December 2017 - tor-commits - lists.torproject.org

[tor/maint-0.3.1] Merge branch 'maint-0.3.0' into maint-0.3.1
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 6b9c2ac23e7dfbaeaefc1fd5923645850668e7af Merge: ee48eb1eb f2ecdeb72 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:25:07 2017 -0500 Merge branch 'maint-0.3.0' into maint-0.3.1 "ours" to avoid version bump.

1 0

[tor/maint-0.3.1] version bump to 0.3.0.13
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit f2ecdeb724c68f854f00a0095a0849627fd4e17b Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:25:01 2017 -0500 version bump to 0.3.0.13 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 315bd2df3..10612eba2 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2015, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.3.0.12-dev]) +AC_INIT([tor],[0.3.0.13]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index 160ef2675..bd8cf3d5c 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.3.0.12-dev" +!define VERSION "0.3.0.13" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index f5a7451a5..5795552a4 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -218,7 +218,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.3.0.12-dev" +#define VERSION "0.3.0.13"

1 0

[tor/maint-0.3.2] Merge branch 'maint-0.3.0' into maint-0.3.1
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit ee48eb1eb5e643cd8af2a32df3cf8c48965f6ce4 Merge: 500f04a74 5fc0587c0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:07:59 2017 -0500 Merge branch 'maint-0.3.0' into maint-0.3.1 changes/bug24313 | 5 +++++ changes/trove-2017-009 | 10 ++++++++++ changes/trove-2017-010 | 6 ++++++ changes/trove-2017-011 | 8 ++++++++ changes/trove-2017-012-part1 | 6 ++++++ changes/trove-2017-012-part2 | 5 +++++ src/common/crypto.c | 16 +++++++++++++--- src/or/entrynodes.c | 3 ++- src/or/protover.c | 5 +++++ src/or/rendservice.c | 8 +++++++- src/or/routerlist.c | 5 ++++- 11 files changed, 71 insertions(+), 6 deletions(-) diff --cc src/or/routerlist.c index 0e45f63f7,83e513448..507580f19 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@@ -2810,17 -2811,23 +2810,20 @@@ router_choose_random_node(smartlist_t * rule = weight_for_exit ? WEIGHT_FOR_EXIT : (need_guard ? WEIGHT_FOR_GUARD : WEIGHT_FOR_MID); - /* Exclude relays that allow single hop exit circuits, if the user - * wants to (such relays might be risky) */ - if (get_options()->ExcludeSingleHopRelays) { - SMARTLIST_FOREACH(nodelist_get_list(), node_t *, node, - if (node_allows_single_hop_exits(node)) { - smartlist_add(excludednodes, node); - }); - } + /* Exclude relays that allow single hop exit circuits. This is an obsolete + * option since 0.2.9.2-alpha and done by default in 0.3.1.0-alpha. */ + SMARTLIST_FOREACH(nodelist_get_list(), node_t *, node, + if (node_allows_single_hop_exits(node)) { + smartlist_add(excludednodes, node); + }); - if ((r = routerlist_find_my_routerinfo())) + /* If the node_t is not found we won't be to exclude ourself but we + * won't be able to pick ourself in router_choose_random_node() so + * this is fine to at least try with our routerinfo_t object. */ + if ((r = router_get_my_routerinfo())) routerlist_add_node_and_family(excludednodes, r); - router_add_running_nodes_to_smartlist(sl, allow_invalid, - need_uptime, need_capacity, + router_add_running_nodes_to_smartlist(sl, need_uptime, need_capacity, need_guard, need_desc, pref_addr, direct_conn); log_debug(LD_CIRC,

