May 2015 - tor-commits - lists.torproject.org

[metrics-lib/master] Handle unrecognized crypto blocks in server descriptors.
by karsten＠torproject.org 29 May '15

29 May '15

commit a8d9e1beef3d0412684d4932354e6dd973bc7cc3 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Fri May 29 11:34:06 2015 +0200 Handle unrecognized crypto blocks in server descriptors. This bug was triggered by #16227, but only because that was the first newly introduced crypto block that we don't recognize yet. --- .../descriptor/impl/ServerDescriptorImpl.java | 35 ++++++++++------ .../descriptor/impl/ServerDescriptorImplTest.java | 42 ++++++++++++++++++++ 2 files changed, 64 insertions(+), 13 deletions(-) diff --git a/src/org/torproject/descriptor/impl/ServerDescriptorImpl.java b/src/org/torproject/descriptor/impl/ServerDescriptorImpl.java index f9a1e48..cf24904 100644 --- a/src/org/torproject/descriptor/impl/ServerDescriptorImpl.java +++ b/src/org/torproject/descriptor/impl/ServerDescriptorImpl.java @@ -66,7 +66,7 @@ public class ServerDescriptorImpl extends DescriptorImpl Scanner s = new Scanner(new String(this.rawDescriptorBytes)). useDelimiter("\n"); String nextCrypto = null; - StringBuilder crypto = null; + List<String> cryptoLines = null; while (s.hasNext()) { String line = s.next(); if (line.startsWith("@")) { @@ -134,25 +134,34 @@ public class ServerDescriptorImpl extends DescriptorImpl } else if (keyword.equals("ntor-onion-key")) { this.parseNtorOnionKeyLine(line, lineNoOpt, partsNoOpt); } else if (line.startsWith("-----BEGIN")) { - crypto = new StringBuilder(); - crypto.append(line + "\n"); + cryptoLines = new ArrayList<String>(); + cryptoLines.add(line); } else if (line.startsWith("-----END")) { - crypto.append(line + "\n"); - String cryptoString = crypto.toString(); - crypto = null; - if (nextCrypto.equals("onion-key")) { + cryptoLines.add(line); + StringBuilder sb = new StringBuilder(); + for (String cryptoLine : cryptoLines) { + sb.append("\n" + cryptoLine); + } + String cryptoString = sb.toString().substring(1); + if ("onion-key".equals(nextCrypto)) { this.onionKey = cryptoString; - } else if (nextCrypto.equals("signing-key")) { + } else if ("signing-key".equals(nextCrypto)) { this.signingKey = cryptoString; - } else if (nextCrypto.equals("router-signature")) { + } else if ("router-signature".equals(nextCrypto)) { this.routerSignature = cryptoString; - } else { + } else if (this.failUnrecognizedDescriptorLines) { throw new DescriptorParseException("Unrecognized crypto " - + "block in server descriptor."); + + "block '" + cryptoString + "' in server descriptor."); + } else { + if (this.unrecognizedLines == null) { + this.unrecognizedLines = new ArrayList<String>(); + } + this.unrecognizedLines.addAll(cryptoLines); } + cryptoLines = null; nextCrypto = null; - } else if (crypto != null) { - crypto.append(line + "\n"); + } else if (cryptoLines != null) { + cryptoLines.add(line); } else { ParseHelper.parseKeyword(line, partsNoOpt[0]); if (this.failUnrecognizedDescriptorLines) { diff --git a/test/org/torproject/descriptor/impl/ServerDescriptorImplTest.java b/test/org/torproject/descriptor/impl/ServerDescriptorImplTest.java index a3329be..b593e21 100644 --- a/test/org/torproject/descriptor/impl/ServerDescriptorImplTest.java +++ b/test/org/torproject/descriptor/impl/ServerDescriptorImplTest.java @@ -1309,5 +1309,47 @@ public class ServerDescriptorImplTest { unrecognizedLines.add(unrecognizedLine); assertEquals(unrecognizedLines, descriptor.getUnrecognizedLines()); } + + @Test() + public void testSomeOtherKey() throws DescriptorParseException { + List<String> unrecognizedLines = new ArrayList<String>(); + unrecognizedLines.add("some-other-key"); + unrecognizedLines.add("-----BEGIN RSA PUBLIC KEY-----"); + unrecognizedLines.add("MIGJAoGBAKM+iiHhO6eHsvd6Xjws9z9EQB1V/Bpuy5ciGJ" + + "1U4V9SeiKooSo5BpPL"); + unrecognizedLines.add("o3XT+6PIgzl3R6uycjS3Ejk47vLEJdcVTm/VG6E0ppu3ol" + + "IynCI4QryfCEuC3cTF"); + unrecognizedLines.add("9wE4WXY4nX7w0RTN18UVLxrt1A9PP0cobFNiPs9rzJCbKF" + + "facOkpAgMBAAE="); + unrecognizedLines.add("-----END RSA PUBLIC KEY-----"); + StringBuilder sb = new StringBuilder(); + for (String line : unrecognizedLines) { + sb.append("\n" + line); + } + ServerDescriptor descriptor = DescriptorBuilder. + createWithUnrecognizedLine(sb.toString().substring(1), false); + assertEquals(unrecognizedLines, descriptor.getUnrecognizedLines()); + } + + @Test() + public void testUnrecognizedCryptoBlockNoKeyword() + throws DescriptorParseException { + List<String> unrecognizedLines = new ArrayList<String>(); + unrecognizedLines.add("-----BEGIN RSA PUBLIC KEY-----"); + unrecognizedLines.add("MIGJAoGBAKM+iiHhO6eHsvd6Xjws9z9EQB1V/Bpuy5ciGJ" + + "1U4V9SeiKooSo5BpPL"); + unrecognizedLines.add("o3XT+6PIgzl3R6uycjS3Ejk47vLEJdcVTm/VG6E0ppu3ol" + + "IynCI4QryfCEuC3cTF"); + unrecognizedLines.add("9wE4WXY4nX7w0RTN18UVLxrt1A9PP0cobFNiPs9rzJCbKF" + + "facOkpAgMBAAE="); + unrecognizedLines.add("-----END RSA PUBLIC KEY-----"); + StringBuilder sb = new StringBuilder(); + for (String line : unrecognizedLines) { + sb.append("\n" + line); + } + ServerDescriptor descriptor = DescriptorBuilder. + createWithUnrecognizedLine(sb.toString().substring(1), false); + assertEquals(unrecognizedLines, descriptor.getUnrecognizedLines()); + } }

1 0

[check/master] Use stem==1.4.1
by arlo＠torproject.org 29 May '15

29 May '15

commit 949ae3fc71cef69d19af51f7ace9430fe19f93ec Author: Arlo Breault <arlolra(a)gmail.com> Date: Thu May 28 19:55:15 2015 -0700 Use stem==1.4.1 --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index d406152..e07b919 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,2 +1,2 @@ python-dateutil==2.1 -stem==1.1.0 +stem==1.4.1

1 0

[translation/torbutton-torbuttondtd] Update translations for torbutton-torbuttondtd
by translation＠torproject.org 28 May '15

28 May '15

commit f6e1fb27ee85404232894369f176fedb19708df0 Author: Translation commit bot <translation(a)torproject.org> Date: Thu May 28 23:16:06 2015 +0000 Update translations for torbutton-torbuttondtd --- nb/torbutton.dtd | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/nb/torbutton.dtd b/nb/torbutton.dtd index d56c4a9..5ec9e22 100644 --- a/nb/torbutton.dtd +++ b/nb/torbutton.dtd @@ -164,24 +164,24 @@ <!ENTITY torbutton.prefs.sec_jit_desc_tooltip "ION JIT, Type Inference, ASM.JS."> <!ENTITY torbutton.prefs.sec_baseline_jit_desc_tooltip "Baseline JIT."> <!ENTITY torbutton.prefs.sec_jit_slower_desc "Skript på noen sider kan kjøre saktere."> -<!ENTITY torbutton.prefs.sec_jar_desc "Remote JAR files are blocked."> -<!ENTITY torbutton.prefs.sec_jar_tooltip "JAR files are extremely rare on the web, but can be a source of XSS and other attacks."> -<!ENTITY torbutton.prefs.sec_mathml_desc "Some mechanisms of displaying math equations are disabled."> +<!ENTITY torbutton.prefs.sec_jar_desc "Eksterne JAR filer er blokkert."> +<!ENTITY torbutton.prefs.sec_jar_tooltip "JAR filer er svært sjeldne på nett, men kan være en kilde til XSS og andre angrep."> +<!ENTITY torbutton.prefs.sec_mathml_desc "Noen mekanismer for å vise matteformler er skrudd av."> <!ENTITY torbutton.prefs.sec_mathml_desc_tooltip "MathML er avskrudd."> <!ENTITY torbutton.prefs.sec_med_high "Medium-høy"> <!ENTITY torbutton.prefs.sec_all_jit_desc "Alle ytelsesforbedringer for JavaScript er avskrudd."> <!ENTITY torbutton.prefs.sec_font_rend_desc "Noen fonttegningsfunksjoner er avskrudd."> -<!ENTITY torbutton.prefs.sec_font_rend_graphite_tooltip "The Graphite font rendering mechanism is disabled."> +<!ENTITY torbutton.prefs.sec_font_rend_graphite_tooltip "Graphite font visningsmekanismen er skrudd av."> <!ENTITY torbutton.prefs.sec_svg_desc "Noen typer bilder er avskrudd."> <!ENTITY torbutton.prefs.sec_svg_desc_tooltip "SVG-bilder er avskrudd."> <!ENTITY torbutton.prefs.sec_js_https_desc "JavaScript er avskrudd som forvalg på alle sider som ikke er HTTPS."> -<!ENTITY torbutton.prefs.sec_js_desc_tooltip "JavaScript can be enabled on a per-site basis via the NoScript toolbar button."> +<!ENTITY torbutton.prefs.sec_js_desc_tooltip "Javascript kan skrus på pr side via NoScript funksjonsknappen."> <!ENTITY torbutton.prefs.sec_high "Høy"> -<!ENTITY torbutton.prefs.sec_all_js_desc "JavaScript is disabled by default on all sites."> +<!ENTITY torbutton.prefs.sec_all_js_desc "Javascript er standard slått av for alle nettsteder."> <!ENTITY torbutton.prefs.sec_audio_video_desc "De fleste lyd og video -formatene er avskrudd."> <!ENTITY torbutton.prefs.sec_audio_video_desc_tooltip "WebM er det eneste kodeket som fremdeles er påskrudd."> -<!ENTITY torbutton.prefs.sec_webfonts_desc "Some fonts and icons may display incorrectly."> -<!ENTITY torbutton.prefs.sec_webfonts_desc_tooltip "Website-provided font files are blocked."> +<!ENTITY torbutton.prefs.sec_webfonts_desc "Noen fonter og ikoner vises kanskje ikke riktig."> +<!ENTITY torbutton.prefs.sec_webfonts_desc_tooltip "Webside-supplerte fonter er blokkert."> <!ENTITY torbutton.prefs.sec_custom "Egenspesifiserte verdier"> <!ENTITY torbutton.circuit_display.title "Tor-krets for denne siden">

1 0

[translation/torbutton-torbuttonproperties] Update translations for torbutton-torbuttonproperties
by translation＠torproject.org 28 May '15

28 May '15

commit b5bd21c161262f8956ee9ff301d2feaee3f13bd2 Author: Translation commit bot <translation(a)torproject.org> Date: Thu May 28 23:16:00 2015 +0000 Update translations for torbutton-torbuttonproperties --- nb/torbutton.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nb/torbutton.properties b/nb/torbutton.properties index a41fd9b..415e508 100644 --- a/nb/torbutton.properties +++ b/nb/torbutton.properties @@ -7,7 +7,7 @@ torbutton.circuit_display.this_browser = Denne nettleseren torbutton.circuit_display.relay = tor-tilknytning torbutton.circuit_display.tor_bridge = Bro torbutton.circuit_display.unknown_country = Ukjent land -torbutton.content_sizer.margin_tooltip = Tor Browser adds this margin to make the width and height of your window less distinctive, and thus reduces the ability of people to track you online. +torbutton.content_sizer.margin_tooltip = Tor nettleseren legger til denne marginen for å lage bredden og høyden på ditt vindu mindre unikt, og reduserer slik muligheten for andre til å spore deg på nett. torbutton.panel.tooltip.disabled = Klikk for å aktivere Tor torbutton.panel.tooltip.enabled = Klikk for å deaktivere Tor torbutton.panel.plugins.disabled = Klikk for å aktivere plugins

1 0

[check/master] Turn off descriptor validation
by arlo＠torproject.org 28 May '15

28 May '15

commit a16bfe14bb463af2b3e60b6eff2c4783946d3f52 Author: Arlo Breault <arlolra(a)gmail.com> Date: Thu May 28 14:06:48 2015 -0700 Turn off descriptor validation * At least until trac 16227 is resolved and stem upgraded. --- scripts/exitips.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/scripts/exitips.py b/scripts/exitips.py index 81059b1..44bbdeb 100755 --- a/scripts/exitips.py +++ b/scripts/exitips.py @@ -49,7 +49,8 @@ def main(consensuses, exit_lists): # read in consensus and store routes in exits for router in parse_file("data/consensuses/" + f, - "network-status-consensus-3 1.0"): + "network-status-consensus-3 1.0", + validate=False): if router.fingerprint in exits: continue r = Router(router, t) @@ -72,7 +73,7 @@ def main(consensuses, exit_lists): # update exit addresses with data from TorDNSEL for descriptor in parse_file("data/exit-lists/" + m[0], - "tordnsel 1.0"): + "tordnsel 1.0", validate=False): e = exits.get(descriptor.fingerprint, None) if e is not None: if e.Tminus == t: @@ -83,7 +84,7 @@ def main(consensuses, exit_lists): # update all with server descriptor info for descriptor in parse_file("data/cached-descriptors", - "server-descriptor 1.0"): + "server-descriptor 1.0", validate=False): if descriptor.fingerprint in exits: r = exits[descriptor.fingerprint] r.IsAllowed = descriptor.exit_policy.is_exiting_allowed()

1 0

[tor/master] Fix unit tests on MSVC2013.
by nickm＠torproject.org 28 May '15

28 May '15

commit 8ca3773f686c43328f3c05a35d4d0e61a30b980c Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 26 10:24:21 2015 -0400 Fix unit tests on MSVC2013. Patch from "NewEraCracker." Fixes bug16030; bugfix on 0.2.6.2-alpha. --- changes/bug16030 | 3 +++ src/test/test_channel.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/changes/bug16030 b/changes/bug16030 new file mode 100644 index 0000000..c14fd62 --- /dev/null +++ b/changes/bug16030 @@ -0,0 +1,3 @@ + o Minor bugfixes (tests): + - Fix a crash in the unit tests on MSVC2013. Fixes bug 16030; bugfix on + 0.2.6.2-alpha. Patch from "NewEraCracker". \ No newline at end of file diff --git a/src/test/test_channel.c b/src/test/test_channel.c index 6cf6649..e11ac3f 100644 --- a/src/test/test_channel.c +++ b/src/test/test_channel.c @@ -420,6 +420,7 @@ new_fake_channel(void) chan->close = chan_test_close; chan->get_overhead_estimate = chan_test_get_overhead_estimate; + chan->get_remote_descr = chan_test_get_remote_descr; chan->num_bytes_queued = chan_test_num_bytes_queued; chan->num_cells_writeable = chan_test_num_cells_writeable; chan->write_cell = chan_test_write_cell; @@ -615,7 +616,6 @@ test_channel_dumpstats(void *arg) /* Test channel_dump_statistics */ ch->describe_transport = chan_test_describe_transport; ch->dumpstats = chan_test_dumpstats; - ch->get_remote_descr = chan_test_get_remote_descr; ch->is_canonical = chan_test_is_canonical; old_count = test_dumpstats_calls; channel_dump_statistics(ch, LOG_DEBUG);

1 0

[tor/master] Fix sandbox use with systemd. bug 16212.
by nickm＠torproject.org 28 May '15

28 May '15

commit 97330ced0c2e0eeae9bb2bc576bb72190237819d Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 14:05:46 2015 -0400 Fix sandbox use with systemd. bug 16212. --- changes/bug16212 | 5 +++++ src/common/sandbox.c | 10 ++++++++++ 2 files changed, 15 insertions(+) diff --git a/changes/bug16212 b/changes/bug16212 new file mode 100644 index 0000000..bc12463 --- /dev/null +++ b/changes/bug16212 @@ -0,0 +1,5 @@ + o Minor bugfixes (sandbox, systemd): + - Allow systemd connections to work with the Linux seccomp2 sandbox + code. Fixes bug 16212; bugfix on 0.2.6.2-alpha. + Patch by Peter Palfrader. + diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 49316c6..a32bd0d 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -170,6 +170,7 @@ static int filter_nopar_gen[] = { SCMP_SYS(read), SCMP_SYS(rt_sigreturn), SCMP_SYS(sched_getaffinity), + SCMP_SYS(sendmsg), SCMP_SYS(set_robust_list), #ifdef __NR_sigreturn SCMP_SYS(sigreturn), @@ -547,6 +548,15 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX), SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM), SCMP_CMP(2, SCMP_CMP_EQ, 0)); + if (rc) + return rc; + + rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), + SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX), + SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_DGRAM), + SCMP_CMP(2, SCMP_CMP_EQ, 0)); + if (rc) + return rc; rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK),

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.6'
by nickm＠torproject.org 28 May '15

28 May '15

commit b66f4cfc9dfdde9e233424ba4c9c25127adc3435 Merge: 5dce182 97330ce Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 14:06:01 2015 -0400 Merge remote-tracking branch 'origin/maint-0.2.6' changes/bug16030 | 3 +++ changes/bug16212 | 5 +++++ src/common/sandbox.c | 10 ++++++++++ src/test/test_channel.c | 2 +- 4 files changed, 19 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.2.6] Fix sandbox use with systemd. bug 16212.
by nickm＠torproject.org 28 May '15

28 May '15

commit 97330ced0c2e0eeae9bb2bc576bb72190237819d Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 14:05:46 2015 -0400 Fix sandbox use with systemd. bug 16212. --- changes/bug16212 | 5 +++++ src/common/sandbox.c | 10 ++++++++++ 2 files changed, 15 insertions(+) diff --git a/changes/bug16212 b/changes/bug16212 new file mode 100644 index 0000000..bc12463 --- /dev/null +++ b/changes/bug16212 @@ -0,0 +1,5 @@ + o Minor bugfixes (sandbox, systemd): + - Allow systemd connections to work with the Linux seccomp2 sandbox + code. Fixes bug 16212; bugfix on 0.2.6.2-alpha. + Patch by Peter Palfrader. + diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 49316c6..a32bd0d 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -170,6 +170,7 @@ static int filter_nopar_gen[] = { SCMP_SYS(read), SCMP_SYS(rt_sigreturn), SCMP_SYS(sched_getaffinity), + SCMP_SYS(sendmsg), SCMP_SYS(set_robust_list), #ifdef __NR_sigreturn SCMP_SYS(sigreturn), @@ -547,6 +548,15 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX), SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM), SCMP_CMP(2, SCMP_CMP_EQ, 0)); + if (rc) + return rc; + + rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), + SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX), + SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_DGRAM), + SCMP_CMP(2, SCMP_CMP_EQ, 0)); + if (rc) + return rc; rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK),

1 0

[tor/master] Avoid double-free on rend_add_service() failure
by nickm＠torproject.org 28 May '15

28 May '15

commit 5dce1829bf8615f78975e1b7d651e97c266b509a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 13:23:09 2015 -0400 Avoid double-free on rend_add_service() failure Rend_add_service() frees its argument on failure; no need to free again. Fixes bug 16228, bugfix on 0.2.7.1-alpha Found by coverity; this is CID 1301387. --- changes/bug16228 | 4 ++++ src/or/rendservice.c | 3 +-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/changes/bug16228 b/changes/bug16228 new file mode 100644 index 0000000..bf36cf8 --- /dev/null +++ b/changes/bug16228 @@ -0,0 +1,4 @@ + o Minor bugfixes (hidden services): + - Avoid crashing with a double-free bug when we create an + ephemeral hidden service but adding it fails for some reason. + Fixes bug 16228; bugfix on 0.2.7.1-alpha. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 0329d70..d27b06d 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -256,7 +256,7 @@ rend_service_free_all(void) } /** Validate <b>service</b> and add it to rend_service_list if possible. - * Return 0 on success and -1 on failure. + * Return 0 on success. On failure, free <b>service</b> and return -1. */ static int rend_add_service(rend_service_t *service) @@ -868,7 +868,6 @@ rend_service_add_ephemeral(crypto_pk_t *pk, /* Initialize the service. */ if (rend_add_service(s)) { - rend_service_free(s); return RSAE_INTERNAL; } *service_id_out = tor_strdup(s->service_id);

1 0