October 2013 - tor-commits - lists.torproject.org

[tor/release-0.2.4] Merge remote-tracking branch 'public/bug9596' into maint-0.2.4
by arma＠torproject.org 11 Oct '13

11 Oct '13

commit 0c3c47565da970839b3701f60fd310ba059ed8af Merge: 0bec652 a5f6cb9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 12:10:47 2013 -0400 Merge remote-tracking branch 'public/bug9596' into maint-0.2.4 changes/bug9596 | 4 ++++ src/or/policies.h | 7 ++++--- 2 files changed, 8 insertions(+), 3 deletions(-)

1 0

[tor/release-0.2.4] Give credit to bug reporter for 9928
by arma＠torproject.org 11 Oct '13

11 Oct '13

commit bfe56e05b08b940d432be9af824b969522eedc98 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 12:06:06 2013 -0400 Give credit to bug reporter for 9928 --- changes/bug9928 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/changes/bug9928 b/changes/bug9928 index e19bcf4..b72cea3 100644 --- a/changes/bug9928 +++ b/changes/bug9928 @@ -2,4 +2,5 @@ - Avoid an off-by-one error when checking buffer boundaries when formatting the exit status of a pluggable transport helper. This is probably not an exploitable bug, but better safe than - sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. + sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. Bug found by + Pedro Ribeiro.

1 0

[tor/release-0.2.4] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by arma＠torproject.org 11 Oct '13

11 Oct '13

commit 7e0f1fa52adcf67d7b9c5459a3cc74f57bbfa3e2 Merge: 0c3c475 dece40f Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 12:16:42 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 changes/bug6979 | 4 ++++ src/or/router.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-)

1 0

[tor/release-0.2.4] Raise buffer size, fix checks for format_exit_helper_status.
by arma＠torproject.org 11 Oct '13

11 Oct '13

commit 17bcfb2604ba3c20a78cdcc78f169b4db6927d25 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 11:13:21 2013 -0400 Raise buffer size, fix checks for format_exit_helper_status. This is probably not an exploitable bug, since you would need to have errno be a large negative value in the unix pluggable-transport launcher case. Still, best avoided. Fixes bug 9928; bugfix on 0.2.3.18-rc. --- changes/bug9928 | 5 +++++ src/common/util.c | 10 +++++----- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/changes/bug9928 b/changes/bug9928 new file mode 100644 index 0000000..e19bcf4 --- /dev/null +++ b/changes/bug9928 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - Avoid an off-by-one error when checking buffer boundaries when + formatting the exit status of a pluggable transport helper. + This is probably not an exploitable bug, but better safe than + sorry. Fixes bug 9928; bugfix on 0.2.3.18-rc. diff --git a/src/common/util.c b/src/common/util.c index 6fb597a..5b0dbcd 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -3256,10 +3256,10 @@ format_hex_number_for_helper_exit_status(unsigned int x, char *buf, * hex_errno. Called between fork and _exit, so must be signal-handler * safe. * - * hex_errno must have at least HEX_ERRNO_SIZE bytes available. + * hex_errno must have at least HEX_ERRNO_SIZE+1 bytes available. * * The format of hex_errno is: "CHILD_STATE/ERRNO\n", left-padded - * with spaces. Note that there is no trailing \0. CHILD_STATE indicates where + * with spaces. CHILD_STATE indicates where * in the processs of starting the child process did the failure occur (see * CHILD_STATE_* macros for definition), and SAVED_ERRNO is the value of * errno when the failure occurred. @@ -3338,8 +3338,8 @@ format_helper_exit_status(unsigned char child_state, int saved_errno, left -= written; cur += written; - /* Check that we have enough space left for a newline */ - if (left <= 0) + /* Check that we have enough space left for a newline and a NUL */ + if (left <= 1) goto err; /* Emit the newline and NUL */ @@ -3594,7 +3594,7 @@ tor_spawn_background(const char *const filename, const char **argv, this is used for printing out the error message */ unsigned char child_state = CHILD_STATE_INIT; - char hex_errno[HEX_ERRNO_SIZE]; + char hex_errno[HEX_ERRNO_SIZE + 1]; static int max_fd = -1;

1 0

[tor/release-0.2.4] Generate bootstrapping status messages for microdescs too
by arma＠torproject.org 11 Oct '13

11 Oct '13

commit c7c24785ee1b846c608ae4691df7d10476885b66 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 8 11:31:08 2013 -0400 Generate bootstrapping status messages for microdescs too Fix for 9927. --- changes/bug9927 | 4 ++++ src/or/directory.c | 2 ++ src/or/relay.c | 1 + 3 files changed, 7 insertions(+) diff --git a/changes/bug9927 b/changes/bug9927 new file mode 100644 index 0000000..e66280c --- /dev/null +++ b/changes/bug9927 @@ -0,0 +1,4 @@ + o Minor features: + - Generate bootstrapping status update events correctly for fetching + microdescriptors. Fixes bug 9927. + diff --git a/src/or/directory.c b/src/or/directory.c index b4381ac..3752367 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -2111,6 +2111,8 @@ connection_dir_client_reached_eof(dir_connection_t *conn) /* Mark remaining ones as failed. */ dir_microdesc_download_failed(which, status_code); } + control_event_bootstrap(BOOTSTRAP_STATUS_LOADING_DESCRIPTORS, + count_loading_descriptors_progress()); SMARTLIST_FOREACH(which, char *, cp, tor_free(cp)); smartlist_free(which); smartlist_free(mds); diff --git a/src/or/relay.c b/src/or/relay.c index 3138c5e..29dc361 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1103,6 +1103,7 @@ connection_edge_process_relay_cell_not_open( control_event_bootstrap(BOOTSTRAP_STATUS_LOADING_STATUS, 0); break; case DIR_PURPOSE_FETCH_SERVERDESC: + case DIR_PURPOSE_FETCH_MICRODESC: control_event_bootstrap(BOOTSTRAP_STATUS_LOADING_DESCRIPTORS, count_loading_descriptors_progress()); break;

1 0

[tor/release-0.2.4] Fix a bug in our bug 9776 fix.
by arma＠torproject.org 11 Oct '13

11 Oct '13

commit 557f3329575cd6d1a2dd36fa8fb9cf0ac0b3f721 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 2 21:42:24 2013 -0400 Fix a bug in our bug 9776 fix. By calling circuit_n_chan_done() unconditionally on close, we were closing pending connections that might not have been pending quite for the connection we were closing. Fix for bug 9880. Thanks to skruffy for finding this and explaining it patiently until we understood. --- changes/bug9880 | 8 ++++++++ src/or/channel.c | 7 ++++++- src/or/channel.h | 3 +++ 3 files changed, 17 insertions(+), 1 deletion(-) diff --git a/changes/bug9880 b/changes/bug9880 new file mode 100644 index 0000000..a7dda8f --- /dev/null +++ b/changes/bug9880 @@ -0,0 +1,8 @@ + o Minor bugfixes: + + - When closing a channel that has already been open, do not close + pending circuits that were waiting to connect to the same relay. + Fixes bug 9880; bugfix on 0.2.5.1-alpha. Thanks to skruffy for + finding this bug. (Bug was merged to 0.2.4 branch but not released + in any 0.2.4 version) + diff --git a/src/or/channel.c b/src/or/channel.c index 1fb39b8..1270eac 100644 --- a/src/or/channel.c +++ b/src/or/channel.c @@ -743,6 +743,9 @@ channel_init(channel_t *chan) /* Timestamp it */ channel_timestamp_created(chan); + + /* It hasn't been open yet. */ + chan->has_been_open = 0; } /** @@ -1294,7 +1297,8 @@ channel_closed(channel_t *chan) /* Inform any pending (not attached) circs that they should * give up. */ - circuit_n_chan_done(chan, 0); + if (! chan->has_been_open) + circuit_n_chan_done(chan, 0); /* Now close all the attached circuits on it. */ circuit_unlink_all_from_channel(chan, END_CIRC_REASON_CHANNEL_CLOSED); @@ -1935,6 +1939,7 @@ channel_change_state(channel_t *chan, channel_state_t to_state) /* Tell circuits if we opened and stuff */ if (to_state == CHANNEL_STATE_OPEN) { channel_do_open_actions(chan); + chan->has_been_open = 1; /* Check for queued cells to process */ if (! TOR_SIMPLEQ_EMPTY(&chan->incoming_queue)) diff --git a/src/or/channel.h b/src/or/channel.h index 0933ec8..2dca817 100644 --- a/src/or/channel.h +++ b/src/or/channel.h @@ -46,6 +46,9 @@ struct channel_s { /* Should we expect to see this channel in the channel lists? */ unsigned char registered:1; + /** has this channel ever been open? */ + unsigned int has_been_open:1; + /** Why did we close? */ enum {

1 0

[tor/release-0.2.4] Merge branch 'bug9880_fix' into maint-0.2.4
by arma＠torproject.org 11 Oct '13

11 Oct '13

commit 0bec65277abed5567458e94c05c2b94f1b84e460 Merge: 938ee9b 557f332 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 2 22:39:27 2013 -0400 Merge branch 'bug9880_fix' into maint-0.2.4 changes/bug9880 | 8 ++++++++ src/or/channel.c | 7 ++++++- src/or/channel.h | 3 +++ 3 files changed, 17 insertions(+), 1 deletion(-)

1 0

[tor/release-0.2.4] When freeing a cert_list_t, avoid memory leak.
by arma＠torproject.org 11 Oct '13

