epan/dissectors/packet-rip.c

   1 /* packet-rip.c
   2  * Routines for RIPv1 and RIPv2 packet disassembly
   3  * RFC1058 (STD 34), RFC1388, RFC1723, RFC2453 (STD 56)
   4  * (c) Copyright Hannes R. Boehm <hannes@boehm.org>
   5  *
   6  * RFC2082 ( Keyed Message Digest Algorithm )
   7  *   Emanuele Caratti  <wiz@iol.it>
   8  *
   9  * Wireshark - Network traffic analyzer
  10  * By Gerald Combs <gerald@wireshark.org>
  11  * Copyright 1998 Gerald Combs
  12  *
  13  * SPDX-License-Identifier: GPL-2.0-or-later
  14  */
  15 #include "config.h"
  16
  17 #include <epan/packet.h>
  18 #include <epan/expert.h>
  19 #include <epan/prefs.h>
  20 #include <epan/to_str.h>
  21
  22 #define UDP_PORT_RIP    520
  23
  24 #define RIPv1   1
  25 #define RIPv2   2
  26
  27 void proto_register_rip(void);
  28 void proto_reg_handoff_rip(void);
  29
  30 static const value_string version_vals[] = {
  31     { RIPv1, "RIPv1" },
  32     { RIPv2, "RIPv2" },
  33     { 0, NULL }
  34 };
  35
  36 static const value_string command_vals[] = {
  37     { 1, "Request" },
  38     { 2, "Response" },
  39     { 3, "Traceon" },
  40     { 4, "Traceoff" },
  41     { 5, "Vendor specific (Sun)" },
  42     { 0, NULL }
  43 };
  44
  45 #define AFVAL_UNSPEC    0
  46 #define AFVAL_IP        2
  47
  48 static const value_string family_vals[] = {
  49     { AFVAL_UNSPEC, "Unspecified" },
  50     { AFVAL_IP,     "IP" },
  51     { 0, NULL }
  52 };
  53
  54 #define AUTH_IP_ROUTE           1
  55 #define AUTH_PASSWORD           2
  56 #define AUTH_KEYED_MSG_DIGEST   3
  57
  58 static const value_string rip_auth_type[] = {
  59     { AUTH_IP_ROUTE,         "IP Route" },
  60     { AUTH_PASSWORD,         "Simple Password" },
  61     { AUTH_KEYED_MSG_DIGEST, "Keyed Message Digest" },
  62     { 0, NULL }
  63 };
  64
  65 #define RIP_HEADER_LENGTH 4
  66 #define RIP_ENTRY_LENGTH 20
  67 #define MD5_AUTH_DATA_LEN 16
  68
  69 static bool pref_display_routing_domain;
  70
  71 static dissector_handle_t rip_handle;
  72
  73 static int proto_rip;
  74
  75 static int hf_rip_auth;
  76 static int hf_rip_auth_data_len;
  77 static int hf_rip_auth_passwd;
  78 static int hf_rip_auth_seq_num;
  79 static int hf_rip_authentication_data;
  80 static int hf_rip_command;
  81 static int hf_rip_digest_offset;
  82 static int hf_rip_family;
  83 static int hf_rip_ip;
  84 static int hf_rip_key_id;
  85 static int hf_rip_metric;
  86 static int hf_rip_netmask;
  87 static int hf_rip_next_hop;
  88 static int hf_rip_route_tag;
  89 static int hf_rip_routing_domain;
  90 static int hf_rip_version;
  91 static int hf_rip_zero_padding;
  92
  93 static int ett_rip;
  94 static int ett_rip_vec;
  95 static int ett_auth_vec;
  96
  97 static expert_field ei_rip_unknown_address_family;
  98
  99 static void dissect_unspec_rip_vektor(tvbuff_t *tvb, int offset, uint8_t version,
 100     proto_tree *tree);
 101 static void dissect_ip_rip_vektor(tvbuff_t *tvb, packet_info *pinfo, int offset, uint8_t version,
 102     proto_tree *tree);
 103 static int dissect_rip_authentication(tvbuff_t *tvb, int offset,
 104     proto_tree *tree);
 105
 106 static int
 107 dissect_rip(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
 108 {
 109     int         offset      = 0;
 110     proto_tree *rip_tree    = NULL;
 111     proto_item *ti;
 112     uint8_t     command;
 113     uint8_t     version;
 114     uint16_t    family;
 115     int         trailer_len = 0;
 116     bool        is_md5_auth = false;
 117
 118     col_set_str(pinfo->cinfo, COL_PROTOCOL, "RIP");
 119     col_clear(pinfo->cinfo, COL_INFO);
 120
 121     command = tvb_get_uint8(tvb, 0);
 122     version = tvb_get_uint8(tvb, 1);
 123
 124     col_set_str(pinfo->cinfo, COL_PROTOCOL,
 125                     val_to_str_const(version, version_vals, "RIP"));
 126     col_add_str(pinfo->cinfo, COL_INFO,
 127                     val_to_str(command, command_vals, "Unknown command (%u)"));
