Enforce maximum amount of bytes sent/received on meta-connections.

[oweals/tinc.git] / src / meta.c

diff --git a/src/meta.c b/src/meta.c
index e62c3b7d859230202834aa5638b76800012f4a28..63f565fe5dbf195997027fa28bca3c4e15083e5b 100644 (file)
--- a/src/meta.c
+++ b/src/meta.c
@@ -1,6 +1,6 @@
 /*
     meta.c -- handle the meta communication
-    Copyright (C) 2000-2014 Guus Sliepen <guus@tinc-vpn.org>,
+    Copyright (C) 2000-2015 Guus Sliepen <guus@tinc-vpn.org>,
                   2000-2005 Ivo Timmermans
                   2006      Scott Lamb <slamb@slamb.org>
 
@@ -30,6 +30,7 @@
 #include "meta.h"
 #include "net.h"
 #include "protocol.h"
+#include "proxy.h"
 #include "utils.h"
 #include "xalloc.h"
 
@@ -61,6 +62,14 @@ bool send_meta(connection_t *c, const char *buffer, int length) {
 
        /* Add our data to buffer */
        if(c->status.encryptout) {
+               /* Check encryption limits */
+               if(length > c->outbudget) {
+                       ifdebug(META) logger(LOG_ERR, "Byte limit exceeded for encryption to %s (%s)", c->name, c->hostname);
+                       return false;
+               } else {
+                       c->outbudget -= length;
+               }
+
                result = EVP_EncryptUpdate(c->outctx, (unsigned char *)c->outbuf + c->outbufstart + c->outbuflen,
                                &outlen, (unsigned char *)buffer, length);
                if(!result || outlen < length) {
@@ -160,9 +169,28 @@ bool receive_meta(connection_t *c) {
        c->buflen += lenin;
 
        while(lenin > 0) {
+               reqlen = 0;
+
+               /* Is it proxy metadata? */
+
+               if(c->allow_request == PROXY) {
+                       reqlen = receive_proxy_meta(c, oldlen, lenin);
+                       if(reqlen < 0)
+                               return false;
+                       goto consume;
+               }
+
                /* Decrypt */
 
                if(c->status.decryptin && !decrypted) {
+                       /* Check decryption limits */
+                       if(lenin > c->inbudget) {
+                               ifdebug(META) logger(LOG_ERR, "Byte limit exceeded for decryption from %s (%s)", c->name, c->hostname);
+                               return false;
+                       } else {
+                               c->inbudget -= lenin;
+                       }
+
                        result = EVP_DecryptUpdate(c->inctx, (unsigned char *)inbuf, &lenout, (unsigned char *)c->buffer + oldlen, lenin);
                        if(!result || lenout != lenin) {
                                logger(LOG_ERR, "Error while decrypting metadata from %s (%s): %s",
@@ -177,74 +205,32 @@ bool receive_meta(connection_t *c) {
 
                if(c->tcplen) {
                        if(c->tcplen <= c->buflen) {
-                               if(!c->node) {
-                                       if(c->outgoing && proxytype == PROXY_SOCKS4 && c->allow_request == ID) {
-                                               if(c->buffer[0] == 0 && c->buffer[1] == 0x5a) {
-                                                       ifdebug(CONNECTIONS) logger(LOG_DEBUG, "Proxy request granted");
-                                               } else {
-                                                       logger(LOG_ERR, "Proxy request rejected");
-                                                       return false;
-                                               }
-                                       } else if(c->outgoing && proxytype == PROXY_SOCKS5 && c->allow_request == ID) {
-                                               if(c->buffer[0] != 5) {
-                                                       logger(LOG_ERR, "Invalid response from proxy server");
-                                                       return false;
-                                               }
-                                               if(c->buffer[1] == (char)0xff) {
-                                                       logger(LOG_ERR, "Proxy request rejected: unsuitable authentication method");
-                                                       return false;
-                                               }
-                                               if(c->buffer[2] != 5) {
-                                                       logger(LOG_ERR, "Invalid response from proxy server");
-                                                       return false;
-                                               }
-                                               if(c->buffer[3] == 0) {
-                                                       ifdebug(CONNECTIONS) logger(LOG_DEBUG, "Proxy request granted");
-                                               } else {
-                                                       logger(LOG_ERR, "Proxy request rejected");
-                                                       return false;
-                                               }
-                                       } else {
-                                               logger(LOG_ERR, "c->tcplen set but c->node is NULL!");
-                                               abort();
-                                       }
-                               } else {
-                                       if(c->allow_request == ALL) {
-                                               receive_tcppacket(c, c->buffer, c->tcplen);
-                                       } else {
-                                               logger(LOG_ERR, "Got unauthorized TCP packet from %s (%s)", c->name, c->hostname);
-                                               return false;
-                                       }
+                               if(c->allow_request != ALL) {
+                                       logger(LOG_ERR, "Got unauthorized TCP packet from %s (%s)", c->name, c->hostname);
+                                       return false;
                                }
 
-                               c->buflen -= c->tcplen;
-                               lenin -= c->tcplen - oldlen;
-                               memmove(c->buffer, c->buffer + c->tcplen, c->buflen);
-                               oldlen = 0;
+                               receive_tcppacket(c, c->buffer, c->tcplen);
+                               reqlen = c->tcplen;
                                c->tcplen = 0;
-                               continue;
-                       } else {
-                               break;
                        }
-               }
-
-               /* Otherwise we are waiting for a request */
-
-               reqlen = 0;
+               } else {
+                       /* Otherwise we are waiting for a request */
 
-               for(i = oldlen; i < c->buflen; i++) {
-                       if(c->buffer[i] == '\n') {
-                               c->buffer[i] = '\0';    /* replace end-of-line by end-of-string so we can use sscanf */
-                               reqlen = i + 1;
-                               break;
+                       for(i = oldlen; i < c->buflen; i++) {
+                               if(c->buffer[i] == '\n') {
+                                       c->buffer[i] = '\0';    /* replace end-of-line by end-of-string so we can use sscanf */
+                                       c->reqlen = reqlen = i + 1;
+                                       break;
+                               }
                        }
-               }
 
-               if(reqlen) {
-                       c->reqlen = reqlen;
-                       if(!receive_request(c))
+                       if(reqlen && !receive_request(c))
                                return false;
+               }
 
+consume:
+               if(reqlen) {
                        c->buflen -= reqlen;
                        lenin -= reqlen - oldlen;
                        memmove(c->buffer, c->buffer + reqlen, c->buflen);