suricata
decode-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode IPv6
31  */
32 
33 #include "suricata-common.h"
34 #include "packet-queue.h"
35 #include "decode.h"
36 #include "decode-ipv6.h"
37 #include "decode-icmpv6.h"
38 #include "decode-events.h"
39 #include "defrag.h"
40 #include "pkt-var.h"
41 #include "util-debug.h"
42 #include "util-print.h"
43 #include "util-unittest.h"
44 #include "util-profiling.h"
45 #include "host.h"
46 
47 #define IPV6_EXTHDRS ip6eh.ip6_exthdrs
48 #define IPV6_EH_CNT ip6eh.ip6_exthdrs_cnt
49 
50 /**
51  * \brief Function to decode IPv4 in IPv6 packets
52  *
53  */
54 static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t plen, PacketQueue *pq)
55 {
56 
57  if (unlikely(plen < IPV4_HEADER_LEN)) {
58  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
59  return;
60  }
61  if (IP_GET_RAW_VER(pkt) == 4) {
62  if (pq != NULL) {
63  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4, pq);
64  if (tp != NULL) {
65  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
66  /* add the tp to the packet queue. */
67  PacketEnqueue(pq,tp);
68  StatsIncr(tv, dtv->counter_ipv4inipv6);
69  return;
70  }
71  }
72  } else {
73  ENGINE_SET_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER);
74  }
75  return;
76 }
77 
78 /**
79  * \brief Function to decode IPv6 in IPv6 packets
80  *
81  */
82 static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t plen, PacketQueue *pq)
83 {
84 
85  if (unlikely(plen < IPV6_HEADER_LEN)) {
86  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
87  return TM_ECODE_FAILED;
88  }
89  if (IP_GET_RAW_VER(pkt) == 6) {
90  if (unlikely(pq != NULL)) {
91  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6, pq);
92  if (tp != NULL) {
93  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
94  PacketEnqueue(pq,tp);
95  StatsIncr(tv, dtv->counter_ipv6inipv6);
96  }
97  }
98  } else {
99  ENGINE_SET_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER);
100  }
101  return TM_ECODE_OK;
102 }
103 
104 #ifndef UNITTESTS // ugly, but we need this in defrag tests
105 static inline
106 #endif
107 void DecodeIPV6FragHeader(Packet *p, uint8_t *pkt,
108  uint16_t hdrextlen, uint16_t plen,
109  uint16_t prev_hdrextlen)
110 {
111  uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
112  int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
113 
114  p->ip6eh.fh_offset = frag_offset;
115  p->ip6eh.fh_more_frags_set = frag_morefrags ? TRUE : FALSE;
116  p->ip6eh.fh_nh = *pkt;
117 
118  uint32_t fh_id;
119  memcpy(&fh_id, pkt+4, 4);
120  p->ip6eh.fh_id = SCNtohl(fh_id);
121 
122  SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x",
123  p->ip6eh.fh_offset,
124  p->ip6eh.fh_more_frags_set ? "true" : "false",
125  p->ip6eh.fh_nh,
126  p->ip6eh.fh_id, p->ip6eh.fh_id);
127 
128  // store header offset, data offset
129  uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
130  uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
131  uint16_t data_len = plen - hdrextlen;
132 
133  p->ip6eh.fh_header_offset = frag_hdr_offset;
134  p->ip6eh.fh_data_offset = data_offset;
135  p->ip6eh.fh_data_len = data_len;
136 
137  /* if we have a prev hdr, store the type and offset of it */
138  if (prev_hdrextlen) {
139  p->ip6eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
140  }
141 
142  SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
143  p->ip6eh.fh_header_offset, p->ip6eh.fh_data_offset,
144  p->ip6eh.fh_data_len);
145 }
146 
147 static void
148 DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
149 {
150  SCEnter();
151 
152  uint8_t *orig_pkt = pkt;
153  uint8_t nh = IPV6_GET_NH(p); /* careful, 0 is actually a real type */
154  uint16_t hdrextlen = 0;
155  uint16_t plen = len;
156  char dstopts = 0;
157  char exthdr_fh_done = 0;
158  int hh = 0;
159  int rh = 0;
160  int eh = 0;
161  int ah = 0;
162 
163  while(1)
164  {
165  if (nh == IPPROTO_NONE) {
166  if (plen > 0) {
167  /* No upper layer, but we do have data. Suspicious. */
168  ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER);
169  }
170  SCReturn;
171  }
172 
173  if (plen < 2) { /* minimal needed in a hdr */
174  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
175  SCReturn;
176  }
177 
178  switch(nh)
179  {
180  case IPPROTO_TCP:
181  IPV6_SET_L4PROTO(p,nh);
182  DecodeTCP(tv, dtv, p, pkt, plen, pq);
183  SCReturn;
184 
185  case IPPROTO_UDP:
186  IPV6_SET_L4PROTO(p,nh);
