sbin/routed/input.c

   1 /*
   2  * Copyright (c) 1983, 1988, 1993
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  * 3. All advertising materials mentioning features or use of this software
  14  *    must display the following acknowledgment:
  15  *      This product includes software developed by the University of
  16  *      California, Berkeley and its contributors.
  17  * 4. Neither the name of the University nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  *
  33  * $FreeBSD: src/sbin/routed/input.c,v 1.7.2.1 2001/08/01 09:01:45 obrien Exp $
  34  * $DragonFly: src/sbin/routed/input.c,v 1.3 2004/07/28 12:27:40 joerg Exp $
  35  */
  36
  37 #include "defs.h"
  38
  39 #if !defined(sgi) && !defined(__NetBSD__)
  40 static char sccsid[] __attribute__((unused)) = "@(#)input.c     8.1 (Berkeley) 6/5/93";
  41 #elif defined(__NetBSD__)
  42 #include <sys/cdefs.h>
  43 __RCSID("$NetBSD$");
  44 #endif
  45 #ident "$FreeBSD: src/sbin/routed/input.c,v 1.7.2.1 2001/08/01 09:01:45 obrien Exp $"
  46
  47 static void input(struct sockaddr_in *, struct interface *, struct interface *,
  48                   struct rip *, int);
  49 static void input_route(naddr, naddr, struct rt_spare *, struct netinfo *);
  50 static int ck_passwd(struct interface *, struct rip *, void *,
  51                      naddr, struct msg_limit *);
  52
  53
  54 /* process RIP input
  55  */
  56 void
  57 read_rip(int sock,
  58          struct interface *sifp)
  59 {
  60         struct sockaddr_in from;
  61         struct interface *aifp;
  62         int fromlen, cc;
  63 #ifdef USE_PASSIFNAME
  64         static struct msg_limit  bad_name;
  65         struct {
  66                 char    ifname[IFNAMSIZ];
  67                 union pkt_buf pbuf;
  68         } inbuf;
  69 #else
  70         struct {
  71                 union pkt_buf pbuf;
  72         } inbuf;
  73 #endif
  74
  75
  76         for (;;) {
  77                 fromlen = sizeof(from);
  78                 cc = recvfrom(sock, &inbuf, sizeof(inbuf), 0,
  79                               (struct sockaddr*)&from, &fromlen);
  80                 if (cc <= 0) {
  81                         if (cc < 0 && errno != EWOULDBLOCK)
  82                                 LOGERR("recvfrom(rip)");
  83                         break;
  84                 }
  85                 if (fromlen != sizeof(struct sockaddr_in))
  86                         logbad(1,"impossible recvfrom(rip) fromlen=%d",
  87                                fromlen);
  88
  89                 /* aifp is the "authenticated" interface via which the packet
  90                  *      arrived.  In fact, it is only the interface on which
  91                  *      the packet should have arrived based on is source
  92                  *      address.
  93                  * sifp is interface associated with the socket through which
  94                  *      the packet was received.
  95                  */
  96 #ifdef USE_PASSIFNAME
  97                 if ((cc -= sizeof(inbuf.ifname)) < 0)
  98                         logbad(0,"missing USE_PASSIFNAME; only %d bytes",
  99                                cc+sizeof(inbuf.ifname));
 100
 101                 /* check the remote interfaces first */
 102                 for (aifp = remote_if; aifp; aifp = aifp->int_rlink) {
 103                         if (aifp->int_addr == from.sin_addr.s_addr)
 104                                 break;
 105                 }
 106                 if (aifp == 0) {
 107                         aifp = ifwithname(inbuf.ifname, 0);
 108                         if (aifp == 0) {
 109                                 msglim(&bad_name, from.sin_addr.s_addr,
 110                                        "impossible interface name %.*s",
 111                                        IFNAMSIZ, inbuf.ifname);
 112                         } else if (((aifp->int_if_flags & IFF_POINTOPOINT)
 113                                     && aifp->int_dstaddr!=from.sin_addr.s_addr)
 114                                    || (!(aifp->int_if_flags & IFF_POINTOPOINT)
 115                                        && !on_net(from.sin_addr.s_addr,
 116                                                   aifp->int_net,
 117                                                   aifp->int_mask))) {
 118                                 /* If it came via the wrong interface, do not
 119                                  * trust it.
 120                                  */
 121                                 aifp = 0;
 122                         }
 123                 }
 124 #else
 125                 aifp = iflookup(from.sin_addr.s_addr);
 126 #endif
 127                 if (sifp == 0)
 128                         sifp = aifp;
 129
 130                 input(&from, sifp, aifp, &inbuf.pbuf.rip, cc);
 131         }
 132 }
 133
 134
 135 /* Process a RIP packet
 136  */
 137 static void
 138 input(struct sockaddr_in *from,         /* received from this IP address */
 139       struct interface *sifp,           /* interface of incoming socket */
 140       struct interface *aifp,           /* "authenticated" interface */
 141       struct rip *rip,
 142       int cc)
 143 {
 144 #       define FROM_NADDR from->sin_addr.s_addr
 145         static struct msg_limit use_auth, bad_len, bad_mask;
 146         static struct msg_limit unk_router, bad_router, bad_nhop;
 147
 148         struct rt_entry *rt;
 149         struct rt_spare new;
 150         struct netinfo *n, *lim;
 151         struct interface *ifp1;
 152         naddr gate, mask, v1_mask, dst, ddst_h = 0;
 153         struct auth *ap;
 154         struct tgate *tg = 0;
 155         struct tgate_net *tn;
 156         int i, j;
 157
 158         /* Notice when we hear from a remote gateway
 159          */
 160         if (aifp != 0
 161             && (aifp->int_state & IS_REMOTE))
 162                 aifp->int_act_time = now.tv_sec;
 163
 164         trace_rip("Recv", "from", from, sifp, rip, cc);
 165
 166         if (rip->rip_vers == 0) {
 167                 msglim(&bad_router, FROM_NADDR,
 168                        "RIP version 0, cmd %d, packet received from %s",
 169                        rip->rip_cmd, naddr_ntoa(FROM_NADDR));
 170                 return;
 171         } else if (rip->rip_vers > RIPv2) {
 172                 rip->rip_vers = RIPv2;
 173         }
 174         if (cc > (int)OVER_MAXPACKETSIZE) {
 175                 msglim(&bad_router, FROM_NADDR,
 176                        "packet at least %d bytes too long received from %s",
 177                        cc-MAXPACKETSIZE, naddr_ntoa(FROM_NADDR));
 178                 return;
 179         }
 180
 181         n = rip->rip_nets;
 182         lim = (struct netinfo *)((char*)rip + cc);
 183
 184         /* Notice authentication.
 185          * As required by section 4.2 in RFC 1723, discard authenticated
 186          * RIPv2 messages, but only if configured for that silliness.
 187          *
 188          * RIPv2 authentication is lame.  Why authenticate queries?
 189          * Why should a RIPv2 implementation with authentication disabled
 190          * not be able to listen to RIPv2 packets with authentication, while
 191          * RIPv1 systems will listen?  Crazy!
 192          */
 193         if (!auth_ok
 194             && rip->rip_vers == RIPv2
 195             && n < lim && n->n_family == RIP_AF_AUTH) {
 196                 msglim(&use_auth, FROM_NADDR,
 197                        "RIPv2 message with authentication from %s discarded",
 198                        naddr_ntoa(FROM_NADDR));
 199                 return;
 200         }
 201
 202         switch (rip->rip_cmd) {
 203         case RIPCMD_REQUEST:
 204                 /* For mere requests, be a little sloppy about the source
 205                  */
 206                 if (aifp == 0)
 207                         aifp = sifp;
 208
 209                 /* Are we talking to ourself or a remote gateway?
 210                  */
 211                 ifp1 = ifwithaddr(FROM_NADDR, 0, 1);
 212                 if (ifp1) {
 213                         if (ifp1->int_state & IS_REMOTE) {
 214                                 /* remote gateway */
 215                                 aifp = ifp1;
 216                                 if (check_remote(aifp)) {
 217                                         aifp->int_act_time = now.tv_sec;
 218                                         (void)if_ok(aifp, "remote ");
 219                                 }
 220                         } else if (from->sin_port == htons(RIP_PORT)) {
 221                                 trace_pkt("    discard our own RIP request");
 222                                 return;
 223                         }
 224                 }
 225
 226                 /* did the request come from a router?
 227                  */
 228                 if (from->sin_port == htons(RIP_PORT)) {
 229                         /* yes, ignore the request if RIP is off so that
 230                          * the router does not depend on us.
 231                          */
 232                         if (rip_sock < 0
 233                             || (aifp != 0
 234                                 && IS_RIP_OUT_OFF(aifp->int_state))) {
 235                                 trace_pkt("    discard request while RIP off");
 236                                 return;
 237                         }
 238                 }
 239
 240                 /* According to RFC 1723, we should ignore unauthenticated
 241                  * queries.  That is too silly to bother with.  Sheesh!
 242                  * Are forwarding tables supposed to be secret, when
 243                  * a bad guy can infer them with test traffic?  When RIP
 244                  * is still the most common router-discovery protocol
 245                  * and so hosts need to send queries that will be answered?
 246                  * What about `rtquery`?
 247                  * Maybe on firewalls you'd care, but not enough to
 248                  * give up the diagnostic facilities of remote probing.
 249                  */
 250
 251                 if (n >= lim) {
 252                         msglim(&bad_len, FROM_NADDR, "empty request from %s",
 253                                naddr_ntoa(FROM_NADDR));
 254                         return;
 255                 }
 256                 if (cc%sizeof(*n) != sizeof(struct rip)%sizeof(*n)) {
 257                         msglim(&bad_len, FROM_NADDR,
 258                                "request of bad length (%d) from %s",
 259                                cc, naddr_ntoa(FROM_NADDR));
 260                 }
 261
 262                 if (rip->rip_vers == RIPv2
 263                     && (aifp == 0 || (aifp->int_state & IS_NO_RIPV1_OUT))) {
 264                         v12buf.buf->rip_vers = RIPv2;
 265                         /* If we have a secret but it is a cleartext secret,
 266                          * do not disclose our secret unless the other guy
 267                          * already knows it.
