June 2015 - tor-commits - lists.torproject.org

[torflow/master] Fix README for the file server.
by mikeperry＠torproject.org 01 Jun '15

01 Jun '15

commit dd3d01fae752ff0c400ec55a700dfa11c31546d6 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Mon Jun 1 13:33:55 2015 -0700 Fix README for the file server. --- NetworkScanners/BwAuthority/README.BwAuthorities | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NetworkScanners/BwAuthority/README.BwAuthorities b/NetworkScanners/BwAuthority/README.BwAuthorities index 7e055b4..e268151 100644 --- a/NetworkScanners/BwAuthority/README.BwAuthorities +++ b/NetworkScanners/BwAuthority/README.BwAuthorities @@ -156,7 +156,7 @@ That's all there is to it. No '????' step needed! Appendix A: Creating the HTTPS scanning server -The scanner server will need approx 30-40Mbit of upstream available, and will +The scanner server will need 500Mbit-1Gbit of upstream available, and will need to serve https via a fixed IP. SSL is needed to avoid HTTP content caches at the various exit nodes. Self-signed certs are OK.

1 0

[translation/tor_animation] Update translations for tor_animation
by translation＠torproject.org 01 Jun '15

01 Jun '15

commit 3d502ca1520307a34ee3f6945f5b7e898a4b2359 Author: Translation commit bot <translation(a)torproject.org> Date: Mon Jun 1 20:46:39 2015 +0000 Update translations for tor_animation --- he.srt | 72 ++++++++++++++++++++++++++++++++-------------------------------- 1 file changed, 36 insertions(+), 36 deletions(-) diff --git a/he.srt b/he.srt index 78c998d..c112c49 100644 --- a/he.srt +++ b/he.srt @@ -1,33 +1,33 @@ 1 00:00:00,660 --> 00:00:02,780 -We've gotten very used to the Internet. +התרגלנו מאוד לשימוש באינטרנט. 2 00:00:03,120 --> 00:00:07,700 -We are constantly sharing information -about ourselves and our private lives: +אנחנו כל הזמן חולקים מידע +על עצמינו ועל חיינו הפרטיים. 3 00:00:08,000 --> 00:00:09,960 -food we eat, people we meet, +מה אנחנו אוכלים ועם מי אנחנו נפגשים. 4 00:00:10,180 --> 00:00:12,480 -places we go, and the stuff we read. +המקומות שאנחנו מבקרים בהם, ומה אנחנו קוראים. 5 00:00:13,280 --> 00:00:14,640 -Let me explain it better. +תנו לי להסביר את זה טוב יותר. 6 00:00:14,920 --> 00:00:17,740 -Right at this moment, -if someone attempts to look you up, +ברגע זה ממש +אם מישהו ינסה לחפש מידע עליכם 7 00:00:18,060 --> 00:00:22,480 -they'll see your real identity, -precise location, operating system, +הם יגלו את זהותכם האמיתית +את המיקום המדוייק שלכם, ואיזה מערכת הפעלה אתם משתמשים 8 00:00:22,800 --> 00:00:26,500 @@ -40,126 +40,126 @@ and so much more information about you and your life 10 -00:00:29,620 --> 00:00:32,460 +00:00:29,200 --> 00:00:31,500 which you probably didn't mean to share with unknown strangers, 11 -00:00:32,920 --> 00:00:35,840 +00:00:31,700 --> 00:00:34,000 who could easily use this data to exploit you. 12 -00:00:36,220 --> 00:00:38,120 +00:00:34,500 --> 00:00:37,000 But not if you're using Tor! 13 -00:00:39,140 --> 00:00:42,840 +00:00:37,140 --> 00:00:40,840 Tor Browser protects our privacy and identity on the Internet. 14 -00:00:43,560 --> 00:00:46,760 +00:00:41,560 --> 00:00:44,760 Tor secures your connection with three layers of encryption 15 -00:00:46,940 --> 00:00:51,760 +00:00:44,940 --> 00:00:49,760 and passes it through three voluntarily operated servers around the world, 16 -00:00:52,280 --> 00:00:55,520 +00:00:50,280 --> 00:00:53,520 which enables us to communicate anonymously over the Internet. 17 -00:00:58,560 --> 00:01:00,280 +00:00:56,560 --> 00:00:58,280 Tor also protects our data 18 -00:01:00,400 --> 00:01:03,900 +00:00:58,400 --> 00:01:01,900 against corporate or government targeted and mass surveillance. 19 -00:01:04,880 --> 00:01:09,340 +00:01:02,880 --> 00:01:07,340 Perhaps you live in a repressive country which tries to control and surveil the Internet. 20 -00:01:09,900 --> 00:01:13,800 +00:01:07,900 --> 00:01:11,800 Or perhaps you don't want big corporations taking advantage of your personal information. 21 -00:01:14,880 --> 00:01:17,640 +00:01:12,880 --> 00:01:15,640 Tor makes all of its users to look the same 22 -00:01:17,920 --> 00:01:20,800 +00:01:15,920 --> 00:01:18,800 which confuses the observer and makes you anonymous. 23 -00:01:21,500 --> 00:01:24,980 +00:01:19,500 --> 00:01:22,980 So, the more people use the Tor network, the stronger it gets 24 -00:01:25,140 --> 00:01:29,800 +00:01:23,140 --> 00:01:27,800 as it's easier to hide in a crowd of people who look exactly the same. 25 -00:01:30,700 --> 00:01:33,240 +00:01:28,700 --> 00:01:31,240 You can bypass the censorship without being worried about 26 -00:01:33,400 --> 00:01:36,100 +00:01:31,400 --> 00:01:34,100 the censor knowing what you do on the Internet. 27 -00:01:38,540 --> 00:01:41,440 +00:01:36,540 --> 00:01:39,440 The ads won't follow you everywhere for months, 28 -00:01:41,640 --> 00:01:43,300 +00:01:39,640 --> 00:01:41,300 starting when you first clicked on a product. 29 -00:01:45,880 --> 00:01:49,380 +00:01:43,880 --> 00:01:47,380 By using Tor, the sites you visit won't even know who you are, 30 -00:01:49,540 --> 00:01:51,760 +00:01:47,540 --> 00:01:49,760 from what part of the world you're visiting them, 31 -00:01:51,920 --> 00:01:53,920 +00:01:49,920 --> 00:01:51,920 unless you login and tell them so. 32 -00:01:56,200 --> 00:01:57,840 +00:01:54,200 --> 00:01:55,840 By downloading and using Tor, 33 -00:01:58,200 --> 00:02:00,560 +00:01:56,200 --> 00:01:58,560 you can protect the people who need anonymity, 34 -00:02:00,880 --> 00:02:03,640 +00:01:58,880 --> 00:02:01,640 like activists, journalists and bloggers. 35 -00:02:04,000 --> 00:02:09,000 +00:02:02,000 --> 00:02:07,000 Download and use Tor! Or run a relay!

