February 2017 - tor-commits - lists.torproject.org

[tor/master] Small fixes to fuzzing documentation.
by nickm＠torproject.org 27 Feb '17

27 Feb '17

commit 4d3310932a86aae731688ac30568f7cfb301dc35 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 24 10:57:58 2017 -0500 Small fixes to fuzzing documentation. --- changes/bug21472 | 3 +++ doc/HACKING/Fuzzing.md | 12 ++++++------ 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/changes/bug21472 b/changes/bug21472 new file mode 100644 index 0000000..f31ec91 --- /dev/null +++ b/changes/bug21472 @@ -0,0 +1,3 @@ + o Documentation: + - Small fixes to the fuzzing documentation. Closes ticket + 21472. diff --git a/doc/HACKING/Fuzzing.md b/doc/HACKING/Fuzzing.md index 16b0b6b..2039d6a 100644 --- a/doc/HACKING/Fuzzing.md +++ b/doc/HACKING/Fuzzing.md @@ -64,14 +64,14 @@ To Build: make cd ../tor PATH=$PATH:../afl/ CC="../afl/afl-gcc" ./configure --enable-expensive-hardening - AFL_HARDEN=1 make clean fuzz + AFL_HARDEN=1 make clean fuzzers To Find The ASAN Memory Limit: (64-bit only) -On 64-bit platforms, afl needs to know how much memory ASAN uses. -Or, you can configure tor without --enable-expensive-hardening, then use - make fuzz -to run the generated test cases through an ASAN-enabled fuzz-http. +On 64-bit platforms, afl needs to know how much memory ASAN uses, +because ASAN tends to allocate a ridiculous amount of virtual memory, +and then not actually use it. + Read afl/docs/notes_for_asan.txt for more details. Download recidivm from http://jwilk.net/software/recidivm @@ -80,7 +80,7 @@ Read afl/docs/notes_for_asan.txt for more details. tar xvzf recidivm*.tar.gz cd recidivm* make - /path/to/recidivm -v src/test/fuzz_dir + /path/to/recidivm -v src/test/fuzz/fuzz-http Use the final "ok" figure as the input to -m when calling afl-fuzz (Normally, recidivm would output a figure automatically, but in some cases, the fuzzing harness will hang when the memory limit is too small.)

1 0

[tor/master] Merge remote-tracking branch 'public/bug21472_030' into maint-0.3.0
by nickm＠torproject.org 27 Feb '17

27 Feb '17

commit b6efd77ec4f891ddaaeafa1c74c45454dde2fdd8 Merge: 619771f 4d33109 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 27 08:38:14 2017 -0500 Merge remote-tracking branch 'public/bug21472_030' into maint-0.3.0 changes/bug21472 | 3 +++ doc/HACKING/Fuzzing.md | 12 ++++++------ 2 files changed, 9 insertions(+), 6 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.3.0'
by nickm＠torproject.org 27 Feb '17

27 Feb '17

commit 17fa4988745f258896d197335ec55e96fedcfb5e Merge: 02aaa7f b6efd77 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 27 08:38:52 2017 -0500 Merge branch 'maint-0.3.0' changes/bug21472 | 3 +++ doc/HACKING/Fuzzing.md | 12 ++++++------ 2 files changed, 9 insertions(+), 6 deletions(-)

1 0

[tor/release-0.3.0] Small fixes to fuzzing documentation.
by nickm＠torproject.org 27 Feb '17

27 Feb '17

commit 4d3310932a86aae731688ac30568f7cfb301dc35 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 24 10:57:58 2017 -0500 Small fixes to fuzzing documentation. --- changes/bug21472 | 3 +++ doc/HACKING/Fuzzing.md | 12 ++++++------ 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/changes/bug21472 b/changes/bug21472 new file mode 100644 index 0000000..f31ec91 --- /dev/null +++ b/changes/bug21472 @@ -0,0 +1,3 @@ + o Documentation: + - Small fixes to the fuzzing documentation. Closes ticket + 21472. diff --git a/doc/HACKING/Fuzzing.md b/doc/HACKING/Fuzzing.md index 16b0b6b..2039d6a 100644 --- a/doc/HACKING/Fuzzing.md +++ b/doc/HACKING/Fuzzing.md @@ -64,14 +64,14 @@ To Build: make cd ../tor PATH=$PATH:../afl/ CC="../afl/afl-gcc" ./configure --enable-expensive-hardening - AFL_HARDEN=1 make clean fuzz + AFL_HARDEN=1 make clean fuzzers To Find The ASAN Memory Limit: (64-bit only) -On 64-bit platforms, afl needs to know how much memory ASAN uses. -Or, you can configure tor without --enable-expensive-hardening, then use - make fuzz -to run the generated test cases through an ASAN-enabled fuzz-http. +On 64-bit platforms, afl needs to know how much memory ASAN uses, +because ASAN tends to allocate a ridiculous amount of virtual memory, +and then not actually use it. + Read afl/docs/notes_for_asan.txt for more details. Download recidivm from http://jwilk.net/software/recidivm @@ -80,7 +80,7 @@ Read afl/docs/notes_for_asan.txt for more details. tar xvzf recidivm*.tar.gz cd recidivm* make - /path/to/recidivm -v src/test/fuzz_dir + /path/to/recidivm -v src/test/fuzz/fuzz-http Use the final "ok" figure as the input to -m when calling afl-fuzz (Normally, recidivm would output a figure automatically, but in some cases, the fuzzing harness will hang when the memory limit is too small.)

1 0

[tor/release-0.3.0] Merge remote-tracking branch 'public/bug21472_030' into maint-0.3.0
by nickm＠torproject.org 27 Feb '17

27 Feb '17

commit b6efd77ec4f891ddaaeafa1c74c45454dde2fdd8 Merge: 619771f 4d33109 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 27 08:38:14 2017 -0500 Merge remote-tracking branch 'public/bug21472_030' into maint-0.3.0 changes/bug21472 | 3 +++ doc/HACKING/Fuzzing.md | 12 ++++++------ 2 files changed, 9 insertions(+), 6 deletions(-)

1 0

[tor/release-0.3.0] Whitespace fix.
by nickm＠torproject.org 27 Feb '17

27 Feb '17

commit 619771f60bde6b69eeaad4efbd844705ec5bcb83 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 24 11:37:33 2017 -0500 Whitespace fix. --- src/or/rendservice.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 522f33e..cb87624 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -3175,8 +3175,8 @@ count_intro_point_circuits(const rend_service_t *service) */ STATIC ssize_t encode_establish_intro_cell_legacy(char *cell_body_out, - size_t cell_body_out_len, - crypto_pk_t *intro_key, char *rend_circ_nonce) + size_t cell_body_out_len, + crypto_pk_t *intro_key, char *rend_circ_nonce) { int retval = -1; int r;

1 0

[tor/release-0.3.0] hs: Fix bad use of sizeof() when encoding ESTABLISH_INTRO legacy cell
by nickm＠torproject.org 27 Feb '17

