CVE-2017-13050: Out-of-bounds Read (CWE-125)
value: The RPKI-Router parser in tcpdump before 4.9.2 has a buffer over-read in print-rpki-rtr.c:rpki_rtr_pdu_print().
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.8
Published: 2017-09-14T06:29Z
Repository: https://github.com/the-tcpdump-group/tcpdump
Language: Other
Files changed: print-rpki-rtr.c, tests/TESTLIST, tests/kday2.out, tests/kday3.out, tests/kday4.out, tests/kday5.out, tests/kday7.out, tests/kday8.out, tests/rpki-rtr-oob.out
Commit date: 2017-09-13 12:25:44 +0100
Commit message: CVE-2017-13050/RPKI-Router: fix a few bugs

The decoder didn't properly check that the PDU length stored in the PDU
header is correct. The only check in place was in rpki_rtr_print() and it
tested whether the length is zero but that is not sufficient. Make all
necessary length and bounds checks, both generic and type-specific, in
rpki_rtr_pdu_print() and reduce rpki_rtr_print() to a simple loop.

This also fixes a minor bug and PDU type 0 (Serial Notify from RFC 6810
Section 5.2) is valid again.

In rpki_rtr_pdu_print() any protocol version was considered version 0,
fix it to skip the rest of input if the PDU protocol version is unknown.

Ibid, the PDU type 10 (Error Report from RFC 6810 Section 5.10) case
block didn't consider the "Length of Error Text" data element mandatory,
put it right.

Ibid, when printing an encapsulated PDU, give itself (via recursion)
respective buffer length to make it possible to tell whether the
encapsulated PDU fits. Do not recurse deeper than 2nd level.

Update prior RPKI-Router test cases that now stop to decode earlier
because of the stricter checks.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s).

Diff: diff --git a/print-rpki-rtr.c b/print-rpki-rtr.c
index 6cc592eb01..8e4c73f109 100644
--- a/print-rpki-rtr.c
+++ b/print-rpki-rtr.c
@@ -80,10 +80,13 @@ typedef struct rpki_rtr_pdu_ipv6_prefix_ {
  * Error report PDU.
  */
 typedef struct rpki_rtr_pdu_error_report_ {
     rpki_rtr_pdu pdu_header;
     u_char encapsulated_pdu_length[4]; /* Encapsulated PDU length */
+    /* Copy of Erroneous PDU (variable, optional) */
+    /* Length of Error Text (4 octets in network byte order) */
+    /* Arbitrary Text of Error Diagnostic Message (variable, optional) */
 } rpki_rtr_pdu_error_report;
 
 /*
  * PDU type codes
  */
@@ -169,37 +172,63 @@ indent_string (u_int indent)
 }
 
 /*
  * Print a single PDU.
  */
-static int
-rpki_rtr_pdu_print (netdissect_options *ndo, const u_char *tptr, u_int indent)
+static u_int
+rpki_rtr_pdu_print (netdissect_options *ndo, const u_char *tptr, const u_int len,
+	const u_char recurse, const u_int indent)
 {
     const rpki_rtr_pdu *pdu_header;
     u_int pdu_type, pdu_len, hexdump;
     const u_char *msg;
 
+    /* Protocol Version */
+    ND_TCHECK_8BITS(tptr);
+    if (*tptr != 0) {
+	/* Skip the rest of the input buffer because even if this is
+	 * a well-formed PDU of a future RPKI-Router protocol version
+	 * followed by a well-formed PDU of RPKI-Router protocol
+	 * version 0, there is no way to know exactly how to skip the
+	 * current PDU.
+	 */
+	ND_PRINT((ndo, "%sRPKI-RTRv%u (unknown)", indent_string(8), *tptr));
+	return len;
+    }
+    if (len < sizeof(rpki_rtr_pdu)) {
+	ND_PRINT((ndo, "(%u bytes is too few to decode)", len));
+	goto invalid;
+    }
+    ND_TCHECK2(*tptr, sizeof(rpki_rtr_pdu));
     pdu_header = (const rpki_rtr_pdu *)tptr;
     pdu_type = pdu_header->pdu_type;
     pdu_len = EXTRACT_32BITS(pdu_header->length);
-    ND_TCHECK2(*tptr, pdu_len);
+    /* Do not check bounds with pdu_len yet, do it in the case blocks
+     * below to make it possible to decode at least the beginning of
+     * a truncated Error Report PDU or a truncated encapsulated PDU.
+     */
     hexdump = FALSE;
 
     ND_PRINT((ndo, "%sRPKI-RTRv%u, %s PDU (%u), length: %u",
 	   indent_string(8),
 	   pdu_header->version,
 	   tok2str(rpki_rtr_pdu_values, "Unknown", pdu_type),
 	   pdu_type, pdu_len));
+    if (pdu_len < sizeof(rpki_rtr_pdu) || pdu_len > len)
+	goto invalid;
 
     switch (pdu_type) {
 
 	/*
 	 * The following PDUs share the message format.
 	 */
     case RPKI_RTR_SERIAL_NOTIFY_PDU:
     case RPKI_RTR_SERIAL_QUERY_PDU:
     case RPKI_RTR_END_OF_DATA_PDU:
+	if (pdu_len != sizeof(rpki_rtr_pdu) + 4)
+	    goto invalid;
+	ND_TCHECK2(*tptr, pdu_len);
         msg = (const u_char *)(pdu_header + 1);
 	ND_PRINT((ndo, "%sSession ID: 0x%04x, Serial: %u",
 	       indent_string(indent+2),
 	       EXTRACT_16BITS(pdu_header->u.session_id),
 	       EXTRACT_32BITS(msg)));
@@ -208,26 +237,35 @@ rpki_rtr_pdu_print (netdissect_options *ndo, const u_char *tptr, u_int indent)
 	/*
 	 * The following PDUs share the message format.
 	 */
     case RPKI_RTR_RESET_QUERY_PDU:
     case RPKI_RTR_CACHE_RESET_PDU:
+	if (pdu_len != sizeof(rpki_rtr_pdu))
+	    goto invalid;
+	/* no additional boundary to check */
 
 	/*
 	 * Zero payload PDUs.
 	 */
 	break;
 
     case RPKI_RTR_CACHE_RESPONSE_PDU:
+	if (pdu_len != sizeof(rpki_rtr_pdu))
+	    goto invalid;
+	/* no additional boundary to check */
 	ND_PRINT((ndo, "%sSession ID: 0x%04x",
 	       indent_string(indent+2),
 	       EXTRACT_16BITS(pdu_header->u.session_id)));
 	break;
 
     case RPKI_RTR_IPV4_PREFIX_PDU:
 	{
 	    const rpki_rtr_pdu_ipv4_prefix *pdu;
 
+	    if (pdu_len != sizeof(rpki_rtr_pdu) + 12)
+		goto invalid;
+	    ND_TCHECK2(*tptr, pdu_len);
 	    pdu = (const rpki_rtr_pdu_ipv4_prefix *)tptr;
 	    ND_PRINT((ndo, "%sIPv4 Prefix %s/%u-%u, origin-as %u, flags 0x%02x",
 		   indent_string(indent+2),
 		   ipaddr_string(ndo, pdu->prefix),
 		   pdu->prefix_length, pdu->max_length,
@@ -237,10 +275,13 @@ rpki_rtr_pdu_print (netdissect_options *ndo, const u_char *tptr, u_int indent)
 
     case RPKI_RTR_IPV6_PREFIX_PDU:
 	{
 	    const rpki_rtr_pdu_ipv6_prefix *pdu;
 
+	    if (pdu_len != sizeof(rpki_rtr_pdu) + 24)
+		goto invalid;
+	    ND_TCHECK2(*tptr, pdu_len);
 	    pdu = (const rpki_rtr_pdu_ipv6_prefix *)tptr;
 	    ND_PRINT((ndo, "%sIPv6 Prefix %s/%u-%u, origin-as %u, flags 0x%02x",
 		   indent_string(indent+2),
 		   ip6addr_string(ndo, pdu->prefix),
 		   pdu->prefix_length, pdu->max_length,
@@ -251,56 +292,80 @@ rpki_rtr_pdu_print (netdissect_options *ndo, const u_char *tptr, u_int indent)
     case RPKI_RTR_ERROR_REPORT_PDU:
 	{
 	    const rpki_rtr_pdu_error_report *pdu;
 	    u_int encapsulated_pdu_length, text_length, tlen, error_code;
 
+	    tlen = sizeof(rpki_rtr_pdu);
+	    /* Do not test for the "Length of Error Text" data element yet. */
+	    if (pdu_len < tlen + 4)
+		goto invalid;
+	    ND_TCHECK2(*tptr, tlen + 4);
+	    /* Safe up to and including the "Length of Encapsulated PDU"
+	     * data element, more data elements may be present.
+	     */
 	    pdu = (const rpki_rtr_pdu_error_report *)tptr;
 	    encapsulated_pdu_length = EXTRACT_32BITS(pdu->encapsulated_pdu_length);
-	    ND_TCHECK2(*tptr, encapsulated_pdu_length);
-	    tlen = pdu_len;
+	    tlen += 4;
 
 	    error_code = EXTRACT_16BITS(pdu->pdu_header.u.error_code);
 	    ND_PRINT((ndo, "%sError code: %s (%u), Encapsulated PDU length: %u",
 		   indent_string(indent+2),
 		   tok2str(rpki_rtr_error_codes, "Unknown", error_code),
 		   error_code, encapsulated_pdu_length));
 
-	    tptr += sizeof(*pdu);
-	    tlen -= sizeof(*pdu);
-
-	    /*
-	     * Recurse if there is an encapsulated PDU.
-	     */
-	    if (encapsulated_pdu_length &&
-		(encapsulated_pdu_length <= tlen)) {
-		ND_PRINT((ndo, "%s-----encapsulated PDU-----", indent_string(indent+4)));
-		if (rpki_rtr_pdu_print(ndo, tptr, indent+2))
-			goto trunc;
+	    if (encapsulated_pdu_length) {
+		/* Section 5.10 of RFC 6810 says:
+		 * "An Error Report PDU MUST NOT be sent for an Error Report PDU."
+		 *
+		 * However, as far as the protocol encoding goes Error Report PDUs can
+		 * happen to be nested in each other, however many times, in which case
+		 * the decoder should still print such semantically incorrect PDUs.
+		 *
+		 * That said, "the Erroneous PDU field MAY be truncated" (ibid), thus
+		 * to keep things simple this implementation decodes only the two
+		 * outermost layers of PDUs and makes bounds checks in the outer and
+		 * the inner PDU independently.
+		 */
+		if (pdu_len < tlen + encapsulated_pdu_length)
+		    goto invalid;
+		if (! recurse) {
+		    ND_TCHECK2(*tptr, tlen + encapsulated_pdu_length);
+		}
+		else {
+		    ND_PRINT((ndo, "%s-----encapsulated PDU-----", indent_string(indent+4)));
+		    rpki_rtr_pdu_print(ndo, tptr + tlen,
+			encapsulated_pdu_length, 0, indent + 2);
+		}
+		tlen += encapsulated_pdu_length;
 	    }
 
-	    tptr += encapsulated_pdu_length;
-	    tlen -= encapsulated_pdu_length;
+	    if (pdu_len < tlen + 4)
+		goto invalid;
+	    ND_TCHECK2(*tptr, tlen + 4);
+	    /* Safe up to and including the "Length of Error Text" data element,
+	     * one more data element may be present.
+	     */
 
 	    /*
 	     * Extract, trail-zero and print the Error message.
 	     */
-	    text_length = 0;
-	    if (tlen > 4) {
-		text_length = EXTRACT_32BITS(tptr);
-		tptr += 4;
-		tlen -= 4;
-	    }
-	    ND_TCHECK2(*tptr, text_length);
-	    if (text_length && (text_length <= tlen )) {
+	    text_length = EXTRACT_32BITS(tptr + tlen);
+	    tlen += 4;
+
+	    if (text_length) {
+		if (pdu_len < tlen + text_length)
+		    goto invalid;
+		/* fn_printn() makes the bounds check */
 		ND_PRINT((ndo, "%sError text: ", indent_string(indent+2)));
-		if (fn_printn(ndo, tptr, text_length, ndo->ndo_snapend))
+		if (fn_printn(ndo, tptr + tlen, text_length, ndo->ndo_snapend))
 			goto trunc;
 	    }
 	}
 	break;
 
     default:
+	ND_TCHECK2(*tptr, pdu_len);
 
 	/*
 	 * Unknown data, please hexdump.
 	 */
 	hexdump = TRUE;
@@ -308,61 +373,33 @@ rpki_rtr_pdu_print (netdissect_options *ndo, const u_char *tptr, u_int indent)
 
     /* do we also want to see a hex dump ? */
     if (ndo->ndo_vflag > 1 || (ndo->ndo_vflag && hexdump)) {
 	print_unknown_data(ndo,tptr,"\n\t  ", pdu_len);
     }
-    return 0;
+    return pdu_len;
 
+invalid:
+    ND_PRINT((ndo, "%s", istr));
+    ND_TCHECK2(*tptr, len);
+    return len;
 trunc:
-    return 1;
+    ND_PRINT((ndo, "\n\t%s", tstr));
+    return len;
 }
 
 void
 rpki_rtr_print(netdissect_options *ndo, register const u_char *pptr, register u_int len)
 {
-    u_int tlen, pdu_type, pdu_len;
-    const u_char *tptr;
-    const rpki_rtr_pdu *pdu_header;
-
-    tptr = pptr;
-    tlen = len;
-
     if (!ndo->ndo_vflag) {
 	ND_PRINT((ndo, ", RPKI-RTR"));
 	return;
     }
-
-    while (tlen >= sizeof(rpki_rtr_pdu)) {
-
-        ND_TCHECK2(*tptr, sizeof(rpki_rtr_pdu));
-
-	pdu_header = (const rpki_rtr_pdu *)tptr;
-        pdu_type = pdu_header->pdu_type;
-        pdu_len = EXTRACT_32BITS(pdu_header->length);
-        ND_TCHECK2(*tptr, pdu_len);
-
-        /* infinite loop check */
-        if (!pdu_type || !pdu_len) {
-            break;
-        }
-
-        if (tlen < pdu_len) {
-            goto trunc;
-        }
-
-	/*
-	 * Print the PDU.
-	 */
-	if (rpki_rtr_pdu_print(ndo, tptr, 8))
-		goto trunc;
-
-        tlen -= pdu_len;
-        tptr += pdu_len;
+    while (len) {
+	u_int pdu_len = rpki_rtr_pdu_print(ndo, pptr, len, 1, 8);
+	len -= pdu_len;
+	pptr += pdu_len;
     }
-    return;
-trunc:
-    ND_PRINT((ndo, "\n\t%s", tstr));
 }
 
 /*
  * Local Variables:
  * c-style: whitesmith
diff --git a/tests/TESTLIST b/tests/TESTLIST
index 1681849a06..a3e038b3fc 100644
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -568,10 +568,11 @@ bgp_mvpn_6_and_7	bgp_mvpn_6_and_7.pcap		bgp_mvpn_6_and_7.out	-v -c1
 rsvp_fast_reroute-oobr	rsvp_fast_reroute-oobr.pcap	rsvp_fast_reroute-oobr.out -v -c1
 esis_opt_prot-oobr	esis_opt_prot-oobr.pcap		esis_opt_prot-oobr.out	-v -c1
 rsvp_uni-oobr-1	rsvp_uni-oobr-1.pcap	rsvp_uni-oobr-1.out	-v -c1
 rsvp_uni-oobr-2	rsvp_uni-oobr-2.pcap	rsvp_uni-oobr-2.out	-v -c1
 rsvp_uni-oobr-3	rsvp_uni-oobr-3.pcap	rsvp_uni-oobr-3.out	-v -c3
+rpki-rtr-oob		rpki-rtr-oob.pcap	rpki-rtr-oob.out	-v -c1
 
 # bad packets from Katie Holly
 mlppp-oobr		mlppp-oobr.pcap			mlppp-oobr.out
 
 # bad packets from Kim Gwan Yeong
diff --git a/tests/kday2.out b/tests/kday2.out
index fa135729c6..ccbaae9ec5 100644
--- a/tests/kday2.out
+++ b/tests/kday2.out
@@ -16,14 +16,7 @@ IP (tos 0x10, ttl 62, id 62920, offset 0, flags [DF], proto TCP (6), length 52,
     204.9.51.132.50079 > 204.243.53.80.22: Flags [.], cksum 0x858b (incorrect -> 0x66a1), ack 2339312418, win 4092, options [nop,nop,TS val 941371913 ecr 1340592084], length 0
 IP (tos 0x0, ttl 64, id 63178, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 3e8c (->438c)!)
     204.9.64.80.55936 > 204.9.40.10.443: Flags [.], cksum 0x0594 (incorrect -> 0x7767), ack 3587398274, win 1040, options [nop,nop,TS val 647770294 ecr 2364779354], length 0
 IP (tos 0x0, ttl 64, id 36752, offset 0, flags [DF], proto TCP (6), length 399, bad cksum a46b (->a474)!)
     204.0.55.10.323 > 204.9.54.80.55936: Flags [P.], cksum 0xc9b6 (incorrect -> 0x8900), seq 3589495407:3589495754, ack 370428050, win 1040, options [nop,nop,TS val 2364757411 ecr 3084508609], length 347
-	RPKI-RTRv177, Unknown PDU (100), length: 60
-	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
-	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
-	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
-	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
-	RPKI-RTRv65, Error Report PDU (10), length: 21
-	  Error code: Unknown (66), Encapsulated PDU length: 37
-	[|RPKI-RTR]
+	RPKI-RTRv177 (unknown)
 EXIT CODE 00000100
diff --git a/tests/kday3.out b/tests/kday3.out
index 95909e0664..4ae7a5cac4 100644
--- a/tests/kday3.out
+++ b/tests/kday3.out
@@ -5,30 +5,16 @@ IP (tos 0x10, ttl 62, id 62920, offset 0, flags [DF], proto TCP (6), length 52,
     204.9.51.132.50079 > 204.243.53.80.22: Flags [.], cksum 0x858b (incorrect -> 0x85a1), ack 1819218722, win 4092, options [nop,nop,TS val 941371913 ecr 1340592084], length 0
 IP (tos 0x0, ttl 64, id 63178, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 3e8c (->438c)!)
     204.9.64.80.55936 > 204.9.40.10.443: Flags [.], cksum 0x0594 (incorrect -> 0x7767), ack 3587398274, win 1040, options [nop,nop,TS val 647770294 ecr 2364779354], length 0
 IP (tos 0x0, ttl 64, id 36752, offset 0, flags [DF], proto TCP (6), length 399, bad cksum a46b (->a474)!)
     204.0.55.10.323 > 204.9.54.80.55936: Flags [P.], cksum 0xc9b6 (incorrect -> 0x0cf1), seq 3589495407:3589495754, ack 370428050, win 1040, options [nop,nop,TS val 2381534627 ecr 3084508609], length 347
-	RPKI-RTRv177, Unknown PDU (100), length: 60
-	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
-	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
-	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
-	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
-	RPKI-RTRv65, Error Report PDU (10), length: 66
-	[|RPKI-RTR]
+	RPKI-RTRv177 (unknown)
 IP (tos 0x10, ttl 62, id 64806, offset 0, flags [DF], proto TCP (6), length 52)
     204.9.51.132.50079 > 204.9.54.80.22: Flags [.], cksum 0x8611 (incorrect -> 0xa678), ack 0, win 4094, options [nop,nop,TS val 941371775 ecr 4294967242], length 0
 IP (tos 0x10, ttl 62, id 62920, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 4504 (->451a)!)
     204.9.51.132.50079 > 204.243.53.80.22: Flags [.], cksum 0x858b (incorrect -> 0x85a1), ack 1, win 4092, options [nop,nop,TS val 941371913 ecr 1340592084], length 0
 IP (tos 0x0, ttl 64, id 63178, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 3e8c (->438c)!)
     204.9.64.80.55936 > 204.9.40.10.443: Flags [.], cksum 0x0594 (incorrect -> 0x8d67), ack 1, win 1040, options [nop,nop,TS val 647770294 ecr 2364773722], length 0
 IP (tos 0x0, ttl 64, id 36752, offset 0, flags [DF], proto TCP (6), length 399, bad cksum a46b (->a474)!)
     204.0.55.10.323 > 204.9.54.80.55936: Flags [P.], cksum 0xc9b6 (incorrect -> 0xa6b3), seq 0:347, ack 1, win 1040, options [nop,nop,TS val 2364757411 ecr 3084508609], length 347
-	RPKI-RTRv177, Unknown PDU (100), length: 60
-	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
-	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
-	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
-	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
-	RPKI-RTRv65, Error Report PDU (10), length: 66
-	  Error code: Unknown (66), Encapsulated PDU length: 37
-	    -----encapsulated PDU-----
-	[|RPKI-RTR]
+	RPKI-RTRv177 (unknown)
 EXIT CODE 00000100
diff --git a/tests/kday4.out b/tests/kday4.out
index ccdebfc8fc..5e2ab47567 100644
--- a/tests/kday4.out
+++ b/tests/kday4.out
@@ -9,50 +9,25 @@ IP (tos 0x10, ttl 62, id 64806, offset 0, flags [DF], proto TCP (6), length 52,
 	0x0030:  4fe7 cfd4                                O...
 IP (tos 0x0, ttl 64, id 63178, offset 0, flags [DF], proto TCP (6), length 52)
     204.9.54.80.55936 > 204.9.55.10.443: Flags [.], cksum 0x0594 (incorrect -> 0x725a), ack 3589495407, win 1040, options [nop,nop,TS val 647770294 ecr 2364779354], length 0
 IP (tos 0x0, ttl 64, id 36752, offset 0, flags [DF], proto TCP (6), length 399, bad cksum a46b (->a474)!)
     204.0.55.10.323 > 204.9.54.80.55936: Flags [P.], cksum 0xc9b6 (incorrect -> 0xcd5f), seq 3589495407:3589495754, ack 370436242, win 1040, options [nop,nop,TS val 2364757411 ecr 3084508609], length 347
-	RPKI-RTRv177, Unknown PDU (100), length: 60
-	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
-	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
-	  0x0020:  b36d cc11 3abf 1291 f106 4ede 58f4 6297
-	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
-	RPKI-RTRv65, Error Report PDU (10), length: 66
-	  Error code: Unknown (66), Encapsulated PDU length: 37
-	    -----encapsulated PDU-----
-	[|RPKI-RTR]
+	RPKI-RTRv177 (unknown)
 IP (tos 0x10, ttl 62, id 64806, offset 0, flags [DF], proto TCP (6), length 52)
     204.9.51.132.50079 > 204.9.54.80.22: Flags [.], cksum 0x8611 (incorrect -> 0xa678), ack 1819218606, win 4094, options [nop,nop,TS val 941371775 ecr 4294967242], length 0
 IP (tos 0x10, ttl 62, id 62920, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 4504 (->451a)!)
     204.9.51.132.50079 > 204.243.53.80.22: Flags [.], cksum 0x858b (incorrect -> 0x85a1), ack 1819218722, win 4092, options [nop,nop,TS val 941371913 ecr 1340592084], length 0
 IP (tos 0x0, ttl 64, id 63178, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 3e8c (->438c)!)
     204.9.64.80.55936 > 204.9.40.10.443: Flags [.], cksum 0x0594 (incorrect -> 0x8d67), ack 3587398274, win 1040, options [nop,nop,TS val 647770294 ecr 2364773722], length 0
 IP (tos 0x0, ttl 64, id 36752, offset 0, flags [DF], proto TCP (6), length 399, bad cksum a46b (->a474)!)
     204.0.55.10.323 > 204.9.54.80.55936: Flags [P.], cksum 0xc9b6 (incorrect -> 0xfa70), seq 0:347, ack 4294959105, win 1040, options [nop,nop,TS val 2364757411 ecr 3084508609], length 347
-	RPKI-RTRv197, Unknown PDU (100), length: 60
-	  0x0000:  c564 003c 0000 003c 0000 00ff ff1f 1b70
-	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
-	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
-	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
-	RPKI-RTRv65, Error Report PDU (10), length: 66
-	  Error code: Unknown (66), Encapsulated PDU length: 37
-	    -----encapsulated PDU-----
-	[|RPKI-RTR]
+	RPKI-RTRv197 (unknown)
 IP truncated-ip - 768 bytes missing! (tos 0x10, ttl 62, id 64806, offset 0, flags [DF], proto TCP (6), length 820, bad cksum 3da6 (->3aa6)!)
     204.9.51.132.50079 > 204.9.54.80.22: Flags [.], seq 0:768, ack 1, win 4094, options [nop,nop,TS val 941371775 ecr 4294967242], length 768
 IP (tos 0x6,ECT(0), ttl 62, id 62920, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 4504 (->4524)!)
     204.9.51.132.50079 > 204.243.53.80.22: Flags [.], cksum 0x858b (incorrect -> 0x85a1), ack 1, win 4092, options [nop,nop,TS val 941371913 ecr 1340592084], length 0
 IP (tos 0x0, ttl 64, id 63178, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 3e8c (->438c)!)
     204.9.64.80.55936 > 204.9.40.10.443: Flags [.], cksum 0x0594 (incorrect -> 0x8d67), ack 1, win 1040, options [nop,nop,TS val 647770294 ecr 2364773722], length 0
 IP (tos 0x0, ttl 64, id 36752, offset 0, flags [DF], proto TCP (6), length 399, bad cksum a46b (->a474)!)
     204.0.55.10.323 > 204.9.54.80.55936: Flags [P.], cksum 0xc9b6 (incorrect -> 0x3f28), seq 0:347, ack 4294959105, win 1040, options [nop,nop,TS val 2364757411 ecr 3084508609], length 347
-	RPKI-RTRv177, Unknown PDU (100), length: 60
-	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
-	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
-	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
-	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
-	RPKI-RTRv65, Error Report PDU (10), length: 66
-	  Error code: Unknown (66), Encapsulated PDU length: 100
-	  Error text: ^@^@^@M-^?M-^?^_^[pM-xWM-nhMM-}M_M-YM-=M-G^I0M-,M-^AvM-3mM-L^Q:M-?^RM-^QM-q^FNM-^aM-tbM-^WM-/M-D9M-$^MM-9zM-%hs3M-hA^J^@B^@^@^@B^@^@^@%M-Dz^HM-i^RM-^DM-5M-^\M->0H^H^@E^P^@4M-}&@^@>^F
-	RPKI-RTRv115, Error Report PDU (10), length: 66
-	[|RPKI-RTR]
+	RPKI-RTRv177 (unknown)
 EXIT CODE 00000100
diff --git a/tests/kday5.out b/tests/kday5.out
index 4a8ed7c97a..a529dd2a47 100644
--- a/tests/kday5.out
+++ b/tests/kday5.out
@@ -16,15 +16,7 @@ IP (tos 0x10, ttl 62, id 62920, offset 0, flags [DF], proto TCP (6), length 52,
     204.9.51.132.50079 > 204.243.53.80.22: Flags [.], cksum 0x858b (incorrect -> 0x98c3), ack 1819279359, win 4092, options [nop,nop,TS val 941371913 ecr 1340592084], length 0
 IP (tos 0x0, ttl 64, id 63178, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 3e8c (->438c)!)
     204.9.64.80.55936 > 204.9.40.10.443: Flags [.], cksum 0x0594 (incorrect -> 0x7767), ack 3587398274, win 1040, options [nop,nop,TS val 647770294 ecr 2364779354], length 0
 IP (tos 0x0, ttl 64, id 36752, offset 0, flags [DF], proto TCP (6), length 399, bad cksum a46b (->a474)!)
     204.0.55.10.323 > 204.9.54.80.55936: Flags [P.], cksum 0xc9b6 (incorrect -> 0x183a), seq 3589495407:3589495754, ack 370428050, win 1040, options [nop,nop,TS val 2351322531 ecr 3084508609], length 347
-	RPKI-RTRv177, Unknown PDU (100), length: 60
-	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
-	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
-	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
-	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
-	RPKI-RTRv65, Error Report PDU (10), length: 66
-	  Error code: Unknown (66), Encapsulated PDU length: 80
-	  Error text: M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-CM-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^V^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J
-	[|RPKI-RTR]
+	RPKI-RTRv177 (unknown)
 EXIT CODE 00000100
diff --git a/tests/kday7.out b/tests/kday7.out
index 75e24cafe7..569cde620f 100644
--- a/tests/kday7.out
+++ b/tests/kday7.out
@@ -9,48 +9,25 @@ IP (tos 0x10, ttl 62, id 64806, offset 0, flags [DF], proto TCP (6), length 52,
 	0x0030:  4fe7 cfd4                                O...
 IP (tos 0x0, ttl 64, id 63178, offset 0, flags [DF], proto TCP (6), length 52)
     204.9.54.80.55936 > 204.9.55.10.443: Flags [.], cksum 0x0594 (incorrect -> 0x725a), ack 3589495407, win 1040, options [nop,nop,TS val 647770294 ecr 2364779354], length 0
 IP (tos 0x0, ttl 64, id 36752, offset 0, flags [DF], proto TCP (6), length 399, bad cksum a46b (->a474)!)
     204.0.55.10.323 > 204.9.54.80.55936: Flags [P.], cksum 0xc9b6 (incorrect -> 0xcd5f), seq 3589495407:3589495754, ack 370436242, win 1040, options [nop,nop,TS val 2364757411 ecr 3084508609], length 347
-	RPKI-RTRv177, Unknown PDU (100), length: 60
-	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
-	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
-	  0x0020:  b36d cc11 3abf 1291 f106 4ede 58f4 6297
-	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
-	RPKI-RTRv65, Error Report PDU (10), length: 66
-	  Error code: Unknown (66), Encapsulated PDU length: 37
-	    -----encapsulated PDU-----
-	[|RPKI-RTR]
+	RPKI-RTRv177 (unknown)
 IP (tos 0x10, ttl 62, id 64806, offset 0, flags [DF], proto TCP (6), length 52)
     204.9.51.132.50079 > 204.9.54.80.22: Flags [.], cksum 0x8611 (incorrect -> 0xa678), ack 1819218606, win 4094, options [nop,nop,TS val 941371775 ecr 4294967242], length 0
 IP (tos 0x10, ttl 62, id 62920, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 4504 (->451a)!)
     204.9.51.132.50079 > 204.243.53.80.22: Flags [.], cksum 0x858b (incorrect -> 0x85a1), ack 1819218722, win 4092, options [nop,nop,TS val 941371913 ecr 1340592084], length 0
 IP (tos 0x0, ttl 64, id 63178, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 3e8c (->438c)!)
     204.9.64.80.55936 > 204.9.40.10.443: Flags [.], cksum 0x0594 (incorrect -> 0x8d67), ack 3587398274, win 1040, options [nop,nop,TS val 647770294 ecr 2364773722], length 0
 IP (tos 0x0, ttl 64, id 36752, offset 0, flags [DF], proto TCP (6), length 399, bad cksum a46b (->a474)!)
     204.0.55.10.323 > 204.9.54.80.55936: Flags [P.], cksum 0xc9b6 (incorrect -> 0xfa86), seq 0:347, ack 4294959105, win 1040, options [nop,nop,TS val 2364757411 ecr 3084508609], length 347
-	RPKI-RTRv197, Unknown PDU (100), length: 60
-	  0x0000:  c564 003c 0000 003c 0000 00ff ff1f 1b70
-	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
-	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
-	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
-	RPKI-RTRv65, Error Report PDU (10), length: 66
-	  Error code: Unknown (66), Encapsulated PDU length: 37
-	    -----encapsulated PDU-----
-	[|RPKI-RTR]
+	RPKI-RTRv197 (unknown)
 IP truncated-ip - 768 bytes missing! (tos 0x10, ttl 62, id 64806, offset 0, flags [DF], proto TCP (6), length 820, bad cksum 3da6 (->3aa6)!)
     204.9.51.132.50079 > 204.9.54.80.22: Flags [.], seq 0:768, ack 1, win 4094, options [nop,nop,TS val 941371775 ecr 4294967242], length 768
 IP (tos 0x6,ECT(0), ttl 62, id 62920, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 4504 (->4524)!)
     204.9.51.132.50079 > 204.243.53.80.22: Flags [.], cksum 0x858b (incorrect -> 0x85a1), ack 1, win 4092, options [nop,nop,TS val 941371913 ecr 1340592084], length 0
 IP (tos 0x0, ttl 64, id 63178, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 3e8c (->438c)!)
     204.9.64.80.55936 > 204.9.40.10.443: Flags [.], cksum 0x0594 (incorrect -> 0x8d67), ack 1, win 1040, options [nop,nop,TS val 647770294 ecr 2364773722], length 0
 IP (tos 0x0, ttl 64, id 36752, offset 0, flags [DF], proto TCP (6), length 399, bad cksum a46b (->a474)!)
     204.0.55.10.323 > 204.9.54.80.55936: Flags [P.], cksum 0xc9b6 (incorrect -> 0x4ba9), seq 0:347, ack 4294959105, win 1040, options [nop,nop,TS val 2364757411 ecr 3084508609], length 347
-	RPKI-RTRv177, Unknown PDU (100), length: 60
-	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
-	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
-	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
-	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
-	RPKI-RTRv65, Error Report PDU (10), length: 66
-	  Error code: Unknown (66), Encapsulated PDU length: 100
-	[|RPKI-RTR]
+	RPKI-RTRv177 (unknown)
 EXIT CODE 00000100
diff --git a/tests/kday8.out b/tests/kday8.out
index 4dfb91c4ae..2e4060b2c9 100644
--- a/tests/kday8.out
+++ b/tests/kday8.out
@@ -16,14 +16,7 @@ IP (tos 0x10, ttl 62, id 62920, offset 0, flags [DF], proto TCP (6), length 52,
     204.9.51.132.50079 > 204.243.53.80.22: Flags [.], cksum 0x858b (incorrect -> 0x85a1), ack 1819218722, win 4092, options [nop,nop,TS val 941371913 ecr 1340592084], length 0
 IP (tos 0x0, ttl 64, id 63178, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 3e8c (->438c)!)
     204.9.64.80.55936 > 204.9.40.10.443: Flags [.], cksum 0x0594 (incorrect -> 0x7767), ack 3587398274, win 1040, options [nop,nop,TS val 647770294 ecr 2364779354], length 0
 IP (tos 0x0, ttl 64, id 36752, offset 0, flags [DF], proto TCP (6), length 399, bad cksum a46b (->a474)!)
     204.0.55.10.323 > 204.9.54.80.55936: Flags [P.], cksum 0xc9b6 (incorrect -> 0xed9b), seq 3589495407:3589495754, ack 370428050, win 1040, options [nop,nop,TS val 2364757411 ecr 3084508609], length 347
-	RPKI-RTRv177, Unknown PDU (100), length: 60
-	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
-	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
-	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
-	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
-	RPKI-RTRv65, Error Report PDU (10), length: 66
-	  Error code: Unknown (66), Encapsulated PDU length: 80
-	[|RPKI-RTR]
+	RPKI-RTRv177 (unknown)
 EXIT CODE 00000100
diff --git a/tests/rpki-rtr-oob.out b/tests/rpki-rtr-oob.out
new file mode 100644
index 0000000000..19bbdc2626
--- /dev/null
+++ b/tests/rpki-rtr-oob.out
@@ -0,0 +1,3 @@
+IP truncated-ip - 22 bytes missing! (tos 0x0, ttl 254, id 13327, offset 0, flags [+, DF, rsvd], proto TCP (6), length 62, bad cksum 8e7f (->c283)!)
+    19.128.128.20.323 > 76.19.6.127.49600: Flags [none], seq 2684354563:2684354585, win 28672, length 22
+	RPKI-RTRv171 (unknown)
diff --git a/tests/rpki-rtr-oob.pcap b/tests/rpki-rtr-oob.pcap
new file mode 100644
index 0000000000..e7b4eb2e5e
Binary files /dev/null and b/tests/rpki-rtr-oob.pcap differ

