welterde/l2tpns
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

cleanup packet length handling

Browse source
This commit is contained in:
Brendan O'Dea 2004-11-03 13:22:39 +00:00
parent fc1ab23bf0
commit 99be8b127a
1 changed files with 74 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

102
ppp.c
View file

@ -1,6 +1,6 @@
// L2TPNS PPP Stuff
char const *cvs_id_ppp = "$Id: ppp.c,v 1.17 2004-10-29 04:01:53 bodea Exp $";
char const *cvs_id_ppp = "$Id: ppp.c,v 1.18 2004-11-03 13:22:39 bodea Exp $";
#include <stdio.h>
#include <string.h>
@ -30,7 +30,7 @@ void processpap(tunnelidt t, sessionidt s, u8 * p, u16 l)
{
char user[129];
char pass[129];
u16 hl;
CSTAT(call_processpap);
@ -41,18 +41,22 @@ void processpap(tunnelidt t, sessionidt s, u8 * p, u16 l)
STAT(tunnel_rx_errors);
return ;
}
if ((hl = ntohs(*(u16 *) (p + 2))) > l)
{
log(1, 0, s, t, "Length mismatch PAP %u/%u\n", hl, l);
STAT(tunnel_rx_errors);
return ;
}
l = hl;
if (*p != 1)
{
log(1, 0, s, t, "Unexpected PAP code %d\n", *p);
STAT(tunnel_rx_errors);
return ;
}
if (ntohs(*(u16 *) (p + 2)) > l)
{
log(1, 0, s, t, "Length mismatch PAP %d/%d\n", ntohs(*(u16 *) (p + 2)), l);
STAT(tunnel_rx_errors);
return ;
}
{
u8 *b = p;
b += 4;
@ -126,8 +130,7 @@ void processpap(tunnelidt t, sessionidt s, u8 * p, u16 l)
void processchap(tunnelidt t, sessionidt s, u8 *p, u16 l)
{
u16 r;
u16 len;
u16 hl;
CSTAT(call_processchap);
@ -142,6 +145,22 @@ void processchap(tunnelidt t, sessionidt s, u8 * p, u16 l)
STAT(tunnel_rx_errors);
return;
}
if (l < 4)
{
log(1, 0, s, t, "Short CHAP %u bytes\n", l);
STAT(tunnel_rx_errors);
return ;
}
if ((hl = ntohs(*(u16 *) (p + 2))) > l)
{
log(1, 0, s, t, "Length mismatch CHAP %u/%u\n", hl, l);
STAT(tunnel_rx_errors);
return ;
}
l = hl;
if (*p != 2)
{
log(1, 0, s, t, "Unexpected CHAP response code %d\n", *p);
@ -154,22 +173,19 @@ void processchap(tunnelidt t, sessionidt s, u8 * p, u16 l)
STAT(tunnel_rx_errors);
return ;
}
len = ntohs(*(u16 *) (p + 2));
if (len > l)
if (l < 5 || p[4] != 16)
{
log(1, 0, s, t, "Bad CHAP length %d\n", len);
log(1, 0, s, t, "Bad CHAP response length %d\n", l < 5 ? -1 : p[4]);
STAT(tunnel_rx_errors);
return ;
}
if (p[4] != 16)
l -= 5;
p += 5;
if (l < 16 || l - 16 >= sizeof(session[s].user))
{
log(1, 0, s, t, "Bad CHAP response length %d\n", p[4]);
STAT(tunnel_rx_errors);
return ;
}
if (len - 21 >= sizeof(session[s].user))
{
log(1, 0, s, t, "CHAP user too long %d\n", len - 21);
log(1, 0, s, t, "CHAP user too long %d\n", l - 16);
STAT(tunnel_rx_errors);
return ;
}
@ -178,10 +194,10 @@ void processchap(tunnelidt t, sessionidt s, u8 * p, u16 l)
{
struct param_pre_auth packet = { &tunnel[t], &session[s], NULL, NULL, PPPCHAP, 1 };
packet.username = calloc(len-20, 1);
packet.username = calloc(l - 16 + 1, 1);
packet.password = calloc(16, 1);
memcpy(packet.username, p + 21, len - 21);
memcpy(packet.password, p + 5, 16);
memcpy(packet.username, p + 16, l - 16);
memcpy(packet.password, p, 16);
run_plugins(PLUGIN_PRE_AUTH, &packet);
if (!packet.continue_auth)
@ -222,7 +238,7 @@ char *ppp_lcp_types[] = {
void dumplcp(u8 *p, int l)
{
signed int x = l - 4;
int x = l - 4;
u8 *o = (p + 4);
log_hex(5, "PPP LCP Packet", p, l);
@ -310,7 +326,7 @@ void processlcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
u8 b[MAXCONTROL];
u8 *q = NULL;
u32 magicno = 0;
u16 hl;
CSTAT(call_processlcp);
@ -321,6 +337,15 @@ void processlcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
STAT(tunnel_rx_errors);
return ;
}
if ((hl = ntohs(*(u16 *) (p + 2))) > l)
{
log(1, 0, s, t, "Length mismatch LCP %u/%u\n", hl, l);
STAT(tunnel_rx_errors);
return ;
}
l = hl;
if (*p == ConfigAck)
{
log(3, session[s].ip, s, t, "LCP: Discarding ConfigAck\n");
@ -328,12 +353,11 @@ void processlcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
}
else if (*p == ConfigReq)
{
l = ntohs(*(u16 *)(p + 2));
signed int x = l - 4;
int x = l - 4;
u8 *o = (p + 4);
log(3, session[s].ip, s, t, "LCP: ConfigReq (%d bytes)...\n", l);
dumplcp(p, l);
if (config->debug > 3) dumplcp(p, l);
while (x > 2)
{
@ -436,7 +460,7 @@ void processlcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
else if (*p == ConfigNak)
{
log(1, session[s].ip, s, t, "Remote end sent a ConfigNak. Ignoring\n");
dumplcp(p, l);
if (config->debug > 3) dumplcp(p, l);
return ;
}
else if (*p == TerminateReq)
@ -499,6 +523,7 @@ void processlcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
// Process IPCP messages
void processipcp(tunnelidt t, sessionidt s, u8 *p, u16 l)
{
u16 hl;
CSTAT(call_processipcp);
@ -509,6 +534,15 @@ void processipcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
STAT(tunnel_rx_errors);
return ;
}
if ((hl = ntohs(*(u16 *) (p + 2))) > l)
{
log(1, 0, s, t, "Length mismatch IPCP %u/%u\n", hl, l);
STAT(tunnel_rx_errors);
return ;
}
l = hl;
if (*p == ConfigAck)
{
// happy with our IPCP
@ -532,12 +566,7 @@ void processipcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
return ;
}
log(4, session[s].ip, s, t, "IPCP ConfigReq received\n");
if (ntohs(*(u16 *) (p + 2)) > l)
{
log(1, 0, s, t, "Length mismatch IPCP %d/%d\n", ntohs(*(u16 *) (p + 2)), l);
STAT(tunnel_rx_errors);
return ;
}
if (!session[s].ip)
{
log(3, 0, s, t, "Waiting on radius reply\n");
@ -549,7 +578,6 @@ void processipcp(tunnelidt t, sessionidt s, u8 * p, u16 l)
u8 *i,
*q;
l = ntohs(*(u16 *) (p + 2)); // We must use length from IPCP len field
q = p + 4;
i = p + l;
while (q < i && q[1])