Changeset 828

Timestamp:

11/26/08 02:51:23 (3 years ago)

Author:

wd

Message:

Prevent data that shoots past the buffer limit in 1459-style protocols from
being treated as a new command.

Location:

branches/ithildin-1.1/modules/ircd

Files:

• connection.h (modified) (2 diffs)
• protocols/shared/rfc1459_io.c (modified) (8 diffs)

branches/ithildin-1.1/modules/ircd/connection.h

@@ -46 +46 @@
     } stats;
 
-#define IRCD_CONNFL_DNS_PTR     0x1
-#define IRCD_CONNFL_DNS_ADDR    0x2
-#define IRCD_CONNFL_DNS        (IRCD_CONNFL_DNS_PTR | IRCD_CONNFL_DNS_ADDR)
-#define IRCD_CONNFL_IDENT       0x4
-#define IRCD_CONNFL_STAGE2      0x8
+#define IRCD_CONNFL_DNS_PTR         0x1
+#define IRCD_CONNFL_DNS_ADDR        0x2
+#define IRCD_CONNFL_DNS            (IRCD_CONNFL_DNS_PTR | IRCD_CONNFL_DNS_ADDR)
+#define IRCD_CONNFL_IDENT           0x4
+#define IRCD_CONNFL_STAGE2          0x8
 #define IRCD_CONN_DONE(x)                                                     \
     (((x)->flags & (IRCD_CONNFL_DNS | IRCD_CONNFL_IDENT)) ==                  \
@@ -56 +56 @@
 #define IRCD_CONN_NEED_STAGE2(x) (!((x)->flags & IRCD_CONNFL_STAGE2))
 
-#define IRCD_CONNFL_WRITEABLE 0x100 /* set if the socket is writeable */
+#define IRCD_CONNFL_WRITEABLE       0x100 /* set if the socket is writeable */
 #define CONN_PINGSENT(conn) (conn->flags & IRCD_CONNFL_PINGSENT)
-#define IRCD_CONNFL_PINGSENT  0x200 /* set when a PING is sent to test for
-                                       activity */
+#define IRCD_CONNFL_PINGSENT        0x200 /* set when a PING is sent to test
+                                             for activity */
         
-#define IRCD_CONNFL_NOSENDQ   0x400 /* this is set if we don't want to observe
-                                       send queue limits on the connection
-                                       (mostly useful for sending
-                                       synchronization data to servers).  it is
-                                       not unset until sendq drops to 0. */
+#define IRCD_CONNFL_NOSENDQ         0x400 /* this is set if we don't want to
+                                             observe send queue limits on the
+                                             connection (mostly useful for
+                                             sending synchronization data to
+                                             servers).  it is not unset until
+                                             sendq drops to 0. */
 #ifdef HAVE_OPENSSL
-#define IRCD_CONNFL_SSLINIT   0x800 /* set when we're waiting for the first
-                                       data event for an initiating SSL socket.
-                                       when we get this event we can begin the
-                                       regular connection initiation. */
+#define IRCD_CONNFL_SSLINIT         0x800 /* set when we're waiting for the
+                                             first data event for an initiating
+                                             SSL socket.  when we get this
+                                             event we can begin the regular
+                                             connection initiation. */
 #endif
+#define IRCD_CONNFL_DIRTYBUFFER    0x1000 /* set when the contents of the
+                                             buffer are 'dirty' (typically
+                                             an overflow command which must
+                                             be discarded) */
 
     int     flags;                  /* connection flags (DO NOT PUT

branches/ithildin-1.1/modules/ircd/protocols/shared/rfc1459_io.c

@@ -22 +22 @@
     int ret = 0;
     char *s;
+    bool dirtybuffer;
 
     /* If we were force-called (ep is NULL) we assume there is data in our
@@ -35 +36 @@
 
         while (cp->buflen > 0) {
+            dirtybuffer = false;
             /* if the buffer is full but no terminating character (\n) is
                found, we cheat */
@@ -45 +47 @@
                     s++;
 
+                /* A command without a newline, add it and note that the
+                 * future contents of the buffer are dirty (handled below
+                 * when we pass out the data) */
                 if (s == cp->buf + cp->bufsize) {
                     cp->buf[cp->bufsize - 1] = '\n';
                     s = cp->buf + cp->bufsize - 1;
+                    dirtybuffer = true;
                 }
             } else {
@@ -55 +61 @@
                     break; /* no separator found, try reading some more */
             }
-            /* make a local copy of the packet, then pass it off to the parser. 
-             * Bump the rest of the contents of 'buf' down if we read more than
-             * we have parsed. */
+
             /* null-terminate and get rid of the [\r]\n sequence. */
             if (s > cp->buf && *(s - 1) == '\r')
@@ -63 +67 @@
             else
                 *s = '\0';
+
             log_debug("[%s] <%s< %s", ircd.me->name,
                     (cp->cli != NULL ? cp->cli->nick :
                      (cp->srv != NULL ? cp->srv->name : "")), cp->buf);
-            if ((ret = packet_parse(cp)) == IRCD_CONNECTION_CLOSED)
-                return (void *)ret; /* connection closed, stop immediately */
+            /* Don't parse the packet if the buffer is dirty, otherwise do
+             * call the parser. */
+            if (!(cp->flags & IRCD_CONNFL_DIRTYBUFFER))
+            {
+                if ((ret = packet_parse(cp)) == IRCD_CONNECTION_CLOSED)
+                    return (void *)ret; /* connection closed, stop immediately */
+            } else
+                cp->flags &= ~IRCD_CONNFL_DIRTYBUFFER;
+
             s++; /* increment s, now we see if our packet contains more data */
             if (s - cp->buf < cp->buflen) {
@@ -77 +89 @@
                 *cp->buf = '\0'; /* zero it out */
             }
+
+            /* If the buffer is marked dirty, set the flag now on the
+             * connection (since we have passed off the previous command) */
+            if (dirtybuffer)
+                cp->flags |= IRCD_CONNFL_DIRTYBUFFER;
 
             if (ret == IRCD_PROTOCOL_CHANGED)
@@ -128 +145 @@
             buf[sm.len++] = ' ';
 
-        sm.len += vsnprintf(&buf[sm.len], MAX_PACKET_LEN - 3 - sm.len, msg,
-                args);
+        sm.len += vsnprintf(&buf[sm.len], MAX_PACKET_LEN - sm.len, msg, args);
     }
 
@@ -139 +155 @@
             (to != NULL ? to : ""), buf);
 
-    strcpy(&buf[sm.len], "\r\n");
-    sm.len += 2;
+    /* Terminate the command */
+    if (sm.len > MAX_PACKET_LEN - 2)
+        sm.len = MAX_PACKET_LEN - 2;
+    buf[sm.len++] = '\r';
+    buf[sm.len++] = '\n';
 
     return &sm;