187  DecodeUDP(tv, dtv, p, pkt, plen, pq);
188  SCReturn;
189 
190  case IPPROTO_ICMPV6:
191  IPV6_SET_L4PROTO(p,nh);
192  DecodeICMPV6(tv, dtv, p, pkt, plen, pq);
193  SCReturn;
194 
195  case IPPROTO_SCTP:
196  IPV6_SET_L4PROTO(p,nh);
197  DecodeSCTP(tv, dtv, p, pkt, plen, pq);
198  SCReturn;
199 
200  case IPPROTO_ROUTING:
201  IPV6_SET_L4PROTO(p,nh);
202  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
203 
204  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
205 
206  if (hdrextlen > plen) {
207  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
208  SCReturn;
209  }
210 
211  if (rh) {
212  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH);
213  /* skip past this extension so we can continue parsing the rest
214  * of the packet */
215  nh = *pkt;
216  pkt += hdrextlen;
217  plen -= hdrextlen;
218  break;
219  }
220 
221  rh = 1;
222  IPV6_EXTHDR_SET_RH(p);
223 
224  uint8_t ip6rh_type = *(pkt + 2);
225  if (ip6rh_type == 0) {
226  ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0);
227  }
228  p->ip6eh.rh_type = ip6rh_type;
229 
230  nh = *pkt;
231  pkt += hdrextlen;
232  plen -= hdrextlen;
233  break;
234 
235  case IPPROTO_HOPOPTS:
236  case IPPROTO_DSTOPTS:
237  {
238  IPV6OptHAO hao_s, *hao = &hao_s;
239  IPV6OptRA ra_s, *ra = &ra_s;
240  IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
241  uint16_t optslen = 0;
242 
243  IPV6_SET_L4PROTO(p,nh);
244  hdrextlen = (*(pkt+1) + 1) << 3;
245  if (hdrextlen > plen) {
246  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
247  SCReturn;
248  }
249 
250  uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
251 
252  /* point the pointers to right structures
253  * in Packet. */
254  if (nh == IPPROTO_HOPOPTS) {
255  if (hh) {
256  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH);
257  /* skip past this extension so we can continue parsing the rest
258  * of the packet */
259  nh = *pkt;
260  pkt += hdrextlen;
261  plen -= hdrextlen;
262  break;
263  }
264 
265  hh = 1;
266 
267  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
268  }
269  else if (nh == IPPROTO_DSTOPTS)
270  {
271  if (dstopts == 0) {
272  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
273  dstopts = 1;
274  } else if (dstopts == 1) {
275  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
276  dstopts = 2;
277  } else {
278  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH);
279  /* skip past this extension so we can continue parsing the rest
280  * of the packet */
281  nh = *pkt;
282  pkt += hdrextlen;
283  plen -= hdrextlen;
284  break;
285  }
286  }
287 
288  if (optslen > plen) {
289  /* since the packet is long enough (we checked
290  * plen against hdrlen, the optlen must be malformed. */
291  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
292  /* skip past this extension so we can continue parsing the rest
293  * of the packet */
294  nh = *pkt;
295  pkt += hdrextlen;
296  plen -= hdrextlen;
297  break;
298  }
299 /** \todo move into own function to loaded on demand */
300  uint16_t padn_cnt = 0;
301  uint16_t other_cnt = 0;
302  uint16_t offset = 0;
303  while(offset < optslen)
304  {
305  if (*ptr == IPV6OPT_PAD1)
306  {
307  padn_cnt++;
308  offset++;
309  ptr++;
310  continue;
311  }
312 
313  if (offset + 1 >= optslen) {
314  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
315  break;
316  }
317 
318  /* length field for each opt */
319  uint8_t ip6_optlen = *(ptr + 1);
320 
321  /* see if the optlen from the packet fits the total optslen */
322  if ((offset + 1 + ip6_optlen) > optslen) {
323  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
324  break;
325  }
326 
327  if (*ptr == IPV6OPT_PADN) /* PadN */
328  {
329  //printf("PadN option\n");
330  padn_cnt++;
331 
332  /* a zero padN len would be weird */
333  if (ip6_optlen == 0)
334  ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN);
335  }
336  else if (*ptr == IPV6OPT_RA) /* RA */
337  {
338  ra->ip6ra_type = *(ptr);
339  ra->ip6ra_len = ip6_optlen;
340 
341  if (ip6_optlen < sizeof(ra->ip6ra_value)) {
342  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
343  break;
344  }
345 
346  memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
347  ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
348  //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
349  // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
350  other_cnt++;
351  }
352  else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
