Input transport data size check

[govpn.git] / src / govpn / peer.go

diff --git a/src/govpn/peer.go b/src/govpn/peer.go
index f3bb0b43befea0c5081fc9dfb994be8415b8a532..5ea245bbd44a02aa196c66801b3bd22b4c3f19f3 100644 (file)
--- a/src/govpn/peer.go
+++ b/src/govpn/peer.go
@@ -22,6 +22,7 @@ import (
        "bytes"
        "encoding/binary"
        "io"
+       "log"
        "sync"
        "sync/atomic"
        "time"
@@ -71,7 +72,8 @@ type Peer struct {
        NoiseEnable bool
        CPR         int
        CPRCycle    time.Duration `json:"-"`
-       EncLess     bool
+       Encless     bool
+       MTU         int
 
        // Cryptography related
        Key          *[SSize]byte `json:"-"`
@@ -143,11 +145,24 @@ func (p *Peer) NonceExpectation(buf []byte) {
        p.NonceCipher.Encrypt(buf, buf)
 }
 
+func cprCycleCalculate(conf *PeerConf) time.Duration {
+       if conf.CPR == 0 {
+               return time.Duration(0)
+       }
+       rate := conf.CPR * 1 << 10
+       if conf.Encless {
+               rate /= EnclessEnlargeSize + conf.MTU
+       } else {
+               rate /= conf.MTU
+       }
+       return time.Second / time.Duration(rate)
+}
+
 func newPeer(isClient bool, addr string, conn io.Writer, conf *PeerConf, key *[SSize]byte) *Peer {
        now := time.Now()
        timeout := conf.Timeout
 
-       cprCycle := cprCycleCalculate(conf.CPR)
+       cprCycle := cprCycleCalculate(conf)
        noiseEnable := conf.Noise
        if conf.CPR > 0 {
                noiseEnable = true
@@ -156,9 +171,9 @@ func newPeer(isClient bool, addr string, conn io.Writer, conf *PeerConf, key *[S
                timeout = timeout / TimeoutHeartbeat
        }
 
-       bufSize := S20BS + MTU + NonceSize
-       if conf.EncLess {
-               bufSize += EncLessEnlargeSize
+       bufSize := S20BS + 2*conf.MTU
+       if conf.Encless {
+               bufSize += EnclessEnlargeSize
                noiseEnable = true
        }
        peer := Peer{
@@ -169,7 +184,8 @@ func newPeer(isClient bool, addr string, conn io.Writer, conf *PeerConf, key *[S
                NoiseEnable: noiseEnable,
                CPR:         conf.CPR,
                CPRCycle:    cprCycle,
-               EncLess:     conf.EncLess,
+               Encless:     conf.Encless,
+               MTU:         conf.MTU,
 
                Key:          key,
                NonceCipher:  newNonceCipher(key),
@@ -203,6 +219,10 @@ func newPeer(isClient bool, addr string, conn io.Writer, conf *PeerConf, key *[S
 // that he is free to receive new packets. Encrypted and authenticated
 // packets will be sent to remote Peer side immediately.
 func (p *Peer) EthProcess(data []byte) {
+       if len(data) > p.MTU-1 { // 1 is for padding byte
+               log.Println("Padded data packet size", len(data)+1, "is bigger than MTU", p.MTU, p)
+               return
+       }
        p.now = time.Now()
        p.BusyT.Lock()
 
@@ -224,10 +244,10 @@ func (p *Peer) EthProcess(data []byte) {
                p.BytesPayloadOut += int64(len(data))
        }
 
-       if p.NoiseEnable && !p.EncLess {
-               p.frameT = p.bufT[S20BS : S20BS+MTU-TagSize]
-       } else if p.EncLess {
-               p.frameT = p.bufT[S20BS : S20BS+MTU]
+       if p.NoiseEnable && !p.Encless {
+               p.frameT = p.bufT[S20BS : S20BS+p.MTU-TagSize]
+       } else if p.Encless {
+               p.frameT = p.bufT[S20BS : S20BS+p.MTU]
        } else {
                p.frameT = p.bufT[S20BS : S20BS+len(data)+1+NonceSize]
        }
@@ -238,9 +258,9 @@ func (p *Peer) EthProcess(data []byte) {
                p.frameT[len(p.frameT)-NonceSize:],
        )
        var out []byte
-       if p.EncLess {
+       if p.Encless {
                var err error
-               out, err = EncLessEncode(
+               out, err = EnclessEncode(
                        p.Key,
                        p.frameT[len(p.frameT)-NonceSize:],
                        p.frameT[:len(p.frameT)-NonceSize],
@@ -280,11 +300,14 @@ func (p *Peer) PktProcess(data []byte, tap io.Writer, reorderable bool) bool {
        if len(data) < MinPktLength {
                return false
        }
+       if !p.Encless && len(data) > len(p.bufR)-S20BS {
+               return false
+       }
        var out []byte
        p.BusyR.Lock()
-       if p.EncLess {
+       if p.Encless {
                var err error
-               out, err = EncLessDecode(
+               out, err = EnclessDecode(
                        p.Key,
                        data[len(data)-NonceSize:],
                        data[:len(data)-NonceSize],