1 files changed, 85 insertions, 57 deletions

diff --git a/src/gnsrecord/gnsrecord_crypto.c b/src/gnsrecord/gnsrecord_crypto.c
index cebc842f3..295d31100 100644
--- a/src/gnsrecord/gnsrecord_crypto.c
+++ b/src/gnsrecord/gnsrecord_crypto.c
@@ -1,21 +1,19 @@
 /*
      This file is part of GNUnet.
-     Copyright (C) 2009-2013 GNUnet e.V.
+     Copyright (C) 2009-2013, 2018 GNUnet e.V.
 
-     GNUnet is free software; you can redistribute it and/or modify
-     it under the terms of the GNU General Public License as published
-     by the Free Software Foundation; either version 3, or (at your
-     option) any later version.
+     GNUnet is free software: you can redistribute it and/or modify it
+     under the terms of the GNU Affero General Public License as published
+     by the Free Software Foundation, either version 3 of the License,
+     or (at your option) any later version.
 
      GNUnet is distributed in the hope that it will be useful, but
      WITHOUT ANY WARRANTY; without even the implied warranty of
      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-     General Public License for more details.
-
-     You should have received a copy of the GNU General Public License
-     along with GNUnet; see the file COPYING.  If not, write to the
-     Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-     Boston, MA 02110-1301, USA.
+     Affero General Public License for more details.
+    
+     You should have received a copy of the GNU Affero General Public License
+     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
 /**
@@ -87,19 +85,26 @@ block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
               const struct GNUNET_GNSRECORD_Data *rd,
               unsigned int rd_count)
 {
-  size_t payload_len = GNUNET_GNSRECORD_records_get_size (rd_count,
-                                                          rd);
-  char payload[sizeof (uint32_t) + payload_len];
+  ssize_t payload_len = GNUNET_GNSRECORD_records_get_size (rd_count,
+                                                           rd);
   struct GNUNET_GNSRECORD_Block *block;
   struct GNUNET_CRYPTO_EcdsaPrivateKey *dkey;
   struct GNUNET_CRYPTO_SymmetricInitializationVector iv;
   struct GNUNET_CRYPTO_SymmetricSessionKey skey;
-  struct GNUNET_GNSRECORD_Data rdc[rd_count];
+  struct GNUNET_GNSRECORD_Data rdc[GNUNET_NZL(rd_count)];
   uint32_t rd_count_nbo;
   struct GNUNET_TIME_Absolute now;
 
+  if (payload_len < 0)
+  {
+    GNUNET_break (0);
+    return NULL;
+  }
   if (payload_len > GNUNET_GNSRECORD_MAX_BLOCK_SIZE)
+  {
+    GNUNET_break (0);
     return NULL;
+  }
   /* convert relative to absolute times */
   now = GNUNET_TIME_absolute_get ();
   for (unsigned int i=0;i<rd_count;i++)
@@ -117,39 +122,43 @@ block_create (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
   }
   /* serialize */
   rd_count_nbo = htonl (rd_count);
-  GNUNET_memcpy (payload,
-                 &rd_count_nbo,
-                 sizeof (uint32_t));
-  GNUNET_assert (payload_len ==
-                 GNUNET_GNSRECORD_records_serialize (rd_count,
-                                                     rdc,
-                                                     payload_len,
-                                                     &payload[sizeof (uint32_t)]));
-  block = GNUNET_malloc (sizeof (struct GNUNET_GNSRECORD_Block) +
-                         sizeof (uint32_t) +
-                         payload_len);
-  block->purpose.size = htonl (sizeof (uint32_t) +
-                               payload_len +
-                               sizeof (struct GNUNET_CRYPTO_EccSignaturePurpose) +
-                               sizeof (struct GNUNET_TIME_AbsoluteNBO));
-  block->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
-  block->expiration_time = GNUNET_TIME_absolute_hton (expire);
-  /* encrypt and sign */
-  dkey = GNUNET_CRYPTO_ecdsa_private_key_derive (key,
-                                                 label,
-                                                 "gns");
-  GNUNET_CRYPTO_ecdsa_key_get_public (dkey,
-                                      &block->derived_key);
-  derive_block_aes_key (&iv,
-                        &skey,
-                        label,
-                        pkey);
-  GNUNET_break (payload_len + sizeof (uint32_t) ==
-                GNUNET_CRYPTO_symmetric_encrypt (payload,
-                                                 payload_len + sizeof (uint32_t),
-                                                 &skey,
-                                                 &iv,
-                                                 &block[1]));
+  {
+    char payload[sizeof (uint32_t) + payload_len];
+
+    GNUNET_memcpy (payload,
+                   &rd_count_nbo,
+                   sizeof (uint32_t));
+    GNUNET_assert (payload_len ==
+                   GNUNET_GNSRECORD_records_serialize (rd_count,
+                                                       rdc,
+                                                       payload_len,
+                                                       &payload[sizeof (uint32_t)]));
+    block = GNUNET_malloc (sizeof (struct GNUNET_GNSRECORD_Block) +
+                           sizeof (uint32_t) +
+                           payload_len);
+    block->purpose.size = htonl (sizeof (uint32_t) +
+                                 payload_len +
+                                 sizeof (struct GNUNET_CRYPTO_EccSignaturePurpose) +
+                                 sizeof (struct GNUNET_TIME_AbsoluteNBO));
+    block->purpose.purpose = htonl (GNUNET_SIGNATURE_PURPOSE_GNS_RECORD_SIGN);
+    block->expiration_time = GNUNET_TIME_absolute_hton (expire);
+    /* encrypt and sign */
+    dkey = GNUNET_CRYPTO_ecdsa_private_key_derive (key,
+                                                   label,
+                                                   "gns");
+    GNUNET_CRYPTO_ecdsa_key_get_public (dkey,
+                                        &block->derived_key);
+    derive_block_aes_key (&iv,
+                          &skey,
+                          label,
+                          pkey);
+    GNUNET_break (payload_len + sizeof (uint32_t) ==
+                  GNUNET_CRYPTO_symmetric_encrypt (payload,
+                                                   payload_len + sizeof (uint32_t),
+                                                   &skey,
+                                                   &iv,
+                                                   &block[1]));
+  }
   if (GNUNET_OK !=
       GNUNET_CRYPTO_ecdsa_sign (dkey,
                                 &block->purpose,
@@ -246,6 +255,7 @@ GNUNET_GNSRECORD_block_create2 (const struct GNUNET_CRYPTO_EcdsaPrivateKey *key,
     GNUNET_CRYPTO_ecdsa_key_get_public (key,
                                         &line->pkey);
   }
+#undef CSIZE
   return block_create (key,
                        &line->pkey,
                        expire,
@@ -304,18 +314,21 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
     GNUNET_break_op (0);
     return GNUNET_SYSERR;
   }
-  derive_block_aes_key (&iv, &skey, label, zone_key);
+  derive_block_aes_key (&iv,
+                        &skey,
+                        label,
+                        zone_key);
   {
     char payload[payload_len];
     uint32_t rd_count;
 
     GNUNET_break (payload_len ==
                   GNUNET_CRYPTO_symmetric_decrypt (&block[1], payload_len,
-                                             &skey, &iv,
-                                             payload));
+                                                   &skey, &iv,
+                                                   payload));
     GNUNET_memcpy (&rd_count,
-            payload,
-            sizeof (uint32_t));
+                   payload,
+                   sizeof (uint32_t));
     rd_count = ntohl (rd_count);
     if (rd_count > 2048)
     {
@@ -324,7 +337,7 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
       return GNUNET_SYSERR;
     }
     {
-      struct GNUNET_GNSRECORD_Data rd[rd_count];
+      struct GNUNET_GNSRECORD_Data rd[GNUNET_NZL(rd_count)];
       unsigned int j;
       struct GNUNET_TIME_Absolute now;
 
@@ -359,10 +372,15 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
               continue;
             if (rd[i].expiration_time < now.abs_value_us)
               include_record = GNUNET_NO; /* Shadow record is expired */
-            if ((rd[k].record_type == rd[i].record_type)
-                && (rd[k].expiration_time >= now.abs_value_us)
-                && (0 == (rd[k].flags & GNUNET_GNSRECORD_RF_SHADOW_RECORD)))
+            if ( (rd[k].record_type == rd[i].record_type) &&
+                 (rd[k].expiration_time >= now.abs_value_us) &&
+                 (0 == (rd[k].flags & GNUNET_GNSRECORD_RF_SHADOW_RECORD)) )
+            {
               include_record = GNUNET_NO; /* We have a non-expired, non-shadow record of the same type */
+              GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                          "Ignoring shadow record\n");
+              break;
+            }
           }
           if (GNUNET_YES == include_record)
           {
@@ -379,6 +397,16 @@ GNUNET_GNSRECORD_block_decrypt (const struct GNUNET_GNSRECORD_Block *block,
             rd[j] = rd[i];
           j++;
         }
+        else
+        {
+          struct GNUNET_TIME_Absolute at;
+
+          at.abs_value_us = rd[i].expiration_time;
+          GNUNET_log (GNUNET_ERROR_TYPE_INFO,
+                      "Excluding record that expired %s (%llu ago)\n",
+                      GNUNET_STRINGS_absolute_time_to_string (at),
+                      (unsigned long long) rd[i].expiration_time - now.abs_value_us);
+        }
       }
       rd_count = j;
       if (NULL != proc)