tor-commits December 2017

tor-commits@lists.torproject.org

14 participants
2422 discussions

[tor/maint-0.2.5] Use local descriptor object to exclude self in path selection
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 6ab07419c88e35c6d8610e20fb3cea16e39c8acd Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Nov 28 19:02:00 2017 -0500 Use local descriptor object to exclude self in path selection TROVE-2017-12. Severity: Medium When choosing a random node for a circuit, directly use our router descriptor to exclude ourself instead of the one in the global descriptor list. That list could be empty because tor could be downloading them which could lead to not excluding ourself. Closes #21534 --- changes/trove-2017-012-part1 | 6 ++++++ src/or/routerlist.c | 5 ++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/changes/trove-2017-012-part1 b/changes/trove-2017-012-part1 new file mode 100644 index 000000000..9fccc2cf6 --- /dev/null +++ b/changes/trove-2017-012-part1 @@ -0,0 +1,6 @@ + o Major bugfixes (security, relay): + - When running as a relay, make sure that we never build a path through + ourselves, even in the case where we have somehow lost the version of + our descriptor appearing in the consensus. Fixes part of bug 21534; + bugfix on 0.2.0.1-alpha. This issue is also tracked as TROVE-2017-012 + and CVE-2017-8822. diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 07e87724b..3bf1eb895 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -2411,7 +2411,10 @@ router_choose_random_node(smartlist_t *excludedsmartlist, }); } - if ((r = routerlist_find_my_routerinfo())) + /* If the node_t is not found we won't be to exclude ourself but we + * won't be able to pick ourself in router_choose_random_node() so + * this is fine to at least try with our routerinfo_t object. */ + if ((r = router_get_my_routerinfo())) routerlist_add_node_and_family(excludednodes, r); router_add_running_nodes_to_smartlist(sl, allow_invalid,

1 0

[tor/maint-0.2.5] Avoid asking for passphrase on junky PEM input
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 1880a6a88e240556a8e6b169f1160aa8220ab0ec Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Nov 11 14:21:37 2017 -0500 Avoid asking for passphrase on junky PEM input Fixes bug 24246 and TROVE-2017-011. This bug is so old, it's in Matej's code. Seems to have been introduced with e01522bbed6eea. --- changes/trove-2017-011 | 8 ++++++++ src/common/crypto.c | 16 +++++++++++++--- 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/changes/trove-2017-011 b/changes/trove-2017-011 new file mode 100644 index 000000000..82d20d9e7 --- /dev/null +++ b/changes/trove-2017-011 @@ -0,0 +1,8 @@ + o Major bugfixes (security): + - Fix a denial of service bug where an attacker could use a malformed + directory object to cause a Tor instance to pause while OpenSSL would + try to read a passphrase from the terminal. (If the terminal was not + available, tor would continue running.) Fixes bug 24246; bugfix on + every version of Tor. Also tracked as TROVE-2017-011 and + CVE-2017-8821. Found by OSS-Fuzz as testcase 6360145429790720. + diff --git a/src/common/crypto.c b/src/common/crypto.c index f7362765d..8d816652d 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -592,11 +592,21 @@ crypto_pk_generate_key_with_bits(crypto_pk_t *env, int bits) return 0; } +/** A PEM callback that always reports a failure to get a password */ +static int +pem_no_password_cb(char *buf, int size, int rwflag, void *u) +{ + (void)buf; + (void)size; + (void)rwflag; + (void)u; + return 0; +} + /** Read a PEM-encoded private key from the len-byte string s * into env. Return 0 on success, -1 on failure. If len is -1, * the string is nul-terminated. */ -/* Used here, and used for testing. */ int crypto_pk_read_private_key_from_string(crypto_pk_t *env, const char *s, ssize_t len) @@ -615,7 +625,7 @@ crypto_pk_read_private_key_from_string(crypto_pk_t *env, if (env->key) RSA_free(env->key); - env->key = PEM_read_bio_RSAPrivateKey(b,NULL,NULL,NULL); + env->key = PEM_read_bio_RSAPrivateKey(b,NULL,pem_no_password_cb,NULL); BIO_free(b); @@ -747,7 +757,7 @@ crypto_pk_read_public_key_from_string(crypto_pk_t *env, const char *src, if (env->key) RSA_free(env->key); - env->key = PEM_read_bio_RSAPublicKey(b, NULL, NULL, NULL); + env->key = PEM_read_bio_RSAPublicKey(b, NULL, pem_no_password_cb, NULL); BIO_free(b); if (!env->key) { crypto_log_errors(LOG_WARN, "reading public key from string");

1 0

[tor/maint-0.2.5] Fix changes file
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 75509dc82778a3bb866dca0fa86ae3e179ad78fa Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 11:52:40 2017 -0500 Fix changes file --- changes/trove-2017-009 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changes/trove-2017-009 b/changes/trove-2017-009 index 512d18c29..166a5faec 100644 --- a/changes/trove-2017-009 +++ b/changes/trove-2017-009 @@ -1,4 +1,4 @@ - o Major fixes (security): + o Major bugfixes (security): - When checking for replays in the INTRODUCE1 cell data for a (legacy) hiddden service, correctly detect replays in the RSA-encrypted part of the cell. We were previously checking for replays on the entire cell,

1 0

[tor/maint-0.2.8] Merge branch 'maint-0.2.5' into maint-0.2.8
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 2e219291bee2d378344286ba091ba09527b07188 Merge: ba4a9cf0c 6bda6777c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:21:36 2017 -0500 Merge branch 'maint-0.2.5' into maint-0.2.8 "ours" to avoid version bump

1 0

[tor/maint-0.2.8] Merge branch 'maint-0.2.5' into maint-0.2.8
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit ba4a9cf0c094b7a19e1bf44264b1244a23a4b38e Merge: 3030741b5 f49876d66 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:07:59 2017 -0500 Merge branch 'maint-0.2.5' into maint-0.2.8 changes/trove-2017-009 | 10 ++++++++++ changes/trove-2017-011 | 8 ++++++++ changes/trove-2017-012-part1 | 6 ++++++ src/common/crypto.c | 16 +++++++++++++--- src/or/rendservice.c | 4 +++- src/or/routerlist.c | 5 ++++- 6 files changed, 44 insertions(+), 5 deletions(-)

1 0

[tor/maint-0.2.8] Merge branch 'trove-2017-011_025' into maint-0.2.5
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 08ce39fb0fd50ab0da4201201fa07e7776cb09e7 Merge: a6a0c7a4e 1880a6a88 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:06:17 2017 -0500 Merge branch 'trove-2017-011_025' into maint-0.2.5 changes/trove-2017-011 | 8 ++++++++ src/common/crypto.c | 16 +++++++++++++--- 2 files changed, 21 insertions(+), 3 deletions(-)

1 0

[tor/maint-0.2.8] Avoid asking for passphrase on junky PEM input
by nickm＠torproject.org 01 Dec '17

01 Dec '17

1 0

[tor/maint-0.2.8] hs-v2: Remove any expiring intro from the retry list
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit 3030741b5d24e9ae36e6d72c6a8c7d035fde9d2a Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Nov 21 10:16:08 2017 -0500 hs-v2: Remove any expiring intro from the retry list TROVE-2017-13. Severity: High. In the unlikely case that a hidden service could be missing intro circuit(s), that it didn't have enough directory information to open new circuits and that an intro point was about to expire, a use-after-free is possible because of the intro point object being both in the retry list and expiring list at the same time. The intro object would get freed after the circuit failed to open and then access a second time when cleaned up from the expiring list. Fixes #24313 --- changes/bug24313 | 5 +++++ src/or/rendservice.c | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/changes/bug24313 b/changes/bug24313 new file mode 100644 index 000000000..b927ec3ba --- /dev/null +++ b/changes/bug24313 @@ -0,0 +1,5 @@ + o Major bugfixes (security, hidden service v2): + - Fix a use-after-free error that could crash v2 Tor hidden services + when it failed to open circuits while expiring introductions + points. Fixes bug 24313; bugfix on 0.2.7.2-alpha. This + issue is also tracked as TROVE-2017-013 and CVE-2017-8823. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 0a5b5efd5..cbf998136 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -3444,6 +3444,10 @@ remove_invalid_intro_points(rend_service_t *service, log_info(LD_REND, "Expiring %s as intro point for %s.", safe_str_client(extend_info_describe(intro->extend_info)), safe_str_client(service->service_id)); + /* We might have put it in the retry list if so, undo. */ + if (retry_nodes) { + smartlist_remove(retry_nodes, intro); + } smartlist_add(service->expiring_nodes, intro); SMARTLIST_DEL_CURRENT(service->intro_nodes, intro); /* Intro point is expired, we need a new one thus don't consider it

1 0

[tor/maint-0.2.8] Merge branch 'trove-2017-009_025' into maint-0.2.5
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit a6a0c7a4ecc22a744b123a47d466963f6023a11f Merge: 831d3b794 75509dc82 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:05:59 2017 -0500 Merge branch 'trove-2017-009_025' into maint-0.2.5 changes/trove-2017-009 | 10 ++++++++++ src/or/rendservice.c | 4 +++- 2 files changed, 13 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.2.8] Merge branch 'trove-2017-012_025' into maint-0.2.5
by nickm＠torproject.org 01 Dec '17

01 Dec '17

commit f49876d66efbc5679ba7d9d9c6538c763b8e06b5 Merge: 08ce39fb0 6ab07419c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Nov 30 12:06:21 2017 -0500 Merge branch 'trove-2017-012_025' into maint-0.2.5 changes/trove-2017-012-part1 | 6 ++++++ src/or/routerlist.c | 5 ++++- 2 files changed, 10 insertions(+), 1 deletion(-)

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits December 2017