September 2012 - tor-commits - lists.torproject.org

[tor/release-0.2.3] Merge remote-tracking branch 'public/bug6404' into maint-0.2.3
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit 991a8acba2e2148a576465c3e07e9f6ce4864ea1 Merge: 88859b2 a4fbfa8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Aug 21 10:35:40 2012 -0400 Merge remote-tracking branch 'public/bug6404' into maint-0.2.3 changes/bug6404 | 16 ++++++++++++++++ src/or/dirvote.c | 48 ++++++++++++++++++++++++++++++------------------ src/or/microdesc.c | 7 +------ src/or/routerparse.c | 5 +++++ 4 files changed, 52 insertions(+), 24 deletions(-)

1 0

[tor/release-0.2.3] whitespace fix
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit 88859b2ff1fdd4e5f4fab8ad818131ea3c2dd1c8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Aug 17 17:10:03 2012 -0400 whitespace fix --- src/or/config.h | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/src/or/config.h b/src/or/config.h index 48f4e86..dd76edc 100644 --- a/src/or/config.h +++ b/src/or/config.h @@ -102,6 +102,5 @@ int addressmap_register_auto(const char *from, const char *to, addressmap_entry_source_t addrmap_source, const char **msg); - #endif

1 0

[tor/release-0.2.3] Merge remote-tracking branch 'public/bug6472' into maint-0.2.3
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit ce4add498f6af197a0e856d262825d547f898305 Merge: 991a8ac 223e7cf Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Aug 24 12:51:02 2012 -0400 Merge remote-tracking branch 'public/bug6472' into maint-0.2.3 changes/bug6472 | 4 ++++ src/or/dns.c | 16 ++++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-)

1 0

[tor/release-0.2.3] When iterating over connections pending DNS, skip marked ones
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit 223e7cfabec5a75a7acd919210f838511e39cb16 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Aug 17 16:46:11 2012 -0400 When iterating over connections pending DNS, skip marked ones Failure to do this would lead to double-free cases and similar, especially when the exit's DNS was broken. See bug 6472 for full details; this is a fix for 6472. Anonymous patch from "cypherpunks" on trac. --- changes/bug6472 | 4 ++++ src/or/dns.c | 16 ++++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/changes/bug6472 b/changes/bug6472 new file mode 100644 index 0000000..dcd42eb --- /dev/null +++ b/changes/bug6472 @@ -0,0 +1,4 @@ + o Minor bugfixes: + - Avoid a pair of double-free and use-after-mark bugs that can + occur with certain timings in canceled and re-received DNS + requests. Fix for bug 6472; bugfix on 0.0.7rc1. diff --git a/src/or/dns.c b/src/or/dns.c index 3e88fad..78893bf 100644 --- a/src/or/dns.c +++ b/src/or/dns.c @@ -450,16 +450,17 @@ purge_expired_resolves(time_t now) if (resolve->pending_connections) { log_debug(LD_EXIT, "Closing pending connections on timed-out DNS resolve!"); - tor_fragile_assert(); while (resolve->pending_connections) { pend = resolve->pending_connections; resolve->pending_connections = pend->next; /* Connections should only be pending if they have no socket. */ tor_assert(!SOCKET_OK(pend->conn->_base.s)); pendconn = pend->conn; - connection_edge_end(pendconn, END_STREAM_REASON_TIMEOUT); - circuit_detach_stream(circuit_get_by_edge_conn(pendconn), pendconn); - connection_free(TO_CONN(pendconn)); + if (!pendconn->_base.marked_for_close) { + connection_edge_end(pendconn, END_STREAM_REASON_TIMEOUT); + circuit_detach_stream(circuit_get_by_edge_conn(pendconn), pendconn); + connection_free(TO_CONN(pendconn)); + } tor_free(pend); } } @@ -1091,6 +1092,13 @@ dns_found_answer(const char *address, uint8_t is_reverse, uint32_t addr, pendconn = pend->conn; /* don't pass complex things to the connection_mark_for_close macro */ assert_connection_ok(TO_CONN(pendconn),time(NULL)); + if (pendconn->_base.marked_for_close) { + /* prevent double-remove. */ + pendconn->_base.state = EXIT_CONN_STATE_RESOLVEFAILED; + resolve->pending_connections = pend->next; + tor_free(pend); + continue; + } tor_addr_from_ipv4h(&pendconn->_base.addr, addr); pendconn->address_ttl = ttl;

1 0

[tor/release-0.2.3] Disable extending to private/internal addresses by default
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit b7c172c9ec762363562220a354feefc521970d7c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 11:16:44 2012 -0400 Disable extending to private/internal addresses by default This is important, since otherwise an attacker can use timing info to probe the internal network. Also, add an option (ExtendAllowPrivateAddresses) so that TestingTorNetwork won't break. Fix for bug 6710; bugfix on all released versions of Tor. --- changes/bug6710 | 7 +++++++ doc/tor.1.txt | 6 ++++++ src/or/circuitbuild.c | 7 +++++++ src/or/config.c | 2 ++ src/or/or.h | 4 +++- 5 files changed, 25 insertions(+), 1 deletions(-) diff --git a/changes/bug6710 b/changes/bug6710 new file mode 100644 index 0000000..69a3c7e --- /dev/null +++ b/changes/bug6710 @@ -0,0 +1,7 @@ + o Major bugfixes (security): + - Reject any attempt to extend to an internal address. Without + this fix, a router could be used to probe addresses on an + internal network to see whether they were accepting + connections. Fix for bug 6710; bugfix on all released versions + of Tor. + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index e7ba848..7e0751b 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1470,6 +1470,11 @@ is non-zero): its extra-info documents that it uploads to the directory authorities. (Default: 1) +**ExtendAllowPrivateAddresses** **0**|**1**:: + When this option is enabled, Tor routers allow EXTEND request to + localhost, RFC1918 addresses, and so on. This can create security issues; + you should probably leave it off. (Default: 0) + DIRECTORY SERVER OPTIONS ------------------------ @@ -1795,6 +1800,7 @@ The following options are used for running a testing Tor network. ClientRejectInternalAddresses 0 CountPrivateBandwidth 1 ExitPolicyRejectPrivate 0 + ExtendAllowPrivateAddresses 1 V3AuthVotingInterval 5 minutes V3AuthVoteDelay 20 seconds V3AuthDistDelay 20 seconds diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 39a223b..f11bebf 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2432,6 +2432,13 @@ circuit_extend(cell_t *cell, circuit_t *circ) return -1; } + if (tor_addr_is_internal(&n_addr, 0) && + !get_options()->ExtendAllowPrivateAddresses) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Client asked me to extend to a private address"); + return -1; + } + /* Check if they asked us for 0000..0000. We support using * an empty fingerprint for the first hop (e.g. for a bridge relay), * but we don't want to let people send us extend cells for empty diff --git a/src/or/config.c b/src/or/config.c index 3970808..d5e80cc 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -276,6 +276,7 @@ static config_var_t _option_vars[] = { V(ExitPolicy, LINELIST, NULL), V(ExitPolicyRejectPrivate, BOOL, "1"), V(ExitPortStatistics, BOOL, "0"), + V(ExtendAllowPrivateAddresses, BOOL, "0"), V(ExtraInfoStatistics, BOOL, "1"), #if defined (WINCE) @@ -473,6 +474,7 @@ static const config_var_t testing_tor_network_defaults[] = { V(ClientRejectInternalAddresses, BOOL, "0"), V(CountPrivateBandwidth, BOOL, "1"), V(ExitPolicyRejectPrivate, BOOL, "0"), + V(ExtendAllowPrivateAddresses, BOOL, "1"), V(V3AuthVotingInterval, INTERVAL, "5 minutes"), V(V3AuthVoteDelay, INTERVAL, "20 seconds"), V(V3AuthDistDelay, INTERVAL, "20 seconds"), diff --git a/src/or/or.h b/src/or/or.h index 908daa6..9074083 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3029,8 +3029,10 @@ typedef struct { config_line_t *RecommendedVersions; config_line_t *RecommendedClientVersions; config_line_t *RecommendedServerVersions; - /** Whether dirservers refuse router descriptors with private IPs. */ + /** Whether dirservers allow router descriptors with private IPs. */ int DirAllowPrivateAddresses; + /** Whether routers accept EXTEND cells to routers with private IPs. */ + int ExtendAllowPrivateAddresses; char *User; /**< Name of user to run Tor as. */ char *Group; /**< Name of group to run Tor as. */ config_line_t *ORPort_lines; /**< Ports to listen on for OR connections. */

1 0

[tor/release-0.2.3] Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit 443e4ae1ee0520cead27dd3a21e9f79b1bed8f8b Merge: ce4add4 1c30e6a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:07:04 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3 Conflicts: src/or/policies.c changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-) diff --cc src/or/policies.c index 3018803,55d08af..6e98421 --- a/src/or/policies.c +++ b/src/or/policies.c @@@ -711,8 -684,12 +711,12 @@@ compare_tor_addr_to_addr_policy(const t if (!policy) { /* no policy? accept all. */ return ADDR_POLICY_ACCEPTED; - } else if (tor_addr_is_null(addr)) { + } else if (addr == NULL || tor_addr_is_null(addr)) { - tor_assert(port != 0); + if (port == 0) { + log_info(LD_BUG, "Rejecting null address with 0 port (family %d)", + addr ? tor_addr_family(addr) : -1); + return ADDR_POLICY_REJECTED; + } return compare_unknown_tor_addr_to_addr_policy(port, policy); } else if (port == 0) { return compare_known_tor_addr_to_addr_policy_noport(addr, policy);

1 0

[tor/release-0.2.3] Fix changes file for 6710: before 0.0.8pre1, you couldn't extend to
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit 45b520b6a4872a5c52b934df9c345e04536568b1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 12:29:04 2012 -0400 Fix changes file for 6710: before 0.0.8pre1, you couldn't extend to a router that another router wasn't already connected to. --- changes/bug6710 | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/changes/bug6710 b/changes/bug6710 index 69a3c7e..2c89346 100644 --- a/changes/bug6710 +++ b/changes/bug6710 @@ -2,6 +2,5 @@ - Reject any attempt to extend to an internal address. Without this fix, a router could be used to probe addresses on an internal network to see whether they were accepting - connections. Fix for bug 6710; bugfix on all released versions - of Tor. + connections. Fix for bug 6710; bugfix on 0.0.8pre1.

1 0

[tor/release-0.2.3] Merge branch 'bug6690_022' into maint-0.2.2
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit 1c30e6abc93fa086a14d01d838066581a3657285 Merge: d48cebc 62d9628 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:03:48 2012 -0400 Merge branch 'bug6690_022' into maint-0.2.2 changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-)

1 0

[tor/release-0.2.3] Merge branch 'bug6710_023' into maint-0.2.3
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit bffe0d3ccc6b49975eae9173b0c1c465d40d2dbf Merge: 443e4ae 45b520b Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:15:01 2012 -0400 Merge branch 'bug6710_023' into maint-0.2.3 changes/bug6710 | 6 ++++++ doc/tor.1.txt | 6 ++++++ src/or/circuitbuild.c | 7 +++++++ src/or/config.c | 2 ++ src/or/or.h | 4 +++- 5 files changed, 24 insertions(+), 1 deletions(-)

1 0

[tor/release-0.2.3] Downgrade path-bias warning messages to INFO for now.
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit b252ffa7cb641398ee19886f71380cd6190bcebc Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 10:46:17 2012 -0400 Downgrade path-bias warning messages to INFO for now. We've had over two months to fix them, and didn't. Now we need 0.2.3.x stable. Yes, it would be cool to get this working in 0.2.3.x, but not at the expense of delaying every other feature that _does_ work in 0.2.3.x. We can do a real fix in 0.2.4. --- changes/disable_pathbias_messages | 3 +++ src/or/circuitbuild.c | 20 ++++++++++---------- 2 files changed, 13 insertions(+), 10 deletions(-) diff --git a/changes/disable_pathbias_messages b/changes/disable_pathbias_messages new file mode 100644 index 0000000..3bc9963 --- /dev/null +++ b/changes/disable_pathbias_messages @@ -0,0 +1,3 @@ + o Disabeled features + - Downgrade path-bias warning messages to INFO. We'll try to get them + working better in 0.2.4. Fixes bug 6475; bugfix on 0.2.3.17-beta. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index f11bebf..fcd13dc 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2656,7 +2656,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) if (circ->has_opened && circ->path_state != PATH_STATE_DID_FIRST_HOP) { if ((rate_msg = rate_limit_log(&first_hop_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Opened circuit is in strange path state %s. " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2683,7 +2683,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) } else { if ((rate_msg = rate_limit_log(&first_hop_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Unopened circuit has strange path state %s. " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2695,7 +2695,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) } else { if ((rate_msg = rate_limit_log(&first_hop_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Unopened circuit has no known guard. " "Circuit is a %s currently %s. %s", circuit_purpose_to_string(circ->_base.purpose), @@ -2709,7 +2709,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) if (circ->path_state == PATH_STATE_NEW_CIRC) { if ((rate_msg = rate_limit_log(&first_hop_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "A %s circuit is in cpath state %d (opened: %d). " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2761,7 +2761,7 @@ pathbias_count_success(origin_circuit_t *circ) } else { if ((rate_msg = rate_limit_log(&success_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Succeeded circuit is in strange path state %s. " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2772,7 +2772,7 @@ pathbias_count_success(origin_circuit_t *circ) } if (guard->first_hops < guard->circuit_successes) { - log_warn(LD_BUG, "Unexpectedly high circuit_successes (%u/%u) " + log_info(LD_BUG, "Unexpectedly high circuit_successes (%u/%u) " "for guard %s=%s", guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); @@ -2780,7 +2780,7 @@ pathbias_count_success(origin_circuit_t *circ) } else { if ((rate_msg = rate_limit_log(&success_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Completed circuit has no known guard. " "Circuit is a %s currently %s. %s", circuit_purpose_to_string(circ->_base.purpose), @@ -2792,7 +2792,7 @@ pathbias_count_success(origin_circuit_t *circ) if (circ->path_state != PATH_STATE_SUCCEEDED) { if ((rate_msg = rate_limit_log(&success_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Opened circuit is in strange path state %s. " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2822,7 +2822,7 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) if (guard->circuit_successes/((double)guard->first_hops) < pathbias_get_disable_rate(options)) { - log_warn(LD_PROTOCOL, + log_info(LD_PROTOCOL, "Extremely low circuit success rate %u/%u for guard %s=%s. " "This might indicate an attack, or a bug.", guard->circuit_successes, guard->first_hops, guard->nickname, @@ -2835,7 +2835,7 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) < pathbias_get_notice_rate(options) && !guard->path_bias_notice) { guard->path_bias_notice = 1; - log_notice(LD_PROTOCOL, + log_info(LD_PROTOCOL, "Low circuit success rate %u/%u for guard %s=%s.", guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN));

1 0