suricata
decode-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2013 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \ingroup decode
20  *
21  * @{
22  */
23 
24 
25 /**
26  * \file
27  *
28  * \author Victor Julien <victor@inliniac.net>
29  *
30  * Decode IPv6
31  */
32 
33 #include "suricata-common.h"
34 #include "decode-ipv6.h"
35 #include "decode.h"
36 #include "defrag.h"
37 #include "util-print.h"
38 #include "util-validate.h"
39 
40 /**
41  * \brief Function to decode IPv4 in IPv6 packets
42  *
43  */
44 static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t plen)
45 {
46 
47  if (unlikely(plen < IPV4_HEADER_LEN)) {
48  ENGINE_SET_INVALID_EVENT(p, IPV4_IN_IPV6_PKT_TOO_SMALL);
49  return;
50  }
51  if (IP_GET_RAW_VER(pkt) == 4) {
52  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV4);
53  if (tp != NULL) {
54  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
55  PacketEnqueueNoLock(&tv->decode_pq,tp);
56  StatsIncr(tv, dtv->counter_ipv4inipv6);
57  return;
58  }
59  } else {
60  ENGINE_SET_EVENT(p, IPV4_IN_IPV6_WRONG_IP_VER);
61  }
62  return;
63 }
64 
65 /**
66  * \brief Function to decode IPv6 in IPv6 packets
67  *
68  */
69 static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
70  const uint8_t *pkt, uint16_t plen)
71 {
72 
73  if (unlikely(plen < IPV6_HEADER_LEN)) {
74  ENGINE_SET_INVALID_EVENT(p, IPV6_IN_IPV6_PKT_TOO_SMALL);
75  return TM_ECODE_FAILED;
76  }
77  if (IP_GET_RAW_VER(pkt) == 6) {
78  Packet *tp = PacketTunnelPktSetup(tv, dtv, p, pkt, plen, DECODE_TUNNEL_IPV6);
79  if (tp != NULL) {
80  PKT_SET_SRC(tp, PKT_SRC_DECODER_IPV6);
81  PacketEnqueueNoLock(&tv->decode_pq,tp);
82  StatsIncr(tv, dtv->counter_ipv6inipv6);
83  }
84  } else {
85  ENGINE_SET_EVENT(p, IPV6_IN_IPV6_WRONG_IP_VER);
86  }
87  return TM_ECODE_OK;
88 }
89 
90 #ifndef UNITTESTS // ugly, but we need this in defrag tests
91 static inline
92 #endif
93 void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
94  uint16_t hdrextlen, uint16_t plen,
95  uint16_t prev_hdrextlen)
96 {
97  uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
98  int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
99 
100  p->ip6eh.fh_offset = frag_offset;
101  p->ip6eh.fh_more_frags_set = frag_morefrags ? true : false;
102  p->ip6eh.fh_nh = *pkt;
103 
104  uint32_t fh_id;
105  memcpy(&fh_id, pkt+4, 4);
106  p->ip6eh.fh_id = SCNtohl(fh_id);
107 
108  SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x",
109  p->ip6eh.fh_offset,
110  p->ip6eh.fh_more_frags_set ? "true" : "false",
111  p->ip6eh.fh_nh,
112  p->ip6eh.fh_id, p->ip6eh.fh_id);
113 
114  // store header offset, data offset
115  uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
116  uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
117  uint16_t data_len = plen - hdrextlen;
118 
119  p->ip6eh.fh_header_offset = frag_hdr_offset;
120  p->ip6eh.fh_data_offset = data_offset;
121  p->ip6eh.fh_data_len = data_len;
122 
123  /* if we have a prev hdr, store the type and offset of it */
124  if (prev_hdrextlen) {
125  p->ip6eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
126  }
127 
128  SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
129  p->ip6eh.fh_header_offset, p->ip6eh.fh_data_offset,
130  p->ip6eh.fh_data_len);
131 }
132 
133 static void
134 DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
135  const uint8_t *pkt, uint16_t len)
136 {
137  SCEnter();
138 
139  const uint8_t *orig_pkt = pkt;
140  uint8_t nh = IPV6_GET_NH(p); /* careful, 0 is actually a real type */
141  uint16_t hdrextlen = 0;
142  uint16_t plen = len;
143  char dstopts = 0;
144  char exthdr_fh_done = 0;
145  int hh = 0;
146  int rh = 0;
147  int ah = 0;
148 
149  while(1)
150  {
151  IPV6_SET_EXTHDRS_LEN(p, (len - plen));
152 
153  if (nh == IPPROTO_NONE) {
154  if (plen > 0) {
155  /* No upper layer, but we do have data. Suspicious. */
156  ENGINE_SET_EVENT(p, IPV6_DATA_AFTER_NONE_HEADER);
157  }
158  SCReturn;
159  }
160 
161  if (plen < 2) { /* minimal needed in a hdr */
162  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
163  SCReturn;
164  }
165 
166  switch(nh)
167  {
168  case IPPROTO_TCP:
169  IPV6_SET_L4PROTO(p,nh);
170  DecodeTCP(tv, dtv, p, pkt, plen);
171  SCReturn;
172 
173  case IPPROTO_UDP:
174  IPV6_SET_L4PROTO(p,nh);
175  DecodeUDP(tv, dtv, p, pkt, plen);
176  SCReturn;
177 
178  case IPPROTO_ICMPV6:
179  IPV6_SET_L4PROTO(p,nh);
180  DecodeICMPV6(tv, dtv, p, pkt, plen);
181  SCReturn;
182 
183  case IPPROTO_SCTP:
184  IPV6_SET_L4PROTO(p,nh);
185  DecodeSCTP(tv, dtv, p, pkt, plen);
186  SCReturn;
187 
188  case IPPROTO_ROUTING:
189  IPV6_SET_L4PROTO(p,nh);
190  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
191 
192  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
193 
194  if (hdrextlen > plen) {
195  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
196  SCReturn;
197  }
198 
199  if (rh) {
200  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_RH);
201  /* skip past this extension so we can continue parsing the rest
202  * of the packet */
203  nh = *pkt;
204  pkt += hdrextlen;
205  plen -= hdrextlen;
206  break;
207  }
208 
209  rh = 1;
210  IPV6_EXTHDR_SET_RH(p);
211 
212  uint8_t ip6rh_type = *(pkt + 2);
213  if (ip6rh_type == 0) {
214  ENGINE_SET_EVENT(p, IPV6_EXTHDR_RH_TYPE_0);
215  }
216  p->ip6eh.rh_type = ip6rh_type;
217 
218  nh = *pkt;
219  pkt += hdrextlen;
220  plen -= hdrextlen;
221  break;
222 
223  case IPPROTO_HOPOPTS:
224  case IPPROTO_DSTOPTS:
225  {
226  IPV6OptHAO hao_s, *hao = &hao_s;
227  IPV6OptRA ra_s, *ra = &ra_s;
228  IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
229  uint16_t optslen = 0;
230 
231  IPV6_SET_L4PROTO(p,nh);
232  hdrextlen = (uint16_t)((*(pkt + 1) + 1) << 3);
233  if (hdrextlen > plen) {
234  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
235  SCReturn;
236  }
237 
238  const uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
239 
240  /* point the pointers to right structures
241  * in Packet. */
242  if (nh == IPPROTO_HOPOPTS) {
243  if (hh) {
244  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_HH);
245  /* skip past this extension so we can continue parsing the rest
246  * of the packet */
247  nh = *pkt;
248  pkt += hdrextlen;
249  plen -= hdrextlen;
250  break;
251  }
252 
253  hh = 1;
254 
255  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
256  }
257  else if (nh == IPPROTO_DSTOPTS)
258  {
259  if (dstopts == 0) {
260  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
261  dstopts = 1;
262  } else if (dstopts == 1) {
263  optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
264  dstopts = 2;
265  } else {
266  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_DH);
267  /* skip past this extension so we can continue parsing the rest
268  * of the packet */
269  nh = *pkt;
270  pkt += hdrextlen;
271  plen -= hdrextlen;
272  break;
273  }
274  }
275 
276  if (optslen > plen) {
277  /* since the packet is long enough (we checked
278  * plen against hdrlen, the optlen must be malformed. */
279  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
280  /* skip past this extension so we can continue parsing the rest
281  * of the packet */
282  nh = *pkt;
283  pkt += hdrextlen;
284  plen -= hdrextlen;
285  break;
286  }
287 /** \todo move into own function to loaded on demand */
288  uint16_t padn_cnt = 0;
289  uint16_t other_cnt = 0;
290  uint16_t offset = 0;
291  while(offset < optslen)
292  {
293  if (*ptr == IPV6OPT_PAD1)
294  {
295  padn_cnt++;
296  offset++;
297  ptr++;
298  continue;
299  }
300 
301  if (offset + 1 >= optslen) {
302  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
303  break;
304  }
305 
306  /* length field for each opt */
307  uint8_t ip6_optlen = *(ptr + 1);
308 
309  /* see if the optlen from the packet fits the total optslen */
310  if ((offset + 1 + ip6_optlen) > optslen) {
311  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
312  break;
313  }
314 
315  if (*ptr == IPV6OPT_PADN) /* PadN */
316  {
317  //printf("PadN option\n");
318  padn_cnt++;
319 
320  /* a zero padN len would be weird */
321  if (ip6_optlen == 0)
322  ENGINE_SET_EVENT(p, IPV6_EXTHDR_ZERO_LEN_PADN);
323  }
324  else if (*ptr == IPV6OPT_RA) /* RA */
325  {
326  ra->ip6ra_type = *(ptr);
327  ra->ip6ra_len = ip6_optlen;
