Don't crash on reading invalid messages.

[libradsec.git] / lib / tcp.c

diff --git a/lib/tcp.c b/lib/tcp.c
index d0bc62c..e2b1a2f 100644 (file)
--- a/lib/tcp.c
+++ b/lib/tcp.c
@@ -1,5 +1,5 @@
-/* Copyright 2011 NORDUnet A/S. All rights reserved.
-   See LICENSE for licensing information.  */
+/* Copyright 2011-2013 NORDUnet A/S. All rights reserved.
+   See LICENSE for licensing information. */
 
 #if defined HAVE_CONFIG_H
 #include <config.h>
@@ -25,8 +25,7 @@
 #include <event2/buffer.h>
 #endif
 
-/* Read one RADIUS packet header.  Return !0 on error.  A return value
-   of 0 means that we need more data.  */
+/** Read one RADIUS packet header. Return !0 on error. */
 static int
 _read_header (struct rs_packet *pkt)
 {
@@ -35,11 +34,13 @@ _read_header (struct rs_packet *pkt)
   n = bufferevent_read (pkt->conn->bev, pkt->hdr, RS_HEADER_LEN);
   if (n == RS_HEADER_LEN)
     {
-      pkt->flags |= rs_packet_hdr_read_flag;
+      pkt->flags |= RS_PACKET_HEADER_READ;
       pkt->rpkt->length = (pkt->hdr[2] << 8) + pkt->hdr[3];
       if (pkt->rpkt->length < 20 || pkt->rpkt->length > RS_MAX_PACKET_LEN)
        {
-         conn_close (&pkt->conn);
+          rs_debug (("%s: invalid packet length: %d\n",
+                     __func__, pkt->rpkt->length));
+          rs_conn_disconnect (pkt->conn);
          return rs_err_conn_push (pkt->conn, RSE_INVALID_PKT,
                                   "invalid packet length: %d",
                                   pkt->rpkt->length);
@@ -56,7 +57,8 @@ _read_header (struct rs_packet *pkt)
     }
   else     /* Error: libevent gave us less than the low watermark. */
     {
-      conn_close (&pkt->conn);
+      rs_debug (("%s: got: %d octets reading header\n", __func__, n));
+      rs_conn_disconnect (pkg->conn);
       return rs_err_conn_push_fl (pkt->conn, RSE_INTERNAL, __FILE__, __LINE__,
                                  "got %d octets reading header", n);
     }
@@ -64,6 +66,13 @@ _read_header (struct rs_packet *pkt)
   return 0;
 }
 
+/** Read a message, check that it's valid RADIUS and hand it off to
+    registered user callback.
+
+    The packet is read from the bufferevent associated with \a pkt and
+    the data is stored in \a pkt->rpkt.
+
+    Return 0 on success and !0 on failure. */
 static int
 _read_packet (struct rs_packet *pkt)
 {
@@ -83,7 +92,7 @@ _read_packet (struct rs_packet *pkt)
     {
       bufferevent_disable (pkt->conn->bev, EV_READ);
       rs_debug (("%s: complete packet read\n", __func__));
-      pkt->flags &= ~rs_packet_hdr_read_flag;
+      pkt->flags &= ~RS_PACKET_HEADER_READ;
       memset (pkt->hdr, 0, sizeof(*pkt->hdr));
 
       /* Checks done by rad_packet_ok:
@@ -94,8 +103,9 @@ _read_packet (struct rs_packet *pkt)
       err = nr_packet_ok (pkt->rpkt);
       if (err != RSE_OK)
        {
-         conn_close (&pkt->conn);
-         return rs_err_conn_push_fl (pkt->conn, err, __FILE__, __LINE__,
+          rs_debug (("%s: %d: invalid packet\n", __func__, -err));
+          rs_conn_disconnect (pkt->conn);
+         return rs_err_conn_push_fl (pkt->conn, -err, __FILE__, __LINE__,
                                      "invalid packet");
        }
 
@@ -141,9 +151,15 @@ tcp_read_cb (struct bufferevent *bev, void *user_data)
   assert (pkt->rpkt);
 
   pkt->rpkt->sockfd = pkt->conn->fd;
-  pkt->rpkt->vps = NULL;
+  pkt->rpkt->vps = NULL;        /* FIXME: can this be done when initializing pkt? */
+
+  /* Read a message header if not already read, return if that
+     fails. Read a message and have it dispatched to the user
+     registered callback.
 
-  if ((pkt->flags & rs_packet_hdr_read_flag) == 0)
+     Room for improvement: Peek inside buffer (evbuffer_copyout()) to
+     avoid the extra copying. */
+  if ((pkt->flags & RS_PACKET_HEADER_READ) == 0)
     if (_read_header (pkt))
       return;                  /* Error.  */
   _read_packet (pkt);