February 2017 - tor-commits - lists.torproject.org

[tor/maint-0.2.9] Merge branch 'maint-0.2.5' into maint-0.2.6
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit da0d5ad9830b22983864660ca1c732627e119747 Merge: 54771bc 332543b Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 08:34:37 2017 -0500 Merge branch 'maint-0.2.5' into maint-0.2.6

1 0

[tor/master] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 332543baedcf651b75722e5d4626c62fdd24ef60 Merge: 640b402 6cb8c0f Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 08:34:08 2017 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/bug18089 | 6 ++++++ src/common/crypto.c | 10 ++++++++++ 2 files changed, 16 insertions(+)

1 0

[tor/master] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 640b4022324c19cf330a26b8d42b6bf7707346ce Merge: 34fdd51 053e11f Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 08:32:10 2017 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5

1 0

[tor/master] Refine the memwipe() arguments check for 18089 a little more.
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 6cb8c0fd4e9c544710b1ad72a695feb87a1d7ee7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 19 08:28:58 2016 -0500 Refine the memwipe() arguments check for 18089 a little more. We still silently ignore memwipe(NULL, ch, 0); and memwipe(ptr, ch, 0); /* for ptr != NULL */ But we now assert on: memwipe(NULL, ch, 30); --- src/common/crypto.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index f913917..522c137 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -2990,9 +2990,11 @@ secret_to_key(char *key_out, size_t key_out_len, const char *secret, void memwipe(void *mem, uint8_t byte, size_t sz) { - if (mem == NULL || sz == 0) { + if (sz == 0) { return; } + /* If sz is nonzero, then mem must not be NULL. */ + tor_assert(mem != NULL); /* Data this large is likely to be an underflow. */ tor_assert(sz < SIZE_T_CEILING);

1 0

[tor/master] Fix out-of-bounds read in INTRODUCE2 client auth
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 053e11f397f3f890c52a1add6aa4e75a9178eba0 Author: John Brooks <john.brooks(a)dereferenced.net> Date: Sat Apr 25 22:52:35 2015 -0600 Fix out-of-bounds read in INTRODUCE2 client auth The length of auth_data from an INTRODUCE2 cell is checked when the auth_type is recognized (1 or 2), but not for any other non-zero auth_type. Later, auth_data is assumed to have at least REND_DESC_COOKIE_LEN bytes, leading to a client-triggered out of bounds read. Fixed by checking auth_len before comparing the descriptor cookie against known clients. Fixes #15823; bugfix on 0.2.1.6-alpha. --- changes/bug15823 | 4 ++++ src/or/rendservice.c | 18 ++++++++++++++---- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/changes/bug15823 b/changes/bug15823 new file mode 100644 index 0000000..987de5d --- /dev/null +++ b/changes/bug15823 @@ -0,0 +1,4 @@ + o Minor bugfixes (hidden service): + - Fix an out-of-bounds read when parsing invalid INTRODUCE2 cells + on a client authorized hidden service. Fixes bug 15823; bugfix + on 0.2.1.6-alpha. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 436f2f4..0a54567 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -939,11 +939,13 @@ rend_service_requires_uptime(rend_service_t *service) return 0; } -/** Check client authorization of a given descriptor_cookie for - * service. Return 1 for success and 0 for failure. */ +/** Check client authorization of a given descriptor_cookie of + * length cookie_len for service. Return 1 for success + * and 0 for failure. */ static int rend_check_authorization(rend_service_t *service, - const char *descriptor_cookie) + const char *descriptor_cookie, + size_t cookie_len) { rend_authorized_client_t *auth_client = NULL; tor_assert(service); @@ -954,6 +956,13 @@ rend_check_authorization(rend_service_t *service, return 0; } + if (cookie_len != REND_DESC_COOKIE_LEN) { + log_info(LD_REND, "Descriptor cookie is %lu bytes, but we expected " + "%lu bytes. Dropping cell.", + (unsigned long)cookie_len, (unsigned long)REND_DESC_COOKIE_LEN); + return 0; + } + /* Look up client authorization by descriptor cookie. */ SMARTLIST_FOREACH(service->clients, rend_authorized_client_t *, client, { if (tor_memeq(client->descriptor_cookie, descriptor_cookie, @@ -1300,7 +1309,8 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request, if (service->clients) { if (parsed_req->version == 3 && parsed_req->u.v3.auth_len > 0) { if (rend_check_authorization(service, - (const char*)parsed_req->u.v3.auth_data)) { + (const char*)parsed_req->u.v3.auth_data, + parsed_req->u.v3.auth_len)) { log_info(LD_REND, "Authorization data in INTRODUCE2 cell are valid."); } else { log_info(LD_REND, "The authorization data that are contained in "

