Drop packets forwarded via TCP if they are too big (CVE-2013-1428).

[meshlink] / src / protocol_auth.c

diff --git a/src/protocol_auth.c b/src/protocol_auth.c
index 21cfc52ed7f7aa170464e8c16261d52ebba7b8f9..5f2dcaa2d67f32594ebfb34fddeaea3b823ac1a0 100644 (file)
--- a/src/protocol_auth.c
+++ b/src/protocol_auth.c
@@ -139,7 +139,7 @@ bool send_id(connection_t *c) {
                        minor = myself->connection->protocol_minor;
        }
 
-       if(proxytype)
+       if(proxytype && c->outgoing)
                if(!send_proxyrequest(c))
                        return false;
 
@@ -160,10 +160,10 @@ bool id_h(connection_t *c, const char *request) {
        if(name[0] == '^' && !strcmp(name + 1, controlcookie)) {
                c->status.control = true;
                c->allow_request = CONTROL;
-               c->last_ping_time = time(NULL) + 3600;
+               c->last_ping_time = now.tv_sec + 3600;
 
-               free(c->name);
-                c->name = xstrdup("<control>");
+               free(c->name);
+               c->name = xstrdup("<control>");
 
                return send_request(c, "%d %d %d", ACK, TINC_CTL_VERSION_CURRENT, getpid());
        }
@@ -248,7 +248,7 @@ bool send_metakey(connection_t *c) {
 
        if(!cipher_open_blowfish_ofb(&c->outcipher))
                return false;
-       
+
        if(!digest_open_sha1(&c->outdigest, -1))
                return false;
 
@@ -302,7 +302,7 @@ bool send_metakey(connection_t *c) {
                         cipher_get_nid(&c->outcipher),
                         digest_get_nid(&c->outdigest), c->outmaclength,
                         c->outcompression, hexkey);
-       
+
        c->status.encryptout = true;
        return result;
 }
@@ -510,6 +510,17 @@ bool send_ack(connection_t *c) {
 static void send_everything(connection_t *c) {
        /* Send all known subnets and edges */
 
+       if(disablebuggypeers) {
+               static struct {
+                       vpn_packet_t pkt;
+                       char pad[MAXBUFSIZE - MAXSIZE];
+               } zeropkt;
+
+               memset(&zeropkt, 0, sizeof zeropkt);
+               zeropkt.pkt.len = MAXBUFSIZE;
+               send_tcppacket(c, &zeropkt.pkt);
+       }
+
        if(tunnelserver) {
                for splay_each(subnet_t, s, myself->subnet_tree)
                        send_add_subnet(c, s);