27 Feb '17

commit 4ed10e5053ebef31d5f922933f7236a6ab743bf9 Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Feb 24 09:48:14 2017 -0500 hs: Fix bad use of sizeof() when encoding ESTABLISH_INTRO legacy cell When encoding a legacy ESTABLISH_INTRO cell, we were using the sizeof() on a pointer instead of using the real size of the destination buffer leading to an overflow passing an enormous value to the signing digest function. Fortunately, that value was only used to make sure the destination buffer length was big enough for the key size and in this case it always was because of the overflow. Fixes #21553 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/bug21553 | 7 +++++++ src/or/rendservice.c | 12 +++++++----- src/or/rendservice.h | 1 + src/test/test_hs_intropoint.c | 1 + 4 files changed, 16 insertions(+), 5 deletions(-) diff --git a/changes/bug21553 b/changes/bug21553 new file mode 100644 index 0000000..6ffa3e2 --- /dev/null +++ b/changes/bug21553 @@ -0,0 +1,7 @@ + o Minor bugfixes (hidden service): + - When encoding a legacy ESTABLISH_INTRO cell, we were using the sizeof() + on a pointer instead of real size of the destination buffer leading to + an overflow passing an enormous value to the signing digest function. + Fortunately, that value was only used to make sure the destination + buffer length was big enough for the key size and in this case it was. + Fixes bug 21553; bugfix on tor-0.3.0.1-alpha. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 1d6fc0f..522f33e 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -3174,8 +3174,9 @@ count_intro_point_circuits(const rend_service_t *service) of bytes written. On fail, return -1. */ STATIC ssize_t -encode_establish_intro_cell_legacy(char *cell_body_out, crypto_pk_t *intro_key, - char *rend_circ_nonce) +encode_establish_intro_cell_legacy(char *cell_body_out, + size_t cell_body_out_len, + crypto_pk_t *intro_key, char *rend_circ_nonce) { int retval = -1; int r; @@ -3202,7 +3203,7 @@ encode_establish_intro_cell_legacy(char *cell_body_out, crypto_pk_t *intro_key, len += 20; note_crypto_pk_op(REND_SERVER); r = crypto_pk_private_sign_digest(intro_key, cell_body_out+len, - sizeof(cell_body_out)-len, + cell_body_out_len - len, cell_body_out, len); if (r<0) { log_warn(LD_BUG, "Internal error: couldn't sign introduction request."); @@ -3313,8 +3314,9 @@ rend_service_intro_has_opened(origin_circuit_t *circuit) /* Send the ESTABLISH_INTRO cell */ { ssize_t len; - len = encode_establish_intro_cell_legacy(buf, circuit->intro_key, - circuit->cpath->prev->rend_circ_nonce); + len = encode_establish_intro_cell_legacy(buf, sizeof(buf), + circuit->intro_key, + circuit->cpath->prev->rend_circ_nonce); if (len < 0) { reason = END_CIRC_REASON_INTERNAL; goto err; diff --git a/src/or/rendservice.h b/src/or/rendservice.h index 3bfac0b..85daaae 100644 --- a/src/or/rendservice.h +++ b/src/or/rendservice.h @@ -130,6 +130,7 @@ STATIC int rend_service_poison_new_single_onion_dir( const rend_service_t *s, const or_options_t* options); STATIC ssize_t encode_establish_intro_cell_legacy(char *cell_body_out, + size_t cell_body_out_len, crypto_pk_t *intro_key, char *rend_circ_nonce); STATIC void prune_services_on_reload(smartlist_t *old_service_list, diff --git a/src/test/test_hs_intropoint.c b/src/test/test_hs_intropoint.c index ea12aeb..b207cd4 100644 --- a/src/test/test_hs_intropoint.c +++ b/src/test/test_hs_intropoint.c @@ -489,6 +489,7 @@ helper_establish_intro_v2(or_circuit_t *intro_circ) /* Use old circuit_key_material why not */ cell_len = encode_establish_intro_cell_legacy((char*)cell_body, + sizeof(cell_body), key1, (char *) circuit_key_material); tt_int_op(cell_len, >, 0);

1 0

[tor/maint-0.3.0] Merge remote-tracking branch 'public/bug21472_030' into maint-0.3.0
by nickm＠torproject.org 27 Feb '17

27 Feb '17

commit b6efd77ec4f891ddaaeafa1c74c45454dde2fdd8 Merge: 619771f 4d33109 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 27 08:38:14 2017 -0500 Merge remote-tracking branch 'public/bug21472_030' into maint-0.3.0 changes/bug21472 | 3 +++ doc/HACKING/Fuzzing.md | 12 ++++++------ 2 files changed, 9 insertions(+), 6 deletions(-)

1 0

[tor/maint-0.3.0] Small fixes to fuzzing documentation.
by nickm＠torproject.org 27 Feb '17

27 Feb '17

commit 4d3310932a86aae731688ac30568f7cfb301dc35 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 24 10:57:58 2017 -0500 Small fixes to fuzzing documentation. --- changes/bug21472 | 3 +++ doc/HACKING/Fuzzing.md | 12 ++++++------ 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/changes/bug21472 b/changes/bug21472 new file mode 100644 index 0000000..f31ec91 --- /dev/null +++ b/changes/bug21472 @@ -0,0 +1,3 @@ + o Documentation: + - Small fixes to the fuzzing documentation. Closes ticket + 21472. diff --git a/doc/HACKING/Fuzzing.md b/doc/HACKING/Fuzzing.md index 16b0b6b..2039d6a 100644 --- a/doc/HACKING/Fuzzing.md +++ b/doc/HACKING/Fuzzing.md @@ -64,14 +64,14 @@ To Build: make cd ../tor PATH=$PATH:../afl/ CC="../afl/afl-gcc" ./configure --enable-expensive-hardening - AFL_HARDEN=1 make clean fuzz + AFL_HARDEN=1 make clean fuzzers To Find The ASAN Memory Limit: (64-bit only) -On 64-bit platforms, afl needs to know how much memory ASAN uses. -Or, you can configure tor without --enable-expensive-hardening, then use - make fuzz -to run the generated test cases through an ASAN-enabled fuzz-http. +On 64-bit platforms, afl needs to know how much memory ASAN uses, +because ASAN tends to allocate a ridiculous amount of virtual memory, +and then not actually use it. + Read afl/docs/notes_for_asan.txt for more details. Download recidivm from http://jwilk.net/software/recidivm @@ -80,7 +80,7 @@ Read afl/docs/notes_for_asan.txt for more details. tar xvzf recidivm*.tar.gz cd recidivm* make - /path/to/recidivm -v src/test/fuzz_dir + /path/to/recidivm -v src/test/fuzz/fuzz-http Use the final "ok" figure as the input to -m when calling afl-fuzz (Normally, recidivm would output a figure automatically, but in some cases, the fuzzing harness will hang when the memory limit is too small.)

1 0

[chutney/master] Minor updates to the README
by teor＠torproject.org 27 Feb '17

27 Feb '17

commit b398fce01da487f9ed12d610de42b1ece4e88347 Author: teor <teor2345(a)gmail.com> Date: Mon Feb 27 23:32:36 2017 +1100 Minor updates to the README --- README | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/README b/README index 7c4f347..f126145 100644 --- a/README +++ b/README @@ -10,10 +10,11 @@ It is supposed to be a good tool for: Right now it only sorta does these things. You will need, at the moment: - - Tor installed somewhere in your path or the location of the 'tor' and - 'tor-gencert' binaries specified through the environment variables - CHUTNEY_TOR and CHUTNEY_TOR_GENCERT, respectively. - - Python 2.7 or later + - Tor installed somewhere in your path, or + - The location of the 'tor' and 'tor-gencert' binaries specified through the + environment variables CHUTNEY_TOR and CHUTNEY_TOR_GENCERT, respectively, or + - To run chutney's tools/test-network.sh from a tor build directory, and + - Python 2.7 or later (Python 3 support is an ongoing work) Stuff to try: @@ -23,13 +24,14 @@ Automated Setup, Verification, and Shutdown: ./tools/test-network.sh --tor-path <tor-build-directory> ./tools/test-network.sh --tor <name-or-path> --tor-gencert <name-or-path> (--tor-path and $TOR_DIR override --tor and --tor-gencert.) + (The script tries hard to find tor.) ./tools/test-network.sh --chutney-path <chutney-directory> - (The script is pretty good at guessing this.) + (The script is pretty good at finding chutney.) test-network.sh looks for some tor binaries (either in a nearby build directory or in your $PATH), configures a comprehensive tor test network, launches it, then verifies data transmission through it, and cleans up after -itself. +itself. Relative paths are supported. You can modify its configuration using command-line arguments, or use the chutney environmental variables documented below:

1 0