suricata
decode-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2025 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode IPv6
31  */
32 
33 #include "suricata-common.h"
34 #include "decode-ipv6.h"
35 #include "decode.h"
36 #include "defrag.h"
37 #include "flow-hash.h"
38 #include "util-print.h"
39 #include "util-validate.h"
40 
41 /**
42  * \brief Function to decode IPv4 in IPv6 packets
43  *
44  */
45 static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t plen)
46 {
47 
48  if (unlikely(plen < IPV4_HEADER_LEN)) {
49  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
50  return;
51  }
52  if (IP_GET_RAW_VER(pkt) == 4) {
53  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4);
54  if (tp != NULL) {
55  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
56  PacketEnqueueNoLock(&tv->decode_pq,tp);
57  StatsCounterIncr(&tv->stats, dtv->counter_ipv4inipv6);
58  }
59  FlowSetupPacket(p);
60  } else {
61  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER);
62  }
63 }
64 
65 /**
66  * \brief Function to decode IPv6 in IPv6 packets
67  *
68  */
69 static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
70  const uint8_t *pkt, uint16_t plen)
71 {
72 
73  if (unlikely(plen < IPV6_HEADER_LEN)) {
74  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
75  return TM_ECODE_FAILED;
76  }
77  if (IP_GET_RAW_VER(pkt) == 6) {
78  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6);
79  if (tp != NULL) {
80  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
81  PacketEnqueueNoLock(&tv->decode_pq,tp);
82  StatsCounterIncr(&tv->stats, dtv->counter_ipv6inipv6);
83  }
84  FlowSetupPacket(p);
85  } else {
86  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER);
87  }
88  return TM_ECODE_OK;
89 }
90 
91 #ifndef UNITTESTS // ugly, but we need this in defrag tests
92 static inline
93 #endif
94 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
95  uint16_t hdrextlen, uint16_t plen,
96  uint16_t prev_hdrextlen)
97 {
98  uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
99  int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
100 
101  p->l3.vars.ip6.eh.fh_offset = frag_offset;
102  p->l3.vars.ip6.eh.fh_more_frags_set = frag_morefrags;
103  p->l3.vars.ip6.eh.fh_nh = *pkt;
104 
105  uint32_t fh_id;
106  memcpy(&fh_id, pkt+4, 4);
107  p->l3.vars.ip6.eh.fh_id = SCNtohl(fh_id);
108 
109  SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x", p->l3.vars.ip6.eh.fh_offset,
110  p->l3.vars.ip6.eh.fh_more_frags_set ? "true" : "false", p->l3.vars.ip6.eh.fh_nh,
111  p->l3.vars.ip6.eh.fh_id, p->l3.vars.ip6.eh.fh_id);
112 
113  // store header offset, data offset
114  uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
115  uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
116  uint16_t data_len = plen - hdrextlen;
117 
118  p->l3.vars.ip6.eh.fh_header_offset = frag_hdr_offset;
119  p->l3.vars.ip6.eh.fh_data_offset = data_offset;
120  p->l3.vars.ip6.eh.fh_data_len = data_len;
121 
122  /* if we have a prev hdr, store the type and offset of it */
123  if (prev_hdrextlen) {
124  p->l3.vars.ip6.eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
125  }
126 
127  SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
128  p->l3.vars.ip6.eh.fh_header_offset, p->l3.vars.ip6.eh.fh_data_offset,
129  p->l3.vars.ip6.eh.fh_data_len);
130 }
131 
132 static void DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const IPV6Hdr *ip6h,
133  const uint8_t *pkt, uint16_t len)
134 {
135  SCEnter();
136 
137  const uint8_t *orig_pkt = pkt;
138  uint8_t nh = IPV6_GET_RAW_NH(ip6h); /* careful, 0 is actually a real type */
139  uint16_t hdrextlen = 0;
140  uint16_t plen = len;
141  char dstopts = 0;
142  char exthdr_fh_done = 0;
143  int hh = 0;
144  int rh = 0;
145  int ah = 0;
146 
147  while(1)
148  {
149  IPV6_SET_EXTHDRS_LEN(p, (len - plen));
150 
151  if (nh == IPPROTO_NONE) {
152  if (plen > 0) {
153  /* No upper layer, but we do have data. Suspicious. */
154  ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER);
155  }
156  SCReturn;
157  }
158 
159  if (plen < 2) { /* minimal needed in a hdr */
160  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
161  SCReturn;
162  }
163 
164  switch(nh)
165  {
166  case IPPROTO_TCP:
167  IPV6_SET_L4PROTO(p,nh);
168  DecodeTCP(tv, dtv, p, pkt, plen);
169  SCReturn;
170 
171  case IPPROTO_UDP:
172  IPV6_SET_L4PROTO(p,nh);
173  DecodeUDP(tv, dtv, p, pkt, plen);
174  SCReturn;
175 
176  case IPPROTO_ICMPV6:
177  IPV6_SET_L4PROTO(p,nh);
178  DecodeICMPV6(tv, dtv, p, pkt, plen);
179  SCReturn;
180 
181  case IPPROTO_SCTP:
182  IPV6_SET_L4PROTO(p,nh);
183  DecodeSCTP(tv, dtv, p, pkt, plen);
184  SCReturn;
185 
186  case IPPROTO_ROUTING:
187  IPV6_SET_L4PROTO(p,nh);
188  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
189 
190  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
191 
192  if (hdrextlen > plen) {
193  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
194  SCReturn;
195  }
196 
197  if (rh) {
198  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH);
199  /* skip past this extension so we can continue parsing the rest
200  * of the packet */
201  nh = *pkt;
202  pkt += hdrextlen;
203  plen -= hdrextlen;
204  break;
205  }
206 
207  rh = 1;
208  IPV6_EXTHDR_SET_RH(p);
209 
210  uint8_t ip6rh_type = *(pkt + 2);
211  if (ip6rh_type == 0) {
212  ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0);
213  }
214  p->l3.vars.ip6.eh.rh_type = ip6rh_type;
215 
216  nh = *pkt;
217  pkt += hdrextlen;
218  plen -= hdrextlen;
219  break;
220 
221  case IPPROTO_HOPOPTS:
222  case IPPROTO_DSTOPTS:
223  {
224  IPV6OptHAO hao_s, *hao = &hao_s;
225  IPV6OptRA ra_s, *ra = &ra_s;
226  IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
227  uint16_t optslen = 0;
228 
229  IPV6_SET_L4PROTO(p,nh);
230  hdrextlen = (uint16_t)((*(pkt + 1) + 1) << 3);
231  if (hdrextlen > plen) {
232  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
233  SCReturn;
234  }
235 
236  const uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
237 
238  /* point the pointers to right structures
239  * in Packet. */
240  if (nh == IPPROTO_HOPOPTS) {
241  if (hh) {
242  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH);
243  /* skip past this extension so we can continue parsing the rest
244  * of the packet */
245  nh = *pkt;
246  pkt += hdrextlen;
247  plen -= hdrextlen;
248  break;
249  }
250 
251  hh = 1;
252 
253  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
254  }
255  else if (nh == IPPROTO_DSTOPTS)
256  {
257  if (dstopts == 0) {
258  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
259  dstopts = 1;
260  } else if (dstopts == 1) {
261  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
262  dstopts = 2;
263  } else {
264  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH);
265  /* skip past this extension so we can continue parsing the rest
266  * of the packet */
267  nh = *pkt;
268  pkt += hdrextlen;
269  plen -= hdrextlen;
270  break;
271  }
272  }
273 
274  if (optslen > plen) {
275  /* since the packet is long enough (we checked
276  * plen against hdrlen, the optlen must be malformed. */
277  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
278  /* skip past this extension so we can continue parsing the rest
279  * of the packet */
280  nh = *pkt;
281  pkt += hdrextlen;
282  plen -= hdrextlen;
283  break;
284  }
285 /** \todo move into own function to loaded on demand */
286  uint16_t padn_cnt = 0;
287  uint16_t other_cnt = 0;
288  uint16_t offset = 0;
289  while(offset < optslen)
290  {
291  if (*ptr == IPV6OPT_PAD1)
292  {
293  padn_cnt++;
294  offset++;
295  ptr++;
296  continue;
297  }
298 
299  if (offset + 1 >= optslen) {
300  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
301  break;
302  }
303 
304  /* length field for each opt */
305  uint8_t ip6_optlen = *(ptr + 1);
306 
307  /* see if the optlen from the packet fits the total optslen.
