suricata
detect-engine-address-ipv6.c
Go to the documentation of this file.
1 /* Copyright (C) 2007-2010 Open Information Security Foundation
2  *
3  * You can copy, redistribute or modify this Program under the terms of
4  * the GNU General Public License version 2 as published by the Free
5  * Software Foundation.
6  *
7  * This program is distributed in the hope that it will be useful,
8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10  * GNU General Public License for more details.
11  *
12  * You should have received a copy of the GNU General Public License
13  * version 2 along with this program; if not, write to the Free Software
14  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15  * 02110-1301, USA.
16  */
17 
18 /**
19  * \file
20  *
21  * \author Victor Julien <victor@inliniac.net>
22  *
23  * IPV6 Address part of the detection engine.
24  */
25 
26 #include "suricata-common.h"
27 
28 #include "decode.h"
29 #include "detect.h"
30 #include "flow-var.h"
31 
32 #include "util-cidr.h"
33 
34 #include "detect-engine-address.h"
35 #include "detect-engine-address-ipv6.h"
36 #include "detect-engine-siggroup.h"
37 #include "detect-engine-port.h"
38 
39 #include "util-debug.h"
40 
41 /**
42  * \brief Compares 2 ipv6 addresses and returns if the first address(a) is less
43  * than the second address(b) or not.
44  *
45  * \param a The first ipv6 address to be compared.
46  * \param b The second ipv6 address to be compared.
47  *
48  * \retval 1 If a < b.
49  * \retval 0 Otherwise, i.e. a >= b.
50  */
51 int AddressIPv6Lt(const Address *a, const Address *b)
52 {
53  int i = 0;
54 
55  for (i = 0; i < 4; i++) {
56  if (SCNtohl(a->addr_data32[i]) < SCNtohl(b->addr_data32[i]))
57  return 1;
58  if (SCNtohl(a->addr_data32[i]) > SCNtohl(b->addr_data32[i]))
59  break;
60  }
61 
62  return 0;
63 }
64 
65 int AddressIPv6LtU32(uint32_t *a, uint32_t *b)
66 {
67  int i = 0;
68 
69  for (i = 0; i < 4; i++) {
70  if (SCNtohl(a[i]) < SCNtohl(b[i]))
71  return 1;
72  if (SCNtohl(a[i]) > SCNtohl(b[i]))
73  break;
74  }
75 
76  return 0;
77 }
78 
79 /**
80  * \brief Compares 2 ipv6 addresses and returns if the first address(a) is
81  * greater than the second address(b) or not.
82  *
83  * \param a The first ipv6 address to be compared.
84  * \param b The second ipv6 address to be compared.
85  *
86  * \retval 1 If a > b.
87  * \retval 0 Otherwise, i.e. a <= b.
88  */
89 int AddressIPv6Gt(const Address *a, const Address *b)
90 {
91  int i = 0;
92 
93  for (i = 0; i < 4; i++) {
94  if (SCNtohl(a->addr_data32[i]) > SCNtohl(b->addr_data32[i]))
95  return 1;
96  if (SCNtohl(a->addr_data32[i]) < SCNtohl(b->addr_data32[i]))
97  break;
98  }
99 
100  return 0;
101 }
102 
103 int AddressIPv6GtU32(uint32_t *a, uint32_t *b)
104 {
105  int i = 0;
106 
107  for (i = 0; i < 4; i++) {
108  if (SCNtohl(a[i]) > SCNtohl(b[i]))
109  return 1;
110  if (SCNtohl(a[i]) < SCNtohl(b[i]))
111  break;
112  }
113 
114  return 0;
115 }
116 
117 /**
118  * \brief Compares 2 ipv6 addresses and returns if the addresses are equal
119  * or not.
120  *
121  * \param a The first ipv6 address to be compared.
122  * \param b The second ipv6 address to be compared.
123  *
124  * \retval 1 If a == b.
125  * \retval 0 Otherwise.
126  */
127 int AddressIPv6Eq(const Address *a, const Address *b)
128 {
129  int i = 0;
130 
131  for (i = 0; i < 4; i++) {
132  if (a->addr_data32[i] != b->addr_data32[i])
133  return 0;
134  }
135 
136  return 1;
137 }
138 
139 int AddressIPv6EqU32(uint32_t *a, uint32_t *b)
140 {
141  int i = 0;
142 
143  for (i = 0; i < 4; i++) {
144  if (a[i] != b[i])
145  return 0;
146  }
147 
148  return 1;
149 }
150 
151 /**
152  * \brief Compares 2 ipv6 addresses and returns if the first address(a) is less
153  * than or equal to the second address(b) or not.
154  *
155  * \param a The first ipv6 address to be compared.
156  * \param b The second ipv6 address to be compared.
157  *
158  * \retval 1 If a <= b.
159  * \retval 0 Otherwise, i.e. a > b.
160  */
161 int AddressIPv6Le(const Address *a, const Address *b)
162 {
163 
164  if (AddressIPv6Eq(a, b) == 1)
165  return 1;
166  if (AddressIPv6Lt(a, b) == 1)
167  return 1;
168 
169  return 0;
170 }
171 
172 int AddressIPv6LeU32(uint32_t *a, uint32_t *b)
173 {
174 
175  if (AddressIPv6EqU32(a, b) == 1)
176  return 1;
177  if (AddressIPv6LtU32(a, b) == 1)
178  return 1;
179 
180  return 0;
181 }
182 
183 /**
184  * \brief Compares 2 ipv6 addresses and returns if the first address(a) is
185  * greater than or equal to the second address(b) or not.
186  *
187  * \param a The first ipv6 address to be compared.
188  * \param b The second ipv6 address to be compared.
189  *
190  * \retval 1 If a >= b.
191  * \retval 0 Otherwise, i.e. a < b.
192  */
193 int AddressIPv6Ge(const Address *a, const Address *b)
194 {
195 
196  if (AddressIPv6Eq(a, b) == 1)
197  return 1;
198  if (AddressIPv6Gt(a, b) == 1)
199  return 1;
200 
201  return 0;
202 }
203 
204 int AddressIPv6GeU32(uint32_t *a, uint32_t *b)
205 {
206 
207  if (AddressIPv6EqU32(a, b) == 1)
208  return 1;
209  if (AddressIPv6GtU32(a, b) == 1)
210  return 1;
211 
212  return 0;
213 }
214 
215 /**
216  * \brief Compares 2 addresses(address ranges) and returns the relationship
217  * between the 2 addresses.
218  *
219  * \param a Pointer to the first address instance to be compared.
220  * \param b Pointer to the second address instance to be compared.
221  *
222  * \retval ADDRESS_EQ If the 2 address ranges a and b, are equal.
223  * \retval ADDRESS_ES b encapsulates a. b_ip1[...a_ip1...a_ip2...]b_ip2.
224  * \retval ADDRESS_EB a encapsulates b. a_ip1[...b_ip1....b_ip2...]a_ip2.
