December 2016 - tor-commits - lists.torproject.org

[tor/maint-0.2.8] Merge branch 'maint-0.2.7' into maint-0.2.8
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit 7f55aaf281473089355c855c2632b2d1a9467ebb Merge: f62c74c a9c8a5f Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 20 18:15:26 2016 -0500 Merge branch 'maint-0.2.7' into maint-0.2.8

1 0

[tor/maint-0.2.9] Merge branch 'maint-0.2.8' into maint-0.2.9
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit a9bfa997aeb33babc7bbcb314891122b07e6dbfa Merge: 897d3c6 7f55aaf Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 20 18:15:56 2016 -0500 Merge branch 'maint-0.2.8' into maint-0.2.9

1 0

[tor/release-0.2.5] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit db58d4d16ff156b8827198b2732646c73eb59f14 Merge: 3d2d3f2 0fb3058 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 20 18:11:08 2016 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/bug21018 | 11 +++++++++++ src/or/rendcommon.c | 6 ++++-- src/or/routerparse.c | 6 +++--- 3 files changed, 18 insertions(+), 5 deletions(-) diff --cc src/or/rendcommon.c index bd701b2,296df55..9637d4d --- a/src/or/rendcommon.c +++ b/src/or/rendcommon.c @@@ -1113,8 -1327,11 +1113,10 @@@ rend_cache_store_v2_desc_as_client(cons intro_size); if (n_intro_points <= 0) { log_warn(LD_REND, "Failed to parse introduction points. Either the " - "service has published a corrupt descriptor or you have " - "provided invalid authorization data."); + "service has published a corrupt descriptor, or you have " + "provided invalid authorization data, or (maybe!) the " + "server is deliberately serving broken data in an attempt " + "to crash you with bug 21018."); - retval = -2; goto err; } else if (n_intro_points > MAX_INTRO_POINTS) { log_warn(LD_REND, "Found too many introduction points on a hidden "

1 0

[tor/release-0.2.6] Fix parsing bug with unecognized token at EOS
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit d978216dea6b21ac38230a59d172139185a68dbd Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Dec 18 20:13:58 2016 -0500 Fix parsing bug with unecognized token at EOS In get_token(), we could read one byte past the end of the region. This is only a big problem in the case where the region itself is (a) potentially hostile, and (b) not explicitly nul-terminated. This patch fixes the underlying bug, and also makes sure that the one remaining case of not-NUL-terminated potentially hostile data gets NUL-terminated. Fix for bug 21018, TROVE-2016-12-002, and CVE-2016-1254 --- changes/bug21018 | 11 +++++++++++ src/or/routerparse.c | 6 +++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/changes/bug21018 b/changes/bug21018 new file mode 100644 index 0000000..49a8b47 --- /dev/null +++ b/changes/bug21018 @@ -0,0 +1,11 @@ + o Major bugfixes (parsing, security): + + - Fix a bug in parsing that could cause clients to read a single + byte past the end of an allocated region. This bug could be + used to cause hardened clients (built with + --enable-expensive-hardening) to crash if they tried to visit + a hostile hidden service. Non-hardened clients are only + affected depending on the details of their platform's memory + allocator. Fixes bug 21018; bugfix on 0.2.0.8-alpha. Found by + using libFuzzer. Also tracked as TROVE-2016-12-002 and as + CVE-2016-1254. diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 176c16f..71373ce 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -3857,7 +3857,7 @@ get_next_token(memarea_t *area, if (tok->tp == ERR_) { /* No keyword matched; call it an "K_opt" or "A_unrecognized" */ - if (**s == '@') + if (*s < eol && **s == '@') tok->tp = A_UNKNOWN_; else tok->tp = K_OPT; @@ -4863,7 +4863,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, crypto_cipher_free(cipher); len = ipos_encrypted_size - 2 - client_entries_len - CIPHER_IV_LEN; - dec = tor_malloc(len); + dec = tor_malloc_zero(len + 1); declen = crypto_cipher_decrypt_with_iv(session_key, dec, len, ipos_encrypted + 2 + client_entries_len, ipos_encrypted_size - 2 - client_entries_len); @@ -4895,7 +4895,7 @@ rend_decrypt_introduction_points(char **ipos_decrypted, "small."); return -1; } - dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1); + dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1 + 1); declen = crypto_cipher_decrypt_with_iv(descriptor_cookie, dec, ipos_encrypted_size -

1 0

[tor/release-0.2.6] Make log message warn about detected attempts to exploit 21018.
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit 0fb3058eced5dce355d777288bd9ec255b875db4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Dec 18 20:17:28 2016 -0500 Make log message warn about detected attempts to exploit 21018. --- src/or/rendcommon.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/or/rendcommon.c b/src/or/rendcommon.c index d1f8b1a..296df55 100644 --- a/src/or/rendcommon.c +++ b/src/or/rendcommon.c @@ -1327,8 +1327,10 @@ rend_cache_store_v2_desc_as_client(const char *desc, intro_size); if (n_intro_points <= 0) { log_warn(LD_REND, "Failed to parse introduction points. Either the " - "service has published a corrupt descriptor or you have " - "provided invalid authorization data."); + "service has published a corrupt descriptor, or you have " + "provided invalid authorization data, or (maybe!) the " + "server is deliberately serving broken data in an attempt " + "to crash you with bug 21018."); retval = -2; goto err; } else if (n_intro_points > MAX_INTRO_POINTS) {

1 0

[tor/release-0.2.6] Merge branch 'maint-0.2.6' into release-0.2.6
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit 4dc5475e3d7d0877905fb87d48fab5003d9d5568 Merge: 0b571cf b18bde2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 20 18:11:39 2016 -0500 Merge branch 'maint-0.2.6' into release-0.2.6 changes/bug21018 | 11 +++++++++++ src/or/rendcommon.c | 6 ++++-- src/or/routerparse.c | 6 +++--- 3 files changed, 18 insertions(+), 5 deletions(-)

1 0

[tor/release-0.2.5] Merge branch 'maint-0.2.5' into release-0.2.5
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit 056978c31c8b2c42e2a7352cbf4b9da31185ca65 Merge: 5322713 db58d4d Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 20 18:11:16 2016 -0500 Merge branch 'maint-0.2.5' into release-0.2.5 changes/bug21018 | 11 +++++++++++ src/or/rendcommon.c | 6 ++++-- src/or/routerparse.c | 6 +++--- 3 files changed, 18 insertions(+), 5 deletions(-)

1 0

[tor/release-0.2.6] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit db58d4d16ff156b8827198b2732646c73eb59f14 Merge: 3d2d3f2 0fb3058 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 20 18:11:08 2016 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/bug21018 | 11 +++++++++++ src/or/rendcommon.c | 6 ++++-- src/or/routerparse.c | 6 +++--- 3 files changed, 18 insertions(+), 5 deletions(-) diff --cc src/or/rendcommon.c index bd701b2,296df55..9637d4d --- a/src/or/rendcommon.c +++ b/src/or/rendcommon.c @@@ -1113,8 -1327,11 +1113,10 @@@ rend_cache_store_v2_desc_as_client(cons intro_size); if (n_intro_points <= 0) { log_warn(LD_REND, "Failed to parse introduction points. Either the " - "service has published a corrupt descriptor or you have " - "provided invalid authorization data."); + "service has published a corrupt descriptor, or you have " + "provided invalid authorization data, or (maybe!) the " + "server is deliberately serving broken data in an attempt " + "to crash you with bug 21018."); - retval = -2; goto err; } else if (n_intro_points > MAX_INTRO_POINTS) { log_warn(LD_REND, "Found too many introduction points on a hidden "

1 0

[tor/release-0.2.6] Merge branch 'maint-0.2.5' into maint-0.2.6
by nickm＠torproject.org 20 Dec '16

20 Dec '16

commit b18bde23cf9c0afc95a83c3bfc7205218add4ddd Merge: 3d9f8ff db58d4d Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 20 18:11:25 2016 -0500 Merge branch 'maint-0.2.5' into maint-0.2.6 changes/bug21018 | 11 +++++++++++ src/or/rendcommon.c | 6 ++++-- src/or/routerparse.c | 6 +++--- 3 files changed, 18 insertions(+), 5 deletions(-)

1 0

[translation/tor-browser-manual] Update translations for tor-browser-manual
by translation＠torproject.org 20 Dec '16

20 Dec '16

commit a3b2af988266d21e298328a5020d4b7b0783d7ab Author: Translation commit bot <translation(a)torproject.org> Date: Tue Dec 20 22:18:26 2016 +0000 Update translations for tor-browser-manual --- pl/pl.po | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/pl/pl.po b/pl/pl.po index 0d30080..ad180b4 100644 --- a/pl/pl.po +++ b/pl/pl.po @@ -8,12 +8,13 @@ # Stanislaw Krukowski <pst3qga(a)tormail.org>, 2016 # Michał <marszczybrew1(a)gmail.com>, 2016 # Maks Skica <maks1823(a)gmail.com>, 2016 +# Michal Lisewski <miclis(a)o2.pl>, 2016 msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "POT-Creation-Date: 2016-12-06 16:36-0600\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: Maks Skica <maks1823(a)gmail.com>, 2016\n" +"Last-Translator: Michal Lisewski <miclis(a)o2.pl>, 2016\n" "Language-Team: Polish (https://www.transifex.com/otf/teams/1519/pl/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -50,6 +51,9 @@ msgid "" " will not be able to track your internet activity, including the names and " "addresses of the websites you visit." msgstr "" +"Twój dostawca internetu, jak i również jakakolwiek osoba obserwująca Twój " +"ruch sieciowy nie będzie w stanie wyśledzić Twojej aktywności w internecie, " +"nie będą wiedzieć jakie strony i adresy internetowe odwiedzasz." #: about-tor-browser.page:25 msgid "" @@ -58,12 +62,19 @@ msgid "" "real Internet (IP) address, and will not know who you are unless you " "explicitly identify yourself." msgstr "" +"Operatorzy stron i usług internetowych, z których używasz, jak i również " +"osoby je obserwujące będą widzieć połączenie pochodzące z sieci Tor zamiast " +"Twojego prawdziwego adresu internetowego (IP) i nie będą wiedzieć kim " +"jesteś, o ile sam nie zechcesz się zidentyfikować." #: about-tor-browser.page:34 msgid "" "In addition, Tor Browser is designed to prevent websites from " "“fingerprinting” or identifying you based on your browser configuration." msgstr "" +"Dodatkowo, Tor Browser został zaprojektowany tak by udaremnić witrynom " +"zidentyfikowanie Ciebie poprzez pobranie „odcisku palca” czy też wgląd w " +"konfigurację przeglądarki." #: about-tor-browser.page:39 msgid "" @@ -71,6 +82,10 @@ msgid "" " valid for a single session (until Tor Browser is exited or a <link xref" "=\"managing-identities#new-identity\">New Identity</link> is requested)." msgstr "" +"Domyślnie, Tor Browser nie zapisuje historii przeglądania. Ciasteczka są " +"ważne tylko przez jedną sesję (dopóki Tor Browser nie zostanie zamknięty lub" +" dopóki nie klikniesz na <link xref=\"managing-identities#new-" +"identity\">Nowa Tożsamość</link>)." #: about-tor-browser.page:50 msgid "How Tor works"

1 0