dhcp.c: improve input validation & length checks
[project/relayd.git] / dhcp.c
1 /*
2 * Copyright (C) 2010 Felix Fietkau <nbd@openwrt.org>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License v2 as published by
6 * the Free Software Foundation.
7 *
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 * GNU General Public License for more details.
12 *
13 * You should have received a copy of the GNU General Public License
14 * along with this program; if not, write to the Free Software
15 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.
16 */
17
18 #define _GNU_SOURCE
19 #include <sys/socket.h>
20 #include <stdio.h>
21 #include <string.h>
22 #include <errno.h>
23 #include <unistd.h>
24 #include <fcntl.h>
25
26 #include "relayd.h"
27
28 struct ip_packet {
29 struct ether_header eth;
30 struct iphdr iph;
31 } __packed;
32
33
34 enum {
35 DHCP_OPTION_ROUTER = 0x03,
36 DHCP_OPTION_ROUTES = 0x79,
37 DHCP_OPTION_END = 0xff,
38 };
39
40 struct dhcp_option {
41 uint8_t code;
42 uint8_t len;
43 uint8_t data[];
44 };
45
46 struct dhcp_header {
47 uint8_t op, htype, hlen, hops;
48 uint32_t xit;
49 uint16_t secs, flags;
50 struct in_addr ciaddr, yiaddr, siaddr, giaddr;
51 unsigned char chaddr[16];
52 unsigned char sname[64];
53 unsigned char file[128];
54 uint32_t cookie;
55 uint8_t option_data[];
56 } __packed;
57
58 static uint16_t
59 chksum(uint16_t sum, const uint8_t *data, uint16_t len)
60 {
61 const uint8_t *last;
62 uint16_t t;
63
64 last = data + len - 1;
65
66 while(data < last) {
67 t = (data[0] << 8) + data[1];
68 sum += t;
69 if(sum < t)
70 sum++;
71 data += 2;
72 }
73
74 if(data == last) {
75 t = (data[0] << 8) + 0;
76 sum += t;
77 if(sum < t)
78 sum++;
79 }
80
81 return sum;
82 }
83
84 static void
85 parse_dhcp_options(struct relayd_host *host, struct dhcp_header *dhcp, int len)
86 {
87 uint8_t *end = (uint8_t *) dhcp + len;
88 struct dhcp_option *opt = (void *)dhcp->option_data;
89 static const uint8_t dest[4] = { 0, 0, 0, 0 };
90
91 while((uint8_t *) opt + sizeof(*opt) < end) {
92 if ((uint8_t *) opt + opt->len > end ||
93 (uint8_t *) opt + sizeof(*opt) > end )
94 break;
95
96 opt = (void *) &opt->data[opt->len];
97 switch(opt->code) {
98 case DHCP_OPTION_ROUTER:
99 DPRINTF(2, "Found a DHCP router option, len=%d\n", opt->len);
100 if (!memcmp(opt->data, host->ipaddr, 4))
101 relayd_add_host_route(host, dest, 0);
102 else
103 relayd_add_pending_route(opt->data, dest, 0, 10000);
104 break;
105 case DHCP_OPTION_ROUTES:
106 DPRINTF(2, "Found a DHCP static routes option, len=%d\n", opt->len);
107 break;
108 case DHCP_OPTION_END:
109 opt = (void *) end;
110 continue;
111 default:
112 DPRINTF(3, "Skipping unknown DHCP option %02x\n", opt->code);
113 continue;
114 }
115
116 }
117 }
118
119 bool relayd_handle_dhcp_packet(struct relayd_interface *rif, void *data, int len, bool forward, bool parse)
120 {
121 struct ip_packet *pkt = data;
122 struct udphdr *udp;
123 struct dhcp_header *dhcp;
124 struct relayd_host *host;
125 int udplen;
126 uint16_t sum;
127
128 if (pkt->eth.ether_type != htons(ETH_P_IP))
129 return false;
130
131 if (pkt->iph.version != 4)
132 return false;
133
134 if (pkt->iph.protocol != IPPROTO_UDP)
135 return false;
136
137 udp = (void *) ((char *) &pkt->iph + (pkt->iph.ihl << 2));
138 dhcp = (void *) (udp + 1);
139
140 if ((uint8_t *)udp + sizeof(*udp) > (uint8_t *)data + len )
141 return false;
142
143 udplen = ntohs(udp->len);
144 if (udplen > len - ((char *) udp - (char *) data))
145 return false;
146
147 if (udp->dest != htons(67) && udp->source != htons(67))
148 return false;
149
150 if (dhcp->op != 1 && dhcp->op != 2)
151 return false;
152
153 if (!forward)
154 return true;
155
156 if (dhcp->op == 2) {
157 host = relayd_refresh_host(rif, pkt->eth.ether_shost, (void *) &pkt->iph.saddr);
158 if (host && parse)
159 parse_dhcp_options(host, dhcp, udplen - sizeof(struct udphdr));
160 }
161
162 DPRINTF(2, "%s: handling DHCP %s\n", rif->ifname, (dhcp->op == 1 ? "request" : "response"));
163
164 dhcp->flags |= htons(DHCP_FLAG_BROADCAST);
165
166 udp->check = 0;
167 sum = udplen + IPPROTO_UDP;
168 sum = chksum(sum, (void *) &pkt->iph.saddr, 8);
169 sum = chksum(sum, (void *) udp, udplen);
170 if (sum == 0)
171 sum = 0xffff;
172
173 udp->check = htons(~sum);
174
175 relayd_forward_bcast_packet(rif, data, len);
176
177 return true;
178 }
179
180