1 0

[tor-messenger-build/master] Clear the server field if domain is changed
by sukhbir＠torproject.org 01 Jun '15

01 Jun '15

commit eba4fc6a1c4e63491f8a4136f2f19fa043988c77 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Mon Jun 1 14:08:41 2015 -0400 Clear the server field if domain is changed --- projects/instantbird/xmpp-onion-js.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/instantbird/xmpp-onion-js.patch b/projects/instantbird/xmpp-onion-js.patch index e6365fc..03652ee 100644 --- a/projects/instantbird/xmpp-onion-js.patch +++ b/projects/instantbird/xmpp-onion-js.patch @@ -43,7 +43,7 @@ diff --git a/im/content/accountWizard.js b/im/content/accountWizard.js }, + setOnionAddress: function aw_setOnionAddress() { -+ if (this.proto.id == "prpl-jabber" && this.onionAddress) { ++ if (this.proto.id == "prpl-jabber") { + document.getElementById("prpl-jabber-server").value = this.onionAddress; + } + },

1 0

[obfs4/master] Delay transport initialization till after logging has been setup.
by yawning＠torproject.org 01 Jun '15

01 Jun '15

commit 69ffcc39c63f4a9a192082da71eea6b06a1e75d7 Author: Yawning Angel <yawning(a)torproject.org> Date: Mon Jun 1 16:15:35 2015 +0000 Delay transport initialization till after logging has been setup. --- ChangeLog | 2 ++ obfs4proxy/obfs4proxy.go | 4 ++++ transports/transports.go | 11 +++++------ 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index 15de989..774be88 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,6 @@ Changes in version 0.0.6 - UNRELEASED: + - Delay transport factory initialization till after logging has been + initialized. Changes in version 0.0.5 - 2015-04-15: - Go vet/fmt fixes, and misc. code cleanups. Patches by mvdan. diff --git a/obfs4proxy/obfs4proxy.go b/obfs4proxy/obfs4proxy.go index 5f7f171..a817583 100644 --- a/obfs4proxy/obfs4proxy.go +++ b/obfs4proxy/obfs4proxy.go @@ -347,6 +347,10 @@ func main() { if err = log.Init(*enableLogging, path.Join(stateDir, obfs4proxyLogFile), *unsafeLogging); err != nil { golog.Fatalf("[ERROR]: %s - failed to initialize logging", execName) } + if err = transports.Init(); err != nil { + log.Errorf("%s - failed to initialize transports: %s", execName, err) + os.Exit(-1) + } log.Noticef("%s - launched", getVersion()) diff --git a/transports/transports.go b/transports/transports.go index ba4e099..e35673b 100644 --- a/transports/transports.go +++ b/transports/transports.go @@ -41,7 +41,7 @@ import ( ) var transportMapLock sync.Mutex -var transportMap map[string]base.Transport +var transportMap map[string]base.Transport = make(map[string]base.Transport) // Register registers a transport protocol. func Register(transport base.Transport) error { @@ -81,13 +81,12 @@ func Get(name string) base.Transport { return t } -func init() { - // Initialize the transport list. - transportMap = make(map[string]base.Transport) - - // Register all the currently supported transports. +// Init initializes all of the integrated transports. +func Init() error { Register(new(obfs2.Transport)) Register(new(obfs3.Transport)) Register(new(obfs4.Transport)) Register(new(scramblesuit.Transport)) + + return nil }

