aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ICMPv6 Decoder and unittests

Browse Source
remotes/origin/master-1.0.x
Pablo Rincon 17 years ago committed by Victor Julien
parent 7fb28ce5b6
commit 292a7e47ef
5 changed files with 1021 additions and 62 deletions
Show Stats Download Patch File Download Diff File

7
src/decode-events.h
Unescape Escape View File

@ -24,6 +24,13 @@ enum {
ICMPV4_UNKNOWN_TYPE,
ICMPV4_UNKNOWN_CODE,
/* ICMPv6 EVENTS */
ICMPV6_UNKNOWN_TYPE,
ICMPV6_UNKNOWN_CODE,
ICMPV6_PKT_TOO_SMALL,
ICMPV6_IPV6_UNKNOWN_VER,
ICMPV6_IPV6_TRUNC_PKT,
/* IPV6 EVENTS */
IPV6_PKT_TOO_SMALL,
IPV6_TRUNC_PKT,

912
src/decode-icmpv6.c
Unescape Escape View File

@ -1,9 +1,13 @@
/* Copyright (c) 2008 Victor Julien <victor@inliniac.net> */
#include "eidps-common.h"
#include "decode.h"
#include "decode-icmpv6.h"
#include "decode.h"
#include "decode-tcp.h"
#include "decode-udp.h"
#include "decode-events.h"
#include "util-unittest.h"
#include "flow.h"
#include "util-debug.h"
/**
@ -77,20 +81,238 @@ inline uint16_t ICMPV6CalculateChecksum(uint16_t *shdr, uint16_t *pkt,
return (uint16_t) ~csum;
}
void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, uint8_t *pkt, uint16_t len, PacketQueue *pq)
/**
* \brief Get variables and do some checks of the embedded IPV6 packet
*
* \param p Pointer to the packet we are filling
* \param partial_packet Pointer to the raw packet buffer
* \param len the len of the rest of the packet not processed yet
*
* \retval void No return value
*/
void DecodePartialIPV6(Packet *p, uint8_t *partial_packet, uint16_t len )
{
/** Check the sizes, the header must fit at least */
if (len < IPV6_HEADER_LEN) {
SCLogDebug("DecodePartialIPV6: ICMPV6_IPV6_TRUNC_PKT");
DECODER_SET_EVENT(p, ICMPV6_IPV6_TRUNC_PKT);
return;
}
IPV6Hdr *icmp6_ip6h = (IPV6Hdr*)partial_packet;
/** Check the embedded version */
if(((icmp6_ip6h->s_ip6_vfc & 0xf0) >> 4) != 6)
/** Check the embedded version */
{
SCLogDebug("DecodePartialIPV6: ICMPv6 contains Unknown IPV6 version "
"ICMPV6_IPV6_UNKNOWN_VER");
DECODER_SET_EVENT(p, ICMPV6_IPV6_UNKNOWN_VER);
return;
}
/** We need to fill icmpv6vars */
p->icmpv6vars.emb_ipv6h = icmp6_ip6h;
/** Get the IP6 address */
p->icmpv6vars.emb_ip6_src[0] = icmp6_ip6h->ip6_src[0];
p->icmpv6vars.emb_ip6_src[1] = icmp6_ip6h->ip6_src[1];
p->icmpv6vars.emb_ip6_src[2] = icmp6_ip6h->ip6_src[2];
p->icmpv6vars.emb_ip6_src[3] = icmp6_ip6h->ip6_src[3];
p->icmpv6vars.emb_ip6_dst[0] = icmp6_ip6h->ip6_dst[0];
p->icmpv6vars.emb_ip6_dst[1] = icmp6_ip6h->ip6_dst[1];
p->icmpv6vars.emb_ip6_dst[2] = icmp6_ip6h->ip6_dst[2];
p->icmpv6vars.emb_ip6_dst[3] = icmp6_ip6h->ip6_dst[3];
/** Get protocol and ports inside the embedded ipv6 packet and set the pointers */
p->icmpv6vars.emb_ip6_proto_next = icmp6_ip6h->s_ip6_nxt;
switch (icmp6_ip6h->s_ip6_nxt) {
case IPPROTO_TCP:
if (len >= IPV6_HEADER_LEN + TCP_HEADER_LEN ) {
p->icmpv6vars.emb_tcph = (TCPHdr*)(partial_packet + IPV6_HEADER_LEN);
p->icmpv6vars.emb_sport = p->icmpv6vars.emb_tcph->th_sport;
p->icmpv6vars.emb_dport = p->icmpv6vars.emb_tcph->th_dport;
SCLogDebug("DecodePartialIPV6: ICMPV6->IPV6->TCP header sport: "
"%"PRIu8" dport %"PRIu8"", p->icmpv6vars.emb_sport,
p->icmpv6vars.emb_dport);
} else {
SCLogDebug("DecodePartialIPV6: Warning, ICMPV6->IPV6->TCP "
"header Didn't fit in the packet!");
p->icmpv6vars.emb_sport = 0;
p->icmpv6vars.emb_dport = 0;
}
break;
case IPPROTO_UDP:
if (len >= IPV6_HEADER_LEN + UDP_HEADER_LEN ) {
p->icmpv6vars.emb_udph = (UDPHdr*)(partial_packet + IPV6_HEADER_LEN);
p->icmpv6vars.emb_sport = p->icmpv6vars.emb_udph->uh_sport;
p->icmpv6vars.emb_dport = p->icmpv6vars.emb_udph->uh_dport;
SCLogDebug("DecodePartialIPV6: ICMPV6->IPV6->UDP header sport: "
"%"PRIu8" dport %"PRIu8"", p->icmpv6vars.emb_sport,
p->icmpv6vars.emb_dport);
} else {
SCLogDebug("DecodePartialIPV6: Warning, ICMPV6->IPV6->UDP "
"header Didn't fit in the packet!");
p->icmpv6vars.emb_sport = 0;
p->icmpv6vars.emb_dport = 0;
}
break;
case IPPROTO_ICMPV6:
p->icmpv6vars.emb_icmpv6h = (ICMPV6Hdr*)(partial_packet + IPV6_HEADER_LEN);
p->icmpv6vars.emb_sport = 0;
p->icmpv6vars.emb_dport = 0;
SCLogDebug("DecodePartialIPV6: ICMPV6->IPV6->ICMP header");
break;
}
/* debug print */
#ifdef DEBUG
char s[46], d[46];
inet_ntop(AF_INET6, (const void *)p->icmpv6vars.emb_ip6_src, s, sizeof(s));
inet_ntop(AF_INET6, (const void *)p->icmpv6vars.emb_ip6_dst, d, sizeof(d));
SCLogDebug("ICMPv6 embedding IPV6 %s->%s - CLASS: %" PRIu32 " FLOW: "
"%" PRIu32 " NH: %" PRIu32 " PLEN: %" PRIu32 " HLIM: %" PRIu32,
s, d, IPV6_GET_RAW_CLASS(icmp6_ip6h), IPV6_GET_RAW_FLOW(icmp6_ip6h),
IPV6_GET_RAW_NH(icmp6_ip6h), IPV6_GET_RAW_PLEN(icmp6_ip6h), IPV6_GET_RAW_HLIM(icmp6_ip6h));
#endif
return;
}
/**
* \brief Decode ICMPV6 packets and fill the Packet with the decoded info
*
* \param tv Pointer to the thread variables
* \param dtv Pointer to the decode thread variables
* \param p Pointer to the packet we are filling
* \param pkt Pointer to the raw packet buffer
* \param len the len of the rest of the packet not processed yet
* \param pq the packet queue were this packet go
*
* \retval void No return value
*/
void DecodeICMPV6(ThreadVars *tv, DecodeThreadVars *dtv, Packet *p,
uint8_t *pkt, uint16_t len, PacketQueue *pq)
{
PerfCounterIncr(dtv->counter_icmpv6, tv->pca);
if (len < ICMPV6_HEADER_LEN) {
/** \todo decode event */
SCLogDebug("DecodeICMPV6: ICMPV6_PKT_TOO_SMALL");
DECODER_SET_EVENT(p, ICMPV6_PKT_TOO_SMALL);
return;
}
p->icmpv6h = (ICMPV6Hdr *)pkt;
p->proto = IPPROTO_ICMPV6;
SCLogDebug("ICMPV6 TYPE %" PRIu32 " CODE %" PRIu32 "", p->icmpv6h->type, p->icmpv6h->code);
SCLogDebug("ICMPV6 TYPE %" PRIu32 " CODE %" PRIu32 "", p->icmpv6h->type,
p->icmpv6h->code);
switch (ICMPV6_GET_TYPE(p)) {
case ICMP6_DST_UNREACH:
SCLogDebug("DecodeICMPV6: ICMP6_DST_UNREACH");
if (ICMPV6_GET_CODE(p) > ICMP6_DST_UNREACH_REJECTROUTE) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code = ICMPV6_GET_CODE(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
}
break;
case ICMP6_PACKET_TOO_BIG:
SCLogDebug("DecodeICMPV6: ICMP6_PACKET_TOO_BIG");
if (ICMPV6_GET_CODE(p) != 0) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code = ICMPV6_GET_CODE(p);
p->icmpv6vars.mtu = ICMPV6_GET_MTU(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
}
break;
case ICMP6_TIME_EXCEEDED:
SCLogDebug("DecodeICMPV6: ICMP6_TIME_EXCEEDED");
if (ICMPV6_GET_CODE(p) > ICMP6_TIME_EXCEED_REASSEMBLY) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code= ICMPV6_GET_CODE(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
}
break;
case ICMP6_PARAM_PROB:
SCLogDebug("DecodeICMPV6: ICMP6_PARAM_PROB");
if (ICMPV6_GET_CODE(p) > ICMP6_PARAMPROB_OPTION) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code= ICMPV6_GET_CODE(p);
p->icmpv6vars.error_ptr= ICMPV6_GET_ERROR_PTR(p);
DecodePartialIPV6(p, (uint8_t*) (pkt + ICMPV6_HEADER_LEN),
len - ICMPV6_HEADER_LEN );
}
break;
case ICMP6_ECHO_REQUEST:
SCLogDebug("DecodeICMPV6: ICMP6_ECHO_REQUEST id: %u seq: %u",
ICMPV6_GET_ID(p), ICMPV6_GET_SEQ(p));
if (ICMPV6_GET_CODE(p) != 0) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code= ICMPV6_GET_CODE(p);
p->icmpv6vars.id = ICMPV6_GET_ID(p);
p->icmpv6vars.seq = ICMPV6_GET_SEQ(p);
}
break;
case ICMP6_ECHO_REPLY:
SCLogDebug("DecodeICMPV6: ICMP6_ECHO_REPLY id: %u seq: %u",
ICMPV6_GET_ID(p), ICMPV6_GET_SEQ(p));
if (p->icmpv6h->code != 0) {
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_CODE);
} else {
p->icmpv6vars.type = ICMPV6_GET_TYPE(p);
p->icmpv6vars.code= ICMPV6_GET_CODE(p);
p->icmpv6vars.id = ICMPV6_GET_ID(p);
p->icmpv6vars.seq = ICMPV6_GET_SEQ(p);
}
break;
default:
SCLogDebug("DecodeICMPV6: ICMPV6 Message type %" PRIu8 " not "
"implemented yet", ICMPV6_GET_TYPE(p));
DECODER_SET_EVENT(p, ICMPV6_UNKNOWN_TYPE);
}
if (DECODER_ISSET_EVENT(p, ICMPV6_UNKNOWN_CODE))
SCLogDebug("DecodeICMPV6: Unknown Code, ICMPV6_UNKNOWN_CODE");
if (DECODER_ISSET_EVENT(p, ICMPV6_UNKNOWN_TYPE))
SCLogDebug("DecodeICMPV6: Unknown Type, ICMPV6_UNKNOWN_TYPE");
p->proto = IPPROTO_ICMPV6;
return;
}
@ -149,8 +371,666 @@ static int ICMPV6CalculateInvalidChecksumtest02(void) {
return (csum == ICMPV6CalculateChecksum((uint16_t *)(raw_ipv6 + 14 + 8),
(uint16_t *)(raw_ipv6 + 54), 68));
}
#endif /* UNITTESTS */
/** \test icmpv6 message type: parameter problem, valid packet
*
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6ParamProbTest01(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x38, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x04, 0x00, 0xcc, 0x2a, 0x6d, 0x93, 0x0b, 0xdf,
0x69, 0x70, 0x12, 0xb7, 0x00, 0x08, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x80, 0x00, 0x08, 0xb5, 0x99, 0xc3, 0xde, 0x40 };
Packet p;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
uint32_t *ipv6src;
uint32_t *ipv6dst;
ipv6src = (uint32_t*) &raw_ipv6[8];
ipv6dst = (uint32_t*) &raw_ipv6[24];
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, &p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (p.icmpv6h == NULL) {
SCLogDebug("ICMPv6 Unable to detect icmpv6 layer from ipv6");
retval = 0;
goto end;
}
if (ICMPV6_GET_TYPE(&p) != 4 || ICMPV6_GET_CODE(&p) != 0 ||
ICMPV6_GET_EMB_PROTO(&p) != IPPROTO_ICMPV6) {
SCLogDebug("ICMPv6 not processed at all");
retval = 0;
goto end;
}
/* Let's check if we retrieved the embedded ipv6 addresses correctly */
uint32_t i=0;
for (i = 0; i < 4; i++) {
if (p.icmpv6vars.emb_ip6_src[i] != ipv6src[i] ||
p.icmpv6vars.emb_ip6_dst[i] != ipv6dst[i]) {
SCLogDebug("ICMPv6 DecodePartialICMPV6 (Embedded ip6h) didn't set "
"the src and dest ip addresses correctly");
retval = 0;
goto end;
}
}
retval = 1;
end:
return retval;
}
/** \test icmpv6 message type: packet too big, valid packet
*
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6PktTooBigTest01(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x30, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x02, 0x00, 0x5c, 0x7a, 0x00, 0x00, 0x05, 0x00,
0x64, 0x14, 0xfd, 0xff, 0x00, 0x00, 0x3b, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 };
Packet p;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
uint32_t *ipv6src;
uint32_t *ipv6dst;
ipv6src = (uint32_t*) &raw_ipv6[8];
ipv6dst = (uint32_t*) &raw_ipv6[24];
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, &p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (p.icmpv6h == NULL) {
SCLogDebug("ICMPv6 Unable to detect icmpv6 layer from ipv6");
retval = 0;
goto end;
}
/* Note: it has an embedded ipv6 packet but no protocol after ipv6 (IPPROTO_NONE) */
if (ICMPV6_GET_TYPE(&p) != 2 || ICMPV6_GET_CODE(&p) != 0 ) {
SCLogDebug("ICMPv6 Not processed at all");
retval = 0;
goto end;
}
/* Let's check if we retrieved the embedded ipv6 addresses correctly */
uint32_t i=0;
for (i = 0; i < 4; i++) {
if (p.icmpv6vars.emb_ip6_src[i] != ipv6src[i] ||
p.icmpv6vars.emb_ip6_dst[i] != ipv6dst[i]) {
SCLogDebug("ICMPv6 DecodePartialICMPV6 (Embedded ip6h) didn't set "
"the src and dest ip addresses correctly");
retval = 0;
goto end;
}
}
SCLogDebug("ICMPV6 IPV6 src and dst properly set");
retval = 1;
end:
return retval;
}
/** \test icmpv6 message type: time exceed, valid packet
*
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6TimeExceedTest01(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x30, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x03, 0x00, 0x56, 0x2d, 0x00, 0x00, 0x00, 0x00,
0x6d, 0x23, 0xff, 0x3d, 0x00, 0x00, 0x3b, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 };
Packet p;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
uint32_t *ipv6src;
uint32_t *ipv6dst;
ipv6src = (uint32_t*) &raw_ipv6[8];
ipv6dst = (uint32_t*) &raw_ipv6[24];
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, &p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (p.icmpv6h == NULL) {
SCLogDebug("ICMPv6 Unable to detect icmpv6 layer from ipv6");
retval = 0;
goto end;
}
/* Note: it has an embedded ipv6 packet but no protocol after ipv6 (IPPROTO_NONE) */
if (ICMPV6_GET_TYPE(&p) != 3 || ICMPV6_GET_CODE(&p) != 0 ||
ICMPV6_GET_EMB_IPV6(&p)==NULL || ICMPV6_GET_EMB_PROTO(&p) != IPPROTO_NONE ) {
SCLogDebug("ICMPv6 Not processed at all");
retval = 0;
goto end;
}
/* Let's check if we retrieved the embedded ipv6 addresses correctly */
uint32_t i=0;
for (i = 0; i < 4; i++) {
if (p.icmpv6vars.emb_ip6_src[i] != ipv6src[i] ||
p.icmpv6vars.emb_ip6_dst[i] != ipv6dst[i]) {
SCLogDebug("ICMPv6 DecodePartialICMPV6 (Embedded ip6h) didn't set "
"the src and dest ip addresses correctly");
retval = 0;
goto end;
}
}
SCLogDebug("ICMPV6 IPV6 src and dst properly set");
retval = 1;
end:
return retval;
}
/** \test icmpv6 message type: destination unreach, valid packet
*
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6DestUnreachTest01(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x30, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x01, 0x00, 0x7b, 0x85, 0x00, 0x00, 0x00, 0x00,
0x60, 0x4b, 0xe8, 0xbd, 0x00, 0x00, 0x3b, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 };
Packet p;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
uint32_t *ipv6src;
uint32_t *ipv6dst;
ipv6src = (uint32_t*) &raw_ipv6[8];
ipv6dst = (uint32_t*) &raw_ipv6[24];
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, &p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (p.icmpv6h == NULL) {
SCLogDebug("ICMPv6 Unable to detect icmpv6 layer from ipv6");
retval = 0;
goto end;
}
/* Note: it has an embedded ipv6 packet but no protocol after ipv6 (IPPROTO_NONE) */
if (ICMPV6_GET_TYPE(&p) != 1 || ICMPV6_GET_CODE(&p) != 0 ||
ICMPV6_GET_EMB_IPV6(&p) == NULL || ICMPV6_GET_EMB_PROTO(&p) != IPPROTO_NONE ) {
SCLogDebug("ICMPv6 Not processed at all");
retval = 0;
goto end;
}
/* Let's check if we retrieved the embedded ipv6 addresses correctly */
uint32_t i=0;
for (i = 0; i < 4; i++) {
if (p.icmpv6vars.emb_ip6_src[i] != ipv6src[i] ||
p.icmpv6vars.emb_ip6_dst[i] != ipv6dst[i]) {
SCLogDebug("ICMPv6 DecodePartialICMPV6 (Embedded ip6h) didn't set "
"the src and dest ip addresses correctly");
retval = 0;
goto end;
}
}
retval = 1;
end:
return retval;
}
/**\test icmpv6 message type: echo request, valid packet
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6EchoReqTest01(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x80, 0x00, 0xe5, 0xa5, 0x25, 0xf0, 0x75, 0x23 };
Packet p;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, &p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (p.icmpv6h == NULL) {
SCLogDebug("ICMPv6 Unable to detect icmpv6 layer from ipv6");
retval = 0;
goto end;
}
SCLogDebug("ID: %u seq: %u", ICMPV6_GET_ID(&p), ICMPV6_GET_SEQ(&p));
if (ICMPV6_GET_TYPE(&p) != 128 || ICMPV6_GET_CODE(&p) != 0 ||
ICMPV6_GET_ID(&p) != 61477 || ICMPV6_GET_SEQ(&p) != 9077) {
SCLogDebug("ICMPv6 Echo request decode failed");
retval = 0;
goto end;
}
retval = 1;
end:
return retval;
}
/**\test icmpv6 message type: echo reply, valid packet
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6EchoRepTest01(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a,
0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x81, 0x00,
0xe5, 0xa5, 0x25, 0xf0, 0x75, 0x23 };
Packet p;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, &p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (p.icmpv6h == NULL) {
SCLogDebug("ICMPv6 Unable to detect icmpv6 layer from ipv6");
retval = 0;
goto end;
}
SCLogDebug("type: %u code %u ID: %u seq: %u", ICMPV6_GET_TYPE(&p),
ICMPV6_GET_CODE(&p),ICMPV6_GET_ID(&p), ICMPV6_GET_SEQ(&p));
if (ICMPV6_GET_TYPE(&p) != 129 || ICMPV6_GET_CODE(&p) != 0 ||
ICMPV6_GET_ID(&p) != 61477 || ICMPV6_GET_SEQ(&p) != 9077) {
SCLogDebug("ICMPv6 Echo reply decode failed");
retval = 0;
goto end;
}
retval = 1;
end:
return retval;
}
/** \test icmpv6 message type: parameter problem, invalid packet
* \brief set the event ICMPV6_IPV6_UNKNOWN_VER properly when the embedded packet has an unknown version
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6ParamProbTest02(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x38, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x04, 0x00, 0xcc, 0x2a, 0x6d, 0x93, 0x0b, 0xdf,
0x38, 0x70, 0x12, 0xb7, 0x00, 0x08, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x80, 0x00, 0x08, 0xb5, 0x99, 0xc3, 0xde, 0x40 };
Packet p;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, &p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (p.icmpv6h == NULL) {
SCLogDebug("ICMPv6 Unable to detect icmpv6 layer from ipv6");
retval = 0;
goto end;
}
if (ICMPV6_GET_TYPE(&p) != 4 || ICMPV6_GET_CODE(&p) != 0) {
SCLogDebug("ICMPv6 Not processed at all");
retval = 0;
goto end;
}
if (!DECODER_ISSET_EVENT(&p, ICMPV6_IPV6_UNKNOWN_VER)) {
SCLogDebug("ICMPv6 Error: Unknown embedded ipv6 version event not set");
retval = 0;
goto end;
}
retval = 1;
end:
return retval;
}
/** \test icmpv6 message type: packet too big, invalid packet
* \brief Set the event ICMPV6_UNKNOWN_CODE if code is invalid for this type
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6PktTooBigTest02(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x30, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x02, 0x10, 0x5c, 0x7a, 0x00, 0x00, 0x05, 0x00,
0x64, 0x14, 0xfd, 0xff, 0x00, 0x00, 0x3b, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 };
Packet p;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, &p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (p.icmpv6h == NULL) {
SCLogDebug("ICMPv6 Unable to detect icmpv6 layer from ipv6");
retval = 0;
goto end;
}
if (!DECODER_ISSET_EVENT(&p, ICMPV6_UNKNOWN_CODE)) {
SCLogDebug("ICMPv6 Error: Unknown code event not set");
retval = 0;
goto end;
}
retval = 1;
end:
return retval;
}
/** \test icmpv6 message type: time exceed, invalid packet
* \brief set the event ICMPV6_PKT_TOO_SMALL properly
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6TimeExceedTest02(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x03, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x02, 0x10, 0x5c };
/* The icmpv6 header is broken in the checksum (so we dont have a complete header) */
Packet p;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, &p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (!DECODER_ISSET_EVENT(&p, ICMPV6_PKT_TOO_SMALL)) {
SCLogDebug("ICMPv6 Error: event packet too small not set");
retval = 0;
goto end;
}
retval = 1;
end:
return retval;
}
/**\test icmpv6 message type: destination unreach, invalid packet
* \brief The embedded packet header (ipv6) is truncated
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6DestUnreachTest02(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x2d, 0x3a, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x01, 0x00, 0x7b, 0x85, 0x00, 0x00, 0x00, 0x00,
0x60, 0x4b, 0xe8, 0xbd, 0x00, 0x00, 0x3b, 0xff,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xff, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00 };
Packet p;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, &p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (!DECODER_ISSET_EVENT(&p, ICMPV6_IPV6_TRUNC_PKT)) {
SCLogDebug("ICMPv6 Error: embedded ipv6 truncated packet event not set");
retval = 0;
goto end;
}
retval = 1;
end:
return retval;
}
/**\test icmpv6 message type: echo request, invalid packet
* \brief unknown code
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6EchoReqTest02(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a,
0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x80, 0x01,
0xe5, 0xa5, 0x25, 0xf0, 0x75, 0x23 };
Packet p;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, &p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (!DECODER_ISSET_EVENT(&p, ICMPV6_UNKNOWN_CODE)) {
SCLogDebug("ICMPv6 Error: Unknown code event not set");
retval = 0;
goto end;
}
retval = 1;
end:
return retval;
}
/**\test icmpv6 message type: echo reply, invalid packet
* \brief unknown code
* \retval retval 0 = Error ; 1 = ok
*/
static int ICMPV6EchoRepTest02(void)
{
int retval = 0;
static uint8_t raw_ipv6[] = {
0x60, 0x00, 0x00, 0x00, 0x00, 0x08, 0x3a,
0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0xff, 0x02, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x81, 0x01,
0xe5, 0xa5, 0x25, 0xf0, 0x75, 0x23 };
Packet p;
IPV6Hdr ip6h;
ThreadVars tv;
DecodeThreadVars dtv;
memset(&tv, 0, sizeof(ThreadVars));
memset(&p, 0, sizeof(Packet));
memset(&dtv, 0, sizeof(DecodeThreadVars));
memset(&ip6h, 0, sizeof(IPV6Hdr));
FlowInitConfig(FLOW_QUIET);
DecodeIPV6(&tv, &dtv, &p, raw_ipv6, sizeof(raw_ipv6), NULL);
FlowShutdown();
if (!DECODER_ISSET_EVENT(&p, ICMPV6_UNKNOWN_CODE)) {
SCLogDebug("ICMPv6 Error: Unknown code event not set");
retval = 0;
goto end;
}
retval = 1;
end:
return retval;
}
#endif /* UNITTESTS */
/**
* \brief Registers ICMPV6 unit tests
* \todo More ICMPv6 tests
@ -158,9 +1038,21 @@ static int ICMPV6CalculateInvalidChecksumtest02(void) {
void DecodeICMPV6RegisterTests(void)
{
#ifdef UNITTESTS
UtRegisterTest("ICMPV6CalculateValidChecksumtest01",
ICMPV6CalculateValidChecksumtest01, 1);
UtRegisterTest("ICMPV6CalculateInValidChecksumtest02",
ICMPV6CalculateInvalidChecksumtest02, 0);
UtRegisterTest("ICMPV6CalculateValidChecksumtest01", ICMPV6CalculateValidChecksumtest01, 1);
UtRegisterTest("ICMPV6CalculateInValidChecksumtest02", ICMPV6CalculateInvalidChecksumtest02, 0);
UtRegisterTest("ICMPV6ParamProbTest01 (Valid)", ICMPV6ParamProbTest01, 1);
UtRegisterTest("ICMPV6DestUnreachTest01 (Valid)", ICMPV6DestUnreachTest01, 1);
UtRegisterTest("ICMPV6PktTooBigTest01 (Valid)", ICMPV6PktTooBigTest01, 1);
UtRegisterTest("ICMPV6TimeExceedTest01 (Valid)", ICMPV6TimeExceedTest01, 1);
UtRegisterTest("ICMPV6EchoReqTest01 (Valid)", ICMPV6EchoReqTest01, 1);
UtRegisterTest("ICMPV6EchoRepTest01 (Valid)", ICMPV6EchoRepTest01, 1);
UtRegisterTest("ICMPV6ParamProbTest02 (Invalid)", ICMPV6ParamProbTest02, 1);
UtRegisterTest("ICMPV6DestUnreachTest02 (Invalid)", ICMPV6DestUnreachTest02, 1);
UtRegisterTest("ICMPV6PktTooBigTest02 (Invalid)", ICMPV6PktTooBigTest02, 1);
UtRegisterTest("ICMPV6TimeExceedTest02 (Invalid)", ICMPV6TimeExceedTest02, 1);
UtRegisterTest("ICMPV6EchoReqTest02 (Invalid)", ICMPV6EchoReqTest02, 1);
UtRegisterTest("ICMPV6EchoRepTest02 (Invalid)", ICMPV6EchoRepTest02, 1);
#endif /* UNITTESTS */
}

157
src/decode-icmpv6.h
Unescape Escape View File

@ -1,87 +1,140 @@
/* Copyright (c) 2008 Victor Julien <victor@inliniac.net> */
#include "decode-tcp.h"
#include "decode-udp.h"
#include "decode-ipv6.h"
#ifndef __DECODE_ICMPV6_H__
#define __DECODE_ICMPV6_H__
#define ICMPV6_HEADER_LEN 8
#define ICMPV6_HEADER_PKT_OFFSET 8
#ifndef ICMP6_DST_UNREACH
/** ICMPV6 Message Types: */
/** Error Messages: (type <128) */
#define ICMP6_DST_UNREACH 1
#endif
#ifndef ICMP6_PACKET_TOO_BIG
#define ICMP6_PACKET_TOO_BIG 2
#endif
#ifndef ICMP6_TIME_EXCEEDED
#define ICMP6_TIME_EXCEEDED 3
#endif
#ifndef ICMP6_PARAM_PROB
#define ICMP6_PARAM_PROB 4
#endif
#ifndef ICMP6_ECHO_REQUEST
/** Informational Messages (type>=128) */
#define ICMP6_ECHO_REQUEST 128
#endif
#ifndef ICMP6_ECHO_REPLY
#define ICMP6_ECHO_REPLY 129
#endif
#ifndef MLD_LISTENER_QUERY
#define MLD_LISTENER_QUERY 130
#endif
#ifndef MLD_LISTENER_REPORT
#define MLD_LISTENER_REPORT 131
#endif
#ifndef MLD_LISTENER_REDUCTION
#define MLD_LISTENER_REDUCTION 132
#endif
#ifndef ICMP6_DST_UNREACH_NOROUTE
#define ICMP6_DST_UNREACH_NOROUTE 0 /* no route to destination */
#endif
#ifndef ICMP6_DST_UNREACH_ADMIN
#define ICMP6_DST_UNREACH_ADMIN 1 /* communication with destination */
#endif /* administratively prohibited */
#ifndef ICMP6_DST_UNREACH_BEYONDSCOPE
#define ICMP6_DST_UNREACH_BEYONDSCOPE 2 /* beyond scope of source address */
#endif
#ifndef ICMP6_DST_UNREACH_ADDR
#define ICMP6_DST_UNREACH_ADDR 3 /* address unreachable */
#endif
#ifndef ICMP6_DST_UNREACH_NOPORT
#define ICMP6_DST_UNREACH_NOPORT 4 /* bad port */
#endif
#ifndef ICMP6_TIME_EXCEED_TRANSIT
/** Destination Unreachable Message (type=1) Code: */
#define ICMP6_DST_UNREACH_NOROUTE 0 /* no route to destination */
#define ICMP6_DST_UNREACH_ADMIN 1 /* communication with destination */
/* administratively prohibited */
#define ICMP6_DST_UNREACH_BEYONDSCOPE 2 /* beyond scope of source address */
#define ICMP6_DST_UNREACH_ADDR 3 /* address unreachable */
#define ICMP6_DST_UNREACH_NOPORT 4 /* bad port */
#define ICMP6_DST_UNREACH_FAILEDPOLICY 5 /* Source address failed ingress/egress policy */
#define ICMP6_DST_UNREACH_REJECTROUTE 6 /* Reject route to destination */
/** Time Exceeded Message (type=3) Code: */
#define ICMP6_TIME_EXCEED_TRANSIT 0 /* Hop Limit == 0 in transit */
#endif
#ifndef ICMP6_TIME_EXCEED_REASSEMBLY
#define ICMP6_TIME_EXCEED_REASSEMBLY 1 /* Reassembly time out */
#endif
#ifndef ICMP6_PARAMPROB_HEADER
/** Parameter Problem Message (type=4) Code: */
#define ICMP6_PARAMPROB_HEADER 0 /* erroneous header field */
#endif
#ifndef ICMP6_PARAMPROB_NEXTHEADER
#define ICMP6_PARAMPROB_NEXTHEADER 1 /* unrecognized Next Header */
#endif
#ifndef ICMP6_PARAMPROB_OPTION
#define ICMP6_PARAMPROB_OPTION 2 /* unrecognized IPv6 option */
#endif
/** marco for icmpv6 type access */
/** macro for icmpv6 "type" access */
#define ICMPV6_GET_TYPE(p) (p)->icmpv6h->type
/** marco for icmpv4 code access */
/** macro for icmpv6 "code" access */
#define ICMPV6_GET_CODE(p) (p)->icmpv6h->code
