suricata
decode-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode IPv6
31  */
32 
33 #include "suricata-common.h"
34 #include "decode-ipv6.h"
35 #include "decode.h"
36 #include "defrag.h"
37 #include "util-print.h"
38 #include "util-validate.h"
39 
40 /**
41  * \brief Function to decode IPv4 in IPv6 packets
42  *
43  */
44 static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t plen)
45 {
46 
47  if (unlikely(plen < IPV4_HEADER_LEN)) {
48  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
49  return;
50  }
51  if (IP_GET_RAW_VER(pkt) == 4) {
52  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4);
53  if (tp != NULL) {
54  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
55  PacketEnqueueNoLock(&tv->decode_pq,tp);
56  StatsIncr(tv, dtv->counter_ipv4inipv6);
57  return;
58  }
59  } else {
60  ENGINE_SET_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER);
61  }
62  return;
63 }
64 
65 /**
66  * \brief Function to decode IPv6 in IPv6 packets
67  *
68  */
69 static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
70  const uint8_t *pkt, uint16_t plen)
71 {
72 
73  if (unlikely(plen < IPV6_HEADER_LEN)) {
74  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
75  return TM_ECODE_FAILED;
76  }
77  if (IP_GET_RAW_VER(pkt) == 6) {
78  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6);
79  if (tp != NULL) {
80  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
81  PacketEnqueueNoLock(&tv->decode_pq,tp);
82  StatsIncr(tv, dtv->counter_ipv6inipv6);
83  }
84  } else {
85  ENGINE_SET_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER);
86  }
87  return TM_ECODE_OK;
88 }
89 
90 #ifndef UNITTESTS // ugly, but we need this in defrag tests
91 static inline
92 #endif
93 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
94  uint16_t hdrextlen, uint16_t plen,
95  uint16_t prev_hdrextlen)
96 {
97  uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
98  int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
99 
100  p->ip6eh.fh_offset = frag_offset;
101  p->ip6eh.fh_more_frags_set = frag_morefrags ? true : false;
102  p->ip6eh.fh_nh = *pkt;
103 
104  uint32_t fh_id;
105  memcpy(&fh_id, pkt+4, 4);
106  p->ip6eh.fh_id = SCNtohl(fh_id);
107 
108  SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x",
109  p->ip6eh.fh_offset,
110  p->ip6eh.fh_more_frags_set ? "true" : "false",
111  p->ip6eh.fh_nh,
112  p->ip6eh.fh_id, p->ip6eh.fh_id);
113 
114  // store header offset, data offset
115  uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
116  uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
117  uint16_t data_len = plen - hdrextlen;
118 
119  p->ip6eh.fh_header_offset = frag_hdr_offset;
120  p->ip6eh.fh_data_offset = data_offset;
121  p->ip6eh.fh_data_len = data_len;
122 
123  /* if we have a prev hdr, store the type and offset of it */
124  if (prev_hdrextlen) {
125  p->ip6eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
126  }
127 
128  SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
129  p->ip6eh.fh_header_offset, p->ip6eh.fh_data_offset,
130  p->ip6eh.fh_data_len);
131 }
132 
133 static void
134 DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
135  const uint8_t *pkt, uint16_t len)
136 {
137  SCEnter();
138 
139  const uint8_t *orig_pkt = pkt;
140  uint8_t nh = IPV6_GET_NH(p); /* careful, 0 is actually a real type */
141  uint16_t hdrextlen = 0;
142  uint16_t plen = len;
143  char dstopts = 0;
144  char exthdr_fh_done = 0;
145  int hh = 0;
146  int rh = 0;
147  int ah = 0;
148 
149  while(1)
150  {
151  IPV6_SET_EXTHDRS_LEN(p, (len - plen));
152 
153  if (nh == IPPROTO_NONE) {
154  if (plen > 0) {
155  /* No upper layer, but we do have data. Suspicious. */
156  ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER);
157  }
158  SCReturn;
159  }
160 
161  if (plen < 2) { /* minimal needed in a hdr */
162  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
163  SCReturn;
164  }
165 
166  switch(nh)
167  {
168  case IPPROTO_TCP:
169  IPV6_SET_L4PROTO(p,nh);
170  DecodeTCP(tv, dtv, p, pkt, plen);
171  SCReturn;
172 
173  case IPPROTO_UDP:
