suricata
decode-ipv6.c
Go to the documentation of this file.
1/* Copyright (C) 2007-2024 Open Information Security Foundation
2 *
3 * You can copy, redistribute or modify this Program under the terms of
4 * the GNU General Public License version 2 as published by the Free
5 * Software Foundation.
6 *
7 * This program is distributed in the hope that it will be useful,
8 * but WITHOUT ANY WARRANTY; without even the implied warranty of
9 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10 * GNU General Public License for more details.
11 *
12 * You should have received a copy of the GNU General Public License
13 * version 2 along with this program; if not, write to the Free Software
14 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15 * 02110-1301, USA.
16 */
17
18/**
19 * \ingroup decode
20 *
21 * @{
22 */
23
24
25/**
26 * \file
27 *
28 * \author Victor Julien <victor@inliniac.net>
29 *
30 * Decode IPv6
31 */
32
33#include "suricata-common.h"
34#include "decode-ipv6.h"
35#include "decode.h"
36#include "defrag.h"
37#include "flow-hash.h"
38#include "util-print.h"
39#include "util-validate.h"
40
41/**
42 * \brief Function to decode IPv4 in IPv6 packets
43 *
44 */
45static void DecodeIPv4inIPv6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t plen)
46{
47
48 if (unlikely(plen < IPV4_HEADER_LEN)) {
50 return;
51 }
52 if (IP_GET_RAW_VER(pkt) == 4) {
54 if (tp != NULL) {
58 }
60 } else {
62 }
63}
64
65/**
66 * \brief Function to decode IPv6 in IPv6 packets
67 *
68 */
69static int DecodeIP6inIP6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
70 const uint8_t *pkt, uint16_t plen)
71{
72
73 if (unlikely(plen < IPV6_HEADER_LEN)) {
75 return TM_ECODE_FAILED;
76 }
77 if (IP_GET_RAW_VER(pkt) == 6) {
79 if (tp != NULL) {
83 }
85 } else {
87 }
88 return TM_ECODE_OK;
89}
90
91#ifndef UNITTESTS // ugly, but we need this in defrag tests
92static inline
93#endif
94void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt,
95 uint16_t hdrextlen, uint16_t plen,
96 uint16_t prev_hdrextlen)
97{
98 uint16_t frag_offset = (*(pkt + 2) << 8 | *(pkt + 3)) & 0xFFF8;
99 int frag_morefrags = (*(pkt + 2) << 8 | *(pkt + 3)) & 0x0001;
100
101 p->l3.vars.ip6.eh.fh_offset = frag_offset;
102 p->l3.vars.ip6.eh.fh_more_frags_set = frag_morefrags ? true : false;
103 p->l3.vars.ip6.eh.fh_nh = *pkt;
104
105 uint32_t fh_id;
106 memcpy(&fh_id, pkt+4, 4);
107 p->l3.vars.ip6.eh.fh_id = SCNtohl(fh_id);
108
109 SCLogDebug("IPV6 FH: offset %u, mf %s, nh %u, id %u/%x", p->l3.vars.ip6.eh.fh_offset,
110 p->l3.vars.ip6.eh.fh_more_frags_set ? "true" : "false", p->l3.vars.ip6.eh.fh_nh,
111 p->l3.vars.ip6.eh.fh_id, p->l3.vars.ip6.eh.fh_id);
112
113 // store header offset, data offset
114 uint16_t frag_hdr_offset = (uint16_t)(pkt - GET_PKT_DATA(p));
115 uint16_t data_offset = (uint16_t)(frag_hdr_offset + hdrextlen);
116 uint16_t data_len = plen - hdrextlen;
117
118 p->l3.vars.ip6.eh.fh_header_offset = frag_hdr_offset;
119 p->l3.vars.ip6.eh.fh_data_offset = data_offset;
120 p->l3.vars.ip6.eh.fh_data_len = data_len;
121
122 /* if we have a prev hdr, store the type and offset of it */
123 if (prev_hdrextlen) {
124 p->l3.vars.ip6.eh.fh_prev_hdr_offset = frag_hdr_offset - prev_hdrextlen;
125 }
126
127 SCLogDebug("IPV6 FH: frag_hdr_offset %u, data_offset %u, data_len %u",
130}
131
132static void DecodeIPV6ExtHdrs(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const IPV6Hdr *ip6h,
133 const uint8_t *pkt, uint16_t len)
134{
135 SCEnter();
136
137 const uint8_t *orig_pkt = pkt;
138 uint8_t nh = IPV6_GET_RAW_NH(ip6h); /* careful, 0 is actually a real type */
