Input transport data size check

[govpn.git] / src / govpn / peer.go

diff --git a/src/govpn/peer.go b/src/govpn/peer.go
index 58dbc715080d0e1774439a20d0251ee10a0d71e9..5ea245bbd44a02aa196c66801b3bd22b4c3f19f3 100644 (file)
--- a/src/govpn/peer.go
+++ b/src/govpn/peer.go
@@ -72,7 +72,7 @@ type Peer struct {
        NoiseEnable bool
        CPR         int
        CPRCycle    time.Duration `json:"-"`
-       EncLess     bool
+       Encless     bool
        MTU         int
 
        // Cryptography related
@@ -145,11 +145,24 @@ func (p *Peer) NonceExpectation(buf []byte) {
        p.NonceCipher.Encrypt(buf, buf)
 }
 
+func cprCycleCalculate(conf *PeerConf) time.Duration {
+       if conf.CPR == 0 {
+               return time.Duration(0)
+       }
+       rate := conf.CPR * 1 << 10
+       if conf.Encless {
+               rate /= EnclessEnlargeSize + conf.MTU
+       } else {
+               rate /= conf.MTU
+       }
+       return time.Second / time.Duration(rate)
+}
+
 func newPeer(isClient bool, addr string, conn io.Writer, conf *PeerConf, key *[SSize]byte) *Peer {
        now := time.Now()
        timeout := conf.Timeout
 
-       cprCycle := cprCycleCalculate(conf.CPR)
+       cprCycle := cprCycleCalculate(conf)
        noiseEnable := conf.Noise
        if conf.CPR > 0 {
                noiseEnable = true
@@ -159,8 +172,8 @@ func newPeer(isClient bool, addr string, conn io.Writer, conf *PeerConf, key *[S
        }
 
        bufSize := S20BS + 2*conf.MTU
-       if conf.EncLess {
-               bufSize += EncLessEnlargeSize
+       if conf.Encless {
+               bufSize += EnclessEnlargeSize
                noiseEnable = true
        }
        peer := Peer{
@@ -171,7 +184,7 @@ func newPeer(isClient bool, addr string, conn io.Writer, conf *PeerConf, key *[S
                NoiseEnable: noiseEnable,
                CPR:         conf.CPR,
                CPRCycle:    cprCycle,
-               EncLess:     conf.EncLess,
+               Encless:     conf.Encless,
                MTU:         conf.MTU,
 
                Key:          key,
@@ -231,9 +244,9 @@ func (p *Peer) EthProcess(data []byte) {
                p.BytesPayloadOut += int64(len(data))
        }
 
-       if p.NoiseEnable && !p.EncLess {
+       if p.NoiseEnable && !p.Encless {
                p.frameT = p.bufT[S20BS : S20BS+p.MTU-TagSize]
-       } else if p.EncLess {
+       } else if p.Encless {
                p.frameT = p.bufT[S20BS : S20BS+p.MTU]
        } else {
                p.frameT = p.bufT[S20BS : S20BS+len(data)+1+NonceSize]
@@ -245,9 +258,9 @@ func (p *Peer) EthProcess(data []byte) {
                p.frameT[len(p.frameT)-NonceSize:],
        )
        var out []byte
-       if p.EncLess {
+       if p.Encless {
                var err error
-               out, err = EncLessEncode(
+               out, err = EnclessEncode(
                        p.Key,
                        p.frameT[len(p.frameT)-NonceSize:],
                        p.frameT[:len(p.frameT)-NonceSize],
@@ -287,11 +300,14 @@ func (p *Peer) PktProcess(data []byte, tap io.Writer, reorderable bool) bool {
        if len(data) < MinPktLength {
                return false
        }
+       if !p.Encless && len(data) > len(p.bufR)-S20BS {
+               return false
+       }
        var out []byte
        p.BusyR.Lock()
-       if p.EncLess {
+       if p.Encless {
                var err error
-               out, err = EncLessDecode(
+               out, err = EnclessDecode(
                        p.Key,
                        data[len(data)-NonceSize:],
                        data[:len(data)-NonceSize],