---
-- Minimalistic DHCP6 (Dynamic Host Configuration Protocol for IPv6)
-- implementation supporting basic DHCP6 Solicit requests The library
-- is structured around the following classes:
-- * DHCP6.Option - DHCP6 options encoders (for requests) and decoders
-- (for responses)
-- * DHCP6.Request - DHCP6 request encoder and decoder
-- * DHCP6.Response - DHCP6 response encoder and decoder
-- * Helper - The helper class, primary script interface
--
-- The following sample code sends a DHCP6 Solicit request and returns a
-- response suitable for script output:
-- <code>
-- local helper = DHCP6.Helper:new("eth0")
-- local status, response = helper:solicit()
-- if ( status ) then
-- return stdnse.format_output(true, response)
-- end
-- </code>
--
-- @author "Patrik Karlsson <patrik@cqure.net>"
--
local bin = require "bin"
local bit = require "bit"
local ipOps = require "ipOps"
local math = require "math"
local nmap = require "nmap"
local os = require "os"
local stdnse = require "stdnse"
local table = require "table"
_ENV = stdnse.module("dhcp6", stdnse.seeall)
DHCP6 = {}
-- DHCP6 request and response types
DHCP6.Type = {
SOLICIT = 1,
ADVERTISE = 2,
REQUEST = 3,
}
-- DHCP6 type as string
DHCP6.TypeStr = {
[DHCP6.Type.SOLICIT] = "Solicit",
[DHCP6.Type.ADVERTISE] = "Advertise",
[DHCP6.Type.REQUEST] = "Request",
}
-- DHCP6 option types
DHCP6.OptionTypes = {
OPTION_CLIENTID = 0x01,
OPTION_SERVERID = 0x02,
OPTION_IA_NA = 0x03,
OPTION_IAADDR = 0x05,
OPTION_ELAPSED_TIME = 0x08,
OPTION_STATUS_CODE = 0x0d,
OPTION_DNS_SERVERS = 0x17,
OPTION_DOMAIN_LIST = 0x18,
OPTION_IA_PD = 0x19,
OPTION_SNTP_SERVERS = 0x1f,
OPTION_CLIENT_FQDN = 0x27,
}
-- DHCP6 options
DHCP6.Option = {
[DHCP6.OptionTypes.OPTION_ELAPSED_TIME] = {
-- Create a new class instance
-- @param time in ms since last request
-- @return o new instance of class
new = function(self, time)
local o = {
type = DHCP6.OptionTypes.OPTION_ELAPSED_TIME,
time = time,
-- in case no time was created, we need this to be able to
-- calculate time since instantiation
created = os.time(),
}
setmetatable(o, self)
self.__index = self
return o
end,
-- Converts option to a string
-- @return str string containing the class instance as string
__tostring = function(self)
local data
if ( self.time ) then
data = bin.pack(">S", self.time)
else
data = bin.pack(">S", (os.time() - self.created) * 1000)
end
return bin.pack(">SP", self.type, data)
end,
},
[DHCP6.OptionTypes.OPTION_CLIENTID] = {
-- Create a new class instance
-- @param mac string containing the mac address
-- @param duid number the duid of the client
-- @param hwtype number the hwtype of the client
-- @param time number time since 2000-01-01 00:00:00
-- @return o new instance of class
new = function(self, mac, duid, hwtype, time)
local o = {
type = DHCP6.OptionTypes.OPTION_CLIENTID,
duid = duid or 1,
hwtype = hwtype or 1,
time = time or os.time() - os.time({year=2000, day=1, month=1, hour=0, min=0, sec=0}),
mac = mac,
}
setmetatable(o, self)
self.__index = self
return o
end,
-- Parse the data string and create an instance of the class
-- @param data string containing the data as received over the socket
-- @return opt new instance of option
parse = function(data)
local opt = DHCP6.Option[DHCP6.OptionTypes.OPTION_CLIENTID]:new()
local pos
pos, opt.duid = bin.unpack(">S", data, pos)
if ( 1 ~= opt.duid ) then
stdnse.print_debug("Unexpected DUID type (%d)", opt.duid)
