23374838686

Committed 21 Mar 2026 07:29AM UTC coverage: 59.341% (-20.0%) from 79.315%

Build # 23374838686

Build Type

Pull #15075

github

Committed by

web-flow

Commit Message

Merge 90b4e834f into 6587e363a

Pull Request Pull Request #15075: Stack 8001 v16.4

Coverage Stats

38 of 70 new or added lines in 10 files covered. (54.29%)

34165 existing lines in 563 files now uncovered.

119621 of 201584 relevant lines covered (59.34%)

650666.92 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

98.55

/src/decode-pppoe.c

/* Copyright (C) 2007-2021 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

/**
 * \ingroup decode
 *
 * @{
 */

/**
 * \file
 *
 * \author James Riden <jamesr@europe.com>
 *
 * PPPOE Decoder
 */

#include "suricata-common.h"

#include "packet-queue.h"

#include "decode.h"
#include "decode-ppp.h"
#include "decode-pppoe.h"
#include "decode-events.h"
#include "flow.h"

#include "util-validate.h"
#include "util-unittest.h"
#include "util-debug.h"

/**
 * \brief Main decoding function for PPPOE Discovery packets
 */
int DecodePPPOEDiscovery(
        ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
{
    DEBUG_VALIDATE_BUG_ON(pkt == NULL);

    StatsCounterIncr(&tv->stats, dtv->counter_pppoe);

    if (len < PPPOE_DISCOVERY_HEADER_MIN_LEN) {
        ENGINE_SET_INVALID_EVENT(p, PPPOE_PKT_TOO_SMALL);
        return TM_ECODE_FAILED;
    }

    PPPOEDiscoveryHdr *pppoedh = (PPPOEDiscoveryHdr *)pkt;

    /* parse the PPPOE code */
    switch (pppoedh->pppoe_code) {
        case PPPOE_CODE_PADI:
            break;
        case PPPOE_CODE_PADO:
            break;
        case PPPOE_CODE_PADR:
            break;
        case PPPOE_CODE_PADS:
            break;
        case PPPOE_CODE_PADT:
            break;
        default:
            SCLogDebug("unknown PPPOE code: 0x%0" PRIX8 "", pppoedh->pppoe_code);
            ENGINE_SET_INVALID_EVENT(p, PPPOE_WRONG_CODE);
            return TM_ECODE_OK;
    }

    uint32_t pppoe_length = SCNtohs(pppoedh->pppoe_length);
    uint32_t packet_length = len - PPPOE_DISCOVERY_HEADER_MIN_LEN;

    SCLogDebug("pppoe_length %" PRIu32 ", packet_length %" PRIu32 "", pppoe_length, packet_length);

    if (pppoe_length > packet_length) {
        SCLogDebug("malformed PPPOE tags");
        ENGINE_SET_INVALID_EVENT(p, PPPOE_MALFORMED_TAGS);
        return TM_ECODE_OK;
    }

#ifdef DEBUG
    /* parse any tags we have in the packet */

    uint32_t tag_length = 0;
    const uint8_t *pkt_pppoedt = pkt + PPPOE_DISCOVERY_HEADER_MIN_LEN;

    // packet_length >= pppoe_length so we have enough data
    while (pppoe_length >= sizeof(PPPOEDiscoveryTag)) {
        PPPOEDiscoveryTag *pppoedt = (PPPOEDiscoveryTag *)pkt_pppoedt;
        uint16_t tag_type = SCNtohs(pppoedt->pppoe_tag_type);
        // upgrade to u32 to avoid u16 overflow
        tag_length = SCNtohs(pppoedt->pppoe_tag_length);

        SCLogDebug("PPPoE Tag type %x, length %" PRIu32, tag_type, tag_length);

        if (pppoe_length >= (4 + tag_length)) {
            pppoe_length -= (4 + tag_length);
            pkt_pppoedt = pkt_pppoedt + (4 + tag_length);
        } else {
            pppoe_length = 0; // don't want an underflow
        }
    }
#endif

    return TM_ECODE_OK;
}

/**
 * \brief Main decoding function for PPPOE Session packets
 */
int DecodePPPOESession(
        ThreadVars *tv, DecodeThreadVars *dtv, Packet *p, const uint8_t *pkt, uint32_t len)
{
    DEBUG_VALIDATE_BUG_ON(pkt == NULL);

    StatsCounterIncr(&tv->stats, dtv->counter_pppoe);

    if (len < PPPOE_SESSION_HEADER_MIN_LEN) {
        ENGINE_SET_INVALID_EVENT(p, PPPOE_PKT_TOO_SMALL);
        return TM_ECODE_FAILED;
    }

    PPPOESessionHdr *pppoesh = (PPPOESessionHdr *)pkt;

    SCLogDebug("PPPOE VERSION %" PRIu32 " TYPE %" PRIu32 " CODE %" PRIu32 " SESSIONID %" PRIu32
               " LENGTH %" PRIu32 "",
            PPPOE_SESSION_GET_VERSION(pppoesh), PPPOE_SESSION_GET_TYPE(pppoesh),
            pppoesh->pppoe_code, SCNtohs(pppoesh->session_id), SCNtohs(pppoesh->pppoe_length));

    /* can't use DecodePPP() here because we only get a single 2-byte word to indicate protocol
     * instead of the full PPP header */
    if (SCNtohs(pppoesh->pppoe_length) > 0) {
        /* decode contained PPP packet */

        uint8_t pppoesh_len;
        uint16_t ppp_protocol = SCNtohs(pppoesh->protocol);

        /* According to RFC1661-2, if the least significant bit of the most significant octet is
         * set, we're dealing with a single-octet protocol field */
        if (ppp_protocol & 0x0100) {
            /* Single-octet variant */
            ppp_protocol >>= 8;
            pppoesh_len = PPPOE_SESSION_HEADER_MIN_LEN;
        } else {
            /* Double-octet variant; increase the length of the session header accordingly */
            pppoesh_len = PPPOE_SESSION_HEADER_MIN_LEN + 1;

            if (len < pppoesh_len) {
                ENGINE_SET_INVALID_EVENT(p, PPPOE_PKT_TOO_SMALL);
                return TM_ECODE_FAILED;
            }
        }

        SCLogDebug("Protocol %" PRIu16 " len %" PRIu8 "", ppp_protocol, pppoesh_len);

        switch (ppp_protocol) {
            case PPP_VJ_COMP:
            case PPP_IPX:
            case PPP_OSI:
            case PPP_NS:
            case PPP_DECNET:
            case PPP_APPLE:
            case PPP_BRPDU:
            case PPP_STII:
            case PPP_VINES:
            case PPP_HELLO:
            case PPP_LUXCOM:
            case PPP_SNS:
            case PPP_MPLS_UCAST:
            case PPP_MPLS_MCAST:
            case PPP_OSICP:
            case PPP_NSCP:
            case PPP_DECNETCP:
            case PPP_APPLECP:
            case PPP_IPXCP:
            case PPP_STIICP:
            case PPP_VINESCP:
            case PPP_MPLSCP:
                ENGINE_SET_EVENT(p, PPP_UNSUP_PROTO);
                break;

            case PPP_IPCP:
            case PPP_IPV6CP:
            case PPP_LCP:
            case PPP_PAP:
            case PPP_CHAP:
            case PPP_CCP:
            case PPP_LQM:
            case PPP_CBCP:
            case PPP_COMP_DGRAM:
            case PPP_CDPCP:
                /* Valid types to be in PPP but don't inspect validity. */
                break;

            case PPP_VJ_UCOMP:

                if (len - pppoesh_len < IPV4_HEADER_LEN) {
                    ENGINE_SET_INVALID_EVENT(p, PPPVJU_PKT_TOO_SMALL);
                    return TM_ECODE_OK;
                }
                if (unlikely(len - pppoesh_len > USHRT_MAX)) {
                    return TM_ECODE_FAILED;
                }

                if (IPV4_GET_RAW_VER((IPV4Hdr *)(pkt + pppoesh_len)) == 4) {
                    DecodeIPV4(tv, dtv, p, pkt + pppoesh_len, (uint16_t)(len - pppoesh_len));
                }
                break;

            case PPP_IP:
                if (len - pppoesh_len < IPV4_HEADER_LEN) {
                    ENGINE_SET_INVALID_EVENT(p, PPPIPV4_PKT_TOO_SMALL);
                    return TM_ECODE_OK;
                }
                if (unlikely(len - pppoesh_len > USHRT_MAX)) {
                    return TM_ECODE_FAILED;
                }
                DecodeIPV4(tv, dtv, p, pkt + pppoesh_len, (uint16_t)(len - pppoesh_len));
                break;

            /* PPP IPv6 was not tested */
            case PPP_IPV6:
                if (len - pppoesh_len < IPV6_HEADER_LEN) {
                    ENGINE_SET_INVALID_EVENT(p, PPPIPV6_PKT_TOO_SMALL);
                    return TM_ECODE_OK;
                }
                if (unlikely(len - pppoesh_len > USHRT_MAX)) {
                    return TM_ECODE_FAILED;
                }

                DecodeIPV6(tv, dtv, p, pkt + pppoesh_len, (uint16_t)(len - pppoesh_len));
                break;

            default:
                SCLogDebug("unknown PPP protocol: %" PRIx32 "", ppp_protocol);
                ENGINE_SET_INVALID_EVENT(p, PPP_WRONG_TYPE);
                return TM_ECODE_OK;
        }
    }
    return TM_ECODE_OK;
}

#ifdef UNITTESTS
/** DecodePPPOEtest01
 *  \brief Decode malformed PPPOE packet (too short)
 *  \retval 1 Expected test value
 */
static int DecodePPPOEtest01(void)
{

    uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x00, 0x00 };
    Packet *p = PacketGetFromAlloc();
    FAIL_IF_NULL(p);
    ThreadVars tv;
    DecodeThreadVars dtv;

    memset(&tv, 0, sizeof(ThreadVars));
    memset(&dtv, 0, sizeof(DecodeThreadVars));

    DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));

    FAIL_IF(!ENGINE_ISSET_EVENT(p, PPPOE_PKT_TOO_SMALL));

    PacketFree(p);
    PASS;
}

/** DecodePPPOEtest02
 *  \brief Valid PPPOE packet - check the invalid ICMP type encapsulated is flagged
 *  \retval 0 Expected test value
 */
static int DecodePPPOEtest02(void)
{

    uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x01, 0x00, 0x40, 0x00, 0x21, 0x45, 0x00, 0x00, 0x3c,
        0x05, 0x5c, 0x00, 0x00, 0x20, 0x01, 0xff, 0x30, 0xc0, 0xa8, 0x0a, 0x7f, 0xc0, 0xa8, 0x0a,
        0x65, 0xab, 0xcd, 0x16, 0x5e, 0x02, 0x00, 0x37, 0x00, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46,
        0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55,
        0x56, 0x57, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49 };

    Packet *p = PacketGetFromAlloc();
    FAIL_IF_NULL(p);
    ThreadVars tv;
    DecodeThreadVars dtv;

    memset(&tv, 0, sizeof(ThreadVars));
    memset(&dtv, 0, sizeof(DecodeThreadVars));

    FlowInitConfig(FLOW_QUIET);

    DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));

    FAIL_IF(ENGINE_ISSET_EVENT(p, PPPOE_PKT_TOO_SMALL));

    // and we insist that the invalid ICMP encapsulated (type 0xab, code 0xcd) is flagged
    FAIL_IF(!ENGINE_ISSET_EVENT(p, ICMPV4_UNKNOWN_TYPE));

    FlowShutdown();
    PacketFree(p);
    PASS;
}

/** DecodePPPOEtest03
 *  \brief Valid example PADO packet PPPOE packet taken from RFC2516
 *  \retval 0 Expected test value
 */
static int DecodePPPOEtest03(void)
{
    /* example PADO packet taken from RFC2516 */
    uint8_t raw_pppoe[] = { 0x11, 0x07, 0x00, 0x00, 0x00, 0x20, 0x01, 0x01, 0x00, 0x00, 0x01, 0x02,
        0x00, 0x18, 0x47, 0x6f, 0x20, 0x52, 0x65, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x20, 0x2d, 0x20,
        0x65, 0x73, 0x68, 0x73, 0x68, 0x65, 0x73, 0x68, 0x6f, 0x6f, 0x74 };

    Packet *p = PacketGetFromAlloc();
    FAIL_IF_NULL(p);
    ThreadVars tv;
    DecodeThreadVars dtv;

    memset(&tv, 0, sizeof(ThreadVars));
    memset(&dtv, 0, sizeof(DecodeThreadVars));

    int r = DecodePPPOEDiscovery(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));
    FAIL_IF_NOT(r == TM_ECODE_OK);

    PacketFree(p);
    PASS;
}

/** DecodePPPOEtest04
 *  \brief Valid example PPPOE packet taken from RFC2516 - but with wrong PPPOE code
 *  \retval 1 Expected test value
 */
static int DecodePPPOEtest04(void)
{

    /* example PADI packet taken from RFC2516, but with wrong code */
    uint8_t raw_pppoe[] = { 0x11, 0xbb, 0x00, 0x00, 0x00, 0x04, 0x01, 0x01, 0x00, 0x00 };

    Packet *p = PacketGetFromAlloc();
    FAIL_IF_NULL(p);
    ThreadVars tv;
    DecodeThreadVars dtv;

    memset(&tv, 0, sizeof(ThreadVars));
    memset(&dtv, 0, sizeof(DecodeThreadVars));

    DecodePPPOEDiscovery(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));

    FAIL_IF(!ENGINE_ISSET_EVENT(p, PPPOE_WRONG_CODE));

    PacketFree(p);
    PASS;
}

/** DecodePPPOEtest05
 *  \brief Valid example PADO PPPOE packet taken from RFC2516, but too short for given length
 *  \retval 0 Expected test value
 */
static int DecodePPPOEtest05(void)
{

    /* example PADI packet taken from RFC2516 */
    uint8_t raw_pppoe[] = { 0x11, 0x07, 0x00, 0x00, 0x00, 0x20, 0x01, 0x01, 0x00, 0x00, 0x01, 0x02,
        0x00, 0x18, 0x47, 0x6f, 0x20, 0x52, 0x65, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x20, 0x2d, 0x20,
        0x65, 0x73, 0x68, 0x73, 0x68 };

    Packet *p = PacketGetFromAlloc();
    FAIL_IF_NULL(p);
    ThreadVars tv;
    DecodeThreadVars dtv;

    memset(&tv, 0, sizeof(ThreadVars));
    memset(&dtv, 0, sizeof(DecodeThreadVars));

    DecodePPPOEDiscovery(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));

    FAIL_IF(!ENGINE_ISSET_EVENT(p, PPPOE_MALFORMED_TAGS));

    PacketFree(p);
    PASS;
}

/** DecodePPPOEtest06
 *  \brief Check that the macros work as expected. Type and version are
 * fields of 4 bits length. So they are sharing the same var and the macros
 * should extract the first 4 bits for version and the second 4 bits for type
 *  \retval 1 Expected test value
 */
static int DecodePPPOEtest06(void)
{

    PPPOESessionHdr pppoesh;
    PPPOEDiscoveryHdr pppoedh;
    pppoesh.pppoe_version_type = 0xAB;
    pppoedh.pppoe_version_type = 0xCD;

    FAIL_IF(PPPOE_SESSION_GET_VERSION(&pppoesh) != 0x0A);
    FAIL_IF(PPPOE_SESSION_GET_TYPE(&pppoesh) != 0x0B);
    FAIL_IF(PPPOE_DISCOVERY_GET_VERSION(&pppoedh) != 0x0C);
    FAIL_IF(PPPOE_DISCOVERY_GET_TYPE(&pppoedh) != 0x0D);
    PASS;
}

/** DecodePPPOEtest07
 *  \brief Valid PPPOE packet with 8 bit protocol field - check the valid ICMP type is accepted
 *  \retval 1 Expected test value
 */
static int DecodePPPOEtest07(void)
{

    uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x2d, 0x00, 0x1c, 0x21, 0x45, 0x00, 0x00, 0x1d, 0x97,
        0xc3, 0x00, 0x00, 0x40, 0x01, 0x47, 0x0f, 0x0a, 0x64, 0x00, 0x00, 0xc0, 0xa8, 0xd1, 0x01,
        0x08, 0x00, 0xd4, 0x4c, 0x1f, 0x32, 0x04, 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00 };

    Packet *p = PacketGetFromAlloc();
    FAIL_IF_NULL(p);
    ThreadVars tv;
    DecodeThreadVars dtv;

    memset(&tv, 0, sizeof(ThreadVars));
    memset(&dtv, 0, sizeof(DecodeThreadVars));

    DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));

    FAIL_IF(ENGINE_ISSET_EVENT(p, PPP_WRONG_TYPE));
    PacketFree(p);
    PASS;
}

/** DecodePPPOEtest08
 *  \brief Valid PPPOE packet with 8 bit protocol field - check the valid HTTP type is accepted
 *  \retval 1 Expected test value
 */
static int DecodePPPOEtest08(void)
{

    uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x2d, 0x00, 0x3d, 0x21, 0x45, 0x00, 0x00, 0x3c, 0x00,
        0x00, 0x40, 0x00, 0x40, 0x06, 0xed, 0xda, 0x0a, 0x64, 0x00, 0x00, 0x8e, 0xfa, 0xb3, 0x83,
        0xde, 0xb5, 0x00, 0x50, 0xd4, 0xbd, 0x76, 0x54, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0xfe,
        0xcc, 0x74, 0x2f, 0x00, 0x00, 0x02, 0x04, 0x05, 0xac, 0x01, 0x03, 0x03, 0x07, 0x04, 0x02,
        0x08, 0x0a, 0xcb, 0xae, 0x92, 0x63, 0x00, 0x00, 0x00, 0x00 };