1 0

[tor/master] Merge branch 'maint-0.2.7' into maint-0.2.8
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 7b24f3e0fef04cdb21cd0b73ec4fde457702a81b Merge: c77ace6 eb72365 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 08:39:33 2017 -0500 Merge branch 'maint-0.2.7' into maint-0.2.8

1 0

[tor/maint-0.2.9] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 05ec055c417c80bf7b13914fade70a72f11accc5 Merge: 332543b 51675f9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 08:38:59 2017 -0500 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/bug17404 | 6 ++++++ src/common/tortls.c | 4 ++++ 2 files changed, 10 insertions(+)

1 0

[tor/master] Merge branch 'maint-0.2.8' into maint-0.2.9
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 0f46f7d1ec8064ffc5573d60819fc7f231497e12 Merge: b928095 7b24f3e Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 08:39:39 2017 -0500 Merge branch 'maint-0.2.8' into maint-0.2.9

1 0

[tor/release-0.2.4] Fix out-of-bounds read in INTRODUCE2 client auth
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 053e11f397f3f890c52a1add6aa4e75a9178eba0 Author: John Brooks <john.brooks(a)dereferenced.net> Date: Sat Apr 25 22:52:35 2015 -0600 Fix out-of-bounds read in INTRODUCE2 client auth The length of auth_data from an INTRODUCE2 cell is checked when the auth_type is recognized (1 or 2), but not for any other non-zero auth_type. Later, auth_data is assumed to have at least REND_DESC_COOKIE_LEN bytes, leading to a client-triggered out of bounds read. Fixed by checking auth_len before comparing the descriptor cookie against known clients. Fixes #15823; bugfix on 0.2.1.6-alpha. --- changes/bug15823 | 4 ++++ src/or/rendservice.c | 18 ++++++++++++++---- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/changes/bug15823 b/changes/bug15823 new file mode 100644 index 0000000..987de5d --- /dev/null +++ b/changes/bug15823 @@ -0,0 +1,4 @@ + o Minor bugfixes (hidden service): + - Fix an out-of-bounds read when parsing invalid INTRODUCE2 cells + on a client authorized hidden service. Fixes bug 15823; bugfix + on 0.2.1.6-alpha. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 436f2f4..0a54567 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -939,11 +939,13 @@ rend_service_requires_uptime(rend_service_t *service) return 0; } -/** Check client authorization of a given descriptor_cookie for - * service. Return 1 for success and 0 for failure. */ +/** Check client authorization of a given descriptor_cookie of + * length cookie_len for service. Return 1 for success + * and 0 for failure. */ static int rend_check_authorization(rend_service_t *service, - const char *descriptor_cookie) + const char *descriptor_cookie, + size_t cookie_len) { rend_authorized_client_t *auth_client = NULL; tor_assert(service); @@ -954,6 +956,13 @@ rend_check_authorization(rend_service_t *service, return 0; } + if (cookie_len != REND_DESC_COOKIE_LEN) { + log_info(LD_REND, "Descriptor cookie is %lu bytes, but we expected " + "%lu bytes. Dropping cell.", + (unsigned long)cookie_len, (unsigned long)REND_DESC_COOKIE_LEN); + return 0; + } + /* Look up client authorization by descriptor cookie. */ SMARTLIST_FOREACH(service->clients, rend_authorized_client_t *, client, { if (tor_memeq(client->descriptor_cookie, descriptor_cookie, @@ -1300,7 +1309,8 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request, if (service->clients) { if (parsed_req->version == 3 && parsed_req->u.v3.auth_len > 0) { if (rend_check_authorization(service, - (const char*)parsed_req->u.v3.auth_data)) { + (const char*)parsed_req->u.v3.auth_data, + parsed_req->u.v3.auth_len)) { log_info(LD_REND, "Authorization data in INTRODUCE2 cell are valid."); } else { log_info(LD_REND, "The authorization data that are contained in "

1 0

[tor/release-0.2.5] Merge remote-tracking branch 'public/bug17404_024' into maint-0.2.4
by nickm＠torproject.org 07 Feb '17

07 Feb '17

commit 51675f97d30e48da68f2cf538f7f805f51af4c36 Merge: 6cb8c0f 9459ae2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 08:37:07 2017 -0500 Merge remote-tracking branch 'public/bug17404_024' into maint-0.2.4 changes/bug17404 | 6 ++++++ src/common/tortls.c | 4 ++++ 2 files changed, 10 insertions(+)

1 0