308  * the option occupies 2 header bytes (type + len) plus
309  * ip6_optlen data bytes, so its data must end within optslen. */
310  if ((offset + 2 + ip6_optlen) > optslen) {
311  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
312  break;
313  }
314 
315  if (*ptr == IPV6OPT_PADN) /* PadN */
316  {
317  padn_cnt++;
318 
319  /* a zero padN len would be weird */
320  if (ip6_optlen == 0)
321  ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN);
322  } else if (*ptr == IPV6OPT_RA) /* RA */
323  {
324  ra->ip6ra_type = *(ptr);
325  ra->ip6ra_len = ip6_optlen;
326 
327  if (ip6_optlen < sizeof(ra->ip6ra_value)) {
328  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
329  break;
330  }
331 
332  memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
333  ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
334  other_cnt++;
335  } else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
336  {
337  jumbo->ip6j_type = *(ptr);
338  jumbo->ip6j_len = ip6_optlen;
339 
340  if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
341  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
342  break;
343  }
344 
345  memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
346  jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
347  } else if (*ptr == IPV6OPT_HAO) /* HAO */
348  {
349  hao->ip6hao_type = *(ptr);
350  hao->ip6hao_len = ip6_optlen;
351 
352  if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
353  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
354  break;
355  }
356 
357  memcpy(&hao->ip6hao_hoa, (ptr + 2), sizeof(hao->ip6hao_hoa));
358  other_cnt++;
359  } else {
360  if (nh == IPPROTO_HOPOPTS)
361  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT);
362  else
363  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT);
364 
365  other_cnt++;
366  }
367  uint16_t optlen = (*(ptr + 1) + 2);
368  ptr += optlen; /* +2 for opt type and opt len fields */
369  offset += optlen;
370  }
371  /* flag packets that have only padding */
372  if (padn_cnt > 0 && other_cnt == 0) {
373  if (nh == IPPROTO_HOPOPTS)
374  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING);
375  else
376  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING);
377  }
378 
379  nh = *pkt;
380  pkt += hdrextlen;
381  plen -= hdrextlen;
382  break;
383  }
384 
385  case IPPROTO_FRAGMENT:
386  {
387  IPV6_SET_L4PROTO(p,nh);
388  /* store the offset of this extension into the packet
389  * past the ipv6 header. We use it in defrag for creating
390  * a defragmented packet without the frag header */
391  if (exthdr_fh_done == 0) {
392  DEBUG_VALIDATE_BUG_ON(pkt - orig_pkt > UINT16_MAX);
393  p->l3.vars.ip6.eh.fh_offset = (uint16_t)(pkt - orig_pkt);
394  exthdr_fh_done = 1;
395  }
396 
397  uint16_t prev_hdrextlen = hdrextlen;
398  hdrextlen = sizeof(IPV6FragHdr);
399  if (hdrextlen > plen) {
400  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
401  SCReturn;
402  }
403 
404  /* for the frag header, the length field is reserved */
405  if (*(pkt + 1) != 0) {
406  ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD);
407  /* non fatal, lets try to continue */
408  }
409 
410  if (IPV6_EXTHDR_ISSET_FH(p)) {
411  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH);
412  nh = *pkt;
413  pkt += hdrextlen;
414  plen -= hdrextlen;
415  break;
416  }
417 
418  /* set the header flag first */
419  IPV6_EXTHDR_SET_FH(p);
420 
421  /* parse the header and setup the vars */
422  DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
423 
424  /* if FH has offset 0 and no more fragments are coming, we
425  * parse this packet further right away, no defrag will be
426  * needed. It is a useless FH then though, so we do set an
427  * decoder event. */
428  if (p->l3.vars.ip6.eh.fh_more_frags_set == 0 && p->l3.vars.ip6.eh.fh_offset == 0) {
429  ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH);
430 
431  nh = *pkt;
432  pkt += hdrextlen;
433  plen -= hdrextlen;
434  break;
435  }
436  if (p->l3.vars.ip6.eh.fh_more_frags_set != 0 && plen % 8 != 0) {
437  // cf https://datatracker.ietf.org/doc/html/rfc2460#section-4.5
438  // each, except possibly the last ("rightmost") one,
439  // being an integer multiple of 8 octets long.
440  ENGINE_SET_EVENT(p, IPV6_FRAG_INVALID_LENGTH);
441  }
442 
443  /* the rest is parsed upon reassembly */
444  p->flags |= PKT_IS_FRAGMENT;
445  SCReturn;
446  }
447  case IPPROTO_ESP:
448  {
449  IPV6_SET_L4PROTO(p,nh);
450  DecodeESP(tv, dtv, p, pkt, plen);
451  SCReturn;
452  }
453  case IPPROTO_AH:
454  {
455  IPV6_SET_L4PROTO(p,nh);
456  /* we need the header as a minimum */
457  hdrextlen = sizeof(IPV6AuthHdr);
458  /* the payload len field is the number of extra 4 byte fields,
459  * IPV6AuthHdr already contains the first */
460  if (*(pkt+1) > 0)
461  hdrextlen += ((*(pkt+1) - 1) * 4);
462 
463  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
464 
465  if (hdrextlen > plen) {
466  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
467  SCReturn;
468  }
469 
470  IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
471  if (ahhdr->ip6ah_reserved != 0x0000) {
472  ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL);
473  }
474 
475  if (ah) {
476  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH);
477  nh = *pkt;
478  pkt += hdrextlen;
479  plen -= hdrextlen;
480  break;
481  }
482 
483  ah = 1;
484 
485  nh = *pkt;
486  pkt += hdrextlen;
487  plen -= hdrextlen;
488  break;
489  }
490  case IPPROTO_IPIP:
491  IPV6_SET_L4PROTO(p,nh);
492  DecodeIPv4inIPv6(tv, dtv, p, pkt, plen);
493  SCReturn;
494  /* none, last header */
495  case IPPROTO_NONE:
496  IPV6_SET_L4PROTO(p,nh);
497  SCReturn;
498  case IPPROTO_ICMP:
499  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
500  SCReturn;
501  /* no parsing yet, just skip it */
502  case IPPROTO_MH:
503  case IPPROTO_HIP:
504  case IPPROTO_SHIM6:
505  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
506  if (hdrextlen > plen) {
507  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
508  SCReturn;
509  }
510  nh = *pkt;
511  pkt += hdrextlen;
512  plen -= hdrextlen;
513  break;
514  default:
515  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
516  IPV6_SET_L4PROTO(p,nh);
517  SCReturn;
518  }
519  }
520 
521  SCReturn;
522 }
523 
524 static const IPV6Hdr *DecodeIPV6Packet(
525  ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
526 {
527  if (unlikely(len < IPV6_HEADER_LEN)) {
528  ENGINE_SET_INVALID_EVENT(p, IPV6_PKT_TOO_SMALL);
529  return NULL;
530  }
531 
532  if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
533  SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
534  ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
535  return NULL;
536  }
537 
538  const IPV6Hdr *ip6h = PacketSetIPV6(p, pkt);
539 
540  if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_RAW_PLEN(ip6h)))) {
541  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
542  return NULL;
543  }
544 
545  SET_IPV6_SRC_ADDR(ip6h, &p->src);
546  SET_IPV6_DST_ADDR(ip6h, &p->dst);
547 
548  return ip6h;
549 }
550 
551 int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
552 {
553  StatsCounterIncr(&tv->stats, dtv->counter_ipv6);
554 
555  if (!PacketIncreaseCheckLayers(p)) {
556  return TM_ECODE_FAILED;
557  }
558  /* do the actual decoding */
559  const IPV6Hdr *ip6h = DecodeIPV6Packet(tv, dtv, p, pkt, len);
560  if (unlikely(ip6h == NULL)) {
561  PacketClearL3(p);
562  return TM_ECODE_FAILED;
563  }
564  p->proto = IPV6_GET_RAW_NH(ip6h);
565 
566 #ifdef DEBUG
567  if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
568  /* debug print */
569  char s[46], d[46];
570  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
571  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
572  SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32
573  " PLEN: %" PRIu32 " HLIM: %" PRIu32 "",
574  s, d, IPV6_GET_RAW_CLASS(ip6h), IPV6_GET_RAW_FLOW(ip6h), IPV6_GET_RAW_NH(ip6h),
575  IPV6_GET_RAW_PLEN(ip6h), IPV6_GET_RAW_HLIM(ip6h));
576  }
577 #endif /* DEBUG */
578  const uint8_t *data = pkt + IPV6_HEADER_LEN;
579  const uint16_t data_len = IPV6_GET_RAW_PLEN(ip6h);
580 
581  /* now process the Ext headers and/or the L4 Layer */
582  switch (IPV6_GET_RAW_NH(ip6h)) {
583  case IPPROTO_TCP:
584  IPV6_SET_L4PROTO (p, IPPROTO_TCP);
585  DecodeTCP(tv, dtv, p, data, data_len);
586  return TM_ECODE_OK;
587  case IPPROTO_UDP:
588  IPV6_SET_L4PROTO (p, IPPROTO_UDP);
589  DecodeUDP(tv, dtv, p, data, data_len);
590  return TM_ECODE_OK;
591  case IPPROTO_ICMPV6:
592  IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
593  DecodeICMPV6(tv, dtv, p, data, data_len);
594  return TM_ECODE_OK;
595  case IPPROTO_SCTP:
596  IPV6_SET_L4PROTO (p, IPPROTO_SCTP);
597  DecodeSCTP(tv, dtv, p, data, data_len);
598  return TM_ECODE_OK;
599  case IPPROTO_IPIP:
600  IPV6_SET_L4PROTO(p, IPPROTO_IPIP);
601  DecodeIPv4inIPv6(tv, dtv, p, data, data_len);
602  return TM_ECODE_OK;
603  case IPPROTO_IPV6:
604  DecodeIP6inIP6(tv, dtv, p, data, data_len);
605  return TM_ECODE_OK;
606  case IPPROTO_GRE:
607  IPV6_SET_L4PROTO(p, IPPROTO_GRE);
608  DecodeGRE(tv, dtv, p, data, data_len);
609  break;
610  case IPPROTO_FRAGMENT:
611  case IPPROTO_HOPOPTS:
612  case IPPROTO_ROUTING:
613  case IPPROTO_NONE:
614  case IPPROTO_DSTOPTS:
615  case IPPROTO_AH:
616  case IPPROTO_ESP:
617  case IPPROTO_MH:
618  case IPPROTO_HIP:
619  case IPPROTO_SHIM6:
620  DecodeIPV6ExtHdrs(tv, dtv, p, ip6h, data, data_len);
621  break;
622  case IPPROTO_ICMP:
623  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
624  break;
625  default:
626  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
627  IPV6_SET_L4PROTO(p, IPV6_GET_RAW_NH(ip6h));
628  break;
629  }
630  p->proto = IPV6_GET_L4PROTO (p);
631 
632  /* Pass to defragger if a fragment. */
633  if (IPV6_EXTHDR_ISSET_FH(p)) {
634  Packet *rp = Defrag(tv, dtv, p);
635  if (rp != NULL) {
636  PacketEnqueueNoLock(&tv->decode_pq,rp);
637  }
638  }
639 
640  return TM_ECODE_OK;
641 }
642 
643 #ifdef UNITTESTS
644 #include "util-unittest-helper.h"
645 #include "packet.h"
646 
647 /**
648  * \test fragment decoding
649  */
650 static int DecodeIPV6FragTest01 (void)
651 {
652 
653  uint8_t raw_frag1[] = {
