tor-commits June 2017

tor-commits@lists.torproject.org

13 participants
1918 discussions

[tor/release-0.3.0] tweak changes file.
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 0c46dc8097a3231cb2e5cb56365a8db8860b4079 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:16:33 2017 -0400 tweak changes file. --- changes/trove-2017-004 | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/changes/trove-2017-004 b/changes/trove-2017-004 index 106d3af..aa90145 100644 --- a/changes/trove-2017-004 +++ b/changes/trove-2017-004 @@ -1,5 +1,8 @@ - o Major bugfixes (hidden service, relay): - - Fix an assertion failure when an hidden service handles a malformed - BEGIN cell. This bug resulted in the service crashing triggered by a - tor_assert(). Part of TROVE-2017-004. Fixes bug 22493; bugfix on - tor-0.3.0.1-alpha. Found by armadev. + o Major bugfixes (hidden service, relay, security): + - Fix an assertion failure when an hidden service handles a + malformed BEGIN cell. This bug resulted in the service crashing + triggered by a tor_assert(). Fixes bug 22493, tracked as + TROVE-2017-004 and as CVE-2017-0375; bugfix on tor-0.3.0.1-alpha. + Found by armadev. + +

1 0

[tor/release-0.3.0] TROVE-2017-004: Fix assertion failure in relay_send_end_cell_from_edge_
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 79b59a2dfcb68897ee89d98587d09e55f07e68d7 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Jun 5 09:35:03 2017 -0400 TROVE-2017-004: Fix assertion failure in relay_send_end_cell_from_edge_ This fixes an assertion failure in relay_send_end_cell_from_edge_() when an origin circuit and a cpath_layer = NULL were passed. A service rendezvous circuit could do such a thing when a malformed BEGIN cell is received but shouldn't in the first place because the service needs to send an END cell on the circuit for which it can not do without a cpath_layer. Fixes #22493 Reported-by: Roger Dingledine <arma(a)torproject.org> Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/trove-2017-004 | 5 +++++ src/or/connection_edge.c | 21 ++++++++++++++------- 2 files changed, 19 insertions(+), 7 deletions(-) diff --git a/changes/trove-2017-004 b/changes/trove-2017-004 new file mode 100644 index 0000000..106d3af --- /dev/null +++ b/changes/trove-2017-004 @@ -0,0 +1,5 @@ + o Major bugfixes (hidden service, relay): + - Fix an assertion failure when an hidden service handles a malformed + BEGIN cell. This bug resulted in the service crashing triggered by a + tor_assert(). Part of TROVE-2017-004. Fixes bug 22493; bugfix on + tor-0.3.0.1-alpha. Found by armadev. diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index dac0c01..d9d9e73 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -3091,14 +3091,21 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) char *address = NULL; uint16_t port = 0; or_circuit_t *or_circ = NULL; + origin_circuit_t *origin_circ = NULL; + crypt_path_t *layer_hint = NULL; const or_options_t *options = get_options(); begin_cell_t bcell; int rv; uint8_t end_reason=0; assert_circuit_ok(circ); - if (!CIRCUIT_IS_ORIGIN(circ)) + if (!CIRCUIT_IS_ORIGIN(circ)) { or_circ = TO_OR_CIRCUIT(circ); + } else { + tor_assert(circ->purpose == CIRCUIT_PURPOSE_S_REND_JOINED); + origin_circ = TO_ORIGIN_CIRCUIT(circ); + layer_hint = origin_circ->cpath->prev; + } relay_header_unpack(&rh, cell->payload); if (rh.length > RELAY_PAYLOAD_SIZE) @@ -3123,7 +3130,7 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) return -END_CIRC_REASON_TORPROTOCOL; } else if (rv == -1) { tor_free(bcell.address); - relay_send_end_cell_from_edge(rh.stream_id, circ, end_reason, NULL); + relay_send_end_cell_from_edge(rh.stream_id, circ, end_reason, layer_hint); return 0; } @@ -3160,7 +3167,7 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) if (!directory_permits_begindir_requests(options) || circ->purpose != CIRCUIT_PURPOSE_OR) { relay_send_end_cell_from_edge(rh.stream_id, circ, - END_STREAM_REASON_NOTDIRECTORY, NULL); + END_STREAM_REASON_NOTDIRECTORY, layer_hint); return 0; } /* Make sure to get the 'real' address of the previous hop: the @@ -3177,7 +3184,7 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) } else { log_warn(LD_BUG, "Got an unexpected command %d", (int)rh.command); relay_send_end_cell_from_edge(rh.stream_id, circ, - END_STREAM_REASON_INTERNAL, NULL); + END_STREAM_REASON_INTERNAL, layer_hint); return 0; } @@ -3188,7 +3195,7 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) if (bcell.flags & BEGIN_FLAG_IPV4_NOT_OK) { tor_free(address); relay_send_end_cell_from_edge(rh.stream_id, circ, - END_STREAM_REASON_EXITPOLICY, NULL); + END_STREAM_REASON_EXITPOLICY, layer_hint); return 0; } } @@ -3211,7 +3218,7 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) n_stream->deliver_window = STREAMWINDOW_START; if (circ->purpose == CIRCUIT_PURPOSE_S_REND_JOINED) { - origin_circuit_t *origin_circ = TO_ORIGIN_CIRCUIT(circ); + tor_assert(origin_circ); log_info(LD_REND,"begin is for rendezvous. configuring stream."); n_stream->base_.address = tor_strdup("(rendezvous)"); n_stream->base_.state = EXIT_CONN_STATE_CONNECTING; @@ -3231,7 +3238,7 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) * the hidden service. */ relay_send_end_cell_from_edge(rh.stream_id, circ, END_STREAM_REASON_DONE, - origin_circ->cpath->prev); + layer_hint); connection_free(TO_CONN(n_stream)); tor_free(address);

