Merge branch 'link_negotiation_assert_023' into release-0.2.3

2 files changed, 15 insertions, 0 deletions

diff --git a/changes/link_negotiation_assert b/changes/link_negotiation_assert
new file mode 100644
index 0000000000..398a545573
--- /dev/null
+++ b/changes/link_negotiation_assert
@@ -0,0 +1,6 @@
+  o Major bugfixs (security):
+    - Fix a group of remotely triggerable assertion failures related to
+      incorrect link protocol negotiation. Found, diagnosed, and fixed
+      by "some guy from France." Fix for CVE-2012-2250; bugfix on
+      0.2.3.6-alpha.
+
diff --git a/src/or/command.c b/src/or/command.c
index 975af046cd..d935b5b18d 100644
--- a/src/or/command.c
+++ b/src/or/command.c
@@ -719,6 +719,15 @@ command_process_versions_cell(var_cell_t *cell, or_connection_t *conn)
            "handshake. Closing connection.");
     connection_mark_for_close(TO_CONN(conn));
     return;
+  } else if (highest_supported_version != 2 &&
+             conn->_base.state == OR_CONN_STATE_OR_HANDSHAKING_V2) {
+    /* XXXX This should eventually be a log_protocol_warn */
+    log_fn(LOG_WARN, LD_OR,
+           "Negotiated link with non-2 protocol after doing a v2 TLS "
+           "handshake with %s. Closing connection.",
+           fmt_addr(&conn->_base.addr));
+    connection_mark_for_close(TO_CONN(conn));
+    return;
   }
 
   conn->link_proto = highest_supported_version;