diff options
| author | Nick Mathewson <nickm@torproject.org> | 2012-10-16 13:41:55 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2012-10-17 19:19:58 -0400 |
| commit | 3d8b73db553712b2bea4fc74b8f478f1b1b39aee (patch) | |
| tree | 15a9329801d89f8fb0a3eb1bd1d494ce98ec4241 /src/or/channeltls.c | |
| parent | 94a030990986e6c731141da3969aeae3ec0f5ea8 (diff) | |
| download | tor-3d8b73db553712b2bea4fc74b8f478f1b1b39aee.tar.gz tor-3d8b73db553712b2bea4fc74b8f478f1b1b39aee.zip | |
Discard extraneous renegotiation attempts in the v3 link protocol
Failure to do so left us open to a remotely triggerable assertion
failure. Fixes CVE-2012-2249; bugfix on 0.2.3.6-alpha. Reported by
"some guy from France".
This patch is a forward-port to 0.2.4, to work with the new channel
logic.
Diffstat (limited to 'src/or/channeltls.c')
| -rw-r--r-- | src/or/channeltls.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/or/channeltls.c b/src/or/channeltls.c index 234aa3111d..4470e92b79 100644 --- a/src/or/channeltls.c +++ b/src/or/channeltls.c @@ -1130,6 +1130,7 @@ enter_v3_handshake_with_cell(var_cell_t *cell, channel_tls_t *chan) "Received a cell while TLS-handshaking, not in " "OR_HANDSHAKING_V3, on a connection we originated."); } + connection_or_block_renegotiation(chan->conn); chan->conn->base_.state = OR_CONN_STATE_OR_HANDSHAKING_V3; if (connection_init_or_handshake_state(chan->conn, started_here) < 0) { connection_or_close_for_error(chan->conn, 0); |