/** DecodePPPtest03
* \brief Decode good PPP packet, additionally the IPv4 packet inside is
* 4 bytes short.
* \retval 0 Test failed
* \retval 1 Test succeeded
*/
static int DecodePPPtest03 (void)
{
uint8_t raw_ppp[] = { 0xff, 0x03, 0x00, 0x21, 0x45, 0xc0, 0x00, 0x2c, 0x4d,
0xed, 0x00, 0x00, 0xff, 0x06, 0xd5, 0x17, 0xbf, 0x01,
0x0d, 0x01, 0xbf, 0x01, 0x0d, 0x03, 0xea, 0x37, 0x00,
0x17, 0x6d, 0x0b, 0xba, 0xc3, 0x00, 0x00, 0x00, 0x00,
0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 };
Packet *p = PacketGetFromAlloc();
if (unlikely(p == NULL))
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&dtv, 0, sizeof(DecodeThreadVars));
FlowInitConfig(FLOW_QUIET);
DecodePPP(&tv, &dtv, p, raw_ppp, sizeof(raw_ppp), NULL);
FlowShutdown();
if(p->ppph == NULL) {
SCFree(p);
return 0;
}
if(ENGINE_ISSET_EVENT(p,PPP_PKT_TOO_SMALL)) {
SCFree(p);
return 0;
}
if(ENGINE_ISSET_EVENT(p,PPPIPV4_PKT_TOO_SMALL)) {
SCFree(p);
return 0;
}
if(ENGINE_ISSET_EVENT(p,PPP_WRONG_TYPE)) {
SCFree(p);
return 0;
}
if (!(ENGINE_ISSET_EVENT(p,IPV4_TRUNC_PKT))) {
SCFree(p);
return 0;
}
/* Function must return here */
SCFree(p);
return 1;
}
/** DecodePPPOEtest04
* \brief Valid example PPPOE packet taken from RFC2516 - but with wrong PPPOE code
* \retval 1 Expected test value
*/
static int DecodePPPOEtest04 (void)
{
/* example PADI packet taken from RFC2516, but with wrong code */
uint8_t raw_pppoe[] = {
0x11, 0xbb, 0x00, 0x00, 0x00, 0x04, 0x01, 0x01,
0x00, 0x00
};
Packet *p = PacketGetFromAlloc();
if (unlikely(p == NULL))
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodePPPOEDiscovery(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe), NULL);
if(ENGINE_ISSET_EVENT(p,PPPOE_WRONG_CODE)) {
SCFree(p);
return 1;
}
SCFree(p);
return 0;
}
/**
* Test that a DCE ethernet frame, followed by data that is too small
* for an ethernet header.
*
* Redmine issue:
* https://redmine.openinfosecfoundation.org/issues/2887
*/
static int DecodeEthernetTestDceNextTooSmall(void)
{
uint8_t raw_eth[] = {
0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
0x94, 0x56, 0x00, 0x01, 0x89, 0x03, //0x88, 0x64,
0x00, 0x00,
0x00, 0x10, 0x94, 0x55, 0x00, 0x01, 0x00, 0x10,
0x94, 0x56, 0x00, 0x01,
};
Packet *p = SCMalloc(SIZE_OF_PACKET);
FAIL_IF_NULL(p);
ThreadVars tv;
DecodeThreadVars dtv;
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
DecodeEthernet(&tv, &dtv, p, raw_eth, sizeof(raw_eth), NULL);
FAIL_IF_NOT(ENGINE_ISSET_EVENT(p, ETHERNET_PKT_TOO_SMALL));
SCFree(p);
PASS;
}
/** DecodePPPOEtest05
* \brief Valid exaple PADO PPPOE packet taken from RFC2516, but too short for given length
* \retval 0 Expected test value
*/
static int DecodePPPOEtest05 (void)
{
/* example PADI packet taken from RFC2516 */
uint8_t raw_pppoe[] = {
0x11, 0x07, 0x00, 0x00, 0x00, 0x20, 0x01, 0x01,
0x00, 0x00, 0x01, 0x02, 0x00, 0x18, 0x47, 0x6f,
0x20, 0x52, 0x65, 0x64, 0x42, 0x61, 0x63, 0x6b,
0x20, 0x2d, 0x20, 0x65, 0x73, 0x68, 0x73, 0x68
};
Packet *p = PacketGetFromAlloc();
if (unlikely(p == NULL))
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodePPPOEDiscovery(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe), NULL);
if(ENGINE_ISSET_EVENT(p,PPPOE_MALFORMED_TAGS)) {
SCFree(p);
return 1;
}
SCFree(p);
return 0;
}
/**
* \test HOP header decode
*/
static int DecodeIPV6HopTest01 (void)
{
uint8_t raw_pkt1[] = {
