welterde/l2tpns
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

cleanup packet length handling

Browse source
This commit is contained in:
bodea 2004-11-03 13:22:39 +00:00
parent 27e17ad461
commit 6b74bac40e
1 changed files with 74 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

102
ppp.c
View file

@ -1,6 +1,6 @@
// L2TPNS PPP Stuff // L2TPNS PPP Stuff
char const *cvs_id_ppp = "$Id: ppp.c,v 1.17 2004/10/29 04:01:53 bodea Exp $"; char const *cvs_id_ppp = "$Id: ppp.c,v 1.18 2004/11/03 13:22:39 bodea Exp $";
#include <stdio.h> #include <stdio.h>
#include <string.h> #include <string.h>
@ -30,7 +30,7 @@ void processpap(tunnelidt t, sessionidt s, u8 * p, u16 l)
{ {
char user[129]; char user[129];
char pass[129]; char pass[129];
u16 hl;
CSTAT(call_processpap); CSTAT(call_processpap);
@ -41,18 +41,22 @@ void processpap(tunnelidt t, sessionidt s, u8 * p, u16 l)
STAT(tunnel_rx_errors); STAT(tunnel_rx_errors);
return ; return ;
} }
if ((hl = ntohs(*(u16 *) (p + 2))) > l)
{
log(1, 0, s, t, "Length mismatch PAP %u/%u\n", hl, l);
STAT(tunnel_rx_errors);
return ;
}
l = hl;
if (*p != 1) if (*p != 1)
{ {
log(1, 0, s, t, "Unexpected PAP code %d\n", *p); log(1, 0, s, t, "Unexpected PAP code %d\n", *p);
STAT(tunnel_rx_errors); STAT(tunnel_rx_errors);
return ; return ;
} }
if (ntohs(*(u16 *) (p + 2)) > l)
{
log(1, 0, s, t, "Length mismatch PAP %d/%d\n", ntohs(*(u16 *) (p + 2)), l);
STAT(tunnel_rx_errors);
return ;
}
{ {
u8 *b = p; u8 *b = p;
b += 4; b += 4;
@ -126,8 +130,7 @@ void processpap(tunnelidt t, sessionidt s, u8 * p, u16 l)
void processchap(tunnelidt t, sessionidt s, u8 *p, u16 l) void processchap(tunnelidt t, sessionidt s, u8 *p, u16 l)
{ {
u16 r; u16 r;
u16 len; u16 hl;
CSTAT(call_processchap); CSTAT(call_processchap);
@ -142,6 +145,22 @@ void processchap(tunnelidt t, sessionidt s, u8 * p, u16 l)
STAT(tunnel_rx_errors); STAT(tunnel_rx_errors);
return; return;
} }
if (l < 4)
{
log(1, 0, s, t, "Short CHAP %u bytes\n", l);
STAT(tunnel_rx_errors);
return ;
}
if ((hl = ntohs(*(u16 *) (p + 2))) > l)
{
log(1, 0, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
STAT(tunnel_rx_errors);
return ;
}
l = hl;
if (*p != 2) if (*p != 2)
{ {
log(1, 0, s, t, "Unexpected CHAP response code %d\n", *p); log(1, 0, s, t, "Unexpected CHAP response code %d\n", *p);
@ -154,22 +173,19 @@ void processchap(tunnelidt t, sessionidt s, u8 * p, u16 l)
STAT(tunnel_rx_errors); STAT(tunnel_rx_errors);
return ; return ;
} }
len = ntohs(*(u16 *) (p + 2));
if (len > l) if (l < 5 || p[4] != 16)
{ {
log(1, 0, s, t, "Bad CHAP length %d\n", len); log(1, 0, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
STAT(tunnel_rx_errors); STAT(tunnel_rx_errors);
return ; return ;
} }
if (p[4] != 16)
l -= 5;
p += 5;
if (l < 16 || l - 16 >= sizeof(session[s].user))
{ {
log(1, 0, s, t, "Bad CHAP response length %d\n", p[4]); log(1, 0, s, t, "CHAP user too long %d\n", l - 16);
STAT(tunnel_rx_errors);
return ;
}
if (len - 21 >= sizeof(session[s].user))
{
log(1, 0, s, t, "CHAP user too long %d\n", len - 21);
STAT(tunnel_rx_errors); STAT(tunnel_rx_errors);
return ; return ;
} }
@ -178,10 +194,10 @@ void processchap(tunnelidt t, sessionidt s, u8 * p, u16 l)
{ {
struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 }; struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
packet.username = calloc(len-20, 1); packet.username = calloc(l - 16 + 1, 1);
packet.password = calloc(16, 1); packet.password = calloc(16, 1);
memcpy(packet.username, p + 21, len - 21); memcpy(packet.username, p + 16, l - 16);
memcpy(packet.password, p + 5, 16); memcpy(packet.password, p, 16);
run_plugins(PLUGIN_PRE_AUTH, &packet); run_plugins(PLUGIN_PRE_AUTH, &packet);
if (!packet.continue_auth) if (!packet.continue_auth)
@ -222,7 +238,7 @@ char *ppp_lcp_types[] = {
void dumplcp(u8 *p, int l) void dumplcp(u8 *p, int l)
{ {
signed int x = l - 4; int x = l - 4;
u8 *o = (p + 4); u8 *o = (p + 4);
log_hex(5, "PPP LCP Packet", p, l); log_hex(5, "PPP LCP Packet", p, l);
@ -310,7 +326,7 @@ void processlcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
u8 b[MAXCONTROL]; u8 b[MAXCONTROL];
u8 *q = NULL; u8 *q = NULL;
u32 magicno = 0; u32 magicno = 0;
u16 hl;
CSTAT(call_processlcp); CSTAT(call_processlcp);
@ -321,6 +337,15 @@ void processlcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
STAT(tunnel_rx_errors); STAT(tunnel_rx_errors);
return ; return ;
} }
if ((hl = ntohs(*(u16 *) (p + 2))) > l)
{
log(1, 0, s, t, "Length mismatch LCP %u/%u\n", hl, l);
STAT(tunnel_rx_errors);
return ;
}
l = hl;
if (*p == ConfigAck) if (*p == ConfigAck)
{ {
log(3, session[s].ip, s, t, "LCP: Discarding ConfigAck\n"); log(3, session[s].ip, s, t, "LCP: Discarding ConfigAck\n");
@ -328,12 +353,11 @@ void processlcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
} }
else if (*p == ConfigReq) else if (*p == ConfigReq)
{ {
l = ntohs(*(u16 *)(p + 2)); int x = l - 4;
signed int x = l - 4;
u8 *o = (p + 4); u8 *o = (p + 4);
log(3, session[s].ip, s, t, "LCP: ConfigReq (%d bytes)...\n", l); log(3, session[s].ip, s, t, "LCP: ConfigReq (%d bytes)...\n", l);
dumplcp(p, l); if (config->debug > 3) dumplcp(p, l);
while (x > 2) while (x > 2)
{ {
@ -436,7 +460,7 @@ void processlcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
else if (*p == ConfigNak) else if (*p == ConfigNak)
{ {
log(1, session[s].ip, s, t, "Remote end sent a ConfigNak. Ignoring\n"); log(1, session[s].ip, s, t, "Remote end sent a ConfigNak. Ignoring\n");
dumplcp(p, l); if (config->debug > 3) dumplcp(p, l);
return ; return ;
} }
else if (*p == TerminateReq) else if (*p == TerminateReq)
@ -499,6 +523,7 @@ void processlcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
// Process IPCP messages // Process IPCP messages
void processipcp(tunnelidt t, sessionidt s, u8 *p, u16 l) void processipcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
{ {
u16 hl;
CSTAT(call_processipcp); CSTAT(call_processipcp);
@ -509,6 +534,15 @@ void processipcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
STAT(tunnel_rx_errors); STAT(tunnel_rx_errors);
return ; return ;
} }
if ((hl = ntohs(*(u16 *) (p + 2))) > l)
{
log(1, 0, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
STAT(tunnel_rx_errors);
return ;
}
l = hl;
if (*p == ConfigAck) if (*p == ConfigAck)
{ {
// happy with our IPCP // happy with our IPCP
@ -532,12 +566,7 @@ void processipcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
return ; return ;
} }
log(4, session[s].ip, s, t, "IPCP ConfigReq received\n"); log(4, session[s].ip, s, t, "IPCP ConfigReq received\n");
if (ntohs(*(u16 *) (p + 2)) > l)
{
log(1, 0, s, t, "Length mismatch IPCP %d/%d\n", ntohs(*(u16 *) (p + 2)), l);
STAT(tunnel_rx_errors);
return ;
}
if (!session[s].ip) if (!session[s].ip)
{ {
log(3, 0, s, t, "Waiting on radius reply\n"); log(3, 0, s, t, "Waiting on radius reply\n");
@ -549,7 +578,6 @@ void processipcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
u8 *i, u8 *i,
*q; *q;
l = ntohs(*(u16 *) (p + 2)); // We must use length from IPCP len field
q = p + 4; q = p + 4;
i = p + l; i = p + l;
while (q < i && q[1]) while (q < i && q[1])