November 2017 - tor-commits - lists.torproject.org

[tor/maint-0.3.2] Assign Exit flag only for ports 80 and 443
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit 8dff23eb34cf63278f8c78eb965c77fe215b860c Author: Roger Dingledine <arma(a)torproject.org> Date: Sun Sep 24 19:27:07 2017 -0400 Assign Exit flag only for ports 80 and 443 Make the "Exit" flag assignment only depend on whether the exit policy allows connections to ports 80 and 443. Previously relays would get the Exit flag if they allowed connections to one of these ports and also port 6667. Resolves ticket 23637. --- changes/ticket23637 | 5 +++++ src/or/policies.c | 13 ++++--------- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/changes/ticket23637 b/changes/ticket23637 new file mode 100644 index 000000000..8687ab1a0 --- /dev/null +++ b/changes/ticket23637 @@ -0,0 +1,5 @@ + o Minor features: + - Make the "Exit" flag assignment only depend on whether the exit + policy allows connections to ports 80 and 443. Previously relays + would get the Exit flag if they allowed connections to one of + these ports and also port 6667. Resolves ticket 23637. diff --git a/src/or/policies.c b/src/or/policies.c index 4c24bfbc3..78451db8f 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -2186,21 +2186,16 @@ exit_policy_is_general_exit_helper(smartlist_t *policy, int port) } /** Return true iff <b>ri</b> is "useful as an exit node", meaning - * it allows exit to at least one /8 address space for at least - * two of ports 80, 443, and 6667. */ + * it allows exit to at least one /8 address space for each of ports 80 + * and 443. */ int exit_policy_is_general_exit(smartlist_t *policy) { - static const int ports[] = { 80, 443, 6667 }; - int n_allowed = 0; - int i; if (!policy) /*XXXX disallow NULL policies? */ return 0; - for (i = 0; i < 3; ++i) { - n_allowed += exit_policy_is_general_exit_helper(policy, ports[i]); - } - return n_allowed >= 2; + return (exit_policy_is_general_exit_helper(policy, 80) && + exit_policy_is_general_exit_helper(policy, 443)); } /** Return false if <b>policy</b> might permit access to some addr:port;

1 0

[tor/release-0.3.2] Merge branch 'maint-0.3.2' into release-0.3.2
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit a71552268dc5918d5c1b23eca45eb07330a68f54 Merge: 5ea9a48ae 3300a6e93 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:20:23 2017 -0500 Merge branch 'maint-0.3.2' into release-0.3.2 changes/ticket23637 | 5 +++++ src/or/policies.c | 13 ++++--------- 2 files changed, 9 insertions(+), 9 deletions(-)

1 0

[tor/release-0.3.2] Merge remote-tracking branch 'arma/ticket23637' into maint-0.3.2
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit 3300a6e93aa9e6adfe9c6bb7949b3774e98b94f8 Merge: cf1e6ad2d 8dff23eb3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:20:20 2017 -0500 Merge remote-tracking branch 'arma/ticket23637' into maint-0.3.2 changes/ticket23637 | 5 +++++ src/or/policies.c | 13 ++++--------- 2 files changed, 9 insertions(+), 9 deletions(-)

1 0

[tor/release-0.3.2] Merge branch 'maint-0.3.2' into release-0.3.2
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit 5ea9a48ae7acd0d4c6180d13e71570dbb9ef6a6f Merge: 4bd9c5323 cf1e6ad2d Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:19:12 2017 -0500 Merge branch 'maint-0.3.2' into release-0.3.2 changes/bug24247 | 6 ++++++ src/test/fuzz/fuzzing_common.c | 5 +++-- 2 files changed, 9 insertions(+), 2 deletions(-)

1 0

[tor/master] Merge branch 'bug24247_032' into maint-0.3.2
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit cf1e6ad2d72696bc788b02c0f51581361f271d67 Merge: 6f9ab69b6 a7ca71cf6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:19:09 2017 -0500 Merge branch 'bug24247_032' into maint-0.3.2 changes/bug24247 | 6 ++++++ src/test/fuzz/fuzzing_common.c | 5 +++-- 2 files changed, 9 insertions(+), 2 deletions(-)

1 0

[tor/release-0.3.2] Merge branch 'bug24247_032' into maint-0.3.2
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit cf1e6ad2d72696bc788b02c0f51581361f271d67 Merge: 6f9ab69b6 a7ca71cf6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:19:09 2017 -0500 Merge branch 'bug24247_032' into maint-0.3.2 changes/bug24247 | 6 ++++++ src/test/fuzz/fuzzing_common.c | 5 +++-- 2 files changed, 9 insertions(+), 2 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.3.2'
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit e209e8e3c1fa524a994e02562878f4c738b0e54e Merge: b9da340cd cf1e6ad2d Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:19:12 2017 -0500 Merge branch 'maint-0.3.2'

1 0

[tor/release-0.3.2] Fix mock_crypto_pk_public_checksig__nocheck() to handle short RSA keys
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit a7ca71cf6b2fb46b049442569188ce046cfd6c34 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Nov 11 14:42:39 2017 -0500 Fix mock_crypto_pk_public_checksig__nocheck() to handle short RSA keys This function -- a mock replacement used only for fuzzing -- would have a buffer overflow if it got an RSA key whose modulus was under 20 bytes long. Fortunately, Tor itself does not appear to have a bug here. Fixes bug 24247; bugfix on 0.3.0.3-alpha when fuzzing was introduced. Found by OSS-Fuzz; this is OSS-Fuzz issue 4177. --- changes/bug24247 | 6 ++++++ src/test/fuzz/fuzzing_common.c | 5 +++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/changes/bug24247 b/changes/bug24247 new file mode 100644 index 000000000..1f4ddcdde --- /dev/null +++ b/changes/bug24247 @@ -0,0 +1,6 @@ + o Minor bugfixes (fuzzing): + - Fix a bug in our fuzzing mock replacement for crypto_pk_checksig(), to + correctly handle cases where a caller gives it an RSA key of under 160 + bits. (This is not actually a bug in Tor itself, but wrather in our + fuzzing code.) Fixes bug 24247; bugfix on 0.3.0.3-alpha. + Found by OSS-Fuzz as issue 4177. diff --git a/src/test/fuzz/fuzzing_common.c b/src/test/fuzz/fuzzing_common.c index 7ebddde1a..1e98eb6c8 100644 --- a/src/test/fuzz/fuzzing_common.c +++ b/src/test/fuzz/fuzzing_common.c @@ -28,8 +28,9 @@ mock_crypto_pk_public_checksig__nocheck(const crypto_pk_t *env, char *to, (void)fromlen; /* We could look at from[0..fromlen-1] ... */ tor_assert(tolen >= crypto_pk_keysize(env)); - memset(to, 0x01, 20); - return 20; + size_t siglen = MIN(20, crypto_pk_keysize(env)); + memset(to, 0x01, siglen); + return (int)siglen; } static int

1 0

[tor/maint-0.3.2] Merge branch 'bug24247_032' into maint-0.3.2
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit cf1e6ad2d72696bc788b02c0f51581361f271d67 Merge: 6f9ab69b6 a7ca71cf6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:19:09 2017 -0500 Merge branch 'bug24247_032' into maint-0.3.2 changes/bug24247 | 6 ++++++ src/test/fuzz/fuzzing_common.c | 5 +++-- 2 files changed, 9 insertions(+), 2 deletions(-)

1 0

[tor/maint-0.3.2] Fix mock_crypto_pk_public_checksig__nocheck() to handle short RSA keys
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit a7ca71cf6b2fb46b049442569188ce046cfd6c34 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Nov 11 14:42:39 2017 -0500 Fix mock_crypto_pk_public_checksig__nocheck() to handle short RSA keys This function -- a mock replacement used only for fuzzing -- would have a buffer overflow if it got an RSA key whose modulus was under 20 bytes long. Fortunately, Tor itself does not appear to have a bug here. Fixes bug 24247; bugfix on 0.3.0.3-alpha when fuzzing was introduced. Found by OSS-Fuzz; this is OSS-Fuzz issue 4177. --- changes/bug24247 | 6 ++++++ src/test/fuzz/fuzzing_common.c | 5 +++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/changes/bug24247 b/changes/bug24247 new file mode 100644 index 000000000..1f4ddcdde --- /dev/null +++ b/changes/bug24247 @@ -0,0 +1,6 @@ + o Minor bugfixes (fuzzing): + - Fix a bug in our fuzzing mock replacement for crypto_pk_checksig(), to + correctly handle cases where a caller gives it an RSA key of under 160 + bits. (This is not actually a bug in Tor itself, but wrather in our + fuzzing code.) Fixes bug 24247; bugfix on 0.3.0.3-alpha. + Found by OSS-Fuzz as issue 4177. diff --git a/src/test/fuzz/fuzzing_common.c b/src/test/fuzz/fuzzing_common.c index 7ebddde1a..1e98eb6c8 100644 --- a/src/test/fuzz/fuzzing_common.c +++ b/src/test/fuzz/fuzzing_common.c @@ -28,8 +28,9 @@ mock_crypto_pk_public_checksig__nocheck(const crypto_pk_t *env, char *to, (void)fromlen; /* We could look at from[0..fromlen-1] ... */ tor_assert(tolen >= crypto_pk_keysize(env)); - memset(to, 0x01, 20); - return 20; + size_t siglen = MIN(20, crypto_pk_keysize(env)); + memset(to, 0x01, siglen); + return (int)siglen; } static int

1 0