Merge branch 'maint-0.2.4' into release-0.2.4
This commit is contained in:
commit
040d7cecf3
|
@ -0,0 +1,4 @@
|
||||||
|
o Minor bugfixes (hidden service):
|
||||||
|
- Fix an out-of-bounds read when parsing invalid INTRODUCE2 cells
|
||||||
|
on a client authorized hidden service. Fixes bug 15823; bugfix
|
||||||
|
on 0.2.1.6-alpha.
|
|
@ -0,0 +1,6 @@
|
||||||
|
o Major bugfixes (security, correctness):
|
||||||
|
- Fix a programming error that could cause us to read 4 bytes before
|
||||||
|
the beginning of an openssl string. This could be used to provoke
|
||||||
|
a crash on systems with an unusual malloc implementation, or
|
||||||
|
systems with unsual hardening installed. Fixes bug 17404; bugfix
|
||||||
|
on 0.2.3.6-alpha.
|
|
@ -0,0 +1,6 @@
|
||||||
|
o Minor fixes (security):
|
||||||
|
- Make memwipe() do nothing when passed a NULL pointer
|
||||||
|
or zero size. Check size argument to memwipe() for underflow.
|
||||||
|
Closes bug #18089. Reported by "gk", patch by "teor".
|
||||||
|
Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352),
|
||||||
|
commit 49dd5ef3 on 7 Nov 2012.
|
|
@ -2972,6 +2972,7 @@ secret_to_key(char *key_out, size_t key_out_len, const char *secret,
|
||||||
/**
|
/**
|
||||||
* Destroy the <b>sz</b> bytes of data stored at <b>mem</b>, setting them to
|
* Destroy the <b>sz</b> bytes of data stored at <b>mem</b>, setting them to
|
||||||
* the value <b>byte</b>.
|
* the value <b>byte</b>.
|
||||||
|
* If <b>mem</b> is NULL or <b>sz</b> is zero, nothing happens.
|
||||||
*
|
*
|
||||||
* This function is preferable to memset, since many compilers will happily
|
* This function is preferable to memset, since many compilers will happily
|
||||||
* optimize out memset() when they can convince themselves that the data being
|
* optimize out memset() when they can convince themselves that the data being
|
||||||
|
@ -2989,6 +2990,15 @@ secret_to_key(char *key_out, size_t key_out_len, const char *secret,
|
||||||
void
|
void
|
||||||
memwipe(void *mem, uint8_t byte, size_t sz)
|
memwipe(void *mem, uint8_t byte, size_t sz)
|
||||||
{
|
{
|
||||||
|
if (sz == 0) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
/* If sz is nonzero, then mem must not be NULL. */
|
||||||
|
tor_assert(mem != NULL);
|
||||||
|
|
||||||
|
/* Data this large is likely to be an underflow. */
|
||||||
|
tor_assert(sz < SIZE_T_CEILING);
|
||||||
|
|
||||||
/* Because whole-program-optimization exists, we may not be able to just
|
/* Because whole-program-optimization exists, we may not be able to just
|
||||||
* have this function call "memset". A smart compiler could inline it, then
|
* have this function call "memset". A smart compiler could inline it, then
|
||||||
* eliminate dead memsets, and declare itself to be clever. */
|
* eliminate dead memsets, and declare itself to be clever. */
|
||||||
|
|
|
@ -2676,6 +2676,10 @@ dn_indicates_v3_cert(X509_NAME *name)
|
||||||
len = ASN1_STRING_to_UTF8(&s, str);
|
len = ASN1_STRING_to_UTF8(&s, str);
|
||||||
if (len < 0)
|
if (len < 0)
|
||||||
return 0;
|
return 0;
|
||||||
|
if (len < 4) {
|
||||||
|
OPENSSL_free(s);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
r = fast_memneq(s + len - 4, ".net", 4);
|
r = fast_memneq(s + len - 4, ".net", 4);
|
||||||
OPENSSL_free(s);
|
OPENSSL_free(s);
|
||||||
return r;
|
return r;
|
||||||
|
|
|
@ -939,11 +939,13 @@ rend_service_requires_uptime(rend_service_t *service)
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
/** Check client authorization of a given <b>descriptor_cookie</b> for
|
/** Check client authorization of a given <b>descriptor_cookie</b> of
|
||||||
* <b>service</b>. Return 1 for success and 0 for failure. */
|
* length <b>cookie_len</b> for <b>service</b>. Return 1 for success
|
||||||
|
* and 0 for failure. */
|
||||||
static int
|
static int
|
||||||
rend_check_authorization(rend_service_t *service,
|
rend_check_authorization(rend_service_t *service,
|
||||||
const char *descriptor_cookie)
|
const char *descriptor_cookie,
|
||||||
|
size_t cookie_len)
|
||||||
{
|
{
|
||||||
rend_authorized_client_t *auth_client = NULL;
|
rend_authorized_client_t *auth_client = NULL;
|
||||||
tor_assert(service);
|
tor_assert(service);
|
||||||
|
@ -954,6 +956,13 @@ rend_check_authorization(rend_service_t *service,
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (cookie_len != REND_DESC_COOKIE_LEN) {
|
||||||
|
log_info(LD_REND, "Descriptor cookie is %lu bytes, but we expected "
|
||||||
|
"%lu bytes. Dropping cell.",
|
||||||
|
(unsigned long)cookie_len, (unsigned long)REND_DESC_COOKIE_LEN);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
/* Look up client authorization by descriptor cookie. */
|
/* Look up client authorization by descriptor cookie. */
|
||||||
SMARTLIST_FOREACH(service->clients, rend_authorized_client_t *, client, {
|
SMARTLIST_FOREACH(service->clients, rend_authorized_client_t *, client, {
|
||||||
if (tor_memeq(client->descriptor_cookie, descriptor_cookie,
|
if (tor_memeq(client->descriptor_cookie, descriptor_cookie,
|
||||||
|
@ -1300,7 +1309,8 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request,
|
||||||
if (service->clients) {
|
if (service->clients) {
|
||||||
if (parsed_req->version == 3 && parsed_req->u.v3.auth_len > 0) {
|
if (parsed_req->version == 3 && parsed_req->u.v3.auth_len > 0) {
|
||||||
if (rend_check_authorization(service,
|
if (rend_check_authorization(service,
|
||||||
(const char*)parsed_req->u.v3.auth_data)) {
|
(const char*)parsed_req->u.v3.auth_data,
|
||||||
|
parsed_req->u.v3.auth_len)) {
|
||||||
log_info(LD_REND, "Authorization data in INTRODUCE2 cell are valid.");
|
log_info(LD_REND, "Authorization data in INTRODUCE2 cell are valid.");
|
||||||
} else {
|
} else {
|
||||||
log_info(LD_REND, "The authorization data that are contained in "
|
log_info(LD_REND, "The authorization data that are contained in "
|
||||||
|
|
Loading…
Reference in New Issue