncr(tv, dtv->counter_ipv6);
575 
576  if (!PacketIncreaseCheckLayers(p)) {
577  return TM_ECODE_FAILED;
578  }
579  /* do the actual decoding */
580  int ret = DecodeIPV6Packet (tv, dtv, p, pkt, len);
581  if (unlikely(ret < 0)) {
582  CLEAR_IPV6_PACKET(p);
583  return TM_ECODE_FAILED;
584  }
585 
586 #ifdef DEBUG
587  if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
588  /* debug print */
589  char s[46], d[46];
590  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
591  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
592  SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32 " PLEN: %" PRIu32 " HLIM: %" PRIu32 "", s,d,
593  IPV6_GET_CLASS(p), IPV6_GET_FLOW(p), IPV6_GET_NH(p), IPV6_GET_PLEN(p),
594  IPV6_GET_HLIM(p));
595  }
596 #endif /* DEBUG */
597 
598  /* now process the Ext headers and/or the L4 Layer */
599  switch(IPV6_GET_NH(p)) {
600  case IPPROTO_TCP:
601  IPV6_SET_L4PROTO (p, IPPROTO_TCP);
602  DecodeTCP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
603  return TM_ECODE_OK;
604  case IPPROTO_UDP:
605  IPV6_SET_L4PROTO (p, IPPROTO_UDP);
606  DecodeUDP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
607  return TM_ECODE_OK;
608  case IPPROTO_ICMPV6:
609  IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
610  DecodeICMPV6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
611  return TM_ECODE_OK;
612  case IPPROTO_SCTP:
613  IPV6_SET_L4PROTO (p, IPPROTO_SCTP);
614  DecodeSCTP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
615  return TM_ECODE_OK;
616  case IPPROTO_IPIP:
617  IPV6_SET_L4PROTO(p, IPPROTO_IPIP);
618  DecodeIPv4inIPv6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
619  return TM_ECODE_OK;
620  case IPPROTO_IPV6:
621  DecodeIP6inIP6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
622  return TM_ECODE_OK;
623  case IPPROTO_GRE:
624  DecodeGRE(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
625  break;
626  case IPPROTO_FRAGMENT:
627  case IPPROTO_HOPOPTS:
628  case IPPROTO_ROUTING:
629  case IPPROTO_NONE:
630  case IPPROTO_DSTOPTS:
631  case IPPROTO_AH:
632  case IPPROTO_ESP:
633  case IPPROTO_MH:
634  case IPPROTO_HIP:
635  case IPPROTO_SHIM6:
636  DecodeIPV6ExtHdrs(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
637  break;
638  case IPPROTO_ICMP:
639  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
640  break;
641  default:
642  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
643  IPV6_SET_L4PROTO (p, IPV6_GET_NH(p));
644  break;
645  }
646  p->proto = IPV6_GET_L4PROTO (p);
647 
648  /* Pass to defragger if a fragment. */
649  if (IPV6_EXTHDR_ISSET_FH(p)) {
650  Packet *rp = Defrag(tv, dtv, p);
651  if (rp != NULL) {
652  PacketEnqueueNoLock(&tv->decode_pq,rp);
653  }
654  }
655 
656  return TM_ECODE_OK;
657 }
658 
659 #ifdef UNITTESTS
660 
661 /**
662  * \test fragment decoding
663  */
664 static int DecodeIPV6FragTest01 (void)
665 {
666 
667  uint8_t raw_frag1[] = {
668  0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
669  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
670  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
671  0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
672  0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
673  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
674  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
675  0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
676  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
677  0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
678  0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
679  0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
680  0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
681  0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
682  0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
683  0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
684  0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
685  0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
686  0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
687  0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
688  0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
689  0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
690  0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
691  0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
692  0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
693  0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
694  0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
695  0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
696  0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
697  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
698  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
699  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
700  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
701  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
702  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
703  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
704  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
705  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
706  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
707  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
708  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
748  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
749  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
750  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
751  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
752  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
753  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
754  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
