From c50098ffc546bc0875daf9139bea64d09ad49fc0 Mon Sep 17 00:00:00 2001 From: Andrew Lewman Date: Mon, 8 Jun 2009 10:27:10 -0400 Subject: [PATCH 1/2] update requirements to openssl 0.9.7 --- tor.spec.in | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tor.spec.in b/tor.spec.in index ec00415f48..54b9be092a 100644 --- a/tor.spec.in +++ b/tor.spec.in @@ -72,7 +72,7 @@ %endif %if %{is_rfl} -%define ostag redflag%(sed -e 's/^.*Desktop /redflag/' -e 's/ .*$//' -e 's/\\./_/g' < /etc/redflag-release) +%define ostag %(sed -e 's/^.*Desktop /redflag/' -e 's/ .*$//' -e 's/\\./_/g' < /etc/redflag-release) %endif # Using the build date ensures that every build really does get @@ -119,11 +119,11 @@ Vendor: The Tor Project (https://torproject.org) Packager: Andrew Lewman %if %{is_suse} -Requires: openssl >= 0.9.6 -BuildRequires: openssl-devel >= 0.9.6, rpm >= 4.0, zlib-devel +Requires: openssl >= 0.9.7 +BuildRequires: openssl-devel >= 0.9.7, rpm >= 4.0, zlib-devel %else -Requires: openssl >= 0.9.6, libevent >= 1.1 -BuildRequires: openssl-devel >= 0.9.6, libevent-devel >= 1.1 +Requires: openssl >= 0.9.7 +BuildRequires: openssl-devel >= 0.9.7 %endif %if %{is_fc} BuildRequires: rpm-build >= 4.0 From 845326317d9c468012ac99fab6e78575a807ed4f Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Fri, 12 Jun 2009 11:18:02 -0400 Subject: [PATCH 2/2] Check answer_len in the remap_addr case of process_relay_cell_not_open. Fix an edge case where a malicious exit relay could convince a controller that the client's DNS question resolves to an internal IP address. Bug found and fixed by "optimist"; bugfix on 0.1.2.8-beta. --- ChangeLog | 5 +++++ src/or/relay.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 527adc9543..bce2aa39d9 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,9 @@ Changes in version 0.2.1.16-?? - 2009-??-?? + o Security fixes: + - Fix an edge case where a malicious exit relay could convince a + controller that the client's DNS question resolves to an internal IP + address. Bug found and fixed by "optimist"; bugfix on 0.1.2.8-beta. + o Major performance improvements (on 0.2.0.x): - Disable and refactor some debugging checks that forced a linear scan over the whole server-side DNS cache. These accounted for over 50% diff --git a/src/or/relay.c b/src/or/relay.c index 85cd8f6c82..9657a82956 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -947,7 +947,7 @@ connection_edge_process_relay_cell_not_open( cell->payload+RELAY_HEADER_SIZE+2, /*answer*/ ttl, -1); - if (answer_type == RESOLVED_TYPE_IPV4) { + if (answer_type == RESOLVED_TYPE_IPV4 && answer_len >= 4) { uint32_t addr = ntohl(get_uint32(cell->payload+RELAY_HEADER_SIZE+2)); remap_event_helper(conn, addr); }