ospf: clean up some length checks.

[tcpdump] / print-ospf.c

diff --git a/print-ospf.c b/print-ospf.c
index eeb7c40dac69f2a9d3bd4a90a0774677c66d978e..7d3578004c8946ffe5d9622ed9df1ba1a48d330e 100644 (file)
--- a/print-ospf.c
+++ b/print-ospf.c
@@ -238,7 +238,7 @@ ospf_grace_lsa_print(netdissect_options *ndo,
                 ND_PRINT("\n\t    Bogus length %u != 4", tlv_length);
                 return -1;
             }
                 ND_PRINT("\n\t    Bogus length %u != 4", tlv_length);
                 return -1;
             }

-            ND_PRINT("%s", ipaddr_string(ndo, tptr));
+            ND_PRINT("%s", GET_IPADDR_STRING(tptr));

             break;
 
         default:
             break;
 
         default:


@@ -301,7 +301,7 @@ ospf_te_lsa_print(netdissect_options *ndo,
 
         switch(tlv_type) {
         case LS_OPAQUE_TE_TLV_LINK:
 
         switch(tlv_type) {
         case LS_OPAQUE_TE_TLV_LINK:

-            while (tlv_length >= sizeof(subtlv_type) + sizeof(subtlv_length)) {
+            while (tlv_length != 0) {

                 if (tlv_length < 4) {
                     ND_PRINT("\n\t    Remaining TLV length %u < 4",
                            tlv_length);
                 if (tlv_length < 4) {
                     ND_PRINT("\n\t    Remaining TLV length %u < 4",
                            tlv_length);


@@ -322,6 +322,11 @@ ospf_te_lsa_print(netdissect_options *ndo,
                        subtlv_type,
                        subtlv_length);
 
                        subtlv_type,
                        subtlv_length);
 

+                if (tlv_length < subtlv_length) {
+                    ND_PRINT("\n\t    Remaining TLV length %u < %u",
+                           tlv_length + 4, subtlv_length + 4);
+                    return -1;
+                }

                 ND_TCHECK_LEN(tptr, subtlv_length);
                 switch(subtlv_type) {
                 case LS_OPAQUE_TE_LINK_SUBTLV_ADMIN_GROUP:
                 ND_TCHECK_LEN(tptr, subtlv_length);
                 switch(subtlv_type) {
                 case LS_OPAQUE_TE_LINK_SUBTLV_ADMIN_GROUP:


@@ -338,11 +343,11 @@ ospf_te_lsa_print(netdissect_options *ndo,
                        goto invalid;
                    }
                     ND_PRINT(", %s (0x%08x)",
                        goto invalid;
                    }
                     ND_PRINT(", %s (0x%08x)",

-                           ipaddr_string(ndo, tptr),
+                           GET_IPADDR_STRING(tptr),

                            GET_BE_U_4(tptr));
                     if (subtlv_length == 8) /* rfc4203 */
                         ND_PRINT(", %s (0x%08x)",
                            GET_BE_U_4(tptr));
                     if (subtlv_length == 8) /* rfc4203 */
                         ND_PRINT(", %s (0x%08x)",

-                               ipaddr_string(ndo, tptr+4),
+                               GET_IPADDR_STRING(tptr+4),

                                GET_BE_U_4(tptr + 4));
                     break;
                 case LS_OPAQUE_TE_LINK_SUBTLV_LOCAL_IP:
                                GET_BE_U_4(tptr + 4));
                     break;
                 case LS_OPAQUE_TE_LINK_SUBTLV_LOCAL_IP:


@@ -351,7 +356,7 @@ ospf_te_lsa_print(netdissect_options *ndo,
                        ND_PRINT(" != 4");
                        goto invalid;
                    }
                        ND_PRINT(" != 4");
                        goto invalid;
                    }

-                    ND_PRINT(", %s", ipaddr_string(ndo, tptr));
+                    ND_PRINT(", %s", GET_IPADDR_STRING(tptr));

                     break;
                 case LS_OPAQUE_TE_LINK_SUBTLV_MAX_BW:
                 case LS_OPAQUE_TE_LINK_SUBTLV_MAX_RES_BW:
                     break;
                 case LS_OPAQUE_TE_LINK_SUBTLV_MAX_BW:
                 case LS_OPAQUE_TE_LINK_SUBTLV_MAX_RES_BW:


@@ -471,6 +476,11 @@ ospf_te_lsa_print(netdissect_options *ndo,
                 if (subtlv_length%4 != 0)
                     subtlv_length+=4-(subtlv_length%4);
 
                 if (subtlv_length%4 != 0)
                     subtlv_length+=4-(subtlv_length%4);
 

+                if (tlv_length < subtlv_length) {
+                    ND_PRINT("\n\t    Remaining TLV length %u < %u",
+                           tlv_length + 4, subtlv_length + 4);
+                    return -1;
+                }

                 tlv_length-=subtlv_length;
                 tptr+=subtlv_length;
 
                 tlv_length-=subtlv_length;
                 tptr+=subtlv_length;
 


@@ -483,7 +493,7 @@ ospf_te_lsa_print(netdissect_options *ndo,
                 return -1;
             }
             ND_TCHECK_4(tptr);
                 return -1;
             }
             ND_TCHECK_4(tptr);

-            ND_PRINT(", %s", ipaddr_string(ndo, tptr));
+            ND_PRINT(", %s", GET_IPADDR_STRING(tptr));

             break;
 
         default:
             break;
 
         default:


@@ -496,6 +506,11 @@ ospf_te_lsa_print(netdissect_options *ndo,
         /* in OSPF everything has to be 32-bit aligned, including TLVs */
         if (tlv_length%4 != 0)
             tlv_length+=4-(tlv_length%4);
         /* in OSPF everything has to be 32-bit aligned, including TLVs */
         if (tlv_length%4 != 0)
             tlv_length+=4-(tlv_length%4);

+        if (tlv_length > ls_length) {
+            ND_PRINT("\n\t    Bogus padded length %u > %u", tlv_length,
+                   ls_length);
+            return -1;
+        }

         ls_length-=tlv_length;
         tptr+=tlv_length;
     }
         ls_length-=tlv_length;
         tptr+=tlv_length;
     }


@@ -517,14 +532,14 @@ ospf_print_lshdr(netdissect_options *ndo,
         ND_TCHECK_2(lshp->ls_length);
         ls_length = GET_BE_U_2(lshp->ls_length);
         if (ls_length < sizeof(struct lsa_hdr)) {
         ND_TCHECK_2(lshp->ls_length);
         ls_length = GET_BE_U_2(lshp->ls_length);
         if (ls_length < sizeof(struct lsa_hdr)) {

-                ND_PRINT("\n\t    Bogus length %u < header (%lu)", ls_length,
-                    (unsigned long)sizeof(struct lsa_hdr));
+                ND_PRINT("\n\t    Bogus length %u < header (%zu)", ls_length,
+                    sizeof(struct lsa_hdr));

                 return(-1);
         }
 
         ND_TCHECK_4(lshp->ls_seq); /* XXX - ls_length check checked this */
         ND_PRINT("\n\t  Advertising Router %s, seq 0x%08x, age %us, length %u",
                 return(-1);
         }
 
         ND_TCHECK_4(lshp->ls_seq); /* XXX - ls_length check checked this */
         ND_PRINT("\n\t  Advertising Router %s, seq 0x%08x, age %us, length %u",

-                  ipaddr_string(ndo, lshp->ls_router),
+                  GET_IPADDR_STRING(lshp->ls_router),

                   GET_BE_U_4(lshp->ls_seq),
                   GET_BE_U_2(lshp->ls_age),
                   ls_length - (u_int)sizeof(struct lsa_hdr));
                   GET_BE_U_4(lshp->ls_seq),
                   GET_BE_U_2(lshp->ls_age),
                   ls_length - (u_int)sizeof(struct lsa_hdr));


@@ -554,7 +569,7 @@ ospf_print_lshdr(netdissect_options *ndo,
             ND_PRINT("\n\t    %s LSA (%u), LSA-ID: %s",
                    tok2str(lsa_values,"unknown",ls_type),
                    ls_type,
             ND_PRINT("\n\t    %s LSA (%u), LSA-ID: %s",
                    tok2str(lsa_values,"unknown",ls_type),
                    ls_type,

-                   ipaddr_string(ndo, lshp->un_lsa_id.lsa_id));
+                   GET_IPADDR_STRING(lshp->un_lsa_id.lsa_id));

             break;
         }
 
             break;
         }
 


@@ -652,26 +667,26 @@ ospf_print_lsa(netdissect_options *ndo,
 
                        case RLA_TYPE_VIRTUAL:
                                ND_PRINT("\n\t      Virtual Link: Neighbor Router-ID: %s, Interface Address: %s",
 
                        case RLA_TYPE_VIRTUAL:
                                ND_PRINT("\n\t      Virtual Link: Neighbor Router-ID: %s, Interface Address: %s",

-                                   ipaddr_string(ndo, rlp->link_id),
-                                   ipaddr_string(ndo, rlp->link_data));
+                                   GET_IPADDR_STRING(rlp->link_id),
+                                   GET_IPADDR_STRING(rlp->link_data));

                                break;
 
                        case RLA_TYPE_ROUTER:
                                ND_PRINT("\n\t      Neighbor Router-ID: %s, Interface Address: %s",
                                break;
 
                        case RLA_TYPE_ROUTER:
                                ND_PRINT("\n\t      Neighbor Router-ID: %s, Interface Address: %s",

-                                   ipaddr_string(ndo, rlp->link_id),
-                                   ipaddr_string(ndo, rlp->link_data));
+                                   GET_IPADDR_STRING(rlp->link_id),
+                                   GET_IPADDR_STRING(rlp->link_data));

                                break;
 
                        case RLA_TYPE_TRANSIT:
                                ND_PRINT("\n\t      Neighbor Network-ID: %s, Interface Address: %s",
                                break;
 
                        case RLA_TYPE_TRANSIT:
                                ND_PRINT("\n\t      Neighbor Network-ID: %s, Interface Address: %s",

-                                   ipaddr_string(ndo, rlp->link_id),
-                                   ipaddr_string(ndo, rlp->link_data));
+                                   GET_IPADDR_STRING(rlp->link_id),
+                                   GET_IPADDR_STRING(rlp->link_data));

                                break;
 
                        case RLA_TYPE_STUB:
                                ND_PRINT("\n\t      Stub Network: %s, Mask: %s",
                                break;
 
                        case RLA_TYPE_STUB:
                                ND_PRINT("\n\t      Stub Network: %s, Mask: %s",

-                                   ipaddr_string(ndo, rlp->link_id),
-                                   ipaddr_string(ndo, rlp->link_data));
+                                   GET_IPADDR_STRING(rlp->link_id),
+                                   GET_IPADDR_STRING(rlp->link_data));

                                break;
 
                        default:
                                break;
 
                        default:


@@ -691,11 +706,11 @@ ospf_print_lsa(netdissect_options *ndo,
        case LS_TYPE_NETWORK:
                ND_TCHECK_4(lsap->lsa_un.un_nla.nla_mask);
                ND_PRINT("\n\t    Mask %s\n\t    Connected Routers:",
        case LS_TYPE_NETWORK:
                ND_TCHECK_4(lsap->lsa_un.un_nla.nla_mask);
                ND_PRINT("\n\t    Mask %s\n\t    Connected Routers:",

-                   ipaddr_string(ndo, lsap->lsa_un.un_nla.nla_mask));
+                   GET_IPADDR_STRING(lsap->lsa_un.un_nla.nla_mask));

                ap = lsap->lsa_un.un_nla.nla_router;
                while ((const u_char *)ap < ls_end) {
                        ND_TCHECK_SIZE(ap);
                ap = lsap->lsa_un.un_nla.nla_router;
                while ((const u_char *)ap < ls_end) {
                        ND_TCHECK_SIZE(ap);

-                       ND_PRINT("\n\t      %s", ipaddr_string(ndo, *ap));
+                       ND_PRINT("\n\t      %s", GET_IPADDR_STRING(*ap));

                        ++ap;
                }
                break;
                        ++ap;
                }
                break;


@@ -703,7 +718,7 @@ ospf_print_lsa(netdissect_options *ndo,
        case LS_TYPE_SUM_IP:
                ND_TCHECK_4(lsap->lsa_un.un_nla.nla_mask);
                ND_PRINT("\n\t    Mask %s",
        case LS_TYPE_SUM_IP:
                ND_TCHECK_4(lsap->lsa_un.un_nla.nla_mask);
                ND_PRINT("\n\t    Mask %s",

-                   ipaddr_string(ndo, lsap->lsa_un.un_sla.sla_mask));
+                   GET_IPADDR_STRING(lsap->lsa_un.un_sla.sla_mask));

                ND_TCHECK_SIZE(lsap->lsa_un.un_sla.sla_tosmetric);
                lp = (const uint8_t *)lsap->lsa_un.un_sla.sla_tosmetric;
                while (lp < ls_end) {
                ND_TCHECK_SIZE(lsap->lsa_un.un_sla.sla_tosmetric);
                lp = (const uint8_t *)lsap->lsa_un.un_sla.sla_tosmetric;
                while (lp < ls_end) {


@@ -741,7 +756,7 @@ ospf_print_lsa(netdissect_options *ndo,
         case LS_TYPE_NSSA: /* fall through - those LSAs share the same format */
                ND_TCHECK_4(lsap->lsa_un.un_nla.nla_mask);
                ND_PRINT("\n\t    Mask %s",
         case LS_TYPE_NSSA: /* fall through - those LSAs share the same format */
                ND_TCHECK_4(lsap->lsa_un.un_nla.nla_mask);
                ND_PRINT("\n\t    Mask %s",

-                   ipaddr_string(ndo, lsap->lsa_un.un_asla.asla_mask));
+                   GET_IPADDR_STRING(lsap->lsa_un.un_asla.asla_mask));

 
                ND_TCHECK_SIZE(lsap->lsa_un.un_sla.sla_tosmetric);
                almp = lsap->lsa_un.un_asla.asla_metric;
 
                ND_TCHECK_SIZE(lsap->lsa_un.un_sla.sla_tosmetric);
                almp = lsap->lsa_un.un_asla.asla_metric;


@@ -762,11 +777,11 @@ ospf_print_lsa(netdissect_options *ndo,
 
                        ND_TCHECK_4(almp->asla_forward);
                        if (GET_IPV4_TO_NETWORK_ORDER(almp->asla_forward) != 0) {
 
                        ND_TCHECK_4(almp->asla_forward);
                        if (GET_IPV4_TO_NETWORK_ORDER(almp->asla_forward) != 0) {

-                               ND_PRINT(", forward %s", ipaddr_string(ndo, almp->asla_forward));
+                               ND_PRINT(", forward %s", GET_IPADDR_STRING(almp->asla_forward));

                        }
                        ND_TCHECK_4(almp->asla_tag);
                        if (GET_IPV4_TO_NETWORK_ORDER(almp->asla_tag) != 0) {
                        }
                        ND_TCHECK_4(almp->asla_tag);
                        if (GET_IPV4_TO_NETWORK_ORDER(almp->asla_tag) != 0) {

-                               ND_PRINT(", tag %s", ipaddr_string(ndo, almp->asla_tag));
+                               ND_PRINT(", tag %s", GET_IPADDR_STRING(almp->asla_tag));

                        }
                        ++almp;
                }
                        }
                        ++almp;
                }


@@ -781,12 +796,12 @@ ospf_print_lsa(netdissect_options *ndo,
 
                        case MCLA_VERTEX_ROUTER:
                                ND_PRINT("\n\t    Router Router-ID %s",
 
                        case MCLA_VERTEX_ROUTER:
                                ND_PRINT("\n\t    Router Router-ID %s",

-                                   ipaddr_string(ndo, mcp->mcla_vid));
+                                   GET_IPADDR_STRING(mcp->mcla_vid));

                                break;
 
                        case MCLA_VERTEX_NETWORK:
                                ND_PRINT("\n\t    Network Designated Router %s",
                                break;
 
                        case MCLA_VERTEX_NETWORK:
                                ND_PRINT("\n\t    Network Designated Router %s",

-                                   ipaddr_string(ndo, mcp->mcla_vid));
+                                   GET_IPADDR_STRING(mcp->mcla_vid));

