torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'maint-0.4.5' into release-0.4.5

Browse Source
This commit is contained in:
David Goulet
2021-10-06 13:24:22 -04:00
parent 0a02fd7445 f0d1240a07
commit ac623fa2ac
2 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/ticket40474
+5
View File
@@ -0,0 +1,5 @@
o Minor bugfixes (onion service, TROVE-2021-008):
- Only log once any v2 access attempts in order to not pollute the logs
with warnings and avoid recording the times on disk when v2 access was
attempted. Important to note that the onion address was _never_ logged.
That is a Low security issue. Fixes bug 40474; bugfix on 0.4.5.8.
src/core/or/connection_edge.c
+10 -6
View File
@@ -2584,12 +2584,16 @@ connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn,
tor_assert(!automap);
if (addresstype == ONION_V2_HOSTNAME) {
log_warn(LD_PROTOCOL,
"Warning! You've just connected to a v2 onion address. These "
"addresses are deprecated for security reasons, and are no "
"longer supported in Tor. Please encourage the site operator "
"to upgrade. For more information see "
"https://blog.torproject.org/v2-deprecation-timeline");
static bool log_once = false;
if (!log_once) {
log_warn(LD_PROTOCOL,
"Warning! You've just connected to a v2 onion address. These "
"addresses are deprecated for security reasons, and are no "
"longer supported in Tor. Please encourage the site operator "
"to upgrade. For more information see "
"https://blog.torproject.org/v2-deprecation-timeline");
log_once = true;
}
}
return connection_ap_handle_onion(conn, socks, circ, addresstype);