1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1983, 1988, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 * 31 * $FreeBSD$ 32 */ 33 34 #include "defs.h" 35 36 #ifdef __NetBSD__ 37 __RCSID("$NetBSD$"); 38 #elif defined(__FreeBSD__) 39 __RCSID("$FreeBSD$"); 40 #else 41 __RCSID("$Revision: 2.26 $"); 42 #ident "$Revision: 2.26 $" 43 #endif 44 45 static void input(struct sockaddr_in *, struct interface *, struct interface *, 46 struct rip *, int); 47 static void input_route(naddr, naddr, struct rt_spare *, struct netinfo *); 48 static int ck_passwd(struct interface *, struct rip *, void *, 49 naddr, struct msg_limit *); 50 51 52 /* process RIP input 53 */ 54 void 55 read_rip(int sock, 56 struct interface *sifp) 57 { 58 struct sockaddr_in from; 59 struct interface *aifp; 60 socklen_t fromlen; 61 int cc; 62 #ifdef USE_PASSIFNAME 63 static struct msg_limit bad_name; 64 struct { 65 char ifname[IFNAMSIZ]; 66 union pkt_buf pbuf; 67 } inbuf; 68 #else 69 struct { 70 union pkt_buf pbuf; 71 } inbuf; 72 #endif 73 74 75 for (;;) { 76 fromlen = sizeof(from); 77 cc = recvfrom(sock, &inbuf, sizeof(inbuf), 0, 78 (struct sockaddr*)&from, &fromlen); 79 if (cc <= 0) { 80 if (cc < 0 && errno != EWOULDBLOCK) 81 LOGERR("recvfrom(rip)"); 82 break; 83 } 84 if (fromlen != sizeof(struct sockaddr_in)) 85 logbad(1,"impossible recvfrom(rip) fromlen=%d", 86 (int)fromlen); 87 88 /* aifp is the "authenticated" interface via which the packet 89 * arrived. In fact, it is only the interface on which 90 * the packet should have arrived based on is source 91 * address. 92 * sifp is interface associated with the socket through which 93 * the packet was received. 94 */ 95 #ifdef USE_PASSIFNAME 96 if ((cc -= sizeof(inbuf.ifname)) < 0) 97 logbad(0,"missing USE_PASSIFNAME; only %d bytes", 98 cc+sizeof(inbuf.ifname)); 99 100 /* check the remote interfaces first */ 101 LIST_FOREACH(aifp, &remote_if, remote_list) { 102 if (aifp->int_addr == from.sin_addr.s_addr) 103 break; 104 } 105 if (aifp == NULL) { 106 aifp = ifwithname(inbuf.ifname, 0); 107 if (aifp == NULL) { 108 msglim(&bad_name, from.sin_addr.s_addr, 109 "impossible interface name %.*s", 110 IFNAMSIZ, inbuf.ifname); 111 } else if (((aifp->int_if_flags & IFF_POINTOPOINT) 112 && aifp->int_dstaddr!=from.sin_addr.s_addr) 113 || (!(aifp->int_if_flags & IFF_POINTOPOINT) 114 && !on_net(from.sin_addr.s_addr, 115 aifp->int_net, 116 aifp->int_mask))) { 117 /* If it came via the wrong interface, do not 118 * trust it. 119 */ 120 aifp = NULL; 121 } 122 } 123 #else 124 aifp = iflookup(from.sin_addr.s_addr); 125 #endif 126 if (sifp == NULL) 127 sifp = aifp; 128 129 input(&from, sifp, aifp, &inbuf.pbuf.rip, cc); 130 } 131 } 132 133 134 /* Process a RIP packet 135 */ 136 static void 137 input(struct sockaddr_in *from, /* received from this IP address */ 138 struct interface *sifp, /* interface of incoming socket */ 139 struct interface *aifp, /* "authenticated" interface */ 140 struct rip *rip, 141 int cc) 142 { 143 # define FROM_NADDR from->sin_addr.s_addr 144 static struct msg_limit use_auth, bad_len, bad_mask; 145 static struct msg_limit unk_router, bad_router, bad_nhop; 146 147 struct rt_entry *rt; 148 struct rt_spare new; 149 struct netinfo *n, *lim; 150 struct interface *ifp1; 151 naddr gate, mask, v1_mask, dst, ddst_h = 0; 152 struct auth *ap; 153 struct tgate *tg = NULL; 154 struct tgate_net *tn; 155 int i, j; 156 157 /* Notice when we hear from a remote gateway 158 */ 159 if (aifp != NULL 160 && (aifp->int_state & IS_REMOTE)) 161 aifp->int_act_time = now.tv_sec; 162 163 trace_rip("Recv", "from", from, sifp, rip, cc); 164 165 if (sifp == NULL) { 166 trace_pkt(" discard a request from an indirect router" 167 " (possibly an attack)"); 168 return; 169 } 170 171 if (rip->rip_vers == 0) { 172 msglim(&bad_router, FROM_NADDR, 173 "RIP version 0, cmd %d, packet received from %s", 174 rip->rip_cmd, naddr_ntoa(FROM_NADDR)); 175 return; 176 } else if (rip->rip_vers > RIPv2) { 177 rip->rip_vers = RIPv2; 178 } 179 if (cc > (int)OVER_MAXPACKETSIZE) { 180 msglim(&bad_router, FROM_NADDR, 181 "packet at least %d bytes too long received from %s", 182 cc-MAXPACKETSIZE, naddr_ntoa(FROM_NADDR)); 183 return; 184 } 185 186 n = rip->rip_nets; 187 lim = (struct netinfo *)((char*)rip + cc); 188 189 /* Notice authentication. 190 * As required by section 4.2 in RFC 1723, discard authenticated 191 * RIPv2 messages, but only if configured for that silliness. 192 * 193 * RIPv2 authentication is lame. Why authenticate queries? 194 * Why should a RIPv2 implementation with authentication disabled 195 * not be able to listen to RIPv2 packets with authentication, while 196 * RIPv1 systems will listen? Crazy! 197 */ 198 if (!auth_ok 199 && rip->rip_vers == RIPv2 200 && n < lim && n->n_family == RIP_AF_AUTH) { 201 msglim(&use_auth, FROM_NADDR, 202 "RIPv2 message with authentication from %s discarded", 203 naddr_ntoa(FROM_NADDR)); 204 return; 205 } 206 207 switch (rip->rip_cmd) { 208 case RIPCMD_REQUEST: 209 /* For mere requests, be a little sloppy about the source 210 */ 211 if (aifp == NULL) 212 aifp = sifp; 213 214 /* Are we talking to ourself or a remote gateway? 215 */ 216 ifp1 = ifwithaddr(FROM_NADDR, 0, 1); 217 if (ifp1) { 218 if (ifp1->int_state & IS_REMOTE) { 219 /* remote gateway */ 220 aifp = ifp1; 221 if (check_remote(aifp)) { 222 aifp->int_act_time = now.tv_sec; 223 (void)if_ok(aifp, "remote "); 224 } 225 } else if (from->sin_port == htons(RIP_PORT)) { 226 trace_pkt(" discard our own RIP request"); 227 return; 228 } 229 } 230 231 /* did the request come from a router? 232 */ 233 if (from->sin_port == htons(RIP_PORT)) { 234 /* yes, ignore the request if RIP is off so that 235 * the router does not depend on us. 236 */ 237 if (rip_sock < 0 238 || (aifp != NULL 239 && IS_RIP_OUT_OFF(aifp->int_state))) { 240 trace_pkt(" discard request while RIP off"); 241 return; 242 } 243 } 244 245 /* According to RFC 1723, we should ignore unauthenticated 246 * queries. That is too silly to bother with. Sheesh! 247 * Are forwarding tables supposed to be secret, when 248 * a bad guy can infer them with test traffic? When RIP 249 * is still the most common router-discovery protocol 250 * and so hosts need to send queries that will be answered? 251 * What about `rtquery`? 252 * Maybe on firewalls you'd care, but not enough to 253 * give up the diagnostic facilities of remote probing. 