0x60,0x00,0x00,0x00,0x00,0x20,0x00,0x01,0xfe,0x80,0x00,0x00,0x00,0x00,0x00,0x00,
0x02,0x0f,0xfe,0xff,0xfe,0x98,0x3d,0x01,0xff,0x02,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x3a,0x00,0xff, /* 0xff is a nonsene opt */
0x02,0x00,0x00,0x00,0x00,
0x82,0x00,0x1c,0x6f,0x27,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
};
Packet *p1 = PacketGetFromAlloc();
FAIL_IF(unlikely(p1 == NULL));
ThreadVars tv;
DecodeThreadVars dtv;
PacketQueue pq;
FlowInitConfig(FLOW_QUIET);
memset(&pq, 0, sizeof(PacketQueue));
memset(&tv, 0, sizeof(ThreadVars));
memset(&dtv, 0, sizeof(DecodeThreadVars));
PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq);
FAIL_IF (!(ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)));
PACKET_RECYCLE(p1);
SCFree(p1);
FlowShutdown();
PASS;
}
/**
* \test DecodeVLANTest02 test if vlan header has unknown type.
*
* \retval 1 on success
* \retval 0 on failure
*/
static int DecodeVLANtest02 (void) {
uint8_t raw_vlan[] = {
0x00, 0x20, 0x01, 0x00, 0x45, 0x00, 0x00, 0x34,
0x3b, 0x36, 0x40, 0x00, 0x40, 0x06, 0xb7, 0xc9,
0x83, 0x97, 0x20, 0x81, 0x83, 0x97, 0x20, 0x15,
0x04, 0x8a, 0x17, 0x70, 0x4e, 0x14, 0xdf, 0x55,
0x4d, 0x3d, 0x5a, 0x61, 0x80, 0x10, 0x6b, 0x50,
0x3c, 0x4c, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a,
0x00, 0x04, 0xf0, 0xc8, 0x01, 0x99, 0xa3, 0xf3
};
Packet *p = PacketGetFromAlloc();
if (unlikely(p == NULL))
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodeVLAN(&tv, &dtv, p, raw_vlan, sizeof(raw_vlan), NULL);
if(ENGINE_ISSET_EVENT(p,VLAN_UNKNOWN_TYPE)) {
SCFree(p);
return 1;
}
SCFree(p);
return 0;
}
/** DecodePPPOEtest04
* \brief Valid example PPPOE packet taken from RFC2516 - but with wrong PPPOE code
* \retval 1 Expected test value
*/
static int DecodePPPOEtest04 (void) {
/* example PADI packet taken from RFC2516, but with wrong code */
uint8_t raw_pppoe[] = {
0x11, 0xbb, 0x00, 0x00, 0x00, 0x04, 0x01, 0x01,
0x00, 0x00
};
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodePPPOEDiscovery(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe), NULL);
if(ENGINE_ISSET_EVENT(p,PPPOE_WRONG_CODE)) {
SCFree(p);
return 1;
}
SCFree(p);
return 0;
}
/* DecodePPPtest02
* Decode malformed ppp layer packet
* Expected test value: 1
*/
static int DecodePPPtest02 (void)
{
uint8_t raw_ppp[] = { 0xff, 0x03, 0x00, 0xff, 0x45, 0xc0, 0x00, 0x2c, 0x4d,
0xed, 0x00, 0x00, 0xff, 0x06, 0xd5, 0x17, 0xbf, 0x01,
0x0d, 0x01, 0xbf, 0x01, 0x0d, 0x03, 0xea, 0x37, 0x00,
0x17, 0x6d, 0x0b, 0xba, 0xc3, 0x00, 0x00, 0x00, 0x00,
0x60, 0x02, 0x10, 0x20, 0xdd, 0xe1, 0x00, 0x00 };
Packet *p = PacketGetFromAlloc();
if (unlikely(p == NULL))
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodePPP(&tv, &dtv, p, raw_ppp, sizeof(raw_ppp), NULL);
/* Function must returns here */
if(ENGINE_ISSET_EVENT(p,PPP_WRONG_TYPE)) {
SCFree(p);
return 1;
}
SCFree(p);
return 0;
}
static int DecodeMPLSTestHeaderTooSmall(void)
{
int ret = 1;
/* A packet that is too small to have a complete MPLS header. */
uint8_t pkt[] = {
0x00, 0x00, 0x11
};
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (unlikely(p == NULL)) {
return 0;
}
ThreadVars tv;
DecodeThreadVars dtv;
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
DecodeMPLS(&tv, &dtv, p, pkt, sizeof(pkt), NULL);
if (!ENGINE_ISSET_EVENT(p, MPLS_HEADER_TOO_SMALL)) {
ret = 0;
}
SCFree(p);
return ret;
}
/**
* \test DecodeVLANTest02 test a good vlan header.
*
* \retval 1 on success
* \retval 0 on failure
*/
static int DecodeVLANtest03 (void) {
uint8_t raw_vlan[] = {
0x00, 0x20, 0x08, 0x00, 0x45, 0x00, 0x00, 0x34,
0x3b, 0x36, 0x40, 0x00, 0x40, 0x06, 0xb7, 0xc9,
0x83, 0x97, 0x20, 0x81, 0x83, 0x97, 0x20, 0x15,
0x04, 0x8a, 0x17, 0x70, 0x4e, 0x14, 0xdf, 0x55,
0x4d, 0x3d, 0x5a, 0x61, 0x80, 0x10, 0x6b, 0x50,
0x3c, 0x4c, 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a,
0x00, 0x04, 0xf0, 0xc8, 0x01, 0x99, 0xa3, 0xf3
};
Packet *p = PacketGetFromAlloc();
if (unlikely(p == NULL))
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&dtv, 0, sizeof(DecodeThreadVars));
FlowInitConfig(FLOW_QUIET);
DecodeVLAN(&tv, &dtv, p, raw_vlan, sizeof(raw_vlan), NULL);
if(p->vlanh == NULL) {
goto error;
}
if(ENGINE_ISSET_EVENT(p,VLAN_HEADER_TOO_SMALL)) {
goto error;
}
if(ENGINE_ISSET_EVENT(p,VLAN_UNKNOWN_TYPE)) {
goto error;
}
PACKET_RECYCLE(p);
FlowShutdown();
SCFree(p);
return 1;
error:
PACKET_RECYCLE(p);
FlowShutdown();
SCFree(p);
return 0;
}
static int DecodeMPLSTestPacketTooSmall(void)
{
ThreadVars tv;
DecodeThreadVars dtv;
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&tv, 0, sizeof(ThreadVars));
Packet *p0 = SCCalloc(1, SIZE_OF_PACKET);
memset(p0, 0, SIZE_OF_PACKET);
uint8_t pkt0[] = { 0x00, 0x01, 0x51, 0xff };
DecodeMPLS(&tv, &dtv, p0, pkt0, sizeof(pkt0), NULL);
FAIL_IF_NOT(ENGINE_ISSET_EVENT(p0, MPLS_PKT_TOO_SMALL));
SCFree(p0);
Packet *p1 = SCCalloc(1, SIZE_OF_PACKET);
FAIL_IF_NULL(p1);
uint8_t pkt1[] = { 0x00, 0x01, 0x51, 0xff, 0x45 };
DecodeMPLS(&tv, &dtv, p1, pkt1, sizeof(pkt1), NULL);
FAIL_IF_NOT(ENGINE_ISSET_EVENT(p1, MPLS_PKT_TOO_SMALL));
SCFree(p1);
Packet *p2 = SCCalloc(1, SIZE_OF_PACKET);
FAIL_IF_NULL(p2);
uint8_t pkt2[] = { 0x00, 0x01, 0x51, 0xff, 0x45, 0x01 };
DecodeMPLS(&tv, &dtv, p2, pkt2, sizeof(pkt2), NULL);
FAIL_IF_NOT(ENGINE_ISSET_EVENT(p2, MPLS_PKT_TOO_SMALL));
SCFree(p2);
Packet *p3 = SCCalloc(1, SIZE_OF_PACKET);
FAIL_IF_NULL(p3);
uint8_t pkt3[] = { 0x00, 0x01, 0x51, 0xff, 0x45, 0x01, 0x02 };
DecodeMPLS(&tv, &dtv, p3, pkt3, sizeof(pkt3), NULL);
FAIL_IF_NOT(ENGINE_ISSET_EVENT(p3, MPLS_PKT_TOO_SMALL));
SCFree(p3);
// This should not create a too small event is it has one more byte
// than required.
