March 2012 - tor-commits - lists.torproject.org

[obfsproxy/master] Add check for gcc and ld hardening flags.
by asn＠torproject.org 10 Mar '12

10 Mar '12

commit 0e69ae88923133dca88f9818671e65957d9f244c Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Mon Feb 13 17:43:01 2012 -0500 Add check for gcc and ld hardening flags. This adds a new one shot automake macro AX_ENABLE_HARDENING and it attempts to add the various security hardening flags we'd like to see if they're available. When they are not available, we simply skip adding the option. This should ensure that we have everything we could possibly have without adding incompatible flags or having to add a lot of weird cruft to the configure.ac file. --- configure.ac | 3 ++ m4/ax_build_hardening.m4 | 63 +++++++++++++++++++++++++++++++++++++ m4/ax_check_compile_flag.m4 | 72 +++++++++++++++++++++++++++++++++++++++++++ m4/ax_check_link_flag.m4 | 71 ++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 209 insertions(+), 0 deletions(-) diff --git a/configure.ac b/configure.ac index cf5bd43..34beb81 100644 --- a/configure.ac +++ b/configure.ac @@ -23,6 +23,9 @@ AC_CHECK_HEADERS([sys/socket.h]) AC_CHECK_HEADERS([sys/types.h]) AC_CHECK_HEADERS([netinet/in.h]) +### Compiler Hardening ### +AX_ENABLE_HARDENING + ### Libraries ### PKG_CHECK_MODULES([libevent], [libevent >= 2.0]) diff --git a/m4/ax_build_hardening.m4 b/m4/ax_build_hardening.m4 new file mode 100644 index 0000000..590a00d --- /dev/null +++ b/m4/ax_build_hardening.m4 @@ -0,0 +1,63 @@ + +# +# SYNOPSIS +# +# AX_ENABLE_HARDENING() +# +# DESCRIPTION +# +# Attempt to enable various gcc compile time and linker security hardening +# options. +# +# LICENSE +# +# Copyright (c) 2012 Jacob Appelbaum <jacob(a)appelbaum.net> +# +# This program is free software: you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation, either version 3 of the License, or (at your +# option) any later version. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General +# Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program. If not, see <http://www.gnu.org/licenses/>. +# +# As a special exception, the respective Autoconf Macro's copyright owner +# gives unlimited permission to copy, distribute and modify the configure +# scripts that are the output of Autoconf when processing the Macro. You +# need not follow the terms of the GNU General Public License when using +# or distributing such scripts, even though portions of the text of the +# Macro appear in them. The GNU General Public License (GPL) does govern +# all other use of the material that constitutes the Autoconf Macro. +# +# This special exception to the GPL applies to versions of the Autoconf +# Macro released by the Autoconf Archive. When you make and distribute a +# modified version of the Autoconf Macro, you may extend this special +# exception to the GPL to apply to your modified version as well. + +#serial 2 + +dnl This macro depends on AX_CHECK_COMPILE_FLAG and AX_CHECK_LINKER_FLAG +AC_DEFUN_ONCE([AX_ENABLE_HARDENING], [ + +### Compiler Hardening ### +# This requires ax_check_compile_flag.m4 +AX_CHECK_COMPILE_FLAG([-D_FORTIFY_SOURCE=2], [CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2"]) +AX_CHECK_COMPILE_FLAG([-fstack-protector-all], [CFLAGS="$CFLAGS -fstack-protector-all"]) +AX_CHECK_COMPILE_FLAG([-fwrapv], [CFLAGS="$CFLAGS -fwrapv"]) +AX_CHECK_COMPILE_FLAG([-fPIE], [CFLAGS="$CFLAGS -fPIE"]) +AX_CHECK_COMPILE_FLAG([--param ssp-buffer-size=1], [CFLAGS="$CFLAGS --param ssp-buffer-size=1"]) +AX_CHECK_COMPILE_FLAG([-fno-strict-aliasing], [CFLAGS="$CFLAGS -fno-strict-aliasing"]) +AX_CHECK_COMPILE_FLAG([-fno-strict-overflow], [CFLAGS="$CFLAGS -fno-strict-overflow"]) + +### Linker Hardening ### +# This requires ax_check_link_flag.m4 +AX_CHECK_LINK_FLAG([-pie], [LDFLAGS="$LDFLAGS -pie"]) +AX_CHECK_LINK_FLAG([-z relro], [LDFLAGS="$LDFLAGS -z relro"]) +AX_CHECK_LINK_FLAG([-z now], [LDFLAGS="$LDFLAGS -z now"]) + +]) diff --git a/m4/ax_check_compile_flag.m4 b/m4/ax_check_compile_flag.m4 new file mode 100644 index 0000000..c3a8d69 --- /dev/null +++ b/m4/ax_check_compile_flag.m4 @@ -0,0 +1,72 @@ +# =========================================================================== +# http://www.gnu.org/software/autoconf-archive/ax_check_compile_flag.html +# =========================================================================== +# +# SYNOPSIS +# +# AX_CHECK_COMPILE_FLAG(FLAG, [ACTION-SUCCESS], [ACTION-FAILURE], [EXTRA-FLAGS]) +# +# DESCRIPTION +# +# Check whether the given FLAG works with the current language's compiler +# or gives an error. (Warnings, however, are ignored) +# +# ACTION-SUCCESS/ACTION-FAILURE are shell commands to execute on +# success/failure. +# +# If EXTRA-FLAGS is defined, it is added to the current language's default +# flags (e.g. CFLAGS) when the check is done. The check is thus made with +# the flags: "CFLAGS EXTRA-FLAGS FLAG". This can for example be used to +# force the compiler to issue an error when a bad flag is given. +# +# NOTE: Implementation based on AX_CFLAGS_GCC_OPTION. Please keep this +# macro in sync with AX_CHECK_{PREPROC,LINK}_FLAG. +# +# LICENSE +# +# Copyright (c) 2008 Guido U. Draheim <guidod(a)gmx.de> +# Copyright (c) 2011 Maarten Bosmans <mkbosmans(a)gmail.com> +# +# This program is free software: you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation, either version 3 of the License, or (at your +# option) any later version. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General +# Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program. If not, see <http://www.gnu.org/licenses/>. +# +# As a special exception, the respective Autoconf Macro's copyright owner +# gives unlimited permission to copy, distribute and modify the configure +# scripts that are the output of Autoconf when processing the Macro. You +# need not follow the terms of the GNU General Public License when using +# or distributing such scripts, even though portions of the text of the +# Macro appear in them. The GNU General Public License (GPL) does govern +# all other use of the material that constitutes the Autoconf Macro. +# +# This special exception to the GPL applies to versions of the Autoconf +# Macro released by the Autoconf Archive. When you make and distribute a +# modified version of the Autoconf Macro, you may extend this special +# exception to the GPL to apply to your modified version as well. + +#serial 2 + +AC_DEFUN([AX_CHECK_COMPILE_FLAG], +[AC_PREREQ(2.59)dnl for _AC_LANG_PREFIX +AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_[]_AC_LANG_ABBREV[]flags_$4_$1])dnl +AC_CACHE_CHECK([whether _AC_LANG compiler accepts $1], CACHEVAR, [ + ax_check_save_flags=$[]_AC_LANG_PREFIX[]FLAGS + _AC_LANG_PREFIX[]FLAGS="$[]_AC_LANG_PREFIX[]FLAGS $4 $1" + AC_COMPILE_IFELSE([AC_LANG_PROGRAM()], + [AS_VAR_SET(CACHEVAR,[yes])], + [AS_VAR_SET(CACHEVAR,[no])]) + _AC_LANG_PREFIX[]FLAGS=$ax_check_save_flags]) +AS_IF([test x"AS_VAR_GET(CACHEVAR)" = xyes], + [m4_default([$2], :)], + [m4_default([$3], :)]) +AS_VAR_POPDEF([CACHEVAR])dnl +])dnl AX_CHECK_COMPILE_FLAGS diff --git a/m4/ax_check_link_flag.m4 b/m4/ax_check_link_flag.m4 new file mode 100644 index 0000000..e2d0d36 --- /dev/null +++ b/m4/ax_check_link_flag.m4 @@ -0,0 +1,71 @@ +# =========================================================================== +# http://www.gnu.org/software/autoconf-archive/ax_check_link_flag.html +# =========================================================================== +# +# SYNOPSIS +# +# AX_CHECK_LINK_FLAG(FLAG, [ACTION-SUCCESS], [ACTION-FAILURE], [EXTRA-FLAGS]) +# +# DESCRIPTION +# +# Check whether the given FLAG works with the linker or gives an error. +# (Warnings, however, are ignored) +# +# ACTION-SUCCESS/ACTION-FAILURE are shell commands to execute on +# success/failure. +# +# If EXTRA-FLAGS is defined, it is added to the linker's default flags +# when the check is done. The check is thus made with the flags: "LDFLAGS +# EXTRA-FLAGS FLAG". This can for example be used to force the linker to +# issue an error when a bad flag is given. +# +# NOTE: Implementation based on AX_CFLAGS_GCC_OPTION. Please keep this +# macro in sync with AX_CHECK_{PREPROC,COMPILE}_FLAG. +# +# LICENSE +# +# Copyright (c) 2008 Guido U. Draheim <guidod(a)gmx.de> +# Copyright (c) 2011 Maarten Bosmans <mkbosmans(a)gmail.com> +# +# This program is free software: you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation, either version 3 of the License, or (at your +# option) any later version. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General +# Public License for more details. +# +# You should have received a copy of the GNU General Public License along +# with this program. If not, see <http://www.gnu.org/licenses/>. +# +# As a special exception, the respective Autoconf Macro's copyright owner +# gives unlimited permission to copy, distribute and modify the configure +# scripts that are the output of Autoconf when processing the Macro. You +# need not follow the terms of the GNU General Public License when using +# or distributing such scripts, even though portions of the text of the +# Macro appear in them. The GNU General Public License (GPL) does govern +# all other use of the material that constitutes the Autoconf Macro. +# +# This special exception to the GPL applies to versions of the Autoconf +# Macro released by the Autoconf Archive. When you make and distribute a +# modified version of the Autoconf Macro, you may extend this special +# exception to the GPL to apply to your modified version as well. + +#serial 2 + +AC_DEFUN([AX_CHECK_LINK_FLAG], +[AS_VAR_PUSHDEF([CACHEVAR],[ax_cv_check_ldflags_$4_$1])dnl +AC_CACHE_CHECK([whether the linker accepts $1], CACHEVAR, [ + ax_check_save_flags=$LDFLAGS + LDFLAGS="$LDFLAGS $4 $1" + AC_LINK_IFELSE([AC_LANG_PROGRAM()], + [AS_VAR_SET(CACHEVAR,[yes])], + [AS_VAR_SET(CACHEVAR,[no])]) + LDFLAGS=$ax_check_save_flags]) +AS_IF([test x"AS_VAR_GET(CACHEVAR)" = xyes], + [m4_default([$2], :)], + [m4_default([$3], :)]) +AS_VAR_POPDEF([CACHEVAR])dnl +])dnl AX_CHECK_LINK_FLAGS

1 0

[obfsproxy/master] Update README compilation instructions.
by asn＠torproject.org 10 Mar '12

10 Mar '12

commit 4aeface16c472632eecd74d1877234eb400c7d39 Author: George Kadianakis <desnacked(a)riseup.net> Date: Fri Mar 9 00:13:43 2012 -0800 Update README compilation instructions. --- ChangeLog | 1 + README | 6 +++++- 2 files changed, 6 insertions(+), 1 deletions(-) diff --git a/ChangeLog b/ChangeLog index 17feada..4e7cdbe 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,7 @@ Changes in version 0.1.1 - <not yet released> Fixes bug #5312. Patch by Peter Palfrader. - Allow doxygen documentation to be built in out-of-source builds. Fixes bug #5315. Patch by Peter Palfrader. + - Improve README installation instructions. Fixes bug #5313. Changes in version 0.1.0 - 2012-03-05 diff --git a/README b/README index 63273ac..49b744f 100644 --- a/README +++ b/README @@ -5,7 +5,11 @@ to the Tor pluggable transports specification, and its modular architecture allows it to support multiple pluggable transports. To build obfsproxy from source: - ./autogen.sh && ./configure && make + ./configure && make + +If you got the source from git, run "./autogen.sh", which will run the +various auto* programs. Then you can run ./configure, and refer to the +above instructions. See doc/ for more obfsproxy information.

1 0

[obfsproxy/master] Merge branch 'bug5313'
by asn＠torproject.org 10 Mar '12

10 Mar '12

commit 844a1a38cc6f84f71542003bf10e273f978f2f5e Merge: 754e669 4aeface Author: George Kadianakis <desnacked(a)riseup.net> Date: Fri Mar 9 16:22:57 2012 -0800 Merge branch 'bug5313' Conflicts: ChangeLog ChangeLog | 1 + README | 6 +++++- 2 files changed, 6 insertions(+), 1 deletions(-) diff --cc ChangeLog index 2e5cfa7,4e7cdbe..7cef66e --- a/ChangeLog +++ b/ChangeLog @@@ -5,8 -5,7 +5,9 @@@ Changes in version 0.1.1 - <not yet rel Fixes bug #5312. Patch by Peter Palfrader. - Allow doxygen documentation to be built in out-of-source builds. Fixes bug #5315. Patch by Peter Palfrader. + - Fix out-of-source building of tester.py. Fixes bug #5310. Patch by + Peter Palfrader. + - Improve README installation instructions. Fixes bug #5313. Changes in version 0.1.0 - 2012-03-05

1 0

[tor/maint-0.2.2] Use a given name in the bug5090 message, at its holder's request.
by nickm＠torproject.org 09 Mar '12

09 Mar '12

commit ec1bc8a979f744d70eabbf9ef37b3f9504c09cfe Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 14:50:46 2012 -0500 Use a given name in the bug5090 message, at its holder's request. --- changes/bug5090 | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/changes/bug5090 b/changes/bug5090 index 5e323de..d47858c 100644 --- a/changes/bug5090 +++ b/changes/bug5090 @@ -2,6 +2,6 @@ - Detect and reject certain misformed escape sequences in configuration values. Previously, these values would cause us to crash if received in a torrc file or over an (authenticated) control port. Bug found by - Esteban Manchado Velázquez. Patch by "flupzor." Fix for bug 5090; - bugfix on 0.2.0.16-alpha. - + Esteban Manchado Velázquez. Patch by Alexander Schrijver. Fix for + bug 5090; bugfix on 0.2.0.16-alpha. +

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2'
by nickm＠torproject.org 09 Mar '12

09 Mar '12

commit 9f88c1e14f22104992904d99b5c857838acd6cfb Merge: 978cfcf 99bd540 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 14:30:12 2012 -0500 Merge remote-tracking branch 'origin/maint-0.2.2' Conflicts: src/or/circuitbuild.c changes/bug5342 | 3 +++ src/or/circuitbuild.c | 5 +++++ 2 files changed, 8 insertions(+), 0 deletions(-) diff --cc src/or/circuitbuild.c index 7c404e6,decb18f..3948008 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@@ -2719,7 -2704,13 +2719,12 @@@ choose_good_exit_server_general(int nee n_supported[i] = -1; continue; /* skip routers that are known to be down or bad exits */ } - if (router->purpose != ROUTER_PURPOSE_GENERAL) { ++ if (node_get_purpose(node) != ROUTER_PURPOSE_GENERAL) { + /* never pick a non-general node as a random exit. */ + n_supported[i] = -1; + continue; + } - if (options->_ExcludeExitNodesUnion && - routerset_contains_router(options->_ExcludeExitNodesUnion, router)) { + if (routerset_contains_node(options->_ExcludeExitNodesUnion, node)) { n_supported[i] = -1; continue; /* user asked us not to use it, no matter what */ }

1 0

[tor/master] Never choose a bridge as an exit. Bug 5342.
by nickm＠torproject.org 09 Mar '12

09 Mar '12

commit 99bd5400e879e7313288f153f464e0b3bc0782e0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 14:27:50 2012 -0500 Never choose a bridge as an exit. Bug 5342. --- changes/bug5342 | 3 +++ src/or/circuitbuild.c | 6 +++++- 2 files changed, 8 insertions(+), 1 deletions(-) diff --git a/changes/bug5342 b/changes/bug5342 new file mode 100644 index 0000000..b2ae451 --- /dev/null +++ b/changes/bug5342 @@ -0,0 +1,3 @@ + o Security fixes: + - Never use a bridge as an exit, even if it claims to be one. Found by + wanoskarnet. Fixes bug 5342. Bugfix on ????. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 72ec9e4..decb18f 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2704,7 +2704,11 @@ choose_good_exit_server_general(routerlist_t *dir, int need_uptime, n_supported[i] = -1; continue; /* skip routers that are known to be down or bad exits */ } - + if (router->purpose != ROUTER_PURPOSE_GENERAL) { + /* never pick a non-general node as a random exit. */ + n_supported[i] = -1; + continue; + } if (options->_ExcludeExitNodesUnion && routerset_contains_router(options->_ExcludeExitNodesUnion, router)) { n_supported[i] = -1;

1 0

[tor/master] Revise "sufficient exit nodes" check to work with restrictive ExitNodes
by nickm＠torproject.org 09 Mar '12

09 Mar '12

commit 8abfcc080424654ae755de352999b3346ebcbb28 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 14:23:23 2012 -0500 Revise "sufficient exit nodes" check to work with restrictive ExitNodes If you set ExitNodes so that only 1 exit node is accepted, the previous patch would have made you unable to build circuits. --- src/or/routerlist.c | 6 ------ 1 files changed, 0 insertions(+), 6 deletions(-) diff --git a/src/or/routerlist.c b/src/or/routerlist.c index f9d2e85..86cdb83 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -4902,12 +4902,6 @@ update_router_have_minimum_dir_info(void) res = 0; control_event_bootstrap(BOOTSTRAP_STATUS_REQUESTING_DESCRIPTORS, 0); goto done; - } else if (num_exit_present < 2) { - tor_snprintf(dir_info_status, sizeof(dir_info_status), - "Only %d descriptor%s here and believed reachable!", - num_exit_present, num_exit_present ? "" : "s"); - res = 0; - goto done; } /* Check for entry nodes. */

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2'
by nickm＠torproject.org 09 Mar '12

09 Mar '12

commit 978cfcfbbb9d7960d081fd1eb26b0706cb296f3c Merge: d4526e1 8abfcc0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 14:25:18 2012 -0500 Merge remote-tracking branch 'origin/maint-0.2.2' src/or/routerlist.c | 6 ------ 1 files changed, 0 insertions(+), 6 deletions(-)

1 0

[tor/maint-0.2.2] Never choose a bridge as an exit. Bug 5342.
by nickm＠torproject.org 09 Mar '12

09 Mar '12

commit 99bd5400e879e7313288f153f464e0b3bc0782e0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 14:27:50 2012 -0500 Never choose a bridge as an exit. Bug 5342. --- changes/bug5342 | 3 +++ src/or/circuitbuild.c | 6 +++++- 2 files changed, 8 insertions(+), 1 deletions(-) diff --git a/changes/bug5342 b/changes/bug5342 new file mode 100644 index 0000000..b2ae451 --- /dev/null +++ b/changes/bug5342 @@ -0,0 +1,3 @@ + o Security fixes: + - Never use a bridge as an exit, even if it claims to be one. Found by + wanoskarnet. Fixes bug 5342. Bugfix on ????. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 72ec9e4..decb18f 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2704,7 +2704,11 @@ choose_good_exit_server_general(routerlist_t *dir, int need_uptime, n_supported[i] = -1; continue; /* skip routers that are known to be down or bad exits */ } - + if (router->purpose != ROUTER_PURPOSE_GENERAL) { + /* never pick a non-general node as a random exit. */ + n_supported[i] = -1; + continue; + } if (options->_ExcludeExitNodesUnion && routerset_contains_router(options->_ExcludeExitNodesUnion, router)) { n_supported[i] = -1;

1 0

[tor/maint-0.2.2] Revise "sufficient exit nodes" check to work with restrictive ExitNodes
by nickm＠torproject.org 09 Mar '12

09 Mar '12

commit 8abfcc080424654ae755de352999b3346ebcbb28 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 14:23:23 2012 -0500 Revise "sufficient exit nodes" check to work with restrictive ExitNodes If you set ExitNodes so that only 1 exit node is accepted, the previous patch would have made you unable to build circuits. --- src/or/routerlist.c | 6 ------ 1 files changed, 0 insertions(+), 6 deletions(-) diff --git a/src/or/routerlist.c b/src/or/routerlist.c index f9d2e85..86cdb83 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -4902,12 +4902,6 @@ update_router_have_minimum_dir_info(void) res = 0; control_event_bootstrap(BOOTSTRAP_STATUS_REQUESTING_DESCRIPTORS, 0); goto done; - } else if (num_exit_present < 2) { - tor_snprintf(dir_info_status, sizeof(dir_info_status), - "Only %d descriptor%s here and believed reachable!", - num_exit_present, num_exit_present ? "" : "s"); - res = 0; - goto done; } /* Check for entry nodes. */

1 0