worker-auth: require exact session_id length in cookie auth reply

recv_cookie_auth_reply() used > instead of != when validating
msg->session_id.len, allowing a shorter-than-expected length to
pass. ws->session_id is always consumed at full sizeof() by the
DTLS session setup; a short fill would leave stale tail bytes.
Align with the stricter != check used in recv_auth_reply().

proxy-proto: abort on zero-length unknown TLV in parse_ssl_tlvs()

An unknown TLV with length == 0 caused an infinite loop: the
AVAIL_HEADER_SIZE macro subtracted nothing and data did not
advance. Detect this and return early, consistent with how
AVAIL_HEADER_SIZE handles other malformed headers.

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

src/worker-auth.c

@@ -746,9 +746,10 @@ static int recv_cookie_auth_reply(worker_st *ws)
 				ws->groupname[0] = 0;
 			}
 
-			if (msg->session_id.len > sizeof(ws->session_id)) {
+			if (msg->session_id.len != sizeof(ws->session_id)) {
 				oclog(ws, LOG_ERR,
-				      "msg->session_id.len too large");
+				      "msg->session_id.len unexpected (%zu)",
+				      msg->session_id.len);
 				ret = ERR_AUTH_FAIL;
 				goto cleanup;
 			}

src/worker-proxyproto.c

@@ -154,6 +154,12 @@ static void parse_ssl_tlvs(struct worker_st *ws, uint8_t *data,
 			}
 			data += orig_len;
 		} else {
+			if (tlv.length == 0) {
+				oclog(ws, LOG_ERR,
+				      "proxy-hdr: zero-length TLV type %x, aborting",
+				      (unsigned int)tlv.type);
+				return;
+			}
 			AVAIL_HEADER_SIZE(data_size, tlv.length);
 			data += tlv.length;
 		}