[tor-commits] [tor/master] Don't allow a rendezvous point to have a private address

[nickm at torproject.org]

commit 4a7964b3bcfa5439ba10e227c2ca8a4564123538
Author: David Goulet <dgoulet at ev0ke.net>
Date:   Tue Dec 8 13:42:27 2015 -0500

    Don't allow a rendezvous point to have a private address
    
    When an HS process an INTRODUCE2 cell, we didn't validate if the IP address
    of the rendezvous point was a local address. If it's the case, we end up
    wasting resources by trying to extend to a local address which fails since
    we do not allow that in circuit_extend().
    
    This commit now rejects a rendezvous point that has a local address once
    seen at the hidden service side unless ExtendAllowPrivateAddresses is set.
    
    Fixes #8976
    
    Signed-off-by: David Goulet <dgoulet at ev0ke.net>
---
 src/or/circuitbuild.c | 15 +++++++++++++++
 src/or/circuitbuild.h |  1 +
 src/or/rendservice.c  | 12 ++++++++++++
 3 files changed, 28 insertions(+)

diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c
index 0688398..6a3c164 100644
--- a/src/or/circuitbuild.c
+++ b/src/or/circuitbuild.c
@@ -2403,3 +2403,18 @@ build_state_get_exit_nickname(cpath_build_state_t *state)
   return state->chosen_exit->nickname;
 }
 
+/** Return true iff the given address can be used to extend to. */
+int extend_info_addr_is_allowed(const tor_addr_t *addr)
+{
+  tor_assert(addr);
+
+  /* Check if we have a private address and if we can extend to it. */
+  if (tor_addr_is_internal(addr, 0) &&
+      !get_options()->ExtendAllowPrivateAddresses) {
+    goto disallow;
+  }
+  /* Allowed! */
+  return 1;
+ disallow:
+  return 0;
+}
diff --git a/src/or/circuitbuild.h b/src/or/circuitbuild.h
index 0156379..5d6222e 100644
--- a/src/or/circuitbuild.h
+++ b/src/or/circuitbuild.h
@@ -53,6 +53,7 @@ extend_info_t *extend_info_new(const char *nickname, const char *digest,
 extend_info_t *extend_info_from_node(const node_t *r, int for_direct_connect);
 extend_info_t *extend_info_dup(extend_info_t *info);
 void extend_info_free(extend_info_t *info);
+int extend_info_addr_is_allowed(const tor_addr_t *addr);
 const node_t *build_state_get_exit_node(cpath_build_state_t *state);
 const char *build_state_get_exit_nickname(cpath_build_state_t *state);
 
diff --git a/src/or/rendservice.c b/src/or/rendservice.c
index 15d98bf..aad47bb 100644
--- a/src/or/rendservice.c
+++ b/src/or/rendservice.c
@@ -1818,6 +1818,18 @@ find_rp_for_intro(const rend_intro_cell_t *intro,
     goto err;
   }
 
+  /* Make sure the RP we are being asked to connect to is _not_ a private
+   * address unless it's allowed. Let's avoid to build a circuit to our
+   * second middle node and fail right after when extending to the RP. */
+  if (!extend_info_addr_is_allowed(&rp->addr)) {
+    if (err_msg_out) {
+      tor_asprintf(&err_msg,
+                   "Relay IP in INTRODUCE2 cell is private address.");
+    }
+    extend_info_free(rp);
+    rp = NULL;
+    goto err;
+  }
   goto done;
 
  err: