March 2018 - tor-commits - lists.torproject.org

[tor/release-0.3.1] Add some protover vote round-trip tests from Teor.
by nickm＠torproject.org 03 Mar '18

03 Mar '18

commit d3a1bdbf56c7e41b54fdd1d3169287ca761698a6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 14 11:47:05 2018 -0500 Add some protover vote round-trip tests from Teor. I've refactored these to be a separate function, to avoid tricky merge conflicts. Some of these are disabled with "XXXX" comments; they should get fixed moving forward. --- src/test/test_protover.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 76 insertions(+) diff --git a/src/test/test_protover.c b/src/test/test_protover.c index f00955d1b..5e65c019e 100644 --- a/src/test/test_protover.c +++ b/src/test/test_protover.c @@ -182,6 +182,81 @@ test_protover_all_supported(void *arg) tor_free(msg); } +static void +test_protover_vote_roundtrip(void *args) +{ + (void) args; + static const struct { + const char *input; + const char *expected_output; + } examples[] = { + { "Fkrkljdsf", NULL }, + { "Zn=4294967295", NULL }, + { "Zn=4294967295-1", NULL }, + { "Zn=4294967293-4294967295", NULL }, + /* Will fail because of 4294967295. */ + { "Foo=1,3 Bar=3 Baz= Quux=9-12,14,15-16,900 Zn=0,4294967295", + NULL }, + { "Foo=1,3 Bar=3 Baz= Quux=9-12,14,15-16,900 Zn=0,4294967294", + "Bar=3 Foo=1,3 Quux=9-12,14-16,900 Zn=0,4294967294" }, + { "Zu16=0,65536", "Zu16=0,65536" }, + { "N-1=1,2", "N-1=1-2" }, + { "-1=4294967295", NULL }, + { "-1=3", "-1=3" }, + /* junk. */ + { "!!3@*", NULL }, + /* Missing equals sign */ + { "Link=4 Haprauxymatyve Desc=9", NULL }, + { "Link=4 Haprauxymatyve=7 Desc=9", + "Desc=9 Haprauxymatyve=7 Link=4" }, + { "=10-11", NULL }, + { "X=10-11", "X=10-11" }, + { "Link=4 =3 Desc=9", NULL }, + { "Link=4 Z=3 Desc=9", "Desc=9 Link=4 Z=3" }, + { "Link=fred", NULL }, + { "Link=1,fred", NULL }, + { "Link=1,fred,3", NULL }, + { "Link=1,9-8,3", NULL }, + // "These fail at the splitting stage in Rust, but the number parsing + // stage in C." + { "Faux=-1", NULL }, + { "Faux=-1-3", NULL }, + { "Faux=1--1", NULL }, + /* Large integers */ + { "Link=4294967296", NULL }, + /* Large range */ + { "Sleen=1-501", "Sleen=1-501" }, + { "Sleen=1-65537", NULL }, + /* CPU/RAM DoS Loop: Rust only. */ + { "Sleen=0-2147483648", NULL }, + /* Rust seems to experience an internal error here. */ + { "Sleen=0-4294967295", NULL }, + }; + unsigned u; + smartlist_t *votes = smartlist_new(); + char *result = NULL; + + for (u = 0; u < ARRAY_LENGTH(examples); ++u) { + const char *input = examples[u].input; + const char *expected_output = examples[u].expected_output; + + smartlist_add(votes, (void*)input); + result = protover_compute_vote(votes, 1); + if (expected_output != NULL) { + tt_str_op(result, OP_EQ, expected_output); + } else { + tt_str_op(result, OP_EQ, ""); + } + + smartlist_clear(votes); + tor_free(result); + } + + done: + smartlist_free(votes); + tor_free(result); +} + #define PV_TEST(name, flags) \ { #name, test_protover_ ##name, (flags), NULL, NULL } @@ -190,6 +265,7 @@ struct testcase_t protover_tests[] = { PV_TEST(parse_fail, 0), PV_TEST(vote, 0), PV_TEST(all_supported, 0), + PV_TEST(vote_roundtrip, 0), END_OF_TESTCASES };

1 0

[tor/release-0.3.1] Draft changelog for 0.3.1.10
by nickm＠torproject.org 03 Mar '18

03 Mar '18

commit babd102f0b2071694eb0cb9fcbf4a5cbab5c8b7f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 1 16:41:35 2018 -0500 Draft changelog for 0.3.1.10 --- ChangeLog | 42 ++++++++++++++++++++++++++++++++++++++---- changes/bug25249 | 3 --- changes/bug25249.2 | 3 --- changes/trove-2018-001.1 | 6 ------ changes/trove-2018-004 | 8 -------- 5 files changed, 38 insertions(+), 24 deletions(-) diff --git a/ChangeLog b/ChangeLog index f13c8a193..7bbe95d50 100644 --- a/ChangeLog +++ b/ChangeLog @@ -2,7 +2,30 @@ Changes in version 0.3.1.10 - 2018-03-?? Tor 0.3.1.10 backports a number of bugfixes, including important fixes for security issues. - BLURB HERE. + It includes an important security fix for a remote crash attack + against directory authorities, tracked as TROVE-2018-001. + + This release also backports our new system for improved resistance to + denial-of-service attacks against relays. + + This release also fixes several minor bugs and annoyances from + earlier releases. + + All directory authorities should upgrade to one of the versions + released today. All relays not already running Tor 0.3.3.2-alpha or + later should upgrade to one of the versions released today. + + Please note: according to our release calendar, Tor 0.3.1 will no + longer be supported after 1 July 2018. If you will be running Tor + after that date, you should make sure to plan to upgrade to the latest + stable version, or downgrade to 0.2.9 (which will receive long-term + support). + + o Major bugfixes (denial-of-service, directory authority, backport from 0.3.3.3-alpha): + - Fix a protocol-list handling bug that could be used to remotely crash + directory authorities with a null-pointer exception. Fixes bug 25074; + bugfix on 0.2.9.4-alpha. Also tracked as TROVE-2018-001 and + CVE-2018-0490. o Major features (denial-of-service mitigation, backport from 0.3.3.2-alpha): - Give relays some defenses against the recent network overload. We @@ -114,6 +137,14 @@ Changes in version 0.3.1.10 - 2018-03-?? with the OwningControllerProcess feature. Fixes bug 24198; bugfix on 0.2.5.1-alpha. + o Minor bugfixes (denial-of-service, backport from 0.3.3.3-alpha): + - Fix a possible crash on malformed consensus. If a consensus had + contained an unparseable protocol line, it could have made clients + and relays crash with a null-pointer exception. To exploit this + issue, however, an attacker would need to be able to subvert the + directory authority system. Fixes bug 25251; bugfix on + 0.2.9.4-alpha. Also tracked as TROVE-2018-004. + o Minor bugfixes (directory cache, backport from 0.3.2.5-alpha): - Recover better from empty or corrupt files in the consensus cache directory. Fixes bug 24099; bugfix on 0.3.1.1-alpha. @@ -186,14 +217,17 @@ Changes in version 0.3.1.10 - 2018-03-?? the other side ever sent a create_fast cell to us. Backports part of the fixes from bugs 22805 and 24898. + o Minor bugfixes (spec conformance, backport from 0.3.3.3-alpha): + - Forbid "-0" as a protocol version. Fixes part of bug 25249; bugfix on + 0.2.9.4-alpha. + - Forbid UINT32_MAX as a protocol version. Fixes part of bug 25249; + bugfix on 0.2.9.4-alpha. + o Code simplification and refactoring (backport from 0.3.3.3-alpha): - Update the "rust dependencies" submodule to be a project-level repository, rather than a user repository. Closes ticket 25323. - - - Changes in version 0.3.1.9 - 2017-12-01: Tor 0.3.1.9 backports important security and stability fixes from the 0.3.2 development series. All Tor users should upgrade to this diff --git a/changes/bug25249 b/changes/bug25249 deleted file mode 100644 index b4153eeae..000000000 --- a/changes/bug25249 +++ /dev/null @@ -1,3 +0,0 @@ - o Minor bugfixes (spec conformance): - - Forbid "-0" as a protocol version. Fixes part of bug 25249; bugfix on - 0.2.9.4-alpha. diff --git a/changes/bug25249.2 b/changes/bug25249.2 deleted file mode 100644 index 9058c1107..000000000 --- a/changes/bug25249.2 +++ /dev/null @@ -1,3 +0,0 @@ - o Minor bugfixes (spec conformance): - - Forbid UINT32_MAX as a protocol version. Fixes part of bug 25249; - bugfix on 0.2.9.4-alpha. diff --git a/changes/trove-2018-001.1 b/changes/trove-2018-001.1 deleted file mode 100644 index f0ee92f40..000000000 --- a/changes/trove-2018-001.1 +++ /dev/null @@ -1,6 +0,0 @@ - o Major bugfixes (denial-of-service, directory authority): - - Fix a protocol-list handling bug that could be used to remotely crash - directory authorities with a null-pointer exception. Fixes bug 25074; - bugfix on 0.2.9.4-alpha. Also tracked as TROVE-2018-001. - - diff --git a/changes/trove-2018-004 b/changes/trove-2018-004 deleted file mode 100644 index 37e0a89b0..000000000 --- a/changes/trove-2018-004 +++ /dev/null @@ -1,8 +0,0 @@ - o Minor bugfixes (denial-of-service): - - Fix a possible crash on malformed consensus. If a consensus had - contained an unparseable protocol line, it could have made clients - and relays crash with a null-pointer exception. To exploit this - issue, however, an attacker would need to be able to subvert the - directory-authority system. Fixes bug 25251; bugfix on - 0.2.9.4-alpha. Also tracked as TROVE-2018-004. -

1 0

[tor/release-0.3.1] Add another NULL-pointer fix for protover.c.
by nickm＠torproject.org 03 Mar '18

03 Mar '18

commit a83650852d3cd00c9916cae74d755ae55a6b506d Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 14 10:45:57 2018 -0500 Add another NULL-pointer fix for protover.c. This one can only be exploited if you can generate a correctly signed consensus, so it's not as bad as 25074. Fixes bug 25251; also tracked as TROVE-2018-004. --- changes/trove-2018-004 | 8 ++++++++ src/or/protover.c | 5 +++++ 2 files changed, 13 insertions(+) diff --git a/changes/trove-2018-004 b/changes/trove-2018-004 new file mode 100644 index 000000000..37e0a89b0 --- /dev/null +++ b/changes/trove-2018-004 @@ -0,0 +1,8 @@ + o Minor bugfixes (denial-of-service): + - Fix a possible crash on malformed consensus. If a consensus had + contained an unparseable protocol line, it could have made clients + and relays crash with a null-pointer exception. To exploit this + issue, however, an attacker would need to be able to subvert the + directory-authority system. Fixes bug 25251; bugfix on + 0.2.9.4-alpha. Also tracked as TROVE-2018-004. + diff --git a/src/or/protover.c b/src/or/protover.c index a75077462..e63036f78 100644 --- a/src/or/protover.c +++ b/src/or/protover.c @@ -624,6 +624,11 @@ protover_all_supported(const char *s, char **missing_out) } smartlist_t *entries = parse_protocol_list(s); + if (BUG(entries == NULL)) { + log_warn(LD_NET, "Received an unparseable protocol list %s" + " from the consensus", escaped(s)); + return 1; + } missing = smartlist_new();

1 0

[tor/release-0.3.1] Spec conformance on protover: always reject ranges where lo>hi
by nickm＠torproject.org 03 Mar '18

03 Mar '18

commit c5295cc1beb1c13743e11d3a7134e9e75b6da470 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 15 10:49:47 2018 -0500 Spec conformance on protover: always reject ranges where lo>hi --- src/or/protover.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/or/protover.c b/src/or/protover.c index a035b5c83..0c79037f6 100644 --- a/src/or/protover.c +++ b/src/or/protover.c @@ -158,6 +158,9 @@ parse_version_range(const char *s, const char *end_of_range, if (next != end_of_range) goto error; + if (low > high) + goto error; + done: *high_out = high; *low_out = low; @@ -208,10 +211,6 @@ parse_single_entry(const char *s, const char *end_of_entry) goto error; } - if (range->low > range->high) { - goto error; - } - s = comma; while (*s == ',' && s < end_of_entry) ++s;

1 0

[tor/release-0.3.1] Protover tests: disable some obsoleted tests
by nickm＠torproject.org 03 Mar '18

03 Mar '18

commit c1bb8836ff6b3abe32a17ffb3ae25cfdc770ceb4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 15 18:56:29 2018 -0500 Protover tests: disable some obsoleted tests These were meant to demonstrate old behavior, or old rust behavior. One of them _should_ work in Rust, but won't because of implementation details. We'll fix that up later. --- src/test/test_protover.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/src/test/test_protover.c b/src/test/test_protover.c index 8d061c69c..92ead3ca3 100644 --- a/src/test/test_protover.c +++ b/src/test/test_protover.c @@ -176,16 +176,6 @@ test_protover_vote(void *arg) /* Large protover lists that exceed the threshold */ - /* By adding two votes: Rust */ -#if 0 // XXXXX - smartlist_clear(lst); - smartlist_add(lst, (void*) "Sleen=1-500"); - smartlist_add(lst, (void*) "Sleen=1000"); - result = protover_compute_vote(lst, 1); - tt_str_op(result, OP_EQ, ""); - tor_free(result); -#endif - /* By adding two votes, C allows us to exceed the limit */ smartlist_add(lst, (void*) "Sleen=1-65536"); smartlist_add(lst, (void*) "Sleen=100000"); @@ -204,7 +194,7 @@ test_protover_vote(void *arg) smartlist_clear(lst); smartlist_add(lst, (void*) "Sleen=4294967295"); result = protover_compute_vote(lst, 1); - tt_str_op(result, OP_EQ, ""); // XXXX "Sleen=4294967295"); + tt_str_op(result, OP_EQ, ""); tor_free(result); smartlist_clear(lst); @@ -263,6 +253,9 @@ test_protover_all_supported(void *arg) tor_free(msg); /* If we get an unparseable list, we say "yes, that's supported." */ +#ifndef HAVE_RUST + // XXXX let's make this section unconditional: rust should behave the + // XXXX same as C here! tor_capture_bugs_(1); tt_assert(protover_all_supported("Fribble", &msg)); tt_ptr_op(msg, OP_EQ, NULL); @@ -275,6 +268,7 @@ test_protover_all_supported(void *arg) tt_ptr_op(msg, OP_EQ, NULL); tor_free(msg); tor_end_capture_bugs_(); +#endif done: tor_end_capture_bugs_();

1 0

[tor/release-0.3.1] Merge branch 'maint-0.3.1' into release-0.3.1
by nickm＠torproject.org 03 Mar '18

03 Mar '18

commit b6b239ce0c3d1ee5f7f829d8d795e489c2358948 Merge: ce9df228a d4a758e08 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 1 16:07:59 2018 -0500 Merge branch 'maint-0.3.1' into release-0.3.1 changes/bug25249 | 3 + changes/bug25249.2 | 3 + changes/trove-2018-001.1 | 6 ++ changes/trove-2018-004 | 8 +++ src/or/protover.c | 35 ++++++++-- src/test/test_protover.c | 171 +++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 220 insertions(+), 6 deletions(-)

1 0

[tor/release-0.3.1] Merge branch 'maint-0.2.9' into maint-0.3.1
by nickm＠torproject.org 03 Mar '18

03 Mar '18

commit d4a758e08373854639af6991ec95836fa7c15ca4 Merge: ac1942ac5 c1bb8836f Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 1 16:07:59 2018 -0500 Merge branch 'maint-0.2.9' into maint-0.3.1 changes/bug25249 | 3 + changes/bug25249.2 | 3 + changes/trove-2018-001.1 | 6 ++ changes/trove-2018-004 | 8 +++ src/or/protover.c | 35 ++++++++-- src/test/test_protover.c | 171 +++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 220 insertions(+), 6 deletions(-)

1 0

[tor/release-0.3.1] Merge branch 'maint-0.2.9' into maint-0.3.1
by nickm＠torproject.org 03 Mar '18

03 Mar '18

commit 805a785780c2f3abccf080caddc345ca8f484797 Merge: d4a758e08 35753c077 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 1 16:42:25 2018 -0500 Merge branch 'maint-0.2.9' into maint-0.3.1 "ours" merge to avoid version bump.

1 0

[tor/release-0.3.1] Update to 0.3.1.10
by nickm＠torproject.org 03 Mar '18

03 Mar '18

commit c527a8a9c969d446ea0d7f6f4110d5082187dce2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 1 16:43:01 2018 -0500 Update to 0.3.1.10 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 2b02be1ed..892ee2ae8 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2017, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.3.1.9-dev]) +AC_INIT([tor],[0.3.1.10]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index 472ec0d26..72a99b7e4 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.3.1.9-dev" +!define VERSION "0.3.1.10" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 3ecf02482..5f2ef7a86 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -218,7 +218,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.3.1.9-dev" +#define VERSION "0.3.1.10"

1 0

[tor/release-0.3.1] version bump to 0.2.9.15
by nickm＠torproject.org 03 Mar '18

03 Mar '18

commit 35753c077457da66d1dac990379727dd443826cc Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 1 16:42:17 2018 -0500 version bump to 0.2.9.15 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 73470f214..baf6ea3ca 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2015, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.2.9.14-dev]) +AC_INIT([tor],[0.2.9.15]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index 83c6d5c5e..f8e571cb0 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.9.14-dev" +!define VERSION "0.2.9.15" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index bfe026296..fc6366535 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -218,7 +218,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.9.14-dev" +#define VERSION "0.2.9.15"

1 0