return
end
pos, opt.hwtype, opt.time, opt.mac = bin.unpack(">SIA" .. (#data - pos - 4 - 2 + 1), data, pos)
opt.time = opt.time + os.time({year=2000, day=1, month=1, hour=0, min=0, sec=0})
return opt
end,
-- Converts option to a string
-- @return str string containing the class instance as string
__tostring = function(self)
local data = bin.pack(">SSIA", self.duid, self.hwtype, self.time, self.mac)
return bin.pack(">SP", self.type, data)
end,
},
[DHCP6.OptionTypes.OPTION_SERVERID] = {
-- Create a new class instance
-- @param mac string containing the mac address
-- @param duid number the duid of the client
-- @param hwtype number the hwtype of the client
-- @param time number time since 2000-01-01 00:00:00
-- @return o new instance of class
new = function(...) return DHCP6.Option[DHCP6.OptionTypes.OPTION_CLIENTID].new(...) end,
-- Parse the data string and create an instance of the class
-- @param data string containing the data as received over the socket
-- @return opt new instance of option
parse = function(...) return DHCP6.Option[DHCP6.OptionTypes.OPTION_CLIENTID].parse(...) end,
-- Converts option to a string
-- @return str string containing the class instance as string
__tostring = function(...) return DHCP6.Option[DHCP6.OptionTypes.OPTION_CLIENTID].__tostring(...) end,
},
[DHCP6.OptionTypes.OPTION_STATUS_CODE] = {
-- Create a new class instance
-- @param code number containing the error code
-- @param msg string containing the error message
-- @return o new instance of class
new = function(self, code, msg)
local o = {
type = DHCP6.OptionTypes.OPTION_STATUS_CODE,
code = code,
msg = msg,
}
setmetatable(o, self)
self.__index = self
return o
end,
-- Parse the data string and create an instance of the class
-- @param data string containing the data as received over the socket
-- @return opt new instance of option
parse = function(data)
local opt = DHCP6.Option[DHCP6.OptionTypes.OPTION_STATUS_CODE]:new()
local pos
pos, opt.code, opt.msg = bin.unpack(">SA" .. (#data - 2), data)
return opt
end,
},
[DHCP6.OptionTypes.OPTION_DNS_SERVERS] = {
-- Create a new class instance
-- @param servers table containing DNS servers
-- @return o new instance of class
new = function(self, servers)
local o = {
type = DHCP6.OptionTypes.OPTION_DNS_SERVERS,
servers = servers or {},
}
setmetatable(o, self)
self.__index = self
return o
end,
-- Parse the data string and create an instance of the class
-- @param data string containing the data as received over the socket
-- @return opt new instance of option
parse = function(data)
local opt = DHCP6.Option[DHCP6.OptionTypes.OPTION_DNS_SERVERS]:new()
local pos, count = 1, #data/16
for i=1,count do
local srv
pos, srv = bin.unpack(">B16", data, pos)
table.insert(opt.servers, srv)
end
return opt
end,
-- Converts option to a string
-- @return str string containing the class instance as string
__tostring = function(self)
local len = #self.servers * 16
local data= bin.pack(">SS", self.type, self.len)
for _, ipv6 in ipairs(self.servers) do
data = data .. ipOps.ip_to_str(ipv6)
end
return data
end
},
[DHCP6.OptionTypes.OPTION_DOMAIN_LIST] = {
-- Create a new class instance
-- @param domain table containing the search domains
-- @return o new instance of class
new = function(self, domains)
local o = {
type = DHCP6.OptionTypes.OPTION_DOMAIN_LIST,
domains = domains or {},
}
setmetatable(o, self)
self.__index = self
return o
end,
-- Parse the data string and create an instance of the class
-- @param data string containing the data as received over the socket
-- @return opt new instance of option
parse = function(data)
local opt = DHCP6.Option[DHCP6.OptionTypes.OPTION_DOMAIN_LIST]:new()
local pos = 1
repeat
local domain = {}
repeat
local part
pos, part = bin.unpack("p", data, pos)
if ( part ~= "" ) then
table.insert(domain, part)
end
until( part == "" )
table.insert(opt.domains, stdnse.strjoin(".", domain))
until( pos > #data )
return opt
end,
},
[DHCP6.OptionTypes.OPTION_IA_PD] = {
-- Create a new class instance
-- @param iad number containing iad
-- @param t1 number containing t1
-- @param t2 number containing t2
-- @param option string containing any options
-- @return o new instance of class
new = function(self, iaid, t1, t2, options)
local o = {
type = DHCP6.OptionTypes.OPTION_IA_PD,
iaid = iaid,
t1 = t1 or 0,
t2 = t2 or 0,
options = options or "",
}
setmetatable(o, self)
self.__index = self
return o
end,
-- Converts option to a string
-- @return str string containing the class instance as string
__tostring = function(self)
local data = bin.pack(">IIIA", self.iaid, self.t1, self.t2, self.options)
return bin.pack(">SP", self.type, data)
end,
},
[DHCP6.OptionTypes.OPTION_IA_NA] = {
-- Create a new class instance
-- @param iad number containing iad
-- @param t1 number containing t1
-- @param t2 number containing t2
-- @param option table containing any options
-- @return o new instance of class
new = function(self, iaid, t1, t2, options)
local o = {
type = DHCP6.OptionTypes.OPTION_IA_NA,
iaid = iaid,
t1 = t1 or 0,
t2 = t2 or 0,
options = options or {},
}
setmetatable(o, self)
self.__index = self
return o
end,
-- Parse the data string and create an instance of the class
-- @param data string containing the data as received over the socket
-- @return opt new instance of option
parse = function(data)
local opt = DHCP6.Option[DHCP6.OptionTypes.OPTION_IA_NA]:new()
local pos
pos, opt.iaid, opt.t1, opt.t2 = bin.unpack(">III", data)
-- do we have any options
while ( pos < #data ) do
local typ, len, ipv6, pref_lt, valid_lt, options
pos, typ, len = bin.unpack(">SS", data, pos)
if ( 5 == DHCP6.OptionTypes.OPTION_IAADDR ) then
local addr = { type = DHCP6.OptionTypes.OPTION_IAADDR }
pos, addr.ipv6, addr.pref_lt, addr.valid_lt = bin.unpack(">A16II", data, pos)
table.insert(opt.options, addr)
else
pos = pos + len
end
end
return opt
end,
-- Converts option to a string
-- @return str string containing the class instance as string
__tostring = function(self)
local data = bin.pack(">III", self.iaid, self.t1, self.t2)
-- TODO: we don't cover self.options here, we should probably add that
return bin.pack(">SP", self.type, data)
end,
},
[DHCP6.OptionTypes.OPTION_SNTP_SERVERS] = {
-- Create a new class instance
-- @param servers table containing the NTP servers
-- @return o new instance of class
new = function(self, servers)
local o = {
type = DHCP6.OptionTypes.OPTION_SNTP_SERVERS,
servers = servers or {},
}
setmetatable(o, self)
self.__index = self
return o
end,
-- Parse the data string and create an instance of the class
-- @param data string containing the data as received over the socket
-- @return opt new instance of option
parse = function(data)
local opt = DHCP6.Option[DHCP6.OptionTypes.OPTION_SNTP_SERVERS]:new()
local pos, server = 1
repeat
pos, server = bin.unpack(">B16", data, pos)
table.insert( opt.servers, ipOps.bin_to_ip(server) )
until( pos > #data )
return opt
end,
},
[DHCP6.OptionTypes.OPTION_CLIENT_FQDN] = {
-- Create a new class instance
-- @param fqdn string containing the fqdn
-- @return o new instance of class
new = function(self, fqdn)
local o = {
type = DHCP6.OptionTypes.OPTION_CLIENT_FQDN,
fqdn = fqdn or "",
}
setmetatable(o, self)
self.__index = self
return o
end,
-- Parse the data string and create an instance of the class
-- @param data string containing the data as received over the socket
-- @return opt new instance of option
parse = function(data)
local opt = DHCP6.Option[DHCP6.OptionTypes.OPTION_CLIENT_FQDN]:new()
local pos = 2
local pieces = {}
repeat
local tmp
pos, tmp = bin.unpack("p", data, pos)
table.insert(pieces, tmp)
until(pos >= #data)
opt.fqdn = stdnse.strjoin(".", pieces)
return opt
end,
}
}
DHCP6.Request = {
-- Create a new class instance
-- @param msgtype number containing the message type
-- @param xid number containing the transaction id
-- @param opts table containing any request options
-- @return o new instance of class
new = function(self, msgtype, xid, opts)
local o = {
type = msgtype,
xid = xid or math.random(1048575),
opts = opts or {}
}
setmetatable(o, self)
self.__index = self
return o
end,
-- Adds a new DHCP6 option to the request
-- @param opt instance of object to add to the request
addOption = function(self, opt)
table.insert(self.opts, opt)
end,
-- Converts option to a string
-- @return str string containing the class instance as string
__tostring = function(self)
local tmp = bit.lshift(self.type, 24) + self.xid
local data = ""
for _, opt in ipairs(self.opts) do
data = data .. tostring(opt)
end
return bin.pack(">IA", tmp, data)
end,
}
-- The Response class handles responses from the server
DHCP6.Response = {
-- Creates a new instance of the response class
-- @param msgtype number containing the type of DHCP6 message
-- @param xid number containing the transaction ID
new = function(self, msgtype, xid, opts)
local o = {
msgtype = msgtype,
xid = xid,
opts = opts or {},
}
setmetatable(o, self)
self.__index = self
return o
end,
-- Parse the data string and create an instance of the class
-- @param data string containing the data as received over the socket
-- @return opt new instance of option
parse = function(data)
local resp = DHCP6.Response:new()
local pos, tmp = bin.unpack(">I", data)
resp.msgtype = bit.band(tmp, 0xFF000000)
resp.msgtype = bit.rshift(resp.msgtype, 24)
resp.xid = bit.band(tmp, 0x00FFFFFF)
while( pos < #data ) do
local opt = {}
pos, opt.type, opt.data = bin.unpack(">SP", data, pos)
if ( DHCP6.Option[opt.type] and DHCP6.Option[opt.type].parse ) then
local opt_parsed = DHCP6.Option[opt.type].parse(opt.data)
if ( not(opt_parsed) ) then
table.insert(resp.opts, { type = opt.type, raw = opt.data })
else
table.insert(resp.opts, { type = opt.type, resp = opt_parsed, raw = opt.data })
end
else
stdnse.print_debug(2, "No option decoder for type: %d; len: %d", opt.type, #(opt.data or ""))
table.insert(resp.opts, { type = opt.type, raw = opt.data })
end
end
return resp
end
}
-- Table of option to string converters
-- Each option should have it's own function to convert an instance of option
-- to a printable string.
--
-- TODO: These functions could eventually be moved to a method in it's
-- respective class.
OptionToString = {
[DHCP6.OptionTypes.OPTION_CLIENTID] = function(opt)
local HWTYPE_ETHER = 1
if ( HWTYPE_ETHER == opt.hwtype ) then
local mac = stdnse.tohex(opt.mac):upper()
mac = mac:gsub("..", "%1:"):sub(1, -2)
local tm = os.date("%Y-%m-%d %H:%M:%S", opt.time)
return "Client identifier", ("MAC: %s; Time: %s"):format(mac, tm)
end
end,
[DHCP6.OptionTypes.OPTION_SERVERID] = function(opt)
local topic, str = OptionToString[DHCP6.OptionTypes.OPTION_CLIENTID](opt)
return "Server identifier", str
end,
[DHCP6.OptionTypes.OPTION_IA_NA] = function(opt)
if ( opt.options and 1 == #opt.options ) then
local ipv6 = opt.options[1].ipv6
ipv6 = select(2, bin.unpack("B" .. #ipv6, ipv6))
ipv6 = ipOps.bin_to_ip(ipv6)
return "Non-temporary Address", ipv6
end
end,
[DHCP6.OptionTypes.OPTION_DNS_SERVERS] = function(opt)
local servers = {}
for _, srv in ipairs(opt.servers) do
local ipv6 = ipOps.bin_to_ip(srv)
table.insert(servers, ipv6)
end
return "DNS Servers", stdnse.strjoin(",", servers)
end,
[DHCP6.OptionTypes.OPTION_DOMAIN_LIST] = function(opt)
return "Domain Search", stdnse.strjoin(", ", opt.domains)
end,
[DHCP6.OptionTypes.OPTION_STATUS_CODE] = function(opt)
return "Error", ("Code: %d; Message: %s"):format(opt.code, opt.msg)
end,
[DHCP6.OptionTypes.OPTION_SNTP_SERVERS] = function(opt)
return "NTP Servers", stdnse.strjoin(", ", opt.servers)
end,
}
-- The Helper class serves as the main interface to scripts
Helper = {
-- Creates a new Helper class instance
-- @param iface string containing the interface name
-- @param options table containing any options, currently
-- <code>timeout</code> - socket timeout in ms
-- @return o new instance of Helper
new = function(self, iface, options)
local o = {
iface = iface,
options = options or {},
}
setmetatable(o, self)
self.__index = self
local info, err = nmap.get_interface_info(iface)
-- if we faile to get interface info, don't return a helper
-- this is true on OS X for interfaces like: p2p0 and vboxnet0
if ( not(info) and err ) then
return
end
o.mac = info.mac
o.socket = nmap.new_socket("udp")
o.socket:bind(nil, 546)
o.socket:set_timeout(o.options.timeout or 5000)
return o
end,
-- Sends a DHCP6 Solicit message to the server, essentiall requesting a new
-- IPv6 non-temporary address
-- @return table of results suitable for use with
-- <code>stdnse.format_output</code>
solicit = function(self)
local req = DHCP6.Request:new( DHCP6.Type.SOLICIT )
local option = DHCP6.Option
req:addOption(option[DHCP6.OptionTypes.OPTION_ELAPSED_TIME]:new())
req:addOption(option[DHCP6.OptionTypes.OPTION_CLIENTID]:new(self.mac))
local iaid = select(2, bin.unpack(">I", self.mac:sub(3)))
req:addOption(option[DHCP6.OptionTypes.OPTION_IA_NA]:new(iaid, 3600, 5400))
self.host, self.port = { ip = "ff02::1:2" }, { number = 547, protocol = "udp"}
local status, err = self.socket:sendto( self.host, self.port, tostring(req) )
if ( not(status) ) then
self.host.ip = ("%s%%%s"):format(self.host.ip, self.iface)
status, err = self.socket:sendto( self.host, self.port, tostring(req) )
if ( not(status) ) then
return false, "Failed to send DHCP6 request to server"
end
end
local resp, retries = {}, 3
repeat
retries = retries - 1
local status, data = self.socket:receive()
if ( not(status) ) then
return false, "Failed to receive DHCP6 request from server"
end
resp = DHCP6.Response.parse(data)
if ( not(resp) ) then
return false, "Failed to decode DHCP6 response from server"
end
until( req.xid == resp.xid or retries == 0 )
if ( req.xid ~= resp.xid ) then
return false, "Failed to receive DHCP6 response from server"
end
local result, result_options = {}, { name = "Options" }
local resptype = DHCP6.TypeStr[resp.msgtype] or ("Unknown (%d)"):format(resp.msgtype)
table.insert(result, ("Message type: %s"):format(resptype))
table.insert(result, ("Transaction id: %d"):format(resp.xid))
for _, opt in ipairs(resp.opts or {}) do
if ( OptionToString[opt.type] ) then
local topic, str = OptionToString[opt.type](opt.resp)
if ( topic and str ) then
table.insert(result_options, ("%s: %s"):format(topic, str))
end
else
stdnse.print_debug(2, "No decoder for option type: %d", opt.type)
end
end
table.insert(result, result_options)
return true, result
end,
}
return _ENV;
@KyuuKazami