Fix double free in silcd.
[silc.git] / apps / silcd / server_util.c
index 092c81717609c8af4c81bc0797487f477f1b9843..74ce18ba2902866107148517f3f961fe645dd714 100644 (file)
@@ -4,7 +4,7 @@
 
   Author: Pekka Riikonen <priikone@silcnet.org>
 
-  Copyright (C) 1997 - 2005, 2007 Pekka Riikonen
+  Copyright (C) 1997 - 2008 Pekka Riikonen
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -189,17 +189,19 @@ SilcBool silc_server_remove_clients_by_server(SilcServer server,
 
       if (server_signoff) {
        idp = silc_id_payload_encode(client->id, SILC_ID_CLIENT);
-       argv = silc_realloc(argv, sizeof(*argv) * (argc + 1));
-       argv_lens = silc_realloc(argv_lens, sizeof(*argv_lens) *
-                                (argc + 1));
-       argv_types = silc_realloc(argv_types, sizeof(*argv_types) *
-                                 (argc + 1));
-       argv[argc] = silc_calloc(silc_buffer_len(idp), sizeof(*argv[0]));
-       memcpy(argv[argc], idp->data, silc_buffer_len(idp));
-       argv_lens[argc] = silc_buffer_len(idp);
-       argv_types[argc] = argc + 1;
-       argc++;
-       silc_buffer_free(idp);
+       if (idp) {
+         argv = silc_realloc(argv, sizeof(*argv) * (argc + 1));
+         argv_lens = silc_realloc(argv_lens, sizeof(*argv_lens) *
+                                  (argc + 1));
+         argv_types = silc_realloc(argv_types, sizeof(*argv_types) *
+                                   (argc + 1));
+         argv[argc] = silc_calloc(silc_buffer_len(idp), sizeof(*argv[0]));
+         memcpy(argv[argc], idp->data, silc_buffer_len(idp));
+         argv_lens[argc] = silc_buffer_len(idp);
+         argv_types[argc] = argc + 1;
+         argc++;
+         silc_buffer_free(idp);
+       }
       }
 
       /* Update statistics */
@@ -209,10 +211,13 @@ SilcBool silc_server_remove_clients_by_server(SilcServer server,
       SILC_OPER_STATS_UPDATE(client, server, SILC_UMODE_SERVER_OPERATOR);
       SILC_OPER_STATS_UPDATE(client, router, SILC_UMODE_ROUTER_OPERATOR);
 
-      if (client->data.public_key)
-       silc_hash_table_del_by_context(server->pk_hash,
-                                      client->data.public_key,
-                                      client);
+      /* Remove client's public key from repository, this will free it too. */
+      if (client->data.public_key) {
+       silc_skr_del_public_key(server->repository, client->data.public_key,
+                               client);
+       client->data.public_key = NULL;
+      }
+
       silc_server_remove_clients_channels(server, entry, clients,
                                          client, channels);
       silc_server_del_from_watcher_list(server, client);
@@ -223,6 +228,9 @@ SilcBool silc_server_remove_clients_by_server(SilcServer server,
        client->mode = 0;
        client->router = NULL;
        client->connection = NULL;
+       client->data.created = silc_time();
+       silc_dlist_del(server->expired_clients, client);
+       silc_dlist_add(server->expired_clients, client);
       } else {
        silc_idlist_del_data(client);
        silc_idlist_del_client(server->local_list, client);
@@ -266,10 +274,13 @@ SilcBool silc_server_remove_clients_by_server(SilcServer server,
       SILC_OPER_STATS_UPDATE(client, server, SILC_UMODE_SERVER_OPERATOR);
       SILC_OPER_STATS_UPDATE(client, router, SILC_UMODE_ROUTER_OPERATOR);
 
