added sanity checks in commands exchanged from main with sec-mod

src/main-sec-mod-cmd.c

@@ -80,18 +80,19 @@ int handle_sec_mod_commands(main_server_st * s)
 	if (ret == -1) {
 		e = errno;
 		mslog(s, NULL, LOG_ERR,
-		      "cannot obtain metadata from command socket: %s",
+		      "cannot obtain metadata from sec-mod socket: %s",
 		      strerror(e));
 		return ERR_BAD_COMMAND;
 	}
 
 	if (ret == 0) {
-		mslog(s, NULL, LOG_DEBUG, "command socket closed");
+		mslog(s, NULL, LOG_ERR, "command socket for sec-mod closed");
 		return ERR_BAD_COMMAND;
 	}
 
-	if (ret < 3) {
-		mslog(s, NULL, LOG_ERR, "command error");
+	if (ret < 3 || cmd <= MIN_SM_MAIN_CMD || cmd >= MAX_SM_MAIN_CMD) {
+		mslog(s, NULL, LOG_ERR, "main received invalid message from sec-mod of %u bytes (cmd: %u)\n",
+		      (unsigned)length, (unsigned)cmd);
 		return ERR_BAD_COMMAND;
 	}
 
@@ -104,12 +105,12 @@ int handle_sec_mod_commands(main_server_st * s)
 		return ERR_MEM;
 	}
 
-	raw_len = force_read(s->sec_mod_fd, raw, length);
+	raw_len = force_read_timeout(s->sec_mod_fd, raw, length, MAIN_SEC_MOD_TIMEOUT);
 	if (raw_len != length) {
 		e = errno;
 		mslog(s, NULL, LOG_ERR,
-		      "cannot obtain data from command socket: %s",
-		      strerror(e));
+		      "cannot obtain data of cmd %u with length %u from sec-mod socket: %s",
+		      (unsigned)cmd, (unsigned)length, strerror(e));
 		ret = ERR_BAD_COMMAND;
 		goto cleanup;
 	}

src/sec-mod.c

@@ -412,12 +412,12 @@ int serve_request_main(sec_mod_st *sec, int cfd, uint8_t *buffer, unsigned buffe
 	void *pool = buffer;
 
 	/* read request */
-	ret = force_read(cfd, buffer, 3);
+	ret = force_read_timeout(cfd, buffer, 3, MAIN_SEC_MOD_TIMEOUT);
 	if (ret == 0)
 		goto leave;
 	else if (ret < 3) {
 		e = errno;
-		seclog(sec, LOG_INFO, "error receiving msg head: %s",
+		seclog(sec, LOG_ERR, "error receiving msg head: %s",
 		       strerror(e));
 		ret = ERR_BAD_COMMAND;
 		goto leave;
@@ -427,25 +427,31 @@ int serve_request_main(sec_mod_st *sec, int cfd, uint8_t *buffer, unsigned buffe
 	memcpy(&l16, &buffer[1], 2);
 	length = l16;
 
+	if (cmd <= MIN_SM_MAIN_CMD || cmd >= MAX_SM_MAIN_CMD) {
+		seclog(sec, LOG_ERR, "received invalid message from main of %u bytes (cmd: %u)\n",
+		      (unsigned)length, (unsigned)cmd);
+		return ERR_BAD_COMMAND;
+	}
+
 	if (length > buffer_size - 4) {
-		seclog(sec, LOG_INFO, "too big message (%d)", length);
+		seclog(sec, LOG_ERR, "received too big message (%d)", length);
 		ret = ERR_BAD_COMMAND;
 		goto leave;
 	}
 
 	/* read the body */
-	ret = force_read(cfd, buffer, length);
+	ret = force_read_timeout(cfd, buffer, length, MAIN_SEC_MOD_TIMEOUT);
 	if (ret < 0) {
 		e = errno;
-		seclog(sec, LOG_INFO, "error receiving msg body: %s",
-		       strerror(e));
+		seclog(sec, LOG_ERR, "error receiving msg body of cmd %u with length %u: %s",
+		       cmd, (unsigned)length, strerror(e));
 		ret = ERR_BAD_COMMAND;
 		goto leave;
 	}
 
 	ret = process_packet_from_main(pool, cfd, sec, cmd, buffer, ret);
 	if (ret < 0) {
-		seclog(sec, LOG_INFO, "error processing data for '%s' command (%d)", cmd_request_to_str(cmd), ret);
+		seclog(sec, LOG_ERR, "error processing data for '%s' command (%d)", cmd_request_to_str(cmd), ret);
 	}
 	
  leave:

src/vpn.h

@@ -70,6 +70,9 @@ typedef enum {
 #define MIN_NO_COMPRESS_LIMIT 64
 #define DEFAULT_NO_COMPRESS_LIMIT 256
 
+/* Timeout (secs) for communication between main and sec-mod */
+#define MAIN_SEC_MOD_TIMEOUT 20
+
 #define DEBUG_BASIC 1
 #define DEBUG_HTTP  4
 #define DEBUG_TRANSFERRED 5
@@ -163,12 +166,15 @@ typedef enum {
 	SM_CMD_CLI_STATS,
 
 	/* from main to sec-mod and vice versa */
-	SM_CMD_AUTH_SESSION_OPEN=240,
+	MIN_SM_MAIN_CMD=239,
+	SM_CMD_AUTH_SESSION_OPEN,
 	SM_CMD_AUTH_SESSION_CLOSE,
 	SM_CMD_AUTH_SESSION_REPLY,
 	SM_CMD_AUTH_BAN_IP,
 	SM_CMD_AUTH_BAN_IP_REPLY,
 	SM_CMD_AUTH_CLI_STATS,
+
+	MAX_SM_MAIN_CMD,
 } cmd_request_t;
 
 struct group_cfg_st {