1 0

[torspec/master] Add a note on master-key-ed25519 to prop220
by nickm＠torproject.org 01 Jun '15

01 Jun '15

commit 0ebd5db019e32229f2f4afed4b4871501cac0084 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 1 11:54:30 2015 -0400 Add a note on master-key-ed25519 to prop220 --- proposals/220-ecc-id-keys.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/proposals/220-ecc-id-keys.txt b/proposals/220-ecc-id-keys.txt index cf11740..793ef90 100644 --- a/proposals/220-ecc-id-keys.txt +++ b/proposals/220-ecc-id-keys.txt @@ -224,6 +224,11 @@ Status: Draft key also signs all three keys as part of signing the descriptor. + When an ed25519 signature is present, there MAY be a "master-key-ed25519" + element containing the base64 encoded ed25519 master key as a single + argument. If it is present, it MUST match the identity key in + the certificate. + 2.5.1. Checking descriptor signatures. Current versions of Tor will handle these new formats by ignoring the

1 0

[tor/master] Add a master-key-ed25519 line for convenience
by nickm＠torproject.org 01 Jun '15

01 Jun '15

commit 3d653dff5e891c1e547ef7eacbc991410a98c1cb Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 1 11:24:55 2015 -0400 Add a master-key-ed25519 line for convenience --- src/or/router.c | 10 +++++++++- src/or/routerparse.c | 29 ++++++++++++++++++++++++++++- src/test/test_dir.c | 12 ++++++++++-- 3 files changed, 47 insertions(+), 4 deletions(-) diff --git a/src/or/router.c b/src/or/router.c index 6868e7b..0903eb2 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -2406,6 +2406,7 @@ router_dump_router_to_string(routerinfo_t *router, if (emit_ed_sigs) { /* Encode ed25519 signing cert */ char ed_cert_base64[256]; + char ed_fp_base64[ED25519_BASE64_LEN+1]; if (base64_encode(ed_cert_base64, sizeof(ed_cert_base64), (const char*)router->signing_key_cert->encoded, router->signing_key_cert->encoded_len, @@ -2413,10 +2414,17 @@ router_dump_router_to_string(routerinfo_t *router, log_err(LD_BUG,"Couldn't base64-encode signing key certificate!"); goto err; } + if (ed25519_public_to_base64(ed_fp_base64, + &router->signing_key_cert->signing_key)<0) { + log_err(LD_BUG,"Couldn't base64-encode identity key\n"); + goto err; + } tor_asprintf(&ed_cert_line, "identity-ed25519\n" "-----BEGIN ED25519 CERT-----\n" "%s" - "-----END ED25519 CERT-----\n", ed_cert_base64); + "-----END ED25519 CERT-----\n" + "master-key-ed25519 %s\n", + ed_cert_base64, ed_fp_base64); } /* PEM-encode the onion key */ diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 1413d40..ae50cda 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -89,6 +89,7 @@ typedef enum { K_IPV6_POLICY, K_ROUTER_SIG_ED25519, K_IDENTITY_ED25519, + K_MASTER_KEY_ED25519, K_ONION_KEY_CROSSCERT, K_NTOR_ONION_KEY_CROSSCERT, @@ -302,6 +303,7 @@ static token_rule_t routerdesc_token_table[] = { T01("extra-info-digest", K_EXTRA_INFO_DIGEST, GE(1), NO_OBJ ), T01("hidden-service-dir", K_HIDDEN_SERVICE_DIR, NO_ARGS, NO_OBJ ), T01("identity-ed25519", K_IDENTITY_ED25519, NO_ARGS, NEED_OBJ ), + T01("master-key-ed25519", K_MASTER_KEY_ED25519, GE(1), NO_OBJ ), T01("router-sig-ed25519", K_ROUTER_SIG_ED25519, GE(1), NO_OBJ ), T01("onion-key-crosscert", K_ONION_KEY_CROSSCERT, NO_ARGS, NEED_OBJ ), T01("ntor-onion-key-crosscert", K_NTOR_ONION_KEY_CROSSCERT, @@ -1337,9 +1339,11 @@ router_parse_entry_from_string(const char *s, const char *end, } { - directory_token_t *ed_sig_tok, *ed_cert_tok, *cc_tap_tok, *cc_ntor_tok; + directory_token_t *ed_sig_tok, *ed_cert_tok, *cc_tap_tok, *cc_ntor_tok, + *master_key_tok; ed_sig_tok = find_opt_by_keyword(tokens, K_ROUTER_SIG_ED25519); ed_cert_tok = find_opt_by_keyword(tokens, K_IDENTITY_ED25519); + master_key_tok = find_opt_by_keyword(tokens, K_MASTER_KEY_ED25519); cc_tap_tok = find_opt_by_keyword(tokens, K_ONION_KEY_CROSSCERT); cc_ntor_tok = find_opt_by_keyword(tokens, K_NTOR_ONION_KEY_CROSSCERT); int n_ed_toks = !!ed_sig_tok + !!ed_cert_tok + @@ -1350,6 +1354,11 @@ router_parse_entry_from_string(const char *s, const char *end, "cross-certification support"); goto err; } + if (master_key_tok && !ed_sig_tok) { + log_warn(LD_DIR, "Router descriptor has ed25519 master key but no " + "certificate"); + goto err; + } if (ed_sig_tok) { tor_assert(ed_cert_tok && cc_tap_tok && cc_ntor_tok); const int ed_cert_token_pos = smartlist_pos(tokens, ed_cert_tok); @@ -1394,12 +1403,30 @@ router_parse_entry_from_string(const char *s, const char *end, goto err; } router->signing_key_cert = cert; /* makes sure it gets freed. */ + if (cert->cert_type != CERT_TYPE_ID_SIGNING || ! cert->signing_key_included) { log_warn(LD_DIR, "Invalid form for ed25519 cert"); goto err; } + if (master_key_tok) { + /* This token is optional, but if it's present, it must match + * the signature in the signing cert, or supplant it. */ + tor_assert(master_key_tok->n_args >= 1); + ed25519_public_key_t pkey; + if (ed25519_public_from_base64(&pkey, master_key_tok->args[0])<0) { + log_warn(LD_DIR, "Can't parse ed25519 master key"); + goto err; + } + + if (fast_memneq(&cert->signing_key.pubkey, + pkey.pubkey, ED25519_PUBKEY_LEN)) { + log_warn(LD_DIR, "Ed25519 master key does not match " + "key in certificate"); + goto err; + } + } ntor_cc_cert = tor_cert_parse((const uint8_t*)cc_ntor_tok->object_body, cc_ntor_tok->object_size); if (!ntor_cc_cert) { diff --git a/src/test/test_dir.c b/src/test/test_dir.c index 32ac8d4..35bd8ea 100644 --- a/src/test/test_dir.c +++ b/src/test/test_dir.c @@ -227,8 +227,16 @@ test_dir_formats(void *arg) "identity-ed25519\n" "-----BEGIN ED25519 CERT-----\n", sizeof(buf2)); strlcat(buf2, cert_buf, sizeof(buf2)); - strlcat(buf2, "-----END ED25519 CERT-----\n" - "platform Tor "VERSION" on ", sizeof(buf2)); + strlcat(buf2, "-----END ED25519 CERT-----\n", sizeof(buf2)); + strlcat(buf2, "master-key-ed25519 ", sizeof(buf2)); + { + char k[ED25519_BASE64_LEN+1]; + tt_assert(ed25519_public_to_base64(k, &r2->signing_key_cert->signing_key) + >= 0); + strlcat(buf2, k, sizeof(buf2)); + strlcat(buf2, "\n", sizeof(buf2)); + } + strlcat(buf2, "platform Tor "VERSION" on ", sizeof(buf2)); strlcat(buf2, get_uname(), sizeof(buf2)); strlcat(buf2, "\n" "protocols Link 1 2 Circuit 1\n"