1 0

[tor/release-0.2.9] Merge branch 'maint-0.2.6' into maint-0.2.7-redux
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 4915d9c5a7fc8db2497258a293137426cbd0d665 Merge: 2efe027 b796ad0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:28:54 2017 -0400 Merge branch 'maint-0.2.6' into maint-0.2.7-redux "ours" merge to avoid version bump.

1 0

[tor/release-0.2.9] copy changelog to releasenotes
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 75c2fd42cc74d77491faf330cd84a098dade5e2b Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:35:13 2017 -0400 copy changelog to releasenotes --- ReleaseNotes | 73 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) diff --git a/ReleaseNotes b/ReleaseNotes index 4c1bb3d..13455b3 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -2,6 +2,79 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.2.9.11 - 2017-06-08 + Tor 0.2.9.11 fixes a pair of bugs that would allow an attacker to + remotely crash a hidden service with an assertion failure. Anyone + running a hidden service should upgrade to this version, or to some + other version with fixes for TROVE-2017-004 and TROVE-2017-005. + + Tor 0.2.9.11 also backports fixes for several key management bugs + that sometimes made relays unreliable, as well as several other + bugfixes described below. + + o Major bugfixes (hidden service, relay, security, backport + from 0.3.1.3-alpha): + - Fix a remotely triggerable assertion failure caused by receiving a + BEGIN_DIR cell on a hidden service rendezvous circuit. Fixes bug + 22494, tracked as TROVE-2017-005 and CVE-2017-0376; bugfix + on 0.2.2.1-alpha. + + o Major bugfixes (relay, link handshake, backport from 0.3.1.3-alpha): + - When performing the v3 link handshake on a TLS connection, report + that we have the x509 certificate that we actually used on that + connection, even if we have changed certificates since that + connection was first opened. Previously, we would claim to have + used our most recent x509 link certificate, which would sometimes + make the link handshake fail. Fixes one case of bug 22460; bugfix + on 0.2.3.6-alpha. + + o Minor features (fallback directory list, backport from 0.3.1.3-alpha): + - Replace the 177 fallbacks originally introduced in Tor 0.2.9.8 in + December 2016 (of which ~126 were still functional) with a list of + 151 fallbacks (32 new, 119 unchanged, 58 removed) generated in May + 2017. Resolves ticket 21564. + + o Minor features (future-proofing, backport from 0.3.0.7): + - Tor no longer refuses to download microdescriptors or descriptors if + they are listed as "published in the future". This change will + eventually allow us to stop listing meaningful "published" dates + in microdescriptor consensuses, and thereby allow us to reduce the + resources required to download consensus diffs by over 50%. + Implements part of ticket 21642; implements part of proposal 275. + + o Minor features (directory authorities, backport from 0.3.0.4-rc) + - Directory authorities now reject relays running versions + 0.2.9.1-alpha through 0.2.9.4-alpha, because those relays + suffer from bug 20499 and don't keep their consensus cache + up-to-date. Resolves ticket 20509. + + o Minor features (geoip): + - Update geoip and geoip6 to the May 2 2017 Maxmind GeoLite2 + Country database. + + o Minor bugfixes (control port, backport from 0.3.0.6): + - The GETINFO extra-info/digest/<digest> command was broken because + of a wrong base16 decode return value check, introduced when + refactoring that API. Fixes bug 22034; bugfix on 0.2.9.1-alpha. + + o Minor bugfixes (correctness, backport from 0.3.1.3-alpha): + - Avoid undefined behavior when parsing IPv6 entries from the geoip6 + file. Fixes bug 22490; bugfix on 0.2.4.6-alpha. + + o Minor bugfixes (Linux seccomp2 sandbox, backport from 0.3.0.7): + - The getpid() system call is now permitted under the Linux seccomp2 + sandbox, to avoid crashing with versions of OpenSSL (and other + libraries) that attempt to learn the process's PID by using the + syscall rather than the VDSO code. Fixes bug 21943; bugfix + on 0.2.5.1-alpha. + + o Minor bugfixes (memory leak, directory authority, backport + from 0.3.1.2-alpha): + - When directory authorities reject a router descriptor due to + keypinning, free the router descriptor rather than leaking the + memory. Fixes bug 22370; bugfix on 0.2.7.2-alpha. + + Changes in version 0.2.9.10 - 2017-03-01 Tor 0.2.9.10 backports a security fix for users who build Tor with the --enable-expensive-hardening option. It also includes fixes for

1 0

[tor/release-0.3.0] Merge branch 'maint-0.2.7-redux' into maint-0.2.8
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit d15d09a96839e0c13a9b9845a51a402d7a931949 Merge: d850d27 c1646d6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:21:15 2017 -0400 Merge branch 'maint-0.2.7-redux' into maint-0.2.8 changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.0] Merge branch 'maint-0.2.9' into maint-0.3.0
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 53011e3e54c3d8374c7044b657f90eb723ac39d1 Merge: eb5d05f 987c7ca Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:21:15 2017 -0400 Merge branch 'maint-0.2.9' into maint-0.3.0 changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.0] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit dec7998f5c42dde955760efc72f57025a32da238 Merge: 2e5220c 56a7c5b Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:21:15 2017 -0400 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.0] Merge branch 'maint-0.2.5' into maint-0.2.6
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 40bccc20042fcc4f43964b358257470830169e73 Merge: a56cfda dec7998 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:21:15 2017 -0400 Merge branch 'maint-0.2.5' into maint-0.2.6 changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.0] Merge branch 'maint-0.3.0' into release-0.3.0
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 63d0426af5b87f4dd0de710702728c4d737514de Merge: 916791f 53011e3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:21:15 2017 -0400 Merge branch 'maint-0.3.0' into release-0.3.0 changes/trove-2017-004 | 4 ++-- changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 3 files changed, 11 insertions(+), 3 deletions(-)

1 0

[tor/release-0.3.0] TROVE-2017-005: Fix assertion failure in connection_edge_process_relay_cell
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 56a7c5bc15e0447203a491c1ee37de9939ad1dcd Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Jun 5 11:11:42 2017 -0400 TROVE-2017-005: Fix assertion failure in connection_edge_process_relay_cell On an hidden service rendezvous circuit, a BEGIN_DIR could be sent (maliciously) which would trigger a tor_assert() because connection_edge_process_relay_cell() thought that the circuit is an or_circuit_t but is an origin circuit in reality. Fixes #22494 Reported-by: Roger Dingledine <arma(a)torproject.org> Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/changes/trove-2017-005 b/changes/trove-2017-005 new file mode 100644 index 0000000..cebb013 --- /dev/null +++ b/changes/trove-2017-005 @@ -0,0 +1,7 @@ + o Major bugfixes (hidden service, relay, security): + - Fix an assertion failure caused by receiving a BEGIN_DIR cell on + a hidden service rendezvous circuit. Fixes bug 22494, tracked as + TROVE-2017-005 and CVE-2017-0376; bugfix on 0.2.2.1-alpha. Found + by armadev. + + diff --git a/src/or/relay.c b/src/or/relay.c index 7f06c6e..59b79f9 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1297,7 +1297,8 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, "Begin cell for known stream. Dropping."); return 0; } - if (rh.command == RELAY_COMMAND_BEGIN_DIR) { + if (rh.command == RELAY_COMMAND_BEGIN_DIR && + circ->purpose != CIRCUIT_PURPOSE_S_REND_JOINED) { /* Assign this circuit and its app-ward OR connection a unique ID, * so that we can measure download times. The local edge and dir * connection will be assigned the same ID when they are created

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits June 2017