Statistics
| Branch: | Revision:

iof-bird-daemon / proto / rip / packets.c @ 92cc1e74

History | View | Annotate | Download (20.3 KB)

1 8465dccb Ondrej Zajicek (work)
/*
2
 *        BIRD -- Routing Information Protocol (RIP)
3
 *
4
 *        (c) 1998--1999 Pavel Machek <pavel@ucw.cz>
5
 *        (c) 2004--2013 Ondrej Filip <feela@network.cz>
6
 *        (c) 2009--2015 Ondrej Zajicek <santiago@crfreenet.org>
7
 *        (c) 2009--2015 CZ.NIC z.s.p.o.
8
 *
9
 *        Can be freely distributed and used under the terms of the GNU GPL.
10
 */
11
12 d82987d1 Pavel Tvrdík
#undef LOCAL_DEBUG
13
14 8465dccb Ondrej Zajicek (work)
#include "rip.h"
15 de2a27e2 Ondrej Zajicek (work)
#include "lib/mac.h"
16 8465dccb Ondrej Zajicek (work)
17
18
#define RIP_CMD_REQUEST                1        /* want info */
19
#define RIP_CMD_RESPONSE        2        /* responding to request */
20
21
#define RIP_BLOCK_LENGTH        20
22
#define RIP_PASSWD_LENGTH        16
23
24
#define RIP_AF_IPV4                2
25
#define RIP_AF_AUTH                0xffff
26
27
28
/* RIP packet header */
29
struct rip_packet
30
{
31
  u8 command;
32
  u8 version;
33
  u16 unused;
34
};
35
36
/* RTE block for RIPv2 */
37
struct rip_block_v2
38
{
39
  u16 family;
40
  u16 tag;
41
  ip4_addr network;
42
  ip4_addr netmask;
43
  ip4_addr next_hop;
44
  u32 metric;
45
};
46
47
/* RTE block for RIPng */
48
struct rip_block_ng
49
{
50
  ip6_addr prefix;
51
  u16 tag;
52
  u8 pxlen;
53
  u8 metric;
54
};
55
56
/* Authentication block for RIPv2 */
57
struct rip_block_auth
58
{
59
  u16 must_be_ffff;
60
  u16 auth_type;
61
  char password[0];
62
  u16 packet_len;
63
  u8 key_id;
64
  u8 auth_len;
65
  u32 seq_num;
66
  u32 unused1;
67
  u32 unused2;
68
};
69
70
/* Authentication tail, RFC 4822 */
71
struct rip_auth_tail
72
{
73
  u16 must_be_ffff;
74
  u16 must_be_0001;
75 390601f0 Ondrej Zajicek (work)
  byte auth_data[0];
76 8465dccb Ondrej Zajicek (work)
};
77
78
/* Internal representation of RTE block data */
79
struct rip_block
80
{
81 fe9f1a6d Ondrej Zajicek (work)
  net_addr net;
82 8465dccb Ondrej Zajicek (work)
  u32 metric;
83
  u16 tag;
84
  u16 no_af;
85
  ip_addr next_hop;
86
};
87
88
89
#define DROP(DSC,VAL) do { err_dsc = DSC; err_val = VAL; goto drop; } while(0)
90
#define DROP1(DSC) do { err_dsc = DSC; goto drop; } while(0)
91
#define SKIP(DSC) do { err_dsc = DSC; goto skip; } while(0)
92
93
#define LOG_PKT(msg, args...) \
94
  log_rl(&p->log_pkt_tbf, L_REMOTE "%s: " msg, p->p.name, args)
95
96
#define LOG_PKT_AUTH(msg, args...) \
97
  log_rl(&p->log_pkt_tbf, L_AUTH "%s: " msg, p->p.name, args)
98
99
#define LOG_RTE(msg, args...) \
100
  log_rl(&p->log_rte_tbf, L_REMOTE "%s: " msg, p->p.name, args)
101
102
103
static inline void * rip_tx_buffer(struct rip_iface *ifa)
104
{ return ifa->sk->tbuf; }
105
106
static inline uint rip_pkt_hdrlen(struct rip_iface *ifa)
107
{ return sizeof(struct rip_packet) + (ifa->cf->auth_type ? RIP_BLOCK_LENGTH : 0); }
108
109
static inline void
110
rip_put_block(struct rip_proto *p, byte *pos, struct rip_block *rte)
111
{
112
  if (rip_is_v2(p))
113
  {
114
    struct rip_block_v2 *block = (void *) pos;
115
    block->family = rte->no_af ? 0 : htons(RIP_AF_IPV4);
116
    block->tag = htons(rte->tag);
117 fe9f1a6d Ondrej Zajicek (work)
    block->network = ip4_hton(net4_prefix(&rte->net));
118
    block->netmask = ip4_hton(ip4_mkmask(net4_pxlen(&rte->net)));
119 8465dccb Ondrej Zajicek (work)
    block->next_hop = ip4_hton(ipa_to_ip4(rte->next_hop));
120
    block->metric = htonl(rte->metric);
121
  }
122
  else /* RIPng */
123
  {
124
    struct rip_block_ng *block = (void *) pos;
125 fe9f1a6d Ondrej Zajicek (work)
    block->prefix = ip6_hton(net6_prefix(&rte->net));
126 8465dccb Ondrej Zajicek (work)
    block->tag = htons(rte->tag);
127 fe9f1a6d Ondrej Zajicek (work)
    block->pxlen = net6_pxlen(&rte->net);
128 8465dccb Ondrej Zajicek (work)
    block->metric = rte->metric;
129
  }
130
}
131
132
static inline void
133 8860e991 Ondrej Zajicek (work)
rip_put_next_hop(struct rip_proto *p UNUSED, byte *pos, struct rip_block *rte)
134 8465dccb Ondrej Zajicek (work)
{
135
  struct rip_block_ng *block = (void *) pos;
136
  block->prefix = ip6_hton(ipa_to_ip6(rte->next_hop));
137
  block->tag = 0;
138
  block->pxlen = 0;
139
  block->metric = 0xff;
140
}
141
142
static inline int
143
rip_get_block(struct rip_proto *p, byte *pos, struct rip_block *rte)
144
{
145
  if (rip_is_v2(p))
146
  {
147
    struct rip_block_v2 *block = (void *) pos;
148
149
    /* Skip blocks with strange AF, including authentication blocks */
150
    if (block->family != (rte->no_af ? 0 : htons(RIP_AF_IPV4)))
151
      return 0;
152
153 fe9f1a6d Ondrej Zajicek (work)
    uint pxlen = ip4_masklen(ip4_ntoh(block->netmask));
154
    net_fill_ip4(&rte->net, ip4_ntoh(block->network), pxlen);
155 8465dccb Ondrej Zajicek (work)
    rte->metric = ntohl(block->metric);
156
    rte->tag = ntohs(block->tag);
157
    rte->next_hop = ipa_from_ip4(ip4_ntoh(block->next_hop));
158
159
    return 1;
160
  }
161
  else /* RIPng */
162
  {
163
    struct rip_block_ng *block = (void *) pos;
164
165
    /* Handle and skip next hop blocks */
166
    if (block->metric == 0xff)
167
    {
168
      rte->next_hop = ipa_from_ip6(ip6_ntoh(block->prefix));
169
      if (!ipa_is_link_local(rte->next_hop)) rte->next_hop = IPA_NONE;
170
      return 0;
171
    }
172
173 74d94167 Jan Moskyto Matejka
    uint pxlen = (block->pxlen <= IP6_MAX_PREFIX_LENGTH) ? block->pxlen : 255;
174 fe9f1a6d Ondrej Zajicek (work)
    net_fill_ip6(&rte->net, ip6_ntoh(block->prefix), pxlen);
175 8465dccb Ondrej Zajicek (work)
    rte->metric = block->metric;
176
    rte->tag = ntohs(block->tag);
177
    /* rte->next_hop is deliberately kept unmodified */;
178
179
    return 1;
180
  }
181
}
182
183
static inline void
184
rip_update_csn(struct rip_proto *p UNUSED, struct rip_iface *ifa)
185
{
186
  /*
187
   * We update crypto sequence numbers at the beginning of update session to
188
   * avoid issues with packet reordering, so packets inside one update session
189
   * have the same CSN. We are using real time, but enforcing monotonicity.
190
   */
191
  if (ifa->cf->auth_type == RIP_AUTH_CRYPTO)
192
    ifa->csn = (ifa->csn < (u32) now_real) ? (u32) now_real : ifa->csn + 1;
193
}
194
195
static void
196
rip_fill_authentication(struct rip_proto *p, struct rip_iface *ifa, struct rip_packet *pkt, uint *plen)
197
{
198
  struct rip_block_auth *auth = (void *) (pkt + 1);
199
  struct password_item *pass = password_find(ifa->cf->passwords, 0);
200
201
  if (!pass)
202
  {
203
    /* FIXME: This should not happen */
204
    log(L_ERR "%s: No suitable password found for authentication", p->p.name);
205
    memset(auth, 0, sizeof(struct rip_block_auth));
206
    return;
207
  }
208
209
  switch (ifa->cf->auth_type)
210
  {
211
  case RIP_AUTH_PLAIN:
212
    auth->must_be_ffff = htons(0xffff);
213
    auth->auth_type = htons(RIP_AUTH_PLAIN);
214
    strncpy(auth->password, pass->password, RIP_PASSWD_LENGTH);
215
    return;
216
217
  case RIP_AUTH_CRYPTO:
218
    auth->must_be_ffff = htons(0xffff);
219
    auth->auth_type = htons(RIP_AUTH_CRYPTO);
220
    auth->packet_len = htons(*plen);
221
    auth->key_id = pass->id;
222 390601f0 Ondrej Zajicek (work)
    auth->auth_len = mac_type_length(pass->alg);
223 8465dccb Ondrej Zajicek (work)
    auth->seq_num = ifa->csn_ready ? htonl(ifa->csn) : 0;
224
    auth->unused1 = 0;
225
    auth->unused2 = 0;
226
    ifa->csn_ready = 1;
227
228 390601f0 Ondrej Zajicek (work)
    if (pass->alg < ALG_HMAC)
229
      auth->auth_len += sizeof(struct rip_auth_tail);
230
231 8465dccb Ondrej Zajicek (work)
    /*
232
     * Note that RFC 4822 is unclear whether auth_len should cover whole
233
     * authentication trailer or just auth_data length.
234
     *
235 390601f0 Ondrej Zajicek (work)
     * FIXME: We should use just auth_data length by default. Currently we put
236
     * the whole auth trailer length in keyed hash case to keep old behavior,
237
     * but we put just auth_data length in the new HMAC case. Note that Quagga
238
     * has config option for this.
239
     *
240 8465dccb Ondrej Zajicek (work)
     * Crypto sequence numbers are increased by sender in rip_update_csn().
241
     * First CSN should be zero, this is handled by csn_ready.
242
     */
243
244
    struct rip_auth_tail *tail = (void *) ((byte *) pkt + *plen);
245
    tail->must_be_ffff = htons(0xffff);
246
    tail->must_be_0001 = htons(0x0001);
247
248 390601f0 Ondrej Zajicek (work)
    uint auth_len = mac_type_length(pass->alg);
249
    *plen += sizeof(struct rip_auth_tail) + auth_len;
250 8465dccb Ondrej Zajicek (work)
251 390601f0 Ondrej Zajicek (work)
    /* Append key for keyed hash, append padding for HMAC (RFC 4822 2.5) */
252
    if (pass->alg < ALG_HMAC)
253
      strncpy(tail->auth_data, pass->password, auth_len);
254
    else
255
      memset32(tail->auth_data, HMAC_MAGIC, auth_len / 4);
256
257
    mac_fill(pass->alg, pass->password, pass->length,
258
             (byte *) pkt, *plen, tail->auth_data);
259 8465dccb Ondrej Zajicek (work)
    return;
260
261
  default:
262
    bug("Unknown authentication type");
263
  }
264
}
265
266
static int
267
rip_check_authentication(struct rip_proto *p, struct rip_iface *ifa, struct rip_packet *pkt, uint *plen, struct rip_neighbor *n)
268
{
269
  struct rip_block_auth *auth = (void *) (pkt + 1);
270
  struct password_item *pass = NULL;
271
  const char *err_dsc = NULL;
272
  uint err_val = 0;
273
  uint auth_type = 0;
274
275
  /* Check for authentication entry */
276
  if ((*plen >= (sizeof(struct rip_packet) + sizeof(struct rip_block_auth))) &&
277
      (auth->must_be_ffff == htons(0xffff)))
278
    auth_type = ntohs(auth->auth_type);
279
280
  if (auth_type != ifa->cf->auth_type)
281
    DROP("authentication method mismatch", auth_type);
282
283
  switch (auth_type)
284
  {
285
  case RIP_AUTH_NONE:
286
    return 1;
287
288
  case RIP_AUTH_PLAIN:
289
    pass = password_find_by_value(ifa->cf->passwords, auth->password, RIP_PASSWD_LENGTH);
290
    if (!pass)
291
      DROP1("wrong password");
292
293
    return 1;
294
295
  case RIP_AUTH_CRYPTO:
296
    pass = password_find_by_id(ifa->cf->passwords, auth->key_id);
297
    if (!pass)
298
      DROP("no suitable password found", auth->key_id);
299
300
    uint data_len = ntohs(auth->packet_len);
301 390601f0 Ondrej Zajicek (work)
    uint auth_len = mac_type_length(pass->alg);
302
    uint auth_len2 = sizeof(struct rip_auth_tail) + auth_len;
303 8465dccb Ondrej Zajicek (work)
304 390601f0 Ondrej Zajicek (work)
    /*
305
     * Ideally, first check should be check for internal consistency:
306
     *   (data_len + sizeof(struct rip_auth_tail) + auth->auth_len) != *plen
307
     *
308
     * Second one should check expected code length:
309
     *   auth->auth_len != auth_len
310
     *
311
     * But as auth->auth_len has two interpretations, we simplify this
312
     */
313 8465dccb Ondrej Zajicek (work)
314 390601f0 Ondrej Zajicek (work)
    if (data_len + auth_len2 != *plen)
315
      DROP("packet length mismatch", *plen);
316 8465dccb Ondrej Zajicek (work)
317 390601f0 Ondrej Zajicek (work)
    /* Warning: two interpretations of auth_len field */
318
    if ((auth->auth_len != auth_len) && (auth->auth_len != auth_len2))
319
      DROP("wrong authentication length", auth->auth_len);
320 8465dccb Ondrej Zajicek (work)
321
    struct rip_auth_tail *tail = (void *) ((byte *) pkt + data_len);
322
    if ((tail->must_be_ffff != htons(0xffff)) || (tail->must_be_0001 != htons(0x0001)))
323
      DROP1("authentication trailer is missing");
324
325
    /* Accept higher sequence number, or zero if connectivity is lost */
326
    /* FIXME: sequence number must be password/SA specific */
327
    u32 rcv_csn = ntohl(auth->seq_num);
328
    if ((rcv_csn < n->csn) && (rcv_csn || n->uc))
329
    {
330
      /* We want to report both new and old CSN */
331
      LOG_PKT_AUTH("Authentication failed for %I on %s - "
332
                   "lower sequence number (rcv %u, old %u)",
333
                   n->nbr->addr, ifa->iface->name, rcv_csn, n->csn);
334
      return 0;
335
    }
336
337 390601f0 Ondrej Zajicek (work)
    byte *auth_data = alloca(auth_len);
338
    memcpy(auth_data, tail->auth_data, auth_len);
339 8465dccb Ondrej Zajicek (work)
340 390601f0 Ondrej Zajicek (work)
    /* Append key for keyed hash, append padding for HMAC (RFC 4822 2.5) */
341
    if (pass->alg < ALG_HMAC)
342
      strncpy(tail->auth_data, pass->password, auth_len);
343
    else
344
      memset32(tail->auth_data, HMAC_MAGIC, auth_len / 4);
345 8465dccb Ondrej Zajicek (work)
346 390601f0 Ondrej Zajicek (work)
    if (!mac_verify(pass->alg, pass->password, pass->length,
347
                    (byte *) pkt, *plen, auth_data))
348
      DROP("wrong authentication code", pass->id);
349 8465dccb Ondrej Zajicek (work)
350
    *plen = data_len;
351
    n->csn = rcv_csn;
352
353
    return 1;
354
  }
355
356
drop:
357
  LOG_PKT_AUTH("Authentication failed for %I on %s - %s (%u)",
358
               n->nbr->addr, ifa->iface->name, err_dsc, err_val);
359
