Opened 7 years ago

Closed 6 years ago

#12086 closed defect (fixed)

BridgeDB accepts incoming emails sent to 'givemebridges@serious.ly'

Reported by: isis Owned by: isis
Priority: High Milestone:
Component: Circumvention/BridgeDB Version:
Severity: Keywords: bridgedb-email, security
Cc: isis, sysrqb Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description (last modified by isis)

From this commit message for this unittest which reproduces the issue and which is currently failing with this error:

BridgeDB's current code will accept an incoming email with a To: givemebridges@serious.ly header. However, BridgeDB's reply will still contain: From: bridges@torproject.org.

Obviously, it shouldn't be possible for any email whose SMTP RCPT TO domain is 'serious.ly' to actually end up in BridgeDB's mail queue. Though, if the outside SMTP layer is sent to '[bridges|ponticum].torproject.org' (with MAIL FROM: a gmail/yahoo address), these messages still end up in BridgeDB's mail queue.

The following netcat session demonstrates that this is possible:

  ∃!isisⒶwintermute:(master *$=)~ ∴ torsocks nc bridges.torproject.org 25
  220 ponticum.torproject.org ESMTP Postfix (Debian/GNU)
  HELO ponticum.torproject.org
  250 ponticum.torproject.org
  MAIL FROM: isisgrimalkin@gmail.com
  250 2.1.0 Ok
  RCPT TO: bridges@bridges.torproject.org
  250 2.1.5 Ok
  DATA
  354 End data with <CR><LF>.<CR><LF>
  From: isislovecruft@gmail.com
  To: givemebridgesrightnow@serious.ly
  Subject: mwhahaha

  get transport obfs3
  .
  250 2.0.0 Ok: queued as F03972834F
  QUIT
  221 2.0.0 Bye


This request resulted in the following...


Although these logs were taken from the currently live server, they are "sanitised".¹

¹ Where "sanitised" means "all bridge info, including IP addresses and hashes, are faked" and "all email addresses are mine".

...debug logs:

15:30:31 DEBUG    L690:server.validateFrom()    ORIGIN: "'<bridgedb@ponticum>'"
15:30:31 DEBUG    L699:server.validateFrom()    Got canonical domain: 'ponticum'
15:30:31 DEBUG    L495:server.lineReceived()    > Received: from ponticum (ponticum [127.0.0.1]) for <bridges@bridgedb>; Wed, 21 May 2014 15:30:31 +0000
15:30:31 DEBUG    L495:server.lineReceived()    > From isisgrimalkin@gmail.com  Wed May 21 15:30:31 2014
15:30:31 DEBUG    L495:server.lineReceived()    > X-Original-To: bridges@bridges.torproject.org
15:30:31 DEBUG    L495:server.lineReceived()    > Delivered-To: bridgedb@ponticum.torproject.org
15:30:31 DEBUG    L495:server.lineReceived()    > Received: from ponticum.torproject.org (kpebetka.net [95.79.25.182])
15:30:31 DEBUG    L495:server.lineReceived()    >       by ponticum.torproject.org (Postfix) with SMTP id F03972834F
15:30:31 DEBUG    L495:server.lineReceived()    >       for <bridges@bridges.torproject.org>; Wed, 21 May 2014 15:29:18 +0000 (UTC)
15:30:31 DEBUG    L495:server.lineReceived()    > From: isislovecruft@gmail.com
15:30:31 DEBUG    L495:server.lineReceived()    > To: givemebridgesrightnow@serious.ly
15:30:31 DEBUG    L495:server.lineReceived()    > Subject: mwhahaha
15:30:31 DEBUG    L495:server.lineReceived()    > X-DKIM-Authentication-Results: dunno
15:30:31 DEBUG    L495:server.lineReceived()    > Date: Wed, 21 May 2014 15:30:31 -0000
15:30:31 DEBUG    L495:server.lineReceived()    > Message-Id: <1400686231.135135.6548@ponticum>
15:30:31 DEBUG    L495:server.lineReceived()    >
15:30:31 DEBUG    L495:server.lineReceived()    > get transport obfs3
15:30:31 DEBUG    L495:server.lineReceived()    >
15:30:31 INFO     L611:server.reply()           Got an email; deciding whether to reply.
15:30:31 INFO     L646:server.reply()           Client requested email translation: en
15:30:31 DEBUG     L70:request.determineBridg() Email request was valid.
15:30:31 DEBUG    L160:request.withPluggableT() Parsing 'transport' line: 'get transport obfs3'
15:30:31 INFO     L169:request.withPluggableT() Email requested transport type: 'obfs3'
15:30:31 DEBUG     L81:request.determineBridg() Generating hashring filters for request.
15:30:31 INFO     L420:Dist.getBridgesForEmai() Attempting to return for 3 bridges for isislovecruft@gmail.com...
15:30:31 DEBUG    L445:Dist.getBridgesForEmai() Cache hit frozenset([<function filterBridgesByTransport(obfs3,<class 'ipaddr.IPv4Address'>)>])
15:30:31 DEBUG     L75:Dist.getNumBridgesPerA() Returning 3 bridges from ring of len: 492
15:30:31 DEBUG   L1034:Bridges.getBridges()     Got duplicate bridge 'edfa2fd66533da52f40424bbe917bd03c8378c2d' in main hashring for position 'eda7f69f7c08bd80861c3afa2921168a007d9ae5'.
15:30:31 DEBUG   L1034:Bridges.getBridges()     Got duplicate bridge 'ed0b2fd66f398afbf10424bb911790faca9ddb8e' in main hashring for position 'eda7f69f7c08bd80861c3afa2921168a007d9ae5'.
15:30:31 DEBUG    L183:server.generateRespons() Email contents:
From: bridges@torproject.org
To: isislovecruft@gmail.com
Message-ID: <20140521153031.21456.73227139.10726@ponticum.torproject.org>
In-Reply-To: <1400686231.135135.6548@ponticum>
Content-Type: text/plain; charset="utf-8"
Date: Wed, 21 May 2014 15:30:31 +0000
Subject: Re: mwhahaha


Hey, isislovecruft!

[This is an automated message; please do not reply.]

Here are your bridges:

  obfs3 10.1.1.1:1111 d14133856abbba8a65607baebf692162c567bf41
  obfs3 10.2.2.2:2222 86f45ab5dcef80a4b1abfcc43579e76f1d0b25a4
  obfs3 10.3.3.3:3333 5d55daabd91e041e74f62dcfab1a29c8bb32f0b2


To enter bridges into Tor Browser, follow the instructions on the  Tor
Browser download page [0] to start Tor Browser.

When the 'Tor Network Settings' dialogue pops up, click 'Configure' and follow
the wizard until it asks:

> Does your Internet Service Provider (ISP) block or otherwise censor connections
> to the Tor network?

Select 'Yes' and then click 'Next'. To configure your new bridges, copy and
paste the bridge lines into the text input box. Finally, click 'Connect', and
you should be good to go! If you experience trouble, try clicking the 'Help'
button in the 'Tor Network Settings' wizard for further assistance.

[0]: https://www.torproject.org/projects/torbrowser.html.en#downloads-beta



COMMANDs: (combine COMMANDs to specify multiple options simultaneously)
  get bridges            Request vanilla bridges.
  get transport [TYPE]   Request a Pluggable Transport by TYPE.
  get help               Displays this message.
  get key                Get a copy of BridgeDB's public GnuPG key.
  get ipv6               Request IPv6 bridges.

Currently supported transport TYPEs:
  obfs2
  obfs3
  scramblesuit


 --
 <3 BridgeDB

----------------------------------------------------------------------
Public Keys: https://bridges.torproject.org/keys
This email was generated with rainbows, unicorns, and sparkles
for isislovecruft@gmail.com on Wednesday, 21 May, 2014 at 15:30:31.


15:30:31 INFO     L655:server.reply()           Sending reply to isislovecruft@gmail.com



The other two bugs detailed in the above commit message are tickets #12089 and #12091 respectively.

Child Tickets

Change History (5)

comment:1 Changed 7 years ago by isis

Description: modified (diff)

comment:2 Changed 7 years ago by isis

Description: modified (diff)

comment:3 Changed 6 years ago by isis

Resolution: fixed
Status: newclosed

This is fixed in my fix/12086-rcptto-other-domain branch, which is based on more unittests and bugfixes in my fix/9874-automate-email-tests branch.

comment:4 Changed 6 years ago by isis

Resolution: fixed
Status: closedreopened

Some of this code was disabled in the fixes for #12627. I'm reopening until it's looked into.

comment:5 in reply to:  4 Changed 6 years ago by isis

Resolution: fixed
Status: reopenedclosed

Replying to isis:

Some of this code was disabled in the fixes for #12627. I'm reopening until it's looked into.

Oops, I meant that some of the fix for #12089 was disabled by #12627. Reclosing.

Note: See TracTickets for help on using tickets.