353  {
354  jumbo->ip6j_type = *(ptr);
355  jumbo->ip6j_len = ip6_optlen;
356 
357  if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
358  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
359  break;
360  }
361 
362  memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
363  jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
364  //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
365  // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
366  }
367  else if (*ptr == IPV6OPT_HAO) /* HAO */
368  {
369  hao->ip6hao_type = *(ptr);
370  hao->ip6hao_len = ip6_optlen;
371 
372  if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
373  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
374  break;
375  }
376 
377  memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa));
378  //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ",
379  // hao->ip6hao_type, hao->ip6hao_len);
380  //char addr_buf[46];
381  //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa),
382  // addr_buf,sizeof(addr_buf));
383  //printf("home addr %s\n", addr_buf);
384  other_cnt++;
385  } else {
386  if (nh == IPPROTO_HOPOPTS)
387  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT);
388  else
389  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT);
390 
391  other_cnt++;
392  }
393  uint16_t optlen = (*(ptr + 1) + 2);
394  ptr += optlen; /* +2 for opt type and opt len fields */
395  offset += optlen;
396  }
397  /* flag packets that have only padding */
398  if (padn_cnt > 0 && other_cnt == 0) {
399  if (nh == IPPROTO_HOPOPTS)
400  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING);
401  else
402  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING);
403  }
404 
405  nh = *pkt;
406  pkt += hdrextlen;
407  plen -= hdrextlen;
408  break;
409  }
410 
411  case IPPROTO_FRAGMENT:
412  {
413  IPV6_SET_L4PROTO(p,nh);
414  /* store the offset of this extension into the packet
415  * past the ipv6 header. We use it in defrag for creating
416  * a defragmented packet without the frag header */
417  if (exthdr_fh_done == 0) {
418  p->ip6eh.fh_offset = pkt - orig_pkt;
419  exthdr_fh_done = 1;
420  }
421 
422  uint16_t prev_hdrextlen = hdrextlen;
423  hdrextlen = sizeof(IPV6FragHdr);
424  if (hdrextlen > plen) {
425  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
426  SCReturn;
427  }
428 
429  /* for the frag header, the length field is reserved */
430  if (*(pkt + 1) != 0) {
431  ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD);
432  /* non fatal, lets try to continue */
433  }
434 
435  if (IPV6_EXTHDR_ISSET_FH(p)) {
436  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH);
437  nh = *pkt;
438  pkt += hdrextlen;
439  plen -= hdrextlen;
440  break;
441  }
442 
443  /* set the header flag first */
444  IPV6_EXTHDR_SET_FH(p);
445 
446  /* parse the header and setup the vars */
447  DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
448 
449  /* if FH has offset 0 and no more fragments are coming, we
450  * parse this packet further right away, no defrag will be
451  * needed. It is a useless FH then though, so we do set an
452  * decoder event. */
453  if (p->ip6eh.fh_more_frags_set == 0 && p->ip6eh.fh_offset == 0) {
454  ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH);
455 
456  nh = *pkt;
457  pkt += hdrextlen;
458  plen -= hdrextlen;
459  break;
460  }
461 
462  /* the rest is parsed upon reassembly */
463  p->flags |= PKT_IS_FRAGMENT;
464  SCReturn;
465  }
466  case IPPROTO_ESP:
467  {
468  IPV6_SET_L4PROTO(p,nh);
469  hdrextlen = sizeof(IPV6EspHdr);
470  if (hdrextlen > plen) {
471  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
472  SCReturn;
473  }
474 
475  if (eh) {
476  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_EH);
477  SCReturn;
478  }
479 
480  eh = 1;
481 
482  nh = IPPROTO_NONE;
483  pkt += hdrextlen;
484  plen -= hdrextlen;
485  break;
486  }
487  case IPPROTO_AH:
488  {
489  IPV6_SET_L4PROTO(p,nh);
490  /* we need the header as a minimum */
491  hdrextlen = sizeof(IPV6AuthHdr);
492  /* the payload len field is the number of extra 4 byte fields,
493  * IPV6AuthHdr already contains the first */
494  if (*(pkt+1) > 0)
495  hdrextlen += ((*(pkt+1) - 1) * 4);
496 
497  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
498 
499  if (hdrextlen > plen) {
500  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
501  SCReturn;
502  }
503 
