Commit 0b5d2646 authored by Roger Dingledine's avatar Roger Dingledine
Browse files

bug 4115: make bridges use begindir for their dir fetches 

removes another avenue for enumerating bridges.
parent 1c2e4d13

changes/bug4115

0 → 100644
+7 −0
Changes for changes/bug4115: 7 added lines, 0 removed lines.
Original line number Diff line number Diff line 
  o Security fixes:

    - Bridge relays now do their directory fetches inside Tor TLS

      connections, like all the other clients do, rather than connecting

      directly to the DirPort like public relays do. Removes another

      avenue for enumerating bridges. Fixes part of bug 4115; bugfix

      on 0.2.0.35.

src/or/directory.c

+1 −2
Changes for src/or/directory.c: 1 added line, 2 removed lines.
Original line number Diff line number Diff line
@@ -785,8 +785,7 @@ directory_command_should_use_begindir(or_options_t *options, 
    return 0; /* We don't know an ORPort -- no chance. */

  if (!anonymized_connection)

    if (!fascist_firewall_allows_address_or(addr, or_port) ||

        directory_fetches_from_authorities(options) ||

        (server_mode(options) && !options->Address))

        directory_fetches_from_authorities(options))

      return 0; /* We're firewalled or are acting like a relay -- also no. */

  if (!options->TunnelDirConns &&

      router_purpose != ROUTER_PURPOSE_BRIDGE)