• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (c) 1998-2011 The TCPDUMP project
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that: (1) source code
6  * distributions retain the above copyright notice and this paragraph
7  * in its entirety, and (2) distributions including binary code include
8  * the above copyright notice and this paragraph in its entirety in
9  * the documentation or other materials provided with the distribution.
10  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
11  * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
12  * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
13  * FOR A PARTICULAR PURPOSE.
14  *
15  * Original code by Hannes Gredler (hannes@gredler.at)
16  */
17 
18 /* \summary: Resource Public Key Infrastructure (RPKI) to Router Protocol printer */
19 
20 /* specification: RFC 6810 */
21 
22 #ifdef HAVE_CONFIG_H
23 #include "config.h"
24 #endif
25 
26 #include <netdissect-stdinc.h>
27 
28 #include <string.h>
29 
30 #include "netdissect.h"
31 #include "extract.h"
32 #include "addrtoname.h"
33 
34 static const char tstr[] = "[|RPKI-RTR]";
35 
36 /*
37  * RPKI/Router PDU header
38  *
39  * Here's what the PDU header looks like.
40  * The length does include the version and length fields.
41  */
42 typedef struct rpki_rtr_pdu_ {
43     u_char version;		/* Version number */
44     u_char pdu_type;		/* PDU type */
45     union {
46 	u_char session_id[2];	/* Session id */
47 	u_char error_code[2];	/* Error code */
48     } u;
49     u_char length[4];
50 } rpki_rtr_pdu;
51 #define RPKI_RTR_PDU_OVERHEAD (offsetof(rpki_rtr_pdu, rpki_rtr_pdu_msg))
52 
53 /*
54  * IPv4 Prefix PDU.
55  */
56 typedef struct rpki_rtr_pdu_ipv4_prefix_ {
57     rpki_rtr_pdu pdu_header;
58     u_char flags;
59     u_char prefix_length;
60     u_char max_length;
61     u_char zero;
62     u_char prefix[4];
63     u_char as[4];
64 } rpki_rtr_pdu_ipv4_prefix;
65 
66 /*
67  * IPv6 Prefix PDU.
68  */
69 typedef struct rpki_rtr_pdu_ipv6_prefix_ {
70     rpki_rtr_pdu pdu_header;
71     u_char flags;
72     u_char prefix_length;
73     u_char max_length;
74     u_char zero;
75     u_char prefix[16];
76     u_char as[4];
77 } rpki_rtr_pdu_ipv6_prefix;
78 
79 /*
80  * Error report PDU.
81  */
82 typedef struct rpki_rtr_pdu_error_report_ {
83     rpki_rtr_pdu pdu_header;
84     u_char encapsulated_pdu_length[4]; /* Encapsulated PDU length */
85     /* Copy of Erroneous PDU (variable, optional) */
86     /* Length of Error Text (4 octets in network byte order) */
87     /* Arbitrary Text of Error Diagnostic Message (variable, optional) */
88 } rpki_rtr_pdu_error_report;
89 
90 /*
91  * PDU type codes
92  */
93 #define RPKI_RTR_SERIAL_NOTIFY_PDU	0
94 #define RPKI_RTR_SERIAL_QUERY_PDU	1
95 #define RPKI_RTR_RESET_QUERY_PDU	2
96 #define RPKI_RTR_CACHE_RESPONSE_PDU	3
97 #define RPKI_RTR_IPV4_PREFIX_PDU	4
98 #define RPKI_RTR_IPV6_PREFIX_PDU	6
99 #define RPKI_RTR_END_OF_DATA_PDU	7
100 #define RPKI_RTR_CACHE_RESET_PDU	8
101 #define RPKI_RTR_ERROR_REPORT_PDU	10
102 
103 static const struct tok rpki_rtr_pdu_values[] = {
104     { RPKI_RTR_SERIAL_NOTIFY_PDU, "Serial Notify" },
105     { RPKI_RTR_SERIAL_QUERY_PDU, "Serial Query" },
106     { RPKI_RTR_RESET_QUERY_PDU, "Reset Query" },
107     { RPKI_RTR_CACHE_RESPONSE_PDU, "Cache Response" },
108     { RPKI_RTR_IPV4_PREFIX_PDU, "IPV4 Prefix" },
109     { RPKI_RTR_IPV6_PREFIX_PDU, "IPV6 Prefix" },
110     { RPKI_RTR_END_OF_DATA_PDU, "End of Data" },
111     { RPKI_RTR_CACHE_RESET_PDU, "Cache Reset" },
112     { RPKI_RTR_ERROR_REPORT_PDU, "Error Report" },
113     { 0, NULL}
114 };
115 
116 static const struct tok rpki_rtr_error_codes[] = {
117     { 0, "Corrupt Data" },
118     { 1, "Internal Error" },
119     { 2, "No Data Available" },
120     { 3, "Invalid Request" },
121     { 4, "Unsupported Protocol Version" },
122     { 5, "Unsupported PDU Type" },
123     { 6, "Withdrawal of Unknown Record" },
124     { 7, "Duplicate Announcement Received" },
125     { 0, NULL}
126 };
127 
128 /*
129  * Build a indentation string for a given indentation level.
130  * XXX this should be really in util.c
131  */
132 static char *
indent_string(u_int indent)133 indent_string (u_int indent)
134 {
135     static char buf[20];
136     u_int idx;
137 
138     idx = 0;
139     buf[idx] = '\0';
140 
141     /*
142      * Does the static buffer fit ?
143      */
144     if (sizeof(buf) < ((indent/8) + (indent %8) + 2)) {
145 	return buf;
146     }
147 
148     /*
149      * Heading newline.
150      */
151     buf[idx] = '\n';
152     idx++;
153 
154     while (indent >= 8) {
155 	buf[idx] = '\t';
156 	idx++;
157 	indent -= 8;
158     }
159 
160     while (indent > 0) {
161 	buf[idx] = ' ';
162 	idx++;
163 	indent--;
164     }
165 
166     /*
167      * Trailing zero.
168      */
169     buf[idx] = '\0';
170 
171     return buf;
172 }
173 
174 /*
175  * Print a single PDU.
176  */
177 static u_int
rpki_rtr_pdu_print(netdissect_options * ndo,const u_char * tptr,const u_int len,const u_char recurse,const u_int indent)178 rpki_rtr_pdu_print (netdissect_options *ndo, const u_char *tptr, const u_int len,
179 	const u_char recurse, const u_int indent)
180 {
181     const rpki_rtr_pdu *pdu_header;
182     u_int pdu_type, pdu_len, hexdump;
183     const u_char *msg;
184 
185     /* Protocol Version */
186     ND_TCHECK_8BITS(tptr);
187     if (*tptr != 0) {
188 	/* Skip the rest of the input buffer because even if this is
189 	 * a well-formed PDU of a future RPKI-Router protocol version
190 	 * followed by a well-formed PDU of RPKI-Router protocol
191 	 * version 0, there is no way to know exactly how to skip the
192 	 * current PDU.
193 	 */
194 	ND_PRINT((ndo, "%sRPKI-RTRv%u (unknown)", indent_string(8), *tptr));
195 	return len;
196     }
197     if (len < sizeof(rpki_rtr_pdu)) {
198 	ND_PRINT((ndo, "(%u bytes is too few to decode)", len));
199 	goto invalid;
200     }
201     ND_TCHECK2(*tptr, sizeof(rpki_rtr_pdu));
202     pdu_header = (const rpki_rtr_pdu *)tptr;
203     pdu_type = pdu_header->pdu_type;
204     pdu_len = EXTRACT_32BITS(pdu_header->length);
205     /* Do not check bounds with pdu_len yet, do it in the case blocks
206      * below to make it possible to decode at least the beginning of
207      * a truncated Error Report PDU or a truncated encapsulated PDU.
208      */
209     hexdump = FALSE;
210 
211     ND_PRINT((ndo, "%sRPKI-RTRv%u, %s PDU (%u), length: %u",
212 	   indent_string(8),
213 	   pdu_header->version,
214 	   tok2str(rpki_rtr_pdu_values, "Unknown", pdu_type),
215 	   pdu_type, pdu_len));
216     if (pdu_len < sizeof(rpki_rtr_pdu) || pdu_len > len)
217 	goto invalid;
218 
219     switch (pdu_type) {
220 
221 	/*
222 	 * The following PDUs share the message format.
223 	 */
224     case RPKI_RTR_SERIAL_NOTIFY_PDU:
225     case RPKI_RTR_SERIAL_QUERY_PDU:
226     case RPKI_RTR_END_OF_DATA_PDU:
227 	if (pdu_len != sizeof(rpki_rtr_pdu) + 4)
228 	    goto invalid;
229 	ND_TCHECK2(*tptr, pdu_len);
230         msg = (const u_char *)(pdu_header + 1);
231 	ND_PRINT((ndo, "%sSession ID: 0x%04x, Serial: %u",
232 	       indent_string(indent+2),
233 	       EXTRACT_16BITS(pdu_header->u.session_id),
234 	       EXTRACT_32BITS(msg)));
235 	break;
236 
237 	/*
238 	 * The following PDUs share the message format.
239 	 */
240     case RPKI_RTR_RESET_QUERY_PDU:
241     case RPKI_RTR_CACHE_RESET_PDU:
242 	if (pdu_len != sizeof(rpki_rtr_pdu))
243 	    goto invalid;
244 	/* no additional boundary to check */
245 
246 	/*
247 	 * Zero payload PDUs.
248 	 */
249 	break;
250 
251     case RPKI_RTR_CACHE_RESPONSE_PDU:
252 	if (pdu_len != sizeof(rpki_rtr_pdu))
253 	    goto invalid;
254 	/* no additional boundary to check */
255 	ND_PRINT((ndo, "%sSession ID: 0x%04x",
256 	       indent_string(indent+2),
257 	       EXTRACT_16BITS(pdu_header->u.session_id)));
258 	break;
259 
260     case RPKI_RTR_IPV4_PREFIX_PDU:
261 	{
262 	    const rpki_rtr_pdu_ipv4_prefix *pdu;
263 
264 	    if (pdu_len != sizeof(rpki_rtr_pdu) + 12)
265 		goto invalid;
266 	    ND_TCHECK2(*tptr, pdu_len);
267 	    pdu = (const rpki_rtr_pdu_ipv4_prefix *)tptr;
268 	    ND_PRINT((ndo, "%sIPv4 Prefix %s/%u-%u, origin-as %u, flags 0x%02x",
269 		   indent_string(indent+2),
270 		   ipaddr_string(ndo, pdu->prefix),
271 		   pdu->prefix_length, pdu->max_length,
272 		   EXTRACT_32BITS(pdu->as), pdu->flags));
273 	}
274 	break;
275 
276     case RPKI_RTR_IPV6_PREFIX_PDU:
277 	{
278 	    const rpki_rtr_pdu_ipv6_prefix *pdu;
279 
280 	    if (pdu_len != sizeof(rpki_rtr_pdu) + 24)
281 		goto invalid;
282 	    ND_TCHECK2(*tptr, pdu_len);
283 	    pdu = (const rpki_rtr_pdu_ipv6_prefix *)tptr;
284 	    ND_PRINT((ndo, "%sIPv6 Prefix %s/%u-%u, origin-as %u, flags 0x%02x",
285 		   indent_string(indent+2),
286 		   ip6addr_string(ndo, pdu->prefix),
287 		   pdu->prefix_length, pdu->max_length,
288 		   EXTRACT_32BITS(pdu->as), pdu->flags));
289 	}
290 	break;
291 
292     case RPKI_RTR_ERROR_REPORT_PDU:
293 	{
294 	    const rpki_rtr_pdu_error_report *pdu;
295 	    u_int encapsulated_pdu_length, text_length, tlen, error_code;
296 
297 	    tlen = sizeof(rpki_rtr_pdu);
298 	    /* Do not test for the "Length of Error Text" data element yet. */
299 	    if (pdu_len < tlen + 4)
300 		goto invalid;
301 	    ND_TCHECK2(*tptr, tlen + 4);
302 	    /* Safe up to and including the "Length of Encapsulated PDU"
303 	     * data element, more data elements may be present.