    Packet *p = PacketGetFromAlloc();
    FAIL_IF_NULL(p);
    ThreadVars tv;
    DecodeThreadVars dtv;

    memset(&tv, 0, sizeof(ThreadVars));
    memset(&dtv, 0, sizeof(DecodeThreadVars));

    DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));

    FAIL_IF(ENGINE_ISSET_EVENT(p, PPP_WRONG_TYPE));
    PacketFree(p);
    PASS;
}

/** DecodePPPOEtest09
 *  \brief Valid PPPOE packet with 16 bit protocol field - check the valid ICMP type is accepted
 *  \retval 1 Expected test value
 */
static int DecodePPPOEtest09(void)
{

    uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x2d, 0x00, 0x1c, 0x00, 0x21, 0x45, 0x00, 0x00, 0x1d,
        0x97, 0xc3, 0x00, 0x00, 0x40, 0x01, 0x47, 0x0f, 0x0a, 0x64, 0x00, 0x00, 0xc0, 0xa8, 0xd1,
        0x01, 0x08, 0x00, 0xd4, 0x4c, 0x1f, 0x32, 0x04, 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00 };

    Packet *p = PacketGetFromAlloc();
    FAIL_IF_NULL(p);
    ThreadVars tv;
    DecodeThreadVars dtv;

    memset(&tv, 0, sizeof(ThreadVars));
    memset(&dtv, 0, sizeof(DecodeThreadVars));

    DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));

    FAIL_IF(ENGINE_ISSET_EVENT(p, PPP_WRONG_TYPE));
    PacketFree(p);
    PASS;
}

/** DecodePPPOEtest10
 *  \brief Valid PPPOE packet with 16 bit protocol field - check the valid HTTP type is accepted
 *  \retval 1 Expected test value
 */
static int DecodePPPOEtest10(void)
{

    uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x2d, 0x00, 0x3d, 0x00, 0x21, 0x45, 0x00, 0x00, 0x3c,
        0x00, 0x00, 0x40, 0x00, 0x40, 0x06, 0xed, 0xda, 0x0a, 0x64, 0x00, 0x00, 0x8e, 0xfa, 0xb3,
        0x83, 0xde, 0xb5, 0x00, 0x50, 0xd4, 0xbd, 0x76, 0x54, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02,
        0xfe, 0xcc, 0x74, 0x2f, 0x00, 0x00, 0x02, 0x04, 0x05, 0xac, 0x01, 0x03, 0x03, 0x07, 0x04,
        0x02, 0x08, 0x0a, 0xcb, 0xae, 0x92, 0x63, 0x00, 0x00, 0x00, 0x00 };

    Packet *p = PacketGetFromAlloc();
    FAIL_IF_NULL(p);
    ThreadVars tv;
    DecodeThreadVars dtv;

    memset(&tv, 0, sizeof(ThreadVars));
    memset(&dtv, 0, sizeof(DecodeThreadVars));

    DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));

    FAIL_IF(ENGINE_ISSET_EVENT(p, PPP_WRONG_TYPE));
    PacketFree(p);
    PASS;
}
#endif /* UNITTESTS */

/**
 * \brief Registers PPPOE unit tests
 * \todo More PPPOE tests
 */
void DecodePPPOERegisterTests(void)
{
#ifdef UNITTESTS
    UtRegisterTest("DecodePPPOEtest01", DecodePPPOEtest01);
    UtRegisterTest("DecodePPPOEtest02", DecodePPPOEtest02);
    UtRegisterTest("DecodePPPOEtest03", DecodePPPOEtest03);
    UtRegisterTest("DecodePPPOEtest04", DecodePPPOEtest04);
    UtRegisterTest("DecodePPPOEtest05", DecodePPPOEtest05);
    UtRegisterTest("DecodePPPOEtest06", DecodePPPOEtest06);
    UtRegisterTest("DecodePPPOEtest07", DecodePPPOEtest07);
    UtRegisterTest("DecodePPPOEtest08", DecodePPPOEtest08);
    UtRegisterTest("DecodePPPOEtest09", DecodePPPOEtest09);
    UtRegisterTest("DecodePPPOEtest10", DecodePPPOEtest10);
#endif /* UNITTESTS */
}

/**
 * @}
 */

1	/* Copyright (C) 2007-2021 Open Information Security Foundation
2	*
3	* You can copy, redistribute or modify this Program under the terms of
4	* the GNU General Public License version 2 as published by the Free
5	* Software Foundation.
6	*
7	* This program is distributed in the hope that it will be useful,
8	* but WITHOUT ANY WARRANTY; without even the implied warranty of
9	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10	* GNU General Public License for more details.
11	*
12	* You should have received a copy of the GNU General Public License
13	* version 2 along with this program; if not, write to the Free Software
14	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15	* 02110-1301, USA.
16	*/
17
18	/**
19	* \ingroup decode
20	*
21	* @{
22	*/
23
24	/**
25	* \file
26	*
27	* \author James Riden <jamesr@europe.com>
28	*
29	* PPPOE Decoder
30	*/
31
32	#include "suricata-common.h"
33
34	#include "packet-queue.h"
35
36	#include "decode.h"
37	#include "decode-ppp.h"
38	#include "decode-pppoe.h"
39	#include "decode-events.h"
40	#include "flow.h"
41
42	#include "util-validate.h"
43	#include "util-unittest.h"
44	#include "util-debug.h"
45
46	/**
47	* \brief Main decoding function for PPPOE Discovery packets
48	*/
49	int DecodePPPOEDiscovery(
50	ThreadVars tv, DecodeThreadVars dtv, Packet p, const uint8_t pkt, uint32_t len)
51	{	2,307✔
52	DEBUG_VALIDATE_BUG_ON(pkt == NULL);	2,307✔
53
54	StatsCounterIncr(&tv->stats, dtv->counter_pppoe);	2,307✔
55
56	if (len < PPPOE_DISCOVERY_HEADER_MIN_LEN) {	2,307✔
57	ENGINE_SET_INVALID_EVENT(p, PPPOE_PKT_TOO_SMALL);	788✔
58	return TM_ECODE_FAILED;	788✔
59	}	788✔
60
61	PPPOEDiscoveryHdr pppoedh = (PPPOEDiscoveryHdr )pkt;	1,519✔
62
63	/* parse the PPPOE code */
64	switch (pppoedh->pppoe_code) {	1,519✔
65	case PPPOE_CODE_PADI:	220✔
66	break;	220✔
67	case PPPOE_CODE_PADO:	222✔
68	break;	222✔
69	case PPPOE_CODE_PADR:	205✔
70	break;	205✔
71	case PPPOE_CODE_PADS:	349✔
72	break;	349✔
73	case PPPOE_CODE_PADT:	86✔
74	break;	86✔
75	default:	437✔
76	SCLogDebug("unknown PPPOE code: 0x%0" PRIX8 "", pppoedh->pppoe_code);	437✔
77	ENGINE_SET_INVALID_EVENT(p, PPPOE_WRONG_CODE);	437✔
78	return TM_ECODE_OK;	437✔
79	}	1,519✔
80
81	uint32_t pppoe_length = SCNtohs(pppoedh->pppoe_length);	1,082✔
82	uint32_t packet_length = len - PPPOE_DISCOVERY_HEADER_MIN_LEN;	1,082✔
83
84	SCLogDebug("pppoe_length %" PRIu32 ", packet_length %" PRIu32 "", pppoe_length, packet_length);	1,082✔
85
86	if (pppoe_length > packet_length) {	1,082✔
87	SCLogDebug("malformed PPPOE tags");	671✔
88	ENGINE_SET_INVALID_EVENT(p, PPPOE_MALFORMED_TAGS);	671✔
89	return TM_ECODE_OK;	671✔
90	}	671✔
91
92	#ifdef DEBUG
93	/* parse any tags we have in the packet */
94
95	uint32_t tag_length = 0;
96	const uint8_t *pkt_pppoedt = pkt + PPPOE_DISCOVERY_HEADER_MIN_LEN;
97
98	// packet_length >= pppoe_length so we have enough data
99	while (pppoe_length >= sizeof(PPPOEDiscoveryTag)) {
100	PPPOEDiscoveryTag pppoedt = (PPPOEDiscoveryTag )pkt_pppoedt;
101	uint16_t tag_type = SCNtohs(pppoedt->pppoe_tag_type);
102	// upgrade to u32 to avoid u16 overflow
103	tag_length = SCNtohs(pppoedt->pppoe_tag_length);
104
105	SCLogDebug("PPPoE Tag type %x, length %" PRIu32, tag_type, tag_length);
106
107	if (pppoe_length >= (4 + tag_length)) {
108	pppoe_length -= (4 + tag_length);
109	pkt_pppoedt = pkt_pppoedt + (4 + tag_length);
110	} else {
111	pppoe_length = 0; // don't want an underflow
112	}
113	}
114	#endif
115
116	return TM_ECODE_OK;	411✔
117	}	1,082✔
118
119	/**
120	* \brief Main decoding function for PPPOE Session packets
121	*/
122	int DecodePPPOESession(
123	ThreadVars tv, DecodeThreadVars dtv, Packet p, const uint8_t pkt, uint32_t len)
124	{	8,144✔
125	DEBUG_VALIDATE_BUG_ON(pkt == NULL);	8,144✔
126
127	StatsCounterIncr(&tv->stats, dtv->counter_pppoe);	8,144✔
128
129	if (len < PPPOE_SESSION_HEADER_MIN_LEN) {	8,144✔
130	ENGINE_SET_INVALID_EVENT(p, PPPOE_PKT_TOO_SMALL);	482✔
131	return TM_ECODE_FAILED;	482✔
132	}	482✔
133
134	PPPOESessionHdr pppoesh = (PPPOESessionHdr )pkt;	7,662✔
135
136	SCLogDebug("PPPOE VERSION %" PRIu32 " TYPE %" PRIu32 " CODE %" PRIu32 " SESSIONID %" PRIu32	7,662✔
137	" LENGTH %" PRIu32 "",	7,662✔
138	PPPOE_SESSION_GET_VERSION(pppoesh), PPPOE_SESSION_GET_TYPE(pppoesh),	7,662✔
139	pppoesh->pppoe_code, SCNtohs(pppoesh->session_id), SCNtohs(pppoesh->pppoe_length));	7,662✔
140
141	/* can't use DecodePPP() here because we only get a single 2-byte word to indicate protocol
142	* instead of the full PPP header */
143	if (SCNtohs(pppoesh->pppoe_length) > 0) {	7,662✔
144	/* decode contained PPP packet */
145
146	uint8_t pppoesh_len;	7,288✔
147	uint16_t ppp_protocol = SCNtohs(pppoesh->protocol);	7,288✔
148
149	/* According to RFC1661-2, if the least significant bit of the most significant octet is
150	* set, we're dealing with a single-octet protocol field */
151	if (ppp_protocol & 0x0100) {	7,288✔
152	/* Single-octet variant */
153	ppp_protocol >>= 8;	2,225✔
154	pppoesh_len = PPPOE_SESSION_HEADER_MIN_LEN;	2,225✔
155	} else {	5,063✔
156	/* Double-octet variant; increase the length of the session header accordingly */
157	pppoesh_len = PPPOE_SESSION_HEADER_MIN_LEN + 1;	5,063✔
158
159	if (len < pppoesh_len) {	5,063✔
160	ENGINE_SET_INVALID_EVENT(p, PPPOE_PKT_TOO_SMALL);	312✔
161	return TM_ECODE_FAILED;	312✔
162	}	312✔
163	}	5,063✔
164
165	SCLogDebug("Protocol %" PRIu16 " len %" PRIu8 "", ppp_protocol, pppoesh_len);	6,976✔
166
167	switch (ppp_protocol) {	6,976✔
168	case PPP_VJ_COMP:	248✔
169	case PPP_IPX:	443✔
170	case PPP_OSI:	511✔
171	case PPP_NS:	1,000✔
172	case PPP_DECNET:	1,407✔
173	case PPP_APPLE:	2,012✔
174	case PPP_BRPDU:	2,236✔
175	case PPP_STII:	2,431✔
176	case PPP_VINES:	2,717✔
177	case PPP_HELLO:	2,802✔
178	case PPP_LUXCOM:	2,868✔
179	case PPP_SNS:	2,938✔
180	case PPP_MPLS_UCAST:	2,972✔
181	case PPP_MPLS_MCAST:	3,040✔
182	case PPP_OSICP:	3,234✔
183	case PPP_NSCP:	3,300✔
184	case PPP_DECNETCP:	3,544✔
185	case PPP_APPLECP:	3,610✔
186	case PPP_IPXCP:	3,676✔
187	case PPP_STIICP:	3,757✔
188	case PPP_VINESCP:	3,833✔
189	case PPP_MPLSCP:	3,843✔
190	ENGINE_SET_EVENT(p, PPP_UNSUP_PROTO);	3,843✔
191	break;	3,843✔
192
193	case PPP_IPCP:	72✔
194	case PPP_IPV6CP:	435✔
195	case PPP_LCP:	559✔
196	case PPP_PAP:	594✔
197	case PPP_CHAP:	660✔
198	case PPP_CCP:	676✔
199	case PPP_LQM:	742✔
200	case PPP_CBCP:	752✔
201	case PPP_COMP_DGRAM:	818✔
202	case PPP_CDPCP:	836✔
203	/* Valid types to be in PPP but don't inspect validity. */
204	break;	836✔
205
206	case PPP_VJ_UCOMP:	483✔
207
208	if (len - pppoesh_len < IPV4_HEADER_LEN) {	483✔
209	ENGINE_SET_INVALID_EVENT(p, PPPVJU_PKT_TOO_SMALL);	199✔
210	return TM_ECODE_OK;	199✔
211	}	199✔
212	if (unlikely(len - pppoesh_len > USHRT_MAX)) {	284✔
213	return TM_ECODE_FAILED;	10✔
214	}	10✔
215
216	if (IPV4_GET_RAW_VER((IPV4Hdr *)(pkt + pppoesh_len)) == 4) {	274✔
217	DecodeIPV4(tv, dtv, p, pkt + pppoesh_len, (uint16_t)(len - pppoesh_len));	195✔
218	}	195✔
219	break;	274✔
220
221	case PPP_IP:	693✔
222	if (len - pppoesh_len < IPV4_HEADER_LEN) {	693✔
223	ENGINE_SET_INVALID_EVENT(p, PPPIPV4_PKT_TOO_SMALL);	196✔
224	return TM_ECODE_OK;	196✔
225	}	196✔
226	if (unlikely(len - pppoesh_len > USHRT_MAX)) {	497✔
227	return TM_ECODE_FAILED;	10✔
228	}	10✔
229	DecodeIPV4(tv, dtv, p, pkt + pppoesh_len, (uint16_t)(len - pppoesh_len));	487✔
230	break;	487✔
231
232	/* PPP IPv6 was not tested */
233	case PPP_IPV6:	152✔
234	if (len - pppoesh_len < IPV6_HEADER_LEN) {	152✔
235	ENGINE_SET_INVALID_EVENT(p, PPPIPV6_PKT_TOO_SMALL);	68✔
236	return TM_ECODE_OK;	68✔
237	}	68✔
238	if (unlikely(len - pppoesh_len > USHRT_MAX)) {	84✔
239	return TM_ECODE_FAILED;	10✔
240	}	10✔
241
242	DecodeIPV6(tv, dtv, p, pkt + pppoesh_len, (uint16_t)(len - pppoesh_len));	74✔
243	break;	74✔
244
245	default:	969✔
246	SCLogDebug("unknown PPP protocol: %" PRIx32 "", ppp_protocol);	969✔
247	ENGINE_SET_INVALID_EVENT(p, PPP_WRONG_TYPE);	969✔
248	return TM_ECODE_OK;	969✔
249	}	6,976✔
250	}	6,976✔
251	return TM_ECODE_OK;	5,888✔
252	}	7,662✔
253
254	#ifdef UNITTESTS
255	/** DecodePPPOEtest01
256	* \brief Decode malformed PPPOE packet (too short)
257	* \retval 1 Expected test value
258	*/
259	static int DecodePPPOEtest01(void)
260	{
261
262	uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x00, 0x00 };
263	Packet *p = PacketGetFromAlloc();
264	FAIL_IF_NULL(p);
265	ThreadVars tv;
266	DecodeThreadVars dtv;
267
268	memset(&tv, 0, sizeof(ThreadVars));
269	memset(&dtv, 0, sizeof(DecodeThreadVars));
270
271	DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));
272
273	FAIL_IF(!ENGINE_ISSET_EVENT(p, PPPOE_PKT_TOO_SMALL));
274
275	PacketFree(p);
276	PASS;
277	}
278
279	/** DecodePPPOEtest02
280	* \brief Valid PPPOE packet - check the invalid ICMP type encapsulated is flagged
281	* \retval 0 Expected test value
282	*/
283	static int DecodePPPOEtest02(void)
284	{
285
286	uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x01, 0x00, 0x40, 0x00, 0x21, 0x45, 0x00, 0x00, 0x3c,
287	0x05, 0x5c, 0x00, 0x00, 0x20, 0x01, 0xff, 0x30, 0xc0, 0xa8, 0x0a, 0x7f, 0xc0, 0xa8, 0x0a,
