Prevent oracle attacks in the legacy protocol (CVE-2018-16737, CVE-2018-16738)

[tinc] / src / tincctl.c

diff --git a/src/tincctl.c b/src/tincctl.c
index af54aef..7244779 100644 (file)
--- a/src/tincctl.c
+++ b/src/tincctl.c
@@ -902,6 +902,8 @@ bool connect_tincd(bool verbose) {
        setsockopt(fd, SOL_SOCKET, SO_NOSIGPIPE, (void *)&one, sizeof(one));
 #endif
 
+       sendline(fd, "%d ^%s %d", ID, controlcookie, TINC_CTL_VERSION_CURRENT);
+
        char data[4096];
        int version;
 
@@ -915,8 +917,6 @@ bool connect_tincd(bool verbose) {
                return false;
        }
 
-       sendline(fd, "%d ^%s %d", ID, controlcookie, TINC_CTL_VERSION_CURRENT);
-
        if(!recvline(fd, line, sizeof(line)) || sscanf(line, "%d %d %d", &code, &version, &pid) != 3 || code != 4 || version != TINC_CTL_VERSION_CURRENT) {
                if(verbose) {
                        fprintf(stderr, "Could not fully establish control socket connection\n");
@@ -1298,12 +1298,12 @@ static int cmd_dump(int argc, char *argv[]) {
                unsigned int options, status_int;
                node_status_t status;
                long int last_state_change;
-               long int udp_ping_rtt;
+               int udp_ping_rtt;
                uint64_t in_packets, in_bytes, out_packets, out_bytes;
 
                switch(req) {
                case REQ_DUMP_NODES: {
-                       int n = sscanf(line, "%*d %*d %4095s %4095s %4095s port %4095s %d %d %d %d %x %x %4095s %4095s %d %hd %hd %hd %ld %ld %lu %lu %lu %lu", node, id, host, port, &cipher, &digest, &maclength, &compression, &options, &status_int, nexthop, via, &distance, &pmtu, &minmtu, &maxmtu, &last_state_change, &udp_ping_rtt, &in_packets, &in_bytes, &out_packets, &out_bytes);
+                       int n = sscanf(line, "%*d %*d %4095s %4095s %4095s port %4095s %d %d %d %d %x %x %4095s %4095s %d %hd %hd %hd %ld %d %"PRIu64" %"PRIu64" %"PRIu64" %"PRIu64, node, id, host, port, &cipher, &digest, &maclength, &compression, &options, &status_int, nexthop, via, &distance, &pmtu, &minmtu, &maxmtu, &last_state_change, &udp_ping_rtt, &in_packets, &in_bytes, &out_packets, &out_bytes);
 
                        if(n != 22) {
                                fprintf(stderr, "Unable to parse node dump from tincd: %s\n", line);
@@ -1333,10 +1333,13 @@ static int cmd_dump(int argc, char *argv[]) {
                                        continue;
                                }
 
-                               printf("%s id %s at %s port %s cipher %d digest %d maclength %d compression %d options %x status %04x nexthop %s via %s distance %d pmtu %d (min %d max %d) rx %lu %lu tx %lu %lu",
+                               printf("%s id %s at %s port %s cipher %d digest %d maclength %d compression %d options %x status %04x nexthop %s via %s distance %d pmtu %d (min %d max %d) rx %"PRIu64" %"PRIu64" tx %"PRIu64" %"PRIu64,
                                       node, id, host, port, cipher, digest, maclength, compression, options, status_int, nexthop, via, distance, pmtu, minmtu, maxmtu, in_packets, in_bytes, out_packets, out_bytes);
-                               if (udp_ping_rtt != -1)
-                                       printf(" rtt %ld.%03ld", udp_ping_rtt/1000, udp_ping_rtt%1000);
+
+                               if(udp_ping_rtt != -1) {
+                                       printf(" rtt %d.%03d", udp_ping_rtt / 1000, udp_ping_rtt % 1000);
+                               }
+
                                printf("\n");
                        }
                }