504  IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
505  if (ahhdr->ip6ah_reserved != 0x0000) {
506  ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL);
507  }
508 
509  if (ah) {
510  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH);
511  nh = *pkt;
512  pkt += hdrextlen;
513  plen -= hdrextlen;
514  break;
515  }
516 
517  ah = 1;
518 
519  nh = *pkt;
520  pkt += hdrextlen;
521  plen -= hdrextlen;
522  break;
523  }
524  case IPPROTO_IPIP:
525  IPV6_SET_L4PROTO(p,nh);
526  DecodeIPv4inIPv6(tv, dtv, p, pkt, plen, pq);
527  SCReturn;
528  /* none, last header */
529  case IPPROTO_NONE:
530  IPV6_SET_L4PROTO(p,nh);
531  SCReturn;
532  case IPPROTO_ICMP:
533  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
534  SCReturn;
535  /* no parsing yet, just skip it */
536  case IPPROTO_MH:
537  case IPPROTO_HIP:
538  case IPPROTO_SHIM6:
539  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
540  if (hdrextlen > plen) {
541  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
542  SCReturn;
543  }
544  nh = *pkt;
545  pkt += hdrextlen;
546  plen -= hdrextlen;
547  break;
548  default:
549  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
550  IPV6_SET_L4PROTO(p,nh);
551  SCReturn;
552  }
553  }
554 
555  SCReturn;
556 }
557 
558 static int DecodeIPV6Packet (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len)
559 {
560  if (unlikely(len < IPV6_HEADER_LEN)) {
561  return -1;
562  }
563 
564  if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
565  SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
566  ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
567  return -1;
568  }
569 
570  p->ip6h = (IPV6Hdr *)pkt;
571 
572  if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_PLEN(p))))
573  {
574  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
575  return -1;
576  }
577 
578  SET_IPV6_SRC_ADDR(p,&p->src);
579  SET_IPV6_DST_ADDR(p,&p->dst);
580 
581  return 0;
582 }
583 
584 int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
585 {
586  int ret;
587 
588  StatsIncr(tv, dtv->counter_ipv6);
589 
590  /* do the actual decoding */
591  ret = DecodeIPV6Packet (tv, dtv, p, pkt, len);
592  if (unlikely(ret < 0)) {
593  p->ip6h = NULL;
594  return TM_ECODE_FAILED;
595  }
596 
597 #ifdef DEBUG
598  if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
599  /* debug print */
600  char s[46], d[46];
601  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
602  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
603  SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32 " PLEN: %" PRIu32 " HLIM: %" PRIu32 "", s,d,
604  IPV6_GET_CLASS(p), IPV6_GET_FLOW(p), IPV6_GET_NH(p), IPV6_GET_PLEN(p),
605  IPV6_GET_HLIM(p));
606  }
607 #endif /* DEBUG */
608 
609  /* now process the Ext headers and/or the L4 Layer */
610  switch(IPV6_GET_NH(p)) {
611  case IPPROTO_TCP:
612  IPV6_SET_L4PROTO (p, IPPROTO_TCP);
613  DecodeTCP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
614  return TM_ECODE_OK;
615  case IPPROTO_UDP:
616  IPV6_SET_L4PROTO (p, IPPROTO_UDP);
617  DecodeUDP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
618  return TM_ECODE_OK;
619  case IPPROTO_ICMPV6:
620  IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
621  DecodeICMPV6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
622  return TM_ECODE_OK;
623  case IPPROTO_SCTP:
624  IPV6_SET_L4PROTO (p, IPPROTO_SCTP);
625  DecodeSCTP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
626  return TM_ECODE_OK;
627  case IPPROTO_IPIP:
628  IPV6_SET_L4PROTO(p, IPPROTO_IPIP);
629  DecodeIPv4inIPv6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
630  return TM_ECODE_OK;
631  case IPPROTO_IPV6:
632  DecodeIP6inIP6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
633  return TM_ECODE_OK;
634  case IPPROTO_GRE:
635  DecodeGRE(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
636  break;
637  case IPPROTO_FRAGMENT:
638  case IPPROTO_HOPOPTS:
639  case IPPROTO_ROUTING:
640  case IPPROTO_NONE:
641  case IPPROTO_DSTOPTS:
642  case IPPROTO_AH:
643  case IPPROTO_ESP:
644  case IPPROTO_MH:
645  case IPPROTO_HIP:
646  case IPPROTO_SHIM6:
647  DecodeIPV6ExtHdrs(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
648  break;
649  case IPPROTO_ICMP:
650  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
651  break;
652  default:
653  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
654  IPV6_SET_L4PROTO (p, IPV6_GET_NH(p));
655  break;
656  }