Packet *p4 = SCCalloc(1, SIZE_OF_PACKET);
FAIL_IF_NULL(p4);
uint8_t pkt4[] = { 0x00, 0x01, 0x51, 0xff, 0x45, 0x01, 0x02, 0x03 };
DecodeMPLS(&tv, &dtv, p4, pkt4, sizeof(pkt4), NULL);
FAIL_IF(ENGINE_ISSET_EVENT(p4, MPLS_PKT_TOO_SMALL));
SCFree(p4);
PASS;
}
/** DecodePPPOEtest02
* \brief Valid PPPOE packet - check the invalid ICMP type encapsulated is flagged
* \retval 0 Expected test value
*/
static int DecodePPPOEtest02 (void) {
uint8_t raw_pppoe[] = {
0x11, 0x00, 0x00, 0x01, 0x00, 0x40, 0x00, 0x21,
0x45, 0x00, 0x00, 0x3c, 0x05, 0x5c, 0x00, 0x00,
0x20, 0x01, 0xff, 0x30, 0xc0, 0xa8, 0x0a, 0x7f,
0xc0, 0xa8, 0x0a, 0x65, 0xab, 0xcd, 0x16, 0x5e,
0x02, 0x00, 0x37, 0x00, 0x41, 0x42, 0x43, 0x44,
0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c,
0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54,
0x55, 0x56, 0x57, 0x41, 0x42, 0x43, 0x44, 0x45,
0x46, 0x47, 0x48, 0x49 };
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
int ret = 0;
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
memset(&dtv, 0, sizeof(DecodeThreadVars));
FlowInitConfig(FLOW_QUIET);
DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe), NULL);
if(ENGINE_ISSET_EVENT(p,PPPOE_PKT_TOO_SMALL)) {
goto end;
}
// and we insist that the invalid ICMP encapsulated (type 0xab, code 0xcd) is flagged
if(! ENGINE_ISSET_EVENT(p,ICMPV4_UNKNOWN_TYPE)) {
goto end;
}
ret = 1;
end:
FlowShutdown();
SCFree(p);
return ret;
}
/** \test icmpv6 message type: parameter problem, invalid packet
* \brief set the event ICMPV6_IPV6_UNKNOWN_VER properly when the embedded packet has an unknown version
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6ParamProbTest02(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x38, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x04, 0x00, 0xcc, 0x2a, 0x6d, 0x93, 0x0b, 0xdf,
0x38, 0x70, 0x12, 0xb7, 0x00, 0x08, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x80, 0x00, 0x08, 0xb5, 0x99, 0xc3, 0xde, 0x40 };
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (p->icmpv6h == NULL) {
SCLogDebug("ICMPv6 Unable to detect icmpv6 layer from ipv6");
retval = 0;
goto end;
}
if (ICMPV6_GET_TYPE(p) != 4 || ICMPV6_GET_CODE(p) != 0) {
SCLogDebug("ICMPv6 Not processed at all");
retval = 0;
goto end;
}
if (!ENGINE_ISSET_EVENT(p, ICMPV6_IPV6_UNKNOWN_VER)) {
SCLogDebug("ICMPv6 Error: Unknown embedded ipv6 version event not set");
retval = 0;
goto end;
}
retval = 1;
end:
SCFree(p);
return retval;
}
/**
* \brief This function is used to match decoder event flags set on a packet with those passed via decode-event:
*
* \param t pointer to thread vars
* \param det_ctx pointer to the pattern matcher thread
* \param p pointer to the current packet
* \param s pointer to the Signature
* \param m pointer to the sigmatch
*
* \retval 0 no match
* \retval 1 match
*/
int DetectEngineEventMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Packet *p, Signature *s, const SigMatchCtx *ctx)
{
SCEnter();
const DetectEngineEventData *de = (const DetectEngineEventData *)ctx;
if (ENGINE_ISSET_EVENT(p, de->event)) {
SCLogDebug("de->event matched %u", de->event);
