December 2017 - tor-commits - lists.torproject.org

[tor/master] Merge branch 'maint-0.3.2'
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit ce4a381935d9c0c2b4003a25fd611a11ada6a160 Merge: cef844d01 424ab08b5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:26:33 2017 -0500 Merge branch 'maint-0.3.2' "ours" to avoid version bump.

1 0

[tor/release-0.2.8] Use local descriptor object to exclude self in path selection
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 6ab07419c88e35c6d8610e20fb3cea16e39c8acd Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Nov 28 19:02:00 2017 -0500 Use local descriptor object to exclude self in path selection TROVE-2017-12. Severity: Medium When choosing a random node for a circuit, directly use our router descriptor to exclude ourself instead of the one in the global descriptor list. That list could be empty because tor could be downloading them which could lead to not excluding ourself. Closes #21534 --- changes/trove-2017-012-part1 | 6 ++++++ src/or/routerlist.c | 5 ++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/changes/trove-2017-012-part1 b/changes/trove-2017-012-part1 new file mode 100644 index 000000000..9fccc2cf6 --- /dev/null +++ b/changes/trove-2017-012-part1 @@ -0,0 +1,6 @@ + o Major bugfixes (security, relay): + - When running as a relay, make sure that we never build a path through + ourselves, even in the case where we have somehow lost the version of + our descriptor appearing in the consensus. Fixes part of bug 21534; + bugfix on 0.2.0.1-alpha. This issue is also tracked as TROVE-2017-012 + and CVE-2017-8822. diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 07e87724b..3bf1eb895 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -2411,7 +2411,10 @@ router_choose_random_node(smartlist_t *excludedsmartlist, }); } - if ((r = routerlist_find_my_routerinfo())) + /* If the node_t is not found we won't be to exclude ourself but we + * won't be able to pick ourself in router_choose_random_node() so + * this is fine to at least try with our routerinfo_t object. */ + if ((r = router_get_my_routerinfo())) routerlist_add_node_and_family(excludednodes, r); router_add_running_nodes_to_smartlist(sl, allow_invalid,

