Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Verify DST.ADDR of "presets/ss-base" #47

Closed
micooz opened this issue Apr 10, 2017 · 0 comments
Closed

Verify DST.ADDR of "presets/ss-base" #47

micooz opened this issue Apr 10, 2017 · 0 comments
Milestone

Comments

@micooz
Copy link
Member

micooz commented Apr 10, 2017

+------+----------+----------+----------+
| ATYP | DST.ADDR | DST.PORT |   DATA   |
+------+----------+----------+----------+
|  1   | Variable |    2     | Variable |
+------+----------+----------+----------+

When use stream ciphers, original implementation lack of verification on DST.ADDR.

Only check ATYP(is one of [0x01, 0x03, 0x04]) can be lose integrity and become easy to sniff.

We can simply check if DST.ADDR is valid or not to avoid attacking to ATYP:

/**
 * verify hostname
 *
 * @param hostname
 * @returns {boolean}
 *
 * @reference
 *   http://stackoverflow.com/questions/1755144/how-to-validate-domain-name-in-php
 */
function isValidHostname(hostname) {
  // overall length check
  if (hostname.length < 1 || hostname.length > 253) {
    return false;
  }
  // valid chars check
  if (/^([a-z\d](-*[a-z\d])*)(\.([a-z\d](-*[a-z\d])*))*$/i.test(hostname) === false) {
    return false;
  }
  // length of each label
  if (/^[^.]{1,63}(\.[^.]{1,63})*$/.test(hostname) === false) {
    return false;
  }
  return true;
}
@micooz micooz added this to the v2.4.0 milestone Apr 10, 2017
@micooz micooz changed the title Enhancement: verify DST.ADDR of origin preset Enhancement: verify DST.ADDR of "presets/ss-base" Apr 14, 2017
@micooz micooz changed the title Enhancement: verify DST.ADDR of "presets/ss-base" Verify DST.ADDR of "presets/ss-base" Apr 14, 2017
@micooz micooz closed this as completed in 8993206 Apr 14, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant