suricata
decode-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2024 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode IPv6
31  */
32 
33 #include "suricata-common.h"
34 #include "decode-ipv6.h"
35 #include "decode.h"
36 #include "defrag.h"
37 #include "flow-hash.h"
38 #include "util-print.h"
39 #include "util-validate.h"
40 
41 /**
42  * \brief Function to decode IPv4 in IPv6 packets
43  *
44  */
45 static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t plen)
46 {
47 
48  if (unlikely(plen < IPV4_HEADER_LEN)) {
49  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
50  return;
51  }
52  if (IP_GET_RAW_VER(pkt) == 4) {
53  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4);
54  if (tp != NULL) {
55  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
56  PacketEnqueueNoLock(&tv->decode_pq,tp);
57  StatsIncr(tv, dtv->counter_ipv4inipv6);
58  }
59  FlowSetupPacket(p);
60  } else {
61  ENGINE_SET_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER);
62  }
63 }
64 
65 /**
66  * \brief Function to decode IPv6 in IPv6 packets
67  *
68  */
69 static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
70  const uint8_t *pkt, uint16_t plen)
71 {
72 
73  if (unlikely(plen < IPV6_HEADER_LEN)) {
74  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
75  return TM_ECODE_FAILED;
76  }
77  if (IP_GET_RAW_VER(pkt) == 6) {
78  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6);
79  if (tp != NULL) {
80  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
81  PacketEnqueueNoLock(&tv->decode_pq,tp);
82  StatsIncr(tv, dtv->counter_ipv6inipv6);
83  }
84  FlowSetupPacket(p);
85  } else {
86  ENGINE_SET_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER);
87  }
88  return TM_ECODE_OK;
89 }
90 
91 #ifndef UNITTESTS // ugly, but we need this in defrag tests
92 static inline
93 #endif
94 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
95  uint16_t hdrextlen, uint16_t plen,
96  uint16_t prev_hdrextlen)
97 {
98  uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
99  int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
100 
101  p->l3.vars.ip6.eh.fh_offset = frag_offset;
102  p->l3.vars.ip6.eh.fh_more_frags_set = frag_morefrags ? true : false;
103  p->l3.vars.ip6.eh.fh_nh = *pkt;
104 
105  uint32_t fh_id;
106  memcpy(&fh_id, pkt+4, 4);
107  p->l3.vars.ip6.eh.fh_id = SCNtohl(fh_id);
108 
109  SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x", p->l3.vars.ip6.eh.fh_offset,
110  p->l3.vars.ip6.eh.fh_more_frags_set ? "true" : "false", p->l3.vars.ip6.eh.fh_nh,
111  p->l3.vars.ip6.eh.fh_id, p->l3.vars.ip6.eh.fh_id);
112 
113  // store header offset, data offset
114  uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
115  uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
116  uint16_t data_len = plen - hdrextlen;
117 
118  p->l3.vars.ip6.eh.fh_header_offset = frag_hdr_offset;
119  p->l3.vars.ip6.eh.fh_data_offset = data_offset;
120  p->l3.vars.ip6.eh.fh_data_len = data_len;
121 
122  /* if we have a prev hdr, store the type and offset of it */
123  if (prev_hdrextlen) {
124  p->l3.vars.ip6.eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
125  }
126 
127  SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
128  p->l3.vars.ip6.eh.fh_header_offset, p->l3.vars.ip6.eh.fh_data_offset,
129  p->l3.vars.ip6.eh.fh_data_len);
130 }
131 
132 static void DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const IPV6Hdr *ip6h,
133  const uint8_t *pkt, uint16_t len)
134 {
135  SCEnter();
136 
137  const uint8_t *orig_pkt = pkt;
138  uint8_t nh = IPV6_GET_RAW_NH(ip6h); /* careful, 0 is actually a real type */
139  uint16_t hdrextlen = 0;
140  uint16_t plen = len;
141  char dstopts = 0;
142  char exthdr_fh_done = 0;
143  int hh = 0;
144  int rh = 0;
145  int ah = 0;
146 
147  while(1)
148  {
149  IPV6_SET_EXTHDRS_LEN(p, (len - plen));
150 
151  if (nh == IPPROTO_NONE) {
152  if (plen > 0) {
153  /* No upper layer, but we do have data. Suspicious. */
154  ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER);
155  }
156  SCReturn;
157  }
158 
159  if (plen < 2) { /* minimal needed in a hdr */
160  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
161  SCReturn;
162  }
163 
