suricata
decode-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode IPv6
31  */
32 
33 #include "suricata-common.h"
34 #include "packet-queue.h"
35 #include "decode.h"
36 #include "decode-ipv6.h"
37 #include "decode-icmpv6.h"
38 #include "decode-events.h"
39 #include "defrag.h"
40 #include "pkt-var.h"
41 #include "util-debug.h"
42 #include "util-print.h"
43 #include "util-unittest.h"
44 #include "util-profiling.h"
45 #include "host.h"
46 
47 /**
48  * \brief Function to decode IPv4 in IPv6 packets
49  *
50  */
51 static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t plen, PacketQueue *pq)
52 {
53 
54  if (unlikely(plen < IPV4_HEADER_LEN)) {
55  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
56  return;
57  }
58  if (IP_GET_RAW_VER(pkt) == 4) {
59  if (pq != NULL) {
60  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4, pq);
61  if (tp != NULL) {
62  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
63  /* add the tp to the packet queue. */
64  PacketEnqueue(pq,tp);
65  StatsIncr(tv, dtv->counter_ipv4inipv6);
66  return;
67  }
68  }
69  } else {
70  ENGINE_SET_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER);
71  }
72  return;
73 }
74 
75 /**
76  * \brief Function to decode IPv6 in IPv6 packets
77  *
78  */
79 static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t plen, PacketQueue *pq)
80 {
81 
82  if (unlikely(plen < IPV6_HEADER_LEN)) {
83  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
84  return TM_ECODE_FAILED;
85  }
86  if (IP_GET_RAW_VER(pkt) == 6) {
87  if (unlikely(pq != NULL)) {
88  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6, pq);
89  if (tp != NULL) {
90  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
91  PacketEnqueue(pq,tp);
92  StatsIncr(tv, dtv->counter_ipv6inipv6);
93  }
94  }
95  } else {
96  ENGINE_SET_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER);
97  }
98  return TM_ECODE_OK;
99 }
100 
101 #ifndef UNITTESTS // ugly, but we need this in defrag tests
102 static inline
103 #endif
104 void DecodeIPV6FragHeader(Packet *p, uint8_t *pkt,
105  uint16_t hdrextlen, uint16_t plen,
106  uint16_t prev_hdrextlen)
107 {
108  uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
109  int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
110 
111  p->ip6eh.fh_offset = frag_offset;
112  p->ip6eh.fh_more_frags_set = frag_morefrags ? TRUE : FALSE;
113  p->ip6eh.fh_nh = *pkt;
114 
115  uint32_t fh_id;
116  memcpy(&fh_id, pkt+4, 4);
117  p->ip6eh.fh_id = SCNtohl(fh_id);
118 
119  SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x",
120  p->ip6eh.fh_offset,
121  p->ip6eh.fh_more_frags_set ? "true" : "false",
122  p->ip6eh.fh_nh,
123  p->ip6eh.fh_id, p->ip6eh.fh_id);
124 
125  // store header offset, data offset
126  uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
127  uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
128  uint16_t data_len = plen - hdrextlen;
129 
130  p->ip6eh.fh_header_offset = frag_hdr_offset;
131  p->ip6eh.fh_data_offset = data_offset;
132  p->ip6eh.fh_data_len = data_len;
133 
134  /* if we have a prev hdr, store the type and offset of it */
135  if (prev_hdrextlen) {
136  p->ip6eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
137  }
138 
139  SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
140  p->ip6eh.fh_header_offset, p->ip6eh.fh_data_offset,
141  p->ip6eh.fh_data_len);
142 }
143 
144 static void
145 DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
146 {
147  SCEnter();
148 
149  uint8_t *orig_pkt = pkt;
150  uint8_t nh = IPV6_GET_NH(p); /* careful, 0 is actually a real type */
151  uint16_t hdrextlen = 0;
152  uint16_t plen = len;
153  char dstopts = 0;
154  char exthdr_fh_done = 0;
155  int hh = 0;
156  int rh = 0;
157  int eh = 0;
158  int ah = 0;
159 
160  while(1)
161  {
162  IPV6_SET_EXTHDRS_LEN(p, (len - plen));
163 
164  if (nh == IPPROTO_NONE) {
165  if (plen > 0) {
166  /* No upper layer, but we do have data. Suspicious. */
167  ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER);
168  }
169  SCReturn;
170  }
171 
172  if (plen < 2) { /* minimal needed in a hdr */
173  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
174  SCReturn;
175  }
176 
177  switch(nh)
178  {
179  case IPPROTO_TCP:
180  IPV6_SET_L4PROTO(p,nh);
181  DecodeTCP(tv, dtv, p, pkt, plen, pq);
182  SCReturn;
183 
184  case IPPROTO_UDP:
185  IPV6_SET_L4PROTO(p,nh);
186  DecodeUDP(tv, dtv, p, pkt, plen, pq);
187  SCReturn;