 128
 129     ti = proto_tree_add_item(tree, proto_rip, tvb, 0, -1, ENC_NA);
 130     rip_tree = proto_item_add_subtree(ti, ett_rip);
 131
 132     proto_tree_add_uint(rip_tree, hf_rip_command, tvb, 0, 1, command);
 133     proto_tree_add_uint(rip_tree, hf_rip_version, tvb, 1, 1, version);
 134     if (version == RIPv2 && pref_display_routing_domain == true)
 135         proto_tree_add_item(rip_tree, hf_rip_routing_domain, tvb, 2, 2,
 136                     ENC_BIG_ENDIAN);
 137
 138     /* skip header */
 139     offset = RIP_HEADER_LENGTH;
 140
 141     /* zero or more entries */
 142     while (tvb_reported_length_remaining(tvb, offset) > trailer_len ) {
 143         family = tvb_get_ntohs(tvb, offset);
 144         switch (family) {
 145         case AFVAL_UNSPEC: /* Unspecified */
 146             /*
 147                 * There should be one entry in the request, and a metric
 148                 * of infinity, meaning "show the entire routing table".
 149                 */
 150             dissect_unspec_rip_vektor(tvb, offset, version, rip_tree);
 151             break;
 152         case AFVAL_IP: /* IP */
 153             dissect_ip_rip_vektor(tvb, pinfo, offset, version, rip_tree);
 154             break;
 155         case 0xFFFF:
 156             if( offset == RIP_HEADER_LENGTH ) {
 157                     trailer_len=dissect_rip_authentication(tvb, offset, rip_tree);
 158                     is_md5_auth = true;
 159             break;
 160             }
 161             if(is_md5_auth && tvb_reported_length_remaining(tvb, offset) == 20)
 162                     break;
 163             /* Intentional fall through */ /* auth Entry MUST be the first! */
 164         default:
 165             proto_tree_add_expert_format(rip_tree, pinfo, &ei_rip_unknown_address_family, tvb, offset,
 166                             RIP_ENTRY_LENGTH, "Unknown address family %u", family);
 167             break;
 168         }
 169
 170         offset += RIP_ENTRY_LENGTH;
 171     }
 172     return tvb_captured_length(tvb);
 173 }
 174
 175 static void
 176 dissect_unspec_rip_vektor(tvbuff_t *tvb, int offset, uint8_t version,
 177                       proto_tree *tree)
 178 {
 179     proto_tree *rip_vektor_tree;
 180     uint32_t    metric;
 181
 182     metric = tvb_get_ntohl(tvb, offset+16);
 183     rip_vektor_tree = proto_tree_add_subtree_format(tree, tvb, offset,
 184                              RIP_ENTRY_LENGTH, ett_rip_vec, NULL, "Address not specified, Metric: %u",
 185                              metric);
 186
 187     proto_tree_add_item(rip_vektor_tree, hf_rip_family, tvb, offset, 2, ENC_BIG_ENDIAN);
 188     if (version == RIPv2) {
 189         proto_tree_add_item(rip_vektor_tree, hf_rip_route_tag, tvb, offset+2, 2,
 190                         ENC_BIG_ENDIAN);
 191         proto_tree_add_item(rip_vektor_tree, hf_rip_netmask, tvb, offset+8, 4,
 192                             ENC_BIG_ENDIAN);
 193         proto_tree_add_item(rip_vektor_tree, hf_rip_next_hop, tvb, offset+12, 4,
 194                             ENC_BIG_ENDIAN);
 195     }
 196     proto_tree_add_uint(rip_vektor_tree, hf_rip_metric, tvb,
 197                         offset+16, 4, metric);
 198 }
 199
 200 static void
 201 dissect_ip_rip_vektor(tvbuff_t *tvb, packet_info *pinfo, int offset, uint8_t version,
 202                       proto_tree *tree)
 203 {
 204     proto_tree *rip_vektor_tree;
 205     uint32_t    metric;
 206
 207     metric = tvb_get_ntohl(tvb, offset+16);
 208     rip_vektor_tree = proto_tree_add_subtree_format(tree, tvb, offset,
 209                              RIP_ENTRY_LENGTH, ett_rip_vec, NULL, "IP Address: %s, Metric: %u",
 210                              tvb_ip_to_str(pinfo->pool, tvb, offset+4), metric);
 211
 212     proto_tree_add_item(rip_vektor_tree, hf_rip_family, tvb, offset, 2, ENC_BIG_ENDIAN);
 213     if (version == RIPv2) {
