July 2012 - tor-commits - lists.torproject.org

[tor/master] Merge remote-tracking branch 'nickm/bug6271_part_a' into maint-0.2.3
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 27ec0248d2460cdfc52462d313272c206ab46f02 Merge: 62c1311 419f541 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jul 6 08:57:29 2012 -0400 Merge remote-tracking branch 'nickm/bug6271_part_a' into maint-0.2.3 changes/bug6271 | 7 +++++++ src/or/relay.c | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.2.3'
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 1fee920999bb51e2831b03faff7dabbcf20355e7 Merge: 7e1a0bb 27ec024 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jul 6 08:59:26 2012 -0400 Merge branch 'maint-0.2.3' changes/bug6271 | 7 +++++++ src/or/relay.c | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletions(-)

1 0

[tor/release-0.2.3] bump version to 0.2.3.18-rc-dev
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 9c5a118272bfbb7d4c287f4310237bf90a404c63 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 28 16:01:55 2012 -0400 bump version to 0.2.3.18-rc-dev --- configure.in | 2 +- contrib/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.in b/configure.in index e9ef4f8..1db7d08 100644 --- a/configure.in +++ b/configure.in @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2012, The Tor Project, Inc. dnl See LICENSE for licensing information AC_INIT -AM_INIT_AUTOMAKE(tor, 0.2.3.18-rc) +AM_INIT_AUTOMAKE(tor, 0.2.3.18-rc-dev) AM_CONFIG_HEADER(orconfig.h) AC_CANONICAL_HOST diff --git a/contrib/tor-mingw.nsi.in b/contrib/tor-mingw.nsi.in index 75b2567..2133a47 100644 --- a/contrib/tor-mingw.nsi.in +++ b/contrib/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.3.18-rc" +!define VERSION "0.2.3.18-rc-dev" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index a5bd2ee..d780d5d 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -232,7 +232,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.3.18-rc" +#define VERSION "0.2.3.18-rc-dev"

1 0

[tor/release-0.2.3] Detect bug 6252 (unexpected sendme cell)
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit c32ec9c425e9539bcc8ede95612e2d331c2cc2dd Author: Roger Dingledine <arma(a)torproject.org> Date: Thu Jun 28 14:00:01 2012 -0400 Detect bug 6252 (unexpected sendme cell) I only check on circuits, not streams, since bloating your stream window past the initial circuit window can't help you much. Also, I compare to CIRCWINDOW_START_MAX so we don't have surprising races if we lower CIRCWINDOW_START for an experiment. --- changes/bug6252 | 8 ++++++++ src/or/relay.c | 14 ++++++++++++++ 2 files changed, 22 insertions(+), 0 deletions(-) diff --git a/changes/bug6252 b/changes/bug6252 new file mode 100644 index 0000000..0d29203 --- /dev/null +++ b/changes/bug6252 @@ -0,0 +1,8 @@ + o Security fixes: + - Tear down the circuit if we get an unexpected SENDME cell. Clients + could use this trick to make their circuits receive cells faster + than our flow control would have allowed, or to gum up the network, + or possibly to do targeted memory denial-of-service attacks on + entry nodes. Fixes bug 6252. Bugfix on the 54th commit on Tor -- + from July 2002, before the release of Tor 0.0.0. + diff --git a/src/or/relay.c b/src/or/relay.c index 3f894bf..4ab4403 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1265,11 +1265,25 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, case RELAY_COMMAND_SENDME: if (!conn) { if (layer_hint) { + if (layer_hint->package_window + CIRCWINDOW_INCREMENT > + CIRCWINDOW_START_MAX) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Bug/attack: unexpected sendme cell from exit relay. " + "Closing circ."); + return -END_CIRC_REASON_TORPROTOCOL; + } layer_hint->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP,"circ-level sendme at origin, packagewindow %d.", layer_hint->package_window); circuit_resume_edge_reading(circ, layer_hint); } else { + if (circ->package_window + CIRCWINDOW_INCREMENT > + CIRCWINDOW_START_MAX) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Bug/attack: unexpected sendme cell from client. " + "Closing circ."); + return -END_CIRC_REASON_TORPROTOCOL; + } circ->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP, "circ-level sendme at non-origin, packagewindow %d.",

1 0

[tor/release-0.2.3] Revert "Detect bug 6252 (unexpected sendme cell)"
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit d13389b30ec2e17a8f08a00f82fac420ae968cd1 Author: Roger Dingledine <arma(a)torproject.org> Date: Sun Jul 1 17:36:35 2012 -0400 Revert "Detect bug 6252 (unexpected sendme cell)" This reverts commit c32ec9c425e9539bcc8ede95612e2d331c2cc2dd. It turns out the two sides of the circuit don't actually stay in sync, so it is perfectly normal for the circuit window on the exit relay to grow to 2000+. We should fix that bug and then reconsider this patch. --- changes/bug6252 | 8 -------- src/or/relay.c | 14 -------------- 2 files changed, 0 insertions(+), 22 deletions(-) diff --git a/changes/bug6252 b/changes/bug6252 deleted file mode 100644 index 0d29203..0000000 --- a/changes/bug6252 +++ /dev/null @@ -1,8 +0,0 @@ - o Security fixes: - - Tear down the circuit if we get an unexpected SENDME cell. Clients - could use this trick to make their circuits receive cells faster - than our flow control would have allowed, or to gum up the network, - or possibly to do targeted memory denial-of-service attacks on - entry nodes. Fixes bug 6252. Bugfix on the 54th commit on Tor -- - from July 2002, before the release of Tor 0.0.0. - diff --git a/src/or/relay.c b/src/or/relay.c index 4ab4403..3f894bf 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1265,25 +1265,11 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, case RELAY_COMMAND_SENDME: if (!conn) { if (layer_hint) { - if (layer_hint->package_window + CIRCWINDOW_INCREMENT > - CIRCWINDOW_START_MAX) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Bug/attack: unexpected sendme cell from exit relay. " - "Closing circ."); - return -END_CIRC_REASON_TORPROTOCOL; - } layer_hint->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP,"circ-level sendme at origin, packagewindow %d.", layer_hint->package_window); circuit_resume_edge_reading(circ, layer_hint); } else { - if (circ->package_window + CIRCWINDOW_INCREMENT > - CIRCWINDOW_START_MAX) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Bug/attack: unexpected sendme cell from client. " - "Closing circ."); - return -END_CIRC_REASON_TORPROTOCOL; - } circ->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP, "circ-level sendme at non-origin, packagewindow %d.",

1 0

[tor/release-0.2.3] On windows, ENOBUFS starts with WSA. #6296. Fix on 0.2.18-rc
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit e9b33ed1bf4140e3aeda5eb9126027fbe5a3ec5a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jul 5 05:01:00 2012 -0400 On windows, ENOBUFS starts with WSA. #6296. Fix on 0.2.18-rc --- changes/bug6296 | 4 ++++ src/common/compat.h | 3 +++ src/or/connection.c | 4 ++-- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/changes/bug6296 b/changes/bug6296 new file mode 100644 index 0000000..b452b17 --- /dev/null +++ b/changes/bug6296 @@ -0,0 +1,4 @@ + o Minor bugfixes: + + - Instead of ENOBUFS on Windows, say WSAENOBUFS. Fixes + compilation on Windows. Fixes bug 6296; bugfix on 0.2.3.18-rc. diff --git a/src/common/compat.h b/src/common/compat.h index 4efb0c8..42648bb 100644 --- a/src/common/compat.h +++ b/src/common/compat.h @@ -500,6 +500,8 @@ int network_init(void); * the actual errno after a socket operation fails. */ #if defined(_WIN32) +/** Expands to WSA<b>e</b> on Windows, and to <b>e</b> elsewhere. */ +#define SOCK_ERRNO(e) WSA##e /** Return true if e is EAGAIN or the local equivalent. */ #define ERRNO_IS_EAGAIN(e) ((e) == EAGAIN || (e) == WSAEWOULDBLOCK) /** Return true if e is EINPROGRESS or the local equivalent. */ @@ -520,6 +522,7 @@ int network_init(void); int tor_socket_errno(tor_socket_t sock); const char *tor_socket_strerror(int e); #else +#define SOCK_ERRNO(e) e #define ERRNO_IS_EAGAIN(e) ((e) == EAGAIN) #define ERRNO_IS_EINPROGRESS(e) ((e) == EINPROGRESS) #define ERRNO_IS_CONN_EINPROGRESS(e) ((e) == EINPROGRESS) diff --git a/src/or/connection.c b/src/or/connection.c index af5c011..95101ef 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -1336,7 +1336,7 @@ connection_connect(connection_t *conn, const char *address, if (get_n_open_sockets() >= get_options()->_ConnLimit-1) { warn_too_many_conns(); - *socket_error = ENOBUFS; + *socket_error = SOCK_ERRNO(ENOBUFS); return -1; } @@ -1431,7 +1431,7 @@ connection_connect(connection_t *conn, const char *address, conn->s = s; if (connection_add_connecting(conn) < 0) { /* no space, forget it */ - *socket_error = ENOBUFS; + *socket_error = SOCK_ERRNO(ENOBUFS); return -1; } return inprogress ? 0 : 1;

