[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-commits] [tor/release-0.2.1] Check fetched rendezvous descriptors' service IDs
commit 7571e9f1cb81927c5bd47190409a30c7f23ea4a1
Author: Robert Ransom <rransom.8774@xxxxxxxxx>
Date: Wed Apr 27 13:37:08 2011 -0700
Check fetched rendezvous descriptors' service IDs
---
changes/check-fetched-rend-desc-service-id | 7 +++++++
src/or/directory.c | 5 +++--
src/or/or.h | 3 ++-
src/or/rendcommon.c | 22 +++++++++++++++++++++-
4 files changed, 33 insertions(+), 4 deletions(-)
diff --git a/changes/check-fetched-rend-desc-service-id b/changes/check-fetched-rend-desc-service-id
new file mode 100644
index 0000000..2f37c30
--- /dev/null
+++ b/changes/check-fetched-rend-desc-service-id
@@ -0,0 +1,7 @@
+ o Security fixes:
+ - When fetching a hidden service descriptor, check that it is for
+ the hidden service we were trying to connect to, in order to
+ stop a directory from pre-seeding a client with a descriptor for
+ a hidden service that they didn't want. Bugfix on 0.0.6.
+
+
diff --git a/src/or/directory.c b/src/or/directory.c
index 01f3375..9f9b2c1 100644
--- a/src/or/directory.c
+++ b/src/or/directory.c
@@ -1909,7 +1909,8 @@ connection_dir_client_reached_eof(dir_connection_t *conn)
(int)body_len, status_code, escaped(reason));
switch (status_code) {
case 200:
- if (rend_cache_store(body, body_len, 0) < -1) {
+ if (rend_cache_store(body, body_len, 0,
+ conn->rend_data->onion_address) < -1) {
log_warn(LD_REND,"Failed to parse rendezvous descriptor.");
/* Any pending rendezvous attempts will notice when
* connection_about_to_close_connection()
@@ -3114,7 +3115,7 @@ directory_handle_command_post(dir_connection_t *conn, const char *headers,
!strcmpstart(url,"/tor/rendezvous/publish")) {
/* rendezvous descriptor post */
log_info(LD_REND, "Handling rendezvous descriptor post.");
- if (rend_cache_store(body, body_len, 1) < 0) {
+ if (rend_cache_store(body, body_len, 1, NULL) < 0) {
log_fn(LOG_PROTOCOL_WARN, LD_DIRSERV,
"Rejected rend descriptor (length %d) from %s.",
(int)body_len, conn->_base.address);
diff --git a/src/or/or.h b/src/or/or.h
index 897ad32..976ba9f 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -4146,7 +4146,8 @@ int rend_cache_lookup_desc(const char *query, int version, const char **desc,
int rend_cache_lookup_entry(const char *query, int version,
rend_cache_entry_t **entry_out);
int rend_cache_lookup_v2_desc_as_dir(const char *query, const char **desc);
-int rend_cache_store(const char *desc, size_t desc_len, int published);
+int rend_cache_store(const char *desc, size_t desc_len, int published,
+ const char *service_id);
int rend_cache_store_v2_desc_as_client(const char *desc,
const rend_data_t *rend_query);
int rend_cache_store_v2_desc_as_dir(const char *desc);
diff --git a/src/or/rendcommon.c b/src/or/rendcommon.c
index c83573b..8727a70 100644
--- a/src/or/rendcommon.c
+++ b/src/or/rendcommon.c
@@ -1047,9 +1047,14 @@ rend_cache_lookup_v2_desc_as_dir(const char *desc_id, const char **desc)
*
* The published flag tells us if we store the descriptor
* in our role as directory (1) or if we cache it as client (0).
+ *
+ * If <b>service_id</b> is non-NULL and the descriptor is not for that
+ * service ID, reject it. <b>service_id</b> must be specified if and
+ * only if <b>published</b> is 0 (we fetched this descriptor).
*/
int
-rend_cache_store(const char *desc, size_t desc_len, int published)
+rend_cache_store(const char *desc, size_t desc_len, int published,
+ const char *service_id)
{
rend_cache_entry_t *e;
rend_service_descriptor_t *parsed;
@@ -1068,6 +1073,12 @@ rend_cache_store(const char *desc, size_t desc_len, int published)
rend_service_descriptor_free(parsed);
return -2;
}
+ if ((service_id != NULL) && strcmp(query, service_id)) {
+ log_warn(LD_REND, "Received service descriptor for service ID %s; "
+ "expected descriptor for service ID %s.",
+ query, safe_str(service_id));
+ return -2;
+ }
now = time(NULL);
if (parsed->timestamp < now-REND_CACHE_MAX_AGE-REND_CACHE_MAX_SKEW) {
log_fn(LOG_PROTOCOL_WARN, LD_REND,
@@ -1253,6 +1264,8 @@ rend_cache_store_v2_desc_as_dir(const char *desc)
* If we have an older descriptor with the same ID, replace it.
* If we have any v0 descriptor with the same ID, reject this one in order
* to not get confused with having both versions for the same service.
+ * If the descriptor's service ID does not match
+ * <b>rend_query</b>-\>onion_address, reject it.
* Return -2 if it's malformed or otherwise rejected; return -1 if we
* already have a v0 descriptor here; return 0 if it's the same or older
* than one we've already got; return 1 if it's novel.
@@ -1303,6 +1316,13 @@ rend_cache_store_v2_desc_as_client(const char *desc,
retval = -2;
goto err;
}
+ if (strcmp(rend_query->onion_address, service_id)) {
+ log_warn(LD_REND, "Received service descriptor for service ID %s; "
+ "expected descriptor for service ID %s.",
+ service_id, safe_str(rend_query->onion_address));
+ retval = -2;
+ goto err;
+ }
/* Decode/decrypt introduction points. */
if (intro_content) {
if (rend_query->auth_type != REND_NO_AUTH &&
_______________________________________________
tor-commits mailing list
tor-commits@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-commits