Warn and ignore the MyFamily setting if BridgeRelay is also set

Roger explains at
  http://archives.seul.org/tor/talk/Nov-2011/msg00209.html :

  "If you list your bridge as part of your family in the relay
  descriptor, then everybody can learn your bridge fingerprint, and
  they can look up your bridge's descriptor (and thus location) at
  the bridge directory authority."

Now, we can't stop relays from listing bridges, but we can warn when
we notice a bridge listing anybody, which might help some.

This fixes bug 4657; it's a fix on 0.2.0.3-alpha, where bridges were
first introduced.

diff --git a/changes/bug4657 b/changes/bug4657
new file mode 100644 (file)
index 0000000..4d9dd7d
--- /dev/null
+++ b/changes/bug4657
@@ -0,0 +1,4 @@
+  o Minor bugfixes:
+    - If the configuration tries to set MyFamily on a bridge, refuse to
+      do so, and warn about the security implications. Fix for bug 4657;
+      bugfix on 0.2.0.3-alpha.

diff --git a/src/or/config.c b/src/or/config.c
index 090aba1c7a1c76f724998c581a7cf77afecc55ae..58c76b4fba3bec588b5ce0a2a2573566cb0d6268 100644 (file)
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -3601,6 +3601,12 @@ options_validate(or_options_t *old_options, or_options_t *options,
   if (options->UseEntryGuards && ! options->NumEntryGuards)
     REJECT("Cannot enable UseEntryGuards with NumEntryGuards set to 0");
 
+  if (options->MyFamily && options->BridgeRelay) {
+    log_warn(LD_CONFIG, "Listing a family for a bridge relay is not "
+             "supported: it can reveal bridge fingerprints to censors. "
+             "You should also make sure you aren't listing this bridge's "
+             "fingerprint in any other MyFamily.");
+  }
   if (check_nickname_list(options->MyFamily, "MyFamily", msg))
     return -1;
   for (cl = options->NodeFamilies; cl; cl = cl->next) {

diff --git a/src/or/router.c b/src/or/router.c
index 365e888af94fe5269b0620211204dcb56ac4bb05..191944815237b4efea8e55580643dd6fc6c42390 100644 (file)
--- a/src/or/router.c
+++ b/src/or/router.c
@@ -1483,7 +1483,7 @@ router_rebuild_descriptor(int force)
   }
   if (authdir_mode(options))
     ri->is_valid = ri->is_named = 1; /* believe in yourself */
-  if (options->MyFamily) {
+  if (options->MyFamily && ! options->BridgeRelay) {
     smartlist_t *family;
     if (!warned_nonexistent_family)
       warned_nonexistent_family = smartlist_create();