October 2019 - tor-commits - lists.torproject.org

[tor/maint-0.4.1] Authorities reject relays running unsupported Tor release series.
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit f3c0a0b9fe2791571dd483ac28a73fc4776169a8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Aug 29 11:43:43 2019 -0400 Authorities reject relays running unsupported Tor release series. Our minimum version is now 0.2.9.5-alpha. Series 0.3.0, 0.3.1, 0.3.2, 0.3.3, and 0.3.4 are now rejected. Also, extract this version-checking code into a new function, so we can test it. Closes ticket 31549. Also reject 0.3.5.0 through 0.3.5.6-rc as unstable. --- changes/ticket31549 | 4 +++ src/feature/dirauth/process_descs.c | 59 +++++++++++++++++++++++++++---------- 2 files changed, 47 insertions(+), 16 deletions(-) diff --git a/changes/ticket31549 b/changes/ticket31549 new file mode 100644 index 000000000..2c27aca4f --- /dev/null +++ b/changes/ticket31549 @@ -0,0 +1,4 @@ + o Minor features (authority): + - Directory authorities now reject relays running all currently + deprecated release series. The currently supported release series + are: 0.2.9, 0.3.5, 0.4.0, 0.4.1, and 0.4.2. Closes ticket 31549. diff --git a/src/feature/dirauth/process_descs.c b/src/feature/dirauth/process_descs.c index 21b8e239e..c5fda80c0 100644 --- a/src/feature/dirauth/process_descs.c +++ b/src/feature/dirauth/process_descs.c @@ -310,6 +310,47 @@ dirserv_would_reject_router(const routerstatus_t *rs) return (res & FP_REJECT) != 0; } +/** + * Check whether the platform string in platform describes a platform + * that, as a directory authority, we want to reject. If it does, return + * true, and set *msg (if present) to a rejection message. Otherwise + * return false. + */ +static bool +dirserv_rejects_tor_version(const char *platform, + const char **msg) +{ + if (!platform) + return false; + + static const char please_upgrade_string[] = + "Tor version is insecure or unsupported. Please upgrade!"; + + /* Versions before Tor 0.2.9 are unsupported. Versions between 0.2.9.0 and + * 0.2.9.4 suffer from bug #20499, where relays don't keep their consensus + * up to date */ + if (!tor_version_as_new_as(platform,"0.2.9.5-alpha")) { + if (msg) + *msg = please_upgrade_string; + return true; + } + + /* Series between Tor 0.3.0 and 0.3.4 inclusive are unsupported, and some + * have bug #27841, which makes them broken as intro points. Reject them. + * + * Also reject unstable versions of 0.3.5, since (as of this writing) + * they are almost none of the network. */ + if (tor_version_as_new_as(platform,"0.3.0.0-alpha-dev") && + !tor_version_as_new_as(platform,"0.3.5.7")) { + if (msg) { + *msg = please_upgrade_string; + } + return true; + } + + return false; +} + /** Helper: As dirserv_router_get_status, but takes the router fingerprint * (hex, no spaces), nickname, address (used for logging only), IP address, OR * port and platform (logging only) as arguments. @@ -342,22 +383,8 @@ dirserv_get_status_impl(const char *id_digest, const char *nickname, } } - /* Versions before Tor 0.2.4.18-rc are too old to support, and are - * missing some important security fixes too. Disable them. */ - if (platform && !tor_version_as_new_as(platform,"0.2.4.18-rc")) { - if (msg) - *msg = "Tor version is insecure or unsupported. Please upgrade!"; - return FP_REJECT; - } - - /* Tor 0.2.9.x where x<5 suffers from bug #20499, where relays don't - * keep their consensus up to date so they make bad guards. - * The simple fix is to just drop them from the network. */ - if (platform && - tor_version_as_new_as(platform,"0.2.9.0-alpha") && - !tor_version_as_new_as(platform,"0.2.9.5-alpha")) { - if (msg) - *msg = "Tor version contains bug 20499. Please upgrade!"; + /* Check whether the version is obsolete, broken, insecure, etc... */ + if (platform && dirserv_rejects_tor_version(platform, msg)) { return FP_REJECT; }

1 0

[tor/master] Merge branch 'maint-0.4.1' into maint-0.4.2
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit 65545e13452bf042087bc99e7a998427941eee79 Merge: b45048fea 8bc65cda4 Author: teor <teor(a)torproject.org> Date: Wed Oct 23 09:59:07 2019 +1000 Merge branch 'maint-0.4.1' into maint-0.4.2 `git merge --strategy ours` to use STATIC for unit tests in maint-0.4.2.

1 0

[tor/master] Merge branch 'pr1450_squashed' into maint-0.4.1
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit 8bc65cda4423d27896dcf3060cbe4d6abcdd3438 Merge: 4a5c909ce f3c0a0b9f Author: teor <teor(a)torproject.org> Date: Wed Oct 23 09:58:22 2019 +1000 Merge branch 'pr1450_squashed' into maint-0.4.1 changes/ticket31549 | 4 +++ src/feature/dirauth/process_descs.c | 59 +++++++++++++++++++++++++++---------- 2 files changed, 47 insertions(+), 16 deletions(-)

1 0

[tor/master] Authorities reject relays running unsupported Tor release series.
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit f3c0a0b9fe2791571dd483ac28a73fc4776169a8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Aug 29 11:43:43 2019 -0400 Authorities reject relays running unsupported Tor release series. Our minimum version is now 0.2.9.5-alpha. Series 0.3.0, 0.3.1, 0.3.2, 0.3.3, and 0.3.4 are now rejected. Also, extract this version-checking code into a new function, so we can test it. Closes ticket 31549. Also reject 0.3.5.0 through 0.3.5.6-rc as unstable. --- changes/ticket31549 | 4 +++ src/feature/dirauth/process_descs.c | 59 +++++++++++++++++++++++++++---------- 2 files changed, 47 insertions(+), 16 deletions(-) diff --git a/changes/ticket31549 b/changes/ticket31549 new file mode 100644 index 000000000..2c27aca4f --- /dev/null +++ b/changes/ticket31549 @@ -0,0 +1,4 @@ + o Minor features (authority): + - Directory authorities now reject relays running all currently + deprecated release series. The currently supported release series + are: 0.2.9, 0.3.5, 0.4.0, 0.4.1, and 0.4.2. Closes ticket 31549. diff --git a/src/feature/dirauth/process_descs.c b/src/feature/dirauth/process_descs.c index 21b8e239e..c5fda80c0 100644 --- a/src/feature/dirauth/process_descs.c +++ b/src/feature/dirauth/process_descs.c @@ -310,6 +310,47 @@ dirserv_would_reject_router(const routerstatus_t *rs) return (res & FP_REJECT) != 0; } +/** + * Check whether the platform string in platform describes a platform + * that, as a directory authority, we want to reject. If it does, return + * true, and set *msg (if present) to a rejection message. Otherwise + * return false. + */ +static bool +dirserv_rejects_tor_version(const char *platform, + const char **msg) +{ + if (!platform) + return false; + + static const char please_upgrade_string[] = + "Tor version is insecure or unsupported. Please upgrade!"; + + /* Versions before Tor 0.2.9 are unsupported. Versions between 0.2.9.0 and + * 0.2.9.4 suffer from bug #20499, where relays don't keep their consensus + * up to date */ + if (!tor_version_as_new_as(platform,"0.2.9.5-alpha")) { + if (msg) + *msg = please_upgrade_string; + return true; + } + + /* Series between Tor 0.3.0 and 0.3.4 inclusive are unsupported, and some + * have bug #27841, which makes them broken as intro points. Reject them. + * + * Also reject unstable versions of 0.3.5, since (as of this writing) + * they are almost none of the network. */ + if (tor_version_as_new_as(platform,"0.3.0.0-alpha-dev") && + !tor_version_as_new_as(platform,"0.3.5.7")) { + if (msg) { + *msg = please_upgrade_string; + } + return true; + } + + return false; +} + /** Helper: As dirserv_router_get_status, but takes the router fingerprint * (hex, no spaces), nickname, address (used for logging only), IP address, OR * port and platform (logging only) as arguments. @@ -342,22 +383,8 @@ dirserv_get_status_impl(const char *id_digest, const char *nickname, } } - /* Versions before Tor 0.2.4.18-rc are too old to support, and are - * missing some important security fixes too. Disable them. */ - if (platform && !tor_version_as_new_as(platform,"0.2.4.18-rc")) { - if (msg) - *msg = "Tor version is insecure or unsupported. Please upgrade!"; - return FP_REJECT; - } - - /* Tor 0.2.9.x where x<5 suffers from bug #20499, where relays don't - * keep their consensus up to date so they make bad guards. - * The simple fix is to just drop them from the network. */ - if (platform && - tor_version_as_new_as(platform,"0.2.9.0-alpha") && - !tor_version_as_new_as(platform,"0.2.9.5-alpha")) { - if (msg) - *msg = "Tor version contains bug 20499. Please upgrade!"; + /* Check whether the version is obsolete, broken, insecure, etc... */ + if (platform && dirserv_rejects_tor_version(platform, msg)) { return FP_REJECT; }

1 0

[tor/master] Merge branch 'maint-0.4.2'
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit 8a56819d2375337027f11073947090224f15993b Merge: 9db1602ec 65545e134 Author: teor <teor(a)torproject.org> Date: Wed Oct 23 10:00:49 2019 +1000 Merge branch 'maint-0.4.2'

1 0

[tpo/master] Bug 32201: Add the mk locale for Tor Browser stable downloads
by boklm＠torproject.org 22 Oct '19

22 Oct '19

commit dd9e5bffce077c57a00ebcf78b1e0a029bc98f48 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Wed Oct 23 00:50:42 2019 +0200 Bug 32201: Add the mk locale for Tor Browser stable downloads --- databags/download-alternatives.ini | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/databags/download-alternatives.ini b/databags/download-alternatives.ini index 0f924bd..752985e 100644 --- a/databags/download-alternatives.ini +++ b/databags/download-alternatives.ini @@ -78,6 +78,10 @@ url = /ka/ url = /ko/ language = 한국어 (ko) +[mk] +url = /mk/ +language = македонски (mk) + [nb-NO] url = /nb-NO/ language = Norsk Bokmål (nb-NO)

1 0

[tor/release-0.3.5] Merge branch 'maint-0.2.9' into maint-0.3.5
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit 1ea19d7a5bf538f5b9f0988c2375966f88d87867 Merge: 21c3488af 7660a7cf7 Author: teor <teor(a)torproject.org> Date: Wed Oct 23 08:24:30 2019 +1000 Merge branch 'maint-0.2.9' into maint-0.3.5 `git merge --strategy ours` to take the 0.3.5 changes for 31001, and ignore the conflicting 0.2.9 changes.

1 0

[tor/release-0.3.5] changes: file for 23507, v3 onion service fix
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit 41bc1fac8e77e399572e020c5ba59462afd75f4b Author: teor <teor(a)torproject.org> Date: Fri Aug 23 16:25:33 2019 +1000 changes: file for 23507, v3 onion service fix --- changes/bug23507 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changes/bug23507 b/changes/bug23507 new file mode 100644 index 000000000..de18273fd --- /dev/null +++ b/changes/bug23507 @@ -0,0 +1,5 @@ + o Minor bugfixes (v3 single onion services): + - Make v3 single onion services fall back to a 3-hop intro, when there + all intro points are unreachable via a 1-hop path. Previously, v3 + single onion services failed when all intro nodes were unreachable + via a 1-hop path. Fixes bug 23507; bugfix on 0.3.2.1-alpha.

