added icmpv6 test case

[tcpdump] / print-ospf6.c

diff --git a/print-ospf6.c b/print-ospf6.c
index 2a9b97f1e5cab85c42c0fe6e73c5f4f0b29dc9d2..fb62b3968597f64103e65dc994ae873191ba0968 100644 (file)
--- a/print-ospf6.c
+++ b/print-ospf6.c
@@ -23,7 +23,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
 
 #ifndef lint
 static const char rcsid[] _U_ =

-    "@(#) $Header: /tcpdump/master/tcpdump/print-ospf6.c,v 1.14 2006-09-05 15:50:26 hannes Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/tcpdump/print-ospf6.c,v 1.15 2006-09-13 06:31:11 guy Exp $ (LBL)";

 #endif
 
 #ifdef HAVE_CONFIG_H
 #endif
 
 #ifdef HAVE_CONFIG_H


@@ -150,7 +150,7 @@ ospf6_print_lshdr(register const struct lsa6_hdr *lshp)
                ipaddr_string(&lshp->ls_router),
                EXTRACT_32BITS(&lshp->ls_seq),
                EXTRACT_16BITS(&lshp->ls_age),
                ipaddr_string(&lshp->ls_router),
                EXTRACT_32BITS(&lshp->ls_seq),
                EXTRACT_16BITS(&lshp->ls_age),

-               EXTRACT_16BITS(&lshp->ls_length)-sizeof(struct lsa6_hdr));
+               EXTRACT_16BITS(&lshp->ls_length)-(u_int)sizeof(struct lsa6_hdr));

 
        ospf6_print_ls_type(EXTRACT_16BITS(&lshp->ls_type), &lshp->ls_stateid);
 
 
        ospf6_print_ls_type(EXTRACT_16BITS(&lshp->ls_type), &lshp->ls_stateid);
 


@@ -160,17 +160,25 @@ trunc:
 }
 
 static int
 }
 
 static int

-ospf6_print_lsaprefix(register const struct lsa6_prefix *lsapp)
+ospf6_print_lsaprefix(const u_int8_t *tptr, u_int lsa_length)

 {
 {

+       const struct lsa6_prefix *lsapp = (struct lsa6_prefix *)tptr;

        u_int wordlen;
        struct in6_addr prefix;
 
        u_int wordlen;
        struct in6_addr prefix;
 

-       TCHECK(*lsapp);
+       if (lsa_length < sizeof (*lsapp) - 4)
+               goto trunc;
+       lsa_length -= sizeof (*lsapp) - 4;
+       TCHECK2(*lsapp, sizeof (*lsapp) - 4);

        wordlen = (lsapp->lsa_p_len + 31) / 32;
        if (wordlen * 4 > sizeof(struct in6_addr)) {
                printf(" bogus prefixlen /%d", lsapp->lsa_p_len);
                goto trunc;
        }
        wordlen = (lsapp->lsa_p_len + 31) / 32;
        if (wordlen * 4 > sizeof(struct in6_addr)) {
                printf(" bogus prefixlen /%d", lsapp->lsa_p_len);
                goto trunc;
        }

+       if (lsa_length < wordlen * 4)
+               goto trunc;
+       lsa_length -= wordlen * 4;
+       TCHECK2(lsapp->lsa_p_prefix, wordlen * 4);

        memset(&prefix, 0, sizeof(prefix));
        memcpy(&prefix, lsapp->lsa_p_prefix, wordlen * 4);
        printf("\n\t\t%s/%d", ip6addr_string(&prefix),
        memset(&prefix, 0, sizeof(prefix));
        memcpy(&prefix, lsapp->lsa_p_prefix, wordlen * 4);
        printf("\n\t\t%s/%d", ip6addr_string(&prefix),


@@ -194,7 +202,6 @@ trunc:
 static int
 ospf6_print_lsa(register const struct lsa6 *lsap)
 {
 static int
 ospf6_print_lsa(register const struct lsa6 *lsap)
 {

-       register const u_char *ls_end, *ls_opt;

        register const struct rlalink6 *rlp;
 #if 0
        register const struct tos_metric *tosp;
        register const struct rlalink6 *rlp;
 #if 0
        register const struct tos_metric *tosp;


@@ -210,34 +217,45 @@ ospf6_print_lsa(register const struct lsa6 *lsap)
        register const u_int32_t *lp;
 #endif
        register u_int prefixes;
        register const u_int32_t *lp;
 #endif
        register u_int prefixes;

