February 2014 - tor-commits - lists.torproject.org

[tor/maint-0.2.4] Merge remote-tracking branch 'public/bug9716_024' into maint-0.2.4
by nickm＠torproject.org 07 Feb '14

07 Feb '14

commit b4e8d8dc0e6f942346895a5cff123db3aa1f94d5 Merge: 9e2de8c a2754d4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 6 16:29:08 2014 -0500 Merge remote-tracking branch 'public/bug9716_024' into maint-0.2.4 changes/bug9716 | 4 ++++ src/or/connection.c | 23 ++++++++++++++++++++++- 2 files changed, 26 insertions(+), 1 deletion(-)

1 0

[tor/master] Merge remote-tracking branch 'public/bug10543_024_v2'
by nickm＠torproject.org 07 Feb '14

07 Feb '14

commit 075482ff8091fb920dc00cd122482828d08ac3c8 Merge: 2d41cab dffac25 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 6 16:25:26 2014 -0500 Merge remote-tracking branch 'public/bug10543_024_v2' changes/bug10543 | 5 +++++ src/or/nodelist.c | 25 ++++++++++++++++++++++++- 2 files changed, 29 insertions(+), 1 deletion(-) diff --cc src/or/nodelist.c index d1a226e,8fa1703..395ea33 --- a/src/or/nodelist.c +++ b/src/or/nodelist.c @@@ -1331,9 -1329,10 +1331,10 @@@ compute_frac_paths_available(const netw smartlist_t *mid = smartlist_new(); smartlist_t *exits = smartlist_new(); smartlist_t *myexits= smartlist_new(); - double f_guard, f_mid, f_exit, f_myexit; + smartlist_t *myexits_unflagged = smartlist_new(); + double f_guard, f_mid, f_exit, f_myexit, f_myexit_unflagged; int np, nu; /* Ignored */ - const int authdir = authdir_mode_v2(options) || authdir_mode_v3(options); + const int authdir = authdir_mode_v3(options); count_usable_descriptors(num_present_out, num_usable_out, mid, consensus, options, now, NULL, 0);

1 0

[tor/master] Make the handling for usable-exit counting handle ExitNodes better
by nickm＠torproject.org 07 Feb '14

07 Feb '14

commit dffac251f1ac666f7e7855cfb800b8ed012ec359 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jan 17 13:39:04 2014 -0500 Make the handling for usable-exit counting handle ExitNodes better It's possible to set your ExitNodes to contains only exits that don't have the Exit flag. If you do that, we'll decide that 0 of your exits are working. Instead, in that case we should look at nodes which have (or which might have) exit policies that don't reject everything. Fix for bug 10543; bugfix on 0.2.4.10-alpha. --- changes/bug10543 | 5 +++++ src/or/nodelist.c | 25 ++++++++++++++++++++++++- 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/changes/bug10543 b/changes/bug10543 new file mode 100644 index 0000000..6044506 --- /dev/null +++ b/changes/bug10543 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - If all nodes with the Exit flag have been disabled with the ExitNodes + flag, consider nodes which can exit to other ports as well. Fixes bug + 10543; bugfix on 0.2.4.10-alpha. + diff --git a/src/or/nodelist.c b/src/or/nodelist.c index 178f084..8fa1703 100644 --- a/src/or/nodelist.c +++ b/src/or/nodelist.c @@ -1329,7 +1329,8 @@ compute_frac_paths_available(const networkstatus_t *consensus, smartlist_t *mid = smartlist_new(); smartlist_t *exits = smartlist_new(); smartlist_t *myexits= smartlist_new(); - double f_guard, f_mid, f_exit, f_myexit; + smartlist_t *myexits_unflagged = smartlist_new(); + double f_guard, f_mid, f_exit, f_myexit, f_myexit_unflagged; int np, nu; /* Ignored */ const int authdir = authdir_mode_v2(options) || authdir_mode_v3(options); @@ -1350,20 +1351,42 @@ compute_frac_paths_available(const networkstatus_t *consensus, }); } + /* All nodes with exit flag */ count_usable_descriptors(&np, &nu, exits, consensus, options, now, NULL, 1); + /* All nodes with exit flag in ExitNodes option */ count_usable_descriptors(&np, &nu, myexits, consensus, options, now, options->ExitNodes, 1); + /* Now compute the nodes in the ExitNodes option where which we don't know + * what their exit policy is, or we know it permits something. */ + count_usable_descriptors(&np, &nu, myexits_unflagged, + consensus, options, now, + options->ExitNodes, 0); + SMARTLIST_FOREACH_BEGIN(myexits_unflagged, const node_t *, node) { + if (node_has_descriptor(node) && node_exit_policy_rejects_all(node)) + SMARTLIST_DEL_CURRENT(myexits_unflagged, node); + } SMARTLIST_FOREACH_END(node); f_guard = frac_nodes_with_descriptors(guards, WEIGHT_FOR_GUARD); f_mid = frac_nodes_with_descriptors(mid, WEIGHT_FOR_MID); f_exit = frac_nodes_with_descriptors(exits, WEIGHT_FOR_EXIT); f_myexit= frac_nodes_with_descriptors(myexits,WEIGHT_FOR_EXIT); + f_myexit_unflagged= + frac_nodes_with_descriptors(myexits_unflagged,WEIGHT_FOR_EXIT); + + /* If our ExitNodes list has eliminated every possible Exit node, and there + * were some possible Exit nodes, then instead consider nodes that permit + * exiting to some ports. */ + if (smartlist_len(myexits) == 0 && + smartlist_len(myexits_unflagged)) { + f_myexit = f_myexit_unflagged; + } smartlist_free(guards); smartlist_free(mid); smartlist_free(exits); smartlist_free(myexits); + smartlist_free(myexits_unflagged); /* This is a tricky point here: we don't want to make it easy for a * directory to trickle exits to us until it learns which exits we have

1 0

[tor/master] Some anti-forensics paranoia...
by nickm＠torproject.org 07 Feb '14

07 Feb '14

commit 01132c93fdfd634475c6d56455efdfe1cff1fe83 Author: Florent Daigniere <nextgens(a)freenetproject.org> Date: Sun Feb 2 18:40:30 2014 +0000 Some anti-forensics paranoia... sed -i 's/BN_free/BN_clear_free/g' --- src/common/crypto.c | 20 ++++++++++---------- src/common/tortls.c | 2 +- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 940a756..925beb3 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -486,7 +486,7 @@ crypto_pk_generate_key_with_bits(crypto_pk_t *env, int bits) r = NULL; done: if (e) - BN_free(e); + BN_clear_free(e); if (r) RSA_free(r); } @@ -1922,7 +1922,7 @@ crypto_set_tls_dh_prime(const char *dynamic_dh_modulus_fname) /* If the space is occupied, free the previous TLS DH prime */ if (dh_param_p_tls) { - BN_free(dh_param_p_tls); + BN_clear_free(dh_param_p_tls); dh_param_p_tls = NULL; } @@ -2084,8 +2084,8 @@ crypto_dh_generate_public(crypto_dh_t *dh) log_warn(LD_CRYPTO, "Weird! Our own DH key was invalid. I guess once-in-" "the-universe chances really do happen. Trying again."); /* Free and clear the keys, so OpenSSL will actually try again. */ - BN_free(dh->dh->pub_key); - BN_free(dh->dh->priv_key); + BN_clear_free(dh->dh->pub_key); + BN_clear_free(dh->dh->priv_key); dh->dh->pub_key = dh->dh->priv_key = NULL; goto again; } @@ -2147,10 +2147,10 @@ tor_check_dh_key(int severity, BIGNUM *bn) log_fn(severity, LD_CRYPTO, "DH key must be at most p-2."); goto err; } - BN_free(x); + BN_clear_free(x); return 0; err: - BN_free(x); + BN_clear_free(x); s = BN_bn2hex(bn); log_fn(severity, LD_CRYPTO, "Rejecting insecure DH key [%s]", s); OPENSSL_free(s); @@ -2209,7 +2209,7 @@ crypto_dh_compute_secret(int severity, crypto_dh_t *dh, done: crypto_log_errors(LOG_WARN, "completing DH handshake"); if (pubkey_bn) - BN_free(pubkey_bn); + BN_clear_free(pubkey_bn); if (secret_tmp) { memwipe(secret_tmp, 0, secret_tmp_len); tor_free(secret_tmp); @@ -3118,11 +3118,11 @@ crypto_global_cleanup(void) ERR_free_strings(); if (dh_param_p) - BN_free(dh_param_p); + BN_clear_free(dh_param_p); if (dh_param_p_tls) - BN_free(dh_param_p_tls); + BN_clear_free(dh_param_p_tls); if (dh_param_g) - BN_free(dh_param_g); + BN_clear_free(dh_param_g); #ifndef DISABLE_ENGINES ENGINE_cleanup(); diff --git a/src/common/tortls.c b/src/common/tortls.c index 60444f1..886ee0d 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -694,7 +694,7 @@ tor_tls_create_certificate(crypto_pk_t *rsa, if (pkey) EVP_PKEY_free(pkey); if (serial_number) - BN_free(serial_number); + BN_clear_free(serial_number); if (name) X509_NAME_free(name); if (name_issuer)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.4'
by nickm＠torproject.org 07 Feb '14

07 Feb '14

commit 2d41cab1502666eaace21f10385964737d246388 Merge: 1b93e3c 9e2de8c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 6 16:12:42 2014 -0500 Merge remote-tracking branch 'origin/maint-0.2.4'

1 0

[tor/master] changelog for 10793
by nickm＠torproject.org 07 Feb '14

07 Feb '14

commit 9e2de8cecc97a9bc6d346d309a1bd6a800a34751 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 3 10:47:49 2014 -0500 changelog for 10793 --- changes/bug10793 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changes/bug10793 b/changes/bug10793 new file mode 100644 index 0000000..24c4025 --- /dev/null +++ b/changes/bug10793 @@ -0,0 +1,4 @@ + o Minor features (security): + - Always clear OpenSSL bignums before freeing them--even bignums + that don't contain secrets. Resolves ticket 10793. Patch by + Florent Daigniere.

1 0

[tor/maint-0.2.4] Some anti-forensics paranoia...
by nickm＠torproject.org 07 Feb '14

07 Feb '14

commit 01132c93fdfd634475c6d56455efdfe1cff1fe83 Author: Florent Daigniere <nextgens(a)freenetproject.org> Date: Sun Feb 2 18:40:30 2014 +0000 Some anti-forensics paranoia... sed -i 's/BN_free/BN_clear_free/g' --- src/common/crypto.c | 20 ++++++++++---------- src/common/tortls.c | 2 +- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 940a756..925beb3 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -486,7 +486,7 @@ crypto_pk_generate_key_with_bits(crypto_pk_t *env, int bits) r = NULL; done: if (e) - BN_free(e); + BN_clear_free(e); if (r) RSA_free(r); } @@ -1922,7 +1922,7 @@ crypto_set_tls_dh_prime(const char *dynamic_dh_modulus_fname) /* If the space is occupied, free the previous TLS DH prime */ if (dh_param_p_tls) { - BN_free(dh_param_p_tls); + BN_clear_free(dh_param_p_tls); dh_param_p_tls = NULL; } @@ -2084,8 +2084,8 @@ crypto_dh_generate_public(crypto_dh_t *dh) log_warn(LD_CRYPTO, "Weird! Our own DH key was invalid. I guess once-in-" "the-universe chances really do happen. Trying again."); /* Free and clear the keys, so OpenSSL will actually try again. */ - BN_free(dh->dh->pub_key); - BN_free(dh->dh->priv_key); + BN_clear_free(dh->dh->pub_key); + BN_clear_free(dh->dh->priv_key); dh->dh->pub_key = dh->dh->priv_key = NULL; goto again; } @@ -2147,10 +2147,10 @@ tor_check_dh_key(int severity, BIGNUM *bn) log_fn(severity, LD_CRYPTO, "DH key must be at most p-2."); goto err; } - BN_free(x); + BN_clear_free(x); return 0; err: - BN_free(x); + BN_clear_free(x); s = BN_bn2hex(bn); log_fn(severity, LD_CRYPTO, "Rejecting insecure DH key [%s]", s); OPENSSL_free(s); @@ -2209,7 +2209,7 @@ crypto_dh_compute_secret(int severity, crypto_dh_t *dh, done: crypto_log_errors(LOG_WARN, "completing DH handshake"); if (pubkey_bn) - BN_free(pubkey_bn); + BN_clear_free(pubkey_bn); if (secret_tmp) { memwipe(secret_tmp, 0, secret_tmp_len); tor_free(secret_tmp); @@ -3118,11 +3118,11 @@ crypto_global_cleanup(void) ERR_free_strings(); if (dh_param_p) - BN_free(dh_param_p); + BN_clear_free(dh_param_p); if (dh_param_p_tls) - BN_free(dh_param_p_tls); + BN_clear_free(dh_param_p_tls); if (dh_param_g) - BN_free(dh_param_g); + BN_clear_free(dh_param_g); #ifndef DISABLE_ENGINES ENGINE_cleanup(); diff --git a/src/common/tortls.c b/src/common/tortls.c index 60444f1..886ee0d 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -694,7 +694,7 @@ tor_tls_create_certificate(crypto_pk_t *rsa, if (pkey) EVP_PKEY_free(pkey); if (serial_number) - BN_free(serial_number); + BN_clear_free(serial_number); if (name) X509_NAME_free(name); if (name_issuer)

1 0

[tor/maint-0.2.4] changelog for 10793
by nickm＠torproject.org 07 Feb '14

07 Feb '14

commit 9e2de8cecc97a9bc6d346d309a1bd6a800a34751 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 3 10:47:49 2014 -0500 changelog for 10793 --- changes/bug10793 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changes/bug10793 b/changes/bug10793 new file mode 100644 index 0000000..24c4025 --- /dev/null +++ b/changes/bug10793 @@ -0,0 +1,4 @@ + o Minor features (security): + - Always clear OpenSSL bignums before freeing them--even bignums + that don't contain secrets. Resolves ticket 10793. Patch by + Florent Daigniere.

1 0

[tor/master] Merge branch 'bug10485_024' into maint-0.2.4
by nickm＠torproject.org 06 Feb '14

06 Feb '14

commit 534acf400e017adf489dfe3eca87ad82bbc15167 Merge: 3511549 edc6fa2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 6 13:24:12 2014 -0500 Merge branch 'bug10485_024' into maint-0.2.4 changes/bug10485 | 4 ++++ src/or/main.c | 5 ----- src/or/rephist.c | 1 - src/or/status.c | 3 +++ 4 files changed, 7 insertions(+), 6 deletions(-)

1 0

[tor/master] Deliver circuit handshake counts as part of the heartbeat
by nickm＠torproject.org 06 Feb '14

06 Feb '14

commit edc6fa25706534b35259111797fade88c9b694da Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 6 13:03:01 2014 -0500 Deliver circuit handshake counts as part of the heartbeat Previously, they went out once an hour, unconditionally. Fixes 10485; bugfix on 0.2.4.17-rc. --- changes/bug10485 | 4 ++++ src/or/main.c | 5 ----- src/or/rephist.c | 1 - src/or/status.c | 3 +++ 4 files changed, 7 insertions(+), 6 deletions(-) diff --git a/changes/bug10485 b/changes/bug10485 new file mode 100644 index 0000000..7e5fa53 --- /dev/null +++ b/changes/bug10485 @@ -0,0 +1,4 @@ + o Minor bugfixes: + - Move message about circuit handshake counts into the heartbeat + message where it belongs, instead of logging it once per hour + unconditionally. Fixes bug 10485; bugfix on 0.2.4.17-rc. diff --git a/src/or/main.c b/src/or/main.c index deed798..bd23141 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -1353,11 +1353,6 @@ run_scheduled_events(time_t now) next_time_to_write_stats_files = next_write; } time_to_write_stats_files = next_time_to_write_stats_files; - - /* Also commandeer this opportunity to log how our circuit handshake - * stats have been doing. */ - if (public_server_mode(options)) - rep_hist_log_circuit_handshake_stats(now); } /* 1h. Check whether we should write bridge statistics to disk. diff --git a/src/or/rephist.c b/src/or/rephist.c index 131e531..2948bf8 100644 --- a/src/or/rephist.c +++ b/src/or/rephist.c @@ -3041,7 +3041,6 @@ void rep_hist_log_circuit_handshake_stats(time_t now) { (void)now; - /* XXX024 maybe quiet this log message before 0.2.4 goes stable for real */ log_notice(LD_HIST, "Circuit handshake stats since last time: " "%d/%d TAP, %d/%d NTor.", onion_handshakes_completed[ONION_HANDSHAKE_TYPE_TAP], diff --git a/src/or/status.c b/src/or/status.c index d239e6e..4c42155 100644 --- a/src/or/status.c +++ b/src/or/status.c @@ -121,6 +121,9 @@ log_heartbeat(time_t now) log_notice(LD_HEARTBEAT, "TLS write overhead: %.f%%", overhead); } + if (public_server_mode(options)) + rep_hist_log_circuit_handshake_stats(now); + tor_free(uptime); tor_free(bw_sent); tor_free(bw_rcvd);

1 0