November 2017 - tor-commits - lists.torproject.org

[tor/maint-0.3.2] Fix mock_crypto_pk_public_checksig__nocheck() to handle short RSA keys
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit a7ca71cf6b2fb46b049442569188ce046cfd6c34 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Nov 11 14:42:39 2017 -0500 Fix mock_crypto_pk_public_checksig__nocheck() to handle short RSA keys This function -- a mock replacement used only for fuzzing -- would have a buffer overflow if it got an RSA key whose modulus was under 20 bytes long. Fortunately, Tor itself does not appear to have a bug here. Fixes bug 24247; bugfix on 0.3.0.3-alpha when fuzzing was introduced. Found by OSS-Fuzz; this is OSS-Fuzz issue 4177. --- changes/bug24247 | 6 ++++++ src/test/fuzz/fuzzing_common.c | 5 +++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/changes/bug24247 b/changes/bug24247 new file mode 100644 index 000000000..1f4ddcdde --- /dev/null +++ b/changes/bug24247 @@ -0,0 +1,6 @@ + o Minor bugfixes (fuzzing): + - Fix a bug in our fuzzing mock replacement for crypto_pk_checksig(), to + correctly handle cases where a caller gives it an RSA key of under 160 + bits. (This is not actually a bug in Tor itself, but wrather in our + fuzzing code.) Fixes bug 24247; bugfix on 0.3.0.3-alpha. + Found by OSS-Fuzz as issue 4177. diff --git a/src/test/fuzz/fuzzing_common.c b/src/test/fuzz/fuzzing_common.c index 7ebddde1a..1e98eb6c8 100644 --- a/src/test/fuzz/fuzzing_common.c +++ b/src/test/fuzz/fuzzing_common.c @@ -28,8 +28,9 @@ mock_crypto_pk_public_checksig__nocheck(const crypto_pk_t *env, char *to, (void)fromlen; /* We could look at from[0..fromlen-1] ... */ tor_assert(tolen >= crypto_pk_keysize(env)); - memset(to, 0x01, 20); - return 20; + size_t siglen = MIN(20, crypto_pk_keysize(env)); + memset(to, 0x01, siglen); + return (int)siglen; } static int

1 0

[tor/release-0.3.1] Stop relays calling directory_fetches_from_authorities on dir downloads
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit c86013291bd26f3497e9efcf96125342d97cba33 Author: teor <teor2345(a)gmail.com> Date: Mon Sep 11 14:21:48 2017 +1000 Stop relays calling directory_fetches_from_authorities on dir downloads This change refactors find_dl_schedule() to only call dependent functions as needed. In particular, directory_fetches_from_authorities() only needs to be called on clients. Stopping spurious directory_fetches_from_authorities() calls on every download on public relays has the following impacts: * fewer address resolution attempts, particularly those mentioned in 21789 * fewer descriptor rebuilds * fewer log messages, particularly those limited in 20610 Fixes 23470 in 0.2.8.1-alpha. The original bug was introduced in commit 35bbf2e as part of prop210. --- changes/bug23470 | 6 ++++++ src/or/directory.c | 22 +++++++++++----------- 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/changes/bug23470 b/changes/bug23470 new file mode 100644 index 000000000..33367b3a3 --- /dev/null +++ b/changes/bug23470 @@ -0,0 +1,6 @@ + o Minor bugfix (relay address resolution): + - Avoid unnecessary calls to directory_fetches_from_authorities() + on relays. This avoids spurious address resolutions and + descriptor rebuilds. This is a mitigation for 21789. The original + bug was introduced in commit 35bbf2e as part of prop210. + Fixes 23470 in 0.2.8.1-alpha. diff --git a/src/or/directory.c b/src/or/directory.c index fce48c6e9..f285e4c6e 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -3703,26 +3703,24 @@ connection_dir_finished_connecting(dir_connection_t *conn) STATIC const smartlist_t * find_dl_schedule(download_status_t *dls, const or_options_t *options) { - const int dir_server = dir_server_mode(options); - const int multi_d = networkstatus_consensus_can_use_multiple_directories( - options); - const int we_are_bootstrapping = networkstatus_consensus_is_bootstrapping( - time(NULL)); - const int use_fallbacks = networkstatus_consensus_can_use_extra_fallbacks( - options); switch (dls->schedule) { case DL_SCHED_GENERIC: - if (dir_server) { + /* Any other directory document */ + if (dir_server_mode(options)) { + /* A directory authority or directory mirror */ return options->TestingServerDownloadSchedule; } else { return options->TestingClientDownloadSchedule; } case DL_SCHED_CONSENSUS: - if (!multi_d) { + if (!networkstatus_consensus_can_use_multiple_directories(options)) { + /* A public relay */ return options->TestingServerConsensusDownloadSchedule; } else { - if (we_are_bootstrapping) { - if (!use_fallbacks) { + /* A client or bridge */ + if (networkstatus_consensus_is_bootstrapping(time(NULL))) { + /* During bootstrapping */ + if (!networkstatus_consensus_can_use_extra_fallbacks(options)) { /* A bootstrapping client without extra fallback directories */ return options->ClientBootstrapConsensusAuthorityOnlyDownloadSchedule; @@ -3738,6 +3736,8 @@ find_dl_schedule(download_status_t *dls, const or_options_t *options) options->ClientBootstrapConsensusFallbackDownloadSchedule; } } else { + /* A client with a reasonably live consensus, with or without + * certificates */ return options->TestingClientConsensusDownloadSchedule; } }

1 0

[tor/release-0.3.1] Merge branch 'maint-0.3.1' into release-0.3.1
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit 5355b99dc0f9e4c69213dc3db244c01b65e80384 Merge: 5c9841166 91188540a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:18:02 2017 -0500 Merge branch 'maint-0.3.1' into release-0.3.1 changes/bug23470 | 6 ++++++ src/or/directory.c | 22 +++++++++++----------- 2 files changed, 17 insertions(+), 11 deletions(-)

1 0

[tor/release-0.3.1] Merge branch 'maint-0.3.0' into maint-0.3.1
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit 91188540af1ce185e7aa7ab19467a42bc9ea7722 Merge: 89b9951ec 16bdb9e36 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:18:02 2017 -0500 Merge branch 'maint-0.3.0' into maint-0.3.1 changes/bug23470 | 6 ++++++ src/or/directory.c | 22 +++++++++++----------- 2 files changed, 17 insertions(+), 11 deletions(-)

1 0

[tor/release-0.3.2] Merge remote-tracking branch 'teor/bug23470-029' into maint-0.2.9
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit ab415ae95081ab662225a4600b93f66e7b4baf7a Merge: 666653758 c86013291 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:17:58 2017 -0500 Merge remote-tracking branch 'teor/bug23470-029' into maint-0.2.9 changes/bug23470 | 6 ++++++ src/or/directory.c | 22 +++++++++++----------- 2 files changed, 17 insertions(+), 11 deletions(-)

1 0

[tor/release-0.3.0] Merge branch 'maint-0.2.9' into maint-0.3.0
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit 16bdb9e365ff43885a4d3b3478ebb224f5a26a33 Merge: 9092e9019 ab415ae95 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:18:02 2017 -0500 Merge branch 'maint-0.2.9' into maint-0.3.0 changes/bug23470 | 6 ++++++ src/or/directory.c | 22 +++++++++++----------- 2 files changed, 17 insertions(+), 11 deletions(-)

1 0

[tor/release-0.3.0] Merge remote-tracking branch 'teor/bug23470-029' into maint-0.2.9
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit ab415ae95081ab662225a4600b93f66e7b4baf7a Merge: 666653758 c86013291 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:17:58 2017 -0500 Merge remote-tracking branch 'teor/bug23470-029' into maint-0.2.9 changes/bug23470 | 6 ++++++ src/or/directory.c | 22 +++++++++++----------- 2 files changed, 17 insertions(+), 11 deletions(-)

1 0

[tor/release-0.3.2] Merge branch 'maint-0.3.1' into maint-0.3.2
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit 6f9ab69b6dbaf99d7dedaa5714b2fc69e51120ca Merge: 7dddef2a7 91188540a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:18:02 2017 -0500 Merge branch 'maint-0.3.1' into maint-0.3.2

1 0

[tor/release-0.3.0] Merge branch 'maint-0.3.0' into release-0.3.0
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit f5bd987c7563e024d68cb5e49c181ca8ef37a774 Merge: 100ff4a92 16bdb9e36 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:18:02 2017 -0500 Merge branch 'maint-0.3.0' into release-0.3.0 changes/bug23470 | 6 ++++++ src/or/directory.c | 22 +++++++++++----------- 2 files changed, 17 insertions(+), 11 deletions(-)

1 0

[tor/release-0.3.1] Merge branch 'maint-0.2.9' into maint-0.3.0
by nickm＠torproject.org 13 Nov '17

13 Nov '17

commit 16bdb9e365ff43885a4d3b3478ebb224f5a26a33 Merge: 9092e9019 ab415ae95 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 13 11:18:02 2017 -0500 Merge branch 'maint-0.2.9' into maint-0.3.0 changes/bug23470 | 6 ++++++ src/or/directory.c | 22 +++++++++++----------- 2 files changed, 17 insertions(+), 11 deletions(-)

1 0