nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-10 21:23:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'public/bug2822'

Browse Source
This commit is contained in:
Nick Mathewson 2012-05-16 11:10:09 -04:00
commit a925fc9189
5 changed files with 46 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
changes/bug2822.1 Normal file
View File

@ -0,0 +1,5 @@
o Minor features:
- Rate-limit log messages when asked to connect anonymously to a private
address. When these hit, they tended to hit fast and often. Partial
fix for bug 2822.

6
changes/bug2822.2 Normal file
View File

@ -0,0 +1,6 @@
o Minor features:
- Don't bother trying to connect to addresses that we are sure will
resolve to 127.0.0.1: Getting 127.0.0.1 in a reply makes us think
we have been lied to, even when the address the client tried to
connect to was "localhost." Partial fix for bug 2822.

9
src/common/address.c
View File

@ -1687,3 +1687,12 @@ get_interface_address(int severity, uint32_t *addr)
return r;
}
/** Return true if we can tell that <b>name</b> is a canonical name for the
* loopback address. */
int
tor_addr_hostname_is_local(const char *name)
{
return !strcasecmp(name, "localhost") ||
!strcasecmp(name, "local") ||
!strcasecmpend(name, ".local");
}

2
src/common/address.h
View File

@ -200,6 +200,8 @@ int tor_addr_is_loopback(const tor_addr_t *addr);
int tor_addr_port_split(int severity, const char *addrport,
char **address_out, uint16_t *port_out);
int tor_addr_hostname_is_local(const char *name);
/* IPv4 helpers */
int is_internal_IP(uint32_t ip, int for_listening);
int addr_port_lookup(int severity, const char *addrport, char **address,

33
src/or/connection_edge.c
View File

@ -2000,20 +2000,35 @@ connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn,
if (options->ClientRejectInternalAddresses &&
!conn->use_begindir && !conn->chosen_exit_name && !circ) {
tor_addr_t addr;
if (tor_addr_parse(&addr, socks->address) >= 0 &&
tor_addr_is_internal(&addr, 0)) {
if (tor_addr_hostname_is_local(socks->address) ||
(tor_addr_parse(&addr, socks->address) >= 0 &&
tor_addr_is_internal(&addr, 0))) {
/* If this is an explicit private address with no chosen exit node,
* then we really don't want to try to connect to it. That's
* probably an error. */
if (conn->is_transparent_ap) {
log_warn(LD_NET,
"Rejecting request for anonymous connection to private "
"address %s on a TransPort or NATDPort. Possible loop "
"in your NAT rules?", safe_str_client(socks->address));
#define WARN_INTERVAL_LOOP 300
static ratelim_t loop_warn_limit = RATELIM_INIT(WARN_INTERVAL_LOOP);
char *m;
if ((m = rate_limit_log(&loop_warn_limit, approx_time()))) {
log_warn(LD_NET,
"Rejecting request for anonymous connection to private "
"address %s on a TransPort or NATDPort. Possible loop "
"in your NAT rules?%s", safe_str_client(socks->address),
m);
tor_free(m);
}
} else {
log_warn(LD_NET,
"Rejecting SOCKS request for anonymous connection to "
"private address %s", safe_str_client(socks->address));
#define WARN_INTERVAL_PRIV 300
static ratelim_t priv_warn_limit = RATELIM_INIT(WARN_INTERVAL_PRIV);
char *m;
if ((m = rate_limit_log(&priv_warn_limit, approx_time()))) {
log_warn(LD_NET,
"Rejecting SOCKS request for anonymous connection to "
"private address %s.%s",
safe_str_client(socks->address),m);
tor_free(m);
}
}
connection_mark_unattached_ap(conn, END_STREAM_REASON_PRIVATE_ADDR);
return -1;