suricata
decode-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode IPv6
31  */
32 
33 #include "suricata-common.h"
34 #include "packet-queue.h"
35 #include "decode.h"
36 #include "decode-ipv6.h"
37 #include "decode-icmpv6.h"
38 #include "decode-events.h"
39 #include "defrag.h"
40 #include "pkt-var.h"
41 #include "util-debug.h"
42 #include "util-print.h"
43 #include "util-unittest.h"
44 #include "util-profiling.h"
45 #include "host.h"
46 
47 /**
48  * \brief Function to decode IPv4 in IPv6 packets
49  *
50  */
51 static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t plen)
52 {
53 
54  if (unlikely(plen < IPV4_HEADER_LEN)) {
55  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
56  return;
57  }
58  if (IP_GET_RAW_VER(pkt) == 4) {
59  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4);
60  if (tp != NULL) {
61  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
62  PacketEnqueueNoLock(&tv->decode_pq,tp);
63  StatsIncr(tv, dtv->counter_ipv4inipv6);
64  return;
65  }
66  } else {
67  ENGINE_SET_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER);
68  }
69  return;
70 }
71 
72 /**
73  * \brief Function to decode IPv6 in IPv6 packets
74  *
75  */
76 static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
77  const uint8_t *pkt, uint16_t plen)
78 {
79 
80  if (unlikely(plen < IPV6_HEADER_LEN)) {
81  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
82  return TM_ECODE_FAILED;
83  }
84  if (IP_GET_RAW_VER(pkt) == 6) {
85  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6);
86  if (tp != NULL) {
87  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
88  PacketEnqueueNoLock(&tv->decode_pq,tp);
89  StatsIncr(tv, dtv->counter_ipv6inipv6);
90  }
91  } else {
92  ENGINE_SET_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER);
93  }
94  return TM_ECODE_OK;
95 }
96 
97 #ifndef UNITTESTS // ugly, but we need this in defrag tests
98 static inline
99 #endif
100 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
101  uint16_t hdrextlen, uint16_t plen,
102  uint16_t prev_hdrextlen)
103 {
104  uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
105  int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
106 
107  p->ip6eh.fh_offset = frag_offset;
108  p->ip6eh.fh_more_frags_set = frag_morefrags ? TRUE : FALSE;
109  p->ip6eh.fh_nh = *pkt;
110 
111  uint32_t fh_id;
112  memcpy(&fh_id, pkt+4, 4);
113  p->ip6eh.fh_id = SCNtohl(fh_id);
114 
115  SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x",
116  p->ip6eh.fh_offset,
117  p->ip6eh.fh_more_frags_set ? "true" : "false",
118  p->ip6eh.fh_nh,
119  p->ip6eh.fh_id, p->ip6eh.fh_id);
120 
121  // store header offset, data offset
122  uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
123  uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
124  uint16_t data_len = plen - hdrextlen;
125 
126  p->ip6eh.fh_header_offset = frag_hdr_offset;
127  p->ip6eh.fh_data_offset = data_offset;
128  p->ip6eh.fh_data_len = data_len;
129 
130  /* if we have a prev hdr, store the type and offset of it */
131  if (prev_hdrextlen) {
132  p->ip6eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
133  }
134 
135  SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
136  p->ip6eh.fh_header_offset, p->ip6eh.fh_data_offset,
137  p->ip6eh.fh_data_len);
138 }
139 
140 static void
141 DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
142  const uint8_t *pkt, uint16_t len)
143 {
144  SCEnter();
145 
146  const uint8_t *orig_pkt = pkt;
147  uint8_t nh = IPV6_GET_NH(p); /* careful, 0 is actually a real type */
148  uint16_t hdrextlen = 0;
149  uint16_t plen = len;
150  char dstopts = 0;
151  char exthdr_fh_done = 0;
152  int hh = 0;
153  int rh = 0;
154  int eh = 0;
155  int ah = 0;
156 
157  while(1)
158  {
159  IPV6_SET_EXTHDRS_LEN(p, (len - plen));
160 
161  if (nh == IPPROTO_NONE) {
162  if (plen > 0) {
163  /* No upper layer, but we do have data. Suspicious. */
164  ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER);
165  }
166  SCReturn;
167  }
168 
169  if (plen < 2) { /* minimal needed in a hdr */
170  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
171  SCReturn;
172  }
173 
174  switch(nh)
175  {
176  case IPPROTO_TCP:
177  IPV6_SET_L4PROTO(p,nh);
178  DecodeTCP(tv, dtv, p, pkt, plen);
179  SCReturn;
180 
181  case IPPROTO_UDP:
182  IPV6_SET_L4PROTO(p,nh);
183  DecodeUDP(tv, dtv, p, pkt, plen);
184  SCReturn;
185 
186  case IPPROTO_ICMPV6:
187  IPV6_SET_L4PROTO(p,nh);
188  DecodeICMPV6(tv, dtv, p, pkt, plen);
189  SCReturn;
190 
191  case IPPROTO_SCTP:
192  IPV6_SET_L4PROTO(p,nh);
193  DecodeSCTP(tv, dtv, p, pkt, plen);
194  SCReturn;
195 
196  case IPPROTO_ROUTING:
197  IPV6_SET_L4PROTO(p,nh);
198  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
199 
200  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
201 
202  if (hdrextlen > plen) {
203  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
204  SCReturn;
205  }
206 
207  if (rh) {
208  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH);
209  /* skip past this extension so we can continue parsing the rest
210  * of the packet */
211  nh = *pkt;
212  pkt += hdrextlen;
213  plen -= hdrextlen;
214  break;
215  }
216 
217  rh = 1;
218  IPV6_EXTHDR_SET_RH(p);
219 
220  uint8_t ip6rh_type = *(pkt + 2);
221  if (ip6rh_type == 0) {
222  ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0);
223  }
224  p->ip6eh.rh_type = ip6rh_type;
225 
226  nh = *pkt;
227  pkt += hdrextlen;
228  plen -= hdrextlen;
229  break;
230 
231  case IPPROTO_HOPOPTS:
232  case IPPROTO_DSTOPTS:
233  {
234  IPV6OptHAO hao_s, *hao = &hao_s;
235  IPV6OptRA ra_s, *ra = &ra_s;
236  IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
237  uint16_t optslen = 0;
238 
239  IPV6_SET_L4PROTO(p,nh);
240  hdrextlen = (*(pkt+1) + 1) << 3;
241  if (hdrextlen > plen) {
242  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
243  SCReturn;
244  }
245 
246  const uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
247 
248  /* point the pointers to right structures
249  * in Packet. */
250  if (nh == IPPROTO_HOPOPTS) {
251  if (hh) {
252  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH);
253  /* skip past this extension so we can continue parsing the rest
254  * of the packet */
255  nh = *pkt;
256  pkt += hdrextlen;
257  plen -= hdrextlen;
258  break;
259  }
260 
261  hh = 1;
262 
263  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
264  }
265  else if (nh == IPPROTO_DSTOPTS)
266  {
267  if (dstopts == 0) {
268  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
269  dstopts = 1;
270  } else if (dstopts == 1) {
271  optslen = ((*(pkt + 1) + 1 ) << 3) - 2;
272  dstopts = 2;
273  } else {
274  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH);
275  /* skip past this extension so we can continue parsing the rest
276  * of the packet */
277  nh = *pkt;
278  pkt += hdrextlen;
279  plen -= hdrextlen;
280  break;
281  }
282  }
283 
284  if (optslen > plen) {
285  /* since the packet is long enough (we checked
286  * plen against hdrlen, the optlen must be malformed. */
287  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
288  /* skip past this extension so we can continue parsing the rest
289  * of the packet */
290  nh = *pkt;
291  pkt += hdrextlen;
292  plen -= hdrextlen;
293  break;
294  }
295 /** \todo move into own function to loaded on demand */
296  uint16_t padn_cnt = 0;
297  uint16_t other_cnt = 0;
298  uint16_t offset = 0;
299  while(offset < optslen)
300  {
301  if (*ptr == IPV6OPT_PAD1)
302  {
303  padn_cnt++;
304  offset++;
305  ptr++;
306  continue;
307  }
308 
309  if (offset + 1 >= optslen) {
310  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
311  break;
312  }
313 
314  /* length field for each opt */
315  uint8_t ip6_optlen = *(ptr + 1);
316 
317  /* see if the optlen from the packet fits the total optslen */
318  if ((offset + 1 + ip6_optlen) > optslen) {
319  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
320  break;
321  }
322 
323  if (*ptr == IPV6OPT_PADN) /* PadN */
324  {
325  //printf("PadN option\n");
326  padn_cnt++;
327 
328  /* a zero padN len would be weird */
329  if (ip6_optlen == 0)
330  ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN);
331  }
332  else if (*ptr == IPV6OPT_RA) /* RA */
333  {
334  ra->ip6ra_type = *(ptr);
335  ra->ip6ra_len = ip6_optlen;
336 
337  if (ip6_optlen < sizeof(ra->ip6ra_value)) {
338  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
339  break;
340  }
341 
342  memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
343  ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
344  //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