657  p->proto = IPV6_GET_L4PROTO (p);
658 
659  /* Pass to defragger if a fragment. */
660  if (IPV6_EXTHDR_ISSET_FH(p)) {
661  Packet *rp = Defrag(tv, dtv, p, pq);
662  if (rp != NULL) {
663  PacketEnqueue(pq,rp);
664  }
665  }
666 
667  return TM_ECODE_OK;
668 }
669 
670 #ifdef UNITTESTS
671 
672 /**
673  * \test fragment decoding
674  */
675 static int DecodeIPV6FragTest01 (void)
676 {
677 
678  uint8_t raw_frag1[] = {
679  0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
680  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
681  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
682  0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
683  0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
684  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
685  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
686  0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
687  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
688  0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
689  0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
690  0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
691  0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
692  0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
693  0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
694  0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
695  0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
696  0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
697  0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
698  0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
699  0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
700  0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
701  0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
702  0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
703  0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
704  0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
705  0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
706  0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
707  0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
708  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
748  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
749  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
750  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
751  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
752  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
753  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
754  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
755  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
756  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
757  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
758  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
759  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
760  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
761  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
762  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
763  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
764  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
765  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
766  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
767  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
768  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
769  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
770  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
771  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
772  };
773  uint8_t raw_frag2[] = {
774  0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
775  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
776  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
777  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
778  0x20, 0x20, 0x20, 0x20,
779  };
780  Packet *pkt;
781  Packet *p1 = PacketGetFromAlloc();
782  if (unlikely(p1 == NULL))
783  return 0;
784  Packet *p2 = PacketGetFromAlloc();
785  if (unlikely(p2 == NULL)) {
786  SCFree(p1);
787  return 0;
788  }
789  ThreadVars tv;
790  DecodeThreadVars dtv;
791  int result = 0;
792  PacketQueue pq;
793 
794  FlowInitConfig(FLOW_QUIET);
795  DefragInit();
796 
797  memset(&pq, 0, sizeof(PacketQueue));
798  memset(&tv, 0, sizeof(ThreadVars));
799  memset(&dtv, 0, sizeof(DecodeThreadVars));
