CVE-2017-13687/CHDLC: Improve bounds and length checks.

[tcpdump] / print-bgp.c

diff --git a/print-bgp.c b/print-bgp.c
index 7e0ce9465a10fcdc7880de581cf430379397b14c..6475fd1b5d71e6940c0be330c6235bdc3e5011d7 100644 (file)
--- a/print-bgp.c
+++ b/print-bgp.c
@@ -26,7 +26,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *

- * Extensively modified by Hannes Gredler (hannes@juniper.net) for more
+ * Extensively modified by Hannes Gredler (hannes@gredler.at) for more

  * complete BGP support.
  */
 
  * complete BGP support.
  */
 


@@ -136,9 +136,10 @@ struct bgp_route_refresh {
 #define BGPTYPE_TUNNEL_ENCAP            23      /* RFC5512 */
 #define BGPTYPE_TRAFFIC_ENG             24      /* RFC5543 */
 #define BGPTYPE_IPV6_EXTD_COMMUNITIES   25      /* RFC5701 */
 #define BGPTYPE_TUNNEL_ENCAP            23      /* RFC5512 */
 #define BGPTYPE_TRAFFIC_ENG             24      /* RFC5543 */
 #define BGPTYPE_IPV6_EXTD_COMMUNITIES   25      /* RFC5701 */

-#define BGPTYPE_AIGP                    26      /* draft-ietf-idr-aigp */
+#define BGPTYPE_AIGP                    26      /* RFC7311 */

 #define BGPTYPE_PE_DISTINGUISHER_LABEL  27      /* RFC6514 */
 #define BGPTYPE_ENTROPY_LABEL           28      /* RFC6790 */
 #define BGPTYPE_PE_DISTINGUISHER_LABEL  27      /* RFC6514 */
 #define BGPTYPE_ENTROPY_LABEL           28      /* RFC6790 */

+#define BGPTYPE_LARGE_COMMUNITY                32      /* draft-ietf-idr-large-community-05 */

 #define BGPTYPE_ATTR_SET               128      /* RFC6368 */
 
 #define BGP_MP_NLRI_MINSIZE              3       /* End of RIB Marker detection */
 #define BGPTYPE_ATTR_SET               128      /* RFC6368 */
 
 #define BGP_MP_NLRI_MINSIZE              3       /* End of RIB Marker detection */


@@ -169,6 +170,7 @@ static const struct tok bgp_attr_values[] = {
     { BGPTYPE_AIGP,             "Accumulated IGP Metric"},
     { BGPTYPE_PE_DISTINGUISHER_LABEL, "PE Distinguisher Label"},
     { BGPTYPE_ENTROPY_LABEL,    "Entropy Label"},
     { BGPTYPE_AIGP,             "Accumulated IGP Metric"},
     { BGPTYPE_PE_DISTINGUISHER_LABEL, "PE Distinguisher Label"},
     { BGPTYPE_ENTROPY_LABEL,    "Entropy Label"},

+    { BGPTYPE_LARGE_COMMUNITY,  "Large Community"},

     { BGPTYPE_ATTR_SET,         "Attribute Set"},
     { 255,                      "Reserved for development"},
     { 0, NULL}
     { BGPTYPE_ATTR_SET,         "Attribute Set"},
     { 255,                      "Reserved for development"},
     { 0, NULL}


@@ -201,7 +203,6 @@ static const struct tok bgp_as_path_segment_close_values[] = {
 #define BGP_OPT_AUTH                    1
 #define BGP_OPT_CAP                     2
 
 #define BGP_OPT_AUTH                    1
 #define BGP_OPT_CAP                     2
 

-

 static const struct tok bgp_opt_values[] = {
     { BGP_OPT_AUTH,             "Authentication Information"},
     { BGP_OPT_CAP,              "Capabilities Advertisement"},
 static const struct tok bgp_opt_values[] = {
     { BGP_OPT_AUTH,             "Authentication Information"},
     { BGP_OPT_CAP,              "Capabilities Advertisement"},


@@ -217,7 +218,7 @@ static const struct tok bgp_opt_values[] = {
 #define BGP_CAPCODE_AS_NEW             65 /* RFC6793 */
 #define BGP_CAPCODE_DYN_CAP            67 /* draft-ietf-idr-dynamic-cap */
 #define BGP_CAPCODE_MULTISESS          68 /* draft-ietf-idr-bgp-multisession */
 #define BGP_CAPCODE_AS_NEW             65 /* RFC6793 */
 #define BGP_CAPCODE_DYN_CAP            67 /* draft-ietf-idr-dynamic-cap */
 #define BGP_CAPCODE_MULTISESS          68 /* draft-ietf-idr-bgp-multisession */

-#define BGP_CAPCODE_ADD_PATH           69 /* draft-ietf-idr-add-paths */
+#define BGP_CAPCODE_ADD_PATH           69 /* RFC7911 */

 #define BGP_CAPCODE_ENH_RR             70 /* draft-keyur-bgp-enhanced-route-refresh */
 #define BGP_CAPCODE_RR_CISCO          128
 
 #define BGP_CAPCODE_ENH_RR             70 /* draft-keyur-bgp-enhanced-route-refresh */
 #define BGP_CAPCODE_RR_CISCO          128
 


@@ -302,6 +303,13 @@ static const struct tok bgp_notify_minor_update_values[] = {
     { 0, NULL}
 };
 
     { 0, NULL}
 };
 

+static const struct tok bgp_notify_minor_fsm_values[] = {
+    { 1,                        "In OpenSent State"},
+    { 2,                        "In OpenConfirm State"},
+    { 3,                        "In Established State"},
+    { 0, NULL }
+};
+

 static const struct tok bgp_notify_minor_cap_values[] = {
     { 1,                        "Invalid Action Value" },
     { 2,                        "Invalid Capability Length" },
 static const struct tok bgp_notify_minor_cap_values[] = {
     { 1,                        "Invalid Action Value" },
     { 2,                        "Invalid Capability Length" },


@@ -348,7 +356,6 @@ static const struct tok bgp_aigp_values[] = {
     { 0, NULL}
 };
 
     { 0, NULL}
 };
 

-

 /* Subsequent address family identifier, RFC2283 section 7 */
 #define SAFNUM_RES                      0
 #define SAFNUM_UNICAST                  1
 /* Subsequent address family identifier, RFC2283 section 7 */
 #define SAFNUM_RES                      0
 #define SAFNUM_UNICAST                  1


@@ -423,7 +430,6 @@ static const struct tok bgp_safi_values[] = {
 #define BGP_EXT_COM_L2VPN_RT_0  0x000a  /* L2VPN Identifier,Format AS(2bytes):AN(4bytes) */
 #define BGP_EXT_COM_L2VPN_RT_1  0xF10a  /* L2VPN Identifier,Format IP address:AN(2bytes) */
 
 #define BGP_EXT_COM_L2VPN_RT_0  0x000a  /* L2VPN Identifier,Format AS(2bytes):AN(4bytes) */
 #define BGP_EXT_COM_L2VPN_RT_1  0xF10a  /* L2VPN Identifier,Format IP address:AN(2bytes) */
 

-

 /* http://www.cisco.com/en/US/tech/tk436/tk428/technologies_tech_note09186a00801eb09a.shtml  */
 #define BGP_EXT_COM_EIGRP_GEN   0x8800
 #define BGP_EXT_COM_EIGRP_METRIC_AS_DELAY  0x8801
 /* http://www.cisco.com/en/US/tech/tk436/tk428/technologies_tech_note09186a00801eb09a.shtml  */
 #define BGP_EXT_COM_EIGRP_GEN   0x8800
 #define BGP_EXT_COM_EIGRP_METRIC_AS_DELAY  0x8801


@@ -700,7 +706,6 @@ trunc:
     return (total_length);
 }
 
     return (total_length);
 }
 

-

 /* RDs and RTs share the same semantics
  * we use bgp_vpn_rd_print for
  * printing route targets inside a NLRI */
 /* RDs and RTs share the same semantics
  * we use bgp_vpn_rd_print for
  * printing route targets inside a NLRI */


@@ -1367,7 +1372,6 @@ bgp_attr_print(netdissect_options *ndo,
                }
                break;
 
                }
                break;
 

-

         /*
          * Process AS4 byte path and AS2 byte path attributes here.
          */
         /*
          * Process AS4 byte path and AS2 byte path attributes here.
          */


@@ -2184,7 +2188,6 @@ bgp_attr_print(netdissect_options *ndo,
                              tok2str(bgp_aigp_values, "Unknown", type),
                              type, length));
 
                              tok2str(bgp_aigp_values, "Unknown", type),
                              type, length));
 

-

                    /*
                     * Check if we can read the TLV data.
                     */
                    /*
                     * Check if we can read the TLV data.
                     */


@@ -2260,7 +2263,23 @@ bgp_attr_print(netdissect_options *ndo,
                }
                 break;
 
                }
                 break;
 

-
+       case BGPTYPE_LARGE_COMMUNITY:
+               if (len == 0 || len % 12) {
+                       ND_PRINT((ndo, "invalid len"));
+                       break;
+               }
+               ND_PRINT((ndo, "\n\t    "));
+               while (len > 0) {
+                       ND_TCHECK2(*tptr, 12);
+                       ND_PRINT((ndo, "%u:%u:%u%s",
+                                EXTRACT_32BITS(tptr),
+                                EXTRACT_32BITS(tptr + 4),
+                                EXTRACT_32BITS(tptr + 8),
+                                (len > 12) ? ", " : ""));
+                        tptr += 12;
+                        len -= 12;
+               }
+               break;

        default:
            ND_TCHECK2(*pptr,len);
             ND_PRINT((ndo, "\n\t    no Attribute %u decoder", atype)); /* we have no decoder for the attribute */
        default:
            ND_TCHECK2(*pptr,len);
             ND_PRINT((ndo, "\n\t    no Attribute %u decoder", atype)); /* we have no decoder for the attribute */


@@ -2618,11 +2637,18 @@ bgp_notification_print(netdissect_options *ndo,
                              bgpn.bgpn_minor),
                   bgpn.bgpn_minor));
             break;
                              bgpn.bgpn_minor),
                   bgpn.bgpn_minor));
             break;

+        case BGP_NOTIFY_MAJOR_FSM:
+            ND_PRINT((ndo, " subcode %s (%u)",
+                  tok2str(bgp_notify_minor_fsm_values, "Unknown",
+                             bgpn.bgpn_minor),
+                  bgpn.bgpn_minor));
+            break;

         case BGP_NOTIFY_MAJOR_CAP:
             ND_PRINT((ndo, " subcode %s (%u)",
                   tok2str(bgp_notify_minor_cap_values, "Unknown",
                              bgpn.bgpn_minor),
                   bgpn.bgpn_minor));
         case BGP_NOTIFY_MAJOR_CAP:
             ND_PRINT((ndo, " subcode %s (%u)",
                   tok2str(bgp_notify_minor_cap_values, "Unknown",
                              bgpn.bgpn_minor),
                   bgpn.bgpn_minor));

+            break;

         case BGP_NOTIFY_MAJOR_CEASE:
             ND_PRINT((ndo, ", subcode %s (%u)",
                   tok2str(bgp_notify_minor_cease_values, "Unknown",
         case BGP_NOTIFY_MAJOR_CEASE:
             ND_PRINT((ndo, ", subcode %s (%u)",
                   tok2str(bgp_notify_minor_cease_values, "Unknown",