755  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
756  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
757  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
758  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
759  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
760  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
761  };
762  uint8_t raw_frag2[] = {
763  0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
764  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
765  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
766  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
767  0x20, 0x20, 0x20, 0x20,
768  };
769  Packet *pkt;
770  Packet *p1 = PacketGetFromAlloc();
771  if (unlikely(p1 == NULL))
772  return 0;
773  Packet *p2 = PacketGetFromAlloc();
774  if (unlikely(p2 == NULL)) {
775  SCFree(p1);
776  return 0;
777  }
778  ThreadVars tv;
779  DecodeThreadVars dtv;
780  int result = 0;
781 
782  FlowInitConfig(FLOW_QUIET);
783  DefragInit();
784 
785  memset(&tv, 0, sizeof(ThreadVars));
786  memset(&dtv, 0, sizeof(DecodeThreadVars));
787 
788  PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
789  PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
790 
791  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
792 
793  if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
794  printf("ipv6 frag header not detected: ");
795  goto end;
796  }
797 
798  DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2));
799 
800  if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
801  printf("ipv6 frag header not detected: ");
802  goto end;
803  }
804 
805  if (tv.decode_pq.len != 1) {
806  printf("no reassembled packet: ");
807  goto end;
808  }
809 
810  result = 1;
811 end:
812  PACKET_RECYCLE(p1);
813  PACKET_RECYCLE(p2);
814  SCFree(p1);
815  SCFree(p2);
816  pkt = PacketDequeueNoLock(&tv.decode_pq);
817  while (pkt != NULL) {
818  PACKET_RECYCLE(pkt);
819  SCFree(pkt);
820  pkt = PacketDequeueNoLock(&tv.decode_pq);
821  }
822  DefragDestroy();
823  FlowShutdown();
824  return result;
825 }
826 
827 /**
828  * \test routing header decode
829  */
830 static int DecodeIPV6RouteTest01 (void)
831 {
832  uint8_t raw_pkt1[] = {
833  0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
834  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
835  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
836  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
837  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
838  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
839 
840  0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
841  0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
842  0xfa, 0x87, 0x00, 0x00,
843  };
844  Packet *p1 = PacketGetFromAlloc();
845  FAIL_IF(unlikely(p1 == NULL));
846  ThreadVars tv;
847  DecodeThreadVars dtv;
848 
849  FlowInitConfig(FLOW_QUIET);
850 
851  memset(&tv, 0, sizeof(ThreadVars));
852  memset(&dtv, 0, sizeof(DecodeThreadVars));
853 
854  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
855 
856  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
857 
858  FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1)));
859  FAIL_IF (p1->ip6eh.rh_type != 0);
860  PACKET_RECYCLE(p1);
861  SCFree(p1);
862  FlowShutdown();
863  PASS;
864 }
865 
866 /**
867  * \test HOP header decode
868  */
869 static int DecodeIPV6HopTest01 (void)
870 {
871  uint8_t raw_pkt1[] = {
872  0x60,0x00,0x00,0x00,0x00,0x20,0x00,0x01,0xfe,0x80,0x00,0x00,0x00,0x00,0x00,0x00,
873  0x02,0x0f,0xfe,0xff,0xfe,0x98,0x3d,0x01,0xff,0x02,0x00,0x00,0x00,0x00,0x00,0x00,
874  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x3a,0x00,0xff, /* 0xff is a nonsene opt */
875  0x02,0x00,0x00,0x00,0x00,
876  0x82,0x00,0x1c,0x6f,0x27,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
877  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
878  };
879  Packet *p1 = PacketGetFromAlloc();
880  FAIL_IF(unlikely(p1 == NULL));
881  ThreadVars tv;
882  DecodeThreadVars dtv;
883 
884  FlowInitConfig(FLOW_QUIET);
885 
886  memset(&tv, 0, sizeof(ThreadVars));
887  memset(&dtv, 0, sizeof(DecodeThreadVars));
888 
889  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
890 
891  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
892 
893  FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
894 
895  PACKET_RECYCLE(p1);
896  SCFree(p1);
897  FlowShutdown();
898  PASS;
899 }
900 
901 #endif /* UNITTESTS */
902 
903 /**
904  * \brief this function registers unit tests for IPV6 decoder
905  */
906 
907 void DecodeIPV6RegisterTests(void)
908 {
909 #ifdef UNITTESTS
910  UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
911  UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
912  UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
913 #endif /* UNITTESTS */
914 }
915 
916 /**
917  * @}
918  */
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:1069
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1076
host.h
IPV6ExtHdrs_::fh_data_offset
uint16_t fh_data_offset
Definition: decode-ipv6.h:227
Packet_::proto
uint8_t proto
Definition: decode.h:464
len
uint8_t len
Definition: app-layer-dnp3.h:2
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:993
IPV6_EXTHDR_DUPL_DH
@ IPV6_EXTHDR_DUPL_DH
Definition: decode-events.h:72
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:295
IPV6_EXTHDR_INVALID_OPTLEN
@ IPV6_EXTHDR_INVALID_OPTLEN
Definition: decode-events.h:76
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
IPV6_EXTHDR_USELESS_FH
@ IPV6_EXTHDR_USELESS_FH
Definition: decode-events.h:69
IPV6_EXTHDR_DUPL_RH
@ IPV6_EXTHDR_DUPL_RH
Definition: decode-events.h:70
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DecodeESP
int DecodeESP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Function to decode IPSEC-ESP packets.