225  * \retval ADDRESS_LE a_ip1(...b_ip1==a_ip2...)b_ip2
226  * \retval ADDRESS_LT a_ip1(...b_ip1...a_ip2...)b_ip2
227  * \retval ADDRESS_GE b_ip1(...a_ip1==b_ip2...)a_ip2
228  * \retval ADDRESS_GT a_ip1 > b_ip2, i.e. the address range for 'a' starts only
229  * after the end of the address range for 'b'
230  */
231 int DetectAddressCmpIPv6(DetectAddress *a, DetectAddress *b)
232 {
233  if (AddressIPv6Eq(&a->ip, &b->ip) == 1 &&
234  AddressIPv6Eq(&a->ip2, &b->ip2) == 1) {
235  return ADDRESS_EQ;
236  } else if (AddressIPv6Ge(&a->ip, &b->ip) == 1 &&
237  AddressIPv6Le(&a->ip, &b->ip2) == 1 &&
238  AddressIPv6Le(&a->ip2, &b->ip2) == 1) {
239  return ADDRESS_ES;
240  } else if (AddressIPv6Le(&a->ip, &b->ip) == 1 &&
241  AddressIPv6Ge(&a->ip2, &b->ip2) == 1) {
242  return ADDRESS_EB;
243  } else if (AddressIPv6Lt(&a->ip, &b->ip) == 1 &&
244  AddressIPv6Lt(&a->ip2, &b->ip2) == 1 &&
245  AddressIPv6Ge(&a->ip2, &b->ip) == 1) {
246  return ADDRESS_LE;
247  } else if (AddressIPv6Lt(&a->ip, &b->ip) == 1 &&
248  AddressIPv6Lt(&a->ip2, &b->ip2) == 1) {
249  return ADDRESS_LT;
250  } else if (AddressIPv6Gt(&a->ip, &b->ip) == 1 &&
251  AddressIPv6Le(&a->ip, &b->ip2) == 1 &&
252  AddressIPv6Gt(&a->ip2, &b->ip2) == 1) {
253  return ADDRESS_GE;
254  } else if (AddressIPv6Gt(&a->ip, &b->ip2) == 1) {
255  return ADDRESS_GT;
256  } else {
257  /* should be unreachable */
258  SCLogDebug("Internal Error: should be unreachable\n");
259  }
260 
261  return ADDRESS_ER;
262 }
263 
264 /**
265  * \brief Takes an IPv6 address in a, and returns in b an IPv6 address which is
266  * one less than the IPv6 address in a. The address sent in a is in host
267  * order, and the address in b will be returned in network order!
268  *
269  * \param a Pointer to an IPv6 address in host order.
270  * \param b Pointer to an IPv6 address store in memory which has to be updated
271  * with the new address(a - 1).
272  */
273 static void AddressCutIPv6CopySubOne(uint32_t *a, uint32_t *b)
274 {
275  uint32_t t = a[3];
276 
277  b[0] = a[0];
278  b[1] = a[1];
279  b[2] = a[2];
280  b[3] = a[3];
281 
282  b[3]--;
283  if (b[3] > t) {
284  t = b[2];
285  b[2]--;
286  if (b[2] > t) {
287  t = b[1];
288  b[1]--;
289  if (b[1] > t)
290  b[0]--;
291  }
292  }
293 
294  b[0] = htonl(b[0]);
295  b[1] = htonl(b[1]);
296  b[2] = htonl(b[2]);
297  b[3] = htonl(b[3]);
298 }
299 
300 /**
301  * \brief Takes an IPv6 address in a, and returns in b an IPv6 address which is
302  * one more than the IPv6 address in a. The address sent in a is in host
303  * order, and the address in b will be returned in network order!
304  *
305  * \param a Pointer to an IPv6 address in host order.
306  * \param b Pointer to an IPv6 address store in memory which has to be updated
307  * with the new address(a + 1).
308  */
309 static void AddressCutIPv6CopyAddOne(uint32_t *a, uint32_t *b)
310 {
311  uint32_t t = a[3];
312 
313  b[0] = a[0];
314  b[1] = a[1];
315  b[2] = a[2];
316  b[3] = a[3];
317 
318  b[3]++;
319  if (b[3] < t) {
320  t = b[2];
321  b[2]++;
322  if (b[2] < t) {
323  t = b[1];
324  b[1]++;
325  if (b[1] < t)
326  b[0]++;
327  }
328  }
329 
330  b[0] = htonl(b[0]);
331  b[1] = htonl(b[1]);
332  b[2] = htonl(b[2]);
333  b[3] = htonl(b[3]);
334 }
335 
336 /**
337  * \brief Copies an IPv6 address in a to the b. The address in a is in host
338  * order and will be copied in network order to b!
339  *
340  * \param a Pointer to the IPv6 address to be copied.
341  * \param b Pointer to an IPv6 address in memory which will be updated with the
342  * address in a.
343  */
344 static void AddressCutIPv6Copy(uint32_t *a, uint32_t *b)
345 {
346  b[0] = htonl(a[0]);
347  b[1] = htonl(a[1]);
348  b[2] = htonl(a[2]);
349  b[3] = htonl(a[3]);
350 }
351 
352 int DetectAddressCutIPv6(DetectEngineCtx *de_ctx, DetectAddress *a,
353  DetectAddress *b, DetectAddress **c)
354 {
355  uint32_t a_ip1[4] = { SCNtohl(a->ip.addr_data32[0]), SCNtohl(a->ip.addr_data32[1]),
356  SCNtohl(a->ip.addr_data32[2]), SCNtohl(a->ip.addr_data32[3]) };
357  uint32_t a_ip2[4] = { SCNtohl(a->ip2.addr_data32[0]), SCNtohl(a->ip2.addr_data32[1]),
358  SCNtohl(a->ip2.addr_data32[2]), SCNtohl(a->ip2.addr_data32[3]) };
359  uint32_t b_ip1[4] = { SCNtohl(b->ip.addr_data32[0]), SCNtohl(b->ip.addr_data32[1]),
360  SCNtohl(b->ip.addr_data32[2]), SCNtohl(b->ip.addr_data32[3]) };
361  uint32_t b_ip2[4] = { SCNtohl(b->ip2.addr_data32[0]), SCNtohl(b->ip2.addr_data32[1]),
362  SCNtohl(b->ip2.addr_data32[2]), SCNtohl(b->ip2.addr_data32[3]) };
363 
364  /* default to NULL */
365  *c = NULL;
366 
367  int r = DetectAddressCmpIPv6(a, b);
368  if (r != ADDRESS_ES && r != ADDRESS_EB && r != ADDRESS_LE && r != ADDRESS_GE) {
369  goto error;
370  }
371 
372  /* we have 3 parts: [aaa[abab]bbb]
373  * part a: a_ip1 <-> b_ip1 - 1
374  * part b: b_ip1 <-> a_ip2
375  * part c: a_ip2 + 1 <-> b_ip2
376  */
377  if (r == ADDRESS_LE) {
378  AddressCutIPv6Copy(a_ip1, a->ip.addr_data32);
379  AddressCutIPv6CopySubOne(b_ip1, a->ip2.addr_data32);
380 
381  AddressCutIPv6Copy(b_ip1, b->ip.addr_data32);
382  AddressCutIPv6Copy(a_ip2, b->ip2.addr_data32);
383 
384  DetectAddress *tmp_c;
385  tmp_c = DetectAddressInit();
386  if (tmp_c == NULL)
387  goto error;
388  tmp_c->ip.family = AF_INET6;
389 
390  AddressCutIPv6CopyAddOne(a_ip2, tmp_c->ip.addr_data32);
391  AddressCutIPv6Copy(b_ip2, tmp_c->ip2.addr_data32);
392 
393  *c = tmp_c;
394 
395  /* we have 3 parts: [bbb[baba]aaa]
396  * part a: b_ip1 <-> a_ip1 - 1
397  * part b: a_ip1 <-> b_ip2
398  * part c: b_ip2 + 1 <-> a_ip2
399  */
400  } else if (r == ADDRESS_GE) {
401  AddressCutIPv6Copy(b_ip1, a->ip.addr_data32);
402  AddressCutIPv6CopySubOne(a_ip1, a->ip2.addr_data32);
403 
404  AddressCutIPv6Copy(a_ip1, b->ip.addr_data32);
405  AddressCutIPv6Copy(b_ip2, b->ip2.addr_data32);
406 
407  DetectAddress *tmp_c;
408  tmp_c = DetectAddressInit();
409  if (tmp_c == NULL)
410  goto error;
411  tmp_c->ip.family = AF_INET6;
412 
413  AddressCutIPv6CopyAddOne(b_ip2, tmp_c->ip.addr_data32);
414  AddressCutIPv6Copy(a_ip2, tmp_c->ip2.addr_data32);
415  *c = tmp_c;
416 
417  /* we have 2 or three parts:
418  *
419  * 2 part: [[abab]bbb] or [bbb[baba]]
420  * part a: a_ip1 <-> a_ip2
421  * part b: a_ip2 + 1 <-> b_ip2
422  *
423  * part a: b_ip1 <-> a_ip1 - 1
424  * part b: a_ip1 <-> a_ip2
425  *
426  * 3 part [bbb[aaa]bbb]
427  * part a: b_ip1 <-> a_ip1 - 1
428  * part b: a_ip1 <-> a_ip2
429  * part c: a_ip2 + 1 <-> b_ip2
430  */
431  } else if (r == ADDRESS_ES) {
432  if (AddressIPv6EqU32(a_ip1, b_ip1) == 1) {
433  AddressCutIPv6Copy(a_ip1, a->ip.addr_data32);
434  AddressCutIPv6Copy(a_ip2, a->ip2.addr_data32);
435 
436  AddressCutIPv6CopyAddOne(a_ip2, b->ip.addr_data32);
437  AddressCutIPv6Copy(b_ip2, b->ip2.addr_data32);
438 
439  } else if (AddressIPv6EqU32(a_ip2, b_ip2) == 1) {
440  AddressCutIPv6Copy(b_ip1, a->ip.addr_data32);
441  AddressCutIPv6CopySubOne(a_ip1, a->ip2.addr_data32);
442 
443  AddressCutIPv6Copy(a_ip1, b->ip.addr_data32);
444  AddressCutIPv6Copy(a_ip2, b->ip2.addr_data32);
445 
446  } else {
447  AddressCutIPv6Copy(b_ip1, a->ip.addr_data32);
448  AddressCutIPv6CopySubOne(a_ip1, a->ip2.addr_data32);
449 
450  AddressCutIPv6Copy(a_ip1, b->ip.addr_data32);
451  AddressCutIPv6Copy(a_ip2, b->ip2.addr_data32);
452 
453  DetectAddress *tmp_c;
454  tmp_c = DetectAddressInit();
455  if (tmp_c == NULL) {
456  goto error;
457  }
458  tmp_c->ip.family = AF_INET6;
459  AddressCutIPv6CopyAddOne(a_ip2, tmp_c->ip.addr_data32);
460  AddressCutIPv6Copy(b_ip2, tmp_c->ip2.addr_data32);
461  *c = tmp_c;
462 
463  }
464  /* we have 2 or three parts:
465  *
466  * 2 part: [[baba]aaa] or [aaa[abab]]
467  * part a: b_ip1 <-> b_ip2
468  * part b: b_ip2 + 1 <-> a_ip2
469  *
470  * part a: a_ip1 <-> b_ip1 - 1
471  * part b: b_ip1 <-> b_ip2
472  *
473  * 3 part [aaa[bbb]aaa]
474  * part a: a_ip1 <-> b_ip2 - 1
475  * part b: b_ip1 <-> b_ip2
476  * part c: b_ip2 + 1 <-> a_ip2
477  */
478  } else if (r == ADDRESS_EB) {
479  if (AddressIPv6EqU32(a_ip1, b_ip1) == 1) {
480  AddressCutIPv6Copy(b_ip1, a->ip.addr_data32);
481  AddressCutIPv6Copy(b_ip2, a->ip2.addr_data32);
482 
483  AddressCutIPv6CopyAddOne(b_ip2, b->ip.addr_data32);
484  AddressCutIPv6Copy(a_ip2, b->ip2.addr_data32);
485  } else if (AddressIPv6EqU32(a_ip2, b_ip2) == 1) {
486  AddressCutIPv6Copy(a_ip1, a->ip.addr_data32);
487  AddressCutIPv6CopySubOne(b_ip1, a->ip2.addr_data32);
488 
489  AddressCutIPv6Copy(b_ip1, b->ip.addr_data32);
490  AddressCutIPv6Copy(b_ip2, b->ip2.addr_data32);
491  } else {
492  AddressCutIPv6Copy(a_ip1, a->ip.addr_data32);
493  AddressCutIPv6CopySubOne(b_ip1, a->ip2.addr_data32);
494 
495  AddressCutIPv6Copy(b_ip1, b->ip.addr_data32);
496  AddressCutIPv6Copy(b_ip2, b->ip2.addr_data32);
497 
498  DetectAddress *tmp_c;
499  tmp_c = DetectAddressInit();
500  if (tmp_c == NULL)
501  goto error;
502 
503  tmp_c->ip.family = AF_INET6;
504  AddressCutIPv6CopyAddOne(b_ip2, tmp_c->ip.addr_data32);
505  AddressCutIPv6Copy(a_ip2, tmp_c->ip2.addr_data32);
506  *c = tmp_c;
507  }
508  }
509 
510  return 0;
511 
512 error:
513  return -1;
514 }
515 
516 #if 0
517 int DetectAddressCutIPv6(DetectAddressData *a, DetectAddressData *b,
518  DetectAddressData **c)
519 {
520  uint32_t a_ip1[4] = { SCNtohl(a->ip[0]), SCNtohl(a->ip[1]),
521  SCNtohl(a->ip[2]), SCNtohl(a->ip[3]) };
522  uint32_t a_ip2[4] = { SCNtohl(a->ip2[0]), SCNtohl(a->ip2[1]),
523  SCNtohl(a->ip2[2]), SCNtohl(a->ip2[3]) };
524  uint32_t b_ip1[4] = { SCNtohl(b->ip[0]), SCNtohl(b->ip[1]),
525  SCNtohl(b->ip[2]), SCNtohl(b->ip[3]) };
526  uint32_t b_ip2[4] = { SCNtohl(b->ip2[0]), SCNtohl(b->ip2[1]),
527  SCNtohl(b->ip2[2]), SCNtohl(b->ip2[3]) };
528 
529  /* default to NULL */
530  *c = NULL;
531 
532  int r = DetectAddressCmpIPv6(a, b);
533  if (r != ADDRESS_ES && r != ADDRESS_EB && r != ADDRESS_LE && r != ADDRESS_GE) {
534  goto error;
535  }
536 
537  /* we have 3 parts: [aaa[abab]bbb]
538  * part a: a_ip1 <-> b_ip1 - 1
539  * part b: b_ip1 <-> a_ip2
540  * part c: a_ip2 + 1 <-> b_ip2
541  */
542  if (r == ADDRESS_LE) {
543  AddressCutIPv6Copy(a_ip1, a->ip);
544  AddressCutIPv6CopySubOne(b_ip1, a->ip2);
545 
546  AddressCutIPv6Copy(b_ip1, b->ip);
547  AddressCutIPv6Copy(a_ip2, b->ip2);
548 
549  DetectAddressData *tmp_c;
550  tmp_c = DetectAddressDataInit();
551  if (tmp_c == NULL)
552  goto error;
553  tmp_c->family = AF_INET6;
554 
555  AddressCutIPv6CopyAddOne(a_ip2, tmp_c->ip);
556  AddressCutIPv6Copy(b_ip2, tmp_c->ip2);
557 
558  *c = tmp_c;
559 
560  /* we have 3 parts: [bbb[baba]aaa]
561  * part a: b_ip1 <-> a_ip1 - 1
562  * part b: a_ip1 <-> b_ip2
563  * part c: b_ip2 + 1 <-> a_ip2
564  */
565  } else if (r == ADDRESS_GE) {
566  AddressCutIPv6Copy(b_ip1, a->ip);
567  AddressCutIPv6CopySubOne(a_ip1, a->ip2);
568 
569  AddressCutIPv6Copy(a_ip1, b->ip);
570  AddressCutIPv6Copy(b_ip2, b->ip2);
571 
572  DetectAddressData *tmp_c;
573  tmp_c = DetectAddressDataInit();
574  if (tmp_c == NULL)
575  goto error;
576  tmp_c->family = AF_INET6;
577 
578  AddressCutIPv6CopyAddOne(b_ip2, tmp_c->ip);
579  AddressCutIPv6Copy(a_ip2, tmp_c->ip2);
580 
581  *c = tmp_c;
582 
583  /* we have 2 or three parts:
584  *
585  * 2 part: [[abab]bbb] or [bbb[baba]]
586  * part a: a_ip1 <-> a_ip2
587  * part b: a_ip2 + 1 <-> b_ip2
588  *
589  * part a: b_ip1 <-> a_ip1 - 1
590  * part b: a_ip1 <-> a_ip2
591  *
592  * 3 part [bbb[aaa]bbb]
593  * part a: b_ip1 <-> a_ip1 - 1
594  * part b: a_ip1 <-> a_ip2
595  * part c: a_ip2 + 1 <-> b_ip2
596  */
597  } else if (r == ADDRESS_ES) {
598  if (AddressIPv6Eq(a_ip1,b_ip1) == 1) {
599  AddressCutIPv6Copy(a_ip1, a->ip);
600  AddressCutIPv6Copy(a_ip2, a->ip2);
601 
602  AddressCutIPv6CopyAddOne(a_ip2, b->ip);
603  AddressCutIPv6Copy(b_ip2, b->ip2);
604  } else if (AddressIPv6Eq(a_ip2, b_ip2) == 1) {
605  AddressCutIPv6Copy(b_ip1, a->ip);
606  AddressCutIPv6CopySubOne(a_ip1, a->ip2);
607 
608  AddressCutIPv6Copy(a_ip1, b->ip);
609  AddressCutIPv6Copy(a_ip2, b->ip2);
610  } else {
611  AddressCutIPv6Copy(b_ip1, a->ip);
612  AddressCutIPv6CopySubOne(a_ip1, a->ip2);
613 
614  AddressCutIPv6Copy(a_ip1, b->ip);
615  AddressCutIPv6Copy(a_ip2, b->ip2);
616 
617  DetectAddressData *tmp_c;
618  tmp_c = DetectAddressDataInit();
619  if (tmp_c == NULL)
620  goto error;
621 
622  tmp_c->family = AF_INET6;
623 
624  AddressCutIPv6CopyAddOne(a_ip2, tmp_c->ip);
625  AddressCutIPv6Copy(b_ip2, tmp_c->ip2);
626  *c = tmp_c;
627  }
628  /* we have 2 or three parts:
629  *
630  * 2 part: [[baba]aaa] or [aaa[abab]]
631  * part a: b_ip1 <-> b_ip2
632  * part b: b_ip2 + 1 <-> a_ip2
633  *
634  * part a: a_ip1 <-> b_ip1 - 1
635  * part b: b_ip1 <-> b_ip2
636  *
637  * 3 part [aaa[bbb]aaa]
638  * part a: a_ip1 <-> b_ip2 - 1
639  * part b: b_ip1 <-> b_ip2
640  * part c: b_ip2 + 1 <-> a_ip2
641  */
642  } else if (r == ADDRESS_EB) {
643  if (AddressIPv6Eq(a_ip1, b_ip1) == 1) {
644  AddressCutIPv6Copy(b_ip1, a->ip);
645  AddressCutIPv6Copy(b_ip2, a->ip2);
646 
647  AddressCutIPv6CopyAddOne(b_ip2, b->ip);
648  AddressCutIPv6Copy(a_ip2, b->ip2);
649  } else if (AddressIPv6Eq(a_ip2, b_ip2) == 1) {
650  AddressCutIPv6Copy(a_ip1, a->ip);
651  AddressCutIPv6CopySubOne(b_ip1, a->ip2);
652 
653  AddressCutIPv6Copy(b_ip1, b->ip);
654  AddressCutIPv6Copy(b_ip2, b->ip2);
655  } else {
656  AddressCutIPv6Copy(a_ip1, a->ip);
657  AddressCutIPv6CopySubOne(b_ip1, a->ip2);
658 
659  AddressCutIPv6Copy(b_ip1, b->ip);
660  AddressCutIPv6Copy(b_ip2, b->ip2);
661 
662  DetectAddressData *tmp_c;
663  tmp_c = DetectAddressDataInit();
664  if (tmp_c == NULL)
665  goto error;
666  tmp_c->family = AF_INET6;
667 
668  AddressCutIPv6CopyAddOne(b_ip2, tmp_c->ip);
669  AddressCutIPv6Copy(a_ip2, tmp_c->ip2);
670  *c = tmp_c;
671  }
672  }
673 
674  return 0;
675 
676 error:
677  return -1;
678 }
679 #endif
680 
681 /**
682  * \brief Cuts and returns an address range, which is the complement of the
683  * address range that is supplied as the argument.
684  *
685  * For example:
686  *
687  * If a = ::-2000::,
688  * then a = 2000::1-FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF and b = NULL
689  * If a = 2000::1-FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF,
690  * then a = ::-2000:: and b = NULL
691  * If a = 2000::1-20FF::2,
692  * then a = ::-2000:: and
693  * b = 20FF::3-FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF
694  *
695  * \param a Pointer to an address range (DetectAddress) instance whose complement
696  * has to be returned in a and b.
697  * \param b Pointer to DetectAddress pointer, that will be supplied back with a
698  * new DetectAddress instance, if the complement demands so.
699  *
700  * \retval 0 On success.
701  * \retval -1 On failure.
702  */
703 int DetectAddressCutNotIPv6(DetectAddress *a, DetectAddress **b)
704 {
705  uint32_t a_ip1[4] = { SCNtohl(a->ip.addr_data32[0]), SCNtohl(a->ip.addr_data32[1]),
706  SCNtohl(a->ip.addr_data32[2]), SCNtohl(a->ip.addr_data32[3]) };
707  uint32_t a_ip2[4] = { SCNtohl(a->ip2.addr_data32[0]), SCNtohl(a->ip2.addr_data32[1]),
708  SCNtohl(a->ip2.addr_data32[2]), SCNtohl(a->ip2.addr_data32[3]) };
709  uint32_t ip_nul[4] = { 0x00000000, 0x00000000, 0x00000000, 0x00000000 };
