April 2012 - tor-commits - lists.torproject.org

[tor/release-0.2.2] Merge remote-tracking branch 'karsten/geoip-march2012' into maint-0.2.2
by arma＠torproject.org 05 Apr '12

05 Apr '12

commit 9d5d3a7fd45265358069f0077857da1d7afaad61 Merge: e217569 c5d7ee7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 8 10:50:03 2012 -0500 Merge remote-tracking branch 'karsten/geoip-march2012' into maint-0.2.2 changes/geoip-march2012 | 3 + src/config/geoip |26743 +++++++++++++++++++++++++++++++++++------------ 2 files changed, 19971 insertions(+), 6775 deletions(-)

1 0

[tor/release-0.2.2] Fix compile warnings in openbsd malloc
by arma＠torproject.org 05 Apr '12

05 Apr '12

commit fe50b676bc905c527254d0bbd1f7c36d41512efe Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Thu Mar 8 19:27:05 2012 +0100 Fix compile warnings in openbsd malloc --- changes/bug5340 | 3 +++ src/common/OpenBSD_malloc_Linux.c | 5 ++++- 2 files changed, 7 insertions(+), 1 deletions(-) diff --git a/changes/bug5340 b/changes/bug5340 new file mode 100644 index 0000000..708988a --- /dev/null +++ b/changes/bug5340 @@ -0,0 +1,3 @@ + o Minor bugfixes: + - Fix a compile warning when using the --enable-openbsd-malloc configure + option. Fixes bug 5340; bugfix on 0.2.0.20-rc. diff --git a/src/common/OpenBSD_malloc_Linux.c b/src/common/OpenBSD_malloc_Linux.c index 445135c..92ca9c0 100644 --- a/src/common/OpenBSD_malloc_Linux.c +++ b/src/common/OpenBSD_malloc_Linux.c @@ -285,6 +285,8 @@ static void *imalloc(size_t size); static void ifree(void *ptr); static void *irealloc(void *ptr, size_t size); static void *malloc_bytes(size_t size); +void *memalign(size_t boundary, size_t size); +size_t malloc_good_size(size_t size); /* * Function for page directory lookup. @@ -1980,10 +1982,11 @@ static int ispowerof2 (size_t a) { int posix_memalign(void **memptr, size_t alignment, size_t size) { void *r; + size_t max; if ((alignment < PTR_SIZE) || (alignment%PTR_SIZE != 0)) return EINVAL; if (!ispowerof2(alignment)) return EINVAL; if (alignment < malloc_minsize) alignment = malloc_minsize; - size_t max = alignment > size ? alignment : size; + max = alignment > size ? alignment : size; if (alignment <= malloc_pagesize) r = malloc(max); else {

1 0

[tor/release-0.2.2] Require a threshold of exit nodes before building circuits
by arma＠torproject.org 05 Apr '12

05 Apr '12

commit ec8a06c5a17c1c4c0b5ff17e73810d98fcdf949b Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 8 15:42:54 2012 -0500 Require a threshold of exit nodes before building circuits This mitigates an attack proposed by wanoskarnet, in which all of a client's bridges collude to restrict the exit nodes that the client knows about. Fixes bug 5343. --- changes/bug5343 | 7 +++++++ src/or/routerlist.c | 29 ++++++++++++++++++++++++----- 2 files changed, 31 insertions(+), 5 deletions(-) diff --git a/changes/bug5343 b/changes/bug5343 new file mode 100644 index 0000000..e4e1489 --- /dev/null +++ b/changes/bug5343 @@ -0,0 +1,7 @@ + o Security fixes: + - Only build circuits if we have a sufficient threshold of the total + descriptors marked in the consensus with the "Exit" flag. This + mitigates an attack proposed by wanoskarnet, in which all of a + client's bridges collude to restrict the exit nodes that the + client knows about. Fixes bug 5343. + diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 1edf651..f9d2e85 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -4788,18 +4788,21 @@ get_dir_info_status_string(void) * them seem like ones we'd use, and how many of those we have * descriptors for. Store the former in *num_usable and the latter in * *num_present. If in_set is non-NULL, only consider those - * routers in in_set. + * routers in in_set. If exit_only is true, only consider nodes + * with the Exit flag. */ static void count_usable_descriptors(int *num_present, int *num_usable, const networkstatus_t *consensus, or_options_t *options, time_t now, - routerset_t *in_set) + routerset_t *in_set, int exit_only) { *num_present = 0, *num_usable=0; SMARTLIST_FOREACH(consensus->routerstatus_list, routerstatus_t *, rs, { + if (exit_only && ! rs->is_exit) + continue; if (in_set && ! routerset_contains_routerstatus(in_set, rs)) continue; if (client_would_use_router(rs, now, options)) { @@ -4830,7 +4833,7 @@ count_loading_descriptors_progress(void) return 0; /* can't count descriptors if we have no list of them */ count_usable_descriptors(&num_present, &num_usable, - consensus, get_options(), now, NULL); + consensus, get_options(), now, NULL, 0); if (num_usable == 0) return 0; /* don't div by 0 */ @@ -4849,6 +4852,7 @@ static void update_router_have_minimum_dir_info(void) { int num_present = 0, num_usable=0; + int num_exit_present = 0, num_exit_usable = 0; time_t now = time(NULL); int res; or_options_t *options = get_options(); @@ -4875,7 +4879,9 @@ update_router_have_minimum_dir_info(void) } count_usable_descriptors(&num_present, &num_usable, consensus, options, now, - NULL); + NULL, 0); + count_usable_descriptors(&num_exit_present, &num_exit_usable, + consensus, options, now, options->ExitNodes, 1); if (num_present < num_usable/4) { tor_snprintf(dir_info_status, sizeof(dir_info_status), @@ -4889,12 +4895,25 @@ update_router_have_minimum_dir_info(void) num_present, num_present ? "" : "s"); res = 0; goto done; + } else if (num_exit_present < num_exit_usable / 3) { + tor_snprintf(dir_info_status, sizeof(dir_info_status), + "We have only %d/%d usable exit node descriptors.", + num_exit_present, num_exit_usable); + res = 0; + control_event_bootstrap(BOOTSTRAP_STATUS_REQUESTING_DESCRIPTORS, 0); + goto done; + } else if (num_exit_present < 2) { + tor_snprintf(dir_info_status, sizeof(dir_info_status), + "Only %d descriptor%s here and believed reachable!", + num_exit_present, num_exit_present ? "" : "s"); + res = 0; + goto done; } /* Check for entry nodes. */ if (options->EntryNodes) { count_usable_descriptors(&num_present, &num_usable, consensus, options, - now, options->EntryNodes); + now, options->EntryNodes, 0); if (!num_usable || !num_present) { tor_snprintf(dir_info_status, sizeof(dir_info_status),

1 0

[tor/release-0.2.2] Correctly handle broken escape sequences in torrc values
by arma＠torproject.org 05 Apr '12

05 Apr '12

commit be0535f00ba40f777a9f47aa41a98aa48254d37c Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 11:50:22 2012 -0500 Correctly handle broken escape sequences in torrc values Previously, malformatted torrc values could crash us. Patch by Esteban Manchado. Fixes bug 5090; fix on 0.2.0.16-alpha. --- changes/bug5090 | 6 ++++++ src/common/util.c | 24 ++++++++++++++++++------ 2 files changed, 24 insertions(+), 6 deletions(-) diff --git a/changes/bug5090 b/changes/bug5090 new file mode 100644 index 0000000..240d470 --- /dev/null +++ b/changes/bug5090 @@ -0,0 +1,6 @@ + o Minor bugfixes: + - Detect and reject certain misformed escape sequences in configuration + values. Previously, these values would cause us to crash if received + in a torrc file or over an (authenticated) control port. Patch by + Esteban Manchado Velázquez. Fix for bug 5090; bugfix on 0.2.0.16-alpha. + diff --git a/src/common/util.c b/src/common/util.c index 7675ede..e3cd154 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -2212,14 +2212,16 @@ unescape_string(const char *s, char **result, size_t *size_out) case '\"': goto end_of_loop; case '\\': - if ((cp[1] == 'x' || cp[1] == 'X') - && TOR_ISXDIGIT(cp[2]) && TOR_ISXDIGIT(cp[3])) { + if (cp[1] == 'x' || cp[1] == 'X') { + if (!(TOR_ISXDIGIT(cp[2]) && TOR_ISXDIGIT(cp[3]))) + return NULL; cp += 4; } else if (TOR_ISODIGIT(cp[1])) { cp += 2; if (TOR_ISODIGIT(*cp)) ++cp; if (TOR_ISODIGIT(*cp)) ++cp; - } else if (cp[1]) { + } else if (cp[1] == 'n' || cp[1] == 'r' || cp[1] == 't' || cp[1] == '"' + || cp[1] == '\\' || cp[1] == '\'') { cp += 2; } else { return NULL; @@ -2251,9 +2253,19 @@ unescape_string(const char *s, char **result, size_t *size_out) case 'r': *out++ = '\r'; cp += 2; break; case 't': *out++ = '\t'; cp += 2; break; case 'x': case 'X': - *out++ = ((hex_decode_digit(cp[2])<<4) + - hex_decode_digit(cp[3])); - cp += 4; + { + int x1, x2; + + x1 = hex_decode_digit(cp[2]); + x2 = hex_decode_digit(cp[3]); + if (x1 == -1 || x2 == -1) { + tor_free(*result); + return NULL; + } + + *out++ = ((x1<<4) + x2); + cp += 4; + } break; case '0': case '1': case '2': case '3': case '4': case '5': case '6': case '7':

1 0

[tor/release-0.2.2] Oops; credit bug5090 patch to flupzor. estebanm only found the bug.
by arma＠torproject.org 05 Apr '12

05 Apr '12

commit 31f253ae6a96ea88425f8ea5c287f5eda599c9e9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 11:54:27 2012 -0500 Oops; credit bug5090 patch to flupzor. estebanm only found the bug. --- changes/bug5090 | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/changes/bug5090 b/changes/bug5090 index 240d470..5e323de 100644 --- a/changes/bug5090 +++ b/changes/bug5090 @@ -1,6 +1,7 @@ o Minor bugfixes: - Detect and reject certain misformed escape sequences in configuration values. Previously, these values would cause us to crash if received - in a torrc file or over an (authenticated) control port. Patch by - Esteban Manchado Velázquez. Fix for bug 5090; bugfix on 0.2.0.16-alpha. + in a torrc file or over an (authenticated) control port. Bug found by + Esteban Manchado Velázquez. Patch by "flupzor." Fix for bug 5090; + bugfix on 0.2.0.16-alpha.

1 0

[tor/release-0.2.2] Merge branch 'bug5343' into maint-0.2.2
by arma＠torproject.org 05 Apr '12

05 Apr '12

commit a574f7f3fe7b4f7300c1ced5f67d8e014e04ffbd Merge: 31f253a ec8a06c Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 13:54:04 2012 -0500 Merge branch 'bug5343' into maint-0.2.2 changes/bug5343 | 7 +++++++ src/or/routerlist.c | 29 ++++++++++++++++++++++++----- 2 files changed, 31 insertions(+), 5 deletions(-)

1 0

[tor/release-0.2.2] Revise "sufficient exit nodes" check to work with restrictive ExitNodes
by arma＠torproject.org 05 Apr '12