SCReturnInt(1);
}
SCReturnInt(0);
}
/** \test icmpv6 message type: packet too big, invalid packet
* \brief Set the event ICMPV6_UNKNOWN_CODE if code is invalid for this type
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6PktTooBigTest02(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x30, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x02, 0x10, 0x5c, 0x7a, 0x00, 0x00, 0x05, 0x00,
0x64, 0x14, 0xfd, 0xff, 0x00, 0x00, 0x3b, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 };
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (p->icmpv6h == NULL) {
SCLogDebug("ICMPv6 Unable to detect icmpv6 layer from ipv6");
retval = 0;
goto end;
}
if (!ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)) {
SCLogDebug("ICMPv6 Error: Unknown code event not set");
retval = 0;
goto end;
}
retval = 1;
end:
SCFree(p);
return retval;
}
/**
* \test HOP header decode
*/
static int DecodeIPV6HopTest01 (void)
{
uint8_t raw_pkt1[] = {
0x60,0x00,0x00,0x00,0x00,0x20,0x00,0x01,0xfe,0x80,0x00,0x00,0x00,0x00,0x00,0x00,
0x02,0x0f,0xfe,0xff,0xfe,0x98,0x3d,0x01,0xff,0x02,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x3a,0x00,0x05,0x02,0x00,0x00,0x00,0x00,
0x82,0x00,0x1c,0x6f,0x27,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
};
Packet *p1 = PacketGetFromAlloc();
if (unlikely(p1 == NULL))
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
int result = 0;
PacketQueue pq;
FlowInitConfig(FLOW_QUIET);
memset(&pq, 0, sizeof(PacketQueue));
memset(&tv, 0, sizeof(ThreadVars));
memset(&dtv, 0, sizeof(DecodeThreadVars));
PacketCopyData(p1, raw_pkt1, sizeof(raw_pkt1));
DecodeIPV6(&tv, &dtv, p1, GET_PKT_DATA(p1), GET_PKT_LEN(p1), &pq);
if (!(IPV6_EXTHDR_ISSET_HH(p1))) {
printf("ipv6 routing header not detected: ");
goto end;
}
if (p1->ip6eh.ip6_exthdrs[0].len != 8) {
printf("ipv6 routing length incorrect: ");
goto end;
}
if (ENGINE_ISSET_EVENT(p1, IPV6_HOPOPTS_UNKNOWN_OPT)) {
printf("engine event IPV6_HOPOPTS_UNKNOWN_OPT set: ");
goto end;
}
result = 1;
end:
PACKET_RECYCLE(p1);
SCFree(p1);
FlowShutdown();
return result;
}
static int ICMPV4InvalidType07(void)
{
uint8_t raw_icmpv4[] = {
0xff, 0x00, 0xab, 0x9b, 0x7f, 0x2b, 0x05, 0x2c,
0x3f, 0x72, 0x93, 0x4a, 0x00, 0x4d, 0x0a, 0x00,
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x38};
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (unlikely(p == NULL))
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
int ret = 0;
IPV4Hdr ip4h;
memset(&ip4h, 0, sizeof(IPV4Hdr));
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
memset(&dtv, 0, sizeof(DecodeThreadVars));
FlowInitConfig(FLOW_QUIET);
p->src.family = AF_INET;
p->dst.family = AF_INET;
p->src.addr_data32[0] = UTHSetIPv4Address("4.3.2.1");;
p->dst.addr_data32[0] = UTHSetIPv4Address("1.2.3.4");;
ip4h.s_ip_src.s_addr = p->src.addr_data32[0];
ip4h.s_ip_dst.s_addr = p->dst.addr_data32[0];
p->ip4h = &ip4h;
DecodeICMPV4(&tv, &dtv, p, raw_icmpv4, sizeof(raw_icmpv4), NULL);
if(ENGINE_ISSET_EVENT(p,ICMPV4_UNKNOWN_TYPE)) {
ret = 1;
}
FlowShutdown();
SCFree(p);
return ret;
}
/**\test icmpv6 message type: destination unreach, invalid packet