360
  return 0;
361
}
362
363
static inline int
364
rip_send_to(struct rip_proto *p, struct rip_iface *ifa, struct rip_packet *pkt, uint plen, ip_addr dst)
365
{
366
  if (ifa->cf->auth_type)
367
    rip_fill_authentication(p, ifa, pkt, &plen);
368
369
  return sk_send_to(ifa->sk, plen, dst, 0);
370
}
371
372
373
void
374
rip_send_request(struct rip_proto *p, struct rip_iface *ifa)
375
{
376
  byte *pos = rip_tx_buffer(ifa);
377
378
  struct rip_packet *pkt = (void *) pos;
379
  pkt->command = RIP_CMD_REQUEST;
380
  pkt->version = ifa->cf->version;
381
  pkt->unused = 0;
382
  pos += rip_pkt_hdrlen(ifa);
383
384
  struct rip_block b = { .no_af = 1, .metric = p->infinity };
385
  rip_put_block(p, pos, &b);
386
  pos += RIP_BLOCK_LENGTH;
387
388
  rip_update_csn(p, ifa);
389
390
  TRACE(D_PACKETS, "Sending request via %s", ifa->iface->name);
391
  rip_send_to(p, ifa, pkt, pos - (byte *) pkt, ifa->addr);
392
}
393
394
static void
395
rip_receive_request(struct rip_proto *p, struct rip_iface *ifa, struct rip_packet *pkt, uint plen, struct rip_neighbor *from)
396
{
397
  TRACE(D_PACKETS, "Request received from %I on %s", from->nbr->addr, ifa->iface->name);
398
399
  byte *pos = (byte *) pkt + rip_pkt_hdrlen(ifa);
400
401
  /* We expect one regular block */
402
  if (plen != (rip_pkt_hdrlen(ifa) + RIP_BLOCK_LENGTH))
403
    return;
404
405
  struct rip_block b = { .no_af = 1 };
406
407
  if (!rip_get_block(p, pos, &b))
408
    return;
409
410 fe9f1a6d Ondrej Zajicek (work)
  /* Special case - infinity metric, for RIPng also zero prefix */
411
  if ((b.metric != p->infinity) ||
412
      (rip_is_ng(p) && !net_zero_ip6((net_addr_ip6 *) &b.net)))
413 8465dccb Ondrej Zajicek (work)
    return;
414
415
  /* We do nothing if TX is already active */
416
  if (ifa->tx_active)
417
  {
418
    TRACE(D_EVENTS, "Skipping request from %I on %s, TX is busy", from->nbr->addr, ifa->iface->name);
419
    return;
420
  }
421
422
  if (!ifa->cf->passive)
423
    rip_send_table(p, ifa, from->nbr->addr, 0);
424
}
425
426
427
static int
428
rip_send_response(struct rip_proto *p, struct rip_iface *ifa)
429
{
430
  if (! ifa->tx_active)
431
    return 0;
432
433
  byte *pos = rip_tx_buffer(ifa);
434
  byte *max = rip_tx_buffer(ifa) + ifa->tx_plen -
435
    (rip_is_v2(p) ? RIP_BLOCK_LENGTH : 2*RIP_BLOCK_LENGTH);
436
  ip_addr last_next_hop = IPA_NONE;
437 92cc1e74 Ondrej Zajicek (work)
  btime now_ = current_time();
438 8465dccb Ondrej Zajicek (work)
  int send = 0;
439
440
  struct rip_packet *pkt = (void *) pos;
441
  pkt->command = RIP_CMD_RESPONSE;
442
  pkt->version = ifa->cf->version;
443
  pkt->unused = 0;
444
  pos += rip_pkt_hdrlen(ifa);
445
446 600998fc Ondrej Zajicek (work)
  FIB_ITERATE_START(&p->rtable, &ifa->tx_fit, struct rip_entry, en)
447 8465dccb Ondrej Zajicek (work)
  {
448
    /* Dummy entries */
449
    if (!en->valid)
450
      goto next_entry;
451
452
    /* Stale entries that should be removed */
453
    if ((en->valid == RIP_ENTRY_STALE) &&
454 92cc1e74 Ondrej Zajicek (work)
        ((en->changed + ifa->cf->garbage_time) <= now_))
455 8465dccb Ondrej Zajicek (work)
      goto next_entry;
456
457
    /* Triggered updates */
458
    if (en->changed < ifa->tx_changed)
459
      goto next_entry;
460
461
    /* Not enough space for current entry */
462
    if (pos > max)
463
    {
464 600998fc Ondrej Zajicek (work)
      FIB_ITERATE_PUT(&ifa->tx_fit);
465 8465dccb Ondrej Zajicek (work)
      goto break_loop;
466
    }
467
468
    struct rip_block rte = {
