April 2015 - tor-commits - lists.torproject.org

[tor/master] Unindent a block in crypto_set_tls_dh_prime
by nickm＠torproject.org 01 Apr '15

01 Apr '15

commit baf24bf4d1c6a6b3c4f20c4d165d92ed05f4ae14 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 1 13:40:37 2015 -0400 Unindent a block in crypto_set_tls_dh_prime --- src/common/crypto.c | 30 ++++++++++++++---------------- 1 file changed, 14 insertions(+), 16 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 55f816a..41c775e 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1782,22 +1782,20 @@ crypto_set_tls_dh_prime(void) dh_param_p_tls = NULL; } - if (1) { - tls_prime = BN_new(); - tor_assert(tls_prime); - - /* This is the 1024-bit safe prime that Apache uses for its DH stuff; see - * modules/ssl/ssl_engine_dh.c; Apache also uses a generator of 2 with this - * prime. - */ - r =BN_hex2bn(&tls_prime, - "D67DE440CBBBDC1936D693D34AFD0AD50C84D239A45F520BB88174CB98" - "BCE951849F912E639C72FB13B4B4D7177E16D55AC179BA420B2A29FE324A" - "467A635E81FF5901377BEDDCFD33168A461AAD3B72DAE8860078045B07A7" - "DBCA7874087D1510EA9FCC9DDD330507DD62DB88AEAA747DE0F4D6E2BD68" - "B0E7393E0F24218EB3"); - tor_assert(r); - } + tls_prime = BN_new(); + tor_assert(tls_prime); + + /* This is the 1024-bit safe prime that Apache uses for its DH stuff; see + * modules/ssl/ssl_engine_dh.c; Apache also uses a generator of 2 with this + * prime. + */ + r = BN_hex2bn(&tls_prime, + "D67DE440CBBBDC1936D693D34AFD0AD50C84D239A45F520BB88174CB98" + "BCE951849F912E639C72FB13B4B4D7177E16D55AC179BA420B2A29FE324A" + "467A635E81FF5901377BEDDCFD33168A461AAD3B72DAE8860078045B07A7" + "DBCA7874087D1510EA9FCC9DDD330507DD62DB88AEAA747DE0F4D6E2BD68" + "B0E7393E0F24218EB3"); + tor_assert(r); tor_assert(tls_prime);

1 0

[tor/master] Remove dynamicdhgroups from the manpage
by nickm＠torproject.org 01 Apr '15

01 Apr '15

commit 840c11b14e673abaa64ae3ba8dc1efcc92a2da27 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 1 13:41:15 2015 -0400 Remove dynamicdhgroups from the manpage --- doc/tor.1.txt | 6 ------ 1 file changed, 6 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index a77cb9b..ed7cff9 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -371,12 +371,6 @@ GENERAL OPTIONS chosen with their regular weights, multiplied by this number, which should be 1.0 or less. (Default: 1.0) -[[DynamicDHGroups]] **DynamicDHGroups** **0**|**1**:: - If this option is set to 1, when running as a server, generate our - own Diffie-Hellman group instead of using the one from Apache's mod_ssl. - This option may help circumvent censorship based on static - Diffie-Hellman parameters. (Default: 0) - [[AlternateDirAuthority]] **AlternateDirAuthority** [__nickname__] [**flags**] __address__:__port__ __fingerprint__ + [[AlternateBridgeAuthority]] **AlternateBridgeAuthority** [__nickname__] [**flags**] __address__:__port__ __ fingerprint__::

1 0

[tor/master] Merge branch 'bug13736'
by nickm＠torproject.org 01 Apr '15

01 Apr '15

commit cd8f13b5cb0f91731653eba1adf0cc3ba597db6d Merge: aa7b792 840c11b Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 1 13:46:50 2015 -0400 Merge branch 'bug13736' changes/bug13736 | 5 + doc/tor.1.txt | 6 - src/common/crypto.c | 277 +++------------------------------------------ src/common/crypto.h | 4 +- src/or/config.c | 24 +--- src/or/or.h | 2 - src/test/testing_common.c | 2 +- 7 files changed, 24 insertions(+), 296 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'yawning/feature15435'
by nickm＠torproject.org 01 Apr '15

01 Apr '15

commit aa7b7922505ef8dfab6df49f5537ffba92322b09 Merge: 34fa4ad fda61e0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 1 13:34:14 2015 -0400 Merge remote-tracking branch 'yawning/feature15435' changes/feature15435 | 5 +++ src/common/util.c | 81 +++++++++++++++++++++++++++++++++++++-------- src/common/util.h | 3 ++ src/or/transports.c | 5 +++ src/test/test_util_slow.c | 2 ++ 5 files changed, 82 insertions(+), 14 deletions(-)

1 0

[tor/master] Implement "TOR_PT_EXIT_ON_STDIN_CLOSE".
by nickm＠torproject.org 01 Apr '15

01 Apr '15

commit fda61e030e12cbd66a2be9905e6855ec6c6a3c63 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Thu Mar 26 12:55:12 2015 +0000 Implement "TOR_PT_EXIT_ON_STDIN_CLOSE". Background processes spawned by Tor now will have a valid stdin. Pluggable transports can detect this behavior with the aformentioned enviornment variable, and exit if stdin ever gets closed. --- changes/feature15435 | 5 +++ src/common/util.c | 81 +++++++++++++++++++++++++++++++++++++-------- src/common/util.h | 3 ++ src/or/transports.c | 5 +++ src/test/test_util_slow.c | 2 ++ 5 files changed, 82 insertions(+), 14 deletions(-) diff --git a/changes/feature15435 b/changes/feature15435 new file mode 100644 index 0000000..afe3603 --- /dev/null +++ b/changes/feature15435 @@ -0,0 +1,5 @@ + o Minor features (pluggable Transports): + - When launching managed pluggable transports, setup a valid open stdin + in the child process that can be used to detect if tor has terminated. + The "TOR_PT_EXIT_ON_STDIN_CLOSE" enviornment variable can be used by + implementations to detect this new behavior. Resolves ticket 15435. diff --git a/src/common/util.c b/src/common/util.c index 2c3a1a1..7096e24 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -3939,9 +3939,11 @@ process_handle_new(void) process_handle_t *out = tor_malloc_zero(sizeof(process_handle_t)); #ifdef _WIN32 + out->stdin_pipe = INVALID_HANDLE_VALUE; out->stdout_pipe = INVALID_HANDLE_VALUE; out->stderr_pipe = INVALID_HANDLE_VALUE; #else + out->stdin_pipe = -1; out->stdout_pipe = -1; out->stderr_pipe = -1; #endif @@ -3981,7 +3983,7 @@ process_handle_waitpid_cb(int status, void *arg) #define CHILD_STATE_FORK 3 #define CHILD_STATE_DUPOUT 4 #define CHILD_STATE_DUPERR 5 -#define CHILD_STATE_REDIRECT 6 +#define CHILD_STATE_DUPIN 6 #define CHILD_STATE_CLOSEFD 7 #define CHILD_STATE_EXEC 8 #define CHILD_STATE_FAILEXEC 9 @@ -4015,6 +4017,8 @@ tor_spawn_background(const char *const filename, const char **argv, HANDLE stdout_pipe_write = NULL; HANDLE stderr_pipe_read = NULL; HANDLE stderr_pipe_write = NULL; + HANDLE stdin_pipe_read = NULL; + HANDLE stdin_pipe_write = NULL; process_handle_t *process_handle; int status; @@ -4060,6 +4064,20 @@ tor_spawn_background(const char *const filename, const char **argv, return status; } + /* Set up pipe for stdin */ + if (!CreatePipe(&stdin_pipe_read, &stdin_pipe_write, &saAttr, 0)) { + log_warn(LD_GENERAL, + "Failed to create pipe for stdin communication with child process: %s", + format_win32_error(GetLastError())); + return status; + } + if (!SetHandleInformation(stderr_pipe_write, HANDLE_FLAG_INHERIT, 0)) { + log_warn(LD_GENERAL, + "Failed to configure pipe for stdin communication with child " + "process: %s", format_win32_error(GetLastError())); + return status; + } + /* Create the child process */ /* Windows expects argv to be a whitespace delimited string, so join argv up @@ -4074,7 +4092,7 @@ tor_spawn_background(const char *const filename, const char **argv, siStartInfo.cb = sizeof(STARTUPINFO); siStartInfo.hStdError = stderr_pipe_write; siStartInfo.hStdOutput = stdout_pipe_write; - siStartInfo.hStdInput = NULL; + siStartInfo.hStdInput = stdin_pipe_read; siStartInfo.dwFlags |= STARTF_USESTDHANDLES; /* Create the child process */ @@ -4104,6 +4122,7 @@ tor_spawn_background(const char *const filename, const char **argv, /* TODO: Close hProcess and hThread in process_handle->pid? */ process_handle->stdout_pipe = stdout_pipe_read; process_handle->stderr_pipe = stderr_pipe_read; + process_handle->stdin_pipe = stdin_pipe_write; status = process_handle->status = PROCESS_STATUS_RUNNING; } @@ -4114,6 +4133,7 @@ tor_spawn_background(const char *const filename, const char **argv, pid_t pid; int stdout_pipe[2]; int stderr_pipe[2]; + int stdin_pipe[2]; int fd, retval; ssize_t nbytes; process_handle_t *process_handle; @@ -4138,7 +4158,7 @@ tor_spawn_background(const char *const filename, const char **argv, child_state = CHILD_STATE_PIPE; - /* Set up pipe for redirecting stdout and stderr of child */ + /* Set up pipe for redirecting stdout, stderr, and stdin of child */ retval = pipe(stdout_pipe); if (-1 == retval) { log_warn(LD_GENERAL, @@ -4159,6 +4179,20 @@ tor_spawn_background(const char *const filename, const char **argv, return status; } + retval = pipe(stdin_pipe); + if (-1 == retval) { + log_warn(LD_GENERAL, + "Failed to set up pipe for stdin communication with child process: %s", + strerror(errno)); + + close(stdout_pipe[0]); + close(stdout_pipe[1]); + close(stderr_pipe[0]); + close(stderr_pipe[1]); + + return status; + } + child_state = CHILD_STATE_MAXFD; #ifdef _SC_OPEN_MAX @@ -4194,13 +4228,11 @@ tor_spawn_background(const char *const filename, const char **argv, if (-1 == retval) goto error; - child_state = CHILD_STATE_REDIRECT; + child_state = CHILD_STATE_DUPIN; - /* Link stdin to /dev/null */ - fd = open("/dev/null", O_RDONLY); /* NOT cloexec, obviously. */ - if (fd != -1) - dup2(fd, STDIN_FILENO); - else + /* Link child stdin to the read end of the pipe */ + retval = dup2(stdin_pipe[0], STDIN_FILENO); + if (-1 == retval) goto error; child_state = CHILD_STATE_CLOSEFD; @@ -4209,7 +4241,8 @@ tor_spawn_background(const char *const filename, const char **argv, close(stderr_pipe[1]); close(stdout_pipe[0]); close(stdout_pipe[1]); - close(fd); + close(stdin_pipe[0]); + close(stdin_pipe[1]); /* Close all other fds, including the read end of the pipe */ /* XXX: We should now be doing enough FD_CLOEXEC setting to make @@ -4259,6 +4292,8 @@ tor_spawn_background(const char *const filename, const char **argv, if (-1 == pid) { log_warn(LD_GENERAL, "Failed to fork child process: %s", strerror(errno)); + close(stdin_pipe[0]); + close(stdin_pipe[1]); close(stdout_pipe[0]); close(stdout_pipe[1]); close(stderr_pipe[0]); @@ -4295,16 +4330,28 @@ tor_spawn_background(const char *const filename, const char **argv, strerror(errno)); } + /* Return write end of the stdin pipe to caller, and close the read end */ + process_handle->stdin_pipe = stdin_pipe[1]; + retval = close(stdin_pipe[0]); + + if (-1 == retval) { + log_warn(LD_GENERAL, + "Failed to close read end of stdin pipe in parent process: %s", + strerror(errno)); + } + status = process_handle->status = PROCESS_STATUS_RUNNING; - /* Set stdout/stderr pipes to be non-blocking */ + /* Set stdin/stdout/stderr pipes to be non-blocking */ if (fcntl(process_handle->stdout_pipe, F_SETFL, O_NONBLOCK) < 0 || - fcntl(process_handle->stderr_pipe, F_SETFL, O_NONBLOCK) < 0) { - log_warn(LD_GENERAL, "Failed to set stderror/stdout pipes nonblocking " - "in parent process: %s", strerror(errno)); + fcntl(process_handle->stderr_pipe, F_SETFL, O_NONBLOCK) < 0 || + fcntl(process_handle->stdin_pipe, F_SETFL, O_NONBLOCK) < 0) { + log_warn(LD_GENERAL, "Failed to set stderror/stdout/stdin pipes " + "nonblocking in parent process: %s", strerror(errno)); } /* Open the buffered IO streams */ process_handle->stdout_handle = fdopen(process_handle->stdout_pipe, "r"); process_handle->stderr_handle = fdopen(process_handle->stderr_pipe, "r"); + process_handle->stdin_handle = fdopen(process_handle->stdin_pipe, "r"); *process_handle_out = process_handle; return process_handle->status; @@ -4347,6 +4394,9 @@ tor_process_handle_destroy,(process_handle_t *process_handle, if (process_handle->stderr_pipe) CloseHandle(process_handle->stderr_pipe); + + if (process_handle->stdin_pipe) + CloseHandle(process_handle->stdin_pipe); #else if (process_handle->stdout_handle) fclose(process_handle->stdout_handle); @@ -4354,6 +4404,9 @@ tor_process_handle_destroy,(process_handle_t *process_handle, if (process_handle->stderr_handle) fclose(process_handle->stderr_handle); + if (process_handle->stdin_handle) + fclose(process_handle->stdin_handle); + clear_waitpid_callback(process_handle->waitpid_cb); #endif diff --git a/src/common/util.h b/src/common/util.h index 3584a87..21ac5b3 100644 --- a/src/common/util.h +++ b/src/common/util.h @@ -474,12 +474,15 @@ struct process_handle_t { /** One of the PROCESS_STATUS_* values */ int status; #ifdef _WIN32 + HANDLE stdin_pipe; HANDLE stdout_pipe; HANDLE stderr_pipe; PROCESS_INFORMATION pid; #else + int stdin_pipe; int stdout_pipe; int stderr_pipe; + FILE *stdin_handle; FILE *stdout_handle; FILE *stderr_handle; pid_t pid; diff --git a/src/or/transports.c b/src/or/transports.c index 6f07054..ba2c784 100644 --- a/src/or/transports.c +++ b/src/or/transports.c @@ -1388,6 +1388,11 @@ create_managed_proxy_environment(const managed_proxy_t *mp) } else { smartlist_add_asprintf(envs, "TOR_PT_EXTENDED_SERVER_PORT="); } + + /* All new versions of tor will keep stdin open, so PTs can use it + * as a reliable termination detection mechanism. + */ + smartlist_add_asprintf(envs, "TOR_PT_EXIT_ON_STDIN_CLOSE=1"); } else { /* If ClientTransportPlugin has a HTTPS/SOCKS proxy configured, set the * TOR_PT_PROXY line. diff --git a/src/test/test_util_slow.c b/src/test/test_util_slow.c index a597ef3..dcd0c9a 100644 --- a/src/test/test_util_slow.c +++ b/src/test/test_util_slow.c @@ -107,9 +107,11 @@ run_util_spawn_background(const char *argv[], const char *expected_out, #ifdef _WIN32 tt_assert(process_handle->stdout_pipe != INVALID_HANDLE_VALUE); tt_assert(process_handle->stderr_pipe != INVALID_HANDLE_VALUE); + tt_assert(process_handle->stdin_pipe != INVALID_HANDLE_VALUE); #else tt_assert(process_handle->stdout_pipe >= 0); tt_assert(process_handle->stderr_pipe >= 0); + tt_assert(process_handle->stdin_pipe >= 0); #endif /* Check stdout */

1 0

[tor/master] Block multiple introductions on the same intro circuit.
by nickm＠torproject.org 01 Apr '15

01 Apr '15

commit a7eae4ddc52006a5d94a07435152c4dc5ab2ac0e Author: George Kadianakis <desnacked(a)riseup.net> Date: Wed Apr 1 14:33:09 2015 +0100 Block multiple introductions on the same intro circuit. --- changes/bug15515 | 4 ++++ src/or/or.h | 3 +++ src/or/rendmid.c | 13 +++++++++++++ 3 files changed, 20 insertions(+) diff --git a/changes/bug15515 b/changes/bug15515 new file mode 100644 index 0000000..dda7c2f --- /dev/null +++ b/changes/bug15515 @@ -0,0 +1,4 @@ + o Minor features (DoS-resistance): + - Make it harder for attackers to overwhelm hidden services with + introductions, by blocking multiple introduction requests on the + same circuit. Resolves ticket #15515. diff --git a/src/or/or.h b/src/or/or.h index 1609587..adf3cfa 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3186,6 +3186,9 @@ typedef struct or_circuit_t { * to the specification? */ unsigned int remaining_relay_early_cells : 4; + /* We have already received an INTRODUCE1 cell on this circuit. */ + unsigned int already_received_introduce1 : 1; + /** True iff this circuit was made with a CREATE_FAST cell. */ unsigned int is_first_hop : 1; diff --git a/src/or/rendmid.c b/src/or/rendmid.c index d89cdf6..48bab19 100644 --- a/src/or/rendmid.c +++ b/src/or/rendmid.c @@ -149,6 +149,19 @@ rend_mid_introduce(or_circuit_t *circ, const uint8_t *request, goto err; } + /* We have already done an introduction on this circuit but we just + received a request for another one. We block it since this might + be an attempt to DoS a hidden service (#15515). */ + if (circ->already_received_introduce1) { + log_fn(LOG_PROTOCOL_WARN, LD_REND, + "Blocking multiple introductions on the same circuit. " + "Someone might be trying to attack a hidden service through " + "this relay."); + goto err; + } + + circ->already_received_introduce1 = 1; + /* We could change this to MAX_HEX_NICKNAME_LEN now that 0.0.9.x is * obsolete; however, there isn't much reason to do so, and we're going * to revise this protocol anyway.

1 0

[tor/master] Merge remote-tracking branch 'public/bug15515_025'
by nickm＠torproject.org 01 Apr '15

01 Apr '15

commit 34fa4ad637ae3997b0ae31f2009a8aacc6261626 Merge: fec3091 a7eae4d Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 1 12:59:19 2015 -0400 Merge remote-tracking branch 'public/bug15515_025' changes/bug15515 | 4 ++++ src/or/or.h | 3 +++ src/or/rendmid.c | 13 +++++++++++++ 3 files changed, 20 insertions(+)

1 0

[stem/master] Test when tail() is unable to read the file
by atagar＠torproject.org 01 Apr '15

01 Apr '15

commit e5046f73a1bfe49cfa7a0b312d11c558c7e47818 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Apr 1 09:51:31 2015 -0700 Test when tail() is unable to read the file --- stem/util/system.py | 2 ++ test/unit/descriptor/reader.py | 5 ++--- test/unit/util/system.py | 9 +++++++++ 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/stem/util/system.py b/stem/util/system.py index fd62b9d..56f3da5 100644 --- a/stem/util/system.py +++ b/stem/util/system.py @@ -756,6 +756,8 @@ def tail(target, lines = None): :param int lines: number of lines to read :returns: **list** of lines the file ends with + + :raises: **IOError** if unable to read the file """ if isinstance(target, str): diff --git a/test/unit/descriptor/reader.py b/test/unit/descriptor/reader.py index debb88a..eaea7ea 100644 --- a/test/unit/descriptor/reader.py +++ b/test/unit/descriptor/reader.py @@ -635,8 +635,7 @@ class TestDescriptorReader(unittest.TestCase): it is located. """ - test_listing_file = open(self.test_listing_path, 'w') - test_listing_file.write(contents) - test_listing_file.close() + with open(self.test_listing_path, 'w') as test_listing_file: + test_listing_file.write(contents) return self.test_listing_path diff --git a/test/unit/util/system.py b/test/unit/util/system.py index 98cfb8d..e3de4d8 100644 --- a/test/unit/util/system.py +++ b/test/unit/util/system.py @@ -9,6 +9,7 @@ import functools import ntpath import os import posixpath +import tempfile import unittest from stem import str_type @@ -391,6 +392,14 @@ class TestSystem(unittest.TestCase): self.assertEqual(14, len(system.tail(path))) self.assertEqual(14, len(system.tail(path, 200))) + self.assertRaises(IOError, system.tail, '/path/doesnt/exist') + + fd, temp_path = tempfile.mkstemp() + os.chmod(temp_path, 0o077) # remove read permissions + self.assertRaises(IOError, system.tail, temp_path) + os.close(fd) + os.remove(temp_path) + @patch('stem.util.system.call') @patch('stem.util.system.is_available', Mock(return_value = True)) def test_bsd_jail_id(self, call_mock):

1 0

[torspec/master] Make it clearer that hidserv-stats can be negative.
by nickm＠torproject.org 01 Apr '15

01 Apr '15

commit 26929b8c55547f646b4bd16011f06dbc97e64953 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Mon Mar 16 09:55:30 2015 +0100 Make it clearer that hidserv-stats can be negative. Fixes #15276. --- dir-spec.txt | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/dir-spec.txt b/dir-spec.txt index a393fd1..7bba929 100644 --- a/dir-spec.txt +++ b/dir-spec.txt @@ -979,7 +979,8 @@ mu = 0 and b = (delta_f / epsilon) with 'delta_f' and 'epsilon' being reported in the key=val part, too; third, the result of the previous obfuscation steps is truncated to the next smaller - integer and included as 'num'. + integer and included as 'num'. Note that the overall reported + value can be negative. "hidserv-dir-onions-seen" SP num SP key=val SP key=val ... NL [At most once.] @@ -991,7 +992,8 @@ The original measurement value is obfuscated in the same way as the 'num' value reported in "hidserv-rend-relayed-cells", but possibly with different parameters as reported in the key=val part - of this line. + of this line. Note that the overall reported value can be + negative. "transport" transportname address:port [arglist] NL [Any number.]

1 0

[torspec/master] Merge remote-tracking branch 'karsten/task-15276'
by nickm＠torproject.org 01 Apr '15

01 Apr '15

commit e80b15b4c03d7cee964214744efbbac29ae9b6cf Merge: 59e4c5e 26929b8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 1 12:52:57 2015 -0400 Merge remote-tracking branch 'karsten/task-15276' dir-spec.txt | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)

1 0