IP Only Engine using radix trees

src/detect-engine-iponly.h

@@ -1,6 +1,33 @@
 #ifndef __DETECT_ENGINE_IPONLY_H__
 #define __DETECT_ENGINE_IPONLY_H__
 
+/**
+ * SigNumArray is a bit array representing signatures
+ * it can be used linked to src/dst address to indicate
+ * which signatures apply to this addres
+ * at IP Only we store SigNumArrays at the radix trees
+ */
+typedef struct SigNumArray_ {
+    uint8_t *array; /* bit array of sig nums */
+    uint32_t size;  /* size in bytes of the array */
+}SigNumArray;
+
+IPOnlyCIDRItem *IPOnlyCIDRItemNew();
+
+IPOnlyCIDRItem *IPOnlyCIDRItemInsertReal(IPOnlyCIDRItem *head, IPOnlyCIDRItem *item);
+IPOnlyCIDRItem *IPOnlyCIDRItemInsert(IPOnlyCIDRItem *head, IPOnlyCIDRItem *item);
+
+void IPOnlyCIDRListFree(IPOnlyCIDRItem *tmphead);
+void IPOnlyCIDRListPrint(IPOnlyCIDRItem *tmphead);
+
+IPOnlyCIDRItem *IPOnlyCIDRListParse2(char *s, int negate);
+
+int IPOnlyCIDRListParse(IPOnlyCIDRItem **gh, char *str);
+int IPOnlySigParseAddress(Signature *s, const char *addrstr, char flag);
+int IPOnlyCIDRItemParseSingle(IPOnlyCIDRItem *dd, char *str);
+int IPOnlyCIDRItemSetup(IPOnlyCIDRItem *gh, char *s);
+
+void IPOnlyCIDRListPrint(IPOnlyCIDRItem *);
 void IPOnlyMatchPacket(DetectEngineCtx *, DetectEngineIPOnlyCtx *, DetectEngineIPOnlyThreadCtx *, Packet *);
 void IPOnlyInit(DetectEngineCtx *, DetectEngineIPOnlyCtx *);
 void IPOnlyPrint(DetectEngineCtx *, DetectEngineIPOnlyCtx *);

src/detect-parse.c

@@ -27,6 +27,7 @@
 #include "util-debug.h"
 #include "string.h"
 #include "detect-parse.h"
+#include "detect-engine-iponly.h"
 
 static pcre *config_pcre = NULL;
 static pcre *option_pcre = NULL;
@@ -580,6 +581,15 @@ int SigParseBasics(Signature *s, char *sigstr, char ***result, uint8_t addrs_dir
 
     if (SigParseAddress(s, arr[CONFIG_DST], SIG_DIREC_DST ^ addrs_direction) < 0)
         goto error;
+
+    /* For IPOnly */
+    if (IPOnlySigParseAddress(s, arr[CONFIG_SRC], SIG_DIREC_SRC ^ addrs_direction) < 0)
+       goto error;
+
+    if (IPOnlySigParseAddress(s, arr[CONFIG_DST], SIG_DIREC_DST ^ addrs_direction) < 0)
+        goto error;
+
+
     /* For "ip" we parse the ports as well, even though they will be just "any".
      *  We do this for later sgh building for the tcp and udp protocols. */
     if (DetectProtoContainsProto(&s->proto, IPPROTO_TCP) ||
@@ -614,7 +624,7 @@ int SigParse(DetectEngineCtx *de_ctx, Signature *s, char *sigstr, uint8_t addrs_
 
     int ret = SigParseBasics(s, sigstr, &basics, addrs_direction);
     if (ret < 0) {
-        //printf("SigParseBasics failed\n");
+        printf("SigParseBasics failed\n");
         SCReturnInt(-1);
     }
 

src/detect.c

@@ -518,6 +518,9 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
                                    (p->flow->flags & FLOW_TOCLIENT_IPONLY_SET)))) {
         /* Get the result of the first IPOnlyMatch() */
         if (p->flow->flags & FLOW_ACTION_DROP) p->action |= ACTION_DROP;
+    } else {
+        /* Even without flow we should match the packet src/dst */
+        IPOnlyMatchPacket(de_ctx, &de_ctx->io_ctx, &det_ctx->io_ctx, p);
     }
 
