1 /* $NetBSD: rrenum.c,v 1.18 2015/06/05 15:41:59 roy Exp $ */ 2 /* $KAME: rrenum.c,v 1.14 2004/06/14 05:36:00 itojun Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 #include <sys/types.h> 33 #include <sys/param.h> 34 #include <sys/ioctl.h> 35 #include <sys/socket.h> 36 #include <sys/sysctl.h> 37 38 #include <net/if.h> 39 #ifdef __FreeBSD__ 40 #include <net/if_var.h> 41 #endif 42 #include <net/route.h> 43 #include <netinet/in.h> 44 #include <netinet/in_var.h> 45 #include <netinet/icmp6.h> 46 47 #include <arpa/inet.h> 48 49 #include <errno.h> 50 #include <string.h> 51 #include <stdlib.h> 52 #include <syslog.h> 53 #include "rtadvd.h" 54 #include "rrenum.h" 55 #include "if.h" 56 57 #define RR_ISSET_SEGNUM(segnum_bits, segnum) \ 58 ((((segnum_bits)[(segnum) >> 5]) & (1 << ((segnum) & 31))) != 0) 59 #define RR_SET_SEGNUM(segnum_bits, segnum) \ 60 (((segnum_bits)[(segnum) >> 5]) |= (1 << ((segnum) & 31))) 61 62 struct rr_operation { 63 u_long rro_seqnum; 64 u_long rro_segnum_bits[8]; 65 }; 66 67 static struct rr_operation rro; 68 static int rr_rcvifindex; 69 static int rrcmd2pco[RPM_PCO_MAX] = { 70 0, 71 SIOCAIFPREFIX_IN6, 72 SIOCCIFPREFIX_IN6, 73 SIOCSGIFPREFIX_IN6 74 }; 75 static int s = -1; 76 77 /* 78 * Check validity of a Prefix Control Operation(PCO). 79 * Return 0 on success, 1 on failure. 80 */ 81 static int 82 rr_pco_check(int len, struct rr_pco_match *rpm) 83 { 84 struct rr_pco_use *rpu, *rpulim; 85 int checklen; 86 87 /* rpm->rpm_len must be (4N * 3) as router-renum-05.txt */ 88 if ((rpm->rpm_len - 3) < 0 || /* must be at least 3 */ 89 (rpm->rpm_len - 3) & 0x3) { /* must be multiple of 4 */ 90 syslog(LOG_WARNING, "<%s> rpm_len %d is not 4N * 3", 91 __func__, rpm->rpm_len); 92 return 1; 93 } 94 /* rpm->rpm_code must be valid value */ 95 switch (rpm->rpm_code) { 96 case RPM_PCO_ADD: 97 case RPM_PCO_CHANGE: 98 case RPM_PCO_SETGLOBAL: 99 break; 100 default: 101 syslog(LOG_WARNING, "<%s> unknown rpm_code %d", __func__, 102 rpm->rpm_code); 103 return 1; 104 } 105 /* rpm->rpm_matchlen must be 0 to 128 inclusive */ 106 if (rpm->rpm_matchlen > 128) { 107 syslog(LOG_WARNING, "<%s> rpm_matchlen %d is over 128", 108 __func__, rpm->rpm_matchlen); 109 return 1; 110 } 111 112 /* 113 * rpu->rpu_uselen, rpu->rpu_keeplen, and sum of them must be 114 * between 0 and 128 inclusive 115 */ 116 for (rpu = (struct rr_pco_use *)(rpm + 1), 117 rpulim = (struct rr_pco_use *)((char *)rpm + len); 118 rpu < rpulim; 119 rpu += 1) { 120 checklen = rpu->rpu_uselen; 121 checklen += rpu->rpu_keeplen; 122 /* 123 * omit these check, because either of rpu_uselen 124 * and rpu_keeplen is unsigned char 125 * (128 > rpu_uselen > 0) 126 * (128 > rpu_keeplen > 0) 127 * (rpu_uselen + rpu_keeplen > 0) 128 */ 129 if (checklen > 128) { 130 syslog(LOG_WARNING, "<%s> sum of rpu_uselen %d and" 131 " rpu_keeplen %d is %d(over 128)", 132 __func__, rpu->rpu_uselen, 133 rpu->rpu_keeplen, 134 rpu->rpu_uselen + rpu->rpu_keeplen); 135 return 1; 136 } 137 } 138 return 0; 139 } 140 141 static void 142 do_use_prefix(int len, struct rr_pco_match *rpm, 143 struct in6_rrenumreq *irr, int ifindex) 144 { 145 struct rr_pco_use *rpu, *rpulim; 146 struct rainfo *rai; 147 struct prefix *pp; 148 149 rpu = (struct rr_pco_use *)(rpm + 1); 150 rpulim = (struct rr_pco_use *)((char *)rpm + len); 151 152 if (rpu == rpulim) { /* no use prefix */ 153 if (rpm->rpm_code == RPM_PCO_ADD) 154 return; 155 156 irr->irr_u_uselen = 0; 157 irr->irr_u_keeplen = 0; 158 irr->irr_raf_mask_onlink = 0; 159 irr->irr_raf_mask_auto = 0; 160 irr->irr_vltime = 0; 161 irr->irr_pltime = 0; 162 memset(&irr->irr_flags, 0, sizeof(irr->irr_flags)); 163 irr->irr_useprefix.sin6_len = 0; /* let it mean, no addition */ 164 irr->irr_useprefix.sin6_family = 0; 165 irr->irr_useprefix.sin6_addr = in6addr_any; 166 if (ioctl(s, rrcmd2pco[rpm->rpm_code], irr) < 0 && 167 errno != EADDRNOTAVAIL) 168 syslog(LOG_ERR, "<%s> ioctl: %m", __func__); 169 return; 170 } 171 172 for (rpu = (struct rr_pco_use *)(rpm + 1), 173 rpulim = (struct rr_pco_use *)((char *)rpm + len); 174 rpu < rpulim; 175 rpu += 1) { 176 /* init in6_rrenumreq fields */ 177 irr->irr_u_uselen = rpu->rpu_uselen; 178 irr->irr_u_keeplen = rpu->rpu_keeplen; 179 irr->irr_raf_mask_onlink = 180 !!(rpu->rpu_ramask & ICMP6_RR_PCOUSE_RAFLAGS_ONLINK); 181 irr->irr_raf_mask_auto = 182 !!(rpu->rpu_ramask & ICMP6_RR_PCOUSE_RAFLAGS_AUTO); 183 irr->irr_vltime = ntohl(rpu->rpu_vltime); 184 irr->irr_pltime = ntohl(rpu->rpu_pltime); 185 irr->irr_raf_onlink = 186 (rpu->rpu_raflags & ICMP6_RR_PCOUSE_RAFLAGS_ONLINK) == 0 ? 0 : 1; 187 irr->irr_raf_auto = 188 (rpu->rpu_raflags & ICMP6_RR_PCOUSE_RAFLAGS_AUTO) == 0 ? 0 : 1; 189 irr->irr_rrf_decrvalid = 190 (rpu->rpu_flags & ICMP6_RR_PCOUSE_FLAGS_DECRVLTIME) == 0 ? 0 : 1; 191 irr->irr_rrf_decrprefd = 192 (rpu->rpu_flags & ICMP6_RR_PCOUSE_FLAGS_DECRPLTIME) == 0 ? 0 : 1; 193 irr->irr_useprefix.sin6_len = sizeof(irr->irr_useprefix); 194 irr->irr_useprefix.sin6_family = AF_INET6; 195 irr->irr_useprefix.sin6_addr = rpu->rpu_prefix; 196 197 if (ioctl(s, rrcmd2pco[rpm->rpm_code], irr) < 0 && 198 errno != EADDRNOTAVAIL) 199 syslog(LOG_ERR, "<%s> ioctl: %m", __func__); 200 201 /* very adhoc: should be rewritten */ 202 if (rpm->rpm_code == RPM_PCO_CHANGE && 203 IN6_ARE_ADDR_EQUAL(&rpm->rpm_prefix, &rpu->rpu_prefix) && 204 rpm->rpm_matchlen == rpu->rpu_uselen && 205 rpu->rpu_uselen == rpu->rpu_keeplen) { 206 if ((rai = if_indextorainfo(ifindex)) == NULL) 207 continue; /* non-advertising IF */ 208 209 TAILQ_FOREACH(pp, &rai->prefix, next) { 210 struct timespec now; 211 212 if (prefix_match(&pp->prefix, pp->prefixlen, 213 &rpm->rpm_prefix, 214 rpm->rpm_matchlen)) { 215 /* change parameters */ 216 pp->validlifetime = ntohl(rpu->rpu_vltime); 217 pp->preflifetime = ntohl(rpu->rpu_pltime); 218 if (irr->irr_rrf_decrvalid) { 219 clock_gettime(CLOCK_MONOTONIC, 220 &now); 221 pp->vltimeexpire = 222 now.tv_sec + pp->validlifetime; 223 } else 224 pp->vltimeexpire = 0; 225 if (irr->irr_rrf_decrprefd) { 226 clock_gettime(CLOCK_MONOTONIC, 227 &now); 228 pp->pltimeexpire = 229 now.tv_sec + pp->preflifetime; 230 } else 231 pp->pltimeexpire = 0; 232 } 233 } 234 } 235 } 236 } 237 238 /* 239 * process a Prefix Control Operation(PCO). 240 * return 0 on success, 1 on failure 241 */ 242 static int 243 do_pco(struct icmp6_router_renum *rr, int len, struct rr_pco_match *rpm) 244 { 245 int ifindex = 0; 246 struct in6_rrenumreq irr; 247 struct rainfo *rai; 248 249 if ((rr_pco_check(len, rpm) != 0)) 250 return 1; 251 252 if (s == -1 && (s = socket(AF_INET6, SOCK_DGRAM, 0)) < 0) { 253 syslog(LOG_ERR, "<%s> socket: %m", __func__); 254 exit(1); 255 } 256 257 memset(&irr, 0, sizeof(irr)); 258 irr.irr_origin = PR_ORIG_RR; 259 irr.irr_m_len = rpm->rpm_matchlen; 260 irr.irr_m_minlen = rpm->rpm_minlen; 261 irr.irr_m_maxlen = rpm->rpm_maxlen; 262 irr.irr_matchprefix.sin6_len = sizeof(irr.irr_matchprefix); 263 irr.irr_matchprefix.sin6_family = AF_INET6; 264 irr.irr_matchprefix.sin6_addr = rpm->rpm_prefix; 265 266 /* 267 * if ICMP6_RR_FLAGS_FORCEAPPLY(A flag) is 0 and IFF_UP is off, 268 * the interface is not applied 269 */ 270 271 if (rr->rr_flags & ICMP6_RR_FLAGS_FORCEAPPLY) { 272 while (if_indextoname(++ifindex, irr.irr_name)) { 273 rai = if_indextorainfo(ifindex); 274 if (rai && (rai->ifflags & IFF_UP)) { 275 /* TODO: interface scope check */ 276 do_use_prefix(len, rpm, &irr, ifindex); 277 } 278 } 279 } 280 if (errno == ENXIO) 281 return 0; 282 else if (errno) { 283 syslog(LOG_ERR, "<%s> if_indextoname: %m", __func__); 284 return 1; 285 } 286 return 0; 287 } 288 289 /* 290 * call do_pco() for each Prefix Control Operations(PCOs) in a received 291 * Router Renumbering Command packet. 292 * return 0 on success, 1 on failure 293 */ 294 static int 295 do_rr(size_t len, struct icmp6_router_renum *rr) 296 { 297 struct rr_pco_match *rpm; 298 char *cp, *lim; 299 300 lim = (char *)rr + len; 301 cp = (char *)(rr + 1); 302 len -= sizeof(struct icmp6_router_renum); 303 304 while (cp < lim) { 305 size_t rpmlen; 306 307 rpm = (struct rr_pco_match *)cp; 308 if (len < sizeof(struct rr_pco_match)) { 309 tooshort: 310 syslog(LOG_ERR, "<%s> pkt too short. left len = %zd. " 311 "garbage at end of pkt?", __func__, len); 312 return 1; 313 } 314 rpmlen = rpm->rpm_len << 3; 315 if (len < rpmlen) 316 goto tooshort; 317 318 if (do_pco(rr, rpmlen, rpm)) { 319 syslog(LOG_WARNING, "<%s> invalid PCO", __func__); 320 goto next; 321 } 322 323 next: 324 cp += rpmlen; 325 len -= rpmlen; 326 } 327 328 return 0; 329 } 330 331 /* 332 * check validity of a router renumbering command packet 333 * return 0 on success, 1 on failure 334 */ 335 static int 336 rr_command_check(size_t len, struct icmp6_router_renum *rr, 337 struct in6_addr *from, struct in6_addr *dst) 338 { 339 char ntopbuf[INET6_ADDRSTRLEN]; 340 341 /* omit rr minimal length check. hope kernel have done it. */ 342 /* rr_command length check */ 343 if (len < (sizeof(struct icmp6_router_renum) + 344 sizeof(struct rr_pco_match))) { 345 syslog(LOG_ERR, "<%s> rr_command len %zd is too short", 346 __func__, len); 347 return 1; 348 } 349 350 /* destination check. only for multicast. omit unicast check. */ 351 if (IN6_IS_ADDR_MULTICAST(dst) && !IN6_IS_ADDR_MC_LINKLOCAL(dst) && 352 !IN6_IS_ADDR_MC_SITELOCAL(dst)) { 353 syslog(LOG_ERR, "<%s> dst mcast addr %s is illegal", 354 __func__, 355 inet_ntop(AF_INET6, dst, ntopbuf, INET6_ADDRSTRLEN)); 356 return 1; 357 } 358 359 /* seqnum and segnum check */ 360 if (rro.rro_seqnum > rr->rr_seqnum) { 361 syslog(LOG_WARNING, 362 "<%s> rcvd old seqnum %d from %s", 363 __func__, (uint32_t)ntohl(rr->rr_seqnum), 364 inet_ntop(AF_INET6, from, ntopbuf, INET6_ADDRSTRLEN)); 365 return 1; 366 } 367 if (rro.rro_seqnum == rr->rr_seqnum && 368 (rr->rr_flags & ICMP6_RR_FLAGS_TEST) == 0 && 369 RR_ISSET_SEGNUM(rro.rro_segnum_bits, rr->rr_segnum)) { 370 if ((rr->rr_flags & ICMP6_RR_FLAGS_REQRESULT) != 0) 371 syslog(LOG_WARNING, 372 "<%s> rcvd duped segnum %d from %s", 373 __func__, rr->rr_segnum, 374 inet_ntop(AF_INET6, from, ntopbuf, 375 INET6_ADDRSTRLEN)); 376 return 0; 377 } 378 379 /* update seqnum */ 380 if (rro.rro_seqnum != rr->rr_seqnum) { 381 /* then must be "<" */ 382 383 /* init rro_segnum_bits */ 384 memset(rro.rro_segnum_bits, 0, 385 sizeof(rro.rro_segnum_bits)); 386 } 387 rro.rro_seqnum = rr->rr_seqnum; 388 389 return 0; 390 } 391 392 static void 393 rr_command_input(int len, struct icmp6_router_renum *rr, 394 struct in6_addr *from, struct in6_addr *dst) 395 { 396 /* rr_command validity check */ 397 if (rr_command_check(len, rr, from, dst)) 398 goto failed; 399 if ((rr->rr_flags & (ICMP6_RR_FLAGS_TEST|ICMP6_RR_FLAGS_REQRESULT)) == 400 ICMP6_RR_FLAGS_TEST) 401 return; 402 403 /* do router renumbering */ 404 if (do_rr(len, rr)) { 405 goto failed; 406 } 407 408 /* update segnum */ 409 RR_SET_SEGNUM(rro.rro_segnum_bits, rr->rr_segnum); 410 411 return; 412 413 failed: 414 syslog(LOG_ERR, "<%s> received RR was invalid", __func__); 415 return; 416 } 417 418 void 419 rr_input(size_t len, struct icmp6_router_renum *rr, struct in6_pktinfo *pi, 420 struct sockaddr_in6 *from, struct in6_addr *dst) 421 { 422 char ntopbuf[2][INET6_ADDRSTRLEN], ifnamebuf[IFNAMSIZ]; 423 424 syslog(LOG_DEBUG, 425 "<%s> RR received from %s to %s on %s", 426 __func__, 427 inet_ntop(AF_INET6, &from->sin6_addr, 428 ntopbuf[0], INET6_ADDRSTRLEN), 429 inet_ntop(AF_INET6, &dst, ntopbuf[1], INET6_ADDRSTRLEN), 430 if_indextoname(pi->ipi6_ifindex, ifnamebuf)); 431 432 /* packet validation based on Section 4.1 of RFC2894 */ 433 if (len < sizeof(struct icmp6_router_renum)) { 434 syslog(LOG_NOTICE, 435 "<%s>: RR short message (size %zd) from %s to %s on %s", 436 __func__, len, 437 inet_ntop(AF_INET6, &from->sin6_addr, 438 ntopbuf[0], INET6_ADDRSTRLEN), 439 inet_ntop(AF_INET6, &dst, ntopbuf[1], INET6_ADDRSTRLEN), 440 if_indextoname(pi->ipi6_ifindex, ifnamebuf)); 441 return; 442 } 443 444 /* 445 * If the IPv6 destination address is neither an All Routers multicast 446 * address [AARCH] nor one of the receiving router's unicast addresses, 447 * the message MUST be discarded and SHOULD be logged to network 448 * management. 449 * We rely on the kernel input routine for unicast addresses, and thus 450 * check multicast destinations only. 451 */ 452 if (IN6_IS_ADDR_MULTICAST(&pi->ipi6_addr) && 453 !IN6_ARE_ADDR_EQUAL(&sin6_sitelocal_allrouters.sin6_addr, 454 &pi->ipi6_addr)) 455 { 456 syslog(LOG_NOTICE, 457 "<%s>: RR message with invalid destination (%s) " 458 "from %s on %s", 459 __func__, 460 inet_ntop(AF_INET6, &dst, ntopbuf[0], INET6_ADDRSTRLEN), 461 inet_ntop(AF_INET6, &from->sin6_addr, 462 ntopbuf[1], INET6_ADDRSTRLEN), 463 if_indextoname(pi->ipi6_ifindex, ifnamebuf)); 464 return; 465 } 466 467 rr_rcvifindex = pi->ipi6_ifindex; 468 469 switch (rr->rr_code) { 470 case ICMP6_ROUTER_RENUMBERING_COMMAND: 471 rr_command_input(len, rr, &from->sin6_addr, dst); 472 /* TODO: send reply msg */ 473 break; 474 case ICMP6_ROUTER_RENUMBERING_RESULT: 475 /* RESULT will be processed by rrenumd */ 476 break; 477 case ICMP6_ROUTER_RENUMBERING_SEQNUM_RESET: 478 /* TODO: sequence number reset */ 479 break; 480 default: 481 syslog(LOG_ERR, "<%s> received unknown code %d", 482 __func__, rr->rr_code); 483 break; 484 485 } 486 487 return; 488 } 489