October 2015 - tor-commits - lists.torproject.org

[tor/release-0.2.7] Check for len < 4 in dn_indicates_v3_cert
by nickm＠torproject.org 21 Oct '15

21 Oct '15

commit 35bf07b8d67d018f7740ca195cf8c7c86b1b4ef9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 21 11:44:43 2015 -0400 Check for len < 4 in dn_indicates_v3_cert Without this check, we potentially look up to 3 characters before the start of a malloc'd segment, which could provoke a crash under certain (weird afaik) circumstances. Fixes 17404; bugfix on 0.2.6.3-alpha. --- changes/bug17404 | 6 ++++++ src/common/tortls.c | 4 ++++ 2 files changed, 10 insertions(+) diff --git a/changes/bug17404 b/changes/bug17404 new file mode 100644 index 0000000..d524f66 --- /dev/null +++ b/changes/bug17404 @@ -0,0 +1,6 @@ + o Major bugfixes (security, correctness): + - Fix a programming error that could cause us to read 4 bytes before + the beginning of an openssl string. This could be used to provoke + a crash on systems with an unusual malloc implementation, or + systems with unsual hardening installed. Fixes bug 17404; bugfix + on 0.2.3.6-alpha. diff --git a/src/common/tortls.c b/src/common/tortls.c index 4222f6d..75ca47d 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -2676,6 +2676,10 @@ dn_indicates_v3_cert(X509_NAME *name) len = ASN1_STRING_to_UTF8(&s, str); if (len < 0) return 0; + if (len < 4) { + OPENSSL_free(s); + return 0; + } r = fast_memneq(s + len - 4, ".net", 4); OPENSSL_free(s); return r;

1 0

[tor/release-0.2.7] Fix the return value
by nickm＠torproject.org 21 Oct '15

21 Oct '15

commit 9459ae260e3ae428283c3b45d08aaef6ef9f6fa3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 21 12:01:05 2015 -0400 Fix the return value --- src/common/tortls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index 75ca47d..840b677 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -2678,7 +2678,7 @@ dn_indicates_v3_cert(X509_NAME *name) return 0; if (len < 4) { OPENSSL_free(s); - return 0; + return 1; } r = fast_memneq(s + len - 4, ".net", 4); OPENSSL_free(s);

1 0

[tor/release-0.2.7] Note that you can use a unix domain socket for hsport
by nickm＠torproject.org 21 Oct '15

21 Oct '15

commit 7b859fd8c558c9cf08add79db87fb1cb76537535 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 21 12:22:05 2015 -0400 Note that you can use a unix domain socket for hsport --- changes/bug17364 | 3 +++ doc/tor.1.txt | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/changes/bug17364 b/changes/bug17364 new file mode 100644 index 0000000..dd9ff12 --- /dev/null +++ b/changes/bug17364 @@ -0,0 +1,3 @@ + o Documentation: + - Note that HiddenServicePorts can take a unix domain socket. + Closes ticket 17364. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 954c8fa..5ea5623 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2176,8 +2176,8 @@ The following options are used to configure a hidden service. option multiple times; each time applies to the service using the most recent HiddenServiceDir. By default, this option maps the virtual port to the same port on 127.0.0.1 over TCP. You may override the target port, - address, or both by specifying a target of addr, port, or addr:port. - (You can specify an IPv6 target as [addr]:port.) + address, or both by specifying a target of addr, port, addr:port, or + **unix:**__path__. (You can specify an IPv6 target as [addr]:port.) You may also have multiple lines with the same VIRTPORT: when a user connects to that VIRTPORT, one of the TARGETs from those lines will be chosen at random.

