Merge branch 'remove_allow_dotexit_v2' (37302e64) · Commits · The Tor Project / Core / Tor

changes/bug23426

0 → 100644

+4 −0

Original line number	Diff line number	Diff line
		o Removed features:
		- The AllowDotExit option has been removed as unsafe. It has
		been deprecated since 0.2.9.2-alpha. Closes ticket 23426.

doc/tor.1.txt

+1 −7

Original line number	Diff line number	Diff line
		@@ -954,7 +954,7 @@ The following options are useful only for clients (that is, if
		The ExcludeNodes option overrides this option: any node listed in both
		ExitNodes and ExcludeNodes is treated as excluded. +
		+
		The .exit address notation, if enabled via AllowDotExit, overrides
		The .exit address notation, if enabled via MapAddress, overrides
		this option.

		[[EntryNodes]] EntryNodes __node__,__node__,__...__::
		@@ -1358,12 +1358,6 @@ The following options are useful only for clients (that is, if
		resolved. This helps trap accidental attempts to resolve URLs and so on.
		(Default: 0)

		[[AllowDotExit]] AllowDotExit 0\|1::
		If enabled, we convert "www.google.com.foo.exit" addresses on the
		SocksPort/TransPort/NATDPort into "www.google.com" addresses that exit from
		the node "foo". Disabled by default since attacking websites and exit
		relays can use it to manipulate your path selection. (Default: 0)

		[[HTTPTunnelPort]] HTTPTunnelPort \['address':]__port__\|auto [_isolation flags_]::
		Open this port to listen for proxy connections using the "HTTP CONNECT"
		protocol instead of SOCKS. Set this to 0

src/or/config.c

+1 −6

Original line number	Diff line number	Diff line
		@@ -208,7 +208,7 @@ static config_var_t option_vars_[] = {
		VAR("AccountingRule", STRING, AccountingRule_option, "max"),
		V(AccountingStart, STRING, NULL),
		V(Address, STRING, NULL),
		V(AllowDotExit, BOOL, "0"),
		OBSOLETE("AllowDotExit"),
		OBSOLETE("AllowInvalidNodes"),
		V(AllowNonRFC953Hostnames, BOOL, "0"),
		OBSOLETE("AllowSingleHopCircuits"),
		@@ -684,11 +684,6 @@ static const config_var_t testing_tor_network_defaults[] = {
		#undef OBSOLETE

		static const config_deprecation_t option_deprecation_notes_[] = {
		/* Deprecated since 0.2.9.2-alpha... */
		{ "AllowDotExit", "Unrestricted use of the .exit notation can be used for "
		"a wide variety of application-level attacks." },
		/* End of options deprecated since 0.2.9.2-alpha. */

		/* Deprecated since 0.3.2.0-alpha. */
		{ "HTTPProxy", "It only applies to direct unencrypted HTTP connections "
		"to your directory server, which your Tor probably wasn't using." },

src/or/connection_edge.c

+10 −11

Original line number	Diff line number	Diff line
		@@ -1237,10 +1237,9 @@ connection_ap_handshake_rewrite(entry_connection_t *conn,
		/* Check for whether this is a .exit address. By default, those are
		* disallowed when they're coming straight from the client, but you're
		* allowed to have them in MapAddress commands and so forth. */
		if (!strcmpend(socks->address, ".exit") && !options->AllowDotExit) {
		if (!strcmpend(socks->address, ".exit")) {
		log_warn(LD_APP, "The \".exit\" notation is disabled in Tor due to "
		"security risks. Set AllowDotExit in your torrc to enable "
		"it (at your own risk).");
		"security risks.");
		control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
		escaped(socks->address));
		out->end_reason = END_STREAM_REASON_TORPROTOCOL;
		@@ -1674,23 +1673,23 @@ connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn,
		const node_t *node = NULL;

		/* If this .exit was added by an AUTOMAP, then it came straight from
		* a user. Make sure that options->AllowDotExit permits that! */
		if (exit_source == ADDRMAPSRC_AUTOMAP && !options->AllowDotExit) {
		/* Whoops; this one is stale. It must have gotten added earlier,
		* when AllowDotExit was on. */
		log_warn(LD_APP,"Stale automapped address for '%s.exit', with "
		"AllowDotExit disabled. Refusing.",
		* a user. That's not safe. */
		if (exit_source == ADDRMAPSRC_AUTOMAP) {
		/* Whoops; this one is stale. It must have gotten added earlier?
		* (Probably this is not possible, since AllowDotExit no longer
		* exists.) */
		log_warn(LD_APP,"Stale automapped address for '%s.exit'. Refusing.",
		safe_str_client(socks->address));
		control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s",
		escaped(socks->address));
		connection_mark_unattached_ap(conn, END_STREAM_REASON_TORPROTOCOL);
		tor_assert_nonfatal_unreached();
		return -1;
		}

		/* Double-check to make sure there are no .exits coming from
		* impossible/weird sources. */
		if (exit_source == ADDRMAPSRC_DNS \|\|
		(exit_source == ADDRMAPSRC_NONE && !options->AllowDotExit)) {
		if (exit_source == ADDRMAPSRC_DNS \|\| exit_source == ADDRMAPSRC_NONE) {
		/* It shouldn't be possible to get a .exit address from any of these
		* sources. */
		log_warn(LD_BUG,"Address '%s.exit', with impossible source for the "

src/or/or.h

+0 −7

Original line number	Diff line number	Diff line
		@@ -4169,13 +4169,6 @@ typedef struct {
		* if we are a cache). For authorities, this is always true. */
		int DownloadExtraInfo;

		/** If true, we convert "www.google.com.foo.exit" addresses on the
		* socks/trans/natd ports into "www.google.com" addresses that
		* exit from the node "foo". Disabled by default since attacking
		* websites and exit relays can use it to manipulate your path
		* selection. */
		int AllowDotExit;

		/** If true, we're configured to collect statistics on clients
		* requesting network statuses from us as directory. */
		int DirReqStatistics_option;