proto/rip/packets.c

/*
 *	BIRD -- Routing Information Protocol (RIP)
 *
 *	(c) 1998--1999 Pavel Machek <pavel@ucw.cz>
 *	(c) 2004--2013 Ondrej Filip <feela@network.cz>
 *	(c) 2009--2015 Ondrej Zajicek <santiago@crfreenet.org>
 *	(c) 2009--2015 CZ.NIC z.s.p.o.
 *
 *	Can be freely distributed and used under the terms of the GNU GPL.
 */

#undef LOCAL_DEBUG

#include "rip.h"
#include "lib/mac.h"


#define RIP_CMD_REQUEST		1	/* want info */
#define RIP_CMD_RESPONSE	2	/* responding to request */

#define RIP_CMD_UPDATE_REQUEST	9
#define RIP_CMD_UPDATE_RESPONSE	10
#define RIP_CMD_UPDATE_ACK	11

#define RIP_BLOCK_LENGTH	20
#define RIP_PASSWD_LENGTH	16

#define RIP_AF_IPV4		2
#define RIP_AF_AUTH		0xffff

#define RIP_UPDATE_VERSION	1


/* RIP packet header */
struct rip_packet
{
  u8 command;
  u8 version;
  u16 unused;
};

/* Triggered RIP update header (RFC 2091) */
struct rip_update_hdr
{
  u8 version;
  u8 flush;
  u16 seqnum;
};

/* RTE block for RIPv2 */
struct rip_block_v2
{
  u16 family;
  u16 tag;
  ip4_addr network;
  ip4_addr netmask;
  ip4_addr next_hop;
  u32 metric;
};

/* RTE block for RIPng */
struct rip_block_ng
{
  ip6_addr prefix;
  u16 tag;
  u8 pxlen;
  u8 metric;
};

/* Authentication block for RIPv2 */
struct rip_block_auth
{
  u16 must_be_ffff;
  u16 auth_type;
  union {
    char password[16];
    struct {
      u16 packet_len;
      u8 key_id;
      u8 auth_len;
      u32 seq_num;
      u32 unused1;
      u32 unused2;
    };
  };
};

/* Authentication tail, RFC 4822 */
struct rip_auth_tail
{
  u16 must_be_ffff;
  u16 must_be_0001;
  byte auth_data[0];
};

/* Internal representation of RTE block data */
struct rip_block
{
  net_addr net;
  u32 metric;
  u16 tag;
  u16 no_af;
  ip_addr next_hop;
};

static int
rip_send_ack(struct rip_proto *p, struct rip_iface *ifa, uint flush, uint seqnum);

#define DROP(DSC,VAL) do { err_dsc = DSC; err_val = VAL; goto drop; } while(0)
#define DROP1(DSC) do { err_dsc = DSC; goto drop; } while(0)
#define SKIP(DSC) do { err_dsc = DSC; goto skip; } while(0)

#define LOG_PKT(msg, args...) \
  log_rl(&p->log_pkt_tbf, L_REMOTE "%s: " msg, p->p.name, args)

#define LOG_PKT_AUTH(msg, args...) \
  log_rl(&p->log_pkt_tbf, L_AUTH "%s: " msg, p->p.name, args)

#define LOG_RTE(msg, args...) \
  log_rl(&p->log_rte_tbf, L_REMOTE "%s: " msg, p->p.name, args)


static inline void * rip_tx_buffer(struct rip_iface *ifa)
{ return ifa->sk->tbuf; }

static inline uint
rip_pkt_hdrlen(struct rip_iface *ifa)
{
  return sizeof(struct rip_packet) +
    (ifa->cf->demand_circuit ? sizeof(struct rip_update_hdr) : 0) +
    (ifa->cf->auth_type ? RIP_BLOCK_LENGTH : 0);
}

static inline struct rip_update_hdr *
rip_get_update_hdr(struct rip_packet *pkt)
{
  return (void *) ((byte *) pkt + sizeof(struct rip_packet));
}

static inline struct rip_block_auth *
rip_get_auth_block(struct rip_iface *ifa, struct rip_packet *pkt)
{
  return (void *) ((byte *) pkt + sizeof(struct rip_packet) +
		   (ifa->cf->demand_circuit ? sizeof(struct rip_update_hdr) : 0));
}


static inline void
rip_put_block(struct rip_proto *p, byte *pos, struct rip_block *rte)
{
  if (rip_is_v2(p))
  {
    struct rip_block_v2 *block = (void *) pos;
    block->family = rte->no_af ? 0 : htons(RIP_AF_IPV4);
    block->tag = htons(rte->tag);
    block->network = ip4_hton(net4_prefix(&rte->net));
    block->netmask = ip4_hton(ip4_mkmask(net4_pxlen(&rte->net)));
    block->next_hop = ip4_hton(ipa_to_ip4(rte->next_hop));
    block->metric = htonl(rte->metric);
  }
  else /* RIPng */
  {
    struct rip_block_ng *block = (void *) pos;
    block->prefix = ip6_hton(net6_prefix(&rte->net));
    block->tag = htons(rte->tag);
    block->pxlen = net6_pxlen(&rte->net);
    block->metric = rte->metric;
  }
}

static inline void
rip_put_next_hop(struct rip_proto *p UNUSED, byte *pos, struct rip_block *rte)
{
  struct rip_block_ng *block = (void *) pos;
  block->prefix = ip6_hton(ipa_to_ip6(rte->next_hop));
  block->tag = 0;
  block->pxlen = 0;
  block->metric = 0xff;
}

static inline int
rip_get_block(struct rip_proto *p, byte *pos, struct rip_block *rte)
{
  if (rip_is_v2(p))
  {
    struct rip_block_v2 *block = (void *) pos;

    /* Skip blocks with strange AF, including authentication blocks */
    if (block->family != (rte->no_af ? 0 : htons(RIP_AF_IPV4)))
      return 0;

    uint pxlen = ip4_masklen(ip4_ntoh(block->netmask));
    net_fill_ip4(&rte->net, ip4_ntoh(block->network), pxlen);
    rte->metric = ntohl(block->metric);
    rte->tag = ntohs(block->tag);
    rte->next_hop = ipa_from_ip4(ip4_ntoh(block->next_hop));

    return 1;
  }
  else /* RIPng */
  {
    struct rip_block_ng *block = (void *) pos;

    /* Handle and skip next hop blocks */
    if (block->metric == 0xff)
    {
      rte->next_hop = ipa_from_ip6(ip6_ntoh(block->prefix));
      if (!ipa_is_link_local(rte->next_hop)) rte->next_hop = IPA_NONE;
      return 0;
    }

    uint pxlen = (block->pxlen <= IP6_MAX_PREFIX_LENGTH) ? block->pxlen : 255;
    net_fill_ip6(&rte->net, ip6_ntoh(block->prefix), pxlen);
    rte->metric = block->metric;
    rte->tag = ntohs(block->tag);
    /* rte->next_hop is deliberately kept unmodified */;

    return 1;
  }
}

static inline void
rip_update_csn(struct rip_proto *p UNUSED, struct rip_iface *ifa)
{
  /*
   * We update crypto sequence numbers at the beginning of update session to
   * avoid issues with packet reordering, so packets inside one update session
   * have the same CSN. We are using real time, but enforcing monotonicity.
   */
  if (ifa->cf->auth_type == RIP_AUTH_CRYPTO)
  {
    u32 now_real = (u32) (current_real_time() TO_S);
    ifa->csn = (ifa->csn < now_real) ? now_real : ifa->csn + 1;
  }
}

static inline void
rip_fill_header(struct rip_iface *ifa, struct rip_packet *pkt, uint cmd)
{
  *pkt = (struct rip_packet) {
    .command = cmd,
    .version = ifa->cf->version
  };
}

static inline void
rip_fill_update_hdr(struct rip_packet *pkt, uint flush, uint seqnum)
{
  struct rip_update_hdr *hdr = rip_get_update_hdr(pkt);

  *hdr = (struct rip_update_hdr) {
    .version = RIP_UPDATE_VERSION,
    .flush = flush,
    .seqnum = htons(seqnum)
  };
}

static void
rip_fill_authentication(struct rip_proto *p, struct rip_iface *ifa, struct rip_packet *pkt, uint *plen)
{
  struct rip_block_auth *auth = rip_get_auth_block(ifa, pkt);
  struct password_item *pass = password_find(ifa->cf->passwords, 0);

  if (!pass)
  {
    /* FIXME: This should not happen */
    log(L_ERR "%s: No suitable password found for authentication", p->p.name);
    memset(auth, 0, sizeof(struct rip_block_auth));
    return;
  }

  switch (ifa->cf->auth_type)
  {
  case RIP_AUTH_PLAIN:
    auth->must_be_ffff = htons(0xffff);
    auth->auth_type = htons(RIP_AUTH_PLAIN);
    strncpy(auth->password, pass->password, RIP_PASSWD_LENGTH);
    return;

  case RIP_AUTH_CRYPTO:
    auth->must_be_ffff = htons(0xffff);
    auth->auth_type = htons(RIP_AUTH_CRYPTO);
    auth->packet_len = htons(*plen);
    auth->key_id = pass->id;
    auth->auth_len = mac_type_length(pass->alg);
    auth->seq_num = ifa->csn_ready ? htonl(ifa->csn) : 0;
    auth->unused1 = 0;
    auth->unused2 = 0;
    ifa->csn_ready = 1;

    if (pass->alg < ALG_HMAC)
      auth->auth_len += sizeof(struct rip_auth_tail);

    /*
     * Note that RFC 4822 is unclear whether auth_len should cover whole
     * authentication trailer or just auth_data length.
     *
     * FIXME: We should use just auth_data length by default. Currently we put
     * the whole auth trailer length in keyed hash case to keep old behavior,
     * but we put just auth_data length in the new HMAC case. Note that Quagga
     * has config option for this.
     *
     * Crypto sequence numbers are increased by sender in rip_update_csn().
     * First CSN should be zero, this is handled by csn_ready.
     */

    struct rip_auth_tail *tail = (void *) ((byte *) pkt + *plen);
    tail->must_be_ffff = htons(0xffff);
    tail->must_be_0001 = htons(0x0001);

    uint auth_len = mac_type_length(pass->alg);
    *plen += sizeof(struct rip_auth_tail) + auth_len;

    /* Append key for keyed hash, append padding for HMAC (RFC 4822 2.5) */
    if (pass->alg < ALG_HMAC)
      strncpy(tail->auth_data, pass->password, auth_len);
    else
      memset32(tail->auth_data, HMAC_MAGIC, auth_len / 4);

    mac_fill(pass->alg, pass->password, pass->length,
	     (byte *) pkt, *plen, tail->auth_data);
    return;

  default:
    bug("Unknown authentication type");
  }
}

static int
rip_check_authentication(struct rip_proto *p, struct rip_iface *ifa, struct rip_packet *pkt, uint *plen, uint hdr_len, struct rip_neighbor *n)
{
  struct rip_block_auth *auth = (void *) ((byte *) pkt + hdr_len);
  struct password_item *pass = NULL;
  const char *err_dsc = NULL;
  uint err_val = 0;
  uint auth_type = 0;

  /* Check for authentication entry */
  if ((*plen >= (hdr_len + sizeof(struct rip_block_auth))) &&
      (auth->must_be_ffff == htons(0xffff)))
    auth_type = ntohs(auth->auth_type);

  if (auth_type != ifa->cf->auth_type)
    DROP("authentication method mismatch", auth_type);

  switch (auth_type)
  {
  case RIP_AUTH_NONE:
    return 1;

  case RIP_AUTH_PLAIN:
    pass = password_find_by_value(ifa->cf->passwords, auth->password, RIP_PASSWD_LENGTH);
    if (!pass)
      DROP1("wrong password");

    return 1;

  case RIP_AUTH_CRYPTO:
    pass = password_find_by_id(ifa->cf->passwords, auth->key_id);
    if (!pass)
      DROP("no suitable password found", auth->key_id);

    uint data_len = ntohs(auth->packet_len);
    uint auth_len = mac_type_length(pass->alg);
    uint auth_len2 = sizeof(struct rip_auth_tail) + auth_len;

    /*
     * Ideally, first check should be check for internal consistency:
     *   (data_len + sizeof(struct rip_auth_tail) + auth->auth_len) != *plen
     *
     * Second one should check expected code length:
     *   auth->auth_len != auth_len
     *
     * But as auth->auth_len has two interpretations, we simplify this
     */

    if (data_len + auth_len2 != *plen)
      DROP("packet length mismatch", *plen);

    /* Warning: two interpretations of auth_len field */
    if ((auth->auth_len != auth_len) && (auth->auth_len != auth_len2))
      DROP("wrong authentication length", auth->auth_len);

    struct rip_auth_tail *tail = (void *) ((byte *) pkt + data_len);
    if ((tail->must_be_ffff != htons(0xffff)) || (tail->must_be_0001 != htons(0x0001)))
      DROP1("authentication trailer is missing");

    /* Accept higher sequence number, or zero if connectivity is lost */
    /* FIXME: sequence number must be password/SA specific */
    u32 rcv_csn = ntohl(auth->seq_num);
    if ((rcv_csn < n->csn) && (rcv_csn || n->uc))
    {
      /* We want to report both new and old CSN */
      LOG_PKT_AUTH("Authentication failed for %I on %s - "
		   "lower sequence number (rcv %u, old %u)",
		   n->nbr->addr, ifa->iface->name, rcv_csn, n->csn);
      return 0;
    }

    byte *auth_data = alloca(auth_len);
    memcpy(auth_data, tail->auth_data, auth_len);

    /* Append key for keyed hash, append padding for HMAC (RFC 4822 2.5) */
    if (pass->alg < ALG_HMAC)
      strncpy(tail->auth_data, pass->password, auth_len);
    else
      memset32(tail->auth_data, HMAC_MAGIC, auth_len / 4);

    if (!mac_verify(pass->alg, pass->password, pass->length,
		    (byte *) pkt, *plen, auth_data))
      DROP("wrong authentication code", pass->id);

    *plen = data_len;
    n->csn = rcv_csn;

    return 1;
  }

drop:
  LOG_PKT_AUTH("Authentication failed for %I on %s - %s (%u)",
	       n->nbr->addr, ifa->iface->name, err_dsc, err_val);

  return 0;
}

static inline int
rip_send_to(struct rip_proto *p, struct rip_iface *ifa, struct rip_packet *pkt, uint plen, ip_addr dst)
{
  if (ifa->cf->auth_type)
    rip_fill_authentication(p, ifa, pkt, &plen);

  return sk_send_to(ifa->sk, plen, dst, 0);
}

static inline void
rip_kick_rxmt_timer(struct rip_iface *ifa)
{
  if (! tm_active(ifa->rxmt_timer))
    tm_start(ifa->rxmt_timer, ifa->cf->rxmt_time);
}


void
rip_send_request(struct rip_proto *p, struct rip_iface *ifa)
{
  struct rip_packet *pkt = rip_tx_buffer(ifa);
  byte *pos = (byte *) pkt + rip_pkt_hdrlen(ifa);

  rip_fill_header(ifa, pkt, RIP_CMD_REQUEST);

  if (ifa->cf->demand_circuit)
  {
    pkt->command = RIP_CMD_UPDATE_REQUEST;
    rip_fill_update_hdr(pkt, 0, 0);

    /* Must be acknowledged by update response */
    ifa->req_pending = 1;
    rip_kick_rxmt_timer(ifa);
  }

  struct rip_block b = { .no_af = 1, .metric = p->infinity };
  rip_put_block(p, pos, &b);
  pos += RIP_BLOCK_LENGTH;

  rip_update_csn(p, ifa);

  TRACE(D_PACKETS, "Sending request via %s", ifa->iface->name);
  rip_send_to(p, ifa, pkt, pos - (byte *) pkt, ifa->addr);
}

static void
rip_receive_request(struct rip_proto *p, struct rip_iface *ifa, struct rip_packet *pkt, uint plen, struct rip_neighbor *from)
{
  TRACE(D_PACKETS, "Request received from %I on %s", from->nbr->addr, ifa->iface->name);

  byte *pos = (byte *) pkt + rip_pkt_hdrlen(ifa);

  /* We expect one regular block */
  if (plen != (rip_pkt_hdrlen(ifa) + RIP_BLOCK_LENGTH))
    return;

  struct rip_block b = { .no_af = 1 };

  if (!rip_get_block(p, pos, &b))
    return;

  /* Special case - infinity metric, for RIPng also zero prefix */
  if ((b.metric != p->infinity) ||
      (rip_is_ng(p) && !net_zero_ip6((net_addr_ip6 *) &b.net)))
    return;

  /* We do nothing if TX is already active */
  if (ifa->tx_active)
  {
    TRACE(D_EVENTS, "Skipping request from %I on %s, TX is busy", from->nbr->addr, ifa->iface->name);
    return;
  }

  if (!ifa->cf->passive)
    rip_send_table(p, ifa, from->nbr->addr, 0);
}


static int
rip_send_response(struct rip_proto *p, struct rip_iface *ifa)
{
  if (! ifa->tx_active)
    return 0;

