Re: [PATCH] new UDPCP Communication Protocol

Eric Dumazet
2011-01-02T22:49:32Z

Le dimanche 02 janvier 2011 à 23:39 +0100, stefani@seibold.net a écrit :
> +
> +/*
> + * Create a new destination descriptor for the given IPV4 address and port
> + */
> +static struct udpcp_dest *new_dest(struct sock *sk, __be32 addr, __be16 port)
> +{
> + struct udpcp_dest *dest;
> + struct udpcp_sock *usk = udpcp_sk(sk);
> +
> + if (usk->connections >= udpcp_max_connections)
> + return NULL;
> +
> + dest = kzalloc(sizeof(*dest), sk->sk_allocation);
> +
> + if (dest) {
> + usk->connections++;
> + skb_queue_head_init(&dest->xmit);
> + dest->addr = addr;
> + dest->port = port;
> + dest->ackmode = UDPCP_ACK;
> + list_add_tail(&dest->list, &usk->destlist);
> + }
> +
> + return dest;
> +}
> +

Hmm, so 'connections' is increased, never decreased.

This seems a fatal flaw in this protocol, since a malicious user can
easily fill the list with garbage, and block regular communications.