HardenedBSD/sbin/routed/input.c

/*
 * Copyright (c) 1983, 1988, 1993
 *	The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 4. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 *
 * $FreeBSD$
 */

#include "defs.h"

#ifdef __NetBSD__
__RCSID("$NetBSD$");
#elif defined(__FreeBSD__)
__RCSID("$FreeBSD$");
#else
__RCSID("$Revision: 2.26 $");
#ident "$Revision: 2.26 $"
#endif

static void input(struct sockaddr_in *, struct interface *, struct interface *,
		  struct rip *, int);
static void input_route(naddr, naddr, struct rt_spare *, struct netinfo *);
static int ck_passwd(struct interface *, struct rip *, void *,
		     naddr, struct msg_limit *);


/* process RIP input
 */
void
read_rip(int sock,
	 struct interface *sifp)
{
	struct sockaddr_in from;
	struct interface *aifp;
	socklen_t fromlen;
	int cc;
#ifdef USE_PASSIFNAME
	static struct msg_limit  bad_name;
	struct {
		char	ifname[IFNAMSIZ];
		union pkt_buf pbuf;
	} inbuf;
#else
	struct {
		union pkt_buf pbuf;
	} inbuf;
#endif


	for (;;) {
		fromlen = sizeof(from);
		cc = recvfrom(sock, &inbuf, sizeof(inbuf), 0,
			      (struct sockaddr*)&from, &fromlen);
		if (cc <= 0) {
			if (cc < 0 && errno != EWOULDBLOCK)
				LOGERR("recvfrom(rip)");
			break;
		}
		if (fromlen != sizeof(struct sockaddr_in))
			logbad(1,"impossible recvfrom(rip) fromlen=%d",
			       (int)fromlen);

		/* aifp is the "authenticated" interface via which the packet
		 *	arrived.  In fact, it is only the interface on which
		 *	the packet should have arrived based on is source
		 *	address.
		 * sifp is interface associated with the socket through which
		 *	the packet was received.
		 */
#ifdef USE_PASSIFNAME
		if ((cc -= sizeof(inbuf.ifname)) < 0)
			logbad(0,"missing USE_PASSIFNAME; only %d bytes",
			       cc+sizeof(inbuf.ifname));

		/* check the remote interfaces first */
		LIST_FOREACH(aifp, &remote_if, remote_list) {
			if (aifp->int_addr == from.sin_addr.s_addr)
				break;
		}
		if (aifp == 0) {
			aifp = ifwithname(inbuf.ifname, 0);
			if (aifp == 0) {
				msglim(&bad_name, from.sin_addr.s_addr,
				       "impossible interface name %.*s",
				       IFNAMSIZ, inbuf.ifname);
			} else if (((aifp->int_if_flags & IFF_POINTOPOINT)
				    && aifp->int_dstaddr!=from.sin_addr.s_addr)
				   || (!(aifp->int_if_flags & IFF_POINTOPOINT)
				       && !on_net(from.sin_addr.s_addr,
						  aifp->int_net,
						  aifp->int_mask))) {
				/* If it came via the wrong interface, do not
				 * trust it.
				 */
				aifp = 0;
			}
		}
#else
		aifp = iflookup(from.sin_addr.s_addr);
#endif
		if (sifp == 0)
			sifp = aifp;

		input(&from, sifp, aifp, &inbuf.pbuf.rip, cc);
	}
}


/* Process a RIP packet
 */
static void
input(struct sockaddr_in *from,		/* received from this IP address */
      struct interface *sifp,		/* interface of incoming socket */
      struct interface *aifp,		/* "authenticated" interface */
      struct rip *rip,
      int cc)
{
#	define FROM_NADDR from->sin_addr.s_addr
	static struct msg_limit use_auth, bad_len, bad_mask;
	static struct msg_limit unk_router, bad_router, bad_nhop;

	struct rt_entry *rt;
	struct rt_spare new;
	struct netinfo *n, *lim;
	struct interface *ifp1;
	naddr gate, mask, v1_mask, dst, ddst_h = 0;
	struct auth *ap;
	struct tgate *tg = 0;
	struct tgate_net *tn;
	int i, j;

