1 /* 2 * Copyright (c) 1998-2011 The TCPDUMP project 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that: (1) source code 6 * distributions retain the above copyright notice and this paragraph 7 * in its entirety, and (2) distributions including binary code include 8 * the above copyright notice and this paragraph in its entirety in 9 * the documentation or other materials provided with the distribution. 10 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND 11 * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT 12 * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 13 * FOR A PARTICULAR PURPOSE. 14 * 15 * Original code by Hannes Gredler (hannes@gredler.at) 16 */ 17 18 /* \summary: Resource Public Key Infrastructure (RPKI) to Router Protocol printer */ 19 20 /* specification: RFC 6810 */ 21 22 #ifdef HAVE_CONFIG_H 23 #include "config.h" 24 #endif 25 26 #include <netdissect-stdinc.h> 27 28 #include <string.h> 29 30 #include "netdissect.h" 31 #include "extract.h" 32 #include "addrtoname.h" 33 34 static const char tstr[] = "[|RPKI-RTR]"; 35 36 /* 37 * RPKI/Router PDU header 38 * 39 * Here's what the PDU header looks like. 40 * The length does include the version and length fields. 41 */ 42 typedef struct rpki_rtr_pdu_ { 43 u_char version; /* Version number */ 44 u_char pdu_type; /* PDU type */ 45 union { 46 u_char session_id[2]; /* Session id */ 47 u_char error_code[2]; /* Error code */ 48 } u; 49 u_char length[4]; 50 } rpki_rtr_pdu; 51 #define RPKI_RTR_PDU_OVERHEAD (offsetof(rpki_rtr_pdu, rpki_rtr_pdu_msg)) 52 53 /* 54 * IPv4 Prefix PDU. 55 */ 56 typedef struct rpki_rtr_pdu_ipv4_prefix_ { 57 rpki_rtr_pdu pdu_header; 58 u_char flags; 59 u_char prefix_length; 60 u_char max_length; 61 u_char zero; 62 u_char prefix[4]; 63 u_char as[4]; 64 } rpki_rtr_pdu_ipv4_prefix; 65 66 /* 67 * IPv6 Prefix PDU. 68 */ 69 typedef struct rpki_rtr_pdu_ipv6_prefix_ { 70 rpki_rtr_pdu pdu_header; 71 u_char flags; 72 u_char prefix_length; 73 u_char max_length; 74 u_char zero; 75 u_char prefix[16]; 76 u_char as[4]; 77 } rpki_rtr_pdu_ipv6_prefix; 78 79 /* 80 * Error report PDU. 81 */ 82 typedef struct rpki_rtr_pdu_error_report_ { 83 rpki_rtr_pdu pdu_header; 84 u_char encapsulated_pdu_length[4]; /* Encapsulated PDU length */ 85 /* Copy of Erroneous PDU (variable, optional) */ 86 /* Length of Error Text (4 octets in network byte order) */ 87 /* Arbitrary Text of Error Diagnostic Message (variable, optional) */ 88 } rpki_rtr_pdu_error_report; 89 90 /* 91 * PDU type codes 92 */ 93 #define RPKI_RTR_SERIAL_NOTIFY_PDU 0 94 #define RPKI_RTR_SERIAL_QUERY_PDU 1 95 #define RPKI_RTR_RESET_QUERY_PDU 2 96 #define RPKI_RTR_CACHE_RESPONSE_PDU 3 97 #define RPKI_RTR_IPV4_PREFIX_PDU 4 98 #define RPKI_RTR_IPV6_PREFIX_PDU 6 99 #define RPKI_RTR_END_OF_DATA_PDU 7 100 #define RPKI_RTR_CACHE_RESET_PDU 8 101 #define RPKI_RTR_ERROR_REPORT_PDU 10 102 103 static