August 2012 - tor-commits - lists.torproject.org

[tor/maint-0.2.3] Disable extending to private/internal addresses by default
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit b7c172c9ec762363562220a354feefc521970d7c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 11:16:44 2012 -0400 Disable extending to private/internal addresses by default This is important, since otherwise an attacker can use timing info to probe the internal network. Also, add an option (ExtendAllowPrivateAddresses) so that TestingTorNetwork won't break. Fix for bug 6710; bugfix on all released versions of Tor. --- changes/bug6710 | 7 +++++++ doc/tor.1.txt | 6 ++++++ src/or/circuitbuild.c | 7 +++++++ src/or/config.c | 2 ++ src/or/or.h | 4 +++- 5 files changed, 25 insertions(+), 1 deletions(-) diff --git a/changes/bug6710 b/changes/bug6710 new file mode 100644 index 0000000..69a3c7e --- /dev/null +++ b/changes/bug6710 @@ -0,0 +1,7 @@ + o Major bugfixes (security): + - Reject any attempt to extend to an internal address. Without + this fix, a router could be used to probe addresses on an + internal network to see whether they were accepting + connections. Fix for bug 6710; bugfix on all released versions + of Tor. + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index e7ba848..7e0751b 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1470,6 +1470,11 @@ is non-zero): its extra-info documents that it uploads to the directory authorities. (Default: 1) +**ExtendAllowPrivateAddresses** **0**|**1**:: + When this option is enabled, Tor routers allow EXTEND request to + localhost, RFC1918 addresses, and so on. This can create security issues; + you should probably leave it off. (Default: 0) + DIRECTORY SERVER OPTIONS ------------------------ @@ -1795,6 +1800,7 @@ The following options are used for running a testing Tor network. ClientRejectInternalAddresses 0 CountPrivateBandwidth 1 ExitPolicyRejectPrivate 0 + ExtendAllowPrivateAddresses 1 V3AuthVotingInterval 5 minutes V3AuthVoteDelay 20 seconds V3AuthDistDelay 20 seconds diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 39a223b..f11bebf 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2432,6 +2432,13 @@ circuit_extend(cell_t *cell, circuit_t *circ) return -1; } + if (tor_addr_is_internal(&n_addr, 0) && + !get_options()->ExtendAllowPrivateAddresses) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Client asked me to extend to a private address"); + return -1; + } + /* Check if they asked us for 0000..0000. We support using * an empty fingerprint for the first hop (e.g. for a bridge relay), * but we don't want to let people send us extend cells for empty diff --git a/src/or/config.c b/src/or/config.c index 3970808..d5e80cc 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -276,6 +276,7 @@ static config_var_t _option_vars[] = { V(ExitPolicy, LINELIST, NULL), V(ExitPolicyRejectPrivate, BOOL, "1"), V(ExitPortStatistics, BOOL, "0"), + V(ExtendAllowPrivateAddresses, BOOL, "0"), V(ExtraInfoStatistics, BOOL, "1"), #if defined (WINCE) @@ -473,6 +474,7 @@ static const config_var_t testing_tor_network_defaults[] = { V(ClientRejectInternalAddresses, BOOL, "0"), V(CountPrivateBandwidth, BOOL, "1"), V(ExitPolicyRejectPrivate, BOOL, "0"), + V(ExtendAllowPrivateAddresses, BOOL, "1"), V(V3AuthVotingInterval, INTERVAL, "5 minutes"), V(V3AuthVoteDelay, INTERVAL, "20 seconds"), V(V3AuthDistDelay, INTERVAL, "20 seconds"), diff --git a/src/or/or.h b/src/or/or.h index 908daa6..9074083 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3029,8 +3029,10 @@ typedef struct { config_line_t *RecommendedVersions; config_line_t *RecommendedClientVersions; config_line_t *RecommendedServerVersions; - /** Whether dirservers refuse router descriptors with private IPs. */ + /** Whether dirservers allow router descriptors with private IPs. */ int DirAllowPrivateAddresses; + /** Whether routers accept EXTEND cells to routers with private IPs. */ + int ExtendAllowPrivateAddresses; char *User; /**< Name of user to run Tor as. */ char *Group; /**< Name of group to run Tor as. */ config_line_t *ORPort_lines; /**< Ports to listen on for OR connections. */

1 0

[tor/maint-0.2.3] Fix changes file for 6710: before 0.0.8pre1, you couldn't extend to
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 45b520b6a4872a5c52b934df9c345e04536568b1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 12:29:04 2012 -0400 Fix changes file for 6710: before 0.0.8pre1, you couldn't extend to a router that another router wasn't already connected to. --- changes/bug6710 | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/changes/bug6710 b/changes/bug6710 index 69a3c7e..2c89346 100644 --- a/changes/bug6710 +++ b/changes/bug6710 @@ -2,6 +2,5 @@ - Reject any attempt to extend to an internal address. Without this fix, a router could be used to probe addresses on an internal network to see whether they were accepting - connections. Fix for bug 6710; bugfix on all released versions - of Tor. + connections. Fix for bug 6710; bugfix on 0.0.8pre1.

