diff --git a/changes/issue-2011-10-19L b/changes/issue-2011-10-19L
new file mode 100644
index 0000000000..b879c9d401
--- /dev/null
+++ b/changes/issue-2011-10-19L
@@ -0,0 +1,28 @@
+ o Security fixes:
+
+ - Don't send TLS certificate chains on outgoing OR connections
+ from clients and bridges. Previously, each client or bridge
+ would use a single cert chain for all outgoing OR connections
+ for up to 24 hours, which allowed any relay connected to by a
+ client or bridge to determine which entry guards it is using.
+ This is a potential user-tracing bug for *all* users; everyone
+ who uses Tor's client or hidden service functionality should
+ upgrade. Fixes CVE-2011-2768. Bugfix on FIXME; found by
+ frosty_un.
+
+ - Don't use any OR connection on which we have received a
+ CREATE_FAST cell to satisfy an EXTEND request. Previously, we
+ would not consider whether a connection appears to be from a
+ client or bridge when deciding whether to use that connection to
+ satisfy an EXTEND request. Mitigates CVE-2011-2768, by
+ preventing an attacker from determining whether an unpatched
+ client is connected to a patched relay. Bugfix on FIXME; found
+ by frosty_un.
+
+ - Don't assign the Guard flag to relays running a version of Tor
+ which would use an OR connection on which it has received a
+ CREATE_FAST cell to satisfy an EXTEND request. Mitigates
+ CVE-2011-2768, by ensuring that clients will not connect
+ directly to any relay which an attacker could probe for an
+ unpatched client's connections.
+
diff --git a/changes/issue-2011-10-23G b/changes/issue-2011-10-23G
new file mode 100644
index 0000000000..45f86754f0
--- /dev/null
+++ b/changes/issue-2011-10-23G
@@ -0,0 +1,9 @@
+ o Security fixes:
+
+ - Reject CREATE and CREATE_FAST cells on outgoing OR connections
+ from a bridge to a relay. Previously, we would accept them and
+ handle them normally, thereby allowing a malicious relay to
+ easily distinguish bridges which connect to it from clients.
+ Fixes CVE-2011-2769. Bugfix on 0.2.0.3-alpha, when bridges were
+ implemented; found by frosty_un.
+
diff --git a/src/common/tortls.c b/src/common/tortls.c
index 10f4440cb4..352c3d6176 100644
--- a/src/common/tortls.c
+++ b/src/common/tortls.c
@@ -192,9 +192,11 @@ static X509* tor_tls_create_certificate(crypto_pk_env_t *rsa,
static void tor_tls_unblock_renegotiation(tor_tls_t *tls);
static int tor_tls_context_init_one(tor_tls_context_t **ppcontext,
crypto_pk_env_t *identity,
- unsigned int key_lifetime);
+ unsigned int key_lifetime,
+ int is_client);
static tor_tls_context_t *tor_tls_context_new(crypto_pk_env_t *identity,
- unsigned int key_lifetime);
+ unsigned int key_lifetime,
+ int is_client);
/** Global TLS contexts. We keep them here because nobody else needs
* to touch them. */
@@ -653,7 +655,7 @@ tor_tls_context_init(int is_public_server,
rv1 = tor_tls_context_init_one(&server_tls_context,
server_identity,
- key_lifetime);
+ key_lifetime, 0);
if (rv1 >= 0) {
new_ctx = server_tls_context;
@@ -669,7 +671,8 @@ tor_tls_context_init(int is_public_server,
if (server_identity != NULL) {
rv1 = tor_tls_context_init_one(&server_tls_context,
server_identity,
- key_lifetime);
+ key_lifetime,
+ 0);
} else {
tor_tls_context_t *old_ctx = server_tls_context;
server_tls_context = NULL;
@@ -681,7 +684,8 @@ tor_tls_context_init(int is_public_server,
rv2 = tor_tls_context_init_one(&client_tls_context,
client_identity,
- key_lifetime);
+ key_lifetime,
+ 1);
}
return MIN(rv1, rv2);
@@ -696,10 +700,12 @@ tor_tls_context_init(int is_public_server,
static int
tor_tls_context_init_one(tor_tls_context_t **ppcontext,
crypto_pk_env_t *identity,
- unsigned int key_lifetime)
+ unsigned int key_lifetime,
+ int is_client)
{
tor_tls_context_t *new_ctx = tor_tls_context_new(identity,
- key_lifetime);
+ key_lifetime,
+ is_client);
tor_tls_context_t *old_ctx = *ppcontext;
if (new_ctx != NULL) {
@@ -721,7 +727,8 @@ tor_tls_context_init_one(tor_tls_context_t **ppcontext,
* certificate.
*/
static tor_tls_context_t *
-tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime)
+tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime,
+ int is_client)
{
crypto_pk_env_t *rsa = NULL;
EVP_PKEY *pkey = NULL;
@@ -738,22 +745,26 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime)
goto error;
if (crypto_pk_generate_key(rsa)<0)
goto error;
- /* Create certificate signed by identity key. */
- cert = tor_tls_create_certificate(rsa, identity, nickname, nn2,
- key_lifetime);
- /* Create self-signed certificate for identity key. */
- idcert = tor_tls_create_certificate(identity, identity, nn2, nn2,
- IDENTITY_CERT_LIFETIME);
- if (!cert || !idcert) {
- log(LOG_WARN, LD_CRYPTO, "Error creating certificate");
- goto error;
+ if (!is_client) {
+ /* Create certificate signed by identity key. */
+ cert = tor_tls_create_certificate(rsa, identity, nickname, nn2,
+ key_lifetime);
+ /* Create self-signed certificate for identity key. */
+ idcert = tor_tls_create_certificate(identity, identity, nn2, nn2,
+ IDENTITY_CERT_LIFETIME);
+ if (!cert || !idcert) {
+ log(LOG_WARN, LD_CRYPTO, "Error creating certificate");
+ goto error;
+ }
}
result = tor_malloc_zero(sizeof(tor_tls_context_t));
result->refcnt = 1;
- result->my_cert = X509_dup(cert);
- result->my_id_cert = X509_dup(idcert);
- result->key = crypto_pk_dup_key(rsa);
+ if (!is_client) {
+ result->my_cert = X509_dup(cert);
+ result->my_id_cert = X509_dup(idcert);
+ result->key = crypto_pk_dup_key(rsa);
+ }
#ifdef EVERYONE_HAS_AES
/* Tell OpenSSL to only use TLS1 */
@@ -785,27 +796,31 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime)
#ifdef SSL_MODE_RELEASE_BUFFERS
SSL_CTX_set_mode(result->ctx, SSL_MODE_RELEASE_BUFFERS);
#endif
- if (cert && !SSL_CTX_use_certificate(result->ctx,cert))
- goto error;
- X509_free(cert); /* We just added a reference to cert. */
- cert=NULL;
- if (idcert) {
- X509_STORE *s = SSL_CTX_get_cert_store(result->ctx);
- tor_assert(s);
- X509_STORE_add_cert(s, idcert);
- X509_free(idcert); /* The context now owns the reference to idcert */
- idcert = NULL;
+ if (! is_client) {
+ if (cert && !SSL_CTX_use_certificate(result->ctx,cert))
+ goto error;
+ X509_free(cert); /* We just added a reference to cert. */
+ cert=NULL;
+ if (idcert) {
+ X509_STORE *s = SSL_CTX_get_cert_store(result->ctx);
+ tor_assert(s);
+ X509_STORE_add_cert(s, idcert);
+ X509_free(idcert); /* The context now owns the reference to idcert */
+ idcert = NULL;
+ }
}
SSL_CTX_set_session_cache_mode(result->ctx, SSL_SESS_CACHE_OFF);
- tor_assert(rsa);
- if (!(pkey = _crypto_pk_env_get_evp_pkey(rsa,1)))
- goto error;
- if (!SSL_CTX_use_PrivateKey(result->ctx, pkey))
- goto error;
- EVP_PKEY_free(pkey);
- pkey = NULL;
- if (!SSL_CTX_check_private_key(result->ctx))
- goto error;
+ if (!is_client) {
+ tor_assert(rsa);
+ if (!(pkey = _crypto_pk_env_get_evp_pkey(rsa,1)))
+ goto error;
+ if (!SSL_CTX_use_PrivateKey(result->ctx, pkey))
+ goto error;
+ EVP_PKEY_free(pkey);
+ pkey = NULL;
+ if (!SSL_CTX_check_private_key(result->ctx))
+ goto error;
+ }
{
crypto_dh_env_t *dh = crypto_dh_new(DH_TYPE_TLS);
tor_assert(dh);
diff --git a/src/or/command.c b/src/or/command.c
index 12b4c30f5c..1fa8bc6a7e 100644
--- a/src/or/command.c
+++ b/src/or/command.c
@@ -232,6 +232,7 @@ static void
command_process_create_cell(cell_t *cell, or_connection_t *conn)
{
or_circuit_t *circ;
+ or_options_t *options = get_options();
int id_is_high;
if (we_are_hibernating()) {
@@ -243,9 +244,11 @@ command_process_create_cell(cell_t *cell, or_connection_t *conn)
return;
}
- if (!server_mode(get_options())) {
+ if (!server_mode(options) ||
+ (!public_server_mode(options) && conn->is_outgoing)) {
log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
- "Received create cell (type %d) from %s:%d, but we're a client. "
+ "Received create cell (type %d) from %s:%d, but we're connected "
+ "to it as a client. "
"Sending back a destroy.",
(int)cell->command, conn->_base.address, conn->_base.port);
connection_or_send_destroy(cell->circ_id, conn,
@@ -305,7 +308,13 @@ command_process_create_cell(cell_t *cell, or_connection_t *conn)
* a CPU worker. */
char keys[CPATH_KEY_MATERIAL_LEN];
char reply[DIGEST_LEN*2];
+
tor_assert(cell->command == CELL_CREATE_FAST);
+
+ /* Make sure we never try to use the OR connection on which we
+ * received this cell to satisfy an EXTEND request, */
+ conn->is_connection_with_client = 1;
+
if (fast_server_handshake(cell->payload, (uint8_t*)reply,
(uint8_t*)keys, sizeof(keys))<0) {
log_warn(LD_OR,"Failed to generate key material. Closing.");
diff --git a/src/or/config.c b/src/or/config.c
index 230ccf25c0..78e433620d 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -269,6 +269,8 @@ static config_var_t _option_vars[] = {
V(GeoIPFile, FILENAME,
SHARE_DATADIR PATH_SEPARATOR "tor" PATH_SEPARATOR "geoip"),
#endif
+ V(GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays,
+ BOOL, "0"),
OBSOLETE("Group"),
V(HardwareAccel, BOOL, "0"),
V(AccelName, STRING, NULL),
diff --git a/src/or/connection_or.c b/src/or/connection_or.c
index c019f6592b..27a34d3d15 100644
--- a/src/or/connection_or.c
+++ b/src/or/connection_or.c
@@ -548,6 +548,11 @@ connection_or_get_for_extend(const char *digest,
tor_assert(tor_memeq(conn->identity_digest, digest, DIGEST_LEN));
if (conn->_base.marked_for_close)
continue;
+ /* Never return a connection on which the other end appears to be
+ * a client. */
+ if (conn->is_connection_with_client) {
+ continue;
+ }
/* Never return a non-open connection. */
if (conn->_base.state != OR_CONN_STATE_OPEN) {
/* If the address matches, don't launch a new connection for this
@@ -808,6 +813,8 @@ connection_or_connect(const tor_addr_t *_addr, uint16_t port,
conn->_base.state = OR_CONN_STATE_CONNECTING;
control_event_or_conn_status(conn, OR_CONN_EVENT_LAUNCHED, 0);
+ conn->is_outgoing = 1;
+
/* use a proxy server if available */
if (options->HTTPSProxy) {
using_proxy = 1;
diff --git a/src/or/dirserv.c b/src/or/dirserv.c
index 66079018ab..c427fe2ef3 100644
--- a/src/or/dirserv.c
+++ b/src/or/dirserv.c
@@ -2251,6 +2251,74 @@ get_possible_sybil_list(const smartlist_t *routers)
return omit_as_sybil;
}
+/** Return non-zero iff a relay running the Tor version specified in
+ * platform is suitable for use as a potential entry guard. */
+static int
+is_router_version_good_for_possible_guard(const char *platform)
+{
+ static int parsed_versions_initialized = 0;
+ static tor_version_t first_good_0_2_1_guard_version;
+ static tor_version_t first_good_0_2_2_guard_version;
+ static tor_version_t first_good_later_guard_version;
+
+ tor_version_t router_version;
+
+ /* XXX023 This block should be extracted into its own function. */
+ /* XXXX Begin code copied from tor_version_as_new_as (in routerparse.c) */
+ {
+ char *s, *s2, *start;
+ char tmp[128];
+
+ tor_assert(platform);
+
+ if (strcmpstart(platform,"Tor ")) /* nonstandard Tor; be safe and say yes */
+ return 1;
+
+ start = (char *)eat_whitespace(platform+3);
+ if (!*start) return 0;
+ s = (char *)find_whitespace(start); /* also finds '\0', which is fine */
+ s2 = (char*)eat_whitespace(s);
+ if (!strcmpstart(s2, "(r") || !strcmpstart(s2, "(git-"))
+ s = (char*)find_whitespace(s2);
+
+ if ((size_t)(s-start+1) >= sizeof(tmp)) /* too big, no */
+ return 0;
+ strlcpy(tmp, start, s-start+1);
+
+ if (tor_version_parse(tmp, &router_version)<0) {
+ log_info(LD_DIR,"Router version '%s' unparseable.",tmp);
+ return 1; /* be safe and say yes */
+ }
+ }
+ /* XXXX End code copied from tor_version_as_new_as (in routerparse.c) */
+
+ if (!parsed_versions_initialized) {
+ /* CVE-2011-2769 was fixed on the relay side in Tor versions
+ * 0.2.1.31, 0.2.2.34, and 0.2.3.6-alpha. */
+ tor_assert(tor_version_parse("0.2.1.31",
+ &first_good_0_2_1_guard_version)>=0);
+ tor_assert(tor_version_parse("0.2.2.34",
+ &first_good_0_2_2_guard_version)>=0);
+ tor_assert(tor_version_parse("0.2.3.6-alpha",
+ &first_good_later_guard_version)>=0);
+
+ /* Don't parse these constant version strings once for every relay
+ * for every vote. */
+ parsed_versions_initialized = 1;
+ }
+
+ return ((tor_version_same_series(&first_good_0_2_1_guard_version,
+ &router_version) &&
+ tor_version_compare(&first_good_0_2_1_guard_version,
+ &router_version) <= 0) ||
+ (tor_version_same_series(&first_good_0_2_2_guard_version,
+ &router_version) &&
+ tor_version_compare(&first_good_0_2_2_guard_version,
+ &router_version) <= 0) ||
+ (tor_version_compare(&first_good_later_guard_version,
+ &router_version) <= 0));
+}
+
/** Extract status information from ri and from other authority
* functions and store it in rs>. If naming, consider setting
* the named flag in rs.
@@ -2264,6 +2332,7 @@ set_routerstatus_from_routerinfo(routerstatus_t *rs,
int naming, int listbadexits,
int listbaddirs, int vote_on_hsdirs)
{
+ const or_options_t *options = get_options();
int unstable_version =
!tor_version_as_new_as(ri->platform,"0.1.1.16-rc-cvs");
memset(rs, 0, sizeof(routerstatus_t));
@@ -2294,7 +2363,9 @@ set_routerstatus_from_routerinfo(routerstatus_t *rs,
(router_get_advertised_bandwidth(ri) >= BANDWIDTH_TO_GUARANTEE_GUARD ||
router_get_advertised_bandwidth(ri) >=
MIN(guard_bandwidth_including_exits,
- guard_bandwidth_excluding_exits))) {
+ guard_bandwidth_excluding_exits)) &&
+ (options->GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays ||
+ is_router_version_good_for_possible_guard(ri->platform))) {
long tk = rep_hist_get_weighted_time_known(
ri->cache_info.identity_digest, now);
double wfu = rep_hist_get_weighted_fractional_uptime(
diff --git a/src/or/or.h b/src/or/or.h
index 31deb897c7..7d50e1f505 100644
--- a/src/or/or.h
+++ b/src/or/or.h
@@ -1068,6 +1068,12 @@ typedef struct or_connection_t {
* router itself has a problem.
*/
unsigned int is_bad_for_new_circs:1;
+ /** True iff we have decided that the other end of this connection
+ * is a client. Connections with this flag set should never be used
+ * to satisfy an EXTEND request. */
+ unsigned int is_connection_with_client:1;
+ /** True iff this is an outgoing connection. */
+ unsigned int is_outgoing:1;
uint8_t link_proto; /**< What protocol version are we using? 0 for
* "none negotiated yet." */
circid_t next_circ_id; /**< Which circ_id do we try to use next on
@@ -2666,6 +2672,10 @@ typedef struct {
* number of servers per IP address shared
* with an authority. */
+ /** Should we assign the Guard flag to relays which would allow
+ * exploitation of CVE-2011-2768 against their clients? */
+ int GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays;
+
char *AccountingStart; /**< How long is the accounting interval, and when
* does it start? */
uint64_t AccountingMax; /**< How many bytes do we allow per accounting
diff --git a/src/or/routerparse.c b/src/or/routerparse.c
index aed4fd131e..001c4d6c7f 100644
--- a/src/or/routerparse.c
+++ b/src/or/routerparse.c
@@ -572,7 +572,6 @@ static int check_signature_token(const char *digest,
int flags,
const char *doctype);
static crypto_pk_env_t *find_dir_signing_key(const char *str, const char *eos);
-static int tor_version_same_series(tor_version_t *a, tor_version_t *b);
#undef DEBUG_AREA_ALLOC
@@ -4556,7 +4555,7 @@ tor_version_compare(tor_version_t *a, tor_version_t *b)
/** Return true iff versions a and b belong to the same series.
*/
-static int
+int
tor_version_same_series(tor_version_t *a, tor_version_t *b)
{
tor_assert(a);
diff --git a/src/or/routerparse.h b/src/or/routerparse.h
index 8b8cde25f6..527de5dc8b 100644
--- a/src/or/routerparse.h
+++ b/src/or/routerparse.h
@@ -47,6 +47,7 @@ version_status_t tor_version_is_obsolete(const char *myversion,
int tor_version_parse(const char *s, tor_version_t *out);
int tor_version_as_new_as(const char *platform, const char *cutoff);
int tor_version_compare(tor_version_t *a, tor_version_t *b);
+int tor_version_same_series(tor_version_t *a, tor_version_t *b);
void sort_version_list(smartlist_t *lst, int remove_duplicates);
void assert_addr_policy_ok(smartlist_t *t);
void dump_distinct_digest_count(int severity);