174  IPV6_SET_L4PROTO(p,nh);
175  DecodeUDP(tv, dtv, p, pkt, plen);
176  SCReturn;
177 
178  case IPPROTO_ICMPV6:
179  IPV6_SET_L4PROTO(p,nh);
180  DecodeICMPV6(tv, dtv, p, pkt, plen);
181  SCReturn;
182 
183  case IPPROTO_SCTP:
184  IPV6_SET_L4PROTO(p,nh);
185  DecodeSCTP(tv, dtv, p, pkt, plen);
186  SCReturn;
187 
188  case IPPROTO_ROUTING:
189  IPV6_SET_L4PROTO(p,nh);
190  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
191 
192  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
193 
194  if (hdrextlen > plen) {
195  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
196  SCReturn;
197  }
198 
199  if (rh) {
200  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH);
201  /* skip past this extension so we can continue parsing the rest
202  * of the packet */
203  nh = *pkt;
204  pkt += hdrextlen;
205  plen -= hdrextlen;
206  break;
207  }
208 
209  rh = 1;
210  IPV6_EXTHDR_SET_RH(p);
211 
212  uint8_t ip6rh_type = *(pkt + 2);
213  if (ip6rh_type == 0) {
214  ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0);
215  }
216  p->ip6eh.rh_type = ip6rh_type;
217 
218  nh = *pkt;
219  pkt += hdrextlen;
220  plen -= hdrextlen;
221  break;
222 
223  case IPPROTO_HOPOPTS:
224  case IPPROTO_DSTOPTS:
225  {
226  IPV6OptHAO hao_s, *hao = &hao_s;
227  IPV6OptRA ra_s, *ra = &ra_s;
228  IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
229  uint16_t optslen = 0;
230 
231  IPV6_SET_L4PROTO(p,nh);
232  hdrextlen = (uint16_t)((*(pkt + 1) + 1) << 3);
233  if (hdrextlen > plen) {
234  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
235  SCReturn;
236  }
237 
238  const uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
239 
240  /* point the pointers to right structures
241  * in Packet. */
242  if (nh == IPPROTO_HOPOPTS) {
243  if (hh) {
244  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH);
245  /* skip past this extension so we can continue parsing the rest
246  * of the packet */
247  nh = *pkt;
248  pkt += hdrextlen;
249  plen -= hdrextlen;
250  break;
251  }
252 
253  hh = 1;
254 
255  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
256  }
257  else if (nh == IPPROTO_DSTOPTS)
258  {
259  if (dstopts == 0) {
260  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
261  dstopts = 1;
262  } else if (dstopts == 1) {
263  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
264  dstopts = 2;
265  } else {
266  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH);
267  /* skip past this extension so we can continue parsing the rest
268  * of the packet */
269  nh = *pkt;
270  pkt += hdrextlen;
271  plen -= hdrextlen;
272  break;
273  }
274  }
275 
276  if (optslen > plen) {
277  /* since the packet is long enough (we checked
278  * plen against hdrlen, the optlen must be malformed. */
279  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
280  /* skip past this extension so we can continue parsing the rest
281  * of the packet */
282  nh = *pkt;
283  pkt += hdrextlen;
284  plen -= hdrextlen;
285  break;
286  }
287 /** \todo move into own function to loaded on demand */
288  uint16_t padn_cnt = 0;
289  uint16_t other_cnt = 0;
290  uint16_t offset = 0;
291  while(offset < optslen)
292  {
293  if (*ptr == IPV6OPT_PAD1)
294  {
295  padn_cnt++;
296  offset++;
297  ptr++;
298  continue;
299  }
300 
301  if (offset + 1 >= optslen) {
302  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
303  break;
304  }
305 
306  /* length field for each opt */
307  uint8_t ip6_optlen = *(ptr + 1);
308 
309  /* see if the optlen from the packet fits the total optslen */
310  if ((offset + 1 + ip6_optlen) > optslen) {
311  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
312  break;
313  }
314 
315  if (*ptr == IPV6OPT_PADN) /* PadN */
316  {
317  //printf("PadN option\n");
318  padn_cnt++;
319 
320  /* a zero padN len would be weird */
321  if (ip6_optlen == 0)
322  ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN);
323  }
324  else if (*ptr == IPV6OPT_RA) /* RA */
325  {
326  ra->ip6ra_type = *(ptr);
327  ra->ip6ra_len = ip6_optlen;
328 
329  if (ip6_optlen < sizeof(ra->ip6ra_value)) {
330  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
331  break;
332  }
333 
334  memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
335  ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
336  //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
337  // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
338  other_cnt++;
339  }
340  else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
341  {
342  jumbo->ip6j_type = *(ptr);
343  jumbo->ip6j_len = ip6_optlen;
344 
345  if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
346  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
347  break;
348  }
349 
350  memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
351  jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
352  //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
353  // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
354  }
355  else if (*ptr == IPV6OPT_HAO) /* HAO */
356  {
357  hao->ip6hao_type = *(ptr);
358  hao->ip6hao_len = ip6_optlen;
359 
360  if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
361  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
362  break;
363  }
364 
365  memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa));
366  //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ",
367  // hao->ip6hao_type, hao->ip6hao_len);
368  //char addr_buf[46];
369  //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa),
370  // addr_buf,sizeof(addr_buf));
371  //printf("home addr %s\n", addr_buf);
372  other_cnt++;
373  } else {
374  if (nh == IPPROTO_HOPOPTS)
375  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT);
376  else
377  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT);
378 
379  other_cnt++;
380  }
381  uint16_t optlen = (*(ptr + 1) + 2);
382  ptr += optlen; /* +2 for opt type and opt len fields */
383  offset += optlen;
384  }
385  /* flag packets that have only padding */
386  if (padn_cnt > 0 && other_cnt == 0) {
387  if (nh == IPPROTO_HOPOPTS)
388  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING);
389  else
390  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING);
391  }
392 
393  nh = *pkt;
394  pkt += hdrextlen;
395  plen -= hdrextlen;
396  break;
397  }
398 
399  case IPPROTO_FRAGMENT:
400  {
401  IPV6_SET_L4PROTO(p,nh);
402  /* store the offset of this extension into the packet
403  * past the ipv6 header. We use it in defrag for creating
404  * a defragmented packet without the frag header */
405  if (exthdr_fh_done == 0) {
406  DEBUG_VALIDATE_BUG_ON(pkt - orig_pkt > UINT16_MAX);
407  p->ip6eh.fh_offset = (uint16_t)(pkt - orig_pkt);
408  exthdr_fh_done = 1;
409  }
410 
411  uint16_t prev_hdrextlen = hdrextlen;
412  hdrextlen = sizeof(IPV6FragHdr);
413  if (hdrextlen > plen) {
414  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
415  SCReturn;
416  }
417 
418  /* for the frag header, the length field is reserved */
419  if (*(pkt + 1) != 0) {
420  ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD);
421  /* non fatal, lets try to continue */
422  }
423 
424  if (IPV6_EXTHDR_ISSET_FH(p)) {
425  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH);
426  nh = *pkt;
427  pkt += hdrextlen;
428  plen -= hdrextlen;
429  break;
430  }
431 
432  /* set the header flag first */
433  IPV6_EXTHDR_SET_FH(p);
434 
435  /* parse the header and setup the vars */
436  DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
437 
438  /* if FH has offset 0 and no more fragments are coming, we
439  * parse this packet further right away, no defrag will be
440  * needed. It is a useless FH then though, so we do set an
441  * decoder event. */
442  if (p->ip6eh.fh_more_frags_set == 0 && p->ip6eh.fh_offset == 0) {
443  ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH);
444 
445  nh = *pkt;
446  pkt += hdrextlen;
447  plen -= hdrextlen;
448  break;
449  }
450  if (p->ip6eh.fh_more_frags_set != 0 && plen % 8 != 0) {
451  // cf https://datatracker.ietf.org/doc/html/rfc2460#section-4.5
452  // each, except possibly the last ("rightmost") one,
453  // being an integer multiple of 8 octets long.
