diff --git a/src/decode-pppoe.c b/src/decode-pppoe.c index 76cd3e2f7a..d212f1a1e1 100644 --- a/src/decode-pppoe.c +++ b/src/decode-pppoe.c @@ -211,26 +211,21 @@ static int DecodePPPOEtest01 (void) { } /** DecodePPPOEtest02 - * \brief Valid PPPOE packet + * \brief Valid PPPOE packet - check the invalid ICMP type encapsulated is flagged * \retval 0 Expected test value */ static int DecodePPPOEtest02 (void) { uint8_t raw_pppoe[] = { - 0x11, 0x00, 0x00, 0x01, 0x00, 0x68, 0x00, 0x21, - 0x45, 0xc0, 0x00, 0x64, 0x00, 0x1e, 0x00, 0x00, - 0xff, 0x01, 0xa7, 0x78, 0x0a, 0x00, 0x00, 0x02, - 0x0a, 0x00, 0x00, 0x01, 0x00, 0x00, 0x4a, 0x61, - 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x0f, 0x3b, 0xd4, 0xab, 0xcd, 0xab, 0xcd, - 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, - 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, - 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, - 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, - 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, - 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, - 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, 0xab, 0xcd, - 0xab, 0xcd, 0xab, 0xcd }; + 0x11, 0x00, 0x00, 0x01, 0x00, 0x40, 0x00, 0x21, + 0x45, 0x00, 0x00, 0x3c, 0x05, 0x5c, 0x00, 0x00, + 0x20, 0x01, 0xff, 0x30, 0xc0, 0xa8, 0x0a, 0x7f, + 0xc0, 0xa8, 0x0a, 0x65, 0xab, 0xcd, 0x16, 0x5e, + 0x02, 0x00, 0x37, 0x00, 0x41, 0x42, 0x43, 0x44, + 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, + 0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, + 0x55, 0x56, 0x57, 0x41, 0x42, 0x43, 0x44, 0x45, + 0x46, 0x47, 0x48, 0x49 }; Packet p; ThreadVars tv; @@ -246,6 +241,12 @@ static int DecodePPPOEtest02 (void) { return 1; } + // and we insist that the invalid ICMP encapsulated (type 0xab, code 0xcd) is flagged + + if(! DECODER_ISSET_EVENT(&p,ICMPV4_UNKNOWN_TYPE)) { + return 1; + } + return 0; }