const struct tok rpki_rtr_pdu_values[] = { 104 { RPKI_RTR_SERIAL_NOTIFY_PDU, "Serial Notify" }, 105 { RPKI_RTR_SERIAL_QUERY_PDU, "Serial Query" }, 106 { RPKI_RTR_RESET_QUERY_PDU, "Reset Query" }, 107 { RPKI_RTR_CACHE_RESPONSE_PDU, "Cache Response" }, 108 { RPKI_RTR_IPV4_PREFIX_PDU, "IPV4 Prefix" }, 109 { RPKI_RTR_IPV6_PREFIX_PDU, "IPV6 Prefix" }, 110 { RPKI_RTR_END_OF_DATA_PDU, "End of Data" }, 111 { RPKI_RTR_CACHE_RESET_PDU, "Cache Reset" }, 112 { RPKI_RTR_ERROR_REPORT_PDU, "Error Report" }, 113 { 0, NULL} 114 }; 115 116 static const struct tok rpki_rtr_error_codes[] = { 117 { 0, "Corrupt Data" }, 118 { 1, "Internal Error" }, 119 { 2, "No Data Available" }, 120 { 3, "Invalid Request" }, 121 { 4, "Unsupported Protocol Version" }, 122 { 5, "Unsupported PDU Type" }, 123 { 6, "Withdrawal of Unknown Record" }, 124 { 7, "Duplicate Announcement Received" }, 125 { 0, NULL} 126 }; 127 128 /* 129 * Build a indentation string for a given indentation level. 130 * XXX this should be really in util.c 131 */ 132 static char * 133 indent_string (u_int indent) 134 { 135 static char buf[20]; 136 u_int idx; 137 138 idx = 0; 139 buf[idx] = '\0'; 140 141 /* 142 * Does the static buffer fit ? 143 */ 144 if (sizeof(buf) < ((indent/8) + (indent %8) + 2)) { 145 return buf; 146 } 147 148 /* 149 * Heading newline. 150 */ 151 buf[idx] = '\n'; 152 idx++; 153 154 while (indent >= 8) { 155 buf[idx] = '\t'; 156 idx++; 157 indent -= 8; 158 } 159 160 while (indent > 0) { 161 buf[idx] = ' '; 162 idx++; 163 indent--; 164 } 165 166 /* 167 * Trailing zero. 168 */ 169 buf[idx] = '\0'; 170 171 return buf; 172 } 173 174 /* 175 * Print a single PDU. 176 */ 177 static u_int 178 rpki_rtr_pdu_print (netdissect_options *ndo, const u_char *tptr, const u_int len, 179 const u_char recurse, const u_int indent) 180 { 181 const rpki_rtr_pdu *pdu_header; 182 u_int pdu_type, pdu_len, hexdump; 183 const u_char *msg; 184 185 /* Protocol Version */ 186 ND_TCHECK_8BITS(tptr); 187 if (*tptr != 0) { 188 /* Skip the rest of the input buffer because even if this is 189 * a well-formed PDU of a future RPKI-Router protocol version 190 * followed by a well-formed PDU of RPKI-Router protocol 191 * version 0, there is no way to know exactly how to skip the 192 * current PDU. 193 */ 194 ND_PRINT((ndo, "%sRPKI-RTRv%u (unknown)", indent_string(8), *tptr)); 195 return len; 196 } 197 if (len < sizeof(rpki_rtr_pdu)) { 198 ND_PRINT((ndo, "(%u bytes is too few to decode)", len)); 199 goto invalid; 200 } 201 ND_TCHECK2(*tptr, sizeof(rpki_rtr_pdu)); 202 pdu_header = (const rpki_rtr_pdu *)tptr; 203 pdu_type = pdu_header->pdu_type; 204 pdu_len = EXTRACT_32BITS(pdu_header->length); 205 /* Do not check bounds with pdu_len yet, do it in the case blocks 206 * below to make it possible to decode at least the beginning of 207 * a truncated Error Report PDU or a truncated encapsulated PDU. 208 */ 209 hexdump = FALSE; 210 211 ND_PRINT((ndo, "%sRPKI-RTRv%u, %s PDU (%u), length: %u", 212 indent_string(8), 213 pdu_header->version, 214 tok2str(rpki_rtr_pdu_values, "Unknown", pdu_type), 215 pdu_type, pdu_len)); 216 if (pdu_len < sizeof(rpki_rtr_pdu) || pdu_len > len) 217 goto invalid; 218 219 switch (pdu_type) { 220 221 /* 222 * The following PDUs share the message format. 