summaryrefslogtreecommitdiffstats
path: root/print-rpki-rtr.c
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--print-rpki-rtr.c391
1 files changed, 391 insertions, 0 deletions
diff --git a/print-rpki-rtr.c b/print-rpki-rtr.c
new file mode 100644
index 0000000..36be399
--- /dev/null
+++ b/print-rpki-rtr.c
@@ -0,0 +1,391 @@
+/*
+ * Copyright (c) 1998-2011 The TCPDUMP project
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that: (1) source code
+ * distributions retain the above copyright notice and this paragraph
+ * in its entirety, and (2) distributions including binary code include
+ * the above copyright notice and this paragraph in its entirety in
+ * the documentation or other materials provided with the distribution.
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND
+ * WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
+ * LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE.
+ *
+ * Original code by Hannes Gredler (hannes@gredler.at)
+ */
+
+/* \summary: Resource Public Key Infrastructure (RPKI) to Router Protocol printer */
+
+/* specification: RFC 6810 */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include "netdissect-stdinc.h"
+
+#define ND_LONGJMP_FROM_TCHECK
+#include "netdissect.h"
+#include "extract.h"
+#include "addrtoname.h"
+
+
+/*
+ * RPKI/Router PDU header
+ *
+ * Here's what the PDU header looks like.
+ * The length does include the version and length fields.
+ */
+typedef struct rpki_rtr_pdu_ {
+ nd_uint8_t version; /* Version number */
+ nd_uint8_t pdu_type; /* PDU type */
+ union {
+ nd_uint16_t session_id; /* Session id */
+ nd_uint16_t error_code; /* Error code */
+ } u;
+ nd_uint32_t length;
+} rpki_rtr_pdu;
+
+/*
+ * IPv4 Prefix PDU.
+ */
+typedef struct rpki_rtr_pdu_ipv4_prefix_ {
+ rpki_rtr_pdu pdu_header;
+ nd_uint8_t flags;
+ nd_uint8_t prefix_length;
+ nd_uint8_t max_length;
+ nd_uint8_t zero;
+ nd_ipv4 prefix;
+ nd_uint32_t as;
+} rpki_rtr_pdu_ipv4_prefix;
+
+/*
+ * IPv6 Prefix PDU.
+ */
+typedef struct rpki_rtr_pdu_ipv6_prefix_ {
+ rpki_rtr_pdu pdu_header;
+ nd_uint8_t flags;
+ nd_uint8_t prefix_length;
+ nd_uint8_t max_length;
+ nd_uint8_t zero;
+ nd_ipv6 prefix;
+ nd_uint32_t as;
+} rpki_rtr_pdu_ipv6_prefix;
+
+/*
+ * Error report PDU.
+ */
+typedef struct rpki_rtr_pdu_error_report_ {
+ rpki_rtr_pdu pdu_header;
+ nd_uint32_t encapsulated_pdu_length; /* Encapsulated PDU length */
+ /* Copy of Erroneous PDU (variable, optional) */
+ /* Length of Error Text (4 octets in network byte order) */
+ /* Arbitrary Text of Error Diagnostic Message (variable, optional) */
+} rpki_rtr_pdu_error_report;
+
+/*
+ * PDU type codes
+ */
+#define RPKI_RTR_SERIAL_NOTIFY_PDU 0
+#define RPKI_RTR_SERIAL_QUERY_PDU 1
+#define RPKI_RTR_RESET_QUERY_PDU 2
+#define RPKI_RTR_CACHE_RESPONSE_PDU 3
+#define RPKI_RTR_IPV4_PREFIX_PDU 4
+#define RPKI_RTR_IPV6_PREFIX_PDU 6
+#define RPKI_RTR_END_OF_DATA_PDU 7
+#define RPKI_RTR_CACHE_RESET_PDU 8
+#define RPKI_RTR_ERROR_REPORT_PDU 10
+
+static const struct tok rpki_rtr_pdu_values[] = {
+ { RPKI_RTR_SERIAL_NOTIFY_PDU, "Serial Notify" },
+ { RPKI_RTR_SERIAL_QUERY_PDU, "Serial Query" },
+ { RPKI_RTR_RESET_QUERY_PDU, "Reset Query" },
+ { RPKI_RTR_CACHE_RESPONSE_PDU, "Cache Response" },
+ { RPKI_RTR_IPV4_PREFIX_PDU, "IPV4 Prefix" },
+ { RPKI_RTR_IPV6_PREFIX_PDU, "IPV6 Prefix" },
+ { RPKI_RTR_END_OF_DATA_PDU, "End of Data" },
+ { RPKI_RTR_CACHE_RESET_PDU, "Cache Reset" },
+ { RPKI_RTR_ERROR_REPORT_PDU, "Error Report" },
+ { 0, NULL}
+};
+
+static const struct tok rpki_rtr_error_codes[] = {
+ { 0, "Corrupt Data" },
+ { 1, "Internal Error" },
+ { 2, "No Data Available" },
+ { 3, "Invalid Request" },
+ { 4, "Unsupported Protocol Version" },
+ { 5, "Unsupported PDU Type" },
+ { 6, "Withdrawal of Unknown Record" },
+ { 7, "Duplicate Announcement Received" },
+ { 0, NULL}
+};
+
+/*
+ * Build a indentation string for a given indentation level.
+ * XXX this should be really in util.c
+ */
+static char *
+indent_string (u_int indent)
+{
+ static char buf[20];
+ u_int idx;
+
+ idx = 0;
+ buf[idx] = '\0';
+
+ /*
+ * Does the static buffer fit ?
+ */
+ if (sizeof(buf) < ((indent/8) + (indent %8) + 2)) {
+ return buf;
+ }
+
+ /*
+ * Heading newline.
+ */
+ buf[idx] = '\n';
+ idx++;
+
+ while (indent >= 8) {
+ buf[idx] = '\t';
+ idx++;
+ indent -= 8;
+ }
+
+ while (indent > 0) {
+ buf[idx] = ' ';
+ idx++;
+ indent--;
+ }
+
+ /*
+ * Trailing zero.
+ */
+ buf[idx] = '\0';
+
+ return buf;
+}
+
+/*
+ * Print a single PDU.
+ */
+static u_int
+rpki_rtr_pdu_print(netdissect_options *ndo, const u_char *tptr, const u_int len,
+ const u_char recurse, const u_int indent)
+{
+ const rpki_rtr_pdu *pdu_header;
+ u_int pdu_type, pdu_len, hexdump;
+ const u_char *msg;
+
+ /* Protocol Version */
+ if (GET_U_1(tptr) != 0) {
+ /* Skip the rest of the input buffer because even if this is
+ * a well-formed PDU of a future RPKI-Router protocol version
+ * followed by a well-formed PDU of RPKI-Router protocol
+ * version 0, there is no way to know exactly how to skip the
+ * current PDU.
+ */
+ ND_PRINT("%sRPKI-RTRv%u (unknown)", indent_string(8), GET_U_1(tptr));
+ return len;
+ }
+ if (len < sizeof(rpki_rtr_pdu)) {
+ ND_PRINT("(%u bytes is too few to decode)", len);
+ goto invalid;
+ }
+ ND_TCHECK_LEN(tptr, sizeof(rpki_rtr_pdu));
+ pdu_header = (const rpki_rtr_pdu *)tptr;
+ pdu_type = GET_U_1(pdu_header->pdu_type);
+ pdu_len = GET_BE_U_4(pdu_header->length);
+ /* Do not check bounds with pdu_len yet, do it in the case blocks
+ * below to make it possible to decode at least the beginning of
+ * a truncated Error Report PDU or a truncated encapsulated PDU.
+ */
+ hexdump = FALSE;
+
+ ND_PRINT("%sRPKI-RTRv%u, %s PDU (%u), length: %u",
+ indent_string(8),
+ GET_U_1(pdu_header->version),
+ tok2str(rpki_rtr_pdu_values, "Unknown", pdu_type),
+ pdu_type, pdu_len);
+ if (pdu_len < sizeof(rpki_rtr_pdu) || pdu_len > len)
+ goto invalid;
+
+ switch (pdu_type) {
+
+ /*
+ * The following PDUs share the message format.
+ */
+ case RPKI_RTR_SERIAL_NOTIFY_PDU:
+ case RPKI_RTR_SERIAL_QUERY_PDU:
+ case RPKI_RTR_END_OF_DATA_PDU:
+ if (pdu_len != sizeof(rpki_rtr_pdu) + 4)
+ goto invalid;
+ msg = (const u_char *)(pdu_header + 1);
+ ND_PRINT("%sSession ID: 0x%04x, Serial: %u",
+ indent_string(indent+2),
+ GET_BE_U_2(pdu_header->u.session_id),
+ GET_BE_U_4(msg));
+ break;
+
+ /*
+ * The following PDUs share the message format.
+ */
+ case RPKI_RTR_RESET_QUERY_PDU:
+ case RPKI_RTR_CACHE_RESET_PDU:
+ if (pdu_len != sizeof(rpki_rtr_pdu))
+ goto invalid;
+ /* no additional boundary to check */
+
+ /*
+ * Zero payload PDUs.
+ */
+ break;
+
+ case RPKI_RTR_CACHE_RESPONSE_PDU:
+ if (pdu_len != sizeof(rpki_rtr_pdu))
+ goto invalid;
+ /* no additional boundary to check */
+ ND_PRINT("%sSession ID: 0x%04x",
+ indent_string(indent+2),
+ GET_BE_U_2(pdu_header->u.session_id));
+ break;
+
+ case RPKI_RTR_IPV4_PREFIX_PDU:
+ {
+ const rpki_rtr_pdu_ipv4_prefix *pdu;
+
+ if (pdu_len != sizeof(rpki_rtr_pdu_ipv4_prefix))
+ goto invalid;
+ pdu = (const rpki_rtr_pdu_ipv4_prefix *)tptr;
+ ND_PRINT("%sIPv4 Prefix %s/%u-%u, origin-as %u, flags 0x%02x",
+ indent_string(indent+2),
+ GET_IPADDR_STRING(pdu->prefix),
+ GET_U_1(pdu->prefix_length), GET_U_1(pdu->max_length),
+ GET_BE_U_4(pdu->as), GET_U_1(pdu->flags));
+ }
+ break;
+
+ case RPKI_RTR_IPV6_PREFIX_PDU:
+ {
+ const rpki_rtr_pdu_ipv6_prefix *pdu;
+
+ if (pdu_len != sizeof(rpki_rtr_pdu_ipv6_prefix))
+ goto invalid;
+ pdu = (const rpki_rtr_pdu_ipv6_prefix *)tptr;
+ ND_PRINT("%sIPv6 Prefix %s/%u-%u, origin-as %u, flags 0x%02x",
+ indent_string(indent+2),
+ GET_IP6ADDR_STRING(pdu->prefix),
+ GET_U_1(pdu->prefix_length), GET_U_1(pdu->max_length),
+ GET_BE_U_4(pdu->as), GET_U_1(pdu->flags));
+ }
+ break;
+
+ case RPKI_RTR_ERROR_REPORT_PDU:
+ {
+ const rpki_rtr_pdu_error_report *pdu;
+ u_int encapsulated_pdu_length, text_length, tlen, error_code;
+
+ tlen = sizeof(rpki_rtr_pdu);
+ /* Do not test for the "Length of Error Text" data element yet. */
+ if (pdu_len < tlen + 4)
+ goto invalid;
+ ND_TCHECK_LEN(tptr, tlen + 4);
+ /* Safe up to and including the "Length of Encapsulated PDU"
+ * data element, more data elements may be present.
+ */
+ pdu = (const rpki_rtr_pdu_error_report *)tptr;
+ encapsulated_pdu_length = GET_BE_U_4(pdu->encapsulated_pdu_length);
+ tlen += 4;
+
+ error_code = GET_BE_U_2(pdu->pdu_header.u.error_code);
+ ND_PRINT("%sError code: %s (%u), Encapsulated PDU length: %u",
+ indent_string(indent+2),
+ tok2str(rpki_rtr_error_codes, "Unknown", error_code),
+ error_code, encapsulated_pdu_length);
+
+ if (encapsulated_pdu_length) {
+ /* Section 5.10 of RFC 6810 says:
+ * "An Error Report PDU MUST NOT be sent for an Error Report PDU."
+ *
+ * However, as far as the protocol encoding goes Error Report PDUs can
+ * happen to be nested in each other, however many times, in which case
+ * the decoder should still print such semantically incorrect PDUs.
+ *
+ * That said, "the Erroneous PDU field MAY be truncated" (ibid), thus
+ * to keep things simple this implementation decodes only the two
+ * outermost layers of PDUs and makes bounds checks in the outer and
+ * the inner PDU independently.
+ */
+ if (pdu_len < tlen + encapsulated_pdu_length)
+ goto invalid;
+ if (! recurse) {
+ ND_TCHECK_LEN(tptr, tlen + encapsulated_pdu_length);
+ }
+ else {
+ ND_PRINT("%s-----encapsulated PDU-----", indent_string(indent+4));
+ rpki_rtr_pdu_print(ndo, tptr + tlen,
+ encapsulated_pdu_length, 0, indent + 2);
+ }
+ tlen += encapsulated_pdu_length;
+ }
+
+ if (pdu_len < tlen + 4)
+ goto invalid;
+ ND_TCHECK_LEN(tptr, tlen + 4);
+ /* Safe up to and including the "Length of Error Text" data element,
+ * one more data element may be present.
+ */
+
+ /*
+ * Extract, trail-zero and print the Error message.
+ */
+ text_length = GET_BE_U_4(tptr + tlen);
+ tlen += 4;
+
+ if (text_length) {
+ if (pdu_len < tlen + text_length)
+ goto invalid;
+ /* nd_printn() makes the bounds check */
+ ND_PRINT("%sError text: ", indent_string(indent+2));
+ (void)nd_printn(ndo, tptr + tlen, text_length, NULL);
+ }
+ }
+ break;
+
+ default:
+ ND_TCHECK_LEN(tptr, pdu_len);
+
+ /*
+ * Unknown data, please hexdump.
+ */
+ hexdump = TRUE;
+ }
+
+ /* do we also want to see a hex dump ? */
+ if (ndo->ndo_vflag > 1 || (ndo->ndo_vflag && hexdump)) {
+ print_unknown_data(ndo,tptr,"\n\t ", pdu_len);
+ }
+ return pdu_len;
+
+invalid:
+ nd_print_invalid(ndo);
+ ND_TCHECK_LEN(tptr, len);
+ return len;
+}
+
+void
+rpki_rtr_print(netdissect_options *ndo, const u_char *pptr, u_int len)
+{
+ ndo->ndo_protocol = "rpki_rtr";
+ if (!ndo->ndo_vflag) {
+ ND_PRINT(", RPKI-RTR");
+ return;
+ }
+ while (len) {
+ u_int pdu_len = rpki_rtr_pdu_print(ndo, pptr, len, 1, 8);
+ len -= pdu_len;
+ pptr += pdu_len;
+ }
+}
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-08 04:03:17 +0000