345  // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
346  other_cnt++;
347  }
348  else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
349  {
350  jumbo->ip6j_type = *(ptr);
351  jumbo->ip6j_len = ip6_optlen;
352 
353  if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
354  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
355  break;
356  }
357 
358  memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
359  jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
360  //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
361  // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
362  }
363  else if (*ptr == IPV6OPT_HAO) /* HAO */
364  {
365  hao->ip6hao_type = *(ptr);
366  hao->ip6hao_len = ip6_optlen;
367 
368  if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
369  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
370  break;
371  }
372 
373  memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa));
374  //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ",
375  // hao->ip6hao_type, hao->ip6hao_len);
376  //char addr_buf[46];
377  //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa),
378  // addr_buf,sizeof(addr_buf));
379  //printf("home addr %s\n", addr_buf);
380  other_cnt++;
381  } else {
382  if (nh == IPPROTO_HOPOPTS)
383  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT);
384  else
385  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT);
386 
387  other_cnt++;
388  }
389  uint16_t optlen = (*(ptr + 1) + 2);
390  ptr += optlen; /* +2 for opt type and opt len fields */
391  offset += optlen;
392  }
393  /* flag packets that have only padding */
394  if (padn_cnt > 0 && other_cnt == 0) {
395  if (nh == IPPROTO_HOPOPTS)
396  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING);
397  else
398  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING);
399  }
400 
401  nh = *pkt;
402  pkt += hdrextlen;
403  plen -= hdrextlen;
404  break;
405  }
406 
407  case IPPROTO_FRAGMENT:
408  {
409  IPV6_SET_L4PROTO(p,nh);
410  /* store the offset of this extension into the packet
411  * past the ipv6 header. We use it in defrag for creating
412  * a defragmented packet without the frag header */
413  if (exthdr_fh_done == 0) {
414  p->ip6eh.fh_offset = pkt - orig_pkt;
415  exthdr_fh_done = 1;
416  }
417 
418  uint16_t prev_hdrextlen = hdrextlen;
419  hdrextlen = sizeof(IPV6FragHdr);
420  if (hdrextlen > plen) {
421  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
422  SCReturn;
423  }
424 
425  /* for the frag header, the length field is reserved */
426  if (*(pkt + 1) != 0) {
427  ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD);
428  /* non fatal, lets try to continue */
429  }
430 
431  if (IPV6_EXTHDR_ISSET_FH(p)) {
432  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH);
433  nh = *pkt;
434  pkt += hdrextlen;
435  plen -= hdrextlen;
436  break;
437  }
438 
439  /* set the header flag first */
440  IPV6_EXTHDR_SET_FH(p);
441 
442  /* parse the header and setup the vars */
443  DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
444 
445  /* if FH has offset 0 and no more fragments are coming, we
446  * parse this packet further right away, no defrag will be
447  * needed. It is a useless FH then though, so we do set an
448  * decoder event. */
449  if (p->ip6eh.fh_more_frags_set == 0 && p->ip6eh.fh_offset == 0) {
450  ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH);
451 
452  nh = *pkt;
453  pkt += hdrextlen;
454  plen -= hdrextlen;
455  break;
456  }
457 
458  /* the rest is parsed upon reassembly */
459  p->flags |= PKT_IS_FRAGMENT;
460  SCReturn;
461  }
462  case IPPROTO_ESP:
463  {
464  IPV6_SET_L4PROTO(p,nh);
465  hdrextlen = sizeof(IPV6EspHdr);
466  if (hdrextlen > plen) {
467  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
468  SCReturn;
469  }
470 
471  if (eh) {
472  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_EH);
473  SCReturn;
474  }
475 
476  eh = 1;
477 
478  nh = IPPROTO_NONE;
479  pkt += hdrextlen;
480  plen -= hdrextlen;
481  break;
482  }
483  case IPPROTO_AH:
484  {
485  IPV6_SET_L4PROTO(p,nh);
486  /* we need the header as a minimum */
487  hdrextlen = sizeof(IPV6AuthHdr);
488  /* the payload len field is the number of extra 4 byte fields,
489  * IPV6AuthHdr already contains the first */
490  if (*(pkt+1) > 0)
