From 7433eeb5c0adb20a349e0392f3261de153e6dcea Mon Sep 17 00:00:00 2001
From: zzz <zzz@mail.i2p>
Date: Wed, 7 Mar 2018 18:06:46 +0000
Subject: [PATCH] Router: Validate tunnel ID in requests Fix max ID

---
 core/java/src/net/i2p/data/TunnelId.java               |  2 +-
 .../src/net/i2p/router/tunnel/TunnelDispatcher.java    |  6 +++---
 .../src/net/i2p/router/tunnel/pool/BuildHandler.java   | 10 ++++++++++
 .../src/net/i2p/router/tunnel/pool/BuildRequestor.java |  2 +-
 .../test/junit/net/i2p/router/tunnel/FragmentTest.java |  2 +-
 5 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/core/java/src/net/i2p/data/TunnelId.java b/core/java/src/net/i2p/data/TunnelId.java
index 6c0609348..0d5de2e73 100644
--- a/core/java/src/net/i2p/data/TunnelId.java
+++ b/core/java/src/net/i2p/data/TunnelId.java
@@ -27,7 +27,7 @@ import java.io.OutputStream;
 public class TunnelId extends DataStructureImpl {
     private long _tunnelId;
     
-    public static final long MAX_ID_VALUE = (1L << 32) - 2L;
+    public static final long MAX_ID_VALUE = 0xffffffffL;
     
     public TunnelId() { 
         _tunnelId = -1;
diff --git a/router/java/src/net/i2p/router/tunnel/TunnelDispatcher.java b/router/java/src/net/i2p/router/tunnel/TunnelDispatcher.java
index 4e80c3657..fbd2bcd06 100644
--- a/router/java/src/net/i2p/router/tunnel/TunnelDispatcher.java
+++ b/router/java/src/net/i2p/router/tunnel/TunnelDispatcher.java
@@ -396,7 +396,7 @@ public class TunnelDispatcher implements Service {
         long rv;
         TunnelId tid;
         do {
-            rv = 1 + _context.random().nextLong(TunnelId.MAX_ID_VALUE - 1);
+            rv = 1 + _context.random().nextLong(TunnelId.MAX_ID_VALUE);
             tid = new TunnelId(rv);
         } while (_outboundGateways.containsKey(tid));
         return rv;
@@ -413,7 +413,7 @@ public class TunnelDispatcher implements Service {
         long rv;
         TunnelId tid;
         do {
-            rv = 1 + _context.random().nextLong(TunnelId.MAX_ID_VALUE - 1);
+            rv = 1 + _context.random().nextLong(TunnelId.MAX_ID_VALUE);
             tid = new TunnelId(rv);
         } while (_participants.containsKey(tid));
         return rv;
@@ -430,7 +430,7 @@ public class TunnelDispatcher implements Service {
         long rv;
         TunnelId tid;
         do {
-            rv = 1 + _context.random().nextLong(TunnelId.MAX_ID_VALUE - 1);
+            rv = 1 + _context.random().nextLong(TunnelId.MAX_ID_VALUE);
             tid = new TunnelId(rv);
         } while (_inboundGateways.containsKey(tid));
         return rv;
diff --git a/router/java/src/net/i2p/router/tunnel/pool/BuildHandler.java b/router/java/src/net/i2p/router/tunnel/pool/BuildHandler.java
index b70600586..cd38b64af 100644
--- a/router/java/src/net/i2p/router/tunnel/pool/BuildHandler.java
+++ b/router/java/src/net/i2p/router/tunnel/pool/BuildHandler.java
@@ -668,6 +668,16 @@ class BuildHandler implements Runnable {
             return;
         }
 
+        if (ourId <= 0 || ourId > TunnelId.MAX_ID_VALUE ||
+            nextId <= 0 || nextId > TunnelId.MAX_ID_VALUE) {
+            _context.statManager().addRateData("tunnel.rejectHostile", 1);
+            if (_log.shouldWarn())
+                _log.warn("Dropping build request, bad tunnel ID: " + req);
+            if (from != null)
+                _context.commSystem().mayDisconnect(from);
+            return;
+        }
+
         // Loop checks
         if ((!isOutEnd) && _context.routerHash().equals(nextPeer)) {
             _context.statManager().addRateData("tunnel.rejectHostile", 1);
diff --git a/router/java/src/net/i2p/router/tunnel/pool/BuildRequestor.java b/router/java/src/net/i2p/router/tunnel/pool/BuildRequestor.java
index f9eaad307..0856c5dc2 100644
--- a/router/java/src/net/i2p/router/tunnel/pool/BuildRequestor.java
+++ b/router/java/src/net/i2p/router/tunnel/pool/BuildRequestor.java
@@ -95,7 +95,7 @@ abstract class BuildRequestor {
                 else if (isIB && i == len - 1)
                     id = ctx.tunnelDispatcher().getNewIBEPID();
                 else
-                    id = 1 + ctx.random().nextLong(TunnelId.MAX_ID_VALUE - 1);
+                    id = 1 + ctx.random().nextLong(TunnelId.MAX_ID_VALUE);
                 cfg.getConfig(i).setReceiveTunnelId(DataHelper.toLong(4, id));
             }
             
diff --git a/router/java/test/junit/net/i2p/router/tunnel/FragmentTest.java b/router/java/test/junit/net/i2p/router/tunnel/FragmentTest.java
index ac6b96107..4722bcecb 100644
--- a/router/java/test/junit/net/i2p/router/tunnel/FragmentTest.java
+++ b/router/java/test/junit/net/i2p/router/tunnel/FragmentTest.java
@@ -161,7 +161,7 @@ public class FragmentTest {
             _context.random().nextBytes(toRouter.getData());
         }
         if (includeTunnel)
-            toTunnel = new TunnelId(_context.random().nextLong(TunnelId.MAX_ID_VALUE));
+            toTunnel = new TunnelId(1 + _context.random().nextLong(TunnelId.MAX_ID_VALUE));
         return new PendingGatewayMessage(m, toRouter, toTunnel);
     }