May 2018 - tor-commits - lists.torproject.org

[tor/master] Merge branch 'maint-0.3.3'
by nickm＠torproject.org 22 May '18

22 May '18

commit 740b8bb79c6d4ca6bf5c860c319b71fb81840334 Merge: a78957888 074b182ba Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 22 12:40:40 2018 -0400 Merge branch 'maint-0.3.3' "ours" merge to avoid version bump

1 0

[tor/maint-0.3.3] version bump to 0.3.3.6
by nickm＠torproject.org 22 May '18

22 May '18

commit 074b182baa091881d1741a6a66a08fef09090777 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 22 12:40:18 2018 -0400 version bump to 0.3.3.6 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 44235024c..fbe6450e8 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2017, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.3.3.5-rc-dev]) +AC_INIT([tor],[0.3.3.6]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index c27e244b5..164d27518 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.3.3.5-rc-dev" +!define VERSION "0.3.3.6" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index de1bc8c85..bb683e009 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -218,7 +218,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.3.3.5-rc-dev" +#define VERSION "0.3.3.6"

1 0

[tor/release-0.3.3] add TROVE-2018-005 to changelog and releasenotes
by nickm＠torproject.org 22 May '18

22 May '18

commit b6a88173bbf048cbab87e2bcdd29718a4b5e6837 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 22 12:37:49 2018 -0400 add TROVE-2018-005 to changelog and releasenotes --- ChangeLog | 9 ++++++++- ReleaseNotes | 9 ++++++++- changes/TROVE-2018-005 | 6 ------ 3 files changed, 16 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index d31dbbf02..e6d129cf8 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,4 @@ -Changes in version 0.3.3.6 - 2018-05-?? +Changes in version 0.3.3.6 - 2018-05-22 Tor 0.3.3.6 is the first stable release in the 0.3.3 series. It backports several important fixes from the 0.3.4.1-alpha. @@ -13,6 +13,13 @@ Changes in version 0.3.3.6 - 2018-05-?? Below are the changes since 0.3.3.5-rc. For a list of all changes since 0.3.2, see the ReleaseNotes file. + o Major bugfixes (security, directory authority, denial-of-service): + - Fix a bug that could have allowed an attacker to force a + directory authority to use up all its RAM by passing it a + maliciously crafted protocol versions string. Fixes bug 25517; + bugfix on 0.2.9.4-alpha. This issue is also tracked as + TROVE-2018-005. + o Major bugfixes (directory authorities, security, backport from 0.3.4.1-alpha): - When directory authorities read a zero-byte bandwidth file, they would previously log a warning with the contents of an diff --git a/ReleaseNotes b/ReleaseNotes index 1772288f2..d63f87ccb 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -2,7 +2,7 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. -Changes in version 0.3.3.6 - 2018-05-?? +Changes in version 0.3.3.6 - 2018-05-22 Tor 0.3.3.6 is the first stable release in the 0.3.3 series. It backports several important fixes from the 0.3.4.1-alpha. @@ -21,6 +21,13 @@ Changes in version 0.3.3.6 - 2018-05-?? - When built with Rust, Tor now depends on version 0.2.39 of the libc crate. Closes tickets 25310 and 25664. + o Major bugfixes (security, directory authority, denial-of-service): + - Fix a bug that could have allowed an attacker to force a + directory authority to use up all its RAM by passing it a + maliciously crafted protocol versions string. Fixes bug 25517; + bugfix on 0.2.9.4-alpha. This issue is also tracked as + TROVE-2018-005. + o Major features (denial-of-service mitigation): - Give relays some defenses against the recent network overload. We start with three defenses (default parameters in parentheses). diff --git a/changes/TROVE-2018-005 b/changes/TROVE-2018-005 deleted file mode 100644 index 769c653f4..000000000 --- a/changes/TROVE-2018-005 +++ /dev/null @@ -1,6 +0,0 @@ - o Major bugfixes (security, directory authority, denial-of-service): - - Fix a bug that could have allowed an attacker to force a - directory authority to use up all its RAM by passing it a - maliciously crafted protocol versions string. Fixes bug 25517; - bugfix on 0.2.9.4-alpha. This issue is also tracked as - TROVE-2018-005.

1 0

[tor/maint-0.3.3] protover: TROVE-2018-005 Fix potential DoS in protover protocol parsing.
by nickm＠torproject.org 22 May '18

22 May '18

commit eb966928428a80c105d33bd60bcae5503a1adeb7 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Mar 29 01:54:05 2018 +0000 protover: TROVE-2018-005 Fix potential DoS in protover protocol parsing. In protover.c, the `expand_protocol_list()` function expands a `smartlist_t` of `proto_entry_t`s to their protocol name concatenated with each version number. For example, given a `proto_entry_t` like so: proto_entry_t *proto = tor_malloc(sizeof(proto_entry_t)); proto_range_t *range = tor_malloc_zero(sizeof(proto_range_t)); proto->name = tor_strdup("DoSaaaaaaaaaaaaaaaaaaaaaa[19KB]aaa"); proto->ranges = smartlist_new(); range->low = 1; range->high = 65536; smartlist_add(proto->ranges, range); (Where `[19KB]` is roughly 19KB of `"a"` bytes.) This would expand in `expand_protocol_list()` to a `smartlist_t` containing 65536 copies of the string, e.g.: "DoSaaaaaaaaaaaaaaaaaaaaaa[19KB]aaa=1" "DoSaaaaaaaaaaaaaaaaaaaaaa[19KB]aaa=2" […] "DoSaaaaaaaaaaaaaaaaaaaaaa[19KB]aaa=65535" Thus constituting a potential resource exhaustion attack. The Rust implementation is not subject to this attack, because it instead expands the above string into a `HashMap<String, HashSet<u32>` prior to #24031, and a `HashMap<UnvalidatedProtocol, ProtoSet>` after). Neither Rust version is subject to this attack, because it only stores the `String` once per protocol. (Although a related, but apparently of too minor impact to be usable, DoS bug has been fixed in #24031. [0]) [0]: https://bugs.torproject.org/24031 * ADDS hard limit on protocol name lengths in protover.c and checks in parse_single_entry() and expand_protocol_list(). * ADDS tests to ensure the bug is caught. * FIXES #25517: https://bugs.torproject.org/25517 --- src/or/protover.c | 22 ++++++++++++++++++++++ src/test/test_protover.c | 24 ++++++++++++++++++++++++ 2 files changed, 46 insertions(+) diff --git a/src/or/protover.c b/src/or/protover.c index 45f0377d6..24b381361 100644 --- a/src/or/protover.c +++ b/src/or/protover.c @@ -50,6 +50,11 @@ static const struct { #define N_PROTOCOL_NAMES ARRAY_LENGTH(PROTOCOL_NAMES) +/* Maximum allowed length of any single subprotocol name. */ +// C_RUST_COUPLED: src/rust/protover/protover.rs +// `MAX_PROTOCOL_NAME_LENGTH` +static const uint MAX_PROTOCOL_NAME_LENGTH = 100; + /** * Given a protocol_type_t, return the corresponding string used in * descriptors. @@ -195,6 +200,15 @@ parse_single_entry(const char *s, const char *end_of_entry) if (equals == s) goto error; + /* The name must not be longer than MAX_PROTOCOL_NAME_LENGTH. */ + if (equals - s > MAX_PROTOCOL_NAME_LENGTH) { + log_warn(LD_NET, "When parsing a protocol entry, I got a very large " + "protocol name. This is possibly an attack or a bug, unless " + "the Tor network truly supports protocol names larger than " + "%ud characters. The offending string was: %s", + MAX_PROTOCOL_NAME_LENGTH, escaped(out->name)); + goto error; + } out->name = tor_strndup(s, equals-s); tor_assert(equals < end_of_entry); @@ -397,6 +411,14 @@ expand_protocol_list(const smartlist_t *protos) SMARTLIST_FOREACH_BEGIN(protos, const proto_entry_t *, ent) { const char *name = ent->name; + if (strlen(name) > MAX_PROTOCOL_NAME_LENGTH) { + log_warn(LD_NET, "When expanding a protocol entry, I got a very large " + "protocol name. This is possibly an attack or a bug, unless " + "the Tor network truly supports protocol names larger than " + "%ud characters. The offending string was: %s", + MAX_PROTOCOL_NAME_LENGTH, escaped(name)); + continue; + } SMARTLIST_FOREACH_BEGIN(ent->ranges, const proto_range_t *, range) { uint32_t u; for (u = range->low; u <= range->high; ++u) { diff --git a/src/test/test_protover.c b/src/test/test_protover.c index 9b94044b9..66deb7551 100644 --- a/src/test/test_protover.c +++ b/src/test/test_protover.c @@ -110,6 +110,12 @@ test_protover_parse_fail(void *arg) elts = parse_protocol_list("Link=1,9-8,3"); tt_ptr_op(elts, OP_EQ, NULL); + /* Protocol name too long */ + elts = parse_protocol_list("DoSaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"); + tt_ptr_op(elts, OP_EQ, NULL); + done: ; } @@ -203,6 +209,15 @@ test_protover_vote(void *arg) tt_str_op(result, OP_EQ, ""); tor_free(result); + /* Protocol name too long */ + smartlist_clear(lst); + smartlist_add(lst, (void*) "DoSaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"); + result = protover_compute_vote(lst, 1); + tt_str_op(result, OP_EQ, ""); + tor_free(result); + done: tor_free(result); smartlist_free(lst); @@ -270,6 +285,15 @@ test_protover_all_supported(void *arg) tor_end_capture_bugs_(); #endif + /* Protocol name too long */ + tor_capture_bugs_(1); + tt_assert(protover_all_supported( + "DoSaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + "aaaaaaaaaaaa=1-65536", &msg)); + tor_end_capture_bugs_(); + done: tor_end_capture_bugs_(); tor_free(msg);

1 0

[tor/maint-0.3.3] vote: TROVE-2018-005 Make DirAuths omit misbehaving routers from their vote.
by nickm＠torproject.org 22 May '18

22 May '18

commit b681438daf06d8d5b1c67d8c78f1b041f9b1f5b8 Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon May 7 23:59:06 2018 +0000 vote: TROVE-2018-005 Make DirAuths omit misbehaving routers from their vote. --- src/or/dirserv.c | 6 ++++++ src/or/protover.c | 12 ++++++++++++ src/or/protover.h | 1 + 3 files changed, 19 insertions(+) diff --git a/src/or/dirserv.c b/src/or/dirserv.c index 95bef9889..68df1c467 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -2943,6 +2943,12 @@ dirserv_generate_networkstatus_vote_obj(crypto_pk_t *private_key, microdescriptors = smartlist_new(); SMARTLIST_FOREACH_BEGIN(routers, routerinfo_t *, ri) { + /* If it has a protover list and contains a protocol name greater than + * MAX_PROTOCOL_NAME_LENGTH, skip it. */ + if (ri->protocol_list && + protover_contains_long_protocol_names(ri->protocol_list)) { + continue; + } if (ri->cache_info.published_on >= cutoff) { routerstatus_t *rs; vote_routerstatus_t *vrs; diff --git a/src/or/protover.c b/src/or/protover.c index 24b381361..94e6b11c4 100644 --- a/src/or/protover.c +++ b/src/or/protover.c @@ -274,6 +274,18 @@ parse_protocol_list(const char *s) } /** + * Return true if the unparsed protover in <b>s</b> would contain a protocol + * name longer than MAX_PROTOCOL_NAME_LENGTH, and false otherwise. + */ +bool +protover_contains_long_protocol_names(const char *s) +{ + if (!parse_protocol_list(s)) + return true; + return false; +} + +/** * Given a protocol type and version number, return true iff we know * how to speak that protocol. */ diff --git a/src/or/protover.h b/src/or/protover.h index 657977279..8b2db85d7 100644 --- a/src/or/protover.h +++ b/src/or/protover.h @@ -38,6 +38,7 @@ typedef enum protocol_type_t { PRT_CONS, } protocol_type_t; +bool protover_contains_long_protocol_names(const char *s); int protover_all_supported(const char *s, char **missing); int protover_is_supported_here(protocol_type_t pr, uint32_t ver); const char *protover_get_supported_protocols(void);

1 0

[tor/maint-0.3.3] changes file for TROVE-2018-005
by nickm＠torproject.org 22 May '18

22 May '18

commit d2bc019053058b09b5552d327106d9fbe0acad56 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 22 12:21:00 2018 -0400 changes file for TROVE-2018-005 --- changes/TROVE-2018-005 | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/changes/TROVE-2018-005 b/changes/TROVE-2018-005 new file mode 100644 index 000000000..769c653f4 --- /dev/null +++ b/changes/TROVE-2018-005 @@ -0,0 +1,6 @@ + o Major bugfixes (security, directory authority, denial-of-service): + - Fix a bug that could have allowed an attacker to force a + directory authority to use up all its RAM by passing it a + maliciously crafted protocol versions string. Fixes bug 25517; + bugfix on 0.2.9.4-alpha. This issue is also tracked as + TROVE-2018-005.

1 0

[tor/maint-0.3.3] Merge branch 'trove-2018-005_032' into trove-2018-005_033
by nickm＠torproject.org 22 May '18

22 May '18

commit a3a8d80bebdbb8988a2f33dea8b18a41e445c06f Merge: 3d1266324 d2bc01905 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 22 12:27:15 2018 -0400 Merge branch 'trove-2018-005_032' into trove-2018-005_033 changes/TROVE-2018-005 | 6 ++++++ src/or/dirserv.c | 6 ++++++ src/or/protover.c | 34 ++++++++++++++++++++++++++++++++++ src/or/protover.h | 3 ++- src/test/test_protover.c | 25 +++++++++++++++++++++++++ 5 files changed, 73 insertions(+), 1 deletion(-) diff --cc src/test/test_protover.c index 7bf1471eb,66deb7551..a7d4667df --- a/src/test/test_protover.c +++ b/src/test/test_protover.c @@@ -125,7 -109,13 +125,14 @@@ test_protover_parse_fail(void *arg /* Broken range */ elts = parse_protocol_list("Link=1,9-8,3"); tt_ptr_op(elts, OP_EQ, NULL); + + /* Protocol name too long */ + elts = parse_protocol_list("DoSaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"); + tt_ptr_op(elts, OP_EQ, NULL); + +#endif done: ; } @@@ -283,23 -267,33 +299,32 @@@ test_protover_all_supported(void *arg tt_str_op(msg, OP_EQ, "Sleen=0-4294967294"); tor_free(msg); - /* If we get an unparseable list, we say "yes, that's supported." */ -#ifndef HAVE_RUST - // XXXX let's make this section unconditional: rust should behave the - // XXXX same as C here! + /* If we get a (barely) valid (but unsupported list, we say "yes, that's + * supported." */ + tt_assert(protover_all_supported("Fribble=", &msg)); + tt_ptr_op(msg, OP_EQ, NULL); + + /* If we get a completely unparseable list, protover_all_supported should + * hit a fatal assertion for BUG(entries == NULL). */ tor_capture_bugs_(1); tt_assert(protover_all_supported("Fribble", &msg)); - tt_ptr_op(msg, OP_EQ, NULL); tor_end_capture_bugs_(); - /* This case is forbidden. Since it came from a protover_all_supported, - * it can trigger a bug message. */ + /* If we get a completely unparseable list, protover_all_supported should + * hit a fatal assertion for BUG(entries == NULL). */ tor_capture_bugs_(1); tt_assert(protover_all_supported("Sleen=0-4294967295", &msg)); - tt_ptr_op(msg, OP_EQ, NULL); - tor_free(msg); tor_end_capture_bugs_(); -#endif + /* Protocol name too long */ + tor_capture_bugs_(1); + tt_assert(protover_all_supported( + "DoSaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + "aaaaaaaaaaaa=1-65536", &msg)); + tor_end_capture_bugs_(); + done: tor_end_capture_bugs_(); tor_free(msg);

1 0

[tor/maint-0.3.3] Add stdbool to protover.h. Only needed for the 032 backport
by nickm＠torproject.org 22 May '18

22 May '18

commit bc2d6876b3f64497f66eca0ecc150696f476e401 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 22 12:15:52 2018 -0400 Add stdbool to protover.h. Only needed for the 032 backport --- src/or/protover.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/protover.h b/src/or/protover.h index 8b2db85d7..ab7f4d1dd 100644 --- a/src/or/protover.h +++ b/src/or/protover.h @@ -10,7 +10,7 @@ #define TOR_PROTOVER_H #include "container.h" - +#include <stdbool.h> /** The first version of Tor that included "proto" entries in its * descriptors. Authorities should use this to decide whether to * guess proto lines. */

1 0

[tor/master] vote: TROVE-2018-005 Make DirAuths omit misbehaving routers from their vote.
by nickm＠torproject.org 22 May '18

22 May '18

commit b681438daf06d8d5b1c67d8c78f1b041f9b1f5b8 Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon May 7 23:59:06 2018 +0000 vote: TROVE-2018-005 Make DirAuths omit misbehaving routers from their vote. --- src/or/dirserv.c | 6 ++++++ src/or/protover.c | 12 ++++++++++++ src/or/protover.h | 1 + 3 files changed, 19 insertions(+) diff --git a/src/or/dirserv.c b/src/or/dirserv.c index 95bef9889..68df1c467 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -2943,6 +2943,12 @@ dirserv_generate_networkstatus_vote_obj(crypto_pk_t *private_key, microdescriptors = smartlist_new(); SMARTLIST_FOREACH_BEGIN(routers, routerinfo_t *, ri) { + /* If it has a protover list and contains a protocol name greater than + * MAX_PROTOCOL_NAME_LENGTH, skip it. */ + if (ri->protocol_list && + protover_contains_long_protocol_names(ri->protocol_list)) { + continue; + } if (ri->cache_info.published_on >= cutoff) { routerstatus_t *rs; vote_routerstatus_t *vrs; diff --git a/src/or/protover.c b/src/or/protover.c index 24b381361..94e6b11c4 100644 --- a/src/or/protover.c +++ b/src/or/protover.c @@ -274,6 +274,18 @@ parse_protocol_list(const char *s) } /** + * Return true if the unparsed protover in <b>s</b> would contain a protocol + * name longer than MAX_PROTOCOL_NAME_LENGTH, and false otherwise. + */ +bool +protover_contains_long_protocol_names(const char *s) +{ + if (!parse_protocol_list(s)) + return true; + return false; +} + +/** * Given a protocol type and version number, return true iff we know * how to speak that protocol. */ diff --git a/src/or/protover.h b/src/or/protover.h index 657977279..8b2db85d7 100644 --- a/src/or/protover.h +++ b/src/or/protover.h @@ -38,6 +38,7 @@ typedef enum protocol_type_t { PRT_CONS, } protocol_type_t; +bool protover_contains_long_protocol_names(const char *s); int protover_all_supported(const char *s, char **missing); int protover_is_supported_here(protocol_type_t pr, uint32_t ver); const char *protover_get_supported_protocols(void);

1 0

[tor/master] Add stdbool to protover.h. Only needed for the 032 backport
by nickm＠torproject.org 22 May '18

22 May '18

commit bc2d6876b3f64497f66eca0ecc150696f476e401 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 22 12:15:52 2018 -0400 Add stdbool to protover.h. Only needed for the 032 backport --- src/or/protover.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/protover.h b/src/or/protover.h index 8b2db85d7..ab7f4d1dd 100644 --- a/src/or/protover.h +++ b/src/or/protover.h @@ -10,7 +10,7 @@ #define TOR_PROTOVER_H #include "container.h" - +#include <stdbool.h> /** The first version of Tor that included "proto" entries in its * descriptors. Authorities should use this to decide whether to * guess proto lines. */

1 0