diff --git a/src/Sessions.cc b/src/Sessions.cc index a5b054b933..675cc240c6 100644 --- a/src/Sessions.cc +++ b/src/Sessions.cc @@ -600,8 +600,7 @@ void NetSessions::DoNextPacket(double t, const struct pcap_pkthdr* hdr, if ( ipv6_ext_headers && ip_hdr->NumHeaders() > 1 ) { pkt_hdr_val = ip_hdr->BuildPktHdrVal(); - // [Robin] This should be ipv6_ext_headers, right? - conn->Event(new_packet, 0, pkt_hdr_val); + conn->Event(ipv6_ext_headers, 0, pkt_hdr_val); } if ( new_packet ) diff --git a/src/bro.bif b/src/bro.bif index ff06288940..375a1c64c1 100644 --- a/src/bro.bif +++ b/src/bro.bif @@ -2049,6 +2049,38 @@ function is_v6_addr%(a: addr%): bool # # =========================================================================== +## Converts the *data* field of :bro:type:`ip6_routing` records that have +## *rtype* of 0 into a set of addresses. +## +## s: The *data* field of an :bro:type:`ip6_routing` record that has +## an *rtype* of 0. +## +## Returns: The set of addresses contained in the routing header data. +function routing0_data_to_addrs%(s: string%): addr_set + %{ + BroType* index_type = base_type(TYPE_ADDR); + TypeList* set_index = new TypeList(index_type); + set_index->Append(index_type); + TableVal* tv = new TableVal(new SetType(set_index, 0)); + + int len = s->Len(); + const u_char* bytes = s->Bytes(); + bytes += 4; // go past 32-bit reserved field + len -= 4; + if ( ( len % 16 ) != 0 ) + reporter->Warning("Bad ip6_routing data length: %d", s->Len()); + + while ( len > 0 ) + { + IPAddr a(IPAddr::IPv6, (const uint32*) bytes, IPAddr::Network); + tv->Assign(new AddrVal(a), 0); + bytes += 16; + len -= 16; + } + + return tv; + %} + ## Converts a :bro:type:`addr` to a :bro:type:`index_vec`. ## ## a: The address to convert into a vector of counts. diff --git a/src/main.cc b/src/main.cc index 6313528980..f5a5b5282f 100644 --- a/src/main.cc +++ b/src/main.cc @@ -837,7 +837,7 @@ int main(int argc, char** argv) if ( dns_type != DNS_PRIME ) net_init(interfaces, read_files, netflows, flow_files, - writefile, "tcp or udp or icmp", + writefile, "", secondary_path->Filter(), do_watchdog); BroFile::SetDefaultRotation(log_rotate_interval, log_max_size); diff --git a/testing/btest/Baseline/bifs.routing0_data_to_addrs/output b/testing/btest/Baseline/bifs.routing0_data_to_addrs/output new file mode 100644 index 0000000000..7179bf8564 --- /dev/null +++ b/testing/btest/Baseline/bifs.routing0_data_to_addrs/output @@ -0,0 +1,4 @@ +{ +2001:78:1:32::1, +2001:78:1:32::2 +} diff --git a/testing/btest/Baseline/core.ipv6-frag/dns.log b/testing/btest/Baseline/core.ipv6-frag/dns.log new file mode 100644 index 0000000000..50c9684bac --- /dev/null +++ b/testing/btest/Baseline/core.ipv6-frag/dns.log @@ -0,0 +1,9 @@ +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path dns +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto trans_id query qclass qclass_name qtype qtype_name rcode rcode_name QR AA TC RD RA Z answers TTLs +#types time string addr port addr port enum count string count string count string count string bool bool bool bool bool count vector[string] vector[interval] +1331084278.438444 UWkUyAuUGXf 2001:470:1f11:81f:d138:5f55:6d4:1fe2 51850 2607:f740:b::f93 53 udp 3903 txtpadding_323.n1.netalyzr.icsi.berkeley.edu 1 C_INTERNET 16 TXT 0 NOERROR F T F T F 0 This TXT record should be ignored 1.000000 +1331084293.592245 arKYeMETxOg 2001:470:1f11:81f:d138:5f55:6d4:1fe2 51851 2607:f740:b::f93 53 udp 40849 txtpadding_3230.n1.netalyzr.icsi.berkeley.edu 1 C_INTERNET 16 TXT 0 NOERROR F T F T F 0 This TXT record should be ignored 1.000000 diff --git a/testing/btest/Baseline/core.ipv6-frag/output b/testing/btest/Baseline/core.ipv6-frag/output new file mode 100644 index 0000000000..5020d94e8d --- /dev/null +++ b/testing/btest/Baseline/core.ipv6-frag/output @@ -0,0 +1,5 @@ +ip6=[hdr=[class=0, flow=0, len=81, nxt=17, hlim=64, src=2001:470:1f11:81f:d138:5f55:6d4:1fe2, dst=2607:f740:b::f93], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[], ext_order=[]], udp = [sport=51850/udp, dport=53/udp, ulen=81] +ip6=[hdr=[class=0, flow=0, len=331, nxt=17, hlim=53, src=2607:f740:b::f93, dst=2001:470:1f11:81f:d138:5f55:6d4:1fe2], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[], ext_order=[]], udp = [sport=53/udp, dport=51850/udp, ulen=331] +ip6=[hdr=[class=0, flow=0, len=82, nxt=17, hlim=64, src=2001:470:1f11:81f:d138:5f55:6d4:1fe2, dst=2607:f740:b::f93], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[], ext_order=[]], udp = [sport=51851/udp, dport=53/udp, ulen=82] +ip6=[hdr=[class=0, flow=0, len=82, nxt=17, hlim=64, src=2001:470:1f11:81f:d138:5f55:6d4:1fe2, dst=2607:f740:b::f93], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[], ext_order=[]], udp = [sport=51851/udp, dport=53/udp, ulen=82] +ip6=[hdr=[class=0, flow=0, len=3238, nxt=17, hlim=53, src=2607:f740:b::f93, dst=2001:470:1f11:81f:d138:5f55:6d4:1fe2], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[], ext_order=[]], udp = [sport=53/udp, dport=51851/udp, ulen=3238] diff --git a/testing/btest/Baseline/core.ipv6_esp/output b/testing/btest/Baseline/core.ipv6_esp/output new file mode 100644 index 0000000000..645b4c8c56 --- /dev/null +++ b/testing/btest/Baseline/core.ipv6_esp/output @@ -0,0 +1,120 @@ +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::2], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=1]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::2], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=2]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::2], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=3]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::2], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=4]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::2], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=5]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::2], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=6]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::2], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=7]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::2], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=8]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::2], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=9]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::2], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=10]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::3], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=1]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::3], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=2]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::3], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=3]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::3], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=4]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::3], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=5]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::3], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=6]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::3], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=7]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::3], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=8]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::3], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=9]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::3], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=10]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::4], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=1]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::4], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=2]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::4], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=3]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::4], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=4]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::4], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=5]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::4], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=6]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::4], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=7]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::4], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=8]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::4], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=9]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::4], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=10]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::5], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=1]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::5], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=2]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::5], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=3]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::5], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=4]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::5], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=5]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::5], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=6]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::5], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=7]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::5], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=8]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::5], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=9]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::5], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=10]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::12], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=1]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::12], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=2]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::12], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=3]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::12], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=4]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::12], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=5]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::12], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=6]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::12], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=7]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::12], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=8]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::12], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=9]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=116, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::12], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=10, seq=10]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::13], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=1]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::13], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=2]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::13], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=3]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::13], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=4]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::13], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=5]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::13], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=6]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::13], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=7]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::13], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=8]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::13], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=9]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::13], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=11, seq=10]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::14], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=1]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::14], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=2]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::14], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=3]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::14], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=4]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::14], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=5]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::14], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=6]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::14], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=7]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::14], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=8]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::14], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=9]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=100, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::14], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=12, seq=10]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::15], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=1]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::15], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=2]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::15], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=3]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::15], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=4]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::15], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=5]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::15], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=6]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::15], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=7]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::15], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=8]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::15], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=9]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::15], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=13, seq=10]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=104, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::22], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=20, seq=1]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=104, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::22], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=20, seq=2]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=104, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::22], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=20, seq=3]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=104, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::22], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=20, seq=4]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=104, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::22], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=20, seq=5]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=104, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::22], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=20, seq=6]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=104, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::22], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=20, seq=7]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=104, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::22], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=20, seq=8]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=104, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::22], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=20, seq=9]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=104, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::22], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=20, seq=10]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::23], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=21, seq=1]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::23], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=21, seq=2]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::23], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=21, seq=3]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::23], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=21, seq=4]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::23], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=21, seq=5]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::23], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=21, seq=6]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::23], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=21, seq=7]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::23], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=21, seq=8]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::23], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=21, seq=9]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::23], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=21, seq=10]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::24], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=22, seq=1]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::24], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=22, seq=2]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::24], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=22, seq=3]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::24], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=22, seq=4]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::24], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=22, seq=5]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::24], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=22, seq=6]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::24], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=22, seq=7]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::24], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=22, seq=8]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::24], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=22, seq=9]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=88, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::24], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=22, seq=10]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=76, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::25], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=23, seq=1]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=76, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::25], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=23, seq=2]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=76, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::25], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=23, seq=3]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=76, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::25], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=23, seq=4]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=76, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::25], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=23, seq=5]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=76, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::25], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=23, seq=6]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=76, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::25], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=23, seq=7]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=76, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::25], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=23, seq=8]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=76, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::25], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=23, seq=9]], ext_order=[50]], tcp=, udp=, icmp=] +[ip=, ip6=[hdr=[class=0, flow=0, len=76, nxt=50, hlim=64, src=3ffe::1, dst=3ffe::25], hopopts=[], dstopts=[], routing=[], fragment=[], ah=[], esp=[[spi=23, seq=10]], ext_order=[50]], tcp=, udp=, icmp=] diff --git a/testing/btest/Baseline/core.ipv6_ext_headers/output b/testing/btest/Baseline/core.ipv6_ext_headers/output new file mode 100644 index 0000000000..4cc9c706ae --- /dev/null +++ b/testing/btest/Baseline/core.ipv6_ext_headers/output @@ -0,0 +1 @@ +[ip=, ip6=[hdr=[class=0, flow=0, len=59, nxt=0, hlim=64, src=2001:4f8:4:7:2e0:81ff:fe52:ffff, dst=2001:4f8:4:7:2e0:81ff:fe52:9a6b], hopopts=[[nxt=43, len=0, options=[[otype=1, len=4, data=\0\0\0\0]]]], dstopts=[], routing=[[nxt=17, len=4, rtype=0, segleft=2, data=\0\0\0\0 ^A\0x\0^A\02\0\0\0\0\0\0\0^A ^A\0x\0^A\02\0\0\0\0\0\0\0^B]], fragment=[], ah=[], esp=[], ext_order=[0, 43]], tcp=, udp=[sport=53/udp, dport=53/udp, ulen=11], icmp=] diff --git a/testing/btest/Traces/ext_hdr_hbh_routing.trace b/testing/btest/Traces/ext_hdr_hbh_routing.trace new file mode 100644 index 0000000000..2a294ed58e Binary files /dev/null and b/testing/btest/Traces/ext_hdr_hbh_routing.trace differ diff --git a/testing/btest/Traces/ip6_esp.trace b/testing/btest/Traces/ip6_esp.trace new file mode 100644 index 0000000000..8b3b19a99a Binary files /dev/null and b/testing/btest/Traces/ip6_esp.trace differ diff --git a/testing/btest/Traces/ipv6-fragmented-dns.trace b/testing/btest/Traces/ipv6-fragmented-dns.trace new file mode 100755 index 0000000000..9dda47a8a9 Binary files /dev/null and b/testing/btest/Traces/ipv6-fragmented-dns.trace differ diff --git a/testing/btest/bifs/routing0_data_to_addrs.test b/testing/btest/bifs/routing0_data_to_addrs.test new file mode 100644 index 0000000000..f150ec2a35 --- /dev/null +++ b/testing/btest/bifs/routing0_data_to_addrs.test @@ -0,0 +1,9 @@ +# @TEST-EXEC: bro -C -b -r $TRACES/ext_hdr_hbh_routing.trace %INPUT >output +# @TEST-EXEC: btest-diff output + +event ipv6_ext_headers(c: connection, p: pkt_hdr) + { + for ( h in p$ip6$routing ) + if ( p$ip6$routing[h]$rtype == 0 ) + print routing0_data_to_addrs(p$ip6$routing[h]$data); + } diff --git a/testing/btest/core/ipv6-frag.test b/testing/btest/core/ipv6-frag.test new file mode 100644 index 0000000000..32c7c0a8c1 --- /dev/null +++ b/testing/btest/core/ipv6-frag.test @@ -0,0 +1,9 @@ +# @TEST-EXEC: bro -r $TRACES/ipv6-fragmented-dns.trace %INPUT >output +# @TEST-EXEC: btest-diff output +# @TEST-EXEC: btest-diff dns.log + +event new_packet(c: connection, p: pkt_hdr) + { + if ( p?$ip6 && p?$ udp ) + print fmt("ip6=%s, udp = %s", p$ip6, p$udp); + } diff --git a/testing/btest/core/ipv6_esp.test b/testing/btest/core/ipv6_esp.test new file mode 100644 index 0000000000..b606c23400 --- /dev/null +++ b/testing/btest/core/ipv6_esp.test @@ -0,0 +1,10 @@ +# @TEST-EXEC: bro -r $TRACES/ip6_esp.trace %INPUT >output +# @TEST-EXEC: btest-diff output + +# Just check that the event is raised correctly for a packet containing +# ESP extension headers. + +event esp_packet(p: pkt_hdr) + { + print p; + } diff --git a/testing/btest/core/ipv6_ext_headers.test b/testing/btest/core/ipv6_ext_headers.test new file mode 100644 index 0000000000..170a67bc72 --- /dev/null +++ b/testing/btest/core/ipv6_ext_headers.test @@ -0,0 +1,10 @@ +# @TEST-EXEC: bro -C -b -r $TRACES/ext_hdr_hbh_routing.trace %INPUT >output +# @TEST-EXEC: btest-diff output + +# Just check that the event is raised correctly for a packet containing +# extension headers. + +event ipv6_ext_headers(c: connection, p: pkt_hdr) + { + print p; + }