1 0

[tor/master] remove changes files that are going into 0.3.2.6-alpha or earlier.
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 699899cbff1aafe1f6d991f45843b2b4e395b05a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:31:23 2017 -0500 remove changes files that are going into 0.3.2.6-alpha or earlier. --- changes/bastet_v6 | 4 ---- changes/bug23681 | 5 ----- changes/bug23783 | 5 ----- changes/bug24050 | 5 ----- changes/bug24086 | 7 ------- changes/bug24099 | 4 ---- changes/bug24198 | 4 ---- changes/bug24313 | 5 ----- changes/ticket23856 | 4 ---- changes/ticket24315 | 3 --- changes/trove-2017-009 | 10 ---------- changes/trove-2017-010 | 6 ------ changes/trove-2017-011 | 8 -------- changes/trove-2017-012-part1 | 6 ------ changes/trove-2017-012-part2 | 5 ----- 15 files changed, 81 deletions(-) diff --git a/changes/bastet_v6 b/changes/bastet_v6 deleted file mode 100644 index ee4e2c809..000000000 --- a/changes/bastet_v6 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor features (directory authority): - - Add an IPv6 address for the "bastet" directory authority. - Closes ticket 24394. - diff --git a/changes/bug23681 b/changes/bug23681 deleted file mode 100644 index e317f36d5..000000000 --- a/changes/bug23681 +++ /dev/null @@ -1,5 +0,0 @@ - o Minor bugfixes (hidden service client): - - The introduction circuit was being timed out too quickly while waiting - for the rendezvous circuit to complete. Keep the intro circuit around - longer instead of timing out and reopening new ones constantly. Fixes - bug 23681; bugfix on 0.2.4.8-alpha. diff --git a/changes/bug23783 b/changes/bug23783 deleted file mode 100644 index 98c583a12..000000000 --- a/changes/bug23783 +++ /dev/null @@ -1,5 +0,0 @@ - o Minor bugfixes (compilation, windows): - - When detecting OpenSSL on Windows from our configure script, make sure - to try linking with the ws2_32 library. Fixes bug 23783; bugfix on - 0.3.2.2-alpha. - diff --git a/changes/bug24050 b/changes/bug24050 deleted file mode 100644 index d184a77ac..000000000 --- a/changes/bug24050 +++ /dev/null @@ -1,5 +0,0 @@ - o Minor bugfixes (client): - - By default, do not enable storage of client-side DNS values. - These values were unused by default previously, but they should - not have been cached at all. Fixes bug 24050; bugfix on - 0.2.6.3-alpha. diff --git a/changes/bug24086 b/changes/bug24086 deleted file mode 100644 index 2ae0b37e6..000000000 --- a/changes/bug24086 +++ /dev/null @@ -1,7 +0,0 @@ - o Minor bugfixes (directory cache): - - When a consensus diff calculation is only partially successful, only - record the successful parts as having succeeded. Partial success - can happen if (for example) one compression method fails but - the others succeed. Previously we misrecorded all the calculations as - having succeeded, which would later cause a nonfatal assertion failure. - Fixes bug 24086; bugfix on 0.3.1.1-alpha. diff --git a/changes/bug24099 b/changes/bug24099 deleted file mode 100644 index dca399266..000000000 --- a/changes/bug24099 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor bugfixes (directory cache): - - Recover better from empty or corrupt files in the consensus cache - directory. Fixes bug 24099; bugfix on 0.3.1.1-alpha. - diff --git a/changes/bug24198 b/changes/bug24198 deleted file mode 100644 index 679070687..000000000 --- a/changes/bug24198 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor bugfixes (controller, linux seccomp2 sandbox): - - Avoid a crash when attempting to use the seccomp2 sandbox - together with the OwningControllerProcess feature. - Fixes bug 24198; bugfix on 0.2.5.1-alpha. diff --git a/changes/bug24313 b/changes/bug24313 deleted file mode 100644 index b927ec3ba..000000000 --- a/changes/bug24313 +++ /dev/null @@ -1,5 +0,0 @@ - o Major bugfixes (security, hidden service v2): - - Fix a use-after-free error that could crash v2 Tor hidden services - when it failed to open circuits while expiring introductions - points. Fixes bug 24313; bugfix on 0.2.7.2-alpha. This - issue is also tracked as TROVE-2017-013 and CVE-2017-8823. diff --git a/changes/ticket23856 b/changes/ticket23856 deleted file mode 100644 index 049da18d0..000000000 --- a/changes/ticket23856 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor feature (relay statistics): - - Change relay bandwidth reporting stats interval from 4 hours to 24 hours - in order to reduce the efficiency of guard discovery attacks. Fixes - ticket 23856. diff --git a/changes/ticket24315 b/changes/ticket24315 deleted file mode 100644 index df34dbf41..000000000 --- a/changes/ticket24315 +++ /dev/null @@ -1,3 +0,0 @@ - o Major features (linux seccomp2 sandbox): - - Update the sandbox rules so that they should now work correctly with - Glibc 2.26. Closes ticket 24315. diff --git a/changes/trove-2017-009 b/changes/trove-2017-009 deleted file mode 100644 index 166a5faec..000000000 --- a/changes/trove-2017-009 +++ /dev/null @@ -1,10 +0,0 @@ - o Major bugfixes (security): - - When checking for replays in the INTRODUCE1 cell data for a (legacy) - hiddden service, correctly detect replays in the RSA-encrypted part of - the cell. We were previously checking for replays on the entire cell, - but those can be circumvented due to the malleability of Tor's legacy - hybrid encryption. This fix helps prevent a traffic confirmation - attack. Fixes bug 24244; bugfix on 0.2.4.1-alpha. This issue is also - tracked as TROVE-2017-009 and CVE-2017-8819. - - diff --git a/changes/trove-2017-010 b/changes/trove-2017-010 deleted file mode 100644 index d5bf9333d..000000000 --- a/changes/trove-2017-010 +++ /dev/null @@ -1,6 +0,0 @@ - o Major bugfixes (security): - - Fix a denial-of-service issue where an attacker could crash - a directory authority using a malformed router descriptor. - Fixes bug 24245; bugfix on 0.2.9.4-alpha. Also tracked - as TROVE-2017-010 and CVE-2017-8820. - diff --git a/changes/trove-2017-011 b/changes/trove-2017-011 deleted file mode 100644 index 82d20d9e7..000000000 --- a/changes/trove-2017-011 +++ /dev/null @@ -1,8 +0,0 @@ - o Major bugfixes (security): - - Fix a denial of service bug where an attacker could use a malformed - directory object to cause a Tor instance to pause while OpenSSL would - try to read a passphrase from the terminal. (If the terminal was not - available, tor would continue running.) Fixes bug 24246; bugfix on - every version of Tor. Also tracked as TROVE-2017-011 and - CVE-2017-8821. Found by OSS-Fuzz as testcase 6360145429790720. - diff --git a/changes/trove-2017-012-part1 b/changes/trove-2017-012-part1 deleted file mode 100644 index 9fccc2cf6..000000000 --- a/changes/trove-2017-012-part1 +++ /dev/null @@ -1,6 +0,0 @@ - o Major bugfixes (security, relay): - - When running as a relay, make sure that we never build a path through - ourselves, even in the case where we have somehow lost the version of - our descriptor appearing in the consensus. Fixes part of bug 21534; - bugfix on 0.2.0.1-alpha. This issue is also tracked as TROVE-2017-012 - and CVE-2017-8822. diff --git a/changes/trove-2017-012-part2 b/changes/trove-2017-012-part2 deleted file mode 100644 index ed994c5b0..000000000 --- a/changes/trove-2017-012-part2 +++ /dev/null @@ -1,5 +0,0 @@ - o Major bugfixes (security, relay): - - When running as a relay, make sure that we never ever choose ourselves - as a guard. Previously, this was possible. Fixes part of bug 21534; - bugfix on 0.3.0.1-alpha. This issue is also tracked as TROVE-2017-012 - and CVE-2017-8822.