Definition: decode-esp.c:64
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:1084
ip6rh_type
uint8_t ip6rh_type
Definition: decode-ipv6.h:3
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
IPV6OptRA_::ip6ra_value
uint16_t ip6ra_value
Definition: decode-ipv6.h:181
IPV6OptHAO_::ip6hao_hoa
struct in6_addr ip6hao_hoa
Definition: decode-ipv6.h:173
IPV6_EXTHDR_ISSET_FH
#define IPV6_EXTHDR_ISSET_FH(p)
Definition: decode-ipv6.h:239
SET_IPV6_DST_ADDR
#define SET_IPV6_DST_ADDR(p, a)
Definition: decode.h:185
IPV6ExtHdrs_::fh_nh
uint8_t fh_nh
Definition: decode-ipv6.h:221
IPV6OPT_HAO
#define IPV6OPT_HAO
Definition: decode-ipv6.h:166
Packet_::flags
uint32_t flags
Definition: decode.h:477
IPV6_DSTOPTS_UNKNOWN_OPT
@ IPV6_DSTOPTS_UNKNOWN_OPT
Definition: decode-events.h:82
IPV6OPT_PADN
#define IPV6OPT_PADN
Definition: decode-ipv6.h:163
IPV6_UNKNOWN_NEXT_HEADER
@ IPV6_UNKNOWN_NEXT_HEADER
Definition: decode-events.h:90
packet-queue.h
IPV6OPT_RA
#define IPV6OPT_RA
Definition: decode-ipv6.h:164
IPV6_DATA_AFTER_NONE_HEADER
@ IPV6_DATA_AFTER_NONE_HEADER
Definition: decode-events.h:88
IPV6_EXTHDR_SET_FH
#define IPV6_EXTHDR_SET_FH(p)
Definition: decode-ipv6.h:238
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:93
IPPROTO_GRE
#define IPPROTO_GRE
Definition: decode-gre.h:30
IPV6_FRAG_INVALID_LENGTH
@ IPV6_FRAG_INVALID_LENGTH
Definition: decode-events.h:172
IP_GET_RAW_VER
#define IP_GET_RAW_VER(pkt)
Definition: decode.h:260
IPV6_EXTHDR_DUPL_HH
@ IPV6_EXTHDR_DUPL_HH
Definition: decode-events.h:71
IPV6_SET_L4PROTO
#define IPV6_SET_L4PROTO(p, proto)
Definition: decode-ipv6.h:72
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:83
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:231
util-unittest.h
DecodeSCTP
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-sctp.c:66
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:82
IPV6ExtHdrs_::fh_id
uint32_t fh_id
Definition: decode-ipv6.h:234
IPV6OptHAO_::ip6hao_len
uint8_t ip6hao_len
Definition: decode-ipv6.h:172
IPV4_IN_IPV6_WRONG_IP_VER
@ IPV4_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:180
IPV6_GET_PLEN
#define IPV6_GET_PLEN(p)
Definition: decode-ipv6.h:88
CLEAR_IPV6_PACKET
#define CLEAR_IPV6_PACKET(p)
Definition: decode-ipv6.h:111
IPV6OPT_JUMBO
#define IPV6OPT_JUMBO
Definition: decode-ipv6.h:165
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1241
IPV6_EXTHDR_RH_TYPE_0
@ IPV6_EXTHDR_RH_TYPE_0
Definition: decode-events.h:85
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:523
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:712
IPV6_HOPOPTS_ONLY_PADDING
@ IPV6_HOPOPTS_ONLY_PADDING
Definition: decode-events.h:81
decode-ipv6.h
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
IPV6_TRUNC_EXTHDR
@ IPV6_TRUNC_EXTHDR
Definition: decode-events.h:67
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:206
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1209
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:101
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:236
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:274
pkt-var.h
IPV6ExtHdrs_::fh_more_frags_set
bool fh_more_frags_set
Definition: decode-ipv6.h:220
SET_IPV6_SRC_ADDR
#define SET_IPV6_SRC_ADDR(p, a)
Definition: decode.h:177
DecodeGRE
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode GRE packets.
Definition: decode-gre.c:47
decode-icmpv6.h
IPV6_GET_NH
#define IPV6_GET_NH(p)
Definition: decode-ipv6.h:86
util-profiling.h
SCReturn
#define SCReturn
Definition: util-debug.h:302
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:54
IPV6Hdr_
Definition: decode-ipv6.h:32
IPV6_EXTHDR_ZERO_LEN_PADN
@ IPV6_EXTHDR_ZERO_LEN_PADN
Definition: decode-events.h:86
Packet_
Definition: decode.h:442
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:572
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:992
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:235
IPV6ExtHdrs_::fh_offset
uint16_t fh_offset
Definition: decode-ipv6.h:233
IPV6_WITH_ICMPV4
@ IPV6_WITH_ICMPV4
Definition: decode-events.h:91
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:711
defrag.h
IPV6_EXTHDR_ISSET_RH
#define IPV6_EXTHDR_ISSET_RH(p)
Definition: decode-ipv6.h:241
IPV6_EXTHDR_DUPL_AH
@ IPV6_EXTHDR_DUPL_AH
Definition: decode-events.h:73
IPV6OptRA_
Definition: decode-ipv6.h:178
IPV6ExtHdrs_::fh_data_len
uint16_t fh_data_len
Definition: decode-ipv6.h:228
IPV6_IN_IPV6_PKT_TOO_SMALL
@ IPV6_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:183
IPV6_EXTHDR_DUPL_FH
@ IPV6_EXTHDR_DUPL_FH
Definition: decode-events.h:68
IPV6OptJumbo_::ip6j_payload_len
uint32_t ip6j_payload_len
Definition: decode-ipv6.h:189
decode-events.h
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
DecodeTCP
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-tcp.c:251
IPV6_IN_IPV6_WRONG_IP_VER
@ IPV6_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:184
IPV6_GET_FLOW
#define IPV6_GET_FLOW(p)
Definition: decode-ipv6.h:84
IPV6_HOPOPTS_UNKNOWN_OPT
@ IPV6_HOPOPTS_UNKNOWN_OPT
Definition: decode-events.h:80
IPV6_FH_NON_ZERO_RES_FIELD
@ IPV6_FH_NON_ZERO_RES_FIELD
Definition: decode-events.h:87
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:167
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
IPV6_GET_CLASS
#define IPV6_GET_CLASS(p)
Definition: decode-ipv6.h:82
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:395
DecodeICMPV6
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:189
suricata-common.h
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:689
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:670
IPV4_HEADER_LEN
#define IPV4_HEADER_LEN
Definition: decode-ipv4.h:28
IPV6OptHAO_::ip6hao_type
uint8_t ip6hao_type
Definition: decode-ipv6.h:171
IPV4_IN_IPV6_PKT_TOO_SMALL
@ IPV4_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:179
IPV6ExtHdrs_::fh_header_offset
uint16_t fh_header_offset
Definition: decode-ipv6.h:226
IPV6ExtHdrs_::fh_prev_hdr_offset
uint16_t fh_prev_hdr_offset
Definition: decode-ipv6.h:224
IPV6_WRONG_IP_VER
@ IPV6_WRONG_IP_VER
Definition: decode-events.h:77
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:173
PacketQueueNoLock_::len
uint32_t len
Definition: packet-queue.h:35
IPV6_SET_EXTHDRS_LEN
#define IPV6_SET_EXTHDRS_LEN(p, len)
Definition: decode-ipv6.h:73
IPV6OptRA_::ip6ra_len
uint8_t ip6ra_len
Definition: decode-ipv6.h:180
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:230
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:394
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:672
IPV6_TRUNC_PKT
@ IPV6_TRUNC_PKT
Definition: decode-events.h:66
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:110
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
IPV6OptJumbo_
Definition: decode-ipv6.h:186
IPV6OptRA_::ip6ra_type
uint8_t ip6ra_type
Definition: decode-ipv6.h:179
IPV6OptJumbo_::ip6j_len
uint8_t ip6j_len
Definition: decode-ipv6.h:188
Packet_::dst
Address dst
Definition: decode.h:447
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1077
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:43
IPV6OptJumbo_::ip6j_type
uint8_t ip6j_type
Definition: decode-ipv6.h:187
IPV6_HEADER_LEN
#define IPV6_HEADER_LEN
Definition: decode-ipv6.h:27
IPV6ExtHdrs_::rh_type
uint8_t rh_type
Definition: decode-ipv6.h:217
Packet_::ip6h
IPV6Hdr * ip6h
Definition: decode.h:542
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:311
Defrag
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:1009
IPV6_EXTHDR_AH_RES_NOT_NULL
@ IPV6_EXTHDR_AH_RES_NOT_NULL
Definition: decode-events.h:78
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:647
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:111
DecodeIPV6RegisterTests
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
Definition: decode-ipv6.c:907
IPV6OptHAO_
Definition: decode-ipv6.h:170
Packet_::src
Address src
Definition: decode.h:446
IPV6_DSTOPTS_ONLY_PADDING
@ IPV6_DSTOPTS_ONLY_PADDING
Definition: decode-events.h:83
DefragInit
void DefragInit(void)
Definition: defrag.c:1055
PACKET_RECYCLE
#define PACKET_RECYCLE(p)
Definition: decode.h:884
IPV6_EXTHDR_SET_RH
#define IPV6_EXTHDR_SET_RH(p)
Definition: decode-ipv6.h:240
Packet_::ip6eh
IPV6ExtHdrs ip6eh
Definition: decode.h:549
IPV6OPT_PAD1
#define IPV6OPT_PAD1
Definition: decode-ipv6.h:162