Statistics
| Branch: | Revision:

iof-bird-daemon / proto / ospf / packet.c @ e81b440f

History | View | Annotate | Download (11.7 KB)

1
/*
2
 *        BIRD -- OSPF
3
 *
4
 *        (c) 1999--2005 Ondrej Filip <feela@network.cz>
5
 *
6
 *        Can be freely distributed and used under the terms of the GNU GPL.
7
 */
8

    
9
#include "ospf.h"
10
#include "nest/password.h"
11
#include "lib/md5.h"
12

    
13
void
14
ospf_pkt_fill_hdr(struct ospf_iface *ifa, void *buf, u8 h_type)
15
{
16
  struct proto_ospf *po = ifa->oa->po;
17
  struct ospf_packet *pkt;
18

    
19
  pkt = (struct ospf_packet *) buf;
20

    
21
  pkt->version = OSPF_VERSION;
22

    
23
  pkt->type = h_type;
24

    
25
  pkt->routerid = htonl(po->router_id);
26
  pkt->areaid = htonl(ifa->oa->areaid);
27

    
28
#ifdef OSPFv3
29
  pkt->instance_id = ifa->instance_id;
30
#endif
31

    
32
#ifdef OSPFv2
33
  pkt->autype = htons(ifa->autype);
34
#endif
35

    
36
  pkt->checksum = 0;
37
}
38

    
39
unsigned
40
ospf_pkt_maxsize(struct ospf_iface *ifa)
41
{
42
  /* For virtual links use mtu=576, can be mtu < 576? */
43
  unsigned mtu = (ifa->type == OSPF_IT_VLINK) ? OSPF_VLINK_MTU : ifa->iface->mtu;
44
  unsigned add = 0;
45

    
46
#ifdef OSPFv2
47
  add = ((ifa->autype == OSPF_AUTH_CRYPT) ? OSPF_AUTH_CRYPT_SIZE : 0);
48
#endif
49

    
50
  return ((mtu <=  ifa->iface->mtu) ? mtu : ifa->iface->mtu) -
51
  SIZE_OF_IP_HEADER - add;
52
}
53

    
54

    
55
#ifdef OSPFv2
56

    
57
static void
58
ospf_pkt_finalize(struct ospf_iface *ifa, struct ospf_packet *pkt)
59
{
60
  struct password_item *passwd = NULL;
61
  void *tail;
62
  struct MD5Context ctxt;
63
  char password[OSPF_AUTH_CRYPT_SIZE];
64

    
65
  pkt->autype = htons(ifa->autype);
66

    
67
  switch(ifa->autype)
68
  {
69
    case OSPF_AUTH_SIMPLE:
70
      bzero(&pkt->u, sizeof(union ospf_auth));
71
      passwd = password_find(ifa->passwords, 1);
72
      if (!passwd)
73
      {
74
        log( L_ERR "No suitable password found for authentication" );
75
        return;
76
      }
77
      password_cpy(pkt->u.password, passwd->password, sizeof(union ospf_auth));
78
    case OSPF_AUTH_NONE:
79
      pkt->checksum = ipsum_calculate(pkt, sizeof(struct ospf_packet) -
80
                                  sizeof(union ospf_auth), (pkt + 1),
81
                                  ntohs(pkt->length) -
82
                                  sizeof(struct ospf_packet), NULL);
83
      break;
84
    case OSPF_AUTH_CRYPT:
85
      passwd = password_find(ifa->passwords, 0);
86
      if (!passwd)
87
      {
88
        log( L_ERR "No suitable password found for authentication" );
89
        return;
90
      }
91

    
92
      pkt->checksum = 0;
93

    
94
      /* Perhaps use random value to prevent replay attacks after
95
         reboot when system does not have independent RTC? */
96
      if (!ifa->csn)
97
        {
98
          ifa->csn = (u32) now;
99
          ifa->csn_use = now;
100
        }
101

    
102
      /* We must have sufficient delay between sending a packet and increasing 
103
         CSN to prevent reordering of packets (in a network) with different CSNs */
104
      if ((now - ifa->csn_use) > 1)
105
        ifa->csn++;
106

    
107
      ifa->csn_use = now;
108

    
109
      pkt->u.md5.keyid = passwd->id;
110
      pkt->u.md5.len = OSPF_AUTH_CRYPT_SIZE;
111
      pkt->u.md5.zero = 0;
112
      pkt->u.md5.csn = htonl(ifa->csn);
113
      tail = ((void *)pkt) + ntohs(pkt->length);
114
      MD5Init(&ctxt);
115
      MD5Update(&ctxt, (char *) pkt, ntohs(pkt->length));
116
      password_cpy(password, passwd->password, OSPF_AUTH_CRYPT_SIZE);
117
      MD5Update(&ctxt, password, OSPF_AUTH_CRYPT_SIZE);
118
      MD5Final(tail, &ctxt);
119
      break;
120
    default:
121
      bug("Unknown authentication type");
122
  }
123
}
124

    
125
static int
126
ospf_pkt_checkauth(struct ospf_neighbor *n, struct ospf_iface *ifa, struct ospf_packet *pkt, int size)
127
{
128
  struct proto_ospf *po = ifa->oa->po;
129
  struct proto *p = &po->proto;
130
  struct password_item *pass = NULL, *ptmp;
131
  void *tail;
132
  char md5sum[OSPF_AUTH_CRYPT_SIZE];
133
  char password[OSPF_AUTH_CRYPT_SIZE];
134
  struct MD5Context ctxt;
135

    
136

    
137
  if (pkt->autype != htons(ifa->autype))
138
  {
139
    OSPF_TRACE(D_PACKETS, "OSPF_auth: Method differs (%d)", ntohs(pkt->autype));
140
    return 0;
141
  }
142

    
143
  if (n && (ifa != n->ifa))
144
  {
145
    OSPF_TRACE(D_PACKETS, "OSPF_auth: received packet from strange interface (%s/%s)",
146
      ifa->iface->name, n->ifa->iface->name);
147
    return 0;
148
  }
149

    
150
  switch(ifa->autype)
151
  {
152
    case OSPF_AUTH_NONE:
153
      return 1;
154
      break;
155
    case OSPF_AUTH_SIMPLE:
156
      pass = password_find(ifa->passwords, 1);
157
      if (!pass)
158
      {
159
        OSPF_TRACE(D_PACKETS, "OSPF_auth: no password found");
160
        return 0;
161
      }
162
      password_cpy(password, pass->password, sizeof(union ospf_auth));
163

    
164
      if (memcmp(pkt->u.password, password, sizeof(union ospf_auth)))
165
      {
166
        char ppass[sizeof(union ospf_auth) + 1];
167
        bzero(ppass, (sizeof(union ospf_auth) + 1));
168
        memcpy(ppass, pkt->u.password, sizeof(union ospf_auth));
169
        OSPF_TRACE(D_PACKETS, "OSPF_auth: different passwords (%s)", ppass);
170
        return 0;
171
      }
172
      return 1;
173
      break;
174
    case OSPF_AUTH_CRYPT:
175
      if (pkt->u.md5.len != OSPF_AUTH_CRYPT_SIZE)
176
      {
177
        OSPF_TRACE(D_PACKETS, "OSPF_auth: wrong size of md5 digest");
178
        return 0;
179
      }
180

    
181
      if (ntohs(pkt->length) + OSPF_AUTH_CRYPT_SIZE != size)
182
      {
183
        OSPF_TRACE(D_PACKETS, "OSPF_auth: size mismatch (%d vs %d)",
184
          ntohs(pkt->length) + OSPF_AUTH_CRYPT_SIZE, size);
185
        return 0;
186
      }
187

    
188
      if (pkt->u.md5.zero)
189
      {
190
        OSPF_TRACE(D_PACKETS, "OSPF_auth: \"zero\" area is non-zero");
191
        return 0;
192
      }
193

    
194
      tail = ((void *)pkt) + ntohs(pkt->length);
195

    
196
      if (ifa->passwords)
197
      {
198
        WALK_LIST(ptmp, *(ifa->passwords))
199
        {
200
          if (pkt->u.md5.keyid != ptmp->id) continue;
201
          if ((ptmp->accfrom > now_real) || (ptmp->accto < now_real)) continue;
202
          pass = ptmp;
203
          break;
204
        }
205
      }
206

    
207
      if (!pass)
208
      {
209
        OSPF_TRACE(D_PACKETS, "OSPF_auth: no suitable md5 password found");
210
        return 0;
211
      }
212

    
213
      if (n)
214
      {
215
        u32 rcv_csn = ntohl(pkt->u.md5.csn);
216
        if(rcv_csn < n->csn)
217
        {
218
          OSPF_TRACE(D_PACKETS, "OSPF_auth: lower sequence number (rcv %d, old %d)", rcv_csn, n->csn);
219
          return 0;
220
        }
221

    
222
        n->csn = rcv_csn;
223
      }
224

    
225
      MD5Init(&ctxt);
226
      MD5Update(&ctxt, (char *) pkt, ntohs(pkt->length));
227
      password_cpy(password, pass->password, OSPF_AUTH_CRYPT_SIZE);
228
      MD5Update(&ctxt, password, OSPF_AUTH_CRYPT_SIZE);
229
      MD5Final(md5sum, &ctxt);
230
      if (memcmp(md5sum, tail, OSPF_AUTH_CRYPT_SIZE))
231
      {
232
        OSPF_TRACE(D_PACKETS, "OSPF_auth: wrong md5 digest");
233
        return 0;
234
      }
235
      return 1;
236
      break;
237
    default:
238
      OSPF_TRACE(D_PACKETS, "OSPF_auth: unknown auth type");
239
      return 0;
240
  }
241
}
242

    
243
#else
244

    
245
/* OSPFv3 authentication not yet supported */
246

    
247
static inline void
248
ospf_pkt_finalize(struct ospf_iface *ifa, struct ospf_packet *pkt)
249
{ }
250

    
251
static int
252
ospf_pkt_checkauth(struct ospf_neighbor *n, struct ospf_iface *ifa, struct ospf_packet *pkt, int size)
253
{ return 1; }
254

    
255
#endif
256

    
257
/**
258
 * ospf_rx_hook
259
 * @sk: socket we received the packet. Its ignored.
260
 * @size: size of the packet
261
 *
262
 * This is the entry point for messages from neighbors. Many checks (like
263
 * authentication, checksums, size) are done before the packet is passed to
264
 * non generic functions.
265
 */
266
int
267
ospf_rx_hook(sock * sk, int size)
268
{
269
  struct ospf_packet *ps;
270
  struct ospf_iface *ifa = (struct ospf_iface *) (sk->data);
271
  struct proto_ospf *po = ifa->oa->po;
272
  struct proto *p = &po->proto;
273
  struct ospf_neighbor *n;
274
  int osize;
275
  char *mesg = "Bad OSPF packet from ";
276
  struct ospf_iface *iff;
277

    
278
  if (ifa->stub)
279
    return (1);
280

    
281
  ps = (struct ospf_packet *) ip_skip_header(sk->rbuf, &size);
282

    
283
  if (ps == NULL)
284
  {
285
    log(L_ERR "%s%I - bad IP header", mesg, sk->faddr);
286
    return 1;
287
  }
288

    
289
  /* We receive packets related to vlinks even on non-vlink sockets */
290
  if ((ifa->oa->areaid != 0) && (ntohl(ps->areaid) == 0))
291
  {
292
    WALK_LIST(iff, po->iface_list)
293
    {
294
      if ((iff->type == OSPF_IT_VLINK) && (iff->iface == ifa->iface) &&
295
          (iff->voa = ifa->oa) && ipa_equal(sk->faddr, iff->vip))
296
      {
297
        return 1;       /* Packet is for VLINK */
298
      }
299
    }
300
  }
301

    
302
  DBG("%s: RX_Hook called on interface %s.\n", p->name, sk->iface->name);
303

    
304
  if ((unsigned) size < sizeof(struct ospf_packet))
305
  {
306
    log(L_ERR "%s%I - too short (%u bytes)", mesg, sk->faddr, size);
307
    return 1;
308
  }
309

    
310
  osize = ntohs(ps->length);
311
  if ((osize > size) || ((osize % 4) != 0))
312
  {
313
    log(L_ERR "%s%I - size field does not match (%d/%d)", mesg, sk->faddr, osize, size);
314
    return 1;
315
  }
316

    
317
  if (ps->version != OSPF_VERSION)
318
  {
319
    log(L_ERR "%s%I - version %u", mesg, sk->faddr, ps->version);
320
    return 1;
321
  }
322

    
323
#ifdef OSPFv2
324
  if ((ps->autype != htons(OSPF_AUTH_CRYPT)) &&
325
      (!ipsum_verify(ps, 16, (void *) ps + sizeof(struct ospf_packet),
326
                     osize - sizeof(struct ospf_packet), NULL)))
327
  {
328
    log(L_ERR "%s%I - bad checksum", mesg, sk->faddr);
329
    return 1;
330
  }
331
#endif
332

    
333
  if (ntohl(ps->areaid) != ifa->oa->areaid)
334
  {
335
    log(L_ERR "%s%I - different area (%u)", mesg, sk->faddr, ntohl(ps->areaid));
336
    return 1;
337
  }
338

    
339
  /* FIXME - handling of instance id should be better */
340
#ifdef OSPFv3
341
  if (ps->instance_id != ifa->instance_id)
342
  {
343
    log(L_ERR "%s%I - different instance (%u)", mesg, sk->faddr, ps->instance_id);
344
    return 1;
345
  }
346
#endif
347

    
348
  if (ntohl(ps->routerid) == po->router_id)
349
  {
350
    log(L_ERR "%s%I - received my own router ID!", mesg, sk->faddr);
351
    return 1;
352
  }
353

    
354
  if (ntohl(ps->routerid) == 0)
355
  {
356
    log(L_ERR "%s%I - router id = 0.0.0.0", mesg, sk->faddr);
357
    return 1;
358
  }
359

    
360
  if ((unsigned) size > sk->rbsize)
361
  {
362
    log(L_ERR "%s%I - packet is too large (%d vs %d)",
363
        mesg, sk->faddr, size, sk->rbsize);
364
    return 1;
365
  }
366

    
367
  /* This is deviation from RFC 2328 - neighbours should be identified by
368
   * IP address on broadcast and NBMA networks.
369
   */
370
  n = find_neigh(ifa, ntohl(ps->routerid));
371

    
372
  if(!n && (ps->type != HELLO_P))
373
  {
374
    OSPF_TRACE(D_PACKETS, "Received non-hello packet from uknown neighbor (%I)", sk->faddr);
375
    return 1;
376
  }
377

    
378
  if (!ospf_pkt_checkauth(n, ifa, ps, size))
379
  {
380
    log(L_ERR "%s%I - authentification failed", mesg, sk->faddr);
381
    return 1;
382
  }
383

    
384
  /* Dump packet 
385
     pu8=(u8 *)(sk->rbuf+5*4);
386
     for(i=0;i<ntohs(ps->length);i+=4)
387
     DBG("%s: received %u,%u,%u,%u\n",p->name, pu8[i+0], pu8[i+1], pu8[i+2],
388
     pu8[i+3]);
389
     DBG("%s: received size: %u\n",p->name,size);
390
   */
391

    
392
  switch (ps->type)
393
  {
394
  case HELLO_P:
395
    DBG("%s: Hello received.\n", p->name);
396
    ospf_hello_receive(ps, ifa, n, sk->faddr);
397
    break;
398
  case DBDES_P:
399
    DBG("%s: Database description received.\n", p->name);
400
    ospf_dbdes_receive(ps, ifa, n);
401
    break;
402
  case LSREQ_P:
403
    DBG("%s: Link state request received.\n", p->name);
404
    ospf_lsreq_receive(ps, ifa, n);
405
    break;
406
  case LSUPD_P:
407
    DBG("%s: Link state update received.\n", p->name);
408
    ospf_lsupd_receive(ps, ifa, n);
409
    break;
410
  case LSACK_P:
411
    DBG("%s: Link state ack received.\n", p->name);
412
    ospf_lsack_receive(ps, ifa, n);
413
    break;
414
  default:
415
    log(L_ERR "%s%I - wrong type %u", mesg, sk->faddr, ps->type);
416
    return 1;
417
  };
418
  return 1;
419
}
420

    
421
void
422
ospf_tx_hook(sock * sk)
423
{
424
  struct ospf_iface *ifa= (struct ospf_iface *) (sk->data);
425
  struct proto *p = (struct proto *) (ifa->oa->po);
426
  log(L_ERR "%s: TX_Hook called on interface %s\n", p->name, sk->iface->name);
427
}
428

    
429
void
430
ospf_err_hook(sock * sk, int err)
431
{
432
  struct ospf_iface *ifa= (struct ospf_iface *) (sk->data);
433
  struct proto *p = (struct proto *) (ifa->oa->po);
434
  log(L_ERR "%s: Err_Hook called on interface %s with err=%d\n",
435
    p->name, sk->iface->name, err);
436
}
437

    
438
void
439
ospf_send_to_agt(struct ospf_iface *ifa, u8 state)
440
{
441
  struct ospf_neighbor *n;
442

    
443
  WALK_LIST(n, ifa->neigh_list) if (n->state >= state)
444
    ospf_send_to(ifa, n->ip);
445
}
446

    
447
void
448
ospf_send_to_bdr(struct ospf_iface *ifa)
449
{
450
  if (!ipa_equal(ifa->drip, IPA_NONE))
451
    ospf_send_to(ifa, ifa->drip);
452
  if (!ipa_equal(ifa->bdrip, IPA_NONE))
453
    ospf_send_to(ifa, ifa->bdrip);
454
}
455

    
456
void
457
ospf_send_to(struct ospf_iface *ifa, ip_addr ip)
458
{
459
  sock *sk = ifa->sk;
460
  struct ospf_packet *pkt = (struct ospf_packet *) sk->tbuf;
461
  int len = ntohs(pkt->length);
462

    
463
#ifdef OSPFv2
464
  if (ifa->autype == OSPF_AUTH_CRYPT)
465
    len += OSPF_AUTH_CRYPT_SIZE;
466
#endif
467

    
468
  ospf_pkt_finalize(ifa, pkt);
469
  if (sk->tbuf != sk->tpos)
470
    log(L_ERR "Aiee, old packet was overwritted in TX buffer");
471

    
472
  if (ipa_equal(ip, IPA_NONE))
473
    sk_send(sk, len);
474
  else
475
    sk_send_to(sk, len, ip, OSPF_PROTO);
476
}
477