	/* Notice when we hear from a remote gateway
	 */
	if (aifp != 0
	    && (aifp->int_state & IS_REMOTE))
		aifp->int_act_time = now.tv_sec;

	trace_rip("Recv", "from", from, sifp, rip, cc);

	if (rip->rip_vers == 0) {
		msglim(&bad_router, FROM_NADDR,
		       "RIP version 0, cmd %d, packet received from %s",
		       rip->rip_cmd, naddr_ntoa(FROM_NADDR));
		return;
	} else if (rip->rip_vers > RIPv2) {
		rip->rip_vers = RIPv2;
	}
	if (cc > (int)OVER_MAXPACKETSIZE) {
		msglim(&bad_router, FROM_NADDR,
		       "packet at least %d bytes too long received from %s",
		       cc-MAXPACKETSIZE, naddr_ntoa(FROM_NADDR));
		return;
	}

	n = rip->rip_nets;
	lim = (struct netinfo *)((char*)rip + cc);

	/* Notice authentication.
	 * As required by section 4.2 in RFC 1723, discard authenticated
	 * RIPv2 messages, but only if configured for that silliness.
	 *
	 * RIPv2 authentication is lame.  Why authenticate queries?
	 * Why should a RIPv2 implementation with authentication disabled
	 * not be able to listen to RIPv2 packets with authentication, while
	 * RIPv1 systems will listen?  Crazy!
	 */
	if (!auth_ok
	    && rip->rip_vers == RIPv2
	    && n < lim && n->n_family == RIP_AF_AUTH) {
		msglim(&use_auth, FROM_NADDR,
		       "RIPv2 message with authentication from %s discarded",
		       naddr_ntoa(FROM_NADDR));
		return;
	}

	switch (rip->rip_cmd) {
	case RIPCMD_REQUEST:
		/* For mere requests, be a little sloppy about the source
		 */
		if (aifp == 0)
			aifp = sifp;

		/* Are we talking to ourself or a remote gateway?
		 */
		ifp1 = ifwithaddr(FROM_NADDR, 0, 1);
		if (ifp1) {
			if (ifp1->int_state & IS_REMOTE) {
				/* remote gateway */
				aifp = ifp1;
				if (check_remote(aifp)) {
					aifp->int_act_time = now.tv_sec;
					(void)if_ok(aifp, "remote ");
				}
			} else if (from->sin_port == htons(RIP_PORT)) {
				trace_pkt("    discard our own RIP request");
				return;
			}
		}

		/* did the request come from a router?
		 */
		if (from->sin_port == htons(RIP_PORT)) {
			/* yes, ignore the request if RIP is off so that
			 * the router does not depend on us.
			 */
			if (rip_sock < 0
			    || (aifp != 0
				&& IS_RIP_OUT_OFF(aifp->int_state))) {
				trace_pkt("    discard request while RIP off");
				return;
			}
		}

		/* According to RFC 1723, we should ignore unauthenticated
		 * queries.  That is too silly to bother with.  Sheesh!
		 * Are forwarding tables supposed to be secret, when
		 * a bad guy can infer them with test traffic?  When RIP
		 * is still the most common router-discovery protocol
		 * and so hosts need to send queries that will be answered?
		 * What about `rtquery`?
		 * Maybe on firewalls you'd care, but not enough to
		 * give up the diagnostic facilities of remote probing.
		 */

		if (n >= lim) {
			msglim(&bad_len, FROM_NADDR, "empty request from %s",
			       naddr_ntoa(FROM_NADDR));
			return;
		}
		if (cc%sizeof(*n) != sizeof(struct rip)%sizeof(*n)) {
			msglim(&bad_len, FROM_NADDR,
			       "request of bad length (%d) from %s",
			       cc, naddr_ntoa(FROM_NADDR));
		}

		if (rip->rip_vers == RIPv2
		    && (aifp == 0 || (aifp->int_state & IS_NO_RIPV1_OUT))) {
			v12buf.buf->rip_vers = RIPv2;
			/* If we have a secret but it is a cleartext secret,
			 * do not disclose our secret unless the other guy
			 * already knows it.
			 */
			ap = find_auth(aifp);
			if (ap != 0 && ap->type == RIP_AUTH_PW
			    && n->n_family == RIP_AF_AUTH
			    && !ck_passwd(aifp,rip,lim,FROM_NADDR,&use_auth))
				ap = 0;
		} else {
			v12buf.buf->rip_vers = RIPv1;
			ap = 0;
		}
		clr_ws_buf(&v12buf, ap);

		do {
			n->n_metric = ntohl(n->n_metric);