328 
329  if (ip6_optlen < sizeof(ra->ip6ra_value)) {
330  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
331  break;
332  }
333 
334  memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
335  ra->ip6ra_value = SCNtohs(ra->ip6ra_value);
336  //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
337  // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
338  other_cnt++;
339  }
340  else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
341  {
342  jumbo->ip6j_type = *(ptr);
343  jumbo->ip6j_len = ip6_optlen;
344 
345  if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
346  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
347  break;
348  }
349 
350  memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
351  jumbo->ip6j_payload_len = SCNtohl(jumbo->ip6j_payload_len);
352  //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
353  // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
354  }
355  else if (*ptr == IPV6OPT_HAO) /* HAO */
356  {
357  hao->ip6hao_type = *(ptr);
358  hao->ip6hao_len = ip6_optlen;
359 
360  if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
361  ENGINE_SET_INVALID_EVENT(p, IPV6_EXTHDR_INVALID_OPTLEN);
362  break;
363  }
364 
365  memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa));
366  //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ",
367  // hao->ip6hao_type, hao->ip6hao_len);
368  //char addr_buf[46];
369  //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa),
370  // addr_buf,sizeof(addr_buf));
371  //printf("home addr %s\n", addr_buf);
372  other_cnt++;
373  } else {
374  if (nh == IPPROTO_HOPOPTS)
375  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_UNKNOWN_OPT);
376  else
377  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_UNKNOWN_OPT);
378 
379  other_cnt++;
380  }
381  uint16_t optlen = (*(ptr + 1) + 2);
382  ptr += optlen; /* +2 for opt type and opt len fields */
383  offset += optlen;
384  }
385  /* flag packets that have only padding */
386  if (padn_cnt > 0 && other_cnt == 0) {
387  if (nh == IPPROTO_HOPOPTS)
388  ENGINE_SET_EVENT(p, IPV6_HOPOPTS_ONLY_PADDING);
389  else
390  ENGINE_SET_EVENT(p, IPV6_DSTOPTS_ONLY_PADDING);
391  }
392 
393  nh = *pkt;
394  pkt += hdrextlen;
395  plen -= hdrextlen;
396  break;
397  }
398 
399  case IPPROTO_FRAGMENT:
400  {
401  IPV6_SET_L4PROTO(p,nh);
402  /* store the offset of this extension into the packet
403  * past the ipv6 header. We use it in defrag for creating
404  * a defragmented packet without the frag header */
405  if (exthdr_fh_done == 0) {
406  DEBUG_VALIDATE_BUG_ON(pkt - orig_pkt > UINT16_MAX);
407  p->ip6eh.fh_offset = (uint16_t)(pkt - orig_pkt);
408  exthdr_fh_done = 1;
409  }
410 
411  uint16_t prev_hdrextlen = hdrextlen;
412  hdrextlen = sizeof(IPV6FragHdr);
413  if (hdrextlen > plen) {
414  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
415  SCReturn;
416  }
417 
418  /* for the frag header, the length field is reserved */
419  if (*(pkt + 1) != 0) {
420  ENGINE_SET_EVENT(p, IPV6_FH_NON_ZERO_RES_FIELD);
421  /* non fatal, lets try to continue */
422  }
423 
424  if (IPV6_EXTHDR_ISSET_FH(p)) {
425  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_FH);
426  nh = *pkt;
427  pkt += hdrextlen;
428  plen -= hdrextlen;
429  break;
430  }
431 
432  /* set the header flag first */
433  IPV6_EXTHDR_SET_FH(p);
434 
435  /* parse the header and setup the vars */
436  DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
437 
438  /* if FH has offset 0 and no more fragments are coming, we
439  * parse this packet further right away, no defrag will be
440  * needed. It is a useless FH then though, so we do set an
441  * decoder event. */
442  if (p->ip6eh.fh_more_frags_set == 0 && p->ip6eh.fh_offset == 0) {
443  ENGINE_SET_EVENT(p, IPV6_EXTHDR_USELESS_FH);
444 
445  nh = *pkt;
446  pkt += hdrextlen;
447  plen -= hdrextlen;
448  break;
449  }
450  if (p->ip6eh.fh_more_frags_set != 0 && plen % 8 != 0) {
451  // cf https://datatracker.ietf.org/doc/html/rfc2460#section-4.5
452  // each, except possibly the last ("rightmost") one,
453  // being an integer multiple of 8 octets long.
