[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #17443 [Tor]: tor-gencert --passphrase-fd improperly checks for newline
#17443: tor-gencert --passphrase-fd improperly checks for newline
------------------------+------------------------------------
Reporter: junglefowl | Owner: nickm
Type: defect | Status: needs_review
Priority: Medium | Milestone: Tor: 0.2.8.x-final
Component: Tor | Version: Tor: 0.2.7.4-rc
Severity: Normal | Resolution:
Keywords: crash | Actual Points:
Parent ID: | Points:
Sponsor: |
------------------------+------------------------------------
Comment (by cypherpunks):
Replying to [comment:8 nickm]:
> Initializing the buffer to zero.
This could be simplified to `char buf[1024] = {0};`.
>
> >What about the argument against limiting the passphrase as made in
comment 2 or is that for another ticket?
>
> A few observations there:
> * Changing the semantics of tor-gencert could make existing scripts
start acting differently.
Makes sense, reading until EOF is good enough and shouldn't break
anything.
> * The current semantics were meant for approximate compatibility with
the semantics of the case where passphrase-fd wasn't given.
A custom password callback function can be passed to the OpenSSL functions
which could be reused for the passphrase-fd case. This would guarantee
equal semantics. Maybe for another ticket?
> * Nobody runs tor-gencert on windows; it's only for authorities.
Wouldn't it therefore be important to have some test coverage on this
tool?
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/17443#comment:11>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs