base.c

Go to the documentation of this file.

/*
 *   This library is free software; you can redistribute it and/or
 *   modify it under the terms of the GNU Lesser General Public
 *   License as published by the Free Software Foundation; either
 *   version 2.1 of the License, or (at your option) any later version.
 *
 *   This library is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 *   Lesser General Public License for more details.
 *
 *   You should have received a copy of the GNU Lesser General Public
 *   License along with this library; if not, write to the Free Software
 *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
 */
 
/**
 * $Id: 440c45bcf9131b1c865bac6cc7282e46a8f8d26a $
 *
 * @file protocols/dhcpv6/base.c
 * @brief Functions to encode DHCP options.
 *
 * @author Arran Cudbard-Bell (a.cudbardb@freeradius.org)
 *
 * @copyright 2018 The FreeRADIUS server project
 * @copyright 2018 NetworkRADIUS SARL (legal@networkradius.com)
 */
#include <freeradius-devel/io/pair.h>
#include <freeradius-devel/protocol/dhcpv6/freeradius.internal.h>
#include <freeradius-devel/protocol/dhcpv6/rfc3315.h>
#include <freeradius-devel/protocol/dhcpv6/rfc5007.h>
#include <freeradius-devel/util/proto.h>
#include <freeradius-devel/util/rand.h>
 
#include "dhcpv6.h"
#include "attrs.h"
 
static uint32_t instance_count = 0;
static bool     instantiated = false;
 
fr_dict_t const *dict_dhcpv6;
 
extern fr_dict_autoload_t libfreeradius_dhcpv6_dict[];
fr_dict_autoload_t libfreeradius_dhcpv6_dict[] = {
        { .out = &dict_dhcpv6, .proto = "dhcpv6" },
        DICT_AUTOLOAD_TERMINATOR
};
 
fr_dict_attr_t const *attr_packet_type;
fr_dict_attr_t const *attr_transaction_id;
fr_dict_attr_t const *attr_hop_count;
fr_dict_attr_t const *attr_relay_link_address;
fr_dict_attr_t const *attr_relay_peer_address;
fr_dict_attr_t const *attr_relay_message;
fr_dict_attr_t const *attr_option_request;
fr_dict_attr_t const *attr_auth;
 
extern fr_dict_attr_autoload_t libfreeradius_dhcpv6_dict_attr[];
fr_dict_attr_autoload_t libfreeradius_dhcpv6_dict_attr[] = {
        { .out = &attr_packet_type, .name = "Packet-Type", .type = FR_TYPE_UINT32, .dict = &dict_dhcpv6 },
        { .out = &attr_transaction_id, .name = "Transaction-Id", .type = FR_TYPE_OCTETS, .dict = &dict_dhcpv6 },
        { .out = &attr_hop_count, .name = "Hop-Count", .type = FR_TYPE_UINT8, .dict = &dict_dhcpv6 },
        { .out = &attr_relay_link_address, .name = "Relay-Link-Address", .type = FR_TYPE_IPV6_ADDR, .dict = &dict_dhcpv6 },
        { .out = &attr_relay_peer_address, .name = "Relay-Peer-Address", .type = FR_TYPE_IPV6_ADDR, .dict = &dict_dhcpv6 },
        { .out = &attr_relay_message, .name = "Relay-Message", .type = FR_TYPE_GROUP, .dict = &dict_dhcpv6 },
        { .out = &attr_option_request, .name = "Option-Request", .type = FR_TYPE_ATTR, .dict = &dict_dhcpv6 },
        { .out = &attr_auth, .name = "Auth", .type = FR_TYPE_STRUCT, .dict = &dict_dhcpv6 },
        DICT_AUTOLOAD_TERMINATOR
};
 
/*
 * grep VALUE share/dictionary/dhcpv6/dictionary.freeradius.internal  | awk '{print "[" $4 "] = \"" $3 "\"," }'
 */
char const *fr_dhcpv6_packet_names[FR_DHCPV6_CODE_MAX] = {
         [0]                                            = "invalid",
         [FR_PACKET_TYPE_VALUE_SOLICIT]                 = "Solicit",
         [FR_PACKET_TYPE_VALUE_ADVERTISE]               = "Advertise",
         [FR_PACKET_TYPE_VALUE_REQUEST]                 = "Request",
         [FR_PACKET_TYPE_VALUE_CONFIRM]                 = "Confirm",
         [FR_PACKET_TYPE_VALUE_RENEW]                   = "Renew",
         [FR_PACKET_TYPE_VALUE_REBIND]                  = "Rebind",
         [FR_PACKET_TYPE_VALUE_REPLY]                   = "Reply",
         [FR_PACKET_TYPE_VALUE_RELEASE]                 = "Release",
         [FR_PACKET_TYPE_VALUE_DECLINE]                 = "Decline",
         [FR_PACKET_TYPE_VALUE_RECONFIGURE]             = "Reconfigure",
         [FR_PACKET_TYPE_VALUE_INFORMATION_REQUEST]     = "Information-Request",
         [FR_PACKET_TYPE_VALUE_RELAY_FORWARD]           = "Relay-Forward",
         [FR_PACKET_TYPE_VALUE_RELAY_REPLY]             = "Relay-Reply",
         [FR_PACKET_TYPE_VALUE_LEASE_QUERY]             = "Lease-Query",
         [FR_PACKET_TYPE_VALUE_LEASE_QUERY_REPLY]       = "Lease-Query-Reply",
         [FR_PACKET_TYPE_VALUE_LEASE_QUERY_DONE]        = "Lease-Query-Done",
         [FR_PACKET_TYPE_VALUE_LEASE_QUERY_DATA]        = "Lease-Query-Data",
         [FR_PACKET_TYPE_VALUE_RECONFIGURE_REQUEST]     = "Reconfigure-Request",
         [FR_PACKET_TYPE_VALUE_RECONFIGURE_REPLY]       = "Reconfigure-Reply",
         [FR_PACKET_TYPE_VALUE_DHCPV4_QUERY]            = "DHCPv4-Query",
         [FR_PACKET_TYPE_VALUE_DHCPV4_RESPONSE]         = "DHCPv4-Response",
         [FR_PACKET_TYPE_VALUE_ACTIVE_LEASE_QUERY]      = "Active-Lease-Query",
         [FR_PACKET_TYPE_VALUE_START_TLS]               = "Start-TLS",
         [FR_PACKET_TYPE_VALUE_BIND_UPDATE]             = "Bind-Update",
         [FR_PACKET_TYPE_VALUE_BIND_REPLY]              = "Bind-Reply",
         [FR_PACKET_TYPE_VALUE_POOL_REQUEST]            = "Pool-Request",
         [FR_PACKET_TYPE_VALUE_POOL_RESPONSE]           = "Pool-Response",
         [FR_PACKET_TYPE_VALUE_UPDATE_REQUEST]          = "Update-Request",
         [FR_PACKET_TYPE_VALUE_UPDATE_REQUEST_ALL]      = "Update-Request-All",
         [FR_PACKET_TYPE_VALUE_UPDATE_DONE]             = "Update-Done",
         [FR_PACKET_TYPE_VALUE_CONNECT]                 = "Connect",
         [FR_PACKET_TYPE_VALUE_CONNECT_REPLY]           = "Connect-Reply",
         [FR_PACKET_TYPE_VALUE_DISCONNECT]              = "Disconnect",
         [FR_PACKET_TYPE_VALUE_STATE]                   = "State",
         [FR_PACKET_TYPE_VALUE_CONTACT]                 = "Contact"
};
 
FR_DICT_ATTR_FLAG_FUNC(fr_dhcpv6_attr_flags_t, dns_label)
FR_DICT_ATTR_FLAG_FUNC(fr_dhcpv6_attr_flags_t, partial_dns_label)
 
static fr_dict_flag_parser_t const dhcpv6_flags[] = {
        { L("dns_label"),               { .func = dict_flag_dns_label } },
        { L("partial_dns_label"),       { .func = dict_flag_partial_dns_label } }
};
 
static ssize_t fr_dhcpv6_ok_internal(uint8_t const *packet, uint8_t const *end, size_t max_attributes, int depth);
 
static ssize_t fr_dhcpv6_options_ok(uint8_t const *packet, uint8_t const *end, size_t max_attributes,
                                    bool allow_relay, int depth)
{
        size_t attributes;
        uint8_t const *p;
 
        attributes = 0;
        p = packet;
 
        while (p < end) {
                uint16_t len;
 
                if ((size_t)(end - p) < DHCPV6_OPT_HDR_LEN) {
                        fr_strerror_const("Not enough room for option header");
                        return -(p - packet);
                }
 
                len = DHCPV6_GET_OPTION_LEN(p);
                if ((size_t)(end - p) < (DHCPV6_OPT_HDR_LEN + len)) {
                        fr_strerror_const("Option length overflows the packet");
                        return -(p - packet);
                }
 
                attributes++;
                if (attributes > (size_t) max_attributes) {
                        fr_strerror_const("Too many attributes");
                        return -(p - packet);
                }
 
                /*
                 *      Recurse into the Relay-Message attribute, but
                 *      only if the outer packet was a relayed message.
                 */
                if (allow_relay && (p[0] == 0) && (p[1] == attr_relay_message->attr)) {
                        ssize_t child;
 
                        /*
                         *      Recurse to check the encapsulated packet.
                         */
                        child = fr_dhcpv6_ok_internal(p + 4, p + 4 + len, max_attributes - attributes, depth + 1);
                        if (child <= 0) return -((p + 4) - packet) + child;
 
                        attributes += child;
                }
 
                p += DHCPV6_OPT_HDR_LEN + len;
        }
 
        return attributes;
}
 
static ssize_t fr_dhcpv6_ok_internal(uint8_t const *packet, uint8_t const *end, size_t max_attributes, int depth)
{
        uint8_t const   *p;
        ssize_t         attributes;
        bool            allow_relay;
        size_t          packet_len = end - packet;
 
        if (end == packet) {
                fr_strerror_const("Packet is empty");
                return 0;
        }
 
        if (depth > DHCPV6_MAX_RELAY_NESTING) {
                fr_strerror_const("Too many layers forwarded packets");
                return 0;
        }
 
        switch (packet[0]) {
        case FR_DHCPV6_RELAY_FORWARD:
        case FR_DHCPV6_RELAY_REPLY:
                if (packet_len < DHCPV6_RELAY_HDR_LEN) {
                        fr_strerror_const("Packet is too small for relay header");
                        return 0;
                }
 