654  0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
655  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
656  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
657  0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
658  0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
659  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
660  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
661  0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
662  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
663  0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
664  0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
665  0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
666  0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
667  0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
668  0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
669  0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
670  0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
671  0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
672  0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
673  0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
674  0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
675  0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
676  0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
677  0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
678  0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
679  0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
680  0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
681  0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
682  0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
683  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
684  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
685  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
686  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
687  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
688  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
689  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
690  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
691  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
692  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
693  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
694  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
695  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
696  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
697  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
698  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
699  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
700  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
701  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
702  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
703  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
704  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
705  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
706  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
707  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
708  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747  };
748  uint8_t raw_frag2[] = {
749  0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
750  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
751  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
752  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
753  0x20, 0x20, 0x20, 0x20,
754  };
755  Packet *pkt;
756  Packet *p1 = PacketGetFromAlloc();
757  if (unlikely(p1 == NULL))
758  return 0;
759  Packet *p2 = PacketGetFromAlloc();
760  if (unlikely(p2 == NULL)) {
761  PacketFree(p1);
762  return 0;
763  }
764  ThreadVars tv;
765  DecodeThreadVars dtv;
766  int result = 0;
767 
768  FlowInitConfig(FLOW_QUIET);
769  DefragInit();
770 
771  memset(&tv, 0, sizeof(ThreadVars));
772  memset(&dtv, 0, sizeof(DecodeThreadVars));
773 
774  PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
775  PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
776 
777  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
778 
779  if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
780  printf("ipv6 frag header not detected: ");
781  goto end;
782  }
783 
784  DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2));
785 
786  if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
787  printf("ipv6 frag header not detected: ");
788  goto end;
789  }
790 
791  if (tv.decode_pq.len != 1) {
792  printf("no reassembled packet: ");
793  goto end;
794  }
795 
796  result = 1;
797 end:
798  PacketRecycle(p1);
799  PacketRecycle(p2);
800  PacketFree(p1);
801  PacketFree(p2);
802  pkt = PacketDequeueNoLock(&tv.decode_pq);
803  while (pkt != NULL) {
804  PacketRecycle(pkt);
805  PacketFree(pkt);
806  pkt = PacketDequeueNoLock(&tv.decode_pq);
807  }
808  DefragDestroy();
809  FlowShutdown();
810  return result;
811 }
812 
813 /**
814  * \test routing header decode
815  */
816 static int DecodeIPV6RouteTest01 (void)
817 {
818  uint8_t raw_pkt1[] = {
819  0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
820  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
821  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
822  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
823  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
824  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
825 
826  0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
827  0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
828  0xfa, 0x87, 0x00, 0x00,
829  };
830  Packet *p1 = PacketGetFromAlloc();
831  FAIL_IF(unlikely(p1 == NULL));
832  ThreadVars tv;
833  DecodeThreadVars dtv;
834 
835  FlowInitConfig(FLOW_QUIET);
836 
837  memset(&tv, 0, sizeof(ThreadVars));
838  memset(&dtv, 0, sizeof(DecodeThreadVars));
839 
840  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
841 
842  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
843 
844  FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1)));
845  FAIL_IF(p1->l3.vars.ip6.eh.rh_type != 0);
846  PacketRecycle(p1);
847  PacketFree(p1);
848  FlowShutdown();
849  PASS;
850 }
851 
852 /**
853  * \test HOP header decode
854  */
855 static int DecodeIPV6HopTest01 (void)
856 {
857  uint8_t raw_pkt1[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x01, 0xfe, 0x80, 0x00, 0x00,
858  0x00, 0x00, 0x00, 0x00, 0x02, 0x0f, 0xfe, 0xff, 0xfe, 0x98, 0x3d, 0x01, 0xff, 0x02, 0x00,
859  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x3a, 0x00,
860  0xff, /* 0xff is a nonsense opt */
861  0x02, 0x00, 0x00, 0x00, 0x00, 0x82, 0x00, 0x1c, 0x6f, 0x27, 0x10, 0x00, 0x00, 0x00, 0x00,
862  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
863  Packet *p1 = PacketGetFromAlloc();
864  FAIL_IF(unlikely(p1 == NULL));
865  ThreadVars tv;
866  DecodeThreadVars dtv;
867 
868  FlowInitConfig(FLOW_QUIET);
869 
870  memset(&tv, 0, sizeof(ThreadVars));
871  memset(&dtv, 0, sizeof(DecodeThreadVars));
872 
873  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
874 
875  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
876 
877  FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
878 
879  PacketRecycle(p1);
880  PacketFree(p1);
881  FlowShutdown();
882  PASS;
883 }
884 
885 /**
886  * \test pkt too small event setting
887  */
888 static int DecodeIPV6PktTooSmallTest01(void)
889 {
890  uint8_t raw_pkt1[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x01, 0xfe, 0x80, 0x00, 0x00,
891  0x00, 0x00, 0x00, 0x00, 0x02, 0x0f, 0xfe, 0xff, 0xfe, 0x98, 0x3d, 0x01, 0xff, 0x02, 0x00,
892  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x3a, 0x00,
893  0xff, /* 0xff is a nonsense opt */
894  0x02, 0x00, 0x00, 0x00, 0x00, 0x82, 0x00, 0x1c, 0x6f, 0x27, 0x10, 0x00, 0x00, 0x00, 0x00,
895  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
896  Packet *p1 = PacketGetFromAlloc();
897  FAIL_IF(unlikely(p1 == NULL));
898  ThreadVars tv;
899  DecodeThreadVars dtv;
900 
901  FlowInitConfig(FLOW_QUIET);
902 
903  memset(&tv, 0, sizeof(ThreadVars));
904  memset(&dtv, 0, sizeof(DecodeThreadVars));
905 
906  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
907 
908  /* force pkt length to be shorter than headers length */
909  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1) - 33);
910 
911  FAIL_IF_NOT(ENGINE_ISSET_EVENT(p1, IPV6_PKT_TOO_SMALL));
912  PacketRecycle(p1);
913  PacketFree(p1);
914  FlowShutdown();
915  PASS;
916 }
917 
918 #endif /* UNITTESTS */
919 
920 /**
921  * \brief this function registers unit tests for IPV6 decoder
922  */
923 
924 void DecodeIPV6RegisterTests(void)
925 {
926 #ifdef UNITTESTS
927  UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
928  UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
929  UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
930  UtRegisterTest("DecodeIPV6PktTooSmallTest01", DecodeIPV6PktTooSmallTest01);
931 #endif /* UNITTESTS */
932 }
933 
934 /**
935  * @}
936  */
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:1231
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1127
Packet_::proto
uint8_t proto
Definition: decode.h:538
len
uint8_t len
Definition: app-layer-dnp3.h:2
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:1150
IPV6_GET_RAW_PLEN
#define IPV6_GET_RAW_PLEN(ip6h)
Definition: decode-ipv6.h:66
IPV4_IN_IPV6_PKT_TOO_SMALL
@ IPV4_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:199
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
DecodeThreadVars_::counter_ipv6
StatsCounterId counter_ipv6
Definition: decode.h:1012
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
IPV6_GET_RAW_HLIM
#define IPV6_GET_RAW_HLIM(ip6h)
Definition: decode-ipv6.h:67
IPV6_GET_RAW_NH
#define IPV6_GET_RAW_NH(ip6h)
Definition: decode-ipv6.h:65
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:383
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
PacketL3::vars
union PacketL3::@30 vars
IPV6_EXTHDR_DUPL_FH
@ IPV6_EXTHDR_DUPL_FH
Definition: decode-events.h:72
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DecodeESP
int DecodeESP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Function to decode IPSEC-ESP packets.