  /* In demand circuit mode, we may wait for ACK */
  if (ifa->tx_pending)
    return 0;

  struct rip_packet *pkt = rip_tx_buffer(ifa);
  byte *pos = (byte *) pkt + rip_pkt_hdrlen(ifa);
  byte *max = (byte *) pkt + ifa->tx_plen -
    (rip_is_v2(p) ? RIP_BLOCK_LENGTH : 2*RIP_BLOCK_LENGTH);
  ip_addr last_next_hop = IPA_NONE;
  btime now_ = current_time();
  int send = 0;

  rip_fill_header(ifa, pkt, RIP_CMD_RESPONSE);

  if (ifa->cf->demand_circuit)
  {
    pkt->command = RIP_CMD_UPDATE_RESPONSE;
    rip_fill_update_hdr(pkt, ifa->tx_flush, ifa->tx_seqnum);
  }

  FIB_ITERATE_START(&p->rtable, &ifa->tx_fit, struct rip_entry, en)
  {
    /* Dummy entries */
    if (!en->valid)
      goto next_entry;

    /* Stale entries that should be removed */
    if ((en->valid == RIP_ENTRY_STALE) &&
	((en->changed + ifa->cf->garbage_time) <= now_))
      goto next_entry;

    /* Triggered updates */
    if (en->changed < ifa->tx_changed)
      goto next_entry;

    /* Not enough space for current entry */
    if (pos > max)
    {
      FIB_ITERATE_PUT(&ifa->tx_fit);
      goto send_pkt;
    }

    struct rip_block rte = {
      .metric = en->metric,
      .tag = en->tag
    };

    net_copy(&rte.net, en->n.addr);

    if (en->iface == ifa->iface)
      rte.next_hop = en->next_hop;

    if (rip_is_v2(p) && (ifa->cf->version == RIP_V1))
    {
      /* Skipping subnets (i.e. not hosts, classful networks or default route) */
      if (ip4_masklen(ip4_class_mask(net4_prefix(&rte.net))) != rte.net.pxlen)
	goto next_entry;

      rte.tag = 0;
      rte.net.pxlen = 0;
      rte.next_hop = IPA_NONE;
    }

    /* Split horizon */
    if (en->from == ifa->iface && ifa->cf->split_horizon)
    {
      if (ifa->cf->poison_reverse)
      {
	rte.metric = p->infinity;
	rte.next_hop = IPA_NONE;
      }
      else
	goto next_entry;
    }

    // TRACE(D_PACKETS, "    %N -> %I metric %d", &rte.net, rte.next_hop, rte.metric);

    /* RIPng next hop entry */
    if (rip_is_ng(p) && !ipa_equal(rte.next_hop, last_next_hop))
    {
      last_next_hop = rte.next_hop;
      rip_put_next_hop(p, pos, &rte);
      pos += RIP_BLOCK_LENGTH;
    }

    rip_put_block(p, pos, &rte);
    pos += RIP_BLOCK_LENGTH;
    send = 1;

  next_entry: ;
  }
  FIB_ITERATE_END;

  if (send)
  {
    FIB_ITERATE_PUT_END(&ifa->tx_fit);
    goto send_pkt;
  }

  /* Do not send empty packet */

  ifa->tx_active = 0;

  /* Unlink second iterator */
  FIB_ITERATE_UNLINK(&ifa->tx_done, &p->rtable);

  return 0;

send_pkt:

  /* Waiting for ack or timeout */
  if (ifa->cf->demand_circuit)
  {
    ifa->tx_pending = 1;
    rip_kick_rxmt_timer(ifa);
  }

  TRACE(D_PACKETS, "Sending response via %s", ifa->iface->name);
  return rip_send_to(p, ifa, pkt, pos - (byte *) pkt, ifa->tx_addr);
}

/**
 * rip_send_table - RIP interface timer hook
 * @p: RIP instance
 * @ifa: RIP interface
 * @addr: destination IP address
 * @changed: time limit for triggered updates
 *
 * The function activates an update session and starts sending routing update
 * packets (using rip_send_response()). The session may be finished during the
 * call or may continue in rip_tx_hook() until all appropriate routes are
 * transmitted. Note that there may be at most one active update session per
 * interface, the function will terminate the old active session before
 * activating the new one.
 */
void
rip_send_table(struct rip_proto *p, struct rip_iface *ifa, ip_addr addr, btime changed)
{
  DBG("RIP: Opening TX session to %I on %s\n", addr, ifa->iface->name);