 268                          */
 269                         ap = find_auth(aifp);
 270                         if (ap != 0 && ap->type == RIP_AUTH_PW
 271                             && n->n_family == RIP_AF_AUTH
 272                             && !ck_passwd(aifp,rip,lim,FROM_NADDR,&use_auth))
 273                                 ap = 0;
 274                 } else {
 275                         v12buf.buf->rip_vers = RIPv1;
 276                         ap = 0;
 277                 }
 278                 clr_ws_buf(&v12buf, ap);
 279
 280                 do {
 281                         n->n_metric = ntohl(n->n_metric);
 282
 283                         /* A single entry with family RIP_AF_UNSPEC and
 284                          * metric HOPCNT_INFINITY means "all routes".
 285                          * We respond to routers only if we are acting
 286                          * as a supplier, or to anyone other than a router
 287                          * (i.e. a query).
 288                          */
 289                         if (n->n_family == RIP_AF_UNSPEC
 290                             && n->n_metric == HOPCNT_INFINITY) {
 291                                 /* Answer a query from a utility program
 292                                  * with all we know.
 293                                  */
 294                                 if (from->sin_port != htons(RIP_PORT)) {
 295                                         supply(from, aifp, OUT_QUERY, 0,
 296                                                rip->rip_vers, ap != 0);
 297                                         return;
 298                                 }
 299
 300                                 /* A router trying to prime its tables.
 301                                  * Filter the answer in the about same way
 302                                  * broadcasts are filtered.
 303                                  *
 304                                  * Only answer a router if we are a supplier
 305                                  * to keep an unwary host that is just starting
 306                                  * from picking us as a router.
 307                                  */
 308                                 if (aifp == 0) {
 309                                         trace_pkt("ignore distant router");
 310                                         return;
 311                                 }
 312                                 if (!supplier
 313                                     || IS_RIP_OFF(aifp->int_state)) {
 314                                         trace_pkt("ignore; not supplying");
 315                                         return;
 316                                 }
 317
 318                                 /* Do not answer a RIPv1 router if
 319                                  * we are sending RIPv2.  But do offer
 320                                  * poor man's router discovery.
 321                                  */
 322                                 if ((aifp->int_state & IS_NO_RIPV1_OUT)
 323                                     && rip->rip_vers == RIPv1) {
 324                                         if (!(aifp->int_state & IS_PM_RDISC)) {
 325                                             trace_pkt("ignore; sending RIPv2");
 326                                             return;
 327                                         }
 328
 329                                         v12buf.n->n_family = RIP_AF_INET;
 330                                         v12buf.n->n_dst = RIP_DEFAULT;
 331                                         i = aifp->int_d_metric;
 332                                         if (0 != (rt = rtget(RIP_DEFAULT, 0)))
 333                                             i = MIN(i, (rt->rt_metric
 334                                                         +aifp->int_metric+1));
 335                                         v12buf.n->n_metric = htonl(i);
 336                                         v12buf.n++;
 337                                         break;
 338                                 }
 339
 340                                 /* Respond with RIPv1 instead of RIPv2 if
 341                                  * that is what we are broadcasting on the
 342                                  * interface to keep the remote router from
 343                                  * getting the wrong initial idea of the
 344                                  * routes we send.
 345                                  */
 346                                 supply(from, aifp, OUT_UNICAST, 0,
 347                                        (aifp->int_state & IS_NO_RIPV1_OUT)
 348                                        ? RIPv2 : RIPv1,
 349                                        ap != 0);
 350                                 return;
 351                         }
 352
 353                         /* Ignore authentication */
 354                         if (n->n_family == RIP_AF_AUTH)
 355                                 continue;
 356
 357                         if (n->n_family != RIP_AF_INET) {
 358                                 msglim(&bad_router, FROM_NADDR,
 359                                        "request from %s for unsupported"
 360                                        " (af %d) %s",
 361                                        naddr_ntoa(FROM_NADDR),
 362                                        ntohs(n->n_family),
 363                                        naddr_ntoa(n->n_dst));
 364                                 return;
 365                         }
 366
 367                         /* We are being asked about a specific destination.
