[tor-bugs] #12086 [BridgeDB]: BridgeDB accepts incoming emails sent to 'givemebridges at serious.ly'
Tor Bug Tracker & Wiki
blackhole at torproject.org
Wed May 21 19:21:04 UTC 2014
#12086: BridgeDB accepts incoming emails sent to 'givemebridges at serious.ly'
--------------------------+--------------------------------------
Reporter: isis | Owner: isis
Type: defect | Status: new
Priority: major | Milestone:
Component: BridgeDB | Version:
Resolution: | Keywords: bridgedb-email, security
Actual Points: | Parent ID:
Points: |
--------------------------+--------------------------------------
Description changed by isis:
Old description:
> From
> [https://gitweb.torproject.org/user/isis/bridgedb.git/commitdiff/4c18a4e2b89872c5731d4301665642065980086e
> this commit message] for
> [https://gitweb.torproject.org/user/isis/bridgedb.git/blob/4c18a4e2b89872c5731d4301665642065980086e:/lib/bridgedb/test/test_email_server.py#l326
> this unittest which reproduces the issue] and which is [https://travis-
> ci.org/isislovecruft/bridgedb/jobs/25714425#L1679 currently failing with
> this error]:
>
> BridgeDB's current code will accept an incoming email with a
> {{{To: givemebridges at serious.ly}}}
> header. However, BridgeDB's reply will still contain:
> {{{From: bridges at torproject.org}}}
>
> Obviously, it ''shouldn't'' be possible for any email whose SMTP `RCPT
> TO` domain is `'serious.ly'` to actually end up in BridgeDB's mail queue.
> Though, if the outside SMTP layer is sent to
> `'[bridges|ponticum].torproject.org'` (with `MAIL FROM:` a gmail/yahoo
> address), these messages still end up in BridgeDB's mail queue.
>
> The following netcat session demonstrates that this is possible:
>
> {{{
> ∃!isisⒶwintermute:(master *$=)~ ∴ torsocks nc bridges.torproject.org 25
> 220 ponticum.torproject.org ESMTP Postfix (Debian/GNU)
> HELO ponticum.torproject.org
> 250 ponticum.torproject.org
> MAIL FROM: isisgrimalkin at gmail.com
> 250 2.1.0 Ok
> RCPT TO: bridges at bridges.torproject.org
> 250 2.1.5 Ok
> DATA
> 354 End data with <CR><LF>.<CR><LF>
> From: isislovecruft at gmail.com
> To: givemebridgesrightnow at serious.ly
> Subject: mwhahaha
>
> get transport obfs3
> .
> 250 2.0.0 Ok: queued as F03972834F
> QUIT
> 221 2.0.0 Bye
> }}}
>
> This request resulted in the following (sanitised) debug logs:
> {{{
> 15:30:31 DEBUG L690:server.validateFrom() ORIGIN:
> "'<bridgedb at ponticum>'"
> 15:30:31 DEBUG L699:server.validateFrom() Got canonical domain:
> 'ponticum'
> 15:30:31 DEBUG L495:server.lineReceived() > Received: from ponticum
> (ponticum [127.0.0.1]) for <bridges at bridgedb>; Wed, 21 May 2014 15:30:31
> +0000
> 15:30:31 DEBUG L495:server.lineReceived() > From
> isisgrimalkin at gmail.com Wed May 21 15:30:31 2014
> 15:30:31 DEBUG L495:server.lineReceived() > X-Original-To:
> bridges at bridges.torproject.org
> 15:30:31 DEBUG L495:server.lineReceived() > Delivered-To:
> bridgedb at ponticum.torproject.org
> 15:30:31 DEBUG L495:server.lineReceived() > Received: from
> ponticum.torproject.org (kpebetka.net [95.79.25.182])
> 15:30:31 DEBUG L495:server.lineReceived() > by
> ponticum.torproject.org (Postfix) with SMTP id F03972834F
> 15:30:31 DEBUG L495:server.lineReceived() > for
> <bridges at bridges.torproject.org>; Wed, 21 May 2014 15:29:18 +0000 (UTC)
> 15:30:31 DEBUG L495:server.lineReceived() > From:
> isislovecruft at gmail.com
> 15:30:31 DEBUG L495:server.lineReceived() > To:
> givemebridgesrightnow at serious.ly
> 15:30:31 DEBUG L495:server.lineReceived() > Subject: mwhahaha
> 15:30:31 DEBUG L495:server.lineReceived() > X-DKIM-Authentication-
> Results: dunno
> 15:30:31 DEBUG L495:server.lineReceived() > Date: Wed, 21 May 2014
> 15:30:31 -0000
> 15:30:31 DEBUG L495:server.lineReceived() > Message-Id:
> <1400686231.135135.6548 at ponticum>
> 15:30:31 DEBUG L495:server.lineReceived() >
> 15:30:31 DEBUG L495:server.lineReceived() > get transport obfs3
> 15:30:31 DEBUG L495:server.lineReceived() >
> 15:30:31 INFO L611:server.reply() Got an email; deciding
> whether to reply.
> 15:30:31 INFO L646:server.reply() Client requested email
> translation: en
> 15:30:31 DEBUG L70:request.determineBridg() Email request was valid.
> 15:30:31 DEBUG L160:request.withPluggableT() Parsing 'transport' line:
> 'get transport obfs3'
> 15:30:31 INFO L169:request.withPluggableT() Email requested transport
> type: 'obfs3'
> 15:30:31 DEBUG L81:request.determineBridg() Generating hashring
> filters for request.
> 15:30:31 INFO L420:Dist.getBridgesForEmai() Attempting to return for
> 3 bridges for isislovecruft at gmail.com...
> 15:30:31 DEBUG L445:Dist.getBridgesForEmai() Cache hit
> frozenset([<function filterBridgesByTransport(obfs3,<class
> 'ipaddr.IPv4Address'>)>])
> 15:30:31 DEBUG L75:Dist.getNumBridgesPerA() Returning 3 bridges from
> ring of len: 492
> 15:30:31 DEBUG L1034:Bridges.getBridges() Got duplicate bridge
> 'edfa2fd66533da52f40424bbe917bd03c8378c2d' in main hashring for position
> 'eda7f69f7c08bd80861c3afa2921168a007d9ae5'.
> 15:30:31 DEBUG L1034:Bridges.getBridges() Got duplicate bridge
> 'ed0b2fd66f398afbf10424bb911790faca9ddb8e' in main hashring for position
> 'eda7f69f7c08bd80861c3afa2921168a007d9ae5'.
> 15:30:31 DEBUG L183:server.generateRespons() Email contents:
> From: bridges at torproject.org
> To: isislovecruft at gmail.com
> Message-ID: <20140521153031.21456.73227139.10726 at ponticum.torproject.org>
> In-Reply-To: <1400686231.135135.6548 at ponticum>
> Content-Type: text/plain; charset="utf-8"
> Date: Wed, 21 May 2014 15:30:31 +0000
> Subject: Re: mwhahaha
>
> Hey, isislovecruft!
>
> [This is an automated message; please do not reply.]
>
> Here are your bridges:
>
> obfs3 10.1.1.1:1111 d14133856abbba8a65607baebf692162c567bf41
> obfs3 10.2.2.2:2222 86f45ab5dcef80a4b1abfcc43579e76f1d0b25a4
> obfs3 10.3.3.3:3333 5d55daabd91e041e74f62dcfab1a29c8bb32f0b2
>
> To enter bridges into Tor Browser, follow the instructions on the Tor
> Browser download page [0] to start Tor Browser.
>
> When the 'Tor Network Settings' dialogue pops up, click 'Configure' and
> follow
> the wizard until it asks:
>
> > Does your Internet Service Provider (ISP) block or otherwise censor
> connections
> > to the Tor network?
>
> Select 'Yes' and then click 'Next'. To configure your new bridges, copy
> and
> paste the bridge lines into the text input box. Finally, click 'Connect',
> and
> you should be good to go! If you experience trouble, try clicking the
> 'Help'
> button in the 'Tor Network Settings' wizard for further assistance.
>
> [0]: https://www.torproject.org/projects/torbrowser.html.en#downloads-
> beta
>
>
> COMMANDs: (combine COMMANDs to specify multiple options simultaneously)
> get bridges Request vanilla bridges.
> get transport [TYPE] Request a Pluggable Transport by TYPE.
> get help Displays this message.
> get key Get a copy of BridgeDB's public GnuPG key.
> get ipv6 Request IPv6 bridges.
>
> Currently supported transport TYPEs:
> obfs2
> obfs3
> scramblesuit
>
> --
> <3 BridgeDB
>
> ----------------------------------------------------------------------
> Public Keys: https://bridges.torproject.org/keys
> This email was generated with rainbows, unicorns, and sparkles
> for isislovecruft at gmail.com on Wednesday, 21 May, 2014 at 15:30:31.