     /* we assume we have an uri when we start inspection */

src/detect.h

@@ -13,6 +13,7 @@
 #include "util-hashlist.h"
 #include "util-debug.h"
 #include "util-error.h"
+#include "util-radix-tree.h"
 
 #include "detect-threshold.h"
 
@@ -175,11 +176,21 @@ typedef struct DetectPort_ {
 /* Detection Engine flags */
 #define DE_QUIET           0x01     /**< DE is quiet (esp for unittests) */
 
-typedef struct DetectEngineIPOnlyThreadCtx_ {
-    DetectAddress *src, *dst;
-    uint8_t *sig_match_array; /* bit array of sig nums */
-    uint32_t sig_match_size;  /* size in bytes of the array */
-} DetectEngineIPOnlyThreadCtx;
+typedef struct IPOnlyCIDRItem_ {
+    /* address data for this item */
+    uint8_t family;
+    uint32_t ip[4];
+    /* netmask in CIDR values (ex. /16 /18 /24..) */
+    uint8_t netmask;
+
+    /* If this host or net is negated for the signum */
+    uint8_t negated;
+    SigIntId signum; /**< our internal id */
+
+    /* linked list, the header should be the biggest network */
+    struct IPOnlyCIDRItem_ *next;
+
+} IPOnlyCIDRItem;
 
 /** \brief Signature container */
 typedef struct Signature_ {
@@ -202,6 +213,9 @@ typedef struct Signature_ {
     DetectProto proto;
     DetectPort *sp, *dp;
 
+    /** netblocks and hosts specified at the sid, in CIDR format */
+    IPOnlyCIDRItem *CidrSrc, *CidrDst;
+
     /** ptr to the SigMatch lists */
     struct SigMatch_ *match; /* non-payload matches */
     struct SigMatch_ *match_tail; /* non-payload matches, tail of the list */
@@ -226,6 +240,11 @@ typedef struct Signature_ {
     uint16_t sm_cnt;
 } Signature;
 
+typedef struct DetectEngineIPOnlyThreadCtx_ {
+    uint8_t *sig_match_array; /* bit array of sig nums */
+    uint32_t sig_match_size;  /* size in bytes of the array */
+} DetectEngineIPOnlyThreadCtx;
+
 /** \brief IP only rules matching ctx.
  *  \todo a radix tree would be great here */
 typedef struct DetectEngineIPOnlyCtx_ {
@@ -233,6 +252,13 @@ typedef struct DetectEngineIPOnlyCtx_ {
     HashListTable *ht16_src, *ht16_dst;
     HashListTable *ht24_src, *ht24_dst;
 
+    /* Lookup trees */
+    SCRadixTree *tree_ipv4src, *tree_ipv4dst;
+    SCRadixTree *tree_ipv6src, *tree_ipv6dst;
+
+    /* Used to build the radix trees */
+    IPOnlyCIDRItem *ip_src, *ip_dst;
+
     /* counters */
     uint32_t a_src_uniq16, a_src_total16;
     uint32_t a_dst_uniq16, a_dst_total16;

src/reputation.c

@@ -34,7 +34,7 @@ IPReputationCtx *SCReputationInitCtx() {
     }
     memset(rep_ctx,0,sizeof(IPReputationCtx));
 
-    rep_ctx->reputationIPV4_tree = SCRadixCreateRadixTree(SCReputationFreeData);
+    rep_ctx->reputationIPV4_tree = SCRadixCreateRadixTree(SCReputationFreeData, NULL);
     if (rep_ctx->reputationIPV4_tree == NULL) {
         SCLogDebug("Error initializing Reputation IPV4 module");
         return NULL;
@@ -42,7 +42,7 @@ IPReputationCtx *SCReputationInitCtx() {
 
     SCLogDebug("Reputation IPV4 module initialized");
 
-    rep_ctx->reputationIPV6_tree = SCRadixCreateRadixTree(SCReputationFreeData);
+    rep_ctx->reputationIPV6_tree = SCRadixCreateRadixTree(SCReputationFreeData, NULL);
     if (rep_ctx->reputationIPV6_tree == NULL) {
         SCLogDebug("Error initializing Reputation IPV6 module");
         return NULL;

src/util-clock.h

@@ -12,6 +12,6 @@
 
 #define CLOCK_PRINT_SEC     printf("Seconds spent: %.4fs\n", ((clo2 - clo1)/(double)CLOCKS_PER_SEC))
 
-#define GET_CLOCK_END_SECS  ((clo - clo1)/(double)CLOCKS_PER_SEC)
+#define GET_CLOCK_END_SECS  ((clo1 - clo2)/(double)CLOCKS_PER_SEC)
 
 #endif /*__UTIL_CLOCK_H__ */

src/util-error.c

@@ -73,6 +73,7 @@ const char * SCErrorToString(SCError err)
         CASE_CODE (SC_ERR_POOL_INIT);
         CASE_CODE (SC_ERR_UNIMPLEMENTED);
         CASE_CODE (SC_ERR_FAST_LOG_GENERIC);
+        CASE_CODE (SC_ERR_IPONLY_RADIX);
         CASE_CODE (SC_ERR_DEBUG_LOG_GENERIC);
         CASE_CODE (SC_ERR_UNIFIED_LOG_GENERIC);
         CASE_CODE (SC_ERR_HTTP_LOG_GENERIC);

src/util-error.h

@@ -96,6 +96,7 @@ typedef enum {
     SC_ERR_DAEMON,
     SC_ERR_UNIMPLEMENTED,
     SC_ERR_ADDRESS_ENGINE_GENERIC,
+    SC_ERR_IPONLY_RADIX,
     SC_ERR_FAST_LOG_GENERIC,
     SC_ERR_DEBUG_LOG_GENERIC,
     SC_ERR_UNIFIED_LOG_GENERIC,

src/util-host-os-info.c

@@ -199,7 +199,7 @@ int SCHInfoAddHostOSInfo(char *host_os, char *host_os_ip_range, int is_ipv4)
 
     /* create the radix tree that would hold all the host os info */
     if (sc_hinfo_tree == NULL)
-        sc_hinfo_tree = SCRadixCreateRadixTree(SCHInfoFreeUserDataOSPolicy);
+        sc_hinfo_tree = SCRadixCreateRadixTree(SCHInfoFreeUserDataOSPolicy, NULL);
 
     /* the host os flavour that has to be sent as user data */
     if ( (user_data = SCHInfoAllocUserDataOSPolicy(host_os)) == NULL) {

src/util-radix-tree.c

@@ -204,7 +204,7 @@ static SCRadixPrefix *SCRadixCreatePrefix(uint8_t *key_stream,
 {
     SCRadixPrefix *prefix = NULL;
 
-    if ((key_bitlen % 8 != 0) || key_bitlen == 0) {
+    if ((key_bitlen % 8 != 0)) {
         SCLogError(SC_ERR_INVALID_ARGUMENT, "Invalid argument bitlen - %d",
                    key_bitlen);
         return NULL;
@@ -408,7 +408,7 @@ static int SCRadixPrefixContainNetmaskAndSetUserData(SCRadixPrefix *prefix,
         }
     }
 
- no_match:
+no_match:
     return 0;
 }
 
@@ -486,7 +486,7 @@ static inline void SCRadixReleaseNode(SCRadixNode *node, SCRadixTree *tree)
  *
  * \retval tree The newly created radix tree on success
  */
-SCRadixTree *SCRadixCreateRadixTree(void (*Free)(void*))
+SCRadixTree *SCRadixCreateRadixTree(void (*Free)(void*), void (*PrintData)(void*))
 {
     SCRadixTree *tree = NULL;
 
@@ -497,6 +497,7 @@ SCRadixTree *SCRadixCreateRadixTree(void (*Free)(void*))
     memset(tree, 0, sizeof(SCRadixTree));
 
     tree->Free = Free;
+    tree->PrintData = PrintData;
 
     return tree;
 }
@@ -526,7 +527,8 @@ static void SCRadixReleaseRadixSubtree(SCRadixNode *node, SCRadixTree *tree)
  */
 void SCRadixReleaseRadixTree(SCRadixTree *tree)
 {
-    SCRadixReleaseRadixSubtree(tree->head, tree);
+    if (tree != NULL)
+        SCRadixReleaseRadixSubtree(tree->head, tree);
 
     tree->head = NULL;
 