1 0

[tor/release-0.3.5] Try using make -k in the Appveyor configuration
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit 49a11f8a8a61a4d8b8657a98291862ffc96e99d9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 23 15:04:54 2019 -0400 Try using make -k in the Appveyor configuration Frequently, when a patch fails, it has failures in several files. Using the "-k" flag will let us learn all the compilation errors, not just the first one that the compiler hits. Based on a patch by rl1987. Closes ticket 31372. --- .appveyor.yml | 6 +++--- changes/ticket31372_appveyor | 4 ++++ 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.appveyor.yml b/.appveyor.yml index 9913bf3bd..25f87fa45 100644 --- a/.appveyor.yml +++ b/.appveyor.yml @@ -83,8 +83,8 @@ build_script: # configure its flags. liblzma just works. #> Execute-Bash "ZSTD_CFLAGS='-L/${env:compiler_path}/include' ZSTD_LIBS='-L/${env:compiler_path}/lib -lzstd' ../configure --prefix=/${env:compiler_path} --build=${env:target} --host=${env:target} --with-openssl-dir=/${env:compiler_path} --disable-asciidoc --enable-fatal-warnings ${env:hardening}" - Execute-Bash "V=1 make -j2" - Execute-Bash "V=1 make -j2 install" + Execute-Bash "V=1 make -k -j2" + Execute-Bash "V=1 make -k -j2 install" } test_script: @@ -95,7 +95,7 @@ test_script: $buildpath = @("C:\msys64\${env:compiler_path}\bin") + $oldpath $env:Path = $buildpath -join ';' Set-Location "${env:build}" - Execute-Bash "VERBOSE=1 make -j2 check" + Execute-Bash "VERBOSE=1 make -k -j2 check" } on_finish: diff --git a/changes/ticket31372_appveyor b/changes/ticket31372_appveyor new file mode 100644 index 000000000..e7bb03182 --- /dev/null +++ b/changes/ticket31372_appveyor @@ -0,0 +1,4 @@ + o Minor features (continuous integration): + - When building on Appveyor, pass the "-k" flag to make, so that + we are informed of all compilation failures, not just the first + one or two. Closes part of ticket 31372.

1 0

[tor/release-0.3.5] Change loglevel of message 'Hash of session info was not as expected'
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit 05fa1689eb96a1249030e1d51828a308d19d728c Author: rl1987 <rl1987(a)sdf.lonestar.org> Date: Sat Jul 20 18:28:07 2019 +0300 Change loglevel of message 'Hash of session info was not as expected' --- changes/bug12399 | 3 +++ src/feature/rend/rendmid.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/changes/bug12399 b/changes/bug12399 new file mode 100644 index 000000000..922c08c5e --- /dev/null +++ b/changes/bug12399 @@ -0,0 +1,3 @@ + o Minor bugfixes (logging): + - Change log level of message "Hash of session info was not as expected" + to LOG_PROTOCOL_WARN. Fixes bug 12399; bugfix on 0.1.1.10-alpha. diff --git a/src/feature/rend/rendmid.c b/src/feature/rend/rendmid.c index fcfa5052c..3ba48f885 100644 --- a/src/feature/rend/rendmid.c +++ b/src/feature/rend/rendmid.c @@ -70,7 +70,8 @@ rend_mid_establish_intro_legacy(or_circuit_t *circ, const uint8_t *request, goto err; } if (tor_memneq(expected_digest, request+2+asn1len, DIGEST_LEN)) { - log_warn(LD_PROTOCOL, "Hash of session info was not as expected."); + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Hash of session info was not as expected."); reason = END_CIRC_REASON_TORPROTOCOL; goto err; }

1 0