Reject create cells on outgoing OR connections from bridges

diff --git a/changes/issue-2011-10-23G b/changes/issue-2011-10-23G
new file mode 100644 (file)
index 0000000..45f8675
--- /dev/null
+++ b/changes/issue-2011-10-23G
@@ -0,0 +1,9 @@
+  o Security fixes:
+
+    - Reject CREATE and CREATE_FAST cells on outgoing OR connections
+      from a bridge to a relay.  Previously, we would accept them and
+      handle them normally, thereby allowing a malicious relay to
+      easily distinguish bridges which connect to it from clients.
+      Fixes CVE-2011-2769.  Bugfix on 0.2.0.3-alpha, when bridges were
+      implemented; found by frosty_un.
+

diff --git a/src/or/command.c b/src/or/command.c
index a17a3a602545d7da7c554dac6b1b2c44e7096988..54f23bb0cd576f59d2b78b843512185400db70ac 100644 (file)
--- a/src/or/command.c
+++ b/src/or/command.c
@@ -219,6 +219,7 @@ static void
 command_process_create_cell(cell_t *cell, or_connection_t *conn)
 {
   or_circuit_t *circ;
+  or_options_t *options = get_options();
   int id_is_high;
 
   if (we_are_hibernating()) {
@@ -230,9 +231,11 @@ command_process_create_cell(cell_t *cell, or_connection_t *conn)
     return;
   }
 
-  if (!server_mode(get_options())) {
+  if (!server_mode(options) ||
+      (!public_server_mode(options) && conn->is_outgoing)) {
     log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
-           "Received create cell (type %d) from %s:%d, but we're a client. "
+           "Received create cell (type %d) from %s:%d, but we're connected "
+           "to it as a client. "
            "Sending back a destroy.",
            (int)cell->command, conn->_base.address, conn->_base.port);
     connection_or_send_destroy(cell->circ_id, conn,