[tor-commits] [tor/maint-0.2.2] Reject create cells on outgoing OR connections from bridges

[arma at torproject.org]

commit a74e7fd40f1a77eb4000d8216bb5b80cdd8a6193
Author: Robert Ransom <rransom.8774 at gmail.com>
Date:   Sun Oct 23 15:21:49 2011 -0700

    Reject create cells on outgoing OR connections from bridges
---
 changes/issue-2011-10-23G |    9 +++++++++
 src/or/command.c          |    7 +++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/changes/issue-2011-10-23G b/changes/issue-2011-10-23G
new file mode 100644
index 0000000..45f8675
--- /dev/null
+++ b/changes/issue-2011-10-23G
@@ -0,0 +1,9 @@
+  o Security fixes:
+
+    - Reject CREATE and CREATE_FAST cells on outgoing OR connections
+      from a bridge to a relay.  Previously, we would accept them and
+      handle them normally, thereby allowing a malicious relay to
+      easily distinguish bridges which connect to it from clients.
+      Fixes CVE-2011-2769.  Bugfix on 0.2.0.3-alpha, when bridges were
+      implemented; found by frosty_un.
+
diff --git a/src/or/command.c b/src/or/command.c
index a17a3a6..54f23bb 100644
--- a/src/or/command.c
+++ b/src/or/command.c
@@ -219,6 +219,7 @@ static void
 command_process_create_cell(cell_t *cell, or_connection_t *conn)
 {
   or_circuit_t *circ;
+  or_options_t *options = get_options();
   int id_is_high;
 
   if (we_are_hibernating()) {
@@ -230,9 +231,11 @@ command_process_create_cell(cell_t *cell, or_connection_t *conn)
     return;
   }
 
-  if (!server_mode(get_options())) {
+  if (!server_mode(options) ||
+      (!public_server_mode(options) && conn->is_outgoing)) {
     log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
-           "Received create cell (type %d) from %s:%d, but we're a client. "
+           "Received create cell (type %d) from %s:%d, but we're connected "
+           "to it as a client. "
            "Sending back a destroy.",
            (int)cell->command, conn->_base.address, conn->_base.port);
     connection_or_send_destroy(cell->circ_id, conn,