February 2016 - tor-commits - lists.torproject.org

[gettor/master] Better name for OS
by ilv＠torproject.org 16 Feb '16

16 Feb '16

commit 6f7b7b33317076d176531b6918390cf2b8c2c928 Author: ilv <ilv(a)users.noreply.github.com> Date: Tue Feb 16 17:26:47 2016 -0300 Better name for OS --- gettor/smtp.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gettor/smtp.py b/gettor/smtp.py index 1cc8db3..32b43ae 100644 --- a/gettor/smtp.py +++ b/gettor/smtp.py @@ -374,7 +374,7 @@ class SMTP(object): try: links_subject = self._get_msg('links_subject', 'en') links_msg = self._get_msg('links_msg', 'en') - links_msg = links_msg % (os, links) + links_msg = links_msg % (OS[os], links) self._send_email( from_addr,

1 0

[gettor/master] Updated messages sent by twitter/xmpp bots according to #17424
by ilv＠torproject.org 16 Feb '16

16 Feb '16

commit b8a1100afa66edb8b76e6a164524978239b16448 Author: ilv <ilv(a)users.noreply.github.com> Date: Tue Feb 16 17:29:16 2016 -0300 Updated messages sent by twitter/xmpp bots according to #17424 --- lang/twitter/i18n/en/LC_MESSAGES/en.po | 55 ++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/lang/twitter/i18n/en/LC_MESSAGES/en.po b/lang/twitter/i18n/en/LC_MESSAGES/en.po new file mode 100644 index 0000000..46c2738 --- /dev/null +++ b/lang/twitter/i18n/en/LC_MESSAGES/en.po @@ -0,0 +1,55 @@ +domain "en" + +#: Links +msgid "links" +msgstr "You requested Tor Browser for %s.\n\ +\n\ +You will need only one of the links below to download the bundle. If a link\n\ +does not work for you, try the next one.\n\ +\n\ +%s" + +#: Mirrors message +msgid "mirrors" +msgstr "Hi! this is the GetTor robot.\n\ +\n\ +Thank you for your request. Below you will find an updated list of\n\ +mirrors of Tor Project's website.\n\ +\n\ +%s" + +#: Help +msgid "help" +msgstr "Hi! This is the GetTor robot. I am here to help you download the\n\ +latest version of Tor Browser.\n\ +\n\ +Please reply to this message with one of the options below:\n\ +\n\ + windows\n\ + linux\n\ + osx\n\ + mirrors\n\ +\n\ +I will then send you the download instructions." + +#: Mirrors unavailable message +msgid "mirrors_unavailable" +msgstr "Hello there! this is the 'GetTor' robot.\n\ +\n\ +I'm sorry, I can't send you mirrors right now, please try again later.\n\ +\n\ +Still need help? If you have any questions, trouble connecting to Tor\n\ +network, or need to talk to a human, please contact our support team at:\n\ +\n\ + help(a)rt.torproject.org\n\ +\n\ +We are ready to answer your queries in English, Farsi, Chinese, Arabic,\n\ +French and Spanish." + +#: Internal error +msgid "internal_error" +msgstr "Internal error" + +#: Internal error +msgid "message_error" +msgstr "Message too long."

1 0

[gettor/master] Use Tor Browser instead of Tor Browser Bundle
by ilv＠torproject.org 16 Feb '16

16 Feb '16

commit 5eaa85908dc5498ea8818b7e7632d9f2030ba479 Author: ilv <ilv(a)users.noreply.github.com> Date: Tue Feb 16 02:13:41 2016 -0300 Use Tor Browser instead of Tor Browser Bundle --- upload/bundles2github.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/upload/bundles2github.py b/upload/bundles2github.py index 2e3c888..ee157f0 100644 --- a/upload/bundles2github.py +++ b/upload/bundles2github.py @@ -40,7 +40,7 @@ def upload_new_release(github_repo, version, upload_dir): release = target_repo.create_release( 'v{}'.format(version), target_commitish="master", - name='Tor Browser Bundle {}'.format(version), + name='Tor Browser {}'.format(version), body='', draft=True, )

1 0

[tor/master] Fix a NULL dereference on unit test failure. CID 1353177.
by nickm＠torproject.org 16 Feb '16

16 Feb '16

commit 31c96a36994470cd63c5a71cdbd0e3acea987228 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 16 12:55:41 2016 -0500 Fix a NULL dereference on unit test failure. CID 1353177. --- src/test/test_routerlist.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/test/test_routerlist.c b/src/test/test_routerlist.c index fdbd5ab..eaf8a55 100644 --- a/src/test/test_routerlist.c +++ b/src/test/test_routerlist.c @@ -434,8 +434,10 @@ test_routerlist_router_is_already_dir_fetching(void *arg) done: /* If a connection is never set up, connection_free chokes on it. */ - buf_free(mocked_connection->inbuf); - buf_free(mocked_connection->outbuf); + if (mocked_connection) { + buf_free(mocked_connection->inbuf); + buf_free(mocked_connection->outbuf); + } tor_free(mocked_connection); UNMOCK(connection_get_by_type_addr_port_purpose); }

1 0

[tor/master] Set or_ap/dir_ap.port on the invalid addr case. Bug in no released Tor. CID 1353178 and 1353179.
by nickm＠torproject.org 16 Feb '16

16 Feb '16

commit 549493846782efa7d6655317844782b6acade1b2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 16 12:58:02 2016 -0500 Set or_ap/dir_ap.port on the invalid addr case. Bug in no released Tor. CID 1353178 and 1353179. --- src/or/directory.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/or/directory.c b/src/or/directory.c index fc610d0..ecf6da8 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -1004,7 +1004,7 @@ directory_initiate_command(const tor_addr_t *or_addr, uint16_t or_port, } else { /* the family doesn't matter here, so make it IPv4 */ tor_addr_make_null(&or_ap.addr, AF_INET); - or_port = 0; + or_ap.port = or_port = 0; } if (tor_addr_port_is_valid(dir_addr, dir_port, 0)) { @@ -1013,7 +1013,7 @@ directory_initiate_command(const tor_addr_t *or_addr, uint16_t or_port, } else { /* the family doesn't matter here, so make it IPv4 */ tor_addr_make_null(&dir_ap.addr, AF_INET); - dir_port = 0; + dir_ap.port = dir_port = 0; } directory_initiate_command_rend(&or_ap, &dir_ap,

1 0

[tor/master] src/common/compat.c:tor_vasprintf() - vsnprintf() was properly checked but tor_vsnprintf() available so why not use it?
by nickm＠torproject.org 16 Feb '16

16 Feb '16

commit b3639c8291098eeeefb166914bad98a53e506b90 Author: Jeremy <jeremy(a)sturgix.com> Date: Tue Dec 1 13:00:58 2015 -0500 src/common/compat.c:tor_vasprintf() - vsnprintf() was properly checked but tor_vsnprintf() available so why not use it? --- src/common/compat.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/common/compat.c b/src/common/compat.c index 6f35753..e8b0897 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -573,7 +573,9 @@ tor_vasprintf(char **strp, const char *fmt, va_list args) int len, r; va_list tmp_args; va_copy(tmp_args, args); - len = vsnprintf(buf, sizeof(buf), fmt, tmp_args); + /* vsnprintf() was properly checked but tor_vsnprintf() available so + * why not use it? */ + len = tor_vsnprintf(buf, sizeof(buf), fmt, tmp_args); va_end(tmp_args); if (len < (int)sizeof(buf)) { *strp = tor_strdup(buf);

1 0

[tor/master] ext/eventdns.c multiple replacements of snprintf() with tor_snprintf() which always null terminates and returns -1 if result is truncated.
by nickm＠torproject.org 16 Feb '16

16 Feb '16

commit 86a5305d46175c5d0c67564d3ee4e86a27f0c460 Author: Jeremy <jeremy(a)sturgix.com> Date: Tue Dec 1 12:29:08 2015 -0500 ext/eventdns.c multiple replacements of snprintf() with tor_snprintf() which always null terminates and returns -1 if result is truncated. --- src/ext/eventdns.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/src/ext/eventdns.c b/src/ext/eventdns.c index a0c7ff2..1894cbe 100644 --- a/src/ext/eventdns.c +++ b/src/ext/eventdns.c @@ -388,7 +388,7 @@ debug_ntoa(u32 address) { static char buf[32]; u32 a = ntohl(address); - snprintf(buf, sizeof(buf), "%d.%d.%d.%d", + tor_snprintf(buf, sizeof(buf), "%d.%d.%d.%d", (int)(u8)((a>>24)&0xff), (int)(u8)((a>>16)&0xff), (int)(u8)((a>>8 )&0xff), @@ -436,12 +436,7 @@ evdns_log(int warn, const char *fmt, ...) if (!evdns_log_fn) return; va_start(args,fmt); -#ifdef _WIN32 - _vsnprintf(buf, sizeof(buf), fmt, args); -#else - vsnprintf(buf, sizeof(buf), fmt, args); -#endif - buf[sizeof(buf)-1] = '\0'; + tor_vsnprintf(buf, sizeof(buf), fmt, args); evdns_log_fn(warn, buf); va_end(args); } @@ -762,7 +757,7 @@ reply_handle(struct evdns_request *const req, u16 flags, u32 ttl, struct reply * /* we regard these errors as marking a bad nameserver */ if (req->reissue_count < global_max_reissues) { char msg[64]; - snprintf(msg, sizeof(msg), "Bad response %d (%s)", + tor_snprintf(msg, sizeof(msg), "Bad response %d (%s)", error, evdns_err_to_string(error)); nameserver_failed(req->ns, msg); if (!request_reissue(req)) return; @@ -1705,7 +1700,7 @@ evdns_server_request_add_ptr_reply(struct evdns_server_request *req, struct in_a assert(!(in && inaddr_name)); if (in) { a = ntohl(in->s_addr); - snprintf(buf, sizeof(buf), "%d.%d.%d.%d.in-addr.arpa", + tor_snprintf(buf, sizeof(buf), "%d.%d.%d.%d.in-addr.arpa", (int)(u8)((a )&0xff), (int)(u8)((a>>8 )&0xff), (int)(u8)((a>>16)&0xff), @@ -2638,7 +2633,7 @@ int evdns_resolve_reverse(const struct in_addr *in, int flags, evdns_callback_ty u32 a; assert(in); a = ntohl(in->s_addr); - snprintf(buf, sizeof(buf), "%d.%d.%d.%d.in-addr.arpa", + tor_snprintf(buf, sizeof(buf), "%d.%d.%d.%d.in-addr.arpa", (int)(u8)((a )&0xff), (int)(u8)((a>>8 )&0xff), (int)(u8)((a>>16)&0xff),

1 0

[tor/master] Harden check_private_dir() to remove any potential race.
by nickm＠torproject.org 16 Feb '16

16 Feb '16

commit f48c607fd970aedaf0180a0a23b04eb5101abca0 Author: Jeremy <jeremy(a)sturgix.com> Date: Tue Dec 8 13:25:15 2015 -0500 Harden check_private_dir() to remove any potential race. Remove any potential race between stat() and chmod(). Replace stat() with fstat(). Replace chmod() with fchmod() --- src/common/util.c | 70 +++++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 60 insertions(+), 10 deletions(-) diff --git a/src/common/util.c b/src/common/util.c index e8044f9..305b6ae 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -2029,9 +2029,10 @@ int check_private_dir(const char *dirname, cpd_check_t check, const char *effective_user) { + int fd; int r; struct stat st; - char *f; + //char *f; #ifndef _WIN32 unsigned unwanted_bits = 0; const struct passwd *pw = NULL; @@ -2041,18 +2042,34 @@ check_private_dir(const char *dirname, cpd_check_t check, (void)effective_user; #endif + /* + * Goal is to harden the implementation by removing any + * potential for race between stat() and chmod(). + * chmod() accepts filename as argument. If an attacker can move + * the file between stat() and chmod(), a potential race exists. + * + * Several suggestions taken from: + * https://developer.apple.com/library/mac/documentation/Security/Conceptual/S… + */ tor_assert(dirname); - f = tor_strdup(dirname); - clean_name_for_stat(f); - log_debug(LD_FS, "stat()ing %s", f); - r = stat(sandbox_intern_string(f), &st); - tor_free(f); - if (r) { + + /* Open directory. + * O_NOFOLLOW to ensure that it does not follow symbolic links */ + fd = open(sandbox_intern_string(dirname), O_NOFOLLOW); + + /* Was there an error? Maybe the directory does not exist? */ + if (fd == -1) { + if (errno != ENOENT) { + /* Other directory error */ log_warn(LD_FS, "Directory %s cannot be read: %s", dirname, strerror(errno)); return -1; } + + /* Received ENOENT: Directory does not exist */ + + /* Should we create the directory? */ if (check & CPD_CREATE) { log_info(LD_GENERAL, "Creating directory %s", dirname); #if defined (_WIN32) @@ -2064,23 +2081,51 @@ check_private_dir(const char *dirname, cpd_check_t check, r = mkdir(dirname, 0700); } #endif + + /* check for mkdir() error */ if (r) { log_warn(LD_FS, "Error creating directory %s: %s", dirname, strerror(errno)); return -1; } - } else if (!(check & CPD_CHECK)) { + + /* we just created the directory. try to open it again. + * permissions on the directory will be checked again below.*/ + fd = open(sandbox_intern_string(dirname), O_NOFOLLOW); + + if ( fd == -1 ) return -1; + + } else if (!(check & CPD_CHECK)) { log_warn(LD_FS, "Directory %s does not exist.", dirname); return -1; } + /* XXXX In the case where check==CPD_CHECK, we should look at the * parent directory a little harder. */ return 0; } + + tor_assert(fd); + + //f = tor_strdup(dirname); + //clean_name_for_stat(f); + log_debug(LD_FS, "stat()ing %s", dirname); + //r = stat(sandbox_intern_string(f), &st); + r = fstat(fd, &st); + if (r == -1) { + log_warn(LD_FS, "fstat() on directory %s failed.", dirname); + close(fd); + return -1; + } + //tor_free(f); + + /* check that dirname is a directory */ if (!(st.st_mode & S_IFDIR)) { log_warn(LD_FS, "%s is not a directory", dirname); + close(fd); return -1; } + #ifndef _WIN32 if (effective_user) { /* Look up the user and group information. @@ -2097,7 +2142,6 @@ check_private_dir(const char *dirname, cpd_check_t check, running_uid = getuid(); running_gid = getgid(); } - if (st.st_uid != running_uid) { const struct passwd *pw = NULL; char *process_ownername = NULL; @@ -2113,6 +2157,7 @@ check_private_dir(const char *dirname, cpd_check_t check, pw ? pw->pw_name : "<unknown>", (int)st.st_uid); tor_free(process_ownername); + close(fd); return -1; } if ( (check & (CPD_GROUP_OK|CPD_GROUP_READ)) @@ -2129,6 +2174,7 @@ check_private_dir(const char *dirname, cpd_check_t check, gr ? gr->gr_name : "<unknown>", (int)st.st_gid); tor_free(process_groupname); + close(fd); return -1; } if (check & (CPD_GROUP_OK|CPD_GROUP_READ)) { @@ -2141,6 +2187,7 @@ check_private_dir(const char *dirname, cpd_check_t check, if (check & CPD_CHECK_MODE_ONLY) { log_warn(LD_FS, "Permissions on directory %s are too permissive.", dirname); + close(fd); return -1; } log_warn(LD_FS, "Fixing permissions on directory %s", dirname); @@ -2150,15 +2197,18 @@ check_private_dir(const char *dirname, cpd_check_t check, new_mode |= 0050; /* Group should have rx */ } new_mode &= ~unwanted_bits; /* Clear the bits that we didn't want set...*/ - if (chmod(dirname, new_mode)) { + if (fchmod(fd, new_mode)) { log_warn(LD_FS, "Could not chmod directory %s: %s", dirname, strerror(errno)); + close(fd); return -1; } else { + close(fd); return 0; } } #endif + close(fd); return 0; }

1 0

[tor/master] src/common/compat.c:tor_vasprintf() - changed vsnprintf() to tor_vsnprintf() which ensures string is null terminated.
by nickm＠torproject.org 16 Feb '16

16 Feb '16

commit fcc6541fdee2af8005766c3cd4b81e5edd8ae5ea Author: Jeremy <jeremy(a)sturgix.com> Date: Tue Dec 1 12:27:29 2015 -0500 src/common/compat.c:tor_vasprintf() - changed vsnprintf() to tor_vsnprintf() which ensures string is null terminated. --- src/common/compat.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/common/compat.c b/src/common/compat.c index 7d72b4b..6f35753 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -580,7 +580,8 @@ tor_vasprintf(char **strp, const char *fmt, va_list args) return len; } strp_tmp = tor_malloc(len+1); - r = vsnprintf(strp_tmp, len+1, fmt, args); + /* use of tor_vsnprintf() will ensure string is null terminated */ + r = tor_vsnprintf(strp_tmp, len+1, fmt, args); if (r != len) { tor_free(strp_tmp); *strp = NULL;

1 0

[tor/master] src/common/util.c:expand_filename() - Perhaps use GetFullPathName() as a form of input validation on the filename argument.
by nickm＠torproject.org 16 Feb '16

16 Feb '16

commit 4e19133dccfc4d252e9ed2695f6fe49bb4503ac8 Author: Jeremy <jeremy(a)sturgix.com> Date: Tue Dec 1 15:41:03 2015 -0500 src/common/util.c:expand_filename() - Perhaps use GetFullPathName() as a form of input validation on the filename argument. --- src/common/util.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/common/util.c b/src/common/util.c index b33c80f..e8044f9 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -2873,6 +2873,9 @@ expand_filename(const char *filename) { tor_assert(filename); #ifdef _WIN32 + /* Might consider using GetFullPathName() as described here: + * http://etutorials.org/Programming/secure+programming/Chapter+3.+Input+Valid… + */ return tor_strdup(filename); #else if (*filename == '~') {

1 0