710  uint32_t ip_max[4] = { 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF };
711 
712  /* default to NULL */
713  *b = NULL;
714 
715  if (!(a_ip1[0] == 0x00000000 && a_ip1[1] == 0x00000000 &&
716  a_ip1[2] == 0x00000000 && a_ip1[3] == 0x00000000) &&
717  !(a_ip2[0] == 0xFFFFFFFF && a_ip2[1] == 0xFFFFFFFF &&
718  a_ip2[2] == 0xFFFFFFFF && a_ip2[3] == 0xFFFFFFFF)) {
719  AddressCutIPv6Copy(ip_nul, a->ip.addr_data32);
720  AddressCutIPv6CopySubOne(a_ip1, a->ip2.addr_data32);
721 
722  DetectAddress *tmp_b = DetectAddressInit();
723  if (tmp_b == NULL)
724  goto error;
725 
726  tmp_b->ip.family = AF_INET6;
727  AddressCutIPv6CopyAddOne(a_ip2, tmp_b->ip.addr_data32);
728  AddressCutIPv6Copy(ip_max, tmp_b->ip2.addr_data32);
729  *b = tmp_b;
730  } else if ((a_ip1[0] == 0x00000000 && a_ip1[1] == 0x00000000 &&
731  a_ip1[2] == 0x00000000 && a_ip1[3] == 0x00000000) &&
732  !(a_ip2[0] == 0xFFFFFFFF && a_ip2[1] == 0xFFFFFFFF &&
733  a_ip2[2] == 0xFFFFFFFF && a_ip2[3] == 0xFFFFFFFF)) {
734  AddressCutIPv6CopyAddOne(a_ip2, a->ip.addr_data32);
735  AddressCutIPv6Copy(ip_max, a->ip2.addr_data32);
736  } else if (!(a_ip1[0] == 0x00000000 && a_ip1[1] == 0x00000000 &&
737  a_ip1[2] == 0x00000000 && a_ip1[3] == 0x00000000) &&
738  (a_ip2[0] == 0xFFFFFFFF && a_ip2[1] == 0xFFFFFFFF &&
739  a_ip2[2] == 0xFFFFFFFF && a_ip2[3] == 0xFFFFFFFF)) {
740  AddressCutIPv6Copy(ip_nul, a->ip.addr_data32);
741  AddressCutIPv6CopySubOne(a_ip1, a->ip2.addr_data32);
742  } else {
743  goto error;
744  }
745 
746  return 0;
747 
748 error:
749  return -1;
750 }
751 
752 
753 /***************************************Unittests******************************/
754 
755 #ifdef UNITTESTS
756 
757 static int AddressTestIPv6Gt01(void)
758 {
759  uint32_t a[4] = { 1, 2, 3, 4 };
760  uint32_t b[4] = { 0, 2, 3, 4 };
761 
762  FAIL_IF_NOT(AddressIPv6GtU32(a, b) == 1);
763  PASS;
764 }
765 
766 static int AddressTestIPv6Gt02(void)
767 {
768  uint32_t a[4] = { 0, 2, 3, 4 };
769  uint32_t b[4] = { 1, 2, 3, 4 };
770 
771  FAIL_IF_NOT(AddressIPv6GtU32(a, b) == 0);
772  PASS;
773 }
774 
775 static int AddressTestIPv6Gt03(void)
776 {
777  uint32_t a[4] = { 1, 2, 3, 4 };
778  uint32_t b[4] = { 1, 2, 3, 4 };
779 
780  FAIL_IF_NOT(AddressIPv6GtU32(a, b) == 0);
781  PASS;
782 }
783 
784 static int AddressTestIPv6Gt04(void)
785 {
786  uint32_t a[4] = { 1, 2, 3, 5 };
787  uint32_t b[4] = { 1, 2, 3, 4 };
788 
789  FAIL_IF_NOT(AddressIPv6GtU32(a, b) == 1);
790  PASS;
791 }
792 
793 static int AddressTestIPv6Lt01(void)
794 {
795  uint32_t a[4] = { 0, 2, 3, 4 };
796  uint32_t b[4] = { 1, 2, 3, 4 };
797 
798  FAIL_IF_NOT(AddressIPv6LtU32(a, b) == 1);
799  PASS;
800 }
801 
802 static int AddressTestIPv6Lt02(void)
803 {
804  uint32_t a[4] = { 1, 2, 3, 4 };
805  uint32_t b[4] = { 0, 2, 3, 4 };
806 
807  FAIL_IF_NOT(AddressIPv6LtU32(a, b) == 0);
808  PASS;
809 }
810 
811 static int AddressTestIPv6Lt03(void)
812 {
813  uint32_t a[4] = { 1, 2, 3, 4 };
814  uint32_t b[4] = { 1, 2, 3, 4 };
815 
816  FAIL_IF_NOT(AddressIPv6LtU32(a, b) == 0);
817  PASS;
818 }
819 
820 static int AddressTestIPv6Lt04(void)
821 {
822  uint32_t a[4] = { 1, 2, 3, 4 };
823  uint32_t b[4] = { 1, 2, 3, 5 };
824 
825  FAIL_IF_NOT(AddressIPv6LtU32(a, b) == 1);
826  PASS;
827 }
828 
829 static int AddressTestIPv6Eq01(void)
830 {
831  uint32_t a[4] = { 0, 2, 3, 4 };
832  uint32_t b[4] = { 1, 2, 3, 4 };
833 
834  FAIL_IF_NOT(AddressIPv6EqU32(a, b) == 0);
835  PASS;
836 }
837 
838 static int AddressTestIPv6Eq02(void)
839 {
840  uint32_t a[4] = { 1, 2, 3, 4 };
841  uint32_t b[4] = { 0, 2, 3, 4 };
842 
843  FAIL_IF_NOT(AddressIPv6EqU32(a, b) == 0);
844  PASS;
845 }
846 
847 static int AddressTestIPv6Eq03(void)
848 {
849  uint32_t a[4] = { 1, 2, 3, 4 };
850  uint32_t b[4] = { 1, 2, 3, 4 };
851 
852  FAIL_IF_NOT(AddressIPv6EqU32(a, b) == 1);
853  PASS;
854 }
855 
856 static int AddressTestIPv6Eq04(void)
857 {
858  uint32_t a[4] = { 1, 2, 3, 4 };
859  uint32_t b[4] = { 1, 2, 3, 5 };
860 
861  FAIL_IF_NOT(AddressIPv6EqU32(a, b) == 0);
862  PASS;
863 }
864 
865 static int AddressTestIPv6Le01(void)
866 {
867  uint32_t a[4] = { 0, 2, 3, 4 };
868  uint32_t b[4] = { 1, 2, 3, 4 };
869 
870  FAIL_IF_NOT(AddressIPv6LeU32(a, b) == 1);
871  PASS;
872 }
873 
874 static int AddressTestIPv6Le02(void)
875 {
876  uint32_t a[4] = { 1, 2, 3, 4 };
877  uint32_t b[4] = { 0, 2, 3, 4 };
878 
879  FAIL_IF_NOT(AddressIPv6LeU32(a, b) == 0);
880  PASS;
881 }
882 
883 static int AddressTestIPv6Le03(void)
884 {
885  uint32_t a[4] = { 1, 2, 3, 4 };
886  uint32_t b[4] = { 1, 2, 3, 4 };
887 
888  FAIL_IF_NOT(AddressIPv6LeU32(a, b) == 1);
889  PASS;
890 }
891 
892 static int AddressTestIPv6Le04(void)
893 {
894  uint32_t a[4] = { 1, 2, 3, 4 };
895  uint32_t b[4] = { 1, 2, 3, 5 };
896 
897  FAIL_IF_NOT(AddressIPv6LeU32(a, b) == 1);
898  PASS;
899 }
900 
901 static int AddressTestIPv6Le05(void)
902 {
903  uint32_t a[4];
904  uint32_t b[4];
905  struct in6_addr in6;
906 
907  FAIL_IF(inet_pton(AF_INET6, "1999:ffff:ffff:ffff:ffff:ffff:ffff:ffff", &in6) != 1);
908  memcpy(&a, &in6.s6_addr, sizeof(in6.s6_addr));
909 
910  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
911  memcpy(&b, &in6.s6_addr, sizeof(in6.s6_addr));
912 
913  FAIL_IF_NOT(AddressIPv6LeU32(a, b) == 1);
914  PASS;
915 }
916 
917 static int AddressTestIPv6Ge01(void)
918 {
919  uint32_t a[4] = { 0, 2, 3, 4 };
920  uint32_t b[4] = { 1, 2, 3, 4 };
921 
922  FAIL_IF_NOT(AddressIPv6GeU32(a, b) == 0);
923  PASS;
924 }
925 
926 static int AddressTestIPv6Ge02(void)
927 {
928  uint32_t a[4] = { 1, 2, 3, 4 };
929  uint32_t b[4] = { 0, 2, 3, 4 };
930 
931  FAIL_IF_NOT(AddressIPv6GeU32(a, b) == 1);
932  PASS;
933 }
934 
935 static int AddressTestIPv6Ge03(void)
936 {
937  uint32_t a[4] = { 1, 2, 3, 4 };
938  uint32_t b[4] = { 1, 2, 3, 4 };
939 
940  FAIL_IF_NOT(AddressIPv6GeU32(a, b) == 1);
941  PASS;
942 }
943 
944 static int AddressTestIPv6Ge04(void)
945 {
946  uint32_t a[4] = { 1, 2, 3, 4 };
947  uint32_t b[4] = { 1, 2, 3, 5 };
948 
949  FAIL_IF_NOT(AddressIPv6GeU32(a, b) == 0);
950  PASS;
951 }
952 
953 static int AddressTestIPv6Ge05(void)
954 {
955  uint32_t a[4];
956  uint32_t b[4];
957  struct in6_addr in6;
958 
959  FAIL_IF(inet_pton(AF_INET6, "1999:ffff:ffff:ffff:ffff:ffff:ffff:ffff", &in6) != 1);
960  memcpy(&a, &in6.s6_addr, sizeof(in6.s6_addr));
961 
962  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
963  memcpy(&b, &in6.s6_addr, sizeof(in6.s6_addr));
964 
965  FAIL_IF_NOT(AddressIPv6GeU32(a, b) == 0);
966  PASS;
967 }
968 
969 static int AddressTestIPv6SubOne01(void)
970 {
971  uint32_t a[4], b[4];
972  struct in6_addr in6;
973 
974  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
975  memcpy(a, in6.s6_addr, sizeof(in6.s6_addr));
976 
977  a[0] = SCNtohl(a[0]);
978  a[1] = SCNtohl(a[1]);
979  a[2] = SCNtohl(a[2]);
980  a[3] = SCNtohl(a[3]);
981 
982  AddressCutIPv6CopySubOne(a, b);
983 
984  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
985  memcpy(a, in6.s6_addr, sizeof(in6.s6_addr));
986  FAIL_IF(b[0] != a[0]);
987  FAIL_IF(b[1] != a[1]);
988  FAIL_IF(b[2] != a[2]);
989  FAIL_IF(b[3] != a[3]);
990  PASS;
991 }
992 
993 static int AddressTestIPv6SubOne02(void)
994 {
995  uint32_t a[4], b[4];
996  struct in6_addr in6;
997 
998  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
999  memcpy(a, in6.s6_addr, sizeof(in6.s6_addr));
1000 
1001  a[0] = SCNtohl(a[0]);
1002  a[1] = SCNtohl(a[1]);
1003  a[2] = SCNtohl(a[2]);
1004  a[3] = SCNtohl(a[3]);
1005 
1006  AddressCutIPv6CopySubOne(a, b);
1007 
1008  FAIL_IF(inet_pton(AF_INET6, "1FFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1);
