January 2017 - tor-commits - lists.torproject.org

[tor-browser-bundle/master] Bug 20989: Browser sandbox profile is too restrictive on OSX 10.12.2
by gk＠torproject.org 18 Jan '17

18 Jan '17

commit f55cbeea243675db8acf1015ca7e1ceed39f0933 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Tue Jan 17 10:27:25 2017 -0500 Bug 20989: Browser sandbox profile is too restrictive on OSX 10.12.2 Allow full read access to all files under /usr/lib. Allow full read access to /Library/Preferences/com.apple.ViewBridge.plist. Allow writes to TorBrowser-Data/Browser/profiles.ini (otherwise, a new browser profile is created each time the browser is opened). --- Bundle-Data/mac-sandbox/tb.sb | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/Bundle-Data/mac-sandbox/tb.sb b/Bundle-Data/mac-sandbox/tb.sb index eda7a1f..385e914 100644 --- a/Bundle-Data/mac-sandbox/tb.sb +++ b/Bundle-Data/mac-sandbox/tb.sb @@ -28,6 +28,7 @@ (allow file-read* (path "/Library/Preferences/com.apple.HIToolbox.plist") + (path "/Library/Preferences/com.apple.ViewBridge.plist") (path "/Library/Preferences/.GlobalPreferences.plist") (path "/dev/random") (path "/dev/urandom") @@ -41,6 +42,7 @@ (subpath "/Library/Fonts") (subpath "/System") (subpath "/private/var/folders") + (subpath "/usr/lib") (subpath "/usr/share") (home-subpath "/Downloads") (home-subpath "/Library/Input Methods") @@ -66,7 +68,6 @@ (path "/private/var/db/.AppleSetupDone") (path "/tmp") (path "/var") - (subpath "/usr/lib") (torbrowser-data-dir-path "/Tor/control.socket") (torbrowser-data-dir-path "/Tor/socks.socket") (path-regex "/private/tmp/Tor[-0-9]*/control.socket") @@ -86,11 +87,6 @@ (path "/Library/Preferences/.GlobalPreferences.plist") ) -; Disallow writes to the profiles ini file. -(deny file-write* - (torbrowser-data-dir-subpath "/Browser/profiles.ini") -) - (allow iokit-open) (allow ipc-posix-shm

1 0

[sandboxed-tor-browser/master] Bump the version to 0.0.4-dev, so I can do development again.
by yawning＠torproject.org 18 Jan '17

18 Jan '17

commit 6477aea9f9918d7a50a23196c77c3b42a96bdb2c Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Wed Jan 18 20:15:49 2017 +0000 Bump the version to 0.0.4-dev, so I can do development again. --- ChangeLog | 2 ++ data/version | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 3a57898..9557a1d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,5 @@ +Changes in version 0.0.4 - UNRELEASED: + Changes in version 0.0.3 - 2017-01-18: * Bug 21057: Change the metadata URL(s) for the stable bundle. * Bug 21184: Do a better job of killing/cleaning up bwrap children. diff --git a/data/version b/data/version index bcab45a..c08daab 100644 --- a/data/version +++ b/data/version @@ -1 +1 @@ -0.0.3 +0.0.4-dev

1 0

[tor/master] Merge remote-tracking branch 'dgoulet/bug21062_030_01'
by nickm＠torproject.org 18 Jan '17

18 Jan '17

commit e167a0e17d9211205651b07b65b0e83695bf6cf1 Merge: 31dd7de 0069d14 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 18 15:11:36 2017 -0500 Merge remote-tracking branch 'dgoulet/bug21062_030_01' changes/bug21062 | 4 ++++ src/or/circuitbuild.c | 2 +- src/or/circuitstats.c | 22 +++++++++++----------- src/or/circuitstats.h | 2 +- src/or/circuituse.c | 4 ++-- src/or/config.c | 2 +- 6 files changed, 20 insertions(+), 16 deletions(-)

1 0

[tor/master] circuit: Make circuit_build_times_disabled take an or_options_t
by nickm＠torproject.org 18 Jan '17

18 Jan '17

commit 0069d14753e6050cc20ccd2009b3e04ab8426497 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Jan 18 12:53:01 2017 -0500 circuit: Make circuit_build_times_disabled take an or_options_t That way, when we are parsing the options and LearnCircuitBuildTimeout is set to 0, we don't assert trying to get the options list with get_options(). Fixes #21062 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/bug21062 | 4 ++++ src/or/circuitbuild.c | 2 +- src/or/circuitstats.c | 22 +++++++++++----------- src/or/circuitstats.h | 2 +- src/or/circuituse.c | 4 ++-- src/or/config.c | 2 +- 6 files changed, 20 insertions(+), 16 deletions(-) diff --git a/changes/bug21062 b/changes/bug21062 new file mode 100644 index 0000000..3297e1e --- /dev/null +++ b/changes/bug21062 @@ -0,0 +1,4 @@ + o Minor bugfixex (config): + - Don't assert when trying to get the options list when + LearnCircuitBuildTimeout is set to 0 and we are actually currently + parsing the options. Fixes #21062; bugfix on tor-0.2.9.3-alpha. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 55929c1..d4e3019 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1017,7 +1017,7 @@ circuit_send_next_onion_skin(origin_circuit_t *circ) "Assuming clock jump. Purpose %d (%s)", timediff, circ->base_.purpose, circuit_purpose_to_string(circ->base_.purpose)); - } else if (!circuit_build_times_disabled()) { + } else if (!circuit_build_times_disabled(get_options())) { /* Only count circuit times if the network is live */ if (circuit_build_times_network_check_live( get_circuit_build_times())) { diff --git a/src/or/circuitstats.c b/src/or/circuitstats.c index 6cb99e4..48cb89d 100644 --- a/src/or/circuitstats.c +++ b/src/or/circuitstats.c @@ -105,12 +105,11 @@ get_circuit_build_timeout_ms(void) * 6. If we are configured in Single Onion mode */ int -circuit_build_times_disabled(void) +circuit_build_times_disabled(const or_options_t *options) { if (unit_tests) { return 0; } else { - const or_options_t *options = get_options(); int consensus_disabled = networkstatus_get_param(NULL, "cbtdisabled", 0, 0, 1); int config_disabled = !options->LearnCircuitBuildTimeout; @@ -417,7 +416,7 @@ circuit_build_times_new_consensus_params(circuit_build_times_t *cbt, * update if we aren't. */ - if (!circuit_build_times_disabled()) { + if (!circuit_build_times_disabled(get_options())) { num = circuit_build_times_recent_circuit_count(ns); if (num > 0) { @@ -493,14 +492,15 @@ static double circuit_build_times_get_initial_timeout(void) { double timeout; + const or_options_t *options = get_options(); /* * Check if we have LearnCircuitBuildTimeout, and if we don't, * always use CircuitBuildTimeout, no questions asked. */ - if (!unit_tests && get_options()->CircuitBuildTimeout) { - timeout = get_options()->CircuitBuildTimeout*1000; - if (!circuit_build_times_disabled() && + if (!unit_tests && options->CircuitBuildTimeout) { + timeout = options->CircuitBuildTimeout*1000; + if (!circuit_build_times_disabled(options) && timeout < circuit_build_times_min_timeout()) { log_warn(LD_CIRC, "Config CircuitBuildTimeout too low. Setting to %ds", circuit_build_times_min_timeout()/1000); @@ -542,7 +542,7 @@ circuit_build_times_init(circuit_build_times_t *cbt) * Check if we really are using adaptive timeouts, and don't keep * track of this stuff if not. */ - if (!circuit_build_times_disabled()) { + if (!circuit_build_times_disabled(get_options())) { cbt->liveness.num_recent_circs = circuit_build_times_recent_circuit_count(NULL); cbt->liveness.timeouts_after_firsthop = @@ -906,7 +906,7 @@ circuit_build_times_parse_state(circuit_build_times_t *cbt, int err = 0; circuit_build_times_init(cbt); - if (circuit_build_times_disabled()) { + if (circuit_build_times_disabled(get_options())) { return 0; } @@ -1507,7 +1507,7 @@ circuit_build_times_count_close(circuit_build_times_t *cbt, int did_onehop, time_t start_time) { - if (circuit_build_times_disabled()) { + if (circuit_build_times_disabled(get_options())) { cbt->close_ms = cbt->timeout_ms = circuit_build_times_get_initial_timeout(); return 0; @@ -1538,7 +1538,7 @@ void circuit_build_times_count_timeout(circuit_build_times_t *cbt, int did_onehop) { - if (circuit_build_times_disabled()) { + if (circuit_build_times_disabled(get_options())) { cbt->close_ms = cbt->timeout_ms = circuit_build_times_get_initial_timeout(); return; @@ -1612,7 +1612,7 @@ circuit_build_times_set_timeout(circuit_build_times_t *cbt) /* * Just return if we aren't using adaptive timeouts */ - if (circuit_build_times_disabled()) + if (circuit_build_times_disabled(get_options())) return; if (!circuit_build_times_set_timeout_worker(cbt)) diff --git a/src/or/circuitstats.h b/src/or/circuitstats.h index 72b1609..2391027 100644 --- a/src/or/circuitstats.h +++ b/src/or/circuitstats.h @@ -17,7 +17,7 @@ circuit_build_times_t *get_circuit_build_times_mutable(void); double get_circuit_build_close_time_ms(void); double get_circuit_build_timeout_ms(void); -int circuit_build_times_disabled(void); +int circuit_build_times_disabled(const or_options_t *options); int circuit_build_times_enough_to_compute(const circuit_build_times_t *cbt); void circuit_build_times_update_state(const circuit_build_times_t *cbt, or_state_t *state); diff --git a/src/or/circuituse.c b/src/or/circuituse.c index ecd35af..72293f5 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -1140,7 +1140,7 @@ needs_circuits_for_build(int num) { if (router_have_consensus_path() != CONSENSUS_PATH_UNKNOWN) { if (num < CBT_MAX_UNUSED_OPEN_CIRCUITS && - !circuit_build_times_disabled() && + !circuit_build_times_disabled(get_options()) && circuit_build_times_needs_circuits_now(get_circuit_build_times())) { return 1; } @@ -1400,7 +1400,7 @@ circuit_expire_old_circuits_clientside(void) cutoff = now; last_expired_clientside_circuits = now.tv_sec; - if (! circuit_build_times_disabled() && + if (! circuit_build_times_disabled(get_options()) && circuit_build_times_needs_circuits(get_circuit_build_times())) { /* Circuits should be shorter lived if we need more of them * for learning a good build timeout */ diff --git a/src/or/config.c b/src/or/config.c index c4e9ca2..c5ce728 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -3545,7 +3545,7 @@ options_validate(or_options_t *old_options, or_options_t *options, int severity = LOG_NOTICE; /* Be a little quieter if we've deliberately disabled * LearnCircuitBuildTimeout. */ - if (circuit_build_times_disabled()) { + if (circuit_build_times_disabled(options)) { severity = LOG_INFO; } log_fn(severity, LD_CONFIG, "You disabled LearnCircuitBuildTimeout, but "

1 0

[tor/master] Merge branch 'bug20684_030_01'
by nickm＠torproject.org 18 Jan '17

18 Jan '17

commit 31dd7dec9a9ca6cf6e146fc429ee6be8bcd2042d Merge: 9d47f4d e0e729d Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 18 15:08:42 2017 -0500 Merge branch 'bug20684_030_01' src/or/config.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)

1 0

[tor/master] put units in constant names for DIRCACHE_MEN_MEM*
by nickm＠torproject.org 18 Jan '17

18 Jan '17

commit e0e729d4b52ef4a14e63e194ff0a47a0aa0d0f99 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 18 15:08:10 2017 -0500 put units in constant names for DIRCACHE_MEN_MEM* --- src/or/config.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index e83eb54..2584fe6 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -4350,8 +4350,8 @@ compute_real_max_mem_in_queues(const uint64_t val, int log_guess) } /* If we have less than 300 MB suggest disabling dircache */ -#define DIRCACHE_MIN_MEM 300 -#define DIRCACHE_MIN_MB_MEM (DIRCACHE_MIN_MEM*ONE_MEGABYTE) +#define DIRCACHE_MIN_MEM_MB 300 +#define DIRCACHE_MIN_MEM_BYTES (DIRCACHE_MIN_MEM_MB*ONE_MEGABYTE) #define STRINGIFY(val) #val /** Create a warning message for emitting if we are a dircache but may not have @@ -4371,21 +4371,21 @@ have_enough_mem_for_dircache(const or_options_t *options, size_t total_mem, } } if (options->DirCache) { - if (total_mem < DIRCACHE_MIN_MB_MEM) { + if (total_mem < DIRCACHE_MIN_MEM_BYTES) { if (options->BridgeRelay) { *msg = tor_strdup("Running a Bridge with less than " - STRINGIFY(DIRCACHE_MIN_MEM) " MB of memory is not " + STRINGIFY(DIRCACHE_MIN_MEM_MB) " MB of memory is not " "recommended."); } else { *msg = tor_strdup("Being a directory cache (default) with less than " - STRINGIFY(DIRCACHE_MIN_MEM) " MB of memory is not " + STRINGIFY(DIRCACHE_MIN_MEM_MB) " MB of memory is not " "recommended and may consume most of the available " "resources, consider disabling this functionality by " "setting the DirCache option to 0."); } } } else { - if (total_mem >= DIRCACHE_MIN_MB_MEM) { + if (total_mem >= DIRCACHE_MIN_MEM_BYTES) { *msg = tor_strdup("DirCache is disabled and we are configured as a " "relay. This may disqualify us from becoming a guard in the " "future.");

1 0

[tor/master] Rename DIRCACHE_MIN_BANDWIDTH and DIRCACHE_MIN_MB_BANDWIDTH
by nickm＠torproject.org 18 Jan '17

18 Jan '17

commit 426ceb41ef8a583cedaac5df68400c201aa30d8f Author: Neel Chauhan <neel(a)neelc.org> Date: Sat Dec 24 07:26:37 2016 -0500 Rename DIRCACHE_MIN_BANDWIDTH and DIRCACHE_MIN_MB_BANDWIDTH Renamed to DIRCACHE_MIN_MEM and DIRCACHE_MIN_MB_MEM. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/config.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index c4e9ca2..e83eb54 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -4350,8 +4350,8 @@ compute_real_max_mem_in_queues(const uint64_t val, int log_guess) } /* If we have less than 300 MB suggest disabling dircache */ -#define DIRCACHE_MIN_MB_BANDWIDTH 300 -#define DIRCACHE_MIN_BANDWIDTH (DIRCACHE_MIN_MB_BANDWIDTH*ONE_MEGABYTE) +#define DIRCACHE_MIN_MEM 300 +#define DIRCACHE_MIN_MB_MEM (DIRCACHE_MIN_MEM*ONE_MEGABYTE) #define STRINGIFY(val) #val /** Create a warning message for emitting if we are a dircache but may not have @@ -4371,21 +4371,21 @@ have_enough_mem_for_dircache(const or_options_t *options, size_t total_mem, } } if (options->DirCache) { - if (total_mem < DIRCACHE_MIN_BANDWIDTH) { + if (total_mem < DIRCACHE_MIN_MB_MEM) { if (options->BridgeRelay) { *msg = tor_strdup("Running a Bridge with less than " - STRINGIFY(DIRCACHE_MIN_MB_BANDWIDTH) " MB of memory is " - "not recommended."); + STRINGIFY(DIRCACHE_MIN_MEM) " MB of memory is not " + "recommended."); } else { *msg = tor_strdup("Being a directory cache (default) with less than " - STRINGIFY(DIRCACHE_MIN_MB_BANDWIDTH) " MB of memory is " - "not recommended and may consume most of the available " + STRINGIFY(DIRCACHE_MIN_MEM) " MB of memory is not " + "recommended and may consume most of the available " "resources, consider disabling this functionality by " "setting the DirCache option to 0."); } } } else { - if (total_mem >= DIRCACHE_MIN_BANDWIDTH) { + if (total_mem >= DIRCACHE_MIN_MB_MEM) { *msg = tor_strdup("DirCache is disabled and we are configured as a " "relay. This may disqualify us from becoming a guard in the " "future.");

1 0

[sandboxed-tor-browser/master] Remove suggestions to use other projects. No functional changes.
by yawning＠torproject.org 18 Jan '17

18 Jan '17

commit 851b16c0ebe52285de5aa8f1e0ef8e59392dfa11 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Wed Jan 18 19:31:29 2017 +0000 Remove suggestions to use other projects. No functional changes. --- README.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/README.md b/README.md index 1b8d51b..53a885f 100644 --- a/README.md +++ b/README.md @@ -10,9 +10,7 @@ works on Linux, and will NEVER support anything else since sandboxing is OS specific. There are several unresolved issues that affect security and fingerprinting. -Do not assume that this is perfect, merely "an improvement over nothing". If -you require strong security, consider combining the sandbox with something like -Qubes, Subgraph or Tails. +Do not assume that this is perfect, merely "an improvement over nothing". Runtime dependencies:

1 0

[sandboxed-tor-browser/master] Do the release ritual for sandboxed-tor-browser-0.0.3.
by yawning＠torproject.org 18 Jan '17

18 Jan '17

commit 220a347dcea5b3cb4fe4c286c93472f7f23c4b43 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Wed Jan 18 20:03:11 2017 +0000 Do the release ritual for sandboxed-tor-browser-0.0.3. --- ChangeLog | 2 +- data/version | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index cc700f1..3a57898 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,4 @@ -Changes in version 0.0.3 - UNRELEASED: +Changes in version 0.0.3 - 2017-01-18: * Bug 21057: Change the metadata URL(s) for the stable bundle. * Bug 21184: Do a better job of killing/cleaning up bwrap children. * Bug 21093: Go back to using gosecco for seccomp rule compilation. diff --git a/data/version b/data/version index b470f6b..bcab45a 100644 --- a/data/version +++ b/data/version @@ -1 +1 @@ -0.0.3-dev +0.0.3

1 0

[tor/master] Fix a memory leak in bench.c
by nickm＠torproject.org 18 Jan '17

18 Jan '17

commit 9d47f4d298553cbbafa5afb65e4972bff0b3024a Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 18 14:29:52 2017 -0500 Fix a memory leak in bench.c --- src/test/bench.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/test/bench.c b/src/test/bench.c index 30984fd..99bc686 100644 --- a/src/test/bench.c +++ b/src/test/bench.c @@ -120,7 +120,7 @@ bench_onion_TAP(void) uint64_t start, end; char os[TAP_ONIONSKIN_CHALLENGE_LEN]; char or[TAP_ONIONSKIN_REPLY_LEN]; - crypto_dh_t *dh_out; + crypto_dh_t *dh_out = NULL; key = crypto_pk_new(); key2 = crypto_pk_new(); @@ -175,6 +175,7 @@ bench_onion_TAP(void) NANOCOUNT(start, end, iters)/1e3); done: + crypto_dh_free(dh_out); crypto_pk_free(key); crypto_pk_free(key2); }

1 0