- tor-commits - lists.torproject.org

[tor/maint-0.2.3] Merge branch 'disable_pathbias_warnings_v2' into maint-0.2.3
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit d98f2996b0b7b8629ac05662976cb3e4f100efcd Merge: bffe0d3 b252ffa Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:19:52 2012 -0400 Merge branch 'disable_pathbias_warnings_v2' into maint-0.2.3 changes/disable_pathbias_messages | 3 +++ src/or/circuitbuild.c | 20 ++++++++++---------- 2 files changed, 13 insertions(+), 10 deletions(-)

1 0

[tor/maint-0.2.3] Downgrade path-bias warning messages to INFO for now.
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit b252ffa7cb641398ee19886f71380cd6190bcebc Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 10:46:17 2012 -0400 Downgrade path-bias warning messages to INFO for now. We've had over two months to fix them, and didn't. Now we need 0.2.3.x stable. Yes, it would be cool to get this working in 0.2.3.x, but not at the expense of delaying every other feature that _does_ work in 0.2.3.x. We can do a real fix in 0.2.4. --- changes/disable_pathbias_messages | 3 +++ src/or/circuitbuild.c | 20 ++++++++++---------- 2 files changed, 13 insertions(+), 10 deletions(-) diff --git a/changes/disable_pathbias_messages b/changes/disable_pathbias_messages new file mode 100644 index 0000000..3bc9963 --- /dev/null +++ b/changes/disable_pathbias_messages @@ -0,0 +1,3 @@ + o Disabeled features + - Downgrade path-bias warning messages to INFO. We'll try to get them + working better in 0.2.4. Fixes bug 6475; bugfix on 0.2.3.17-beta. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index f11bebf..fcd13dc 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2656,7 +2656,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) if (circ->has_opened && circ->path_state != PATH_STATE_DID_FIRST_HOP) { if ((rate_msg = rate_limit_log(&first_hop_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Opened circuit is in strange path state %s. " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2683,7 +2683,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) } else { if ((rate_msg = rate_limit_log(&first_hop_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Unopened circuit has strange path state %s. " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2695,7 +2695,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) } else { if ((rate_msg = rate_limit_log(&first_hop_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Unopened circuit has no known guard. " "Circuit is a %s currently %s. %s", circuit_purpose_to_string(circ->_base.purpose), @@ -2709,7 +2709,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) if (circ->path_state == PATH_STATE_NEW_CIRC) { if ((rate_msg = rate_limit_log(&first_hop_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "A %s circuit is in cpath state %d (opened: %d). " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2761,7 +2761,7 @@ pathbias_count_success(origin_circuit_t *circ) } else { if ((rate_msg = rate_limit_log(&success_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Succeeded circuit is in strange path state %s. " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2772,7 +2772,7 @@ pathbias_count_success(origin_circuit_t *circ) } if (guard->first_hops < guard->circuit_successes) { - log_warn(LD_BUG, "Unexpectedly high circuit_successes (%u/%u) " + log_info(LD_BUG, "Unexpectedly high circuit_successes (%u/%u) " "for guard %s=%s", guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); @@ -2780,7 +2780,7 @@ pathbias_count_success(origin_circuit_t *circ) } else { if ((rate_msg = rate_limit_log(&success_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Completed circuit has no known guard. " "Circuit is a %s currently %s. %s", circuit_purpose_to_string(circ->_base.purpose), @@ -2792,7 +2792,7 @@ pathbias_count_success(origin_circuit_t *circ) if (circ->path_state != PATH_STATE_SUCCEEDED) { if ((rate_msg = rate_limit_log(&success_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Opened circuit is in strange path state %s. " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2822,7 +2822,7 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) if (guard->circuit_successes/((double)guard->first_hops) < pathbias_get_disable_rate(options)) { - log_warn(LD_PROTOCOL, + log_info(LD_PROTOCOL, "Extremely low circuit success rate %u/%u for guard %s=%s. " "This might indicate an attack, or a bug.", guard->circuit_successes, guard->first_hops, guard->nickname, @@ -2835,7 +2835,7 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) < pathbias_get_notice_rate(options) && !guard->path_bias_notice) { guard->path_bias_notice = 1; - log_notice(LD_PROTOCOL, + log_info(LD_PROTOCOL, "Low circuit success rate %u/%u for guard %s=%s.", guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN));