Definition: decode-esp.c:64
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:1244
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:282
IPV6OptRA_::ip6ra_value
uint16_t ip6ra_value
Definition: decode-ipv6.h:138
IPV6OptHAO_::ip6hao_hoa
struct in6_addr ip6hao_hoa
Definition: decode-ipv6.h:130
IPV6_EXTHDR_ISSET_FH
#define IPV6_EXTHDR_ISSET_FH(p)
Definition: decode-ipv6.h:174
IPV6OPT_HAO
#define IPV6OPT_HAO
Definition: decode-ipv6.h:123
Packet_::flags
uint32_t flags
Definition: decode.h:562
PacketRecycle
void PacketRecycle(Packet *p)
Definition: packet.c:166
IPV6_GET_RAW_CLASS
#define IPV6_GET_RAW_CLASS(ip6h)
Definition: decode-ipv6.h:63
IPV6OPT_PADN
#define IPV6OPT_PADN
Definition: decode-ipv6.h:120
IPV6_DSTOPTS_ONLY_PADDING
@ IPV6_DSTOPTS_ONLY_PADDING
Definition: decode-events.h:87
flow-hash.h
IPV6OPT_RA
#define IPV6OPT_RA
Definition: decode-ipv6.h:121
IPV6_HOPOPTS_ONLY_PADDING
@ IPV6_HOPOPTS_ONLY_PADDING
Definition: decode-events.h:85
IPV6_EXTHDR_SET_FH
#define IPV6_EXTHDR_SET_FH(p)
Definition: decode-ipv6.h:173
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:75
IPV6_TRUNC_EXTHDR
@ IPV6_TRUNC_EXTHDR
Definition: decode-events.h:71
IPPROTO_GRE
#define IPPROTO_GRE
Definition: decode-gre.h:30
IP_GET_RAW_VER
#define IP_GET_RAW_VER(pkt)
Definition: decode.h:233
p
Packet * p
Definition: fuzz_iprep.c:21
IPV6_SET_L4PROTO
#define IPV6_SET_L4PROTO(p, proto)
Definition: decode-ipv6.h:72
IPV4_IN_IPV6_WRONG_IP_VER
@ IPV4_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:200
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:82
IPV6_TRUNC_PKT
@ IPV6_TRUNC_PKT
Definition: decode-events.h:70
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:205
DecodeSCTP
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-sctp.c:204
util-unittest-helper.h
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:81
IPV6OptHAO_::ip6hao_len
uint8_t ip6hao_len
Definition: decode-ipv6.h:129
IPV6_EXTHDR_DUPL_HH
@ IPV6_EXTHDR_DUPL_HH
Definition: decode-events.h:75
IPV6OPT_JUMBO
#define IPV6OPT_JUMBO
Definition: decode-ipv6.h:122
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1366
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:576
decode-ipv6.h
decode.h
IPPROTO_SHIM6
#define IPPROTO_SHIM6
Definition: decode.h:1286
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
IPV6_PKT_TOO_SMALL
@ IPV6_PKT_TOO_SMALL
Definition: decode-events.h:69
IPV6_EXTHDR_USELESS_FH
@ IPV6_EXTHDR_USELESS_FH
Definition: decode-events.h:73
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:208
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1335
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:94
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:284
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:210
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:238
IPV6_EXTHDR_DUPL_AH
@ IPV6_EXTHDR_DUPL_AH
Definition: decode-events.h:77
StatsCounterIncr
void StatsCounterIncr(StatsThreadContext *stats, StatsCounterId id)
Increments the local counter.
Definition: counters.c:164
DecodeGRE
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode GRE packets.
Definition: decode-gre.c:47
PacketFree
void PacketFree(Packet *p)
Return a malloced packet.
Definition: decode.c:222
IPV6_IN_IPV6_WRONG_IP_VER
@ IPV6_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:204
PacketL3::ip6
struct PacketL3::@30::@31 ip6
SET_IPV6_SRC_ADDR
#define SET_IPV6_SRC_ADDR(ip6h, a)
Definition: decode.h:160
IPV6_FRAG_INVALID_LENGTH
@ IPV6_FRAG_INVALID_LENGTH
Definition: decode-events.h:192
IPV6_DSTOPTS_UNKNOWN_OPT
@ IPV6_DSTOPTS_UNKNOWN_OPT
Definition: decode-events.h:86
SCReturn
#define SCReturn
Definition: util-debug.h:286
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:55
IPV6Hdr_
Definition: decode-ipv6.h:32
IPV6_EXTHDR_ZERO_LEN_PADN
@ IPV6_EXTHDR_ZERO_LEN_PADN
Definition: decode-events.h:90
Packet_
Definition: decode.h:516
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:551
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:1149
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:209
IPV6_EXTHDR_DUPL_DH
@ IPV6_EXTHDR_DUPL_DH
Definition: decode-events.h:76
IPPROTO_HIP
#define IPPROTO_HIP
Definition: decode.h:1282
defrag.h
IPV6_EXTHDR_ISSET_RH
#define IPV6_EXTHDR_ISSET_RH(p)
Definition: decode-ipv6.h:176
IPV6OptRA_
Definition: decode-ipv6.h:135
DecodeThreadVars_::counter_ipv4inipv6
StatsCounterId counter_ipv4inipv6
Definition: decode.h:1051
IPV6_UNKNOWN_NEXT_HEADER
@ IPV6_UNKNOWN_NEXT_HEADER
Definition: decode-events.h:94
IPV6OptJumbo_::ip6j_payload_len
uint32_t ip6j_payload_len
Definition: decode-ipv6.h:146
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:34
DecodeTCP
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-tcp.c:293
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:168
IPPROTO_IPIP
#define IPPROTO_IPIP
Definition: decode.h:1257
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:439
DecodeICMPV6
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:177
suricata-common.h
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:720
IPV4_HEADER_LEN
#define IPV4_HEADER_LEN
Definition: decode-ipv4.h:28
IPV6OptHAO_::ip6hao_type
uint8_t ip6hao_type
Definition: decode-ipv6.h:128
packet.h
IPV6_GET_RAW_FLOW
#define IPV6_GET_RAW_FLOW(ip6h)
Definition: decode-ipv6.h:64
IPV6_WITH_ICMPV4
@ IPV6_WITH_ICMPV4
Definition: decode-events.h:95
IPV6_EXTHDR_INVALID_OPTLEN
@ IPV6_EXTHDR_INVALID_OPTLEN
Definition: decode-events.h:80
IPV6_EXTHDR_DUPL_RH
@ IPV6_EXTHDR_DUPL_RH
Definition: decode-events.h:74
IPV6_HOPOPTS_UNKNOWN_OPT
@ IPV6_HOPOPTS_UNKNOWN_OPT
Definition: decode-events.h:84
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:33
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:261
PacketQueueNoLock_::len
uint32_t len
Definition: packet-queue.h:37
IPV6_FH_NON_ZERO_RES_FIELD
@ IPV6_FH_NON_ZERO_RES_FIELD
Definition: decode-events.h:91
IPV6_SET_EXTHDRS_LEN
#define IPV6_SET_EXTHDRS_LEN(p, len)
Definition: decode-ipv6.h:73
IPV6_WRONG_IP_VER
@ IPV6_WRONG_IP_VER
Definition: decode-events.h:81
Packet_::l3
struct PacketL3 l3
Definition: decode.h:615
IPV6OptRA_::ip6ra_len
uint8_t ip6ra_len
Definition: decode-ipv6.h:137
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:204
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:438
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:995
IPPROTO_MH
#define IPPROTO_MH
Definition: decode.h:1277
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:111
IPV6OptJumbo_
Definition: decode-ipv6.h:143
IPV6OptRA_::ip6ra_type
uint8_t ip6ra_type
Definition: decode-ipv6.h:136
IPV6_DATA_AFTER_NONE_HEADER
@ IPV6_DATA_AFTER_NONE_HEADER
Definition: decode-events.h:92
IPV6OptJumbo_::ip6j_len
uint8_t ip6j_len
Definition: decode-ipv6.h:145
Packet_::dst
Address dst
Definition: decode.h:521
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1239
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:44
IPV6OptJumbo_::ip6j_type
uint8_t ip6j_type
Definition: decode-ipv6.h:144
IPV6_HEADER_LEN
#define IPV6_HEADER_LEN
Definition: decode-ipv6.h:27
IPV6_IN_IPV6_PKT_TOO_SMALL
@ IPV6_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:203
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:1273
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:399
IPV6_EXTHDR_AH_RES_NOT_NULL
@ IPV6_EXTHDR_AH_RES_NOT_NULL
Definition: decode-events.h:82
Defrag
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:1031
SET_IPV6_DST_ADDR
#define SET_IPV6_DST_ADDR(ip6h, a)
Definition: decode.h:169
IPV6_EXTHDR_RH_TYPE_0
@ IPV6_EXTHDR_RH_TYPE_0
Definition: decode-events.h:89
ThreadVars_::stats
StatsThreadContext stats
Definition: threadvars.h:121
DecodeThreadVars_::counter_ipv6inipv6
StatsCounterId counter_ipv6inipv6
Definition: decode.h:1052
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:768
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:109
FlowSetupPacket
void FlowSetupPacket(Packet *p)
prepare packet for a life with flow Set PKT_WANTS_FLOW flag to indicate workers should do a flow look...
Definition: flow-hash.c:518
DecodeIPV6RegisterTests
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
Definition: decode-ipv6.c:924
IPV6OptHAO_
Definition: decode-ipv6.h:127
Packet_::src
Address src
Definition: decode.h:520
DefragInit
void DefragInit(void)
Definition: defrag.c:1107
IPV6_EXTHDR_SET_RH
#define IPV6_EXTHDR_SET_RH(p)
Definition: decode-ipv6.h:175
IPV6OPT_PAD1
#define IPV6OPT_PAD1
Definition: decode-ipv6.h:119