223 */ 224 case RPKI_RTR_SERIAL_NOTIFY_PDU: 225 case RPKI_RTR_SERIAL_QUERY_PDU: 226 case RPKI_RTR_END_OF_DATA_PDU: 227 if (pdu_len != sizeof(rpki_rtr_pdu) + 4) 228 goto invalid; 229 ND_TCHECK2(*tptr, pdu_len); 230 msg = (const u_char *)(pdu_header + 1); 231 ND_PRINT((ndo, "%sSession ID: 0x%04x, Serial: %u", 232 indent_string(indent+2), 233 EXTRACT_16BITS(pdu_header->u.session_id), 234 EXTRACT_32BITS(msg))); 235 break; 236 237 /* 238 * The following PDUs share the message format. 239 */ 240 case RPKI_RTR_RESET_QUERY_PDU: 241 case RPKI_RTR_CACHE_RESET_PDU: 242 if (pdu_len != sizeof(rpki_rtr_pdu)) 243 goto invalid; 244 /* no additional boundary to check */ 245 246 /* 247 * Zero payload PDUs. 248 */ 249 break; 250 251 case RPKI_RTR_CACHE_RESPONSE_PDU: 252 if (pdu_len != sizeof(rpki_rtr_pdu)) 253 goto invalid; 254 /* no additional boundary to check */ 255 ND_PRINT((ndo, "%sSession ID: 0x%04x", 256 indent_string(indent+2), 257 EXTRACT_16BITS(pdu_header->u.session_id))); 258 break; 259 260 case RPKI_RTR_IPV4_PREFIX_PDU: 261 { 262 const rpki_rtr_pdu_ipv4_prefix *pdu; 263 264 if (pdu_len != sizeof(rpki_rtr_pdu) + 12) 265 goto invalid; 266 ND_TCHECK2(*tptr, pdu_len); 267 pdu = (const rpki_rtr_pdu_ipv4_prefix *)tptr; 268 ND_PRINT((ndo, "%sIPv4 Prefix %s/%u-%u, origin-as %u, flags 0x%02x", 269 indent_string(indent+2), 270 ipaddr_string(ndo, pdu->prefix), 271 pdu->prefix_length, pdu->max_length, 272 EXTRACT_32BITS(pdu->as), pdu->flags)); 273 } 274 break; 275 276 case RPKI_RTR_IPV6_PREFIX_PDU: 277 { 278 const rpki_rtr_pdu_ipv6_prefix *pdu; 279 280 if (pdu_len != sizeof(rpki_rtr_pdu) + 24) 281 goto invalid; 282 ND_TCHECK2(*tptr, pdu_len); 283 pdu = (const rpki_rtr_pdu_ipv6_prefix *)tptr; 284 ND_PRINT((ndo, "%sIPv6 Prefix %s/%u-%u, origin-as %u, flags 0x%02x", 285 indent_string(indent+2), 286 ip6addr_string(ndo, pdu->prefix), 287 pdu->prefix_length, pdu->max_length, 288 EXTRACT_32BITS(pdu->as), pdu->flags)); 289 } 290 break; 291 292 case RPKI_RTR_ERROR_REPORT_PDU: 293 { 294 const rpki_rtr_pdu_error_report *pdu; 295 u_int encapsulated_pdu_length, text_length, tlen, error_code; 296 297 tlen = sizeof(rpki_rtr_pdu); 298 /* Do not test for the "Length of Error Text" data element yet. */ 299 if (pdu_len < tlen + 4) 300 goto invalid; 301 ND_TCHECK2(*tptr, tlen + 4); 302 /* Safe up to and including the "Length of Encapsulated PDU" 303 * data element, more data elements may be present. 