From 322b6f7e65d1f923130bf2eed09fcc2af6bdcae7 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Thu, 2 Aug 2007 01:28:40 +0000 Subject: [PATCH] r13892@Kushana: nickm | 2007-08-01 18:27:13 -0700 Close immediately after anything but a successful authentication attempt on the control port. Backport candidate. svn:r11016 --- ChangeLog | 6 +++++- src/or/control.c | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 33ba642ec7..3653ff59df 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,8 @@ -Changes in version 0.2.0.4-alpha - 2007-??-?? +Changes in version 0.2.0.4-alpha - 2007-08-01 + o Major security fixes: + - Close immediately after missing authentication on control port; + do not allow multiple authentication attempts. + o Major bugfixes (compilation): - Fix win32 compilation: apparently IN_ADDR and IN6_ADDR are already defined there. diff --git a/src/or/control.c b/src/or/control.c index 94fd90fd77..2a95234b5c 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -971,6 +971,7 @@ handle_control_authenticate(control_connection_t *conn, uint32_t len, "551 Invalid hexadecimal encoding. Maybe you tried a plain text " "password? If so, the standard requires that you put it in " "double quotes.\r\n", conn); + connection_mark_for_close(TO_CONN(conn)); tor_free(password); return 0; } @@ -981,6 +982,7 @@ handle_control_authenticate(control_connection_t *conn, uint32_t len, if (!get_escaped_string(body, len, &password, &password_len)) { connection_write_str_to_buf("551 Invalid quoted string. You need " "to put the password in double quotes.\r\n", conn); + connection_mark_for_close(TO_CONN(conn)); return 0; } used_quoted_string = 1; @@ -1032,6 +1034,7 @@ handle_control_authenticate(control_connection_t *conn, uint32_t len, errstr = "Unknown reason."; connection_printf_to_buf(conn, "515 Authentication failed: %s\r\n", errstr); + connection_mark_for_close(TO_CONN(conn)); return 0; ok: log_info(LD_CONTROL, "Authenticated control connection (%d)", conn->_base.s); @@ -2439,6 +2442,7 @@ connection_control_process_inbuf(control_connection_t *conn) if (conn->_base.state == CONTROL_CONN_STATE_NEEDAUTH && strcasecmp(conn->incoming_cmd, "AUTHENTICATE")) { connection_write_str_to_buf("514 Authentication required.\r\n", conn); + connection_mark_for_close(TO_CONN(conn)); conn->incoming_cmd_cur_len = 0; goto again; }