June 2017 - tor-commits - lists.torproject.org

[tor/maint-0.3.0] Merge branch 'maint-0.2.9' into maint-0.3.0
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit d389480da54dfff4900b5ddf8c0795a02672bafe Merge: a0664fd 8239af0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:29:23 2017 -0400 Merge branch 'maint-0.2.9' into maint-0.3.0 "ours" merge to avoid version bump.

1 0

[tor/maint-0.3.0] Merge branch 'maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit dec7998f5c42dde955760efc72f57025a32da238 Merge: 2e5220c 56a7c5b Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:21:15 2017 -0400 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.3.0] bump to 0.2.9.11
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit b53322024967746b24eb47ac688ddfbf7df8599f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:24:38 2017 -0400 bump to 0.2.9.11 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index d54793a..b295bf5 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2015, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.2.9.10-dev]) +AC_INIT([tor],[0.2.9.11]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index 5f3ac99..1f78046 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.9.10-dev" +!define VERSION "0.2.9.11" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index a54c009..b5ab2bf 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -218,7 +218,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.9.10-dev" +#define VERSION "0.2.9.11"

1 0

[tor/maint-0.3.0] Merge branch 'maint-0.2.5' into maint-0.2.6
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit b796ad0300d1b023bc38e5a1498b47bc2e680eae Merge: 0de4620 77c5d8c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:28:29 2017 -0400 Merge branch 'maint-0.2.5' into maint-0.2.6 "ours" merge to avoid version bump.

1 0

[tor/maint-0.3.0] Merge branch 'maint-0.2.7-redux' into maint-0.2.8
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit d15d09a96839e0c13a9b9845a51a402d7a931949 Merge: d850d27 c1646d6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:21:15 2017 -0400 Merge branch 'maint-0.2.7-redux' into maint-0.2.8 changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.3.0] Merge branch 'maint-0.2.8' into maint-0.2.9
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 8239af0d9cb3e45e4c5ff04ab057450934e306cf Merge: b533220 bff08ed Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:29:12 2017 -0400 Merge branch 'maint-0.2.8' into maint-0.2.9 "ours" merge to avoid version bump.

1 0

[tor/maint-0.3.0] Merge branch 'maint-0.2.6' into maint-0.2.7-redux
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit c1646d6e894f11fe3a363468d7a668648f2d63d7 Merge: 9a6f938 40bccc2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:21:15 2017 -0400 Merge branch 'maint-0.2.6' into maint-0.2.7-redux changes/trove-2017-005 | 7 +++++++ src/or/relay.c | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.3.0] Bump to 0.2.7.8
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 2efe0275bcdbbdf37d1d8ef59a8ec4df9f5fca59 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:27:34 2017 -0400 Bump to 0.2.7.8 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 80c4d3c..f754942 100644 --- a/configure.ac +++ b/configure.ac @@ -3,7 +3,7 @@ dnl Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson dnl Copyright (c) 2007-2015, The Tor Project, Inc. dnl See LICENSE for licensing information -AC_INIT([tor],[0.2.7.7]) +AC_INIT([tor],[0.2.7.8]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index f20c1a6..32c9731 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.7.7" +!define VERSION "0.2.7.8" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 57385c9..46714ef 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -232,7 +232,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.7.7" +#define VERSION "0.2.7.8"

1 0

[tor/master] tweak changes file.
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 0c46dc8097a3231cb2e5cb56365a8db8860b4079 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 8 09:16:33 2017 -0400 tweak changes file. --- changes/trove-2017-004 | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/changes/trove-2017-004 b/changes/trove-2017-004 index 106d3af..aa90145 100644 --- a/changes/trove-2017-004 +++ b/changes/trove-2017-004 @@ -1,5 +1,8 @@ - o Major bugfixes (hidden service, relay): - - Fix an assertion failure when an hidden service handles a malformed - BEGIN cell. This bug resulted in the service crashing triggered by a - tor_assert(). Part of TROVE-2017-004. Fixes bug 22493; bugfix on - tor-0.3.0.1-alpha. Found by armadev. + o Major bugfixes (hidden service, relay, security): + - Fix an assertion failure when an hidden service handles a + malformed BEGIN cell. This bug resulted in the service crashing + triggered by a tor_assert(). Fixes bug 22493, tracked as + TROVE-2017-004 and as CVE-2017-0375; bugfix on tor-0.3.0.1-alpha. + Found by armadev. + +

1 0

[tor/master] TROVE-2017-004: Fix assertion failure in relay_send_end_cell_from_edge_
by nickm＠torproject.org 08 Jun '17