454  ENGINE_SET_EVENT(p, IPV6_FRAG_INVALID_LENGTH);
455  }
456 
457  /* the rest is parsed upon reassembly */
458  p->flags |= PKT_IS_FRAGMENT;
459  SCReturn;
460  }
461  case IPPROTO_ESP:
462  {
463  IPV6_SET_L4PROTO(p,nh);
464  DecodeESP(tv, dtv, p, pkt, plen);
465  SCReturn;
466  }
467  case IPPROTO_AH:
468  {
469  IPV6_SET_L4PROTO(p,nh);
470  /* we need the header as a minimum */
471  hdrextlen = sizeof(IPV6AuthHdr);
472  /* the payload len field is the number of extra 4 byte fields,
473  * IPV6AuthHdr already contains the first */
474  if (*(pkt+1) > 0)
475  hdrextlen += ((*(pkt+1) - 1) * 4);
476 
477  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
478 
479  if (hdrextlen > plen) {
480  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
481  SCReturn;
482  }
483 
484  IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
485  if (ahhdr->ip6ah_reserved != 0x0000) {
486  ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL);
487  }
488 
489  if (ah) {
490  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH);
491  nh = *pkt;
492  pkt += hdrextlen;
493  plen -= hdrextlen;
494  break;
495  }
496 
497  ah = 1;
498 
499  nh = *pkt;
500  pkt += hdrextlen;
501  plen -= hdrextlen;
502  break;
503  }
504  case IPPROTO_IPIP:
505  IPV6_SET_L4PROTO(p,nh);
506  DecodeIPv4inIPv6(tv, dtv, p, pkt, plen);
507  SCReturn;
508  /* none, last header */
509  case IPPROTO_NONE:
510  IPV6_SET_L4PROTO(p,nh);
511  SCReturn;
512  case IPPROTO_ICMP:
513  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
514  SCReturn;
515  /* no parsing yet, just skip it */
516  case IPPROTO_MH:
517  case IPPROTO_HIP:
518  case IPPROTO_SHIM6:
519  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
520  if (hdrextlen > plen) {
521  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
522  SCReturn;
523  }
524  nh = *pkt;
525  pkt += hdrextlen;
526  plen -= hdrextlen;
527  break;
528  default:
529  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
530  IPV6_SET_L4PROTO(p,nh);
531  SCReturn;
532  }
533  }
534 
535  SCReturn;
536 }
537 
538 static int DecodeIPV6Packet (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
539 {
540  if (unlikely(len < IPV6_HEADER_LEN)) {
541  return -1;
542  }
543 
544  if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
545  SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
546  ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
547  return -1;
548  }
549 
550  p->ip6h = (IPV6Hdr *)pkt;
551 
552  if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_PLEN(p))))
553  {
554  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
555  return -1;
556  }
557 
558  SET_IPV6_SRC_ADDR(p,&p->src);
559  SET_IPV6_DST_ADDR(p,&p->dst);
560 
561  return 0;
562 }
563 
564 int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
565 {
566  StatsIncr(tv, dtv->counter_ipv6);
567 
568  if (!PacketIncreaseCheckLayers(p)) {
569  return TM_ECODE_FAILED;
570  }
571  /* do the actual decoding */
572  int ret = DecodeIPV6Packet (tv, dtv, p, pkt, len);
573  if (unlikely(ret < 0)) {
574  CLEAR_IPV6_PACKET(p);
575  return TM_ECODE_FAILED;
576  }
577  p->proto = IPV6_GET_NH(p);
578 
579 #ifdef DEBUG
580  if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
581  /* debug print */
582  char s[46], d[46];
583  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
584  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
585  SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32 " PLEN: %" PRIu32 " HLIM: %" PRIu32 "", s,d,
586  IPV6_GET_CLASS(p), IPV6_GET_FLOW(p), IPV6_GET_NH(p), IPV6_GET_PLEN(p),
587  IPV6_GET_HLIM(p));
588  }
589 #endif /* DEBUG */
590 
591  /* now process the Ext headers and/or the L4 Layer */
592  switch(IPV6_GET_NH(p)) {
593  case IPPROTO_TCP:
594  IPV6_SET_L4PROTO (p, IPPROTO_TCP);
595  DecodeTCP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
596  return TM_ECODE_OK;
597  case IPPROTO_UDP:
598  IPV6_SET_L4PROTO (p, IPPROTO_UDP);
599  DecodeUDP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
600  return TM_ECODE_OK;
601  case IPPROTO_ICMPV6:
602  IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
603  DecodeICMPV6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
604  return TM_ECODE_OK;
605  case IPPROTO_SCTP:
606  IPV6_SET_L4PROTO (p, IPPROTO_SCTP);
607  DecodeSCTP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
608  return TM_ECODE_OK;
609  case IPPROTO_IPIP:
610  IPV6_SET_L4PROTO(p, IPPROTO_IPIP);
611  DecodeIPv4inIPv6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
612  return TM_ECODE_OK;