05 Apr '12

commit 8abfcc080424654ae755de352999b3346ebcbb28 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 14:23:23 2012 -0500 Revise "sufficient exit nodes" check to work with restrictive ExitNodes If you set ExitNodes so that only 1 exit node is accepted, the previous patch would have made you unable to build circuits. --- src/or/routerlist.c | 6 ------ 1 files changed, 0 insertions(+), 6 deletions(-) diff --git a/src/or/routerlist.c b/src/or/routerlist.c index f9d2e85..86cdb83 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -4902,12 +4902,6 @@ update_router_have_minimum_dir_info(void) res = 0; control_event_bootstrap(BOOTSTRAP_STATUS_REQUESTING_DESCRIPTORS, 0); goto done; - } else if (num_exit_present < 2) { - tor_snprintf(dir_info_status, sizeof(dir_info_status), - "Only %d descriptor%s here and believed reachable!", - num_exit_present, num_exit_present ? "" : "s"); - res = 0; - goto done; } /* Check for entry nodes. */

1 0

[tor/release-0.2.2] Never choose a bridge as an exit. Bug 5342.
by arma＠torproject.org 05 Apr '12

05 Apr '12

commit 99bd5400e879e7313288f153f464e0b3bc0782e0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 14:27:50 2012 -0500 Never choose a bridge as an exit. Bug 5342. --- changes/bug5342 | 3 +++ src/or/circuitbuild.c | 6 +++++- 2 files changed, 8 insertions(+), 1 deletions(-) diff --git a/changes/bug5342 b/changes/bug5342 new file mode 100644 index 0000000..b2ae451 --- /dev/null +++ b/changes/bug5342 @@ -0,0 +1,3 @@ + o Security fixes: + - Never use a bridge as an exit, even if it claims to be one. Found by + wanoskarnet. Fixes bug 5342. Bugfix on ????. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 72ec9e4..decb18f 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2704,7 +2704,11 @@ choose_good_exit_server_general(routerlist_t *dir, int need_uptime, n_supported[i] = -1; continue; /* skip routers that are known to be down or bad exits */ } - + if (router->purpose != ROUTER_PURPOSE_GENERAL) { + /* never pick a non-general node as a random exit. */ + n_supported[i] = -1; + continue; + } if (options->_ExcludeExitNodesUnion && routerset_contains_router(options->_ExcludeExitNodesUnion, router)) { n_supported[i] = -1;

1 0

[tor/release-0.2.2] Use a given name in the bug5090 message, at its holder's request.
by arma＠torproject.org 05 Apr '12

05 Apr '12

commit ec1bc8a979f744d70eabbf9ef37b3f9504c09cfe Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 9 14:50:46 2012 -0500 Use a given name in the bug5090 message, at its holder's request. --- changes/bug5090 | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/changes/bug5090 b/changes/bug5090 index 5e323de..d47858c 100644 --- a/changes/bug5090 +++ b/changes/bug5090 @@ -2,6 +2,6 @@ - Detect and reject certain misformed escape sequences in configuration values. Previously, these values would cause us to crash if received in a torrc file or over an (authenticated) control port. Bug found by - Esteban Manchado Velázquez. Patch by "flupzor." Fix for bug 5090; - bugfix on 0.2.0.16-alpha. - + Esteban Manchado Velázquez. Patch by Alexander Schrijver. Fix for + bug 5090; bugfix on 0.2.0.16-alpha. +

1 0

[tor/release-0.2.2] Merge commit 'a5704b1c624c9a808f52f3a125339f00e2b9a378' into maint-0.2.2
by arma＠torproject.org 05 Apr '12

05 Apr '12

commit 650e2aac46ed9857eed1863cefda45c632bb21eb Merge: ec1bc8a a5704b1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 26 13:59:49 2012 -0400 Merge commit 'a5704b1c624c9a808f52f3a125339f00e2b9a378' into maint-0.2.2 src/common/crypto.c | 68 +++++++++++++++++++++++++++++++++++++++++++++ src/common/crypto.h | 3 ++ src/test/test_crypto.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 141 insertions(+), 1 deletions(-)

1 0