188 
189  case IPPROTO_ICMPV6:
190  IPV6_SET_L4PROTO(p,nh);
191  DecodeICMPV6(tv, dtv, p, pkt, plen, pq);
192  SCReturn;
193 
194  case IPPROTO_SCTP:
195  IPV6_SET_L4PROTO(p,nh);
196  DecodeSCTP(tv, dtv, p, pkt, plen, pq);
197  SCReturn;
198 
199  case IPPROTO_ROUTING:
200  IPV6_SET_L4PROTO(p,nh);
201  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
202 
203  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
204 
205  if (hdrextlen > plen) {
206  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
207  SCReturn;
208  }
209 
210  if (rh) {
211  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH);
212  /* skip past this extension so we can continue parsing the rest
213  * of the packet */
214  nh = *pkt;
215  pkt += hdrextlen;
216  plen -= hdrextlen;
217  break;
218  }
219 
220  rh = 1;
221  IPV6_EXTHDR_SET_RH(p);
222 
223  uint8_t ip6rh_type = *(pkt + 2);
224  if (ip6rh_type == 0) {
225  ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0);
226  }
227  p->ip6eh.rh_type = ip6rh_type;
228 
229  nh = *pkt;
230  pkt += hdrextlen;
231  plen -= hdrextlen;
232  break;
233 
234  case IPPROTO_HOPOPTS:
235  case IPPROTO_DSTOPTS:
236  {
237  IPV6OptHAO hao_s, *hao = &hao_s;
238  IPV6OptRA ra_s, *ra = &ra_s;
239  IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
240  uint16_t optslen = 0;
241 
242  IPV6_SET_L4PROTO(p,nh);
243  hdrextlen = (*(pkt+1) + 1) << 3;
244  if (hdrextlen > plen) {
245  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
246  SCReturn;
247  }
248 
249  uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
250 
251  /* point the pointers to right structures
252  * in Packet. */
253  if (nh == IPPROTO_HOPOPTS) {
254  if (hh) {
255  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH);
256  /* skip past this extension so we can continue parsing the rest
257  * of the packet */
258  nh = *pkt;
259  pkt += hdrextlen;
260  plen -= hdrextlen;
261  break;
262  }
263 
264  hh = 1;
265 
266  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
267  }
268  else if (nh == IPPROTO_DSTOPTS)
269  {
270  if (dstopts == 0) {
271  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
272  dstopts = 1;
273  } else if (dstopts == 1) {
274  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
275  dstopts = 2;
276  } else {
277  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH);
278  /* skip past this extension so we can continue parsing the rest
279  * of the packet */
280  nh = *pkt;
281  pkt += hdrextlen;
282  plen -= hdrextlen;
283  break;
284  }
285  }
286 
287  if (optslen > plen) {
288  /* since the packet is long enough (we checked
289  * plen against hdrlen, the optlen must be malformed. */
290  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
291  /* skip past this extension so we can continue parsing the rest
292  * of the packet */
293  nh = *pkt;
294  pkt += hdrextlen;
295  plen -= hdrextlen;
296  break;
297  }
298 /** \todo move into own function to loaded on demand */
299  uint16_t padn_cnt = 0;
300  uint16_t other_cnt = 0;
301  uint16_t offset = 0;
302  while(offset < optslen)
303  {
304  if (*ptr == IPV6OPT_PAD1)
305  {
306  padn_cnt++;
307  offset++;
308  ptr++;
309  continue;
310  }
311 
312  if (offset + 1 >= optslen) {
313  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
314  break;
315  }
316 
317  /* length field for each opt */
318  uint8_t ip6_optlen = *(ptr + 1);
319 
320  /* see if the optlen from the packet fits the total optslen */
321  if ((offset + 1 + ip6_optlen) > optslen) {
322  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
323  break;
324  }
325 
326  if (*ptr == IPV6OPT_PADN) /* PadN */
327  {
328  //printf("PadN option\n");
329  padn_cnt++;
330 
331  /* a zero padN len would be weird */
332  if (ip6_optlen == 0)
333  ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN);
334  }
335  else if (*ptr == IPV6OPT_RA) /* RA */
336  {
337  ra->ip6ra_type = *(ptr);
338  ra->ip6ra_len = ip6_optlen;
339 
340  if (ip6_optlen < sizeof(ra->ip6ra_value)) {
341  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
342  break;
343  }
344 
345  memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
346  ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
347  //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
348  // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
349  other_cnt++;
350  }
351  else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
352  {