-      if (client->data.public_key)
-       silc_hash_table_del_by_context(server->pk_hash,
-                                      client->data.public_key,
-                                      client);
+      /* Remove client's public key from repository, this will free it too. */
+      if (client->data.public_key) {
+       silc_skr_del_public_key(server->repository, client->data.public_key,
+                               client);
+       client->data.public_key = NULL;
+      }
+
       silc_server_remove_clients_channels(server, entry, clients,
                                          client, channels);
       silc_server_del_from_watcher_list(server, client);
@@ -280,6 +291,9 @@ SilcBool silc_server_remove_clients_by_server(SilcServer server,
        client->mode = 0;
        client->router = NULL;
        client->connection = NULL;
+       client->data.created = silc_time();
+       silc_dlist_del(server->expired_clients, client);
+       silc_dlist_add(server->expired_clients, client);
       } else {
        silc_idlist_del_data(client);
        silc_idlist_del_client(server->global_list, client);
@@ -403,10 +417,8 @@ silc_server_update_clients_by_real_server(SilcServer server,
           since the server is local. */
        if (!local) {
          SILC_LOG_DEBUG(("Moving client to local list"));
-         silc_idcache_add(server->local_list->clients, client_cache->name,
-                          client_cache->id, client_cache->context);
-         silc_idcache_del_by_context(server->global_list->clients, client,
-                                     NULL);
+         silc_idcache_move(server->global_list->clients,
+                           server->local_list->clients, client_cache);
        }
        server_entry = server_entry->router;
       } else {
@@ -415,20 +427,16 @@ silc_server_update_clients_by_real_server(SilcServer server,
           since the server is local. */
        if (server_entry->server_type != SILC_BACKUP_ROUTER && !local) {
          SILC_LOG_DEBUG(("Moving client to local list"));
-         silc_idcache_add(server->local_list->clients, client_cache->name,
-                          client_cache->id, client_cache->context);
-         silc_idcache_del_by_context(server->global_list->clients, client,
-                                     NULL);
+         silc_idcache_move(server->global_list->clients,
+                           server->local_list->clients, client_cache);
 
        } else if (server->server_type == SILC_BACKUP_ROUTER && local) {
          /* If we are backup router and this client is on local list, we
             must move it to global list, as it is not currently local to
             us (we are not primary). */
          SILC_LOG_DEBUG(("Moving client to global list"));
-         silc_idcache_add(server->global_list->clients, client_cache->name,
-                          client_cache->id, client_cache->context);
-         silc_idcache_del_by_context(server->local_list->clients, client,
-                                     NULL);
+         silc_idcache_move(server->local_list->clients,
+                           server->global_list->clients, client_cache);
        }
       }
 
@@ -455,10 +463,8 @@ silc_server_update_clients_by_real_server(SilcServer server,
           since the server is global. */
        if (local) {
          SILC_LOG_DEBUG(("Moving client to global list"));
-         silc_idcache_add(server->global_list->clients, client_cache->name,
-                          client_cache->id, client_cache->context);
-         silc_idcache_del_by_context(server->local_list->clients, client,
-                                     NULL);
+         silc_idcache_move(server->local_list->clients,
+                           server->global_list->clients, client_cache);
        }
        server_entry = server_entry->router;
       } else {
@@ -467,10 +473,8 @@ silc_server_update_clients_by_real_server(SilcServer server,
           since the server is global. */
        if (server_entry->server_type != SILC_BACKUP_ROUTER && local) {
          SILC_LOG_DEBUG(("Moving client to global list"));
-         silc_idcache_add(server->global_list->clients, client_cache->name,
-                          client_cache->id, client_cache->context);
-         silc_idcache_del_by_context(server->local_list->clients, client,
-                                     NULL);
+         silc_idcache_move(server->local_list->clients,
+                           server->global_list->clients, client_cache);
        }
       }
       return server_entry;
@@ -997,7 +1001,7 @@ SilcUInt32 silc_server_num_sockets_by_ip(SilcServer server, const char *ip,
 
   silc_dlist_start(server->conns);
   while ((conn = silc_dlist_get(server->conns))) {
-    if (!conn->sock)
+    if (!conn->sock || !silc_packet_stream_is_valid(conn->sock))
       continue;
     silc_socket_stream_get_info(silc_packet_stream_get_stream(conn->sock),
                                NULL, NULL, &ipaddr, NULL);
@@ -1023,7 +1027,7 @@ silc_server_find_socket_by_host(SilcServer server,
 
   silc_dlist_start(server->conns);
   while ((conn = silc_dlist_get(server->conns))) {
-    if (!conn->sock)
+    if (!conn->sock || !silc_packet_stream_is_valid(conn->sock))
       continue;
     idata = silc_packet_get_context(conn->sock);
     silc_socket_stream_get_info(silc_packet_stream_get_stream(conn->sock),
@@ -1044,19 +1048,29 @@ silc_server_find_socket_by_host(SilcServer server,
 SilcUInt32 silc_server_num_sockets_by_remote(SilcServer server,
                                             const char *ip,
                                             const char *hostname,
-                                            SilcUInt16 port)
+                                            SilcUInt16 port,
+                                            SilcConnectionType type)
 {
   SilcServerConnection conn;
+  SilcIDListData idata;
+  SilcConnectionType t = SILC_CONN_UNKNOWN;
   int count = 0;
 
   if (!ip && !hostname)
     return 0;
 
+  SILC_LOG_DEBUG(("Num connections %d", silc_dlist_count(server->conns)));
+
   silc_dlist_start(server->conns);
   while ((conn = silc_dlist_get(server->conns))) {
+    if (conn->sock) {
+      idata = silc_packet_get_context(conn->sock);
+      if (idata)
+       t = idata->conn_type;
+    }
     if (((ip && !strcmp(conn->remote_host, ip)) ||
         (hostname && !strcmp(conn->remote_host, hostname))) &&
-       conn->remote_port == port)
+       conn->remote_port == port && t == type)
       count++;
   }
 
@@ -1082,8 +1096,7 @@ static void find_callback(SilcSKR skr, SilcSKRFind find,
   silc_skr_find_free(find);
 }
 
-/* Get public key. For public key tables that has multiple keys in it the
-   silc_server_find_public_key must be used. */
+/* Get public key by key usage and key context. */
 
 SilcPublicKey silc_server_get_public_key(SilcServer server,
                                         SilcSKRKeyUsage usage,
@@ -1103,6 +1116,13 @@ SilcPublicKey silc_server_get_public_key(SilcServer server,
   silc_skr_find(server->repository, server->schedule,
                find, find_callback, &public_key);
 
+#ifdef SILC_DEBUG
+  if (public_key)
+    SILC_LOG_DEBUG(("Found public key"));
+  else
+    SILC_LOG_DEBUG(("Public key not found"));
+#endif /* SILC_DEBUG */
+
   return public_key;
 }
 
@@ -1179,6 +1199,7 @@ SilcBool silc_server_connection_allowed(SilcServer server,
       silc_server_disconnect_remote(server, sock,
                                    SILC_STATUS_ERR_BAD_VERSION,
                                    "You support too old protocol version");
+      silc_server_free_sock_user_data(server, sock, NULL);
       return FALSE;
     }
 
@@ -1190,6 +1211,7 @@ SilcBool silc_server_connection_allowed(SilcServer server,
       silc_server_disconnect_remote(server, sock,
                                    SILC_STATUS_ERR_BAD_VERSION,
                                    "You support too old software version");
+      silc_server_free_sock_user_data(server, sock, NULL);
       return FALSE;
     }
 
@@ -1201,6 +1223,7 @@ SilcBool silc_server_connection_allowed(SilcServer server,
       silc_server_disconnect_remote(server, sock,
                                    SILC_STATUS_ERR_BAD_VERSION,
                                    "Your software is not supported");
+      silc_server_free_sock_user_data(server, sock, NULL);
       return FALSE;
     }
   }
@@ -1214,20 +1237,25 @@ SilcBool silc_server_connection_allowed(SilcServer server,
                  global->connections_max_per_host);
 
   if (max_hosts && conn_number >= max_hosts) {
+    SILC_LOG_DEBUG(("Server is full, %d >= %d", conn_number, max_hosts));
     SILC_LOG_INFO(("Server is full, closing %s (%s) connection",
                   hostname, ip));
     silc_server_disconnect_remote(server, sock,
                                  SILC_STATUS_ERR_RESOURCE_LIMIT,
                                  "Server is full, try again later");
+    silc_server_free_sock_user_data(server, sock, NULL);
     return FALSE;
   }
 
   if (num_sockets >= max_per_host) {
+    SILC_LOG_DEBUG(("Too many connections, %d >= %d", num_sockets,
+                   max_per_host));
     SILC_LOG_INFO(("Too many connections from %s (%s), closing connection",
                   hostname, ip));
     silc_server_disconnect_remote(server, sock,
                                  SILC_STATUS_ERR_RESOURCE_LIMIT,
                                  "Too many connections from your host");
+    silc_server_free_sock_user_data(server, sock, NULL);
     return FALSE;
   }
 
@@ -1238,9 +1266,9 @@ SilcBool silc_server_connection_allowed(SilcServer server,
    of the checks fails FALSE is returned. */
 
 SilcBool silc_server_check_cmode_rights(SilcServer server,
-                                   SilcChannelEntry channel,
-                                   SilcChannelClientEntry client,
-                                   SilcUInt32 mode)
+                                       SilcChannelEntry channel,
+                                       SilcChannelClientEntry client,
+                                       SilcUInt32 mode)
 {
   SilcBool is_op = client->mode & SILC_CHANNEL_UMODE_CHANOP;
   SilcBool is_fo = client->mode & SILC_CHANNEL_UMODE_CHANFO;
@@ -1350,8 +1378,8 @@ SilcBool silc_server_check_cmode_rights(SilcServer server,
    FALSE if setting some mode is not allowed. */
 
 SilcBool silc_server_check_umode_rights(SilcServer server,
-                                   SilcClientEntry client,
-                                   SilcUInt32 mode)
+                                       SilcClientEntry client,
+                                       SilcUInt32 mode)
 {
   SilcBool server_op = FALSE, router_op = FALSE;
 
@@ -1519,8 +1547,17 @@ void silc_server_kill_client(SilcServer server,
   if (remote_client->connection) {
     /* Remove locally conneted client */
     SilcPacketStream sock = remote_client->connection;
-    silc_server_free_client_data(server, sock, remote_client, FALSE, NULL);
-    silc_server_close_connection(server, sock);
+
+    if (sock)
+      silc_packet_stream_ref(sock);
+
+    silc_server_free_sock_user_data(server, sock, NULL);
+
+    if (sock) {
+      silc_packet_set_context(sock, NULL);
+      silc_server_close_connection(server, sock);
+      silc_packet_stream_unref(sock);
+    }
   } else {
     /* Update statistics */
     server->stat.clients--;
@@ -1529,10 +1566,12 @@ void silc_server_kill_client(SilcServer server,
     SILC_OPER_STATS_UPDATE(remote_client, server, SILC_UMODE_SERVER_OPERATOR);
     SILC_OPER_STATS_UPDATE(remote_client, router, SILC_UMODE_ROUTER_OPERATOR);
 
-    if (remote_client->data.public_key)
-      silc_hash_table_del_by_context(server->pk_hash,
-                                     remote_client->data.public_key,
-                                     remote_client);
+    /* Remove client's public key from repository, this will free it too. */
+    if (remote_client->data.public_key) {
+      silc_skr_del_public_key(server->repository,
+                             remote_client->data.public_key, remote_client);
+      remote_client->data.public_key = NULL;
+    }
 
     if (SILC_IS_LOCAL(remote_client)) {
       server->stat.my_clients--;
@@ -1540,6 +1579,7 @@ void silc_server_kill_client(SilcServer server,
     }
 
     /* Remove remote client */
+    silc_dlist_del(server->expired_clients, remote_client);
     silc_idlist_del_data(remote_client);
     if (!silc_idlist_del_client(server->global_list, remote_client)) {
       /* Remove this client from watcher list if it is */
@@ -1594,9 +1634,9 @@ silc_server_check_watcher_list_foreach(void *key, void *context,
    notify change of notify type indicated by `notify'. */
 
 SilcBool silc_server_check_watcher_list(SilcServer server,
-                                   SilcClientEntry client,
-                                   const char *new_nick,
-                                   SilcNotifyType notify)
+                                       SilcClientEntry client,
+                                       const char *new_nick,
+                                       SilcNotifyType notify)
 {
   unsigned char hash[16];
   WatcherNotifyContext n;
@@ -1645,7 +1685,7 @@ SilcBool silc_server_check_watcher_list(SilcServer server,
    is not watching any nicknames. */
 
 SilcBool silc_server_del_from_watcher_list(SilcServer server,
-                                      SilcClientEntry client)
+                                          SilcClientEntry client)
 {
   SilcHashTableList htl;
   void *key;
@@ -1732,10 +1772,11 @@ SilcBool silc_server_inviteban_match(SilcServer server, SilcHashTable list,
                                     SilcUInt8 type, void *check)
 {
   unsigned char *tmp = NULL;
-  SilcUInt32 len = 0, t;
+  SilcUInt32 len = 0;
   SilcHashTableList htl;
   SilcBuffer entry, idp = NULL, pkp = NULL;
   SilcBool ret = FALSE;
+  void *t;
 
   SILC_LOG_DEBUG(("Matching invite/ban"));
 
@@ -1765,13 +1806,14 @@ SilcBool silc_server_inviteban_match(SilcServer server, SilcHashTable list,
   /* Compare the list */
   silc_hash_table_list(list, &htl);
   while (silc_hash_table_get(&htl, (void *)&t, (void *)&entry)) {
-    if (type == t) {
+    if (type == SILC_PTR_TO_32(t)) {
       if (type == 1) {
        if (silc_string_match(entry->data, tmp)) {
          ret = TRUE;
          break;
        }
-      } else if (!memcmp(entry->data, tmp, len)) {
+      } else if (silc_buffer_len(entry) == len &&
+                !memcmp(entry->data, tmp, len)) {
        ret = TRUE;
        break;
       }
@@ -1788,11 +1830,14 @@ SilcBool silc_server_inviteban_match(SilcServer server, SilcHashTable list,
 
 /* Process invite or ban information */
 
-SilcBool silc_server_inviteban_process(SilcServer server, SilcHashTable list,
-                                  SilcUInt8 action, SilcArgumentPayload args)
+SilcBool silc_server_inviteban_process(SilcServer server,
+                                      SilcHashTable list,
+                                      SilcUInt8 action,
+                                      SilcArgumentPayload args)
 {
   unsigned char *tmp;
   SilcUInt32 type, len;
+  void *ptype;
   SilcBuffer tmp2;
   SilcHashTableList htl;
 
@@ -1819,8 +1864,9 @@ SilcBool silc_server_inviteban_process(SilcServer server, SilcHashTable list,
 
        /* Check if the string is added already */
        silc_hash_table_list(list, &htl);
-       while (silc_hash_table_get(&htl, (void *)&type, (void *)&tmp2)) {
-         if (type == 1 && silc_string_match(tmp2->data, tmp)) {
+       while (silc_hash_table_get(&htl, (void *)&ptype, (void *)&tmp2)) {
+         if (SILC_PTR_TO_32(ptype) == 1 &&
+             silc_string_match(tmp2->data, tmp)) {
            tmp = NULL;
            break;
          }
@@ -1850,8 +1896,8 @@ SilcBool silc_server_inviteban_process(SilcServer server, SilcHashTable list,
 
        /* Check if the public key is in the list already */
        silc_hash_table_list(list, &htl);
-       while (silc_hash_table_get(&htl, (void *)&type, (void *)&tmp2)) {
-         if (type == 2 && !memcmp(tmp2->data, tmp, len)) {
+       while (silc_hash_table_get(&htl, (void *)&ptype, (void *)&tmp2)) {
+         if (SILC_PTR_TO_32(ptype) == 2 && !memcmp(tmp2->data, tmp, len)) {
            tmp = NULL;
            break;
          }
@@ -1870,8 +1916,8 @@ SilcBool silc_server_inviteban_process(SilcServer server, SilcHashTable list,
 
        /* Check if the ID is in the list already */
        silc_hash_table_list(list, &htl);
-       while (silc_hash_table_get(&htl, (void *)&type, (void *)&tmp2)) {
-         if (type == 3 && !memcmp(tmp2->data, tmp, len)) {
+       while (silc_hash_table_get(&htl, (void *)&ptype, (void *)&tmp2)) {
+         if (SILC_PTR_TO_32(ptype) == 3 && !memcmp(tmp2->data, tmp, len)) {
            tmp = NULL;
            break;
          }
@@ -1909,8 +1955,9 @@ SilcBool silc_server_inviteban_process(SilcServer server, SilcHashTable list,
 
        /* Delete from the list */
        silc_hash_table_list(list, &htl);
-       while (silc_hash_table_get(&htl, (void *)&type, (void *)&tmp2)) {
-         if (type == 1 && silc_string_match(tmp2->data, tmp)) {
+       while (silc_hash_table_get(&htl, (void *)&ptype, (void *)&tmp2)) {
+         if (SILC_PTR_TO_32(ptype) == 1 &&
+             silc_string_match(tmp2->data, tmp)) {
            silc_hash_table_del_by_context(list, (void *)1, tmp2);
            break;
          }
@@ -1930,8 +1977,8 @@ SilcBool silc_server_inviteban_process(SilcServer server, SilcHashTable list,
 
        /* Delete from the invite list */
        silc_hash_table_list(list, &htl);
-       while (silc_hash_table_get(&htl, (void *)&type, (void *)&tmp2)) {
-         if (type == 2 && !memcmp(tmp2->data, tmp, len)) {
+       while (silc_hash_table_get(&htl, (void *)&ptype, (void *)&tmp2)) {
+         if (SILC_PTR_TO_32(ptype) == 2 && !memcmp(tmp2->data, tmp, len)) {
            silc_hash_table_del_by_context(list, (void *)2, tmp2);
            break;
          }
@@ -1943,8 +1990,8 @@ SilcBool silc_server_inviteban_process(SilcServer server, SilcHashTable list,
 
        /* Delete from the invite list */
        silc_hash_table_list(list, &htl);
-       while (silc_hash_table_get(&htl, (void *)&type, (void *)&tmp2)) {
-         if (type == 3 && !memcmp(tmp2->data, tmp, len)) {
+       while (silc_hash_table_get(&htl, (void *)&ptype, (void *)&tmp2)) {
+         if (SILC_PTR_TO_32(ptype) == 3 && !memcmp(tmp2->data, tmp, len)) {
            silc_hash_table_del_by_context(list, (void *)3, tmp2);
            break;
          }
@@ -1974,7 +2021,7 @@ void silc_server_create_connections(SilcServer server)
   silc_schedule_task_del_by_callback(server->schedule,
                                     silc_server_connect_to_router);
   silc_schedule_task_add_timeout(server->schedule,
-                                silc_server_connect_to_router, server, 0, 1);
+                                silc_server_connect_to_router, server, 1, 0);
 }
 
 static void
@@ -2074,6 +2121,8 @@ SilcBuffer silc_server_get_channel_pk_list(SilcServer server,
   silc_hash_table_list(channel->channel_pubkeys, &htl);
   while (silc_hash_table_get(&htl, NULL, (void *)&pk)) {
     pkp = silc_public_key_payload_encode(pk);
+    if (!pkp)
+      continue;
     list = silc_argument_payload_encode_one(list, pkp->data,
                                            silc_buffer_len(pkp),
                                            announce ? 0x03 :
@@ -2179,10 +2228,10 @@ SilcStatus silc_server_set_channel_pk_list(SilcServer server,
    on the `channel' public key list. */
 
 SilcBool silc_server_verify_channel_auth(SilcServer server,
-                                    SilcChannelEntry channel,
-                                    SilcClientID *client_id,
-                                    const unsigned char *auth,
-                                    SilcUInt32 auth_len)
+                                        SilcChannelEntry channel,
+                                        SilcClientID *client_id,
+                                        const unsigned char *auth,
+                                        SilcUInt32 auth_len)
 {
   SilcAuthPayload ap;
   SilcPublicKey chpk;