288	0x65, 0xab, 0xcd, 0x16, 0x5e, 0x02, 0x00, 0x37, 0x00, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46,
289	0x47, 0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f, 0x50, 0x51, 0x52, 0x53, 0x54, 0x55,
290	0x56, 0x57, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49 };
291
292	Packet *p = PacketGetFromAlloc();
293	FAIL_IF_NULL(p);
294	ThreadVars tv;
295	DecodeThreadVars dtv;
296
297	memset(&tv, 0, sizeof(ThreadVars));
298	memset(&dtv, 0, sizeof(DecodeThreadVars));
299
300	FlowInitConfig(FLOW_QUIET);
301
302	DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));
303
304	FAIL_IF(ENGINE_ISSET_EVENT(p, PPPOE_PKT_TOO_SMALL));
305
306	// and we insist that the invalid ICMP encapsulated (type 0xab, code 0xcd) is flagged
307	FAIL_IF(!ENGINE_ISSET_EVENT(p, ICMPV4_UNKNOWN_TYPE));
308
309	FlowShutdown();
310	PacketFree(p);
311	PASS;
312	}
313
314	/** DecodePPPOEtest03
315	* \brief Valid example PADO packet PPPOE packet taken from RFC2516
316	* \retval 0 Expected test value
317	*/
318	static int DecodePPPOEtest03(void)
319	{
320	/* example PADO packet taken from RFC2516 */
321	uint8_t raw_pppoe[] = { 0x11, 0x07, 0x00, 0x00, 0x00, 0x20, 0x01, 0x01, 0x00, 0x00, 0x01, 0x02,
322	0x00, 0x18, 0x47, 0x6f, 0x20, 0x52, 0x65, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x20, 0x2d, 0x20,
323	0x65, 0x73, 0x68, 0x73, 0x68, 0x65, 0x73, 0x68, 0x6f, 0x6f, 0x74 };
324
325	Packet *p = PacketGetFromAlloc();
326	FAIL_IF_NULL(p);
327	ThreadVars tv;
328	DecodeThreadVars dtv;
329
330	memset(&tv, 0, sizeof(ThreadVars));
331	memset(&dtv, 0, sizeof(DecodeThreadVars));
332
333	int r = DecodePPPOEDiscovery(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));
334	FAIL_IF_NOT(r == TM_ECODE_OK);
335
336	PacketFree(p);
337	PASS;
338	}
339
340	/** DecodePPPOEtest04
341	* \brief Valid example PPPOE packet taken from RFC2516 - but with wrong PPPOE code
342	* \retval 1 Expected test value
343	*/
344	static int DecodePPPOEtest04(void)
345	{
346
347	/* example PADI packet taken from RFC2516, but with wrong code */
348	uint8_t raw_pppoe[] = { 0x11, 0xbb, 0x00, 0x00, 0x00, 0x04, 0x01, 0x01, 0x00, 0x00 };
349
350	Packet *p = PacketGetFromAlloc();
351	FAIL_IF_NULL(p);
352	ThreadVars tv;
353	DecodeThreadVars dtv;
354
355	memset(&tv, 0, sizeof(ThreadVars));
356	memset(&dtv, 0, sizeof(DecodeThreadVars));
357
358	DecodePPPOEDiscovery(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));
359
360	FAIL_IF(!ENGINE_ISSET_EVENT(p, PPPOE_WRONG_CODE));
361
362	PacketFree(p);
363	PASS;
364	}
365
366	/** DecodePPPOEtest05
367	* \brief Valid example PADO PPPOE packet taken from RFC2516, but too short for given length
368	* \retval 0 Expected test value
369	*/
370	static int DecodePPPOEtest05(void)
371	{
372
373	/* example PADI packet taken from RFC2516 */
374	uint8_t raw_pppoe[] = { 0x11, 0x07, 0x00, 0x00, 0x00, 0x20, 0x01, 0x01, 0x00, 0x00, 0x01, 0x02,
375	0x00, 0x18, 0x47, 0x6f, 0x20, 0x52, 0x65, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x20, 0x2d, 0x20,
376	0x65, 0x73, 0x68, 0x73, 0x68 };
377
378	Packet *p = PacketGetFromAlloc();
379	FAIL_IF_NULL(p);
380	ThreadVars tv;
381	DecodeThreadVars dtv;
382
383	memset(&tv, 0, sizeof(ThreadVars));
384	memset(&dtv, 0, sizeof(DecodeThreadVars));
385
386	DecodePPPOEDiscovery(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));
387
388	FAIL_IF(!ENGINE_ISSET_EVENT(p, PPPOE_MALFORMED_TAGS));
389
390	PacketFree(p);
391	PASS;
392	}
393
394	/** DecodePPPOEtest06
395	* \brief Check that the macros work as expected. Type and version are
396	* fields of 4 bits length. So they are sharing the same var and the macros
397	* should extract the first 4 bits for version and the second 4 bits for type
398	* \retval 1 Expected test value
399	*/
400	static int DecodePPPOEtest06(void)
401	{
402
403	PPPOESessionHdr pppoesh;
404	PPPOEDiscoveryHdr pppoedh;
405	pppoesh.pppoe_version_type = 0xAB;
406	pppoedh.pppoe_version_type = 0xCD;
407
408	FAIL_IF(PPPOE_SESSION_GET_VERSION(&pppoesh) != 0x0A);
409	FAIL_IF(PPPOE_SESSION_GET_TYPE(&pppoesh) != 0x0B);
410	FAIL_IF(PPPOE_DISCOVERY_GET_VERSION(&pppoedh) != 0x0C);
411	FAIL_IF(PPPOE_DISCOVERY_GET_TYPE(&pppoedh) != 0x0D);
412	PASS;
413	}
414
415	/** DecodePPPOEtest07
416	* \brief Valid PPPOE packet with 8 bit protocol field - check the valid ICMP type is accepted
417	* \retval 1 Expected test value
418	*/
419	static int DecodePPPOEtest07(void)
420	{
421
422	uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x2d, 0x00, 0x1c, 0x21, 0x45, 0x00, 0x00, 0x1d, 0x97,
423	0xc3, 0x00, 0x00, 0x40, 0x01, 0x47, 0x0f, 0x0a, 0x64, 0x00, 0x00, 0xc0, 0xa8, 0xd1, 0x01,
