CVE-2017-13687/CHDLC: Improve bounds and length checks.

[tcpdump] / print-bgp.c

diff --git a/print-bgp.c b/print-bgp.c
index 7e0ce9465a10fcdc7880de581cf430379397b14c..6475fd1b5d71e6940c0be330c6235bdc3e5011d7 100644 (file)
--- a/print-bgp.c
+++ b/print-bgp.c
@@ -26,7 +26,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * Extensively modified by Hannes Gredler (hannes@juniper.net) for more
+ * Extensively modified by Hannes Gredler (hannes@gredler.at) for more
  * complete BGP support.
  */
 
@@ -136,9 +136,10 @@ struct bgp_route_refresh {
 #define BGPTYPE_TUNNEL_ENCAP            23      /* RFC5512 */
 #define BGPTYPE_TRAFFIC_ENG             24      /* RFC5543 */
 #define BGPTYPE_IPV6_EXTD_COMMUNITIES   25      /* RFC5701 */
-#define BGPTYPE_AIGP                    26      /* draft-ietf-idr-aigp */
+#define BGPTYPE_AIGP                    26      /* RFC7311 */
 #define BGPTYPE_PE_DISTINGUISHER_LABEL  27      /* RFC6514 */
 #define BGPTYPE_ENTROPY_LABEL           28      /* RFC6790 */
+#define BGPTYPE_LARGE_COMMUNITY                32      /* draft-ietf-idr-large-community-05 */
 #define BGPTYPE_ATTR_SET               128      /* RFC6368 */
 
 #define BGP_MP_NLRI_MINSIZE              3       /* End of RIB Marker detection */
@@ -169,6 +170,7 @@ static const struct tok bgp_attr_values[] = {
     { BGPTYPE_AIGP,             "Accumulated IGP Metric"},
     { BGPTYPE_PE_DISTINGUISHER_LABEL, "PE Distinguisher Label"},
     { BGPTYPE_ENTROPY_LABEL,    "Entropy Label"},
+    { BGPTYPE_LARGE_COMMUNITY,  "Large Community"},
     { BGPTYPE_ATTR_SET,         "Attribute Set"},
     { 255,                      "Reserved for development"},
     { 0, NULL}
@@ -201,7 +203,6 @@ static const struct tok bgp_as_path_segment_close_values[] = {
 #define BGP_OPT_AUTH                    1
 #define BGP_OPT_CAP                     2
 
-
 static const struct tok bgp_opt_values[] = {
     { BGP_OPT_AUTH,             "Authentication Information"},
     { BGP_OPT_CAP,              "Capabilities Advertisement"},
@@ -217,7 +218,7 @@ static const struct tok bgp_opt_values[] = {
 #define BGP_CAPCODE_AS_NEW             65 /* RFC6793 */
 #define BGP_CAPCODE_DYN_CAP            67 /* draft-ietf-idr-dynamic-cap */
 #define BGP_CAPCODE_MULTISESS          68 /* draft-ietf-idr-bgp-multisession */
-#define BGP_CAPCODE_ADD_PATH           69 /* draft-ietf-idr-add-paths */
+#define BGP_CAPCODE_ADD_PATH           69 /* RFC7911 */
 #define BGP_CAPCODE_ENH_RR             70 /* draft-keyur-bgp-enhanced-route-refresh */
 #define BGP_CAPCODE_RR_CISCO          128
 
@@ -302,6 +303,13 @@ static const struct tok bgp_notify_minor_update_values[] = {
     { 0, NULL}
 };
 
+static const struct tok bgp_notify_minor_fsm_values[] = {
+    { 1,                        "In OpenSent State"},
+    { 2,                        "In OpenConfirm State"},
+    { 3,                        "In Established State"},
+    { 0, NULL }
+};
+
 static const struct tok bgp_notify_minor_cap_values[] = {
     { 1,                        "Invalid Action Value" },
     { 2,                        "Invalid Capability Length" },
@@ -348,7 +356,6 @@ static const struct tok bgp_aigp_values[] = {
     { 0, NULL}
 };
 
-
 /* Subsequent address family identifier, RFC2283 section 7 */
 #define SAFNUM_RES                      0
 #define SAFNUM_UNICAST                  1
@@ -423,7 +430,6 @@ static const struct tok bgp_safi_values[] = {
 #define BGP_EXT_COM_L2VPN_RT_0  0x000a  /* L2VPN Identifier,Format AS(2bytes):AN(4bytes) */
 #define BGP_EXT_COM_L2VPN_RT_1  0xF10a  /* L2VPN Identifier,Format IP address:AN(2bytes) */
 
-
 /* http://www.cisco.com/en/US/tech/tk436/tk428/technologies_tech_note09186a00801eb09a.shtml  */
 #define BGP_EXT_COM_EIGRP_GEN   0x8800
 #define BGP_EXT_COM_EIGRP_METRIC_AS_DELAY  0x8801
@@ -700,7 +706,6 @@ trunc:
     return (total_length);
 }
 
-
 /* RDs and RTs share the same semantics
  * we use bgp_vpn_rd_print for
  * printing route targets inside a NLRI */
@@ -1367,7 +1372,6 @@ bgp_attr_print(netdissect_options *ndo,
                }
                break;
 
-
         /*
          * Process AS4 byte path and AS2 byte path attributes here.
          */
@@ -2184,7 +2188,6 @@ bgp_attr_print(netdissect_options *ndo,
                              tok2str(bgp_aigp_values, "Unknown", type),
                              type, length));
 
-
                    /*
                     * Check if we can read the TLV data.
                     */
@@ -2260,7 +2263,23 @@ bgp_attr_print(netdissect_options *ndo,
                }
                 break;
 
-
+       case BGPTYPE_LARGE_COMMUNITY:
+               if (len == 0 || len % 12) {
+                       ND_PRINT((ndo, "invalid len"));
+                       break;
+               }
+               ND_PRINT((ndo, "\n\t    "));
+               while (len > 0) {
+                       ND_TCHECK2(*tptr, 12);
+                       ND_PRINT((ndo, "%u:%u:%u%s",
+                                EXTRACT_32BITS(tptr),
+                                EXTRACT_32BITS(tptr + 4),
+                                EXTRACT_32BITS(tptr + 8),
+                                (len > 12) ? ", " : ""));
+                        tptr += 12;
+                        len -= 12;
+               }
+               break;
        default:
            ND_TCHECK2(*pptr,len);
             ND_PRINT((ndo, "\n\t    no Attribute %u decoder", atype)); /* we have no decoder for the attribute */
@@ -2618,11 +2637,18 @@ bgp_notification_print(netdissect_options *ndo,
                              bgpn.bgpn_minor),
                   bgpn.bgpn_minor));
             break;
+        case BGP_NOTIFY_MAJOR_FSM:
+            ND_PRINT((ndo, " subcode %s (%u)",
+                  tok2str(bgp_notify_minor_fsm_values, "Unknown",
+                             bgpn.bgpn_minor),
+                  bgpn.bgpn_minor));
+            break;
         case BGP_NOTIFY_MAJOR_CAP:
             ND_PRINT((ndo, " subcode %s (%u)",
                   tok2str(bgp_notify_minor_cap_values, "Unknown",
                              bgpn.bgpn_minor),
                   bgpn.bgpn_minor));
+            break;
         case BGP_NOTIFY_MAJOR_CEASE:
             ND_PRINT((ndo, ", subcode %s (%u)",
                   tok2str(bgp_notify_minor_cease_values, "Unknown",