September 2016 - tor-commits - lists.torproject.org

[tor/master] Merge branch 'maint-0.2.8'
by nickm＠torproject.org 20 Sep '16

20 Sep '16

commit 62ee4f185f984f11d75522eedcee92d1f15fc7a6 Merge: 06d99aa 9ebe202 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 20 19:30:45 2016 -0400 Merge branch 'maint-0.2.8' changes/bug20103 | 7 +++++++ src/or/networkstatus.c | 24 +++++++++++++----------- 2 files changed, 20 insertions(+), 11 deletions(-) diff --cc src/or/networkstatus.c index 72af505,1cedfef..28f5b42 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@@ -1731,9 -1629,11 +1731,11 @@@ networkstatus_set_current_consensus(con /* Are we missing any certificates at all? */ if (r != 1 && dl_certs) - authority_certs_fetch_missing(c, now); + authority_certs_fetch_missing(c, now, source_dir); - if (flav == usable_consensus_flavor()) { + const int is_usable_flavor = flav == usable_consensus_flavor(); + + if (is_usable_flavor) { notify_control_networkstatus_changed(current_consensus, c); } if (flav == FLAV_NS) {

1 0

[tor/maint-0.2.8] Don't look at any routerstatus_t when the networkstatus is inconsistent
by nickm＠torproject.org 20 Sep '16

20 Sep '16

commit 9b5a19c64b8195298753b3cd7059e8fcaaabe5bd Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 19 12:03:58 2016 -0400 Don't look at any routerstatus_t when the networkstatus is inconsistent For a brief moment in networkstatus_set_current_consensus(), the old consensus has been freed, but the node_t objects still have dead pointers to the routerstatus_t objects within it. During that interval, we absolutely must not do anything that would cause Tor to look at those dangling pointers. Unfortunately, calling the (badly labeled!) current_consensus macro or anything else that calls into we_use_microdescriptors_for_circuits(), can make us look at the nodelist. The fix is to make sure we identify the main consensus flavor _outside_ the danger zone, and to make the danger zone much much smaller. Fixes bug 20103. This bug has been implicitly present for AGES; we just got lucky for a very long time. It became a crash bug in 0.2.8.2-alpha when we merged 35bbf2e4a4e8ccb to make find_dl_schedule start looking at the consensus, and 4460feaf2850ef0 which made node_get_all_orports less (accidentally) tolerant of nodes with a valid ri pointer but dangling rs pointer. --- changes/bug20103 | 7 +++++++ src/or/networkstatus.c | 24 +++++++++++++----------- 2 files changed, 20 insertions(+), 11 deletions(-) diff --git a/changes/bug20103 b/changes/bug20103 new file mode 100644 index 0000000..c2b81d3 --- /dev/null +++ b/changes/bug20103 @@ -0,0 +1,7 @@ + o Major bug fixes (crash): + + - Fix a complicated crash bug that could affect Tor clients + configured to use bridges when replacing a networkstatus consensus + in which one of their bridges was mentioned. OpenBSD users saw + more crashes here, but all platforms were potentially affected. + Fixes bug 20103; bugfix on 0.2.8.2-alpha. diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c index 51fc011..1cedfef 100644 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@ -1631,7 +1631,9 @@ networkstatus_set_current_consensus(const char *consensus, if (r != 1 && dl_certs) authority_certs_fetch_missing(c, now); - if (flav == usable_consensus_flavor()) { + const int is_usable_flavor = flav == usable_consensus_flavor(); + + if (is_usable_flavor) { notify_control_networkstatus_changed(current_consensus, c); } if (flav == FLAV_NS) { @@ -1674,20 +1676,12 @@ networkstatus_set_current_consensus(const char *consensus, } } - /* Reset the failure count only if this consensus is actually valid. */ - if (c->valid_after <= now && now <= c->valid_until) { - download_status_reset(&consensus_dl_status[flav]); - } else { - if (!from_cache) - download_status_failed(&consensus_dl_status[flav], 0); - } + if (is_usable_flavor) { + nodelist_set_consensus(c); - if (flav == usable_consensus_flavor()) { /* XXXXNM Microdescs: needs a non-ns variant. ???? NM*/ update_consensus_networkstatus_fetch_time(now); - nodelist_set_consensus(current_consensus); - dirvote_recalculate_timing(options, now); routerstatus_list_update_named_server_map(); @@ -1711,6 +1705,14 @@ networkstatus_set_current_consensus(const char *consensus, current_consensus); } + /* Reset the failure count only if this consensus is actually valid. */ + if (c->valid_after <= now && now <= c->valid_until) { + download_status_reset(&consensus_dl_status[flav]); + } else { + if (!from_cache) + download_status_failed(&consensus_dl_status[flav], 0); + } + if (directory_caches_dir_info(options)) { dirserv_set_cached_consensus_networkstatus(consensus, flavor,