469
      .metric = en->metric,
470
      .tag = en->tag
471
    };
472
473 fe9f1a6d Ondrej Zajicek (work)
    net_copy(&rte.net, en->n.addr);
474
475 8465dccb Ondrej Zajicek (work)
    if (en->iface == ifa->iface)
476
      rte.next_hop = en->next_hop;
477
478
    if (rip_is_v2(p) && (ifa->cf->version == RIP_V1))
479
    {
480
      /* Skipping subnets (i.e. not hosts, classful networks or default route) */
481 fe9f1a6d Ondrej Zajicek (work)
      if (ip4_masklen(ip4_class_mask(net4_prefix(&rte.net))) != rte.net.pxlen)
482 8465dccb Ondrej Zajicek (work)
        goto next_entry;
483
484
      rte.tag = 0;
485 fe9f1a6d Ondrej Zajicek (work)
      rte.net.pxlen = 0;
486 8465dccb Ondrej Zajicek (work)
      rte.next_hop = IPA_NONE;
487
    }
488
489
    /* Split horizon */
490
    if (en->from == ifa->iface && ifa->cf->split_horizon)
491
    {
492
      if (ifa->cf->poison_reverse)
493
      {
494
        rte.metric = p->infinity;
495
        rte.next_hop = IPA_NONE;
496
      }
497
      else
498
        goto next_entry;
499
    }
500
501 fe9f1a6d Ondrej Zajicek (work)
    // TRACE(D_PACKETS, "    %N -> %I metric %d", &rte.net, rte.next_hop, rte.metric);
502 8465dccb Ondrej Zajicek (work)
503
    /* RIPng next hop entry */
504
    if (rip_is_ng(p) && !ipa_equal(rte.next_hop, last_next_hop))
505
    {
506
      last_next_hop = rte.next_hop;
507
      rip_put_next_hop(p, pos, &rte);
508
      pos += RIP_BLOCK_LENGTH;
509
    }
510
511
    rip_put_block(p, pos, &rte);
512
    pos += RIP_BLOCK_LENGTH;
513
    send = 1;
514
515
  next_entry: ;
516
  }
517 600998fc Ondrej Zajicek (work)
  FIB_ITERATE_END;
518 8465dccb Ondrej Zajicek (work)
  ifa->tx_active = 0;
519
520
  /* Do not send empty packet */
521
  if (!send)
522
    return 0;
523
524
break_loop:
525
  TRACE(D_PACKETS, "Sending response via %s", ifa->iface->name);
526
  return rip_send_to(p, ifa, pkt, pos - (byte *) pkt, ifa->tx_addr);
527
}
528
529
/**
530
 * rip_send_table - RIP interface timer hook
531
 * @p: RIP instance
532
 * @ifa: RIP interface
533
 * @addr: destination IP address
534
 * @changed: time limit for triggered updates
535
 *
536
 * The function activates an update session and starts sending routing update
537
 * packets (using rip_send_response()). The session may be finished during the
538
 * call or may continue in rip_tx_hook() until all appropriate routes are
539
 * transmitted. Note that there may be at most one active update session per
540
 * interface, the function will terminate the old active session before
541
 * activating the new one.
542
 */
543
void
544 92cc1e74 Ondrej Zajicek (work)
rip_send_table(struct rip_proto *p, struct rip_iface *ifa, ip_addr addr, btime changed)
545 8465dccb Ondrej Zajicek (work)
{
546 d82987d1 Pavel Tvrdík
  DBG("RIP: Opening TX session to %I on %s\n", addr, ifa->iface->name);
547 8465dccb Ondrej Zajicek (work)
548
  rip_reset_tx_session(p, ifa);
549
550
  ifa->tx_active = 1;
551
  ifa->tx_addr = addr;
552
  ifa->tx_changed = changed;
553
  FIB_ITERATE_INIT(&ifa->tx_fit, &p->rtable);
554
555
  rip_update_csn(p, ifa);
556
557
  while (rip_send_response(p, ifa) > 0)
558
    ;
559
}
560
561
static void
562
rip_tx_hook(sock *sk)
563
{
564
  struct rip_iface *ifa = sk->data;
565
  struct rip_proto *p = ifa->rip;
566
567
  DBG("RIP: TX hook called (iface %s, src %I, dst %I)\n",
568
      sk->iface->name, sk->saddr, sk->daddr);
569
570
  while (rip_send_response(p, ifa) > 0)
571
    ;
572
}
573
574
static void
575
rip_err_hook(sock *sk, int err)
576
{
577
  struct rip_iface *ifa = sk->data;
578
  struct rip_proto *p = ifa->rip;
579
580
  log(L_ERR "%s: Socket error on %s: %M", p->p.name, ifa->iface->name, err);
581
582
  rip_reset_tx_session(p, ifa);
583
}
584
585
static void
586
rip_receive_response(struct rip_proto *p, struct rip_iface *ifa, struct rip_packet *pkt, uint plen, struct rip_neighbor *from)
587
{
588
  struct rip_block rte = {};
589
  const char *err_dsc = NULL;
590
591
  TRACE(D_PACKETS, "Response received from %I on %s", from->nbr->addr, ifa->iface->name);
592
593
  byte *pos = (byte *) pkt + sizeof(struct rip_packet);
594
  byte *end = (byte *) pkt + plen;
595 92cc1e74 Ondrej Zajicek (work)
  btime now_ = current_time();
596 8465dccb Ondrej Zajicek (work)
597
  for (; pos < end; pos += RIP_BLOCK_LENGTH)
598
  {
599
    /* Find next regular RTE */
600
    if (!rip_get_block(p, pos, &rte))
601
      continue;
602
603
    if (rip_is_v2(p) && (pkt->version == RIP_V1))
604
    {
605 fe9f1a6d Ondrej Zajicek (work)
      if (ifa->cf->check_zero && (rte.tag || rte.net.pxlen || ipa_nonzero(rte.next_hop)))
606 8465dccb Ondrej Zajicek (work)
        SKIP("RIPv1 reserved field is nonzero");
607
608
      rte.tag = 0;
609 fe9f1a6d Ondrej Zajicek (work)
      rte.net.pxlen = ip4_masklen(ip4_class_mask(net4_prefix(&rte.net)));
610 8465dccb Ondrej Zajicek (work)
      rte.next_hop = IPA_NONE;
611
    }
612
613 fe9f1a6d Ondrej Zajicek (work)
    if (rte.net.pxlen == 255)
614 8465dccb Ondrej Zajicek (work)
      SKIP("invalid prefix length");
615
616 fe9f1a6d Ondrej Zajicek (work)
    net_normalize(&rte.net);
617
618
    int c = net_classify(&rte.net);
619
    if ((c < 0) || !(c & IADDR_HOST) || ((c & IADDR_SCOPE_MASK) <= SCOPE_LINK))
620
      SKIP("invalid prefix");
621
622 8465dccb Ondrej Zajicek (work)
    if (rte.metric > p->infinity)
623
      SKIP("invalid metric");
624
625
    if (ipa_nonzero(rte.next_hop))
626
    {
627
      neighbor *nbr = neigh_find2(&p->p, &rte.next_hop, ifa->iface, 0);
628
      if (!nbr || (nbr->scope <= 0))
629
        rte.next_hop = IPA_NONE;
630
    }
631
632 fe9f1a6d Ondrej Zajicek (work)
    // TRACE(D_PACKETS, "    %N -> %I metric %d", &rte.net.n, rte.next_hop, rte.metric);
633 8465dccb Ondrej Zajicek (work)
634
    rte.metric += ifa->cf->metric;
635
636
    if (rte.metric < p->infinity)
637
    {
638
      struct rip_rte new = {
639
        .from = from,
640
        .next_hop = ipa_nonzero(rte.next_hop) ? rte.next_hop : from->nbr->addr,
641
        .metric = rte.metric,
642
        .tag = rte.tag,
643 92cc1e74 Ondrej Zajicek (work)
        .expires = now_ + ifa->cf->timeout_time
644 8465dccb Ondrej Zajicek (work)
      };
645
646 fe9f1a6d Ondrej Zajicek (work)
      rip_update_rte(p, &rte.net, &new);
647 8465dccb Ondrej Zajicek (work)
    }
648
    else
649 fe9f1a6d Ondrej Zajicek (work)
      rip_withdraw_rte(p, &rte.net, from);
650 8465dccb Ondrej Zajicek (work)
651
    continue;
652
653
  skip:
654 fe9f1a6d Ondrej Zajicek (work)
    LOG_RTE("Ignoring route %N received from %I - %s",
655
            &rte.net, from->nbr->addr, err_dsc);
656 8465dccb Ondrej Zajicek (work)
  }
657
}
658
659
static int
660 3e236955 Jan Moskyto Matejka
rip_rx_hook(sock *sk, uint len)
661 8465dccb Ondrej Zajicek (work)
{
662
  struct rip_iface *ifa = sk->data;
663
  struct rip_proto *p = ifa->rip;
664
  const char *err_dsc = NULL;
665
  uint err_val = 0;
666
667
  if (sk->lifindex != sk->iface->index)
668
    return 1;
669
670
  DBG("RIP: RX hook called (iface %s, src %I, dst %I)\n",
671
      sk->iface->name, sk->faddr, sk->laddr);
672
673
  /* Silently ignore my own packets */
674 153f02da Ondrej Zajicek (work)
  if (ipa_equal(sk->faddr, sk->saddr))
675 8465dccb Ondrej Zajicek (work)
    return 1;
676
677
  if (rip_is_ng(p) && !ipa_is_link_local(sk->faddr))
678
    DROP1("wrong src address");
679
680
  struct rip_neighbor *n = rip_get_neighbor(p, &sk->faddr, ifa);
681
682
  if (!n)
683
    DROP1("not from neighbor");
684
685
  if ((ifa->cf->ttl_security == 1) && (sk->rcv_ttl < 255))
686
    DROP("wrong TTL", sk->rcv_ttl);
687
688
  if (sk->fport != sk->dport)
689
    DROP("wrong src port", sk->fport);
690
691
  if (len < sizeof(struct rip_packet))
692
    DROP("too short", len);
693
694
  if (sk->flags & SKF_TRUNCATED)
695
    DROP("truncated", len);
696
697
  struct rip_packet *pkt = (struct rip_packet *) sk->rbuf;
698
  uint plen = len;
699
700
  if (!pkt->version || (ifa->cf->version_only && (pkt->version != ifa->cf->version)))
701
    DROP("wrong version", pkt->version);
702
703
  /* rip_check_authentication() has its own error logging */
704
  if (rip_is_v2(p) && !rip_check_authentication(p, ifa, pkt, &plen, n))
705
    return 1;
706
707
  if ((plen - sizeof(struct rip_packet)) % RIP_BLOCK_LENGTH)
708
    DROP("invalid length", plen);
709
710 92cc1e74 Ondrej Zajicek (work)
  n->last_seen = current_time();
711 8465dccb Ondrej Zajicek (work)
  rip_update_bfd(p, n);
712
713
  switch (pkt->command)
714
  {
715
  case RIP_CMD_REQUEST:
716
    rip_receive_request(p, ifa, pkt, plen, n);
717
    break;
718
719
  case RIP_CMD_RESPONSE:
720
    rip_receive_response(p, ifa, pkt, plen, n);
721
    break;
722
723
  default:
724
    DROP("unknown command", pkt->command);
725
  }
726
  return 1;
727
728
drop:
729
  LOG_PKT("Bad packet from %I via %s - %s (%u)",
730
          sk->faddr, sk->iface->name, err_dsc, err_val);
731
732
  return 1;
733
}
734
735
int
736
rip_open_socket(struct rip_iface *ifa)
737
{
738
  struct rip_proto *p = ifa->rip;
739
740
  sock *sk = sk_new(p->p.pool);
741
  sk->type = SK_UDP;
742 08b3a24d Ondrej Zajicek (work)
  sk->subtype = rip_is_v2(p) ? SK_IPV4 : SK_IPV6;
743 8465dccb Ondrej Zajicek (work)
  sk->sport = ifa->cf->port;
744
  sk->dport = ifa->cf->port;
745
  sk->iface = ifa->iface;
746 153f02da Ondrej Zajicek (work)
  sk->saddr = rip_is_v2(p) ? ifa->iface->addr4->ip : ifa->iface->llv6->ip;
747 8465dccb Ondrej Zajicek (work)
748
  sk->rx_hook = rip_rx_hook;
749
  sk->tx_hook = rip_tx_hook;
750
  sk->err_hook = rip_err_hook;
751
  sk->data = ifa;
752
753
  sk->tos = ifa->cf->tx_tos;
754
  sk->priority = ifa->cf->tx_priority;
755
  sk->ttl = ifa->cf->ttl_security ? 255 : 1;
756 08b3a24d Ondrej Zajicek (work)
  sk->flags = SKF_LADDR_RX | ((ifa->cf->ttl_security == 1) ? SKF_TTL_RX : 0);
757 8465dccb Ondrej Zajicek (work)
758
  /* sk->rbsize and sk->tbsize are handled in rip_iface_update_buffers() */
759
760
  if (sk_open(sk) < 0)
761
    goto err;
762
763
  if (ifa->cf->mode == RIP_IM_MULTICAST)
764
  {
765
    if (sk_setup_multicast(sk) < 0)
766
      goto err;
767
768
    if (sk_join_group(sk, ifa->addr) < 0)
769
      goto err;
770
  }
771
  else /* Broadcast */
772
  {
773
    if (sk_setup_broadcast(sk) < 0)
774
      goto err;
775
776
    if (ipa_zero(ifa->addr))
777
    {
778
      sk->err = "Missing broadcast address";
779
      goto err;
780
    }
781
  }
782
783
  ifa->sk = sk;
784
  return 1;
785
786
err:
787
  sk_log_error(sk, p->p.name);
788
  rfree(sk);
789
  return 0;
790
}