diff options
| author | Robert Ransom <rransom.8774@gmail.com> | 2011-10-23 15:21:49 -0700 |
|---|---|---|
| committer | Sebastian Hahn <sebastian@torproject.org> | 2011-10-26 23:21:14 +0200 |
| commit | a74e7fd40f1a77eb4000d8216bb5b80cdd8a6193 (patch) | |
| tree | f1148867fb5627a0cbeba3bab4a65e589d0032cd | |
| parent | c05bb53508f5fe3e570a285e6c9ead452ded0e43 (diff) | |
| download | tor-a74e7fd40f1a77eb4000d8216bb5b80cdd8a6193.tar.gz tor-a74e7fd40f1a77eb4000d8216bb5b80cdd8a6193.zip | |
Reject create cells on outgoing OR connections from bridges
| -rw-r--r-- | changes/issue-2011-10-23G | 9 | ||||
| -rw-r--r-- | src/or/command.c | 7 |
2 files changed, 14 insertions, 2 deletions
diff --git a/changes/issue-2011-10-23G b/changes/issue-2011-10-23G new file mode 100644 index 0000000000..45f86754f0 --- /dev/null +++ b/changes/issue-2011-10-23G @@ -0,0 +1,9 @@ + o Security fixes: + + - Reject CREATE and CREATE_FAST cells on outgoing OR connections + from a bridge to a relay. Previously, we would accept them and + handle them normally, thereby allowing a malicious relay to + easily distinguish bridges which connect to it from clients. + Fixes CVE-2011-2769. Bugfix on 0.2.0.3-alpha, when bridges were + implemented; found by frosty_un. + diff --git a/src/or/command.c b/src/or/command.c index a17a3a6025..54f23bb0cd 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -219,6 +219,7 @@ static void command_process_create_cell(cell_t *cell, or_connection_t *conn) { or_circuit_t *circ; + or_options_t *options = get_options(); int id_is_high; if (we_are_hibernating()) { @@ -230,9 +231,11 @@ command_process_create_cell(cell_t *cell, or_connection_t *conn) return; } - if (!server_mode(get_options())) { + if (!server_mode(options) || + (!public_server_mode(options) && conn->is_outgoing)) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Received create cell (type %d) from %s:%d, but we're a client. " + "Received create cell (type %d) from %s:%d, but we're connected " + "to it as a client. " "Sending back a destroy.", (int)cell->command, conn->_base.address, conn->_base.port); connection_or_send_destroy(cell->circ_id, conn, |