1 0

[tor/release-0.2.8] version bump to 0.2.8.17
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 6ee44725449794951f93020bb04e5fa3ba784742 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:22:32 2017 -0500 version bump to 0.2.8.17 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 6fb101bf9..94cebf401 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2015, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.2.8.16-dev]) +AC_INIT([tor],[0.2.8.17]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index b9eac37c5..b9076fbc7 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.8.16-dev" +!define VERSION "0.2.8.17" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 211243d1d..9db6ef209 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -229,7 +229,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.8.16-dev" +#define VERSION "0.2.8.17"

1 0

[tor/release-0.2.8] Merge branch 'maint-0.2.8' into release-0.2.8
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 52bbd003fd4f509630f227655d1daeaf1707809e Merge: fb47b90cc 6ee447254 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:28:39 2017 -0500 Merge branch 'maint-0.2.8' into release-0.2.8 configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)

1 0

[tor/release-0.2.9] Merge branch 'trove-2017-011_025' into maint-0.2.5
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 08ce39fb0fd50ab0da4201201fa07e7776cb09e7 Merge: a6a0c7a4e 1880a6a88 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:06:17 2017 -0500 Merge branch 'trove-2017-011_025' into maint-0.2.5 changes/trove-2017-011 | 8 ++++++++ src/common/crypto.c | 16 +++++++++++++--- 2 files changed, 21 insertions(+), 3 deletions(-)

1 0

[tor/release-0.2.9] Handle NULL input to protover_compute_for_old_tor()
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 2c0487ecfb410d1361b114e60d8e9ffd2ed092ec Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Nov 11 13:56:35 2017 -0500 Handle NULL input to protover_compute_for_old_tor() Fixes bug 24245; bugfix on 0.2.9.4-alpha. TROVE-2017-010. --- changes/trove-2017-010 | 6 ++++++ src/or/protover.c | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/changes/trove-2017-010 b/changes/trove-2017-010 new file mode 100644 index 000000000..d5bf9333d --- /dev/null +++ b/changes/trove-2017-010 @@ -0,0 +1,6 @@ + o Major bugfixes (security): + - Fix a denial-of-service issue where an attacker could crash + a directory authority using a malformed router descriptor. + Fixes bug 24245; bugfix on 0.2.9.4-alpha. Also tracked + as TROVE-2017-010 and CVE-2017-8820. + diff --git a/src/or/protover.c b/src/or/protover.c index 0a4d4fb8f..98957cabd 100644 --- a/src/or/protover.c +++ b/src/or/protover.c @@ -694,6 +694,11 @@ protocol_list_contains(const smartlist_t *protos, const char * protover_compute_for_old_tor(const char *version) { + if (version == NULL) { + /* No known version; guess the oldest series that is still supported. */ + version = "0.2.5.15"; + } + if (tor_version_as_new_as(version, FIRST_TOR_VERSION_TO_ADVERTISE_PROTOCOLS)) { return "";