304 */ 305 pdu = (const rpki_rtr_pdu_error_report *)tptr; 306 encapsulated_pdu_length = EXTRACT_32BITS(pdu->encapsulated_pdu_length); 307 tlen += 4; 308 309 error_code = EXTRACT_16BITS(pdu->pdu_header.u.error_code); 310 ND_PRINT((ndo, "%sError code: %s (%u), Encapsulated PDU length: %u", 311 indent_string(indent+2), 312 tok2str(rpki_rtr_error_codes, "Unknown", error_code), 313 error_code, encapsulated_pdu_length)); 314 315 if (encapsulated_pdu_length) { 316 /* Section 5.10 of RFC 6810 says: 317 * "An Error Report PDU MUST NOT be sent for an Error Report PDU." 318 * 319 * However, as far as the protocol encoding goes Error Report PDUs can 320 * happen to be nested in each other, however many times, in which case 321 * the decoder should still print such semantically incorrect PDUs. 322 * 323 * That said, "the Erroneous PDU field MAY be truncated" (ibid), thus 324 * to keep things simple this implementation decodes only the two 325 * outermost layers of PDUs and makes bounds checks in the outer and 326 * the inner PDU independently. 327 */ 328 if (pdu_len < tlen + encapsulated_pdu_length) 329 goto invalid; 330 if (! recurse) { 331 ND_TCHECK2(*tptr, tlen + encapsulated_pdu_length); 332 } 333 else { 334 ND_PRINT((ndo, "%s-----encapsulated PDU-----", indent_string(indent+4))); 335 rpki_rtr_pdu_print(ndo, tptr + tlen, 336 encapsulated_pdu_length, 0, indent + 2); 337 } 338 tlen += encapsulated_pdu_length; 339 } 340 341 if (pdu_len < tlen + 4) 342 goto invalid; 343 ND_TCHECK2(*tptr, tlen + 4); 344 /* Safe up to and including the "Length of Error Text" data element, 345 * one more data element may be present. 346 */ 347 348 /* 349 * Extract, trail-zero and print the Error message. 350 */ 351 text_length = EXTRACT_32BITS(tptr + tlen); 352 tlen += 4; 353 354 if (text_length) { 355 if (pdu_len < tlen + text_length) 356 goto invalid; 357 /* fn_printn() makes the bounds check */ 358 ND_PRINT((ndo, "%sError text: ", indent_string(indent+2))); 359 if (fn_printn(ndo, tptr + tlen, text_length, ndo->ndo_snapend)) 360 goto trunc; 361 } 362 } 363 break; 364 365 default: 366 ND_TCHECK2(*tptr, pdu_len); 367 368 /* 369 * Unknown data, please hexdump. 370 */ 371 hexdump = TRUE; 372 } 373 374 /* do we also want to see a hex dump ? */ 375 if (ndo->ndo_vflag > 1 || (ndo->ndo_vflag && hexdump)) { 376 print_unknown_data(ndo,tptr,"\n\t ", pdu_len); 377 } 378 return pdu_len; 379 380 invalid: 381 ND_PRINT((ndo, "%s", istr)); 382 ND_TCHECK2(*tptr, len); 383 return len; 384 trunc: 385 ND_PRINT((ndo, "\n\t%s", tstr)); 386 return len; 387 } 388 389 void 390 rpki_rtr_print(netdissect_options *ndo, register const u_char *pptr, register u_int len) 391 { 392 if (!ndo->ndo_vflag) { 393 ND_PRINT((ndo, ", RPKI-RTR")); 394 return; 395 } 396 while (len) { 397 u_int pdu_len = rpki_rtr_pdu_print(ndo, pptr, len, 1, 8); 398 len -= pdu_len; 399 pptr += pdu_len; 400 } 401 } 402 403 /* 404 * Local Variables: 405 * c-style: whitesmith 406 * c-basic-offset: 4 407 * End: 408 */ 409