/** macro for icmpv6 "csum" access */
#define ICMPV6_GET_CSUM(p) (p)->icmpv6h->csum
/** If message is informational */
/** macro for icmpv6 "id" access */
#define ICMPV6_GET_ID(p) (p)->icmpv6h->icmpv6b.icmpv6i.id
/** macro for icmpv6 "seq" access */
#define ICMPV6_GET_SEQ(p) (p)->icmpv6h->icmpv6b.icmpv6i.seq
/** If message is Error */
/** macro for icmpv6 "unused" access */
#define ICMPV6_GET_UNUSED(p) (p)->icmpv6h->icmpv6b.icmpv6e.unused
/** macro for icmpv6 "error_ptr" access */
#define ICMPV6_GET_ERROR_PTR(p) (p)->icmpv6h->icmpv6b.icmpv6e.error_ptr
/** macro for icmpv6 "mtu" access */
#define ICMPV6_GET_MTU(p) (p)->icmpv6h->icmpv6b.icmpv6e.mtu
/** macro for icmpv6 embedded "protocol" access */
#define ICMPV6_GET_EMB_PROTO(p) (p)->icmpv6vars.emb_ip6_proto_next
/** macro for icmpv6 embedded "ipv6h" header access */
#define ICMPV6_GET_EMB_IPV6(p) (p)->icmpv6vars.emb_ipv6h
/** macro for icmpv6 embedded "tcph" header access */
#define ICMPV6_GET_EMB_TCP(p) (p)->icmpv6vars.emb_tcph
/** macro for icmpv6 embedded "udph" header access */
#define ICMPV6_GET_EMB_UDP(p) (p)->icmpv6vars.emb_udph
/** macro for icmpv6 embedded "icmpv6h" header access */
#define ICMPV6_GET_EMB_icmpv6h(p) (p)->icmpv6vars.emb_icmpv6h
typedef struct ICMPV6Info_
{
uint16_t id;
uint16_t seq;
} ICMPV6Info;
typedef struct ICMPV6Cache_ {
/* checksum computed over the icmpv6 packet */
int32_t comp_csum;
} ICMPV6Cache;
/** ICMPv6 header structure */
typedef struct ICMPV6Hdr_
{
uint8_t type;
uint8_t code;
uint16_t csum;
/* XXX incomplete */
union{
ICMPV6Info icmpv6i; /** Informational message */
union
{
uint32_t unused; /** for types 1 and 3, should be zero */
uint32_t error_ptr; /** for type 4, pointer to the octet that originate the error */
uint32_t mtu; /** for type 2, the Maximum Transmission Unit of the next-hop link */
}icmpv6e; /** Error Message */
}icmpv6b;
} ICMPV6Hdr;
typedef struct ICMPV6Cache_ {
/* checksum computed over the icmpv6 packet */
int32_t comp_csum;
} ICMPV6Cache;
/** Data available from the decoded packet */
typedef struct ICMPV6Vars_ {
uint8_t type;
uint8_t code;
/* checksum of the icmpv6 packet */
uint16_t csum;
uint16_t id;
uint16_t seq;
uint32_t mtu;
uint32_t error_ptr;
/** Pointers to the embedded packet headers */
IPV6Hdr *emb_ipv6h;
TCPHdr *emb_tcph;
UDPHdr *emb_udph;
ICMPV6Hdr *emb_icmpv6h;
/** IPv6 src and dst address */
uint32_t emb_ip6_src[4];
uint32_t emb_ip6_dst[4];
uint8_t emb_ip6_proto_next;
/** TCP/UDP ports */
uint16_t emb_sport;
uint16_t emb_dport;
} ICMPV6Vars;
inline uint16_t ICMPV6CalculateChecksum(uint16_t *, uint16_t *, uint16_t);
void DecodeICMPV6RegisterTests(void);

2
src/decode.h
Unescape Escape View File

@ -252,8 +252,10 @@ typedef struct Packet_
ICMPV4Hdr *icmpv4h;
ICMPV4Cache icmpv4c;
ICMPV4Vars icmpv4vars;
ICMPV6Hdr *icmpv6h;
ICMPV6Cache icmpv6c;
ICMPV6Vars icmpv6vars;
TCPHdr *tcph;
TCPVars tcpvars;

5
src/detect-decode-event.h
Unescape Escape View File

@ -43,6 +43,11 @@ struct DetectDecodeEvents_ {
{ "ipv6.exthdr_dupl_ah", IPV6_EXTHDR_DUPL_AH, },
{ "ipv6.exthdr_dupl_eh", IPV6_EXTHDR_DUPL_EH, },
{ "ipv6.exthdr_invalid_optlen", IPV6_EXTHDR_INVALID_OPTLEN, },
{ "icmpv6.unknown_type", ICMPV6_UNKNOWN_TYPE,},
{ "icmpv6.unknown_code", ICMPV6_UNKNOWN_CODE,},
{ "icmpv6.pkt_too_small", ICMPV6_PKT_TOO_SMALL,},
{ "icmpv6.ipv6_unknown_version", ICMPV6_IPV6_UNKNOWN_VER,},
{ "icmpv6.ipv6_trunc_pkt", ICMPV6_IPV6_TRUNC_PKT,},
{ "tcp.pkt_too_small", TCP_PKT_TOO_SMALL, },
{ "tcp.hlen_too_small", TCP_HLEN_TOO_SMALL, },
{ "tcp.invalid_optlen", TCP_INVALID_OPTLEN, },

Write Preview
Loading…
Cancel
Save