February 2017 - tor-commits - lists.torproject.org

[tor/maint-0.2.8] Revert "Add hidserv-stats filname to our sandbox filter"
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 5446cb8d3d536e9bc737de6d9286bd4b4b185661 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 09:28:50 2017 -0500 Revert "Add hidserv-stats filname to our sandbox filter" Reverting this in 0.2.6 only -- we're no backporting seccomp2-loosening fixes to 0.2.6. This reverts commit 2ec5e24c58a08816ed2f09c8bd6301599bc2f2f7. --- changes/bug17354 | 4 ---- src/or/main.c | 1 - 2 files changed, 5 deletions(-) diff --git a/changes/bug17354 b/changes/bug17354 deleted file mode 100644 index 53da007..0000000 --- a/changes/bug17354 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor bugfixes (sandbox): - - Add the "hidserv-stats" filename to our sandbox filter for the - HiddenServiceStatistics option to work properly. Fixes bug 17354; - bugfix on tor-0.2.6.2-alpha~54^2~1. Patch from David Goulet. diff --git a/src/or/main.c b/src/or/main.c index df0cd1b..e539222 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -3018,7 +3018,6 @@ sandbox_init_filter(void) RENAME_SUFFIX2("stats", "exit-stats", ".tmp"); RENAME_SUFFIX2("stats", "buffer-stats", ".tmp"); RENAME_SUFFIX2("stats", "conn-stats", ".tmp"); - RENAME_SUFFIX2("stats", "hidserv-stats", ".tmp"); RENAME_SUFFIX("hashed-fingerprint", ".tmp"); RENAME_SUFFIX("router-stability", ".tmp");

1 0

[tor/release-0.2.6] Revert "Add hidserv-stats filname to our sandbox filter"
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 5446cb8d3d536e9bc737de6d9286bd4b4b185661 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 09:28:50 2017 -0500 Revert "Add hidserv-stats filname to our sandbox filter" Reverting this in 0.2.6 only -- we're no backporting seccomp2-loosening fixes to 0.2.6. This reverts commit 2ec5e24c58a08816ed2f09c8bd6301599bc2f2f7. --- changes/bug17354 | 4 ---- src/or/main.c | 1 - 2 files changed, 5 deletions(-) diff --git a/changes/bug17354 b/changes/bug17354 deleted file mode 100644 index 53da007..0000000 --- a/changes/bug17354 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor bugfixes (sandbox): - - Add the "hidserv-stats" filename to our sandbox filter for the - HiddenServiceStatistics option to work properly. Fixes bug 17354; - bugfix on tor-0.2.6.2-alpha~54^2~1. Patch from David Goulet. diff --git a/src/or/main.c b/src/or/main.c index df0cd1b..e539222 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -3018,7 +3018,6 @@ sandbox_init_filter(void) RENAME_SUFFIX2("stats", "exit-stats", ".tmp"); RENAME_SUFFIX2("stats", "buffer-stats", ".tmp"); RENAME_SUFFIX2("stats", "conn-stats", ".tmp"); - RENAME_SUFFIX2("stats", "hidserv-stats", ".tmp"); RENAME_SUFFIX("hashed-fingerprint", ".tmp"); RENAME_SUFFIX("router-stability", ".tmp");

1 0

[tor/master] Merge branch 'maint-0.2.6' into maint-0.2.7
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 86d5a6fac04a3f78b3bd2a8a7a1f2d9776010334 Merge: 0a43134 5446cb8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 09:29:27 2017 -0500 Merge branch 'maint-0.2.6' into maint-0.2.7 "ours" merge to avoid reverting 17354, which was already fixed in 0.2.7.4-rc.

1 0

[tor/master] Merge branch 'maint-0.2.9'
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 274094b0d72b834fcb6fee78dda7af8a5989c24c Merge: ea2f08a 65cda78 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 09:30:26 2017 -0500 Merge branch 'maint-0.2.9'

1 0

[tor/master] Merge branch 'maint-0.2.8' into maint-0.2.9
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 65cda78ec6037da8059526d1c23449013f921ed2 Merge: a271ad2 a9f936d Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 09:30:19 2017 -0500 Merge branch 'maint-0.2.8' into maint-0.2.9

1 0

[tor/master] Merge branch 'maint-0.2.7' into maint-0.2.8
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit a9f936d0d757c5628a8da0b88af4710b2f6d22fd Merge: b60fb3a 86d5a6f Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 09:30:10 2017 -0500 Merge branch 'maint-0.2.7' into maint-0.2.8