1 0

[tor/master] Don't look at any routerstatus_t when the networkstatus is inconsistent
by nickm＠torproject.org 20 Sep '16

20 Sep '16

commit 9b5a19c64b8195298753b3cd7059e8fcaaabe5bd Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 19 12:03:58 2016 -0400 Don't look at any routerstatus_t when the networkstatus is inconsistent For a brief moment in networkstatus_set_current_consensus(), the old consensus has been freed, but the node_t objects still have dead pointers to the routerstatus_t objects within it. During that interval, we absolutely must not do anything that would cause Tor to look at those dangling pointers. Unfortunately, calling the (badly labeled!) current_consensus macro or anything else that calls into we_use_microdescriptors_for_circuits(), can make us look at the nodelist. The fix is to make sure we identify the main consensus flavor _outside_ the danger zone, and to make the danger zone much much smaller. Fixes bug 20103. This bug has been implicitly present for AGES; we just got lucky for a very long time. It became a crash bug in 0.2.8.2-alpha when we merged 35bbf2e4a4e8ccb to make find_dl_schedule start looking at the consensus, and 4460feaf2850ef0 which made node_get_all_orports less (accidentally) tolerant of nodes with a valid ri pointer but dangling rs pointer. --- changes/bug20103 | 7 +++++++ src/or/networkstatus.c | 24 +++++++++++++----------- 2 files changed, 20 insertions(+), 11 deletions(-) diff --git a/changes/bug20103 b/changes/bug20103 new file mode 100644 index 0000000..c2b81d3 --- /dev/null +++ b/changes/bug20103 @@ -0,0 +1,7 @@ + o Major bug fixes (crash): + + - Fix a complicated crash bug that could affect Tor clients + configured to use bridges when replacing a networkstatus consensus + in which one of their bridges was mentioned. OpenBSD users saw + more crashes here, but all platforms were potentially affected. + Fixes bug 20103; bugfix on 0.2.8.2-alpha. diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c index 51fc011..1cedfef 100644 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@ -1631,7 +1631,9 @@ networkstatus_set_current_consensus(const char *consensus, if (r != 1 && dl_certs) authority_certs_fetch_missing(c, now); - if (flav == usable_consensus_flavor()) { + const int is_usable_flavor = flav == usable_consensus_flavor(); + + if (is_usable_flavor) { notify_control_networkstatus_changed(current_consensus, c); } if (flav == FLAV_NS) { @@ -1674,20 +1676,12 @@ networkstatus_set_current_consensus(const char *consensus, } } - /* Reset the failure count only if this consensus is actually valid. */ - if (c->valid_after <= now && now <= c->valid_until) { - download_status_reset(&consensus_dl_status[flav]); - } else { - if (!from_cache) - download_status_failed(&consensus_dl_status[flav], 0); - } + if (is_usable_flavor) { + nodelist_set_consensus(c); - if (flav == usable_consensus_flavor()) { /* XXXXNM Microdescs: needs a non-ns variant. ???? NM*/ update_consensus_networkstatus_fetch_time(now); - nodelist_set_consensus(current_consensus); - dirvote_recalculate_timing(options, now); routerstatus_list_update_named_server_map(); @@ -1711,6 +1705,14 @@ networkstatus_set_current_consensus(const char *consensus, current_consensus); } + /* Reset the failure count only if this consensus is actually valid. */ + if (c->valid_after <= now && now <= c->valid_until) { + download_status_reset(&consensus_dl_status[flav]); + } else { + if (!from_cache) + download_status_failed(&consensus_dl_status[flav], 0); + } + if (directory_caches_dir_info(options)) { dirserv_set_cached_consensus_networkstatus(consensus, flavor,

1 0

[tor/maint-0.2.8] Merge remote-tracking branch 'public/bug20103_028_v3' into maint-0.2.8
by nickm＠torproject.org 20 Sep '16

20 Sep '16

commit 9ebe202da0c56ed6c006a0410a636a9e99d111f7 Merge: 19a9872 9b5a19c Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 20 19:30:24 2016 -0400 Merge remote-tracking branch 'public/bug20103_028_v3' into maint-0.2.8 changes/bug20103 | 7 +++++++ src/or/networkstatus.c | 24 +++++++++++++----------- 2 files changed, 20 insertions(+), 11 deletions(-)

1 0

[tor/release-0.2.8] Merge remote-tracking branch 'public/bug20103_028_v3' into maint-0.2.8
by nickm＠torproject.org 20 Sep '16