@@ -1414,6 +1416,48 @@ SCRadixNode *SCRadixFindKeyIPV4BestMatch(uint8_t *key_stream, SCRadixTree *tree)
     return SCRadixFindKey(key_stream, 32, tree, 0);
 }
 
+/**
+ * \brief Checks if an IPV4 Netblock address is present in the tree
+ *
+ * \param key_stream Data that has to be found in the Radix tree.  In this case
+ *                   an IPV4  netblock address
+ * \param tree       Pointer to the Radix tree instance
+ */
+SCRadixNode *SCRadixFindKeyIPV4Netblock(uint8_t *key_stream, SCRadixTree *tree,
+                                        uint8_t netmask)
+{
+    SCRadixNode *node = NULL;
+    node = SCRadixFindKey(key_stream, 32, tree, 0);
+    if (node == NULL)
+        return node;
+
+    if (SCRadixPrefixContainNetmaskAndSetUserData(node->prefix, netmask, 1))
+        return node;
+    else
+        return NULL;
+}
+
+/**
+ * \brief Checks if an IPV6 Netblock address is present in the tree
+ *
+ * \param key_stream Data that has to be found in the Radix tree.  In this case
+ *                   an IPV6  netblock address
+ * \param tree       Pointer to the Radix tree instance
+ */
+SCRadixNode *SCRadixFindKeyIPV6Netblock(uint8_t *key_stream, SCRadixTree *tree,
+                                        uint8_t netmask)
+{
+    SCRadixNode *node = NULL;
+    node = SCRadixFindKey(key_stream, 128, tree, 0);
+    if (node == NULL)
+        return node;
+
+    if (SCRadixPrefixContainNetmaskAndSetUserData(node->prefix, (uint16_t)netmask, 1))
+        return node;
+    else
+        return NULL;
+}
+
 /**
  * \brief Checks if an IPV6 address is present in the tree
  *
@@ -1444,7 +1488,7 @@ SCRadixNode *SCRadixFindKeyIPV6BestMatch(uint8_t *key_stream, SCRadixTree *tree)
  * \param node  Pointer to the Radix node whose information has to be printed
  * \param level Used for indentation purposes
  */
-static void SCRadixPrintNodeInfo(SCRadixNode *node, int level)
+void SCRadixPrintNodeInfo(SCRadixNode *node, int level,  void (*PrintData)(void*))
 {
     int i = 0;
 
@@ -1469,7 +1513,21 @@ static void SCRadixPrintNodeInfo(SCRadixNode *node, int level)
                 printf(".");
             printf("%d", node->prefix->stream[i]);
         }
-        printf(")\n");
+        printf(")");
+
+        if (PrintData != NULL) {
+            SCRadixUserData *ud = NULL;
+            do {
+                ud = node->prefix->user_data;
+                printf(" [%d], ", ud->netmask);
+                PrintData(ud->user);
+                ud = ud->next;
+            } while (ud != NULL);
+        } else {
+            printf("No print function provided");
+        }
+        printf("\n");
+
     } else {
         printf("NULL)\n");
     }
@@ -1484,12 +1542,12 @@ static void SCRadixPrintNodeInfo(SCRadixNode *node, int level)
  * \param node  Pointer to the node that is the root of the subtree to be printed
  * \param level Used for indentation purposes
  */
-static void SCRadixPrintRadixSubtree(SCRadixNode *node, int level)
+static void SCRadixPrintRadixSubtree(SCRadixNode *node, int level, void (*PrintData)(void*))
 {
     if (node != NULL) {
-        SCRadixPrintNodeInfo(node, level);
-        SCRadixPrintRadixSubtree(node->left, level + 1);
-        SCRadixPrintRadixSubtree(node->right, level + 1);
+        SCRadixPrintNodeInfo(node, level, PrintData);
+        SCRadixPrintRadixSubtree(node->left, level + 1, PrintData);
+        SCRadixPrintRadixSubtree(node->right, level + 1, PrintData);
     }
 
     return;
@@ -1517,7 +1575,7 @@ void SCRadixPrintTree(SCRadixTree *tree)
 {
     printf("Printing the Radix Tree: \n");
 
-    SCRadixPrintRadixSubtree(tree->head, 0);
+    SCRadixPrintRadixSubtree(tree->head, 0, tree->PrintData);
 
     return;
 }
@@ -1533,7 +1591,8 @@ int SCRadixTestInsertion01(void)
 
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
+
 
     node[0] = SCRadixAddKeyGeneric((uint8_t *)"abaa", 32, tree, NULL);
     node[1] = SCRadixAddKeyGeneric((uint8_t *)"abab", 32, tree, NULL);
@@ -1552,7 +1611,7 @@ int SCRadixTestInsertion02(void)
     SCRadixTree *tree = NULL;
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
 
     SCRadixAddKeyGeneric((uint8_t *)"aaaaaa", 48, tree, NULL);
     SCRadixAddKeyGeneric((uint8_t *)"aaaaab", 48, tree, NULL);
@@ -1570,7 +1629,7 @@ int SCRadixTestIPV4Insertion03(void)
     struct sockaddr_in servaddr;
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
 
     /* add the keys */
     bzero(&servaddr, sizeof(servaddr));
@@ -1681,7 +1740,7 @@ int SCRadixTestIPV4Removal04(void)
     struct sockaddr_in servaddr;
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
 
     /* add the keys */
     bzero(&servaddr, sizeof(servaddr));
@@ -1792,7 +1851,7 @@ int SCRadixTestCharacterInsertion05(void)
     SCRadixTree *tree = NULL;
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
 
     /* Let us have our team here ;-) */
     SCRadixAddKeyGeneric((uint8_t *)"Victor", 48, tree, NULL);
@@ -1832,7 +1891,7 @@ int SCRadixTestCharacterRemoval06(void)
     SCRadixTree *tree = NULL;
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
 
     /* Let us have our team here ;-) */
     SCRadixAddKeyGeneric((uint8_t *)"Victor", 48, tree, NULL);
@@ -1887,7 +1946,7 @@ int SCRadixTestIPV6Insertion07(void)
     struct sockaddr_in6 servaddr;
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
 
     /* add the keys */
     bzero(&servaddr, sizeof(servaddr));
@@ -2001,7 +2060,7 @@ int SCRadixTestIPV6Removal08(void)
     struct sockaddr_in6 servaddr;
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
 
     /* add the keys */
     bzero(&servaddr, sizeof(servaddr));
@@ -2240,7 +2299,7 @@ int SCRadixTestIPV4NetblockInsertion09(void)
     struct sockaddr_in servaddr;
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
 
     /* add the keys */
     bzero(&servaddr, sizeof(servaddr));
@@ -2350,7 +2409,7 @@ int SCRadixTestIPV4NetblockInsertion10(void)
     struct sockaddr_in servaddr;
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
 
     /* add the keys */
     bzero(&servaddr, sizeof(servaddr));
@@ -2457,7 +2516,7 @@ int SCRadixTestIPV4NetblockInsertion11(void)
     struct sockaddr_in servaddr;
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
 
     /* add the keys */
     bzero(&servaddr, sizeof(servaddr));
@@ -2625,7 +2684,7 @@ int SCRadixTestIPV4NetblockInsertion12(void)
     struct sockaddr_in servaddr;
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
 
     /* add the keys */
     bzero(&servaddr, sizeof(servaddr));
@@ -2749,7 +2808,7 @@ int SCRadixTestIPV6NetblockInsertion13(void)
     struct sockaddr_in6 servaddr;
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
 
     /* add the keys */
     bzero(&servaddr, sizeof(servaddr));
@@ -2880,7 +2939,7 @@ int SCRadixTestIPV6NetblockInsertion14(void)
     struct sockaddr_in6 servaddr;
     int result = 1;
 
-    tree = SCRadixCreateRadixTree(NULL);
+    tree = SCRadixCreateRadixTree(NULL, NULL);
 
     /* add the keys */
     bzero(&servaddr, sizeof(servaddr));

src/util-radix-tree.h

@@ -73,6 +73,7 @@ typedef struct SCRadixTree_ {
 
     /* function pointer that is supplied by the user to free the user data
      * held by the user field of SCRadixNode */
+    void (*PrintData)(void *);
     void (*Free)(void *);
 } SCRadixTree;
 
@@ -81,7 +82,7 @@ struct in_addr *SCRadixValidateIPV4Address(const char *);
 struct in6_addr *SCRadixValidateIPV6Address(const char *);
 void SCRadixChopIPAddressAgainstNetmask(uint8_t *, uint8_t, uint16_t);
 
-SCRadixTree *SCRadixCreateRadixTree(void (*Free)(void*));
+SCRadixTree *SCRadixCreateRadixTree(void (*Free)(void*), void (*PrintData)(void*));
 void SCRadixReleaseRadixTree(SCRadixTree *);
 
 SCRadixNode *SCRadixAddKeyGeneric(uint8_t *, uint16_t, SCRadixTree *, void *);
@@ -99,12 +100,17 @@ void SCRadixRemoveKeyIPV6Netblock(uint8_t *, SCRadixTree *, uint8_t);
 void SCRadixRemoveKeyIPV6(uint8_t *, SCRadixTree *);
 
 SCRadixNode *SCRadixFindKeyGeneric(uint8_t *, uint16_t, SCRadixTree *);
+
 SCRadixNode *SCRadixFindKeyIPV4ExactMatch(uint8_t *, SCRadixTree *);
+SCRadixNode *SCRadixFindKeyIPV4Netblock(uint8_t *, SCRadixTree *, uint8_t);
 SCRadixNode *SCRadixFindKeyIPV4BestMatch(uint8_t *, SCRadixTree *);
+
 SCRadixNode *SCRadixFindKeyIPV6ExactMatch(uint8_t *, SCRadixTree *);
+SCRadixNode *SCRadixFindKeyIPV6Netblock(uint8_t *, SCRadixTree *, uint8_t);
 SCRadixNode *SCRadixFindKeyIPV6BestMatch(uint8_t *, SCRadixTree *);
 
 void SCRadixPrintTree(SCRadixTree *);
+void SCRadixPrintNodeInfo(SCRadixNode *, int,  void (*PrintData)(void*));
 
 void SCRadixRegisterTests(void);
 

src/util-unittest-helper.c

@@ -17,6 +17,67 @@
 #include <stdarg.h>
 #include "detect-engine.h"
 
+/**
+ * \brief UTHBuildPacketReal is a function that create tcp/udp packets for unittests
+ * specifying ip and port sources and destinations (IPV6)
+ *
+ * \param payload pointer to the payloadd buffer
+ * \param payload_len pointer to the length of the payload
+ * \param ipproto Protocols allowed atm are IPPROTO_TCP and IPPROTO_UDP
+ * \param src pointer to a string containing the ip source
+ * \param dst pointer to a string containing the ip destination
+ * \param sport pointer to a string containing the port source
+ * \param dport pointer to a string containing the port destination
+ *
+ * \retval Packet pointer to the built in packet
+ */
+Packet *UTHBuildPacketIPV6Real(uint8_t *payload, uint16_t payload_len,
+                           uint16_t ipproto, char *src, char *dst,
+                           uint16_t sport, uint16_t dport) {
+    uint32_t in[4];
+
+    Packet *p = SCMalloc(sizeof(Packet));
+    if (p == NULL) {
+        SCLogError(SC_ERR_MEM_ALLOC, "Error allocating packet");
+        exit(EXIT_FAILURE);
+    }
+    memset(p, 0, sizeof(Packet));
+
+    p->src.family = AF_INET6;
+    p->dst.family = AF_INET6;
+    p->payload = payload;
+    p->payload_len = payload_len;
+    p->proto = ipproto;
+
+    inet_pton(AF_INET6, src, &in);
+    p->src.addr_data32[0] = in[0];
+    p->src.addr_data32[1] = in[1];
+    p->src.addr_data32[2] = in[2];
+    p->src.addr_data32[3] = in[3];
+    p->sp = sport;
+
+    inet_pton(AF_INET6, dst, &in);
+    p->dst.addr_data32[0] = in[0];
+    p->dst.addr_data32[1] = in[1];
+    p->dst.addr_data32[2] = in[2];
+    p->dst.addr_data32[3] = in[3];
+    p->dp = dport;
+
+    p->ip6h = SCMalloc(sizeof(IPV6Hdr));
+    if (p->ip6h == NULL) {
+       SCLogError(SC_ERR_MEM_ALLOC, "Error allocating packet ip6h");
+        exit(EXIT_FAILURE);
+    }
+    p->tcph = SCMalloc(sizeof(TCPHdr));
+    if (p->tcph == NULL) {
+        SCLogError(SC_ERR_MEM_ALLOC, "Error allocating packet tcph");
+        exit(EXIT_FAILURE);
+    }
+    p->tcph->th_sport = sport;
+    p->tcph->th_dport = dport;
+    return p;
+}
+
 /**
  * \brief UTHBuildPacketReal is a function that create tcp/udp packets for unittests
  * specifying ip and port sources and destinations
@@ -200,6 +261,23 @@ Packet *UTHBuildPacketSrcDst(uint8_t *payload, uint16_t payload_len,
                               41424, 80);
 }
 
