1 /* 2 * Copyright (c) 1983, 1988, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgment: 15 * This product includes software developed by the University of 16 * California, Berkeley and its contributors. 17 * 4. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * $FreeBSD$ 34 */ 35 36 #include "defs.h" 37 38 #ifdef __NetBSD__ 39 __RCSID("$NetBSD$"); 40 #elif defined(__FreeBSD__) 41 __RCSID("$FreeBSD$"); 42 #else 43 __RCSID("$Revision: 2.26 $"); 44 #ident "$Revision: 2.26 $" 45 #endif 46 #ident "$FreeBSD$" 47 48 static void input(struct sockaddr_in *, struct interface *, struct interface *, 49 struct rip *, int); 50 static void input_route(naddr, naddr, struct rt_spare *, struct netinfo *); 51 static int ck_passwd(struct interface *, struct rip *, void *, 52 naddr, struct msg_limit *); 53 54 55 /* process RIP input 56 */ 57 void 58 read_rip(int sock, 59 struct interface *sifp) 60 { 61 struct sockaddr_in from; 62 struct interface *aifp; 63 int fromlen, cc; 64 #ifdef USE_PASSIFNAME 65 static struct msg_limit bad_name; 66 struct { 67 char ifname[IFNAMSIZ]; 68 union pkt_buf pbuf; 69 } inbuf; 70 #else 71 struct { 72 union pkt_buf pbuf; 73 } inbuf; 74 #endif 75 76 77 for (;;) { 78 fromlen = sizeof(from); 79 cc = recvfrom(sock, &inbuf, sizeof(inbuf), 0, 80 (struct sockaddr*)&from, &fromlen); 81 if (cc <= 0) { 82 if (cc < 0 && errno != EWOULDBLOCK) 83 LOGERR("recvfrom(rip)"); 84 break; 85 } 86 if (fromlen != sizeof(struct sockaddr_in)) 87 logbad(1,"impossible recvfrom(rip) fromlen=%d", 88 fromlen); 89 90 /* aifp is the "authenticated" interface via which the packet 91 * arrived. In fact, it is only the interface on which 92 * the packet should have arrived based on is source 93 * address. 94 * sifp is interface associated with the socket through which 95 * the packet was received. 96 */ 97 #ifdef USE_PASSIFNAME 98 if ((cc -= sizeof(inbuf.ifname)) < 0) 99 logbad(0,"missing USE_PASSIFNAME; only %d bytes", 100 cc+sizeof(inbuf.ifname)); 101 102 /* check the remote interfaces first */ 103 for (aifp = remote_if; aifp; aifp = aifp->int_rlink) { 104 if (aifp->int_addr == from.sin_addr.s_addr) 105 break; 106 } 107 if (aifp == 0) { 108 aifp = ifwithname(inbuf.ifname, 0); 109 if (aifp == 0) { 110 msglim(&bad_name, from.sin_addr.s_addr, 111 "impossible interface name %.*s", 112 IFNAMSIZ, inbuf.ifname); 113 } else if (((aifp->int_if_flags & IFF_POINTOPOINT) 114 && aifp->int_dstaddr!=from.sin_addr.s_addr) 115 || (!(aifp->int_if_flags & IFF_POINTOPOINT) 116 && !on_net(from.sin_addr.s_addr, 117 aifp->int_net, 118 aifp->int_mask))) { 119 /* If it came via the wrong interface, do not 120 * trust it. 121 */ 122 aifp = 0; 123 } 124 } 125 #else 126 aifp = iflookup(from.sin_addr.s_addr); 127 #endif 128 if (sifp == 0) 129 sifp = aifp; 130 131 input(&from, sifp, aifp, &inbuf.pbuf.rip, cc); 132 } 133 } 134 135 136 /* Process a RIP packet 137 */ 138 static void 139 input(struct sockaddr_in *from, /* received from this IP address */ 140 struct interface *sifp, /* interface of incoming socket */ 141 struct interface *aifp, /* "authenticated" interface */ 142 struct rip *rip, 143 int cc) 144 { 145 # define FROM_NADDR from->sin_addr.s_addr 146 static struct msg_limit use_auth, bad_len, bad_mask; 147 static struct msg_limit unk_router, bad_router, bad_nhop; 148 149 struct rt_entry *rt; 150 struct rt_spare new; 151 struct netinfo *n, *lim; 152 struct interface *ifp1; 153 naddr gate, mask, v1_mask, dst, ddst_h = 0; 154 struct auth *ap; 155 struct tgate *tg = 0; 156 struct tgate_net *tn; 157 int i, j; 158 159 /* Notice when we hear from a remote gateway 160 */ 161 if (aifp != 0 162 && (aifp->int_state & IS_REMOTE)) 163 aifp->int_act_time = now.tv_sec; 164 165 trace_rip("Recv", "from", from, sifp, rip, cc); 166 167 if (rip->rip_vers == 0) { 168 msglim(&bad_router, FROM_NADDR, 169 "RIP version 0, cmd %d, packet received from %s", 170 rip->rip_cmd, naddr_ntoa(FROM_NADDR)); 171 return; 172 } else if (rip->rip_vers > RIPv2) { 173 rip->rip_vers = RIPv2; 174 } 175 if (cc > (int)OVER_MAXPACKETSIZE) { 176 msglim(&bad_router, FROM_NADDR, 177 "packet at least %d bytes too long received from %s", 178 cc-MAXPACKETSIZE, naddr_ntoa(FROM_NADDR)); 179 return; 180 } 181 182 n = rip->rip_nets; 183 lim = (struct netinfo *)((char*)rip + cc); 184 185 /* Notice authentication. 186 * As required by section 4.2 in RFC 1723, discard authenticated 187 * RIPv2 messages, but only if configured for that silliness. 188 * 189 * RIPv2 authentication is lame. Why authenticate queries? 190 * Why should a RIPv2 implementation with authentication disabled 191 * not be able to listen to RIPv2 packets with authentication, while 192 * RIPv1 systems will listen? Crazy! 193 */ 194 if (!auth_ok 195 && rip->rip_vers == RIPv2 196 && n < lim && n->n_family == RIP_AF_AUTH) { 197 msglim(&use_auth, FROM_NADDR, 198 "RIPv2 message with authentication from %s discarded", 199 naddr_ntoa(FROM_NADDR)); 200 return; 201 } 202 203 switch (rip->rip_cmd) { 204 case RIPCMD_REQUEST: 205 /* For mere requests, be a little sloppy about the source 206 */ 207 if (aifp == 0) 208 aifp = sifp; 209 210 /* Are we talking to ourself or a remote gateway? 211 */ 212 ifp1 = ifwithaddr(FROM_NADDR, 0, 1); 213 if (ifp1) { 214 if (ifp1->int_state & IS_REMOTE) { 215 /* remote gateway */ 216 aifp = ifp1; 217 if (check_remote(aifp)) { 218 aifp->int_act_time = now.tv_sec; 219 (void)if_ok(aifp, "remote "); 220 } 221 } else if (from->sin_port == htons(RIP_PORT)) { 222 trace_pkt(" discard our own RIP request"); 223 return; 224 } 225 } 226 227 /* did the request come from a router? 228 */ 229 if (from->sin_port == htons(RIP_PORT)) { 230 /* yes, ignore the request if RIP is off so that 231 * the router does not depend on us. 232 */ 233 if (rip_sock < 0 234 || (aifp != 0 235 && IS_RIP_OUT_OFF(aifp->int_state))) { 236 trace_pkt(" discard request while RIP off"); 237 return; 238 } 239 } 240 241 /* According to RFC 1723, we should ignore unauthenticated 242 * queries. That is too silly to bother with. Sheesh! 243 * Are forwarding tables supposed to be secret, when 244 * a bad guy can infer them with test traffic? When RIP 245 * is still the most common router-discovery protocol 246 * and so hosts need to send queries that will be answered? 247 * What about `rtquery`? 248 * Maybe on firewalls you'd care, but not enough to 249 * give up the diagnostic facilities of remote probing. 