metasploit-framework/lib/racket/l4/icmpv6.rb

# $Id: icmpv6.rb 157 2009-12-14 15:27:32Z jhart $
#
# Copyright (c) 2008, Jon Hart 
# All rights reserved.
# 
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#     * Redistributions of source code must retain the above copyright
#       notice, this list of conditions and the following disclaimer.
#     * Redistributions in binary form must reproduce the above copyright
#       notice, this list of conditions and the following disclaimer in the
#       documentation and/or other materials provided with the distribution.
#     * Neither the name of the <organization> nor the
#       names of its contributors may be used to endorse or promote products
#       derived from this software without specific prior written permission.
# 
# THIS SOFTWARE IS PROVIDED BY Jon Hart ``AS IS'' AND ANY
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL Jon Hart BE LIABLE FOR ANY
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
module Racket
module L4
# Internet Control Message Protcol, v6
#
# http://en.wikipedia.org/wiki/ICMPv6
#
# Generic ICMP class from which all ICMP variants spawn.  This should never be used directly.
class ICMPv6Generic < RacketPart
  ICMPv6_TYPE_ECHO_REPLY = 129
  ICMPv6_TYPE_DESTINATION_UNREACHABLE = 1
  ICMPv6_TYPE_PACKET_TOO_BIG = 2
  ICMPv6_TYPE_ECHO_REQUEST = 128
  ICMPv6_TYPE_TIME_EXCEEDED = 3
  ICMPv6_TYPE_PARAMETER_PROBLEM = 4
  ICMPv6_TYPE_MLD_QUERY = 130
  ICMPv6_TYPE_MLD_REPORT = 131
  ICMPv6_TYPE_MLD_DONE = 132
  ICMPv6_TYPE_ROUTER_SOLICITATION = 133
  ICMPv6_TYPE_ROUTER_ADVERTISEMENT = 134
  ICMPv6_TYPE_NEIGHBOR_SOLICITATION = 135
  ICMPv6_TYPE_NEIGHBOR_ADVERTISEMENT = 136
  ICMPv6_TYPE_REDIRECT = 137
  ICMPv6_TYPE_INFORMATION_REQUEST = 139
  ICMPv6_TYPE_INFORMATION_REPLY = 140

  # Type
  unsigned :type, 8
  # Code
  unsigned :code, 8
  # Checksum
  unsigned :checksum, 16
  rest :message

  # check the checksum for this ICMP packet
  def checksum?
    self.checksum == compute_checksum
  end

  def initialize(*args)
    super(*args)
    @autofix = false
  end

  # Add an ICMPv6 option.  RFC claims that the value should be padded (with what?)
  # to land on a 64-bit boundary, however that doesn't always appear to be the case.  so, yeah,
  # try to pad on your own or pick strings that are multiples of 8 characters
  def add_option(type, value)
    t = Misc::TLV.new(1,1)
    t.type = type
    t.length = (value.length + 2) / 8
    just = value.length + 2 + (8 - ((value.length + 2) % 8))
    t.value = (value.length + 2) % 8 == 0 ? value : value.ljust(just, "\x00")
    self.payload = t.encode + self.payload 
  end

  # ignorantly assume the first parts of the payload contain ICMPv6 options
  # and find a return an array of Racket::Misc::TLV representing the options
  def get_options
    p = self.payload
    options = []
    until ((o = Misc::TLV.new(1,1,8,true).decode(p)).nil?)
      options << o[0..2]
      p = o[3]
    end
    options
  end

  # compute and set the checksum for this ICMP packet
  def checksum!(src_ip, dst_ip)
    self.checksum = compute_checksum(src_ip, dst_ip)
  end

  # 'fix' this ICMP packet up for sending.
  # (really, just set the checksum)
  def fix!(src_ip, dst_ip)
    self.checksum!(src_ip, dst_ip)
  end

  # get the source link layer address of this message, if found
  def slla
    addr = nil
    self.get_options.each do |o|
      type, length, value, rest = o.flatten
      if (type == 1)
        addr = L2::Misc.string2mac(value)
      end
    end
    addr
  end

  # set the source link layer address of this message.
  # expects +addr+ in de:ad:ba:dc:af:e0 form
  def slla=(addr)
    self.add_option(1, L2::Misc.mac2string(addr))
  end

  # get the target link layer address of this message, if found
  def tlla
    addr = nil
    self.get_options.each do |o|
      type, length, value, rest = o.flatten
      if (type == 2)
        addr = L2::Misc.string2mac(value)
      end
    end
    addr
  end

  # set the target link layer address of this message
  # expects +addr+ in de:ad:ba:dc:af:e0 form
  def tlla=(addr)
    self.add_option(2, L2::Misc.mac2string(addr))
  end

private
  def compute_checksum(src_ip, dst_ip)
    s1 = src_ip >> 96 
    s2 = (src_ip >> 64) & 0xFFFFFFFF
    s3 = (src_ip >> 32) & 0xFFFFFFFF
    s4 = src_ip & 0xFFFFFFFF

    d1 = dst_ip >> 96 
    d2 = (dst_ip >> 64) & 0xFFFFFFFF
    d3 = (dst_ip >> 32) & 0xFFFFFFFF
    d4 = dst_ip & 0xFFFFFFFF

    # pseudo header used for checksum calculation as per RFC 768 
    pseudo = [ s1, s2, s3, s4, d1, d2, d3, d4, self.length, 58, self.type, self.code, 0, self.message ]
    L3::Misc.checksum(pseudo.pack("NNNNNNNNNNCCna*"))
  end
end
# Send raw ICMP packets of your own design
class ICMPv6 < ICMPv6Generic
  rest :payload
end

# Generic ICMPv6 echo, used by ICMPv6EchoRequest and ICMPv6EchoReply 
class ICMPv6Echo < ICMPv6Generic
  # identifier to aid in matching echo requests/replies
  unsigned :id, 16
  # sequence number to aid in matching requests/replies
  unsigned :sequence, 16
  rest :payload

  def initialize(*args)
    super(*args)
  end

end

# ICMPv6Echo Request
class ICMPv6EchoRequest < ICMPv6Echo
  rest :payload

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_ECHO_REQUEST
    self.code = 0
  end

end

# ICMPv6Echo Reply
class ICMPv6EchoReply < ICMPv6Echo
  rest :payload

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_ECHO_REPLY
    self.code = 0
  end
end

# ICMP Destination Unreachable Message
class ICMPv6DestinationUnreachable < ICMPv6Generic
  ICMPv6_CODE_NO_ROUTE = 0 
  ICMPv6_CODE_ADMIN_PROHIBITED = 1
  ICMPv6_CODE_BEYOND_SCOPE = 2 
  ICMPv6_CODE_ADDRESS_UNREACHABLE = 3 
  ICMPv6_CODE_PORT_UNREACHABLE = 4
  ICMPv6_CODE_FAILED_POLICY = 4 
  ICMPv6_CODE_REJECT_ROUTE = 5 
  # This is never used according to the RFC
  unsigned :unused, 32
  # Internet header + 64 bits of original datagram
  rest :payload

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_DESTINATION_UNREACHABLE
  end
end

class ICMPv6PacketTooBig < ICMPv6Generic
  # The Maximum Transmission Unit of the next-hop link
  unsigned :mtu, 32
  rest :payload

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_PACKET_TOO_BIG
  end

end

# ICMP Time Exceeded Message 
class ICMPv6TimeExceeded < ICMPv6Generic
  ICMPv6_CODE_TTL_EXCEEDED_IN_TRANSIT = 0 
  ICMPv6_CODE_FRAG_REASSEMBLY_TIME_EXCEEDED = 1
  # This is never used according to the RFC
  unsigned :unused, 32
  # As much of the original ICMPv6 packet without busting MTU
  rest :payload

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_TIME_EXCEEDED 
  end
end

# ICMPv6 Parameter Problem Message 
class ICMPv6ParameterProblem < ICMPv6Generic
  ICMPv6_CODE_ERRONEOUS_HEADER = 0
  ICMPv6_CODE_UNRECOGNIZED_NEXT_HEADER = 1
  ICMPv6_CODE_UNRECOGNIZED_OPTION = 2
  # pointer to the octet where the error was detected
  unsigned :pointer, 32 
  # As much of the original ICMPv6 packet without busting MTU
  rest :payload

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_PARAMETER_PROBLEM
  end
end

# ICMPv6 Multicast Listener Discovery (MLD)
# http://www.faqs.org/rfcs/rfc2710.html
class ICMPv6MulticastListener < ICMPv6Generic
  # maximum response delay
  unsigned :delay, 16
  # should be zero.  never used.
  unsigned :reserved, 16
  # multicast address
  unsigned :address, 128
  rest :payload

  def initialize(*args)
    super(*args)
  end
end

class ICMPv6MulticastListenerQuery < ICMPv6MulticastListener
  rest :payload

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_MLD_QUERY
  end
end

class ICMPv6MulticastListenerReport < ICMPv6MulticastListener
  rest :payload

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_MLD_REPORT
  end
end

class ICMPv6MulticastListenerDone < ICMPv6MulticastListener
  rest :payload

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_MLD_DONE
  end
end

# http://tools.ietf.org/html/rfc4861
class ICMPv6RouterSolicitation < ICMPv6Generic
  # should be 0, never used.
  unsigned :reserved, 32
  rest :payload

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_ROUTER_SOLICITATION
  end
end

# http://tools.ietf.org/html/rfc4861
class ICMPv6RouterAdvertisement < ICMPv6Generic
  # default value that should be placed in the hop count field of the IP header
  # for outgoing IP packets
  unsigned :hop_limit, 8
  # boolean, managed address configuration?
  unsigned :managed_config, 1
  # boolean, other configuration?
  unsigned :other_config, 1
  # set to 0, never used.
  unsigned :reserved, 6
  # lifetime associated with the default router in seconds
  unsigned :lifetime, 16
  # time in milliseconds that a node assumes a neighbor is reachable after having received a reachability confirmation
  unsigned :reachable_time, 32
  # time in milliseconds between retransmitted neighbor solicitation messages
  unsigned :retrans_time, 32
  rest :payload

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_ROUTER_ADVERTISEMENT
  end
end

# http://tools.ietf.org/html/rfc4861
class ICMPv6NeighborSolicitation < ICMPv6Generic
  # set to 0, never used.
  unsigned :reserved, 32
  # target address of the solicitation
  unsigned :address, 128
  rest :payload

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_NEIGHBOR_SOLICITATION
  end
end

# http://tools.ietf.org/html/rfc4861
class ICMPv6NeighborAdvertisement < ICMPv6Generic
  # normally this would be router (1), solicited (1), override(1) and reserved (2), however
  # a bit-struct byte boundary bug bites us here
  unsigned :bigbustedfield, 32
  # for solicited adverts, the target address field in the solicitation that prompted this.
  # for unsolicited adverts, the address whose link-layer address has changed 
  unsigned :address, 128
  rest :payload
  
  # set solicited flag
  def solicited=(f)
    self.bigbustedfield = (f << 30) ^ self.bigbustedfield
  end

  # set router flag
  def router=(f)
    self.bigbustedfield = (f << 31) ^ self.bigbustedfield
  end

  # set override flag
  def override=(f)
    self.bigbustedfield = (f << 29) ^ self.bigbustedfield
  end

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_NEIGHBOR_ADVERTISEMENT
  end
end

# http://tools.ietf.org/html/rfc4861
class ICMPv6Redirect < ICMPv6Generic
  # unused, should be 0
  unsigned :reserved, 32
  # the IP address that is a better first hop to use for the ICMP destination address
  unsigned :src_ip, 128
  # the IP address of the destination that is redirected to the target
  unsigned :dst_ip, 128
  rest :payload

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_REDIRECT
  end
end

# Generic class that IPv6NodeInformationRequest and Reply inherit from
# http://tools.ietf.org/html/rfc4620
class ICMPv6NodeInformation < ICMPv6Generic
  # type of information requested in a query or supplied in a reply
  unsigned :qtype, 16
  # qtype-specific flags that may be defined for certain qtypes and their replies
  unsigned :flags, 16
  # opaque field to help avoid spoofing and/or to aid in matching replies with queries
  text :nonce, 64 
  rest :payload

  def initialize(*args)
    super(*args)
  end
end

# http://tools.ietf.org/html/rfc4620
class ICMPv6NodeInformationRequest < ICMPv6NodeInformation
  ICMPv6_CODE_INFORMATION_REQUEST_IPv6 = 0
  ICMPv6_CODE_INFORMATION_REQUEST_NAME = 1 
  ICMPv6_CODE_INFORMATION_REQUEST_IPv4 = 2

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_INFORMATION_REQUEST
  end
end

# http://tools.ietf.org/html/rfc4620
class ICMPv6NodeInformationReply < ICMPv6NodeInformation
  ICMPv6_CODE_INFORMATION_REPLY_SUCCESS = 0
  ICMPv6_CODE_INFORMATION_REPLY_REFUSE = 1 
  ICMPv6_CODE_INFORMATION_REPLY_UNKNOWN = 2

  def initialize(*args)
    super(*args)
    self.type = ICMPv6_TYPE_INFORMATION_REPLY
  end
end
end
end
# vim: set ts=2 et sw=2: