use hierarchical defensive receiving strategy

readloop.go

@@ -18,12 +18,7 @@ func (s *UDPSession) defaultReadLoop() {
 				atomic.AddUint64(&DefaultSnmp.InErrs, 1)
 				continue
 			}
-
-			if n >= s.headerSize+IKCP_OVERHEAD {
-				s.packetInput(buf[:n])
-			} else {
-				atomic.AddUint64(&DefaultSnmp.InErrs, 1)
-			}
+			s.packetInput(buf[:n])
 		} else {
 			s.notifyReadError(errors.WithStack(err))
 			return
@@ -35,11 +30,7 @@ func (l *Listener) defaultMonitor() {
 	buf := make([]byte, mtuLimit)
 	for {
 		if n, from, err := l.conn.ReadFrom(buf); err == nil {
-			if n >= l.headerSize+IKCP_OVERHEAD {
-				l.packetInput(buf[:n], from)
-			} else {
-				atomic.AddUint64(&DefaultSnmp.InErrs, 1)
-			}
+			l.packetInput(buf[:n], from)
 		} else {
 			l.notifyReadError(errors.WithStack(err))
 			return

readloop_linux.go

@@ -39,11 +39,6 @@ func (s *UDPSession) readLoop() {
 					continue
 				}
 
-				if msg.N < s.headerSize+IKCP_OVERHEAD {
-					atomic.AddUint64(&DefaultSnmp.InErrs, 1)
-					continue
-				}
-
 				// source and size has validated
 				s.packetInput(msg.Buffers[0][:msg.N])
 			}
@@ -95,11 +90,7 @@ func (l *Listener) monitor() {
 		if count, err := xconn.ReadBatch(msgs, 0); err == nil {
 			for i := 0; i < count; i++ {
 				msg := &msgs[i]
-				if msg.N >= l.headerSize+IKCP_OVERHEAD {
-					l.packetInput(msg.Buffers[0][:msg.N], msg.Addr)
-				} else {
-					atomic.AddUint64(&DefaultSnmp.InErrs, 1)
-				}
+				l.packetInput(msg.Buffers[0][:msg.N], msg.Addr)
 			}
 		} else {
 			// compatibility issue:

sess.go

@@ -653,7 +653,7 @@ func (s *UDPSession) notifyWriteError(err error) {
 // packet input stage
 func (s *UDPSession) packetInput(data []byte) {
 	dataValid := false
-	if s.block != nil {
+	if s.block != nil && len(data) >= cryptHeaderSize {
 		s.block.Decrypt(data, data)
 		data = data[nonceSize:]
 		checksum := crc32.ChecksumIEEE(data[crcSize:])
@@ -667,7 +667,7 @@ func (s *UDPSession) packetInput(data []byte) {
 		dataValid = true
 	}
 
-	if dataValid {
+	if dataValid && len(data) >= IKCP_OVERHEAD {
 		s.kcpInput(data)
 	}
 }
@@ -677,7 +677,7 @@ func (s *UDPSession) kcpInput(data []byte) {
 
 	fecFlag := binary.LittleEndian.Uint16(data[4:])
 	if fecFlag == typeData || fecFlag == typeParity { // 16bit kcp cmd [81-84] and frg [0-255] will not overlap with FEC type 0x00f1 0x00f2
-		if len(data) > fecHeaderSize {
+		if len(data) >= fecHeaderSizePlus2 {
 			f := fecPacket(data)
 			if f.flag() == typeParity {
 				fecParityShards++
@@ -794,7 +794,7 @@ type (
 // packet input stage
 func (l *Listener) packetInput(data []byte, addr net.Addr) {
 	dataValid := false
-	if l.block != nil {
+	if l.block != nil && len(data) >= cryptHeaderSize {
 		l.block.Decrypt(data, data)
 		data = data[nonceSize:]
 		checksum := crc32.ChecksumIEEE(data[crcSize:])
@@ -808,7 +808,7 @@ func (l *Listener) packetInput(data []byte, addr net.Addr) {
 		dataValid = true
 	}
 
-	if dataValid {
+	if dataValid && len(data) >= IKCP_OVERHEAD {
 		l.sessionLock.Lock()
 		s, ok := l.sessions[addr.String()]
 		l.sessionLock.Unlock()

sess_test.go

@@ -34,7 +34,7 @@ func dialEcho(port int) (*UDPSession, error) {
 	//block, _ := NewTEABlockCrypt(pass[:16])
 	//block, _ := NewAESBlockCrypt(pass)
 	block, _ := NewSalsa20BlockCrypt(pass)
-	sess, err := DialWithOptions(fmt.Sprintf("127.0.0.1:%v", port), block, 10, 1)
+	sess, err := DialWithOptions(fmt.Sprintf("127.0.0.1:%v", port), block, 10, 0)
 	if err != nil {
 		panic(err)
 	}