1 0

[tor/master] More check-spaces fixes
by nickm＠torproject.org 01 Jun '15

01 Jun '15

commit 3028507e96a51f2058e7ce6678ac8f2d8ab1b502 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 1 10:56:54 2015 -0400 More check-spaces fixes --- src/test/test_link_handshake.c | 81 +++++++++++++++++++++++----------------- 1 file changed, 47 insertions(+), 34 deletions(-) diff --git a/src/test/test_link_handshake.c b/src/test/test_link_handshake.c index 0b3900e..7ad2c30 100644 --- a/src/test/test_link_handshake.c +++ b/src/test/test_link_handshake.c @@ -329,7 +329,7 @@ test_link_handshake_recv_certs_ok_server(void *arg) #define CERTS_FAIL(name, code) \ static void \ - test_link_handshake_recv_certs_ ## name (void *arg) \ + test_link_handshake_recv_certs_ ## name(void *arg) \ { \ certs_data_t *d = arg; \ { code ; } \ @@ -349,44 +349,54 @@ CERTS_FAIL(already_authenticated, CERTS_FAIL(empty, d->cell->payload_len = 0) CERTS_FAIL(bad_circid, d->cell->circ_id = 1) CERTS_FAIL(truncated_1, d->cell->payload[0] = 5) -CERTS_FAIL(truncated_2, { - d->cell->payload_len = 4; - memcpy(d->cell->payload, "\x01\x01\x00\x05", 4);}) -CERTS_FAIL(truncated_3, { - d->cell->payload_len = 7; - memcpy(d->cell->payload, "\x01\x01\x00\x05""abc", 7);}) +CERTS_FAIL(truncated_2, + { + d->cell->payload_len = 4; + memcpy(d->cell->payload, "\x01\x01\x00\x05", 4); + }) +CERTS_FAIL(truncated_3, + { + d->cell->payload_len = 7; + memcpy(d->cell->payload, "\x01\x01\x00\x05""abc", 7); + }) #define REENCODE() do { \ ssize_t n = certs_cell_encode(d->cell->payload, 4096, d->ccell); \ tt_int_op(n, >, 0); \ d->cell->payload_len = n; \ } while (0) -CERTS_FAIL(not_x509, { +CERTS_FAIL(not_x509, + { certs_cell_cert_setlen_body(certs_cell_get_certs(d->ccell, 0), 3); certs_cell_get_certs(d->ccell, 0)->cert_len = 3; REENCODE(); - }) -CERTS_FAIL(both_link, { + }) +CERTS_FAIL(both_link, + { certs_cell_get_certs(d->ccell, 0)->cert_type = 1; certs_cell_get_certs(d->ccell, 1)->cert_type = 1; REENCODE(); - }) -CERTS_FAIL(both_id_rsa, { + }) +CERTS_FAIL(both_id_rsa, + { certs_cell_get_certs(d->ccell, 0)->cert_type = 2; certs_cell_get_certs(d->ccell, 1)->cert_type = 2; REENCODE(); - }) -CERTS_FAIL(both_auth, { + }) +CERTS_FAIL(both_auth, + { certs_cell_get_certs(d->ccell, 0)->cert_type = 3; certs_cell_get_certs(d->ccell, 1)->cert_type = 3; REENCODE(); - }) -CERTS_FAIL(wrong_labels_1, { + }) +CERTS_FAIL(wrong_labels_1, + { certs_cell_get_certs(d->ccell, 0)->cert_type = 2; certs_cell_get_certs(d->ccell, 1)->cert_type = 1; REENCODE(); - }) -CERTS_FAIL(wrong_labels_2, { + }) +CERTS_FAIL(wrong_labels_2, + { const tor_x509_cert_t *a; const tor_x509_cert_t *b; const uint8_t *enca; @@ -399,20 +409,23 @@ CERTS_FAIL(wrong_labels_2, { certs_cell_get_certs(d->ccell, 1)->cert_len = lena; REENCODE(); }) -CERTS_FAIL(wrong_labels_3, { - certs_cell_get_certs(d->ccell, 0)->cert_type = 2; - certs_cell_get_certs(d->ccell, 1)->cert_type = 3; - REENCODE(); - }) -CERTS_FAIL(server_missing_certs, { - d->c->handshake_state->started_here = 0; - }) -CERTS_FAIL(server_wrong_labels_1, { - d->c->handshake_state->started_here = 0; - certs_cell_get_certs(d->ccell, 0)->cert_type = 2; - certs_cell_get_certs(d->ccell, 1)->cert_type = 3; - REENCODE(); - }) +CERTS_FAIL(wrong_labels_3, + { + certs_cell_get_certs(d->ccell, 0)->cert_type = 2; + certs_cell_get_certs(d->ccell, 1)->cert_type = 3; + REENCODE(); + }) +CERTS_FAIL(server_missing_certs, + { + d->c->handshake_state->started_here = 0; + }) +CERTS_FAIL(server_wrong_labels_1, + { + d->c->handshake_state->started_here = 0; + certs_cell_get_certs(d->ccell, 0)->cert_type = 2; + certs_cell_get_certs(d->ccell, 1)->cert_type = 3; + REENCODE(); + }) static void test_link_handshake_send_authchallenge(void *arg) @@ -563,7 +576,7 @@ test_link_handshake_recv_authchallenge_ok_unrecognized(void *arg) #define AUTHCHALLENGE_FAIL(name, code) \ static void \ - test_link_handshake_recv_authchallenge_ ## name (void *arg) \ + test_link_handshake_recv_authchallenge_ ## name(void *arg) \ { \ authchallenge_data_t *d = arg; \ { code ; } \ @@ -782,7 +795,7 @@ test_link_handshake_auth_cell(void *arg) #define AUTHENTICATE_FAIL(name, code) \ static void \ - test_link_handshake_auth_ ## name (void *arg) \ + test_link_handshake_auth_ ## name(void *arg) \ { \ authenticate_data_t *d = arg; \ { code ; } \

1 0

[tor/master] Fix a memory leak in routerkeys.c
by nickm＠torproject.org 01 Jun '15

01 Jun '15

commit fcc01d7cafef86dd3ef449e474b0ff7ca45cac85 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 1 10:45:51 2015 -0400 Fix a memory leak in routerkeys.c --- src/or/routerkeys.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/or/routerkeys.c b/src/or/routerkeys.c index 8b1ade5..b17d195 100644 --- a/src/or/routerkeys.c +++ b/src/or/routerkeys.c @@ -134,6 +134,7 @@ ed_key_init_from_file(const char *fname, uint32_t flags, goto done; /* Read a cert. */ + tor_free(got_tag); uint8_t certbuf[256]; ssize_t cert_body_len = crypto_read_tagged_contents_from_file( cert_fname, "ed25519v1-cert",

1 0

[tor/master] Fix some memory leaks in ed25519 code and tests
by nickm＠torproject.org 01 Jun '15

01 Jun '15

commit d31877c6bf68c942b6c66bc7a59781d75a3dc3b5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 1 10:26:11 2015 -0400 Fix some memory leaks in ed25519 code and tests --- src/or/dircollate.c | 1 + src/test/test_dir.c | 12 +++++++----- src/test/test_microdesc.c | 1 + 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/src/or/dircollate.c b/src/or/dircollate.c index 34259ec..331e058 100644 --- a/src/or/dircollate.c +++ b/src/or/dircollate.c @@ -125,6 +125,7 @@ dircollator_free(dircollator_t *dc) digestmap_free(dc->by_collated_rsa_sha1, NULL); digestmap_free(dc->by_rsa_sha1, tor_free_); + smartlist_free(dc->all_rsa_sha1_lst); ddmap_entry_t **e, **next, *this; for (e = HT_START(double_digest_map, &dc->by_both_ids); diff --git a/src/test/test_dir.c b/src/test/test_dir.c index 3e9e955..32ac8d4 100644 --- a/src/test/test_dir.c +++ b/src/test/test_dir.c @@ -91,7 +91,6 @@ test_dir_formats(void *arg) addr_policy_t *ex1, *ex2; routerlist_t *dir1 = NULL, *dir2 = NULL; uint8_t *rsa_cc = NULL; - tor_cert_t *ntor_cc = NULL; or_options_t *options = get_options_mutable(); const addr_policy_t *p; time_t now = time(NULL); @@ -155,7 +154,6 @@ test_dir_formats(void *arg) r2->or_port = 9005; r2->dir_port = 0; r2->onion_pkey = crypto_pk_dup_key(pk2); - r2->onion_curve25519_pkey = tor_malloc_zero(sizeof(curve25519_public_key_t)); curve25519_keypair_t r2_onion_keypair; curve25519_keypair_generate(&r2_onion_keypair, 0); r2->onion_curve25519_pkey = tor_memdup(&r2_onion_keypair.pubkey, @@ -257,15 +255,19 @@ test_dir_formats(void *arg) strlcat(buf2, cert_buf, sizeof(buf2)); strlcat(buf2, "-----END CROSSCERT-----\n", sizeof(buf2)); int ntor_cc_sign; - ntor_cc = make_ntor_onion_key_crosscert(&r2_onion_keypair, + { + tor_cert_t *ntor_cc = NULL; + ntor_cc = make_ntor_onion_key_crosscert(&r2_onion_keypair, &kp1.pubkey, r2->cache_info.published_on, MIN_ONION_KEY_LIFETIME, &ntor_cc_sign); - tt_assert(ntor_cc); - base64_encode(cert_buf, sizeof(cert_buf), + tt_assert(ntor_cc); + base64_encode(cert_buf, sizeof(cert_buf), (char*)ntor_cc->encoded, ntor_cc->encoded_len, BASE64_ENCODE_MULTILINE); + tor_cert_free(ntor_cc); + } tor_snprintf(buf2+strlen(buf2), sizeof(buf2)-strlen(buf2), "ntor-onion-key-crosscert %d\n" "-----BEGIN ED25519 CERT-----\n" diff --git a/src/test/test_microdesc.c b/src/test/test_microdesc.c index 3c22e18..5dc5b2b 100644 --- a/src/test/test_microdesc.c +++ b/src/test/test_microdesc.c @@ -470,6 +470,7 @@ test_md_generate(void *arg) md = dirvote_create_microdescriptor(ri, 21); tt_str_op(md->body, ==, test_md_18); + routerinfo_free(ri); ri = router_parse_entry_from_string(test_ri2, NULL, 0, 0, NULL, NULL); microdesc_free(md);

