March 2016 - tor-commits - lists.torproject.org

[tor/release-0.2.7] Merge branch 'maint-0.2.5' into maint-0.2.6
by nickm＠torproject.org 21 Mar '16

21 Mar '16

commit 44ad3be221fb8e5e648c6d56054fb1d8596a645b Merge: e2efa9e f06d9a9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 5 08:13:24 2016 -0500 Merge branch 'maint-0.2.5' into maint-0.2.6 changes/geoip-february2016 | 4 + src/config/geoip | 2144 +++++++++++++++++++++++++++++++++----------- src/config/geoip6 | 864 ++++++++++++++---- 3 files changed, 2328 insertions(+), 684 deletions(-)

1 0

[tor/release-0.2.7] Check ORPort and DirPort reachability before publishing a relay descriptor
by nickm＠torproject.org 21 Mar '16

21 Mar '16

commit 6094a886cf9be92d29077b428554a75c9971a2ca Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Mon Jan 18 14:00:29 2016 +1100 Check ORPort and DirPort reachability before publishing a relay descriptor Otherwise, relays publish a descriptor with DirPort 0 when the DirPort reachability test takes longer than the ORPort reachability test. Closes bug #18050. Reported by "starlight", patch by "teor". Bugfix on 0.1.0.1-rc, commit a1f1fa6ab on 27 Feb 2005. --- changes/bug18050 | 7 +++++++ src/or/main.c | 10 ++++++---- src/or/router.c | 13 +++++++++---- 3 files changed, 22 insertions(+), 8 deletions(-) diff --git a/changes/bug18050 b/changes/bug18050 new file mode 100644 index 0000000..ce24a77 --- /dev/null +++ b/changes/bug18050 @@ -0,0 +1,7 @@ + o Minor fixes (relays): + - Check that both the ORPort and DirPort (if present) are reachable + before publishing a relay descriptor. Otherwise, relays publish a + descriptor with DirPort 0 when the DirPort reachability test takes + longer than the ORPort reachability test. + Closes bug #18050. Reported by "starlight", patch by "teor". + Bugfix on 0.1.0.1-rc, commit a1f1fa6ab on 27 Feb 2005. diff --git a/src/or/main.c b/src/or/main.c index df0cd1b..5198b51 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -1718,8 +1718,9 @@ second_elapsed_callback(periodic_timer_t *timer, void *arg) if (me && !check_whether_orport_reachable()) { char *address = tor_dup_ip(me->addr); log_warn(LD_CONFIG,"Your server (%s:%d) has not managed to confirm that " - "its ORPort is reachable. Please check your firewalls, ports, " - "address, /etc/hosts file, etc.", + "its ORPort is reachable. Relays do not publish descriptors " + "until their ORPort and DirPort are reachable. Please check " + "your firewalls, ports, address, /etc/hosts file, etc.", address, me->or_port); control_event_server_status(LOG_WARN, "REACHABILITY_FAILED ORADDRESS=%s:%d", @@ -1731,8 +1732,9 @@ second_elapsed_callback(periodic_timer_t *timer, void *arg) char *address = tor_dup_ip(me->addr); log_warn(LD_CONFIG, "Your server (%s:%d) has not managed to confirm that its " - "DirPort is reachable. Please check your firewalls, ports, " - "address, /etc/hosts file, etc.", + "DirPort is reachable. Relays do not publish descriptors " + "until their ORPort and DirPort are reachable. Please check " + "your firewalls, ports, address, /etc/hosts file, etc.", address, me->dir_port); control_event_server_status(LOG_WARN, "REACHABILITY_FAILED DIRADDRESS=%s:%d", diff --git a/src/or/router.c b/src/or/router.c index 2ddaa89..53e0522 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -1232,7 +1232,8 @@ router_orport_found_reachable(void) char *address = tor_dup_ip(me->addr); log_notice(LD_OR,"Self-testing indicates your ORPort is reachable from " "the outside. Excellent.%s", - get_options()->PublishServerDescriptor_ != NO_DIRINFO ? + get_options()->PublishServerDescriptor_ != NO_DIRINFO + && check_whether_dirport_reachable() ? " Publishing server descriptor." : ""); can_reach_or_port = 1; mark_my_descriptor_dirty("ORPort found reachable"); @@ -1256,7 +1257,10 @@ router_dirport_found_reachable(void) if (!can_reach_dir_port && me) { char *address = tor_dup_ip(me->addr); log_notice(LD_DIRSERV,"Self-testing indicates your DirPort is reachable " - "from the outside. Excellent."); + "from the outside. Excellent.%s", + get_options()->PublishServerDescriptor_ != NO_DIRINFO + && check_whether_orport_reachable() ? + " Publishing server descriptor." : ""); can_reach_dir_port = 1; if (decide_to_advertise_dirport(get_options(), me->dir_port)) { mark_my_descriptor_dirty("DirPort found reachable"); @@ -1459,7 +1463,8 @@ proxy_mode(const or_options_t *options) * and * - We have ORPort set * and - * - We believe we are reachable from the outside; or + * - We believe both our ORPort and DirPort (if present) are reachable from + * the outside; or * - We are an authoritative directory server. */ static int @@ -1478,7 +1483,7 @@ decide_if_publishable_server(void) if (!router_get_advertised_or_port(options)) return 0; - return check_whether_orport_reachable(); + return check_whether_orport_reachable() && check_whether_dirport_reachable(); } /** Initiate server descriptor upload as reasonable (if server is publishable,

1 0

[tor/release-0.2.7] Merge remote-tracking branch 'teor/bug18050' into maint-0.2.7
by nickm＠torproject.org 21 Mar '16

21 Mar '16

commit 83dfcfbc4a295ca52325f47291d109cd0a16ac8f Merge: b34c5c6 6094a88 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 18 19:51:57 2016 -0500 Merge remote-tracking branch 'teor/bug18050' into maint-0.2.7 changes/bug18050 | 7 +++++++ src/or/main.c | 10 ++++++---- src/or/router.c | 13 +++++++++---- 3 files changed, 22 insertions(+), 8 deletions(-)

1 0

[tor/release-0.2.7] Merge branch 'maint-0.2.6' into maint-0.2.7
by nickm＠torproject.org 21 Mar '16

21 Mar '16

commit 8335b1f9a91076f100e7d3ba6b45f3ed9fc2986a Merge: 83dfcfb db81565 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 18 20:00:16 2016 -0500 Merge branch 'maint-0.2.6' into maint-0.2.7 changes/bug18089 | 6 ++++++ src/common/crypto.c | 8 ++++++++ 2 files changed, 14 insertions(+)

1 0

[tor/release-0.2.7] Make memwipe() do nothing when passed a NULL pointer or zero size
by nickm＠torproject.org 21 Mar '16

21 Mar '16

commit db8156533133836b19bca51f7fabba4d161b6ba2 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Tue Jan 19 11:22:58 2016 +1100 Make memwipe() do nothing when passed a NULL pointer or zero size Check size argument to memwipe() for underflow. Closes bug #18089. Reported by "gk", patch by "teor". Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352), commit 49dd5ef3 on 7 Nov 2012. --- changes/bug18089 | 6 ++++++ src/common/crypto.c | 8 ++++++++ 2 files changed, 14 insertions(+) diff --git a/changes/bug18089 b/changes/bug18089 new file mode 100644 index 0000000..c1fb342 --- /dev/null +++ b/changes/bug18089 @@ -0,0 +1,6 @@ + o Minor fixes (security): + - Make memwipe() do nothing when passed a NULL pointer + or zero size. Check size argument to memwipe() for underflow. + Closes bug #18089. Reported by "gk", patch by "teor". + Bugfix on 0.2.3.25 and 0.2.4.6-alpha (#7352), + commit 49dd5ef3 on 7 Nov 2012. diff --git a/src/common/crypto.c b/src/common/crypto.c index 218c7be..4e0b383 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -3012,6 +3012,7 @@ base32_decode(char *dest, size_t destlen, const char *src, size_t srclen) /** * Destroy the sz bytes of data stored at mem, setting them to * the value byte. + * If mem is NULL or sz is zero, nothing happens. * * This function is preferable to memset, since many compilers will happily * optimize out memset() when they can convince themselves that the data being @@ -3029,6 +3030,13 @@ base32_decode(char *dest, size_t destlen, const char *src, size_t srclen) void memwipe(void *mem, uint8_t byte, size_t sz) { + if (mem == NULL || sz == 0) { + return; + } + + /* Data this large is likely to be an underflow. */ + tor_assert(sz < SIZE_T_CEILING); + /* Because whole-program-optimization exists, we may not be able to just * have this function call "memset". A smart compiler could inline it, then * eliminate dead memsets, and declare itself to be clever. */

1 0

[tor/release-0.2.7] Refine the memwipe() arguments check for 18089 a little more.
by nickm＠torproject.org 21 Mar '16

21 Mar '16

commit e2efa9e321972709933b6b9a68da035e1a91aa08 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 19 08:28:58 2016 -0500 Refine the memwipe() arguments check for 18089 a little more. We still silently ignore memwipe(NULL, ch, 0); and memwipe(ptr, ch, 0); /* for ptr != NULL */ But we now assert on: memwipe(NULL, ch, 30); --- src/common/crypto.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 4e0b383..8402ca0 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -3030,9 +3030,11 @@ base32_decode(char *dest, size_t destlen, const char *src, size_t srclen) void memwipe(void *mem, uint8_t byte, size_t sz) { - if (mem == NULL || sz == 0) { + if (sz == 0) { return; } + /* If sz is nonzero, then mem must not be NULL. */ + tor_assert(mem != NULL); /* Data this large is likely to be an underflow. */ tor_assert(sz < SIZE_T_CEILING);

1 0

[tor/release-0.2.7] Try to fix formatting in manpage
by nickm＠torproject.org 21 Mar '16

21 Mar '16

commit 601c82325549c00fb6d3c507c87b3224de44fa3f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 28 11:52:48 2016 -0500 Try to fix formatting in manpage --- doc/tor.1.txt | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 0f605ff..c011bff 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -95,8 +95,7 @@ COMMAND-LINE OPTIONS which tells Tor to only send warnings and errors to the console, or with the **--quiet** option, which tells Tor not to log to the console at all. -[[opt-keygen]] **--keygen** [**--newpass**] - +[[opt-keygen]] **--keygen** [**--newpass**]:: Running "tor --keygen" creates a new ed25519 master identity key for a relay, or only a fresh temporary signing key and certificate, if you already have a master key. Optionally you can encrypt the master identity

1 0

[tor/release-0.2.7] avoid integer overflow in and around smartlist_ensure_capacity.
by nickm＠torproject.org 21 Mar '16

21 Mar '16

commit bca7083e8285e8e6a4377076a7e432417eafc6d2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 27 12:26:02 2016 -0500 avoid integer overflow in and around smartlist_ensure_capacity. This closes bug 18162; bugfix on a45b1315909c9, which fixed a related issue long ago. In addition to the #18162 issues, this fixes a signed integer overflow in smarltist_add_all(), which is probably not so great either. --- changes/bug18162 | 7 +++++++ src/common/container.c | 22 +++++++++++++--------- 2 files changed, 20 insertions(+), 9 deletions(-) diff --git a/changes/bug18162 b/changes/bug18162 new file mode 100644 index 0000000..0844d6f --- /dev/null +++ b/changes/bug18162 @@ -0,0 +1,7 @@ + o Major bugfixes (security, pointers): + + - Avoid a difficult-to-trigger heap corruption attack when extending + a smartlist to contain over 16GB of pointers. Fixes bug #18162; + bugfix on Tor 0.1.1.11-alpha, which fixed a related bug + incompletely. Reported by Guido Vranken. + diff --git a/src/common/container.c b/src/common/container.c index eec497a..46d9c2e 100644 --- a/src/common/container.c +++ b/src/common/container.c @@ -60,15 +60,17 @@ smartlist_clear(smartlist_t *sl) /** Make sure that sl can hold at least size entries. */ static INLINE void -smartlist_ensure_capacity(smartlist_t *sl, int size) +smartlist_ensure_capacity(smartlist_t *sl, size_t size) { #if SIZEOF_SIZE_T > SIZEOF_INT #define MAX_CAPACITY (INT_MAX) #else #define MAX_CAPACITY (int)((SIZE_MAX / (sizeof(void*)))) #endif - if (size > sl->capacity) { - int higher = sl->capacity; + tor_assert(size <= MAX_CAPACITY); + + if (size > (size_t) sl->capacity) { + size_t higher = (size_t) sl->capacity; if (PREDICT_UNLIKELY(size > MAX_CAPACITY/2)) { tor_assert(size <= MAX_CAPACITY); higher = MAX_CAPACITY; @@ -76,7 +78,8 @@ smartlist_ensure_capacity(smartlist_t *sl, int size) while (size > higher) higher *= 2; } - sl->capacity = higher; + tor_assert(higher <= INT_MAX); /* Redundant */ + sl->capacity = (int) higher; sl->list = tor_realloc(sl->list, sizeof(void*)*((size_t)sl->capacity)); } } @@ -85,7 +88,7 @@ smartlist_ensure_capacity(smartlist_t *sl, int size) void smartlist_add(smartlist_t *sl, void *element) { - smartlist_ensure_capacity(sl, sl->num_used+1); + smartlist_ensure_capacity(sl, ((size_t) sl->num_used)+1); sl->list[sl->num_used++] = element; } @@ -93,11 +96,12 @@ smartlist_add(smartlist_t *sl, void *element) void smartlist_add_all(smartlist_t *s1, const smartlist_t *s2) { - int new_size = s1->num_used + s2->num_used; - tor_assert(new_size >= s1->num_used); /* check for overflow. */ + size_t new_size = (size_t)s1->num_used + (size_t)s2->num_used; + tor_assert(new_size >= (size_t) s1->num_used); /* check for overflow. */ smartlist_ensure_capacity(s1, new_size); memcpy(s1->list + s1->num_used, s2->list, s2->num_used*sizeof(void*)); - s1->num_used = new_size; + tor_assert(new_size <= INT_MAX); /* redundant. */ + s1->num_used = (int) new_size; } /** Remove all elements E from sl such that E==element. Preserve @@ -334,7 +338,7 @@ smartlist_insert(smartlist_t *sl, int idx, void *val) if (idx == sl->num_used) { smartlist_add(sl, val); } else { - smartlist_ensure_capacity(sl, sl->num_used+1); + smartlist_ensure_capacity(sl, ((size_t) sl->num_used)+1); /* Move other elements away */ if (idx < sl->num_used) memmove(sl->list + idx + 1, sl->list + idx,

1 0

[tor/release-0.2.7] Merge branch 'maint-0.2.6' into maint-0.2.7
by nickm＠torproject.org 21 Mar '16

21 Mar '16

commit 534a0ba59b4d772b0e3e6a1dfc5050d534fdb9fc Merge: 8335b1f e2efa9e Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 19 08:30:39 2016 -0500 Merge branch 'maint-0.2.6' into maint-0.2.7 src/common/crypto.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

[tor/release-0.2.7] Add descriptions for --keygen to the manpage
by nickm＠torproject.org 21 Mar '16

21 Mar '16

commit fb64c55cf87615745e7c59c5bdc660119986bab1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jan 28 10:19:29 2016 -0500 Add descriptions for --keygen to the manpage Based on text from s7r --- changes/bug17583 | 4 ++++ doc/tor.1.txt | 29 +++++++++++++++++++++++++++-- 2 files changed, 31 insertions(+), 2 deletions(-) diff --git a/changes/bug17583 b/changes/bug17583 new file mode 100644 index 0000000..d77d467 --- /dev/null +++ b/changes/bug17583 @@ -0,0 +1,4 @@ + o Documentation: + - Add a description of the correct use of the '--keygen' command-line + option. Closes ticket 17583; based on text by 's7r'. + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 5ea5623..0f605ff 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -95,6 +95,30 @@ COMMAND-LINE OPTIONS which tells Tor to only send warnings and errors to the console, or with the **--quiet** option, which tells Tor not to log to the console at all. +[[opt-keygen]] **--keygen** [**--newpass**] + + Running "tor --keygen" creates a new ed25519 master identity key for a + relay, or only a fresh temporary signing key and certificate, if you + already have a master key. Optionally you can encrypt the master identity + key with a passphrase: Tor will ask you for one. If you don't want to + encrypt the master key, just don't enter any passphrase when asked. + + + + The **--newpass** option should be used with --keygen only when you need + to add, change, or remove a passphrase on an existing ed25519 master + identity key. You will be prompted for the old passphase (if any), + and the new passphrase (if any). + + + + When generating a master key, you will probably want to use + **--DataDirectory** to control where the keys + and certificates will be stored, and **--SigningKeyLifetime** to + control their lifetimes. Their behavior is as documented in the + server options section below. (You must have write access to the specified + DataDirectory.) + + + + To use the generated files, you must copy them to the DataDirectory/keys + directory of your Tor daemon, and make sure that they are owned by the + user actually running the Tor daemon on your system. + Other options can be specified on the command-line in the format "--option value", in the format "option value", or in a configuration file. For instance, you can tell Tor to start listening for SOCKS connections on port @@ -1908,8 +1932,9 @@ is non-zero): [[OfflineMasterKey]] **OfflineMasterKey** **0**|**1**:: If non-zero, the Tor relay will never generate or load its master secret - key. Instead, you'll have to use "tor --keygen" to manage the master - secret key. (Default: 0) + key. Instead, you'll have to use "tor --keygen" to manage the permanent + ed25519 master identity key, as well as the corresponding temporary + signing keys and certificates. (Default: 0) DIRECTORY SERVER OPTIONS ------------------------

1 0