albino
/
ngircd-tor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Don't read SSL client data before DNS resolver is finished 

Fix the cb_clientserver_ssl() callback function to not read in and store SSL
encrypted client data before the asynchronous DNS resolver sub-process has
finished: This could have resulted in discarding the resolved client hostname
and IDENT reply afterwards, because in some situations (timing dependent) the
NICK and USER commands could have already been read in from the client,
stored in the buffer, and been processed.

Thanks to Julian Brost for reporting the issue and testing, and to Federico
G. Schwindt <fgsch@lodoss.net> for helping to debug it!
This commit is contained in:
Alexander Barton 2013-03-09 17:44:34 +01:00
parent b33da9b8f3
commit b4393277ea
1 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/ngircd/conn.c
View File

@ -367,13 +367,13 @@ cb_clientserver(int sock, short what)
#ifdef SSL_SUPPORT
/**
* IO callback for established SSL-enabled client and server connections.
* IO callback for new SSL-enabled client and server connections.
*
* @param sock Socket descriptor.
* @param what IO specification (IO_WANTREAD/IO_WANTWRITE/...).
*/
static void
cb_clientserver_ssl(int sock, short what)
cb_clientserver_ssl(int sock, UNUSED short what)
{
CONN_ID idx = Socket2Index(sock);
@ -390,14 +390,11 @@ cb_clientserver_ssl(int sock, short what)
case 0:
return; /* EAGAIN: callback will be invoked again by IO layer */
default:
Conn_Close(idx, "SSL accept error, closing socket", "SSL accept error", false);
Conn_Close(idx,
"SSL accept error, closing socket", "SSL accept error",
false);
return;
}
if (what & IO_WANTREAD)
Read_Request(idx);
if (what & IO_WANTWRITE)
Handle_Write(idx);
io_event_setcb(sock, cb_clientserver); /* SSL handshake completed */
}