 214         proto_tree_add_item(rip_vektor_tree, hf_rip_route_tag, tvb, offset+2, 2,
 215                         ENC_BIG_ENDIAN);
 216     }
 217
 218     proto_tree_add_item(rip_vektor_tree, hf_rip_ip, tvb, offset+4, 4, ENC_BIG_ENDIAN);
 219
 220     if (version == RIPv2) {
 221         proto_tree_add_item(rip_vektor_tree, hf_rip_netmask, tvb, offset+8, 4,
 222                             ENC_BIG_ENDIAN);
 223         proto_tree_add_item(rip_vektor_tree, hf_rip_next_hop, tvb, offset+12, 4,
 224                             ENC_BIG_ENDIAN);
 225     }
 226     proto_tree_add_uint(rip_vektor_tree, hf_rip_metric, tvb,
 227                         offset+16, 4, metric);
 228 }
 229
 230 static int
 231 dissect_rip_authentication(tvbuff_t *tvb, int offset, proto_tree *tree)
 232 {
 233     proto_tree *rip_authentication_tree;
 234     uint16_t    authtype;
 235     uint32_t    digest_off, auth_data_len;
 236
 237     auth_data_len = 0;
 238     authtype = tvb_get_ntohs(tvb, offset + 2);
 239
 240     rip_authentication_tree = proto_tree_add_subtree_format(tree, tvb, offset, RIP_ENTRY_LENGTH,
 241                         ett_rip_vec, NULL, "Authentication: %s", val_to_str( authtype, rip_auth_type, "Unknown (%u)" ) );
 242
 243     proto_tree_add_uint(rip_authentication_tree, hf_rip_auth, tvb, offset+2, 2,
 244                 authtype);
 245
 246     switch ( authtype ) {
 247
 248     case AUTH_PASSWORD: /* Plain text password */
 249         proto_tree_add_item(rip_authentication_tree, hf_rip_auth_passwd,
 250                         tvb, offset+4, 16, ENC_ASCII);
 251         break;
 252
 253     case AUTH_KEYED_MSG_DIGEST: /* Keyed MD5 rfc 2082 */
 254         digest_off = tvb_get_ntohs( tvb, offset+4 );
 255         proto_tree_add_item( rip_authentication_tree, hf_rip_digest_offset, tvb, offset+4, 2, ENC_BIG_ENDIAN);
 256         proto_tree_add_item( rip_authentication_tree, hf_rip_key_id, tvb, offset+6, 1, ENC_NA);
 257         auth_data_len = tvb_get_uint8( tvb, offset+7 );
 258         proto_tree_add_item( rip_authentication_tree, hf_rip_auth_data_len, tvb, offset+7, 1, ENC_NA);
 259         proto_tree_add_item( rip_authentication_tree, hf_rip_auth_seq_num, tvb, offset+8, 4, ENC_BIG_ENDIAN);
 260         proto_tree_add_item( rip_authentication_tree, hf_rip_zero_padding, tvb, offset+12, 8, ENC_ASCII);
 261         rip_authentication_tree = proto_tree_add_subtree( rip_authentication_tree, tvb, offset-4+digest_off,
 262                         MD5_AUTH_DATA_LEN+4, ett_auth_vec, NULL, "Authentication Data Trailer" );
 263         proto_tree_add_item( rip_authentication_tree, hf_rip_authentication_data, tvb, offset-4+digest_off+4,
 264                         MD5_AUTH_DATA_LEN, ENC_NA);
 265         break;
 266     }
 267     return auth_data_len;
 268 }
 269
 270 void
 271 proto_register_rip(void)
 272 {
 273     static hf_register_info hf[] = {
 274         { &hf_rip_command,
 275             { "Command", "rip.command",
 276               FT_UINT8, BASE_DEC, VALS(command_vals), 0,
 277               "What type of RIP Command is this", HFILL }
 278         },
 279         { &hf_rip_version,
 280             { "Version", "rip.version",
 281               FT_UINT8, BASE_DEC, VALS(version_vals), 0,
 282               "Version of the RIP protocol", HFILL }
 283         },
 284         { &hf_rip_routing_domain,
 285             { "Routing Domain", "rip.routing_domain",
 286               FT_UINT16, BASE_DEC, NULL, 0,
 287               "RIPv2 Routing Domain", HFILL }
 288         },
 289         { &hf_rip_ip,
 290             { "IP Address", "rip.ip",
 291               FT_IPv4, BASE_NONE, NULL, 0,
 292               NULL, HFILL }
 293         },
 294         { &hf_rip_netmask,
 295             { "Netmask", "rip.netmask",
 296               FT_IPv4, BASE_NETMASK, NULL, 0,
 297               NULL, HFILL }
 298         },
 299         { &hf_rip_next_hop,
 300             { "Next Hop", "rip.next_hop",
 301               FT_IPv4, BASE_NONE, NULL, 0,
 302               "Next Hop router for this route", HFILL }
 303         },
 304         { &hf_rip_metric,
 305             { "Metric", "rip.metric",
 306               FT_UINT16, BASE_DEC, NULL, 0,
 307               "Metric for this route", HFILL }
 308         },
 309         { &hf_rip_auth,
 310             { "Authentication type", "rip.auth.type",
 311               FT_UINT16, BASE_DEC, VALS(rip_auth_type), 0,
 312               "Type of authentication", HFILL }
 313         },
 314         { &hf_rip_auth_passwd,
 315             { "Password", "rip.auth.passwd",
 316               FT_STRING, BASE_NONE, NULL, 0,
 317               "Authentication password", HFILL }
 318         },
 319         { &hf_rip_family,
 320             { "Address Family", "rip.family",
 321               FT_UINT16, BASE_DEC, VALS(family_vals), 0,
 322               NULL, HFILL }
 323         },
 324         { &hf_rip_route_tag,
 325             { "Route Tag", "rip.route_tag",
 326               FT_UINT16, BASE_DEC, NULL, 0,
 327               NULL, HFILL }
 328         },
 329         { &hf_rip_zero_padding,
 330             { "Zero adding", "rip.zero_padding",
 331               FT_STRING, BASE_NONE, NULL, 0,
 332               "Authentication password", HFILL }
 333         },
 334         { &hf_rip_digest_offset,
 335             { "Digest Offset", "rip.digest_offset",
 336               FT_UINT16, BASE_DEC, NULL, 0,
 337               NULL, HFILL }
 338         },
 339         { &hf_rip_key_id,
 340             { "Key ID", "rip.key_id",
 341               FT_UINT8, BASE_DEC, NULL, 0,
 342               NULL, HFILL }
 343         },
 344         { &hf_rip_auth_data_len,
 345             { "Auth Data Len", "rip.auth_data_len",
 346               FT_UINT8, BASE_DEC, NULL, 0,
 347               NULL, HFILL }
 348         },
 349         { &hf_rip_auth_seq_num,
 350             { "Seq num", "rip.seq_num",
 351               FT_UINT32, BASE_DEC, NULL, 0,
 352               NULL, HFILL }
 353         },
 354         { &hf_rip_authentication_data,
 355             { "Authentication Data", "rip.authentication_data",
 356               FT_BYTES, BASE_NONE, NULL, 0,
 357               NULL, HFILL }
 358         },
 359     };
 360
 361     static int *ett[] = {
 362         &ett_rip,
 363         &ett_rip_vec,
 364         &ett_auth_vec,
 365     };
 366
 367     static ei_register_info ei[] = {
 368         { &ei_rip_unknown_address_family, { "rip.unknown_address_family", PI_PROTOCOL, PI_WARN, "Unknown address family", EXPFILL }},
 369     };
 370
 371     expert_module_t* expert_rip;
 372     module_t *rip_module;
 373
 374     proto_rip = proto_register_protocol("Routing Information Protocol", "RIP", "rip");
 375     proto_register_field_array(proto_rip, hf, array_length(hf));
 376     proto_register_subtree_array(ett, array_length(ett));
 377     expert_rip = expert_register_protocol(proto_rip);
 378     expert_register_field_array(expert_rip, ei, array_length(ei));
 379
 380     rip_module = prefs_register_protocol(proto_rip, NULL);
 381
 382     prefs_register_bool_preference(rip_module, "display_routing_domain", "Display Routing Domain field", "Display the third and forth bytes of the RIPv2 header as the Routing Domain field (introduced in RFC 1388 [January 1993] and obsolete as of RFC 1723 [November 1994])", &pref_display_routing_domain);
 383
 384     rip_handle = register_dissector("rip", dissect_rip, proto_rip);
 385 }
 386
 387 void
 388 proto_reg_handoff_rip(void)
 389 {
 390     dissector_add_uint_with_preference("udp.port", UDP_PORT_RIP, rip_handle);
 391 }
 392
 393 /*
 394  * Editor modelines  -  https://www.wireshark.org/tools/modelines.html
 395  *
 396  * Local variables:
 397  * c-basic-offset: 4
 398  * tab-width: 8
 399  * indent-tabs-mode: nil
 400  * End:
 401  *
 402  * vi: set shiftwidth=4 tabstop=8 expandtab:
 403  * :indentSize=4:tabSize=8:noTabs=true:
 404  */