1 0

[tor/release-0.2.7] Merge branch 'maint-0.2.7' into release-0.2.7
by nickm＠torproject.org 21 Oct '15

21 Oct '15

commit cd8a62a60cbafb61bed8b64e988dacf2b1444668 Merge: 3f3a753 7b859fd Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 21 13:35:04 2015 -0400 Merge branch 'maint-0.2.7' into release-0.2.7 changes/bug17364 | 3 +++ changes/bug17403 | 3 +++ changes/bug17404 | 6 ++++++ doc/tor.1.txt | 4 ++-- src/common/tortls.c | 4 ++++ src/or/routerkeys.c | 2 ++ 6 files changed, 20 insertions(+), 2 deletions(-)

1 0

[tor/release-0.2.7] More 0274-rc changelog updating
by nickm＠torproject.org 21 Oct '15

21 Oct '15

commit 89a9d8c8d75dac081dd304442182e29186888c39 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 21 13:37:06 2015 -0400 More 0274-rc changelog updating --- ChangeLog | 11 +++++++++++ changes/bug17364 | 3 --- changes/bug17403 | 3 --- changes/bug17404 | 6 ------ 4 files changed, 11 insertions(+), 12 deletions(-) diff --git a/ChangeLog b/ChangeLog index 259e4e5..077e8a4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -4,6 +4,13 @@ Changes in version 0.2.7.4-rc - 2015-10-21 on different platforms. If no further significant bounds are found, the next release will the the official stable release. + o Major bugfixes (security, correctness): + - Fix a programming error that could cause us to read 4 bytes before + the beginning of an openssl string. This could be used to provoke + a crash on systems with an unusual malloc implementation, or + systems with unsual hardening installed. Fixes bug 17404; bugfix + on 0.2.3.6-alpha. + o Major bugfixes (correctness): - Fix a use-after-free bug in validate_intro_point_failure(). Fixes bug 17401; bugfix on 0.2.7.3-rc. @@ -13,6 +20,8 @@ Changes in version 0.2.7.4-rc - 2015-10-21 17398; bugfix on 0.2.6.1-alpha. - Fix a memory leak in rend_cache_failure_entry_free(). Fixes bug 17402; bugfix on 0.2.7.3-rc. + - Fix a memory leak when reading an expired signing key from disk. + Fixes bug 17403; bugfix on 0.2.7.2-rc. o Minor features (geoIP): - Update geoip and geoip6 to the October 9 2015 Maxmind GeoLite2 @@ -51,6 +60,8 @@ Changes in version 0.2.7.4-rc - 2015-10-21 o Documentation: - Fix capitalization of SOCKS in sample torrc. Closes ticket 15609. + - Note that HiddenServicePorts can take a unix domain socket. Closes + ticket 17364. Changes in version 0.2.7.3-rc - 2015-09-25 diff --git a/changes/bug17364 b/changes/bug17364 deleted file mode 100644 index dd9ff12..0000000 --- a/changes/bug17364 +++ /dev/null @@ -1,3 +0,0 @@ - o Documentation: - - Note that HiddenServicePorts can take a unix domain socket. - Closes ticket 17364. diff --git a/changes/bug17403 b/changes/bug17403 deleted file mode 100644 index e83a4a2..0000000 --- a/changes/bug17403 +++ /dev/null @@ -1,3 +0,0 @@ - o Minor bugfixes (memory leaks): - - Fix a memory leak when reading an expired signing key from disk. - Fixes bug 17403; bugfix on 0.2.7.2-rc. diff --git a/changes/bug17404 b/changes/bug17404 deleted file mode 100644 index d524f66..0000000 --- a/changes/bug17404 +++ /dev/null @@ -1,6 +0,0 @@ - o Major bugfixes (security, correctness): - - Fix a programming error that could cause us to read 4 bytes before - the beginning of an openssl string. This could be used to provoke - a crash on systems with an unusual malloc implementation, or - systems with unsual hardening installed. Fixes bug 17404; bugfix - on 0.2.3.6-alpha.

1 0

[tor/master] More leaks to fix.
by nickm＠torproject.org 21 Oct '15

21 Oct '15

commit eead8612663e60c6016a734d434c1eb277c4650c Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 21 13:12:19 2015 -0400 More leaks to fix. --- src/test/test_threads.c | 2 ++ src/test/test_tortls.c | 20 +++++++++++++++++--- 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/src/test/test_threads.c b/src/test/test_threads.c index 35f5dc8..fe88c94 100644 --- a/src/test/test_threads.c +++ b/src/test/test_threads.c @@ -73,6 +73,8 @@ thread_test_func_(void* _s) ++thread_fns_failed; tor_mutex_release(thread_test_mutex_); + tor_free(mycount); + tor_mutex_release(m); spawn_exit(); diff --git a/src/test/test_tortls.c b/src/test/test_tortls.c index 805a5b8..cb24cfc 100644 --- a/src/test/test_tortls.c +++ b/src/test/test_tortls.c @@ -129,6 +129,9 @@ test_tortls_tor_tls_new(void *data) (void) data; MOCK(tor_tls_cert_matches_key, mock_tls_cert_matches_key); crypto_pk_t *key1 = NULL, *key2 = NULL; + SSL_METHOD *method = NULL; + SSL_CTX *ctx = NULL; + key1 = pk_generate(2); key2 = pk_generate(3); @@ -144,8 +147,8 @@ test_tortls_tor_tls_new(void *data) tt_assert(!tls); #ifndef OPENSSL_OPAQUE - SSL_METHOD *method = give_me_a_test_method(); - SSL_CTX *ctx = SSL_CTX_new(method); + method = give_me_a_test_method(); + ctx = SSL_CTX_new(method); method->num_ciphers = fake_num_ciphers; client_tls_context->ctx = ctx; tls = tor_tls_new(-1, 0); @@ -157,6 +160,8 @@ test_tortls_tor_tls_new(void *data) crypto_pk_free(key1); crypto_pk_free(key2); tor_tls_free(tls); + tor_free(method); + tor_tls_free_all(); } #define NS_MODULE tortls @@ -2819,6 +2824,7 @@ test_tortls_cert_is_valid(void *ignored) scert = tor_malloc_zero(sizeof(tor_x509_cert_t)); ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0); tt_int_op(ret, OP_EQ, 0); + tor_free(scert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString)); @@ -2830,6 +2836,7 @@ test_tortls_cert_is_valid(void *ignored) tor_x509_cert_free(scert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString)); + ASN1_TIME_free(cert->cert->cert_info->validity->notAfter); cert->cert->cert_info->validity->notAfter = ASN1_TIME_set(NULL, time(NULL)-1000000); ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0); @@ -2839,15 +2846,18 @@ test_tortls_cert_is_valid(void *ignored) tor_x509_cert_free(scert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString)); + X509_PUBKEY_free(cert->cert->cert_info->key); cert->cert->cert_info->key = NULL; ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 1); tt_int_op(ret, OP_EQ, 0); #endif +#if 0 tor_x509_cert_free(cert); tor_x509_cert_free(scert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString)); + /* This doesn't actually change the key in the cert. XXXXXX */ BN_one(EVP_PKEY_get1_RSA(X509_get_pubkey(cert->cert))->n); ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 1); tt_int_op(ret, OP_EQ, 0); @@ -2856,6 +2866,7 @@ test_tortls_cert_is_valid(void *ignored) tor_x509_cert_free(scert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString)); + /* This doesn't actually change the key in the cert. XXXXXX */ X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC; ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 1); tt_int_op(ret, OP_EQ, 0); @@ -2864,6 +2875,7 @@ test_tortls_cert_is_valid(void *ignored) tor_x509_cert_free(scert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString)); + /* This doesn't actually change the key in the cert. XXXXXX */ X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC; ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0); tt_int_op(ret, OP_EQ, 1); @@ -2872,10 +2884,12 @@ test_tortls_cert_is_valid(void *ignored) tor_x509_cert_free(scert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString)); + /* This doesn't actually change the key in the cert. XXXXXX */ X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC; X509_get_pubkey(cert->cert)->ameth = NULL; ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0); tt_int_op(ret, OP_EQ, 0); +#endif done: tor_x509_cert_free(cert); @@ -2913,7 +2927,7 @@ test_tortls_context_init_one(void *ignored) struct testcase_t tortls_tests[] = { LOCAL_TEST_CASE(errno_to_tls_error, 0), LOCAL_TEST_CASE(err_to_string, 0), - LOCAL_TEST_CASE(tor_tls_new, 0), + LOCAL_TEST_CASE(tor_tls_new, TT_FORK), LOCAL_TEST_CASE(tor_tls_get_error, 0), LOCAL_TEST_CASE(get_state_description, TT_FORK), LOCAL_TEST_CASE(get_by_ssl, TT_FORK),

1 0

[tor/master] resolve some leaks in test_tortls.c
by nickm＠torproject.org 21 Oct '15

21 Oct '15

commit 2acf72795ae8e91d070ae4d0bfd10ebc72acf6cd Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 21 12:41:00 2015 -0400 resolve some leaks in test_tortls.c --- src/test/test_tortls.c | 35 +++++++++++++++++++++++++++++------ 1 file changed, 29 insertions(+), 6 deletions(-) diff --git a/src/test/test_tortls.c b/src/test/test_tortls.c index 2e53293..805a5b8 100644 --- a/src/test/test_tortls.c +++ b/src/test/test_tortls.c @@ -132,11 +132,12 @@ test_tortls_tor_tls_new(void *data) key1 = pk_generate(2); key2 = pk_generate(3); - tor_tls_t *tls; + tor_tls_t *tls = NULL; tt_int_op(tor_tls_context_init(TOR_TLS_CTX_IS_PUBLIC_SERVER, key1, key2, 86400), OP_EQ, 0); tls = tor_tls_new(-1, 0); tt_want(tls); + tor_tls_free(tls); tls = NULL; client_tls_context->ctx = NULL; tls = tor_tls_new(-1, 0); @@ -155,6 +156,7 @@ test_tortls_tor_tls_new(void *data) UNMOCK(tor_tls_cert_matches_key); crypto_pk_free(key1); crypto_pk_free(key2); + tor_tls_free(tls); } #define NS_MODULE tortls @@ -185,7 +187,7 @@ test_tortls_tor_tls_get_error(void *data) key1 = pk_generate(2); key2 = pk_generate(3); - tor_tls_t *tls; + tor_tls_t *tls = NULL; tt_int_op(tor_tls_context_init(TOR_TLS_CTX_IS_PUBLIC_SERVER, key1, key2, 86400), OP_EQ, 0); tls = tor_tls_new(-1, 0); @@ -200,6 +202,7 @@ test_tortls_tor_tls_get_error(void *data) NS_UNMOCK(logv); crypto_pk_free(key1); crypto_pk_free(key2); + tor_tls_free(tls); } static void @@ -2784,19 +2787,26 @@ test_tortls_cert_new(void *ignored) ret = tor_x509_cert_new(cert); tt_assert(ret); + tor_x509_cert_free(ret); +#if 0 + cert = read_cert_from(validCertString); + /* XXX this doesn't do what you think: it alters a copy of the pubkey. */ X509_get_pubkey(cert)->type = EVP_PKEY_DSA; ret = tor_x509_cert_new(cert); tt_assert(ret); +#endif #ifndef OPENSSL_OPAQUE + cert = read_cert_from(validCertString); + X509_CINF_free(cert->cert_info); cert->cert_info = NULL; ret = tor_x509_cert_new(cert); tt_assert(ret); #endif done: - (void)0; + tor_x509_cert_free(ret); } static void @@ -2804,7 +2814,7 @@ test_tortls_cert_is_valid(void *ignored) { (void)ignored; int ret; - tor_x509_cert_t *cert = NULL, *scert; + tor_x509_cert_t *cert = NULL, *scert = NULL; scert = tor_malloc_zero(sizeof(tor_x509_cert_t)); ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0); @@ -2816,6 +2826,8 @@ test_tortls_cert_is_valid(void *ignored) tt_int_op(ret, OP_EQ, 1); #ifndef OPENSSL_OPAQUE + tor_x509_cert_free(cert); + tor_x509_cert_free(scert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString)); cert->cert->cert_info->validity->notAfter = @@ -2823,6 +2835,8 @@ test_tortls_cert_is_valid(void *ignored) ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0); tt_int_op(ret, OP_EQ, 0); + tor_x509_cert_free(cert); + tor_x509_cert_free(scert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString)); cert->cert->cert_info->key = NULL; @@ -2830,24 +2844,32 @@ test_tortls_cert_is_valid(void *ignored) tt_int_op(ret, OP_EQ, 0); #endif + tor_x509_cert_free(cert); + tor_x509_cert_free(scert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString)); BN_one(EVP_PKEY_get1_RSA(X509_get_pubkey(cert->cert))->n); ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 1); tt_int_op(ret, OP_EQ, 0); + tor_x509_cert_free(cert); + tor_x509_cert_free(scert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString)); X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC; ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 1); tt_int_op(ret, OP_EQ, 0); + tor_x509_cert_free(cert); + tor_x509_cert_free(scert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString)); X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC; ret = tor_tls_cert_is_valid(LOG_WARN, cert, scert, 0); tt_int_op(ret, OP_EQ, 1); + tor_x509_cert_free(cert); + tor_x509_cert_free(scert); cert = tor_x509_cert_new(read_cert_from(validCertString)); scert = tor_x509_cert_new(read_cert_from(caCertString)); X509_get_pubkey(cert->cert)->type = EVP_PKEY_EC; @@ -2856,7 +2878,8 @@ test_tortls_cert_is_valid(void *ignored) tt_int_op(ret, OP_EQ, 0); done: - (void)0; + tor_x509_cert_free(cert); + tor_x509_cert_free(scert); } static void @@ -2878,7 +2901,7 @@ test_tortls_context_init_one(void *ignored) } #define LOCAL_TEST_CASE(name, flags) \ - { #name, test_tortls_##name, (flags), NULL, NULL } + { #name, test_tortls_##name, (flags|TT_FORK), NULL, NULL } #ifdef OPENSSL_OPAQUE #define INTRUSIVE_TEST_CASE(name, flags) \

1 0

[tor/maint-0.2.7] Note that you can use a unix domain socket for hsport
by nickm＠torproject.org 21 Oct '15

21 Oct '15

commit 7b859fd8c558c9cf08add79db87fb1cb76537535 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 21 12:22:05 2015 -0400 Note that you can use a unix domain socket for hsport --- changes/bug17364 | 3 +++ doc/tor.1.txt | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/changes/bug17364 b/changes/bug17364 new file mode 100644 index 0000000..dd9ff12 --- /dev/null +++ b/changes/bug17364 @@ -0,0 +1,3 @@ + o Documentation: + - Note that HiddenServicePorts can take a unix domain socket. + Closes ticket 17364. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 954c8fa..5ea5623 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2176,8 +2176,8 @@ The following options are used to configure a hidden service. option multiple times; each time applies to the service using the most recent HiddenServiceDir. By default, this option maps the virtual port to the same port on 127.0.0.1 over TCP. You may override the target port, - address, or both by specifying a target of addr, port, or addr:port. - (You can specify an IPv6 target as [addr]:port.) + address, or both by specifying a target of addr, port, addr:port, or + **unix:**__path__. (You can specify an IPv6 target as [addr]:port.) You may also have multiple lines with the same VIRTPORT: when a user connects to that VIRTPORT, one of the TARGETs from those lines will be chosen at random.

1 0

[torspec/master] Ignore OS X's .DS_Store directory metadata files
by nickm＠torproject.org 21 Oct '15

21 Oct '15

commit 2f13c587f0d30a4836194e5dfeaef060ce239179 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Mon Oct 19 06:28:13 2015 +1100 Ignore OS X's .DS_Store directory metadata files --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index be2ff82..46fc8a6 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,5 @@ *.orig *.rej +# OS X folder cruft +.DS_Store

1 0

[torspec/master] Merge remote-tracking branch 'teor/gitignore-osx'
by nickm＠torproject.org 21 Oct '15

21 Oct '15

commit 29435e0051967a3e4b0dfe8401fd1325b5f5ddf5 Merge: 3bac19d 2f13c58 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 21 12:20:03 2015 -0400 Merge remote-tracking branch 'teor/gitignore-osx' .gitignore | 2 ++ 1 file changed, 2 insertions(+)

1 0