+/**
+ * \brief UTHBuildPacketSrcDst is a wrapper that build packets specifying IPs
+ * and defaulting ports (IPV6)
+ *
+ * \param payload pointer to the payloadd buffer
+ * \param payload_len pointer to the length of the payload
+ * \param ipproto Protocols allowed atm are IPPROTO_TCP and IPPROTO_UDP
+ *
+ * \retval Packet pointer to the built in packet
+ */
+Packet *UTHBuildPacketIPV6SrcDst(uint8_t *payload, uint16_t payload_len,
+                           uint16_t ipproto, char *src, char *dst) {
+    return UTHBuildPacketIPV6Real(payload, payload_len, ipproto,
+                              src, dst,
+                              41424, 80);
+}
+
 /**
  * \brief UTHBuildPacketSrcDstPorts is a wrapper that build packets specifying
  * src and dst ports and defaulting IPs
@@ -277,7 +355,7 @@ void UTHFreePacket(Packet *p) {
  * \param sigs array of char* pointing to signatures to load
  * \param numsigs number of signatures to load and check
  * \param results pointer to arrays of numbers, each of them foreach packet
- *                to check if sids matches that packet as espected with
+ *                to check if sids matches that packet as expected with
  *                that number of times or not. The size of results should be
  *                numpkts * numsigs * sizeof(uint16_t *)
  *
@@ -340,7 +418,7 @@ int UTHCheckPacketMatchResults(Packet *p, uint32_t sids[], uint32_t results[], i
     for (; i < numsids; i++) {
         uint16_t r = PacketAlertCheck(p, sids[i]);
         if (r != results[i]) {
-            SCLogInfo("Sid %"PRIu32" matched %"PRIu16" times, and not %"PRIu16" as espected", sids[i], r, results[i]);
+            SCLogInfo("Sid %"PRIu32" matched %"PRIu16" times, and not %"PRIu16" as expected", sids[i], r, results[i]);
             res = 0;
         } else {
             SCLogInfo("Sid %"PRIu32" matched %"PRIu16" times, as expected", sids[i], r);

src/util-unittest-helper.h

@@ -6,6 +6,8 @@ Packet *UTHBuildPacket(uint8_t *, uint16_t, uint16_t);
 Packet *UTHBuildPacketSrcDst(uint8_t *, uint16_t, uint16_t, char *, char *);
 Packet *UTHBuildPacketSrcDstPorts(uint8_t *, uint16_t, uint16_t, uint16_t, uint16_t);
 
+Packet *UTHBuildPacketIPV6SrcDst(uint8_t *, uint16_t, uint16_t, char *, char *);
+
 int UTHPacketMatchSigMpm(Packet *, char *, uint16_t);
 Packet **UTHBuildPacketArrayFromEth(uint8_t **, int *, int);
 Packet *UTHBuildPacketFromEth(uint8_t *, uint16_t);