torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add client code to detect attempts to connect to 127.0.0.1 etc

Browse Source 
We detect and reject said attempts if there is no chosen exit node or
circuit: connecting to a private addr via a randomly chosen exit node
will usually fail (if all exits reject private addresses), is always
ill-defined (you're not asking for any particular host or service),
and usually an error (you've configured all requests to go over Tor
when you really wanted to configure all _remote_ requests to go over
Tor).

This can also help detect forwarding loop requests.

Found as part of bug2279.
This commit is contained in:
Nick Mathewson
2011-01-25 20:39:44 -05:00
parent 85da676108
commit 411ec3c0f8
6 changed files with 48 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/or/connection_edge.c
+21
View File
@@ -1659,6 +1659,27 @@ connection_ap_handshake_rewrite_and_attach(edge_connection_t *conn,
connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
return -1;
}
if (!conn->use_begindir && !conn->chosen_exit_name && !circ) {
tor_addr_t addr;
if (tor_addr_from_str(&addr, socks->address) >= 0 &&
tor_addr_is_internal(&addr, 0)) {
/* If this is an explicit private address with no chosen exit node,
* then we really don't want to try to connect to it. That's
* probably an error. */
if (conn->is_transparent_ap) {
log_warn(LD_NET,
"Rejecting request for anonymous connection to private "
"address %s on a TransPort or NatdPort. Possible loop "
"in your NAT rules?", safe_str_client(socks->address));
} else {
log_warn(LD_NET,
"Rejecting SOCKS request for anonymous connection to "
"private address %s", safe_str_client(socks->address));
}
connection_mark_unattached_ap(conn, END_STREAM_REASON_PRIVATE_ADDR);
return -1;
}
}
if (!conn->use_begindir && !conn->chosen_exit_name && !circ) {
/* see if we can find a suitable enclave exit */