* \brief The embedded packet header (ipv6) is truncated
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6DestUnreachTest02(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x2d, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x01, 0x00, 0x7b, 0x85, 0x00, 0x00, 0x00, 0x00,
0x60, 0x4b, 0xe8, 0xbd, 0x00, 0x00, 0x3b, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00 };
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (!ENGINE_ISSET_EVENT(p, ICMPV6_IPV6_TRUNC_PKT)) {
SCLogDebug("ICMPv6 Error: embedded ipv6 truncated packet event not set");
retval = 0;
goto end;
}
retval = 1;
end:
SCFree(p);
return retval;
}
/** DecodeRawtest03
* \brief Valid Raw packet
* \retval 0 Expected test value
*/
static int DecodeRawTest03 (void) {
/* IPV13 */
uint8_t raw_ip[] = {
0xdf, 0x00, 0x00, 0x3d, 0x49, 0x42, 0x40, 0x00,
0x40, 0x06, 0xcf, 0x8a, 0x0a, 0x1f, 0x03, 0xaf,
0x0a, 0x1f, 0x0a, 0x02, 0xa5, 0xe7, 0xde, 0xad,
0x00, 0x0c, 0xe2, 0x0e, 0x8b, 0xfe, 0x0c, 0xe7,
0x80, 0x18, 0x00, 0xb7, 0xaf, 0xeb, 0x00, 0x00,
0x01, 0x01, 0x08, 0x0a, 0x00, 0x08, 0xab, 0x4f,
0x34, 0x40, 0x67, 0x31, 0x3b, 0x63, 0x61, 0x74,
0x20, 0x6b, 0x65, 0x79, 0x3b };
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (unlikely(p == NULL))
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
if (PacketCopyData(p, raw_ip, sizeof(raw_ip)) == -1) {
SCFree(p);
return 1;
}
FlowInitConfig(FLOW_QUIET);
DecodeRaw(&tv, &dtv, p, raw_ip, GET_PKT_LEN(p), NULL);
if (ENGINE_ISSET_EVENT(p,IPRAW_INVALID_IPV)) {
FlowShutdown();
SCFree(p);
return 0;
} else {
printf("expected IPRAW_INVALID_IPV to be set but it wasn't: ");
}
FlowShutdown();
SCFree(p);
return 1;
}
static int DecodeMPLSTestUnknownPayloadType(void)
{
int ret = 1;
/* Valid label: 21.
* Unknown payload type: 1.
*/
uint8_t pkt[] = {
0x00, 0x01, 0x51, 0xff, 0x15, 0x00, 0x00, 0x64,
0x00, 0x0a, 0x00, 0x00, 0xff, 0x01, 0xa5, 0x6a,
0x0a, 0x01, 0x02, 0x01, 0x0a, 0x22, 0x00, 0x01,
0x08, 0x00, 0x3a, 0x77, 0x0a, 0x39, 0x06, 0x2b,
0x00, 0x00, 0x00, 0x00, 0x00, 0x1f, 0x33, 0x50,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd
};
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (unlikely(p == NULL)) {
return 0;
}
ThreadVars tv;
DecodeThreadVars dtv;
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
DecodeMPLS(&tv, &dtv, p, pkt, sizeof(pkt), NULL);
if (!ENGINE_ISSET_EVENT(p, MPLS_UNKNOWN_PAYLOAD_TYPE)) {
ret = 0;
}
SCFree(p);
return ret;
}
/** \test icmpv6 message type: time exceed, invalid packet
* \brief set the event ICMPV6_PKT_TOO_SMALL properly
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6TimeExceedTest02(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x03, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x02, 0x10, 0x5c };
/* The icmpv6 header is broken in the checksum (so we dont have a complete header) */
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (!ENGINE_ISSET_EVENT(p, ICMPV6_PKT_TOO_SMALL)) {
SCLogDebug("ICMPv6 Error: event packet too small not set");
retval = 0;
goto end;
}
retval = 1;
end:
SCFree(p);
return retval;
}
/**
* \test DecodeVLANTest01 test if vlan header is too small.
*
* \retval 1 on success
* \retval 0 on failure
*/
static int DecodeVLANtest01 (void) {
uint8_t raw_vlan[] = { 0x00, 0x20, 0x08 };
Packet *p = PacketGetFromAlloc();
if (unlikely(p == NULL))
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodeVLAN(&tv, &dtv, p, raw_vlan, sizeof(raw_vlan), NULL);
if(ENGINE_ISSET_EVENT(p,VLAN_HEADER_TOO_SMALL)) {
SCFree(p);
return 1;
}
SCFree(p);
return 0;
}
/**\test icmpv6 message type: echo request, invalid packet
* \brief unknown code
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6EchoReqTest02(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a,
0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x80, 0x01,
0xe5, 0xa5, 0x25, 0xf0, 0x75, 0x23 };
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (!ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE)) {
SCLogDebug("ICMPv6 Error: Unknown code event not set");
retval = 0;
goto end;
}
retval = 1;
end:
SCFree(p);
return retval;
}
static int DecodeMPLSTestBadLabelReserved(void)
{
int ret = 1;
uint8_t pkt[] = {
0x00, 0x00, 0x51, 0xff, 0x45, 0x00, 0x00, 0x64,
0x00, 0x0a, 0x00, 0x00, 0xff, 0x01, 0xa5, 0x6a,
0x0a, 0x01, 0x02, 0x01, 0x0a, 0x22, 0x00, 0x01,
0x08, 0x00, 0x3a, 0x77, 0x0a, 0x39, 0x06, 0x2b,
0x00, 0x00, 0x00, 0x00, 0x00, 0x1f, 0x33, 0x50,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd,
0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd
};
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (unlikely(p == NULL)) {
return 0;
}
ThreadVars tv;
DecodeThreadVars dtv;
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
DecodeMPLS(&tv, &dtv, p, pkt, sizeof(pkt), NULL);
if (!ENGINE_ISSET_EVENT(p, MPLS_BAD_LABEL_RESERVED)) {
ret = 0;
}
SCFree(p);
return ret;
}
/* DecodePPPtest01
* Decode malformed ip layer PPP packet
* Expected test value: 1
*/
static int DecodePPPtest01 (void) {
uint8_t raw_ppp[] = { 0xff, 0x03, 0x00, 0x21, 0x45, 0xc0, 0x00 };
Packet *p = PacketGetFromAlloc();
if (unlikely(p == NULL))
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodePPP(&tv, &dtv, p, raw_ppp, sizeof(raw_ppp), NULL);
/* Function my returns here with expected value */
if(ENGINE_ISSET_EVENT(p,PPPIPV4_PKT_TOO_SMALL)) {
SCFree(p);
return 1;
}
SCFree(p);
return 0;
}
static int DecodeGREtest01 (void)
{
uint8_t raw_gre[] = { 0x00 ,0x6e ,0x62 };
Packet *p = PacketGetFromAlloc();
if (unlikely(p == NULL))
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodeGRE(&tv, &dtv, p, raw_gre, sizeof(raw_gre), NULL);
if(ENGINE_ISSET_EVENT(p,GRE_PKT_TOO_SMALL)) {
SCFree(p);
return 1;
}
SCFree(p);
return 0;
}
static int DecodeGREtest02 (void) {
uint8_t raw_gre[] = {
0x00, 0x6e, 0x62, 0xac, 0x40, 0x00, 0x40, 0x2f,
0xc2, 0xc7, 0x0a, 0x00, 0x00, 0x64, 0x0a, 0x00,
0x00, 0x8a, 0x30, 0x01, 0x0b, 0x00, 0x4e, 0x00,
0x00, 0x00, 0x18, 0x4a, 0x50, 0xff, 0x03, 0x00,
0x21, 0x45, 0x00, 0x00, 0x4a, 0x00, 0x00, 0x40,
0x00, 0x40, 0x11, 0x94, 0x22, 0x50, 0x7e, 0x2b,
0x2d, 0xc2, 0x6d, 0x68, 0x68, 0x80, 0x0e, 0x00,
0x35, 0x00, 0x36, 0x9f, 0x18, 0xdb, 0xc4, 0x01,
0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
0x01, 0x03, 0x73, 0x31, 0x36, 0x09, 0x73, 0x69,
0x74, 0x65, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x03,
0x63, 0x6f, 0x6d, 0x00, 0x00, 0x01, 0x00, 0x01,
0x00, 0x00, 0x29, 0x10, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00 };
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodeGRE(&tv, &dtv, p, raw_gre, sizeof(raw_gre), NULL);
if(ENGINE_ISSET_EVENT(p,GRE_WRONG_VERSION)) {
SCFree(p);
return 1;
}
SCFree(p);
return 0;
}
static int DecodeGREtest01 (void) {
uint8_t raw_gre[] = { 0x00 ,0x6e ,0x62 };
Packet *p = SCMalloc(SIZE_OF_PACKET);
if (p == NULL)
return 0;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(p, 0, SIZE_OF_PACKET);
p->pkt = (uint8_t *)(p + 1);
memset(&dtv, 0, sizeof(DecodeThreadVars));
DecodeGRE(&tv, &dtv, p, raw_gre, sizeof(raw_gre), NULL);
if(ENGINE_ISSET_EVENT(p,GRE_PKT_TOO_SMALL)) {
SCFree(p);
return 1;
}
SCFree(p);
return 0;
}
/**
* \brief Decode ICMPV6 packets and fill the Packet with the decoded info
*
* \param tv Pointer to the thread variables
* \param dtv Pointer to the decode thread variables
* \param p Pointer to the packet we are filling
* \param pkt Pointer to the raw packet buffer
* \param len the len of the rest of the packet not processed yet
* \param pq the packet queue were this packet go
*
* \retval void No return value
*/
void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
uint8_t *pkt, uint16_t len, PacketQueue *pq)
{
int error_msg = 0;
SCPerfCounterIncr(dtv->counter_icmpv6, tv->sc_perf_pca);
if (len < ICMPV6_HEADER_LEN) {
SCLogDebug("ICMPV6_PKT_TOO_SMALL");
ENGINE_SET_EVENT(p, ICMPV6_PKT_TOO_SMALL);
return;
}
p->icmpv6h = (ICMPV6Hdr *)pkt;
p->proto = IPPROTO_ICMPV6;
p->type = p->icmpv6h->type;
p->code = p->icmpv6h->code;
p->payload_len = len - ICMPV6_HEADER_LEN;
p->payload = pkt + ICMPV6_HEADER_LEN;
SCLogDebug("ICMPV6 TYPE %" PRIu32 " CODE %" PRIu32 "", p->icmpv6h->type,
p->icmpv6h->code);
switch (ICMPV6_GET_TYPE(p)) {
case ICMP6_DST_UNREACH:
SCLogDebug("ICMP6_DST_UNREACH");
if (ICMPV6_GET_CODE(p) > ICMP6_DST_UNREACH_REJECTROUTE) {
ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
}
error_msg = 1;
break;
case ICMP6_PACKET_TOO_BIG:
SCLogDebug("ICMP6_PACKET_TOO_BIG");
if (ICMPV6_GET_CODE(p) != 0) {
ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.mtu = ICMPV6_GET_MTU(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
}
error_msg = 1;
break;
case ICMP6_TIME_EXCEEDED:
SCLogDebug("ICMP6_TIME_EXCEEDED");
if (ICMPV6_GET_CODE(p) > ICMP6_TIME_EXCEED_REASSEMBLY) {
ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
}
error_msg = 1;
break;
case ICMP6_PARAM_PROB:
SCLogDebug("ICMP6_PARAM_PROB");
if (ICMPV6_GET_CODE(p) > ICMP6_PARAMPROB_OPTION) {
ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.error_ptr= ICMPV6_GET_ERROR_PTR(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
}
error_msg = 1;
break;
case ICMP6_ECHO_REQUEST:
SCLogDebug("ICMP6_ECHO_REQUEST id: %u seq: %u",
p->icmpv6h->icmpv6b.icmpv6i.id, p->icmpv6h->icmpv6b.icmpv6i.seq);
if (ICMPV6_GET_CODE(p) != 0) {
ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.id = p->icmpv6h->icmpv6b.icmpv6i.id;
p->icmpv6vars.seq = p->icmpv6h->icmpv6b.icmpv6i.seq;
}
break;
case ICMP6_ECHO_REPLY:
SCLogDebug("ICMP6_ECHO_REPLY id: %u seq: %u",
p->icmpv6h->icmpv6b.icmpv6i.id, p->icmpv6h->icmpv6b.icmpv6i.seq);
if (p->icmpv6h->code != 0) {
ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.id = p->icmpv6h->icmpv6b.icmpv6i.id;
p->icmpv6vars.seq = p->icmpv6h->icmpv6b.icmpv6i.seq;
}
break;
default:
SCLogDebug("ICMPV6 Message type %" PRIu8 " not "
"implemented yet", ICMPV6_GET_TYPE(p));
ENGINE_SET_EVENT(p, ICMPV6_UNKNOWN_TYPE);
}
/* for a info message the header is just 4 bytes */
if (!error_msg) {
if (p->payload_len >= 4) {
p->payload_len -= 4;
p->payload = pkt + 4;
} else {
p->payload_len = 0;
p->payload = NULL;
}
}
#ifdef DEBUG
if (ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE))
SCLogDebug("Unknown Code, ICMPV6_UNKNOWN_CODE");
if (ENGINE_ISSET_EVENT(p, ICMPV6_UNKNOWN_TYPE))
SCLogDebug("Unknown Type, ICMPV6_UNKNOWN_TYPE");
#endif
/* Flow is an integral part of us */
FlowHandlePacket(tv, p);
return;
}