1 0

[tor/maint-0.2.9] changes file for 21280
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit a271ad2a7efed53c42bc84b0f781a6603bd494fc Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 25 13:15:37 2017 -0500 changes file for 21280 --- changes/bug21280 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changes/bug21280 b/changes/bug21280 new file mode 100644 index 0000000..e9f0bc1 --- /dev/null +++ b/changes/bug21280 @@ -0,0 +1,5 @@ + o Minor bugfixes (tor-resolve): + - The tor-resolve command line tool now rejects hostnames over 255 + characters in length. Previously, it would silently truncate + them, which could lead to bugs. Fixes bug 21280; bugfix on 0.0.9pre5. + Patch by "junglefowl".

1 0

[tor/master] Do not truncate too long hostnames
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit c4920a60c6af935cc347fe3436dd7ff62a9e380d Author: junglefowl <junglefowl(a)riseup.net> Date: Tue Jan 24 18:40:01 2017 +0000 Do not truncate too long hostnames If a hostname is supplied to tor-resolve which is too long, it will be silently truncated, resulting in a different hostname lookup: $ tor-resolve $(python -c 'print("google.com" + "m" * 256)') If tor-resolve uses SOCKS5, the length is stored in an unsigned char, which overflows in this case and leads to the hostname "google.com". As this one is a valid hostname, it returns an address instead of giving an error due to the invalid supplied hostname. --- src/tools/tor-resolve.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/tools/tor-resolve.c b/src/tools/tor-resolve.c index 29f85c4..6ac866d 100644 --- a/src/tools/tor-resolve.c +++ b/src/tools/tor-resolve.c @@ -80,6 +80,10 @@ build_socks_resolve_request(char **out, } ipv6 = reverse && tor_addr_family(&addr) == AF_INET6; addrlen = reverse ? (ipv6 ? 16 : 4) : 1 + strlen(hostname); + if (addrlen > UINT8_MAX) { + log_err(LD_GENERAL, "Hostname is too long!"); + return -1; + } len = 6 + addrlen; *out = tor_malloc(len); (*out)[0] = 5; /* SOCKS version 5 */

1 0

[tor/master] changes file for 21280
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit a271ad2a7efed53c42bc84b0f781a6603bd494fc Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 25 13:15:37 2017 -0500 changes file for 21280 --- changes/bug21280 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changes/bug21280 b/changes/bug21280 new file mode 100644 index 0000000..e9f0bc1 --- /dev/null +++ b/changes/bug21280 @@ -0,0 +1,5 @@ + o Minor bugfixes (tor-resolve): + - The tor-resolve command line tool now rejects hostnames over 255 + characters in length. Previously, it would silently truncate + them, which could lead to bugs. Fixes bug 21280; bugfix on 0.0.9pre5. + Patch by "junglefowl".

1 0

[tor/maint-0.2.9] Do not truncate too long hostnames
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit c4920a60c6af935cc347fe3436dd7ff62a9e380d Author: junglefowl <junglefowl(a)riseup.net> Date: Tue Jan 24 18:40:01 2017 +0000 Do not truncate too long hostnames If a hostname is supplied to tor-resolve which is too long, it will be silently truncated, resulting in a different hostname lookup: $ tor-resolve $(python -c 'print("google.com" + "m" * 256)') If tor-resolve uses SOCKS5, the length is stored in an unsigned char, which overflows in this case and leads to the hostname "google.com". As this one is a valid hostname, it returns an address instead of giving an error due to the invalid supplied hostname. --- src/tools/tor-resolve.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/tools/tor-resolve.c b/src/tools/tor-resolve.c index 29f85c4..6ac866d 100644 --- a/src/tools/tor-resolve.c +++ b/src/tools/tor-resolve.c @@ -80,6 +80,10 @@ build_socks_resolve_request(char **out, } ipv6 = reverse && tor_addr_family(&addr) == AF_INET6; addrlen = reverse ? (ipv6 ? 16 : 4) : 1 + strlen(hostname); + if (addrlen > UINT8_MAX) { + log_err(LD_GENERAL, "Hostname is too long!"); + return -1; + } len = 6 + addrlen; *out = tor_malloc(len); (*out)[0] = 5; /* SOCKS version 5 */

1 0