October 2019 - tor-commits - lists.torproject.org

[tor/master] Merge branch 'maint-0.4.2'
by nickm＠torproject.org 22 Oct '19

22 Oct '19

commit 7c88fcf4e2ed04af07fed9438b59764f1b4adab0 Merge: 7d75e1dbd 5ddc04f49 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 22 12:53:12 2019 -0400 Merge branch 'maint-0.4.2'

1 0

[tor/release-0.4.2] Merge remote-tracking branch 'tor-github/pr/1341' into maint-0.4.1
by nickm＠torproject.org 22 Oct '19

22 Oct '19

commit d08d29f15f0c80b74f6440b8b84eefe241c87aad Merge: b588b6087 4bbefc2aa Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 22 12:53:06 2019 -0400 Merge remote-tracking branch 'tor-github/pr/1341' into maint-0.4.1 changes/bug30916 | 4 ++++ src/feature/relay/router.c | 18 ++++++++---------- 2 files changed, 12 insertions(+), 10 deletions(-)

1 0

[tor/release-0.4.2] Merge branch 'maint-0.4.1' into maint-0.4.2
by nickm＠torproject.org 22 Oct '19

22 Oct '19

commit 5ddc04f49d1bcb9485de5a0eb500c6e03ac5fe7e Merge: 730f0e3da d08d29f15 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 22 12:53:12 2019 -0400 Merge branch 'maint-0.4.1' into maint-0.4.2

1 0

[tor/maint-0.4.1] Merge branch 'bug30916_035' into bug30916_041
by nickm＠torproject.org 22 Oct '19

22 Oct '19

commit 4bbefc2aac2d3770817200700e2a384d966bffe2 Merge: 70bcff601 2da4d64a6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 18 11:19:41 2019 -0400 Merge branch 'bug30916_035' into bug30916_041 changes/bug30916 | 4 ++++ src/feature/relay/router.c | 18 ++++++++---------- 2 files changed, 12 insertions(+), 10 deletions(-) diff --cc src/feature/relay/router.c index 25bb1835c,1dbaf2ed6..e2ba51a5b --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@@ -284,19 -278,17 +284,17 @@@ construct_ntor_key_map(void { di_digest256_map_t *m = NULL; - if (!fast_mem_is_zero((const char*) - curve25519_onion_key.pubkey.public_key, - CURVE25519_PUBKEY_LEN)) { - dimap_add_entry(&m, - curve25519_onion_key.pubkey.public_key, + const uint8_t *cur_pk = curve25519_onion_key.pubkey.public_key; + const uint8_t *last_pk = last_curve25519_onion_key.pubkey.public_key; + - if (!tor_mem_is_zero((const char *)cur_pk, CURVE25519_PUBKEY_LEN)) { ++ if (!fast_mem_is_zero((const char *)cur_pk, CURVE25519_PUBKEY_LEN)) { + dimap_add_entry(&m, cur_pk, tor_memdup(&curve25519_onion_key, sizeof(curve25519_keypair_t))); } - if (!fast_mem_is_zero((const char*) - last_curve25519_onion_key.pubkey.public_key, - CURVE25519_PUBKEY_LEN)) { - dimap_add_entry(&m, - last_curve25519_onion_key.pubkey.public_key, - if (!tor_mem_is_zero((const char*)last_pk, CURVE25519_PUBKEY_LEN) && ++ if (!fast_mem_is_zero((const char*)last_pk, CURVE25519_PUBKEY_LEN) && + tor_memneq(cur_pk, last_pk, CURVE25519_PUBKEY_LEN)) { + dimap_add_entry(&m, last_pk, tor_memdup(&last_curve25519_onion_key, sizeof(curve25519_keypair_t))); }

1 0

[tor/release-0.4.1] Merge remote-tracking branch 'tor-github/pr/1341' into maint-0.4.1
by nickm＠torproject.org 22 Oct '19

22 Oct '19

commit d08d29f15f0c80b74f6440b8b84eefe241c87aad Merge: b588b6087 4bbefc2aa Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 22 12:53:06 2019 -0400 Merge remote-tracking branch 'tor-github/pr/1341' into maint-0.4.1 changes/bug30916 | 4 ++++ src/feature/relay/router.c | 18 ++++++++---------- 2 files changed, 12 insertions(+), 10 deletions(-)

1 0

[tor/release-0.4.1] Avoid a crash if our "current" and "old" ntor onion keys are equal
by nickm＠torproject.org 22 Oct '19

22 Oct '19

commit 2da4d64a64a803f4b0a6d56e517b4288bef6c4f8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 18 11:14:45 2019 -0400 Avoid a crash if our "current" and "old" ntor onion keys are equal Our dimap code asserts if you try to add the same key twice; this can't happen if everything is running smoothly, but it's possible if you try to start a relay where secret_onion_key_ntor is the same as secret_onion_key_ntor.old. Fixes bug 30916; bugfix on 0.2.4.8-alpha when ntor keys were introduced. --- changes/bug30916 | 4 ++++ src/feature/relay/router.c | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug30916 b/changes/bug30916 new file mode 100644 index 000000000..b006bfc75 --- /dev/null +++ b/changes/bug30916 @@ -0,0 +1,4 @@ + o Minor bugfixes (relay): + - Avoid crashing when starting with a corrupt keys directory where + the old ntor key and the new ntor key are identical. Fixes bug 30916; + bugfix on 0.2.4.8-alpha. diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c index 88a30cef0..1dbaf2ed6 100644 --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@ -286,7 +286,8 @@ construct_ntor_key_map(void) tor_memdup(&curve25519_onion_key, sizeof(curve25519_keypair_t))); } - if (!tor_mem_is_zero((const char*)last_pk, CURVE25519_PUBKEY_LEN)) { + if (!tor_mem_is_zero((const char*)last_pk, CURVE25519_PUBKEY_LEN) && + tor_memneq(cur_pk, last_pk, CURVE25519_PUBKEY_LEN)) { dimap_add_entry(&m, last_pk, tor_memdup(&last_curve25519_onion_key, sizeof(curve25519_keypair_t)));

1 0

[tor/master] Make options_validate() no longer use its "defaults" argument.
by nickm＠torproject.org 22 Oct '19

22 Oct '19

commit 8d84e10e8776eab8a44a039af0c15443fba83bc6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 22 08:27:13 2019 -0400 Make options_validate() no longer use its "defaults" argument. It can just look at what the defaults are. Closes ticket 32185. --- changes/ticket32185 | 4 ++++ src/app/config/config.c | 13 ++++++++++--- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/changes/ticket32185 b/changes/ticket32185 new file mode 100644 index 000000000..86f5dc5af --- /dev/null +++ b/changes/ticket32185 @@ -0,0 +1,4 @@ + o Code simplification and refactoring: + - Simplify the options_validate() code so that it looks at the default + options directly, rather than taking default options as an argument. + This change lets us simplify its interface. Closes ticket 32185. diff --git a/src/app/config/config.c b/src/app/config/config.c index 77b73f885..f07c9bbc2 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -3434,7 +3434,7 @@ options_validate_single_onion(or_options_t *options, char **msg) */ STATIC int options_validate(or_options_t *old_options, or_options_t *options, - or_options_t *default_options, int from_setconf_unused, + or_options_t *default_options_unused, int from_setconf_unused, char **msg) { config_line_t *cl; @@ -3442,6 +3442,7 @@ options_validate(or_options_t *old_options, or_options_t *options, int n_ports=0; int world_writable_control_socket=0; (void)from_setconf_unused; /* 29211 TODO: Remove this from the API. */ + (void)default_options_unused; /* 29211 TODO: Remove this from the API. */ tor_assert(msg); *msg = NULL; @@ -4486,12 +4487,17 @@ options_validate(or_options_t *old_options, or_options_t *options, "AlternateDirAuthority and AlternateBridgeAuthority configured."); } + /* Check for options that can only be changed from the defaults in testing + networks. */ + or_options_t *dflt_options = options_new(); + options_init(dflt_options); #define CHECK_DEFAULT(arg) \ STMT_BEGIN \ if (!options->TestingTorNetwork && \ !options->UsingTestNetworkDefaults_ && \ - !config_is_same(get_options_mgr(),options, \ - default_options,#arg)) { \ + !config_is_same(get_options_mgr(),options, \ + dflt_options,#arg)) { \ + or_options_free(dflt_options); \ REJECT(#arg " may only be changed in testing Tor " \ "networks!"); \ } STMT_END @@ -4515,6 +4521,7 @@ options_validate(or_options_t *old_options, or_options_t *options, CHECK_DEFAULT(TestingAuthKeySlop); CHECK_DEFAULT(TestingLinkKeySlop); #undef CHECK_DEFAULT + or_options_free(dflt_options); if (!options->ClientDNSRejectInternalAddresses && !(options->DirAuthorities ||

1 0

[tor/master] Simplify CHECK_DEFAULT() logic a little further.
by nickm＠torproject.org 22 Oct '19