304 	     */
305 	    pdu = (const rpki_rtr_pdu_error_report *)tptr;
306 	    encapsulated_pdu_length = EXTRACT_32BITS(pdu->encapsulated_pdu_length);
307 	    tlen += 4;
308 
309 	    error_code = EXTRACT_16BITS(pdu->pdu_header.u.error_code);
310 	    ND_PRINT((ndo, "%sError code: %s (%u), Encapsulated PDU length: %u",
311 		   indent_string(indent+2),
312 		   tok2str(rpki_rtr_error_codes, "Unknown", error_code),
313 		   error_code, encapsulated_pdu_length));
314 
315 	    if (encapsulated_pdu_length) {
316 		/* Section 5.10 of RFC 6810 says:
317 		 * "An Error Report PDU MUST NOT be sent for an Error Report PDU."
318 		 *
319 		 * However, as far as the protocol encoding goes Error Report PDUs can
320 		 * happen to be nested in each other, however many times, in which case
321 		 * the decoder should still print such semantically incorrect PDUs.
322 		 *
323 		 * That said, "the Erroneous PDU field MAY be truncated" (ibid), thus
324 		 * to keep things simple this implementation decodes only the two
325 		 * outermost layers of PDUs and makes bounds checks in the outer and
326 		 * the inner PDU independently.
327 		 */
328 		if (pdu_len < tlen + encapsulated_pdu_length)
329 		    goto invalid;
330 		if (! recurse) {
331 		    ND_TCHECK2(*tptr, tlen + encapsulated_pdu_length);
332 		}
333 		else {
334 		    ND_PRINT((ndo, "%s-----encapsulated PDU-----", indent_string(indent+4)));
335 		    rpki_rtr_pdu_print(ndo, tptr + tlen,
336 			encapsulated_pdu_length, 0, indent + 2);
337 		}
338 		tlen += encapsulated_pdu_length;
339 	    }
340 
341 	    if (pdu_len < tlen + 4)
342 		goto invalid;
343 	    ND_TCHECK2(*tptr, tlen + 4);
344 	    /* Safe up to and including the "Length of Error Text" data element,
345 	     * one more data element may be present.
346 	     */
347 
348 	    /*
349 	     * Extract, trail-zero and print the Error message.
350 	     */
351 	    text_length = EXTRACT_32BITS(tptr + tlen);
352 	    tlen += 4;
353 
354 	    if (text_length) {
355 		if (pdu_len < tlen + text_length)
356 		    goto invalid;
357 		/* fn_printn() makes the bounds check */
358 		ND_PRINT((ndo, "%sError text: ", indent_string(indent+2)));
359 		if (fn_printn(ndo, tptr + tlen, text_length, ndo->ndo_snapend))
360 			goto trunc;
361 	    }
362 	}
363 	break;
364 
365     default:
366 	ND_TCHECK2(*tptr, pdu_len);
367 
368 	/*
369 	 * Unknown data, please hexdump.
370 	 */
371 	hexdump = TRUE;
372     }
373 
374     /* do we also want to see a hex dump ? */
375     if (ndo->ndo_vflag > 1 || (ndo->ndo_vflag && hexdump)) {
376 	print_unknown_data(ndo,tptr,"\n\t  ", pdu_len);
377     }
378     return pdu_len;
379 
380 invalid:
381     ND_PRINT((ndo, "%s", istr));
382     ND_TCHECK2(*tptr, len);
383     return len;
384 trunc:
385     ND_PRINT((ndo, "\n\t%s", tstr));
386     return len;
387 }
388 
389 void
rpki_rtr_print(netdissect_options * ndo,register const u_char * pptr,register u_int len)390 rpki_rtr_print(netdissect_options *ndo, register const u_char *pptr, register u_int len)
391 {
392     if (!ndo->ndo_vflag) {
393 	ND_PRINT((ndo, ", RPKI-RTR"));
394 	return;
395     }
396     while (len) {
397 	u_int pdu_len = rpki_rtr_pdu_print(ndo, pptr, len, 1, 8);
398 	len -= pdu_len;
399 	pptr += pdu_len;
400     }
401 }
402 
403 /*
404  * Local Variables:
405  * c-style: whitesmith
406  * c-basic-offset: 4
407  * End:
408  */
409