353  jumbo->ip6j_type = *(ptr);
354  jumbo->ip6j_len = ip6_optlen;
355 
356  if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
357  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
358  break;
359  }
360 
361  memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
362  jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
363  //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
364  // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
365  }
366  else if (*ptr == IPV6OPT_HAO) /* HAO */
367  {
368  hao->ip6hao_type = *(ptr);
369  hao->ip6hao_len = ip6_optlen;
370 
371  if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
372  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
373  break;
374  }
375 
376  memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa));
377  //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ",
378  // hao->ip6hao_type, hao->ip6hao_len);
379  //char addr_buf[46];
380  //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa),
381  // addr_buf,sizeof(addr_buf));
382  //printf("home addr %s\n", addr_buf);
383  other_cnt++;
384  } else {
385  if (nh == IPPROTO_HOPOPTS)
386  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT);
387  else
388  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT);
389 
390  other_cnt++;
391  }
392  uint16_t optlen = (*(ptr + 1) + 2);
393  ptr += optlen; /* +2 for opt type and opt len fields */
394  offset += optlen;
395  }
396  /* flag packets that have only padding */
397  if (padn_cnt > 0 && other_cnt == 0) {
398  if (nh == IPPROTO_HOPOPTS)
399  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING);
400  else
401  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING);
402  }
403 
404  nh = *pkt;
405  pkt += hdrextlen;
406  plen -= hdrextlen;
407  break;
408  }
409 
410  case IPPROTO_FRAGMENT:
411  {
412  IPV6_SET_L4PROTO(p,nh);
413  /* store the offset of this extension into the packet
414  * past the ipv6 header. We use it in defrag for creating
415  * a defragmented packet without the frag header */
416  if (exthdr_fh_done == 0) {
417  p->ip6eh.fh_offset = pkt - orig_pkt;
418  exthdr_fh_done = 1;
419  }
420 
421  uint16_t prev_hdrextlen = hdrextlen;
422  hdrextlen = sizeof(IPV6FragHdr);
423  if (hdrextlen > plen) {
424  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
425  SCReturn;
426  }
427 
428  /* for the frag header, the length field is reserved */
429  if (*(pkt + 1) != 0) {
430  ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD);
431  /* non fatal, lets try to continue */
432  }
433 
434  if (IPV6_EXTHDR_ISSET_FH(p)) {
435  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH);
436  nh = *pkt;
437  pkt += hdrextlen;
438  plen -= hdrextlen;
439  break;
440  }
441 
442  /* set the header flag first */
443  IPV6_EXTHDR_SET_FH(p);
444 
445  /* parse the header and setup the vars */
446  DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
447 
448  /* if FH has offset 0 and no more fragments are coming, we
449  * parse this packet further right away, no defrag will be
450  * needed. It is a useless FH then though, so we do set an
451  * decoder event. */
452  if (p->ip6eh.fh_more_frags_set == 0 && p->ip6eh.fh_offset == 0) {
453  ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH);
454 
455  nh = *pkt;
456  pkt += hdrextlen;
457  plen -= hdrextlen;
458  break;
459  }
460 
461  /* the rest is parsed upon reassembly */
462  p->flags |= PKT_IS_FRAGMENT;
463  SCReturn;
464  }
465  case IPPROTO_ESP:
466  {
467  IPV6_SET_L4PROTO(p,nh);
468  hdrextlen = sizeof(IPV6EspHdr);
469  if (hdrextlen > plen) {
470  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
471  SCReturn;
472  }
473 
474  if (eh) {
475  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_EH);
476  SCReturn;
477  }
478 
479  eh = 1;
480 
481  nh = IPPROTO_NONE;
482  pkt += hdrextlen;
483  plen -= hdrextlen;
484  break;
485  }
486  case IPPROTO_AH:
487  {
488  IPV6_SET_L4PROTO(p,nh);
489  /* we need the header as a minimum */
490  hdrextlen = sizeof(IPV6AuthHdr);
491  /* the payload len field is the number of extra 4 byte fields,
492  * IPV6AuthHdr already contains the first */
493  if (*(pkt+1) > 0)
494  hdrextlen += ((*(pkt+1) - 1) * 4);
495 
496  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
497 
498  if (hdrextlen > plen) {
499  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
500  SCReturn;
501  }
502 
503  IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
504  if (ahhdr->ip6ah_reserved != 0x0000) {
505  ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL);
506  }
507 
508  if (ah) {
509  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH);
510  nh = *pkt;
511  pkt += hdrextlen;
512  plen -= hdrextlen;
513  break;
514  }
515 
516  ah = 1;
517 
518  nh = *pkt;
519  pkt += hdrextlen;
520  plen -= hdrextlen;
521  break;
522  }
523  case IPPROTO_IPIP:
524  IPV6_SET_L4PROTO(p,nh);
525  DecodeIPv4inIPv6(tv, dtv, p, pkt, plen, pq);
526  SCReturn;
527  /* none, last header */
528  case IPPROTO_NONE:
529  IPV6_SET_L4PROTO(p,nh);
530  SCReturn;
531  case IPPROTO_ICMP:
532  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
533  SCReturn;
534  /* no parsing yet, just skip it */
535  case IPPROTO_MH:
536  case IPPROTO_HIP:
537  case IPPROTO_SHIM6:
538  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
539  if (hdrextlen > plen) {
540  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
541  SCReturn;
542  }
543  nh = *pkt;
544  pkt += hdrextlen;
545  plen -= hdrextlen;
546  break;
547  default:
548  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
549  IPV6_SET_L4PROTO(p,nh);
550  SCReturn;
551  }
552  }
553 
554  SCReturn;
555 }
556 
557 static int DecodeIPV6Packet (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len)
558 {
559  if (unlikely(len < IPV6_HEADER_LEN)) {
560  return -1;
561  }
562 
563  if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
564  SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
565  ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
566  return -1;
567  }
568 
569  p->ip6h = (IPV6Hdr *)pkt;
570 
571  if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_PLEN(p))))
572  {
573  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
574  return -1;
575  }
576 
577  SET_IPV6_SRC_ADDR(p,&p->src);
578  SET_IPV6_DST_ADDR(p,&p->dst);
579 
580  return 0;
581 }
582 
583 int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
584 {
585  StatsIncr(tv, dtv->counter_ipv6);
586 
587  /* do the actual decoding */
588  int ret = DecodeIPV6Packet (tv, dtv, p, pkt, len);
589  if (unlikely(ret < 0)) {
590  p->ip6h = NULL;
591  return TM_ECODE_FAILED;
592  }
593 
594 #ifdef DEBUG
595  if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
596  /* debug print */
597  char s[46], d[46];
598  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
599  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
600  SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32 " PLEN: %" PRIu32 " HLIM: %" PRIu32 "", s,d,
601  IPV6_GET_CLASS(p), IPV6_GET_FLOW(p), IPV6_GET_NH(p), IPV6_GET_PLEN(p),
602  IPV6_GET_HLIM(p));
603  }
604 #endif /* DEBUG */
605 
606  /* now process the Ext headers and/or the L4 Layer */
607  switch(IPV6_GET_NH(p)) {
608  case IPPROTO_TCP:
609  IPV6_SET_L4PROTO (p, IPPROTO_TCP);
610  DecodeTCP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
611  return TM_ECODE_OK;
612  case IPPROTO_UDP:
613  IPV6_SET_L4PROTO (p, IPPROTO_UDP);
614  DecodeUDP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
615  return TM_ECODE_OK;
616  case IPPROTO_ICMPV6:
617  IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
618  DecodeICMPV6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
619  return TM_ECODE_OK;
620  case IPPROTO_SCTP:
621  IPV6_SET_L4PROTO (p, IPPROTO_SCTP);
622  DecodeSCTP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
623  return TM_ECODE_OK;
624  case IPPROTO_IPIP:
625  IPV6_SET_L4PROTO(p, IPPROTO_IPIP);
626  DecodeIPv4inIPv6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
627  return TM_ECODE_OK;
628  case IPPROTO_IPV6:
629  DecodeIP6inIP6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
630  return TM_ECODE_OK;
631  case IPPROTO_GRE:
632  DecodeGRE(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
633  break;
634  case IPPROTO_FRAGMENT:
635  case IPPROTO_HOPOPTS:
636  case IPPROTO_ROUTING:
637  case IPPROTO_NONE:
638  case IPPROTO_DSTOPTS:
639  case IPPROTO_AH:
640  case IPPROTO_ESP:
641  case IPPROTO_MH:
642  case IPPROTO_HIP:
643  case IPPROTO_SHIM6:
644  DecodeIPV6ExtHdrs(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p), pq);
645  break;
646  case IPPROTO_ICMP:
647  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
648  break;
649  default:
650  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
651  IPV6_SET_L4PROTO (p, IPV6_GET_NH(p));
652  break;
653  }
654  p->proto = IPV6_GET_L4PROTO (p);