 368                          */
 369                         dst = n->n_dst;
 370                         if (!check_dst(dst)) {
 371                                 msglim(&bad_router, FROM_NADDR,
 372                                        "bad queried destination %s from %s",
 373                                        naddr_ntoa(dst),
 374                                        naddr_ntoa(FROM_NADDR));
 375                                 return;
 376                         }
 377
 378                         /* decide what mask was intended */
 379                         if (rip->rip_vers == RIPv1
 380                             || 0 == (mask = ntohl(n->n_mask))
 381                             || 0 != (ntohl(dst) & ~mask))
 382                                 mask = ripv1_mask_host(dst, aifp);
 383
 384                         /* try to find the answer */
 385                         rt = rtget(dst, mask);
 386                         if (!rt && dst != RIP_DEFAULT)
 387                                 rt = rtfind(n->n_dst);
 388
 389                         if (v12buf.buf->rip_vers != RIPv1)
 390                                 v12buf.n->n_mask = mask;
 391                         if (rt == 0) {
 392                                 /* we do not have the answer */
 393                                 v12buf.n->n_metric = HOPCNT_INFINITY;
 394                         } else {
 395                                 /* we have the answer, so compute the
 396                                  * right metric and next hop.
 397                                  */
 398                                 v12buf.n->n_family = RIP_AF_INET;
 399                                 v12buf.n->n_dst = dst;
 400                                 v12buf.n->n_metric = (rt->rt_metric+1
 401                                                       + ((aifp!=0)
 402                                                           ? aifp->int_metric
 403                                                           : 1));
 404                                 if (v12buf.n->n_metric > HOPCNT_INFINITY)
 405                                         v12buf.n->n_metric = HOPCNT_INFINITY;
 406                                 if (v12buf.buf->rip_vers != RIPv1) {
 407                                         v12buf.n->n_tag = rt->rt_tag;
 408                                         v12buf.n->n_mask = mask;
 409                                         if (aifp != 0
 410                                             && on_net(rt->rt_gate,
 411                                                       aifp->int_net,
 412                                                       aifp->int_mask)
 413                                             && rt->rt_gate != aifp->int_addr)
 414                                             v12buf.n->n_nhop = rt->rt_gate;
 415                                 }
 416                         }
 417                         v12buf.n->n_metric = htonl(v12buf.n->n_metric);
 418
 419                         /* Stop paying attention if we fill the output buffer.
 420                          */
 421                         if (++v12buf.n >= v12buf.lim)
 422                                 break;
 423                 } while (++n < lim);
 424
 425                 /* Send the answer about specific routes.
 426                  */
 427                 if (ap != 0 && ap->type == RIP_AUTH_MD5)
 428                         end_md5_auth(&v12buf, ap);
 429
 430                 if (from->sin_port != htons(RIP_PORT)) {
 431                         /* query */
 432                         (void)output(OUT_QUERY, from, aifp,
 433                                      v12buf.buf,
 434                                      ((char *)v12buf.n - (char*)v12buf.buf));
 435                 } else if (supplier) {
 436                         (void)output(OUT_UNICAST, from, aifp,
 437                                      v12buf.buf,
 438                                      ((char *)v12buf.n - (char*)v12buf.buf));
 439                 } else {
 440                         /* Only answer a router if we are a supplier
 441                          * to keep an unwary host that is just starting
 442                          * from picking us an a router.
 443                          */
 444                         ;
 445                 }
 446                 return;
 447
 448         case RIPCMD_TRACEON:
 449         case RIPCMD_TRACEOFF:
 450                 /* Notice that trace messages are turned off for all possible
 451                  * abuse if _PATH_TRACE is undefined in pathnames.h.
 452                  * Notice also that because of the way the trace file is
 453                  * handled in trace.c, no abuse is plausible even if
 454                  * _PATH_TRACE_ is defined.
 455                  *
 456                  * First verify message came from a privileged port. */
 457                 if (ntohs(from->sin_port) > IPPORT_RESERVED) {
 458                         msglog("trace command from untrusted port on %s",
 459                                naddr_ntoa(FROM_NADDR));
 460                         return;
 461                 }
 462                 if (aifp == 0) {
 463                         msglog("trace command from unknown router %s",
 464                                naddr_ntoa(FROM_NADDR));
 465                         return;
 466                 }
 467                 if (rip->rip_cmd == RIPCMD_TRACEON) {
 468                         rip->rip_tracefile[cc-4] = '\0';
 469                         set_tracefile((char*)rip->rip_tracefile,
 470                                       "trace command: %s\n", 0);
 471                 } else {
 472                         trace_off("tracing turned off by %s",
 473                                   naddr_ntoa(FROM_NADDR));
 474                 }
 475                 return;
 476
 477         case RIPCMD_RESPONSE:
 478                 if (cc%sizeof(*n) != sizeof(struct rip)%sizeof(*n)) {
 479                         msglim(&bad_len, FROM_NADDR,
 480                                "response of bad length (%d) from %s",
 481                                cc, naddr_ntoa(FROM_NADDR));
 482                 }
 483
 484                 /* verify message came from a router */
 485                 if (from->sin_port != ntohs(RIP_PORT)) {
 486                         msglim(&bad_router, FROM_NADDR,
 487                                "    discard RIP response from unknown port"
 488                                " %d on host %s", ntohs(from->sin_port),
 489                                 naddr_ntoa(FROM_NADDR));
 490                         return;
 491                 }
 492
 493                 if (rip_sock < 0) {
 494                         trace_pkt("    discard response while RIP off");
 495                         return;
 496                 }
 497
 498                 /* Are we talking to ourself or a remote gateway?