800 
801  PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
802  PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
803 
804  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq);
805 
806  if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
807  printf("ipv6 frag header not detected: ");
808  goto end;
809  }
810 
811  DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2), &pq);
812 
813  if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
814  printf("ipv6 frag header not detected: ");
815  goto end;
816  }
817 
818  if (pq.len != 1) {
819  printf("no reassembled packet: ");
820  goto end;
821  }
822 
823  result = 1;
824 end:
825  PACKET_RECYCLE(p1);
826  PACKET_RECYCLE(p2);
827  SCFree(p1);
828  SCFree(p2);
829  pkt = PacketDequeue(&pq);
830  while (pkt != NULL) {
831  PACKET_RECYCLE(pkt);
832  SCFree(pkt);
833  pkt = PacketDequeue(&pq);
834  }
835  DefragDestroy();
836  FlowShutdown();
837  return result;
838 }
839 
840 /**
841  * \test routing header decode
842  */
843 static int DecodeIPV6RouteTest01 (void)
844 {
845  uint8_t raw_pkt1[] = {
846  0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
847  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
848  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
849  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
850  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
851  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
852 
853  0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
854  0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
855  0xfa, 0x87, 0x00, 0x00,
856  };
857  Packet *p1 = PacketGetFromAlloc();
858  FAIL_IF(unlikely(p1 == NULL));
859  ThreadVars tv;
860  DecodeThreadVars dtv;
861  PacketQueue pq;
862 
863  FlowInitConfig(FLOW_QUIET);
864 
865  memset(&pq, 0, sizeof(PacketQueue));
866  memset(&tv, 0, sizeof(ThreadVars));
867  memset(&dtv, 0, sizeof(DecodeThreadVars));
868 
869  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
870 
871  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq);
872 
873  FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1)));
874  FAIL_IF (p1->ip6eh.rh_type != 0);
875  PACKET_RECYCLE(p1);
876  SCFree(p1);
877  FlowShutdown();
878  PASS;
879 }
880 
881 /**
882  * \test HOP header decode
883  */
884 static int DecodeIPV6HopTest01 (void)
885 {
886  uint8_t raw_pkt1[] = {
887  0x60,0x00,0x00,0x00,0x00,0x20,0x00,0x01,0xfe,0x80,0x00,0x00,0x00,0x00,0x00,0x00,
888  0x02,0x0f,0xfe,0xff,0xfe,0x98,0x3d,0x01,0xff,0x02,0x00,0x00,0x00,0x00,0x00,0x00,
889  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x3a,0x00,0xff, /* 0xff is a nonsene opt */
890  0x02,0x00,0x00,0x00,0x00,
891  0x82,0x00,0x1c,0x6f,0x27,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
892  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
893  };
894  Packet *p1 = PacketGetFromAlloc();
895  FAIL_IF(unlikely(p1 == NULL));
896  ThreadVars tv;
897  DecodeThreadVars dtv;
898  PacketQueue pq;
899 
900  FlowInitConfig(FLOW_QUIET);
901 
902  memset(&pq, 0, sizeof(PacketQueue));
903  memset(&tv, 0, sizeof(ThreadVars));
904  memset(&dtv, 0, sizeof(DecodeThreadVars));
905 
906  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
907 
908  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq);
909 
910  FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
911 
912  PACKET_RECYCLE(p1);
913  SCFree(p1);
914  FlowShutdown();
915  PASS;
916 }
917 
918 #endif /* UNITTESTS */
919 
920 /**
921  * \brief this function registers unit tests for IPV6 decoder
922  */
923 
924 void DecodeIPV6RegisterTests(void)
925 {
926 #ifdef UNITTESTS
927  UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
928  UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
929  UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
930 #endif /* UNITTESTS */
931 }
932 
933 /**
934  * @}
935  */
IPV6OPT_RA
#define IPV6OPT_RA
Definition: decode-ipv6.h:161
IPV6_EXTHDR_SET_RH
#define IPV6_EXTHDR_SET_RH(p)
Definition: decode-ipv6.h:237
IPV6Hdr_
Definition: decode-ipv6.h:31
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:991
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:335
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:1006
IPV6OptHAO_::ip6hao_len
uint8_t ip6hao_len
Definition: decode-ipv6.h:169
FALSE
#define FALSE
Definition: suricata-common.h:34
DecodeGRE
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq)
Function to decode GRE packets.
Definition: decode-gre.c:46
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
IPV6OptHAO_::ip6hao_hoa
struct in6_addr ip6hao_hoa
Definition: decode-ipv6.h:170
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1107
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-udp.c:73
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:89
offset
uint64_t offset
Definition: util-streaming-buffer.h:1478
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:38
Packet_::dst
Address dst
Definition: decode.h:411
IPV6OPT_JUMBO
#define IPV6OPT_JUMBO
Definition: decode-ipv6.h:162
PacketQueue_
Definition: decode.h:620
PACKET_RECYCLE
#define PACKET_RECYCLE(p)
Definition: decode.h:817
DecodeTCP
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-tcp.c:199
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1067
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:667
DecodeSCTP
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-sctp.c:62
TRUE
#define TRUE
Definition: suricata-common.h:33
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:631
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1134
IPPROTO_GRE
#define IPPROTO_GRE
Definition: decode-gre.h:30
IPV6OptRA_::ip6ra_type
uint8_t ip6ra_type
Definition: decode-ipv6.h:176
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-ipv6.c:584
Packet_::ip6h
IPV6Hdr * ip6h
Definition: decode.h:500
IPV6_GET_PLEN
#define IPV6_GET_PLEN(p)
Definition: decode-ipv6.h:87
Packet_::proto
uint8_t proto
Definition: decode.h:428
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:218
IPV6ExtHdrs_::fh_data_len
uint16_t fh_data_len
Definition: decode-ipv6.h:225
Packet_::ip6eh
IPV6ExtHdrs ip6eh
Definition: decode.h:507
IPV6ExtHdrs_::fh_nh
uint8_t fh_nh
Definition: decode-ipv6.h:218
PacketQueue_::len
uint32_t len
Definition: decode.h:623
SET_IPV6_SRC_ADDR
#define SET_IPV6_SRC_ADDR(p, a)
Definition: decode.h:163
IPV6OptRA_::ip6ra_value
uint16_t ip6ra_value
Definition: decode-ipv6.h:178
IPV6_EXTHDR_SET_FH
#define IPV6_EXTHDR_SET_FH(p)
Definition: decode-ipv6.h:235
IPV6ExtHdrs_::fh_header_offset
uint16_t fh_header_offset
Definition: decode-ipv6.h:223
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:668
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
IPV6_GET_FLOW
#define IPV6_GET_FLOW(p)
Definition: decode-ipv6.h:83
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:632
SCEnter
#define SCEnter(...)
Definition: util-debug.h:337
IP_GET_RAW_VER
#define IP_GET_RAW_VER(pkt)
Definition: decode.h:247
IPV6_GET_CLASS
#define IPV6_GET_CLASS(p)
Definition: decode-ipv6.h:81
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:163
IPV6OptJumbo_::ip6j_len
uint8_t ip6j_len
Definition: decode-ipv6.h:185
DecodeIPV6RegisterTests
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
Definition: decode-ipv6.c:924
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:267
IPV6_GET_NH
#define IPV6_GET_NH(p)
Definition: decode-ipv6.h:85
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:376
Packet_
Definition: decode.h:405
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:107
IPV6OptJumbo_::ip6j_type
uint8_t ip6j_type
Definition: decode-ipv6.h:184
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:649
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:92
DefragInit
void DefragInit(void)
Definition: defrag.c:1045
IPV6ExtHdrs_::fh_more_frags_set
_Bool fh_more_frags_set
Definition: decode-ipv6.h:217
IPV6_SET_L4PROTO
#define IPV6_SET_L4PROTO(p, proto)
Definition: decode-ipv6.h:72
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:217
IPV6_HEADER_LEN
#define IPV6_HEADER_LEN
Definition: decode-ipv6.h:27
SCFree
#define SCFree(a)
Definition: util-mem.h:228
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:377
DecodeICMPV6
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:189
Defrag
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, PacketQueue *pq)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:999
IPV6OptHAO_
Definition: decode-ipv6.h:166
IPV6ExtHdrs_::rh_type
uint8_t rh_type
Definition: decode-ipv6.h:214
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:667
IPV6_EXTHDR_ISSET_FH
#define IPV6_EXTHDR_ISSET_FH(p)
Definition: decode-ipv6.h:236
IPV6OPT_PADN
#define IPV6OPT_PADN
Definition: decode-ipv6.h:160
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:223
PacketDequeue
Packet * PacketDequeue(PacketQueue *q)
Definition: packet-queue.c:167
IPV6OPT_PAD1
#define IPV6OPT_PAD1
Definition: decode-ipv6.h:159
IPV6OptJumbo_::ip6j_payload_len
uint32_t ip6j_payload_len
Definition: decode-ipv6.h:186
IPV6OptHAO_::ip6hao_type
uint8_t ip6hao_type
Definition: decode-ipv6.h:168
IPV6ExtHdrs_::fh_offset
uint16_t fh_offset
Definition: decode-ipv6.h:230
SCReturn
#define SCReturn
Definition: util-debug.h:339
len
uint8_t len
Definition: app-layer-dnp3.h:2643
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
SET_IPV6_DST_ADDR
#define SET_IPV6_DST_ADDR(p, a)
Definition: decode.h:171
IPV6ExtHdrs_::fh_data_offset
uint16_t fh_data_offset
Definition: decode-ipv6.h:224
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:222
IPV6ExtHdrs_::fh_prev_hdr_offset
uint16_t fh_prev_hdr_offset
Definition: decode-ipv6.h:221
IPV6OptRA_::ip6ra_len
uint8_t ip6ra_len
Definition: decode-ipv6.h:177
Packet_::flags
uint32_t flags
Definition: decode.h:441
IPV6ExtHdrs_::fh_id
uint32_t fh_id
Definition: decode-ipv6.h:231
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto, PacketQueue *pq)
Setup a pseudo packet (tunnel)
Definition: decode.c:275
ip6rh_type
uint8_t ip6rh_type
Definition: decode-ipv6.h:928
IPV6OptRA_
Definition: decode-ipv6.h:174
IPV4_HEADER_LEN
#define IPV4_HEADER_LEN
Definition: decode-ipv4.h:28
PacketCopyData
int PacketCopyData(Packet *p, uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:259
IPV6_EXTHDR_ISSET_RH
#define IPV6_EXTHDR_ISSET_RH(p)
Definition: decode-ipv6.h:238
PacketEnqueue
void PacketEnqueue(PacketQueue *q, Packet *p)
Definition: packet-queue.c:139
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:999
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:141
Packet_::src
Address src
Definition: decode.h:410
IPV6OPT_HAO
#define IPV6OPT_HAO
Definition: decode-ipv6.h:163
FlowInitConfig
void FlowInitConfig(char quiet)
initialize the configuration
Definition: flow.c:512
IPV6OptJumbo_
Definition: decode-ipv6.h:182