The Tcpdump Group git mirrors - tcpdump/blob - print-rpki-rtr.c

   1 /*
   2  * Copyright (c) 1998-2011 The TCPDUMP project
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that: (1) source code
   6  * distributions retain the above copyright notice and this paragraph
   7  * in its entirety, and (2) distributions including binary code include
   8  * the above copyright notice and this paragraph in its entirety in
   9  * the documentation or other materials provided with the distribution.
  10  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
  11  * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
  12  * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  13  * FOR A PARTICULAR PURPOSE.
  14  *
  15  * Original code by Hannes Gredler (hannes@gredler.at)
  16  */
  17
  18 /* \summary: Resource Public Key Infrastructure (RPKI) to Router Protocol printer */
  19
  20 /* specification: RFC 6810 */
  21
  22 #ifdef HAVE_CONFIG_H
  23 #include <config.h>
  24 #endif
  25
  26 #include "netdissect-stdinc.h"
  27
  28 #include <string.h>
  29
  30 #include "netdissect.h"
  31 #include "extract.h"
  32 #include "addrtoname.h"
  33
  34 static const char tstr[] = "[|RPKI-RTR]";
  35
  36 /*
  37  * RPKI/Router PDU header
  38  *
  39  * Here's what the PDU header looks like.
  40  * The length does include the version and length fields.
  41  */
  42 typedef struct rpki_rtr_pdu_ {
  43     u_char version;             /* Version number */
  44     u_char pdu_type;            /* PDU type */
  45     union {
  46         u_char session_id[2];   /* Session id */
  47         u_char error_code[2];   /* Error code */
  48     } u;
  49     u_char length[4];
  50 } rpki_rtr_pdu;
  51
  52 /*
  53  * IPv4 Prefix PDU.
  54  */
  55 typedef struct rpki_rtr_pdu_ipv4_prefix_ {
  56     rpki_rtr_pdu pdu_header;
  57     u_char flags;
  58     u_char prefix_length;
  59     u_char max_length;
  60     u_char zero;
  61     u_char prefix[4];
  62     u_char as[4];
  63 } rpki_rtr_pdu_ipv4_prefix;
  64
  65 /*
  66  * IPv6 Prefix PDU.
  67  */
  68 typedef struct rpki_rtr_pdu_ipv6_prefix_ {
  69     rpki_rtr_pdu pdu_header;
  70     u_char flags;
  71     u_char prefix_length;
  72     u_char max_length;
  73     u_char zero;
  74     u_char prefix[16];
  75     u_char as[4];
  76 } rpki_rtr_pdu_ipv6_prefix;
  77
  78 /*
  79  * Error report PDU.
  80  */
  81 typedef struct rpki_rtr_pdu_error_report_ {
  82     rpki_rtr_pdu pdu_header;
  83     u_char encapsulated_pdu_length[4]; /* Encapsulated PDU length */
  84     /* Copy of Erroneous PDU (variable, optional) */
  85     /* Length of Error Text (4 octets in network byte order) */
  86     /* Arbitrary Text of Error Diagnostic Message (variable, optional) */
  87 } rpki_rtr_pdu_error_report;
  88
  89 /*
  90  * PDU type codes
  91  */
  92 #define RPKI_RTR_SERIAL_NOTIFY_PDU      0
  93 #define RPKI_RTR_SERIAL_QUERY_PDU       1
  94 #define RPKI_RTR_RESET_QUERY_PDU        2
  95 #define RPKI_RTR_CACHE_RESPONSE_PDU     3
  96 #define RPKI_RTR_IPV4_PREFIX_PDU        4
  97 #define RPKI_RTR_IPV6_PREFIX_PDU        6
  98 #define RPKI_RTR_END_OF_DATA_PDU        7
  99 #define RPKI_RTR_CACHE_RESET_PDU        8
 100 #define RPKI_RTR_ERROR_REPORT_PDU       10
 101
 102 static const struct tok rpki_rtr_pdu_values[] = {
 103     { RPKI_RTR_SERIAL_NOTIFY_PDU, "Serial Notify" },
 104     { RPKI_RTR_SERIAL_QUERY_PDU, "Serial Query" },
 105     { RPKI_RTR_RESET_QUERY_PDU, "Reset Query" },
 106     { RPKI_RTR_CACHE_RESPONSE_PDU, "Cache Response" },
 107     { RPKI_RTR_IPV4_PREFIX_PDU, "IPV4 Prefix" },
 108     { RPKI_RTR_IPV6_PREFIX_PDU, "IPV6 Prefix" },
 109     { RPKI_RTR_END_OF_DATA_PDU, "End of Data" },
 110     { RPKI_RTR_CACHE_RESET_PDU, "Cache Reset" },
 111     { RPKI_RTR_ERROR_REPORT_PDU, "Error Report" },
 112     { 0, NULL}
 113 };
 114
 115 static const struct tok rpki_rtr_error_codes[] = {
 116     { 0, "Corrupt Data" },
 117     { 1, "Internal Error" },
 118     { 2, "No Data Available" },
 119     { 3, "Invalid Request" },
 120     { 4, "Unsupported Protocol Version" },
 121     { 5, "Unsupported PDU Type" },
 122     { 6, "Withdrawal of Unknown Record" },
 123     { 7, "Duplicate Announcement Received" },
 124     { 0, NULL}
 125 };
 126
 127 /*
 128  * Build a indentation string for a given indentation level.
 129  * XXX this should be really in util.c
 130  */
 131 static char *
 132 indent_string (u_int indent)
 133 {
 134     static char buf[20];
 135     u_int idx;
 136
 137     idx = 0;
 138     buf[idx] = '\0';
 139
 140     /*
 141      * Does the static buffer fit ?
 142      */
 143     if (sizeof(buf) < ((indent/8) + (indent %8) + 2)) {
 144         return buf;
 145     }
 146
 147     /*
 148      * Heading newline.
 149      */
 150     buf[idx] = '\n';
 151     idx++;
 152
 153     while (indent >= 8) {
 154         buf[idx] = '\t';
 155         idx++;
 156         indent -= 8;
 157     }
 158
 159     while (indent > 0) {
 160         buf[idx] = ' ';
 161         idx++;
 162         indent--;
 163     }
 164
 165     /*
 166      * Trailing zero.
 167      */
 168     buf[idx] = '\0';
 169
 170     return buf;
 171 }
 172
 173 /*
 174  * Print a single PDU.
 175  */
 176 static u_int
 177 rpki_rtr_pdu_print (netdissect_options *ndo, const u_char *tptr, const u_int len,
 178         const u_char recurse, const u_int indent)
 179 {
 180     const rpki_rtr_pdu *pdu_header;
 181     u_int pdu_type, pdu_len, hexdump;
 182     const u_char *msg;
 183
 184     /* Protocol Version */
 185     ND_TCHECK_1(tptr);
 186     if (EXTRACT_U_1(tptr) != 0) {
 187         /* Skip the rest of the input buffer because even if this is
 188          * a well-formed PDU of a future RPKI-Router protocol version
 189          * followed by a well-formed PDU of RPKI-Router protocol
 190          * version 0, there is no way to know exactly how to skip the
 191          * current PDU.
 192          */
 193         ND_PRINT("%sRPKI-RTRv%u (unknown)", indent_string(8), EXTRACT_U_1(tptr));
 194         return len;
 195     }
 196     if (len < sizeof(rpki_rtr_pdu)) {
 197         ND_PRINT("(%u bytes is too few to decode)", len);
 198         goto invalid;
 199     }
 200     ND_TCHECK_LEN(tptr, sizeof(rpki_rtr_pdu));
 201     pdu_header = (const rpki_rtr_pdu *)tptr;
 202     pdu_type = pdu_header->pdu_type;
 203     pdu_len = EXTRACT_BE_U_4(pdu_header->length);
 204     /* Do not check bounds with pdu_len yet, do it in the case blocks
 205      * below to make it possible to decode at least the beginning of
 206      * a truncated Error Report PDU or a truncated encapsulated PDU.
 207      */
 208     hexdump = FALSE;
 209
 210     ND_PRINT("%sRPKI-RTRv%u, %s PDU (%u), length: %u",
 211            indent_string(8),
 212            pdu_header->version,
 213            tok2str(rpki_rtr_pdu_values, "Unknown", pdu_type),
 214            pdu_type, pdu_len);
 215     if (pdu_len < sizeof(rpki_rtr_pdu) || pdu_len > len)
 216         goto invalid;
 217
 218     switch (pdu_type) {
 219
 220         /*
 221          * The following PDUs share the message format.
 222          */
 223     case RPKI_RTR_SERIAL_NOTIFY_PDU:
 224     case RPKI_RTR_SERIAL_QUERY_PDU:
 225     case RPKI_RTR_END_OF_DATA_PDU:
 226         if (pdu_len != sizeof(rpki_rtr_pdu) + 4)
 227             goto invalid;
 228         ND_TCHECK_LEN(tptr, pdu_len);
 229         msg = (const u_char *)(pdu_header + 1);
 230         ND_PRINT("%sSession ID: 0x%04x, Serial: %u",
 231                indent_string(indent+2),
 232                EXTRACT_BE_U_2(pdu_header->u.session_id),
 233                EXTRACT_BE_U_4(msg));
 234         break;
 235
 236         /*
 237          * The following PDUs share the message format.
 238          */
 239     case RPKI_RTR_RESET_QUERY_PDU:
 240     case RPKI_RTR_CACHE_RESET_PDU:
 241         if (pdu_len != sizeof(rpki_rtr_pdu))
 242             goto invalid;
 243         /* no additional boundary to check */
 244
 245         /*
 246          * Zero payload PDUs.
 247          */
 248         break;
 249
 250     case RPKI_RTR_CACHE_RESPONSE_PDU:
 251         if (pdu_len != sizeof(rpki_rtr_pdu))
 252             goto invalid;
 253         /* no additional boundary to check */
 254         ND_PRINT("%sSession ID: 0x%04x",
 255                indent_string(indent+2),
 256                EXTRACT_BE_U_2(pdu_header->u.session_id));
 257         break;
 258
 259     case RPKI_RTR_IPV4_PREFIX_PDU:
 260         {
 261             const rpki_rtr_pdu_ipv4_prefix *pdu;
 262
 263             if (pdu_len != sizeof(rpki_rtr_pdu) + 12)
 264                 goto invalid;
 265             ND_TCHECK_LEN(tptr, pdu_len);
 266             pdu = (const rpki_rtr_pdu_ipv4_prefix *)tptr;
 267             ND_PRINT("%sIPv4 Prefix %s/%u-%u, origin-as %u, flags 0x%02x",
 268                    indent_string(indent+2),
 269                    ipaddr_string(ndo, pdu->prefix),
 270                    pdu->prefix_length, pdu->max_length,
 271                    EXTRACT_BE_U_4(pdu->as), pdu->flags);
 272         }
 273         break;
 274
 275     case RPKI_RTR_IPV6_PREFIX_PDU:
 276         {
 277             const rpki_rtr_pdu_ipv6_prefix *pdu;
 278
 279             if (pdu_len != sizeof(rpki_rtr_pdu) + 24)
 280                 goto invalid;
 281             ND_TCHECK_LEN(tptr, pdu_len);
 282             pdu = (const rpki_rtr_pdu_ipv6_prefix *)tptr;
 283             ND_PRINT("%sIPv6 Prefix %s/%u-%u, origin-as %u, flags 0x%02x",
 284                    indent_string(indent+2),
 285                    ip6addr_string(ndo, pdu->prefix),
 286                    pdu->prefix_length, pdu->max_length,
 287                    EXTRACT_BE_U_4(pdu->as), pdu->flags);
 288         }
 289         break;
 290
 291     case RPKI_RTR_ERROR_REPORT_PDU:
 292         {
 293             const rpki_rtr_pdu_error_report *pdu;
 294             u_int encapsulated_pdu_length, text_length, tlen, error_code;
 295
 296             tlen = sizeof(rpki_rtr_pdu);
 297             /* Do not test for the "Length of Error Text" data element yet. */
 298             if (pdu_len < tlen + 4)
 299                 goto invalid;
 300             ND_TCHECK_LEN(tptr, tlen + 4);
 301             /* Safe up to and including the "Length of Encapsulated PDU"
 302              * data element, more data elements may be present.
