updates

diff --git a/CHANGES b/CHANGES
index 2ffe0ed5932010e3eaee40d2c561f0ae6a7884cb..e0ca47c142ff5710a917b5572a031244550e06a0 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,14 @@
+Thu Dec 20 16:14:52 CET 2001  Pekka Riikonen <priikone@silcnet.org>
+
+       * The silc_packet_receive_process now returns FALSE if the
+         read data was invalid packet, and TRUE if it was ok.
+
+         The server now checks that if unauthenticated connection
+         sends data and its processing fails the server will close
+         the connection since it could be a malicious flooder. 
+
+         Affected files lib/silccore/silcpacket.[ch], silcd/server.c.
+
 Wed Dec 19 21:31:25 EET 2001  Pekka Riikonen <priikone@silcnet.org>
 
        * Make sure the warning about error opening a log file is

diff --git a/apps/silcd/server.c b/apps/silcd/server.c
index d6a4d4e220e7cc229ec04618143537b92a54f083..add682ce7ed650c3c839723dba4262d6319860dc 100644 (file)
--- a/apps/silcd/server.c
+++ b/apps/silcd/server.c
@@ -1592,9 +1592,23 @@ SILC_TASK_CALLBACK(silc_server_packet_process)
  
   /* Process the packet. This will call the parser that will then
      decrypt and parse the packet. */
-  silc_packet_receive_process(sock, server->server_type == SILC_ROUTER ? 
-                             TRUE : FALSE, cipher, hmac, sequence, 
-                             silc_server_packet_parse, server);
+  ret = silc_packet_receive_process(sock, server->server_type == SILC_ROUTER ? 
+                                   TRUE : FALSE, cipher, hmac, sequence, 
+                                   silc_server_packet_parse, server);
+
+  /* If this socket connection is not authenticated yet and the packet
+     processing failed we will drop the connection since it can be
+     a malicious flooder. */
+  if (sock->type == SILC_SOCKET_TYPE_UNKNOWN && ret == FALSE &&
+      (!sock->protocol || sock->protocol->protocol->type ==
+       SILC_PROTOCOL_SERVER_KEY_EXCHANGE)) {
+    SILC_LOG_DEBUG(("Bad data sent from unknown connection %d", sock->sock));
+    SILC_SET_DISCONNECTING(sock);
+
+    if (sock->user_data)
+      silc_server_free_sock_user_data(server, sock);
+    silc_server_close_connection(server, sock);
+  }
 }
   
 /* Parses whole packet, received earlier. */

diff --git a/lib/silccore/silcpacket.c b/lib/silccore/silcpacket.c
index 6d6c0747d63d8a8c8623c4cfa06ac1d0fe817a4d..190682868381958e12b1e795c889226101e94b14 100644 (file)
--- a/lib/silccore/silcpacket.c
+++ b/lib/silccore/silcpacket.c
@@ -323,7 +323,7 @@ int silc_packet_receive(SilcSocketConnection sock)
    SilcPacketParserContext will indicate also whether the received
    packet was normal or special packet. */
 
-void silc_packet_receive_process(SilcSocketConnection sock,
+bool silc_packet_receive_process(SilcSocketConnection sock,
                                 bool local_is_router,
                                 SilcCipher cipher, SilcHmac hmac,
                                 uint32 sequence,
@@ -336,10 +336,10 @@ void silc_packet_receive_process(SilcSocketConnection sock,
 
   /* Do not process for disconnected connection */
   if (SILC_IS_DISCONNECTED(sock))
-    return;
-  
+    return TRUE;
+
   if (sock->inbuf->len < SILC_PACKET_MIN_HEADER_LEN)
-    return;
+    return TRUE;
 
   if (hmac)
     mac_len = silc_hmac_len(hmac);
@@ -349,7 +349,7 @@ void silc_packet_receive_process(SilcSocketConnection sock,
 
     if (sock->inbuf->len < SILC_PACKET_MIN_HEADER_LEN) {
       SILC_LOG_DEBUG(("Partial packet in queue, waiting for the rest"));
-      return;
+      return TRUE;
     }
 
     /* Decrypt first 16 bytes of the packet */
@@ -364,14 +364,14 @@ void silc_packet_receive_process(SilcSocketConnection sock,
     if (packetlen < SILC_PACKET_MIN_LEN) {
       SILC_LOG_DEBUG(("Received invalid packet, dropped"));
       silc_buffer_clear(sock->inbuf);
-      return;
+      return FALSE;
     }
 
     if (sock->inbuf->len < paddedlen + mac_len) {
       SILC_LOG_DEBUG(("Received partial packet, waiting for the rest"
                      "(%d < %d)", sock->inbuf->len, paddedlen + mac_len));
       SILC_SET_INBUF_PENDING(sock);
-      return;
+      return TRUE;
     }
 
     SILC_UNSET_INBUF_PENDING(sock);
@@ -433,10 +433,11 @@ void silc_packet_receive_process(SilcSocketConnection sock,
   }
 
   if (cont == FALSE && sock->inbuf->len > 0)
-    return;
+    return TRUE;
 
   SILC_LOG_DEBUG(("Clearing inbound buffer"));
   silc_buffer_clear(sock->inbuf);
+  return TRUE;
 }
 
 /* Checks MAC in the packet. Returns TRUE if MAC is Ok. This is called

diff --git a/lib/silccore/silcpacket.h b/lib/silccore/silcpacket.h
index 3bfd897fe36a389fdea2ebf39fd9af491c2c5404..54d6bc16a1a9d58962547b7a2f3fc4b9e0267fab 100644 (file)
--- a/lib/silccore/silcpacket.h
+++ b/lib/silccore/silcpacket.h
@@ -503,7 +503,7 @@ int silc_packet_receive(SilcSocketConnection sock);
  *
  * SYNOPSIS
  *
- *    void silc_packet_receive_process(SilcSocketConnection sock,
+ *    bool silc_packet_receive_process(SilcSocketConnection sock,
  *                                     bool local_is_router,
  *                                     SilcCipher cipher, SilcHmac hmac,
  *                                     SilcPacketParserCallback parser,
@@ -525,7 +525,7 @@ int silc_packet_receive(SilcSocketConnection sock);
  *    packet was normal or special packet.
  *
  ***/
-void silc_packet_receive_process(SilcSocketConnection sock,
+bool silc_packet_receive_process(SilcSocketConnection sock,
                                 bool local_is_router,
                                 SilcCipher cipher, SilcHmac hmac,
                                 uint32 sequence,

diff --git a/scripts/silcdoc/silcdoc b/scripts/silcdoc/silcdoc
index b03eacb3c037ec0c16a384e8f7f5d78c05e62f1b..66f0c040a4e45b7630a09e3e27d9f833fc7fda26 100755 (executable)
--- a/scripts/silcdoc/silcdoc
+++ b/scripts/silcdoc/silcdoc
@@ -35,6 +35,13 @@ ROBO=$4
 # Get all headers in the source directory
 headers=`find $SRC -name "silc*.h"`
 
+#
+# ASCII documentation
+#
+if [ "$TYPE" = "ASCII" ]; then
+
+fi
+
 #
 # HTML documentation
 #
@@ -58,7 +65,7 @@ if [ "$TYPE" = "HTML" ]; then
     do
       n=`grep $k $i |cut -d=  -f2 |cut -d:  -f2`
       echo "<LI><A HREF="$k">$n</A>" >>$DST/$fname.links
-      echo "&nbsp;&nbsp;&nbsp;> <A HREF="$k">$n</A><BR>" >>$DST/index.tmpl
+      echo "&nbsp;&nbsp;&nbsp; <A HREF="$k">$n</A><BR>" >>$DST/index.tmpl
     done
   done