                                break;
 
                        default:
                                break;
 
                        default:


@@ -806,25 +821,26 @@ ospf_print_lsa(netdissect_options *ndo,
             case LS_OPAQUE_TYPE_RI:
                tptr = (const uint8_t *)(lsap->lsa_un.un_ri_tlv);
 
             case LS_OPAQUE_TYPE_RI:
                tptr = (const uint8_t *)(lsap->lsa_un.un_ri_tlv);
 

-               while (ls_length != 0) {
+               int ls_length_remaining = ls_length;
+               while (ls_length_remaining != 0) {

                     ND_TCHECK_4(tptr);
                     ND_TCHECK_4(tptr);

-                   if (ls_length < 4) {
-                        ND_PRINT("\n\t    Remaining LS length %u < 4", ls_length);
+                   if (ls_length_remaining < 4) {
+                        ND_PRINT("\n\t    Remaining LS length %u < 4", ls_length_remaining);

                         return(ls_end);
                     }
                     tlv_type = GET_BE_U_2(tptr);
                     tlv_length = GET_BE_U_2(tptr + 2);
                     tptr+=4;
                         return(ls_end);
                     }
                     tlv_type = GET_BE_U_2(tptr);
                     tlv_length = GET_BE_U_2(tptr + 2);
                     tptr+=4;

-                    ls_length-=4;
+                    ls_length_remaining-=4;

 
                     ND_PRINT("\n\t    %s TLV (%u), length: %u, value: ",
                            tok2str(lsa_opaque_ri_tlv_values,"unknown",tlv_type),
                            tlv_type,
                            tlv_length);
 
 
                     ND_PRINT("\n\t    %s TLV (%u), length: %u, value: ",
                            tok2str(lsa_opaque_ri_tlv_values,"unknown",tlv_type),
                            tlv_type,
                            tlv_length);
 

-                    if (tlv_length > ls_length) {
-                        ND_PRINT("\n\t    Bogus length %u > %u", tlv_length,
-                            ls_length);
+                    if (tlv_length > ls_length_remaining) {
+                        ND_PRINT("\n\t    Bogus length %u > remaining LS length %u", tlv_length,
+                            ls_length_remaining);

                         return(ls_end);
                     }
                     ND_TCHECK_LEN(tptr, tlv_length);
                         return(ls_end);
                     }
                     ND_TCHECK_LEN(tptr, tlv_length);


@@ -847,7 +863,7 @@ ospf_print_lsa(netdissect_options *ndo,
 
                     }
                     tptr+=tlv_length;
 
                     }
                     tptr+=tlv_length;

-                    ls_length-=tlv_length;
+                    ls_length_remaining-=tlv_length;

                 }
                 break;
 
                 }
                 break;
 


@@ -1000,25 +1016,25 @@ ospf_decode_v2(netdissect_options *ndo,
                ND_PRINT("\n\t  Hello Timer %us, Dead Timer %us, Mask %s, Priority %u",
                          GET_BE_U_2(op->ospf_hello.hello_helloint),
                          GET_BE_U_4(op->ospf_hello.hello_deadint),
                ND_PRINT("\n\t  Hello Timer %us, Dead Timer %us, Mask %s, Priority %u",
                          GET_BE_U_2(op->ospf_hello.hello_helloint),
                          GET_BE_U_4(op->ospf_hello.hello_deadint),

-                         ipaddr_string(ndo, op->ospf_hello.hello_mask),
+                         GET_IPADDR_STRING(op->ospf_hello.hello_mask),

                          GET_U_1(op->ospf_hello.hello_priority));
 
                ND_TCHECK_4(op->ospf_hello.hello_dr);
                if (GET_IPV4_TO_NETWORK_ORDER(op->ospf_hello.hello_dr) != 0)
                        ND_PRINT("\n\t  Designated Router %s",
                          GET_U_1(op->ospf_hello.hello_priority));
 
                ND_TCHECK_4(op->ospf_hello.hello_dr);
                if (GET_IPV4_TO_NETWORK_ORDER(op->ospf_hello.hello_dr) != 0)
                        ND_PRINT("\n\t  Designated Router %s",

-                           ipaddr_string(ndo, op->ospf_hello.hello_dr));
+                           GET_IPADDR_STRING(op->ospf_hello.hello_dr));

 
                ND_TCHECK_4(op->ospf_hello.hello_bdr);
                if (GET_IPV4_TO_NETWORK_ORDER(op->ospf_hello.hello_bdr) != 0)
                        ND_PRINT(", Backup Designated Router %s",
 
                ND_TCHECK_4(op->ospf_hello.hello_bdr);
                if (GET_IPV4_TO_NETWORK_ORDER(op->ospf_hello.hello_bdr) != 0)
                        ND_PRINT(", Backup Designated Router %s",

-                                 ipaddr_string(ndo, op->ospf_hello.hello_bdr));
+                                 GET_IPADDR_STRING(op->ospf_hello.hello_bdr));

 
                ap = op->ospf_hello.hello_neighbor;
                if ((const u_char *)ap < dataend)
                        ND_PRINT("\n\t  Neighbor List:");
                while ((const u_char *)ap < dataend) {
                        ND_TCHECK_SIZE(ap);
 
                ap = op->ospf_hello.hello_neighbor;
                if ((const u_char *)ap < dataend)
                        ND_PRINT("\n\t  Neighbor List:");
                while ((const u_char *)ap < dataend) {
                        ND_TCHECK_SIZE(ap);

-                       ND_PRINT("\n\t    %s", ipaddr_string(ndo, *ap));
+                       ND_PRINT("\n\t    %s", GET_IPADDR_STRING(*ap));

                        ++ap;
                }
                break;  /* HELLO */
                        ++ap;
                }
                break;  /* HELLO */


@@ -1051,7 +1067,7 @@ ospf_decode_v2(netdissect_options *ndo,
                     ND_TCHECK_SIZE(lsrp);
 
                     ND_PRINT("\n\t  Advertising Router: %s, %s LSA (%u)",
                     ND_TCHECK_SIZE(lsrp);
 
                     ND_PRINT("\n\t  Advertising Router: %s, %s LSA (%u)",

-                           ipaddr_string(ndo, lsrp->ls_router),
+                           GET_IPADDR_STRING(lsrp->ls_router),

                            tok2str(lsa_values,"unknown",GET_BE_U_4(lsrp->ls_type)),
                            GET_BE_U_4(lsrp->ls_type));
 
                            tok2str(lsa_values,"unknown",GET_BE_U_4(lsrp->ls_type)),
                            GET_BE_U_4(lsrp->ls_type));
 


@@ -1067,7 +1083,7 @@ ospf_decode_v2(netdissect_options *ndo,
                         break;
                     default:
                         ND_PRINT(", LSA-ID: %s",
                         break;
                     default:
                         ND_PRINT(", LSA-ID: %s",

-                               ipaddr_string(ndo, lsrp->un_ls_stateid.ls_stateid));
+                               GET_IPADDR_STRING(lsrp->un_ls_stateid.ls_stateid));

                         break;
                     }
 
                         break;
                     }
 


@@ -1147,11 +1163,11 @@ ospf_print(netdissect_options *ndo,
        }
 
        ND_TCHECK_4(op->ospf_routerid);
        }
 
        ND_TCHECK_4(op->ospf_routerid);

-       ND_PRINT("\n\tRouter-ID %s", ipaddr_string(ndo, op->ospf_routerid));
+       ND_PRINT("\n\tRouter-ID %s", GET_IPADDR_STRING(op->ospf_routerid));

 
        ND_TCHECK_4(op->ospf_areaid);
        if (GET_IPV4_TO_NETWORK_ORDER(op->ospf_areaid) != 0)
 
        ND_TCHECK_4(op->ospf_areaid);
        if (GET_IPV4_TO_NETWORK_ORDER(op->ospf_areaid) != 0)

-               ND_PRINT(", Area %s", ipaddr_string(ndo, op->ospf_areaid));
+               ND_PRINT(", Area %s", GET_IPADDR_STRING(op->ospf_areaid));

        else
                ND_PRINT(", Backbone Area");
 
        else
                ND_PRINT(", Backbone Area");