[or-cvs] r9191: Better handling of internal addresses wrt X-Your-Address-Is (in tor/trunk: . doc src/or)
nickm at seul.org
nickm at seul.org
Mon Dec 25 03:42:40 UTC 2006
Author: nickm
Date: 2006-12-24 22:42:38 -0500 (Sun, 24 Dec 2006)
New Revision: 9191
Modified:
tor/trunk/
tor/trunk/ChangeLog
tor/trunk/doc/TODO
tor/trunk/doc/dir-spec.txt
tor/trunk/src/or/connection_edge.c
tor/trunk/src/or/directory.c
tor/trunk/src/or/router.c
Log:
r11713 at Kushana: nickm | 2006-12-24 22:42:08 -0500
Better handling of internal addresses wrt X-Your-Address-Is (never believe them; never provide them.) Also, report something useful for X-Your-Address-Is with one-hop tunneled connections.
Property changes on: tor/trunk
___________________________________________________________________
svk:merge ticket from /tor/trunk [r11713] on c95137ef-5f19-0410-b913-86e773d04f59
Modified: tor/trunk/ChangeLog
===================================================================
--- tor/trunk/ChangeLog 2006-12-25 02:47:37 UTC (rev 9190)
+++ tor/trunk/ChangeLog 2006-12-25 03:42:38 UTC (rev 9191)
@@ -62,6 +62,9 @@
- When we get a 503 from a directory, and we're not a server, we don't
count the failure against the total number of failures allowed for the
thing we're trying to download.
+ - Report X-Your-Address-Is correctly from tunneled directory connections;
+ don't report X-Your-Address-Is is when it's an internal address; and
+ never believe reported remote addresses when they're internal.
o Security bugfixes:
- Stop sending the HttpProxyAuthenticator string to directory
Modified: tor/trunk/doc/TODO
===================================================================
--- tor/trunk/doc/TODO 2006-12-25 02:47:37 UTC (rev 9190)
+++ tor/trunk/doc/TODO 2006-12-25 03:42:38 UTC (rev 9191)
@@ -63,6 +63,8 @@
key=value syntax. so we could have a 'tor' version, but we
could also have a 'conn' version, a 'dir' version, etc down
the road. and one day maybe the 'tor' key would be deprecated.
+ o Give the right answer for X-Your-Address-Is on tunneled directory
+ connections.
o Document .noconnect addresses...
A new file 'address-spec.txt' that describes .exit, .onion,
Modified: tor/trunk/doc/dir-spec.txt
===================================================================
--- tor/trunk/doc/dir-spec.txt 2006-12-25 02:47:37 UTC (rev 9190)
+++ tor/trunk/doc/dir-spec.txt 2006-12-25 03:42:38 UTC (rev 9191)
@@ -854,6 +854,10 @@
Servers MAY include an X-Your-Address-Is: header, whose value is the
apparent IP address of the client connecting to them (as a dotted quad).
+ For directory connections tunneled over a BEGIN_DIR stream, servers SHOULD
+ report the IP from which the circuit carrying the BEGIN_DIR stream reached
+ them. [Servers before version 0.1.2.5-alpha reported 127.0.0.1 for all
+ BEGIN_DIR-tunneled connections.]
Servers SHOULD disable caching of multiple network statuses or multiple
router descriptors. Servers MAY enable caching of single descriptors,
Modified: tor/trunk/src/or/connection_edge.c
===================================================================
--- tor/trunk/src/or/connection_edge.c 2006-12-25 02:47:37 UTC (rev 9190)
+++ tor/trunk/src/or/connection_edge.c 2006-12-25 03:42:38 UTC (rev 9191)
@@ -1963,8 +1963,11 @@
char *address=NULL;
uint16_t port;
char end_payload[1];
+ or_circuit_t *or_circ = NULL;
assert_circuit_ok(circ);
+ if (!CIRCUIT_IS_ORIGIN(circ))
+ or_circ = TO_OR_CIRCUIT(circ);
relay_header_unpack(&rh, cell->payload);
@@ -2022,7 +2025,7 @@
return 0;
}
#endif
- if (!CIRCUIT_IS_ORIGIN(circ) && TO_OR_CIRCUIT(circ)->is_first_hop) {
+ if (or_circ && or_circ->is_first_hop) {
/* Don't let clients use us as a single-hop proxy; it attracts attackers
* and users who'd be better off with, well, single-hop proxies.
*/
@@ -2043,7 +2046,10 @@
end_payload, 1, NULL);
return 0;
}
- address = tor_strdup("127.0.0.1");
+ if (or_circ && or_circ->p_conn && or_circ->p_conn->_base.address)
+ address = tor_strdup(or_circ->p_conn->_base.address);
+ else
+ address = tor_strdup("127.0.0.1");
} else {
log_warn(LD_BUG, "Got an unexpected command %d", (int)rh.command);
end_payload[0] = END_STREAM_REASON_INTERNAL;
@@ -2112,6 +2118,8 @@
log_debug(LD_EXIT,"about to start the dns_resolve().");
if (rh.command == RELAY_COMMAND_BEGIN_DIR) {
+ if (or_circ && or_circ->p_conn && or_circ->p_conn->_base.addr)
+ n_stream->_base.addr = or_circ->p_conn->_base.addr;
n_stream->next_stream = TO_OR_CIRCUIT(circ)->n_streams;
n_stream->on_circuit = circ;
TO_OR_CIRCUIT(circ)->n_streams = n_stream;
Modified: tor/trunk/src/or/directory.c
===================================================================
--- tor/trunk/src/or/directory.c 2006-12-25 02:47:37 UTC (rev 9190)
+++ tor/trunk/src/or/directory.c 2006-12-25 03:42:38 UTC (rev 9191)
@@ -1353,10 +1353,15 @@
format_rfc1123_time(date, now);
cp = tmp;
tor_snprintf(cp, sizeof(tmp),
- "HTTP/1.0 200 OK\r\nDate: %s\r\nContent-Type: %s\r\n"
- X_ADDRESS_HEADER "%s\r\n",
- date, type, conn->_base.address);
+ "HTTP/1.0 200 OK\r\nDate: %s\r\nContent-Type: %s\r\n",
+ date, type);
cp += strlen(tmp);
+ if (!is_internal_IP(conn->_base.addr, 0)) {
+ /* Don't report the source address for a localhost/private connection. */
+ tor_snprintf(cp, sizeof(tmp)-(cp-tmp),
+ X_ADDRESS_HEADER "%s\r\n", conn->_base.address);
+ cp += strlen(cp);
+ }
if (encoding) {
tor_snprintf(cp, sizeof(tmp)-(cp-tmp),
"Content-Encoding: %s\r\n", encoding);
Modified: tor/trunk/src/or/router.c
===================================================================
--- tor/trunk/src/or/router.c 2006-12-25 02:47:37 UTC (rev 9190)
+++ tor/trunk/src/or/router.c 2006-12-25 03:42:38 UTC (rev 9191)
@@ -1034,7 +1034,14 @@
last_guessed_ip = cur; /* store it in case we need it later */
return;
}
+ if (is_internal_IP(addr, 0)) {
+ /* Don't believe anybody who says our IP is, say, 127.0.0.1. */
+ return;
+ }
+ /* Okay. We can't resolve our own address, and X-Your-Address-Is is giving
+ * us an answer different from what we had the last time we managed to
+ * resolve it. */
if (last_guessed_ip != addr) {
log_addr_has_changed(LOG_NOTICE, last_guessed_ip, addr);
server_has_changed_ip();
More information about the tor-commits
mailing list