nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-24 12:23:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Reject create cells on outgoing OR connections from bridges

Browse Source
This commit is contained in:
Robert Ransom 2011-10-23 15:21:49 -07:00 committed by Sebastian Hahn
parent c05bb53508
commit a74e7fd40f
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
changes/issue-2011-10-23G Normal file
View File

@ -0,0 +1,9 @@
o Security fixes:
- Reject CREATE and CREATE_FAST cells on outgoing OR connections
from a bridge to a relay. Previously, we would accept them and
handle them normally, thereby allowing a malicious relay to
easily distinguish bridges which connect to it from clients.
Fixes CVE-2011-2769. Bugfix on 0.2.0.3-alpha, when bridges were
implemented; found by frosty_un.

7
src/or/command.c
View File

@ -219,6 +219,7 @@ static void
command_process_create_cell(cell_t *cell, or_connection_t *conn)
{
or_circuit_t *circ;
or_options_t *options = get_options();
int id_is_high;
if (we_are_hibernating()) {
@ -230,9 +231,11 @@ command_process_create_cell(cell_t *cell, or_connection_t *conn)
return;
}
if (!server_mode(get_options())) {
if (!server_mode(options) ||
(!public_server_mode(options) && conn->is_outgoing)) {
log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
"Received create cell (type %d) from %s:%d, but we're a client. "
"Received create cell (type %d) from %s:%d, but we're connected "
"to it as a client. "
"Sending back a destroy.",
(int)cell->command, conn->_base.address, conn->_base.port);
connection_or_send_destroy(cell->circ_id, conn,