diff options
| author | Nick Mathewson <nickm@torproject.org> | 2012-10-16 12:55:50 -0400 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2012-10-17 19:18:16 -0400 |
| commit | f357ef9dccccfb5ce2408dbd5f8456de02bac895 (patch) | |
| tree | cfd709e594c28e4c4f73fd3bbb48ccd51b98f6c1 /src/or/command.c | |
| parent | e2549c3b745313d6647c7e1d05025a84e1d33873 (diff) | |
| download | tor-f357ef9dccccfb5ce2408dbd5f8456de02bac895.tar.gz tor-f357ef9dccccfb5ce2408dbd5f8456de02bac895.zip | |
Discard extraneous renegotiation attempts in the v3 link protocol
Failure to do so left us open to a remotely triggerable assertion
failure. Fixes CVE-2012-2249; bugfix on 0.2.3.6-alpha. Reported by
"some guy from France".
Diffstat (limited to 'src/or/command.c')
| -rw-r--r-- | src/or/command.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/or/command.c b/src/or/command.c index d8a409bc27..975af046cd 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -649,6 +649,7 @@ enter_v3_handshake_with_cell(var_cell_t *cell, or_connection_t *conn) "Received a cell while TLS-handshaking, not in " "OR_HANDSHAKING_V3, on a connection we originated."); } + connection_or_block_renegotiation(conn); conn->_base.state = OR_CONN_STATE_OR_HANDSHAKING_V3; if (connection_init_or_handshake_state(conn, started_here) < 0) { connection_mark_for_close(TO_CONN(conn)); |