250 */ 251 252 if (n >= lim) { 253 msglim(&bad_len, FROM_NADDR, "empty request from %s", 254 naddr_ntoa(FROM_NADDR)); 255 return; 256 } 257 if (cc%sizeof(*n) != sizeof(struct rip)%sizeof(*n)) { 258 msglim(&bad_len, FROM_NADDR, 259 "request of bad length (%d) from %s", 260 cc, naddr_ntoa(FROM_NADDR)); 261 } 262 263 if (rip->rip_vers == RIPv2 264 && (aifp == 0 || (aifp->int_state & IS_NO_RIPV1_OUT))) { 265 v12buf.buf->rip_vers = RIPv2; 266 /* If we have a secret but it is a cleartext secret, 267 * do not disclose our secret unless the other guy 268 * already knows it. 269 */ 270 ap = find_auth(aifp); 271 if (ap != 0 && ap->type == RIP_AUTH_PW 272 && n->n_family == RIP_AF_AUTH 273 && !ck_passwd(aifp,rip,lim,FROM_NADDR,&use_auth)) 274 ap = 0; 275 } else { 276 v12buf.buf->rip_vers = RIPv1; 277 ap = 0; 278 } 279 clr_ws_buf(&v12buf, ap); 280 281 do { 282 n->n_metric = ntohl(n->n_metric); 283 284 /* A single entry with family RIP_AF_UNSPEC and 285 * metric HOPCNT_INFINITY means "all routes". 286 * We respond to routers only if we are acting 287 * as a supplier, or to anyone other than a router 288 * (i.e. a query). 289 */ 290 if (n->n_family == RIP_AF_UNSPEC 291 && n->n_metric == HOPCNT_INFINITY) { 292 /* Answer a query from a utility program 293 * with all we know. 294 */ 295 if (from->sin_port != htons(RIP_PORT)) { 296 supply(from, aifp, OUT_QUERY, 0, 297 rip->rip_vers, ap != 0); 298 return; 299 } 300 301 /* A router trying to prime its tables. 302 * Filter the answer in the about same way 303 * broadcasts are filtered. 304 * 305 * Only answer a router if we are a supplier 306 * to keep an unwary host that is just starting 307 * from picking us as a router. 308 */ 309 if (aifp == 0) { 310 trace_pkt("ignore distant router"); 311 return; 312 } 313 if (!supplier 314 || IS_RIP_OFF(aifp->int_state)) { 315 trace_pkt("ignore; not supplying"); 316 return; 317 } 318 319 /* Do not answer a RIPv1 router if 320 * we are sending RIPv2. But do offer 321 * poor man's router discovery. 322 */ 323 if ((aifp->int_state & IS_NO_RIPV1_OUT) 324 && rip->rip_vers == RIPv1) { 325 if (!(aifp->int_state & IS_PM_RDISC)) { 326 trace_pkt("ignore; sending RIPv2"); 327 return; 328 } 329 330 v12buf.n->n_family = RIP_AF_INET; 331 v12buf.n->n_dst = RIP_DEFAULT; 332 i = aifp->int_d_metric; 333 if (0 != (rt = rtget(RIP_DEFAULT, 0))) { 334 j = (rt->rt_metric 335 +aifp->int_metric 336 +aifp->int_adj_outmetric 337 +1); 338 if (i > j) 339 i = j; 340 } 341 v12buf.n->n_metric = htonl(i); 342 v12buf.n++; 343 break; 344 } 345 346 /* Respond with RIPv1 instead of RIPv2 if 347 * that is what we are broadcasting on the 348 * interface to keep the remote router from 349 * getting the wrong initial idea of the 350 * routes we send. 351 */ 352 supply(from, aifp, OUT_UNICAST, 0, 353 (aifp->int_state & IS_NO_RIPV1_OUT) 354 ? RIPv2 : RIPv1, 355 ap != 0); 356 return; 357 } 358 359 /* Ignore authentication */ 360 if (n->n_family == RIP_AF_AUTH) 361 continue; 362 363 if (n->n_family != RIP_AF_INET) { 364 msglim(&bad_router, FROM_NADDR, 365 "request from %s for unsupported" 366 " (af %d) %s", 367 naddr_ntoa(FROM_NADDR), 368 ntohs(n->n_family), 369 naddr_ntoa(n->n_dst)); 370 return; 371 } 372 373 /* We are being asked about a specific destination. 374 */ 375 dst = n->n_dst; 376 if (!check_dst(dst)) { 377 msglim(&bad_router, FROM_NADDR, 378 "bad queried destination %s from %s", 379 naddr_ntoa(dst), 380 naddr_ntoa(FROM_NADDR)); 381 return; 382 } 383 384 /* decide what mask was intended */ 385 if (rip->rip_vers == RIPv1 386 || 0 == (mask = ntohl(n->n_mask)) 387 || 0 != (ntohl(dst) & ~mask)) 388 mask = ripv1_mask_host(dst, aifp); 389 390 /* try to find the answer */ 391 rt = rtget(dst, mask); 392 if (!rt && dst != RIP_DEFAULT) 393 rt = rtfind(n->n_dst); 394 395 if (v12buf.buf->rip_vers != RIPv1) 396 v12buf.n->n_mask = mask; 397 if (rt == 0) { 398 /* we do not have the answer */ 399 v12buf.n->n_metric = HOPCNT_INFINITY; 400 } else { 401 /* we have the answer, so compute the 402 * right metric and next hop. 403 */ 404 v12buf.n->n_family = RIP_AF_INET; 405 v12buf.n->n_dst = dst; 406 j = rt->rt_metric+1; 407 if (!aifp) 408 ++j; 409 else 410 j += (aifp->int_metric 411 + aifp->int_adj_outmetric); 412 if (j < HOPCNT_INFINITY) 413 v12buf.n->n_metric = j; 414 else 415 v12buf.n->n_metric = HOPCNT_INFINITY; 416 if (v12buf.buf->rip_vers != RIPv1) { 417 v12buf.n->n_tag = rt->rt_tag; 418 v12buf.n->n_mask = mask; 419 if (aifp != 0 420 && on_net(rt->rt_gate, 421 aifp->int_net, 422 aifp->int_mask) 423 && rt->rt_gate != aifp->int_addr) 424 v12buf.n->n_nhop = rt->rt_gate; 425 } 426 } 427 v12buf.n->n_metric = htonl(v12buf.n->n_metric); 428 429 /* Stop paying attention if we fill the output buffer. 430 */ 431 if (++v12buf.n >= v12buf.lim) 432 break; 433 } while (++n < lim); 434 435 /* Send the answer about specific routes. 436 */ 437 if (ap != 0 && ap->type == RIP_AUTH_MD5) 438 end_md5_auth(&v12buf, ap); 439 440 if (from->sin_port != htons(RIP_PORT)) { 441 /* query */ 442 (void)output(OUT_QUERY, from, aifp, 443 v12buf.buf, 444 ((char *)v12buf.n - (char*)v12buf.buf)); 445 } else if (supplier) { 446 (void)output(OUT_UNICAST, from, aifp, 447 v12buf.buf, 448 ((char *)v12buf.n - (char*)v12buf.buf)); 449 } else { 450 /* Only answer a router if we are a supplier 451 * to keep an unwary host that is just starting 452 * from picking us an a router. 453 */ 454 ; 455 } 456 return; 457 458 case RIPCMD_TRACEON: 459 case RIPCMD_TRACEOFF: 460 /* Notice that trace messages are turned off for all possible 461 * abuse if _PATH_TRACE is undefined in pathnames.h. 462 * Notice also that because of the way the trace file is 463 * handled in trace.c, no abuse is plausible even if 464 * _PATH_TRACE_ is defined. 465 * 466 * First verify message came from a privileged port. */ 467 if (ntohs(from->sin_port) > IPPORT_RESERVED) { 468 msglog("trace command from untrusted port on %s", 469 naddr_ntoa(FROM_NADDR)); 470 return; 471 } 472 if (aifp == 0) { 473 msglog("trace command from unknown router %s", 474 naddr_ntoa(FROM_NADDR)); 475 return; 476 } 477 if (rip->rip_cmd == RIPCMD_TRACEON) { 478 rip->rip_tracefile[cc-4] = '\0'; 479 set_tracefile((char*)rip->rip_tracefile, 480 "trace command: %s\n", 0); 481 } else { 482 trace_off("tracing turned off by %s", 483 naddr_ntoa(FROM_NADDR)); 484 } 485 return; 486 487 case RIPCMD_RESPONSE: 488 if (cc%sizeof(*n) != sizeof(struct rip)%sizeof(*n)) { 489 msglim(&bad_len, FROM_NADDR, 490 "response of bad length (%d) from %s", 491 cc, naddr_ntoa(FROM_NADDR)); 492 } 493 494 /* verify message came from a router */ 495 if (from->sin_port != ntohs(RIP_PORT)) { 496 msglim(&bad_router, FROM_NADDR, 497 " discard RIP response from unknown port" 498 " %d on %s", 499 ntohs(from->sin_port), naddr_ntoa(FROM_NADDR)); 500 return; 501 } 502 503 if (rip_sock < 0) { 504 trace_pkt(" discard response while RIP off"); 505 return; 506 } 507 508 /* Are we talking to ourself or a remote gateway? 509 */ 510 ifp1 = ifwithaddr(FROM_NADDR, 0, 1); 511 if (ifp1) { 512 if (ifp1->int_state & IS_REMOTE) { 513 /* remote gateway */ 514 aifp = ifp1; 515 if (check_remote(aifp)) { 516 aifp->int_act_time = now.tv_sec; 517 (void)if_ok(aifp, "remote "); 518 } 519 } else { 520 trace_pkt(" discard our own RIP response"); 521 return; 522 } 523 } 524 525 /* Accept routing packets from routers directly connected 526 * via broadcast or point-to-point networks, and from 527 * those listed in /etc/gateways. 528 */ 529 if (aifp == 0) { 530 msglim(&unk_router, FROM_NADDR, 531 " discard response from %s" 532 " via unexpected interface", 533 naddr_ntoa(FROM_NADDR)); 534 return; 535 } 536 if (IS_RIP_IN_OFF(aifp->int_state)) { 537 trace_pkt(" discard RIPv%d response" 538 " via disabled interface %s", 539 rip->rip_vers, aifp->int_name); 540 return; 541 } 542 543 if (n >= lim) { 544 msglim(&bad_len, FROM_NADDR, "empty response from %s", 545 naddr_ntoa(FROM_NADDR)); 546 return; 547 } 548 549 if (((aifp->int_state & IS_NO_RIPV1_IN) 550 && rip->rip_vers == RIPv1) 551 || ((aifp->int_state & IS_NO_RIPV2_IN) 552 && rip->rip_vers != RIPv1)) { 553 trace_pkt(" discard RIPv%d response", 554 rip->rip_vers); 555 return; 556 } 557 558 /* Ignore routes via dead interface. 559 */ 560 if (aifp->int_state & IS_BROKE) { 561 trace_pkt("discard response via broken interface %s", 562 aifp->int_name); 563 return; 564 } 565 566 /* If the interface cares, ignore bad routers. 567 * Trace but do not log this problem, because where it 568 * happens, it happens frequently. 569 */ 570 if (aifp->int_state & IS_DISTRUST) { 571 tg = tgates; 572 while (tg->tgate_addr != FROM_NADDR) { 573 tg = tg->tgate_next; 574 if (tg == 0) { 575 trace_pkt(" discard RIP response" 576 " from untrusted router %s", 577 naddr_ntoa(FROM_NADDR)); 578 return; 579 } 580 } 581 } 582 583 /* Authenticate the packet if we have a secret. 584 * If we do not have any secrets, ignore the error in 585 * RFC 1723 and accept it regardless. 586 */ 587 if (aifp->int_auth[0].type != RIP_AUTH_NONE 588 && rip->rip_vers != RIPv1 589 && !ck_passwd(aifp,rip,lim,FROM_NADDR,&use_auth)) 590 return; 591 592 do { 593 if (n->n_family == RIP_AF_AUTH) 594 continue; 595 596 n->n_metric = ntohl(n->n_metric); 597 dst = n->n_dst; 598 if (n->n_family != RIP_AF_INET 599 && (n->n_family != RIP_AF_UNSPEC 600 || dst != RIP_DEFAULT)) { 601 msglim(&bad_router, FROM_NADDR, 602 "route from %s to unsupported" 603 " address family=%d destination=%s", 604 naddr_ntoa(FROM_NADDR), 605 n->n_family, 606 naddr_ntoa(dst)); 607 continue; 608 } 609 if (!check_dst(dst)) { 610 msglim(&bad_router, FROM_NADDR, 611 "bad destination %s from %s", 612 naddr_ntoa(dst), 613 naddr_ntoa(FROM_NADDR)); 614 return; 615 } 616 if (n->n_metric == 0 617 || n->n_metric > HOPCNT_INFINITY) { 618 msglim(&bad_router, FROM_NADDR, 619 "bad metric %d from %s" 620 " for destination %s", 621 n->n_metric, 622 naddr_ntoa(FROM_NADDR), 623 naddr_ntoa(dst)); 624 return; 625 } 626 627 /* Notice the next-hop. 628 */ 629 gate = FROM_NADDR; 630 if (n->n_nhop != 0) { 631 if (rip->rip_vers == RIPv1) { 632 n->n_nhop = 0; 633 } else { 634 /* Use it only if it is valid. */ 635 if (on_net(n->n_nhop, 636 aifp->int_net, aifp->int_mask) 637 && check_dst(n->n_nhop)) { 638 gate = n->n_nhop; 639 } else { 640 msglim(&bad_nhop, FROM_NADDR, 641 "router %s to %s" 642 " has bad next hop %s", 643 naddr_ntoa(FROM_NADDR), 644 naddr_ntoa(dst), 645 naddr_ntoa(n->n_nhop)); 646 n->n_nhop = 0; 647 } 648 } 649 } 650 651 if (rip->rip_vers == RIPv1 652 || 0 == (mask = ntohl(n->n_mask))) { 653 mask = ripv1_mask_host(dst,aifp); 654 } else if ((ntohl(dst) & ~mask) != 0) { 655 msglim(&bad_mask, FROM_NADDR, 656 "router %s sent bad netmask" 657 " %#lx with %s", 658 naddr_ntoa(FROM_NADDR), 659 (u_long)mask, 660 naddr_ntoa(dst)); 661 continue; 662 } 663 if (rip->rip_vers == RIPv1) 664 n->n_tag = 0; 665 666 /* Adjust metric according to incoming interface.. 