diff options
author | brian <brian@FreeBSD.org> | 1999-03-16 01:24:23 +0000 |
---|---|---|
committer | brian <brian@FreeBSD.org> | 1999-03-16 01:24:23 +0000 |
commit | f7a7179f0fecc8d4e0dfb40980a3f903f39c5271 (patch) | |
tree | 74ee26338504b6ad711d4738882d1100f22b52f4 /usr.sbin | |
parent | ac59e661beea56de0ee42cfd156fff6034b778ad (diff) | |
download | FreeBSD-src-f7a7179f0fecc8d4e0dfb40980a3f903f39c5271.zip FreeBSD-src-f7a7179f0fecc8d4e0dfb40980a3f903f39c5271.tar.gz |
Detect pred1 packets where the length != the packet length
Use a maximum of MAX_MRU + 2 bytes for incoming packets, not
MAX_MTU + 2.
Tidy up some diagnostics.
Diffstat (limited to 'usr.sbin')
-rw-r--r-- | usr.sbin/ppp/pred.c | 29 |
1 files changed, 17 insertions, 12 deletions
diff --git a/usr.sbin/ppp/pred.c b/usr.sbin/ppp/pred.c index b910f4c..1919a8e 100644 --- a/usr.sbin/ppp/pred.c +++ b/usr.sbin/ppp/pred.c @@ -26,7 +26,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $Id: pred.c,v 1.22 1998/08/07 18:42:50 brian Exp $ + * $Id: pred.c,v 1.23 1999/03/11 01:49:15 brian Exp $ */ #include <sys/types.h> @@ -87,17 +87,16 @@ compress(struct pred1_state *state, u_char *source, u_char *dest, int len) } static void -SyncTable(struct pred1_state *state, u_char * source, u_char * dest, int len) +SyncTable(struct pred1_state *state, u_char *source, u_char *dest, int len) { while (len--) { - if (state->dict[state->hash] != *source) - state->dict[state->hash] = *source; - HASH(state, *dest++ = *source++); + *dest++ = state->dict[state->hash] = *source; + HASH(state, *source++); } } static int -decompress(struct pred1_state *state, u_char * source, u_char * dest, int len) +decompress(struct pred1_state *state, u_char *source, u_char *dest, int len) { int i, bitmask; unsigned char flags, *orgdest; @@ -220,7 +219,7 @@ Pred1Input(void *v, struct ccp *ccp, u_short *proto, struct mbuf *bp) u_char *bufp; u_short fcs; - wp = mbuf_Alloc(MAX_MTU + 2, MB_IPIN); + wp = mbuf_Alloc(MAX_MRU + 2, MB_IPIN); cp = MBUF_CTOP(bp); olen = mbuf_Length(bp); pp = bufp = MBUF_CTOP(wp); @@ -242,6 +241,12 @@ Pred1Input(void *v, struct ccp *ccp, u_short *proto, struct mbuf *bp) } cp += olen - 4; pp += len1; + } else if (len + 4 != olen) { + log_Printf(LogCCP, "Pred1: Length error (got %d, not %d)\n", len + 4, olen); + fsm_Reopen(&ccp->fsm); + mbuf_Free(wp); + mbuf_Free(bp); + return NULL; } else { ccp->compin += len; SyncTable(state, cp, pp, len); @@ -251,10 +256,6 @@ Pred1Input(void *v, struct ccp *ccp, u_short *proto, struct mbuf *bp) *pp++ = *cp++; /* CRC */ *pp++ = *cp++; fcs = hdlc_Fcs(INITFCS, bufp, wp->cnt = pp - bufp); - if (fcs != GOODFCS) - log_Printf(LogDEBUG, "Pred1Input: fcs = 0x%04x (%s), len = 0x%x," - " olen = 0x%x\n", fcs, (fcs == GOODFCS) ? "good" : "bad", - len, olen); if (fcs == GOODFCS) { wp->offset += 2; /* skip length */ wp->cnt -= 4; /* skip length & CRC */ @@ -271,7 +272,11 @@ Pred1Input(void *v, struct ccp *ccp, u_short *proto, struct mbuf *bp) mbuf_Free(bp); return wp; } else { - log_Printf(LogCCP, "%s: Bad CRC-16\n", ccp->fsm.link->name); + const char *pre = *MBUF_CTOP(bp) & 0x80 ? "" : "un"; + log_Printf(LogDEBUG, "Pred1Input: fcs = 0x%04x (%scompressed), len = 0x%x," + " olen = 0x%x\n", fcs, pre, len, olen); + log_Printf(LogCCP, "%s: Bad %scompressed CRC-16\n", + ccp->fsm.link->name, pre); fsm_Reopen(&ccp->fsm); mbuf_Free(wp); } |