1009  memcpy(a, in6.s6_addr, sizeof(in6.s6_addr));
1010  FAIL_IF(b[0] != a[0]);
1011  FAIL_IF(b[1] != a[1]);
1012  FAIL_IF(b[2] != a[2]);
1013  FAIL_IF(b[3] != a[3]);
1014  PASS;
1015 }
1016 
1017 static int AddressTestIPv6AddOne01(void)
1018 {
1019  uint32_t a[4], b[4];
1020  struct in6_addr in6;
1021 
1022  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1023  memcpy(a, in6.s6_addr, sizeof(in6.s6_addr));
1024 
1025  a[0] = SCNtohl(a[0]);
1026  a[1] = SCNtohl(a[1]);
1027  a[2] = SCNtohl(a[2]);
1028  a[3] = SCNtohl(a[3]);
1029 
1030  AddressCutIPv6CopyAddOne(a, b);
1031 
1032  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1033  memcpy(a, in6.s6_addr, sizeof(in6.s6_addr));
1034  FAIL_IF(b[0] != a[0]);
1035  FAIL_IF(b[1] != a[1]);
1036  FAIL_IF(b[2] != a[2]);
1037  FAIL_IF(b[3] != a[3]);
1038  PASS;
1039 }
1040 
1041 static int AddressTestIPv6AddOne02(void)
1042 {
1043  uint32_t a[4], b[4];
1044  struct in6_addr in6;
1045 
1046  FAIL_IF(inet_pton(AF_INET6, "1FFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1);
1047  memcpy(a, in6.s6_addr, sizeof(in6.s6_addr));
1048 
1049  a[0] = SCNtohl(a[0]);
1050  a[1] = SCNtohl(a[1]);
1051  a[2] = SCNtohl(a[2]);
1052  a[3] = SCNtohl(a[3]);
1053 
1054  AddressCutIPv6CopyAddOne(a, b);
1055 
1056  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1057  memcpy(a, in6.s6_addr, sizeof(in6.s6_addr));
1058  FAIL_IF(b[0] != a[0]);
1059  FAIL_IF(b[1] != a[1]);
1060  FAIL_IF(b[2] != a[2]);
1061  FAIL_IF(b[3] != a[3]);
1062  PASS;
1063 }
1064 
1065 static int AddressTestIPv6AddressCmp01(void)
1066 {
1067  DetectAddress *a = DetectAddressInit();
1068  DetectAddress *b = DetectAddressInit();
1069  struct in6_addr in6;
1070 
1071  FAIL_IF_NULL(a);
1072  FAIL_IF_NULL(b);
1073 
1074  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1075  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1076  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1077  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1078  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1079  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1080  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1081  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1082  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_EQ);
1083 
1084  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1085  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1086  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1087  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1088  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1089  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1090  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1091  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1092  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_ES);
1093 
1094  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1095  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1096  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1097  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1098  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1099  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1100  FAIL_IF(inet_pton(AF_INET6, "2000::11", &in6) != 1);
1101  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1102  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_ES);
1103 
1104  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1105  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1106  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1107  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1108  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1109  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1110  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1111  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1112  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_ES);
1113 
1114  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1115  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1116  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1117  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1118  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1119  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1120  FAIL_IF(inet_pton(AF_INET6, "2000::11", &in6) != 1);
1121  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1122  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_ES);
1123 
1124  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1125  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1126  FAIL_IF(inet_pton(AF_INET6, "2000::11", &in6) != 1);
1127  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1128  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1129  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1130  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1131  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1132  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_ES);
1133 
1134  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1135  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1136  FAIL_IF(inet_pton(AF_INET6, "2000::11", &in6) != 1);
1137  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1138  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1139  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1140  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1141  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1142  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_EB);
1143 
1144  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1145  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1146  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1147  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1148  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1149  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1150  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1151  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1152  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_EB);
1153 
1154  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1155  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1156  FAIL_IF(inet_pton(AF_INET6, "2000::11", &in6) != 1);
1157  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1158  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1159  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1160  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1161  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1162  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_EB);
1163 
1164  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1165  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1166  FAIL_IF(inet_pton(AF_INET6, "2000::11", &in6) != 1);
1167  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1168  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1169  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1170  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1171  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1172  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_EB);
1173 
1174  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1175  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1176  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1177  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1178  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1179  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1180  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1181  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1182  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_LE);
1183 
1184  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1185  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1186  FAIL_IF(inet_pton(AF_INET6, "2000::15", &in6) != 1);
1187  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1188  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1189  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1190  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1191  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1192  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_LE);
1193 
1194  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1195  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1196  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1197  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1198  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1199  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1200  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1201  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1202  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_LE);
1203 
1204  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1205  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1206  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1207  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1208  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1209  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1210  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1211  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1212  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_LE);
1213 
1214  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1215  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1216  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1217  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1218  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1219  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1220  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1221  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1222  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_LE);
1223 
1224  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1225  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1226  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1227  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1228  FAIL_IF(inet_pton(AF_INET6, "2000::15", &in6) != 1);
1229  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1230  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1231  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1232  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_LT);
1233 
1234  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1235  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1236  FAIL_IF(inet_pton(AF_INET6, "2000::15", &in6) != 1);
1237  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1238  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1239  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1240  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1241  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1242  /* we could get a LE */
1243  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_LT);
1244 
1245  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1246  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1247  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1248  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1249  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1250  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1251  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1252  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1253  /* we could get a LE */
1254  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_LT);
1255 
1256  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1257  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1258  FAIL_IF(inet_pton(AF_INET6, "2000::19", &in6) != 1);
1259  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1260  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1261  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1262  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1263  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1264  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_LT);
1265 
1266  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1267  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1268  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1269  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1270  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1271  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1272  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1273  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1274  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_LT);
1275 
1276  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1277  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1278  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1279  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1280  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1281  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1282  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1283  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1284  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_LT);
1285 
1286  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1287  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1288  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1289  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1290  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1291  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1292  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1293  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1294  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_GE);
1295 
1296  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1297  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1298  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1299  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1300  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1301  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1302  FAIL_IF(inet_pton(AF_INET6, "2000::15", &in6) != 1);
1303  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1304  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_GE);
1305 
1306  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1307  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1308  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1309  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1310  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1311  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1312  FAIL_IF(inet_pton(AF_INET6, "2000::15", &in6) != 1);
1313  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1314  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_GE);
1315 
1316  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1317  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1318  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1319  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1320  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1321  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1322  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1323  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1324  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_GE);
1325 
1326  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1327  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1328  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1329  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1330  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1331  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1332  FAIL_IF(inet_pton(AF_INET6, "2000::19", &in6) != 1);
1333  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1334  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_GE);
1335 
1336  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1337  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1338  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1339  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1340  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1341  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1342  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1343  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1344  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_GE);
1345 
1346  FAIL_IF(inet_pton(AF_INET6, "2000::15", &in6) != 1);
1347  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1348  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1349  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1350  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1351  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1352  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1353  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1354  FAIL_IF_NOT(DetectAddressCmpIPv6(a, b) == ADDRESS_GT);
1355 
1356  FAIL_IF(inet_pton(AF_INET6, "2000::15", &in6) != 1);
1357  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1358  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1359  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1360  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1361  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1362  FAIL_IF(inet_pton(AF_INET6, "2000::15", &in6) != 1);
1363  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1364  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_GT);
1365 
1366  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1367  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1368  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1369  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1370  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1371  memcpy(&b->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1372  FAIL_IF(inet_pton(AF_INET6, "2000::10", &in6) != 1);
1373  memcpy(&b->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1374  FAIL_IF(DetectAddressCmpIPv6(a, b) == ADDRESS_GT);
1375 
1376  DetectAddressFree(a);
1377  DetectAddressFree(b);
1378  PASS;
1379 }
1380 
1381 static int AddressTestIPv6CutNot01(void)
1382 {
1383  struct in6_addr in6;
1384  DetectAddress *a = DetectAddressInit();
1385  FAIL_IF_NULL(a);
1386 
1387  FAIL_IF(inet_pton(AF_INET6, "::", &in6) != 1);
1388  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1389  FAIL_IF(inet_pton(AF_INET6, "FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1);
1390  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1391 
1392  DetectAddress *b = NULL;
1393  FAIL_IF_NOT(DetectAddressCutNotIPv6(a, &b) == -1);
1394  FAIL_IF_NOT_NULL(b);
1395 
1396  DetectAddressFree(a);
1397  PASS;
1398 }
1399 
1400 static int AddressTestIPv6CutNot02(void)
1401 {
1402  struct in6_addr in6;
1403  DetectAddress *a = DetectAddressInit();
1404  FAIL_IF_NULL(a);
1405  DetectAddress *temp = DetectAddressInit();
1406  FAIL_IF_NULL(temp);
1407 
1408  FAIL_IF(inet_pton(AF_INET6, "::", &in6) != 1);
1409  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1410  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1411  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1412 
1413  DetectAddress *b = NULL;
1414  FAIL_IF_NOT(DetectAddressCutNotIPv6(a, &b) == 0);
1415  FAIL_IF(b != NULL);
1416 
1417  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1418  memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1419  FAIL_IF(inet_pton(AF_INET6, "FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1);
1420  memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1421 
1422  FAIL_IF(DetectAddressCmpIPv6(a, temp) != ADDRESS_EQ);
1423 
1424  DetectAddressFree(a);
1425  DetectAddressFree(temp);
1426  PASS;
1427 }
1428 
1429 static int AddressTestIPv6CutNot03(void)
1430 {
1431  struct in6_addr in6;
1432  DetectAddress *a = DetectAddressInit();
1433  FAIL_IF_NULL(a);
1434  DetectAddress *temp = DetectAddressInit();
1435  FAIL_IF_NULL(temp);
1436 
1437  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1438  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1439  FAIL_IF(inet_pton(AF_INET6, "FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1);
1440  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1441 
1442  DetectAddress *b = NULL;
1443  FAIL_IF_NOT(DetectAddressCutNotIPv6(a, &b) == 0);
1444  FAIL_IF(b != NULL);
1445 
1446  FAIL_IF(inet_pton(AF_INET6, "::", &in6) != 1);
1447  memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1448  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1449  memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1450 
1451  FAIL_IF(DetectAddressCmpIPv6(a, temp) != ADDRESS_EQ);
1452 
1453  DetectAddressFree(a);
1454  DetectAddressFree(temp);
1455  PASS;
1456 }
1457 
1458 static int AddressTestIPv6CutNot04(void)
1459 {
1460  struct in6_addr in6;
1461  DetectAddress *a = DetectAddressInit();
1462  FAIL_IF_NULL(a);
1463  DetectAddress *temp = DetectAddressInit();
1464  FAIL_IF_NULL(temp);
1465 
1466  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1467  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1468  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1469  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1470 
1471  DetectAddress *b = NULL;
1472  FAIL_IF_NOT(DetectAddressCutNotIPv6(a, &b) == 0);
1473 
1474  FAIL_IF(inet_pton(AF_INET6, "::", &in6) != 1);
1475  memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1476  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1477  memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1478  FAIL_IF(DetectAddressCmpIPv6(a, temp) != ADDRESS_EQ);
1479 
1480  FAIL_IF_NULL(b);
1481  FAIL_IF(inet_pton(AF_INET6, "2000::2", &in6) != 1);
1482  memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1483  FAIL_IF(inet_pton(AF_INET6, "FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1);
1484  memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1485  FAIL_IF(DetectAddressCmpIPv6(b, temp) != ADDRESS_EQ);
1486 
1487  DetectAddressFree(a);
1488  DetectAddressFree(b);
1489  DetectAddressFree(temp);
1490  PASS;
1491 }
1492 
1493 static int AddressTestIPv6CutNot05(void)
1494 {
1495  struct in6_addr in6;
1496  DetectAddress *a = DetectAddressInit();
1497  FAIL_IF_NULL(a);
1498  DetectAddress *temp = DetectAddressInit();
1499  FAIL_IF_NULL(temp);
1500 
1501  FAIL_IF(inet_pton(AF_INET6, "2000::1", &in6) != 1);
1502  memcpy(&a->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1503  FAIL_IF(inet_pton(AF_INET6, "2000::20", &in6) != 1);
1504  memcpy(&a->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1505 
1506  DetectAddress *b = NULL;
1507  FAIL_IF_NOT(DetectAddressCutNotIPv6(a, &b) == 0);
1508 
