bfd: fix missing Authentication in control pkt

According RFC 5880, add a simpilfed version handling authentication
Signed-off-by: zmw12306 <zmw12306@gmail.com>
(cherry picked from commit 98707b04d425dfcc24670704d268a733bbf0bc3f)

diff --git a/bfdd/bfd.h b/bfdd/bfd.h
index 5451e66c23dfd476e32e889f2ab9cb8d869ab273..69529aba171a901682aa7279e6587f2d6a528344 100644 (file)
--- a/bfdd/bfd.h
+++ b/bfdd/bfd.h
@@ -32,6 +32,11 @@ DECLARE_MGROUP(BFDD);
 DECLARE_MTYPE(BFDD_CONTROL);
 DECLARE_MTYPE(BFDD_NOTIFICATION);
 
+/* bfd Authentication Type. */
+#define BFD_AUTH_NULL 0
+#define BFD_AUTH_SIMPLE 1
+#define BFD_AUTH_CRYPTOGRAPHIC 2
+
 struct bfd_timers {
        uint32_t desired_min_tx;
        uint32_t required_min_rx;
@@ -60,6 +65,15 @@ struct bfd_pkt {
        struct bfd_timers timers;
 };
 
+/*
+ * Format of authentification.
+ */
+struct bfd_auth {
+       uint8_t type;
+       uint8_t length;
+};
+
+
 /*
  * Format of Echo packet.
  */

diff --git a/bfdd/bfd_packet.c b/bfdd/bfd_packet.c
index ea7a1038ae6b974b56bf337ad27bb50831137849..0c72ee75816d3bbd4bc479ca6acaa708d67a246c 100644 (file)
--- a/bfdd/bfd_packet.c
+++ b/bfdd/bfd_packet.c
@@ -768,6 +768,37 @@ static void cp_debug(bool mhop, struct sockaddr_any *peer,
                   mhop ? "yes" : "no", peerstr, localstr, portstr, vrfstr);
 }
 
+static bool bfd_check_auth(const struct bfd_session *bfd,
+                          const struct bfd_pkt *cp)
+{
+       if (CHECK_FLAG(cp->flags, BFD_ABIT)) {
+               /* RFC5880 4.1: Authentication Section is present. */
+               struct bfd_auth *auth = (struct bfd_auth *)(cp + 1);
+               uint16_t pkt_auth_type = ntohs(auth->type);
+
+               if (cp->len < BFD_PKT_LEN + sizeof(struct bfd_auth))
+                       return false;
+
+               if (cp->len < BFD_PKT_LEN + auth->length)
+                       return false;
+
+               switch (pkt_auth_type) {
+               case BFD_AUTH_NULL:
+                       return false;
+               case BFD_AUTH_SIMPLE:
+                       /* RFC5880 6.7: To be finshed. */
+                       return false;
+               case BFD_AUTH_CRYPTOGRAPHIC:
+                       /* RFC5880 6.7: To be finshed. */
+                       return false;
+               default:
+                       /* RFC5880 6.7: To be finshed. */
+                       return false;
+               }
+       }
+       return true;
+}
+
 void bfd_recv_cb(struct event *t)
 {
        int sd = EVENT_FD(t);
@@ -932,6 +963,13 @@ void bfd_recv_cb(struct event *t)
 
        bfd->discrs.remote_discr = ntohl(cp->discrs.my_discr);
 
+       /* Check authentication. */
+       if (!bfd_check_auth(bfd, cp)) {
+               cp_debug(is_mhop, &peer, &local, ifindex, vrfid,
+                        "Authentication failed");
+               return;
+       }
+
        /* Save remote diagnostics before state switch. */
        bfd->remote_diag = cp->diag & BFD_DIAGMASK;