1 0

[tor/release-0.2.9] Merge branch 'trove-2017-012_025' into maint-0.2.5
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit f49876d66efbc5679ba7d9d9c6538c763b8e06b5 Merge: 08ce39fb0 6ab07419c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:06:21 2017 -0500 Merge branch 'trove-2017-012_025' into maint-0.2.5 changes/trove-2017-012-part1 | 6 ++++++ src/or/routerlist.c | 5 ++++- 2 files changed, 10 insertions(+), 1 deletion(-)

1 0

[tor/release-0.2.9] Avoid asking for passphrase on junky PEM input
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 1880a6a88e240556a8e6b169f1160aa8220ab0ec Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Nov 11 14:21:37 2017 -0500 Avoid asking for passphrase on junky PEM input Fixes bug 24246 and TROVE-2017-011. This bug is so old, it's in Matej's code. Seems to have been introduced with e01522bbed6eea. --- changes/trove-2017-011 | 8 ++++++++ src/common/crypto.c | 16 +++++++++++++--- 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/changes/trove-2017-011 b/changes/trove-2017-011 new file mode 100644 index 000000000..82d20d9e7 --- /dev/null +++ b/changes/trove-2017-011 @@ -0,0 +1,8 @@ + o Major bugfixes (security): + - Fix a denial of service bug where an attacker could use a malformed + directory object to cause a Tor instance to pause while OpenSSL would + try to read a passphrase from the terminal. (If the terminal was not + available, tor would continue running.) Fixes bug 24246; bugfix on + every version of Tor. Also tracked as TROVE-2017-011 and + CVE-2017-8821. Found by OSS-Fuzz as testcase 6360145429790720. + diff --git a/src/common/crypto.c b/src/common/crypto.c index f7362765d..8d816652d 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -592,11 +592,21 @@ crypto_pk_generate_key_with_bits(crypto_pk_t *env, int bits) return 0; } +/** A PEM callback that always reports a failure to get a password */ +static int +pem_no_password_cb(char *buf, int size, int rwflag, void *u) +{ + (void)buf; + (void)size; + (void)rwflag; + (void)u; + return 0; +} + /** Read a PEM-encoded private key from the len-byte string s * into env. Return 0 on success, -1 on failure. If len is -1, * the string is nul-terminated. */ -/* Used here, and used for testing. */ int crypto_pk_read_private_key_from_string(crypto_pk_t *env, const char *s, ssize_t len) @@ -615,7 +625,7 @@ crypto_pk_read_private_key_from_string(crypto_pk_t *env, if (env->key) RSA_free(env->key); - env->key = PEM_read_bio_RSAPrivateKey(b,NULL,NULL,NULL); + env->key = PEM_read_bio_RSAPrivateKey(b,NULL,pem_no_password_cb,NULL); BIO_free(b); @@ -747,7 +757,7 @@ crypto_pk_read_public_key_from_string(crypto_pk_t *env, const char *src, if (env->key) RSA_free(env->key); - env->key = PEM_read_bio_RSAPublicKey(b, NULL, NULL, NULL); + env->key = PEM_read_bio_RSAPublicKey(b, NULL, pem_no_password_cb, NULL); BIO_free(b); if (!env->key) { crypto_log_errors(LOG_WARN, "reading public key from string");

1 0

[tor/release-0.2.8] Merge branch 'maint-0.2.8' into release-0.2.8
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit fb47b90cc1e73f4d22d629c2fffe76d2488a7805 Merge: 6661c0352 ba4a9cf0c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:07:59 2017 -0500 Merge branch 'maint-0.2.8' into release-0.2.8 changes/bug24313 | 5 +++++ changes/trove-2017-009 | 10 ++++++++++ changes/trove-2017-011 | 8 ++++++++ changes/trove-2017-012-part1 | 6 ++++++ src/common/crypto.c | 16 +++++++++++++--- src/or/rendservice.c | 8 +++++++- src/or/routerlist.c | 5 ++++- 7 files changed, 53 insertions(+), 5 deletions(-)

1 0