Commit f88ac647 authored by Mike Perry's avatar Mike Perry
Browse files

Bug 13028: Prevent potential proxy bypass cases. 

It looks like these cases should only be invoked in the NSS command line
tools, and not the browser, but I decided to patch them anyway because there
literally is a maze of network function pointers being passed around, and it's
very hard to tell if some random code might not pass in the proper proxied
versions of the networking code here by accident.
parent 0900069b

security/nss/lib/certhigh/ocsp.c

+8 −0
Original line number Diff line number Diff line
@@ -2933,6 +2933,14 @@ ocsp_ConnectToHost(const char *host, PRUint16 port) 
    PRNetAddr addr;

    char *netdbbuf = NULL;



    // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but

    // we want to ensure nothing can ever hit this code in production.

#if 1

    printf("Tor Browser BUG: Attempted OSCP direct connect to %s, port %u\n", host,

            port);

    goto loser;

#endif



    sock = PR_NewTCPSocket();

    if (sock == NULL)

	goto loser;

security/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_socket.c

+21 −0
Original line number Diff line number Diff line
@@ -1329,6 +1329,13 @@ pkix_pl_Socket_Create( 
                    plContext),

                    PKIX_COULDNOTCREATESOCKETOBJECT);



        // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but

        // we want to ensure nothing can ever hit this code in production.

#if 1

        printf("Tor Browser BUG: Attempted pkix direct socket connect\n");

        PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED);

#endif



        socket->isServer = isServer;

        socket->timeout = timeout;

        socket->clientSock = NULL;
@@ -1428,6 +1435,13 @@ pkix_pl_Socket_CreateByName( 


        localCopyName = PL_strdup(serverName);



        // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but

        // we want to ensure nothing can ever hit this code in production.

#if 1

        printf("Tor Browser BUG: Attempted pkix direct connect to %s\n", serverName);

        PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED);

#endif



        sepPtr = strchr(localCopyName, ':');

        /* First strip off the portnum, if present, from the end of the name */

        if (sepPtr) {
@@ -1577,6 +1591,13 @@ pkix_pl_Socket_CreateByHostAndPort( 
        PKIX_ENTER(SOCKET, "pkix_pl_Socket_CreateByHostAndPort");

        PKIX_NULLCHECK_THREE(hostname, pStatus, pSocket);



        // XXX: Do we need a unittest ifdef here? We don't want to break the tests, but

        // we want to ensure nothing can ever hit this code in production.

#if 1

        printf("Tor Browser BUG: Attempted pkix direct connect to %s, port %u\n", hostname,

                portnum);

        PKIX_ERROR(PKIX_PRNEWTCPSOCKETFAILED);

#endif



        prstatus = PR_GetHostByName(hostname, buf, sizeof(buf), &hostent);