			/* A single entry with family RIP_AF_UNSPEC and
			 * metric HOPCNT_INFINITY means "all routes".
			 * We respond to routers only if we are acting
			 * as a supplier, or to anyone other than a router
			 * (i.e. a query).
			 */
			if (n->n_family == RIP_AF_UNSPEC
			    && n->n_metric == HOPCNT_INFINITY) {
				/* Answer a query from a utility program
				 * with all we know.
				 */
				if (from->sin_port != htons(RIP_PORT)) {
					supply(from, aifp, OUT_QUERY, 0,
					       rip->rip_vers, ap != 0);
					return;
				}

				/* A router trying to prime its tables.
				 * Filter the answer in the about same way
				 * broadcasts are filtered.
				 *
				 * Only answer a router if we are a supplier
				 * to keep an unwary host that is just starting
				 * from picking us as a router.
				 */
				if (aifp == 0) {
					trace_pkt("ignore distant router");
					return;
				}
				if (!supplier
				    || IS_RIP_OFF(aifp->int_state)) {
					trace_pkt("ignore; not supplying");
					return;
				}

				/* Do not answer a RIPv1 router if
				 * we are sending RIPv2.  But do offer
				 * poor man's router discovery.
				 */
				if ((aifp->int_state & IS_NO_RIPV1_OUT)
				    && rip->rip_vers == RIPv1) {
					if (!(aifp->int_state & IS_PM_RDISC)) {
					    trace_pkt("ignore; sending RIPv2");
					    return;
					}

					v12buf.n->n_family = RIP_AF_INET;
					v12buf.n->n_dst = RIP_DEFAULT;
					i = aifp->int_d_metric;
					if (0 != (rt = rtget(RIP_DEFAULT, 0))) {
					    j = (rt->rt_metric
						 +aifp->int_metric
						 +aifp->int_adj_outmetric
						 +1);
					    if (i > j)
						i = j;
					}
					v12buf.n->n_metric = htonl(i);
					v12buf.n++;
					break;
				}

				/* Respond with RIPv1 instead of RIPv2 if
				 * that is what we are broadcasting on the
				 * interface to keep the remote router from
				 * getting the wrong initial idea of the
				 * routes we send.
				 */
				supply(from, aifp, OUT_UNICAST, 0,
				       (aifp->int_state & IS_NO_RIPV1_OUT)
				       ? RIPv2 : RIPv1,
				       ap != 0);
				return;
			}

			/* Ignore authentication */
			if (n->n_family == RIP_AF_AUTH)
				continue;

			if (n->n_family != RIP_AF_INET) {
				msglim(&bad_router, FROM_NADDR,
				       "request from %s for unsupported"
				       " (af %d) %s",
				       naddr_ntoa(FROM_NADDR),
				       ntohs(n->n_family),
				       naddr_ntoa(n->n_dst));
				return;
			}

			/* We are being asked about a specific destination.
			 */
			dst = n->n_dst;
			if (!check_dst(dst)) {
				msglim(&bad_router, FROM_NADDR,
				       "bad queried destination %s from %s",
				       naddr_ntoa(dst),
				       naddr_ntoa(FROM_NADDR));
				return;
			}

			/* decide what mask was intended */
			if (rip->rip_vers == RIPv1
			    || 0 == (mask = ntohl(n->n_mask))
			    || 0 != (ntohl(dst) & ~mask))
				mask = ripv1_mask_host(dst, aifp);

			/* try to find the answer */
			rt = rtget(dst, mask);
			if (!rt && dst != RIP_DEFAULT)
				rt = rtfind(n->n_dst);

			if (v12buf.buf->rip_vers != RIPv1)
				v12buf.n->n_mask = mask;
			if (rt == 0) {
				/* we do not have the answer */
				v12buf.n->n_metric = HOPCNT_INFINITY;
			} else {
				/* we have the answer, so compute the
				 * right metric and next hop.
				 */
				v12buf.n->n_family = RIP_AF_INET;
				v12buf.n->n_dst = dst;
				j = rt->rt_metric+1;
				if (!aifp)
					++j;
				else
					j += (aifp->int_metric
					      + aifp->int_adj_outmetric);
				if (j < HOPCNT_INFINITY)
					v12buf.n->n_metric = j;
				else
					v12buf.n->n_metric = HOPCNT_INFINITY;
				if (v12buf.buf->rip_vers != RIPv1) {
					v12buf.n->n_tag = rt->rt_tag;
					v12buf.n->n_mask = mask;
					if (aifp != 0
					    && on_net(rt->rt_gate,
						      aifp->int_net,
						      aifp->int_mask)
					    && rt->rt_gate != aifp->int_addr)
					    v12buf.n->n_nhop = rt->rt_gate;
				}
			}
			v12buf.n->n_metric = htonl(v12buf.n->n_metric);

			/* Stop paying attention if we fill the output buffer.
			 */
			if (++v12buf.n >= v12buf.lim)
				break;
		} while (++n < lim);

		/* Send the answer about specific routes.
		 */
		if (ap != 0 && ap->type == RIP_AUTH_MD5)
			end_md5_auth(&v12buf, ap);

		if (from->sin_port != htons(RIP_PORT)) {
			/* query */
			(void)output(OUT_QUERY, from, aifp,
				     v12buf.buf,
				     ((char *)v12buf.n - (char*)v12buf.buf));
		} else if (supplier) {
			(void)output(OUT_UNICAST, from, aifp,
				     v12buf.buf,
				     ((char *)v12buf.n - (char*)v12buf.buf));
		} else {
			/* Only answer a router if we are a supplier
			 * to keep an unwary host that is just starting
			 * from picking us an a router.
			 */
			;
		}
		return;

	case RIPCMD_TRACEON:
	case RIPCMD_TRACEOFF:
		/* Notice that trace messages are turned off for all possible
		 * abuse if _PATH_TRACE is undefined in pathnames.h.
		 * Notice also that because of the way the trace file is
		 * handled in trace.c, no abuse is plausible even if
		 * _PATH_TRACE_ is defined.
		 *
		 * First verify message came from a privileged port. */
		if (ntohs(from->sin_port) > IPPORT_RESERVED) {
			msglog("trace command from untrusted port on %s",
			       naddr_ntoa(FROM_NADDR));
			return;
		}
		if (aifp == 0) {
			msglog("trace command from unknown router %s",
			       naddr_ntoa(FROM_NADDR));
			return;
		}
		if (rip->rip_cmd == RIPCMD_TRACEON) {
			rip->rip_tracefile[cc-4] = '\0';
			set_tracefile((char*)rip->rip_tracefile,
				      "trace command: %s\n", 0);
		} else {
			trace_off("tracing turned off by %s",
				  naddr_ntoa(FROM_NADDR));
		}
		return;

	case RIPCMD_RESPONSE:
		if (cc%sizeof(*n) != sizeof(struct rip)%sizeof(*n)) {
			msglim(&bad_len, FROM_NADDR,
			       "response of bad length (%d) from %s",
			       cc, naddr_ntoa(FROM_NADDR));
		}

		/* verify message came from a router */
		if (from->sin_port != ntohs(RIP_PORT)) {
			msglim(&bad_router, FROM_NADDR,
			       "    discard RIP response from unknown port"
			       " %d on %s",
			       ntohs(from->sin_port), naddr_ntoa(FROM_NADDR));
			return;
		}

		if (rip_sock < 0) {
			trace_pkt("    discard response while RIP off");
			return;
		}

		/* Are we talking to ourself or a remote gateway?
		 */
		ifp1 = ifwithaddr(FROM_NADDR, 0, 1);
		if (ifp1) {
			if (ifp1->int_state & IS_REMOTE) {
				/* remote gateway */
				aifp = ifp1;
				if (check_remote(aifp)) {
					aifp->int_act_time = now.tv_sec;
					(void)if_ok(aifp, "remote ");
				}
			} else {
				trace_pkt("    discard our own RIP response");
				return;
			}
		}

		/* Accept routing packets from routers directly connected
		 * via broadcast or point-to-point networks, and from
		 * those listed in /etc/gateways.
		 */
		if (aifp == 0) {
			msglim(&unk_router, FROM_NADDR,
			       "   discard response from %s"
			       " via unexpected interface",
			       naddr_ntoa(FROM_NADDR));
			return;
		}
		if (IS_RIP_IN_OFF(aifp->int_state)) {
			trace_pkt("    discard RIPv%d response"
				  " via disabled interface %s",
				  rip->rip_vers, aifp->int_name);
			return;
		}

		if (n >= lim) {
			msglim(&bad_len, FROM_NADDR, "empty response from %s",
			       naddr_ntoa(FROM_NADDR));
			return;
		}

		if (((aifp->int_state & IS_NO_RIPV1_IN)
		     && rip->rip_vers == RIPv1)
		    || ((aifp->int_state & IS_NO_RIPV2_IN)
			&& rip->rip_vers != RIPv1)) {
			trace_pkt("    discard RIPv%d response",
				  rip->rip_vers);
			return;
		}

		/* Ignore routes via dead interface.
		 */
		if (aifp->int_state & IS_BROKE) {
			trace_pkt("discard response via broken interface %s",
				  aifp->int_name);
			return;
		}

		/* If the interface cares, ignore bad routers.
		 * Trace but do not log this problem, because where it
		 * happens, it happens frequently.
		 */
		if (aifp->int_state & IS_DISTRUST) {
			tg = tgates;
			while (tg->tgate_addr != FROM_NADDR) {
				tg = tg->tgate_next;
				if (tg == 0) {
					trace_pkt("    discard RIP response"
						  " from untrusted router %s",
						  naddr_ntoa(FROM_NADDR));
					return;
				}
			}
		}

		/* Authenticate the packet if we have a secret.
		 * If we do not have any secrets, ignore the error in
		 * RFC 1723 and accept it regardless.
		 */
		if (aifp->int_auth[0].type != RIP_AUTH_NONE
		    && rip->rip_vers != RIPv1
		    && !ck_passwd(aifp,rip,lim,FROM_NADDR,&use_auth))
			return;

		do {
			if (n->n_family == RIP_AF_AUTH)
				continue;

			n->n_metric = ntohl(n->n_metric);
			dst = n->n_dst;
			if (n->n_family != RIP_AF_INET
			    && (n->n_family != RIP_AF_UNSPEC
				|| dst != RIP_DEFAULT)) {
				msglim(&bad_router, FROM_NADDR,
				       "route from %s to unsupported"
				       " address family=%d destination=%s",
				       naddr_ntoa(FROM_NADDR),
				       n->n_family,
				       naddr_ntoa(dst));
				continue;
			}
			if (!check_dst(dst)) {
				msglim(&bad_router, FROM_NADDR,
				       "bad destination %s from %s",
				       naddr_ntoa(dst),
				       naddr_ntoa(FROM_NADDR));
				return;
			}
			if (n->n_metric == 0
			    || n->n_metric > HOPCNT_INFINITY) {
				msglim(&bad_router, FROM_NADDR,
				       "bad metric %d from %s"
				       " for destination %s",
				       n->n_metric,
				       naddr_ntoa(FROM_NADDR),
				       naddr_ntoa(dst));
				return;
			}

			/* Notice the next-hop.
			 */
			gate = FROM_NADDR;
			if (n->n_nhop != 0) {
				if (rip->rip_vers == RIPv1) {
					n->n_nhop = 0;
				} else {
				    /* Use it only if it is valid. */
				    if (on_net(n->n_nhop,
					       aifp->int_net, aifp->int_mask)
					&& check_dst(n->n_nhop)) {
					    gate = n->n_nhop;
				    } else {
					    msglim(&bad_nhop, FROM_NADDR,
						   "router %s to %s"
						   " has bad next hop %s",
						   naddr_ntoa(FROM_NADDR),
						   naddr_ntoa(dst),
						   naddr_ntoa(n->n_nhop));
					    n->n_nhop = 0;
				    }
				}
			}

			if (rip->rip_vers == RIPv1
			    || 0 == (mask = ntohl(n->n_mask))) {
				mask = ripv1_mask_host(dst,aifp);
			} else if ((ntohl(dst) & ~mask) != 0) {
				msglim(&bad_mask, FROM_NADDR,
				       "router %s sent bad netmask"
				       " %#lx with %s",
				       naddr_ntoa(FROM_NADDR),
				       (u_long)mask,
				       naddr_ntoa(dst));
				continue;
			}
			if (rip->rip_vers == RIPv1)
				n->n_tag = 0;

			/* Adjust metric according to incoming interface..
			 */
			n->n_metric += (aifp->int_metric
					+ aifp->int_adj_inmetric);
			if (n->n_metric > HOPCNT_INFINITY)
				n->n_metric = HOPCNT_INFINITY;

			/* Should we trust this route from this router? */
			if (tg && (tn = tg->tgate_nets)->mask != 0) {
				for (i = 0; i < MAX_TGATE_NETS; i++, tn++) {
					if (on_net(dst, tn->net, tn->mask)
					    && tn->mask <= mask)
					    break;
				}
				if (i >= MAX_TGATE_NETS || tn->mask == 0) {
					trace_pkt("   ignored unauthorized %s",
						  addrname(dst,mask,0));
					continue;
				}
			}

			/* Recognize and ignore a default route we faked
			 * which is being sent back to us by a machine with
			 * broken split-horizon.
			 * Be a little more paranoid than that, and reject
			 * default routes with the same metric we advertised.
			 */
			if (aifp->int_d_metric != 0
			    && dst == RIP_DEFAULT
			    && (int)n->n_metric >= aifp->int_d_metric)
				continue;

			/* We can receive aggregated RIPv2 routes that must
			 * be broken down before they are transmitted by
			 * RIPv1 via an interface on a subnet.
			 * We might also receive the same routes aggregated
			 * via other RIPv2 interfaces.
			 * This could cause duplicate routes to be sent on
			 * the RIPv1 interfaces.  "Longest matching variable
			 * length netmasks" lets RIPv2 listeners understand,
			 * but breaking down the aggregated routes for RIPv1
			 * listeners can produce duplicate routes.
			 *
			 * Breaking down aggregated routes here bloats
			 * the daemon table, but does not hurt the kernel
			 * table, since routes are always aggregated for
			 * the kernel.
			 *
			 * Notice that this does not break down network
			 * routes corresponding to subnets.  This is part
			 * of the defense against RS_NET_SYN.
			 */
			if (have_ripv1_out
			    && (((rt = rtget(dst,mask)) == 0
				 || !(rt->rt_state & RS_NET_SYN)))
			    && (v1_mask = ripv1_mask_net(dst,0)) > mask) {
				ddst_h = v1_mask & -v1_mask;
				i = (v1_mask & ~mask)/ddst_h;
				if (i >= 511) {
					/* Punt if we would have to generate
					 * an unreasonable number of routes.
					 */
					if (TRACECONTENTS)
					    trace_misc("accept %s-->%s as 1"
						       " instead of %d routes",
						       addrname(dst,mask,0),
						       naddr_ntoa(FROM_NADDR),
						       i+1);
					i = 0;
				} else {
					mask = v1_mask;
				}
			} else {
				i = 0;
			}

			new.rts_gate = gate;
			new.rts_router = FROM_NADDR;
			new.rts_metric = n->n_metric;
			new.rts_tag = n->n_tag;
			new.rts_time = now.tv_sec;
			new.rts_ifp = aifp;
			new.rts_de_ag = i;
			j = 0;
			for (;;) {
				input_route(dst, mask, &new, n);
				if (++j > i)
					break;
				dst = htonl(ntohl(dst) + ddst_h);
			}
		} while (++n < lim);
		break;
	}
#undef FROM_NADDR
}


/* Process a single input route.
 */
static void
input_route(naddr dst,			/* network order */
	    naddr mask,
	    struct rt_spare *new,
	    struct netinfo *n)
{
	int i;
	struct rt_entry *rt;
	struct rt_spare *rts, *rts0;
	struct interface *ifp1;


	/* See if the other guy is telling us to send our packets to him.
	 * Sometimes network routes arrive over a point-to-point link for
	 * the network containing the address(es) of the link.
	 *
	 * If our interface is broken, switch to using the other guy.
	 */
	ifp1 = ifwithaddr(dst, 1, 1);
	if (ifp1 != 0
	    && (!(ifp1->int_state & IS_BROKE)
		|| (ifp1->int_state & IS_PASSIVE)))
		return;

	/* Look for the route in our table.
	 */
	rt = rtget(dst, mask);

	/* Consider adding the route if we do not already have it.
	 */
	if (rt == 0) {
		/* Ignore unknown routes being poisoned.
		 */
		if (new->rts_metric == HOPCNT_INFINITY)
			return;

		/* Ignore the route if it points to us */
		if (n->n_nhop != 0
		    && 0 != ifwithaddr(n->n_nhop, 1, 0))
			return;

		/* If something has not gone crazy and tried to fill
		 * our memory, accept the new route.
		 */
		if (total_routes < MAX_ROUTES)
			rtadd(dst, mask, 0, new);
		return;
	}

	/* We already know about the route.  Consider this update.
	 *
	 * If (rt->rt_state & RS_NET_SYN), then this route
	 * is the same as a network route we have inferred
	 * for subnets we know, in order to tell RIPv1 routers
	 * about the subnets.
	 *
	 * It is impossible to tell if the route is coming
	 * from a distant RIPv2 router with the standard
	 * netmask because that router knows about the entire
	 * network, or if it is a round-about echo of a
	 * synthetic, RIPv1 network route of our own.
	 * The worst is that both kinds of routes might be
	 * received, and the bad one might have the smaller
	 * metric.  Partly solve this problem by never
	 * aggregating into such a route.  Also keep it
	 * around as long as the interface exists.
	 */

	rts0 = rt->rt_spares;
	for (rts = rts0, i = NUM_SPARES; i != 0; i--, rts++) {
		if (rts->rts_router == new->rts_router)
			break;
		/* Note the worst slot to reuse,
		 * other than the current slot.
		 */
		if (rts0 == rt->rt_spares
		    || BETTER_LINK(rt, rts0, rts))
			rts0 = rts;
	}
	if (i != 0) {
		/* Found a route from the router already in the table.
		 */

		/* If the new route is a route broken down from an
		 * aggregated route, and if the previous route is either
		 * not a broken down route or was broken down from a finer
		 * netmask, and if the previous route is current,
		 * then forget this one.
		 */
		if (new->rts_de_ag > rts->rts_de_ag
		    && now_stale <= rts->rts_time)
			return;

		/* Keep poisoned routes around only long enough to pass
		 * the poison on.  Use a new timestamp for good routes.
		 */
		if (rts->rts_metric == HOPCNT_INFINITY
		    && new->rts_metric == HOPCNT_INFINITY)
			new->rts_time = rts->rts_time;

		/* If this is an update for the router we currently prefer,
		 * then note it.
		 */
		if (i == NUM_SPARES) {
			rtchange(rt, rt->rt_state, new, 0);
			/* If the route got worse, check for something better.
			 */
			if (new->rts_metric > rts->rts_metric)
				rtswitch(rt, 0);
			return;
		}

		/* This is an update for a spare route.
		 * Finished if the route is unchanged.
		 */
		if (rts->rts_gate == new->rts_gate
		    && rts->rts_metric == new->rts_metric
		    && rts->rts_tag == new->rts_tag) {
			trace_upslot(rt, rts, new);
			*rts = *new;
			return;
		}
		/* Forget it if it has gone bad.
		 */
		if (new->rts_metric == HOPCNT_INFINITY) {
			rts_delete(rt, rts);
			return;
		}

	} else {
		/* The update is for a route we know about,
		 * but not from a familiar router.
		 *
		 * Ignore the route if it points to us.
		 */
		if (n->n_nhop != 0
		    && 0 != ifwithaddr(n->n_nhop, 1, 0))
			return;