-       register int bytelen, length, lsa_length;
+       register int bytelen;
+       register u_int length, lsa_length;

        u_int32_t flags32;
        u_int32_t flags32;

-        u_int8_t *tptr;
+       const u_int8_t *tptr;

 
        if (ospf6_print_lshdr(&lsap->ls_hdr))
                return (1);
        TCHECK(lsap->ls_hdr.ls_length);
         length = EXTRACT_16BITS(&lsap->ls_hdr.ls_length);
 
        if (ospf6_print_lshdr(&lsap->ls_hdr))
                return (1);
        TCHECK(lsap->ls_hdr.ls_length);
         length = EXTRACT_16BITS(&lsap->ls_hdr.ls_length);

+
+       /*
+        * The LSA length includes the length of the header;
+        * it must have a value that's at least that length.
+        * If it does, find the length of what follows the
+        * header.
+        */
+        if (length < sizeof(struct lsa6_hdr))
+               return (1);

         lsa_length = length - sizeof(struct lsa6_hdr);
         lsa_length = length - sizeof(struct lsa6_hdr);

-       ls_end = (u_char *)lsap + length;

         tptr = (u_int8_t *)lsap+sizeof(struct lsa6_hdr);
 
        switch (EXTRACT_16BITS(&lsap->ls_hdr.ls_type)) {
        case LS_TYPE_ROUTER | LS_SCOPE_AREA:
         tptr = (u_int8_t *)lsap+sizeof(struct lsa6_hdr);
 
        switch (EXTRACT_16BITS(&lsap->ls_hdr.ls_type)) {
        case LS_TYPE_ROUTER | LS_SCOPE_AREA:

+               if (lsa_length < sizeof (lsap->lsa_un.un_rla.rla_options))
+                       return (1);
+               lsa_length -= sizeof (lsap->lsa_un.un_rla.rla_options);

                TCHECK(lsap->lsa_un.un_rla.rla_options);
                 printf("\n\t      Options [%s]",
                        bittok2str(ospf6_option_values, "none",
                                   EXTRACT_32BITS(&lsap->lsa_un.un_rla.rla_options)));
                TCHECK(lsap->lsa_un.un_rla.rla_options);
                 printf("\n\t      Options [%s]",
                        bittok2str(ospf6_option_values, "none",
                                   EXTRACT_32BITS(&lsap->lsa_un.un_rla.rla_options)));

-
-               TCHECK(lsap->lsa_un.un_rla.rla_flags);

                 printf(", RLA-Flags [%s]",
                        bittok2str(ospf6_rla_flag_values, "none",
                                   lsap->lsa_un.un_rla.rla_flags));
 
                 printf(", RLA-Flags [%s]",
                        bittok2str(ospf6_rla_flag_values, "none",
                                   lsap->lsa_un.un_rla.rla_flags));
 

-
-               TCHECK(lsap->lsa_un.un_rla.rla_link);

                rlp = lsap->lsa_un.un_rla.rla_link;
                rlp = lsap->lsa_un.un_rla.rla_link;

-               while (rlp + 1 <= (struct rlalink6 *)ls_end) {
+               while (lsa_length != 0) {
+                       if (lsa_length < sizeof (*rlp))
+                               return (1);
+                       lsa_length -= sizeof (*rlp);

                        TCHECK(*rlp);
                        switch (rlp->link_type) {
 
                        TCHECK(*rlp);
                        switch (rlp->link_type) {
 


@@ -276,13 +294,20 @@ ospf6_print_lsa(register const struct lsa6 *lsap)
                break;
 
        case LS_TYPE_NETWORK | LS_SCOPE_AREA:
                break;
 
        case LS_TYPE_NETWORK | LS_SCOPE_AREA:

+               if (lsa_length < sizeof (lsap->lsa_un.un_nla.nla_options))
+                       return (1);
+               lsa_length -= sizeof (lsap->lsa_un.un_nla.nla_options);

                TCHECK(lsap->lsa_un.un_nla.nla_options);
                 printf("\n\t      Options [%s]",
                        bittok2str(ospf6_option_values, "none",
                                   EXTRACT_32BITS(&lsap->lsa_un.un_nla.nla_options)));
                TCHECK(lsap->lsa_un.un_nla.nla_options);
                 printf("\n\t      Options [%s]",
                        bittok2str(ospf6_option_values, "none",
                                   EXTRACT_32BITS(&lsap->lsa_un.un_nla.nla_options)));

+

                printf("\n\t      Connected Routers:");
                ap = lsap->lsa_un.un_nla.nla_router;
                printf("\n\t      Connected Routers:");
                ap = lsap->lsa_un.un_nla.nla_router;

-               while ((u_char *)ap < ls_end) {
+               while (lsa_length != 0) {
+                       if (lsa_length < sizeof (*ap))
+                               return (1);
+                       lsa_length -= sizeof (*ap);

                        TCHECK(*ap);
                        printf("\n\t\t%s", ipaddr_string(ap));
                        ++ap;
                        TCHECK(*ap);
                        printf("\n\t\t%s", ipaddr_string(ap));
                        ++ap;


@@ -290,18 +315,27 @@ ospf6_print_lsa(register const struct lsa6 *lsap)
                break;
 
        case LS_TYPE_INTER_AP | LS_SCOPE_AREA:
                break;
 
        case LS_TYPE_INTER_AP | LS_SCOPE_AREA:

+               if (lsa_length < sizeof (lsap->lsa_un.un_inter_ap.inter_ap_metric))
+                       return (1);
+               lsa_length -= sizeof (lsap->lsa_un.un_inter_ap.inter_ap_metric);

                TCHECK(lsap->lsa_un.un_inter_ap.inter_ap_metric);
                printf(", metric %u",
                        EXTRACT_32BITS(&lsap->lsa_un.un_inter_ap.inter_ap_metric) & SLA_MASK_METRIC);
                TCHECK(lsap->lsa_un.un_inter_ap.inter_ap_metric);
                printf(", metric %u",
                        EXTRACT_32BITS(&lsap->lsa_un.un_inter_ap.inter_ap_metric) & SLA_MASK_METRIC);

-               lsapp = lsap->lsa_un.un_inter_ap.inter_ap_prefix;
-               while (lsapp + sizeof(lsapp) <= (struct lsa6_prefix *)ls_end) {
-                       bytelen = ospf6_print_lsaprefix(lsapp);
-                       if (bytelen)
+
+               tptr = (u_int8_t *)lsap->lsa_un.un_inter_ap.inter_ap_prefix;
+               while (lsa_length != 0) {
+                       bytelen = ospf6_print_lsaprefix(tptr, lsa_length);
+                       if (bytelen < 0)

                                goto trunc;
                                goto trunc;

-                       lsapp = (struct lsa6_prefix *)(((u_char *)lsapp) + bytelen);
+                       lsa_length -= bytelen;
+                       tptr += bytelen;

                }
                break;
                }
                break;

-       case LS_SCOPE_AS | LS_TYPE_ASE:
+
+       case LS_TYPE_ASE | LS_SCOPE_AS:
+               if (lsa_length < sizeof (lsap->lsa_un.un_asla.asla_metric))
+                       return (1);
+               lsa_length -= sizeof (lsap->lsa_un.un_asla.asla_metric);

                TCHECK(lsap->lsa_un.un_asla.asla_metric);
                flags32 = EXTRACT_32BITS(&lsap->lsa_un.un_asla.asla_metric);
                 printf("\n\t     Flags [%s]",
                TCHECK(lsap->lsa_un.un_asla.asla_metric);
                flags32 = EXTRACT_32BITS(&lsap->lsa_un.un_asla.asla_metric);
                 printf("\n\t     Flags [%s]",


@@ -309,48 +343,63 @@ ospf6_print_lsa(register const struct lsa6 *lsap)
                printf(" metric %u",
                       EXTRACT_32BITS(&lsap->lsa_un.un_asla.asla_metric) &
                       ASLA_MASK_METRIC);
                printf(" metric %u",
                       EXTRACT_32BITS(&lsap->lsa_un.un_asla.asla_metric) &
                       ASLA_MASK_METRIC);

-               lsapp = lsap->lsa_un.un_asla.asla_prefix;
-               bytelen = ospf6_print_lsaprefix(lsapp);
+
+               tptr = (u_int8_t *)lsap->lsa_un.un_asla.asla_prefix;
+               lsapp = (struct lsa6_prefix *)tptr;
+               bytelen = ospf6_print_lsaprefix(tptr, lsa_length);

                if (bytelen < 0)
                        goto trunc;
                if (bytelen < 0)
                        goto trunc;

-               if ((ls_opt = (u_char *)(((u_char *)lsapp) + bytelen)) < ls_end) {
-                       struct in6_addr *fwdaddr6;
+               lsa_length -= bytelen;
+               tptr += bytelen;

 
 