20 Sep '16

commit 9ebe202da0c56ed6c006a0410a636a9e99d111f7 Merge: 19a9872 9b5a19c Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 20 19:30:24 2016 -0400 Merge remote-tracking branch 'public/bug20103_028_v3' into maint-0.2.8 changes/bug20103 | 7 +++++++ src/or/networkstatus.c | 24 +++++++++++++----------- 2 files changed, 20 insertions(+), 11 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'public/bug20103_028_v3' into maint-0.2.8
by nickm＠torproject.org 20 Sep '16

20 Sep '16

commit 9ebe202da0c56ed6c006a0410a636a9e99d111f7 Merge: 19a9872 9b5a19c Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 20 19:30:24 2016 -0400 Merge remote-tracking branch 'public/bug20103_028_v3' into maint-0.2.8 changes/bug20103 | 7 +++++++ src/or/networkstatus.c | 24 +++++++++++++----------- 2 files changed, 20 insertions(+), 11 deletions(-)

1 0

[tor/release-0.2.8] Don't look at any routerstatus_t when the networkstatus is inconsistent
by nickm＠torproject.org 20 Sep '16

20 Sep '16

commit 9b5a19c64b8195298753b3cd7059e8fcaaabe5bd Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 19 12:03:58 2016 -0400 Don't look at any routerstatus_t when the networkstatus is inconsistent For a brief moment in networkstatus_set_current_consensus(), the old consensus has been freed, but the node_t objects still have dead pointers to the routerstatus_t objects within it. During that interval, we absolutely must not do anything that would cause Tor to look at those dangling pointers. Unfortunately, calling the (badly labeled!) current_consensus macro or anything else that calls into we_use_microdescriptors_for_circuits(), can make us look at the nodelist. The fix is to make sure we identify the main consensus flavor _outside_ the danger zone, and to make the danger zone much much smaller. Fixes bug 20103. This bug has been implicitly present for AGES; we just got lucky for a very long time. It became a crash bug in 0.2.8.2-alpha when we merged 35bbf2e4a4e8ccb to make find_dl_schedule start looking at the consensus, and 4460feaf2850ef0 which made node_get_all_orports less (accidentally) tolerant of nodes with a valid ri pointer but dangling rs pointer. --- changes/bug20103 | 7 +++++++ src/or/networkstatus.c | 24 +++++++++++++----------- 2 files changed, 20 insertions(+), 11 deletions(-) diff --git a/changes/bug20103 b/changes/bug20103 new file mode 100644 index 0000000..c2b81d3 --- /dev/null +++ b/changes/bug20103 @@ -0,0 +1,7 @@ + o Major bug fixes (crash): + + - Fix a complicated crash bug that could affect Tor clients + configured to use bridges when replacing a networkstatus consensus + in which one of their bridges was mentioned. OpenBSD users saw + more crashes here, but all platforms were potentially affected. + Fixes bug 20103; bugfix on 0.2.8.2-alpha. diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c index 51fc011..1cedfef 100644 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@ -1631,7 +1631,9 @@ networkstatus_set_current_consensus(const char *consensus, if (r != 1 && dl_certs) authority_certs_fetch_missing(c, now); - if (flav == usable_consensus_flavor()) { + const int is_usable_flavor = flav == usable_consensus_flavor(); + + if (is_usable_flavor) { notify_control_networkstatus_changed(current_consensus, c); } if (flav == FLAV_NS) { @@ -1674,20 +1676,12 @@ networkstatus_set_current_consensus(const char *consensus, } } - /* Reset the failure count only if this consensus is actually valid. */ - if (c->valid_after <= now && now <= c->valid_until) { - download_status_reset(&consensus_dl_status[flav]); - } else { - if (!from_cache) - download_status_failed(&consensus_dl_status[flav], 0); - } + if (is_usable_flavor) { + nodelist_set_consensus(c); - if (flav == usable_consensus_flavor()) { /* XXXXNM Microdescs: needs a non-ns variant. ???? NM*/ update_consensus_networkstatus_fetch_time(now); - nodelist_set_consensus(current_consensus); - dirvote_recalculate_timing(options, now); routerstatus_list_update_named_server_map(); @@ -1711,6 +1705,14 @@ networkstatus_set_current_consensus(const char *consensus, current_consensus); } + /* Reset the failure count only if this consensus is actually valid. */ + if (c->valid_after <= now && now <= c->valid_until) { + download_status_reset(&consensus_dl_status[flav]); + } else { + if (!from_cache) + download_status_failed(&consensus_dl_status[flav], 0); + } + if (directory_caches_dir_info(options)) { dirserv_set_cached_consensus_networkstatus(consensus, flavor,

1 0

[tor/release-0.2.8] Merge branch 'maint-0.2.8' into release-0.2.8
by nickm＠torproject.org 20 Sep '16

20 Sep '16

commit a8b607bfddd1acf2896cb12dd80389e4b1d66a24 Merge: f527a80 9ebe202 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 20 19:30:38 2016 -0400 Merge branch 'maint-0.2.8' into release-0.2.8 changes/bug20103 | 7 +++++++ src/or/networkstatus.c | 24 +++++++++++++----------- 2 files changed, 20 insertions(+), 11 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.2.8'
by nickm＠torproject.org 20 Sep '16

20 Sep '16

commit 06d99aa2c42de6013b3fa55ac03c661f57f90047 Merge: 32926b0 19a9872 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 20 19:29:17 2016 -0400 Merge branch 'maint-0.2.8' src/or/fallback_dirs.inc | 46 ++++++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 16 deletions(-)

1 0

[tor/release-0.2.8] Update hard-coded fallback list based on pre-0.2.9 checks
by nickm＠torproject.org 20 Sep '16

20 Sep '16

commit c6d51b45770497227115f1a1d474cb5a8d582dd9 Author: teor <teor2345(a)gmail.com> Date: Tue Sep 20 16:49:45 2016 +1000 Update hard-coded fallback list based on pre-0.2.9 checks --- src/or/fallback_dirs.inc | 54 +++++++++++++++++++++++++++++++----------------- 1 file changed, 35 insertions(+), 19 deletions(-) diff --git a/src/or/fallback_dirs.inc b/src/or/fallback_dirs.inc index 245110f..c2329f1 100644 --- a/src/or/fallback_dirs.inc +++ b/src/or/fallback_dirs.inc @@ -30,9 +30,11 @@ URL: https:onionoo.torproject.orguptime?first_seen_days=7-&flag=V2Dir&type=relay " weight=10", "178.62.197.82:80 orport=443 id=0D3EBA17E1C78F1E9900BABDB23861D46FCAF163" " weight=10", -"144.76.14.145:110 orport=143 id=14419131033443AE6E21DA82B0D307F7CAE42BDB" -" ipv6=[2a01:4f8:190:9490::dead]:443" -" weight=10", +/* Fallback was on 0.2.8.6 list, but down for a week before 0.2.9 + * "144.76.14.145:110 orport=143 id=14419131033443AE6E21DA82B0D307F7CAE42BDB" + * " ipv6=[2a01:4f8:190:9490::dead]:443" + * " weight=10", + */ "178.32.216.146:9030 orport=9001 id=17898F9A2EBC7D69DAF87C00A1BD2FABF3C9E1D2" " weight=10", "46.101.151.222:80 orport=443 id=1DBAED235E3957DE1ABD25B4206BE71406FB61F8" @@ -47,8 +49,10 @@ URL: https:onionoo.torproject.orguptime?first_seen_days=7-&flag=V2Dir&type=relay * "51.254.215.121:80 orport=443 id=262B66AD25C79588AD1FC8ED0E966395B47E5C1D" * " weight=10", */ -"194.150.168.79:11112 orport=11111 id=29F1020B94BE25E6BE1AD13E93CE19D2131B487C" -" weight=10", +/* Fallback was on 0.2.8.6 list, but went down before 0.2.9 + * "194.150.168.79:11112 orport=11111 id=29F1020B94BE25E6BE1AD13E93CE19D2131B487C" + * " weight=10", + */ "144.76.26.175:9012 orport=9011 id=2BA2C8E96B2590E1072AECE2BDB5C48921BF8510" " weight=10", "62.210.124.124:9130 orport=9101 id=2EBD117806EE43C3CC885A8F1E4DC60F207E7D3E" @@ -84,8 +88,10 @@ URL: https:onionoo.torproject.orguptime?first_seen_days=7-&flag=V2Dir&type=relay "212.51.134.123:9030 orport=9001 id=50586E25BE067FD1F739998550EDDCB1A14CA5B2" " ipv6=[2a02:168:6e00:0:3a60:77ff:fe9c:8bd1]:9001" " weight=10", -"5.175.233.86:80 orport=443 id=5525D0429BFE5DC4F1B0E9DE47A4CFA169661E33" -" weight=10", +/* Fallback was on 0.2.8.6 list, but changed IPv4 before 0.2.9 + * "5.175.233.86:80 orport=443 id=5525D0429BFE5DC4F1B0E9DE47A4CFA169661E33" + * " weight=10", + */ "94.23.204.175:9030 orport=9001 id=5665A3904C89E22E971305EE8C1997BCA4123C69" " weight=10", "109.163.234.9:80 orport=443 id=5714542DCBEE1DD9864824723638FD44B2122CEA" @@ -109,8 +115,10 @@ URL: https:onionoo.torproject.orguptime?first_seen_days=7-&flag=V2Dir&type=relay " weight=10", "144.76.73.140:9030 orport=9001 id=6A640018EABF3DA9BAD9321AA37C2C87BBE1F907" " weight=10", -"94.126.23.174:9030 orport=9001 id=6FC6F08270D565BE89B7C819DD8E2D487397C073" -" weight=10", +/* Fallback was on 0.2.8.6 list, but went down before 0.2.9 + * "94.126.23.174:9030 orport=9001 id=6FC6F08270D565BE89B7C819DD8E2D487397C073" + * " weight=10", + */ "176.31.191.26:9030 orport=9001 id=7350AB9ED7568F22745198359373C04AC783C37C" " weight=10", "46.101.237.246:9030 orport=9001 id=75F1992FD3F403E9C082A5815EB5D12934CDF46C" @@ -166,9 +174,11 @@ URL: https:onionoo.torproject.orguptime?first_seen_days=7-&flag=V2Dir&type=relay " weight=10", "46.165.230.5:80 orport=443 id=A0F06C2FADF88D3A39AA3072B406F09D7095AC9E" " weight=10", -"171.25.193.77:80 orport=443 id=A10C4F666D27364036B562823E5830BC448E046A" -" ipv6=[2001:67c:289c:3::77]:443" -" weight=10", +/* Fallback was on 0.2.8.6 list, but went down before 0.2.9 + * "171.25.193.77:80 orport=443 id=A10C4F666D27364036B562823E5830BC448E046A" + * " ipv6=[2001:67c:289c:3::77]:443" + * " weight=10", + */ "176.9.5.116:9030 orport=9001 id=A1EB8D8F1EE28DB98BBB1EAA3B4BEDD303BAB911" " weight=10", "192.34.63.137:9030 orport=443 id=ABCB4965F1FEE193602B50A365425105C889D3F8" @@ -240,13 +250,17 @@ URL: https:onionoo.torproject.orguptime?first_seen_days=7-&flag=V2Dir&type=relay " weight=10", "5.34.183.205:80 orport=443 id=DDD7871C1B7FA32CB55061E08869A236E61BDDF8" " weight=10", -"195.191.233.221:80 orport=443 id=DE134FC8E5CC4EC8A5DE66934E70AC9D70267197" -" weight=10", +/* Fallback was on 0.2.8.6 list, but went down before 0.2.9 + * "195.191.233.221:80 orport=443 id=DE134FC8E5CC4EC8A5DE66934E70AC9D70267197" + * " weight=10", + */ "46.252.26.2:45212 orport=49991 id=E589316576A399C511A9781A73DA4545640B479D" " weight=10", -"176.31.180.157:143 orport=22 id=E781F4EC69671B3F1864AE2753E0890351506329" -" ipv6=[2001:41d0:8:eb9d::1]:22" -" weight=10", +/* Fallback was on 0.2.8.6 list, but went down before 0.2.9 + * "176.31.180.157:143 orport=22 id=E781F4EC69671B3F1864AE2753E0890351506329" + * " ipv6=[2001:41d0:8:eb9d::1]:22" + * " weight=10", + */ "131.188.40.188:443 orport=80 id=EBE718E1A49EE229071702964F8DB1F318075FF8" " weight=10", "91.219.236.222:80 orport=443 id=EC413181CEB1C8EDC17608BBB177CD5FD8535E99" @@ -256,8 +270,10 @@ URL: https:onionoo.torproject.orguptime?first_seen_days=7-&flag=V2Dir&type=relay " weight=10", "46.101.143.173:80 orport=443 id=F960DF50F0FD4075AC9B505C1D4FFC8384C490FB" " weight=10", -"195.154.8.111:80 orport=443 id=FCB6695F8F2DC240E974510A4B3A0F2B12AB5B64" -" weight=10", +/* Fallback was on 0.2.8.6 list, but changed IPv4 before 0.2.9 + * "195.154.8.111:80 orport=443 id=FCB6695F8F2DC240E974510A4B3A0F2B12AB5B64" + * " weight=10", + */ "192.187.124.98:9030 orport=9001 id=FD1871854BFC06D7B02F10742073069F0528B5CC" " weight=10", "193.11.164.243:9030 orport=9001 id=FFA72BD683BC2FCF988356E6BEC1E490F313FB07"

1 0