164  switch(nh)
165  {
166  case IPPROTO_TCP:
167  IPV6_SET_L4PROTO(p,nh);
168  DecodeTCP(tv, dtv, p, pkt, plen);
169  SCReturn;
170 
171  case IPPROTO_UDP:
172  IPV6_SET_L4PROTO(p,nh);
173  DecodeUDP(tv, dtv, p, pkt, plen);
174  SCReturn;
175 
176  case IPPROTO_ICMPV6:
177  IPV6_SET_L4PROTO(p,nh);
178  DecodeICMPV6(tv, dtv, p, pkt, plen);
179  SCReturn;
180 
181  case IPPROTO_SCTP:
182  IPV6_SET_L4PROTO(p,nh);
183  DecodeSCTP(tv, dtv, p, pkt, plen);
184  SCReturn;
185 
186  case IPPROTO_ROUTING:
187  IPV6_SET_L4PROTO(p,nh);
188  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
189 
190  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
191 
192  if (hdrextlen > plen) {
193  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
194  SCReturn;
195  }
196 
197  if (rh) {
198  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH);
199  /* skip past this extension so we can continue parsing the rest
200  * of the packet */
201  nh = *pkt;
202  pkt += hdrextlen;
203  plen -= hdrextlen;
204  break;
205  }
206 
207  rh = 1;
208  IPV6_EXTHDR_SET_RH(p);
209 
210  uint8_t ip6rh_type = *(pkt + 2);
211  if (ip6rh_type == 0) {
212  ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0);
213  }
214  p->l3.vars.ip6.eh.rh_type = ip6rh_type;
215 
216  nh = *pkt;
217  pkt += hdrextlen;
218  plen -= hdrextlen;
219  break;
220 
221  case IPPROTO_HOPOPTS:
222  case IPPROTO_DSTOPTS:
223  {
224  IPV6OptHAO hao_s, *hao = &hao_s;
225  IPV6OptRA ra_s, *ra = &ra_s;
226  IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
227  uint16_t optslen = 0;
228 
229  IPV6_SET_L4PROTO(p,nh);
230  hdrextlen = (uint16_t)((*(pkt + 1) + 1) << 3);
231  if (hdrextlen > plen) {
232  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
233  SCReturn;
234  }
235 
236  const uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
237 
238  /* point the pointers to right structures
239  * in Packet. */
240  if (nh == IPPROTO_HOPOPTS) {
241  if (hh) {
242  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH);
243  /* skip past this extension so we can continue parsing the rest
244  * of the packet */
245  nh = *pkt;
246  pkt += hdrextlen;
247  plen -= hdrextlen;
248  break;
249  }
250 
251  hh = 1;
252 
253  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
254  }
255  else if (nh == IPPROTO_DSTOPTS)
256  {
257  if (dstopts == 0) {
258  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
259  dstopts = 1;
260  } else if (dstopts == 1) {
261  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
262  dstopts = 2;
263  } else {
264  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH);
265  /* skip past this extension so we can continue parsing the rest
266  * of the packet */
267  nh = *pkt;
268  pkt += hdrextlen;
269  plen -= hdrextlen;
270  break;
271  }
272  }
273 
274  if (optslen > plen) {
275  /* since the packet is long enough (we checked
276  * plen against hdrlen, the optlen must be malformed. */
277  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
278  /* skip past this extension so we can continue parsing the rest
279  * of the packet */
280  nh = *pkt;
281  pkt += hdrextlen;
282  plen -= hdrextlen;
283  break;
284  }
285 /** \todo move into own function to loaded on demand */
286  uint16_t padn_cnt = 0;
287  uint16_t other_cnt = 0;
288  uint16_t offset = 0;
289  while(offset < optslen)
290  {
291  if (*ptr == IPV6OPT_PAD1)
292  {
293  padn_cnt++;
294  offset++;
295  ptr++;
296  continue;
297  }
298 
299  if (offset + 1 >= optslen) {
300  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
301  break;
302  }
303 
304  /* length field for each opt */
305  uint8_t ip6_optlen = *(ptr + 1);
306 
307  /* see if the optlen from the packet fits the total optslen */
308  if ((offset + 1 + ip6_optlen) > optslen) {
309  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
310  break;
311  }
312 
313  if (*ptr == IPV6OPT_PADN) /* PadN */
314  {
315  //printf("PadN option\n");
316  padn_cnt++;
317 
318  /* a zero padN len would be weird */
319  if (ip6_optlen == 0)
320  ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN);
321  }
322  else if (*ptr == IPV6OPT_RA) /* RA */
323  {
324  ra->ip6ra_type = *(ptr);
325  ra->ip6ra_len = ip6_optlen;
326 
327  if (ip6_optlen < sizeof(ra->ip6ra_value)) {
328  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
329  break;
330  }
331 
332  memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
333  ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
334  //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
335  // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
336  other_cnt++;
337  }
338  else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
339  {
340  jumbo->ip6j_type = *(ptr);
341  jumbo->ip6j_len = ip6_optlen;
342 
343  if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
344  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
345  break;
346  }
347 
348  memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
349  jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
350  //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
351  // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
352  }
353  else if (*ptr == IPV6OPT_HAO) /* HAO */
354  {
355  hao->ip6hao_type = *(ptr);
356  hao->ip6hao_len = ip6_optlen;
357 
358  if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
359  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
360  break;
361  }
362 
363  memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa));
364  //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ",
365  // hao->ip6hao_type, hao->ip6hao_len);
366  //char addr_buf[46];
367  //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa),
368  // addr_buf,sizeof(addr_buf));
369  //printf("home addr %s\n", addr_buf);
370  other_cnt++;
371  } else {
372  if (nh == IPPROTO_HOPOPTS)
373  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT);
374  else
375  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT);
376 
377  other_cnt++;
378  }
379  uint16_t optlen = (*(ptr + 1) + 2);
380  ptr += optlen; /* +2 for opt type and opt len fields */
381  offset += optlen;
382  }
383  /* flag packets that have only padding */
384  if (padn_cnt > 0 && other_cnt == 0) {
385  if (nh == IPPROTO_HOPOPTS)
386  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING);
387  else
388  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING);
389  }
390 
391  nh = *pkt;
392  pkt += hdrextlen;
393  plen -= hdrextlen;
394  break;
395  }
396 
397  case IPPROTO_FRAGMENT:
398  {
399  IPV6_SET_L4PROTO(p,nh);
400  /* store the offset of this extension into the packet
401  * past the ipv6 header. We use it in defrag for creating
402  * a defragmented packet without the frag header */
403  if (exthdr_fh_done == 0) {
404  DEBUG_VALIDATE_BUG_ON(pkt - orig_pkt > UINT16_MAX);
405  p->l3.vars.ip6.eh.fh_offset = (uint16_t)(pkt - orig_pkt);
406  exthdr_fh_done = 1;
407  }
408 
409  uint16_t prev_hdrextlen = hdrextlen;
410  hdrextlen = sizeof(IPV6FragHdr);
411  if (hdrextlen > plen) {
412  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
413  SCReturn;
414  }
415 
416  /* for the frag header, the length field is reserved */
417  if (*(pkt + 1) != 0) {
418  ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD);
419  /* non fatal, lets try to continue */
420  }
421 
422  if (IPV6_EXTHDR_ISSET_FH(p)) {
423  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH);
424  nh = *pkt;
425  pkt += hdrextlen;
426  plen -= hdrextlen;
427  break;
428  }
429 
430  /* set the header flag first */
431  IPV6_EXTHDR_SET_FH(p);
432 
433  /* parse the header and setup the vars */
434  DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
435 
436  /* if FH has offset 0 and no more fragments are coming, we
437  * parse this packet further right away, no defrag will be
438  * needed. It is a useless FH then though, so we do set an
439  * decoder event. */
440  if (p->l3.vars.ip6.eh.fh_more_frags_set == 0 && p->l3.vars.ip6.eh.fh_offset == 0) {
441  ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH);
442 
443  nh = *pkt;
444  pkt += hdrextlen;
445  plen -= hdrextlen;
446  break;
447  }
448  if (p->l3.vars.ip6.eh.fh_more_frags_set != 0 && plen % 8 != 0) {
449  // cf https://datatracker.ietf.org/doc/html/rfc2460#section-4.5
450  // each, except possibly the last ("rightmost") one,
451  // being an integer multiple of 8 octets long.
452  ENGINE_SET_EVENT(p, IPV6_FRAG_INVALID_LENGTH);
453  }
454 
455  /* the rest is parsed upon reassembly */
456  p->flags |= PKT_IS_FRAGMENT;
457  SCReturn;
458  }
459  case IPPROTO_ESP:
460  {
461  IPV6_SET_L4PROTO(p,nh);
462  DecodeESP(tv, dtv, p, pkt, plen);
463  SCReturn;
464  }
465  case IPPROTO_AH:
466  {
467  IPV6_SET_L4PROTO(p,nh);
468  /* we need the header as a minimum */
469  hdrextlen = sizeof(IPV6AuthHdr);
470  /* the payload len field is the number of extra 4 byte fields,
471  * IPV6AuthHdr already contains the first */
472  if (*(pkt+1) > 0)
473  hdrextlen += ((*(pkt+1) - 1) * 4);
474 
475  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
476 
477  if (hdrextlen > plen) {
478  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
479  SCReturn;
480  }
481 
482  IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
483  if (ahhdr->ip6ah_reserved != 0x0000) {
484  ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL);
485  }
486 
487  if (ah) {
488  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH);
489  nh = *pkt;
490  pkt += hdrextlen;
491  plen -= hdrextlen;
492  break;
493  }
494 
495  ah = 1;
496 
497  nh = *pkt;
498  pkt += hdrextlen;
499  plen -= hdrextlen;
500  break;
501  }
502  case IPPROTO_IPIP:
503  IPV6_SET_L4PROTO(p,nh);
504  DecodeIPv4inIPv6(tv, dtv, p, pkt, plen);
505  SCReturn;
506  /* none, last header */
507  case IPPROTO_NONE:
508  IPV6_SET_L4PROTO(p,nh);
509  SCReturn;
510  case IPPROTO_ICMP:
511  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
512  SCReturn;
513  /* no parsing yet, just skip it */
514  case IPPROTO_MH:
515  case IPPROTO_HIP:
516  case IPPROTO_SHIM6:
517  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
518  if (hdrextlen > plen) {
519  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
520  SCReturn;
521  }
522  nh = *pkt;
523  pkt += hdrextlen;
524  plen -= hdrextlen;
525  break;
526  default:
527  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
528  IPV6_SET_L4PROTO(p,nh);
529  SCReturn;
530  }
531  }
532 
533  SCReturn;
534 }
535 
536 static const IPV6Hdr *DecodeIPV6Packet(
537  ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
538 {
539  if (unlikely(len < IPV6_HEADER_LEN)) {
540  return NULL;
541  }
542 
543  if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
544  SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
545  ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
546  return NULL;
547  }
548 
549  const IPV6Hdr *ip6h = PacketSetIPV6(p, pkt);
550 
551  if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_RAW_PLEN(ip6h)))) {
552  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
553  return NULL;
554  }
555 
556  SET_IPV6_SRC_ADDR(ip6h, &p->src);
557  SET_IPV6_DST_ADDR(ip6h, &p->dst);
558 
559  return ip6h;
560 }
561 
562 int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
563 {
564  StatsIncr(tv, dtv->counter_ipv6);
565 
566  if (!PacketIncreaseCheckLayers(p)) {
567  return TM_ECODE_FAILED;
568  }
569  /* do the actual decoding */
570  const IPV6Hdr *ip6h = DecodeIPV6Packet(tv, dtv, p, pkt, len);
571  if (unlikely(ip6h == NULL)) {
572  PacketClearL3(p);
573  return TM_ECODE_FAILED;
574  }
575  p->proto = IPV6_GET_RAW_NH(ip6h);
576 
577 #ifdef DEBUG
578  if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
579  /* debug print */
580  char s[46], d[46];
581  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
582  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
583  SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32
584  " PLEN: %" PRIu32 " HLIM: %" PRIu32 "",
585  s, d, IPV6_GET_RAW_CLASS(ip6h), IPV6_GET_RAW_FLOW(ip6h), IPV6_GET_RAW_NH(ip6h),
586  IPV6_GET_RAW_PLEN(ip6h), IPV6_GET_RAW_HLIM(ip6h));
587  }
588 #endif /* DEBUG */
589  const uint8_t *data = pkt + IPV6_HEADER_LEN;
590  const uint16_t data_len = IPV6_GET_RAW_PLEN(ip6h);
591 
592  /* now process the Ext headers and/or the L4 Layer */
593  switch (IPV6_GET_RAW_NH(ip6h)) {
594  case IPPROTO_TCP:
595  IPV6_SET_L4PROTO (p, IPPROTO_TCP);
596  DecodeTCP(tv, dtv, p, data, data_len);
597  return TM_ECODE_OK;
598  case IPPROTO_UDP:
599  IPV6_SET_L4PROTO (p, IPPROTO_UDP);
600  DecodeUDP(tv, dtv, p, data, data_len);
601  return TM_ECODE_OK;
602  case IPPROTO_ICMPV6:
603  IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
604  DecodeICMPV6(tv, dtv, p, data, data_len);
605  return TM_ECODE_OK;
606  case IPPROTO_SCTP:
607  IPV6_SET_L4PROTO (p, IPPROTO_SCTP);
608  DecodeSCTP(tv, dtv, p, data, data_len);
609  return TM_ECODE_OK;
610  case IPPROTO_IPIP:
611  IPV6_SET_L4PROTO(p, IPPROTO_IPIP);
612  DecodeIPv4inIPv6(tv, dtv, p, data, data_len);
613  return TM_ECODE_OK;
614  case IPPROTO_IPV6:
615  DecodeIP6inIP6(tv, dtv, p, data, data_len);
616  return TM_ECODE_OK;
617  case IPPROTO_GRE:
618  IPV6_SET_L4PROTO(p, IPPROTO_GRE);
619  DecodeGRE(tv, dtv, p, data, data_len);
620  break;
621  case IPPROTO_FRAGMENT:
622  case IPPROTO_HOPOPTS:
623  case IPPROTO_ROUTING:
624  case IPPROTO_NONE:
625  case IPPROTO_DSTOPTS:
626  case IPPROTO_AH:
627  case IPPROTO_ESP:
628  case IPPROTO_MH:
629  case IPPROTO_HIP:
630  case IPPROTO_SHIM6:
631  DecodeIPV6ExtHdrs(tv, dtv, p, ip6h, data, data_len);
632  break;
633  case IPPROTO_ICMP:
634  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
635  break;
636  default:
637  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
638  IPV6_SET_L4PROTO(p, IPV6_GET_RAW_NH(ip6h));
639  break;
640  }
641  p->proto = IPV6_GET_L4PROTO (p);
642 
643  /* Pass to defragger if a fragment. */
644  if (IPV6_EXTHDR_ISSET_FH(p)) {
645  Packet *rp = Defrag(tv, dtv, p);
646  if (rp != NULL) {
647  PacketEnqueueNoLock(&tv->decode_pq,rp);
648  }
649  }
650 
651  return TM_ECODE_OK;
652 }
653 
654 #ifdef UNITTESTS
655 #include "util-unittest-helper.h"
656 #include "packet.h"
657 
658 /**
659  * \test fragment decoding
660  */
661 static int DecodeIPV6FragTest01 (void)
662 {
663 
664  uint8_t raw_frag1[] = {
665  0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
666  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
667  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
668  0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
669  0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
670  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
671  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
672  0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
673  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
674  0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
675  0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
676  0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
677  0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
678  0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
679  0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
680  0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
681  0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
682  0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
683  0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
684  0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
685  0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
686  0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
687  0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
688  0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
689  0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
690  0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
691  0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
692  0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
693  0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
694  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
695  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
696  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
697  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
698  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
699  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
700  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
701  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
702  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
703  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
704  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
705  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
706  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
707  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
708  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
748  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
749  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
750  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
751  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
752  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
753  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
754  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
755  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
756  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
757  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
758  };
759  uint8_t raw_frag2[] = {
760  0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
761  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
762  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
763  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
764  0x20, 0x20, 0x20, 0x20,
765  };
766  Packet *pkt;
767  Packet *p1 = PacketGetFromAlloc();
768  if (unlikely(p1 == NULL))
769  return 0;
770  Packet *p2 = PacketGetFromAlloc();
771  if (unlikely(p2 == NULL)) {
772  SCFree(p1);
773  return 0;
774  }
775  ThreadVars tv;
776  DecodeThreadVars dtv;
777  int result = 0;
778 
779  FlowInitConfig(FLOW_QUIET);
780  DefragInit();
781 
782  memset(&tv, 0, sizeof(ThreadVars));
783  memset(&dtv, 0, sizeof(DecodeThreadVars));
784 
785  PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
786  PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
787 
788  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
789 
790  if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
791  printf("ipv6 frag header not detected: ");
792  goto end;
793  }
794 
795  DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2));
796 
797  if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
798  printf("ipv6 frag header not detected: ");
799  goto end;
800  }
801 
802  if (tv.decode_pq.len != 1) {
803  printf("no reassembled packet: ");
804  goto end;
805  }
806 
807  result = 1;
808 end:
809  PacketRecycle(p1);
810  PacketRecycle(p2);
811  SCFree(p1);
812  SCFree(p2);
813  pkt = PacketDequeueNoLock(&tv.decode_pq);
814  while (pkt != NULL) {
815  PacketRecycle(pkt);
816  SCFree(pkt);
817  pkt = PacketDequeueNoLock(&tv.decode_pq);
818  }
819  DefragDestroy();
820  FlowShutdown();
821  return result;
822 }
823 
824 /**
825  * \test routing header decode
826  */
827 static int DecodeIPV6RouteTest01 (void)
828 {
829  uint8_t raw_pkt1[] = {
830  0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
831  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
832  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
833  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
834  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
835  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
836 
837  0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
838  0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
839  0xfa, 0x87, 0x00, 0x00,
840  };
841  Packet *p1 = PacketGetFromAlloc();
842  FAIL_IF(unlikely(p1 == NULL));
843  ThreadVars tv;
844  DecodeThreadVars dtv;
845 
846  FlowInitConfig(FLOW_QUIET);
847 
848  memset(&tv, 0, sizeof(ThreadVars));
849  memset(&dtv, 0, sizeof(DecodeThreadVars));
850 
851  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
852 
853  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
854 
855  FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1)));
856  FAIL_IF(p1->l3.vars.ip6.eh.rh_type != 0);
857  PacketRecycle(p1);
858  SCFree(p1);
859  FlowShutdown();
860  PASS;
861 }
862 
863 /**
864  * \test HOP header decode
865  */
866 static int DecodeIPV6HopTest01 (void)
867 {
868  uint8_t raw_pkt1[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x01, 0xfe, 0x80, 0x00, 0x00,
869  0x00, 0x00, 0x00, 0x00, 0x02, 0x0f, 0xfe, 0xff, 0xfe, 0x98, 0x3d, 0x01, 0xff, 0x02, 0x00,
870  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x3a, 0x00,
871  0xff, /* 0xff is a nonsense opt */
872  0x02, 0x00, 0x00, 0x00, 0x00, 0x82, 0x00, 0x1c, 0x6f, 0x27, 0x10, 0x00, 0x00, 0x00, 0x00,
873  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
874  Packet *p1 = PacketGetFromAlloc();
875  FAIL_IF(unlikely(p1 == NULL));
876  ThreadVars tv;
877  DecodeThreadVars dtv;
878 
879  FlowInitConfig(FLOW_QUIET);
880 
881  memset(&tv, 0, sizeof(ThreadVars));
882  memset(&dtv, 0, sizeof(DecodeThreadVars));
883 
884  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
885 
886  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
887 
888  FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
889 
890  PacketRecycle(p1);
891  SCFree(p1);
892  FlowShutdown();
893  PASS;
894 }
895 
896 #endif /* UNITTESTS */
897 
898 /**
899  * \brief this function registers unit tests for IPV6 decoder
900  */
901 
902 void DecodeIPV6RegisterTests(void)
903 {
904 #ifdef UNITTESTS
905  UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
906  UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
907  UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
908 #endif /* UNITTESTS */
909 }
910 
911 /**
912  * @}
913  */
IPV6_FRAG_INVALID_LENGTH
@ IPV6_FRAG_INVALID_LENGTH
Definition: decode-events.h:180
IPV4_IN_IPV6_WRONG_IP_VER
@ IPV4_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:188
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:1186
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1129
PacketL3::ip6
struct PacketL3::@31::@32 ip6
Packet_::proto
uint8_t proto
Definition: decode.h:523
len
uint8_t len
Definition: app-layer-dnp3.h:2
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:1107
IPV6_GET_RAW_PLEN
#define IPV6_GET_RAW_PLEN(ip6h)
Definition: decode-ipv6.h:66
IPV4_IN_IPV6_PKT_TOO_SMALL
@ IPV4_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:187
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:166
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
IPV6_GET_RAW_HLIM
#define IPV6_GET_RAW_HLIM(ip6h)
Definition: decode-ipv6.h:67
IPV6_GET_RAW_NH
#define IPV6_GET_RAW_NH(ip6h)
Definition: decode-ipv6.h:65
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:377
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DecodeESP
int DecodeESP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Function to decode IPSEC-ESP packets.
Definition: decode-esp.c:64
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:1199
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:275
IPV6_DSTOPTS_UNKNOWN_OPT
@ IPV6_DSTOPTS_UNKNOWN_OPT
Definition: decode-events.h:85
IPV6OptRA_::ip6ra_value
uint16_t ip6ra_value
Definition: decode-ipv6.h:138
IPV6OptHAO_::ip6hao_hoa
struct in6_addr ip6hao_hoa
Definition: decode-ipv6.h:130
IPV6_EXTHDR_ISSET_FH
#define IPV6_EXTHDR_ISSET_FH(p)
Definition: decode-ipv6.h:174
IPV6OPT_HAO
#define IPV6OPT_HAO
Definition: decode-ipv6.h:123
Packet_::flags
uint32_t flags
Definition: decode.h:544
PacketRecycle
void PacketRecycle(Packet *p)
Definition: packet.c:150
IPV6_GET_RAW_CLASS
#define IPV6_GET_RAW_CLASS(ip6h)
Definition: decode-ipv6.h:63
IPV6OPT_PADN
#define IPV6OPT_PADN
Definition: decode-ipv6.h:120
IPV6_EXTHDR_USELESS_FH
@ IPV6_EXTHDR_USELESS_FH
Definition: decode-events.h:72
flow-hash.h
IPV6OPT_RA
#define IPV6OPT_RA
Definition: decode-ipv6.h:121
IPV6_EXTHDR_SET_FH
#define IPV6_EXTHDR_SET_FH(p)
Definition: decode-ipv6.h:173
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:75
IPPROTO_GRE
#define IPPROTO_GRE
Definition: decode-gre.h:30
IP_GET_RAW_VER
#define IP_GET_RAW_VER(pkt)
Definition: decode.h:232
IPV6_SET_L4PROTO
#define IPV6_SET_L4PROTO(p, proto)
Definition: decode-ipv6.h:72
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:82
IPV6_EXTHDR_DUPL_HH
@ IPV6_EXTHDR_DUPL_HH
Definition: decode-events.h:74
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:204
IPV6_IN_IPV6_PKT_TOO_SMALL
@ IPV6_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:191
IPV6_IN_IPV6_WRONG_IP_VER
@ IPV6_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:192
DecodeSCTP
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-sctp.c:62
util-unittest-helper.h
IPV6_HOPOPTS_ONLY_PADDING
@ IPV6_HOPOPTS_ONLY_PADDING
Definition: decode-events.h:84
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:81
IPV6OptHAO_::ip6hao_len
uint8_t ip6hao_len
Definition: decode-ipv6.h:129
IPV6OPT_JUMBO
#define IPV6OPT_JUMBO
Definition: decode-ipv6.h:122
IPV6_DATA_AFTER_NONE_HEADER
@ IPV6_DATA_AFTER_NONE_HEADER
Definition: decode-events.h:91
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1325
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:547
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:1013
IPV6_FH_NON_ZERO_RES_FIELD
@ IPV6_FH_NON_ZERO_RES_FIELD
Definition: decode-events.h:90
decode-ipv6.h
IPV6_UNKNOWN_NEXT_HEADER
@ IPV6_UNKNOWN_NEXT_HEADER
Definition: decode-events.h:93
decode.h
IPPROTO_SHIM6
#define IPPROTO_SHIM6
Definition: decode.h:1241
IPV6_TRUNC_EXTHDR
@ IPV6_TRUNC_EXTHDR
Definition: decode-events.h:70
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
IPV6_TRUNC_PKT
@ IPV6_TRUNC_PKT
Definition: decode-events.h:69
IPV6_EXTHDR_DUPL_FH
@ IPV6_EXTHDR_DUPL_FH
Definition: decode-events.h:71
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:208
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1290
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:94
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:277
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:209
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:58
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:231
DecodeGRE
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode GRE packets.
Definition: decode-gre.c:47
IPV6_EXTHDR_DUPL_RH
@ IPV6_EXTHDR_DUPL_RH
Definition: decode-events.h:73
IPV6_EXTHDR_AH_RES_NOT_NULL
@ IPV6_EXTHDR_AH_RES_NOT_NULL
Definition: decode-events.h:81
SET_IPV6_SRC_ADDR
#define SET_IPV6_SRC_ADDR(ip6h, a)
Definition: decode.h:159
SCReturn
#define SCReturn
Definition: util-debug.h:279
IPV6_EXTHDR_RH_TYPE_0
@ IPV6_EXTHDR_RH_TYPE_0
Definition: decode-events.h:88
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:55
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:501
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:562
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:1106
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:208
PacketL3::vars
union PacketL3::@31 vars
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:1012
IPPROTO_HIP
#define IPPROTO_HIP
Definition: decode.h:1237
IPV6_EXTHDR_DUPL_DH
@ IPV6_EXTHDR_DUPL_DH
Definition: decode-events.h:75
defrag.h
IPV6_EXTHDR_ISSET_RH
#define IPV6_EXTHDR_ISSET_RH(p)
Definition: decode-ipv6.h:176
IPV6OptRA_
Definition: decode-ipv6.h:135
IPV6OptJumbo_::ip6j_payload_len
uint32_t ip6j_payload_len
Definition: decode-ipv6.h:146
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
DecodeTCP
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-tcp.c:273
IPV6_DSTOPTS_ONLY_PADDING
@ IPV6_DSTOPTS_ONLY_PADDING
Definition: decode-events.h:86
IPV6_EXTHDR_ZERO_LEN_PADN
@ IPV6_EXTHDR_ZERO_LEN_PADN
Definition: decode-events.h:89
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:168
IPPROTO_IPIP
#define IPPROTO_IPIP
Definition: decode.h:1212
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:431
DecodeICMPV6
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:177
suricata-common.h
IPV6_WRONG_IP_VER
@ IPV6_WRONG_IP_VER
Definition: decode-events.h:80
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:980
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:691
IPV4_HEADER_LEN
#define IPV4_HEADER_LEN
Definition: decode-ipv4.h:28
IPV6OptHAO_::ip6hao_type
uint8_t ip6hao_type
Definition: decode-ipv6.h:128
packet.h
IPV6_GET_RAW_FLOW
#define IPV6_GET_RAW_FLOW(ip6h)
Definition: decode-ipv6.h:64
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:258
PacketQueueNoLock_::len
uint32_t len
Definition: packet-queue.h:37
IPV6_SET_EXTHDRS_LEN
#define IPV6_SET_EXTHDRS_LEN(p, len)
Definition: decode-ipv6.h:73
Packet_::l3
struct PacketL3 l3
Definition: decode.h:600
IPV6OptRA_::ip6ra_len
uint8_t ip6ra_len
Definition: decode-ipv6.h:137
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:203
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:430
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:963
IPV6_EXTHDR_DUPL_AH
@ IPV6_EXTHDR_DUPL_AH
Definition: decode-events.h:76
IPV6_WITH_ICMPV4
@ IPV6_WITH_ICMPV4
Definition: decode-events.h:94
IPPROTO_MH
#define IPPROTO_MH
Definition: decode.h:1232
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:112
IPV6OptJumbo_
Definition: decode-ipv6.h:143
IPV6OptRA_::ip6ra_type
uint8_t ip6ra_type
Definition: decode-ipv6.h:136
IPV6OptJumbo_::ip6j_len
uint8_t ip6j_len
Definition: decode-ipv6.h:145
Packet_::dst
Address dst
Definition: decode.h:506
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:1194
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:43
IPV6OptJumbo_::ip6j_type
uint8_t ip6j_type
Definition: decode-ipv6.h:144
IPV6_HEADER_LEN
#define IPV6_HEADER_LEN
Definition: decode-ipv6.h:27
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:1228
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:393
Defrag
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:1063
SET_IPV6_DST_ADDR
#define SET_IPV6_DST_ADDR(ip6h, a)
Definition: decode.h:168
IPV6_EXTHDR_INVALID_OPTLEN
@ IPV6_EXTHDR_INVALID_OPTLEN
Definition: decode-events.h:79
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:767
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:102
FlowSetupPacket
void FlowSetupPacket(Packet *p)
prepare packet for a life with flow Set PKT_WANTS_FLOW flag to indicate workers should do a flow look...
Definition: flow-hash.c:533
DecodeIPV6RegisterTests
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
Definition: decode-ipv6.c:902
IPV6OptHAO_
Definition: decode-ipv6.h:127
Packet_::src
Address src
Definition: decode.h:505
DefragInit
void DefragInit(void)
Definition: defrag.c:1109
IPV6_EXTHDR_SET_RH
#define IPV6_EXTHDR_SET_RH(p)
Definition: decode-ipv6.h:175
IPV6_HOPOPTS_UNKNOWN_OPT
@ IPV6_HOPOPTS_UNKNOWN_OPT
Definition: decode-events.h:83
IPV6OPT_PAD1
#define IPV6OPT_PAD1
Definition: decode-ipv6.h:119