Don't crash on reading invalid messages.

[radsecproxy.git] / lib / udp.c

diff --git a/lib/udp.c b/lib/udp.c
index 911616d..36af084 100644 (file)
--- a/lib/udp.c
+++ b/lib/udp.c
@@ -1,5 +1,5 @@
 /* Copyright 2011 NORDUnet A/S. All rights reserved.
-   See the file COPYING for licensing information.  */
+   See LICENSE for licensing information. */
 
 #if defined HAVE_CONFIG_H
 #include <config.h>
@@ -9,6 +9,7 @@
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <event2/event.h>
+#include <radius/client.h>
 #include <radsec/radsec.h>
 #include <radsec/radsec-impl.h>
 #include "debug.h"
@@ -27,7 +28,7 @@ _send (struct rs_connection *conn, int fd)
   assert (pkt->rpkt->data);
 
   /* Send.  */
-  r = compat_send (fd, pkt->rpkt->data, pkt->rpkt->data_len, 0);
+  r = compat_send (fd, pkt->rpkt->data, pkt->rpkt->length, 0);
   if (r == -1)
     {
       int sockerr = evutil_socket_geterror (pkt->conn->fd);
@@ -37,7 +38,7 @@ _send (struct rs_connection *conn, int fd)
                                    evutil_socket_error_to_string (sockerr));
     }
 
-  assert (r == pkt->rpkt->data_len);
+  assert (r == pkt->rpkt->length);
   /* Unlink the packet.  */
   conn->out_queue = pkt->next;
 
@@ -63,29 +64,26 @@ _send (struct rs_connection *conn, int fd)
 static void
 _evcb (evutil_socket_t fd, short what, void *user_data)
 {
+  int err;
+  struct rs_packet *pkt = (struct rs_packet *) user_data;
+
   rs_debug (("%s: fd=%d what =", __func__, fd));
-  if (what & EV_TIMEOUT) rs_debug ((" TIMEOUT"));
+  if (what & EV_TIMEOUT) rs_debug ((" TIMEOUT -- shouldn't happen!"));
   if (what & EV_READ) rs_debug ((" READ"));
   if (what & EV_WRITE) rs_debug ((" WRITE"));
   rs_debug (("\n"));
 
+  assert (pkt);
+  assert (pkt->conn);
   if (what & EV_READ)
     {
       /* Read a single UDP packet and stick it in USER_DATA.  */
       /* TODO: Verify that unsolicited packets are dropped.  */
-      struct rs_packet *pkt = (struct rs_packet *) user_data;
       ssize_t r = 0;
 
-      assert (pkt);
-      assert (pkt->conn);
+      assert (pkt->rpkt->data);
 
-      pkt->rpkt->data = rs_malloc (pkt->conn->ctx, 4096);
-      if (pkt->rpkt->data == NULL)
-       {
-         rs_err_conn_push_fl (pkt->conn, RSE_NOMEM, __FILE__, __LINE__, NULL);
-         return;
-       }
-      r = compat_recv (fd, pkt->rpkt->data, 4096, MSG_TRUNC);
+      r = compat_recv (fd, pkt->rpkt->data, RS_MAX_PACKET_LEN, MSG_TRUNC);
       if (r == -1)
        {
          int sockerr = evutil_socket_geterror (pkt->conn->fd);
@@ -94,7 +92,7 @@ _evcb (evutil_socket_t fd, short what, void *user_data)
              /* FIXME: Really shouldn't happen since we've been told
                 that fd is readable!  */
              rs_debug (("%s: EAGAIN reading UDP packet -- wot?"));
-             return;
+              goto err_out;
            }
 
          /* Hard error.  */
@@ -102,22 +100,22 @@ _evcb (evutil_socket_t fd, short what, void *user_data)
                               "%d: recv: %d (%s)", fd, sockerr,
                               evutil_socket_error_to_string (sockerr));
          event_del (pkt->conn->tev);
-         return;
+          goto err_out;
        }
       event_del (pkt->conn->tev);
-      if (r < 20 || r > 4096)  /* Short or long packet.  */
+      if (r < 20 || r > RS_MAX_PACKET_LEN)     /* Short or long packet.  */
        {
          rs_err_conn_push (pkt->conn, RSE_INVALID_PKT,
-                           "invalid packet length: %d",
-                           pkt->rpkt->data_len);
-         return;
+                            "invalid packet length: %d", r);
+          goto err_out;
        }
-      pkt->rpkt->data_len = (pkt->rpkt->data[2] << 8) + pkt->rpkt->data[3];
-      if (!rad_packet_ok (pkt->rpkt, 0))
+      pkt->rpkt->length = (pkt->rpkt->data[2] << 8) + pkt->rpkt->data[3];
+      err = nr_packet_ok (pkt->rpkt);
+      if (err)
        {
-         rs_err_conn_push_fl (pkt->conn, RSE_FR, __FILE__, __LINE__,
-                              "invalid packet: %s", fr_strerror ());
-         return;
+         rs_err_conn_push_fl (pkt->conn, -err, __FILE__, __LINE__,
+                              "invalid packet");
+          goto err_out;
        }
       /* Hand over message to user.  This changes ownership of pkt.
         Don't touch it afterwards -- it might have been freed.  */
@@ -126,10 +124,6 @@ _evcb (evutil_socket_t fd, short what, void *user_data)
     }
   else if (what & EV_WRITE)
     {
-      struct rs_packet *pkt = (struct rs_packet *) user_data;
-      assert (pkt);
-      assert (pkt->conn);
-
       if (!pkt->conn->is_connected)
        event_on_connect (pkt->conn, pkt);
 
@@ -138,11 +132,10 @@ _evcb (evutil_socket_t fd, short what, void *user_data)
          if (pkt->conn->callbacks.sent_cb)
            pkt->conn->callbacks.sent_cb (pkt->conn->user_data);
     }
+  return;
 
-#if defined (DEBUG)
-  if (what & EV_TIMEOUT)
-    rs_debug (("%s: timeout on UDP event, shouldn't happen\n", __func__));
-#endif
+ err_out:
+  rs_conn_disconnect (pkt->conn);
 }
 
 int
@@ -155,7 +148,10 @@ udp_init (struct rs_connection *conn, struct rs_packet *pkt)
   if (!conn->rev || !conn->wev)
     {
       if (conn->rev)
-       event_free (conn->rev);
+       {
+         event_free (conn->rev);
+         conn->rev = NULL;
+       }
       /* ENOMEM _or_ EINVAL but EINVAL only if we use EV_SIGNAL, at
         least for now (libevent-2.0.5).  */
       return rs_err_conn_push_fl (conn, RSE_NOMEM, __FILE__, __LINE__, NULL);