 499                  */
 500                 ifp1 = ifwithaddr(FROM_NADDR, 0, 1);
 501                 if (ifp1) {
 502                         if (ifp1->int_state & IS_REMOTE) {
 503                                 /* remote gateway */
 504                                 aifp = ifp1;
 505                                 if (check_remote(aifp)) {
 506                                         aifp->int_act_time = now.tv_sec;
 507                                         (void)if_ok(aifp, "remote ");
 508                                 }
 509                         } else {
 510                                 trace_pkt("    discard our own RIP response");
 511                                 return;
 512                         }
 513                 }
 514
 515                 /* Accept routing packets from routers directly connected
 516                  * via broadcast or point-to-point networks, and from
 517                  * those listed in /etc/gateways.
 518                  */
 519                 if (aifp == 0) {
 520                         msglim(&unk_router, FROM_NADDR,
 521                                "   discard response from %s"
 522                                " via unexpected interface",
 523                                naddr_ntoa(FROM_NADDR));
 524                         return;
 525                 }
 526                 if (IS_RIP_IN_OFF(aifp->int_state)) {
 527                         trace_pkt("    discard RIPv%d response"
 528                                   " via disabled interface %s",
 529                                   rip->rip_vers, aifp->int_name);
 530                         return;
 531                 }
 532
 533                 if (n >= lim) {
 534                         msglim(&bad_len, FROM_NADDR, "empty response from %s",
 535                                naddr_ntoa(FROM_NADDR));
 536                         return;
 537                 }
 538
 539                 if (((aifp->int_state & IS_NO_RIPV1_IN)
 540                      && rip->rip_vers == RIPv1)
 541                     || ((aifp->int_state & IS_NO_RIPV2_IN)
 542                         && rip->rip_vers != RIPv1)) {
 543                         trace_pkt("    discard RIPv%d response",
 544                                   rip->rip_vers);
 545                         return;
 546                 }
 547
 548                 /* Ignore routes via dead interface.
 549                  */
 550                 if (aifp->int_state & IS_BROKE) {
 551                         trace_pkt("discard response via broken interface %s",
 552                                   aifp->int_name);
 553                         return;
 554                 }
 555
 556                 /* If the interface cares, ignore bad routers.
 557                  * Trace but do not log this problem, because where it
 558                  * happens, it happens frequently.
 559                  */
 560                 if (aifp->int_state & IS_DISTRUST) {
 561                         tg = tgates;
 562                         while (tg->tgate_addr != FROM_NADDR) {
 563                                 tg = tg->tgate_next;
 564                                 if (tg == 0) {
 565                                         trace_pkt("    discard RIP response"
 566                                                   " from untrusted router %s",
 567                                                   naddr_ntoa(FROM_NADDR));
 568                                         return;
 569                                 }
 570                         }
 571                 }
 572
 573                 /* Authenticate the packet if we have a secret.
 574                  * If we do not have any secrets, ignore the error in
 575                  * RFC 1723 and accept it regardless.
 576                  */
 577                 if (aifp->int_auth[0].type != RIP_AUTH_NONE
 578                     && rip->rip_vers != RIPv1
 579                     && !ck_passwd(aifp,rip,lim,FROM_NADDR,&use_auth))
 580                         return;
 581
 582                 do {
 583                         if (n->n_family == RIP_AF_AUTH)
 584                                 continue;
 585
 586                         n->n_metric = ntohl(n->n_metric);
 587                         dst = n->n_dst;
 588                         if (n->n_family != RIP_AF_INET
 589                             && (n->n_family != RIP_AF_UNSPEC
 590                                 || dst != RIP_DEFAULT)) {
 591                                 msglim(&bad_router, FROM_NADDR,
 592                                        "route from %s to unsupported"
 593                                        " address family=%d destination=%s",
 594                                        naddr_ntoa(FROM_NADDR),
 595                                        n->n_family,
 596                                        naddr_ntoa(dst));
 597                                 continue;
 598                         }
 599                         if (!check_dst(dst)) {
 600                                 msglim(&bad_router, FROM_NADDR,
 601                                        "bad destination %s from %s",
 602                                        naddr_ntoa(dst),
 603                                        naddr_ntoa(FROM_NADDR));
 604                                 return;
 605                         }
 606                         if (n->n_metric == 0
 607                             || n->n_metric > HOPCNT_INFINITY) {
 608                                 msglim(&bad_router, FROM_NADDR,
 609                                        "bad metric %d from %s"
 610                                        " for destination %s",
 611                                        n->n_metric,
 612                                        naddr_ntoa(FROM_NADDR),
 613                                        naddr_ntoa(dst));
 614                                 return;
 615                         }
 616
 617                         /* Notice the next-hop.
 618                          */
 619                         gate = FROM_NADDR;
 620                         if (n->n_nhop != 0) {
 621                                 if (rip->rip_vers == RIPv1) {
 622                                         n->n_nhop = 0;
 623                                 } else {
 624                                     /* Use it only if it is valid. */
 625                                     if (on_net(n->n_nhop,
 626                                                aifp->int_net, aifp->int_mask)
 627                                         && check_dst(n->n_nhop)) {
 628                                             gate = n->n_nhop;
 629                                     } else {
 630                                             msglim(&bad_nhop, FROM_NADDR,
 631                                                    "router %s to %s"
 632                                                    " has bad next hop %s",
 633                                                    naddr_ntoa(FROM_NADDR),
 634                                                    naddr_ntoa(dst),
 635                                                    naddr_ntoa(n->n_nhop));
 636                                             n->n_nhop = 0;
 637                                     }
 638                                 }
 639                         }
 640
 641                         if (rip->rip_vers == RIPv1
 642                             || 0 == (mask = ntohl(n->n_mask))) {
 643                                 mask = ripv1_mask_host(dst,aifp);
 644                         } else if ((ntohl(dst) & ~mask) != 0) {
 645                                 msglim(&bad_mask, FROM_NADDR,
 646                                        "router %s sent bad netmask"
 647                                        " %#lx with %s",
 648                                        naddr_ntoa(FROM_NADDR),
 649                                        (u_long)mask,
 650                                        naddr_ntoa(dst));
 651                                 continue;
 652                         }
 653                         if (rip->rip_vers == RIPv1)
 654                                 n->n_tag = 0;
 655
 656                         /* Adjust metric according to incoming interface..
 657                          */
 658                         n->n_metric += aifp->int_metric;
 659                         if (n->n_metric > HOPCNT_INFINITY)
 660                                 n->n_metric = HOPCNT_INFINITY;
 661
 662                         /* Should we trust this route from this router? */
 663                         if (tg && (tn = tg->tgate_nets)->mask != 0) {
 664                                 for (i = 0; i < MAX_TGATE_NETS; i++, tn++) {
 665                                         if (on_net(dst, tn->net, tn->mask)
 666                                             && tn->mask <= mask)
 667                                             break;
 668                                 }
 669                                 if (i >= MAX_TGATE_NETS || tn->mask == 0) {
 670                                         trace_pkt("   ignored unauthorized %s",
 671                                                   addrname(dst,mask,0));
 672                                         continue;
 673                                 }
 674                         }
 675
 676                         /* Recognize and ignore a default route we faked
 677                          * which is being sent back to us by a machine with
 678                          * broken split-horizon.
 679                          * Be a little more paranoid than that, and reject
 680                          * default routes with the same metric we advertised.
 681                          */
 682                         if (aifp->int_d_metric != 0
 683                             && dst == RIP_DEFAULT
 684                             && (int)n->n_metric >= aifp->int_d_metric)
 685                                 continue;
 686
 687                         /* We can receive aggregated RIPv2 routes that must
 688                          * be broken down before they are transmitted by
 689                          * RIPv1 via an interface on a subnet.
 690                          * We might also receive the same routes aggregated
 691                          * via other RIPv2 interfaces.
 692                          * This could cause duplicate routes to be sent on
 693                          * the RIPv1 interfaces.  "Longest matching variable
 694                          * length netmasks" lets RIPv2 listeners understand,
 695                          * but breaking down the aggregated routes for RIPv1
 696                          * listeners can produce duplicate routes.
 697                          *
 698                          * Breaking down aggregated routes here bloats
 699                          * the daemon table, but does not hurt the kernel
 700                          * table, since routes are always aggregated for
 701                          * the kernel.
 702                          *
 703                          * Notice that this does not break down network
 704                          * routes corresponding to subnets.  This is part
 705                          * of the defense against RS_NET_SYN.
 706                          */
 707                         if (have_ripv1_out
 708                             && (((rt = rtget(dst,mask)) == 0
 709                                  || !(rt->rt_state & RS_NET_SYN)))
 710                             && (v1_mask = ripv1_mask_net(dst,0)) > mask) {
 711                                 ddst_h = v1_mask & -v1_mask;
 712                                 i = (v1_mask & ~mask)/ddst_h;
 713                                 if (i >= 511) {
 714                                         /* Punt if we would have to generate
 715                                          * an unreasonable number of routes.
 716                                          */
 717                                         if (TRACECONTENTS)
 718                                             trace_misc("accept %s-->%s as 1"
 719                                                        " instead of %d routes",
 720                                                        addrname(dst,mask,0),
 721                                                        naddr_ntoa(FROM_NADDR),
 722                                                        i+1);
 723                                         i = 0;
 724                                 } else {
 725                                         mask = v1_mask;
 726                                 }
 727                         } else {
 728                                 i = 0;
 729                         }
 730
 731                         new.rts_gate = gate;
 732                         new.rts_router = FROM_NADDR;
 733                         new.rts_metric = n->n_metric;
 734                         new.rts_tag = n->n_tag;
 735                         new.rts_time = now.tv_sec;
 736                         new.rts_ifp = aifp;
 737                         new.rts_de_ag = i;
 738                         j = 0;
 739                         for (;;) {
 740                                 input_route(dst, mask, &new, n);
 741                                 if (++j > i)
 742                                         break;
 743                                 dst = htonl(ntohl(dst) + ddst_h);
 744                         }
 745                 } while (++n < lim);
 746                 break;
 747         }
 748 #undef FROM_NADDR
 749 }
 750
 751
 752 /* Process a single input route.