>
> 15:30:31 INFO L655:server.reply() Sending reply to
> isislovecruft at gmail.com
> }}}
>
> The other two bugs detailed in the above commit message are tickets #XXX
> and #XXX respectively.
New description:
From
[https://gitweb.torproject.org/user/isis/bridgedb.git/commitdiff/4c18a4e2b89872c5731d4301665642065980086e
this commit message] for
[https://gitweb.torproject.org/user/isis/bridgedb.git/blob/4c18a4e2b89872c5731d4301665642065980086e:/lib/bridgedb/test/test_email_server.py#l326
this unittest which reproduces the issue] and which is [https://travis-
ci.org/isislovecruft/bridgedb/jobs/25714425#L1679 currently failing with
this error]:
> BridgeDB's current code will accept an incoming email with a `To:
givemebridges at serious.ly` header. However, BridgeDB's reply will still
contain: `From: bridges at torproject.org`.
>
> Obviously, it ''shouldn't'' be possible for any email whose SMTP `RCPT
TO` domain is `'serious.ly'` to actually end up in BridgeDB's mail queue.
Though, if the outside SMTP layer is sent to
`'[bridges|ponticum].torproject.org'` (with `MAIL FROM:` a gmail/yahoo
address), these messages still end up in BridgeDB's mail queue.
>
> The following netcat session demonstrates that this is possible:
>
> {{{
> ∃!isisⒶwintermute:(master *$=)~ ∴ torsocks nc bridges.torproject.org
25
> 220 ponticum.torproject.org ESMTP Postfix (Debian/GNU)
> HELO ponticum.torproject.org
> 250 ponticum.torproject.org
> MAIL FROM: isisgrimalkin at gmail.com
> 250 2.1.0 Ok
> RCPT TO: bridges at bridges.torproject.org
> 250 2.1.5 Ok
> DATA
> 354 End data with <CR><LF>.<CR><LF>
> From: isislovecruft at gmail.com
> To: givemebridgesrightnow at serious.ly
> Subject: mwhahaha
>
> get transport obfs3
> .
> 250 2.0.0 Ok: queued as F03972834F
> QUIT
> 221 2.0.0 Bye
> }}}
>
> This request resulted in the following...
Although these logs ''were'' taken from the currently live server, they
are "sanitised".¹
¹ Where "sanitised" means "all bridge info, including IP addresses and
hashes, are faked" and "all email addresses are mine".
> ...debug logs:
>
> {{{
> 15:30:31 DEBUG L690:server.validateFrom() ORIGIN:
"'<bridgedb at ponticum>'"
> 15:30:31 DEBUG L699:server.validateFrom() Got canonical domain:
'ponticum'
> 15:30:31 DEBUG L495:server.lineReceived() > Received: from
ponticum (ponticum [127.0.0.1]) for <bridges at bridgedb>; Wed, 21 May 2014
15:30:31 +0000
> 15:30:31 DEBUG L495:server.lineReceived() > From
isisgrimalkin at gmail.com Wed May 21 15:30:31 2014
> 15:30:31 DEBUG L495:server.lineReceived() > X-Original-To:
bridges at bridges.torproject.org
> 15:30:31 DEBUG L495:server.lineReceived() > Delivered-To:
bridgedb at ponticum.torproject.org
> 15:30:31 DEBUG L495:server.lineReceived() > Received: from
ponticum.torproject.org (kpebetka.net [95.79.25.182])
> 15:30:31 DEBUG L495:server.lineReceived() > by
ponticum.torproject.org (Postfix) with SMTP id F03972834F
> 15:30:31 DEBUG L495:server.lineReceived() > for
<bridges at bridges.torproject.org>; Wed, 21 May 2014 15:29:18 +0000 (UTC)
> 15:30:31 DEBUG L495:server.lineReceived() > From:
isislovecruft at gmail.com
> 15:30:31 DEBUG L495:server.lineReceived() > To:
givemebridgesrightnow at serious.ly
> 15:30:31 DEBUG L495:server.lineReceived() > Subject: mwhahaha
> 15:30:31 DEBUG L495:server.lineReceived() > X-DKIM-Authentication-
Results: dunno
> 15:30:31 DEBUG L495:server.lineReceived() > Date: Wed, 21 May 2014
15:30:31 -0000
> 15:30:31 DEBUG L495:server.lineReceived() > Message-Id:
<1400686231.135135.6548 at ponticum>
> 15:30:31 DEBUG L495:server.lineReceived() >
> 15:30:31 DEBUG L495:server.lineReceived() > get transport obfs3
> 15:30:31 DEBUG L495:server.lineReceived() >
> 15:30:31 INFO L611:server.reply() Got an email; deciding
whether to reply.
> 15:30:31 INFO L646:server.reply() Client requested email
translation: en
> 15:30:31 DEBUG L70:request.determineBridg() Email request was valid.
> 15:30:31 DEBUG L160:request.withPluggableT() Parsing 'transport'
line: 'get transport obfs3'
> 15:30:31 INFO L169:request.withPluggableT() Email requested
transport type: 'obfs3'
> 15:30:31 DEBUG L81:request.determineBridg() Generating hashring
filters for request.
> 15:30:31 INFO L420:Dist.getBridgesForEmai() Attempting to return for
3 bridges for isislovecruft at gmail.com...
> 15:30:31 DEBUG L445:Dist.getBridgesForEmai() Cache hit
frozenset([<function filterBridgesByTransport(obfs3,<class
'ipaddr.IPv4Address'>)>])
> 15:30:31 DEBUG L75:Dist.getNumBridgesPerA() Returning 3 bridges from
ring of len: 492
> 15:30:31 DEBUG L1034:Bridges.getBridges() Got duplicate bridge
'edfa2fd66533da52f40424bbe917bd03c8378c2d' in main hashring for position
'eda7f69f7c08bd80861c3afa2921168a007d9ae5'.
> 15:30:31 DEBUG L1034:Bridges.getBridges() Got duplicate bridge
'ed0b2fd66f398afbf10424bb911790faca9ddb8e' in main hashring for position
'eda7f69f7c08bd80861c3afa2921168a007d9ae5'.
> 15:30:31 DEBUG L183:server.generateRespons() Email contents:
> From: bridges at torproject.org
> To: isislovecruft at gmail.com
> Message-ID:
<20140521153031.21456.73227139.10726 at ponticum.torproject.org>
> In-Reply-To: <1400686231.135135.6548 at ponticum>
> Content-Type: text/plain; charset="utf-8"
> Date: Wed, 21 May 2014 15:30:31 +0000
> Subject: Re: mwhahaha
>
>
> Hey, isislovecruft!
>
> [This is an automated message; please do not reply.]
>
> Here are your bridges:
>
> obfs3 10.1.1.1:1111 d14133856abbba8a65607baebf692162c567bf41
> obfs3 10.2.2.2:2222 86f45ab5dcef80a4b1abfcc43579e76f1d0b25a4
> obfs3 10.3.3.3:3333 5d55daabd91e041e74f62dcfab1a29c8bb32f0b2
>
>
> To enter bridges into Tor Browser, follow the instructions on the Tor
> Browser download page [0] to start Tor Browser.
>
> When the 'Tor Network Settings' dialogue pops up, click 'Configure' and
follow
> the wizard until it asks:
>
> > Does your Internet Service Provider (ISP) block or otherwise censor
connections
> > to the Tor network?
>
> Select 'Yes' and then click 'Next'. To configure your new bridges, copy
and
> paste the bridge lines into the text input box. Finally, click
'Connect', and
> you should be good to go! If you experience trouble, try clicking the
'Help'
> button in the 'Tor Network Settings' wizard for further assistance.
>
> [0]: https://www.torproject.org/projects/torbrowser.html.en#downloads-
beta
>
>
>
> COMMANDs: (combine COMMANDs to specify multiple options simultaneously)
> get bridges Request vanilla bridges.
> get transport [TYPE] Request a Pluggable Transport by TYPE.
> get help Displays this message.
> get key Get a copy of BridgeDB's public GnuPG key.
> get ipv6 Request IPv6 bridges.
>
> Currently supported transport TYPEs:
> obfs2
> obfs3
> scramblesuit
>
>
> --
> <3 BridgeDB
>
> ----------------------------------------------------------------------
> Public Keys: https://bridges.torproject.org/keys
> This email was generated with rainbows, unicorns, and sparkles
> for isislovecruft at gmail.com on Wednesday, 21 May, 2014 at 15:30:31.
>
>
> 15:30:31 INFO L655:server.reply() Sending reply to
isislovecruft at gmail.com
> }}}
>
The other two bugs detailed in the above commit message are tickets #12089
and #XXX respectively.
--
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12086#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
More information about the tor-bugs
mailing list