1 0

[tor/master] Disable extending to private/internal addresses by default
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit b7c172c9ec762363562220a354feefc521970d7c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 11:16:44 2012 -0400 Disable extending to private/internal addresses by default This is important, since otherwise an attacker can use timing info to probe the internal network. Also, add an option (ExtendAllowPrivateAddresses) so that TestingTorNetwork won't break. Fix for bug 6710; bugfix on all released versions of Tor. --- changes/bug6710 | 7 +++++++ doc/tor.1.txt | 6 ++++++ src/or/circuitbuild.c | 7 +++++++ src/or/config.c | 2 ++ src/or/or.h | 4 +++- 5 files changed, 25 insertions(+), 1 deletions(-) diff --git a/changes/bug6710 b/changes/bug6710 new file mode 100644 index 0000000..69a3c7e --- /dev/null +++ b/changes/bug6710 @@ -0,0 +1,7 @@ + o Major bugfixes (security): + - Reject any attempt to extend to an internal address. Without + this fix, a router could be used to probe addresses on an + internal network to see whether they were accepting + connections. Fix for bug 6710; bugfix on all released versions + of Tor. + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index e7ba848..7e0751b 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1470,6 +1470,11 @@ is non-zero): its extra-info documents that it uploads to the directory authorities. (Default: 1) +**ExtendAllowPrivateAddresses** **0**|**1**:: + When this option is enabled, Tor routers allow EXTEND request to + localhost, RFC1918 addresses, and so on. This can create security issues; + you should probably leave it off. (Default: 0) + DIRECTORY SERVER OPTIONS ------------------------ @@ -1795,6 +1800,7 @@ The following options are used for running a testing Tor network. ClientRejectInternalAddresses 0 CountPrivateBandwidth 1 ExitPolicyRejectPrivate 0 + ExtendAllowPrivateAddresses 1 V3AuthVotingInterval 5 minutes V3AuthVoteDelay 20 seconds V3AuthDistDelay 20 seconds diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 39a223b..f11bebf 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2432,6 +2432,13 @@ circuit_extend(cell_t *cell, circuit_t *circ) return -1; } + if (tor_addr_is_internal(&n_addr, 0) && + !get_options()->ExtendAllowPrivateAddresses) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Client asked me to extend to a private address"); + return -1; + } + /* Check if they asked us for 0000..0000. We support using * an empty fingerprint for the first hop (e.g. for a bridge relay), * but we don't want to let people send us extend cells for empty diff --git a/src/or/config.c b/src/or/config.c index 3970808..d5e80cc 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -276,6 +276,7 @@ static config_var_t _option_vars[] = { V(ExitPolicy, LINELIST, NULL), V(ExitPolicyRejectPrivate, BOOL, "1"), V(ExitPortStatistics, BOOL, "0"), + V(ExtendAllowPrivateAddresses, BOOL, "0"), V(ExtraInfoStatistics, BOOL, "1"), #if defined (WINCE) @@ -473,6 +474,7 @@ static const config_var_t testing_tor_network_defaults[] = { V(ClientRejectInternalAddresses, BOOL, "0"), V(CountPrivateBandwidth, BOOL, "1"), V(ExitPolicyRejectPrivate, BOOL, "0"), + V(ExtendAllowPrivateAddresses, BOOL, "1"), V(V3AuthVotingInterval, INTERVAL, "5 minutes"), V(V3AuthVoteDelay, INTERVAL, "20 seconds"), V(V3AuthDistDelay, INTERVAL, "20 seconds"), diff --git a/src/or/or.h b/src/or/or.h index 908daa6..9074083 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3029,8 +3029,10 @@ typedef struct { config_line_t *RecommendedVersions; config_line_t *RecommendedClientVersions; config_line_t *RecommendedServerVersions; - /** Whether dirservers refuse router descriptors with private IPs. */ + /** Whether dirservers allow router descriptors with private IPs. */ int DirAllowPrivateAddresses; + /** Whether routers accept EXTEND cells to routers with private IPs. */ + int ExtendAllowPrivateAddresses; char *User; /**< Name of user to run Tor as. */ char *Group; /**< Name of group to run Tor as. */ config_line_t *ORPort_lines; /**< Ports to listen on for OR connections. */

1 0

[tor/master] Fix changes file for 6710: before 0.0.8pre1, you couldn't extend to
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 45b520b6a4872a5c52b934df9c345e04536568b1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 12:29:04 2012 -0400 Fix changes file for 6710: before 0.0.8pre1, you couldn't extend to a router that another router wasn't already connected to. --- changes/bug6710 | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/changes/bug6710 b/changes/bug6710 index 69a3c7e..2c89346 100644 --- a/changes/bug6710 +++ b/changes/bug6710 @@ -2,6 +2,5 @@ - Reject any attempt to extend to an internal address. Without this fix, a router could be used to probe addresses on an internal network to see whether they were accepting - connections. Fix for bug 6710; bugfix on all released versions - of Tor. + connections. Fix for bug 6710; bugfix on 0.0.8pre1.

1 0

[tor/master] Merge branch 'bug6710_023' into maint-0.2.3
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit bffe0d3ccc6b49975eae9173b0c1c465d40d2dbf Merge: 443e4ae 45b520b Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:15:01 2012 -0400 Merge branch 'bug6710_023' into maint-0.2.3 changes/bug6710 | 6 ++++++ doc/tor.1.txt | 6 ++++++ src/or/circuitbuild.c | 7 +++++++ src/or/config.c | 2 ++ src/or/or.h | 4 +++- 5 files changed, 24 insertions(+), 1 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3'
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 0c5a44ed0a790951bdfd319eec734c04eb972a08 Merge: e232938 bffe0d3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:16:27 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' changes/bug6710 | 6 ++++++ doc/tor.1.txt | 6 ++++++ src/or/circuitbuild.c | 7 +++++++ src/or/config.c | 2 ++ src/or/or.h | 4 +++- 5 files changed, 24 insertions(+), 1 deletions(-)

1 0

[tor/maint-0.2.3] Disable extending to private/internal addresses by default
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit b7c172c9ec762363562220a354feefc521970d7c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 11:16:44 2012 -0400 Disable extending to private/internal addresses by default This is important, since otherwise an attacker can use timing info to probe the internal network. Also, add an option (ExtendAllowPrivateAddresses) so that TestingTorNetwork won't break. Fix for bug 6710; bugfix on all released versions of Tor. --- changes/bug6710 | 7 +++++++ doc/tor.1.txt | 6 ++++++ src/or/circuitbuild.c | 7 +++++++ src/or/config.c | 2 ++ src/or/or.h | 4 +++- 5 files changed, 25 insertions(+), 1 deletions(-) diff --git a/changes/bug6710 b/changes/bug6710 new file mode 100644 index 0000000..69a3c7e --- /dev/null +++ b/changes/bug6710 @@ -0,0 +1,7 @@ + o Major bugfixes (security): + - Reject any attempt to extend to an internal address. Without + this fix, a router could be used to probe addresses on an + internal network to see whether they were accepting + connections. Fix for bug 6710; bugfix on all released versions + of Tor. + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index e7ba848..7e0751b 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1470,6 +1470,11 @@ is non-zero): its extra-info documents that it uploads to the directory authorities. (Default: 1) +**ExtendAllowPrivateAddresses** **0**|**1**:: + When this option is enabled, Tor routers allow EXTEND request to + localhost, RFC1918 addresses, and so on. This can create security issues; + you should probably leave it off. (Default: 0) + DIRECTORY SERVER OPTIONS ------------------------ @@ -1795,6 +1800,7 @@ The following options are used for running a testing Tor network. ClientRejectInternalAddresses 0 CountPrivateBandwidth 1 ExitPolicyRejectPrivate 0 + ExtendAllowPrivateAddresses 1 V3AuthVotingInterval 5 minutes V3AuthVoteDelay 20 seconds V3AuthDistDelay 20 seconds diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 39a223b..f11bebf 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2432,6 +2432,13 @@ circuit_extend(cell_t *cell, circuit_t *circ) return -1; } + if (tor_addr_is_internal(&n_addr, 0) && + !get_options()->ExtendAllowPrivateAddresses) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Client asked me to extend to a private address"); + return -1; + } + /* Check if they asked us for 0000..0000. We support using * an empty fingerprint for the first hop (e.g. for a bridge relay), * but we don't want to let people send us extend cells for empty diff --git a/src/or/config.c b/src/or/config.c index 3970808..d5e80cc 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -276,6 +276,7 @@ static config_var_t _option_vars[] = { V(ExitPolicy, LINELIST, NULL), V(ExitPolicyRejectPrivate, BOOL, "1"), V(ExitPortStatistics, BOOL, "0"), + V(ExtendAllowPrivateAddresses, BOOL, "0"), V(ExtraInfoStatistics, BOOL, "1"), #if defined (WINCE) @@ -473,6 +474,7 @@ static const config_var_t testing_tor_network_defaults[] = { V(ClientRejectInternalAddresses, BOOL, "0"), V(CountPrivateBandwidth, BOOL, "1"), V(ExitPolicyRejectPrivate, BOOL, "0"), + V(ExtendAllowPrivateAddresses, BOOL, "1"), V(V3AuthVotingInterval, INTERVAL, "5 minutes"), V(V3AuthVoteDelay, INTERVAL, "20 seconds"), V(V3AuthDistDelay, INTERVAL, "20 seconds"), diff --git a/src/or/or.h b/src/or/or.h index 908daa6..9074083 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3029,8 +3029,10 @@ typedef struct { config_line_t *RecommendedVersions; config_line_t *RecommendedClientVersions; config_line_t *RecommendedServerVersions; - /** Whether dirservers refuse router descriptors with private IPs. */ + /** Whether dirservers allow router descriptors with private IPs. */ int DirAllowPrivateAddresses; + /** Whether routers accept EXTEND cells to routers with private IPs. */ + int ExtendAllowPrivateAddresses; char *User; /**< Name of user to run Tor as. */ char *Group; /**< Name of group to run Tor as. */ config_line_t *ORPort_lines; /**< Ports to listen on for OR connections. */

1 0

[tor/maint-0.2.3] Fix changes file for 6710: before 0.0.8pre1, you couldn't extend to
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 45b520b6a4872a5c52b934df9c345e04536568b1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 12:29:04 2012 -0400 Fix changes file for 6710: before 0.0.8pre1, you couldn't extend to a router that another router wasn't already connected to. --- changes/bug6710 | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/changes/bug6710 b/changes/bug6710 index 69a3c7e..2c89346 100644 --- a/changes/bug6710 +++ b/changes/bug6710 @@ -2,6 +2,5 @@ - Reject any attempt to extend to an internal address. Without this fix, a router could be used to probe addresses on an internal network to see whether they were accepting - connections. Fix for bug 6710; bugfix on all released versions - of Tor. + connections. Fix for bug 6710; bugfix on 0.0.8pre1.

1 0

[tor/maint-0.2.3] Merge branch 'bug6710_023' into maint-0.2.3
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit bffe0d3ccc6b49975eae9173b0c1c465d40d2dbf Merge: 443e4ae 45b520b Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:15:01 2012 -0400 Merge branch 'bug6710_023' into maint-0.2.3 changes/bug6710 | 6 ++++++ doc/tor.1.txt | 6 ++++++ src/or/circuitbuild.c | 7 +++++++ src/or/config.c | 2 ++ src/or/or.h | 4 +++- 5 files changed, 24 insertions(+), 1 deletions(-)

1 0

[tor/master] Merge branch 'bug6690_022' into maint-0.2.2
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 1c30e6abc93fa086a14d01d838066581a3657285 Merge: d48cebc 62d9628 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:03:48 2012 -0400 Merge branch 'bug6690_022' into maint-0.2.2 changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-)

1 0