 753  */
 754 static void
 755 input_route(naddr dst,                  /* network order */
 756             naddr mask,
 757             struct rt_spare *new,
 758             struct netinfo *n)
 759 {
 760         int i;
 761         struct rt_entry *rt;
 762         struct rt_spare *rts, *rts0;
 763         struct interface *ifp1;
 764
 765
 766         /* See if the other guy is telling us to send our packets to him.
 767          * Sometimes network routes arrive over a point-to-point link for
 768          * the network containing the address(es) of the link.
 769          *
 770          * If our interface is broken, switch to using the other guy.
 771          */
 772         ifp1 = ifwithaddr(dst, 1, 1);
 773         if (ifp1 != 0
 774             && (!(ifp1->int_state & IS_BROKE)
 775                 || (ifp1->int_state & IS_PASSIVE)))
 776                 return;
 777
 778         /* Look for the route in our table.
 779          */
 780         rt = rtget(dst, mask);
 781
 782         /* Consider adding the route if we do not already have it.
 783          */
 784         if (rt == 0) {
 785                 /* Ignore unknown routes being poisoned.
 786                  */
 787                 if (new->rts_metric == HOPCNT_INFINITY)
 788                         return;
 789
 790                 /* Ignore the route if it points to us */
 791                 if (n->n_nhop != 0
 792                     && 0 != ifwithaddr(n->n_nhop, 1, 0))
 793                         return;
 794
 795                 /* If something has not gone crazy and tried to fill
 796                  * our memory, accept the new route.
 797                  */
 798                 if (total_routes < MAX_ROUTES)
 799                         rtadd(dst, mask, 0, new);
 800                 return;
 801         }
 802
 803         /* We already know about the route.  Consider this update.
 804          *
 805          * If (rt->rt_state & RS_NET_SYN), then this route
 806          * is the same as a network route we have inferred
 807          * for subnets we know, in order to tell RIPv1 routers
 808          * about the subnets.
 809          *
 810          * It is impossible to tell if the route is coming
 811          * from a distant RIPv2 router with the standard
 812          * netmask because that router knows about the entire
 813          * network, or if it is a round-about echo of a
 814          * synthetic, RIPv1 network route of our own.
 815          * The worst is that both kinds of routes might be
 816          * received, and the bad one might have the smaller
 817          * metric.  Partly solve this problem by never
 818          * aggregating into such a route.  Also keep it
 819          * around as long as the interface exists.
 820          */
 821
 822         rts0 = rt->rt_spares;
 823         for (rts = rts0, i = NUM_SPARES; i != 0; i--, rts++) {
 824                 if (rts->rts_router == new->rts_router)
 825                         break;
 826                 /* Note the worst slot to reuse,
 827                  * other than the current slot.
 828                  */
 829                 if (rts0 == rt->rt_spares
 830                     || BETTER_LINK(rt, rts0, rts))
 831                         rts0 = rts;
 832         }
 833         if (i != 0) {
 834                 /* Found a route from the router already in the table.
 835                  */
 836
 837                 /* If the new route is a route broken down from an
 838                  * aggregated route, and if the previous route is either
 839                  * not a broken down route or was broken down from a finer
 840                  * netmask, and if the previous route is current,
 841                  * then forget this one.
 842                  */
 843                 if (new->rts_de_ag > rts->rts_de_ag
 844                     && now_stale <= rts->rts_time)
 845                         return;
 846
 847                 /* Keep poisoned routes around only long enough to pass
 848                  * the poison on.  Use a new timestamp for good routes.
 849                  */
 850                 if (rts->rts_metric == HOPCNT_INFINITY
 851                     && new->rts_metric == HOPCNT_INFINITY)
 852                         new->rts_time = rts->rts_time;
 853
 854                 /* If this is an update for the router we currently prefer,
 855                  * then note it.
 856                  */
 857                 if (i == NUM_SPARES) {
 858                         rtchange(rt, rt->rt_state, new, 0);
 859                         /* If the route got worse, check for something better.
 860                          */
 861                         if (new->rts_metric > rts->rts_metric)
 862                                 rtswitch(rt, 0);
 863                         return;
 864                 }
 865
 866                 /* This is an update for a spare route.
 867                  * Finished if the route is unchanged.
 868                  */
 869                 if (rts->rts_gate == new->rts_gate
 870                     && rts->rts_metric == new->rts_metric
 871                     && rts->rts_tag == new->rts_tag) {
 872                         trace_upslot(rt, rts, new);
 873                         *rts = *new;
 874                         return;
 875                 }
 876                 /* Forget it if it has gone bad.
