March 2017 - tor-commits - lists.torproject.org

[tor/release-0.3.0] Fix a crash when a connection tries to open just after it has been unlinked
by nickm＠torproject.org 05 Mar '17

05 Mar '17

commit 4b5cdb2c3060eefcc616764845a4ed7c002117b7 Author: teor <teor2345(a)gmail.com> Date: Thu Mar 2 09:49:35 2017 +1100 Fix a crash when a connection tries to open just after it has been unlinked Fixes bug 21576; bugfix on Tor 0.2.9.3-alpha. Reported by alecmuffett. --- changes/bug21576 | 4 ++++ src/or/connection_edge.c | 12 +++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/changes/bug21576 b/changes/bug21576 new file mode 100644 index 0000000..68d8471 --- /dev/null +++ b/changes/bug21576 @@ -0,0 +1,4 @@ + o Major bugfixes (crash, directory connections): + - Fix a rare crash when sending a begin cell on a circuit whose linked + directory connection has already been closed. Fixes bug 21576; + bugfix on Tor 0.2.9.3-alpha. Reported by alecmuffett. diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 3550d0e..f033d17 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -2437,10 +2437,16 @@ connection_ap_handshake_send_begin(entry_connection_t *ap_conn) } else if (begin_type == RELAY_COMMAND_BEGIN_DIR) { /* This connection is a begindir directory connection. * Look at the linked directory connection to access the directory purpose. - * (This must be non-NULL, because we're doing begindir.) */ - tor_assert(base_conn->linked); + * If a BEGINDIR connection is ever not linked, that's a bug. */ + if (BUG(!base_conn->linked)) { + return -1; + } connection_t *linked_dir_conn_base = base_conn->linked_conn; - tor_assert(linked_dir_conn_base); + /* If the linked connection has been unlinked by other code, we can't send + * a begin cell on it. */ + if (!linked_dir_conn_base) { + return -1; + } /* Sensitive directory connections must have an anonymous path length. * Otherwise, directory connections are typically one-hop. * This matches the earlier check for directory connection path anonymity

1 0

[tor/maint-0.3.0] Merge remote-tracking branch 'teor/bug21576_029_v2' into maint-0.3.0
by nickm＠torproject.org 05 Mar '17

05 Mar '17

commit 333d5d0f2afb4023d9763ec8ce28f973cbecc591 Merge: 528dcd1 4b5cdb2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Mar 4 20:23:38 2017 -0500 Merge remote-tracking branch 'teor/bug21576_029_v2' into maint-0.3.0 changes/bug21576 | 4 ++++ src/or/connection_edge.c | 12 +++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.3.0'
by nickm＠torproject.org 05 Mar '17

05 Mar '17

commit 3a1cba7d90855d63387168a0345f9c51436bd322 Merge: c04209c 333d5d0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Mar 4 20:24:02 2017 -0500 Merge branch 'maint-0.3.0' changes/bug21576 | 4 ++++ src/or/connection_edge.c | 12 +++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-)

1 0

[tor/master] Fix a crash when a connection tries to open just after it has been unlinked
by nickm＠torproject.org 05 Mar '17

05 Mar '17

commit 4b5cdb2c3060eefcc616764845a4ed7c002117b7 Author: teor <teor2345(a)gmail.com> Date: Thu Mar 2 09:49:35 2017 +1100 Fix a crash when a connection tries to open just after it has been unlinked Fixes bug 21576; bugfix on Tor 0.2.9.3-alpha. Reported by alecmuffett. --- changes/bug21576 | 4 ++++ src/or/connection_edge.c | 12 +++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/changes/bug21576 b/changes/bug21576 new file mode 100644 index 0000000..68d8471 --- /dev/null +++ b/changes/bug21576 @@ -0,0 +1,4 @@ + o Major bugfixes (crash, directory connections): + - Fix a rare crash when sending a begin cell on a circuit whose linked + directory connection has already been closed. Fixes bug 21576; + bugfix on Tor 0.2.9.3-alpha. Reported by alecmuffett. diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 3550d0e..f033d17 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -2437,10 +2437,16 @@ connection_ap_handshake_send_begin(entry_connection_t *ap_conn) } else if (begin_type == RELAY_COMMAND_BEGIN_DIR) { /* This connection is a begindir directory connection. * Look at the linked directory connection to access the directory purpose. - * (This must be non-NULL, because we're doing begindir.) */ - tor_assert(base_conn->linked); + * If a BEGINDIR connection is ever not linked, that's a bug. */ + if (BUG(!base_conn->linked)) { + return -1; + } connection_t *linked_dir_conn_base = base_conn->linked_conn; - tor_assert(linked_dir_conn_base); + /* If the linked connection has been unlinked by other code, we can't send + * a begin cell on it. */ + if (!linked_dir_conn_base) { + return -1; + } /* Sensitive directory connections must have an anonymous path length. * Otherwise, directory connections are typically one-hop. * This matches the earlier check for directory connection path anonymity

1 0

[tor/maint-0.3.0] Fix a crash when a connection tries to open just after it has been unlinked
by nickm＠torproject.org 05 Mar '17

05 Mar '17

commit 4b5cdb2c3060eefcc616764845a4ed7c002117b7 Author: teor <teor2345(a)gmail.com> Date: Thu Mar 2 09:49:35 2017 +1100 Fix a crash when a connection tries to open just after it has been unlinked Fixes bug 21576; bugfix on Tor 0.2.9.3-alpha. Reported by alecmuffett. --- changes/bug21576 | 4 ++++ src/or/connection_edge.c | 12 +++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/changes/bug21576 b/changes/bug21576 new file mode 100644 index 0000000..68d8471 --- /dev/null +++ b/changes/bug21576 @@ -0,0 +1,4 @@ + o Major bugfixes (crash, directory connections): + - Fix a rare crash when sending a begin cell on a circuit whose linked + directory connection has already been closed. Fixes bug 21576; + bugfix on Tor 0.2.9.3-alpha. Reported by alecmuffett. diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 3550d0e..f033d17 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -2437,10 +2437,16 @@ connection_ap_handshake_send_begin(entry_connection_t *ap_conn) } else if (begin_type == RELAY_COMMAND_BEGIN_DIR) { /* This connection is a begindir directory connection. * Look at the linked directory connection to access the directory purpose. - * (This must be non-NULL, because we're doing begindir.) */ - tor_assert(base_conn->linked); + * If a BEGINDIR connection is ever not linked, that's a bug. */ + if (BUG(!base_conn->linked)) { + return -1; + } connection_t *linked_dir_conn_base = base_conn->linked_conn; - tor_assert(linked_dir_conn_base); + /* If the linked connection has been unlinked by other code, we can't send + * a begin cell on it. */ + if (!linked_dir_conn_base) { + return -1; + } /* Sensitive directory connections must have an anonymous path length. * Otherwise, directory connections are typically one-hop. * This matches the earlier check for directory connection path anonymity

1 0

[tor/master] Merge remote-tracking branch 'teor/bug21576_029_v2' into maint-0.3.0
by nickm＠torproject.org 05 Mar '17

05 Mar '17

commit 333d5d0f2afb4023d9763ec8ce28f973cbecc591 Merge: 528dcd1 4b5cdb2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Mar 4 20:23:38 2017 -0500 Merge remote-tracking branch 'teor/bug21576_029_v2' into maint-0.3.0 changes/bug21576 | 4 ++++ src/or/connection_edge.c | 12 +++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-)

1 0

[tor/release-0.3.0] Merge remote-tracking branch 'teor/bug21576_029_v2' into maint-0.3.0
by nickm＠torproject.org 05 Mar '17

05 Mar '17

commit 333d5d0f2afb4023d9763ec8ce28f973cbecc591 Merge: 528dcd1 4b5cdb2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Mar 4 20:23:38 2017 -0500 Merge remote-tracking branch 'teor/bug21576_029_v2' into maint-0.3.0 changes/bug21576 | 4 ++++ src/or/connection_edge.c | 12 +++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-)

1 0

[tor/release-0.3.0] Merge branch 'maint-0.3.0' into release-0.3.0
by nickm＠torproject.org 05 Mar '17

05 Mar '17

commit 7ffef14d334e69cff649fb3aef26669bc17c62c4 Merge: 2e3645d 333d5d0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Mar 4 20:23:57 2017 -0500 Merge branch 'maint-0.3.0' into release-0.3.0 changes/bug21576 | 4 ++++ src/or/connection_edge.c | 12 +++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-)

1 0

[research-web/master] Add "Safety Board" link to "Tech Reports" page.
by karsten＠torproject.org 04 Mar '17

04 Mar '17

commit 756c4cbb448871b30b88081194e7153db6bc6b84 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Sat Mar 4 10:09:12 2017 +0100 Add "Safety Board" link to "Tech Reports" page. --- techreports-header.html | 1 + 1 file changed, 1 insertion(+) diff --git a/techreports-header.html b/techreports-header.html index 96f72e7..244bbfd 100644 --- a/techreports-header.html +++ b/techreports-header.html @@ -15,6 +15,7 @@ width="193" height="79"></a></td> <td class="banner-middle"> <a href="index.html">Home</a> + <a href="safetyboard.html">Safety Board</a> <a href="groups.html">Groups</a> <a href="ideas.html">Ideas</a> Tech Reports

1 0

[research-web/master] Replace tor-assistants@ with Tor: Contact page.
by karsten＠torproject.org 04 Mar '17

04 Mar '17

commit 86e0bb24734284e3b3f13c1cab165802c66c0a3c Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Sat Mar 4 10:12:11 2017 +0100 Replace tor-assistants@ with Tor: Contact page. --- htdocs/index.html | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/htdocs/index.html b/htdocs/index.html index ec433d0..27a0d42 100644 --- a/htdocs/index.html +++ b/htdocs/index.html @@ -34,9 +34,8 @@ Tor design, what's going on in the Tor network, and more generally on attacks and defenses for anonymous communication systems. This page summarizes the resources we provide to help make your Tor research more effective. -The best way to reach us about research is through the -<a href="mailto:tor-assistants@lists.torproject.org">tor-assistants</a> -list.</p> +You can reach us about research by picking one of the channels listed +<a href="https://www.torproject.org/about/contact">here</a>.</p> <ul>

1 0