139 uint16_t hdrextlen = 0;
140 uint16_t plen = len;
141 char dstopts = 0;
142 char exthdr_fh_done = 0;
143 int hh = 0;
144 int rh = 0;
145 int ah = 0;
146
147 while(1)
148 {
149 IPV6_SET_EXTHDRS_LEN(p, (len - plen));
150
151 if (nh == IPPROTO_NONE) {
152 if (plen > 0) {
153 /* No upper layer, but we do have data. Suspicious. */
155 }
156 SCReturn;
157 }
158
159 if (plen < 2) { /* minimal needed in a hdr */
161 SCReturn;
162 }
163
164 switch(nh)
165 {
166 case IPPROTO_TCP:
167 IPV6_SET_L4PROTO(p,nh);
168 DecodeTCP(tv, dtv, p, pkt, plen);
169 SCReturn;
170
171 case IPPROTO_UDP:
172 IPV6_SET_L4PROTO(p,nh);
173 DecodeUDP(tv, dtv, p, pkt, plen);
174 SCReturn;
175
176 case IPPROTO_ICMPV6:
177 IPV6_SET_L4PROTO(p,nh);
178 DecodeICMPV6(tv, dtv, p, pkt, plen);
179 SCReturn;
180
181 case IPPROTO_SCTP:
182 IPV6_SET_L4PROTO(p,nh);
183 DecodeSCTP(tv, dtv, p, pkt, plen);
184 SCReturn;
185
186 case IPPROTO_ROUTING:
187 IPV6_SET_L4PROTO(p,nh);
188 hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
189
190 SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
191
192 if (hdrextlen > plen) {
194 SCReturn;
195 }
196
197 if (rh) {
199 /* skip past this extension so we can continue parsing the rest
200 * of the packet */
201 nh = *pkt;
202 pkt += hdrextlen;
203 plen -= hdrextlen;
204 break;
205 }
206
207 rh = 1;
209
210 uint8_t ip6rh_type = *(pkt + 2);
211 if (ip6rh_type == 0) {
213 }
214 p->l3.vars.ip6.eh.rh_type = ip6rh_type;
215
216 nh = *pkt;
217 pkt += hdrextlen;
218 plen -= hdrextlen;
219 break;
220
221 case IPPROTO_HOPOPTS:
222 case IPPROTO_DSTOPTS:
223 {
224 IPV6OptHAO hao_s, *hao = &hao_s;
225 IPV6OptRA ra_s, *ra = &ra_s;
226 IPV6OptJumbo jumbo_s, *jumbo = &jumbo_s;
227 uint16_t optslen = 0;
228
229 IPV6_SET_L4PROTO(p,nh);
230 hdrextlen = (uint16_t)((*(pkt + 1) + 1) << 3);
231 if (hdrextlen > plen) {
233 SCReturn;
234 }
235
236 const uint8_t *ptr = pkt + 2; /* +2 to go past nxthdr and len */
237
238 /* point the pointers to right structures
239 * in Packet. */
240 if (nh == IPPROTO_HOPOPTS) {
241 if (hh) {
243 /* skip past this extension so we can continue parsing the rest
244 * of the packet */
245 nh = *pkt;
246 pkt += hdrextlen;
247 plen -= hdrextlen;
248 break;
249 }
250
251 hh = 1;
252
253 optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
254 }
255 else if (nh == IPPROTO_DSTOPTS)
256 {
257 if (dstopts == 0) {
258 optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
259 dstopts = 1;
260 } else if (dstopts == 1) {
261 optslen = (uint16_t)((*(pkt + 1) + 1) << 3) - 2;
262 dstopts = 2;
263 } else {
265 /* skip past this extension so we can continue parsing the rest
266 * of the packet */
267 nh = *pkt;
268 pkt += hdrextlen;
269 plen -= hdrextlen;
270 break;
271 }
272 }
273
274 if (optslen > plen) {
275 /* since the packet is long enough (we checked
276 * plen against hdrlen, the optlen must be malformed. */
278 /* skip past this extension so we can continue parsing the rest
279 * of the packet */
280 nh = *pkt;
281 pkt += hdrextlen;
282 plen -= hdrextlen;
283 break;
284 }
285/** \todo move into own function to loaded on demand */
286 uint16_t padn_cnt = 0;
287 uint16_t other_cnt = 0;
288 uint16_t offset = 0;
289 while(offset < optslen)
290 {
291 if (*ptr == IPV6OPT_PAD1)
292 {
293 padn_cnt++;
294 offset++;
295 ptr++;
296 continue;
297 }
298
299 if (offset + 1 >= optslen) {
301 break;
302 }
303
304 /* length field for each opt */
305 uint8_t ip6_optlen = *(ptr + 1);
306
307 /* see if the optlen from the packet fits the total optslen */
308 if ((offset + 1 + ip6_optlen) > optslen) {
310 break;
311 }
312
313 if (*ptr == IPV6OPT_PADN) /* PadN */
314 {
315 //printf("PadN option\n");
316 padn_cnt++;
317
318 /* a zero padN len would be weird */
319 if (ip6_optlen == 0)
321 }
322 else if (*ptr == IPV6OPT_RA) /* RA */
323 {
324 ra->ip6ra_type = *(ptr);
325 ra->ip6ra_len = ip6_optlen;
326
327 if (ip6_optlen < sizeof(ra->ip6ra_value)) {
329 break;
330 }
331
332 memcpy(&ra->ip6ra_value, (ptr + 2), sizeof(ra->ip6ra_value));
334 //printf("RA option: type %" PRIu32 " len %" PRIu32 " value %" PRIu32 "\n",
335 // ra->ip6ra_type, ra->ip6ra_len, ra->ip6ra_value);
336 other_cnt++;
337 }
338 else if (*ptr == IPV6OPT_JUMBO) /* Jumbo */
339 {
340 jumbo->ip6j_type = *(ptr);
341 jumbo->ip6j_len = ip6_optlen;
342
343 if (ip6_optlen < sizeof(jumbo->ip6j_payload_len)) {
345 break;
346 }
347
348 memcpy(&jumbo->ip6j_payload_len, (ptr+2), sizeof(jumbo->ip6j_payload_len));
350 //printf("Jumbo option: type %" PRIu32 " len %" PRIu32 " payload len %" PRIu32 "\n",
351 // jumbo->ip6j_type, jumbo->ip6j_len, jumbo->ip6j_payload_len);
352 }
353 else if (*ptr == IPV6OPT_HAO) /* HAO */
354 {
355 hao->ip6hao_type = *(ptr);
356 hao->ip6hao_len = ip6_optlen;
357
358 if (ip6_optlen < sizeof(hao->ip6hao_hoa)) {
360 break;
361 }
362
363 memcpy(&hao->ip6hao_hoa, (ptr+2), sizeof(hao->ip6hao_hoa));
364 //printf("HAO option: type %" PRIu32 " len %" PRIu32 " ",
365 // hao->ip6hao_type, hao->ip6hao_len);
366 //char addr_buf[46];
367 //PrintInet(AF_INET6, (char *)&(hao->ip6hao_hoa),
368 // addr_buf,sizeof(addr_buf));
369 //printf("home addr %s\n", addr_buf);
370 other_cnt++;
371 } else {
372 if (nh == IPPROTO_HOPOPTS)
374 else
376
377 other_cnt++;
378 }
379 uint16_t optlen = (*(ptr + 1) + 2);
380 ptr += optlen; /* +2 for opt type and opt len fields */
381 offset += optlen;
382 }
383 /* flag packets that have only padding */
384 if (padn_cnt > 0 && other_cnt == 0) {
385 if (nh == IPPROTO_HOPOPTS)
387 else
389 }
390
391 nh = *pkt;
392 pkt += hdrextlen;
393 plen -= hdrextlen;
394 break;
395 }
396
397 case IPPROTO_FRAGMENT:
398 {
399 IPV6_SET_L4PROTO(p,nh);
400 /* store the offset of this extension into the packet
401 * past the ipv6 header. We use it in defrag for creating
402 * a defragmented packet without the frag header */
403 if (exthdr_fh_done == 0) {
404 DEBUG_VALIDATE_BUG_ON(pkt - orig_pkt > UINT16_MAX);
405 p->l3.vars.ip6.eh.fh_offset = (uint16_t)(pkt - orig_pkt);
406 exthdr_fh_done = 1;
407 }
408
409 uint16_t prev_hdrextlen = hdrextlen;
410 hdrextlen = sizeof(IPV6FragHdr);
411 if (hdrextlen > plen) {
413 SCReturn;
414 }
415
416 /* for the frag header, the length field is reserved */
417 if (*(pkt + 1) != 0) {
419 /* non fatal, lets try to continue */
420 }
421
422 if (IPV6_EXTHDR_ISSET_FH(p)) {
424 nh = *pkt;
425 pkt += hdrextlen;
426 plen -= hdrextlen;
427 break;
428 }
429
430 /* set the header flag first */
432
433 /* parse the header and setup the vars */
434 DecodeIPV6FragHeader(p, pkt, hdrextlen, plen, prev_hdrextlen);
435
436 /* if FH has offset 0 and no more fragments are coming, we
437 * parse this packet further right away, no defrag will be
438 * needed. It is a useless FH then though, so we do set an
439 * decoder event. */
440 if (p->l3.vars.ip6.eh.fh_more_frags_set == 0 && p->l3.vars.ip6.eh.fh_offset == 0) {
442
443 nh = *pkt;
444 pkt += hdrextlen;
445 plen -= hdrextlen;
446 break;
447 }
448 if (p->l3.vars.ip6.eh.fh_more_frags_set != 0 && plen % 8 != 0) {
449 // cf https://datatracker.ietf.org/doc/html/rfc2460#section-4.5
450 // each, except possibly the last ("rightmost") one,
451 // being an integer multiple of 8 octets long.
453 }
454
455 /* the rest is parsed upon reassembly */
457 SCReturn;
458 }
459 case IPPROTO_ESP:
460 {
461 IPV6_SET_L4PROTO(p,nh);
462 DecodeESP(tv, dtv, p, pkt, plen);
463 SCReturn;
464 }
465 case IPPROTO_AH:
466 {
467 IPV6_SET_L4PROTO(p,nh);
468 /* we need the header as a minimum */
469 hdrextlen = sizeof(IPV6AuthHdr);
470 /* the payload len field is the number of extra 4 byte fields,
471 * IPV6AuthHdr already contains the first */
472 if (*(pkt+1) > 0)
473 hdrextlen += ((*(pkt+1) - 1) * 4);
474
475 SCLogDebug("hdrextlen %"PRIu16, hdrextlen);
476
477 if (hdrextlen > plen) {
479 SCReturn;
480 }
481
482 IPV6AuthHdr *ahhdr = (IPV6AuthHdr *)pkt;
483 if (ahhdr->ip6ah_reserved != 0x0000) {
485 }
486
487 if (ah) {
489 nh = *pkt;
490 pkt += hdrextlen;
491 plen -= hdrextlen;
492 break;
493 }
494
495 ah = 1;
496
497 nh = *pkt;
498 pkt += hdrextlen;
499 plen -= hdrextlen;
500 break;
501 }
502 case IPPROTO_IPIP:
503 IPV6_SET_L4PROTO(p,nh);
504 DecodeIPv4inIPv6(tv, dtv, p, pkt, plen);
505 SCReturn;
506 /* none, last header */
507 case IPPROTO_NONE:
508 IPV6_SET_L4PROTO(p,nh);
509 SCReturn;
510 case IPPROTO_ICMP:
512 SCReturn;
513 /* no parsing yet, just skip it */
514 case IPPROTO_MH:
515 case IPPROTO_HIP:
516 case IPPROTO_SHIM6:
517 hdrextlen = 8 + (*(pkt+1) * 8); /* 8 bytes + length in 8 octet units */
518 if (hdrextlen > plen) {
520 SCReturn;
521 }
522 nh = *pkt;
523 pkt += hdrextlen;
524 plen -= hdrextlen;
525 break;
526 default:
528 IPV6_SET_L4PROTO(p,nh);
529 SCReturn;
530 }
531 }
532
533 SCReturn;
534}
535
536static const IPV6Hdr *DecodeIPV6Packet(
537 ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
538{
540 return NULL;
541 }
542
543 if (unlikely(IP_GET_RAW_VER(pkt) != 6)) {
544 SCLogDebug("wrong ip version %d",IP_GET_RAW_VER(pkt));
546 return NULL;
547 }
548
549 const IPV6Hdr *ip6h = PacketSetIPV6(p, pkt);
550
553 return NULL;
554 }
555
556 SET_IPV6_SRC_ADDR(ip6h, &p->src);
557 SET_IPV6_DST_ADDR(ip6h, &p->dst);
558
559 return ip6h;
560}
561
562int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
563{
565
566 if (!PacketIncreaseCheckLayers(p)) {
567 return TM_ECODE_FAILED;
568 }
569 /* do the actual decoding */
570 const IPV6Hdr *ip6h = DecodeIPV6Packet(tv, dtv, p, pkt, len);
571 if (unlikely(ip6h == NULL)) {
572 PacketClearL3(p);
573 return TM_ECODE_FAILED;
574 }
575 p->proto = IPV6_GET_RAW_NH(ip6h);
576
577#ifdef DEBUG
578 if (SCLogDebugEnabled()) { /* only convert the addresses if debug is really enabled */
579 /* debug print */
580 char s[46], d[46];
581 PrintInet(AF_INET6, (const void *)GET_IPV6_SRC_ADDR(p), s, sizeof(s));
582 PrintInet(AF_INET6, (const void *)GET_IPV6_DST_ADDR(p), d, sizeof(d));
583 SCLogDebug("IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: %" PRIu32 " NH: %" PRIu32
584 " PLEN: %" PRIu32 " HLIM: %" PRIu32 "",
585 s, d, IPV6_GET_RAW_CLASS(ip6h), IPV6_GET_RAW_FLOW(ip6h), IPV6_GET_RAW_NH(ip6h),
587 }
588#endif /* DEBUG */
589 const uint8_t *data = pkt + IPV6_HEADER_LEN;
590 const uint16_t data_len = IPV6_GET_RAW_PLEN(ip6h);
591
592 /* now process the Ext headers and/or the L4 Layer */
593 switch (IPV6_GET_RAW_NH(ip6h)) {
594 case IPPROTO_TCP:
595 IPV6_SET_L4PROTO (p, IPPROTO_TCP);
596 DecodeTCP(tv, dtv, p, data, data_len);
597 return TM_ECODE_OK;
598 case IPPROTO_UDP:
599 IPV6_SET_L4PROTO (p, IPPROTO_UDP);
600 DecodeUDP(tv, dtv, p, data, data_len);
601 return TM_ECODE_OK;
602 case IPPROTO_ICMPV6:
603 IPV6_SET_L4PROTO (p, IPPROTO_ICMPV6);
604 DecodeICMPV6(tv, dtv, p, data, data_len);
605 return TM_ECODE_OK;
606 case IPPROTO_SCTP:
608 DecodeSCTP(tv, dtv, p, data, data_len);
609 return TM_ECODE_OK;
610 case IPPROTO_IPIP:
612 DecodeIPv4inIPv6(tv, dtv, p, data, data_len);
613 return TM_ECODE_OK;
614 case IPPROTO_IPV6:
615 DecodeIP6inIP6(tv, dtv, p, data, data_len);
616 return TM_ECODE_OK;
617 case IPPROTO_GRE:
619 DecodeGRE(tv, dtv, p, data, data_len);
620 break;
621 case IPPROTO_FRAGMENT:
622 case IPPROTO_HOPOPTS:
623 case IPPROTO_ROUTING:
624 case IPPROTO_NONE:
625 case IPPROTO_DSTOPTS:
626 case IPPROTO_AH:
627 case IPPROTO_ESP:
628 case IPPROTO_MH:
629 case IPPROTO_HIP:
630 case IPPROTO_SHIM6:
631 DecodeIPV6ExtHdrs(tv, dtv, p, ip6h, data, data_len);
632 break;
633 case IPPROTO_ICMP:
635 break;
636 default:
639 break;
640 }
641 p->proto = IPV6_GET_L4PROTO (p);
642
643 /* Pass to defragger if a fragment. */
644 if (IPV6_EXTHDR_ISSET_FH(p)) {
645 Packet *rp = Defrag(tv, dtv, p);
646 if (rp != NULL) {
648 }
649 }
650
651 return TM_ECODE_OK;
652}
653
654#ifdef UNITTESTS
655#include "util-unittest-helper.h"
656#include "packet.h"
657
658/**
659 * \test fragment decoding
660 */
661static int DecodeIPV6FragTest01 (void)
662{
663
664 uint8_t raw_frag1[] = {
665 0x60, 0x0f, 0x1a, 0xcf, 0x05, 0xa8, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
666 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
667 0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x00, 0x01, 0xdf, 0xf8, 0x11, 0xd7,
668 0x00, 0x50, 0xa6, 0x5c, 0xcc, 0xd7, 0x28, 0x9f, 0xc3, 0x34, 0xc6, 0x58, 0x80, 0x10, 0x20, 0x13,
