1 /*
2 * Copyright (c) 1998-2011 The TCPDUMP project
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that: (1) source code
6 * distributions retain the above copyright notice and this paragraph
7 * in its entirety, and (2) distributions including binary code include
8 * the above copyright notice and this paragraph in its entirety in
9 * the documentation or other materials provided with the distribution.
10 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
11 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
12 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
13 * FOR A PARTICULAR PURPOSE.
14 *
15 * Original code by Hannes Gredler (hannes@gredler.at)
16 */
17
18 /* \summary: Resource Public Key Infrastructure (RPKI) to Router Protocol printer */
19
20 /* specification: RFC 6810 */
21
22 #ifdef HAVE_CONFIG_H
23 #include "config.h"
24 #endif
25
26 #include <netdissect-stdinc.h>
27
28 #include <string.h>
29
30 #include "netdissect.h"
31 #include "extract.h"
32 #include "addrtoname.h"
33
34 static const char tstr[] = "[|RPKI-RTR]";
35
36 /*
37 * RPKI/Router PDU header
38 *
39 * Here's what the PDU header looks like.
40 * The length does include the version and length fields.
41 */
42 typedef struct rpki_rtr_pdu_ {
43 u_char version; /* Version number */
44 u_char pdu_type; /* PDU type */
45 union {
46 u_char session_id[2]; /* Session id */
47 u_char error_code[2]; /* Error code */
48 } u;
49 u_char length[4];
50 } rpki_rtr_pdu;
51 #define RPKI_RTR_PDU_OVERHEAD (offsetof(rpki_rtr_pdu, rpki_rtr_pdu_msg))
52
53 /*
54 * IPv4 Prefix PDU.
55 */
56 typedef struct rpki_rtr_pdu_ipv4_prefix_ {
57 rpki_rtr_pdu pdu_header;
58 u_char flags;
59 u_char prefix_length;
60 u_char max_length;
61 u_char zero;
62 u_char prefix[4];
63 u_char as[4];
64 } rpki_rtr_pdu_ipv4_prefix;
65
66 /*
67 * IPv6 Prefix PDU.
68 */
69 typedef struct rpki_rtr_pdu_ipv6_prefix_ {
70 rpki_rtr_pdu pdu_header;
71 u_char flags;
72 u_char prefix_length;
73 u_char max_length;
74 u_char zero;
75 u_char prefix[16];
76 u_char as[4];
77 } rpki_rtr_pdu_ipv6_prefix;
78
79 /*
80 * Error report PDU.
81 */
82 typedef struct rpki_rtr_pdu_error_report_ {
83 rpki_rtr_pdu pdu_header;
84 u_char encapsulated_pdu_length[4]; /* Encapsulated PDU length */
85 /* Copy of Erroneous PDU (variable, optional) */
86 /* Length of Error Text (4 octets in network byte order) */
87 /* Arbitrary Text of Error Diagnostic Message (variable, optional) */
88 } rpki_rtr_pdu_error_report;
89
90 /*
91 * PDU type codes
92 */
93 #define RPKI_RTR_SERIAL_NOTIFY_PDU 0
94 #define RPKI_RTR_SERIAL_QUERY_PDU 1
95 #define RPKI_RTR_RESET_QUERY_PDU 2
96 #define RPKI_RTR_CACHE_RESPONSE_PDU 3
97 #define RPKI_RTR_IPV4_PREFIX_PDU 4
98 #define RPKI_RTR_IPV6_PREFIX_PDU 6
99 #define RPKI_RTR_END_OF_DATA_PDU 7
100 #define RPKI_RTR_CACHE_RESET_PDU 8
101 #define RPKI_RTR_ERROR_REPORT_PDU 10
102
103 static const struct tok rpki_rtr_pdu_values[] = {
104 { RPKI_RTR_SERIAL_NOTIFY_PDU, "Serial Notify" },
105 { RPKI_RTR_SERIAL_QUERY_PDU, "Serial Query" },
106 { RPKI_RTR_RESET_QUERY_PDU, "Reset Query" },
107 { RPKI_RTR_CACHE_RESPONSE_PDU, "Cache Response" },
108 { RPKI_RTR_IPV4_PREFIX_PDU, "IPV4 Prefix" },
109 { RPKI_RTR_IPV6_PREFIX_PDU, "IPV6 Prefix" },
110 { RPKI_RTR_END_OF_DATA_PDU, "End of Data" },
111 { RPKI_RTR_CACHE_RESET_PDU, "Cache Reset" },
112 { RPKI_RTR_ERROR_REPORT_PDU, "Error Report" },
113 { 0, NULL}
114 };
115
116 static const struct tok rpki_rtr_error_codes[] = {
117 { 0, "Corrupt Data" },
118 { 1, "Internal Error" },
119 { 2, "No Data Available" },
120 { 3, "Invalid Request" },
121 { 4, "Unsupported Protocol Version" },
122 { 5, "Unsupported PDU Type" },
123 { 6, "Withdrawal of Unknown Record" },
124 { 7, "Duplicate Announcement Received" },
125 { 0, NULL}
126 };
127
128 /*
129 * Build a indentation string for a given indentation level.
130 * XXX this should be really in util.c
131 */
132 static char *
indent_string(u_int indent)133 indent_string (u_int indent)
134 {
135 static char buf[20];
136 u_int idx;
137
138 idx = 0;
139 buf[idx] = '\0';
140
141 /*
142 * Does the static buffer fit ?
143 */
144 if (sizeof(buf) < ((indent/8) + (indent %8) + 2)) {
145 return buf;
146 }
147
148 /*
149 * Heading newline.
150 */
151 buf[idx] = '\n';
152 idx++;
153
154 while (indent >= 8) {
155 buf[idx] = '\t';
156 idx++;
157 indent -= 8;
158 }
159
160 while (indent > 0) {
161 buf[idx] = ' ';
162 idx++;
163 indent--;
164 }
165
166 /*
167 * Trailing zero.
168 */
169 buf[idx] = '\0';
170
171 return buf;
172 }
173
174 /*
175 * Print a single PDU.
176 */
177 static u_int
rpki_rtr_pdu_print(netdissect_options * ndo,const u_char * tptr,const u_int len,const u_char recurse,const u_int indent)178 rpki_rtr_pdu_print (netdissect_options *ndo, const u_char *tptr, const u_int len,
179 const u_char recurse, const u_int indent)
180 {
181 const rpki_rtr_pdu *pdu_header;
182 u_int pdu_type, pdu_len, hexdump;
183 const u_char *msg;
184
185 /* Protocol Version */
186 ND_TCHECK_8BITS(tptr);
187 if (*tptr != 0) {
188 /* Skip the rest of the input buffer because even if this is
189 * a well-formed PDU of a future RPKI-Router protocol version
190 * followed by a well-formed PDU of RPKI-Router protocol
191 * version 0, there is no way to know exactly how to skip the
192 * current PDU.
193 */
194 ND_PRINT((ndo, "%sRPKI-RTRv%u (unknown)", indent_string(8), *tptr));
195 return len;
196 }
197 if (len < sizeof(rpki_rtr_pdu)) {
198 ND_PRINT((ndo, "(%u bytes is too few to decode)", len));
199 goto invalid;
200 }
201 ND_TCHECK2(*tptr, sizeof(rpki_rtr_pdu));
202 pdu_header = (const rpki_rtr_pdu *)tptr;
203 pdu_type = pdu_header->pdu_type;
204 pdu_len = EXTRACT_32BITS(pdu_header->length);
205 /* Do not check bounds with pdu_len yet, do it in the case blocks
206 * below to make it possible to decode at least the beginning of
207 * a truncated Error Report PDU or a truncated encapsulated PDU.
208 */
209 hexdump = FALSE;
210
211 ND_PRINT((ndo, "%sRPKI-RTRv%u, %s PDU (%u), length: %u",
212 indent_string(8),
213 pdu_header->version,
214 tok2str(rpki_rtr_pdu_values, "Unknown", pdu_type),
215 pdu_type, pdu_len));
216 if (pdu_len < sizeof(rpki_rtr_pdu) || pdu_len > len)
217 goto invalid;
218
219 switch (pdu_type) {
220
221 /*
222 * The following PDUs share the message format.
223 */
224 case RPKI_RTR_SERIAL_NOTIFY_PDU:
225 case RPKI_RTR_SERIAL_QUERY_PDU:
226 case RPKI_RTR_END_OF_DATA_PDU:
227 if (pdu_len != sizeof(rpki_rtr_pdu) + 4)
228 goto invalid;
229 ND_TCHECK2(*tptr, pdu_len);
230 msg = (const u_char *)(pdu_header + 1);
231 ND_PRINT((ndo, "%sSession ID: 0x%04x, Serial: %u",
232 indent_string(indent+2),
233 EXTRACT_16BITS(pdu_header->u.session_id),
234 EXTRACT_32BITS(msg)));
235 break;
236
237 /*
238 * The following PDUs share the message format.
239 */
240 case RPKI_RTR_RESET_QUERY_PDU:
241 case RPKI_RTR_CACHE_RESET_PDU:
242 if (pdu_len != sizeof(rpki_rtr_pdu))
243 goto invalid;
244 /* no additional boundary to check */
245
246 /*
247 * Zero payload PDUs.
248 */
249 break;
250
251 case RPKI_RTR_CACHE_RESPONSE_PDU:
252 if (pdu_len != sizeof(rpki_rtr_pdu))
253 goto invalid;
254 /* no additional boundary to check */
255 ND_PRINT((ndo, "%sSession ID: 0x%04x",
256 indent_string(indent+2),
257 EXTRACT_16BITS(pdu_header->u.session_id)));
258 break;
259
260 case RPKI_RTR_IPV4_PREFIX_PDU:
261 {
262 const rpki_rtr_pdu_ipv4_prefix *pdu;
263
264 if (pdu_len != sizeof(rpki_rtr_pdu) + 12)
265 goto invalid;
266 ND_TCHECK2(*tptr, pdu_len);
267 pdu = (const rpki_rtr_pdu_ipv4_prefix *)tptr;
268 ND_PRINT((ndo, "%sIPv4 Prefix %s/%u-%u, origin-as %u, flags 0x%02x",
269 indent_string(indent+2),
270 ipaddr_string(ndo, pdu->prefix),
271 pdu->prefix_length, pdu->max_length,
272 EXTRACT_32BITS(pdu->as), pdu->flags));
273 }
274 break;
275
276 case RPKI_RTR_IPV6_PREFIX_PDU:
277 {
278 const rpki_rtr_pdu_ipv6_prefix *pdu;
279
280 if (pdu_len != sizeof(rpki_rtr_pdu) + 24)
281 goto invalid;
282 ND_TCHECK2(*tptr, pdu_len);
283 pdu = (const rpki_rtr_pdu_ipv6_prefix *)tptr;
284 ND_PRINT((ndo, "%sIPv6 Prefix %s/%u-%u, origin-as %u, flags 0x%02x",
285 indent_string(indent+2),
286 ip6addr_string(ndo, pdu->prefix),
287 pdu->prefix_length, pdu->max_length,
288 EXTRACT_32BITS(pdu->as), pdu->flags));
289 }
290 break;
291
292 case RPKI_RTR_ERROR_REPORT_PDU:
293 {
294 const rpki_rtr_pdu_error_report *pdu;
295 u_int encapsulated_pdu_length, text_length, tlen, error_code;
296
297 tlen = sizeof(rpki_rtr_pdu);
298 /* Do not test for the "Length of Error Text" data element yet. */
299 if (pdu_len < tlen + 4)
300 goto invalid;
301 ND_TCHECK2(*tptr, tlen + 4);
302 /* Safe up to and including the "Length of Encapsulated PDU"
303 * data element, more data elements may be present.
304 */
305 pdu = (const rpki_rtr_pdu_error_report *)tptr;
306 encapsulated_pdu_length = EXTRACT_32BITS(pdu->encapsulated_pdu_length);
307 tlen += 4;
308
309 error_code = EXTRACT_16BITS(pdu->pdu_header.u.error_code);
310 ND_PRINT((ndo, "%sError code: %s (%u), Encapsulated PDU length: %u",
311 indent_string(indent+2),
312 tok2str(rpki_rtr_error_codes, "Unknown", error_code),
313 error_code, encapsulated_pdu_length));
314
315 if (encapsulated_pdu_length) {
316 /* Section 5.10 of RFC 6810 says:
317 * "An Error Report PDU MUST NOT be sent for an Error Report PDU."
318 *
319 * However, as far as the protocol encoding goes Error Report PDUs can
320 * happen to be nested in each other, however many times, in which case
321 * the decoder should still print such semantically incorrect PDUs.
322 *
323 * That said, "the Erroneous PDU field MAY be truncated" (ibid), thus
324 * to keep things simple this implementation decodes only the two
325 * outermost layers of PDUs and makes bounds checks in the outer and
326 * the inner PDU independently.
327 */
328 if (pdu_len < tlen + encapsulated_pdu_length)
329 goto invalid;
330 if (! recurse) {
331 ND_TCHECK2(*tptr, tlen + encapsulated_pdu_length);
332 }
333 else {
334 ND_PRINT((ndo, "%s-----encapsulated PDU-----", indent_string(indent+4)));
335 rpki_rtr_pdu_print(ndo, tptr + tlen,
336 encapsulated_pdu_length, 0, indent + 2);
337 }
338 tlen += encapsulated_pdu_length;
339 }
340
341 if (pdu_len < tlen + 4)
342 goto invalid;
343 ND_TCHECK2(*tptr, tlen + 4);
344 /* Safe up to and including the "Length of Error Text" data element,
345 * one more data element may be present.
346 */
347
348 /*
349 * Extract, trail-zero and print the Error message.
350 */
351 text_length = EXTRACT_32BITS(tptr + tlen);
352 tlen += 4;
353
354 if (text_length) {
355 if (pdu_len < tlen + text_length)
356 goto invalid;
357 /* fn_printn() makes the bounds check */
358 ND_PRINT((ndo, "%sError text: ", indent_string(indent+2)));
359 if (fn_printn(ndo, tptr + tlen, text_length, ndo->ndo_snapend))
360 goto trunc;
361 }
362 }
363 break;
364
365 default:
366 ND_TCHECK2(*tptr, pdu_len);
367
368 /*
369 * Unknown data, please hexdump.
370 */
371 hexdump = TRUE;
372 }
373
374 /* do we also want to see a hex dump ? */
375 if (ndo->ndo_vflag > 1 || (ndo->ndo_vflag && hexdump)) {
376 print_unknown_data(ndo,tptr,"\n\t ", pdu_len);
377 }
378 return pdu_len;
379
380 invalid:
381 ND_PRINT((ndo, "%s", istr));
382 ND_TCHECK2(*tptr, len);
383 return len;
384 trunc:
385 ND_PRINT((ndo, "\n\t%s", tstr));
386 return len;
387 }
388
389 void
rpki_rtr_print(netdissect_options * ndo,register const u_char * pptr,register u_int len)390 rpki_rtr_print(netdissect_options *ndo, register const u_char *pptr, register u_int len)
391 {
392 if (!ndo->ndo_vflag) {
393 ND_PRINT((ndo, ", RPKI-RTR"));
394 return;
395 }
396 while (len) {
397 u_int pdu_len = rpki_rtr_pdu_print(ndo, pptr, len, 1, 8);
398 len -= pdu_len;
399 pptr += pdu_len;
400 }
401 }
402
403 /*
404 * Local Variables:
405 * c-style: whitesmith
406 * c-basic-offset: 4
407 * End:
408 */
409