454  ENGINE_SET_EVENT(p, IPV6_FRAG_INVALID_LENGTH);
455  }
456 
457  /* the rest is parsed upon reassembly */
458  p->flags |= PKT_IS_FRAGMENT;
459  SCReturn;
460  }
461  case IPPROTO_ESP:
462  {
463  IPV6_SET_L4PROTO(p,nh);
464  DecodeESP(tv, dtv, p, pkt, plen);
465  SCReturn;
466  }
467  case IPPROTO_AH:
468  {
469  IPV6_SET_L4PROTO(p,nh);
470  /* we need the header as a minimum */
471  hdrextlen = sizeof(IPV6AuthHdr);
472  /* the payload len field is the number of extra 4 byte fields,
473  * IPV6AuthHdr already contains the first */
474  if (*(pkt+1) > 0)
475  hdrextlen += ((*(pkt+1) - 1) * 4);
476 
477  SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
478 
479  if (hdrextlen > plen) {
480  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
481  SCReturn;
482  }
483 
484  IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
485  if (ahhdr->ip6ah_reserved != 0x0000) {
486  ENGINE_SET_EVENT(p, IPV6_EXTHDR_AH_RES_NOT_NULL);
487  }
488 
489  if (ah) {
490  ENGINE_SET_EVENT(p, IPV6_EXTHDR_DUPL_AH);
491  nh = *pkt;
492  pkt += hdrextlen;
493  plen -= hdrextlen;
494  break;
495  }
496 
497  ah = 1;
498 
499  nh = *pkt;
500  pkt += hdrextlen;
501  plen -= hdrextlen;
502  break;
503  }
504  case IPPROTO_IPIP:
505  IPV6_SET_L4PROTO(p,nh);
506  DecodeIPv4inIPv6(tv, dtv, p, pkt, plen);
507  SCReturn;
508  /* none, last header */
509  case IPPROTO_NONE:
510  IPV6_SET_L4PROTO(p,nh);
511  SCReturn;
512  case IPPROTO_ICMP:
513  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
514  SCReturn;
515  /* no parsing yet, just skip it */
516  case IPPROTO_MH:
517  case IPPROTO_HIP:
518  case IPPROTO_SHIM6:
519  hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
520  if (hdrextlen > plen) {
521  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_EXTHDR);
522  SCReturn;
523  }
524  nh = *pkt;
525  pkt += hdrextlen;
526  plen -= hdrextlen;
527  break;
528  default:
529  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
530  IPV6_SET_L4PROTO(p,nh);
531  SCReturn;
532  }
533  }
534 
535  SCReturn;
536 }
537 
538 static int DecodeIPV6Packet (ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
539 {
540  if (unlikely(len < IPV6_HEADER_LEN)) {
541  return -1;
542  }
543 
544  if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
545  SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
546  ENGINE_SET_INVALID_EVENT(p, IPV6_WRONG_IP_VER);
547  return -1;
548  }
549 
550  p->ip6h = (IPV6Hdr *)pkt;
551 
552  if (unlikely(len < (IPV6_HEADER_LEN + IPV6_GET_PLEN(p))))
553  {
554  ENGINE_SET_INVALID_EVENT(p, IPV6_TRUNC_PKT);
555  return -1;
556  }
557 
558  SET_IPV6_SRC_ADDR(p,&p->src);
559  SET_IPV6_DST_ADDR(p,&p->dst);
560 
561  return 0;
562 }
563 
564 int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
565 {
566  StatsIncr(tv, dtv->counter_ipv6);
567 
568  if (!PacketIncreaseCheckLayers(p)) {
569  return TM_ECODE_FAILED;
570  }
571  /* do the actual decoding */
572  int ret = DecodeIPV6Packet (tv, dtv, p, pkt, len);
573  if (unlikely(ret < 0)) {
574  CLEAR_IPV6_PACKET(p);
575  return TM_ECODE_FAILED;
576  }
577 
578 #ifdef DEBUG
579  if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
580  /* debug print */
581  char s[46], d[46];
582  PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
583  PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
584  SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32 " PLEN: %" PRIu32 " HLIM: %" PRIu32 "", s,d,
585  IPV6_GET_CLASS(p), IPV6_GET_FLOW(p), IPV6_GET_NH(p), IPV6_GET_PLEN(p),
586  IPV6_GET_HLIM(p));
587  }
588 #endif /* DEBUG */
589 
590  /* now process the Ext headers and/or the L4 Layer */
591  switch(IPV6_GET_NH(p)) {
592  case IPPROTO_TCP:
593  IPV6_SET_L4PROTO (p, IPPROTO_TCP);
594  DecodeTCP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
595  return TM_ECODE_OK;
596  case IPPROTO_UDP:
597  IPV6_SET_L4PROTO (p, IPPROTO_UDP);
598  DecodeUDP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
599  return TM_ECODE_OK;
600  case IPPROTO_ICMPV6:
601  IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
602  DecodeICMPV6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
603  return TM_ECODE_OK;
604  case IPPROTO_SCTP:
605  IPV6_SET_L4PROTO (p, IPPROTO_SCTP);
606  DecodeSCTP(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
607  return TM_ECODE_OK;
608  case IPPROTO_IPIP:
609  IPV6_SET_L4PROTO(p, IPPROTO_IPIP);
610  DecodeIPv4inIPv6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
611  return TM_ECODE_OK;
612  case IPPROTO_IPV6:
613  DecodeIP6inIP6(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
614  return TM_ECODE_OK;
615  case IPPROTO_GRE:
616  DecodeGRE(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
617  break;
618  case IPPROTO_FRAGMENT:
619  case IPPROTO_HOPOPTS:
620  case IPPROTO_ROUTING:
621  case IPPROTO_NONE:
622  case IPPROTO_DSTOPTS:
623  case IPPROTO_AH:
624  case IPPROTO_ESP:
625  case IPPROTO_MH:
626  case IPPROTO_HIP:
627  case IPPROTO_SHIM6:
628  DecodeIPV6ExtHdrs(tv, dtv, p, pkt + IPV6_HEADER_LEN, IPV6_GET_PLEN(p));
629  break;
630  case IPPROTO_ICMP:
631  ENGINE_SET_EVENT(p,IPV6_WITH_ICMPV4);
632  break;
633  default:
634  ENGINE_SET_EVENT(p, IPV6_UNKNOWN_NEXT_HEADER);
635  IPV6_SET_L4PROTO (p, IPV6_GET_NH(p));
636  break;
637  }
638  p->proto = IPV6_GET_L4PROTO (p);
639 
640  /* Pass to defragger if a fragment. */
641  if (IPV6_EXTHDR_ISSET_FH(p)) {
642  Packet *rp = Defrag(tv, dtv, p);
643  if (rp != NULL) {
644  PacketEnqueueNoLock(&tv->decode_pq,rp);
645  }
646  }
647 
648  return TM_ECODE_OK;
649 }
650 
651 #ifdef UNITTESTS
652 #include "util-unittest-helper.h"
653 #include "packet.h"
654 
655 /**
656  * \test fragment decoding
657  */
658 static int DecodeIPV6FragTest01 (void)
659 {
660 
661  uint8_t raw_frag1[] = {
662  0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
663  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
664  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
665  0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
666  0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
667  0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
668  0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
669  0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
670  0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
671  0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
672  0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
673  0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
674  0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
675  0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
676  0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
677  0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
678  0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
679  0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
680  0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
681  0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
682  0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
683  0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
684  0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
685  0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
686  0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
687  0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
688  0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
689  0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
690  0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
691  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
692  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
693  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
694  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
695  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
696  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
697  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
698  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
699  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
700  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
701  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
702  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
703  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
704  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
705  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
706  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
707  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
708  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
748  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
749  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
750  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
751  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
752  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
753  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
754  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
755  };
756  uint8_t raw_frag2[] = {
757  0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
758  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
759  0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
760  0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
761  0x20, 0x20, 0x20, 0x20,
762  };
763  Packet *pkt;
764  Packet *p1 = PacketGetFromAlloc();
765  if (unlikely(p1 == NULL))
766  return 0;
767  Packet *p2 = PacketGetFromAlloc();
768  if (unlikely(p2 == NULL)) {
769  SCFree(p1);
770  return 0;
771  }
772  ThreadVars tv;
773  DecodeThreadVars dtv;
774  int result = 0;
775 
776  FlowInitConfig(FLOW_QUIET);
777  DefragInit();
778 
779  memset(&tv, 0, sizeof(ThreadVars));
780  memset(&dtv, 0, sizeof(DecodeThreadVars));
781 
782  PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
783  PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
784 
785  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
786 
787  if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
788  printf("ipv6 frag header not detected: ");
789  goto end;
790  }
791 
792  DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2));
793 
794  if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
795  printf("ipv6 frag header not detected: ");
796  goto end;
797  }
798 
799  if (tv.decode_pq.len != 1) {
800  printf("no reassembled packet: ");
801  goto end;
802  }
803 
804  result = 1;
805 end:
806  PacketRecycle(p1);
807  PacketRecycle(p2);
808  SCFree(p1);
809  SCFree(p2);
810  pkt = PacketDequeueNoLock(&tv.decode_pq);
811  while (pkt != NULL) {
812  PacketRecycle(pkt);
813  SCFree(pkt);
814  pkt = PacketDequeueNoLock(&tv.decode_pq);
815  }
816  DefragDestroy();
817  FlowShutdown();
818  return result;
819 }
820 
821 /**
822  * \test routing header decode
823  */
824 static int DecodeIPV6RouteTest01 (void)
825 {
826  uint8_t raw_pkt1[] = {
827  0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
828  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
829  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
830  0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
831  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
832  0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
833 
834  0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
835  0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
836  0xfa, 0x87, 0x00, 0x00,
837  };
838  Packet *p1 = PacketGetFromAlloc();
839  FAIL_IF(unlikely(p1 == NULL));
840  ThreadVars tv;
841  DecodeThreadVars dtv;
842 
843  FlowInitConfig(FLOW_QUIET);
844 
845  memset(&tv, 0, sizeof(ThreadVars));
846  memset(&dtv, 0, sizeof(DecodeThreadVars));
847 
848  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
849 
850  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
851 
852  FAIL_IF (!(IPV6_EXTHDR_ISSET_RH(p1)));
853  FAIL_IF (p1->ip6eh.rh_type != 0);
854  PacketRecycle(p1);
855  SCFree(p1);
856  FlowShutdown();
857  PASS;
858 }
859 
860 /**
861  * \test HOP header decode
862  */
863 static int DecodeIPV6HopTest01 (void)
864 {
865  uint8_t raw_pkt1[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x01, 0xfe, 0x80, 0x00, 0x00,
866  0x00, 0x00, 0x00, 0x00, 0x02, 0x0f, 0xfe, 0xff, 0xfe, 0x98, 0x3d, 0x01, 0xff, 0x02, 0x00,
867  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x3a, 0x00,
868  0xff, /* 0xff is a nonsense opt */
869  0x02, 0x00, 0x00, 0x00, 0x00, 0x82, 0x00, 0x1c, 0x6f, 0x27, 0x10, 0x00, 0x00, 0x00, 0x00,
870  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
871  Packet *p1 = PacketGetFromAlloc();
872  FAIL_IF(unlikely(p1 == NULL));
873  ThreadVars tv;
874  DecodeThreadVars dtv;
875 
876  FlowInitConfig(FLOW_QUIET);
877 
878  memset(&tv, 0, sizeof(ThreadVars));
879  memset(&dtv, 0, sizeof(DecodeThreadVars));
880 
881  PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
882 
883  DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
884 
885  FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
886 
887  PacketRecycle(p1);
888  SCFree(p1);
889  FlowShutdown();
890  PASS;
891 }
892 
893 #endif /* UNITTESTS */
894 
895 /**
896  * \brief this function registers unit tests for IPV6 decoder
897  */
898 
899 void DecodeIPV6RegisterTests(void)
900 {
901 #ifdef UNITTESTS
902  UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
903  UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
904  UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
905 #endif /* UNITTESTS */
906 }
907 
908 /**
909  * @}
910  */
IPV6_FRAG_INVALID_LENGTH
@ IPV6_FRAG_INVALID_LENGTH
Definition: decode-events.h:173
IPV4_IN_IPV6_WRONG_IP_VER
@ IPV4_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:181
ENGINE_SET_EVENT
#define ENGINE_SET_EVENT(p, e)
Definition: decode.h:891
DefragDestroy
void DefragDestroy(void)
Definition: defrag.c:1074
IPV6ExtHdrs_::fh_data_offset
uint16_t fh_data_offset
Definition: decode-ipv6.h:227
Packet_::proto
uint8_t proto
Definition: decode.h:451
len
uint8_t len
Definition: app-layer-dnp3.h:2
DECODE_TUNNEL_IPV6
@ DECODE_TUNNEL_IPV6
Definition: decode.h:815
IPV4_IN_IPV6_PKT_TOO_SMALL
@ IPV4_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:180
StatsIncr
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition: counters.c:167
offset
uint64_t offset
Definition: util-streaming-buffer.h:0
DecodeUDP
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-udp.c:75
PacketCopyData
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition: decode.c:292
unlikely
#define unlikely(expr)
Definition: util-optimize.h:35
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:103
DecodeESP
int DecodeESP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Function to decode IPSEC-ESP packets.
Definition: decode-esp.c:64
ENGINE_ISSET_EVENT
#define ENGINE_ISSET_EVENT(p, e)
Definition: decode.h:906
ip6rh_type
uint8_t ip6rh_type
Definition: decode-ipv6.h:3
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:269
IPV6_DSTOPTS_UNKNOWN_OPT
@ IPV6_DSTOPTS_UNKNOWN_OPT
Definition: decode-events.h:82
IPV6OptRA_::ip6ra_value
uint16_t ip6ra_value
Definition: decode-ipv6.h:181
IPV6OptHAO_::ip6hao_hoa
struct in6_addr ip6hao_hoa
Definition: decode-ipv6.h:173
IPV6_EXTHDR_ISSET_FH
#define IPV6_EXTHDR_ISSET_FH(p)
Definition: decode-ipv6.h:239
SET_IPV6_DST_ADDR
#define SET_IPV6_DST_ADDR(p, a)
Definition: decode.h:169
IPV6ExtHdrs_::fh_nh
uint8_t fh_nh
Definition: decode-ipv6.h:221
IPV6OPT_HAO
#define IPV6OPT_HAO
Definition: decode-ipv6.h:166
Packet_::flags
uint32_t flags
Definition: decode.h:464
PacketRecycle
void PacketRecycle(Packet *p)
Definition: packet.c:167
IPV6OPT_PADN
#define IPV6OPT_PADN
Definition: decode-ipv6.h:163
IPV6_EXTHDR_USELESS_FH
@ IPV6_EXTHDR_USELESS_FH
Definition: decode-events.h:69
IPV6OPT_RA
#define IPV6OPT_RA