-                       if ((flags32 & ASLA_FLAG_FWDADDR) != 0) {
-                               fwdaddr6 = (struct in6_addr *)ls_opt;
-                               TCHECK(*fwdaddr6);
-                               printf(" forward %s",
-                                      ip6addr_string(fwdaddr6));
-
-                               ls_opt += sizeof(struct in6_addr);
-                       }
-
-                       if ((flags32 & ASLA_FLAG_ROUTETAG) != 0) {
-                               TCHECK(*(u_int32_t *)ls_opt);
-                               printf(" tag %s",
-                                      ipaddr_string((u_int32_t *)ls_opt));
+               if ((flags32 & ASLA_FLAG_FWDADDR) != 0) {
+                       struct in6_addr *fwdaddr6;

 
 

-                               ls_opt += sizeof(u_int32_t);
-                       }
+                       fwdaddr6 = (struct in6_addr *)tptr;
+                       if (lsa_length < sizeof (*fwdaddr6))
+                               return (1);
+                       lsa_length -= sizeof (*fwdaddr6);
+                       TCHECK(*fwdaddr6);
+                       printf(" forward %s",
+                              ip6addr_string(fwdaddr6));
+                       tptr += sizeof(*fwdaddr6);
+               }

 
 

-                       if (lsapp->lsa_p_metric) {
-                               TCHECK(*(u_int32_t *)ls_opt);
-                               printf(" RefLSID: %s",
-                                      ipaddr_string((u_int32_t *)ls_opt));
+               if ((flags32 & ASLA_FLAG_ROUTETAG) != 0) {
+                       if (lsa_length < sizeof (u_int32_t))
+                               return (1);
+                       lsa_length -= sizeof (u_int32_t);
+                       TCHECK(*(u_int32_t *)tptr);
+                       printf(" tag %s",
+                              ipaddr_string((u_int32_t *)tptr));
+                       tptr += sizeof(u_int32_t);
+               }

 
 

-                               ls_opt += sizeof(u_int32_t);
-                       }
+               if (lsapp->lsa_p_metric) {
+                       if (lsa_length < sizeof (u_int32_t))
+                               return (1);
+                       lsa_length -= sizeof (u_int32_t);
+                       TCHECK(*(u_int32_t *)tptr);
+                       printf(" RefLSID: %s",
+                              ipaddr_string((u_int32_t *)tptr));
+                       tptr += sizeof(u_int32_t);

                }
                break;
 
        case LS_TYPE_LINK:
                /* Link LSA */
                llsap = &lsap->lsa_un.un_llsa;
                }
                break;
 
        case LS_TYPE_LINK:
                /* Link LSA */
                llsap = &lsap->lsa_un.un_llsa;

-               TCHECK(llsap->llsa_options);
+               if (lsa_length < sizeof (llsap->llsa_priandopt))
+                       return (1);
+               lsa_length -= sizeof (llsap->llsa_priandopt);
+               TCHECK(llsap->llsa_priandopt);

                 printf("\n\t      Options [%s]",
                        bittok2str(ospf6_option_values, "none",
                                   EXTRACT_32BITS(&llsap->llsa_options)));
                 printf("\n\t      Options [%s]",
                        bittok2str(ospf6_option_values, "none",
                                   EXTRACT_32BITS(&llsap->llsa_options)));

-               TCHECK(llsap->llsa_nprefix);
+
+               if (lsa_length < sizeof (llsap->llsa_lladdr) + sizeof (llsap->llsa_nprefix))
+                       return (1);
+               lsa_length -= sizeof (llsap->llsa_lladdr) + sizeof (llsap->llsa_nprefix);

                 prefixes = EXTRACT_32BITS(&llsap->llsa_nprefix);
                printf("\n\t      Priority %d, Link-local address %s, Prefixes %d:",
                        llsap->llsa_priority,
                 prefixes = EXTRACT_32BITS(&llsap->llsa_nprefix);
                printf("\n\t      Priority %d, Link-local address %s, Prefixes %d:",
                        llsap->llsa_priority,


@@ -358,57 +407,63 @@ ospf6_print_lsa(register const struct lsa6 *lsap)
                        prefixes);
 
                tptr = (u_int8_t *)llsap->llsa_prefix;
                        prefixes);
 
                tptr = (u_int8_t *)llsap->llsa_prefix;

-                while (prefixes > 0) {
-                    lsapp = (struct lsa6_prefix *)tptr;
-                    if ((bytelen = ospf6_print_lsaprefix(lsapp)) == -1) {
-                        goto trunc;
-                    }
-                    prefixes--;
-                    tptr += bytelen;
-                }
+               while (prefixes > 0) {
+                       bytelen = ospf6_print_lsaprefix(tptr, lsa_length);
+                       if (bytelen < 0)
+                               goto trunc;
+                       prefixes--;
+                       lsa_length -= bytelen;
+                       tptr += bytelen;
+               }

                break;
 
        case LS_TYPE_INTRA_AP | LS_SCOPE_AREA:
                /* Intra-Area-Prefix LSA */
                break;
 
        case LS_TYPE_INTRA_AP | LS_SCOPE_AREA:
                /* Intra-Area-Prefix LSA */

+               if (lsa_length < sizeof (lsap->lsa_un.un_intra_ap.intra_ap_rtid))
+                       return (1);
+               lsa_length -= sizeof (lsap->lsa_un.un_intra_ap.intra_ap_rtid);

                TCHECK(lsap->lsa_un.un_intra_ap.intra_ap_rtid);
                ospf6_print_ls_type(
                        EXTRACT_16BITS(&lsap->lsa_un.un_intra_ap.intra_ap_lstype),
                        &lsap->lsa_un.un_intra_ap.intra_ap_lsid);
                TCHECK(lsap->lsa_un.un_intra_ap.intra_ap_rtid);
                ospf6_print_ls_type(
                        EXTRACT_16BITS(&lsap->lsa_un.un_intra_ap.intra_ap_lstype),
                        &lsap->lsa_un.un_intra_ap.intra_ap_lsid);

+
+               if (lsa_length < sizeof (lsap->lsa_un.un_intra_ap.intra_ap_nprefix))
+                       return (1);
+               lsa_length -= sizeof (lsap->lsa_un.un_intra_ap.intra_ap_nprefix);

                TCHECK(lsap->lsa_un.un_intra_ap.intra_ap_nprefix);
                 prefixes = EXTRACT_16BITS(&lsap->lsa_un.un_intra_ap.intra_ap_nprefix);
                printf("\n\t      Prefixes %d:", prefixes);
 
                TCHECK(lsap->lsa_un.un_intra_ap.intra_ap_nprefix);
                 prefixes = EXTRACT_16BITS(&lsap->lsa_un.un_intra_ap.intra_ap_nprefix);
                printf("\n\t      Prefixes %d:", prefixes);
 

-                tptr = (u_int8_t *)lsap->lsa_un.un_intra_ap.intra_ap_prefix;
-
-                while (prefixes > 0) {
-                    lsapp = (struct lsa6_prefix *)tptr;
-                    if ((bytelen = ospf6_print_lsaprefix(lsapp)) == -1) {
-                        goto trunc;
-                    }
-                    prefixes--;
-                    tptr += bytelen;
-                }
+               tptr = (u_int8_t *)lsap->lsa_un.un_intra_ap.intra_ap_prefix;
+               while (prefixes > 0) {
+                       bytelen = ospf6_print_lsaprefix(tptr, lsa_length);
+                       if (bytelen < 0)
+                               goto trunc;
+                       prefixes--;
+                       lsa_length -= bytelen;
+                       tptr += bytelen;
+               }

                break;
 
         case LS_TYPE_GRACE | LS_SCOPE_LINKLOCAL:
                 if (ospf_print_grace_lsa(tptr, lsa_length) == -1) {
                     return 1;
                 }
                break;
 
         case LS_TYPE_GRACE | LS_SCOPE_LINKLOCAL:
                 if (ospf_print_grace_lsa(tptr, lsa_length) == -1) {
                     return 1;
                 }

-            
-            break;
+                break;

 
         case LS_TYPE_INTRA_ATE | LS_SCOPE_LINKLOCAL:
 
         case LS_TYPE_INTRA_ATE | LS_SCOPE_LINKLOCAL:

-            if (ospf_print_te_lsa(tptr, lsa_length) == -1) {
-                return 1;
-            }
-            break;
+                if (ospf_print_te_lsa(tptr, lsa_length) == -1) {
+                    return 1;
+                }
+                break;

 
        default:
 
        default:

-            if(!print_unknown_data(tptr,
-                                   "\n\t      ",
-                                   lsa_length)) {
-                return (1);
-            }
+                if(!print_unknown_data(tptr,
+                                       "\n\t      ",
+                                       lsa_length)) {
+                    return (1);
+                }
+                break;

        }
 
        return (0);
        }
 
        return (0);