1 0

[tor/master] Appease make check-spaces
by andrea＠torproject.org 01 Jun '15

01 Jun '15

commit 0e0b65db4f0f0c67bcbb3f51a9e6061bc4c96c5e Author: Andrea Shepard <andrea(a)torproject.org> Date: Mon Jun 1 12:59:14 2015 +0000 Appease make check-spaces --- src/common/aes.c | 1 + src/common/crypto_ed25519.h | 1 - src/common/tortls.c | 3 ++- src/or/channeltls.c | 2 +- src/or/control.c | 2 +- src/or/dircollate.c | 6 ++++-- src/or/dircollate.h | 1 + src/or/or.h | 1 - src/or/rendservice.c | 3 ++- src/or/routerkeys.c | 9 ++++++--- src/or/routerlist.c | 3 ++- src/or/routerparse.c | 6 ++++-- src/or/torcert.c | 1 + src/test/test_buffers.c | 1 - src/test/test_hs.c | 5 +++-- src/test/test_link_handshake.c | 3 +-- 16 files changed, 29 insertions(+), 19 deletions(-) diff --git a/src/common/aes.c b/src/common/aes.c index dbc12dc..8b9d81f 100644 --- a/src/common/aes.c +++ b/src/common/aes.c @@ -501,3 +501,4 @@ aes_set_iv(aes_cnt_cipher_t *cipher, const char *iv) } #endif + diff --git a/src/common/crypto_ed25519.h b/src/common/crypto_ed25519.h index 8ffb9f2..4d20406 100644 --- a/src/common/crypto_ed25519.h +++ b/src/common/crypto_ed25519.h @@ -88,7 +88,6 @@ int ed25519_public_blind(ed25519_public_key_t *out, const ed25519_public_key_t *inp, const uint8_t *param); - /* XXXX move these to crypto_format.h */ #define ED25519_BASE64_LEN 43 int ed25519_public_from_base64(ed25519_public_key_t *pkey, diff --git a/src/common/tortls.c b/src/common/tortls.c index 098df9d..a4b6c48 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1810,7 +1810,8 @@ rectify_client_ciphers(SSL *ssl) SSL_CIPHER_get_name(cipher)); ++j; } else if (cipher && - (SSL_CIPHER_get_id(cipher) & 0xffff) == CLIENT_CIPHER_INFO_LIST[i].id) { + (SSL_CIPHER_get_id(cipher) & 0xffff) == + CLIENT_CIPHER_INFO_LIST[i].id) { /* "cipher" is the cipher we expect. Put it on the list. */ log_debug(LD_NET, "Found cipher %s", SSL_CIPHER_get_name(cipher)); sk_SSL_CIPHER_push(CLIENT_CIPHER_STACK, cipher); diff --git a/src/or/channeltls.c b/src/or/channeltls.c index ecf0218..c90f569 100644 --- a/src/or/channeltls.c +++ b/src/or/channeltls.c @@ -2004,7 +2004,7 @@ channel_tls_process_auth_challenge_cell(var_cell_t *cell, channel_tls_t *chan) goto done; } -done: + done: auth_challenge_cell_free(ac); #undef ERR diff --git a/src/or/control.c b/src/or/control.c index 746dfff..2eaad4e 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -6029,7 +6029,7 @@ get_desc_id_from_query(const rend_data_t *rend_data, const char *hsdir_fp) } SMARTLIST_FOREACH_END(fingerprint); } -end: + end: return desc_id; } diff --git a/src/or/dircollate.c b/src/or/dircollate.c index 20dfb35..34259ec 100644 --- a/src/or/dircollate.c +++ b/src/or/dircollate.c @@ -59,8 +59,10 @@ ddmap_entry_set_digests(ddmap_entry_t *ent, memcpy(ent->d + DIGEST_LEN, ed25519, DIGEST256_LEN); } -HT_PROTOTYPE(double_digest_map, ddmap_entry_s, node, ddmap_entry_hash, ddmap_entry_eq); -HT_GENERATE2(double_digest_map, ddmap_entry_s, node, ddmap_entry_hash, ddmap_entry_eq, 0.6, tor_reallocarray, tor_free_); +HT_PROTOTYPE(double_digest_map, ddmap_entry_s, node, ddmap_entry_hash, + ddmap_entry_eq); +HT_GENERATE2(double_digest_map, ddmap_entry_s, node, ddmap_entry_hash, + ddmap_entry_eq, 0.6, tor_reallocarray, tor_free_); static void dircollator_add_routerstatus(dircollator_t *dc, int vote_num, diff --git a/src/or/dircollate.h b/src/or/dircollate.h index 9eba37a..cd1e8ac 100644 --- a/src/or/dircollate.h +++ b/src/or/dircollate.h @@ -47,3 +47,4 @@ struct dircollator_s { #endif #endif + diff --git a/src/or/or.h b/src/or/or.h index 81e1c1c..ec5f277 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4281,7 +4281,6 @@ typedef struct { * XXXX Eventually, the default will be 0. */ int ExitRelay; - /** For how long (seconds) do we declare our singning keys to be valid? */ int SigningKeyLifetime; /** For how long (seconds) do we declare our link keys to be valid? */ diff --git a/src/or/rendservice.c b/src/or/rendservice.c index d27b06d..c857d4c 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -581,7 +581,8 @@ rend_config_services(const or_options_t *options, int validate_only) 10, 0, 1, &ok, NULL); if (!ok) { log_warn(LD_CONFIG, - "HiddenServiceMaxStreamsCloseCircuit should be 0 or 1, not %s", + "HiddenServiceMaxStreamsCloseCircuit should be 0 or 1, " + "not %s", line->value); rend_service_free(service); return -1; diff --git a/src/or/routerkeys.c b/src/or/routerkeys.c index a76bf99..8b1ade5 100644 --- a/src/or/routerkeys.c +++ b/src/or/routerkeys.c @@ -312,7 +312,8 @@ load_ed_keys(const