Definition: decode-ipv6.h:164
IPV6_EXTHDR_SET_FH
#define IPV6_EXTHDR_SET_FH(p)
Definition: decode-ipv6.h:238
IPV6_GET_L4PROTO
#define IPV6_GET_L4PROTO(p)
Definition: decode-ipv6.h:93
IPPROTO_GRE
#define IPPROTO_GRE
Definition: decode-gre.h:30
IP_GET_RAW_VER
#define IP_GET_RAW_VER(pkt)
Definition: decode.h:244
IPV6_SET_L4PROTO
#define IPV6_SET_L4PROTO(p, proto)
Definition: decode-ipv6.h:72
TM_ECODE_FAILED
@ TM_ECODE_FAILED
Definition: tm-threads-common.h:85
IPV6_EXTHDR_DUPL_HH
@ IPV6_EXTHDR_DUPL_HH
Definition: decode-events.h:71
GET_IPV6_DST_ADDR
#define GET_IPV6_DST_ADDR(p)
Definition: decode.h:215
IPV6_IN_IPV6_PKT_TOO_SMALL
@ IPV6_IN_IPV6_PKT_TOO_SMALL
Definition: decode-events.h:184
IPV6_IN_IPV6_WRONG_IP_VER
@ IPV6_IN_IPV6_WRONG_IP_VER
Definition: decode-events.h:185
DecodeSCTP
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-sctp.c:66
util-unittest-helper.h
IPV6_HOPOPTS_ONLY_PADDING
@ IPV6_HOPOPTS_ONLY_PADDING
Definition: decode-events.h:81
TM_ECODE_OK
@ TM_ECODE_OK
Definition: tm-threads-common.h:84
IPV6ExtHdrs_::fh_id
uint32_t fh_id
Definition: decode-ipv6.h:234
IPV6OptHAO_::ip6hao_len
uint8_t ip6hao_len
Definition: decode-ipv6.h:172
IPV6_GET_PLEN
#define IPV6_GET_PLEN(p)
Definition: decode-ipv6.h:88
CLEAR_IPV6_PACKET
#define CLEAR_IPV6_PACKET(p)
Definition: decode-ipv6.h:111
IPV6OPT_JUMBO
#define IPV6OPT_JUMBO
Definition: decode-ipv6.h:165
IPV6_DATA_AFTER_NONE_HEADER
@ IPV6_DATA_AFTER_NONE_HEADER
Definition: decode-events.h:88
PKT_SET_SRC
#define PKT_SET_SRC(p, src_val)
Definition: decode.h:1066
FlowInitConfig
void FlowInitConfig(bool quiet)
initialize the configuration
Definition: flow.c:543
DecodeThreadVars_::counter_ipv6inipv6
uint16_t counter_ipv6inipv6
Definition: decode.h:710
IPV6_FH_NON_ZERO_RES_FIELD
@ IPV6_FH_NON_ZERO_RES_FIELD
Definition: decode-events.h:87
decode-ipv6.h
IPV6_UNKNOWN_NEXT_HEADER
@ IPV6_UNKNOWN_NEXT_HEADER
Definition: decode-events.h:90
decode.h
IPPROTO_SHIM6
#define IPPROTO_SHIM6
Definition: decode.h:948
IPV6_TRUNC_EXTHDR
@ IPV6_TRUNC_EXTHDR
Definition: decode-events.h:67
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
IPV6_TRUNC_PKT
@ IPV6_TRUNC_PKT
Definition: decode-events.h:66
IPV6_EXTHDR_DUPL_FH
@ IPV6_EXTHDR_DUPL_FH
Definition: decode-events.h:68
PacketDequeueNoLock
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
Definition: packet-queue.c:208
PKT_IS_FRAGMENT
#define PKT_IS_FRAGMENT
Definition: decode.h:1031
DecodeIPV6FragHeader
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition: decode-ipv6.c:93
util-print.h
SCEnter
#define SCEnter(...)
Definition: util-debug.h:271
GET_PKT_DATA
#define GET_PKT_DATA(p)
Definition: decode.h:220
ThreadVars_
Per thread variable structure.
Definition: threadvars.h:57
PrintInet
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition: util-print.c:274
IPV6ExtHdrs_::fh_more_frags_set
bool fh_more_frags_set
Definition: decode-ipv6.h:220
SET_IPV6_SRC_ADDR
#define SET_IPV6_SRC_ADDR(p, a)
Definition: decode.h:161
DecodeGRE
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode GRE packets.
Definition: decode-gre.c:47
IPV6_EXTHDR_DUPL_RH
@ IPV6_EXTHDR_DUPL_RH
Definition: decode-events.h:70
IPV6_EXTHDR_AH_RES_NOT_NULL
@ IPV6_EXTHDR_AH_RES_NOT_NULL
Definition: decode-events.h:78
IPV6_GET_NH
#define IPV6_GET_NH(p)
Definition: decode-ipv6.h:86
SCReturn
#define SCReturn
Definition: util-debug.h:273
IPV6_EXTHDR_RH_TYPE_0
@ IPV6_EXTHDR_RH_TYPE_0
Definition: decode-events.h:85
PKT_SRC_DECODER_IPV6
@ PKT_SRC_DECODER_IPV6
Definition: decode.h:57
IPV6Hdr_
Definition: decode-ipv6.h:32
Packet_
Definition: decode.h:429
DecodeIPV6
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-ipv6.c:564
DECODE_TUNNEL_IPV4
@ DECODE_TUNNEL_IPV4
Definition: decode.h:814
GET_PKT_LEN
#define GET_PKT_LEN(p)
Definition: decode.h:219
IPV6ExtHdrs_::fh_offset
uint16_t fh_offset
Definition: decode-ipv6.h:233
DecodeThreadVars_::counter_ipv4inipv6
uint16_t counter_ipv4inipv6
Definition: decode.h:709
IPPROTO_HIP
#define IPPROTO_HIP
Definition: decode.h:944
IPV6_EXTHDR_DUPL_DH
@ IPV6_EXTHDR_DUPL_DH
Definition: decode-events.h:72
defrag.h
IPV6_EXTHDR_ISSET_RH
#define IPV6_EXTHDR_ISSET_RH(p)
Definition: decode-ipv6.h:241
IPV6OptRA_
Definition: decode-ipv6.h:178
IPV6ExtHdrs_::fh_data_len
uint16_t fh_data_len
Definition: decode-ipv6.h:228
IPV6OptJumbo_::ip6j_payload_len
uint32_t ip6j_payload_len
Definition: decode-ipv6.h:189
dtv
DecodeThreadVars * dtv
Definition: fuzz_decodepcapfile.c:33
DecodeTCP
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition: decode-tcp.c:248
IPV6_DSTOPTS_ONLY_PADDING
@ IPV6_DSTOPTS_ONLY_PADDING
Definition: decode-events.h:83
IPV6_EXTHDR_ZERO_LEN_PADN
@ IPV6_EXTHDR_ZERO_LEN_PADN
Definition: decode-events.h:86
IPV6_GET_FLOW
#define IPV6_GET_FLOW(p)
Definition: decode-ipv6.h:84
PacketEnqueueNoLock
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Definition: packet-queue.c:168
IPPROTO_IPIP
#define IPPROTO_IPIP
Definition: decode.h:919
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
IPV6_GET_CLASS
#define IPV6_GET_CLASS(p)
Definition: decode-ipv6.h:82
SCNtohs
#define SCNtohs(x)
Definition: suricata-common.h:409
DecodeICMPV6
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Decode ICMPV6 packets and fill the Packet with the decoded info.
Definition: decode-icmpv6.c:178
suricata-common.h
IPV6_WRONG_IP_VER
@ IPV6_WRONG_IP_VER
Definition: decode-events.h:77
DecodeThreadVars_::counter_ipv6
uint16_t counter_ipv6
Definition: decode.h:682
FlowShutdown
void FlowShutdown(void)
shutdown the flow engine
Definition: flow.c:689
IPV4_HEADER_LEN
#define IPV4_HEADER_LEN
Definition: decode-ipv4.h:28
IPV6OptHAO_::ip6hao_type
uint8_t ip6hao_type
Definition: decode-ipv6.h:171
packet.h
IPV6ExtHdrs_::fh_header_offset
uint16_t fh_header_offset
Definition: decode-ipv6.h:226
IPV6ExtHdrs_::fh_prev_hdr_offset
uint16_t fh_prev_hdr_offset
Definition: decode-ipv6.h:224
tv
ThreadVars * tv
Definition: fuzz_decodepcapfile.c:32
util-validate.h
PacketGetFromAlloc
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition: decode.c:173
PacketQueueNoLock_::len
uint32_t len
Definition: packet-queue.h:37
IPV6_SET_EXTHDRS_LEN
#define IPV6_SET_EXTHDRS_LEN(p, len)
Definition: decode-ipv6.h:73
IPV6OptRA_::ip6ra_len
uint8_t ip6ra_len
Definition: decode-ipv6.h:180
GET_IPV6_SRC_ADDR
#define GET_IPV6_SRC_ADDR(p)
Definition: decode.h:214
SCFree
#define SCFree(p)
Definition: util-mem.h:61
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:408
DecodeThreadVars_
Structure to hold thread specific data for all decode modules.
Definition: decode.h:665
IPV6_EXTHDR_DUPL_AH
@ IPV6_EXTHDR_DUPL_AH
Definition: decode-events.h:73
IPV6_WITH_ICMPV4
@ IPV6_WITH_ICMPV4
Definition: decode-events.h:91
IPPROTO_MH
#define IPPROTO_MH
Definition: decode.h:939
ThreadVars_::decode_pq
PacketQueueNoLock decode_pq
Definition: threadvars.h:111
IPV6_GET_HLIM
#define IPV6_GET_HLIM(p)
Definition: decode-ipv6.h:90
IPV6OptJumbo_
Definition: decode-ipv6.h:186
IPV6OptRA_::ip6ra_type
uint8_t ip6ra_type
Definition: decode-ipv6.h:179
IPV6OptJumbo_::ip6j_len
uint8_t ip6j_len
Definition: decode-ipv6.h:188
Packet_::dst
Address dst
Definition: decode.h:434
ENGINE_SET_INVALID_EVENT
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition: decode.h:899
FLOW_QUIET
#define FLOW_QUIET
Definition: flow.h:41
IPV6OptJumbo_::ip6j_type
uint8_t ip6j_type
Definition: decode-ipv6.h:187
IPV6_HEADER_LEN
#define IPV6_HEADER_LEN
Definition: decode-ipv6.h:27
IPPROTO_SCTP
#define IPPROTO_SCTP
Definition: decode.h:935
IPV6ExtHdrs_::rh_type
uint8_t rh_type
Definition: decode-ipv6.h:217
Packet_::ip6h
IPV6Hdr * ip6h
Definition: decode.h:534
PacketTunnelPktSetup
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition: decode.c:308
Defrag
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Entry point for IPv4 and IPv6 fragments.
Definition: defrag.c:1008
IPV6_EXTHDR_INVALID_OPTLEN
@ IPV6_EXTHDR_INVALID_OPTLEN
Definition: decode-events.h:76
SCLogDebugEnabled
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition: util-debug.c:771
DEBUG_VALIDATE_BUG_ON
#define DEBUG_VALIDATE_BUG_ON(exp)
Definition: util-validate.h:104
DecodeIPV6RegisterTests
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
Definition: decode-ipv6.c:899
IPV6OptHAO_
Definition: decode-ipv6.h:170
Packet_::src
Address src
Definition: decode.h:433
DefragInit
void DefragInit(void)
Definition: defrag.c:1054
IPV6_EXTHDR_SET_RH
#define IPV6_EXTHDR_SET_RH(p)
Definition: decode-ipv6.h:240
Packet_::ip6eh
IPV6ExtHdrs ip6eh
Definition: decode.h:541
IPV6_HOPOPTS_UNKNOWN_OPT
@ IPV6_HOPOPTS_UNKNOWN_OPT
Definition: decode-events.h:80
IPV6OPT_PAD1
#define IPV6OPT_PAD1
Definition: decode-ipv6.h:162