1 0

[tor/maint-0.3.2] Merge branch 'trove-2017-012_030' into maint-0.3.0
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit d459c08b7d5cb1766bda5443ea2750bca160212d Merge: 766d0a2d9 91cee3c9e Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:07:43 2017 -0500 Merge branch 'trove-2017-012_030' into maint-0.3.0 changes/trove-2017-012-part2 | 5 +++++ src/or/entrynodes.c | 3 ++- 2 files changed, 7 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.3.2] Avoid asking for passphrase on junky PEM input
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 1880a6a88e240556a8e6b169f1160aa8220ab0ec Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Nov 11 14:21:37 2017 -0500 Avoid asking for passphrase on junky PEM input Fixes bug 24246 and TROVE-2017-011. This bug is so old, it's in Matej's code. Seems to have been introduced with e01522bbed6eea. --- changes/trove-2017-011 | 8 ++++++++ src/common/crypto.c | 16 +++++++++++++--- 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/changes/trove-2017-011 b/changes/trove-2017-011 new file mode 100644 index 000000000..82d20d9e7 --- /dev/null +++ b/changes/trove-2017-011 @@ -0,0 +1,8 @@ + o Major bugfixes (security): + - Fix a denial of service bug where an attacker could use a malformed + directory object to cause a Tor instance to pause while OpenSSL would + try to read a passphrase from the terminal. (If the terminal was not + available, tor would continue running.) Fixes bug 24246; bugfix on + every version of Tor. Also tracked as TROVE-2017-011 and + CVE-2017-8821. Found by OSS-Fuzz as testcase 6360145429790720. + diff --git a/src/common/crypto.c b/src/common/crypto.c index f7362765d..8d816652d 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -592,11 +592,21 @@ crypto_pk_generate_key_with_bits(crypto_pk_t *env, int bits) return 0; } +/** A PEM callback that always reports a failure to get a password */ +static int +pem_no_password_cb(char *buf, int size, int rwflag, void *u) +{ + (void)buf; + (void)size; + (void)rwflag; + (void)u; + return 0; +} + /** Read a PEM-encoded private key from the len-byte string s * into env. Return 0 on success, -1 on failure. If len is -1, * the string is nul-terminated. */ -/* Used here, and used for testing. */ int crypto_pk_read_private_key_from_string(crypto_pk_t *env, const char *s, ssize_t len) @@ -615,7 +625,7 @@ crypto_pk_read_private_key_from_string(crypto_pk_t *env, if (env->key) RSA_free(env->key); - env->key = PEM_read_bio_RSAPrivateKey(b,NULL,NULL,NULL); + env->key = PEM_read_bio_RSAPrivateKey(b,NULL,pem_no_password_cb,NULL); BIO_free(b); @@ -747,7 +757,7 @@ crypto_pk_read_public_key_from_string(crypto_pk_t *env, const char *src, if (env->key) RSA_free(env->key); - env->key = PEM_read_bio_RSAPublicKey(b, NULL, NULL, NULL); + env->key = PEM_read_bio_RSAPublicKey(b, NULL, pem_no_password_cb, NULL); BIO_free(b); if (!env->key) { crypto_log_errors(LOG_WARN, "reading public key from string");

1 0

[tor/maint-0.3.2] Merge branch 'trove-2017-012_025' into maint-0.2.5
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit f49876d66efbc5679ba7d9d9c6538c763b8e06b5 Merge: 08ce39fb0 6ab07419c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:06:21 2017 -0500 Merge branch 'trove-2017-012_025' into maint-0.2.5 changes/trove-2017-012-part1 | 6 ++++++ src/or/routerlist.c | 5 ++++- 2 files changed, 10 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.3.2] Merge branch 'trove-2017-010_029' into maint-0.2.9
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 52d7af631cb1075289ba519d0c3b89e0b5816f5e Merge: 072e194a1 2c0487ecf Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:07:26 2017 -0500 Merge branch 'trove-2017-010_029' into maint-0.2.9 changes/trove-2017-010 | 6 ++++++ src/or/protover.c | 5 +++++ 2 files changed, 11 insertions(+)

1 0

[tor/maint-0.3.2] Merge branch 'maint-0.2.5' into maint-0.2.8
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit ba4a9cf0c094b7a19e1bf44264b1244a23a4b38e Merge: 3030741b5 f49876d66 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:07:59 2017 -0500 Merge branch 'maint-0.2.5' into maint-0.2.8 changes/trove-2017-009 | 10 ++++++++++ changes/trove-2017-011 | 8 ++++++++ changes/trove-2017-012-part1 | 6 ++++++ src/common/crypto.c | 16 +++++++++++++--- src/or/rendservice.c | 4 +++- src/or/routerlist.c | 5 ++++- 6 files changed, 44 insertions(+), 5 deletions(-)