                p = packet + DHCPV6_RELAY_HDR_LEN;
                allow_relay = true;
                break;
 
        case 0:
                fr_strerror_const("Invalid Message type 0");
                return 0;
 
        default:
                /*
                 *      8 bit code + 24 bits of transaction ID
                 */
                if (packet_len < DHCPV6_HDR_LEN) {
                        fr_strerror_const("Packet is too small for DHCPv6 header");
                        return 0;
                }
 
                p = packet + DHCPV6_HDR_LEN;
                allow_relay = false;
                break;
        }
 
        attributes = fr_dhcpv6_options_ok(p, end, max_attributes, allow_relay, depth);
        if (attributes < 0) return -(p - packet) + attributes;
 
        return attributes;
}
 
 
/** See if the data pointed to by PTR is a valid DHCPv6 packet.
 *
 * @param[in] packet            to check.
 * @param[in] packet_len        The size of the packet data.
 * @param[in] max_attributes    to allow in the packet.
 * @return
 *      - True on success.
 *      - False on failure.
 */
bool fr_dhcpv6_ok(uint8_t const *packet, size_t packet_len, uint32_t max_attributes)
{
        ssize_t slen;
 
        slen = fr_dhcpv6_ok_internal(packet, packet + packet_len, max_attributes, 0);
        if (slen <= 0) {
                fr_strerror_printf_push("Invalid DHCPv6 packet starting at offset %zd", -slen);
                return false;
        }
 
        return true;
}
 
/*
 *      Return pointer to a particular option.
 */
uint8_t const *fr_dhcpv6_option_find(uint8_t const *start, uint8_t const *end, unsigned int option)
{
        uint8_t const *p = start;
 
        while (p < end) {
                uint16_t found;
                uint16_t len;
 
                if ((size_t)(end - p) < DHCPV6_OPT_HDR_LEN) return NULL;
 
                found = DHCPV6_GET_OPTION_NUM(p);
                len = DHCPV6_GET_OPTION_LEN(p);
 
                if ((p + DHCPV6_OPT_HDR_LEN + len) > end) return NULL;
 
                if (found == option) return p;
 
                p += DHCPV6_OPT_HDR_LEN + len;
        }
 
        return NULL;
}
 
static bool duid_match(uint8_t const *option, fr_dhcpv6_decode_ctx_t const *packet_ctx)
{
        uint16_t len;
 
        len = DHCPV6_GET_OPTION_LEN(option);
        if (len != packet_ctx->duid_len) return false;
        if (memcmp(option + 4, packet_ctx->duid, packet_ctx->duid_len) != 0) return false;
 
        return true;
}
 
/** Verify a reply packet from a server to a client
 *
 */
static bool verify_to_client(uint8_t const *packet, size_t packet_len, fr_dhcpv6_decode_ctx_t const *packet_ctx)
{
        uint32_t transaction_id;
        uint8_t const *option;
        uint8_t const *options = packet + 4;
        uint8_t const *end = packet + packet_len;
 
        switch (packet[0]) {
        case FR_PACKET_TYPE_VALUE_ADVERTISE:
                transaction_id = fr_nbo_to_uint24(&packet[1]);
                if (transaction_id != packet_ctx->transaction_id) {
                fail_tid:
                        fr_strerror_const("Transaction ID does not match");
                        return false;
                }
 
                if (!fr_dhcpv6_option_find(options, end, FR_SERVER_ID)) {
                fail_sid:
                        fr_strerror_const("Packet does not contain a Server-Id option");
                        return false;
                }
 
                option = fr_dhcpv6_option_find(options, end, FR_CLIENT_ID);
                if (!option) {
                fail_cid:
                        fr_strerror_const("Packet does not contain a Client-Id option");
                        return false;
                }
 
                /*
                 *      The DUID MUST exist.
                 */
                if (!packet_ctx->duid) {
                fail_duid:
                        fr_strerror_const("Packet context does not contain a DUID");
                        return false;
                }
 
        check_duid:
                if (!duid_match(option, packet_ctx)) {
                fail_match:
                        fr_strerror_const("DUID in packet does not match our DUID");
                        return false;
                }
                return true;
 
        case FR_PACKET_TYPE_VALUE_REPLY:
                transaction_id = fr_nbo_to_uint24(&packet[1]);
                if (transaction_id != packet_ctx->transaction_id) goto fail_tid;
 
                if (!fr_dhcpv6_option_find(options, end, FR_SERVER_ID)) goto fail_sid;
 
                /*
                 *      It's OK to not have a client ID in the reply if we didn't send one.
                 */
                option = fr_dhcpv6_option_find(options, end, FR_CLIENT_ID);
                if (!option) {
                        if (!packet_ctx->duid) return true;
                        goto fail_cid;
                }
                goto check_duid;
 
        case FR_PACKET_TYPE_VALUE_RECONFIGURE:
#if 1
                /*
                 *      See RFC 8415 Section 18 (option format), and Section 20 (functionality).
                 *
                 *      In order to support sending Reconfigure messages, we have to support the Auth option.
                 *      Except that common clients don't support it:
                 *
                 *      https://www.cisco.com/c/en/us/td/docs/routers/asr920/configuration/guide/ipaddr-dhcp/17-1-1/b-dhcp-xe-17-1-asr920/b-dhcp-xe-17-1-asr920_chapter_0101.html
                 *
                 *      "DHCPv6 Reconfigure message type is not be supported on the Cisco ASR920 Series routers."
                 *
                 *      So we don't support it, either.  The rest of the comments here are notes about what we
                 *      would need to do in order to support Reconfigure, and the Auth option.
                 *
                 *      If auth.type == 1, the contents of the attribute are just a reconfigure key, which is
                 *      sent over the network in the clear.  The server has to get the key from somewhere, OR
                 *      create it from a CSRNG and then store it.  The client just stores it somewhere.
                 *      Except that the key is sent over the network in the clear, which make is pretty much
                 *      useless for security.
                 *
                 *      If auth.type == 2, then we need to check the encode/decode context for a key, and if
                 *      not fail.
                 *
                 *      For encode, encode the structure and remember in the encode context where we encoded
                 *      it.  Then when we are finished encoding the entire packet, go back and do an HMAC-MD5
                 *      over the packet and update the auth.value field.
                 *
                 *      We also have to ignore any supplied auth.rdm and auth.replay-detection field, and then
                 *      force auth.rdm=0, and set auth.reply-detection to the current 64-bit NTP time.  The
                 *      replay-detection field is a monotonically increasing 64-bit value which is saved
                 *      across server restarts.  So an NTP time is the easiest way to manage that.
                 *
                 *      For decode, we have to check the reply-detection field, and fail if it's smaller than
                 *      what we expect.  Then, remember where the Auth option is in the packet, go back and do
                 *      an HMAC-MD5 over the packet.
                 *
                 *      See also references to attr_auth in encode.c and decode.c.
                 */
                fr_strerror_const("Sending Reconfigure to a client is not supported");
                return false;
#else
                if (!fr_dhcpv6_option_find(options, end, FR_SERVER_ID)) goto fail_sid;
 
                option = fr_dhcpv6_option_find(options, end, FR_CLIENT_ID);
                if (!option) goto fail_cid;
 
                /*
                 *      The DUID MUST exist.
                 */
                if (!packet_ctx->duid) goto fail_duid;
                if (!duid_match(option, packet_ctx)) goto fail_match;
 
                option = fr_dhcpv6_option_find(options, end, FR_RECONF_MSG);
                if (!option) {
                        fr_strerror_const("Packet does not contain a Reconf-Msg option");
                        return false;
                }
 
                /*
                 *      Check reconfigure message type, and reject
                 *      if it is not valid.
                 */
                switch (option[4]) {
                case FR_DHCPV6_RENEW:
                case FR_DHCPV6_REBIND:
                case FR_DHCPV6_INFORMATION_REQUEST:
                        break;
                default:
                        fr_strerror_const("Invalid Reconf-Msg option value");
                        return false;
                }
 
                /*
                 *      @todo - Do an HMAC-MD5 of the Auth option.
                 */
                break;
#endif
 
        case FR_DHCPV6_RELAY_REPLY:
                if (packet_len < DHCPV6_RELAY_HDR_LEN) {
                        fr_strerror_const("Relay-Reply message is too small");
                        return false;
                }
 
                options += (DHCPV6_RELAY_HDR_LEN - 4); /* we assumed it was a normal packet above  */
                option = fr_dhcpv6_option_find(options, end, FR_RELAY_MESSAGE);
                if (!option) {
                        fr_strerror_const("Packet does not contain a Relay-Message option");
                        return false;
                }
                return verify_to_client(option + 4, DHCPV6_GET_OPTION_LEN(option), packet_ctx);
 
        case FR_DHCPV6_LEASE_QUERY_REPLY:
                transaction_id = fr_nbo_to_uint24(&packet[1]);
                if (transaction_id != packet_ctx->transaction_id) goto fail_tid;
 
                if (!fr_dhcpv6_option_find(options, end, FR_SERVER_ID)) goto fail_sid;
 
                option = fr_dhcpv6_option_find(options, end, FR_CLIENT_ID);
                if (!option) goto fail_cid;
 
                /*
                 *      The DUID MUST exist.
                 */
                if (!packet_ctx->duid) goto fail_duid;
                if (!duid_match(option, packet_ctx)) goto fail_match;
                break;
 
        case FR_PACKET_TYPE_VALUE_REQUEST:
        case FR_PACKET_TYPE_VALUE_CONFIRM:
        case FR_PACKET_TYPE_VALUE_RENEW:
        case FR_PACKET_TYPE_VALUE_REBIND:
        case FR_PACKET_TYPE_VALUE_RELEASE:
        case FR_PACKET_TYPE_VALUE_DECLINE:
        case FR_PACKET_TYPE_VALUE_INFORMATION_REQUEST:
        default:
                fr_strerror_const("Invalid message type sent to client");
                return false;
        }
 
        return true;
}
 
 
/** Verify a packet from a client to a server
 *
 */
static bool verify_from_client(uint8_t const *packet, size_t packet_len, fr_dhcpv6_decode_ctx_t const *packet_ctx)
{
        uint8_t const *option;
        uint8_t const *options = packet + 4;
        uint8_t const *end = packet + packet_len;
 