08 Jun '17

commit 79b59a2dfcb68897ee89d98587d09e55f07e68d7 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Jun 5 09:35:03 2017 -0400 TROVE-2017-004: Fix assertion failure in relay_send_end_cell_from_edge_ This fixes an assertion failure in relay_send_end_cell_from_edge_() when an origin circuit and a cpath_layer = NULL were passed. A service rendezvous circuit could do such a thing when a malformed BEGIN cell is received but shouldn't in the first place because the service needs to send an END cell on the circuit for which it can not do without a cpath_layer. Fixes #22493 Reported-by: Roger Dingledine <arma(a)torproject.org> Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/trove-2017-004 | 5 +++++ src/or/connection_edge.c | 21 ++++++++++++++------- 2 files changed, 19 insertions(+), 7 deletions(-) diff --git a/changes/trove-2017-004 b/changes/trove-2017-004 new file mode 100644 index 0000000..106d3af --- /dev/null +++ b/changes/trove-2017-004 @@ -0,0 +1,5 @@ + o Major bugfixes (hidden service, relay): + - Fix an assertion failure when an hidden service handles a malformed + BEGIN cell. This bug resulted in the service crashing triggered by a + tor_assert(). Part of TROVE-2017-004. Fixes bug 22493; bugfix on + tor-0.3.0.1-alpha. Found by armadev. diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index dac0c01..d9d9e73 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -3091,14 +3091,21 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) char *address = NULL; uint16_t port = 0; or_circuit_t *or_circ = NULL; + origin_circuit_t *origin_circ = NULL; + crypt_path_t *layer_hint = NULL; const or_options_t *options = get_options(); begin_cell_t bcell; int rv; uint8_t end_reason=0; assert_circuit_ok(circ); - if (!CIRCUIT_IS_ORIGIN(circ)) + if (!CIRCUIT_IS_ORIGIN(circ)) { or_circ = TO_OR_CIRCUIT(circ); + } else { + tor_assert(circ->purpose == CIRCUIT_PURPOSE_S_REND_JOINED); + origin_circ = TO_ORIGIN_CIRCUIT(circ); + layer_hint = origin_circ->cpath->prev; + } relay_header_unpack(&rh, cell->payload); if (rh.length > RELAY_PAYLOAD_SIZE) @@ -3123,7 +3130,7 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) return -END_CIRC_REASON_TORPROTOCOL; } else if (rv == -1) { tor_free(bcell.address); - relay_send_end_cell_from_edge(rh.stream_id, circ, end_reason, NULL); + relay_send_end_cell_from_edge(rh.stream_id, circ, end_reason, layer_hint); return 0; } @@ -3160,7 +3167,7 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) if (!directory_permits_begindir_requests(options) || circ->purpose != CIRCUIT_PURPOSE_OR) { relay_send_end_cell_from_edge(rh.stream_id, circ, - END_STREAM_REASON_NOTDIRECTORY, NULL); + END_STREAM_REASON_NOTDIRECTORY, layer_hint); return 0; } /* Make sure to get the 'real' address of the previous hop: the @@ -3177,7 +3184,7 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) } else { log_warn(LD_BUG, "Got an unexpected command %d", (int)rh.command); relay_send_end_cell_from_edge(rh.stream_id, circ, - END_STREAM_REASON_INTERNAL, NULL); + END_STREAM_REASON_INTERNAL, layer_hint); return 0; } @@ -3188,7 +3195,7 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) if (bcell.flags & BEGIN_FLAG_IPV4_NOT_OK) { tor_free(address); relay_send_end_cell_from_edge(rh.stream_id, circ, - END_STREAM_REASON_EXITPOLICY, NULL); + END_STREAM_REASON_EXITPOLICY, layer_hint); return 0; } } @@ -3211,7 +3218,7 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) n_stream->deliver_window = STREAMWINDOW_START; if (circ->purpose == CIRCUIT_PURPOSE_S_REND_JOINED) { - origin_circuit_t *origin_circ = TO_ORIGIN_CIRCUIT(circ); + tor_assert(origin_circ); log_info(LD_REND,"begin is for rendezvous. configuring stream."); n_stream->base_.address = tor_strdup("(rendezvous)"); n_stream->base_.state = EXIT_CONN_STATE_CONNECTING; @@ -3231,7 +3238,7 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ) * the hidden service. */ relay_send_end_cell_from_edge(rh.stream_id, circ, END_STREAM_REASON_DONE, - origin_circ->cpath->prev); + layer_hint); connection_free(TO_CONN(n_stream)); tor_free(address);

1 0