diff options
| author | Nick Mathewson <nickm@torproject.org> | 2008-10-21 16:51:59 +0000 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2008-10-21 16:51:59 +0000 |
| commit | 5e762e6a5c0e6729bb7dbb586af2690c087d9ba8 (patch) | |
| tree | 89ba2b2b5f4a850a66e19f4e09b94bdce2e6db25 | |
| parent | b593fd5c20bb3a0080673f6853e95bb9f3ffb799 (diff) | |
| download | tor-5e762e6a5c0e6729bb7dbb586af2690c087d9ba8.tar.gz tor-5e762e6a5c0e6729bb7dbb586af2690c087d9ba8.zip | |
Fix the rest of bug 619: reject *:* servers should not do DNS lookups, even if broken clients send them RELAY_BEGIN cells. Patch from rovv.
svn:r17138
| -rw-r--r-- | ChangeLog | 3 | ||||
| -rw-r--r-- | src/or/dns.c | 15 |
2 files changed, 11 insertions, 7 deletions
@@ -31,6 +31,9 @@ Changes in version 0.2.1.7-alpha - 2008-10-xx - Send a valid END cell back when a client tries to connect to a nonexistent hidden service port. Bugfix on 0.1.2.15. Fixes bug 840. Patch from rovv. + - If a broken client asks a non-exit router to connect somewhere, + do not even do the DNS lookup before rejecting the connection. + Fixes another case of bug 619. Patch from rovv. Changes in version 0.2.1.6-alpha - 2008-09-30 diff --git a/src/or/dns.c b/src/or/dns.c index 397c8ff489..aa251b4322 100644 --- a/src/or/dns.c +++ b/src/or/dns.c @@ -553,15 +553,10 @@ dns_resolve(edge_connection_t *exitconn) or_circuit_t *oncirc = TO_OR_CIRCUIT(exitconn->on_circuit); int is_resolve, r; char *hostname = NULL; - routerinfo_t *me; is_resolve = exitconn->_base.purpose == EXIT_PURPOSE_RESOLVE; - if (is_resolve && - (!(me = router_get_my_routerinfo()) || - policy_is_reject_star(me->exit_policy))) /* non-exit */ - r = -1; - else - r = dns_resolve_impl(exitconn, is_resolve, oncirc, &hostname); + r = dns_resolve_impl(exitconn, is_resolve, oncirc, &hostname); + switch (r) { case 1: /* We got an answer without a lookup -- either the answer was @@ -636,6 +631,7 @@ dns_resolve_impl(edge_connection_t *exitconn, int is_resolve, cached_resolve_t *resolve; cached_resolve_t search; pending_connection_t *pending_connection; + routerinfo_t *me; struct in_addr in; time_t now = time(NULL); uint8_t is_reverse = 0; @@ -652,6 +648,11 @@ dns_resolve_impl(edge_connection_t *exitconn, int is_resolve, exitconn->address_ttl = DEFAULT_DNS_TTL; return 1; } + /* If we're a non-exit, don't even do DNS lookups. */ + if (!(me = router_get_my_routerinfo()) || + policy_is_reject_star(me->exit_policy)) { + return -1; + } if (address_is_invalid_destination(exitconn->_base.address, 0)) { log(LOG_PROTOCOL_WARN, LD_EXIT, "Rejecting invalid destination address %s", |