October 2012 - tor-commits - lists.torproject.org

[tor/master] Merge branch 'link_negotiation_assert_024'
by nickm＠torproject.org 25 Oct '12

25 Oct '12

commit 48cdcc9d4ad12b7c57c8ac578db5961da27fde85 Merge: e4abac0 c442d85 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 25 10:21:01 2012 -0400 Merge branch 'link_negotiation_assert_024' changes/link_negotiation_assert | 6 ++++++ src/or/channeltls.c | 9 +++++++++ 2 files changed, 15 insertions(+), 0 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3'
by nickm＠torproject.org 25 Oct '12

25 Oct '12

commit e4abac08a2ade5329594dcc220a02b3b680cb9e8 Merge: ad49b8a 758428d Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 25 10:19:46 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' (Using an -s ours merge for Not taking the CVE-2012-2250 fix from maint-0.2.3; it would conflict.)

1 0

[tor/maint-0.2.3] Fix a remotely triggerable assertion failure (CVE-2012-2250)
by nickm＠torproject.org 25 Oct '12

25 Oct '12

commit 758428dd32128874cefacc92ef63c1b5bc9a656e Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 23 22:58:38 2012 -0400 Fix a remotely triggerable assertion failure (CVE-2012-2250) If we completed the handshake for the v2 link protocol but wound up negotiating the wong protocol version, we'd become so confused about what part of the handshake we were in that we'd promptly die with an assertion. This is a fix for CVE-2012-2250; it's a bugfix on 0.2.3.6-alpha. All servers running that version or later should really upgrade. Bug and fix from "some guy from France." I tweaked his code slightly to make it log the IP of the offending node. --- changes/link_negotiation_assert | 6 ++++++ src/or/command.c | 9 +++++++++ 2 files changed, 15 insertions(+), 0 deletions(-) diff --git a/changes/link_negotiation_assert b/changes/link_negotiation_assert new file mode 100644 index 0000000..398a545 --- /dev/null +++ b/changes/link_negotiation_assert @@ -0,0 +1,6 @@ + o Major bugfixs (security): + - Fix a group of remotely triggerable assertion failures related to + incorrect link protocol negotiation. Found, diagnosed, and fixed + by "some guy from France." Fix for CVE-2012-2250; bugfix on + 0.2.3.6-alpha. + diff --git a/src/or/command.c b/src/or/command.c index 975af04..d935b5b 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -719,6 +719,15 @@ command_process_versions_cell(var_cell_t *cell, or_connection_t *conn) "handshake. Closing connection."); connection_mark_for_close(TO_CONN(conn)); return; + } else if (highest_supported_version != 2 && + conn->_base.state == OR_CONN_STATE_OR_HANDSHAKING_V2) { + /* XXXX This should eventually be a log_protocol_warn */ + log_fn(LOG_WARN, LD_OR, + "Negotiated link with non-2 protocol after doing a v2 TLS " + "handshake with %s. Closing connection.", + fmt_addr(&conn->_base.addr)); + connection_mark_for_close(TO_CONN(conn)); + return; } conn->link_proto = highest_supported_version;

1 0

[tor/release-0.2.3] Fix a remotely triggerable assertion failure (CVE-2012-2250)
by nickm＠torproject.org 25 Oct '12

25 Oct '12

commit 758428dd32128874cefacc92ef63c1b5bc9a656e Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 23 22:58:38 2012 -0400 Fix a remotely triggerable assertion failure (CVE-2012-2250) If we completed the handshake for the v2 link protocol but wound up negotiating the wong protocol version, we'd become so confused about what part of the handshake we were in that we'd promptly die with an assertion. This is a fix for CVE-2012-2250; it's a bugfix on 0.2.3.6-alpha. All servers running that version or later should really upgrade. Bug and fix from "some guy from France." I tweaked his code slightly to make it log the IP of the offending node. --- changes/link_negotiation_assert | 6 ++++++ src/or/command.c | 9 +++++++++ 2 files changed, 15 insertions(+), 0 deletions(-) diff --git a/changes/link_negotiation_assert b/changes/link_negotiation_assert new file mode 100644 index 0000000..398a545 --- /dev/null +++ b/changes/link_negotiation_assert @@ -0,0 +1,6 @@ + o Major bugfixs (security): + - Fix a group of remotely triggerable assertion failures related to + incorrect link protocol negotiation. Found, diagnosed, and fixed + by "some guy from France." Fix for CVE-2012-2250; bugfix on + 0.2.3.6-alpha. + diff --git a/src/or/command.c b/src/or/command.c index 975af04..d935b5b 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -719,6 +719,15 @@ command_process_versions_cell(var_cell_t *cell, or_connection_t *conn) "handshake. Closing connection."); connection_mark_for_close(TO_CONN(conn)); return; + } else if (highest_supported_version != 2 && + conn->_base.state == OR_CONN_STATE_OR_HANDSHAKING_V2) { + /* XXXX This should eventually be a log_protocol_warn */ + log_fn(LOG_WARN, LD_OR, + "Negotiated link with non-2 protocol after doing a v2 TLS " + "handshake with %s. Closing connection.", + fmt_addr(&conn->_base.addr)); + connection_mark_for_close(TO_CONN(conn)); + return; } conn->link_proto = highest_supported_version;

1 0

[tor/release-0.2.3] Merge branch 'link_negotiation_assert_023' into release-0.2.3
by nickm＠torproject.org 25 Oct '12

25 Oct '12

commit da336312eb7fde5cdc311465e2a9036ac60273e7 Merge: 89dc27b 758428d Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 25 10:15:03 2012 -0400 Merge branch 'link_negotiation_assert_023' into release-0.2.3 changes/link_negotiation_assert | 6 ++++++ src/or/command.c | 9 +++++++++ 2 files changed, 15 insertions(+), 0 deletions(-)

1 0

[tor/master] Start an 0.2.4.5 changelog.
by nickm＠torproject.org 25 Oct '12

25 Oct '12

commit ad49b8ab569ddaae8a828c6a611bd143772bb5aa Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 25 10:13:34 2012 -0400 Start an 0.2.4.5 changelog. The items from 0.2.3.x are copy-and-pastd from current release-0.2.3 changelog; the others are folded in from changes/*. --- ChangeLog | 35 +++++++++++++++++++++++++++++++++++ changes/bug7189_server_only | 4 ---- changes/bug7190 | 6 ------ changes/bug7191 | 5 ----- changes/bug7192 | 10 ---------- changes/split_circuitbuild | 4 ---- 6 files changed, 35 insertions(+), 29 deletions(-) diff --git a/ChangeLog b/ChangeLog index f45ae9c..f312b22 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,38 @@ +Changes in version 0.2.4.5-alpha - 2012-10-2? + o Major bugfixes (also in 0.2.3.24-rc): + - Fix a denial of service attack by which any directory authority + could crash all the others, or by which a single v2 directory + authority could crash everybody downloading v2 directory + information. Fixes bug 7191; bugfix on 0.2.0.10-alpha. + - When parsing exit policy summaries from microdescriptors, we had + previously been ignoring the last character in each one, so that + "accept 80,443,8080" would be treated by clients as indicating + a node that allows access to ports 80, 443, and 808. That would + lead to clients attempting connections that could never work, + and ignoring exit nodes that would support their connections. Now + clients parse these exit policy summaries correctly. Fixes bug 7192; + bugfix on 0.2.3.1-alpha. + + o Minor bugfixes (also in 0.2.3.24-rc): + - Clients now consider the ClientRejectInternalAddresses config option + when using a microdescriptor consensus stanza to decide whether + an exit relay would allow exiting to an internal address. Fixes + bug 7190; bugfix on 0.2.3.1-alpha. + + o Code simplification and refactoring: + - Start using OpenBSD's implementation of queue.h (originally by Niels + Provos). + - Move the entry node code from circuitbuild.c to its own file. + - Move the circuit build timeout tracking code from circuitbuild.c + to its own file. + + o Minor bugfixes: + - Only disable TLS session ticket support when running as a TLS + server. This keeps clients harder to distinguish from regular firefox + connections. Fixes bug 7189; bugfix on Tor 0.2.3.23-rc. + + + Changes in version 0.2.4.4-alpha - 2012-10-20 Tor 0.2.4.4-alpha adds a new v3 directory authority, fixes a privacy vulnerability introduced by a change in OpenSSL, fixes a remotely diff --git a/changes/bug7189_server_only b/changes/bug7189_server_only deleted file mode 100644 index 9ad5ad9..0000000 --- a/changes/bug7189_server_only +++ /dev/null @@ -1,4 +0,0 @@ - o Minor bugfixes: - - Only disable TLS session ticket support when running as a TLS - server. This keeps clients harder to distinguish from regular firefox - connections. Fixes bug 7189; bugfix on Tor 0.2.3.23-rc. diff --git a/changes/bug7190 b/changes/bug7190 deleted file mode 100644 index 1607f79..0000000 --- a/changes/bug7190 +++ /dev/null @@ -1,6 +0,0 @@ - o Minor bugfixes: - - Clients now consider the ClientRejectInternalAddresses config option - when using a microdescriptor consensus stanza to decide whether - an exit relay would allow exiting to an internal address. Fixes - bug 7190; bugfix on 0.2.3.1-alpha. - diff --git a/changes/bug7191 b/changes/bug7191 deleted file mode 100644 index a3bee6e..0000000 --- a/changes/bug7191 +++ /dev/null @@ -1,5 +0,0 @@ - o Major bugfixes: - - Fix a denial of service attack by which any directory authority - could crash all the others, or by which a single v2 directory - authority could crash everybody downloading v2 directory - information. Fixes bug 7191; bugfix on 0.2.0.10-alpha. diff --git a/changes/bug7192 b/changes/bug7192 deleted file mode 100644 index 10cbc24..0000000 --- a/changes/bug7192 +++ /dev/null @@ -1,10 +0,0 @@ - o Major bugfixes: - - When parsing exit policy summaries from microdescriptors, we had - previously been ignoring the last character in each one, so that - "accept 80,443,8080" would be treated by clients as indicating a - node that allows access to ports 80, 443, and 808. That would lead - to clients attempting connections that could never work, and - ignoring exit nodes that would support their connections. Now clients - parse these exit policy summaries correctly. Fixes bug 7192; - bugfix on 0.2.3.1-alpha. - diff --git a/changes/split_circuitbuild b/changes/split_circuitbuild deleted file mode 100644 index 0d3c80e..0000000 --- a/changes/split_circuitbuild +++ /dev/null @@ -1,4 +0,0 @@ - o Code simplification and refactoring: - - Move the entry node code from circuitbuild.c to its own file. - - Move the circuit build timeout tracking code from circuitbuild.c - to its own file.

1 0

[torbrowser/maint-2.2] update firefox to 10.0.10esr
by erinn＠torproject.org 25 Oct '12

25 Oct '12

commit fe5294802022f3cb9f436a787e121786fbae2fec Author: Erinn Clark <erinn(a)torproject.org> Date: Thu Oct 25 11:19:31 2012 +0100 update firefox to 10.0.10esr --- build-scripts/versions.mk | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/build-scripts/versions.mk b/build-scripts/versions.mk index 3da6032..99c4030 100644 --- a/build-scripts/versions.mk +++ b/build-scripts/versions.mk @@ -10,7 +10,7 @@ VIDALIA_VER=0.2.20 LIBEVENT_VER=2.0.20-stable TOR_VER=0.2.2.39 PIDGIN_VER=2.6.4 -FIREFOX_VER=10.0.9esr +FIREFOX_VER=10.0.10esr MOZBUILD_VER=1.5.1 PYMAKE_VER=87d436cd8974 TORBUTTON_VER=1.4.6.3

1 0

[torbrowser/maint-2.3] update firefox to 10.0.10esr
by erinn＠torproject.org 25 Oct '12

25 Oct '12

commit 0179e89134f0e42d5fa9eac05cd487f4ddeeb3e2 Author: Erinn Clark <erinn(a)torproject.org> Date: Thu Oct 25 11:20:11 2012 +0100 update firefox to 10.0.10esr --- build-scripts/versions-alpha.mk | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/build-scripts/versions-alpha.mk b/build-scripts/versions-alpha.mk index 345a836..1505a20 100644 --- a/build-scripts/versions-alpha.mk +++ b/build-scripts/versions-alpha.mk @@ -10,7 +10,7 @@ VIDALIA_VER=0.2.20 LIBEVENT_VER=2.0.20-stable TOR_VER=0.2.3.23-rc PIDGIN_VER=2.6.4 -FIREFOX_VER=10.0.9esr +FIREFOX_VER=10.0.10esr MOZBUILD_VER=1.5.1 PYMAKE_VER=87d436cd8974 TORBUTTON_VER=1.4.6.3

1 0

[torbrowser/maint-2.3] update firefox to 10.0.10esr
by erinn＠torproject.org 25 Oct '12

25 Oct '12

commit fe5294802022f3cb9f436a787e121786fbae2fec Author: Erinn Clark <erinn(a)torproject.org> Date: Thu Oct 25 11:19:31 2012 +0100 update firefox to 10.0.10esr --- build-scripts/versions.mk | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/build-scripts/versions.mk b/build-scripts/versions.mk index 3da6032..99c4030 100644 --- a/build-scripts/versions.mk +++ b/build-scripts/versions.mk @@ -10,7 +10,7 @@ VIDALIA_VER=0.2.20 LIBEVENT_VER=2.0.20-stable TOR_VER=0.2.2.39 PIDGIN_VER=2.6.4 -FIREFOX_VER=10.0.9esr +FIREFOX_VER=10.0.10esr MOZBUILD_VER=1.5.1 PYMAKE_VER=87d436cd8974 TORBUTTON_VER=1.4.6.3

1 0

[torbrowser/maint-2.3] Merge branch 'maint-2.2' into maint-2.3
by erinn＠torproject.org 25 Oct '12

25 Oct '12

commit 157fe34aa28e4c66dbdae5a9f1750241db6836c3 Merge: 06557b2 fe52948 Author: Erinn Clark <erinn(a)torproject.org> Date: Thu Oct 25 11:19:46 2012 +0100 Merge branch 'maint-2.2' into maint-2.3 build-scripts/versions.mk | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

1 0