or_options_t *options, time_t now) check_signing_cert = signing_key_cert; use_signing = master_signing_key; } else { - char *fname = options_get_datadir_fname2(options, "keys", "ed25519_signing"); + char *fname = + options_get_datadir_fname2(options, "keys", "ed25519_signing"); sign = ed_key_init_from_file( fname, INIT_ED_KEY_NEEDCERT| @@ -340,7 +341,8 @@ load_ed_keys(const or_options_t *options, time_t now) if (! want_new_signing_key) flags |= INIT_ED_KEY_OMIT_SECRET; - char *fname = options_get_datadir_fname2(options, "keys", "ed25519_master_id"); + char *fname = + options_get_datadir_fname2(options, "keys", "ed25519_master_id"); id = ed_key_init_from_file( fname, flags, @@ -363,7 +365,8 @@ load_ed_keys(const or_options_t *options, time_t now) INIT_ED_KEY_EXTRA_STRONG| INIT_ED_KEY_NEEDCERT| INIT_ED_KEY_INCLUDE_SIGNING_KEY_IN_CERT); - char *fname = options_get_datadir_fname2(options, "keys", "ed25519_signing"); + char *fname = + options_get_datadir_fname2(options, "keys", "ed25519_signing"); sign = ed_key_init_from_file(fname, flags, LOG_WARN, sign_signing_key_with_id, now, diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 7eba13a..3502196 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -4921,7 +4921,8 @@ routerinfo_incompatible_with_extrainfo(const routerinfo_t *ri, * digest256 was in the ri. */ digest256_matches = tor_memeq(ei->digest256, ri->extra_info_digest256, DIGEST256_LEN); - digest256_matches |= tor_mem_is_zero(ri->extra_info_digest256, DIGEST256_LEN); + digest256_matches |= + tor_mem_is_zero(ri->extra_info_digest256, DIGEST256_LEN); /* The identity must match exactly to have been generated at the same time * by the same router. */ diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 1835bf8..1413d40 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -2352,7 +2352,8 @@ routerstatus_parse_entry_from_string(memarea_t *area, if (!strcmp(t->args[0], "ed25519")) { vote_rs->has_ed25519_listing = 1; if (strcmp(t->args[1], "none") && - digest256_from_base64((char*)vote_rs->ed25519_id, t->args[1])<0) { + digest256_from_base64((char*)vote_rs->ed25519_id, + t->args[1])<0) { log_warn(LD_DIR, "Bogus ed25519 key in networkstatus vote"); goto err; } @@ -3184,7 +3185,8 @@ networkstatus_parse_vote_from_string(const char *s, const char **eos_out, } if (ns_type != NS_TYPE_CONSENSUS) { digest256map_t *ed_id_map = digest256map_new(); - SMARTLIST_FOREACH_BEGIN(ns->routerstatus_list, vote_routerstatus_t *, vrs) { + SMARTLIST_FOREACH_BEGIN(ns->routerstatus_list, vote_routerstatus_t *, + vrs) { if (! vrs->has_ed25519_listing || tor_mem_is_zero((const char *)vrs->ed25519_id, DIGEST256_LEN)) continue; diff --git a/src/or/torcert.c b/src/or/torcert.c index 838501e..f028910 100644 --- a/src/or/torcert.c +++ b/src/or/torcert.c @@ -282,3 +282,4 @@ tor_make_rsa_ed25519_crosscert(const ed25519_public_key_t *ed_key, *cert = res; return sz; } + diff --git a/src/test/test_buffers.c b/src/test/test_buffers.c index 22ee6aa..e8fce12 100644 --- a/src/test/test_buffers.c +++ b/src/test/test_buffers.c @@ -744,7 +744,6 @@ test_buffers_tls_read_mocked(void *arg) next_reply_val[1] = 5000; tt_int_op(6000, ==, read_to_buf_tls(NULL, 6000, buf)); - done: UNMOCK(tor_tls_read); tor_free(mem); diff --git a/src/test/test_hs.c b/src/test/test_hs.c index fc265bc..6d01798 100644 --- a/src/test/test_hs.c +++ b/src/test/test_hs.c @@ -210,8 +210,9 @@ test_hs_desc_event(void *arg) /* test valid content. */ char *exp_msg; - control_event_hs_descriptor_content(rend_query.onion_address, STR_HS_CONTENT_DESC_ID, - HSDIR_EXIST_ID, hs_desc_content); + control_event_hs_descriptor_content(rend_query.onion_address, + STR_HS_CONTENT_DESC_ID, HSDIR_EXIST_ID, + hs_desc_content); tor_asprintf(&exp_msg, "650+HS_DESC_CONTENT " STR_HS_ADDR " "\ STR_HS_CONTENT_DESC_ID " " STR_HSDIR_EXIST_LONGNAME\ "\r\n%s\r\n.\r\n650 OK\r\n", hs_desc_content); diff --git a/src/test/test_link_handshake.c b/src/test/test_link_handshake.c index b3b6531..0b3900e 100644 --- a/src/test/test_link_handshake.c +++ b/src/test/test_link_handshake.c @@ -197,7 +197,6 @@ typedef struct certs_data_s { crypto_pk_t *key1, *key2; } certs_data_t; - static int recv_certs_cleanup(const struct testcase_t *test, void *obj) { @@ -593,7 +592,6 @@ AUTHCHALLENGE_FAIL(truncated, AUTHCHALLENGE_FAIL(nonzero_circid, d->cell->circ_id = 1337) - static tor_x509_cert_t *mock_peer_cert = NULL; static tor_x509_cert_t * mock_get_peer_cert(tor_tls_t *tls) @@ -914,3 +912,4 @@ struct testcase_t link_handshake_tests[] = { END_OF_TESTCASES }; +

1 0