diff options
| -rw-r--r-- | changes/bug18329-minimal | 6 | ||||
| -rw-r--r-- | changes/trove-2017-009 | 10 | ||||
| -rw-r--r-- | src/or/rendservice.c | 4 | ||||
| -rw-r--r-- | src/or/router.c | 9 |
4 files changed, 28 insertions, 1 deletions
diff --git a/changes/bug18329-minimal b/changes/bug18329-minimal new file mode 100644 index 0000000000..804c4e8dd1 --- /dev/null +++ b/changes/bug18329-minimal @@ -0,0 +1,6 @@ + o Minor features (bridge): + - Bridges now include notice in their descriptors that they are bridges, + and notice of their distribution status, based on their publication + settings. Implements ticket 18329. For more fine-grained control of + how a bridge is distributed, upgrade to 0.3.2.x or later. + diff --git a/changes/trove-2017-009 b/changes/trove-2017-009 new file mode 100644 index 0000000000..166a5faec6 --- /dev/null +++ b/changes/trove-2017-009 @@ -0,0 +1,10 @@ + o Major bugfixes (security): + - When checking for replays in the INTRODUCE1 cell data for a (legacy) + hiddden service, correctly detect replays in the RSA-encrypted part of + the cell. We were previously checking for replays on the entire cell, + but those can be circumvented due to the malleability of Tor's legacy + hybrid encryption. This fix helps prevent a traffic confirmation + attack. Fixes bug 24244; bugfix on 0.2.4.1-alpha. This issue is also + tracked as TROVE-2017-009 and CVE-2017-8819. + + diff --git a/src/or/rendservice.c b/src/or/rendservice.c index d958de9df9..ba8891eade 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -1162,6 +1162,7 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request, time_t now = time(NULL); time_t elapsed; int replay; + size_t keylen; /* Do some initial validation and logging before we parse the cell */ if (circuit->base_.purpose != CIRCUIT_PURPOSE_S_INTRO) { @@ -1245,9 +1246,10 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request, } /* check for replay of PK-encrypted portion. */ + keylen = crypto_pk_keysize(intro_key); replay = replaycache_add_test_and_elapsed( intro_point->accepted_intro_rsa_parts, - parsed_req->ciphertext, parsed_req->ciphertext_len, + parsed_req->ciphertext, MIN(parsed_req->ciphertext_len, keylen), &elapsed); if (replay) { diff --git a/src/or/router.c b/src/or/router.c index 2cdbb0c8bb..90b2431a22 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -2385,6 +2385,15 @@ router_dump_router_to_string(routerinfo_t *router, smartlist_add_asprintf(chunks, "contact %s\n", ci); } + if (options->BridgeRelay) { + const char *bd; + if (options->PublishServerDescriptor_ & BRIDGE_DIRINFO) + bd = "any"; + else + bd = "none"; + smartlist_add_asprintf(chunks, "bridge-distribution-request %s\n", bd); + } + #ifdef CURVE25519_ENABLED if (router->onion_curve25519_pkey) { char kbuf[128]; |