Ticket #567: udp-issues-jinfei.patch

uspace/srv/net/inetsrv/pdu.c

@@ -105 +105 @@
     size_t offs, size_t mtu, void **rdata, size_t *rsize, size_t *roffs)
 {
         /* Upper bound for fragment offset field */
-        size_t fragoff_limit = 1 << (FF_FRAGOFF_h - FF_FRAGOFF_l);
+        size_t fragoff_limit = 1 << (FF_FRAGOFF_h - FF_FRAGOFF_l+1);
         
         /* Verify that total size of datagram is within reasonable bounds */
-        if (offs + packet->size > FRAG_OFFS_UNIT * fragoff_limit)
+        if ( packet->size > FRAG_OFFS_UNIT * fragoff_limit)
                 return ELIMIT;
         
         size_t hdr_size = sizeof(ip_header_t);

uspace/srv/net/inetsrv/reass.c

@@ -54 +54 @@
         link_t map_link;
         /** List of fragments, @c reass_frag_t */
         list_t frags;
+        void *data;
 } reass_dgram_t;
 
 /** One datagram fragment */
@@ -84 +85 @@
 {
         reass_dgram_t *rdg;
         int rc;
-
         log_msg(LOG_DEFAULT, LVL_DEBUG, "inet_reass_queue_packet()");
 
         fibril_mutex_lock(&reass_dgram_map_lock);
@@ -102 +102 @@
         rc = reass_dgram_insert_frag(rdg, packet);
         if (rc != EOK)
                 return ENOMEM;
-
+                
         /* Check if datagram is complete */
         if (reass_dgram_complete(rdg)) {
                 /* Remove it from the map */
@@ -197 +197 @@
 
         frag->packet = *packet;
         frag->packet.data = data_copy;
+        memcpy(data_copy, packet->data, packet->size);
 
         /*
          * XXX Make resource-consuming attacks harder, eliminate any duplicate
@@ -208 +209 @@
          */
 
         link = list_first(&rdg->frags);
-        while (link != NULL) {
+        while (link != NULL ) {
                 reass_frag_t *qf = list_get_instance(link, reass_frag_t,
                     dgram_link);
 
                 if (qf->packet.offs >= packet->offs)
                         break;
-
-                link = link->next;
+                if ( link->next != &rdg->frags.head)
+                        link = link->next;
+                else
+                        break;
         }
 
-        if (link != NULL)
+        if (link != NULL){
                 list_insert_after(&frag->dgram_link, link);
-        else
+        } else {
                 list_append(&frag->dgram_link, &rdg->frags);
+        }
 
         return EOK;
 }
@@ -242 +246 @@
         /* First fragment must be at offset zero */
         frag = list_get_instance(list_first(&rdg->frags), reass_frag_t,
             dgram_link);
-        if (frag->packet.offs != 0)
+        if (frag->packet.offs != 0) {
                 return false;
+        }
 
         prev = frag;
         while (true) {
                 link = frag->dgram_link.next;
-                if (link == NULL)
+                if (link == NULL || link == (&rdg->frags.head))
                         return false;
 
                 /* Each next fragment must follow immediately or overlap */
                 frag = list_get_instance(link, reass_frag_t, dgram_link);
-                if (frag->packet.offs > prev->packet.offs + prev->packet.size)
+                if (frag->packet.offs > prev->packet.offs + prev->packet.size){
                         return false;
+                }
 
                 /* No more fragments - datagram is complete */
                 if (!frag->packet.mf)
@@ -306 +312 @@
         dgram_size = frag->packet.offs + frag->packet.size;
 
         /* Upper bound for fragment offset field */
-        fragoff_limit = 1 << (FF_FRAGOFF_h - FF_FRAGOFF_l);
+        fragoff_limit = 1 << (FF_FRAGOFF_h - FF_FRAGOFF_l+1);
 
         /* Verify that total size of datagram is within reasonable bounds */
         if (dgram_size > FRAG_OFFS_UNIT * fragoff_limit)
                 return ELIMIT;
 
-        dgram.data = calloc(dgram_size, 1);
+        dgram.data = rdg->data = calloc(dgram_size, 1);
         if (dgram.data == NULL)
                 return ENOMEM;
 
@@ -333 +339 @@
                 ce = min(dgram_size, cfrag->packet.offs + cfrag->packet.size);
 
                 if (ce > cb) {
-                        memcpy(dgram.data + cb,
+                        memcpy(dgram.data + cb, cfrag->packet.data, cfrag->packet.size);
+
+/*                      memcpy(dgram.data + cb,
                             cfrag->packet.data + cb - cfrag->packet.offs,
-                            ce - cb);
+                            ce - cb);*/
                 }
 
                 if (!cfrag->packet.mf)
                         break;
         }
-
         return inet_recv_dgram_local(&dgram, proto);
 }
 
@@ -360 +367 @@
                 free(frag->packet.data);
                 free(frag);
         }
-
+        free(rdg->data);
         free(rdg);
 }
 

uspace/srv/net/udp/assoc.c

@@ -274 +274 @@
                 return ENOMEM;
 
         rc = udp_transmit_pdu(pdu);
+        udp_pdu_delete(pdu);
+
         if (rc != EOK)
                 return EIO;
-
-        udp_pdu_delete(pdu);
-
         return EOK;
 }
 
@@ -328 +327 @@
         int rc;
 
         log_msg(LOG_DEFAULT, LVL_DEBUG, "udp_assoc_received(%p, %p)", rsp, msg);
+        
+        //timeout assoc queue; in case of client crash
 
         assoc = udp_assoc_find_ref(rsp);
         if (assoc == NULL) {
                 log_msg(LOG_DEFAULT, LVL_DEBUG, "No association found. Message dropped.");
                 /* XXX Generate ICMP error. */
                 /* XXX Might propagate error directly by error return. */
+                udp_msg_delete(msg);
                 return;
         }
 

uspace/srv/net/udp/msg.c

@@ -49 +49 @@
 /** Delete segment. */
 void udp_msg_delete(udp_msg_t *msg)
 {
+        free(msg->data);
         free(msg);
 }
 

uspace/srv/net/udp/pdu.c

@@ -196 +196 @@
         if (nmsg == NULL)
                 return ENOMEM;
 
-        nmsg->data = text;
+        //nmsg->data = text;
         nmsg->data_size = length - sizeof(udp_header_t);
+        nmsg->data = malloc(nmsg->data_size);
+        memcpy(nmsg->data, text, nmsg->data_size);
 
         *msg = nmsg;
         return EOK;

uspace/srv/net/udp/udp_type.h

@@ -42 +42 @@
 #include <sys/types.h>
 #include <inet/addr.h>
 
-#define UDP_FRAGMENT_SIZE 4096
-
+#define UDP_FRAGMENT_SIZE 65535
 
 typedef enum {
         UDP_EOK,