667 */ 668 n->n_metric += (aifp->int_metric 669 + aifp->int_adj_inmetric); 670 if (n->n_metric > HOPCNT_INFINITY) 671 n->n_metric = HOPCNT_INFINITY; 672 673 /* Should we trust this route from this router? */ 674 if (tg && (tn = tg->tgate_nets)->mask != 0) { 675 for (i = 0; i < MAX_TGATE_NETS; i++, tn++) { 676 if (on_net(dst, tn->net, tn->mask) 677 && tn->mask <= mask) 678 break; 679 } 680 if (i >= MAX_TGATE_NETS || tn->mask == 0) { 681 trace_pkt(" ignored unauthorized %s", 682 addrname(dst,mask,0)); 683 continue; 684 } 685 } 686 687 /* Recognize and ignore a default route we faked 688 * which is being sent back to us by a machine with 689 * broken split-horizon. 690 * Be a little more paranoid than that, and reject 691 * default routes with the same metric we advertised. 692 */ 693 if (aifp->int_d_metric != 0 694 && dst == RIP_DEFAULT 695 && (int)n->n_metric >= aifp->int_d_metric) 696 continue; 697 698 /* We can receive aggregated RIPv2 routes that must 699 * be broken down before they are transmitted by 700 * RIPv1 via an interface on a subnet. 701 * We might also receive the same routes aggregated 702 * via other RIPv2 interfaces. 703 * This could cause duplicate routes to be sent on 704 * the RIPv1 interfaces. "Longest matching variable 705 * length netmasks" lets RIPv2 listeners understand, 706 * but breaking down the aggregated routes for RIPv1 707 * listeners can produce duplicate routes. 708 * 709 * Breaking down aggregated routes here bloats 710 * the daemon table, but does not hurt the kernel 711 * table, since routes are always aggregated for 712 * the kernel. 713 * 714 * Notice that this does not break down network 715 * routes corresponding to subnets. This is part 716 * of the defense against RS_NET_SYN. 717 */ 718 if (have_ripv1_out 719 && (((rt = rtget(dst,mask)) == 0 720 || !(rt->rt_state & RS_NET_SYN))) 721 && (v1_mask = ripv1_mask_net(dst,0)) > mask) { 722 ddst_h = v1_mask & -v1_mask; 723 i = (v1_mask & ~mask)/ddst_h; 724 if (i >= 511) { 725 /* Punt if we would have to generate 726 * an unreasonable number of routes. 727 */ 728 if (TRACECONTENTS) 729 trace_misc("accept %s-->%s as 1" 730 " instead of %d routes", 731 addrname(dst,mask,0), 732 naddr_ntoa(FROM_NADDR), 733 i+1); 734 i = 0; 735 } else { 736 mask = v1_mask; 737 } 738 } else { 739 i = 0; 740 } 741 742 new.rts_gate = gate; 743 new.rts_router = FROM_NADDR; 744 new.rts_metric = n->n_metric; 745 new.rts_tag = n->n_tag; 746 new.rts_time = now.tv_sec; 747 new.rts_ifp = aifp; 748 new.rts_de_ag = i; 749 j = 0; 750 for (;;) { 751 input_route(dst, mask, &new, n); 752 if (++j > i) 753 break; 754 dst = htonl(ntohl(dst) + ddst_h); 755 } 756 } while (++n < lim); 757 break; 758 } 759 #undef FROM_NADDR 760 } 761 762 763 /* Process a single input route. 764 */ 765 static void 766 input_route(naddr dst, /* network order */ 767 naddr mask, 768 struct rt_spare *new, 769 struct netinfo *n) 770 { 771 int i; 772 struct rt_entry *rt; 773 struct rt_spare *rts, *rts0; 774 struct interface *ifp1; 775 776 777 /* See if the other guy is telling us to send our packets to him. 778 * Sometimes network routes arrive over a point-to-point link for 779 * the network containing the address(es) of the link. 780 * 781 * If our interface is broken, switch to using the other guy. 782 */ 783 ifp1 = ifwithaddr(dst, 1, 1); 784 if (ifp1 != 0 785 && (!(ifp1->int_state & IS_BROKE) 786 || (ifp1->int_state & IS_PASSIVE))) 787 return; 788 789 /* Look for the route in our table. 790 */ 791 rt = rtget(dst, mask); 792 793 /* Consider adding the route if we do not already have it. 794 */ 795 if (rt == 0) { 796 /* Ignore unknown routes being poisoned. 797 */ 798 if (new->rts_metric == HOPCNT_INFINITY) 799 return; 800 801 /* Ignore the route if it points to us */ 802 if (n->n_nhop != 0 803 && 0 != ifwithaddr(n->n_nhop, 1, 0)) 804 return; 805 806 /* If something has not gone crazy and tried to fill 807 * our memory, accept the new route. 808 */ 809 if (total_routes < MAX_ROUTES) 810 rtadd(dst, mask, 0, new); 811 return; 812 } 813 814 /* We already know about the route. Consider this update. 815 * 816 * If (rt->rt_state & RS_NET_SYN), then this route 817 * is the same as a network route we have inferred 818 * for subnets we know, in order to tell RIPv1 routers 819 * about the subnets. 820 * 821 * It is impossible to tell if the route is coming 822 * from a distant RIPv2 router with the standard 823 * netmask because that router knows about the entire 824 * network, or if it is a round-about echo of a 825 * synthetic, RIPv1 network route of our own. 826 * The worst is that both kinds of routes might be 827 * received, and the bad one might have the smaller 828 * metric. Partly solve this problem by never 829 * aggregating into such a route. Also keep it 830 * around as long as the interface exists. 831 */ 832 833 rts0 = rt->rt_spares; 834 for (rts = rts0, i = NUM_SPARES; i != 0; i--, rts++) { 835 if (rts->rts_router == new->rts_router) 836 break; 837 /* Note the worst slot to reuse, 838 * other than the current slot. 839 */ 840 if (rts0 == rt->rt_spares 841 || BETTER_LINK(rt, rts0, rts)) 842 rts0 = rts; 843 } 844 if (i != 0) { 845 /* Found a route from the router already in the table. 846 */ 847 848 /* If the new route is a route broken down from an 849 * aggregated route, and if the previous route is either 850 * not a broken down route or was broken down from a finer 851 * netmask, and if the previous route is current, 852 * then forget this one. 853 */ 854 if (new->rts_de_ag > rts->rts_de_ag 855 && now_stale <= rts->rts_time) 856 return; 857 858 /* Keep poisoned routes around only long enough to pass 859 * the poison on. Use a new timestamp for good routes. 860 */ 861 if (rts->rts_metric == HOPCNT_INFINITY 862 && new->rts_metric == HOPCNT_INFINITY) 863 new->rts_time = rts->rts_time; 864 865 /* If this is an update for the router we currently prefer, 866 * then note it. 867 */ 868 if (i == NUM_SPARES) { 869 rtchange(rt, rt->rt_state, new, 0); 870 /* If the route got worse, check for something better. 871 */ 872 if (new->rts_metric > rts->rts_metric) 873 rtswitch(rt, 0); 874 return; 875 } 876 877 /* This is an update for a spare route. 878 * Finished if the route is unchanged. 