 877                  */
 878                 if (new->rts_metric == HOPCNT_INFINITY) {
 879                         rts_delete(rt, rts);
 880                         return;
 881                 }
 882
 883         } else {
 884                 /* The update is for a route we know about,
 885                  * but not from a familiar router.
 886                  *
 887                  * Ignore the route if it points to us.
 888                  */
 889                 if (n->n_nhop != 0
 890                     && 0 != ifwithaddr(n->n_nhop, 1, 0))
 891                         return;
 892
 893                 /* the loop above set rts0=worst spare */
 894                 rts = rts0;
 895
 896                 /* Save the route as a spare only if it has
 897                  * a better metric than our worst spare.
 898                  * This also ignores poisoned routes (those
 899                  * received with metric HOPCNT_INFINITY).
 900                  */
 901                 if (new->rts_metric >= rts->rts_metric)
 902                         return;
 903         }
 904
 905         trace_upslot(rt, rts, new);
 906         *rts = *new;
 907
 908         /* try to switch to a better route */
 909         rtswitch(rt, rts);
 910 }
 911
 912
 913 static int                              /* 0 if bad */
 914 ck_passwd(struct interface *aifp,
 915           struct rip *rip,
 916           void *lim,
 917           naddr from,
 918           struct msg_limit *use_authp)
 919 {
 920 #       define NA (rip->rip_auths)
 921         struct netauth *na2;
 922         struct auth *ap;
 923         MD5_CTX md5_ctx;
 924         u_char hash[RIP_AUTH_PW_LEN];
 925         int i, len;
 926
 927
 928         if ((void *)NA >= lim || NA->a_family != RIP_AF_AUTH) {
 929                 msglim(use_authp, from, "missing password from %s",
 930                        naddr_ntoa(from));
 931                 return 0;
 932         }
 933
 934         /* accept any current (+/- 24 hours) password
 935          */
 936         for (ap = aifp->int_auth, i = 0; i < MAX_AUTH_KEYS; i++, ap++) {
 937                 if (ap->type != NA->a_type
 938                     || (u_long)ap->start > (u_long)clk.tv_sec+DAY
 939                     || (u_long)ap->end+DAY < (u_long)clk.tv_sec)
 940                         continue;
 941
 942                 if (NA->a_type == RIP_AUTH_PW) {
 943                         if (!memcmp(NA->au.au_pw, ap->key, RIP_AUTH_PW_LEN))
 944                                 return 1;
 945
 946                 } else {
 947                         /* accept MD5 secret with the right key ID
 948                          */
 949                         if (NA->au.a_md5.md5_keyid != ap->keyid)
 950                                 continue;
 951
 952                         len = ntohs(NA->au.a_md5.md5_pkt_len);
 953                         if ((len-sizeof(*rip)) % sizeof(*NA) != 0
 954                             || len != (char *)lim-(char*)rip-(int)sizeof(*NA)) {
 955                                 msglim(use_authp, from,
 956                                        "wrong MD5 RIPv2 packet length of %d"
 957                                        " instead of %d from %s",
 958                                        len, (int)((char *)lim-(char *)rip
 959                                                   -sizeof(*NA)),
 960                                        naddr_ntoa(from));
 961                                 return 0;
 962                         }
 963                         na2 = (struct netauth *)((char *)rip+len);
 964
 965                         /* Given a good hash value, these are not security
 966                          * problems so be generous and accept the routes,
 967                          * after complaining.
 968                          */
 969                         if (TRACEPACKETS) {
 970                                 if (NA->au.a_md5.md5_auth_len
 971                                     != RIP_AUTH_MD5_LEN)
 972                                         msglim(use_authp, from,
 973                                                "unknown MD5 RIPv2 auth len %#x"
 974                                                " instead of %#x from %s",
 975                                                NA->au.a_md5.md5_auth_len,
 976                                                RIP_AUTH_MD5_LEN,
 977                                                naddr_ntoa(from));
 978                                 if (na2->a_family != RIP_AF_AUTH)
 979                                         msglim(use_authp, from,
 980                                                "unknown MD5 RIPv2 family %#x"
 981                                                " instead of %#x from %s",
 982                                                na2->a_family, RIP_AF_AUTH,
 983                                                naddr_ntoa(from));
 984                                 if (na2->a_type != ntohs(1))
 985                                         msglim(use_authp, from,
 986                                                "MD5 RIPv2 hash has %#x"
 987                                                " instead of %#x from %s",
 988                                                na2->a_type, ntohs(1),
 989                                                naddr_ntoa(from));
 990                         }
 991
 992                         MD5Init(&md5_ctx);
 993                         MD5Update(&md5_ctx, (u_char *)rip, len);
 994                         MD5Update(&md5_ctx, ap->key, RIP_AUTH_MD5_LEN);
 995                         MD5Final(hash, &md5_ctx);
 996                         if (!memcmp(hash, na2->au.au_pw, sizeof(hash)))
 997                                 return 1;
 998                 }
 999         }
1000
1001         msglim(use_authp, from, "bad password from %s",
1002                naddr_ntoa(from));
1003         return 0;
1004 #undef NA
1005 }