613  case IPPROTO_IPV6:
614  DecodeIP6inIP6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
615  return TM_ECODE_OK;
616  case IPPROTO_GRE:
617  IPV6_SET_L4PROTO(p, IPPROTO_GRE);
618  DecodeGRE(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
619  break;
620  case IPPROTO_FRAGMENT:
621  case IPPROTO_HOPOPTS:
622  case IPPROTO_ROUTING:
623  case IPPROTO_NONE:
624  case IPPROTO_DSTOPTS:
625  case IPPROTO_AH:
626  case IPPROTO_ESP:
627  case IPPROTO_MH:
628  case IPPROTO_HIP:
629  case IPPROTO_SHIM6:
630  DecodeIPV6ExtHdrs(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
631  break;
632  case IPPROTO_ICMP:
633  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
634  break;
635  default:
636  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
637  IPV6_SET_L4PROTO (p, IPV6_GET_NH(p));
638  break;
639  }
640  p->proto = IPV6_GET_L4PROTO (p);
641 
642  /* Pass to defragger if a fragment. */
643  if (IPV6_EXTHDR_ISSET_FH(p)) {
644  Packet *rp = Defrag(tv, dtv, p);
645  if (rp != NULL) {
646  PacketEnqueueNoLock(&tv->decode_pq,rp);
647  }
648  }
649 
650  return TM_ECODE_OK;
651 }
652 
653 #ifdef UNITTESTS
654 #include "util-unittest-helper.h"
655 #include "packet.h"
656 
657 /**
658  * \test fragment decoding
659  */
660 static int DecodeIPV6FragTest01 (void)
661 {
662 
663  uint8_t raw_frag1[] = {
664  0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
665  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
666  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
667  0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
668  0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
669  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
670  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
671  0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
672  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
673  0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
674  0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
675  0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
676  0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
677  0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
678  0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
679  0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
680  0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
681  0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
682  0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
683  0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
684  0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
685  0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
686  0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
687  0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
688  0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
689  0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
690  0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
691  0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
692  0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
693  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
694  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
695  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
696  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
697  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
698  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
699  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
700  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
701  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
702  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
703  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
704  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
705  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
706  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
707  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
708  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
748  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
749  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
750  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
751  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
752  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
753  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
754  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
755  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
756  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
757  };
758  uint8_t raw_frag2[] = {
759  0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
760  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
761  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
762  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
763  0x20, 0x20, 0x20, 0x20,
764  };
765  Packet *pkt;
766  Packet *p1 = PacketGetFromAlloc();
767  if (unlikely(p1 == NULL))
768  return 0;
769  Packet *p2 = PacketGetFromAlloc();
770  if (unlikely(p2 == NULL)) {
771  SCFree(p1);
772  return 0;
773  }
774  ThreadVars tv;
775  DecodeThreadVars dtv;
776  int result = 0;
777 
778  FlowInitConfig(FLOW_QUIET);
779  DefragInit();
780 
781  memset(&tv, 0, sizeof(ThreadVars));
782  memset(&dtv, 0, sizeof(DecodeThreadVars));
783 
784  PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
785  PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
786 
787  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
788 
789  if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
790  printf("ipv6 frag header not detected: ");
791  goto end;
792  }
793 
794  DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2));
795 
796  if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
797  printf("ipv6 frag header not detected: ");
798  goto end;
799  }
800 
801  if (tv.decode_pq.len != 1) {
802  printf("no reassembled packet: ");
803  goto end;
804  }
805 
806  result = 1;
807 end:
808  PacketRecycle(p1);
809  PacketRecycle(p2);
810  SCFree(p1);
811  SCFree(p2);
812  pkt = PacketDequeueNoLock(&tv.decode_pq);
813  while (pkt != NULL) {
814  PacketRecycle(pkt);
815  SCFree(pkt);
816  pkt = PacketDequeueNoLock(&tv.decode_pq);
817  }
818  DefragDestroy();
819  FlowShutdown();
820  return result;
821 }
822 
823 /**
824  * \test routing header decode
825  */
826 static int DecodeIPV6RouteTest01 (void)
827 {
828  uint8_t raw_pkt1[] = {
829  0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
830  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
831  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
832  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
833  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
834  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
835 
836  0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
837  0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
838  0xfa, 0x87, 0x00, 0x00,
839  };
840  Packet *p1 = PacketGetFromAlloc();
841  FAIL_IF(unlikely(p1 == NULL));
842  ThreadVars tv;
843  DecodeThreadVars dtv;
844 
845  FlowInitConfig(FLOW_QUIET);
846 
847  memset(&tv, 0, sizeof(ThreadVars));
848  memset(&dtv, 0, sizeof(DecodeThreadVars));
849 
850  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
851 
852  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
853 
854  FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1)));
855  FAIL_IF (p1->ip6eh.rh_type != 0);
856  PacketRecycle(p1);
857  SCFree(p1);
858  FlowShutdown();
859  PASS;
860 }
861 
862 /**
863  * \test HOP header decode
864  */
865 static int DecodeIPV6HopTest01 (void)
866 {
867  uint8_t raw_pkt1[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x01, 0xfe, 0x80, 0x00, 0x00,
868  0x00, 0x00, 0x00, 0x00, 0x02, 0x0f, 0xfe, 0xff, 0xfe, 0x98, 0x3d, 0x01, 0xff, 0x02, 0x00,
869  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x3a, 0x00,
870  0xff, /* 0xff is a nonsense opt */
871  0x02, 0x00, 0x00, 0x00, 0x00, 0x82, 0x00, 0x1c, 0x6f, 0x27, 0x10, 0x00, 0x00, 0x00, 0x00,
872  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
873  Packet *p1 = PacketGetFromAlloc();
874  FAIL_IF(unlikely(p1 == NULL));
875  ThreadVars tv;
876  DecodeThreadVars dtv;
877 
878  FlowInitConfig(FLOW_QUIET);
879 
880  memset(&tv, 0, sizeof(ThreadVars));
881  memset(&dtv, 0, sizeof(DecodeThreadVars));
882 
883  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
884 
885  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
886 
887  FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
888 
889  PacketRecycle(p1);
890  SCFree(p1);
891  FlowShutdown();
892  PASS;
893 }
894 
895 #endif /* UNITTESTS */
896 
897 /**
898  * \brief this function registers unit tests for IPV6 decoder
899  */
900 
901 void DecodeIPV6RegisterTests(void)
902 {
903 #ifdef UNITTESTS
904  UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
905  UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
906  UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
907 #endif /* UNITTESTS */
908 }
909 
910 /**
911  * @}
912  */
IPV6_FRAG_INVALID_LENGTH
@ IPV6_FRAG_INVALID_LENGTH
Definition: decode-events.h:173
IPV4_IN_IPV6_WRONG_IP_VER
@ IPV4_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:181
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:904
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1119
IPV6ExtHdrs_::fh_data_offset
uint16_t fh_data_offset
Definition: decode-ipv6.h:227
Packet_::proto
uint8_t proto
Definition: decode.h:459
len
uint8_t len
Definition: app-layer-dnp3.h:2
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:828
IPV4_IN_IPV6_PKT_TOO_SMALL
@ IPV4_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:180
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:167
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:348
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DecodeESP
int DecodeESP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Function to decode IPSEC-ESP packets.
Definition: decode-esp.c:64
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:919
ip6rh_type
uint8_t ip6rh_type
Definition: decode-ipv6.h:3
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
IPV6_DSTOPTS_UNKNOWN_OPT
@ IPV6_DSTOPTS_UNKNOWN_OPT
Definition: decode-events.h:82
IPV6OptRA_::ip6ra_value
uint16_t ip6ra_value
Definition: decode-ipv6.h:181
IPV6OptHAO_::ip6hao_hoa
struct in6_addr ip6hao_hoa
Definition: decode-ipv6.h:173
IPV6_EXTHDR_ISSET_FH
#define IPV6_EXTHDR_ISSET_FH(p)
Definition: decode-ipv6.h:239
SET_IPV6_DST_ADDR
#define SET_IPV6_DST_ADDR(p, a)
Definition: decode.h:170
IPV6ExtHdrs_::fh_nh
uint8_t fh_nh
Definition: decode-ipv6.h:221
IPV6OPT_HAO
#define IPV6OPT_HAO
Definition: decode-ipv6.h:166
Packet_::flags
uint32_t flags
Definition: decode.h:474
PacketRecycle
void PacketRecycle(Packet *p)
Definition: packet.c:169
IPV6OPT_PADN
#define IPV6OPT_PADN
Definition: decode-ipv6.h:163
IPV6_EXTHDR_USELESS_FH
@ IPV6_EXTHDR_USELESS_FH
Definition: decode-events.h:69
IPV6OPT_RA
#define IPV6OPT_RA
Definition: decode-ipv6.h:164
IPV6_EXTHDR_SET_FH
#define IPV6_EXTHDR_SET_FH(p)
Definition: decode-ipv6.h:238
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:93
IPPROTO_GRE
#define IPPROTO_GRE
Definition: decode-gre.h:30
IP_GET_RAW_VER
#define IP_GET_RAW_VER(pkt)
Definition: decode.h:244
IPV6_SET_L4PROTO
#define IPV6_SET_L4PROTO(p, proto)
Definition: decode-ipv6.h:72
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
IPV6_EXTHDR_DUPL_HH
@ IPV6_EXTHDR_DUPL_HH
Definition: decode-events.h:71
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:216
IPV6_IN_IPV6_PKT_TOO_SMALL
@ IPV6_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:184
IPV6_IN_IPV6_WRONG_IP_VER
@ IPV6_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:185
DecodeSCTP
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-sctp.c:66
util-unittest-helper.h
IPV6_HOPOPTS_ONLY_PADDING
@ IPV6_HOPOPTS_ONLY_PADDING
Definition: decode-events.h:81
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
IPV6ExtHdrs_::fh_id
uint32_t fh_id
Definition: decode-ipv6.h:234
IPV6OptHAO_::ip6hao_len
uint8_t ip6hao_len
Definition: decode-ipv6.h:172
IPV6_GET_PLEN
#define IPV6_GET_PLEN(p)
Definition: decode-ipv6.h:88
CLEAR_IPV6_PACKET
#define CLEAR_IPV6_PACKET(p)
Definition: decode-ipv6.h:111
IPV6OPT_JUMBO
#define IPV6OPT_JUMBO
Definition: decode-ipv6.h:165
IPV6_DATA_AFTER_NONE_HEADER
@ IPV6_DATA_AFTER_NONE_HEADER
Definition: decode-events.h:88
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1078
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:537
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:731
IPV6_FH_NON_ZERO_RES_FIELD
@ IPV6_FH_NON_ZERO_RES_FIELD
Definition: decode-events.h:87
decode-ipv6.h
IPV6_UNKNOWN_NEXT_HEADER
@ IPV6_UNKNOWN_NEXT_HEADER
Definition: decode-events.h:90
decode.h
IPPROTO_SHIM6
#define IPPROTO_SHIM6
Definition: decode.h:961
IPV6_TRUNC_EXTHDR
@ IPV6_TRUNC_EXTHDR
Definition: decode-events.h:67
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
IPV6_TRUNC_PKT
@ IPV6_TRUNC_PKT
Definition: decode-events.h:66
IPV6_EXTHDR_DUPL_FH
@ IPV6_EXTHDR_DUPL_FH
Definition: decode-events.h:68
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:208
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1046
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:93
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:221
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:241
IPV6ExtHdrs_::fh_more_frags_set
bool fh_more_frags_set
Definition: decode-ipv6.h:220
SET_IPV6_SRC_ADDR
#define SET_IPV6_SRC_ADDR(p, a)
Definition: decode.h:162
DecodeGRE
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode GRE packets.
Definition: decode-gre.c:47
IPV6_EXTHDR_DUPL_RH
@ IPV6_EXTHDR_DUPL_RH
Definition: decode-events.h:70
IPV6_EXTHDR_AH_RES_NOT_NULL
@ IPV6_EXTHDR_AH_RES_NOT_NULL
Definition: decode-events.h:78
IPV6_GET_NH
#define IPV6_GET_NH(p)
Definition: decode-ipv6.h:86
SCReturn
#define SCReturn
Definition: util-debug.h:273
IPV6_EXTHDR_RH_TYPE_0
@ IPV6_EXTHDR_RH_TYPE_0
Definition: decode-events.h:85
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:58
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:437
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:564
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:827
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:220
IPV6ExtHdrs_::fh_offset
uint16_t fh_offset
Definition: decode-ipv6.h:233
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:730
IPPROTO_HIP
#define IPPROTO_HIP
Definition: decode.h:957
IPV6_EXTHDR_DUPL_DH
@ IPV6_EXTHDR_DUPL_DH
Definition: decode-events.h:72
defrag.h
IPV6_EXTHDR_ISSET_RH
#define IPV6_EXTHDR_ISSET_RH(p)
Definition: decode-ipv6.h:241
IPV6OptRA_
Definition: decode-ipv6.h:178
IPV6ExtHdrs_::fh_data_len
uint16_t fh_data_len
Definition: decode-ipv6.h:228
IPV6OptJumbo_::ip6j_payload_len
uint32_t ip6j_payload_len
Definition: decode-ipv6.h:189
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
DecodeTCP
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-tcp.c:248
IPV6_DSTOPTS_ONLY_PADDING
@ IPV6_DSTOPTS_ONLY_PADDING
Definition: decode-events.h:83
IPV6_EXTHDR_ZERO_LEN_PADN
@ IPV6_EXTHDR_ZERO_LEN_PADN
Definition: decode-events.h:86
IPV6_GET_FLOW
#define IPV6_GET_FLOW(p)
Definition: decode-ipv6.h:84
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:168
IPPROTO_IPIP
#define IPPROTO_IPIP
Definition: decode.h:932
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
IPV6_GET_CLASS
#define IPV6_GET_CLASS(p)
Definition: decode-ipv6.h:82
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:414
DecodeICMPV6
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:178
suricata-common.h
IPV6_WRONG_IP_VER
@ IPV6_WRONG_IP_VER
Definition: decode-events.h:77
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:702
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:685
IPV4_HEADER_LEN
#define IPV4_HEADER_LEN
Definition: decode-ipv4.h:28
IPV6OptHAO_::ip6hao_type
uint8_t ip6hao_type
Definition: decode-ipv6.h:171
packet.h
IPV6ExtHdrs_::fh_header_offset
uint16_t fh_header_offset
Definition: decode-ipv6.h:226
IPV6ExtHdrs_::fh_prev_hdr_offset
uint16_t fh_prev_hdr_offset
Definition: decode-ipv6.h:224
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:229
PacketQueueNoLock_::len
uint32_t len
Definition: packet-queue.h:37
IPV6_SET_EXTHDRS_LEN
#define IPV6_SET_EXTHDRS_LEN(p, len)
Definition: decode-ipv6.h:73
IPV6OptRA_::ip6ra_len
uint8_t ip6ra_len
Definition: decode-ipv6.h:180
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:215
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:413
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:685
IPV6_EXTHDR_DUPL_AH
@ IPV6_EXTHDR_DUPL_AH
Definition: decode-events.h:73
IPV6_WITH_ICMPV4
@ IPV6_WITH_ICMPV4
Definition: decode-events.h:91
IPPROTO_MH
#define IPPROTO_MH
Definition: decode.h:952
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:111
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
IPV6OptJumbo_
Definition: decode-ipv6.h:186
IPV6OptRA_::ip6ra_type
uint8_t ip6ra_type
Definition: decode-ipv6.h:179
IPV6OptJumbo_::ip6j_len
uint8_t ip6j_len
Definition: decode-ipv6.h:188
Packet_::dst
Address dst
Definition: decode.h:442
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:912
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:42
IPV6OptJumbo_::ip6j_type
uint8_t ip6j_type
Definition: decode-ipv6.h:187
IPV6_HEADER_LEN
#define IPV6_HEADER_LEN
Definition: decode-ipv6.h:27
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:948
IPV6ExtHdrs_::rh_type
uint8_t rh_type
Definition: decode-ipv6.h:217
Packet_::ip6h
IPV6Hdr * ip6h
Definition: decode.h:547
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:364
Defrag
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:1049
IPV6_EXTHDR_INVALID_OPTLEN
@ IPV6_EXTHDR_INVALID_OPTLEN
Definition: decode-events.h:76
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:771
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:103
DecodeIPV6RegisterTests
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
Definition: decode-ipv6.c:901
IPV6OptHAO_
Definition: decode-ipv6.h:170
Packet_::src
Address src
Definition: decode.h:441
DefragInit
void DefragInit(void)
Definition: defrag.c:1099
IPV6_EXTHDR_SET_RH
#define IPV6_EXTHDR_SET_RH(p)
Definition: decode-ipv6.h:240
Packet_::ip6eh
IPV6ExtHdrs ip6eh
Definition: decode.h:554
IPV6_HOPOPTS_UNKNOWN_OPT
@ IPV6_HOPOPTS_UNKNOWN_OPT
Definition: decode-events.h:80
IPV6OPT_PAD1
#define IPV6OPT_PAD1
Definition: decode-ipv6.h:162