1 0

[tor/release-0.2.3] Fix a bug handling SENDME cells on nonexistent streams.
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 419f541aa737d3ab230ec2595d0614e2d94a5e44 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jul 6 07:29:54 2012 -0400 Fix a bug handling SENDME cells on nonexistent streams. This could result in bizarre window values. Report and patch contributed pseudymously. Fixes part of bug 6271. This bug was introduced before the first Tor release, in svn commit r152. (bug 6271, part a.) --- changes/bug6271 | 7 +++++++ src/or/relay.c | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletions(-) diff --git a/changes/bug6271 b/changes/bug6271 new file mode 100644 index 0000000..06b129f --- /dev/null +++ b/changes/bug6271 @@ -0,0 +1,7 @@ + o Major bugfixes + + - Fix a bug handling SENDME cells on nonexistent streams that + could result in bizarre window values. Report and patch + contributed pseudymously. Fixes part of bug 6271. This bug + was introduced before the first Tor release, in svn commit + r152. diff --git a/src/or/relay.c b/src/or/relay.c index b637fad..50c1455 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1220,7 +1220,7 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, "'connected' received, no conn attached anymore. Ignoring."); return 0; case RELAY_COMMAND_SENDME: - if (!conn) { + if (!rh.stream_id) { if (layer_hint) { layer_hint->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP,"circ-level sendme at origin, packagewindow %d.", @@ -1235,6 +1235,11 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, } return 0; } + if (!conn) { + log_info(domain,"sendme cell dropped, unknown stream (streamid %d).", + rh.stream_id); + return 0; + } conn->package_window += STREAMWINDOW_INCREMENT; log_debug(domain,"stream-level sendme, packagewindow now %d.", conn->package_window);

1 0

[tor/release-0.2.3] Merge remote-tracking branch 'nickm/bug6271_part_a' into maint-0.2.3
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 27ec0248d2460cdfc52462d313272c206ab46f02 Merge: 62c1311 419f541 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jul 6 08:57:29 2012 -0400 Merge remote-tracking branch 'nickm/bug6271_part_a' into maint-0.2.3 changes/bug6271 | 7 +++++++ src/or/relay.c | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletions(-)

1 0

[tor/release-0.2.3] Fix port range in parse_port_range().
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 62c1311b3ab57c61488ecfc8c94fabb5f2c70e6e Author: George Kadianakis <desnacked(a)riseup.net> Date: Fri Jun 22 18:24:06 2012 +0300 Fix port range in parse_port_range(). --- changes/bug6218 | 3 +++ src/common/address.c | 2 +- 2 files changed, 4 insertions(+), 1 deletions(-) diff --git a/changes/bug6218 b/changes/bug6218 new file mode 100644 index 0000000..5d5d108 --- /dev/null +++ b/changes/bug6218 @@ -0,0 +1,3 @@ + o Minor bugfixes: + - Fix wrong TCP port range in parse_port_range(). Fixes bug 6218; + bugfix on 0.2.1.10-alpha. diff --git a/src/common/address.c b/src/common/address.c index 30665fa..e88869f 100644 --- a/src/common/address.c +++ b/src/common/address.c @@ -1526,7 +1526,7 @@ parse_port_range(const char *port, uint16_t *port_min_out, } else if (endptr && *endptr == '-') { port = endptr+1; endptr = NULL; - port_max = (int)tor_parse_long(port, 10, 1, 65536, &ok, &endptr); + port_max = (int)tor_parse_long(port, 10, 1, 65535, &ok, &endptr); if (!ok) { log_warn(LD_GENERAL, "Malformed port %s on address range; rejecting.",

1 0

[tor/maint-0.2.3] Fix a bug handling SENDME cells on nonexistent streams.
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 419f541aa737d3ab230ec2595d0614e2d94a5e44 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jul 6 07:29:54 2012 -0400 Fix a bug handling SENDME cells on nonexistent streams. This could result in bizarre window values. Report and patch contributed pseudymously. Fixes part of bug 6271. This bug was introduced before the first Tor release, in svn commit r152. (bug 6271, part a.) --- changes/bug6271 | 7 +++++++ src/or/relay.c | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletions(-) diff --git a/changes/bug6271 b/changes/bug6271 new file mode 100644 index 0000000..06b129f --- /dev/null +++ b/changes/bug6271 @@ -0,0 +1,7 @@ + o Major bugfixes + + - Fix a bug handling SENDME cells on nonexistent streams that + could result in bizarre window values. Report and patch + contributed pseudymously. Fixes part of bug 6271. This bug + was introduced before the first Tor release, in svn commit + r152. diff --git a/src/or/relay.c b/src/or/relay.c index b637fad..50c1455 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1220,7 +1220,7 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, "'connected' received, no conn attached anymore. Ignoring."); return 0; case RELAY_COMMAND_SENDME: - if (!conn) { + if (!rh.stream_id) { if (layer_hint) { layer_hint->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP,"circ-level sendme at origin, packagewindow %d.", @@ -1235,6 +1235,11 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, } return 0; } + if (!conn) { + log_info(domain,"sendme cell dropped, unknown stream (streamid %d).", + rh.stream_id); + return 0; + } conn->package_window += STREAMWINDOW_INCREMENT; log_debug(domain,"stream-level sendme, packagewindow now %d.", conn->package_window);

1 0