 303              */
 304             pdu = (const rpki_rtr_pdu_error_report *)tptr;
 305             encapsulated_pdu_length = EXTRACT_BE_U_4(pdu->encapsulated_pdu_length);
 306             tlen += 4;
 307
 308             error_code = EXTRACT_BE_U_2(pdu->pdu_header.u.error_code);
 309             ND_PRINT("%sError code: %s (%u), Encapsulated PDU length: %u",
 310                    indent_string(indent+2),
 311                    tok2str(rpki_rtr_error_codes, "Unknown", error_code),
 312                    error_code, encapsulated_pdu_length);
 313
 314             if (encapsulated_pdu_length) {
 315                 /* Section 5.10 of RFC 6810 says:
 316                  * "An Error Report PDU MUST NOT be sent for an Error Report PDU."
 317                  *
 318                  * However, as far as the protocol encoding goes Error Report PDUs can
 319                  * happen to be nested in each other, however many times, in which case
 320                  * the decoder should still print such semantically incorrect PDUs.
 321                  *
 322                  * That said, "the Erroneous PDU field MAY be truncated" (ibid), thus
 323                  * to keep things simple this implementation decodes only the two
 324                  * outermost layers of PDUs and makes bounds checks in the outer and
 325                  * the inner PDU independently.
 326                  */
 327                 if (pdu_len < tlen + encapsulated_pdu_length)
 328                     goto invalid;
 329                 if (! recurse) {
 330                     ND_TCHECK_LEN(tptr, tlen + encapsulated_pdu_length);
 331                 }
 332                 else {
 333                     ND_PRINT("%s-----encapsulated PDU-----", indent_string(indent+4));
 334                     rpki_rtr_pdu_print(ndo, tptr + tlen,
 335                         encapsulated_pdu_length, 0, indent + 2);
 336                 }
 337                 tlen += encapsulated_pdu_length;
 338             }
 339
 340             if (pdu_len < tlen + 4)
 341                 goto invalid;
 342             ND_TCHECK_LEN(tptr, tlen + 4);
 343             /* Safe up to and including the "Length of Error Text" data element,
 344              * one more data element may be present.
 345              */
 346
 347             /*
 348              * Extract, trail-zero and print the Error message.
 349              */
 350             text_length = EXTRACT_BE_U_4(tptr + tlen);
 351             tlen += 4;
 352
 353             if (text_length) {
 354                 if (pdu_len < tlen + text_length)
 355                     goto invalid;
 356                 /* nd_printn() makes the bounds check */
 357                 ND_PRINT("%sError text: ", indent_string(indent+2));
 358                 if (nd_printn(ndo, tptr + tlen, text_length, ndo->ndo_snapend))
 359                         goto trunc;
 360             }
 361         }
 362         break;
 363
 364     default:
 365         ND_TCHECK_LEN(tptr, pdu_len);
 366
 367         /*
 368          * Unknown data, please hexdump.
 369          */
 370         hexdump = TRUE;
 371     }
 372
 373     /* do we also want to see a hex dump ? */
 374     if (ndo->ndo_vflag > 1 || (ndo->ndo_vflag && hexdump)) {
 375         print_unknown_data(ndo,tptr,"\n\t  ", pdu_len);
 376     }
 377     return pdu_len;
 378
 379 invalid:
 380     ND_PRINT("%s", istr);
 381     ND_TCHECK_LEN(tptr, len);
 382     return len;
 383 trunc:
 384     ND_PRINT("\n\t%s", tstr);
 385     return len;
 386 }
 387
 388 void
 389 rpki_rtr_print(netdissect_options *ndo, const u_char *pptr, u_int len)
 390 {
 391     ndo->ndo_protocol = "rpki_rtr";
 392     if (!ndo->ndo_vflag) {
 393         ND_PRINT(", RPKI-RTR");
 394         return;
 395     }
 396     while (len) {
 397         u_int pdu_len = rpki_rtr_pdu_print(ndo, pptr, len, 1, 8);
 398         len -= pdu_len;
 399         pptr += pdu_len;
 400     }
 401 }