1 0

[tor/maint-0.3.2] Use local descriptor object to exclude self in path selection
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 6ab07419c88e35c6d8610e20fb3cea16e39c8acd Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Nov 28 19:02:00 2017 -0500 Use local descriptor object to exclude self in path selection TROVE-2017-12. Severity: Medium When choosing a random node for a circuit, directly use our router descriptor to exclude ourself instead of the one in the global descriptor list. That list could be empty because tor could be downloading them which could lead to not excluding ourself. Closes #21534 --- changes/trove-2017-012-part1 | 6 ++++++ src/or/routerlist.c | 5 ++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/changes/trove-2017-012-part1 b/changes/trove-2017-012-part1 new file mode 100644 index 000000000..9fccc2cf6 --- /dev/null +++ b/changes/trove-2017-012-part1 @@ -0,0 +1,6 @@ + o Major bugfixes (security, relay): + - When running as a relay, make sure that we never build a path through + ourselves, even in the case where we have somehow lost the version of + our descriptor appearing in the consensus. Fixes part of bug 21534; + bugfix on 0.2.0.1-alpha. This issue is also tracked as TROVE-2017-012 + and CVE-2017-8822. diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 07e87724b..3bf1eb895 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -2411,7 +2411,10 @@ router_choose_random_node(smartlist_t *excludedsmartlist, }); } - if ((r = routerlist_find_my_routerinfo())) + /* If the node_t is not found we won't be to exclude ourself but we + * won't be able to pick ourself in router_choose_random_node() so + * this is fine to at least try with our routerinfo_t object. */ + if ((r = router_get_my_routerinfo())) routerlist_add_node_and_family(excludednodes, r); router_add_running_nodes_to_smartlist(sl, allow_invalid,

1 0

[tor/maint-0.3.2] Merge branch 'maint-0.3.1' into maint-0.3.2
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit fd73a168ca5bf8ea6a0fa01878dd16d356d14cfa Merge: 25d50decb ee48eb1eb Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:07:59 2017 -0500 Merge branch 'maint-0.3.1' into maint-0.3.2 changes/bug24313 | 5 +++++ changes/trove-2017-009 | 10 ++++++++++ changes/trove-2017-010 | 6 ++++++ changes/trove-2017-011 | 8 ++++++++ changes/trove-2017-012-part1 | 6 ++++++ changes/trove-2017-012-part2 | 5 +++++ src/common/crypto.c | 16 +++++++++++++--- src/or/entrynodes.c | 3 ++- src/or/protover.c | 5 +++++ src/or/rendservice.c | 8 +++++++- src/or/routerlist.c | 5 ++++- 11 files changed, 71 insertions(+), 6 deletions(-) diff --cc src/or/routerlist.c index 355f8e0fa,507580f19..af4f67dc1 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@@ -2825,21 -2810,17 +2825,24 @@@ router_choose_random_node(smartlist_t * rule = weight_for_exit ? WEIGHT_FOR_EXIT : (need_guard ? WEIGHT_FOR_GUARD : WEIGHT_FOR_MID); - /* Exclude relays that allow single hop exit circuits. This is an obsolete - * option since 0.2.9.2-alpha and done by default in 0.3.1.0-alpha. */ - SMARTLIST_FOREACH(nodelist_get_list(), node_t *, node, + SMARTLIST_FOREACH_BEGIN(nodelist_get_list(), node_t *, node) { if (node_allows_single_hop_exits(node)) { + /* Exclude relays that allow single hop exit circuits. This is an + * obsolete option since 0.2.9.2-alpha and done by default in + * 0.3.1.0-alpha. */ smartlist_add(excludednodes, node); - }); + } else if (rendezvous_v3 && + !node_supports_v3_rendezvous_point(node)) { + /* Exclude relays that do not support to rendezvous for a hidden service + * version 3. */ + smartlist_add(excludednodes, node); + } + } SMARTLIST_FOREACH_END(node); - if ((r = routerlist_find_my_routerinfo())) + /* If the node_t is not found we won't be to exclude ourself but we + * won't be able to pick ourself in router_choose_random_node() so + * this is fine to at least try with our routerinfo_t object. */ + if ((r = router_get_my_routerinfo())) routerlist_add_node_and_family(excludednodes, r); router_add_running_nodes_to_smartlist(sl, need_uptime, need_capacity,

1 0