  rip_reset_tx_session(p, ifa);

  ifa->tx_active = 1;
  ifa->tx_addr = addr;
  ifa->tx_changed = changed;
  FIB_ITERATE_INIT(&ifa->tx_fit, &p->rtable);
  FIB_ITERATE_INIT(&ifa->tx_done, &p->rtable);

  if (ifa->cf->demand_circuit)
    ifa->tx_flush = ! changed;

  rip_update_csn(p, ifa);

  while (rip_send_response(p, ifa) > 0)
    ;
}

static void
rip_tx_hook(sock *sk)
{
  struct rip_iface *ifa = sk->data;
  struct rip_proto *p = ifa->rip;

  DBG("RIP: TX hook called (iface %s, src %I, dst %I)\n",
      sk->iface->name, sk->saddr, sk->daddr);

  while (rip_send_response(p, ifa) > 0)
    ;
}

static void
rip_err_hook(sock *sk, int err)
{
  struct rip_iface *ifa = sk->data;
  struct rip_proto *p = ifa->rip;

  log(L_ERR "%s: Socket error on %s: %M", p->p.name, ifa->iface->name, err);

  rip_reset_tx_session(p, ifa);
}

static void
rip_receive_response(struct rip_proto *p, struct rip_iface *ifa, struct rip_packet *pkt, uint plen, struct rip_neighbor *from)
{
  struct rip_block rte = {};
  const char *err_dsc = NULL;

  TRACE(D_PACKETS, "Response received from %I on %s", from->nbr->addr, ifa->iface->name);

  byte *pos = (byte *) pkt + rip_pkt_hdrlen(ifa);
  byte *end = (byte *) pkt + plen;

  btime expires = current_time() + ifa->cf->timeout_time;

  if (pkt->command == RIP_CMD_UPDATE_RESPONSE)
  {
    struct rip_update_hdr *hdr = rip_get_update_hdr(pkt);
    rip_send_ack(p, ifa, hdr->flush, ntohs(hdr->seqnum));
    expires = TIME_INFINITY;

    /* Handle flush bit */
    if (hdr->flush)
    {
      /* Flush old routes */
      rip_flush_table(p, from);

      /* Acknowledge pending request */
      ifa->req_pending = 0;
    }
  }

  for (; pos < end; pos += RIP_BLOCK_LENGTH)
  {
    /* Find next regular RTE */
    if (!rip_get_block(p, pos, &rte))
      continue;

    if (rip_is_v2(p) && (pkt->version == RIP_V1))
    {
      if (ifa->cf->check_zero && (rte.tag || rte.net.pxlen || ipa_nonzero(rte.next_hop)))
	SKIP("RIPv1 reserved field is nonzero");

      rte.tag = 0;
      rte.net.pxlen = ip4_masklen(ip4_class_mask(net4_prefix(&rte.net)));
      rte.next_hop = IPA_NONE;
    }

    if (rte.net.pxlen == 255)
      SKIP("invalid prefix length");

    net_normalize(&rte.net);

    int c = net_classify(&rte.net);
    if ((c < 0) || !(c & IADDR_HOST) || ((c & IADDR_SCOPE_MASK) <= SCOPE_LINK))
      SKIP("invalid prefix");

    if (rte.metric > p->infinity)
      SKIP("invalid metric");

    if (ipa_nonzero(rte.next_hop))
    {
      neighbor *nbr = neigh_find(&p->p, rte.next_hop, ifa->iface, 0);
      if (!nbr || (nbr->scope <= 0))
	rte.next_hop = IPA_NONE;
    }

    // TRACE(D_PACKETS, "    %N -> %I metric %d", &rte.net.n, rte.next_hop, rte.metric);

    rte.metric += ifa->cf->metric;

    if (rte.metric < p->infinity)
    {
      struct rip_rte new = {
	.from = from,
	.next_hop = ipa_nonzero(rte.next_hop) ? rte.next_hop : from->nbr->addr,
	.metric = rte.metric,
	.tag = rte.tag,
	.expires = expires
      };

      rip_update_rte(p, &rte.net, &new);
    }
    else
      rip_withdraw_rte(p, &rte.net, from);

    continue;

  skip:
    LOG_RTE("Ignoring route %N received from %I - %s",
	    &rte.net, from->nbr->addr, err_dsc);
  }
}

int
rip_send_flush(struct rip_proto *p, struct rip_iface *ifa)
{
  /* Caller should handle cleanup of pending response */
  if (ifa->tx_pending)
    return 0;

  struct rip_packet *pkt = rip_tx_buffer(ifa);

  rip_fill_header(ifa, pkt, RIP_CMD_UPDATE_RESPONSE);
  rip_fill_update_hdr(pkt, 1, ifa->tx_seqnum);