669 0x18, 0x1f, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0xcd, 0xf9, 0x3a, 0x41, 0x00, 0x1a, 0x91, 0x8a,
670 0x48, 0x54, 0x54, 0x50, 0x2f, 0x31, 0x2e, 0x31, 0x20, 0x32, 0x30, 0x30, 0x20, 0x4f, 0x4b, 0x0d,
671 0x0a, 0x44, 0x61, 0x74, 0x65, 0x3a, 0x20, 0x46, 0x72, 0x69, 0x2c, 0x20, 0x30, 0x32, 0x20, 0x44,
672 0x65, 0x63, 0x20, 0x32, 0x30, 0x31, 0x31, 0x20, 0x30, 0x38, 0x3a, 0x33, 0x32, 0x3a, 0x35, 0x37,
673 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x3a, 0x20, 0x41, 0x70,
674 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x43, 0x61, 0x63, 0x68, 0x65, 0x2d, 0x43, 0x6f, 0x6e, 0x74,
675 0x72, 0x6f, 0x6c, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d, 0x0a, 0x50,
676 0x72, 0x61, 0x67, 0x6d, 0x61, 0x3a, 0x20, 0x6e, 0x6f, 0x2d, 0x63, 0x61, 0x63, 0x68, 0x65, 0x0d,
677 0x0a, 0x45, 0x78, 0x70, 0x69, 0x72, 0x65, 0x73, 0x3a, 0x20, 0x54, 0x68, 0x75, 0x2c, 0x20, 0x30,
678 0x31, 0x20, 0x4a, 0x61, 0x6e, 0x20, 0x31, 0x39, 0x37, 0x31, 0x20, 0x30, 0x30, 0x3a, 0x30, 0x30,
679 0x3a, 0x30, 0x30, 0x20, 0x47, 0x4d, 0x54, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74,
680 0x2d, 0x4c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x3a, 0x20, 0x31, 0x35, 0x39, 0x39, 0x0d, 0x0a, 0x4b,
681 0x65, 0x65, 0x70, 0x2d, 0x41, 0x6c, 0x69, 0x76, 0x65, 0x3a, 0x20, 0x74, 0x69, 0x6d, 0x65, 0x6f,
682 0x75, 0x74, 0x3d, 0x35, 0x2c, 0x20, 0x6d, 0x61, 0x78, 0x3d, 0x39, 0x39, 0x0d, 0x0a, 0x43, 0x6f,
683 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x3a, 0x20, 0x4b, 0x65, 0x65, 0x70, 0x2d, 0x41,
684 0x6c, 0x69, 0x76, 0x65, 0x0d, 0x0a, 0x43, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x2d, 0x54, 0x79,
685 0x70, 0x65, 0x3a, 0x20, 0x61, 0x70, 0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2f,
686 0x6a, 0x61, 0x76, 0x61, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x3b, 0x63, 0x68, 0x61, 0x72, 0x73,
687 0x65, 0x74, 0x3d, 0x61, 0x73, 0x63, 0x69, 0x69, 0x0d, 0x0a, 0x0d, 0x0a, 0x5f, 0x6a, 0x71, 0x6a,
688 0x73, 0x70, 0x28, 0x7b, 0x22, 0x69, 0x70, 0x22, 0x3a, 0x22, 0x32, 0x30, 0x30, 0x31, 0x3a, 0x39,
689 0x38, 0x30, 0x3a, 0x33, 0x32, 0x62, 0x32, 0x3a, 0x31, 0x3a, 0x32, 0x65, 0x34, 0x31, 0x3a, 0x33,
690 0x38, 0x66, 0x66, 0x3a, 0x66, 0x65, 0x61, 0x37, 0x3a, 0x65, 0x61, 0x65, 0x62, 0x22, 0x2c, 0x22,
691 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x69, 0x70, 0x76, 0x36, 0x22, 0x2c, 0x22, 0x73, 0x75,
692 0x62, 0x74, 0x79, 0x70, 0x65, 0x22, 0x3a, 0x22, 0x22, 0x2c, 0x22, 0x76, 0x69, 0x61, 0x22, 0x3a,
693 0x22, 0x22, 0x2c, 0x22, 0x70, 0x61, 0x64, 0x64, 0x69, 0x6e, 0x67, 0x22, 0x3a, 0x22, 0x20, 0x20,
694 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
695 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
696 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
697 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
698 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
699 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
700 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
701 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
702 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
703 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
704 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
705 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
706 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
707 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
708 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
709 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
710 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
711 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
712 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
713 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
714 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
715 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
716 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
717 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
718 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
719 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
720 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
721 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
722 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
723 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
724 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
725 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
726 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
727 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
728 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
729 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
730 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
731 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
732 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
733 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
734 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
735 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
736 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
737 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
738 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
739 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
740 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
741 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
742 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
743 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
744 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
745 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
746 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
747 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
748 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
749 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
750 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
751 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
752 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
753 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
754 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
755 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
756 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
757 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
758 };
759 uint8_t raw_frag2[] = {
760 0x60, 0x0f, 0x1a, 0xcf, 0x00, 0x1c, 0x2c, 0x36, 0x20, 0x01, 0x04, 0x70, 0x00, 0x01, 0x00, 0x18,
761 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x20, 0x01, 0x09, 0x80, 0x32, 0xb2, 0x00, 0x01,
762 0x2e, 0x41, 0x38, 0xff, 0xfe, 0xa7, 0xea, 0xeb, 0x06, 0x00, 0x05, 0xa0, 0xdf, 0xf8, 0x11, 0xd7,
763 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
764 0x20, 0x20, 0x20, 0x20,
765 };
766 Packet *pkt;
768 if (unlikely(p1 == NULL))
769 return 0;
771 if (unlikely(p2 == NULL)) {
772 SCFree(p1);
773 return 0;
774 }
777 int result = 0;
778
780 DefragInit();
781
782 memset(&tv, 0, sizeof(ThreadVars));
783 memset(&dtv, 0, sizeof(DecodeThreadVars));
784
785 PacketCopyData(p1, raw_frag1, sizeof(raw_frag1));
786 PacketCopyData(p2, raw_frag2, sizeof(raw_frag2));
787
788 DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
789
790 if (!(IPV6_EXTHDR_ISSET_FH(p1))) {
791 printf("ipv6 frag header not detected: ");
792 goto end;
793 }
794
795 DecodeIPV6(&tv, &dtv, p2, GET_PKT_DATA(p2), GET_PKT_LEN(p2));
796
797 if (!(IPV6_EXTHDR_ISSET_FH(p2))) {
798 printf("ipv6 frag header not detected: ");
799 goto end;
800 }
801
802 if (tv.decode_pq.len != 1) {
803 printf("no reassembled packet: ");
804 goto end;
805 }
806
807 result = 1;
808end:
809 PacketRecycle(p1);
810 PacketRecycle(p2);
811 SCFree(p1);
812 SCFree(p2);
814 while (pkt != NULL) {
815 PacketRecycle(pkt);
816 SCFree(pkt);
818 }
820 FlowShutdown();
821 return result;
822}
823
824/**
825 * \test routing header decode
826 */
827static int DecodeIPV6RouteTest01 (void)
828{
829 uint8_t raw_pkt1[] = {
830 0x60, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x2b, 0x40,
831 0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
832 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02,
833 0x20, 0x01, 0xaa, 0xaa, 0x00, 0x01, 0x00, 0x00,
834 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
835 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
836
837 0xb2, 0xed, 0x00, 0x50, 0x1b, 0xc7, 0x6a, 0xdf,
838 0x00, 0x00, 0x00, 0x00, 0x50, 0x02, 0x20, 0x00,
839 0xfa, 0x87, 0x00, 0x00,
840 };
842 FAIL_IF(unlikely(p1 == NULL));
845
847
848 memset(&tv, 0, sizeof(ThreadVars));
849 memset(&dtv, 0, sizeof(DecodeThreadVars));
850
851 PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
852
853 DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
854
856 FAIL_IF(p1->l3.vars.ip6.eh.rh_type != 0);
857 PacketRecycle(p1);
858 SCFree(p1);
859 FlowShutdown();
860 PASS;
861}
862
863/**
864 * \test HOP header decode
865 */
866static int DecodeIPV6HopTest01 (void)
867{
868 uint8_t raw_pkt1[] = { 0x60, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x01, 0xfe, 0x80, 0x00, 0x00,
869 0x00, 0x00, 0x00, 0x00, 0x02, 0x0f, 0xfe, 0xff, 0xfe, 0x98, 0x3d, 0x01, 0xff, 0x02, 0x00,
870 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x3a, 0x00,
871 0xff, /* 0xff is a nonsense opt */
872 0x02, 0x00, 0x00, 0x00, 0x00, 0x82, 0x00, 0x1c, 0x6f, 0x27, 0x10, 0x00, 0x00, 0x00, 0x00,
873 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
875 FAIL_IF(unlikely(p1 == NULL));
878
880
881 memset(&tv, 0, sizeof(ThreadVars));
882 memset(&dtv, 0, sizeof(DecodeThreadVars));
883
884 PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
885
886 DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1));
887
889
890 PacketRecycle(p1);
891 SCFree(p1);
892 FlowShutdown();
893 PASS;
894}
895
896#endif /* UNITTESTS */
897
898/**
899 * \brief this function registers unit tests for IPV6 decoder
900 */
901
903{
904#ifdef UNITTESTS
905 UtRegisterTest("DecodeIPV6FragTest01", DecodeIPV6FragTest01);
906 UtRegisterTest("DecodeIPV6RouteTest01", DecodeIPV6RouteTest01);
907 UtRegisterTest("DecodeIPV6HopTest01", DecodeIPV6HopTest01);
908#endif /* UNITTESTS */
909}
910
911/**
912 * @}
913 */
uint8_t len
void StatsIncr(ThreadVars *tv, uint16_t id)
Increments the local counter.
Definition counters.c:166
int DecodeESP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Function to decode IPSEC-ESP packets.
Definition decode-esp.c:64
@ IPV6_EXTHDR_AH_RES_NOT_NULL
@ IPV6_HOPOPTS_ONLY_PADDING
@ IPV6_DATA_AFTER_NONE_HEADER
@ IPV6_EXTHDR_ZERO_LEN_PADN
@ IPV6_EXTHDR_DUPL_DH
@ IPV6_EXTHDR_DUPL_HH
@ IPV6_DSTOPTS_ONLY_PADDING
@ IPV6_EXTHDR_RH_TYPE_0
@ IPV6_FRAG_INVALID_LENGTH
@ IPV4_IN_IPV6_PKT_TOO_SMALL
@ IPV6_EXTHDR_DUPL_AH
@ IPV6_TRUNC_EXTHDR
@ IPV6_EXTHDR_DUPL_RH
@ IPV6_WRONG_IP_VER
@ IPV6_EXTHDR_DUPL_FH
@ IPV6_TRUNC_PKT
@ IPV6_UNKNOWN_NEXT_HEADER
@ IPV4_IN_IPV6_WRONG_IP_VER
@ IPV6_WITH_ICMPV4
@ IPV6_EXTHDR_USELESS_FH
@ IPV6_IN_IPV6_WRONG_IP_VER
@ IPV6_DSTOPTS_UNKNOWN_OPT
@ IPV6_FH_NON_ZERO_RES_FIELD
@ IPV6_HOPOPTS_UNKNOWN_OPT
@ IPV6_IN_IPV6_PKT_TOO_SMALL
@ IPV6_EXTHDR_INVALID_OPTLEN
int DecodeGRE(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Function to decode GRE packets.
Definition decode-gre.c:47
#define IPPROTO_GRE
Definition decode-gre.h:30
int DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
Decode ICMPV6 packets and fill the Packet with the decoded info.
#define IPV4_HEADER_LEN
Definition decode-ipv4.h:28
int DecodeIPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
void DecodeIPV6RegisterTests(void)
this function registers unit tests for IPV6 decoder
void DecodeIPV6FragHeader(Packet *p, const uint8_t *pkt, uint16_t hdrextlen, uint16_t plen, uint16_t prev_hdrextlen)
Definition decode-ipv6.c:94
#define IPV6_GET_RAW_PLEN(ip6h)
Definition decode-ipv6.h:66
#define IPV6_GET_RAW_HLIM(ip6h)
Definition decode-ipv6.h:67
#define IPV6OPT_HAO
#define IPV6_GET_RAW_NH(ip6h)
Definition decode-ipv6.h:65
#define IPV6_EXTHDR_SET_FH(p)
#define IPV6_EXTHDR_ISSET_FH(p)
#define IPV6_GET_L4PROTO(p)
Definition decode-ipv6.h:75
#define IPV6_SET_L4PROTO(p, proto)
Definition decode-ipv6.h:72
#define IPV6OPT_JUMBO
#define IPV6_EXTHDR_ISSET_RH(p)
#define IPV6_GET_RAW_FLOW(ip6h)
Definition decode-ipv6.h:64
#define IPV6OPT_RA
#define IPV6OPT_PAD1
#define IPV6_HEADER_LEN
Definition decode-ipv6.h:27
#define IPV6_SET_EXTHDRS_LEN(p, len)
Definition decode-ipv6.h:73
#define IPV6OPT_PADN
#define IPV6_GET_RAW_CLASS(ip6h)
Definition decode-ipv6.h:63
#define IPV6_EXTHDR_SET_RH(p)
int DecodeSCTP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition decode-sctp.c:62
int DecodeTCP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition decode-tcp.c:273
int DecodeUDP(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint16_t len)
Definition decode-udp.c:75
#define GET_IPV6_DST_ADDR(p)
Definition decode.h:204
#define SET_IPV6_SRC_ADDR(ip6h, a)
Definition decode.h:159
#define PKT_SET_SRC(p, src_val)
Definition decode.h:1325
#define GET_PKT_DATA(p)
Definition decode.h:209
#define GET_IPV6_SRC_ADDR(p)
Definition decode.h:203
@ DECODE_TUNNEL_IPV6
Definition decode.h:1107
@ DECODE_TUNNEL_IPV4
Definition decode.h:1106
#define IPPROTO_SHIM6
Definition decode.h:1241
#define IPPROTO_MH
Definition decode.h:1232
#define ENGINE_SET_INVALID_EVENT(p, e)
Definition decode.h:1194
#define ENGINE_ISSET_EVENT(p, e)
Definition decode.h:1199
#define IPPROTO_HIP
Definition decode.h:1237
#define SET_IPV6_DST_ADDR(ip6h, a)
Definition decode.h:168
#define IP_GET_RAW_VER(pkt)
Definition decode.h:232