		/* the loop above set rts0=worst spare */
		rts = rts0;

		/* Save the route as a spare only if it has
		 * a better metric than our worst spare.
		 * This also ignores poisoned routes (those
		 * received with metric HOPCNT_INFINITY).
		 */
		if (new->rts_metric >= rts->rts_metric)
			return;
	}

	trace_upslot(rt, rts, new);
	*rts = *new;

	/* try to switch to a better route */
	rtswitch(rt, rts);
}


static int				/* 0 if bad */
ck_passwd(struct interface *aifp,
	  struct rip *rip,
	  void *lim,
	  naddr from,
	  struct msg_limit *use_authp)
{
#	define NA (rip->rip_auths)
	struct netauth *na2;
	struct auth *ap;
	MD5_CTX md5_ctx;
	u_char hash[RIP_AUTH_PW_LEN];
	int i, len;

	assert(aifp != NULL);
	if ((void *)NA >= lim || NA->a_family != RIP_AF_AUTH) {
		msglim(use_authp, from, "missing password from %s",
		       naddr_ntoa(from));
		return 0;
	}

	/* accept any current (+/- 24 hours) password
	 */
	for (ap = aifp->int_auth, i = 0; i < MAX_AUTH_KEYS; i++, ap++) {
		if (ap->type != NA->a_type
		    || (u_long)ap->start > (u_long)clk.tv_sec+DAY
		    || (u_long)ap->end+DAY < (u_long)clk.tv_sec)
			continue;

		if (NA->a_type == RIP_AUTH_PW) {
			if (!memcmp(NA->au.au_pw, ap->key, RIP_AUTH_PW_LEN))
				return 1;

		} else {
			/* accept MD5 secret with the right key ID
			 */
			if (NA->au.a_md5.md5_keyid != ap->keyid)
				continue;

			len = ntohs(NA->au.a_md5.md5_pkt_len);
			if ((len-sizeof(*rip)) % sizeof(*NA) != 0
			    || len != (char *)lim-(char*)rip-(int)sizeof(*NA)) {
				msglim(use_authp, from,
				       "wrong MD5 RIPv2 packet length of %d"
				       " instead of %d from %s",
				       len, (int)((char *)lim-(char *)rip
						  -sizeof(*NA)),
				       naddr_ntoa(from));
				return 0;
			}
			na2 = (struct netauth *)((char *)rip+len);

			/* Given a good hash value, these are not security
			 * problems so be generous and accept the routes,
			 * after complaining.
			 */
			if (TRACEPACKETS) {
				if (NA->au.a_md5.md5_auth_len
				    != RIP_AUTH_MD5_HASH_LEN)
					msglim(use_authp, from,
					       "unknown MD5 RIPv2 auth len %#x"
					       " instead of %#x from %s",
					       NA->au.a_md5.md5_auth_len,
					       (unsigned)RIP_AUTH_MD5_HASH_LEN,
					       naddr_ntoa(from));
				if (na2->a_family != RIP_AF_AUTH)
					msglim(use_authp, from,
					       "unknown MD5 RIPv2 family %#x"
					       " instead of %#x from %s",
					       na2->a_family, RIP_AF_AUTH,
					       naddr_ntoa(from));
				if (na2->a_type != ntohs(1))
					msglim(use_authp, from,
					       "MD5 RIPv2 hash has %#x"
					       " instead of %#x from %s",
					       na2->a_type, ntohs(1),
					       naddr_ntoa(from));
			}

			MD5Init(&md5_ctx);
			MD5Update(&md5_ctx, (u_char *)rip,
				  len + RIP_AUTH_MD5_HASH_XTRA);
			MD5Update(&md5_ctx, ap->key, RIP_AUTH_MD5_KEY_LEN);
			MD5Final(hash, &md5_ctx);
			if (!memcmp(hash, na2->au.au_pw, sizeof(hash)))
				return 1;
		}
	}

	msglim(use_authp, from, "bad password from %s",
	       naddr_ntoa(from));
	return 0;
#undef NA
}