        /*
         *      Servers MUST have a DUID
         */
        if (!packet_ctx->duid) {
                fr_strerror_const("Packet context does not contain a DUID");
                return false;
        }
 
        switch (packet[0]) {
        case FR_PACKET_TYPE_VALUE_SOLICIT:
        case FR_PACKET_TYPE_VALUE_CONFIRM:
        case FR_PACKET_TYPE_VALUE_REBIND:
                if (!fr_dhcpv6_option_find(options, end, FR_CLIENT_ID)) {
                fail_cid:
                        fr_strerror_const("Packet does not contain a Client-Id option");
                        return false;
                }
 
                if (fr_dhcpv6_option_find(options, end, FR_SERVER_ID)) {
                        fr_strerror_const("Packet contains a Server-Id option");
                        return false;
                }
                break;
 
        case FR_PACKET_TYPE_VALUE_REQUEST:
        case FR_PACKET_TYPE_VALUE_RENEW:
        case FR_PACKET_TYPE_VALUE_DECLINE:
        case FR_PACKET_TYPE_VALUE_RELEASE:
                if (!fr_dhcpv6_option_find(options, end, FR_CLIENT_ID)) goto fail_cid;
 
                option = fr_dhcpv6_option_find(options, end, FR_SERVER_ID);
                if (!option) {
                        fr_strerror_const("Packet does not contain a Server-Id option");
                        return false;
                }
 
                if (!duid_match(option, packet_ctx)) {
                fail_match:
                        fr_strerror_const("DUID in packet does not match our DUID");
                        return false;
                }
                break;
 
        case FR_PACKET_TYPE_VALUE_INFORMATION_REQUEST:
                option = fr_dhcpv6_option_find(options, end, FR_SERVER_ID);
                if (option && !duid_match(option, packet_ctx)) goto fail_match;
 
                /*
                 *      IA options are forbidden.
                 */
                if (fr_dhcpv6_option_find(options, end, FR_IA_NA)) {
                        fr_strerror_const("Packet contains an IA-NA option");
                        return false;
                }
                if (fr_dhcpv6_option_find(options, end, FR_IA_TA)) {
                        fr_strerror_const("Packet contains an IA-TA option");
                        return false;
                }
                if (fr_dhcpv6_option_find(options, end, FR_IA_ADDR)) {
                        fr_strerror_const("Packet contains an IA-Addr option");
                        return false;
                }
                break;
 
        case FR_DHCPV6_RELAY_FORWARD:
                if (packet_len < DHCPV6_RELAY_HDR_LEN) {
                        fr_strerror_const("Relay-Forward message is too small");
                        return false;
                }
 
                options += (DHCPV6_RELAY_HDR_LEN - 4); /* we assumed it was a normal packet above  */
                option = fr_dhcpv6_option_find(options, end, FR_RELAY_MESSAGE);
                if (!option) {
                        fr_strerror_const("Packet does not contain a Relay-Message option");
                        return false;
                }
 
                return verify_from_client(option + 4, DHCPV6_GET_OPTION_LEN(option), packet_ctx);
 
        case FR_PACKET_TYPE_VALUE_LEASE_QUERY:
                if (!fr_dhcpv6_option_find(options, end, FR_CLIENT_ID)) goto fail_cid;
 
                /*
                 *      Server-ID is a SHOULD, but if it exists, it
                 *      MUST match.
                 */
                option = fr_dhcpv6_option_find(options, end, FR_SERVER_ID);
                if (option && !duid_match(option, packet_ctx)) goto fail_match;
 
                option = fr_dhcpv6_option_find(options, end, FR_LEASE_QUERY);
                if (!option) {
                        fr_strerror_const("Packet does not contain a Lease-Query option");
                        return false;
                }
                break;
 
        case FR_PACKET_TYPE_VALUE_ADVERTISE:
        case FR_PACKET_TYPE_VALUE_REPLY:
        case FR_PACKET_TYPE_VALUE_RECONFIGURE:
        default:
                fr_strerror_const("Invalid message type sent to server");
                return false;
        }
        return true;
}
 
/** Verify the packet under some various circumstances
 *
 * @param[in] packet            to check.
 * @param[in] packet_len        The size of the packet data.
 * @param[in] packet_ctx        The expected packet_ctx
 * @param[in] from_server       true for packets from a server, false for packets from a client.
 * @return
 *      - True on success.
 *      - False on failure.
 *
 *      fr_dhcpv6_ok() SHOULD be called before calling this function.
 */
bool fr_dhcpv6_verify(uint8_t const *packet, size_t packet_len, fr_dhcpv6_decode_ctx_t const *packet_ctx,
                      bool from_server)
{
        if (packet_len < DHCPV6_HDR_LEN) return false;
 
        /*
         *      We support up to lease query reply.
         */
        if ((packet[0] == 0) || (packet[0] > FR_DHCPV6_LEASE_QUERY_REPLY)) return false;
 
        if (from_server) return verify_to_client(packet, packet_len, packet_ctx);
 
        return verify_from_client(packet, packet_len, packet_ctx);
}
 
/*
 
       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |    msg-type   |               transaction-id                  |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                                                               |
      .                            options                            .
      .                 (variable number and length)                  .
      |                                                               |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
*/
 
/** Decode a DHCPv6 packet
 *
 */
ssize_t fr_dhcpv6_decode(TALLOC_CTX *ctx, fr_pair_list_t *out, uint8_t const *packet, size_t packet_len)
{
        ssize_t                 slen = -1;
        uint8_t const           *p, *end;
        fr_dhcpv6_decode_ctx_t  packet_ctx = {};
        fr_pair_t               *vp;
        fr_pair_list_t          tmp;
 
        if (packet_len < DHCPV6_HDR_LEN) return 0; /* protect access to packet[0] */
 
        /*
         *      Get the packet type.
         */
        vp = fr_pair_afrom_da(ctx, attr_packet_type);
        if (!vp) return -1;
 
        fr_pair_list_init(&tmp);
        vp->vp_uint32 = packet[0];
        fr_pair_append(&tmp, vp);
 
        switch (packet[0]) {
        case FR_DHCPV6_RELAY_FORWARD:
        case FR_DHCPV6_RELAY_REPLY:
                /*
                 *      Just for sanity check.
                 */
                if (packet_len < DHCPV6_RELAY_HDR_LEN) return -1;
 
                /*
                 *      Decode the header fields.
                 */
                vp = fr_pair_afrom_da(ctx, attr_hop_count);
                if (!vp) goto fail;
                if (fr_value_box_from_network(vp, &vp->data, vp->vp_type, NULL,
                                              &FR_DBUFF_TMP(packet + 1, 1), 1, true) < 0) {
                        talloc_free(vp);
                        goto fail;
                }
                fr_pair_append(&tmp, vp);
 
                vp = fr_pair_afrom_da(ctx, attr_relay_link_address);
                if (!vp) goto fail;
                if (fr_value_box_from_network(vp, &vp->data, vp->vp_type, NULL,
                                              &FR_DBUFF_TMP(packet + 2, 16), 16, true) < 0) {
                        talloc_free(vp);
                        goto fail;
                }
                fr_pair_append(&tmp, vp);
 
                vp = fr_pair_afrom_da(ctx, attr_relay_peer_address);
                if (!vp) goto fail;
                if (fr_value_box_from_network(vp, &vp->data, vp->vp_type, NULL,
                                              &FR_DBUFF_TMP(packet + 2 + 16, 16), 16, true) < 0) {
                        talloc_free(vp);
                        goto fail;
                }
 
                fr_pair_append(&tmp, vp);
 
                p = packet + DHCPV6_RELAY_HDR_LEN;
                goto decode_options;
 
        default:
                break;
        }
 
        /*
         *      And the transaction ID.
         */
        vp = fr_pair_afrom_da(ctx, attr_transaction_id);
        if (!vp) {
        fail:
                fr_pair_list_free(&tmp);
                return slen;
        }
 
        /*
         *      Copy 3 octets over.
         */
        (void) fr_pair_value_memdup(vp, packet + 1, 3, false);
 
        fr_pair_append(&tmp, vp);
 
        p = packet + 4;
 
decode_options:
        end = packet + packet_len;
        packet_ctx.tmp_ctx = talloc_init_const("tmp");
 
        /*
         *      The caller MUST have called fr_dhcpv6_ok() first.  If
         *      he doesn't, all hell breaks loose.
         */
        while (p < end) {
                slen = fr_dhcpv6_decode_option(ctx, &tmp, p, (end - p), &packet_ctx);
                if (slen < 0) {
                        talloc_free(packet_ctx.tmp_ctx);
                        goto fail;
                }
                /*
                 *      If slen is larger than the room in the packet,
                 *      all kinds of bad things happen.
                 */
                 if (!fr_cond_assert(slen <= (end - p))) {
                        talloc_free(packet_ctx.tmp_ctx);
                        goto fail;
                }
 
                 p += slen;
                 talloc_free_children(packet_ctx.tmp_ctx);
        }
        fr_pair_list_append(out, &tmp);
 
        /*
         *      We've parsed the whole packet, return that.
         */
        talloc_free(packet_ctx.tmp_ctx);
        return packet_len;
}
 
/** DHCPV6-specific iterator
 *
 */
void *fr_dhcpv6_next_encodable(fr_dcursor_t *cursor, void *current, void *uctx)
{
        fr_pair_t       *c = current;
        fr_dict_t       *dict = talloc_get_type_abort(uctx, fr_dict_t);
 
        while ((c = fr_dlist_next(cursor->dlist, c))) {
                PAIR_VERIFY(c);
                if (c->da->dict != dict || c->da->flags.internal) continue;
                if (c->vp_type == FR_TYPE_BOOL && !c->vp_bool) continue;
 
                break;
        }
 
        return c;
}
 
/** Encode a DHCPv6 packet
 *
 */
ssize_t fr_dhcpv6_encode(fr_dbuff_t *dbuff, uint8_t const *original, size_t length, int msg_type, fr_pair_list_t *vps)
{
        fr_dbuff_t              frame_dbuff = FR_DBUFF(dbuff);
        fr_pair_t               *vp;
        fr_dict_attr_t const    *root;
        ssize_t                 slen;
        fr_dcursor_t            cursor;
        fr_dhcpv6_encode_ctx_t  packet_ctx;
 
        root = fr_dict_root(dict_dhcpv6);
 
        if (!msg_type) {
                vp = fr_pair_find_by_da(vps, NULL, attr_packet_type);
                if (vp) msg_type = vp->vp_uint32;
        }
 
        if ((msg_type <= 0) || (msg_type > UINT8_MAX)) {
                fr_strerror_printf("Invalid message type %d", msg_type);
                return -1;
        }
 
