From: Roger Dingledine <arma@torproject.org>
Date: Wed, 28 Sep 2011 18:50:43 +0000 (-0400)
Subject: bug 4115: make bridges use begindir for their dir fetches
X-Git-Tag: tor-0.2.3.5-alpha~6^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0b5d2646d56fe351b8b2b4bc97bbad30cb34b6d4;p=thirdparty%2Ftor.git

bug 4115: make bridges use begindir for their dir fetches

removes another avenue for enumerating bridges.
---

diff --git a/changes/bug4115 b/changes/bug4115
new file mode 100644
index 0000000000..626791a806
--- /dev/null
+++ b/changes/bug4115
@@ -0,0 +1,7 @@
+  o Security fixes:
+    - Bridge relays now do their directory fetches inside Tor TLS
+      connections, like all the other clients do, rather than connecting
+      directly to the DirPort like public relays do. Removes another
+      avenue for enumerating bridges. Fixes part of bug 4115; bugfix
+      on 0.2.0.35.
+
diff --git a/src/or/directory.c b/src/or/directory.c
index 52fec6b61a..e3cc70f91f 100644
--- a/src/or/directory.c
+++ b/src/or/directory.c
@@ -785,8 +785,7 @@ directory_command_should_use_begindir(or_options_t *options,
     return 0; /* We don't know an ORPort -- no chance. */
   if (!anonymized_connection)
     if (!fascist_firewall_allows_address_or(addr, or_port) ||
-        directory_fetches_from_authorities(options) ||
-        (server_mode(options) && !options->Address))
+        directory_fetches_from_authorities(options))
       return 0; /* We're firewalled or are acting like a relay -- also no. */
   if (!options->TunnelDirConns &&
       router_purpose != ROUTER_PURPOSE_BRIDGE)