June 2017 - tor-commits - lists.torproject.org

[tor/release-0.2.5] Merge branch 'maint-0.2.5' into release-0.2.5
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 0a78d2947cc1f7a0aa2ede2c37baec3e4c23a424 Merge: 020c003 dec7998 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:21:15 2017 -0400 Merge branch 'maint-0.2.5' into release-0.2.5 changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-)

1 0

[tor/master] Merge branch 'maint-0.2.7-redux' into maint-0.2.8
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit bff08ed8eb4f9c36d32ae5e15bd574052cca8d78 Merge: 792931d 4915d9c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:29:05 2017 -0400 Merge branch 'maint-0.2.7-redux' into maint-0.2.8 "ours" merge to avoid version bump.

1 0

[tor/master] Merge branch 'maint-0.2.9' into maint-0.3.0
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit d389480da54dfff4900b5ddf8c0795a02672bafe Merge: a0664fd 8239af0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:29:23 2017 -0400 Merge branch 'maint-0.2.9' into maint-0.3.0 "ours" merge to avoid version bump.

1 0

[tor/release-0.2.4] Merge branch 'maint-0.2.4' into release-0.2.4
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit cdb58af90d26452be60781355fbf40f7328735bd Merge: 98f6100 56a7c5b Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:21:15 2017 -0400 Merge branch 'maint-0.2.4' into release-0.2.4 changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-)

1 0

[tor/release-0.2.5] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit dec7998f5c42dde955760efc72f57025a32da238 Merge: 2e5220c 56a7c5b Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:21:15 2017 -0400 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-)

1 0

[tor/release-0.2.5] TROVE-2017-005: Fix assertion failure in connection_edge_process_relay_cell
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 56a7c5bc15e0447203a491c1ee37de9939ad1dcd Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Jun 5 11:11:42 2017 -0400 TROVE-2017-005: Fix assertion failure in connection_edge_process_relay_cell On an hidden service rendezvous circuit, a BEGIN_DIR could be sent (maliciously) which would trigger a tor_assert() because connection_edge_process_relay_cell() thought that the circuit is an or_circuit_t but is an origin circuit in reality. Fixes #22494 Reported-by: Roger Dingledine <arma(a)torproject.org> Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/changes/trove-2017-005 b/changes/trove-2017-005 new file mode 100644 index 0000000..cebb013 --- /dev/null +++ b/changes/trove-2017-005 @@ -0,0 +1,7 @@ + o Major bugfixes (hidden service, relay, security): + - Fix an assertion failure caused by receiving a BEGIN_DIR cell on + a hidden service rendezvous circuit. Fixes bug 22494, tracked as + TROVE-2017-005 and CVE-2017-0376; bugfix on 0.2.2.1-alpha. Found + by armadev. + + diff --git a/src/or/relay.c b/src/or/relay.c index 7f06c6e..59b79f9 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1297,7 +1297,8 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, "Begin cell for known stream. Dropping."); return 0; } - if (rh.command == RELAY_COMMAND_BEGIN_DIR) { + if (rh.command == RELAY_COMMAND_BEGIN_DIR && + circ->purpose != CIRCUIT_PURPOSE_S_REND_JOINED) { /* Assign this circuit and its app-ward OR connection a unique ID, * so that we can measure download times. The local edge and dir * connection will be assigned the same ID when they are created

1 0

[tor/master] Merge branch 'maint-0.2.5' into maint-0.2.6
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit b796ad0300d1b023bc38e5a1498b47bc2e680eae Merge: 0de4620 77c5d8c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:28:29 2017 -0400 Merge branch 'maint-0.2.5' into maint-0.2.6 "ours" merge to avoid version bump.

1 0

[tor/master] Merge branch 'maint-0.2.6' into maint-0.2.7-redux
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 4915d9c5a7fc8db2497258a293137426cbd0d665 Merge: 2efe027 b796ad0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:28:54 2017 -0400 Merge branch 'maint-0.2.6' into maint-0.2.7-redux "ours" merge to avoid version bump.

1 0

[tor/master] Merge branch 'maint-0.3.0'
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 40aa1b1fdc459eebffcdc7596cd1972713ef5d56 Merge: 78d4200 d389480 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:29:36 2017 -0400 Merge branch 'maint-0.3.0'

1 0

[tor/master] Tweak 0.2.9.11 changelog
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit a95202d78138193ff0e7b1a28345306f13323b39 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:48:12 2017 -0400 Tweak 0.2.9.11 changelog --- ChangeLog | 5 +++-- ReleaseNotes | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 772109a..e9ff845 100644 --- a/ChangeLog +++ b/ChangeLog @@ -166,10 +166,11 @@ Changes in version 0.3.0.8 - 2017-06-08 Changes in version 0.2.9.11 - 2017-06-08 - Tor 0.2.9.11 fixes a pair of bugs that would allow an attacker to + Tor 0.2.9.11 backports a fix for a bug that would allow an attacker to remotely crash a hidden service with an assertion failure. Anyone running a hidden service should upgrade to this version, or to some - other version with fixes for TROVE-2017-004 and TROVE-2017-005. + other version with fixes for TROVE-2017-005. (Versions before 0.3.0 + are not affected by TROVE-2017-004.) Tor 0.2.9.11 also backports fixes for several key management bugs that sometimes made relays unreliable, as well as several other diff --git a/ReleaseNotes b/ReleaseNotes index da0d254..c6d6917 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -81,10 +81,11 @@ Changes in version 0.3.0.8 - 2017-06-08 Changes in version 0.2.9.11 - 2017-06-08 - Tor 0.2.9.11 fixes a pair of bugs that would allow an attacker to + Tor 0.2.9.11 backports a fix for a bug that would allow an attacker to remotely crash a hidden service with an assertion failure. Anyone running a hidden service should upgrade to this version, or to some - other version with fixes for TROVE-2017-004 and TROVE-2017-005. + other version with fixes for TROVE-2017-005. (Versions before 0.3.0 + are not affected by TROVE-2017-004.) Tor 0.2.9.11 also backports fixes for several key management bugs that sometimes made relays unreliable, as well as several other

1 0