August 2017 - tor-commits - lists.torproject.org

[tor/master] prop224: Client has opened circuit logic
by nickm＠torproject.org 24 Aug '17

24 Aug '17

commit 6eb125d14bf69e9dad427fe4b1005477177acc04 Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Jul 21 13:56:10 2017 -0400 prop224: Client has opened circuit logic Make a single entry point for the entire HS subsystem when a client circuit opens (every HS version). Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/circuituse.c | 4 +- src/or/hs_client.c | 106 ++++++++++++++++++++++++++++++++++++++++++++++++++++ src/or/hs_client.h | 2 + 3 files changed, 110 insertions(+), 2 deletions(-) diff --git a/src/or/circuituse.c b/src/or/circuituse.c index 21cc9c540..5b35155ee 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -1636,7 +1636,7 @@ circuit_has_opened(origin_circuit_t *circ) switch (TO_CIRCUIT(circ)->purpose) { case CIRCUIT_PURPOSE_C_ESTABLISH_REND: - rend_client_rendcirc_has_opened(circ); + hs_client_circuit_has_opened(circ); /* Start building an intro circ if we don't have one yet. */ connection_ap_attach_pending(1); /* This isn't a call to circuit_try_attaching_streams because a @@ -1648,7 +1648,7 @@ circuit_has_opened(origin_circuit_t *circ) * state. */ break; case CIRCUIT_PURPOSE_C_INTRODUCING: - rend_client_introcirc_has_opened(circ); + hs_client_circuit_has_opened(circ); break; case CIRCUIT_PURPOSE_C_GENERAL: /* Tell any AP connections that have been waiting for a new diff --git a/src/or/hs_client.c b/src/or/hs_client.c index 3f951a21a..b06f3d935 100644 --- a/src/or/hs_client.c +++ b/src/or/hs_client.c @@ -308,6 +308,82 @@ send_introduce1(origin_circuit_t *intro_circ, return status; } +/* Using the introduction circuit circ, setup the authentication key of the + * intro point this circuit has extended to. */ +static void +setup_intro_circ_auth_key(origin_circuit_t *circ) +{ + const hs_descriptor_t *desc; + + tor_assert(circ); + + desc = hs_cache_lookup_as_client(&circ->hs_ident->identity_pk); + if (BUG(desc == NULL)) { + /* Opening intro circuit without the descriptor is no good... */ + goto end; + } + + /* We will go over every intro point and try to find which one is linked to + * that circuit. Those lists are small so it's not that expensive. */ + SMARTLIST_FOREACH_BEGIN(desc->encrypted_data.intro_points, + const hs_desc_intro_point_t *, ip) { + SMARTLIST_FOREACH_BEGIN(ip->link_specifiers, + const hs_desc_link_specifier_t *, lspec) { + /* Not all tor node have an ed25519 identity key so we still rely on the + * legacy identity digest. */ + if (lspec->type != LS_LEGACY_ID) { + continue; + } + if (fast_memneq(circ->build_state->chosen_exit->identity_digest, + lspec->u.legacy_id, DIGEST_LEN)) { + break; + } + /* We got it, copy its authentication key to the identifier. */ + ed25519_pubkey_copy(&circ->hs_ident->intro_auth_pk, + &ip->auth_key_cert->signed_key); + goto end; + } SMARTLIST_FOREACH_END(lspec); + } SMARTLIST_FOREACH_END(ip); + + /* Reaching this point means we didn't find any intro point for this circuit + * which is not suppose to happen. */ + tor_assert_nonfatal_unreached(); + + end: + return; +} + +/* Called when an introduction circuit has opened. */ +static void +client_intro_circ_has_opened(origin_circuit_t *circ) +{ + tor_assert(circ); + tor_assert(TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_C_INTRODUCING); + log_info(LD_REND, "Introduction circuit %u has opened. Attaching streams.", + (unsigned int) TO_CIRCUIT(circ)->n_circ_id); + + /* This is an introduction circuit so we'll attach the correct + * authentication key to the circuit identifier so it can be identified + * properly later on. */ + setup_intro_circ_auth_key(circ); + + connection_ap_attach_pending(1); +} + +/* Called when a rendezvous circuit has opened. */ +static void +client_rendezvous_circ_has_opened(origin_circuit_t *circ) +{ + tor_assert(circ); + tor_assert(TO_CIRCUIT(circ)->purpose == CIRCUIT_PURPOSE_C_ESTABLISH_REND); + + log_info(LD_REND, "Rendezvous circuit has opened to %s.", + safe_str_client( + extend_info_describe(circ->build_state->chosen_exit))); + + /* XXX Send ESTABLISH REND cell. */ +} + /* ========== */ /* Public API */ /* ========== */ @@ -430,3 +506,33 @@ hs_client_send_introduce1(origin_circuit_t *intro_circ, rend_circ); } +/* Called when the client circuit circ has been established. It can be either + * an introduction or rendezvous circuit. This function handles all hidden + * service versions. */ +void +hs_client_circuit_has_opened(origin_circuit_t *circ) +{ + tor_assert(circ); + + /* Handle both version. v2 uses rend_data and v3 uses the hs circuit + * identifier hs_ident. Can't be both. */ + switch (TO_CIRCUIT(circ)->purpose) { + case CIRCUIT_PURPOSE_C_INTRODUCING: + if (circ->hs_ident) { + client_intro_circ_has_opened(circ); + } else { + rend_client_introcirc_has_opened(circ); + } + break; + case CIRCUIT_PURPOSE_C_ESTABLISH_REND: + if (circ->hs_ident) { + client_rendezvous_circ_has_opened(circ); + } else { + rend_client_rendcirc_has_opened(circ); + } + break; + default: + tor_assert_nonfatal_unreached(); + } +} + diff --git a/src/or/hs_client.h b/src/or/hs_client.h index d8348ddb3..a716fc02e 100644 --- a/src/or/hs_client.h +++ b/src/or/hs_client.h @@ -25,5 +25,7 @@ int hs_client_refetch_hsdesc(const ed25519_public_key_t *identity_pk); int hs_client_send_introduce1(origin_circuit_t *intro_circ, origin_circuit_t *rend_circ); +void hs_client_circuit_has_opened(origin_circuit_t *circ); + #endif /* TOR_HS_CLIENT_H */