22 Oct '19

commit 4413b030f28fcbe96f1b568796b20a7e90d55301 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 22 08:32:33 2019 -0400 Simplify CHECK_DEFAULT() logic a little further. Since each of these tests only applies to testing networks, put them all into a single block that checks for testing networks. (I recommend reviewing with the "diff -b" option, since the change is mostly indentation.) --- src/app/config/config.c | 57 +++++++++++++++++++++++++------------------------ 1 file changed, 29 insertions(+), 28 deletions(-) diff --git a/src/app/config/config.c b/src/app/config/config.c index f07c9bbc2..337ae9357 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -4487,41 +4487,42 @@ options_validate(or_options_t *old_options, or_options_t *options, "AlternateDirAuthority and AlternateBridgeAuthority configured."); } - /* Check for options that can only be changed from the defaults in testing - networks. */ - or_options_t *dflt_options = options_new(); - options_init(dflt_options); #define CHECK_DEFAULT(arg) \ STMT_BEGIN \ - if (!options->TestingTorNetwork && \ - !options->UsingTestNetworkDefaults_ && \ - !config_is_same(get_options_mgr(),options, \ + if (!config_is_same(get_options_mgr(),options, \ dflt_options,#arg)) { \ or_options_free(dflt_options); \ REJECT(#arg " may only be changed in testing Tor " \ "networks!"); \ - } STMT_END - CHECK_DEFAULT(TestingV3AuthInitialVotingInterval); - CHECK_DEFAULT(TestingV3AuthInitialVoteDelay); - CHECK_DEFAULT(TestingV3AuthInitialDistDelay); - CHECK_DEFAULT(TestingV3AuthVotingStartOffset); - CHECK_DEFAULT(TestingAuthDirTimeToLearnReachability); - CHECK_DEFAULT(TestingEstimatedDescriptorPropagationTime); - CHECK_DEFAULT(TestingServerDownloadInitialDelay); - CHECK_DEFAULT(TestingClientDownloadInitialDelay); - CHECK_DEFAULT(TestingServerConsensusDownloadInitialDelay); - CHECK_DEFAULT(TestingClientConsensusDownloadInitialDelay); - CHECK_DEFAULT(TestingBridgeDownloadInitialDelay); - CHECK_DEFAULT(TestingBridgeBootstrapDownloadInitialDelay); - CHECK_DEFAULT(TestingClientMaxIntervalWithoutRequest); - CHECK_DEFAULT(TestingDirConnectionMaxStall); - CHECK_DEFAULT(TestingAuthKeyLifetime); - CHECK_DEFAULT(TestingLinkCertLifetime); - CHECK_DEFAULT(TestingSigningKeySlop); - CHECK_DEFAULT(TestingAuthKeySlop); - CHECK_DEFAULT(TestingLinkKeySlop); + } STMT_END + + /* Check for options that can only be changed from the defaults in testing + networks. */ + if (! options->TestingTorNetwork && !options->UsingTestNetworkDefaults_) { + or_options_t *dflt_options = options_new(); + options_init(dflt_options); + CHECK_DEFAULT(TestingV3AuthInitialVotingInterval); + CHECK_DEFAULT(TestingV3AuthInitialVoteDelay); + CHECK_DEFAULT(TestingV3AuthInitialDistDelay); + CHECK_DEFAULT(TestingV3AuthVotingStartOffset); + CHECK_DEFAULT(TestingAuthDirTimeToLearnReachability); + CHECK_DEFAULT(TestingEstimatedDescriptorPropagationTime); + CHECK_DEFAULT(TestingServerDownloadInitialDelay); + CHECK_DEFAULT(TestingClientDownloadInitialDelay); + CHECK_DEFAULT(TestingServerConsensusDownloadInitialDelay); + CHECK_DEFAULT(TestingClientConsensusDownloadInitialDelay); + CHECK_DEFAULT(TestingBridgeDownloadInitialDelay); + CHECK_DEFAULT(TestingBridgeBootstrapDownloadInitialDelay); + CHECK_DEFAULT(TestingClientMaxIntervalWithoutRequest); + CHECK_DEFAULT(TestingDirConnectionMaxStall); + CHECK_DEFAULT(TestingAuthKeyLifetime); + CHECK_DEFAULT(TestingLinkCertLifetime); + CHECK_DEFAULT(TestingSigningKeySlop); + CHECK_DEFAULT(TestingAuthKeySlop); + CHECK_DEFAULT(TestingLinkKeySlop); + or_options_free(dflt_options); + } #undef CHECK_DEFAULT - or_options_free(dflt_options); if (!options->ClientDNSRejectInternalAddresses && !(options->DirAuthorities ||

1 0

[tor/master] Merge remote-tracking branch 'tor-github/pr/1446'
by nickm＠torproject.org 22 Oct '19

22 Oct '19

commit 7d75e1dbdf9ab1fc0bbde086ca22a116de0216f4 Merge: 3989dd161 4413b030f Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 22 12:52:32 2019 -0400 Merge remote-tracking branch 'tor-github/pr/1446' changes/ticket32185 | 4 ++++ src/app/config/config.c | 58 ++++++++++++++++++++++++++++--------------------- 2 files changed, 37 insertions(+), 25 deletions(-)

1 0

[tor/maint-0.4.1] Add a rate-limit to our warning about the disabled .exit notation
by nickm＠torproject.org 22 Oct '19

22 Oct '19

commit f0e4120996d3a96252200ea5302dcde3af6e0bc0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 18 15:38:33 2019 -0400 Add a rate-limit to our warning about the disabled .exit notation This warning would previously be given every time we tried to open a connection to a foo.exit address, which could potentially be used to flood the logs. Now, we don't allow this warning to appear more than once every 15 minutes. