Prevent oracle attacks in the legacy protocol (CVE-2018-16737, CVE-2018-16738)

[tinc] / src / connection.c

diff --git a/src/connection.c b/src/connection.c
index 5fcecbd..1c638a4 100644 (file)
--- a/src/connection.c
+++ b/src/connection.c
@@ -27,6 +27,7 @@
 #include "control_common.h"
 #include "list.h"
 #include "logger.h"
+#include "net.h"
 #include "rsa.h"
 #include "subnet.h"
 #include "utils.h"
@@ -52,8 +53,9 @@ connection_t *new_connection(void) {
 }
 
 void free_connection(connection_t *c) {
-       if(!c)
+       if(!c) {
                return;
+       }
 
 #ifndef DISABLE_LEGACY
        cipher_close(c->incipher);
@@ -67,20 +69,27 @@ void free_connection(connection_t *c) {
        ecdsa_free(c->ecdsa);
 
        free(c->hischallenge);
+       free(c->mychallenge);
 
        buffer_clear(&c->inbuf);
        buffer_clear(&c->outbuf);
 
        io_del(&c->io);
 
-       if(c->socket > 0)
-               closesocket(c->socket);
+       if(c->socket > 0) {
+               if(c->status.tarpit) {
+                       tarpit(c->socket);
+               } else {
+                       closesocket(c->socket);
+               }
+       }
 
        free(c->name);
        free(c->hostname);
 
-       if(c->config_tree)
+       if(c->config_tree) {
                exit_configuration(&c->config_tree);
+       }
 
        free(c);
 }
@@ -96,9 +105,9 @@ void connection_del(connection_t *c) {
 bool dump_connections(connection_t *cdump) {
        for list_each(connection_t, c, connection_list) {
                send_request(cdump, "%d %d %s %s %x %d %x",
-                               CONTROL, REQ_DUMP_CONNECTIONS,
-                               c->name, c->hostname, c->options, c->socket,
-                               bitfield_to_int(&c->status, sizeof(c->status)));
+                            CONTROL, REQ_DUMP_CONNECTIONS,
+                            c->name, c->hostname, c->options, c->socket,
+                            bitfield_to_int(&c->status, sizeof(c->status)));
        }
 
        return send_request(cdump, "%d %d", CONTROL, REQ_DUMP_CONNECTIONS);