491  hdrextlen += ((*(pkt+1) - 1) * 4);
492 
493  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
494 
495  if (hdrextlen > plen) {
496  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
497  SCReturn;
498  }
499 
500  IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
501  if (ahhdr->ip6ah_reserved != 0x0000) {
502  ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL);
503  }
504 
505  if (ah) {
506  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH);
507  nh = *pkt;
508  pkt += hdrextlen;
509  plen -= hdrextlen;
510  break;
511  }
512 
513  ah = 1;
514 
515  nh = *pkt;
516  pkt += hdrextlen;
517  plen -= hdrextlen;
518  break;
519  }
520  case IPPROTO_IPIP:
521  IPV6_SET_L4PROTO(p,nh);
522  DecodeIPv4inIPv6(tv, dtv, p, pkt, plen);
523  SCReturn;
524  /* none, last header */
525  case IPPROTO_NONE:
526  IPV6_SET_L4PROTO(p,nh);
527  SCReturn;
528  case IPPROTO_ICMP:
529  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
530  SCReturn;
531  /* no parsing yet, just skip it */
532  case IPPROTO_MH:
533  case IPPROTO_HIP:
534  case IPPROTO_SHIM6:
535  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
536  if (hdrextlen > plen) {
537  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
538  SCReturn;
539  }
540  nh = *pkt;
541  pkt += hdrextlen;
542  plen -= hdrextlen;
543  break;
544  default:
545  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
546  IPV6_SET_L4PROTO(p,nh);
547  SCReturn;
548  }
549  }
550 
551  SCReturn;
552 }
553 
554 static int DecodeIPV6Packet (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
555 {
556  if (unlikely(len < IPV6_HEADER_LEN)) {
557  return -1;
558  }
559 
560  if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
561  SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
562  ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
563  return -1;
564  }
565 
566  p->ip6h = (IPV6Hdr *)pkt;
567 
568  if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_PLEN(p))))
569  {
570  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
571  return -1;
572  }
573 
574  SET_IPV6_SRC_ADDR(p,&p->src);
575  SET_IPV6_DST_ADDR(p,&p->dst);
576 
577  return 0;
578 }
579 
580 int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
581 {
582  StatsIncr(tv, dtv->counter_ipv6);
583 
584  /* do the actual decoding */
585  int ret = DecodeIPV6Packet (tv, dtv, p, pkt, len);
586  if (unlikely(ret < 0)) {
587  CLEAR_IPV6_PACKET(p);
588  return TM_ECODE_FAILED;
589  }
590 
591 #ifdef DEBUG
592  if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
593  /* debug print */
594  char s[46], d[46];
595  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
596  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
597  SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32 " PLEN: %" PRIu32 " HLIM: %" PRIu32 "", s,d,
598  IPV6_GET_CLASS(p), IPV6_GET_FLOW(p), IPV6_GET_NH(p), IPV6_GET_PLEN(p),
599  IPV6_GET_HLIM(p));
600  }
601 #endif /* DEBUG */
602 
603  /* now process the Ext headers and/or the L4 Layer */
604  switch(IPV6_GET_NH(p)) {
605  case IPPROTO_TCP:
606  IPV6_SET_L4PROTO (p, IPPROTO_TCP);
607  DecodeTCP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
608  return TM_ECODE_OK;
609  case IPPROTO_UDP:
610  IPV6_SET_L4PROTO (p, IPPROTO_UDP);
611  DecodeUDP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
612  return TM_ECODE_OK;
613  case IPPROTO_ICMPV6:
614  IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
615  DecodeICMPV6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
616  return TM_ECODE_OK;
617  case IPPROTO_SCTP:
618  IPV6_SET_L4PROTO (p, IPPROTO_SCTP);
619  DecodeSCTP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
620  return TM_ECODE_OK;
621  case IPPROTO_IPIP:
622  IPV6_SET_L4PROTO(p, IPPROTO_IPIP);
623  DecodeIPv4inIPv6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
624  return TM_ECODE_OK;
625  case IPPROTO_IPV6:
626  DecodeIP6inIP6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
627  return TM_ECODE_OK;
628  case IPPROTO_GRE:
629  DecodeGRE(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
630  break;
631  case IPPROTO_FRAGMENT:
632  case IPPROTO_HOPOPTS:
633  case IPPROTO_ROUTING:
634  case IPPROTO_NONE:
635  case IPPROTO_DSTOPTS:
636  case IPPROTO_AH:
637  case IPPROTO_ESP:
638  case IPPROTO_MH:
639  case IPPROTO_HIP:
640  case IPPROTO_SHIM6:
641  DecodeIPV6ExtHdrs(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
642  break;
643  case IPPROTO_ICMP:
644  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
645  break;
646  default:
647  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
648  IPV6_SET_L4PROTO (p, IPV6_GET_NH(p));
649  break;
650  }
651  p->proto = IPV6_GET_L4PROTO (p);
652 
653  /* Pass to defragger if a fragment. */
654  if (IPV6_EXTHDR_ISSET_FH(p)) {
655  Packet *rp = Defrag(tv, dtv, p);
656  if (rp != NULL) {
657  PacketEnqueueNoLock(&tv->decode_pq,rp);
658  }
659  }
660 
661  return TM_ECODE_OK;
662 }
663 
664 #ifdef UNITTESTS
665 
666 /**
667  * \test fragment decoding
668  */
669 static int DecodeIPV6FragTest01 (void)
670 {
671 
672  uint8_t raw_frag1[] = {
673  0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
674  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
675  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
676  0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
677  0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
678  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
679  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
680  0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
681  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
682  0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
683  0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
684  0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
685  0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
686  0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
687  0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
688  0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
689  0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
690  0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
691  0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
692  0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
693  0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
694  0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
695  0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
696  0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
697  0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
698  0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
699  0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
700  0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
701  0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
702  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
703  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
704  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
705  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
706  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
707  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
708  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
748  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
749  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
750  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
751  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
752  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
753  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
754  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
755  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
756  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
757  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
758  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
759  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
760  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
761  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
762  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
763  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
764  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
765  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
766  };
767  uint8_t raw_frag2[] = {
768  0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
769  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
770  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
771  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
772  0x20, 0x20, 0x20, 0x20,
773  };
774  Packet *pkt;
775  Packet *p1 = PacketGetFromAlloc();
776  if (unlikely(p1 == NULL))
777  return 0;
778  Packet *p2 = PacketGetFromAlloc();
779  if (unlikely(p2 == NULL)) {
780  SCFree(p1);
781  return 0;
782  }
783  ThreadVars tv;
784  DecodeThreadVars dtv;
785  int result = 0;
786 
787  FlowInitConfig(FLOW_QUIET);
788  DefragInit();
789 
790  memset(&tv, 0, sizeof(ThreadVars));
791  memset(&dtv, 0, sizeof(DecodeThreadVars));
792 
793  PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
794  PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
795 
796  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
797 
798  if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
799  printf("ipv6 frag header not detected: ");
800  goto end;
801  }
802 
803  DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2));
804 
805  if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
806  printf("ipv6 frag header not detected: ");
807  goto end;
808  }
809 
810  if (tv.decode_pq.len != 1) {
811  printf("no reassembled packet: ");
812  goto end;
813  }
814 
815  result = 1;
816 end:
817  PACKET_RECYCLE(p1);
818  PACKET_RECYCLE(p2);
819  SCFree(p1);
820  SCFree(p2);
821  pkt = PacketDequeueNoLock(&tv.decode_pq);
822  while (pkt != NULL) {
823  PACKET_RECYCLE(pkt);
824  SCFree(pkt);
825  pkt = PacketDequeueNoLock(&tv.decode_pq);
826  }
827  DefragDestroy();
828  FlowShutdown();
829  return result;
830 }
831 
832 /**
833  * \test routing header decode
834  */
835 static int DecodeIPV6RouteTest01 (void)
836 {
837  uint8_t raw_pkt1[] = {
838  0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
839  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
840  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
841  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
842  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
843  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
844 
845  0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
846  0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
847  0xfa, 0x87, 0x00, 0x00,
848  };
849  Packet *p1 = PacketGetFromAlloc();
850  FAIL_IF(unlikely(p1 == NULL));
851  ThreadVars tv;
852  DecodeThreadVars dtv;
853 
854  FlowInitConfig(FLOW_QUIET);
855 
856  memset(&tv, 0, sizeof(ThreadVars));
857  memset(&dtv, 0, sizeof(DecodeThreadVars));
858 
859  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
860 
861  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
862 
863  FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1)));
864  FAIL_IF (p1->ip6eh.rh_type != 0);
865  PACKET_RECYCLE(p1);
866  SCFree(p1);
867  FlowShutdown();
868  PASS;
869 }
870 
871 /**
872  * \test HOP header decode
873  */
874 static int DecodeIPV6HopTest01 (void)
875 {
876  uint8_t raw_pkt1[] = {
877  0x60,0x00,0x00,0x00,0x00,0x20,0x00,0x01,0xfe,0x80,0x00,0x00,0x00,0x00,0x00,0x00,
878  0x02,0x0f,0xfe,0xff,0xfe,0x98,0x3d,0x01,0xff,0x02,0x00,0x00,0x00,0x00,0x00,0x00,
879  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x3a,0x00,0xff, /* 0xff is a nonsene opt */
880  0x02,0x00,0x00,0x00,0x00,
881  0x82,0x00,0x1c,0x6f,0x27,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
882  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
883  };
884  Packet *p1 = PacketGetFromAlloc();
885  FAIL_IF(unlikely(p1 == NULL));
886  ThreadVars tv;
887  DecodeThreadVars dtv;
888 
889  FlowInitConfig(FLOW_QUIET);
890 
891  memset(&tv, 0, sizeof(ThreadVars));
892  memset(&dtv, 0, sizeof(DecodeThreadVars));
893 
894  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
895 
896  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
897 
898  FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
899 
900  PACKET_RECYCLE(p1);
901  SCFree(p1);
902  FlowShutdown();
903  PASS;
904 }
905 
906 #endif /* UNITTESTS */
907 
908 /**
909  * \brief this function registers unit tests for IPV6 decoder
910  */
911 
912 void DecodeIPV6RegisterTests(void)
913 {
914 #ifdef UNITTESTS
915  UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
916  UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
917  UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
918 #endif /* UNITTESTS */
919 }
920 
921 /**
922  * @}
923  */
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:981
IPV6_EXTHDR_DUPL_FH
@ IPV6_EXTHDR_DUPL_FH
Definition: decode-events.h:68