1509  FAIL_IF(inet_pton(AF_INET6, "::", &in6) != 1);
1510  memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1511  FAIL_IF(inet_pton(AF_INET6, "2000::0", &in6) != 1);
1512  memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1513  FAIL_IF(DetectAddressCmpIPv6(a, temp) != ADDRESS_EQ);
1514 
1515  FAIL_IF_NULL(b);
1516  FAIL_IF(inet_pton(AF_INET6, "2000::21", &in6) != 1);
1517  memcpy(&temp->ip.address, in6.s6_addr, sizeof(in6.s6_addr));
1518  FAIL_IF(inet_pton(AF_INET6, "FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", &in6) != 1);
1519  memcpy(&temp->ip2.address, in6.s6_addr, sizeof(in6.s6_addr));
1520  FAIL_IF(DetectAddressCmpIPv6(b, temp) != ADDRESS_EQ);
1521 
1522  DetectAddressFree(a);
1523  DetectAddressFree(b);
1524  DetectAddressFree(temp);
1525  PASS;
1526 }
1527 
1528 #endif /* UNITTESTS */
1529 
1530 void DetectAddressIPv6Tests(void)
1531 {
1532 
1533 #ifdef UNITTESTS
1534  UtRegisterTest("AddressTestIPv6Gt01", AddressTestIPv6Gt01);
1535  UtRegisterTest("AddressTestIPv6Gt02", AddressTestIPv6Gt02);
1536  UtRegisterTest("AddressTestIPv6Gt03", AddressTestIPv6Gt03);
1537  UtRegisterTest("AddressTestIPv6Gt04", AddressTestIPv6Gt04);
1538 
1539  UtRegisterTest("AddressTestIPv6Lt01", AddressTestIPv6Lt01);
1540  UtRegisterTest("AddressTestIPv6Lt02", AddressTestIPv6Lt02);
1541  UtRegisterTest("AddressTestIPv6Lt03", AddressTestIPv6Lt03);
1542  UtRegisterTest("AddressTestIPv6Lt04", AddressTestIPv6Lt04);
1543 
1544  UtRegisterTest("AddressTestIPv6Eq01", AddressTestIPv6Eq01);
1545  UtRegisterTest("AddressTestIPv6Eq02", AddressTestIPv6Eq02);
1546  UtRegisterTest("AddressTestIPv6Eq03", AddressTestIPv6Eq03);
1547  UtRegisterTest("AddressTestIPv6Eq04", AddressTestIPv6Eq04);
1548 
1549  UtRegisterTest("AddressTestIPv6Le01", AddressTestIPv6Le01);
1550  UtRegisterTest("AddressTestIPv6Le02", AddressTestIPv6Le02);
1551  UtRegisterTest("AddressTestIPv6Le03", AddressTestIPv6Le03);
1552  UtRegisterTest("AddressTestIPv6Le04", AddressTestIPv6Le04);
1553  UtRegisterTest("AddressTestIPv6Le05", AddressTestIPv6Le05);
1554 
1555  UtRegisterTest("AddressTestIPv6Ge01", AddressTestIPv6Ge01);
1556  UtRegisterTest("AddressTestIPv6Ge02", AddressTestIPv6Ge02);
1557  UtRegisterTest("AddressTestIPv6Ge03", AddressTestIPv6Ge03);
1558  UtRegisterTest("AddressTestIPv6Ge04", AddressTestIPv6Ge04);
1559  UtRegisterTest("AddressTestIPv6Ge05", AddressTestIPv6Ge05);
1560 
1561  UtRegisterTest("AddressTestIPv6SubOne01", AddressTestIPv6SubOne01);
1562  UtRegisterTest("AddressTestIPv6SubOne02", AddressTestIPv6SubOne02);
1563 
1564  UtRegisterTest("AddressTestIPv6AddOne01", AddressTestIPv6AddOne01);
1565  UtRegisterTest("AddressTestIPv6AddOne02", AddressTestIPv6AddOne02);
1566 
1567  UtRegisterTest("AddressTestIPv6AddressCmp01", AddressTestIPv6AddressCmp01);
1568 
1569  UtRegisterTest("AddressTestIPv6CutNot01", AddressTestIPv6CutNot01);
1570  UtRegisterTest("AddressTestIPv6CutNot02", AddressTestIPv6CutNot02);
1571  UtRegisterTest("AddressTestIPv6CutNot03", AddressTestIPv6CutNot03);
1572  UtRegisterTest("AddressTestIPv6CutNot04", AddressTestIPv6CutNot04);
1573  UtRegisterTest("AddressTestIPv6CutNot05", AddressTestIPv6CutNot05);
1574 #endif /* UNITTESTS */
1575 }
DetectAddress_::ip
Address ip
Definition: detect.h:172
DetectAddressFree
void DetectAddressFree(DetectAddress *ag)
Frees a DetectAddress instance.
Definition: detect-engine-address.c:81
FAIL_IF_NULL
#define FAIL_IF_NULL(expr)
Fail a test if expression evaluates to NULL.
Definition: util-unittest.h:89
ADDRESS_EB
@ ADDRESS_EB
Definition: detect.h:158
ADDRESS_LE
@ ADDRESS_LE
Definition: detect.h:155
DetectAddressCutIPv6
int DetectAddressCutIPv6(DetectEngineCtx *de_ctx, DetectAddress *a, DetectAddress *b, DetectAddress **c)
Definition: detect-engine-address-ipv6.c:352
detect-engine-siggroup.h
AddressIPv6Le
int AddressIPv6Le(const Address *a, const Address *b)
Compares 2 ipv6 addresses and returns if the first address(a) is less than or equal to the second add...
Definition: detect-engine-address-ipv6.c:161
UtRegisterTest
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
Definition: util-unittest.c:101
DetectAddress_
address structure for use in the detection engine.
Definition: detect.h:170
SCLogDebug
#define SCLogDebug(...)
Definition: util-debug.h:282
AddressIPv6Eq
int AddressIPv6Eq(const Address *a, const Address *b)
Compares 2 ipv6 addresses and returns if the addresses are equal or not.
Definition: detect-engine-address-ipv6.c:127
ADDRESS_LT
@ ADDRESS_LT
Definition: detect.h:154
DetectEngineCtx_
main detection engine ctx
Definition: detect.h:995
ADDRESS_EQ
@ ADDRESS_EQ
Definition: detect.h:156
Address_
Definition: decode.h:113
FAIL_IF_NOT
#define FAIL_IF_NOT(expr)
Fail a test if expression evaluates to false.
Definition: util-unittest.h:82
Address_::address
union Address_::@29 address
util-cidr.h
decode.h
FAIL_IF_NOT_NULL
#define FAIL_IF_NOT_NULL(expr)
Fail a test if expression evaluates to non-NULL.
Definition: util-unittest.h:96
util-debug.h
PASS
#define PASS
Pass the test.
Definition: util-unittest.h:105
de_ctx
DetectEngineCtx * de_ctx
Definition: fuzz_siginit.c:22
ADDRESS_GE
@ ADDRESS_GE
Definition: detect.h:159
detect.h
detect-engine-port.h
DetectAddress_::ip2
Address ip2
Definition: detect.h:173
FAIL_IF
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Definition: util-unittest.h:71
suricata-common.h
AddressIPv6EqU32
int AddressIPv6EqU32(uint32_t *a, uint32_t *b)
Definition: detect-engine-address-ipv6.c:139
AddressIPv6GeU32
int AddressIPv6GeU32(uint32_t *a, uint32_t *b)
Definition: detect-engine-address-ipv6.c:204
detect-engine-address-ipv6.h
DetectAddressCmpIPv6
int DetectAddressCmpIPv6(DetectAddress *a, DetectAddress *b)
Compares 2 addresses(address ranges) and returns the relationship between the 2 addresses.
Definition: detect-engine-address-ipv6.c:231
SCNtohl
#define SCNtohl(x)
Definition: suricata-common.h:435
AddressIPv6Lt
int AddressIPv6Lt(const Address *a, const Address *b)
Compares 2 ipv6 addresses and returns if the first address(a) is less than the second address(b) or n...
Definition: detect-engine-address-ipv6.c:51
AddressIPv6LeU32
int AddressIPv6LeU32(uint32_t *a, uint32_t *b)
Definition: detect-engine-address-ipv6.c:172
DetectAddressCutNotIPv6
int DetectAddressCutNotIPv6(DetectAddress *a, DetectAddress **b)
Cuts and returns an address range, which is the complement of the address range that is supplied as t...
Definition: detect-engine-address-ipv6.c:703
Address_::family
char family
Definition: decode.h:114
ADDRESS_ES
@ ADDRESS_ES
Definition: detect.h:157
AddressIPv6GtU32
int AddressIPv6GtU32(uint32_t *a, uint32_t *b)
Definition: detect-engine-address-ipv6.c:103
DetectAddressIPv6Tests
void DetectAddressIPv6Tests(void)
Definition: detect-engine-address-ipv6.c:1530
AddressIPv6Gt
int AddressIPv6Gt(const Address *a, const Address *b)
Compares 2 ipv6 addresses and returns if the first address(a) is greater than the second address(b) o...
Definition: detect-engine-address-ipv6.c:89
AddressIPv6LtU32
int AddressIPv6LtU32(uint32_t *a, uint32_t *b)
Definition: detect-engine-address-ipv6.c:65
AddressIPv6Ge
int AddressIPv6Ge(const Address *a, const Address *b)
Compares 2 ipv6 addresses and returns if the first address(a) is greater than or equal to the second ...
Definition: detect-engine-address-ipv6.c:193
flow-var.h
detect-engine-address.h
DetectAddressInit
DetectAddress * DetectAddressInit(void)
Creates and returns a new instance of a DetectAddress.
Definition: detect-engine-address.c:68
ADDRESS_ER
@ ADDRESS_ER
Definition: detect.h:153
ADDRESS_GT
@ ADDRESS_GT
Definition: detect.h:160