11 Oct '13

commit 7dbf66713f22b5e04a36d300307a4df7e375e76b Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Sep 19 12:22:49 2013 -0400 When freeing a cert_list_t, avoid memory leak. We were freeing these on exit, but when we added the dl_status_map field to them in fddb814f, we forgot to arrange for it to be freed. I've moved the cert_list_free() code into its own function, and added an appropriate dsmap_free() call. Fixes bug 9644; bugfix on 0.2.4.13-alpha. --- changes/bug9644 | 4 ++++ src/or/routerlist.c | 29 ++++++++++++++++++++++------- 2 files changed, 26 insertions(+), 7 deletions(-) diff --git a/changes/bug9644 b/changes/bug9644 new file mode 100644 index 0000000..51c58a5 --- /dev/null +++ b/changes/bug9644 @@ -0,0 +1,4 @@ + o Minor bugfixes: + - Fix a small memory leak on exit. (We weren't freeing directory + authority certificate download statuses.) Fixes bug 9644; bugfix + on 0.2.4.13-alpha. diff --git a/src/or/routerlist.c b/src/or/routerlist.c index c2220f4..c28de24 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -241,6 +241,27 @@ get_cert_list(const char *id_digest) return cl; } +/** Release all space held by a cert_list_t */ +static void +cert_list_free(cert_list_t *cl) +{ + if (!cl) + return; + + SMARTLIST_FOREACH(cl->certs, authority_cert_t *, cert, + authority_cert_free(cert)); + smartlist_free(cl->certs); + dsmap_free(cl->dl_status_map, tor_free_); + tor_free(cl); +} + +/** Wrapper for cert_list_free so we can pass it to digestmap_free */ +static void +cert_list_free_(void *cl) +{ + cert_list_free(cl); +} + /** Reload the cached v3 key certificates from the cached-certs file in * the data directory. Return 0 on success, -1 on failure. */ int @@ -3324,13 +3345,7 @@ routerlist_free_all(void) smartlist_free(fallback_dir_servers); trusted_dir_servers = fallback_dir_servers = NULL; if (trusted_dir_certs) { - DIGESTMAP_FOREACH(trusted_dir_certs, key, cert_list_t *, cl) { - SMARTLIST_FOREACH(cl->certs, authority_cert_t *, cert, - authority_cert_free(cert)); - smartlist_free(cl->certs); - tor_free(cl); - } DIGESTMAP_FOREACH_END; - digestmap_free(trusted_dir_certs, NULL); + digestmap_free(trusted_dir_certs, cert_list_free_); trusted_dir_certs = NULL; } }

1 0

[tor/release-0.2.4] Fix an assert when disabling ORPort with accounting disabled.
by arma＠torproject.org 11 Oct '13

11 Oct '13

commit dece40fd7729934bc32906e94d3e5e746c01f970 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 18 10:26:32 2013 -0400 Fix an assert when disabling ORPort with accounting disabled. The problem was that the server_identity_key_is_set() function could return true under conditions where we don't really have an identity key -- specifically, where we used to have one, but we stopped being a server. This is a fix for 6979; bugfix on 0.2.2.18-alpha where we added that assertion to get_server_identity_key(). --- changes/bug6979 | 4 ++++ src/or/router.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/changes/bug6979 b/changes/bug6979 new file mode 100644 index 0000000..55572ec --- /dev/null +++ b/changes/bug6979 @@ -0,0 +1,4 @@ + o Minor bugfixes: + - Fix an assertion failure that would occur when disabling the + ORPort setting on a running Tor process while accounting was + enabled. Fixes bug 6979; bugfix on 0.2.2.18-alpha. diff --git a/src/or/router.c b/src/or/router.c index 1ace8e2..a3459ae 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -177,7 +177,7 @@ get_server_identity_key(void) int server_identity_key_is_set(void) { - return server_identitykey != NULL; + return server_mode(get_options()) && server_identitykey != NULL; } /** Set the current client identity key to k.

1 0

[tor/release-0.2.4] Increase POLICY_BUF_LEN to 72 to accomodate IPv6 exit policy items.
by arma＠torproject.org 11 Oct '13

11 Oct '13

commit a5f6cb908c32dcf8c7efbde2702b70ccd36e82f0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 26 11:30:09 2013 -0400 Increase POLICY_BUF_LEN to 72 to accomodate IPv6 exit policy items. Fixes bug 9596; bugfix on 0.2.4.7-alpha. --- changes/bug9596 | 4 ++++ src/or/policies.h | 7 ++++--- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/changes/bug9596 b/changes/bug9596 new file mode 100644 index 0000000..b3d138e --- /dev/null +++ b/changes/bug9596 @@ -0,0 +1,4 @@ + o Minor bugfixes: + - Correctly log long IPv6 exit policy, instead of truncating them + or reporting an error. Fixes bug 9596; bugfix on 0.2.4.7-alpha. + diff --git a/src/or/policies.h b/src/or/policies.h index c0e7a9e..facbbb6 100644 --- a/src/or/policies.h +++ b/src/or/policies.h @@ -12,10 +12,11 @@ #ifndef TOR_POLICIES_H #define TOR_POLICIES_H -/* (length of "accept 255.255.255.255/255.255.255.255:65535-65535\n" plus a - * NUL.) +/* (length of + * "accept6 [ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff]/128:65535-65535\n" + * plus a terminating NUL, rounded up to a nice number.) */ -#define POLICY_BUF_LEN 52 +#define POLICY_BUF_LEN 72 int firewall_is_fascist_or(void); int fascist_firewall_allows_address_or(const tor_addr_t *addr, uint16_t port);

1 0