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1090
host.h
IPV6ExtHdrs_::fh_data_offset
uint16_t fh_data_offset
Definition: decode-ipv6.h:227
Packet_::proto
uint8_t proto
Definition: decode.h:433
len
uint8_t len
Definition: app-layer-dnp3.h:2
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:888
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:169
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
IPV6_HOPOPTS_ONLY_PADDING
@ IPV6_HOPOPTS_ONLY_PADDING
Definition: decode-events.h:81
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:74
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:262
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:996
ip6rh_type
uint8_t ip6rh_type
Definition: decode-ipv6.h:3
IPV6_HOPOPTS_UNKNOWN_OPT
@ IPV6_HOPOPTS_UNKNOWN_OPT
Definition: decode-events.h:80
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:298
IPV6OptRA_::ip6ra_value
uint16_t ip6ra_value
Definition: decode-ipv6.h:181
IPV6OptHAO_::ip6hao_hoa
struct in6_addr ip6hao_hoa
Definition: decode-ipv6.h:173
IPV6_EXTHDR_ISSET_FH
#define IPV6_EXTHDR_ISSET_FH(p)
Definition: decode-ipv6.h:239
SET_IPV6_DST_ADDR
#define SET_IPV6_DST_ADDR(p, a)
Definition: decode.h:176
IPV6_EXTHDR_DUPL_HH
@ IPV6_EXTHDR_DUPL_HH
Definition: decode-events.h:71
IPV6ExtHdrs_::fh_nh
uint8_t fh_nh
Definition: decode-ipv6.h:221
IPV6OPT_HAO
#define IPV6OPT_HAO
Definition: decode-ipv6.h:166
Packet_::flags
uint32_t flags
Definition: decode.h:446
IPV6OPT_PADN
#define IPV6OPT_PADN
Definition: decode-ipv6.h:163
IPV6_EXTHDR_DUPL_EH
@ IPV6_EXTHDR_DUPL_EH
Definition: decode-events.h:74
FlowInitConfig
void FlowInitConfig(char quiet)
initialize the configuration
Definition: flow.c:531
IPV6_EXTHDR_DUPL_RH
@ IPV6_EXTHDR_DUPL_RH
Definition: decode-events.h:70
packet-queue.h
IPV6OPT_RA
#define IPV6OPT_RA
Definition: decode-ipv6.h:164
IPV6_IN_IPV6_WRONG_IP_VER
@ IPV6_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:176
IPV6_EXTHDR_AH_RES_NOT_NULL
@ IPV6_EXTHDR_AH_RES_NOT_NULL
Definition: decode-events.h:78
IPV6_EXTHDR_SET_FH
#define IPV6_EXTHDR_SET_FH(p)
Definition: decode-ipv6.h:238
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:93
IPPROTO_GRE
#define IPPROTO_GRE
Definition: decode-gre.h:30
IP_GET_RAW_VER
#define IP_GET_RAW_VER(pkt)
Definition: decode.h:252
IPV6_SET_L4PROTO
#define IPV6_SET_L4PROTO(p, proto)
Definition: decode-ipv6.h:72
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:79
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:223
IPV6_EXTHDR_USELESS_FH
@ IPV6_EXTHDR_USELESS_FH
Definition: decode-events.h:69
util-unittest.h
DecodeSCTP
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-sctp.c:62
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:78
IPV6ExtHdrs_::fh_id
uint32_t fh_id
Definition: decode-ipv6.h:234
IPV6OptHAO_::ip6hao_len
uint8_t ip6hao_len
Definition: decode-ipv6.h:172
IPV6_GET_PLEN
#define IPV6_GET_PLEN(p)
Definition: decode-ipv6.h:88
CLEAR_IPV6_PACKET
#define CLEAR_IPV6_PACKET(p)
Definition: decode-ipv6.h:111
IPV6OPT_JUMBO
#define IPV6OPT_JUMBO
Definition: decode-ipv6.h:165
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1128
IPV6_EXTHDR_INVALID_OPTLEN
@ IPV6_EXTHDR_INVALID_OPTLEN
Definition: decode-events.h:76
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:660
IPV6_EXTHDR_RH_TYPE_0
@ IPV6_EXTHDR_RH_TYPE_0
Definition: decode-events.h:85
decode-ipv6.h
IPV6_WITH_ICMPV4
@ IPV6_WITH_ICMPV4
Definition: decode-events.h:91
decode.h
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
IPV6_FH_NON_ZERO_RES_FIELD
@ IPV6_FH_NON_ZERO_RES_FIELD
Definition: decode-events.h:87
IPV6_TRUNC_PKT
@ IPV6_TRUNC_PKT
Definition: decode-events.h:66
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:206
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1102
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:100
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:300
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:228
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:267
pkt-var.h
IPV6_DSTOPTS_ONLY_PADDING
@ IPV6_DSTOPTS_ONLY_PADDING
Definition: decode-events.h:83
IPV6ExtHdrs_::fh_more_frags_set
bool fh_more_frags_set
Definition: decode-ipv6.h:220
SET_IPV6_SRC_ADDR
#define SET_IPV6_SRC_ADDR(p, a)
Definition: decode.h:168
DecodeGRE
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode GRE packets.
Definition: decode-gre.c:46
decode-icmpv6.h
IPV6_GET_NH
#define IPV6_GET_NH(p)
Definition: decode-ipv6.h:86
TRUE
#define TRUE
Definition: suricata-common.h:33
IPV6_WRONG_IP_VER
@ IPV6_WRONG_IP_VER
Definition: decode-events.h:77
util-profiling.h
FALSE
#define FALSE
Definition: suricata-common.h:34
SCReturn
#define SCReturn
Definition: util-debug.h:302
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:53
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:411
IPV6_EXTHDR_DUPL_DH
@ IPV6_EXTHDR_DUPL_DH
Definition: decode-events.h:72
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:580
IPV6_DATA_AFTER_NONE_HEADER
@ IPV6_DATA_AFTER_NONE_HEADER
Definition: decode-events.h:88
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:887
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:227
IPV6ExtHdrs_::fh_offset
uint16_t fh_offset
Definition: decode-ipv6.h:233
IPV6_DSTOPTS_UNKNOWN_OPT
@ IPV6_DSTOPTS_UNKNOWN_OPT
Definition: decode-events.h:82
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:659
defrag.h
IPV6_EXTHDR_ISSET_RH
#define IPV6_EXTHDR_ISSET_RH(p)
Definition: decode-ipv6.h:241
IPV6OptRA_
Definition: decode-ipv6.h:178
IPV6ExtHdrs_::fh_data_len
uint16_t fh_data_len
Definition: decode-ipv6.h:228
IPV6OptJumbo_::ip6j_payload_len
uint32_t ip6j_payload_len
Definition: decode-ipv6.h:189
decode-events.h
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:30
DecodeTCP
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-tcp.c:234
IPV6_GET_FLOW
#define IPV6_GET_FLOW(p)
Definition: decode-ipv6.h:84
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:167
IPV4_IN_IPV6_WRONG_IP_VER
@ IPV4_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:172
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:71
IPV6_GET_CLASS
#define IPV6_GET_CLASS(p)
Definition: decode-ipv6.h:82
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:398
DecodeICMPV6
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:188
suricata-common.h
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:640
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:686
IPV4_HEADER_LEN
#define IPV4_HEADER_LEN
Definition: decode-ipv4.h:28
IPV6OptHAO_::ip6hao_type
uint8_t ip6hao_type
Definition: decode-ipv6.h:171
IPV4_IN_IPV6_PKT_TOO_SMALL
@ IPV4_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:171
IPV6ExtHdrs_::fh_header_offset
uint16_t fh_header_offset
Definition: decode-ipv6.h:226
IPV6ExtHdrs_::fh_prev_hdr_offset
uint16_t fh_prev_hdr_offset
Definition: decode-ipv6.h:224
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:29
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:144
PacketQueueNoLock_::len
uint32_t len
Definition: packet-queue.h:35
IPV6_SET_EXTHDRS_LEN
#define IPV6_SET_EXTHDRS_LEN(p, len)
Definition: decode-ipv6.h:73
IPV6_IN_IPV6_PKT_TOO_SMALL
@ IPV6_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:175
IPV6OptRA_::ip6ra_len
uint8_t ip6ra_len
Definition: decode-ipv6.h:180
IPV6_TRUNC_EXTHDR
@ IPV6_TRUNC_EXTHDR
Definition: decode-events.h:67
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:222
SCFree
#define SCFree(p)
Definition: util-mem.h:61
IPV6_EXTHDR_DUPL_AH
@ IPV6_EXTHDR_DUPL_AH
Definition: decode-events.h:73
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:397
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:625
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:110
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
IPV6OptJumbo_
Definition: decode-ipv6.h:186
IPV6OptRA_::ip6ra_type
uint8_t ip6ra_type
Definition: decode-ipv6.h:179
IPV6OptJumbo_::ip6j_len
uint8_t ip6j_len
Definition: decode-ipv6.h:188
Packet_::dst
Address dst
Definition: decode.h:416
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:989
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:38
IPV6OptJumbo_::ip6j_type
uint8_t ip6j_type
Definition: decode-ipv6.h:187
IPV6_HEADER_LEN
#define IPV6_HEADER_LEN
Definition: decode-ipv6.h:27
IPV6ExtHdrs_::rh_type
uint8_t rh_type
Definition: decode-ipv6.h:217
Packet_::ip6h
IPV6Hdr * ip6h
Definition: decode.h:505
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:278
Defrag
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:1022
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:662
DecodeIPV6RegisterTests
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
Definition: decode-ipv6.c:912
IPV6OptHAO_
Definition: decode-ipv6.h:170
IPV6_UNKNOWN_NEXT_HEADER
@ IPV6_UNKNOWN_NEXT_HEADER
Definition: decode-events.h:90
Packet_::src
Address src
Definition: decode.h:415
DefragInit
void DefragInit(void)
Definition: defrag.c:1068
PACKET_RECYCLE
#define PACKET_RECYCLE(p)
Definition: decode.h:807
IPV6_EXTHDR_SET_RH
#define IPV6_EXTHDR_SET_RH(p)
Definition: decode-ipv6.h:240
Packet_::ip6eh
IPV6ExtHdrs ip6eh
Definition: decode.h:512
IPV6_EXTHDR_ZERO_LEN_PADN
@ IPV6_EXTHDR_ZERO_LEN_PADN
Definition: decode-events.h:86
IPV6OPT_PAD1
#define IPV6OPT_PAD1
Definition: decode-ipv6.h:162