Make sure we don't run past the end of a BGP attribute or LDP TLV when
dissecting the attribute/TLV.
Make some of the code do a bit more of a "step the pointer through the
data"-style dissection; that was done while debugging the changes in
question. It also fixes up some code to not check for more data than
should actually be there.
Update references to RFC 4906 from the draft, and note that RFC 4447
replaces it.
#ifndef tcpdump_decode_prefix_h
#define tcpdump_decode_prefix_h
#ifndef tcpdump_decode_prefix_h
#define tcpdump_decode_prefix_h
-extern int decode_prefix4(const u_char *pptr, char *buf, u_int buflen);
+extern int decode_prefix4(const u_char *pptr, u_int itemlen, char *buf, u_int buflen);
-extern int decode_prefix6(const u_char *pd, char *buf, u_int buflen);
+extern int decode_prefix6(const u_char *pd, u_int itemlen, char *buf, u_int buflen);
#define BGP_OPT_SIZE 2 /* some compilers may pad to 4 bytes */
#define BGP_CAP_HEADER_SIZE 2 /* some compilers may pad to 4 bytes */
#define BGP_OPT_SIZE 2 /* some compilers may pad to 4 bytes */
#define BGP_CAP_HEADER_SIZE 2 /* some compilers may pad to 4 bytes */
-#define BGP_UPDATE_MINSIZE 23
-
struct bgp_notification {
u_int8_t bgpn_marker[16];
u_int16_t bgpn_len;
struct bgp_notification {
u_int8_t bgpn_marker[16];
u_int16_t bgpn_len;
}; /* EXTRACT_16BITS(&bgp_route_refresh->afi) (sigh) */
#define BGP_ROUTE_REFRESH_SIZE 23
}; /* EXTRACT_16BITS(&bgp_route_refresh->afi) (sigh) */
#define BGP_ROUTE_REFRESH_SIZE 23
-struct bgp_attr {
- u_int8_t bgpa_flags;
- u_int8_t bgpa_type;
- union {
- u_int8_t len;
- u_int16_t elen;
- } bgpa_len;
-#define bgp_attr_len(p) \
- (((p)->bgpa_flags & 0x10) ? \
- EXTRACT_16BITS(&(p)->bgpa_len.elen) : (p)->bgpa_len.len)
-#define bgp_attr_off(p) \
- (((p)->bgpa_flags & 0x10) ? 4 : 3)
-};
+#define bgp_attr_lenlen(flags, p) \
+ (((flags) & 0x10) ? 2 : 1)
+#define bgp_attr_len(flags, p) \
+ (((flags) & 0x10) ? EXTRACT_16BITS(p) : *(p))
#define BGPTYPE_ORIGIN 1
#define BGPTYPE_AS_PATH 2
#define BGPTYPE_ORIGIN 1
#define BGPTYPE_AS_PATH 2
+#define ITEMCHECK(minlen) if (itemlen < minlen) goto badtlv;
+
-decode_prefix4(const u_char *pptr, char *buf, u_int buflen)
+decode_prefix4(const u_char *pptr, u_int itemlen, char *buf, u_int buflen)
plen = pptr[0];
if (32 < plen)
return -1;
plen = pptr[0];
if (32 < plen)
return -1;
memset(&addr, 0, sizeof(addr));
memset(&addr, 0, sizeof(addr));
- TCHECK2(pptr[1], (plen + 7) / 8);
- memcpy(&addr, &pptr[1], (plen + 7) / 8);
+ plenbytes = (plen + 7) / 8;
+ TCHECK2(pptr[1], plenbytes);
+ ITEMCHECK(plenbytes);
+ memcpy(&addr, &pptr[1], plenbytes);
- ((u_char *)&addr)[(plen + 7) / 8 - 1] &=
+ ((u_char *)&addr)[plenbytes - 1] &=
((0xff00 >> (plen % 8)) & 0xff);
}
snprintf(buf, buflen, "%s/%d", getname((u_char *)&addr), plen);
((0xff00 >> (plen % 8)) & 0xff);
}
snprintf(buf, buflen, "%s/%d", getname((u_char *)&addr), plen);
- return 1 + (plen + 7) / 8;
-decode_labeled_prefix4(const u_char *pptr, char *buf, u_int buflen)
+decode_labeled_prefix4(const u_char *pptr, u_int itemlen, char *buf, u_int buflen)
+ /* prefix length and label = 4 bytes */
+ TCHECK2(pptr[0], 4);
+ ITEMCHECK(4);
plen = pptr[0]; /* get prefix length */
/* this is one of the weirdnesses of rfc3107
plen = pptr[0]; /* get prefix length */
/* this is one of the weirdnesses of rfc3107
if (32 < plen)
return -1;
if (32 < plen)
return -1;
memset(&addr, 0, sizeof(addr));
memset(&addr, 0, sizeof(addr));
- TCHECK2(pptr[4], (plen + 7) / 8);
- memcpy(&addr, &pptr[4], (plen + 7) / 8);
+ plenbytes = (plen + 7) / 8;
+ TCHECK2(pptr[4], plenbytes);
+ ITEMCHECK(plenbytes);
+ memcpy(&addr, &pptr[4], plenbytes);
- ((u_char *)&addr)[(plen + 7) / 8 - 1] &=
+ ((u_char *)&addr)[plenbytes - 1] &=
((0xff00 >> (plen % 8)) & 0xff);
}
/* the label may get offsetted by 4 bits so lets shift it right */
((0xff00 >> (plen % 8)) & 0xff);
}
/* the label may get offsetted by 4 bits so lets shift it right */
EXTRACT_24BITS(pptr+1)>>4,
((pptr[3]&1)==0) ? "(BOGUS: Bottom of Stack NOT set!)" : "(bottom)" );
EXTRACT_24BITS(pptr+1)>>4,
((pptr[3]&1)==0) ? "(BOGUS: Bottom of Stack NOT set!)" : "(bottom)" );
- return 4 + (plen + 7) / 8;
-decode_prefix6(const u_char *pd, char *buf, u_int buflen)
+decode_prefix6(const u_char *pd, u_int itemlen, char *buf, u_int buflen)
plen = pd[0];
if (128 < plen)
return -1;
plen = pd[0];
if (128 < plen)
return -1;
memset(&addr, 0, sizeof(addr));
memset(&addr, 0, sizeof(addr));
- TCHECK2(pd[1], (plen + 7) / 8);
- memcpy(&addr, &pd[1], (plen + 7) / 8);
+ plenbytes = (plen + 7) / 8;
+ TCHECK2(pd[1], plenbytes);
+ ITEMCHECK(plenbytes);
+ memcpy(&addr, &pd[1], plenbytes);
- addr.s6_addr[(plen + 7) / 8 - 1] &=
+ addr.s6_addr[plenbytes - 1] &=
((0xff00 >> (plen % 8)) & 0xff);
}
snprintf(buf, buflen, "%s/%d", getname6((u_char *)&addr), plen);
((0xff00 >> (plen % 8)) & 0xff);
}
snprintf(buf, buflen, "%s/%d", getname6((u_char *)&addr), plen);
- return 1 + (plen + 7) / 8;
-decode_labeled_prefix6(const u_char *pptr, char *buf, u_int buflen)
+decode_labeled_prefix6(const u_char *pptr, u_int itemlen, char *buf, u_int buflen)
+ /* prefix length and label = 4 bytes */
+ TCHECK2(pptr[0], 4);
+ ITEMCHECK(4);
plen = pptr[0]; /* get prefix length */
if (24 > plen)
plen = pptr[0]; /* get prefix length */
if (24 > plen)
if (128 < plen)
return -1;
if (128 < plen)
return -1;
memset(&addr, 0, sizeof(addr));
memset(&addr, 0, sizeof(addr));
- TCHECK2(pptr[4], (plen + 7) / 8);
- memcpy(&addr, &pptr[4], (plen + 7) / 8);
+ plenbytes = (plen + 7) / 8;
+ TCHECK2(pptr[4], plenbytes);
+ memcpy(&addr, &pptr[4], plenbytes);
- addr.s6_addr[(plen + 7) / 8 - 1] &=
+ addr.s6_addr[plenbytes - 1] &=
((0xff00 >> (plen % 8)) & 0xff);
}
/* the label may get offsetted by 4 bits so lets shift it right */
((0xff00 >> (plen % 8)) & 0xff);
}
/* the label may get offsetted by 4 bits so lets shift it right */
EXTRACT_24BITS(pptr+1)>>4,
((pptr[3]&1)==0) ? "(BOGUS: Bottom of Stack NOT set!)" : "(bottom)" );
EXTRACT_24BITS(pptr+1)>>4,
((pptr[3]&1)==0) ? "(BOGUS: Bottom of Stack NOT set!)" : "(bottom)" );
- return 4 + (plen + 7) / 8;
-bgp_attr_print(const struct bgp_attr *attr, const u_char *pptr, int len)
+bgp_attr_print(u_int atype, const u_char *pptr, u_int len)
u_int32_t i;
} bw;
int advance;
u_int32_t i;
} bw;
int advance;
const u_char *tptr;
char buf[MAXHOSTNAMELEN + 100];
char tokbuf[TOKBUFSIZE];
const u_char *tptr;
char buf[MAXHOSTNAMELEN + 100];
char tokbuf[TOKBUFSIZE];
- switch (attr->bgpa_type) {
case BGPTYPE_ORIGIN:
if (len != 1)
printf("invalid len");
case BGPTYPE_ORIGIN:
if (len != 1)
printf("invalid len");
* 2 bytes first, and it does not pass, assume that ASs are
* encoded in 4 bytes format and move on.