1 0

[tor/maint-0.2.3] Merge branch 'bug6710_023' into maint-0.2.3
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit bffe0d3ccc6b49975eae9173b0c1c465d40d2dbf Merge: 443e4ae 45b520b Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:15:01 2012 -0400 Merge branch 'bug6710_023' into maint-0.2.3 changes/bug6710 | 6 ++++++ doc/tor.1.txt | 6 ++++++ src/or/circuitbuild.c | 7 +++++++ src/or/config.c | 2 ++ src/or/or.h | 4 +++- 5 files changed, 24 insertions(+), 1 deletions(-)

1 0

[tor/master] Merge branch 'bug6690_022' into maint-0.2.2
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 1c30e6abc93fa086a14d01d838066581a3657285 Merge: d48cebc 62d9628 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:03:48 2012 -0400 Merge branch 'bug6690_022' into maint-0.2.2 changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-)

1 0

[tor/master] Do not assert when comparing a null address/port against a policy
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 11:52:51 2012 -0400 Do not assert when comparing a null address/port against a policy This can create a remote crash opportunity for/against directory authorities. --- changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-) diff --git a/changes/bug6690 b/changes/bug6690 new file mode 100644 index 0000000..99d4297 --- /dev/null +++ b/changes/bug6690 @@ -0,0 +1,7 @@ + o Major bugfixes (security): + - Do not crash when comparing an address with port value 0 to an + address policy. This bug could have been used to cause a remote + assertion failure by or against directory authorities, or to + allow some applications to crash clients. Fixes bug 6690; bugfix + on 0.2.1.10-alpha. + diff --git a/src/or/policies.c b/src/or/policies.c index c870360..55d08af 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -685,7 +685,11 @@ compare_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port, /* no policy? accept all. */ return ADDR_POLICY_ACCEPTED; } else if (tor_addr_is_null(addr)) { - tor_assert(port != 0); + if (port == 0) { + log_info(LD_BUG, "Rejecting null address with 0 port (family %d)", + addr ? tor_addr_family(addr) : -1); + return ADDR_POLICY_REJECTED; + } return compare_unknown_tor_addr_to_addr_policy(port, policy); } else if (port == 0) { return compare_known_tor_addr_to_addr_policy_noport(addr, policy);

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 443e4ae1ee0520cead27dd3a21e9f79b1bed8f8b Merge: ce4add4 1c30e6a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:07:04 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3 Conflicts: src/or/policies.c changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-) diff --cc src/or/policies.c index 3018803,55d08af..6e98421 --- a/src/or/policies.c +++ b/src/or/policies.c @@@ -711,8 -684,12 +711,12 @@@ compare_tor_addr_to_addr_policy(const t if (!policy) { /* no policy? accept all. */ return ADDR_POLICY_ACCEPTED; - } else if (tor_addr_is_null(addr)) { + } else if (addr == NULL || tor_addr_is_null(addr)) { - tor_assert(port != 0); + if (port == 0) { + log_info(LD_BUG, "Rejecting null address with 0 port (family %d)", + addr ? tor_addr_family(addr) : -1); + return ADDR_POLICY_REJECTED; + } return compare_unknown_tor_addr_to_addr_policy(port, policy); } else if (port == 0) { return compare_known_tor_addr_to_addr_policy_noport(addr, policy);

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3'
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit e232938ec82c8c35b99331995d1aeaca67ba9ec1 Merge: 0ccd57f 443e4ae Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:09:29 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-)

1 0

[tor/maint-0.2.3] Do not assert when comparing a null address/port against a policy
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 11:52:51 2012 -0400 Do not assert when comparing a null address/port against a policy This can create a remote crash opportunity for/against directory authorities. --- changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-) diff --git a/changes/bug6690 b/changes/bug6690 new file mode 100644 index 0000000..99d4297 --- /dev/null +++ b/changes/bug6690 @@ -0,0 +1,7 @@ + o Major bugfixes (security): + - Do not crash when comparing an address with port value 0 to an + address policy. This bug could have been used to cause a remote + assertion failure by or against directory authorities, or to + allow some applications to crash clients. Fixes bug 6690; bugfix + on 0.2.1.10-alpha. + diff --git a/src/or/policies.c b/src/or/policies.c index c870360..55d08af 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -685,7 +685,11 @@ compare_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port, /* no policy? accept all. */ return ADDR_POLICY_ACCEPTED; } else if (tor_addr_is_null(addr)) { - tor_assert(port != 0); + if (port == 0) { + log_info(LD_BUG, "Rejecting null address with 0 port (family %d)", + addr ? tor_addr_family(addr) : -1); + return ADDR_POLICY_REJECTED; + } return compare_unknown_tor_addr_to_addr_policy(port, policy); } else if (port == 0) { return compare_known_tor_addr_to_addr_policy_noport(addr, policy);

1 0

[tor/maint-0.2.3] Merge branch 'bug6690_022' into maint-0.2.2
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 1c30e6abc93fa086a14d01d838066581a3657285 Merge: d48cebc 62d9628 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:03:48 2012 -0400 Merge branch 'bug6690_022' into maint-0.2.2 changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-)

1 0

[tor/maint-0.2.3] Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 443e4ae1ee0520cead27dd3a21e9f79b1bed8f8b Merge: ce4add4 1c30e6a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:07:04 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3 Conflicts: src/or/policies.c changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-) diff --cc src/or/policies.c index 3018803,55d08af..6e98421 --- a/src/or/policies.c +++ b/src/or/policies.c @@@ -711,8 -684,12 +711,12 @@@ compare_tor_addr_to_addr_policy(const t if (!policy) { /* no policy? accept all. */ return ADDR_POLICY_ACCEPTED; - } else if (tor_addr_is_null(addr)) { + } else if (addr == NULL || tor_addr_is_null(addr)) { - tor_assert(port != 0); + if (port == 0) { + log_info(LD_BUG, "Rejecting null address with 0 port (family %d)", + addr ? tor_addr_family(addr) : -1); + return ADDR_POLICY_REJECTED; + } return compare_unknown_tor_addr_to_addr_policy(port, policy); } else if (port == 0) { return compare_known_tor_addr_to_addr_policy_noport(addr, policy);

1 0