September 2014 - tor-commits - lists.torproject.org

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.5'
by nickm＠torproject.org 29 Sep '14

29 Sep '14

commit 2e607ff51931b35ee531fa60b83487b3f4f944a7 Merge: a0be2f1 e1a25f0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 29 13:02:50 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.5' changes/13295 | 5 +++++ src/common/sandbox.c | 21 +++++++++++++++++++++ src/common/sandbox.h | 2 ++ src/tools/tor-resolve.c | 2 ++ 4 files changed, 30 insertions(+) diff --cc src/common/sandbox.c index c7e4dcd,dbbaa59..36022c9 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@@ -1292,11 -1380,23 +1292,23 @@@ static HT_HEAD(getaddrinfo_cache, cache HT_PROTOTYPE(getaddrinfo_cache, cached_getaddrinfo_item_t, node, cached_getaddrinfo_item_hash, cached_getaddrinfo_items_eq); -HT_GENERATE(getaddrinfo_cache, cached_getaddrinfo_item_t, node, - cached_getaddrinfo_item_hash, - cached_getaddrinfo_items_eq, - 0.6, tor_malloc_, tor_realloc_, tor_free_); +HT_GENERATE2(getaddrinfo_cache, cached_getaddrinfo_item_t, node, + cached_getaddrinfo_item_hash, + cached_getaddrinfo_items_eq, + 0.6, tor_reallocarray_, tor_free_) + /** If true, don't try to cache getaddrinfo results. */ + static int sandbox_getaddrinfo_cache_disabled = 0; + + /** Tell the sandbox layer not to try to cache getaddrinfo results. Used as in + * tor-resolve, when we have no intention of initializing crypto or of + * installing the sandbox.*/ + void + sandbox_disable_getaddrinfo_cache(void) + { + sandbox_getaddrinfo_cache_disabled = 1; + } + int sandbox_getaddrinfo(const char *name, const char *servname, const struct addrinfo *hints,

1 0

[tor/maint-0.2.5] Merge branch 'bug13295_v2_025' into maint-0.2.5
by nickm＠torproject.org 29 Sep '14

29 Sep '14

commit e1a25f0c3602e007872277ef9ab437cc97cfd47b Merge: 87576e8 09951be Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 29 13:02:35 2014 -0400 Merge branch 'bug13295_v2_025' into maint-0.2.5 changes/13295 | 5 +++++ src/common/sandbox.c | 21 +++++++++++++++++++++ src/common/sandbox.h | 2 ++ src/tools/tor-resolve.c | 2 ++ 4 files changed, 30 insertions(+)

1 0

[tor/maint-0.2.5] Don't use the getaddrinfo sandbox cache from tor-resolve
by nickm＠torproject.org 29 Sep '14

29 Sep '14

commit 09951bea7fe30cd91d8a4dee95278218f0aa199e Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 29 12:57:07 2014 -0400 Don't use the getaddrinfo sandbox cache from tor-resolve Fixes bug 13295; bugfix on 0.2.5.3-alpha. The alternative here is to call crypto_global_init() from tor-resolve, but let's avoid linking openssl into tor-resolve for as long as we can. --- changes/13295 | 5 +++++ src/common/sandbox.c | 21 +++++++++++++++++++++ src/common/sandbox.h | 2 ++ src/tools/tor-resolve.c | 2 ++ 4 files changed, 30 insertions(+) diff --git a/changes/13295 b/changes/13295 new file mode 100644 index 0000000..4334325 --- /dev/null +++ b/changes/13295 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - Disable sandbox name resolver cache when running tor-resolve: + tor-resolve doesn't use the sandbox code, and turning it on was + breaking attempts to do tor-resolve on a non-default server on + Linux. Fixes bug 13295; bugfix on 0.2.5.3-alpha. diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 05b91be..dbbaa59 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -1385,6 +1385,18 @@ HT_GENERATE(getaddrinfo_cache, cached_getaddrinfo_item_t, node, cached_getaddrinfo_items_eq, 0.6, tor_malloc_, tor_realloc_, tor_free_); +/** If true, don't try to cache getaddrinfo results. */ +static int sandbox_getaddrinfo_cache_disabled = 0; + +/** Tell the sandbox layer not to try to cache getaddrinfo results. Used as in + * tor-resolve, when we have no intention of initializing crypto or of + * installing the sandbox.*/ +void +sandbox_disable_getaddrinfo_cache(void) +{ + sandbox_getaddrinfo_cache_disabled = 1; +} + int sandbox_getaddrinfo(const char *name, const char *servname, const struct addrinfo *hints, @@ -1393,6 +1405,10 @@ sandbox_getaddrinfo(const char *name, const char *servname, int err; struct cached_getaddrinfo_item_t search, *item; + if (sandbox_getaddrinfo_cache_disabled) { + return getaddrinfo(name, NULL, hints, res); + } + if (servname != NULL) { log_warn(LD_BUG, "called with non-NULL servname"); return EAI_NONAME; @@ -1834,5 +1850,10 @@ sandbox_is_active(void) { return 0; } + +void +sandbox_disable_getaddrinfo_cache(void) +{ +} #endif diff --git a/src/common/sandbox.h b/src/common/sandbox.h index 20d5d50..35d8777 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -208,5 +208,7 @@ int sandbox_init(sandbox_cfg_t* cfg); /** Return true iff the sandbox is turned on. */ int sandbox_is_active(void); +void sandbox_disable_getaddrinfo_cache(void); + #endif /* SANDBOX_H_ */ diff --git a/src/tools/tor-resolve.c b/src/tools/tor-resolve.c index 306f6c6..480c7e5 100644 --- a/src/tools/tor-resolve.c +++ b/src/tools/tor-resolve.c @@ -8,6 +8,7 @@ #include "../common/util.h" #include "address.h" #include "../common/torlog.h" +#include "sandbox.h" #include <stdio.h> #include <stdlib.h> @@ -344,6 +345,7 @@ main(int argc, char **argv) log_severity_list_t *s = tor_malloc_zero(sizeof(log_severity_list_t)); init_logging(); + sandbox_disable_getaddrinfo_cache(); arg = &argv[1]; n_args = argc-1;

1 0

[doctor/master] Ignore turtles in the descriptor checker
by atagar＠torproject.org 29 Sep '14

29 Sep '14

commit 8e243889f8b3556e82aab6f7ae7e5a6d17fbcc69 Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Sep 29 08:56:47 2014 -0700 Ignore turtles in the descriptor checker DocTor ignores turtles because it's unmaintained. I didn't do the same in the descriptor checker because it only emails me, but I've received over fifty emails about turtles being borked. Time to cut down on the noise. Filed a ticket to track the actual issue... https://trac.torproject.org/projects/tor/ticket/13296 --- descriptor_checker.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/descriptor_checker.py b/descriptor_checker.py index 55e8236..6cd5328 100755 --- a/descriptor_checker.py +++ b/descriptor_checker.py @@ -60,9 +60,15 @@ def main(): for authority in stem.descriptor.remote.get_authorities().values(): # skip authorities that don't vote in the consensus + if authority.v3ident is None: continue + # skip turtles, it's unmaintained + + if authority.nickname == 'turtles': + continue + log.debug("Downloading the consensus from %s..." % authority.nickname) query = stem.descriptor.remote.Query(

1 0

[translation/torbutton-torbuttonproperties] Update translations for torbutton-torbuttonproperties
by translation＠torproject.org 29 Sep '14

29 Sep '14

commit 2ffc36f5536011f3e1b4f1d1c591f031e35e7196 Author: Translation commit bot <translation(a)torproject.org> Date: Mon Sep 29 15:46:03 2014 +0000 Update translations for torbutton-torbuttonproperties --- eu/torbutton.properties | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/eu/torbutton.properties b/eu/torbutton.properties index fdff847..e728cb9 100644 --- a/eu/torbutton.properties +++ b/eu/torbutton.properties @@ -21,13 +21,13 @@ torbutton.popup.test.auto_failed = Tor proxy froga automatikoak huts egin du Tor torbutton.prefs.recommended = (gomendatua) torbutton.prefs.optional = (hautazkoa) torbutton.prefs.crucial = (erabakigarria) -torbutton.popup.external.title = Download an external file type? +torbutton.popup.external.title = Kanpoko fitxategi mota bat desargatu? torbutton.popup.external.app = Tor Browser cannot display this file. You will need to open it with another application.\n\n torbutton.popup.external.note = Some types of files can cause applications to connect to the Internet without using Tor.\n\n torbutton.popup.external.suggest = To be safe, you should only open downloaded files while offline, or use a Tor Live CD such as Tails.\n -torbutton.popup.launch = Download file +torbutton.popup.launch = Fitxategia deskargatu torbutton.popup.cancel = Utzi -torbutton.popup.dontask = Automatically download files from now on +torbutton.popup.dontask = Hemendik aurrera fitxategiak automatikoki deskargatu torbutton.popup.test.no_http_proxy = Tor proxy froga: Ezin da HTTP Proxy lokalera iritsi. Polipo zuzen exekutatzen ari da? torbutton.popup.captcha.title = Saihestu Googleren Captchak? torbutton.popup.captcha.ask = Torbuttonek Google Captcha dat detektatu du. Beste bilaketa motor batera birbideratua izan nahi al duzu eskakizun honetarako? @@ -49,9 +49,9 @@ torbutton.popup.never_ask_again = Ez nazazu galdetu berriz # Canvas permission prompt. Strings are kept here for ease of translation. canvas.siteprompt=This website (%S) attempted to extract HTML5 canvas image data, which may be used to uniquely identify your computer.\n\nShould Tor Browser allow this website to extract HTML5 canvas image data? -canvas.notNow=Not Now +canvas.notNow=Orain ez canvas.notNowAccessKey=N -canvas.allow=Allow in the future +canvas.allow=Etorkizunean baimendu canvas.allowAccessKey=A -canvas.never=Never for this site (recommended) +canvas.never=Inoiz ez gune honetarako (gomendatuta) canvas.neverAccessKey=e

1 0

[tor/master] Automake syntax error :/
by nickm＠torproject.org 29 Sep '14

29 Sep '14

commit a0be2f1350bf4974a9655421c3b30ba87a7b2279 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 29 10:10:37 2014 -0400 Automake syntax error :/ --- src/ext/include.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ext/include.am b/src/ext/include.am index 21d29dc..576fd4e 100644 --- a/src/ext/include.am +++ b/src/ext/include.am @@ -85,7 +85,7 @@ ED25519_REF10_HDRS = \ src/ext/ed25519/ref10/pow225521.h \ src/ext/ed25519/ref10/randombytes.h \ src/ext/ed25519/ref10/sc.h \ - src/ext/ed25519/ref10/sqrtm1.h \ + src/ext/ed25519/ref10/sqrtm1.h noinst_HEADERS += $(ED25519_REF10_HDRS)

1 0

[tor/master] Add missing ed25519_ref10 headers to NOINST_HEADERS.
by nickm＠torproject.org 29 Sep '14

29 Sep '14

commit 9455f45ae3b1fb27c072682caebfb6aed808441c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 29 10:10:08 2014 -0400 Add missing ed25519_ref10 headers to NOINST_HEADERS. --- src/ext/include.am | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/src/ext/include.am b/src/ext/include.am index 69c136b..21d29dc 100644 --- a/src/ext/include.am +++ b/src/ext/include.am @@ -64,8 +64,16 @@ ED25519_REF10_HDRS = \ src/ext/ed25519/ref10/api.h \ src/ext/ed25519/ref10/base.h \ src/ext/ed25519/ref10/base2.h \ + src/ext/ed25519/ref10/crypto_hash_sha512.h \ + src/ext/ed25519/ref10/crypto_int32.h \ + src/ext/ed25519/ref10/crypto_int64.h \ + src/ext/ed25519/ref10/crypto_sign.h \ + src/ext/ed25519/ref10/crypto_uint32.h \ + src/ext/ed25519/ref10/crypto_uint64.h \ + src/ext/ed25519/ref10/crypto_verify_32.h \ src/ext/ed25519/ref10/d.h \ src/ext/ed25519/ref10/d2.h \ + src/ext/ed25519/ref10/ed25519_ref10.h \ src/ext/ed25519/ref10/fe.h \ src/ext/ed25519/ref10/ge.h \ src/ext/ed25519/ref10/ge_add.h \ @@ -75,8 +83,9 @@ ED25519_REF10_HDRS = \ src/ext/ed25519/ref10/ge_sub.h \ src/ext/ed25519/ref10/pow22523.h \ src/ext/ed25519/ref10/pow225521.h \ + src/ext/ed25519/ref10/randombytes.h \ src/ext/ed25519/ref10/sc.h \ - src/ext/ed25519/ref10/sqrtm1.h + src/ext/ed25519/ref10/sqrtm1.h \ noinst_HEADERS += $(ED25519_REF10_HDRS)

1 0

[tor/master] Note when 13290 was introduced.
by nickm＠torproject.org 29 Sep '14

29 Sep '14

commit 18f2bfb8c3328df4b001b963e8b5e2aa44b264fa Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 29 09:50:27 2014 -0400 Note when 13290 was introduced. --- changes/bug13290-avoid-div-zero-circuitstatus-pareto | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changes/bug13290-avoid-div-zero-circuitstatus-pareto b/changes/bug13290-avoid-div-zero-circuitstatus-pareto index 42b121f..cb175a7 100644 --- a/changes/bug13290-avoid-div-zero-circuitstatus-pareto +++ b/changes/bug13290-avoid-div-zero-circuitstatus-pareto @@ -2,4 +2,4 @@ - In circuit_build_times_calculate_timeout() in circuitstats.c, avoid dividing by zero in the pareto calculations. This traps under clang -fsanitize=undefined-trap -fsanitize-undefined-trap-on-error. - Fixes bug 13290. + Fixes bug 13290; bugfix on tor-0.2.2.2-alpha.

1 0

[tor/master] Avoid division by zero in circuitstats pareto
by nickm＠torproject.org 29 Sep '14

29 Sep '14

commit 4d0ad34a92dff2be0b23e75ca5373054a5c9334a Author: teor <teor2345(a)gmail.com> Date: Mon Sep 29 20:24:40 2014 +1000 Avoid division by zero in circuitstats pareto In circuit_build_times_calculate_timeout() in circuitstats.c, avoid dividing by zero in the pareto calculations. If either the alpha or p parameters are 0, we would divide by zero, yielding an infinite result; which would be clamped to INT32_MAX anyway. So rather than dividing by zero, we just skip the offending calculation(s), and use INT32_MAX for the result. Division by zero traps under clang -fsanitize=undefined-trap -fsanitize-undefined-trap-on-error. --- changes/bug13290-avoid-div-zero-circuitstatus-pareto | 5 +++++ src/or/circuitstats.c | 16 +++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/changes/bug13290-avoid-div-zero-circuitstatus-pareto b/changes/bug13290-avoid-div-zero-circuitstatus-pareto new file mode 100644 index 0000000..42b121f --- /dev/null +++ b/changes/bug13290-avoid-div-zero-circuitstatus-pareto @@ -0,0 +1,5 @@ + o Minor bugfixes: + - In circuit_build_times_calculate_timeout() in circuitstats.c, avoid + dividing by zero in the pareto calculations. This traps under + clang -fsanitize=undefined-trap -fsanitize-undefined-trap-on-error. + Fixes bug 13290. diff --git a/src/or/circuitstats.c b/src/or/circuitstats.c index c24259c..5336e40 100644 --- a/src/or/circuitstats.c +++ b/src/or/circuitstats.c @@ -1085,7 +1085,21 @@ circuit_build_times_calculate_timeout(circuit_build_times_t *cbt, tor_assert(1.0-quantile > 0); tor_assert(cbt->Xm > 0); - ret = cbt->Xm/pow(1.0-quantile,1.0/cbt->alpha); + /* If either alpha or p are 0, we would divide by zero, yielding an + * infinite (double) result; which would be clamped to INT32_MAX. + * Instead, initialise ret to INT32_MAX, and skip over these + * potentially illegal/trapping divides by zero. + */ + ret = INT32_MAX; + + if (cbt->alpha > 0) { + double p; + p = pow(1.0-quantile,1.0/cbt->alpha); + if (p > 0) { + ret = cbt->Xm/p; + } + } + if (ret > INT32_MAX) { ret = INT32_MAX; }

1 0

[tor/master] Merge remote-tracking branch 'teor/circuitstats-pareto-avoid-div-zero'
by nickm＠torproject.org 29 Sep '14

29 Sep '14

commit 2b1b1def46395de573902169404238d38ce3070e Merge: ba7b624 4d0ad34 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 29 09:48:02 2014 -0400 Merge remote-tracking branch 'teor/circuitstats-pareto-avoid-div-zero' changes/bug13290-avoid-div-zero-circuitstatus-pareto | 5 +++++ src/or/circuitstats.c | 16 +++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-)

1 0