424	0x08, 0x00, 0xd4, 0x4c, 0x1f, 0x32, 0x04, 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
425	0x00, 0x00, 0x00, 0x00 };
426
427	Packet *p = PacketGetFromAlloc();
428	FAIL_IF_NULL(p);
429	ThreadVars tv;
430	DecodeThreadVars dtv;
431
432	memset(&tv, 0, sizeof(ThreadVars));
433	memset(&dtv, 0, sizeof(DecodeThreadVars));
434
435	DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));
436
437	FAIL_IF(ENGINE_ISSET_EVENT(p, PPP_WRONG_TYPE));
438	PacketFree(p);
439	PASS;
440	}
441
442	/** DecodePPPOEtest08
443	* \brief Valid PPPOE packet with 8 bit protocol field - check the valid HTTP type is accepted
444	* \retval 1 Expected test value
445	*/
446	static int DecodePPPOEtest08(void)
447	{
448
449	uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x2d, 0x00, 0x3d, 0x21, 0x45, 0x00, 0x00, 0x3c, 0x00,
450	0x00, 0x40, 0x00, 0x40, 0x06, 0xed, 0xda, 0x0a, 0x64, 0x00, 0x00, 0x8e, 0xfa, 0xb3, 0x83,
451	0xde, 0xb5, 0x00, 0x50, 0xd4, 0xbd, 0x76, 0x54, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0xfe,
452	0xcc, 0x74, 0x2f, 0x00, 0x00, 0x02, 0x04, 0x05, 0xac, 0x01, 0x03, 0x03, 0x07, 0x04, 0x02,
453	0x08, 0x0a, 0xcb, 0xae, 0x92, 0x63, 0x00, 0x00, 0x00, 0x00 };
454
455	Packet *p = PacketGetFromAlloc();
456	FAIL_IF_NULL(p);
457	ThreadVars tv;
458	DecodeThreadVars dtv;
459
460	memset(&tv, 0, sizeof(ThreadVars));
461	memset(&dtv, 0, sizeof(DecodeThreadVars));
462
463	DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));
464
465	FAIL_IF(ENGINE_ISSET_EVENT(p, PPP_WRONG_TYPE));
466	PacketFree(p);
467	PASS;
468	}
469
470	/** DecodePPPOEtest09
471	* \brief Valid PPPOE packet with 16 bit protocol field - check the valid ICMP type is accepted
472	* \retval 1 Expected test value
473	*/
474	static int DecodePPPOEtest09(void)
475	{
476
477	uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x2d, 0x00, 0x1c, 0x00, 0x21, 0x45, 0x00, 0x00, 0x1d,
478	0x97, 0xc3, 0x00, 0x00, 0x40, 0x01, 0x47, 0x0f, 0x0a, 0x64, 0x00, 0x00, 0xc0, 0xa8, 0xd1,
479	0x01, 0x08, 0x00, 0xd4, 0x4c, 0x1f, 0x32, 0x04, 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
480	0x00, 0x00, 0x00, 0x00, 0x00 };
481
482	Packet *p = PacketGetFromAlloc();
483	FAIL_IF_NULL(p);
484	ThreadVars tv;
485	DecodeThreadVars dtv;
486
487	memset(&tv, 0, sizeof(ThreadVars));
488	memset(&dtv, 0, sizeof(DecodeThreadVars));
489
490	DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));
491
492	FAIL_IF(ENGINE_ISSET_EVENT(p, PPP_WRONG_TYPE));
493	PacketFree(p);
494	PASS;
495	}
496
497	/** DecodePPPOEtest10
498	* \brief Valid PPPOE packet with 16 bit protocol field - check the valid HTTP type is accepted
499	* \retval 1 Expected test value
500	*/
501	static int DecodePPPOEtest10(void)
502	{
503
504	uint8_t raw_pppoe[] = { 0x11, 0x00, 0x00, 0x2d, 0x00, 0x3d, 0x00, 0x21, 0x45, 0x00, 0x00, 0x3c,
505	0x00, 0x00, 0x40, 0x00, 0x40, 0x06, 0xed, 0xda, 0x0a, 0x64, 0x00, 0x00, 0x8e, 0xfa, 0xb3,
506	0x83, 0xde, 0xb5, 0x00, 0x50, 0xd4, 0xbd, 0x76, 0x54, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x02,
507	0xfe, 0xcc, 0x74, 0x2f, 0x00, 0x00, 0x02, 0x04, 0x05, 0xac, 0x01, 0x03, 0x03, 0x07, 0x04,
508	0x02, 0x08, 0x0a, 0xcb, 0xae, 0x92, 0x63, 0x00, 0x00, 0x00, 0x00 };
509
510	Packet *p = PacketGetFromAlloc();
511	FAIL_IF_NULL(p);
512	ThreadVars tv;
513	DecodeThreadVars dtv;
514
515	memset(&tv, 0, sizeof(ThreadVars));
516	memset(&dtv, 0, sizeof(DecodeThreadVars));
517
518	DecodePPPOESession(&tv, &dtv, p, raw_pppoe, sizeof(raw_pppoe));
519
520	FAIL_IF(ENGINE_ISSET_EVENT(p, PPP_WRONG_TYPE));
521	PacketFree(p);
522	PASS;
523	}
524	#endif /* UNITTESTS */
525
526	/**
527	* \brief Registers PPPOE unit tests
528	* \todo More PPPOE tests
529	*/
530	void DecodePPPOERegisterTests(void)
UNCOV 531	{	×
532	#ifdef UNITTESTS
533	UtRegisterTest("DecodePPPOEtest01", DecodePPPOEtest01);
534	UtRegisterTest("DecodePPPOEtest02", DecodePPPOEtest02);
535	UtRegisterTest("DecodePPPOEtest03", DecodePPPOEtest03);
536	UtRegisterTest("DecodePPPOEtest04", DecodePPPOEtest04);
537	UtRegisterTest("DecodePPPOEtest05", DecodePPPOEtest05);
538	UtRegisterTest("DecodePPPOEtest06", DecodePPPOEtest06);
539	UtRegisterTest("DecodePPPOEtest07", DecodePPPOEtest07);
540	UtRegisterTest("DecodePPPOEtest08", DecodePPPOEtest08);
541	UtRegisterTest("DecodePPPOEtest09", DecodePPPOEtest09);
542	UtRegisterTest("DecodePPPOEtest10", DecodePPPOEtest10);
543	#endif /* UNITTESTS */
UNCOV 544	}	×
545
546	/**
547	* @}
548	*/

OISF / suricata / 23374838686

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous