X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=secnet.git;a=blobdiff_plain;f=slip.c;h=17a9099215f9ae8d3cdc236fe9c83a3d8c8cbfaa;hp=db89a274c2fe1769c055b496a208462e160a44a1;hb=5d8fc5c038cb1e4a213e5d0283ebfc5c853ac04f;hpb=f208b9a9c2c54479a170bf94bfb4c71001f570a2

diff --git a/slip.c b/slip.c
index db89a27..17a9099 100644
--- a/slip.c
+++ b/slip.c
@@ -7,6 +7,7 @@
 #include "util.h"
 #include "netlink.h"
 #include "process.h"
+#include "unaligned.h"
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
@@ -23,8 +24,9 @@ struct slip {
     struct buffer_if *buff; /* We unstuff received packets into here
 			       and send them to the netlink code. */
     bool_t pending_esc;
+    bool_t ignoring_packet; /* If this packet was corrupt or overlong,
+			       we ignore everything up to the next END */
     netlink_deliver_fn *netlink_to_tunnel;
-    uint32_t local_address;
 };
 
 /* Generic SLIP mangling code */
@@ -73,35 +75,67 @@ static void slip_unstuff(struct slip *st, uint8_t *buf, uint32_t l)
 
     BUF_ASSERT_USED(st->buff);
     for (i=0; i<l; i++) {
+	int outputchr;
+	enum { OUTPUT_END = 256, OUTPUT_NOTHING = 257 };
+
+	if (!st->buff->size)
+	    buffer_init(st->buff,calculate_max_start_pad());
+
 	if (st->pending_esc) {
 	    st->pending_esc=False;
 	    switch(buf[i]) {
 	    case SLIP_ESCEND:
-		*(uint8_t *)buf_append(st->buff,1)=SLIP_END;
+		outputchr=SLIP_END;
 		break;
 	    case SLIP_ESCESC:
-		*(uint8_t *)buf_append(st->buff,1)=SLIP_ESC;
+		outputchr=SLIP_ESC;
 		break;
 	    default:
-		fatal("userv_afterpoll: bad SLIP escape character");
+		if (!st->ignoring_packet) {
+		    Message(M_WARNING, "userv_afterpoll: bad SLIP escape"
+			    " character, dropping packet\n");
+		}
+		st->ignoring_packet=True;
+		outputchr=OUTPUT_NOTHING;
+		break;
 	    }
 	} else {
 	    switch (buf[i]) {
 	    case SLIP_END:
-		if (st->buff->size>0) {
-		    st->netlink_to_tunnel(&st->nl,st->buff);
-		    BUF_ALLOC(st->buff,"userv_afterpoll");
-		}
-		buffer_init(st->buff,st->nl.max_start_pad);
+		outputchr=OUTPUT_END;
 		break;
 	    case SLIP_ESC:
 		st->pending_esc=True;
+		outputchr=OUTPUT_NOTHING;
 		break;
 	    default:
-		*(uint8_t *)buf_append(st->buff,1)=buf[i];
+		outputchr=buf[i];
 		break;
 	    }
 	}
+
+	if (st->ignoring_packet) {
+	    if (outputchr == OUTPUT_END) {
+		st->ignoring_packet=False;
+		st->buff->size=0;
+	    }
+	} else {
+	    if (outputchr == OUTPUT_END) {
+		if (st->buff->size>0) {
+		    st->netlink_to_tunnel(&st->nl,st->buff);
+		    BUF_ALLOC(st->buff,"userv_afterpoll");
+		}
+		st->buff->size=0;
+	    } else if (outputchr != OUTPUT_NOTHING) {
+		if (buf_remaining_space(st->buff)) {
+		    buf_append_uint8(st->buff,outputchr);
+		} else {
+		    Message(M_WARNING, "userv_afterpoll: dropping overlong"
+			    " SLIP packet\n");
+		    st->ignoring_packet=True;
+		}
+	    }
+	}
     }
 }
 
@@ -112,10 +146,9 @@ static void slip_init(struct slip *st, struct cloc loc, dict_t *dict,
 	netlink_init(&st->nl,st,loc,dict,
 		     "netlink-userv-ipif",NULL,to_host);
     st->buff=find_cl_if(dict,"buffer",CL_BUFFER,True,"name",loc);
-    st->local_address=string_item_to_ipaddr(
-	dict_find_item(dict,"local-address", True, name, loc),"netlink");
     BUF_ALLOC(st->buff,"slip_init");
     st->pending_esc=False;
+    st->ignoring_packet=False;
 }
 
 /* Connection to the kernel through userv-ipif */
@@ -177,6 +210,14 @@ static void userv_deliver_to_kernel(void *sst, struct buffer_if *buf)
 {
     struct userv *st=sst;
 
+    if (buf->size > st->slip.nl.mtu) {
+	Message(M_ERR,"%s: packet of size %"PRIu32" exceeds mtu %"PRIu32":"
+		" cannot be injected into kernel, dropped\n",
+		st->slip.nl.name, buf->size, st->slip.nl.mtu);
+	BUF_FREE(buf);
+	return;
+    }
+
     slip_stuff(&st->slip,buf,st->txfd);
 }
 
@@ -197,7 +238,8 @@ static void userv_userv_callback(void *sst, pid_t pid, int status)
 	    fatal("%s: userv exited unexpectedly: uncaught signal %d",
 		  st->slip.nl.name,WTERMSIG(status));
 	} else {
-	    fatal("%s: userv stopped unexpectedly");
+	    fatal("%s: userv stopped unexpectedly",
+		  st->slip.nl.name);
 	}
     }
     Message(M_WARNING,"%s: userv subprocess died with status %d\n",
@@ -252,7 +294,7 @@ static void userv_invoke_userv(struct userv *st)
 
     addrs=safe_malloc(512,"userv_invoke_userv:addrs");
     snprintf(addrs,512,"%s,%s,%d,slip",
-	     ipaddr_to_string(st->slip.local_address),
+	     ipaddr_to_string(st->slip.nl.local_address),
 	     ipaddr_to_string(st->slip.nl.secnet_address),st->slip.nl.mtu);
 
     allnets=ipset_new();