*/
* 2 bytes first, and it does not pass, assume that ASs are
* encoded in 4 bytes format and move on.
*/
- as_size = bgp_attr_get_as_size(attr->bgpa_type, pptr, len);
+ as_size = bgp_attr_get_as_size(atype, pptr, len);
while (tptr < pptr + len) {
TCHECK(tptr[0]);
while (tptr < pptr + len) {
TCHECK(tptr[0]);
case (AFNUM_INET<<8 | SAFNUM_UNICAST):
case (AFNUM_INET<<8 | SAFNUM_MULTICAST):
case (AFNUM_INET<<8 | SAFNUM_UNIMULTICAST):
case (AFNUM_INET<<8 | SAFNUM_UNICAST):
case (AFNUM_INET<<8 | SAFNUM_MULTICAST):
case (AFNUM_INET<<8 | SAFNUM_UNIMULTICAST):
- advance = decode_prefix4(tptr, buf, sizeof(buf));
+ advance = decode_prefix4(tptr, len, buf, sizeof(buf));
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
+ else if (advance == -3)
+ break; /* bytes left, but not enough */
else
printf("\n\t %s", buf);
break;
case (AFNUM_INET<<8 | SAFNUM_LABUNICAST):
else
printf("\n\t %s", buf);
break;
case (AFNUM_INET<<8 | SAFNUM_LABUNICAST):
- advance = decode_labeled_prefix4(tptr, buf, sizeof(buf));
+ advance = decode_labeled_prefix4(tptr, len, buf, sizeof(buf));
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
+ else if (advance == -3)
+ break; /* bytes left, but not enough */
else
printf("\n\t %s", buf);
break;
else
printf("\n\t %s", buf);
break;
case (AFNUM_INET6<<8 | SAFNUM_UNICAST):
case (AFNUM_INET6<<8 | SAFNUM_MULTICAST):
case (AFNUM_INET6<<8 | SAFNUM_UNIMULTICAST):
case (AFNUM_INET6<<8 | SAFNUM_UNICAST):
case (AFNUM_INET6<<8 | SAFNUM_MULTICAST):
case (AFNUM_INET6<<8 | SAFNUM_UNIMULTICAST):
- advance = decode_prefix6(tptr, buf, sizeof(buf));
+ advance = decode_prefix6(tptr, len, buf, sizeof(buf));
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
+ else if (advance == -3)
+ break; /* bytes left, but not enough */
else
printf("\n\t %s", buf);
break;
case (AFNUM_INET6<<8 | SAFNUM_LABUNICAST):
else
printf("\n\t %s", buf);
break;
case (AFNUM_INET6<<8 | SAFNUM_LABUNICAST):
- advance = decode_labeled_prefix6(tptr, buf, sizeof(buf));
+ advance = decode_labeled_prefix6(tptr, len, buf, sizeof(buf));
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
+ else if (advance == -3)
+ break; /* bytes left, but not enough */
else
printf("\n\t %s", buf);
break;
else
printf("\n\t %s", buf);
break;
case (AFNUM_INET<<8 | SAFNUM_UNICAST):
case (AFNUM_INET<<8 | SAFNUM_MULTICAST):
case (AFNUM_INET<<8 | SAFNUM_UNIMULTICAST):
case (AFNUM_INET<<8 | SAFNUM_UNICAST):
case (AFNUM_INET<<8 | SAFNUM_MULTICAST):
case (AFNUM_INET<<8 | SAFNUM_UNIMULTICAST):
- advance = decode_prefix4(tptr, buf, sizeof(buf));
+ advance = decode_prefix4(tptr, len, buf, sizeof(buf));
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
+ else if (advance == -3)
+ break; /* bytes left, but not enough */
else
printf("\n\t %s", buf);
break;
case (AFNUM_INET<<8 | SAFNUM_LABUNICAST):
else
printf("\n\t %s", buf);
break;
case (AFNUM_INET<<8 | SAFNUM_LABUNICAST):
- advance = decode_labeled_prefix4(tptr, buf, sizeof(buf));
+ advance = decode_labeled_prefix4(tptr, len, buf, sizeof(buf));
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
+ else if (advance == -3)
+ break; /* bytes left, but not enough */
else
printf("\n\t %s", buf);
break;
else
printf("\n\t %s", buf);
break;
case (AFNUM_INET6<<8 | SAFNUM_UNICAST):
case (AFNUM_INET6<<8 | SAFNUM_MULTICAST):
case (AFNUM_INET6<<8 | SAFNUM_UNIMULTICAST):
case (AFNUM_INET6<<8 | SAFNUM_UNICAST):
case (AFNUM_INET6<<8 | SAFNUM_MULTICAST):
case (AFNUM_INET6<<8 | SAFNUM_UNIMULTICAST):
- advance = decode_prefix6(tptr, buf, sizeof(buf));
+ advance = decode_prefix6(tptr, len, buf, sizeof(buf));
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
+ else if (advance == -3)
+ break; /* bytes left, but not enough */
else
printf("\n\t %s", buf);
break;
case (AFNUM_INET6<<8 | SAFNUM_LABUNICAST):
else
printf("\n\t %s", buf);
break;
case (AFNUM_INET6<<8 | SAFNUM_LABUNICAST):
- advance = decode_labeled_prefix6(tptr, buf, sizeof(buf));
+ advance = decode_labeled_prefix6(tptr, len, buf, sizeof(buf));
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
if (advance == -1)
printf("\n\t (illegal prefix length)");
else if (advance == -2)
goto trunc;
+ else if (advance == -3)
+ break; /* bytes left, but not enough */
else
printf("\n\t %s", buf);
break;
else
printf("\n\t %s", buf);
break;
}
case BGPTYPE_ATTR_SET:
TCHECK2(tptr[0], 4);
}
case BGPTYPE_ATTR_SET:
TCHECK2(tptr[0], 4);
+ if (len < 4)
+ goto trunc;
printf("\n\t Origin AS: %s",
as_printf(astostr, sizeof(astostr), EXTRACT_32BITS(tptr)));
tptr+=4;
len -=4;
printf("\n\t Origin AS: %s",
as_printf(astostr, sizeof(astostr), EXTRACT_32BITS(tptr)));
tptr+=4;
len -=4;
- while (len >= 2 ) {
- int alen;
- struct bgp_attr bgpa;
+ while (len) {
+ u_int aflags, atype, alenlen, alen;
- TCHECK2(tptr[0], sizeof(bgpa));
- memcpy(&bgpa, tptr, sizeof(bgpa));
- alen = bgp_attr_len(&bgpa);
- tptr += bgp_attr_off(&bgpa);
- len -= bgp_attr_off(&bgpa);
+ TCHECK2(tptr[0], 2);
+ if (len < 2)
+ goto trunc;
+ aflags = *tptr;
+ atype = *(tptr + 1);
+ tptr += 2;
+ len -= 2;
+ alenlen = bgp_attr_lenlen(aflags, tptr);
+ TCHECK2(tptr[0], alenlen);
+ if (len < alenlen)
+ goto trunc;
+ alen = bgp_attr_len(aflags, tptr);
+ tptr += alenlen;
+ len -= alenlen;
printf("\n\t %s (%u), length: %u",
tok2strbuf(bgp_attr_values,
printf("\n\t %s (%u), length: %u",
tok2strbuf(bgp_attr_values,
- "Unknown Attribute", bgpa.bgpa_type,
- tokbuf, sizeof(tokbuf)),
- bgpa.bgpa_type,
+ "Unknown Attribute", atype,
+ tokbuf, sizeof(tokbuf)),
+ atype,
printf(", Flags [%s%s%s%s",
printf(", Flags [%s%s%s%s",
- bgpa.bgpa_flags & 0x80 ? "O" : "",
- bgpa.bgpa_flags & 0x40 ? "T" : "",
- bgpa.bgpa_flags & 0x20 ? "P" : "",
- bgpa.bgpa_flags & 0x10 ? "E" : "");
- if (bgpa.bgpa_flags & 0xf)
- printf("+%x", bgpa.bgpa_flags & 0xf);
+ aflags & 0x80 ? "O" : "",
+ aflags & 0x40 ? "T" : "",
+ aflags & 0x20 ? "P" : "",
+ aflags & 0x10 ? "E" : "");
+ if (aflags & 0xf)
+ printf("+%x", aflags & 0xf);
printf("]: ");
}
/* FIXME check for recursion */
printf("]: ");
}
/* FIXME check for recursion */
- if (!bgp_attr_print(&bgpa, tptr, alen))
+ if (!bgp_attr_print(atype, tptr, alen))
return 0;
tptr += alen;
len -= alen;
return 0;
tptr += alen;
len -= alen;
default:
TCHECK2(*pptr,len);
default:
TCHECK2(*pptr,len);
- printf("\n\t no Attribute %u decoder",attr->bgpa_type); /* we have no decoder for the attribute */
+ printf("\n\t no Attribute %u decoder",atype); /* we have no decoder for the attribute */
if (vflag <= 1)
print_unknown_data(pptr,"\n\t ",len);
break;
if (vflag <= 1)
print_unknown_data(pptr,"\n\t ",len);
break;
bgp_update_print(const u_char *dat, int length)
{
struct bgp bgp;
bgp_update_print(const u_char *dat, int length)
{
struct bgp bgp;
+ int withdrawn_routes_len;
int len;
int i;
char tokbuf[TOKBUFSIZE];
TCHECK2(dat[0], BGP_SIZE);
int len;
int i;
char tokbuf[TOKBUFSIZE];
TCHECK2(dat[0], BGP_SIZE);
+ if (length < BGP_SIZE)
+ goto trunc;
memcpy(&bgp, dat, BGP_SIZE);
p = dat + BGP_SIZE; /*XXX*/
memcpy(&bgp, dat, BGP_SIZE);
p = dat + BGP_SIZE; /*XXX*/
- len = EXTRACT_16BITS(p);
- if (len) {
+ TCHECK2(p[0], 2);
+ if (length < 2)
+ goto trunc;
+ withdrawn_routes_len = EXTRACT_16BITS(p);
+ p += 2;
+ length -= 2;
+ if (withdrawn_routes_len) {
/*
* Without keeping state from the original NLRI message,
* it's not possible to tell if this a v4 or v6 route,
* so only try to decode it if we're not v6 enabled.
*/
/*
* Without keeping state from the original NLRI message,
* it's not possible to tell if this a v4 or v6 route,
* so only try to decode it if we're not v6 enabled.
*/
+ TCHECK2(p[0], withdrawn_routes_len);
+ if (length < withdrawn_routes_len)
+ goto trunc;
- printf("\n\t Withdrawn routes: %d bytes", len);
+ printf("\n\t Withdrawn routes: %d bytes", withdrawn_routes_len);
+ p += withdrawn_routes_len;
+ length -= withdrawn_routes_len;
#else
char buf[MAXHOSTNAMELEN + 100];
int wpfx;
#else
char buf[MAXHOSTNAMELEN + 100];
int wpfx;
- TCHECK2(p[2], len);
- i = 2;
+ if (withdrawn_routes_len < 2)
+ goto trunc;
+ length -= 2;
+ withdrawn_routes_len -= 2;
+
printf("\n\t Withdrawn routes:");
printf("\n\t Withdrawn routes:");
- while(i < 2 + len) {
- wpfx = decode_prefix4(&p[i], buf, sizeof(buf));
+ while(withdrawn_routes_len > 0) {
+ wpfx = decode_prefix4(p, withdrawn_routes_len, buf, sizeof(buf));
if (wpfx == -1) {
printf("\n\t (illegal prefix length)");
break;
} else if (wpfx == -2)
goto trunc;
if (wpfx == -1) {
printf("\n\t (illegal prefix length)");
break;
} else if (wpfx == -2)
goto trunc;
+ } else if (wpfx == -3)
+ goto trunc; /* bytes left, but not enough */
+ p += wpfx;
+ length -= wpfx;
+ withdrawn_routes_len -= wpfx;
+ if (length < 2)
+ goto trunc;
- if (len == 0 && length == BGP_UPDATE_MINSIZE) {
+ if (withdrawn_routes_len == 0 && len == 0 && length == 0) {
+ /* No withdrawn routes, no path attributes, no NLRI */
printf("\n\t End-of-Rib Marker (empty NLRI)");
return;
}
if (len) {
/* do something more useful!*/
printf("\n\t End-of-Rib Marker (empty NLRI)");
return;
}
if (len) {
/* do something more useful!*/
- i = 2;
- while (i < 2 + len) {
- int alen, aoff;
-
- TCHECK2(p[i], sizeof(bgpa));
- memcpy(&bgpa, &p[i], sizeof(bgpa));
- alen = bgp_attr_len(&bgpa);
- aoff = bgp_attr_off(&bgpa);
-
- printf("\n\t %s (%u), length: %u",
+ while (len) {
+ int aflags, atype, alenlen, alen;
+
+ TCHECK2(p[0], 2);
+ if (len < 2)
+ goto trunc;
+ if (length < 2)
+ goto trunc;
+ aflags = *p;
+ atype = *(p + 1);
+ p += 2;
+ len -= 2;
+ length -= 2;
+ alenlen = bgp_attr_lenlen(aflags, p);
+ TCHECK2(p[0], alenlen);
+ if (len < alenlen)
+ goto trunc;
+ if (length < alenlen)
+ goto trunc;
+ alen = bgp_attr_len(aflags, p);
+ p += alenlen;
+ len -= alenlen;
+ length -= alenlen;
+
+ printf("\n\t %s (%u), length: %u",
tok2strbuf(bgp_attr_values, "Unknown Attribute",
tok2strbuf(bgp_attr_values, "Unknown Attribute",
printf(", Flags [%s%s%s%s",
printf(", Flags [%s%s%s%s",
- bgpa.bgpa_flags & 0x80 ? "O" : "",
- bgpa.bgpa_flags & 0x40 ? "T" : "",
- bgpa.bgpa_flags & 0x20 ? "P" : "",
- bgpa.bgpa_flags & 0x10 ? "E" : "");
- if (bgpa.bgpa_flags & 0xf)
- printf("+%x", bgpa.bgpa_flags & 0xf);
+ aflags & 0x80 ? "O" : "",
+ aflags & 0x40 ? "T" : "",
+ aflags & 0x20 ? "P" : "",
+ aflags & 0x10 ? "E" : "");
+ if (aflags & 0xf)
+ printf("+%x", aflags & 0xf);
- if (!bgp_attr_print(&bgpa, &p[i + aoff], alen))
+ if (len < alen)
+ goto trunc;
+ if (length < alen)
+ if (!bgp_attr_print(atype, p, alen))
+ goto trunc;
+ p += alen;
+ len -= alen;
+ length -= alen;
- if (dat + length > p) {
+ if (length) {
+ /*
+ * XXX - what if they're using the "Advertisement of
+ * Multiple Paths in BGP" feature:
+ *
+ * https://datatracker.ietf.org/doc/draft-ietf-idr-add-paths/
+ *
+ * http://tools.ietf.org/html/draft-ietf-idr-add-paths-06
+ */
printf("\n\t Updated routes:");
printf("\n\t Updated routes:");
- while (dat + length > p) {
char buf[MAXHOSTNAMELEN + 100];
char buf[MAXHOSTNAMELEN + 100];
- i = decode_prefix4(p, buf, sizeof(buf));
+ i = decode_prefix4(p, length, buf, sizeof(buf));
if (i == -1) {
printf("\n\t (illegal prefix length)");
break;
} else if (i == -2)
goto trunc;
if (i == -1) {
printf("\n\t (illegal prefix length)");
break;
} else if (i == -2)
goto trunc;
+ else if (i == -3)
+ goto trunc; /* bytes left, but not enough */
else {
printf("\n\t %s", buf);
p += i;
else {
printf("\n\t %s", buf);
p += i;
#define LDP_FEC_WILDCARD 0x01
#define LDP_FEC_PREFIX 0x02
#define LDP_FEC_HOSTADDRESS 0x03
#define LDP_FEC_WILDCARD 0x01
#define LDP_FEC_PREFIX 0x02
#define LDP_FEC_HOSTADDRESS 0x03
-/* From draft-martini-l2circuit-trans-mpls-13.txt */
+/* From RFC 4906; should probably be updated to RFC 4447 (e.g., VC -> PW) */
#define LDP_FEC_MARTINI_VC 0x80
static const struct tok ldp_fec_values[] = {
#define LDP_FEC_MARTINI_VC 0x80
static const struct tok ldp_fec_values[] = {
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
+#define TLV_TCHECK(minlen) \
+ TCHECK2(*tptr, minlen); if (tlv_tlen < minlen) goto badtlv;
+
int
ldp_tlv_print(register const u_char *tptr) {
int
ldp_tlv_print(register const u_char *tptr) {
switch(tlv_type) {
case LDP_TLV_COMMON_HELLO:
switch(tlv_type) {
case LDP_TLV_COMMON_HELLO:
printf("\n\t Hold Time: %us, Flags: [%s Hello%s]",
EXTRACT_16BITS(tptr),
(EXTRACT_16BITS(tptr+2)&0x8000) ? "Targeted" : "Link",
printf("\n\t Hold Time: %us, Flags: [%s Hello%s]",
EXTRACT_16BITS(tptr),
(EXTRACT_16BITS(tptr+2)&0x8000) ? "Targeted" : "Link",
break;
case LDP_TLV_IPV4_TRANSPORT_ADDR:
break;
case LDP_TLV_IPV4_TRANSPORT_ADDR:
printf("\n\t IPv4 Transport Address: %s", ipaddr_string(tptr));
break;
#ifdef INET6
case LDP_TLV_IPV6_TRANSPORT_ADDR:
printf("\n\t IPv4 Transport Address: %s", ipaddr_string(tptr));
break;
#ifdef INET6
case LDP_TLV_IPV6_TRANSPORT_ADDR:
printf("\n\t IPv6 Transport Address: %s", ip6addr_string(tptr));
break;
#endif
case LDP_TLV_CONFIG_SEQ_NUMBER:
printf("\n\t IPv6 Transport Address: %s", ip6addr_string(tptr));
break;
#endif
case LDP_TLV_CONFIG_SEQ_NUMBER:
printf("\n\t Sequence Number: %u", EXTRACT_32BITS(tptr));
break;
case LDP_TLV_ADDRESS_LIST:
printf("\n\t Sequence Number: %u", EXTRACT_32BITS(tptr));
break;
case LDP_TLV_ADDRESS_LIST:
+ TLV_TCHECK(LDP_TLV_ADDRESS_LIST_AFNUM_LEN);
af = EXTRACT_16BITS(tptr);
tptr+=LDP_TLV_ADDRESS_LIST_AFNUM_LEN;
tlv_tlen -= LDP_TLV_ADDRESS_LIST_AFNUM_LEN;
af = EXTRACT_16BITS(tptr);
tptr+=LDP_TLV_ADDRESS_LIST_AFNUM_LEN;
tlv_tlen -= LDP_TLV_ADDRESS_LIST_AFNUM_LEN;
switch (af) {
case AFNUM_INET:
while(tlv_tlen >= sizeof(struct in_addr)) {
switch (af) {
case AFNUM_INET:
while(tlv_tlen >= sizeof(struct in_addr)) {
+ TCHECK2(*tptr, sizeof(struct in_addr));
printf(" %s",ipaddr_string(tptr));
tlv_tlen-=sizeof(struct in_addr);
tptr+=sizeof(struct in_addr);
printf(" %s",ipaddr_string(tptr));
tlv_tlen-=sizeof(struct in_addr);
tptr+=sizeof(struct in_addr);
#ifdef INET6
case AFNUM_INET6:
while(tlv_tlen >= sizeof(struct in6_addr)) {
#ifdef INET6
case AFNUM_INET6:
while(tlv_tlen >= sizeof(struct in6_addr)) {
+ TCHECK2(*tptr, sizeof(struct in6_addr));
printf(" %s",ip6addr_string(tptr));
tlv_tlen-=sizeof(struct in6_addr);
tptr+=sizeof(struct in6_addr);
printf(" %s",ip6addr_string(tptr));
tlv_tlen-=sizeof(struct in6_addr);
tptr+=sizeof(struct in6_addr);
break;
case LDP_TLV_COMMON_SESSION:
break;
case LDP_TLV_COMMON_SESSION:
printf("\n\t Version: %u, Keepalive: %us, Flags: [Downstream %s, Loop Detection %s]",
EXTRACT_16BITS(tptr), EXTRACT_16BITS(tptr+2),
(EXTRACT_16BITS(tptr+6)&0x8000) ? "On Demand" : "Unsolicited",
printf("\n\t Version: %u, Keepalive: %us, Flags: [Downstream %s, Loop Detection %s]",
EXTRACT_16BITS(tptr), EXTRACT_16BITS(tptr+2),
(EXTRACT_16BITS(tptr+6)&0x8000) ? "On Demand" : "Unsolicited",
fec_type = *tptr;
printf("\n\t %s FEC (0x%02x)",
tok2str(ldp_fec_values, "Unknown", fec_type),
fec_type);
tptr+=1;
fec_type = *tptr;
printf("\n\t %s FEC (0x%02x)",
tok2str(ldp_fec_values, "Unknown", fec_type),
fec_type);
tptr+=1;
switch(fec_type) {
case LDP_FEC_WILDCARD:
break;
case LDP_FEC_PREFIX:
switch(fec_type) {
case LDP_FEC_WILDCARD:
break;
case LDP_FEC_PREFIX:
af = EXTRACT_16BITS(tptr);
af = EXTRACT_16BITS(tptr);
+ tptr+=LDP_TLV_ADDRESS_LIST_AFNUM_LEN;
+ tlv_tlen-=LDP_TLV_ADDRESS_LIST_AFNUM_LEN;
- i=decode_prefix4(tptr,buf,sizeof(buf));
- printf(": IPv4 prefix %s",buf);
+ i=decode_prefix4(tptr,tlv_tlen,buf,sizeof(buf));
+ if (i == -2)
+ goto trunc;
+ if (i == -3)
+ printf(": IPv4 prefix (goes past end of TLV)");
+ else if (i == -1)
+ printf(": IPv4 prefix (invalid length)");
+ else
+ printf(": IPv4 prefix %s",buf);
}
#ifdef INET6
else if (af == AFNUM_INET6) {
}
#ifdef INET6
else if (af == AFNUM_INET6) {
- i=decode_prefix6(tptr,buf,sizeof(buf));
- printf(": IPv6 prefix %s",buf);
+ i=decode_prefix6(tptr,tlv_tlen,buf,sizeof(buf));
+ if (i == -2)
+ goto trunc;
+ if (i == -3)
+ printf(": IPv4 prefix (goes past end of TLV)");
+ else if (i == -1)
+ printf(": IPv6 prefix (invalid length)");
+ else
+ printf(": IPv6 prefix %s",buf);
+ else
+ printf(": Address family %u prefix", af);
break;
case LDP_FEC_HOSTADDRESS:
break;
case LDP_FEC_MARTINI_VC:
break;
case LDP_FEC_HOSTADDRESS:
break;
case LDP_FEC_MARTINI_VC:
- if (!TTEST2(*tptr, 11))
- goto trunc;
+ /*
+ * According to RFC 4908, the VC info Length field can be zero,
+ * in which case not only are there no interface parameters,
+ * there's no VC ID.
+ */
+ TLV_TCHECK(7);
+ if (vc_info_len == 0) {
+ printf(": %s, %scontrol word, group-ID %u, VC-info-length: %u",
+ tok2str(l2vpn_encaps_values, "Unknown", EXTRACT_16BITS(tptr)&0x7fff),
+ EXTRACT_16BITS(tptr)&0x8000 ? "" : "no ",
+ EXTRACT_32BITS(tptr+3),
+ vc_info_len);
+ break;
+ }
+
+ /* Make sure we have the VC ID as well */
+ TLV_TCHECK(11);
printf(": %s, %scontrol word, group-ID %u, VC-ID %u, VC-info-length: %u",
tok2str(l2vpn_encaps_values, "Unknown", EXTRACT_16BITS(tptr)&0x7fff),
EXTRACT_16BITS(tptr)&0x8000 ? "" : "no ",
EXTRACT_32BITS(tptr+3),
EXTRACT_32BITS(tptr+7),
vc_info_len);
printf(": %s, %scontrol word, group-ID %u, VC-ID %u, VC-info-length: %u",
tok2str(l2vpn_encaps_values, "Unknown", EXTRACT_16BITS(tptr)&0x7fff),
EXTRACT_16BITS(tptr)&0x8000 ? "" : "no ",
EXTRACT_32BITS(tptr+3),
EXTRACT_32BITS(tptr+7),
vc_info_len);
+ if (vc_info_len < 4)
+ goto trunc; /* minimum 4, for the VC ID */
+ vc_info_len -= 4; /* subtract out the VC ID, giving the length of the interface parameters */
- if (vc_info_len == 0) /* infinite loop protection */
- break;
-
+ /* Skip past the fixed information and the VC ID */
- if (!TTEST2(*tptr, vc_info_len))
- goto trunc;
+ tlv_tlen-=11;
+ TLV_TCHECK(vc_info_len);
while (vc_info_len > 2) {
vc_info_tlv_type = *tptr;
while (vc_info_len > 2) {
vc_info_tlv_type = *tptr;
break;
case LDP_TLV_GENERIC_LABEL:
break;
case LDP_TLV_GENERIC_LABEL:
printf("\n\t Label: %u", EXTRACT_32BITS(tptr) & 0xfffff);
break;
case LDP_TLV_STATUS:
printf("\n\t Label: %u", EXTRACT_32BITS(tptr) & 0xfffff);
break;
case LDP_TLV_STATUS:
ui = EXTRACT_32BITS(tptr);
tptr+=4;
printf("\n\t Status: 0x%02x, Flags: [%s and %s forward]",
ui = EXTRACT_32BITS(tptr);
tptr+=4;
printf("\n\t Status: 0x%02x, Flags: [%s and %s forward]",
break;
case LDP_TLV_FT_SESSION:
break;
case LDP_TLV_FT_SESSION:
ft_flags = EXTRACT_16BITS(tptr);
printf("\n\t Flags: [%sReconnect, %sSave State, %sAll-Label Protection, %s Checkpoint, %sRe-Learn State]",
ft_flags&0x8000 ? "" : "No ",
ft_flags = EXTRACT_16BITS(tptr);
printf("\n\t Flags: [%sReconnect, %sSave State, %sAll-Label Protection, %s Checkpoint, %sRe-Learn State]",
ft_flags&0x8000 ? "" : "No ",
printf("\n\t MTU: %u", EXTRACT_16BITS(tptr));
break;
printf("\n\t MTU: %u", EXTRACT_16BITS(tptr));
break;
trunc:
printf("\n\t\t packet exceeded snapshot");
return 0;
trunc:
printf("\n\t\t packet exceeded snapshot");
return 0;
+
+badtlv:
+ printf("\n\t\t TLV contents go past end of TLV");
+ return(tlv_len+4); /* Type & Length fields not included */
while(tlen>0) {
/* did we capture enough for fully decoding the msg header ? */
while(tlen>0) {
/* did we capture enough for fully decoding the msg header ? */
- if (!TTEST2(*tptr, sizeof(struct ldp_msg_header)))
- goto trunc;
+ TCHECK2(*tptr, sizeof(struct ldp_msg_header));
ldp_msg_header = (const struct ldp_msg_header *)tptr;
msg_len=EXTRACT_16BITS(ldp_msg_header->length);
ldp_msg_header = (const struct ldp_msg_header *)tptr;
msg_len=EXTRACT_16BITS(ldp_msg_header->length);
msg_tlen=msg_len-sizeof(struct ldp_msg_header)+4; /* Type & Length fields not included */
/* did we capture enough for fully decoding the message ? */
msg_tlen=msg_len-sizeof(struct ldp_msg_header)+4; /* Type & Length fields not included */
/* did we capture enough for fully decoding the message ? */
- if (!TTEST2(*tptr, msg_len))
- goto trunc;
+ TCHECK2(*tptr, msg_len);
hexdump=FALSE;
switch(msg_type) {
hexdump=FALSE;
switch(msg_type) {
projects / tcpdump / commitdiff