#define GET_PKT_LEN(p)
Definition decode.h:208
#define ENGINE_SET_EVENT(p, e)
Definition decode.h:1186
#define PKT_IS_FRAGMENT
Definition decode.h:1290
@ PKT_SRC_DECODER_IPV6
Definition decode.h:55
#define IPPROTO_IPIP
Definition decode.h:1212
#define IPPROTO_SCTP
Definition decode.h:1228
void DefragInit(void)
Definition defrag.c:1109
Packet * Defrag(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p)
Entry point for IPv4 and IPv6 fragments.
Definition defrag.c:1063
void DefragDestroy(void)
Definition defrag.c:1129
void FlowSetupPacket(Packet *p)
prepare packet for a life with flow Set PKT_WANTS_FLOW flag to indicate workers should do a flow look...
Definition flow-hash.c:533
void FlowInitConfig(bool quiet)
initialize the configuration
Definition flow.c:547
void FlowShutdown(void)
shutdown the flow engine
Definition flow.c:691
#define FLOW_QUIET
Definition flow.h:43
DecodeThreadVars * dtv
ThreadVars * tv
void UtRegisterTest(const char *name, int(*TestFn)(void))
Register unit test.
#define PASS
Pass the test.
#define FAIL_IF(expr)
Fail a test if expression evaluates to true.
Packet * PacketGetFromAlloc(void)
Get a malloced packet.
Definition decode.c:258
int PacketCopyData(Packet *p, const uint8_t *pktdata, uint32_t pktlen)
Copy data to Packet payload and set packet length.
Definition decode.c:377
Packet * PacketTunnelPktSetup(ThreadVars *tv, DecodeThreadVars *dtv, Packet *parent, const uint8_t *pkt, uint32_t len, enum DecodeTunnelProto proto)
Setup a pseudo packet (tunnel)
Definition decode.c:393
void PacketEnqueueNoLock(PacketQueueNoLock *qnl, Packet *p)
Packet * PacketDequeueNoLock(PacketQueueNoLock *qnl)
void PacketRecycle(Packet *p)
Definition packet.c:150
Structure to hold thread specific data for all decode modules.
Definition decode.h:963
uint16_t counter_ipv6
Definition decode.h:980
uint16_t counter_ipv4inipv6
Definition decode.h:1012
uint16_t counter_ipv6inipv6
Definition decode.h:1013
uint16_t fh_data_len
uint16_t fh_header_offset
uint16_t fh_offset
uint8_t rh_type
uint16_t fh_data_offset
uint8_t fh_nh
bool fh_more_frags_set
uint32_t fh_id
uint16_t fh_prev_hdr_offset
uint8_t ip6hao_len
struct in6_addr ip6hao_hoa
uint8_t ip6hao_type
uint8_t ip6j_len
uint32_t ip6j_payload_len
uint8_t ip6j_type
uint8_t ip6ra_len
uint8_t ip6ra_type
uint16_t ip6ra_value
union PacketL3::@31 vars
IPV6ExtHdrs eh
Definition decode.h:448
struct PacketL3::@31::@32 ip6
Address src
Definition decode.h:505
struct PacketL3 l3
Definition decode.h:600
uint32_t flags
Definition decode.h:544
Address dst
Definition decode.h:506
uint8_t proto
Definition decode.h:523
Per thread variable structure.
Definition threadvars.h:58
PacketQueueNoLock decode_pq
Definition threadvars.h:112
#define SCNtohs(x)
#define SCNtohl(x)
@ TM_ECODE_FAILED
@ TM_ECODE_OK
int SCLogDebugEnabled(void)
Returns whether debug messages are enabled to be logged or not.
Definition util-debug.c:767
#define SCEnter(...)
Definition util-debug.h:277
#define SCLogDebug(...)
Definition util-debug.h:275
#define SCReturn
Definition util-debug.h:279
#define SCFree(p)
Definition util-mem.h:61
#define unlikely(expr)
const char * PrintInet(int af, const void *src, char *dst, socklen_t size)
Definition util-print.c:231
uint64_t offset
#define DEBUG_VALIDATE_BUG_ON(exp)