Vulnerable code: static int
rpki_rtr_pdu_print (netdissect_options *ndo, const u_char *tptr, u_int indent)
    ND_TCHECK2(*tptr, pdu_len);
	    ND_TCHECK2(*tptr, encapsulated_pdu_length);
	    tlen = pdu_len;
	    tptr += sizeof(*pdu);
	    tlen -= sizeof(*pdu);

	    /*
	     * Recurse if there is an encapsulated PDU.
	     */
	    if (encapsulated_pdu_length &&
		(encapsulated_pdu_length <= tlen)) {
		ND_PRINT((ndo, "%s-----encapsulated PDU-----", indent_string(indent+4)));
		if (rpki_rtr_pdu_print(ndo, tptr, indent+2))
			goto trunc;
	    tptr += encapsulated_pdu_length;
	    tlen -= encapsulated_pdu_length;
	    text_length = 0;
	    if (tlen > 4) {
		text_length = EXTRACT_32BITS(tptr);
		tptr += 4;
		tlen -= 4;
	    }
	    ND_TCHECK2(*tptr, text_length);
	    if (text_length && (text_length <= tlen )) {
		if (fn_printn(ndo, tptr, text_length, ndo->ndo_snapend))
    return 0;
    return 1;
    u_int tlen, pdu_type, pdu_len;
    const u_char *tptr;
    const rpki_rtr_pdu *pdu_header;

    tptr = pptr;
    tlen = len;


    while (tlen >= sizeof(rpki_rtr_pdu)) {

        ND_TCHECK2(*tptr, sizeof(rpki_rtr_pdu));

	pdu_header = (const rpki_rtr_pdu *)tptr;
        pdu_type = pdu_header->pdu_type;
        pdu_len = EXTRACT_32BITS(pdu_header->length);
        ND_TCHECK2(*tptr, pdu_len);

        /* infinite loop check */
        if (!pdu_type || !pdu_len) {
            break;
        }

        if (tlen < pdu_len) {
            goto trunc;
        }

	/*
	 * Print the PDU.
	 */
	if (rpki_rtr_pdu_print(ndo, tptr, 8))
		goto trunc;

        tlen -= pdu_len;
        tptr += pdu_len;
    return;
trunc:
    ND_PRINT((ndo, "\n\t%s", tstr));
	RPKI-RTRv177, Unknown PDU (100), length: 60
	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
	RPKI-RTRv65, Error Report PDU (10), length: 21
	  Error code: Unknown (66), Encapsulated PDU length: 37
	[|RPKI-RTR]
	RPKI-RTRv177, Unknown PDU (100), length: 60
	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
	RPKI-RTRv65, Error Report PDU (10), length: 66
	[|RPKI-RTR]
	RPKI-RTRv177, Unknown PDU (100), length: 60
	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
	RPKI-RTRv65, Error Report PDU (10), length: 66
	  Error code: Unknown (66), Encapsulated PDU length: 37
	    -----encapsulated PDU-----
	[|RPKI-RTR]
	RPKI-RTRv177, Unknown PDU (100), length: 60
	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
	  0x0020:  b36d cc11 3abf 1291 f106 4ede 58f4 6297
	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
	RPKI-RTRv65, Error Report PDU (10), length: 66
	  Error code: Unknown (66), Encapsulated PDU length: 37
	    -----encapsulated PDU-----
	[|RPKI-RTR]
	RPKI-RTRv197, Unknown PDU (100), length: 60
	  0x0000:  c564 003c 0000 003c 0000 00ff ff1f 1b70
	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
	RPKI-RTRv65, Error Report PDU (10), length: 66
	  Error code: Unknown (66), Encapsulated PDU length: 37
	    -----encapsulated PDU-----
	[|RPKI-RTR]
	RPKI-RTRv177, Unknown PDU (100), length: 60
	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
	RPKI-RTRv65, Error Report PDU (10), length: 66
	  Error code: Unknown (66), Encapsulated PDU length: 100
	  Error text: ^@^@^@M-^?M-^?^_^[pM-xWM-nhMM-}M_M-YM-=M-G^I0M-,M-^AvM-3mM-L^Q:M-?^RM-^QM-q^FNM-^aM-tbM-^WM-/M-D9M-$^MM-9zM-%hs3M-hA^J^@B^@^@^@B^@^@^@%M-Dz^HM-i^RM-^DM-5M-^\M->0H^H^@E^P^@4M-}&@^@>^F
	RPKI-RTRv115, Error Report PDU (10), length: 66
	[|RPKI-RTR]
	RPKI-RTRv177, Unknown PDU (100), length: 60
	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
	RPKI-RTRv65, Error Report PDU (10), length: 66
	  Error code: Unknown (66), Encapsulated PDU length: 80
	  Error text: M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-CM-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9M-9^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^V^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J^J
	[|RPKI-RTR]
	RPKI-RTRv177, Unknown PDU (100), length: 60
	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
	  0x0020:  b36d cc11 3abf 1291 f106 4ede 58f4 6297
	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
	RPKI-RTRv65, Error Report PDU (10), length: 66
	  Error code: Unknown (66), Encapsulated PDU length: 37
	    -----encapsulated PDU-----
	[|RPKI-RTR]
	RPKI-RTRv197, Unknown PDU (100), length: 60
	  0x0000:  c564 003c 0000 003c 0000 00ff ff1f 1b70
	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
	RPKI-RTRv65, Error Report PDU (10), length: 66
	  Error code: Unknown (66), Encapsulated PDU length: 37
	    -----encapsulated PDU-----
	[|RPKI-RTR]
	RPKI-RTRv177, Unknown PDU (100), length: 60
	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
	RPKI-RTRv65, Error Report PDU (10), length: 66
	  Error code: Unknown (66), Encapsulated PDU length: 100
	[|RPKI-RTR]
	RPKI-RTRv177, Unknown PDU (100), length: 60
	  0x0000:  b164 003c 0000 003c 0000 00ff ff1f 1b70
	  0x0010:  f857 ee68 4dfd 4d5f d9bd c709 30ac 8176
	  0x0020:  b36d cc11 3abf 1291 f106 4ede 61f4 6297
	  0x0030:  afc4 39a4 0db9 7aa5 6873 33e8
	RPKI-RTRv65, Error Report PDU (10), length: 66
	  Error code: Unknown (66), Encapsulated PDU length: 80
	[|RPKI-RTR]
Fixed code:     /* Copy of Erroneous PDU (variable, optional) */
    /* Length of Error Text (4 octets in network byte order) */
    /* Arbitrary Text of Error Diagnostic Message (variable, optional) */
static u_int
rpki_rtr_pdu_print (netdissect_options *ndo, const u_char *tptr, const u_int len,
	const u_char recurse, const u_int indent)
    /* Protocol Version */
    ND_TCHECK_8BITS(tptr);
    if (*tptr != 0) {
	/* Skip the rest of the input buffer because even if this is
	 * a well-formed PDU of a future RPKI-Router protocol version
	 * followed by a well-formed PDU of RPKI-Router protocol
	 * version 0, there is no way to know exactly how to skip the
	 * current PDU.
	 */
	ND_PRINT((ndo, "%sRPKI-RTRv%u (unknown)", indent_string(8), *tptr));
	return len;
    }
    if (len < sizeof(rpki_rtr_pdu)) {
	ND_PRINT((ndo, "(%u bytes is too few to decode)", len));
	goto invalid;
    }
    ND_TCHECK2(*tptr, sizeof(rpki_rtr_pdu));
    /* Do not check bounds with pdu_len yet, do it in the case blocks
     * below to make it possible to decode at least the beginning of
     * a truncated Error Report PDU or a truncated encapsulated PDU.
     */
    if (pdu_len < sizeof(rpki_rtr_pdu) || pdu_len > len)
	goto invalid;
	if (pdu_len != sizeof(rpki_rtr_pdu) + 4)
	    goto invalid;
	ND_TCHECK2(*tptr, pdu_len);
	if (pdu_len != sizeof(rpki_rtr_pdu))
	    goto invalid;
	/* no additional boundary to check */
	if (pdu_len != sizeof(rpki_rtr_pdu))
	    goto invalid;
	/* no additional boundary to check */
	    if (pdu_len != sizeof(rpki_rtr_pdu) + 12)
		goto invalid;
	    ND_TCHECK2(*tptr, pdu_len);
	    if (pdu_len != sizeof(rpki_rtr_pdu) + 24)
		goto invalid;
	    ND_TCHECK2(*tptr, pdu_len);
	    tlen = sizeof(rpki_rtr_pdu);
	    /* Do not test for the "Length of Error Text" data element yet. */
	    if (pdu_len < tlen + 4)
		goto invalid;
	    ND_TCHECK2(*tptr, tlen + 4);
	    /* Safe up to and including the "Length of Encapsulated PDU"
	     * data element, more data elements may be present.
	     */
	    tlen += 4;
	    if (encapsulated_pdu_length) {
		/* Section 5.10 of RFC 6810 says:
		 * "An Error Report PDU MUST NOT be sent for an Error Report PDU."
		 *
		 * However, as far as the protocol encoding goes Error Report PDUs can
		 * happen to be nested in each other, however many times, in which case
		 * the decoder should still print such semantically incorrect PDUs.
		 *
		 * That said, "the Erroneous PDU field MAY be truncated" (ibid), thus
		 * to keep things simple this implementation decodes only the two
		 * outermost layers of PDUs and makes bounds checks in the outer and
		 * the inner PDU independently.
		 */
		if (pdu_len < tlen + encapsulated_pdu_length)
		    goto invalid;
		if (! recurse) {
		    ND_TCHECK2(*tptr, tlen + encapsulated_pdu_length);
		}
		else {
		    ND_PRINT((ndo, "%s-----encapsulated PDU-----", indent_string(indent+4)));
		    rpki_rtr_pdu_print(ndo, tptr + tlen,
			encapsulated_pdu_length, 0, indent + 2);
		}
		tlen += encapsulated_pdu_length;
	    if (pdu_len < tlen + 4)
		goto invalid;
	    ND_TCHECK2(*tptr, tlen + 4);
	    /* Safe up to and including the "Length of Error Text" data element,
	     * one more data element may be present.
	     */
	    text_length = EXTRACT_32BITS(tptr + tlen);
	    tlen += 4;

	    if (text_length) {
		if (pdu_len < tlen + text_length)
		    goto invalid;
		/* fn_printn() makes the bounds check */
		if (fn_printn(ndo, tptr + tlen, text_length, ndo->ndo_snapend))
	ND_TCHECK2(*tptr, pdu_len);
    return pdu_len;
invalid:
    ND_PRINT((ndo, "%s", istr));
    ND_TCHECK2(*tptr, len);
    return len;
    ND_PRINT((ndo, "\n\t%s", tstr));
    return len;
    while (len) {
	u_int pdu_len = rpki_rtr_pdu_print(ndo, pptr, len, 1, 8);
	len -= pdu_len;
	pptr += pdu_len;
rpki-rtr-oob		rpki-rtr-oob.pcap	rpki-rtr-oob.out	-v -c1
	RPKI-RTRv177 (unknown)
	RPKI-RTRv177 (unknown)
	RPKI-RTRv177 (unknown)
	RPKI-RTRv177 (unknown)
	RPKI-RTRv197 (unknown)
	RPKI-RTRv177 (unknown)
	RPKI-RTRv177 (unknown)
	RPKI-RTRv177 (unknown)
	RPKI-RTRv197 (unknown)
	RPKI-RTRv177 (unknown)
	RPKI-RTRv177 (unknown)
IP truncated-ip - 22 bytes missing! (tos 0x0, ttl 254, id 13327, offset 0, flags [+, DF, rsvd], proto TCP (6), length 62, bad cksum 8e7f (->c283)!)
    19.128.128.20.323 > 76.19.6.127.49600: Flags [none], seq 2684354563:2684354585, win 28672, length 22
	RPKI-RTRv171 (unknown)