655 
656  /* Pass to defragger if a fragment. */
657  if (IPV6_EXTHDR_ISSET_FH(p)) {
658  Packet *rp = Defrag(tv, dtv, p, pq);
659  if (rp != NULL) {
660  PacketEnqueue(pq,rp);
661  }
662  }
663 
664  return TM_ECODE_OK;
665 }
666 
667 #ifdef UNITTESTS
668 
669 /**
670  * \test fragment decoding
671  */
672 static int DecodeIPV6FragTest01 (void)
673 {
674 
675  uint8_t raw_frag1[] = {
676  0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
677  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
678  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
679  0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
680  0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
681  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
682  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
683  0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
684  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
685  0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
686  0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
687  0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
688  0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
689  0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
690  0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
691  0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
692  0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
693  0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
694  0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
695  0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
696  0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
697  0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
698  0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
699  0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
700  0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
701  0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
702  0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
703  0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
704  0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
705  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
706  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
707  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
708  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
748  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
749  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
750  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
751  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
752  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
753  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
754  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
755  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
756  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
757  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
758  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
759  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
760  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
761  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
762  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
763  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
764  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
765  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
766  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
767  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
768  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
769  };
770  uint8_t raw_frag2[] = {
771  0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
772  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
773  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
774  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
775  0x20, 0x20, 0x20, 0x20,
776  };
777  Packet *pkt;
778  Packet *p1 = PacketGetFromAlloc();
779  if (unlikely(p1 == NULL))
780  return 0;
781  Packet *p2 = PacketGetFromAlloc();
782  if (unlikely(p2 == NULL)) {
783  SCFree(p1);
784  return 0;
785  }
786  ThreadVars tv;
787  DecodeThreadVars dtv;
788  int result = 0;
789  PacketQueue pq;
790 
791  FlowInitConfig(FLOW_QUIET);
792  DefragInit();
793 
794  memset(&pq, 0, sizeof(PacketQueue));
795  memset(&tv, 0, sizeof(ThreadVars));
796  memset(&dtv, 0, sizeof(DecodeThreadVars));
797 
798  PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
799  PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
800 
801  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq);
802 
803  if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
804  printf("ipv6 frag header not detected: ");
805  goto end;
806  }
807 
808  DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2), &pq);
809 
810  if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
811  printf("ipv6 frag header not detected: ");
812  goto end;
813  }
814 
815  if (pq.len != 1) {
816  printf("no reassembled packet: ");
817  goto end;
818  }
819 
820  result = 1;
821 end:
822  PACKET_RECYCLE(p1);
823  PACKET_RECYCLE(p2);
824  SCFree(p1);
825  SCFree(p2);
826  pkt = PacketDequeue(&pq);
827  while (pkt != NULL) {
828  PACKET_RECYCLE(pkt);
829  SCFree(pkt);
830  pkt = PacketDequeue(&pq);
831  }
832  DefragDestroy();
833  FlowShutdown();
834  return result;
835 }
836 
837 /**
838  * \test routing header decode
839  */
840 static int DecodeIPV6RouteTest01 (void)
841 {
842  uint8_t raw_pkt1[] = {
843  0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
844  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
845  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
846  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
847  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
848  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
849 
850  0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
851  0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
852  0xfa, 0x87, 0x00, 0x00,
853  };
854  Packet *p1 = PacketGetFromAlloc();
855  FAIL_IF(unlikely(p1 == NULL));
856  ThreadVars tv;
857  DecodeThreadVars dtv;
858  PacketQueue pq;
859 
860  FlowInitConfig(FLOW_QUIET);
861 
862  memset(&pq, 0, sizeof(PacketQueue));
863  memset(&tv, 0, sizeof(ThreadVars));
864  memset(&dtv, 0, sizeof(DecodeThreadVars));
865 
866  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
867 
868  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq);
869 
870  FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1)));
871  FAIL_IF (p1->ip6eh.rh_type != 0);
872  PACKET_RECYCLE(p1);
873  SCFree(p1);
874  FlowShutdown();
875  PASS;
876 }
877 
878 /**
879  * \test HOP header decode
880  */
881 static int DecodeIPV6HopTest01 (void)
882 {
883  uint8_t raw_pkt1[] = {
884  0x60,0x00,0x00,0x00,0x00,0x20,0x00,0x01,0xfe,0x80,0x00,0x00,0x00,0x00,0x00,0x00,
885  0x02,0x0f,0xfe,0xff,0xfe,0x98,0x3d,0x01,0xff,0x02,0x00,0x00,0x00,0x00,0x00,0x00,
886  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x3a,0x00,0xff, /* 0xff is a nonsene opt */
887  0x02,0x00,0x00,0x00,0x00,
888  0x82,0x00,0x1c,0x6f,0x27,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
889  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
890  };
891  Packet *p1 = PacketGetFromAlloc();
892  FAIL_IF(unlikely(p1 == NULL));
893  ThreadVars tv;
894  DecodeThreadVars dtv;
895  PacketQueue pq;
896 
897  FlowInitConfig(FLOW_QUIET);
898 
899  memset(&pq, 0, sizeof(PacketQueue));
900  memset(&tv, 0, sizeof(ThreadVars));
901  memset(&dtv, 0, sizeof(DecodeThreadVars));
902 
903  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
904 
905  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq);
906 
907  FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
908 
909  PACKET_RECYCLE(p1);
910  SCFree(p1);
911  FlowShutdown();
912  PASS;
913 }
914 
915 #endif /* UNITTESTS */
916 
917 /**
918  * \brief this function registers unit tests for IPV6 decoder
919  */
920 
921 void DecodeIPV6RegisterTests(void)
922 {
923 #ifdef UNITTESTS
924  UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
925  UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
926  UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
927 #endif /* UNITTESTS */
928 }
929 
930 /**
931  * @}
932  */
IPV6OPT_RA
#define IPV6OPT_RA
Definition: decode-ipv6.h:164
IPV6_EXTHDR_SET_RH
#define IPV6_EXTHDR_SET_RH(p)
Definition: decode-ipv6.h:240
IPV6Hdr_
Definition: decode-ipv6.h:31
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:989
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:335
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:1004
IPV6OptHAO_::ip6hao_len
uint8_t ip6hao_len
Definition: decode-ipv6.h:172
FALSE
#define FALSE
Definition: suricata-common.h:34
DecodeGRE
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq)
Function to decode GRE packets.
Definition: decode-gre.c:46
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
IPV6OptHAO_::ip6hao_hoa
struct in6_addr ip6hao_hoa
Definition: decode-ipv6.h:173
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1105
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-udp.c:74
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
offset
uint64_t offset
Definition: util-streaming-buffer.h:1478
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:38
Packet_::dst
Address dst
Definition: decode.h:413
IPV6OPT_JUMBO
#define IPV6OPT_JUMBO
Definition: decode-ipv6.h:165
PacketQueue_
Definition: decode.h:620
PACKET_RECYCLE
#define PACKET_RECYCLE(p)
Definition: decode.h:814
DecodeTCP
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-tcp.c:199
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1067
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:666
DecodeSCTP
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-sctp.c:62
TRUE
#define TRUE
Definition: suricata-common.h:33
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:631
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1132
IPPROTO_GRE
#define IPPROTO_GRE
Definition: decode-gre.h:30
IPV6OptRA_::ip6ra_type
uint8_t ip6ra_type
Definition: decode-ipv6.h:179
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
Definition: decode-ipv6.c:583
IPV6_SET_EXTHDRS_LEN
#define IPV6_SET_EXTHDRS_LEN(p, len)
Definition: decode-ipv6.h:73
Packet_::ip6h
IPV6Hdr * ip6h
Definition: decode.h:502
IPV6_GET_PLEN
#define IPV6_GET_PLEN(p)
Definition: decode-ipv6.h:88
Packet_::proto
uint8_t proto
Definition: decode.h:430
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:220
IPV6ExtHdrs_::fh_data_len
uint16_t fh_data_len
Definition: decode-ipv6.h:228
Packet_::ip6eh
IPV6ExtHdrs ip6eh
Definition: decode.h:509
IPV6ExtHdrs_::fh_nh
uint8_t fh_nh
Definition: decode-ipv6.h:221
PacketQueue_::len
uint32_t len
Definition: decode.h:623
SET_IPV6_SRC_ADDR
#define SET_IPV6_SRC_ADDR(p, a)
Definition: decode.h:165
IPV6OptRA_::ip6ra_value
uint16_t ip6ra_value
Definition: decode-ipv6.h:181
IPV6_EXTHDR_SET_FH
#define IPV6_EXTHDR_SET_FH(p)
Definition: decode-ipv6.h:238
IPV6ExtHdrs_::fh_header_offset
uint16_t fh_header_offset
Definition: decode-ipv6.h:226
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:667
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
IPV6_GET_FLOW
#define IPV6_GET_FLOW(p)
Definition: decode-ipv6.h:84
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:632
SCEnter
#define SCEnter(...)
Definition: util-debug.h:337
IP_GET_RAW_VER
#define IP_GET_RAW_VER(pkt)
Definition: decode.h:249
IPV6_GET_CLASS
#define IPV6_GET_CLASS(p)
Definition: decode-ipv6.h:82
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:163
IPV6OptJumbo_::ip6j_len
uint8_t ip6j_len
Definition: decode-ipv6.h:188
DecodeIPV6RegisterTests
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
Definition: decode-ipv6.c:921
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:267
IPV6_GET_NH
#define IPV6_GET_NH(p)
Definition: decode-ipv6.h:86
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:376
Packet_
Definition: decode.h:407
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:104
IPV6OptJumbo_::ip6j_type
uint8_t ip6j_type
Definition: decode-ipv6.h:187
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:647
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:93
DefragInit
void DefragInit(void)
Definition: defrag.c:1045
IPV6ExtHdrs_::fh_more_frags_set
_Bool fh_more_frags_set
Definition: decode-ipv6.h:220
IPV6_SET_L4PROTO
#define IPV6_SET_L4PROTO(p, proto)
Definition: decode-ipv6.h:72
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:219
IPV6_HEADER_LEN
#define IPV6_HEADER_LEN
Definition: decode-ipv6.h:27
SCFree
#define SCFree(a)
Definition: util-mem.h:322
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:377
DecodeICMPV6
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint32_t len, PacketQueue *pq)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:189
Defrag
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, PacketQueue *pq)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:999
IPV6OptHAO_
Definition: decode-ipv6.h:169
IPV6ExtHdrs_::rh_type
uint8_t rh_type
Definition: decode-ipv6.h:217
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:667
IPV6_EXTHDR_ISSET_FH
#define IPV6_EXTHDR_ISSET_FH(p)
Definition: decode-ipv6.h:239
IPV6OPT_PADN
#define IPV6OPT_PADN
Definition: decode-ipv6.h:163
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:225
PacketDequeue
Packet * PacketDequeue(PacketQueue *q)
Definition: packet-queue.c:167
IPV6OPT_PAD1
#define IPV6OPT_PAD1
Definition: decode-ipv6.h:162
IPV6OptJumbo_::ip6j_payload_len
uint32_t ip6j_payload_len
Definition: decode-ipv6.h:189
IPV6OptHAO_::ip6hao_type
uint8_t ip6hao_type
Definition: decode-ipv6.h:171
IPV6ExtHdrs_::fh_offset
uint16_t fh_offset
Definition: decode-ipv6.h:233
SCReturn
#define SCReturn
Definition: util-debug.h:339
len
uint8_t len
Definition: app-layer-dnp3.h:2649
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
SET_IPV6_DST_ADDR
#define SET_IPV6_DST_ADDR(p, a)
Definition: decode.h:173
IPV6ExtHdrs_::fh_data_offset
uint16_t fh_data_offset
Definition: decode-ipv6.h:227
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:224
IPV6ExtHdrs_::fh_prev_hdr_offset
uint16_t fh_prev_hdr_offset
Definition: decode-ipv6.h:224
IPV6OptRA_::ip6ra_len
uint8_t ip6ra_len
Definition: decode-ipv6.h:180
Packet_::flags
uint32_t flags
Definition: decode.h:443
IPV6ExtHdrs_::fh_id
uint32_t fh_id
Definition: decode-ipv6.h:234
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto, PacketQueue *pq)
Setup a pseudo packet (tunnel)
Definition: decode.c:275
ip6rh_type
uint8_t ip6rh_type
Definition: decode-ipv6.h:925
IPV6OptRA_
Definition: decode-ipv6.h:177
IPV4_HEADER_LEN
#define IPV4_HEADER_LEN
Definition: decode-ipv4.h:28
PacketCopyData
int PacketCopyData(Packet *p, uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:259
IPV6_EXTHDR_ISSET_RH
#define IPV6_EXTHDR_ISSET_RH(p)
Definition: decode-ipv6.h:241
PacketEnqueue
void PacketEnqueue(PacketQueue *q, Packet *p)
Definition: packet-queue.c:139
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:997
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:141
Packet_::src
Address src
Definition: decode.h:412
IPV6OPT_HAO
#define IPV6OPT_HAO
Definition: decode-ipv6.h:166
FlowInitConfig
void FlowInitConfig(char quiet)
initialize the configuration
Definition: flow.c:512
IPV6OptJumbo_
Definition: decode-ipv6.h:185