254 */ 255 256 if (n >= lim) { 257 msglim(&bad_len, FROM_NADDR, "empty request from %s", 258 naddr_ntoa(FROM_NADDR)); 259 return; 260 } 261 if (cc%sizeof(*n) != sizeof(struct rip)%sizeof(*n)) { 262 msglim(&bad_len, FROM_NADDR, 263 "request of bad length (%d) from %s", 264 cc, naddr_ntoa(FROM_NADDR)); 265 } 266 267 if (rip->rip_vers == RIPv2 268 && (aifp == NULL || (aifp->int_state & IS_NO_RIPV1_OUT))) { 269 v12buf.buf->rip_vers = RIPv2; 270 /* If we have a secret but it is a cleartext secret, 271 * do not disclose our secret unless the other guy 272 * already knows it. 273 */ 274 ap = find_auth(aifp); 275 if (ap != NULL && ap->type == RIP_AUTH_PW 276 && n->n_family == RIP_AF_AUTH 277 && !ck_passwd(aifp,rip,lim,FROM_NADDR,&use_auth)) 278 ap = NULL; 279 } else { 280 v12buf.buf->rip_vers = RIPv1; 281 ap = NULL; 282 } 283 clr_ws_buf(&v12buf, ap); 284 285 do { 286 n->n_metric = ntohl(n->n_metric); 287 288 /* A single entry with family RIP_AF_UNSPEC and 289 * metric HOPCNT_INFINITY means "all routes". 290 * We respond to routers only if we are acting 291 * as a supplier, or to anyone other than a router 292 * (i.e. a query). 293 */ 294 if (n->n_family == RIP_AF_UNSPEC 295 && n->n_metric == HOPCNT_INFINITY) { 296 /* Answer a query from a utility program 297 * with all we know. 298 */ 299 if (aifp == NULL) { 300 trace_pkt("ignore remote query"); 301 return; 302 } 303 if (from->sin_port != htons(RIP_PORT)) { 304 /* 305 * insecure: query from non-router node 306 * > 1: allow from distant node 307 * > 0: allow from neighbor node 308 * == 0: deny 309 */ 310 if ((aifp != NULL && insecure > 0) || 311 (aifp == NULL && insecure > 1)) 312 supply(from, aifp, OUT_QUERY, 0, 313 rip->rip_vers, 314 ap != NULL); 315 else 316 trace_pkt("Warning: " 317 "possible attack detected"); 318 return; 319 } 320 321 /* A router trying to prime its tables. 322 * Filter the answer in the about same way 323 * broadcasts are filtered. 324 * 325 * Only answer a router if we are a supplier 326 * to keep an unwary host that is just starting 327 * from picking us as a router. 328 */ 329 if (aifp == NULL) { 330 trace_pkt("ignore distant router"); 331 return; 332 } 333 if (!supplier 334 || IS_RIP_OFF(aifp->int_state)) { 335 trace_pkt("ignore; not supplying"); 336 return; 337 } 338 339 /* Do not answer a RIPv1 router if 340 * we are sending RIPv2. But do offer 341 * poor man's router discovery. 342 */ 343 if ((aifp->int_state & IS_NO_RIPV1_OUT) 344 && rip->rip_vers == RIPv1) { 345 if (!(aifp->int_state & IS_PM_RDISC)) { 346 trace_pkt("ignore; sending RIPv2"); 347 return; 348 } 349 350 v12buf.n->n_family = RIP_AF_INET; 351 v12buf.n->n_dst = RIP_DEFAULT; 352 i = aifp->int_d_metric; 353 if (NULL != (rt = rtget(RIP_DEFAULT, 0))) { 354 j = (rt->rt_metric 355 +aifp->int_metric 356 +aifp->int_adj_outmetric 357 +1); 358 if (i > j) 359 i = j; 360 } 361 v12buf.n->n_metric = htonl(i); 362 v12buf.n++; 363 break; 364 } 365 366 /* Respond with RIPv1 instead of RIPv2 if 367 * that is what we are broadcasting on the 368 * interface to keep the remote router from 369 * getting the wrong initial idea of the 370 * routes we send. 371 */ 372 supply(from, aifp, OUT_UNICAST, 0, 373 (aifp->int_state & IS_NO_RIPV1_OUT) 374 ? RIPv2 : RIPv1, 375 ap != NULL); 376 return; 377 } 378 379 /* Ignore authentication */ 380 if (n->n_family == RIP_AF_AUTH) 381 continue; 382 383 if (n->n_family != RIP_AF_INET) { 384 msglim(&bad_router, FROM_NADDR, 385 "request from %s for unsupported" 386 " (af %d) %s", 387 naddr_ntoa(FROM_NADDR), 388 ntohs(n->n_family), 389 naddr_ntoa(n->n_dst)); 390 return; 391 } 392 393 /* We are being asked about a specific destination. 394 */ 395 dst = n->n_dst; 396 if (!check_dst(dst)) { 397 msglim(&bad_router, FROM_NADDR, 398 "bad queried destination %s from %s", 399 naddr_ntoa(dst), 400 naddr_ntoa(FROM_NADDR)); 401 return; 402 } 403 404 /* decide what mask was intended */ 405 if (rip->rip_vers == RIPv1 406 || 0 == (mask = ntohl(n->n_mask)) 407 || 0 != (ntohl(dst) & ~mask)) 408 mask = ripv1_mask_host(dst, aifp); 409 410 /* try to find the answer */ 411 rt = rtget(dst, mask); 412 if (!rt && dst != RIP_DEFAULT) 413 rt = rtfind(n->n_dst); 414 415 if (v12buf.buf->rip_vers != RIPv1) 416 v12buf.n->n_mask = mask; 417 if (rt == NULL) { 418 /* we do not have the answer */ 419 v12buf.n->n_metric = HOPCNT_INFINITY; 420 } else { 421 /* we have the answer, so compute the 422 * right metric and next hop. 423 */ 424 v12buf.n->n_family = RIP_AF_INET; 425 v12buf.n->n_dst = dst; 426 j = rt->rt_metric+1; 427 if (!aifp) 428 ++j; 429 else 430 j += (aifp->int_metric 431 + aifp->int_adj_outmetric); 432 if (j < HOPCNT_INFINITY) 433 v12buf.n->n_metric = j; 434 else 435 v12buf.n->n_metric = HOPCNT_INFINITY; 436 if (v12buf.buf->rip_vers != RIPv1) { 437 v12buf.n->n_tag = rt->rt_tag; 438 v12buf.n->n_mask = mask; 439 if (aifp != NULL 440 && on_net(rt->rt_gate, 441 aifp->int_net, 442 aifp->int_mask) 443 && rt->rt_gate != aifp->int_addr) 444 v12buf.n->n_nhop = rt->rt_gate; 445 } 446 } 447 v12buf.n->n_metric = htonl(v12buf.n->n_metric); 448 449 /* Stop paying attention if we fill the output buffer. 450 */ 451 if (++v12buf.n >= v12buf.lim) 452 break; 453 } while (++n < lim); 454 455 /* Send the answer about specific routes. 456 */ 457 if (ap != NULL && ap->type == RIP_AUTH_MD5) 458 end_md5_auth(&v12buf, ap); 459 460 if (from->sin_port != htons(RIP_PORT)) { 461 /* query */ 462 (void)output(OUT_QUERY, from, aifp, 463 v12buf.buf, 464 ((char *)v12buf.n - (char*)v12buf.buf)); 465 } else if (supplier) { 466 (void)output(OUT_UNICAST, from, aifp, 467 v12buf.buf, 468 ((char *)v12buf.n - (char*)v12buf.buf)); 469 } else { 470 /* Only answer a router if we are a supplier 471 * to keep an unwary host that is just starting 472 * from picking us an a router. 473 */ 474 ; 475 } 476 return; 477 478 case RIPCMD_TRACEON: 479 case RIPCMD_TRACEOFF: 480 /* Notice that trace messages are turned off for all possible 481 * abuse if _PATH_TRACE is undefined in pathnames.h. 482 * Notice also that because of the way the trace file is 483 * handled in trace.c, no abuse is plausible even if 484 * _PATH_TRACE_ is defined. 485 * 486 * First verify message came from a privileged port. */ 487 if (ntohs(from->sin_port) > IPPORT_RESERVED) { 488 msglog("trace command from untrusted port on %s", 489 naddr_ntoa(FROM_NADDR)); 490 return; 491 } 492 if (aifp == NULL) { 493 msglog("trace command from unknown router %s", 494 naddr_ntoa(FROM_NADDR)); 495 return; 496 } 497 if (rip->rip_cmd == RIPCMD_TRACEON) { 498 rip->rip_tracefile[cc-4] = '\0'; 499 set_tracefile((char*)rip->rip_tracefile, 500 "trace command: %s\n", 0); 501 } else { 502 trace_off("tracing turned off by %s", 503 naddr_ntoa(FROM_NADDR)); 504 } 505 return; 506 507 case RIPCMD_RESPONSE: 508 if (cc%sizeof(*n) != sizeof(struct rip)%sizeof(*n)) { 509 msglim(&bad_len, FROM_NADDR, 510 "response of bad length (%d) from %s", 511 cc, naddr_ntoa(FROM_NADDR)); 512 } 513 514 /* verify message came from a router */ 515 if (from->sin_port != ntohs(RIP_PORT)) { 516 msglim(&bad_router, FROM_NADDR, 517 " discard RIP response from unknown port" 518 " %d on %s", 519 ntohs(from->sin_port), naddr_ntoa(FROM_NADDR)); 520 return; 521 } 522 523 if (rip_sock < 0) { 524 trace_pkt(" discard response while RIP off"); 525 return; 526 } 527 528 /* Are we talking to ourself or a remote gateway? 529 */ 530 ifp1 = ifwithaddr(FROM_NADDR, 0, 1); 531 if (ifp1) { 532 if (ifp1->int_state & IS_REMOTE) { 533 /* remote gateway */ 534 aifp = ifp1; 535 if (check_remote(aifp)) { 536 aifp->int_act_time = now.tv_sec; 537 (void)if_ok(aifp, "remote "); 538 } 539 } else { 540 trace_pkt(" discard our own RIP response"); 541 return; 542 } 543 } 544 545 /* Accept routing packets from routers directly connected 546 * via broadcast or point-to-point networks, and from 547 * those listed in /etc/gateways. 548 */ 549 if (aifp == NULL) { 550 msglim(&unk_router, FROM_NADDR, 551 " discard response from %s" 552 " via unexpected interface", 553 naddr_ntoa(FROM_NADDR)); 554 return; 555 } 556 if (IS_RIP_IN_OFF(aifp->int_state)) { 557 trace_pkt(" discard RIPv%d response" 558 " via disabled interface %s", 559 rip->rip_vers, aifp->int_name); 560 return; 561 } 562 563 if (n >= lim) { 564 msglim(&bad_len, FROM_NADDR, "empty response from %s", 565 naddr_ntoa(FROM_NADDR)); 566 return; 567 } 568 569 if (((aifp->int_state & IS_NO_RIPV1_IN) 570 && rip->rip_vers == RIPv1) 571 || ((aifp->int_state & IS_NO_RIPV2_IN) 572 && rip->rip_vers != RIPv1)) { 573 trace_pkt(" discard RIPv%d response", 574 rip->rip_vers); 575 return; 576 } 577 578 /* Ignore routes via dead interface. 579 */ 580 if (aifp->int_state & IS_BROKE) { 581 trace_pkt("discard response via broken interface %s", 582 aifp->int_name); 583 return; 584 } 585 586 /* If the interface cares, ignore bad routers. 587 * Trace but do not log this problem, because where it 588 * happens, it happens frequently. 589 */ 590 if (aifp->int_state & IS_DISTRUST) { 591 tg = tgates; 592 while (tg->tgate_addr != FROM_NADDR) { 593 tg = tg->tgate_next; 594 if (tg == NULL) { 595 trace_pkt(" discard RIP response" 596 " from untrusted router %s", 597 naddr_ntoa(FROM_NADDR)); 598 return; 599 } 600 } 601 } 602 603 /* Authenticate the packet if we have a secret. 604 * If we do not have any secrets, ignore the error in 605 * RFC 1723 and accept it regardless. 606 */ 607 if (aifp->int_auth[0].type != RIP_AUTH_NONE 608 && rip->rip_vers != RIPv1 609 && !ck_passwd(aifp,rip,lim,FROM_NADDR,&use_auth)) 610 return; 611 612 do { 613 if (n->n_family == RIP_AF_AUTH) 614 continue; 615 616 n->n_metric = ntohl(n->n_metric); 617 dst = n->n_dst; 618 if (n->n_family != RIP_AF_INET 619 && (n->n_family != RIP_AF_UNSPEC 620 || dst != RIP_DEFAULT)) { 621 msglim(&bad_router, FROM_NADDR, 622 "route from %s to unsupported" 623 " address family=%d destination=%s", 624 naddr_ntoa(FROM_NADDR), 625 n->n_family, 626 naddr_ntoa(dst)); 627 continue; 628 } 629 if (!check_dst(dst)) { 630 msglim(&bad_router, FROM_NADDR, 631 "bad destination %s from %s", 632 naddr_ntoa(dst), 633 naddr_ntoa(FROM_NADDR)); 634 return; 635 } 636 if (n->n_metric == 0 637 || n->n_metric > HOPCNT_INFINITY) { 638 msglim(&bad_router, FROM_NADDR, 639 "bad metric %d from %s" 640 " for destination %s", 641 n->n_metric, 642 naddr_ntoa(FROM_NADDR), 643 naddr_ntoa(dst)); 644 return; 645 } 646 647 /* Notice the next-hop. 648 */ 649 gate = FROM_NADDR; 650 if (n->n_nhop != 0) { 651 if (rip->rip_vers == RIPv1) { 652 n->n_nhop = 0; 653 } else { 654 /* Use it only if it is valid. */ 655 if (on_net(n->n_nhop, 656 aifp->int_net, aifp->int_mask) 657 && check_dst(n->n_nhop)) { 658 gate = n->n_nhop; 659 } else { 660 msglim(&bad_nhop, FROM_NADDR, 661 "router %s to %s" 662 " has bad next hop %s", 663 naddr_ntoa(FROM_NADDR), 664 naddr_ntoa(dst), 665 naddr_ntoa(n->n_nhop)); 666 n->n_nhop = 0; 667 } 668 } 669 } 670 671 if (rip->rip_vers == RIPv1 672 || 0 == (mask = ntohl(n->n_mask))) { 673 mask = ripv1_mask_host(dst,aifp); 674 } else if ((ntohl(dst) & ~mask) != 0) { 675 msglim(&bad_mask, FROM_NADDR, 676 "router %s sent bad netmask" 677 " %#lx with %s", 678 naddr_ntoa(FROM_NADDR), 679 (u_long)mask, 680 naddr_ntoa(dst)); 681 continue; 682 } 683 if (rip->rip_vers == RIPv1) 684 n->n_tag = 0; 685 686 /* Adjust metric according to incoming interface.. 687 */ 688 n->n_metric += (aifp->int_metric 689 + aifp->int_adj_inmetric); 690 if (n->n_metric > HOPCNT_INFINITY) 691 n->n_metric = HOPCNT_INFINITY; 692 693 /* Should we trust this route from this router? */ 694 if (tg && (tn = tg->tgate_nets)->mask != 0) { 695 for (i = 0; i < MAX_TGATE_NETS; i++, tn++) { 696 if (on_net(dst, tn->net, tn->mask) 697 && tn->mask <= mask) 698 break; 699 } 700 if (i >= MAX_TGATE_NETS || tn->mask == 0) { 701 trace_pkt(" ignored unauthorized %s", 702 addrname(dst,mask,0)); 703 continue; 704 } 705 } 706 707 /* Recognize and ignore a default route we faked 708 * which is being sent back to us by a machine with 709 * broken split-horizon. 710 * Be a little more paranoid than that, and reject 711 * default routes with the same metric we advertised. 712 */ 713 if (aifp->int_d_metric != 0 714 && dst == RIP_DEFAULT 715 && (int)n->n_metric >= aifp->int_d_metric) 716 continue; 717 718 /* We can receive aggregated RIPv2 routes that must 719 * be broken down before they are transmitted by 720 * RIPv1 via an interface on a subnet. 721 * We might also receive the same routes aggregated 722 * via other RIPv2 interfaces. 723 * This could cause duplicate routes to be sent on 724 * the RIPv1 interfaces. "Longest matching variable 725 * length netmasks" lets RIPv2 listeners understand, 726 * but breaking down the aggregated routes for RIPv1 727 * listeners can produce duplicate routes. 728 * 729 * Breaking down aggregated routes here bloats 730 * the daemon table, but does not hurt the kernel 731 * table, since routes are always aggregated for 732 * the kernel. 733 * 734 * Notice that this does not break down network 735 * routes corresponding to subnets. This is part 736 * of the defense against RS_NET_SYN. 737 */ 738 if (have_ripv1_out 739 && (((rt = rtget(dst,mask)) == NULL 740 || !(rt->rt_state & RS_NET_SYN))) 741 && (v1_mask = ripv1_mask_net(dst,0)) > mask) { 742 ddst_h = v1_mask & -v1_mask; 743 i = (v1_mask & ~mask)/ddst_h; 744 if (i >= 511) { 745 /* Punt if we would have to generate 746 * an unreasonable number of routes. 747 */ 748 if (TRACECONTENTS) 749 trace_misc("accept %s-->%s as 1" 750 " instead of %d routes", 751 addrname(dst,mask,0), 752 naddr_ntoa(FROM_NADDR), 753 i+1); 754 i = 0; 755 } else { 756 mask = v1_mask; 757 } 758 } else { 759 i = 0; 760 } 761 762 new.rts_gate = gate; 763 new.rts_router = FROM_NADDR; 764 new.rts_metric = n->n_metric; 765 new.rts_tag = n->n_tag; 766 new.rts_time = now.tv_sec; 767 new.rts_ifp = aifp; 768 new.rts_de_ag = i; 769 j = 0; 770 for (;;) { 771 input_route(dst, mask, &new, n); 772 if (++j > i) 773 break; 774 dst = htonl(ntohl(dst) + ddst_h); 775 } 776 } while (++n < lim); 777 break; 778 } 779 #undef FROM_NADDR 780 } 781 782 783 /* Process a single input route. 784 */ 785 static void 786 input_route(naddr dst, /* network order */ 787 naddr mask, 788 struct rt_spare *new, 789 struct netinfo *n) 790 { 791 int i; 792 struct rt_entry *rt; 793 struct rt_spare *rts, *rts0; 794 struct interface *ifp1; 795 796 797 /* See if the other guy is telling us to send our packets to him. 798 * Sometimes network routes arrive over a point-to-point link for 799 * the network containing the address(es) of the link. 800 * 801 * If our interface is broken, switch to using the other guy. 802 */ 803 ifp1 = ifwithaddr(dst, 1, 1); 804 if (ifp1 != NULL 805 && (!(ifp1->int_state & IS_BROKE) 806 || (ifp1->int_state & IS_PASSIVE))) 807 return; 808 809 /* Look for the route in our table. 810 */ 811 rt = rtget(dst, mask); 812 813 /* Consider adding the route if we do not already have it. 814 */ 815 if (rt == NULL) { 816 /* Ignore unknown routes being poisoned. 817 */ 818 if (new->rts_metric == HOPCNT_INFINITY) 819 return; 820 821 /* Ignore the route if it points to us */ 822 if (n->n_nhop != 0 823 && ifwithaddr(n->n_nhop, 1, 0) != NULL) 824 return; 825 826 /* If something has not gone crazy and tried to fill 827 * our memory, accept the new route. 828 */ 829 if (total_routes < MAX_ROUTES) 830 rtadd(dst, mask, 0, new); 831 return; 832 } 833 834 /* We already know about the route. Consider this update. 835 * 836 * If (rt->rt_state & RS_NET_SYN), then this route 837 * is the same as a network route we have inferred 838 * for subnets we know, in order to tell RIPv1 routers 839 * about the subnets. 840 * 841 * It is impossible to tell if the route is coming 842 * from a distant RIPv2 router with the standard 843 * netmask because that router knows about the entire 844 * network, or if it is a round-about echo of a 845 * synthetic, RIPv1 network route of our own. 846 * The worst is that both kinds of routes might be 847 * received, and the bad one might have the smaller 848 * metric. Partly solve this problem by never 849 * aggregating into such a route. Also keep it 850 * around as long as the interface exists. 851 */ 852 853 rts0 = rt->rt_spares; 854 for (rts = rts0, i = NUM_SPARES; i != 0; i--, rts++) { 855 if (rts->rts_router == new->rts_router) 856 break; 857 /* Note the worst slot to reuse, 858 * other than the current slot. 859 */ 860 if (rts0 == rt->rt_spares 861 || BETTER_LINK(rt, rts0, rts)) 862 rts0 = rts; 863 } 864 if (i != 0) { 865 /* Found a route from the router already in the table. 866 */ 867 868 /* If the new route is a route broken down from an 869 * aggregated route, and if the previous route is either 870 * not a broken down route or was broken down from a finer 871 * netmask, and if the previous route is current, 872 * then forget this one. 873 */ 874 if (new->rts_de_ag > rts->rts_de_ag 875 && now_stale <= rts->rts_time) 876 return; 877 878 /* Keep poisoned routes around only long enough to pass 879 * the poison on. Use a new timestamp for good routes. 880 */ 881 if (rts->rts_metric == HOPCNT_INFINITY 882 && new->rts_metric == HOPCNT_INFINITY) 883 new->rts_time = rts->rts_time; 884 885 /* If this is an update for the router we currently prefer, 886 * then note it. 887 */ 888 if (i == NUM_SPARES) { 889 rtchange(rt, rt->rt_state, new, 0); 890 /* If the route got worse, check for something better. 891 */ 892 if (new->rts_metric > rts->rts_metric) 893 rtswitch(rt, 0); 894 return; 895 } 896 897 /* This is an update for a spare route. 898 * Finished if the route is unchanged. 899 */ 900 if (rts->rts_gate == new->rts_gate 901 && rts->rts_metric == new->rts_metric 902 && rts->rts_tag == new->rts_tag) { 903 trace_upslot(rt, rts, new); 904 *rts = *new; 905 return; 906 } 907 /* Forget it if it has gone bad. 908 */ 909 if (new->rts_metric == HOPCNT_INFINITY) { 910 rts_delete(rt, rts); 911 return; 912 } 913 914 } else { 915 /* The update is for a route we know about, 916 * but not from a familiar router. 917 * 918 * Ignore the route if it points to us. 919 */ 920 if (n->n_nhop != 0 921 && NULL != ifwithaddr(n->n_nhop, 1, 0)) 922 return; 923 924 /* the loop above set rts0=worst spare */ 925 rts = rts0; 926 927 /* Save the route as a spare only if it has 928 * a better metric than our worst spare. 929 * This also ignores poisoned routes (those 930 * received with metric HOPCNT_INFINITY). 931 */ 932 if (new->rts_metric >= rts->rts_metric) 933 return; 934 } 935 936 trace_upslot(rt, rts, new); 937 *rts = *new; 938 939 /* try to switch to a better route */ 940 rtswitch(rt, rts); 941 } 942 943 944 static int /* 0 if bad */ 945 ck_passwd(struct interface *aifp, 946 struct rip *rip, 947 void *lim, 948 naddr from, 949 struct msg_limit *use_authp) 950 { 951 # define NA (rip->rip_auths) 952 struct netauth *na2; 953 struct auth *ap; 954 MD5_CTX md5_ctx; 955 u_char hash[RIP_AUTH_PW_LEN]; 956 int i, len; 957 958 assert(aifp != NULL); 959 if ((void *)NA >= lim || NA->a_family != RIP_AF_AUTH) { 960 msglim(use_authp, from, "missing password from %s", 961 naddr_ntoa(from)); 962 return 0; 963 } 964 965 /* accept any current (+/- 24 hours) password 966 */ 967 for (ap = aifp->int_auth, i = 0; i < MAX_AUTH_KEYS; i++, ap++) { 968 if (ap->type != NA->a_type 969 || (u_long)ap->start > (u_long)clk.tv_sec+DAY 970 || (u_long)ap->end+DAY < (u_long)clk.tv_sec) 971 continue; 972 973 if (NA->a_type == RIP_AUTH_PW) { 974 if (!memcmp(NA->au.au_pw, ap->key, RIP_AUTH_PW_LEN)) 975 return 1; 976 977 } else { 978 /* accept MD5 secret with the right key ID 979 */ 980 if (NA->au.a_md5.md5_keyid != ap->keyid) 981 continue; 982 983 len = ntohs(NA->au.a_md5.md5_pkt_len); 984 if ((len-sizeof(*rip)) % sizeof(*NA) != 0 985 || len != (char *)lim-(char*)rip-(int)sizeof(*NA)) { 986 msglim(use_authp, from, 987 "wrong MD5 RIPv2 packet length of %d" 988 " instead of %d from %s", 989 len, (int)((char *)lim-(char *)rip 990 -sizeof(*NA)), 991 naddr_ntoa(from)); 992 return 0; 993 } 994 na2 = (struct netauth *)((char *)rip+len); 995 996 /* Given a good hash value, these are not security 997 * problems so be generous and accept the routes, 998 * after complaining. 999 */ 1000 if (TRACEPACKETS) { 1001 if (NA->au.a_md5.md5_auth_len 1002 != RIP_AUTH_MD5_HASH_LEN) 1003 msglim(use_authp, from, 1004 "unknown MD5 RIPv2 auth len %#x" 1005 " instead of %#x from %s", 1006 NA->au.a_md5.md5_auth_len, 1007 (unsigned)RIP_AUTH_MD5_HASH_LEN, 1008 naddr_ntoa(from)); 1009 if (na2->a_family != RIP_AF_AUTH) 1010 msglim(use_authp, from, 1011 "unknown MD5 RIPv2 family %#x" 1012 " instead of %#x from %s", 1013 na2->a_family, RIP_AF_AUTH, 1014 naddr_ntoa(from)); 1015 if (na2->a_type != ntohs(1)) 1016 msglim(use_authp, from, 1017 "MD5 RIPv2 hash has %#x" 1018 " instead of %#x from %s", 1019 na2->a_type, ntohs(1), 1020 naddr_ntoa(from)); 1021 } 1022 1023 MD5Init(&md5_ctx); 1024 MD5Update(&md5_ctx, (u_char *)rip, 1025 len + RIP_AUTH_MD5_HASH_XTRA); 1026 MD5Update(&md5_ctx, ap->key, RIP_AUTH_MD5_KEY_LEN); 1027 MD5Final(hash, &md5_ctx); 1028 if (!memcmp(hash, na2->au.au_pw, sizeof(hash))) 1029 return 1; 1030 } 1031 } 1032 1033 msglim(use_authp, from, "bad password from %s", 1034 naddr_ntoa(from)); 1035 return 0; 1036 #undef NA 1037 } 1038