Moved verifiation of proxy responses to earlier in the packet handling

This slows down the main server thread a bit, but means that we
catch attackers earlier, i.e. before pushing a request to a
child thread.

diff --git a/src/main/event.c b/src/main/event.c
index 98d2dd8..fdfa544 100644 (file)
--- a/src/main/event.c
+++ b/src/main/event.c
@@ -706,12 +706,6 @@ static void received_response_to_ping(REQUEST *request)
 
        rad_assert(request->home_server != NULL);
 
-       if (rad_verify(request->proxy_reply, request->proxy,
-                      request->home_server->secret) != 0) {
-               DEBUG("Ignoring spoofed proxy reply.  Signature is invalid");
-               return;
-       }
-               
        home = request->home_server;
        home->num_received_pings++;
 
@@ -2950,6 +2944,23 @@ REQUEST *received_proxy_response(RADIUS_PACKET *packet)
                return NULL;
        }
 
+       /*
+        *      Verify the packet before doing ANYTHING with it.  This
+        *      means we're doing more MD5 checks in the server core.
+        *      However, we can fix that by moving to multiple threads
+        *      listening on sockets.
+        *
+        *      We do this AFTER looking the request up in the hash,
+        *      and AFTER vhecking if we saw a previous request.  This
+        *      helps minimize the DoS effect of people attacking us
+        *      with spoofed packets.
+        */
+       if (rad_verify(request->proxy_reply, packet,
+                      request->home_server->secret) != 0) {
+               DEBUG("Ignoring spoofed proxy reply.  Signature is invalid");
+               return;
+       }
+
        gettimeofday(&now, NULL);
 
        /*

diff --git a/src/main/listen.c b/src/main/listen.c
index 2867e3b..2b12e5b 100644 (file)
--- a/src/main/listen.c
+++ b/src/main/listen.c
@@ -1038,10 +1038,9 @@ static int proxy_socket_encode(UNUSED rad_listen_t *listener, REQUEST *request)
 
 static int proxy_socket_decode(UNUSED rad_listen_t *listener, REQUEST *request)
 {
-       if (rad_verify(request->proxy_reply, request->proxy,
-                      request->home_server->secret) < 0) {
-               return -1;
-       }
+       /*
+        *      rad_verify is run in event.c, received_proxy_response()
+        */
 
        return rad_decode(request->proxy_reply, request->proxy,
                           request->home_server->secret);