March 2015 - tor-commits - lists.torproject.org

[tor/maint-0.2.3] Do not leave empty, invalid chunks in buffers during buf_pullup
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit 71ee53fe9bdf3f64eef9b38de55960185e8be1b5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 3 22:20:17 2015 +0100 Do not leave empty, invalid chunks in buffers during buf_pullup This fixes an assertion failure bug in 15083; bugfix on 0.2.0.10-alpha. Patch from 'cypherpunks' --- changes/bug15083 | 6 ++++++ src/or/buffers.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/changes/bug15083 b/changes/bug15083 new file mode 100644 index 0000000..98d1d0e --- /dev/null +++ b/changes/bug15083 @@ -0,0 +1,6 @@ + o Major bugfixes (relay, stability): + - Fix a bug that could lead to a relay crashing with an assertion + failure if a buffer of exactly the wrong layout was passed + to buf_pullup() at exactly the wrong time. Fixes bug 15083; + bugfix on 0.2.0.10-alpha. Patch from 'cypherpunks'. + diff --git a/src/or/buffers.c b/src/or/buffers.c index 9be0476..7976432 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -426,7 +426,7 @@ buf_pullup(buf_t *buf, size_t bytes, int nulterminate) size_t n = bytes - dest->datalen; src = dest->next; tor_assert(src); - if (n > src->datalen) { + if (n >= src->datalen) { memcpy(CHUNK_WRITE_PTR(dest), src->data, src->datalen); dest->datalen += src->datalen; dest->next = src->next;

1 0

[tor/maint-0.2.3] Make the assert related to 15083 a tiny bit more tolerant
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit 81a994ce77038721df3aa2f77b783db9a52da79e Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 3 22:25:26 2015 +0100 Make the assert related to 15083 a tiny bit more tolerant --- changes/bug15083 | 6 +++++- src/or/buffers.c | 9 ++++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/changes/bug15083 b/changes/bug15083 index 98d1d0e..2bd0715 100644 --- a/changes/bug15083 +++ b/changes/bug15083 @@ -3,4 +3,8 @@ failure if a buffer of exactly the wrong layout was passed to buf_pullup() at exactly the wrong time. Fixes bug 15083; bugfix on 0.2.0.10-alpha. Patch from 'cypherpunks'. - + + - Do not assert if the 'data' pointer on a buffer is advanced to the very + end of the buffer; log a BUG message instead. Only assert if it is + past that point. Fixes bug 15083; bugfix on 0.2.0.10-alpha. + diff --git a/src/or/buffers.c b/src/or/buffers.c index 7976432..9dfed00 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -2483,7 +2483,14 @@ assert_buf_ok(buf_t *buf) total += ch->datalen; tor_assert(ch->datalen <= ch->memlen); tor_assert(ch->data >= &ch->mem[0]); - tor_assert(ch->data < &ch->mem[0]+ch->memlen); + tor_assert(ch->data <= &ch->mem[0]+ch->memlen); + if (ch->data == &ch->mem[0]+ch->memlen) { + static int warned = 0; + if (! warned) { + log_warn(LD_BUG, "Invariant violation in buf.c related to #15083"); + warned = 1; + } + } tor_assert(ch->data+ch->datalen <= &ch->mem[0] + ch->memlen); if (!ch->next) tor_assert(ch == buf->tail);

1 0

[tor/maint-0.2.3] Adjust changes header
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit addffcc14ddf40b3cd1bff3fa86a82354e981a03 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 9 11:07:50 2015 -0400 Adjust changes header --- changes/bug15083 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changes/bug15083 b/changes/bug15083 index 2bd0715..5cc79b5 100644 --- a/changes/bug15083 +++ b/changes/bug15083 @@ -1,4 +1,4 @@ - o Major bugfixes (relay, stability): + o Major bugfixes (relay, stability, possible security): - Fix a bug that could lead to a relay crashing with an assertion failure if a buffer of exactly the wrong layout was passed to buf_pullup() at exactly the wrong time. Fixes bug 15083;

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 09 Mar '15

09 Mar '15

commit c2dfb898d7c80cc65bbe39874c84ac7ffb3293a9 Author: Translation commit bot <translation(a)torproject.org> Date: Mon Mar 9 14:45:13 2015 +0000 Update translations for https_everywhere --- sq/ssl-observatory.dtd | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/sq/ssl-observatory.dtd b/sq/ssl-observatory.dtd index e1603af..bb4af62 100644 --- a/sq/ssl-observatory.dtd +++ b/sq/ssl-observatory.dtd @@ -30,16 +30,16 @@ rrjet korporate shumë ndërhyrës:"> "Paraqitni dhe kontrolloni certifikatat e nënshkruara nga root CA jostandarde"> <!ENTITY ssl-observatory.prefs.alt_roots_tooltip -"It is safe (and a good idea) to enable this option, unless you use an intrusive corporate network or Kaspersky antivirus software that monitors your browsing with a TLS proxy and a private root Certificate Authority. If enabled on such a network, this option might publish evidence of which https:// domains were being visited through that proxy, because of the unique certificates it would produce. So we leave it off by default."> +"Është e sigurt (dhe një ide e mirë) të aftësosh këtë opsion, veç nëse përdorni një rrjet korporate ndërhyrës, ose programin e antivirusit Kaspersky, që vëzhgon shfletimin tuaj me një proxy TLS dhe një root Certificate Authority private. Nëse aftësohet në një rrjet të tillë, ky opsion mund të publikojë prova se cilat domene https:// janë vizituar përmes atij proxy, për shkak të certifikatave unike që ai mund të prodhojë. Kësisoj, e kemi parazgjedhur që ai të rrijë i fikur."> -<!ENTITY ssl-observatory.prefs.anonymous "Check certificates using Tor for anonymity"> +<!ENTITY ssl-observatory.prefs.anonymous "Kontrolloni certifikatat duke përdorur Tor për anonimitetin"> <!ENTITY ssl-observatory.prefs.anonymous_unavailable -"Check certificates using Tor for anonymity (requires Tor)"> +"Kontrolloni certifikatat duke përdorur Tor për anonimitetin (kërkon Tor)"> <!ENTITY ssl-observatory.prefs.anonymous_tooltip -"This option requires Tor to be installed and running"> +"Ky opsion kërkon që Tor të jetë instaluar, si dhe duke u ekzekutuar"> <!ENTITY ssl-observatory.prefs.asn -"When you see a new certificate, tell the Observatory which ISP you are connected to"> +"Kur shihni një certifikatë të re, tregojini Observatorit se me cilën ISP ju jeni lidhur"> <!ENTITY ssl-observatory.prefs.asn_tooltip "This will fetch and send the "Autonomous System number" of your network. This will help us locate attacks against HTTPS, and to determine whether we have observations from networks in places like Iran and Syria where attacks are comparatively common."> @@ -70,26 +70,26 @@ received by the Observatory will indicate that somebody visited www.something.com, but not who visited the site, or what specific page they looked at. Mouseover the options for further details:"> -<!ENTITY ssl-observatory.prefs.hide "Hide advanced options"> +<!ENTITY ssl-observatory.prefs.hide "Fshihini opsionet e përparuara"> <!ENTITY ssl-observatory.prefs.nonanon -"Check certificates even if Tor is not available"> +"Kontrollojini certifikatat edhe nëse Tor nuk është i disponibël"> <!ENTITY ssl-observatory.prefs.nonanon_tooltip -"We will still try to keep the data anonymous, but this option is less secure"> +"Ne do të vijojmë t'i mbajmë të dhënat anonime, por ky opsion është më pak i sigurt"> <!ENTITY ssl-observatory.prefs.priv_dns -"Submit and check certificates for non-public DNS names"> +"Paraqitni dhe kontrolloni certifikatat për emrat e DNS jopublike"> <!ENTITY ssl-observatory.prefs.priv_dns_tooltip -"Unless this option is checked, the Observatory will not record certificates for names that it cannot resolve through the DNS system."> +"Veç nëse ky opsion është i kontrolluar, Observatori nuk do të regjistrojnë certifikata për emrat që ai nuk mund t'i zgjidhë përmes sistemit DNS."> <!ENTITY ssl-observatory.prefs.show "Tregomëni vetitë e përparuara"> <!ENTITY ssl-observatory.prefs.title "Parapëlqimet për Vëzhguesin SSL"> <!ENTITY ssl-observatory.prefs.use "Do ta përdorni Vëzhguesin?"> -<!ENTITY ssl-observatory.warning.title "WARNING from EFF's SSL Observatory"> +<!ENTITY ssl-observatory.warning.title "KUJDES nga Observatori SSL i EFF "> <!ENTITY ssl-observatory.warning.showcert "Show the certificate chain"> <!ENTITY ssl-observatory.warning.okay "Kuptoj"> <!ENTITY ssl-observatory.warning.text "EFF's SSL Observatory has issued a warning about the HTTPS certificiate(s) for this site:">

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 09 Mar '15

09 Mar '15

commit 99399eed0acdc319ef5514dc207b3127425cd1c5 Author: Translation commit bot <translation(a)torproject.org> Date: Mon Mar 9 14:15:14 2015 +0000 Update translations for https_everywhere --- sq/ssl-observatory.dtd | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sq/ssl-observatory.dtd b/sq/ssl-observatory.dtd index ac6a4d5..e1603af 100644 --- a/sq/ssl-observatory.dtd +++ b/sq/ssl-observatory.dtd @@ -20,14 +20,14 @@ to turn it on?">-->  <!ENTITY ssl-observatory.prefs.adv_priv_opts1 -"It is safe to enable this, unless you use a very -intrusive corporate network:"> +"Aktivizimi i kësaj është i sigurt, veç nëse përdorni një +rrjet korporate shumë ndërhyrës:"> <!ENTITY ssl-observatory.prefs.adv_priv_opts2 -"Safe, unless you use a corporate network with secret intranet server names:"> +"I sigurt, veç nëse përdorni një rrjet korporate, me emra të fshehtë të shërbyesve të intranetit:"> <!ENTITY ssl-observatory.prefs.alt_roots -"Submit and check certificates signed by non-standard root CAs"> +"Paraqitni dhe kontrolloni certifikatat e nënshkruara nga root CA jostandarde"> <!ENTITY ssl-observatory.prefs.alt_roots_tooltip "It is safe (and a good idea) to enable this option, unless you use an intrusive corporate network or Kaspersky antivirus software that monitors your browsing with a TLS proxy and a private root Certificate Authority. If enabled on such a network, this option might publish evidence of which https:// domains were being visited through that proxy, because of the unique certificates it would produce. So we leave it off by default.">

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 09 Mar '15

09 Mar '15

commit bf4885f52ac4ff23c1c5b406aa0a422ad681fa89 Author: Translation commit bot <translation(a)torproject.org> Date: Mon Mar 9 13:45:14 2015 +0000 Update translations for https_everywhere --- sq/ssl-observatory.dtd | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sq/ssl-observatory.dtd b/sq/ssl-observatory.dtd index 00798f0..ac6a4d5 100644 --- a/sq/ssl-observatory.dtd +++ b/sq/ssl-observatory.dtd @@ -3,9 +3,9 @@ <!ENTITY ssl-observatory.popup.later "Më Pyesni Më Vonë"> <!ENTITY ssl-observatory.popup.no "Jo"> -<!ENTITY ssl-observatory.popup.text "HTTPS Everywhere can detect attacks -against your browser by sending the certificates you receive to the -Observatory. Turn this on?"> +<!ENTITY ssl-observatory.popup.text "HTTPS Everywhere mund të zbulojë sulmet +kundër shfletuesit tuaj, duke dërguar çdo certifikatë që ju merrni, tek +Observatori. Ta aktivizojmë?">  <!ENTITY ssl-observatory.popup.title -"Should HTTPS Everywhere use the SSL Observatory?"> +"A duhet që HTTPS Everywhere të përdorë Observatorin SSL?"> <!ENTITY ssl-observatory.popup.yes "Po">

1 0

[translation/https_everywhere_completed] Update translations for https_everywhere_completed
by translation＠torproject.org 09 Mar '15

09 Mar '15

commit 4139bc32b8c5458bf3bb7b2f24677d526d6b2e1e Author: Translation commit bot <translation(a)torproject.org> Date: Mon Mar 9 13:15:17 2015 +0000 Update translations for https_everywhere_completed --- bg/https-everywhere.dtd | 2 ++ 1 file changed, 2 insertions(+) diff --git a/bg/https-everywhere.dtd b/bg/https-everywhere.dtd index e6182e8..422c3cc 100644 --- a/bg/https-everywhere.dtd +++ b/bg/https-everywhere.dtd @@ -8,12 +8,14 @@ <!ENTITY https-everywhere.about.contribute "Ако харесвате HTTPS Everywhere можете да направите"> <!ENTITY https-everywhere.about.donate_tor "дарение към Tor"> <!ENTITY https-everywhere.about.tor_lang_code "bg"> +<!ENTITY https-everywhere.about.or "или"> <!ENTITY https-everywhere.about.donate_eff "дарение към EFF"> <!ENTITY https-everywhere.menu.about "За HTTPS Everywhere"> <!ENTITY https-everywhere.menu.observatory "Настройки на SSL Observatory"> <!ENTITY https-everywhere.menu.globalEnable "Включи HTTPS Everywhere"> <!ENTITY https-everywhere.menu.globalDisable "Изключи HTTPS Everywhere"> +<!ENTITY https-everywhere.menu.blockHttpRequests "Блокиране на всички HTTP заявки"> <!ENTITY https-everywhere.menu.showCounter "Показване на брояч"> <!ENTITY https-everywhere.prefs.title "Настройки на HTTPS Everywhere">

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 09 Mar '15

09 Mar '15

commit f12878c69eca4081a3067054993b8b866913ce0b Author: Translation commit bot <translation(a)torproject.org> Date: Mon Mar 9 13:15:13 2015 +0000 Update translations for https_everywhere --- bg/https-everywhere.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bg/https-everywhere.dtd b/bg/https-everywhere.dtd index 981826a..422c3cc 100644 --- a/bg/https-everywhere.dtd +++ b/bg/https-everywhere.dtd @@ -15,7 +15,7 @@ <!ENTITY https-everywhere.menu.observatory "Настройки на SSL Observatory"> <!ENTITY https-everywhere.menu.globalEnable "Включи HTTPS Everywhere"> <!ENTITY https-everywhere.menu.globalDisable "Изключи HTTPS Everywhere"> -<!ENTITY https-everywhere.menu.blockHttpRequests "Block all HTTP requests"> +<!ENTITY https-everywhere.menu.blockHttpRequests "Блокиране на всички HTTP заявки"> <!ENTITY https-everywhere.menu.showCounter "Показване на брояч"> <!ENTITY https-everywhere.prefs.title "Настройки на HTTPS Everywhere">

1 0

[tor/master] Add `check-changes` rule for checking formatting of changes files.
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit 9dc90a5b7bf02bc9a034b57bdbc1588745d00447 Author: cypherpunks <cypherpunks(a)torproject.org> Date: Fri Mar 6 11:56:57 2015 +0100 Add `check-changes` rule for checking formatting of changes files. Additional fixes to make the change work; - fix Python 2 vs 3 issues - fix some PEP 8 warnings - handle paths with numbers correctly - mention the make rule in doc/HACKING. --- Makefile.am | 6 ++++++ changes/feature15180 | 3 +++ doc/HACKING | 7 ++++--- scripts/maint/lintChanges.py | 18 +++++++++++------- 4 files changed, 24 insertions(+), 10 deletions(-) diff --git a/Makefile.am b/Makefile.am index b1f92f5..03dff91 100644 --- a/Makefile.am +++ b/Makefile.am @@ -111,6 +111,12 @@ check-logs: ./scripts/maint/checkLogs.pl \ src/*/*.[ch] | sort -n +.PHONY: check-changes +check-changes: + @if test -d "$(top_srcdir)/changes"; then \ + $(PYTHON) $(top_srcdir)/scripts/maint/lintChanges.py $(top_srcdir)/changes/*; \ + fi + version: @echo "Tor @VERSION@" @if test -d "$(top_srcdir)/.git" && test -x "`which git 2>&1;true`"; then \ diff --git a/changes/feature15180 b/changes/feature15180 new file mode 100644 index 0000000..f73ab96 --- /dev/null +++ b/changes/feature15180 @@ -0,0 +1,3 @@ + o Minor features (testing): + - Add make rule `check-changes` to verify the format of changes files. + Closes ticket 15180. diff --git a/doc/HACKING b/doc/HACKING index 5c71b74..f006bb6 100644 --- a/doc/HACKING +++ b/doc/HACKING @@ -61,9 +61,10 @@ it's a bugfix, mention what bug it fixes and when the bug was introduced. To find out which Git tag the change was introduced in, you can use "git describe --contains <sha1 of commit>". -If at all possible, try to create this file in the same commit where -you are making the change. Please give it a distinctive name that no -other branch will use for the lifetime of your change. +If at all possible, try to create this file in the same commit where you are +making the change. Please give it a distinctive name that no other branch will +use for the lifetime of your change. To verify the format of the changes file, +you can use "make check-changes". When we go to make a release, we will concatenate all the entries in changes to make a draft changelog, and clear the directory. We'll diff --git a/scripts/maint/lintChanges.py b/scripts/maint/lintChanges.py index 69963ae..19d03ec 100755 --- a/scripts/maint/lintChanges.py +++ b/scripts/maint/lintChanges.py @@ -1,19 +1,22 @@ #!/usr/bin/python +from __future__ import print_function +from __future__ import with_statement import sys import re - +import os def lintfile(fname): have_warned = [] + def warn(s): if not have_warned: have_warned.append(1) - print fname,":" - print "\t",s + print("{}:".format(fname)) + print("\t{}".format(s)) - m = re.search(r'(\d{3,})', fname) + m = re.search(r'(\d{3,})', os.path.basename(fname)) if m: bugnum = m.group(1) else: @@ -23,7 +26,7 @@ def lintfile(fname): contents = f.read() if bugnum and bugnum not in contents: - warn("bug number %s does not appear"%bugnum) + warn("bug number {} does not appear".format(bugnum)) lines = contents.split("\n") isBug = ("bug" in lines[0] or "fix" in lines[0]) @@ -44,11 +47,12 @@ def lintfile(fname): if re.search(r'[bB]ug (\d+)', contents): if not re.search(r'[Bb]ugfix on ', contents): warn("bugfix does not say 'bugfix on X.Y.Z'") - elif not re.search('[fF]ixes ([a-z ]*)bug (\d+); bugfix on ', contents): + elif not re.search('[fF]ixes ([a-z ]*)bug (\d+); bugfix on ', + contents): warn("bugfix incant is not semicoloned") -if __name__=='__main__': +if __name__ == '__main__': for fname in sys.argv[1:]: if fname.endswith("~"): continue

1 0

[tor/master] Be exact about the number of spaces in the header.
by nickm＠torproject.org 09 Mar '15

09 Mar '15

commit 034f51dd0223b4d2969a3ecc2f0dc661b07bc6f1 Author: cypherpunks <cypherpunks(a)torproject.org> Date: Fri Mar 6 15:08:45 2015 +0100 Be exact about the number of spaces in the header. Also fixes changes files that warn on this. --- changes/bug14806 | 4 ++-- scripts/maint/lintChanges.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/changes/bug14806 b/changes/bug14806 index 3a2e355..dd85e78 100644 --- a/changes/bug14806 +++ b/changes/bug14806 @@ -1,3 +1,3 @@ - o Minor bugfixes (testing): - - Commandline argument tests moved to Stem. Fixes bug 14806. + o Minor bugfixes (testing): + - Commandline argument tests moved to Stem. Fixes bug 14806. diff --git a/scripts/maint/lintChanges.py b/scripts/maint/lintChanges.py index 19d03ec..c2fc01d 100755 --- a/scripts/maint/lintChanges.py +++ b/scripts/maint/lintChanges.py @@ -31,7 +31,7 @@ def lintfile(fname): lines = contents.split("\n") isBug = ("bug" in lines[0] or "fix" in lines[0]) - if not re.match(r'^ +o (.*)', contents): + if not re.match(r'^[ ]{2}o (.*)', contents): warn("header not in format expected") contents = " ".join(contents.split())

1 0