879 */ 880 if (rts->rts_gate == new->rts_gate 881 && rts->rts_metric == new->rts_metric 882 && rts->rts_tag == new->rts_tag) { 883 trace_upslot(rt, rts, new); 884 *rts = *new; 885 return; 886 } 887 /* Forget it if it has gone bad. 888 */ 889 if (new->rts_metric == HOPCNT_INFINITY) { 890 rts_delete(rt, rts); 891 return; 892 } 893 894 } else { 895 /* The update is for a route we know about, 896 * but not from a familiar router. 897 * 898 * Ignore the route if it points to us. 899 */ 900 if (n->n_nhop != 0 901 && 0 != ifwithaddr(n->n_nhop, 1, 0)) 902 return; 903 904 /* the loop above set rts0=worst spare */ 905 rts = rts0; 906 907 /* Save the route as a spare only if it has 908 * a better metric than our worst spare. 909 * This also ignores poisoned routes (those 910 * received with metric HOPCNT_INFINITY). 911 */ 912 if (new->rts_metric >= rts->rts_metric) 913 return; 914 } 915 916 trace_upslot(rt, rts, new); 917 *rts = *new; 918 919 /* try to switch to a better route */ 920 rtswitch(rt, rts); 921 } 922 923 924 static int /* 0 if bad */ 925 ck_passwd(struct interface *aifp, 926 struct rip *rip, 927 void *lim, 928 naddr from, 929 struct msg_limit *use_authp) 930 { 931 # define NA (rip->rip_auths) 932 struct netauth *na2; 933 struct auth *ap; 934 MD5_CTX md5_ctx; 935 u_char hash[RIP_AUTH_PW_LEN]; 936 int i, len; 937 938 939 if ((void *)NA >= lim || NA->a_family != RIP_AF_AUTH) { 940 msglim(use_authp, from, "missing password from %s", 941 naddr_ntoa(from)); 942 return 0; 943 } 944 945 /* accept any current (+/- 24 hours) password 946 */ 947 for (ap = aifp->int_auth, i = 0; i < MAX_AUTH_KEYS; i++, ap++) { 948 if (ap->type != NA->a_type 949 || (u_long)ap->start > (u_long)clk.tv_sec+DAY 950 || (u_long)ap->end+DAY < (u_long)clk.tv_sec) 951 continue; 952 953 if (NA->a_type == RIP_AUTH_PW) { 954 if (!memcmp(NA->au.au_pw, ap->key, RIP_AUTH_PW_LEN)) 955 return 1; 956 957 } else { 958 /* accept MD5 secret with the right key ID 959 */ 960 if (NA->au.a_md5.md5_keyid != ap->keyid) 961 continue; 962 963 len = ntohs(NA->au.a_md5.md5_pkt_len); 964 if ((len-sizeof(*rip)) % sizeof(*NA) != 0 965 || len != (char *)lim-(char*)rip-(int)sizeof(*NA)) { 966 msglim(use_authp, from, 967 "wrong MD5 RIPv2 packet length of %d" 968 " instead of %d from %s", 969 len, (int)((char *)lim-(char *)rip 970 -sizeof(*NA)), 971 naddr_ntoa(from)); 972 return 0; 973 } 974 na2 = (struct netauth *)((char *)rip+len); 975 976 /* Given a good hash value, these are not security 977 * problems so be generous and accept the routes, 978 * after complaining. 979 */ 980 if (TRACEPACKETS) { 981 if (NA->au.a_md5.md5_auth_len 982 != RIP_AUTH_MD5_HASH_LEN) 983 msglim(use_authp, from, 984 "unknown MD5 RIPv2 auth len %#x" 985 " instead of %#x from %s", 986 NA->au.a_md5.md5_auth_len, 987 RIP_AUTH_MD5_HASH_LEN, 988 naddr_ntoa(from)); 989 if (na2->a_family != RIP_AF_AUTH) 990 msglim(use_authp, from, 991 "unknown MD5 RIPv2 family %#x" 992 " instead of %#x from %s", 993 na2->a_family, RIP_AF_AUTH, 994 naddr_ntoa(from)); 995 if (na2->a_type != ntohs(1)) 996 msglim(use_authp, from, 997 "MD5 RIPv2 hash has %#x" 998 " instead of %#x from %s", 999 na2->a_type, ntohs(1), 1000 naddr_ntoa(from)); 1001 } 1002 1003 MD5Init(&md5_ctx); 1004 MD5Update(&md5_ctx, (u_char *)rip, 1005 len + RIP_AUTH_MD5_HASH_XTRA); 1006 MD5Update(&md5_ctx, ap->key, RIP_AUTH_MD5_KEY_LEN); 1007 MD5Final(hash, &md5_ctx); 1008 if (!memcmp(hash, na2->au.au_pw, sizeof(hash))) 1009 return 1; 1010 } 1011 } 1012 1013 msglim(use_authp, from, "bad password from %s", 1014 naddr_ntoa(from)); 1015 return 0; 1016 #undef NA 1017 } 1018