1 0

[webwml/master] Escaping equals sign in viewport
by hiro＠torproject.org 24 Aug '17

24 Aug '17

commit e670475bcd5d84bfcc58440469d20c5280dfc800 Author: hiromipaw <hiro(a)torproject.org> Date: Thu Aug 24 16:21:44 2017 +0200 Escaping equals sign in viewport --- include/head.wmi | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/include/head.wmi b/include/head.wmi index 57081b2c..dc4d5e26 100644 --- a/include/head.wmi +++ b/include/head.wmi @@ -6,18 +6,22 @@ #use "versions.wmi" #use "navigation.wmi" +<define-tag viewport whitespace=delete> +<meta name="viewport" content="width\=device-width, initial-scale=1"> +</define-tag> + + <!DOCTYPE html> <html> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> - <meta name="viewport" content="width=device-width, initial-scale=1"> + <viewport> <meta name="author" content="The Tor Project, Inc."> <meta name="description" content="The Tor Project's free software protects your privacy online. Site blocked? Email [mailto:gettor@torproject.org] for help downloading Tor Browser."> <meta name="keywords" content="tor, tor project, tor browser, avoid censorship, traffic analysis, anonymous communications, privacy, avoid surveillance, online security, anonymous online, private browsing, anonymity online, online privacy, protect privacy, private mac browser, private windows browser, private android browser, linux browser, anonymity network, tor network, onion router, onion browser"> <meta property="og:image" content="https://www.torproject.org/images/tor-logo.jpg"> - <meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' payments-amazon.com"> {#meta#} <title>$(TITLE)</title> @@ -40,7 +44,7 @@  - # <script language="javascript" type="text/javascript" src="$(DOCROOT)/global.js"></script> + # <script language="javascript" type="text/javascript" src="$(DOCROOT)/global.js"></script> # end WML to generate css/js paths </head> <body>

1 0

[webwml/master] Fix security policy for amazon donate page
by hiro＠torproject.org 24 Aug '17

24 Aug '17

commit 9f7db64946870614808bc6cc8a7f94eef181e5e0 Author: hiromipaw <hiro(a)torproject.org> Date: Tue Aug 8 11:35:15 2017 +0200 Fix security policy for amazon donate page --- include/head.wmi | 1 + 1 file changed, 1 insertion(+) diff --git a/include/head.wmi b/include/head.wmi index b2d16ec4..57081b2c 100644 --- a/include/head.wmi +++ b/include/head.wmi @@ -17,6 +17,7 @@ <meta name="description" content="The Tor Project's free software protects your privacy online. Site blocked? Email [mailto:gettor@torproject.org] for help downloading Tor Browser."> <meta name="keywords" content="tor, tor project, tor browser, avoid censorship, traffic analysis, anonymous communications, privacy, avoid surveillance, online security, anonymous online, private browsing, anonymity online, online privacy, protect privacy, private mac browser, private windows browser, private android browser, linux browser, anonymity network, tor network, onion router, onion browser"> <meta property="og:image" content="https://www.torproject.org/images/tor-logo.jpg"> + <meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' payments-amazon.com"> {#meta#} <title>$(TITLE)</title>

1 0

[webwml/master] Merge branch 'master' of ssh://git-rw.torproject.org/project/web/webwml
by hiro＠torproject.org 24 Aug '17

24 Aug '17

commit 7e3fccb40a7c619f44845b5495bfab411141b777 Merge: e670475b 52c29243 Author: hiromipaw <hiro(a)torproject.org> Date: Thu Aug 24 16:21:48 2017 +0200 Merge branch 'master' of ssh://git-rw.torproject.org/project/web/webwml about/en/corepeople.wml | 2 +- about/en/sponsors.wml | 16 +++++------ include/versions.wmi | 44 +++++++++++++++--------------- projects/torbrowser/RecommendedTBBVersions | 18 ++++++------ 4 files changed, 39 insertions(+), 41 deletions(-)

1 0

[tor/master] Merge branch 'bug23106_032'
by nickm＠torproject.org 24 Aug '17

24 Aug '17

commit b5c5086aba2fa24649fcbda7db80ef599d56e3c6 Merge: 35a29e81a 3b646bf88 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Aug 24 09:45:03 2017 -0400 Merge branch 'bug23106_032' changes/bug23106 | 5 +++++ src/or/onion.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/master] Fix ntohs() that should have been htons()
by nickm＠torproject.org 24 Aug '17

24 Aug '17

commit 3b646bf887f95c7f26ca05fb7fb3af10806b1328 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Aug 4 12:17:53 2017 -0400 Fix ntohs() that should have been htons() Fixes bug 23106; bugfix on 0.2.4.8-alpha. Fortunately, we only support big-endian and little-endian platforms, and on both of those, hton*() and ntoh*() behave the same. And if we did start to support middle endian systems (haha, no), most of _those_ have hton*(x) == ntoh*(x) too. --- changes/bug23106 | 5 +++++ src/or/onion.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug23106 b/changes/bug23106 new file mode 100644 index 000000000..d4ced15f8 --- /dev/null +++ b/changes/bug23106 @@ -0,0 +1,5 @@ + o Minor bugfixes (code correctness): + - Call htons() in extend_cell_format() for encoding a 16-bit + value. Previously we used ntohs(), which happens to behave the + same on all the platforms we support, but which isn't really + correct. Fixes bug 23106; bugfix on 0.2.4.8-alpha. diff --git a/src/or/onion.c b/src/or/onion.c index a98b97cb1..7e1e89df1 100644 --- a/src/or/onion.c +++ b/src/or/onion.c @@ -1219,7 +1219,7 @@ extend_cell_format(uint8_t *command_out, uint16_t *len_out, *command_out = RELAY_COMMAND_EXTEND; *len_out = 6 + TAP_ONIONSKIN_CHALLENGE_LEN + DIGEST_LEN; set_uint32(p, tor_addr_to_ipv4n(&cell_in->orport_ipv4.addr)); - set_uint16(p+4, ntohs(cell_in->orport_ipv4.port)); + set_uint16(p+4, htons(cell_in->orport_ipv4.port)); if (cell_in->create_cell.handshake_type == ONION_HANDSHAKE_TYPE_NTOR) { memcpy(p+6, NTOR_CREATE_MAGIC, 16); memcpy(p+22, cell_in->create_cell.onionskin, NTOR_ONIONSKIN_LEN);

1 0

[tor/master] Merge branch 'bug19281_025'
by nickm＠torproject.org 24 Aug '17

24 Aug '17

commit 35a29e81aea1712caada533dbdab4248612cc185 Merge: d37e8b407 6f7d548bc Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Aug 24 09:27:26 2017 -0400 Merge branch 'bug19281_025' changes/bug19281 | 5 +++++ src/or/control.c | 20 ++++++++++++++------ 2 files changed, 19 insertions(+), 6 deletions(-)

1 0

[tor/master] Make write_escaped_data more robust to large inputs.
by nickm＠torproject.org 24 Aug '17

24 Aug '17

commit 6f7d548bc428a5aa923c04cdcdab59af88a3495b Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 9 08:58:38 2017 -0400 Make write_escaped_data more robust to large inputs. The old implementation would fail with super-long inputs. We never gave it any, but still, it's nicer to dtrt here. Reported by Guido Vranken. Fixes bug 19281. --- changes/bug19281 | 5 +++++ src/or/control.c | 20 ++++++++++++++------ 2 files changed, 19 insertions(+), 6 deletions(-) diff --git a/changes/bug19281 b/changes/bug19281 new file mode 100644 index 000000000..1586ba34f --- /dev/null +++ b/changes/bug19281 @@ -0,0 +1,5 @@ + o Minor bugfixes (correctness, controller): + - Make the controller's write_escaped_data() function robust to extremely + long inputs. Right now, it doesn't actually receive any extremely + long inputs, so this is for defense in depth. Fixes bug 19281; + bugfix on 0.1.1.1-alpha. Reported by Guido Vranken. diff --git a/src/or/control.c b/src/or/control.c index 2ff1cc844..4df670cd2 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -313,16 +313,23 @@ connection_write_str_to_buf(const char *s, control_connection_t *conn) STATIC size_t write_escaped_data(const char *data, size_t len, char **out) { - size_t sz_out = len+8; + tor_assert(len < SIZE_MAX - 9); + size_t sz_out = len+8+1; char *outp; const char *start = data, *end; - int i; + size_t i; int start_of_line; - for (i=0; i<(int)len; ++i) { - if (data[i]== '\n') + for (i=0; i < len; ++i) { + if (data[i] == '\n') { sz_out += 2; /* Maybe add a CR; maybe add a dot. */ + if (sz_out >= SIZE_T_CEILING) { + log_warn(LD_BUG, "Input to write_escaped_data was too long"); + *out = tor_strdup(".\r\n"); + return 3; + } + } } - *out = outp = tor_malloc(sz_out+1); + *out = outp = tor_malloc(sz_out); end = data+len; start_of_line = 1; while (data < end) { @@ -348,7 +355,8 @@ write_escaped_data(const char *data, size_t len, char **out) *outp++ = '\r'; *outp++ = '\n'; *outp = '\0'; /* NUL-terminate just in case. */ - tor_assert((outp - *out) <= (int)sz_out); + tor_assert(outp >= *out); + tor_assert((size_t)(outp - *out) <= sz_out); return outp - *out; }

1 0

[tor/master] Add a 'NoExec' option that causes tor_spawn_background() to fail
by nickm＠torproject.org 24 Aug '17

24 Aug '17

commit eb43401bfb6d69db66d256582a99e63de7d222d8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 9 10:42:37 2017 -0400 Add a 'NoExec' option that causes tor_spawn_background() to fail Core of an implementation for 22976. --- changes/feature22976 | 7 +++++++ doc/tor.1.txt | 7 +++++++ src/common/util.c | 17 +++++++++++++++++ src/common/util.h | 2 ++ src/or/config.c | 11 +++++++++++ src/or/or.h | 4 ++++ 6 files changed, 48 insertions(+) diff --git a/changes/feature22976 b/changes/feature22976 new file mode 100644 index 000000000..334f47ad0 --- /dev/null +++ b/changes/feature22976 @@ -0,0 +1,7 @@ + o Minor features (integration, hardening): + - Added a new NoExec option to . When this option is set to 1, + Tor will never try to run another program, regardless of + the settings of PortForwardingHelper, ClientTransportPlugin, + or ServerTransportPlugin. Once NoExec is set, it cannot be + disabled without restarting Tor. + Closes ticket 22976. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index b4a3cc5f7..fb19ce38b 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -773,6 +773,13 @@ GENERAL OPTIONS circuits. If the option is set to "default", we obey a parameter in the consensus document. (Default: auto) +[[NoExec]] **NoExec** **0**|**1**:: + If this option is set to 1, then Tor will never launch another + executable, regardless of the settings of PortForwardingHelper, + ClientTransportPlugin, or ServerTransportPlugin. Once this + option has been set to 1, it cannot be set back to 0 without + restarting Tor. (Default: 0) + CLIENT OPTIONS -------------- diff --git a/src/common/util.c b/src/common/util.c index 0858d17fe..18108fc24 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -4142,6 +4142,20 @@ process_handle_waitpid_cb(int status, void *arg) #define CHILD_STATE_EXEC 8 #define CHILD_STATE_FAILEXEC 9 /** @} */ +/** + * Boolean. If true, then Tor may call execve or CreateProcess via + * tor_spawn_background. + **/ +static int may_spawn_background_process = 1; +/** + * Turn off may_spawn_background_process, so that all future calls to + * tor_spawn_background are guaranteed to fail. + **/ +void +tor_disable_spawning_background_processes(void) +{ + may_spawn_background_process = 0; +} /** Start a program in the background. If <b>filename</b> contains a '/', then * it will be treated as an absolute or relative path. Otherwise, on * non-Windows systems, the system path will be searched for <b>filename</b>. @@ -4166,6 +4180,9 @@ tor_spawn_background(const char *const filename, const char **argv, process_environment_t *env, process_handle_t **process_handle_out) { + if (may_spawn_background_process == 0) + return PROCESS_STATUS_ERROR; + #ifdef _WIN32 HANDLE stdout_pipe_read = NULL; HANDLE stdout_pipe_write = NULL; diff --git a/src/common/util.h b/src/common/util.h index df581d240..f50cf043a 100644 --- a/src/common/util.h +++ b/src/common/util.h @@ -396,6 +396,8 @@ void tor_check_port_forwarding(const char *filename, struct smartlist_t *ports_to_forward, time_t now); +void tor_disable_spawning_background_processes(void); + typedef struct process_handle_t process_handle_t; typedef struct process_environment_t process_environment_t; int tor_spawn_background(const char *const filename, const char **argv, diff --git a/src/or/config.c b/src/or/config.c index 9b6bf40eb..16e4ded69 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -409,6 +409,7 @@ static config_var_t option_vars_[] = { OBSOLETE("PredictedPortsRelevanceTime"), OBSOLETE("WarnUnsafeSocks"), VAR("NodeFamily", LINELIST, NodeFamilies, NULL), + V(NoExec, BOOL, "0"), V(NumCPUs, UINT, "0"), V(NumDirectoryGuards, UINT, "0"), V(NumEntryGuards, UINT, "0"), @@ -1595,6 +1596,10 @@ options_act(const or_options_t *old_options) const int transition_affects_guards = old_options && options_transition_affects_guards(old_options, options); + if (options->NoExec) { + tor_disable_spawning_background_processes(); + } + /* disable ptrace and later, other basic debugging techniques */ { /* Remember if we already disabled debugger attachment */ @@ -4447,6 +4452,12 @@ options_transition_allowed(const or_options_t *old, return -1; } + if (old->NoExec && !new_val->NoExec) { + *msg = tor_strdup("While Tor is running, disabling " + "NoExec is not allowed."); + return -1; + } + if (sandbox_is_active()) { #define SB_NOCHANGE_STR(opt) \ do { \ diff --git a/src/or/or.h b/src/or/or.h index ff11c7279..e24bfd7cd 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4596,6 +4596,10 @@ typedef struct { * consensuses around so that we can generate diffs from them. If 0, * use the default. */ int MaxConsensusAgeForDiffs; + + /** Bool (default: 0). Tells Tor to never try to exec another program. + */ + int NoExec; } or_options_t; /** Persistent state for an onion router, as saved to disk. */

1 0

[tor/master] Block managed proxies at a higher point
by nickm＠torproject.org 24 Aug '17

24 Aug '17

commit 5fa8d05bfa17d61a2cf96c87f0ffd9a2b6e577d2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 9 10:48:43 2017 -0400 Block managed proxies at a higher point --- src/or/config.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/or/config.c b/src/or/config.c index 7499dab47..e282a6cc6 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -5741,6 +5741,15 @@ parse_transport_line(const or_options_t *options, goto err; } + if (is_managed && options->NoExec) { + log_warn(LD_CONFIG, + "Managed proxies are not compatible with NoExec mode; ignoring." + "(%sTransportPlugin line was %s)", + server ? "Server" : "Client", escaped(line)); + r = 0; + goto done; + } + if (is_managed) { /* managed */

1 0