Prevent oracle attacks in the legacy protocol (CVE-2018-16737, CVE-2018-16738)

[tinc] / src / connection.c

diff --git a/src/connection.c b/src/connection.c
index d39f43f..1c638a4 100644 (file)
--- a/src/connection.c
+++ b/src/connection.c
@@ -1,6 +1,6 @@
 /*
     connection.c -- connection list management
-    Copyright (C) 2000-2012 Guus Sliepen <guus@tinc-vpn.org>,
+    Copyright (C) 2000-2013 Guus Sliepen <guus@tinc-vpn.org>,
                   2000-2005 Ivo Timmermans
                   2008      Max Rijevski <maksuf@gmail.com>
 
@@ -27,6 +27,8 @@
 #include "control_common.h"
 #include "list.h"
 #include "logger.h"
+#include "net.h"
+#include "rsa.h"
 #include "subnet.h"
 #include "utils.h"
 #include "xalloc.h"
@@ -47,41 +49,47 @@ void exit_connections(void) {
 }
 
 connection_t *new_connection(void) {
-       return xmalloc_and_zero(sizeof(connection_t));
+       return xzalloc(sizeof(connection_t));
 }
 
 void free_connection(connection_t *c) {
-       if(!c)
+       if(!c) {
                return;
+       }
 
-       cipher_close(&c->incipher);
-       digest_close(&c->indigest);
-       cipher_close(&c->outcipher);
-       digest_close(&c->outdigest);
+#ifndef DISABLE_LEGACY
+       cipher_close(c->incipher);
+       digest_close(c->indigest);
+       cipher_close(c->outcipher);
+       digest_close(c->outdigest);
+       rsa_free(c->rsa);
+#endif
 
        sptps_stop(&c->sptps);
-       ecdsa_free(&c->ecdsa);
-       rsa_free(&c->rsa);
+       ecdsa_free(c->ecdsa);
 
        free(c->hischallenge);
+       free(c->mychallenge);
 
        buffer_clear(&c->inbuf);
        buffer_clear(&c->outbuf);
 
-       if(event_initialized(&c->inevent))
-               event_del(&c->inevent);
-
-       if(event_initialized(&c->outevent))
-               event_del(&c->outevent);
+       io_del(&c->io);
 
-       if(c->socket > 0)
-               closesocket(c->socket);
+       if(c->socket > 0) {
+               if(c->status.tarpit) {
+                       tarpit(c->socket);
+               } else {
+                       closesocket(c->socket);
+               }
+       }
 
        free(c->name);
        free(c->hostname);
 
-       if(c->config_tree)
+       if(c->config_tree) {
                exit_configuration(&c->config_tree);
+       }
 
        free(c);
 }
@@ -97,9 +105,9 @@ void connection_del(connection_t *c) {
 bool dump_connections(connection_t *cdump) {
        for list_each(connection_t, c, connection_list) {
                send_request(cdump, "%d %d %s %s %x %d %x",
-                               CONTROL, REQ_DUMP_CONNECTIONS,
-                               c->name, c->hostname, c->options, c->socket,
-                               bitfield_to_int(&c->status, sizeof c->status));
+                            CONTROL, REQ_DUMP_CONNECTIONS,
+                            c->name, c->hostname, c->options, c->socket,
+                            bitfield_to_int(&c->status, sizeof(c->status)));
        }
 
        return send_request(cdump, "%d %d", CONTROL, REQ_DUMP_CONNECTIONS);