May 2013 - tor-commits - lists.torproject.org

[tor/release-0.2.4] Changes file for 8235.
by arma＠torproject.org 24 May '13

24 May '13

commit c72558f396b35bb42281162198ddbd652f2155fd Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Apr 23 14:44:40 2013 -0700 Changes file for 8235. --- changes/bug8253-fix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/changes/bug8253-fix b/changes/bug8253-fix new file mode 100644 index 0000000..3d36d06 --- /dev/null +++ b/changes/bug8253-fix @@ -0,0 +1,6 @@ + o Minor bugfixes (log messages) + - Fix a scaling issue in the path bias accounting code that resulted in + "Bug:" log messages from either pathbias_scale_close_rates() or + pathbias_count_build_success(). This represents a bugfix on a previous + bugfix: The original fix attempted in 0.2.4.10-alpha was incomplete. + Fixes bug 8235; bugfix on 0.2.4.1-alpha.

1 0

[tor/release-0.2.4] Bug 8235: Fix scaling adjustments.
by arma＠torproject.org 24 May '13

24 May '13

commit 2170f89a93a268588a50a7e754157c1f6e03b15f Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Apr 23 14:43:38 2013 -0700 Bug 8235: Fix scaling adjustments. We need to subtract both the current built circuits *and* the attempted circuits from the attempt count during scaling, since *both* have already been counted there. --- src/or/circuitbuild.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 31242f6..43d2ffe 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2491,7 +2491,7 @@ pathbias_scale_close_rates(entry_guard_t *guard) /* Verify that the counts are sane before and after scaling */ int counts_are_sane = (guard->circ_attempts >= guard->circ_successes); - guard->circ_attempts -= opened_attempts; + guard->circ_attempts -= (opened_attempts+opened_built); guard->circ_successes -= opened_built; guard->circ_attempts *= scale_ratio; @@ -2501,7 +2501,7 @@ pathbias_scale_close_rates(entry_guard_t *guard) guard->collapsed_circuits *= scale_ratio; guard->unusable_circuits *= scale_ratio; - guard->circ_attempts += opened_attempts; + guard->circ_attempts += (opened_attempts+opened_built); guard->circ_successes += opened_built; entry_guards_changed();

1 0

[tor/release-0.2.4] Increase the pathbias state file miscounting version check.
by arma＠torproject.org 24 May '13

24 May '13

commit ac22bf27d73c51ce6da5afbd2ec29a5403eea2d1 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Apr 23 17:53:53 2013 -0700 Increase the pathbias state file miscounting version check. We now know the bug is present in 0.2.4.12-alpha too. It should be fixed in 0.2.4.13-alpha, though. --- src/or/entrynodes.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 3234f4f..7a1f67d 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1215,7 +1215,7 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) int severity = LOG_INFO; /* If this state file was written by a Tor that would have * already fixed it, then the overcounting bug is still there.. */ - if (tor_version_as_new_as(state_version, "0.2.4.12-alpha")) { + if (tor_version_as_new_as(state_version, "0.2.4.13-alpha")) { severity = LOG_NOTICE; } log_fn(severity, LD_BUG, @@ -1280,7 +1280,7 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) int severity = LOG_INFO; /* If this state file was written by a Tor that would have * already fixed it, then the overcounting bug is still there.. */ - if (tor_version_as_new_as(state_version, "0.2.4.12-alpha")) { + if (tor_version_as_new_as(state_version, "0.2.4.13-alpha")) { severity = LOG_NOTICE; } log_fn(severity, LD_BUG,

1 0

[tor/release-0.2.4] Merge branch 'bug8235-fix-rebased' into maint-0.2.4
by arma＠torproject.org 24 May '13

24 May '13

commit cab5f82d125d721fa4b73568323ac1b6009002c3 Merge: b933360 ac22bf2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 24 22:04:15 2013 -0400 Merge branch 'bug8235-fix-rebased' into maint-0.2.4 changes/bug8253-fix | 6 ++++++ src/or/circuitbuild.c | 4 ++-- src/or/entrynodes.c | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-)

1 0

[tor/release-0.2.4] Merge branch 'bug8844_v2' into maint-0.2.3
by arma＠torproject.org 24 May '13

24 May '13

commit 96d3219176398f377dc4a1c84e14a54e7d2516df Merge: 39ac1db 00e2310 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 9 13:14:22 2013 -0400 Merge branch 'bug8844_v2' into maint-0.2.3 changes/bug8844 | 6 ++++++ src/or/buffers.c | 3 ++- src/test/test.c | 12 ++++++++++++ 3 files changed, 20 insertions(+), 1 deletion(-)

1 0

[tor/release-0.2.4] Merge remote-tracking branch 'public/bug6026' into maint-0.2.4
by arma＠torproject.org 24 May '13

24 May '13

commit f8bb0064d6a06770e6187ba57a2f4a764336aa84 Merge: cab5f82 07e2600 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 24 22:15:47 2013 -0400 Merge remote-tracking branch 'public/bug6026' into maint-0.2.4 changes/bug6026 | 4 ++++ src/or/config.c | 3 ++- src/or/connection.c | 5 ++++- src/or/router.c | 31 ++++++++++++++++++++++++------- src/or/router.h | 5 ++++- 5 files changed, 38 insertions(+), 10 deletions(-)

1 0

[tor/release-0.2.4] Fix 8833: crash bug from using NULL node->ri in dirserv.c
by arma＠torproject.org 24 May '13

24 May '13

commit 139d367f297575a59b96b64a633ed2b6988d60e1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun May 5 18:52:53 2013 -0400 Fix 8833: crash bug from using NULL node->ri in dirserv.c It appears that moria1 crashed because of one instance of this (the one in router_counts_toward_thresholds). The other instance I fixed won't actually have broken anything, but I think it's more clear this way. Fixes bug 8833; bugfix on 0.2.4.12-alpha. --- changes/bug8833 | 3 +++ src/or/dirserv.c | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/changes/bug8833 b/changes/bug8833 new file mode 100644 index 0000000..681a861 --- /dev/null +++ b/changes/bug8833 @@ -0,0 +1,3 @@ + o Major bugfixes (directory authority): + - Fix a crash bug when building a consensus using an older consensus as + its basis. Fixes bug 8833. Bugfix on 0.2.4.12-alpha. diff --git a/src/or/dirserv.c b/src/or/dirserv.c index 66a2c14..16f297a 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -1889,7 +1889,7 @@ router_counts_toward_thresholds(const node_t *node, time_t now, { /* Have measured bw? */ int have_mbw = - dirserv_has_measured_bw(node->ri->cache_info.identity_digest); + dirserv_has_measured_bw(node->identity); uint64_t min_bw_kb = ABSOLUTE_MIN_BW_VALUE_TO_CONSIDER_KB; const or_options_t *options = get_options(); @@ -1959,7 +1959,7 @@ dirserv_compute_performance_thresholds(routerlist_t *rl, if (router_counts_toward_thresholds(node, now, omit_as_sybil, require_mbw)) { routerinfo_t *ri = node->ri; - const char *id = ri->cache_info.identity_digest; + const char *id = node->identity; uint32_t bw_kb; node->is_exit = (!router_exit_policy_rejects_all(ri) && exit_policy_is_general_exit(ri->exit_policy));

1 0

[tor/release-0.2.4] Don't run off the end of the array-of-freelists
by arma＠torproject.org 24 May '13

24 May '13

commit 00e2310f12dfb91aca2949463b57bd6937f19166 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 8 12:04:18 2013 -0400 Don't run off the end of the array-of-freelists This is a fix for bug 8844, where eugenis correctly notes that there's a sentinel value at the end of the list-of-freelists that's never actually checked. It's a bug since the first version of the chunked buffer code back in 0.2.0.16-alpha. This would probably be a crash bug if it ever happens, but nobody's ever reported something like this, so I'm unsure whether it can occur. It would require write_to_buf, write_to_buf_zlib, read_to_buf, or read_to_buf_tls to get an input size of more than 32K. Still, it's a good idea to fix this kind of thing! --- changes/bug8844 | 6 ++++++ src/or/buffers.c | 3 ++- src/test/test.c | 12 ++++++++++++ 3 files changed, 20 insertions(+), 1 deletion(-) diff --git a/changes/bug8844 b/changes/bug8844 new file mode 100644 index 0000000..320e5f2 --- /dev/null +++ b/changes/bug8844 @@ -0,0 +1,6 @@ + o Major bugfixes: + - Prevent the get_freelists() function from running off the end of + the list of freelists if it somehow gets an unrecognized + allocation. Fixes bug 8844; bugfix on 0.2.0.16-alpha. Reported by + eugenis. + diff --git a/src/or/buffers.c b/src/or/buffers.c index ad5ab83..9be0476 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -147,7 +147,8 @@ static INLINE chunk_freelist_t * get_freelist(size_t alloc) { int i; - for (i=0; freelists[i].alloc_size <= alloc; ++i) { + for (i=0; (freelists[i].alloc_size <= alloc && + freelists[i].alloc_size); ++i ) { if (freelists[i].alloc_size == alloc) { return &freelists[i]; } diff --git a/src/test/test.c b/src/test/test.c index ddfd633..ae42394 100644 --- a/src/test/test.c +++ b/src/test/test.c @@ -802,6 +802,18 @@ test_buffers(void) buf_free(buf); buf = NULL; + /* Try adding a string too long for any freelist. */ + { + char *cp = tor_malloc_zero(65536); + buf = buf_new(); + write_to_buf(cp, 65536, buf); + tor_free(cp); + + tt_int_op(buf_datalen(buf), ==, 65536); + buf_free(buf); + buf = NULL; + } + done: if (buf) buf_free(buf);

1 0

[tor/release-0.2.4] Use a clearer idiom for node identity in router_counts_toward_thresholds
by arma＠torproject.org 24 May '13

24 May '13

commit a1d7f7ea503f2f739953d6a25ebb5d93981604be Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun May 5 18:55:19 2013 -0400 Use a clearer idiom for node identity in router_counts_toward_thresholds --- src/or/dirserv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/dirserv.c b/src/or/dirserv.c index 16f297a..8f6d9ec 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -1898,7 +1898,7 @@ router_counts_toward_thresholds(const node_t *node, time_t now, } return node->ri && router_is_active(node->ri, node, now) && - !digestmap_get(omit_as_sybil, node->ri->cache_info.identity_digest) && + !digestmap_get(omit_as_sybil, node->identity) && (dirserv_get_credible_bandwidth_kb(node->ri) >= min_bw_kb) && (have_mbw || !require_mbw); }

1 0

[tor/release-0.2.4] Fix bug 8845: check the right length of memory in aes unit tests
by arma＠torproject.org 24 May '13

24 May '13

commit 7d3fd858388ddd4916c604ed5ab3c8cfc72dfd1c Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 8 12:59:08 2013 -0400 Fix bug 8845: check the right length of memory in aes unit tests This couldn't actually be a buffer overrun unless AES somehow turned into memcpy, but still it's good to fix it. --- changes/bug8845 | 3 +++ src/test/test_crypto.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/changes/bug8845 b/changes/bug8845 new file mode 100644 index 0000000..ace043a --- /dev/null +++ b/changes/bug8845 @@ -0,0 +1,3 @@ + o Minor bugfixes (test): + - Fix an impossible buffer overrun in the AES unit tests. Fixes bug 8845; + bugfix on 0.2.0.7-alpha. Found by eugenis. diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index fcaa081..f92bfd6 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -730,7 +730,7 @@ test_crypto_aes_iv(void *arg) /* Decrypt with the wrong key. */ decrypted_size = crypto_cipher_decrypt_with_iv(key2, decrypted2, 4095, encrypted1, encrypted_size); - test_memneq(plain, decrypted2, encrypted_size); + test_memneq(plain, decrypted2, decrypted_size); /* Alter the initialization vector. */ encrypted1[0] += 42; decrypted_size = crypto_cipher_decrypt_with_iv(key1, decrypted1, 4095,

1 0