  /* We suppose that iface is going down, so we do not expect ACK */
  ifa->tx_seqnum++;

  TRACE(D_PACKETS, "Sending response via %s", ifa->iface->name);
  return rip_send_to(p, ifa, pkt, rip_pkt_hdrlen(ifa), ifa->tx_addr);
}


static int
rip_send_ack(struct rip_proto *p, struct rip_iface *ifa, uint flush, uint seqnum)
{
  struct rip_packet *pkt = rip_tx_buffer(ifa);

  rip_fill_header(ifa, pkt, RIP_CMD_UPDATE_ACK);
  rip_fill_update_hdr(pkt, flush, seqnum);

  TRACE(D_PACKETS, "Sending acknowledge via %s", ifa->iface->name);
  return rip_send_to(p, ifa, pkt, rip_pkt_hdrlen(ifa), ifa->tx_addr);
}

static void
rip_receive_ack(struct rip_proto *p, struct rip_iface *ifa, struct rip_packet *pkt, uint plen UNUSED, struct rip_neighbor *from)
{
  TRACE(D_PACKETS, "Acknowledge received from %I on %s", from->nbr->addr, ifa->iface->name);

  struct rip_update_hdr *hdr = rip_get_update_hdr(pkt);
  uint seqnum = ntohs(hdr->seqnum);

  if (! ifa->tx_active || ! ifa->tx_pending)
  {
    LOG_PKT("Bad acknowledge packet from %I via %s - no pending response",
	    from->nbr->addr, ifa->iface->name);
    return;
  }

  if (seqnum != ifa->tx_seqnum)
  {
    LOG_PKT("Bad acknowledge packet from %I via %s - "
	    "mismatched sequence number (rcv %u, old %u)",
	    from->nbr->addr, ifa->iface->name, seqnum, (uint) ifa->tx_seqnum);
    return;
  }

  /* Move acked position */
  FIB_ITERATE_COPY(&ifa->tx_done, &ifa->tx_fit, &p->rtable);

  /* Packet is no longer pending */
  ifa->tx_pending = 0;
  ifa->tx_seqnum++;

  /* Next one does not have flush bit */
  ifa->tx_flush = 0;

  rip_send_response(p, ifa);
}

/**
 * rip_rxmt_timeout - RIP retransmission timer hook
 * @t: timer
 *
 * In Demand Circuit mode, update packets must be acknowledged to ensure
 * reliability. If they are not acknowledged, we need to retransmit them.
 */
void
rip_rxmt_timeout(timer *t)
{
  struct rip_iface *ifa = t->data;
  struct rip_proto *p = ifa->rip;

  if (ifa->req_pending)
    rip_send_request(p, ifa);

  if (ifa->tx_pending)
  {
    /* Revert to acked position */
    FIB_ITERATE_COPY(&ifa->tx_fit, &ifa->tx_done, &p->rtable);

    /* Packet is no longer pending */
    ifa->tx_pending = 0;
    ifa->tx_seqnum++;

    rip_send_response(p, ifa);
  }
}


static int
rip_rx_hook(sock *sk, uint len)
{
  struct rip_iface *ifa = sk->data;
  struct rip_proto *p = ifa->rip;
  const char *err_dsc = NULL;
  uint err_val = 0;

  if (sk->lifindex != sk->iface->index)
    return 1;

  DBG("RIP: RX hook called (iface %s, src %I, dst %I)\n",
      sk->iface->name, sk->faddr, sk->laddr);

  /* Silently ignore my own packets */
  if (ipa_equal(sk->faddr, sk->saddr))
    return 1;

  if (rip_is_ng(p) && !ipa_is_link_local(sk->faddr))
    DROP1("wrong src address");

  struct rip_neighbor *n = rip_get_neighbor(p, &sk->faddr, ifa);

  if (!n)
    DROP1("not from neighbor");

  if ((ifa->cf->ttl_security == 1) && (sk->rcv_ttl < 255))
    DROP("wrong TTL", sk->rcv_ttl);

  if (sk->fport != sk->dport)
    DROP("wrong src port", sk->fport);

  if (len < sizeof(struct rip_packet))
    DROP("too short", len);

  if (sk->flags & SKF_TRUNCATED)
    DROP("truncated", len);

  struct rip_packet *pkt = (struct rip_packet *) sk->rbuf;
  uint pkt_len = len;
  uint hdr_len = sizeof(struct rip_packet);
  uint update_msg = 0;

  if (!pkt->version || (ifa->cf->version_only && (pkt->version != ifa->cf->version)))
    DROP("wrong version", pkt->version);

  /* Update packets (RFC 2091) have additional header even before auth data */
  if ((pkt->command == RIP_CMD_UPDATE_REQUEST) ||
      (pkt->command == RIP_CMD_UPDATE_RESPONSE) ||
      (pkt->command == RIP_CMD_UPDATE_ACK))
  {
    hdr_len += sizeof(struct rip_update_hdr);

    if (len < hdr_len)
      DROP("too short", len);

    struct rip_update_hdr *hdr = rip_get_update_hdr(pkt);

    if (hdr->version != RIP_UPDATE_VERSION)
      DROP("wrong update header version", hdr->version);

    if (hdr->flush > 1)
      DROP("wrong flush value", hdr->flush);

    update_msg = 1;
  }

  /* rip_check_authentication() has its own error logging */
  if (rip_is_v2(p) && !rip_check_authentication(p, ifa, pkt, &pkt_len, hdr_len, n))
    return 1;

  if ((pkt_len - hdr_len) % RIP_BLOCK_LENGTH)
    DROP("invalid length", pkt_len);

  if (update_msg != ifa->cf->demand_circuit)
    DROP("demand circuit mode mismatch", update_msg);

  n->last_seen = current_time();
  rip_update_bfd(p, n);

  switch (pkt->command)
  {
  case RIP_CMD_REQUEST:
  case RIP_CMD_UPDATE_REQUEST:
    rip_receive_request(p, ifa, pkt, pkt_len, n);
    break;

  case RIP_CMD_RESPONSE:
  case RIP_CMD_UPDATE_RESPONSE:
    rip_receive_response(p, ifa, pkt, pkt_len, n);
    break;

  case RIP_CMD_UPDATE_ACK:
    rip_receive_ack(p, ifa, pkt, pkt_len, n);
    break;

  default:
    DROP("unknown command", pkt->command);
  }
  return 1;

drop:
  LOG_PKT("Bad packet from %I via %s - %s (%u)",
	  sk->faddr, sk->iface->name, err_dsc, err_val);

  return 1;
}

int
rip_open_socket(struct rip_iface *ifa)
{
  struct rip_proto *p = ifa->rip;

  sock *sk = sk_new(p->p.pool);
  sk->type = SK_UDP;
  sk->subtype = rip_is_v2(p) ? SK_IPV4 : SK_IPV6;
  sk->sport = ifa->cf->port;
  sk->dport = ifa->cf->port;
  sk->iface = ifa->iface;
  sk->saddr = rip_is_v2(p) ? ifa->iface->addr4->ip : ifa->iface->llv6->ip;
  sk->vrf = p->p.vrf;

  sk->rx_hook = rip_rx_hook;
  sk->tx_hook = rip_tx_hook;
  sk->err_hook = rip_err_hook;
  sk->data = ifa;

  sk->tos = ifa->cf->tx_tos;
  sk->priority = ifa->cf->tx_priority;
  sk->ttl = ifa->cf->ttl_security ? 255 : 1;
  sk->flags = SKF_LADDR_RX | ((ifa->cf->ttl_security == 1) ? SKF_TTL_RX : 0);

  /* sk->rbsize and sk->tbsize are handled in rip_iface_update_buffers() */

  if (sk_open(sk) < 0)
    goto err;

  if (ifa->cf->mode == RIP_IM_MULTICAST)
  {
    if (sk_setup_multicast(sk) < 0)
      goto err;

    if (sk_join_group(sk, ifa->addr) < 0)
      goto err;
  }
  else /* Broadcast */
  {
    if (sk_setup_broadcast(sk) < 0)
      goto err;

    if (ipa_zero(ifa->addr))
    {
      sk->err = "Missing broadcast address";
      goto err;
    }
  }

  ifa->sk = sk;
  return 1;

err:
  sk_log_error(sk, p->p.name);
  rfree(sk);
  return 0;
}