        FR_DBUFF_IN_RETURN(&frame_dbuff, (uint8_t)msg_type);
 
        switch (msg_type) {
        case FR_DHCPV6_RELAY_REPLY:
        case FR_DHCPV6_RELAY_FORWARD:
                vp = fr_pair_find_by_da(vps, NULL, attr_hop_count);
                if (likely(vp != NULL)) {
                        FR_VALUE_BOX_TO_NETWORK_RETURN(&frame_dbuff, &vp->data);
                } else {
                        FR_DBUFF_MEMSET_RETURN(&frame_dbuff, 0, DHCPV6_HOP_COUNT_LEN);
                }
 
                vp = fr_pair_find_by_da(vps, NULL, attr_relay_link_address);
                if (likely(vp != NULL)) {
                        FR_VALUE_BOX_TO_NETWORK_RETURN(&frame_dbuff, &vp->data);
                } else {
                        FR_DBUFF_MEMSET_RETURN(&frame_dbuff, 0, DHCPV6_LINK_ADDRESS_LEN);
                }
 
                vp = fr_pair_find_by_da(vps, NULL, attr_relay_peer_address);
                if (likely(vp != NULL)) {
                        FR_VALUE_BOX_TO_NETWORK_RETURN(&frame_dbuff, &vp->data);
                } else {
                        FR_DBUFF_MEMSET_RETURN(&frame_dbuff, 0, DHCPV6_PEER_ADDRESS_LEN);
                }
                break;
 
        default:
                /*
                 *      We can set an XID, or we can pick a random one.
                 */
                vp = fr_pair_find_by_da(vps, NULL, attr_transaction_id);
                if (vp && (vp->vp_length >= DHCPV6_TRANSACTION_ID_LEN)) {
                        FR_DBUFF_IN_MEMCPY_RETURN(&frame_dbuff, vp->vp_octets, DHCPV6_TRANSACTION_ID_LEN);
                } else {
                        uint8_t id[DHCPV6_TRANSACTION_ID_LEN];
                        fr_nbo_from_uint24(id, fr_rand());
                        FR_DBUFF_IN_MEMCPY_RETURN(&frame_dbuff, id, sizeof(id)); /* Need 24 bits of the 32bit integer */
                }
                break;
        }
 
        /*
         * Encode options.
         */
        packet_ctx.root = root;
        packet_ctx.original = original;
        packet_ctx.original_length = length;
 
        fr_pair_dcursor_iter_init(&cursor, vps, fr_dhcpv6_next_encodable, dict_dhcpv6);
        while ((fr_dbuff_extend(&frame_dbuff) > 0) && (fr_dcursor_current(&cursor) != NULL)) {
                slen = fr_dhcpv6_encode_option(&frame_dbuff, &cursor, &packet_ctx);
                if (slen < 0) return FR_DBUFF_ERROR_OFFSET(slen, fr_dbuff_used(&frame_dbuff));
        }
 
        return fr_dbuff_set(dbuff, &frame_dbuff);
}
 
 
static char const tabs[] = "\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t";
 
static void print_hex_data(FILE *fp, uint8_t const *ptr, int attrlen, int depth)
{
        int i;
 
        for (i = 0; i < attrlen; i++) {
                if ((i > 0) && ((i & 0x0f) == 0x00))
                        fprintf(fp, "%.*s", depth, tabs);
                fprintf(fp, "%02x ", ptr[i]);
                if ((i & 0x0f) == 0x0f) fprintf(fp, "\n");
        }
        if ((i & 0x0f) != 0) fprintf(fp, "\n");
}
 
static void dhcpv6_print_hex(FILE *fp, uint8_t const *packet, size_t packet_len, int depth)
{
        uint8_t const *option, *end = packet + packet_len;
 
        if (packet_len < 4) {
                fprintf(fp, "%.*s", depth, tabs);
                fprintf(fp, "???:\t");
                print_hex_data(fp, packet, packet_len, depth + 1);
                return;
        }
 
        fprintf(fp, "%.*s", depth, tabs);
        if ((packet[0] > 0) && (packet[0] < FR_DHCPV6_CODE_MAX)) {
                fprintf(fp, "packet: %s\n", fr_dhcpv6_packet_names[packet[0]]);
        } else {
                fprintf(fp, "packet: %02x\n", packet[0]);
        }
 
        if ((packet[0] == FR_PACKET_TYPE_VALUE_RELAY_FORWARD) ||
            (packet[0] == FR_PACKET_TYPE_VALUE_RELAY_REPLY)) {
                if (packet_len < 34) {
                        fprintf(fp, "%.*s", depth, tabs);
                        fprintf(fp, "???:\t");
                        print_hex_data(fp, packet + 1, packet_len - 1, depth + 1);
                        return;
                }
 
                fprintf(fp, "%.*s", depth, tabs);
                fprintf(fp, "hops: %02x\n", packet[1]);
                fprintf(fp, "%.*s", depth, tabs);
                fprintf(fp, "relay link address: ");
                print_hex_data(fp, packet + 2, 16, depth + 1);
 
                fprintf(fp, "%.*s", depth, tabs);
                fprintf(fp, "peer address:       ");
                print_hex_data(fp, packet + 18, 16, depth + 1);
                option = packet + 34;
        } else {
                fprintf(fp, "%.*s", depth, tabs);
                fprintf(fp, "transaction id: ");
                print_hex_data(fp, packet + 1, 3, depth + 1);
                option = packet + 4;
        }
 
        fprintf(fp, "%.*s", depth, tabs);
        fprintf(fp, "options\n");
        while (option < end) {
                uint16_t length;
 
                if ((end - option) < 4) {
                        fprintf(fp, "%.*s", depth + 1, tabs);
                        fprintf(fp, "???:\t");
                        print_hex_data(fp, option, end - option, depth + 2);
                        break;
                }
 
                length = fr_nbo_to_uint16(option + 2);
                fprintf(fp, "%.*s", depth + 1, tabs);
                fprintf(fp, "%04x %04x\t", fr_nbo_to_uint16(option), length);
 
                if (length > end - (option + 4)) {
                        print_hex_data(fp, option + 4, end - (option + 4), depth + 3);
                        break;
                }
 
                print_hex_data(fp, option + 4, length, depth + 3);
                if ((option[0] == 0) && (option[1] == attr_relay_message->attr)) {
                        dhcpv6_print_hex(fp, option + 4, length, depth + 2);
                }
 
                option += 4 + length;
        }
 
        fprintf(fp, "\n");
}
 
/** Print a raw DHCP packet as hex.
 *
 */
void fr_dhcpv6_print_hex(FILE *fp, uint8_t const *packet, size_t packet_len)
{
        dhcpv6_print_hex(fp, packet, packet_len, 0);
}
 
int fr_dhcpv6_global_init(void)
{
        if (instance_count > 0) {
                instance_count++;
                return 0;
        }
 
        instance_count++;
 
        if (fr_dict_autoload(libfreeradius_dhcpv6_dict) < 0) {
        fail:
                instance_count--;
                return -1;
        }
 
        if (fr_dict_attr_autoload(libfreeradius_dhcpv6_dict_attr) < 0) {
                fr_dict_autofree(libfreeradius_dhcpv6_dict);
                goto fail;
        }
 
        instantiated = true;
        return 0;
}
 
void fr_dhcpv6_global_free(void)
{
        if (!instantiated) return;
 
        fr_assert(instance_count > 0);
 
        if (--instance_count > 0) return;
 
        fr_dict_autofree(libfreeradius_dhcpv6_dict);
        instantiated = false;
}
 
static bool attr_valid(fr_dict_attr_t *da)
{
        /*
         *      DNS labels are strings, but are known width.
         */
        if (fr_dhcpv6_flag_any_dns_label(da)) {
                if (da->type != FR_TYPE_STRING) {
                        fr_strerror_const("The 'dns_label' flag can only be used with attributes of type 'string'");
                        return false;
                }
 
                da->flags.is_known_width = true;
                da->flags.length = 0;
        }
 
        if (da->type == FR_TYPE_ATTR)  {
                if (!da->parent->flags.is_root) {
                        fr_strerror_const("Data type 'attribute' can only be used at the dictionary root");
                        return false;
                }
 
                da->flags.is_known_width = true;
                da->flags.length = 2;
        }
 
        if (da_is_length_field8(da)) {
                fr_strerror_const("The 'length=uint8' flag cannot be used for DHCPv6");
                return false;
        }
 
        /*
         *      "arrays" of string/octets are encoded as a 16-bit
         *      length, followed by the actual data.
         */
        if (da->flags.array) {
                if ((da->type == FR_TYPE_STRING) || (da->type == FR_TYPE_OCTETS)) {
                        if (da->flags.extra && !da_is_length_field16(da)) {
                                fr_strerror_const("Invalid flags");
                                return false;
                        }
 
                        da->flags.is_known_width = true;
                        da->flags.extra = true;
                        da->flags.subtype = FLAG_LENGTH_UINT16;
                }
 
                if (!da->flags.is_known_width) {
                        fr_strerror_const("DHCPv6 arrays require data types which have known width");
                        return false;
                }
        }
 
        /*
         *      "extra" signifies that subtype is being used by the
         *      dictionaries itself.
         */
        if (da->flags.extra || !da->flags.subtype) return true;
 
        if ((da->type == FR_TYPE_ATTR) && !da->parent->flags.is_root) {
                fr_strerror_const("The 'attribute' data type can only be used at the dictionary root");
                return false;
        }
 
        da->flags.is_known_width = true;
 
        return true;
}
 
extern fr_dict_protocol_t libfreeradius_dhcpv6_dict_protocol;
fr_dict_protocol_t libfreeradius_dhcpv6_dict_protocol = {
        .name = "dhcpv6",
        .default_type_size = 2,
        .default_type_length = 2,
 
        .attr = {
                .valid = attr_valid,
                .flags = {
                        .table = dhcpv6_flags,
                        .table_len = NUM_ELEMENTS(dhcpv6_flags),
                        .len = sizeof(fr_dhcpv6_attr_flags_t)
                }
        },
 
        .init = fr_dhcpv6_global_init,
        .free = fr_dhcpv6_global_free,
 
        .encode         = fr_dhcpv6_encode_foreign,
        .decode         = fr_dhcpv6_decode_foreign,
};