freebsd-skq/contrib/tcpdump/print-udld.c
Gleb Smirnoff 3340d77368 Update tcpdump to 4.9.0.
It fixes many buffer overflow in different protocol parsers, but none of
them are critical, even in absense of Capsicum.

Security:	CVE-2016-7922, CVE-2016-7923, CVE-2016-7924, CVE-2016-7925
Security:	CVE-2016-7926, CVE-2016-7927, CVE-2016-7928, CVE-2016-7929
Security:	CVE-2016-7930, CVE-2016-7931, CVE-2016-7932, CVE-2016-7933
Security:	CVE-2016-7934, CVE-2016-7935, CVE-2016-7936, CVE-2016-7937
Security:	CVE-2016-7938, CVE-2016-7939, CVE-2016-7940, CVE-2016-7973
Security:	CVE-2016-7974, CVE-2016-7975, CVE-2016-7983, CVE-2016-7984
Security:	CVE-2016-7985, CVE-2016-7986, CVE-2016-7992, CVE-2016-7993
Security:	CVE-2016-8574, CVE-2016-8575, CVE-2017-5202, CVE-2017-5203
Security:	CVE-2017-5204, CVE-2017-5205, CVE-2017-5341, CVE-2017-5342
Security:	CVE-2017-5482, CVE-2017-5483, CVE-2017-5484, CVE-2017-5485
Security:	CVE-2017-5486
2017-02-01 20:26:42 +00:00

199 lines
5.5 KiB
C

/*
* Copyright (c) 1998-2007 The TCPDUMP project
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that: (1) source code
* distributions retain the above copyright notice and this paragraph
* in its entirety, and (2) distributions including binary code include
* the above copyright notice and this paragraph in its entirety in
* the documentation or other materials provided with the distribution.
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND
* WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
* LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE.
*
* Original code by Carles Kishimoto <carles.kishimoto@gmail.com>
*/
/* \summary: Cisco UniDirectional Link Detection (UDLD) protocol printer */
/* specification: RFC 5171 */
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
#include <netdissect-stdinc.h>
#include "netdissect.h"
#include "extract.h"
static const char tstr[] = " [|udld]";
#define UDLD_HEADER_LEN 4
#define UDLD_DEVICE_ID_TLV 0x0001
#define UDLD_PORT_ID_TLV 0x0002
#define UDLD_ECHO_TLV 0x0003
#define UDLD_MESSAGE_INTERVAL_TLV 0x0004
#define UDLD_TIMEOUT_INTERVAL_TLV 0x0005
#define UDLD_DEVICE_NAME_TLV 0x0006
#define UDLD_SEQ_NUMBER_TLV 0x0007
static const struct tok udld_tlv_values[] = {
{ UDLD_DEVICE_ID_TLV, "Device-ID TLV"},
{ UDLD_PORT_ID_TLV, "Port-ID TLV"},
{ UDLD_ECHO_TLV, "Echo TLV"},
{ UDLD_MESSAGE_INTERVAL_TLV, "Message Interval TLV"},
{ UDLD_TIMEOUT_INTERVAL_TLV, "Timeout Interval TLV"},
{ UDLD_DEVICE_NAME_TLV, "Device Name TLV"},
{ UDLD_SEQ_NUMBER_TLV,"Sequence Number TLV"},
{ 0, NULL}
};
static const struct tok udld_code_values[] = {
{ 0x00, "Reserved"},
{ 0x01, "Probe message"},
{ 0x02, "Echo message"},
{ 0x03, "Flush message"},
{ 0, NULL}
};
static const struct tok udld_flags_values[] = {
{ 0x00, "RT"},
{ 0x01, "RSY"},
{ 0, NULL}
};
/*
* UDLD's Protocol Data Unit format:
*
* 0 1 2 3
* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Ver | Opcode | Flags | Checksum |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | List of TLVs (variable length list) |
* | ... |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*
* TLV format:
*
* 0 1 2 3
* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | TYPE | LENGTH |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | VALUE |
* | ... |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*
* LENGTH: Length in bytes of the Type, Length, and Value fields.
*/
#define UDLD_EXTRACT_VERSION(x) (((x)&0xe0)>>5)
#define UDLD_EXTRACT_OPCODE(x) ((x)&0x1f)
void
udld_print (netdissect_options *ndo, const u_char *pptr, u_int length)
{
int code, type, len;
const u_char *tptr;
if (length < UDLD_HEADER_LEN)
goto trunc;
tptr = pptr;
ND_TCHECK2(*tptr, UDLD_HEADER_LEN);
code = UDLD_EXTRACT_OPCODE(*tptr);
ND_PRINT((ndo, "UDLDv%u, Code %s (%x), Flags [%s] (0x%02x), length %u",
UDLD_EXTRACT_VERSION(*tptr),
tok2str(udld_code_values, "Reserved", code),
code,
bittok2str(udld_flags_values, "none", *(tptr+1)),
*(tptr+1),
length));
/*
* In non-verbose mode, just print version and opcode type
*/
if (ndo->ndo_vflag < 1) {
return;
}
ND_PRINT((ndo, "\n\tChecksum 0x%04x (unverified)", EXTRACT_16BITS(tptr+2)));
tptr += UDLD_HEADER_LEN;
while (tptr < (pptr+length)) {
ND_TCHECK2(*tptr, 4);
type = EXTRACT_16BITS(tptr);
len = EXTRACT_16BITS(tptr+2);
ND_PRINT((ndo, "\n\t%s (0x%04x) TLV, length %u",
tok2str(udld_tlv_values, "Unknown", type),
type, len));
if (type == 0)
goto invalid;
/* infinite loop check */
if (len <= 4)
goto invalid;
len -= 4;
tptr += 4;
ND_TCHECK2(*tptr, len);
switch (type) {
case UDLD_DEVICE_ID_TLV:
case UDLD_PORT_ID_TLV:
case UDLD_DEVICE_NAME_TLV:
ND_PRINT((ndo, ", "));
fn_printzp(ndo, tptr, len, NULL);
break;
case UDLD_ECHO_TLV:
ND_PRINT((ndo, ", "));
(void)fn_printn(ndo, tptr, len, NULL);
break;
case UDLD_MESSAGE_INTERVAL_TLV:
case UDLD_TIMEOUT_INTERVAL_TLV:
if (len != 1)
goto invalid;
ND_PRINT((ndo, ", %us", (*tptr)));
break;
case UDLD_SEQ_NUMBER_TLV:
if (len != 4)
goto invalid;
ND_PRINT((ndo, ", %u", EXTRACT_32BITS(tptr)));
break;
default:
break;
}
tptr += len;
}
return;
invalid:
ND_PRINT((ndo, "%s", istr));
return;
trunc:
ND_PRINT((ndo, "%s", tstr));
}
/*
* Local Variables:
* c-style: whitesmith
* c-basic-offset: 4
* End:
*/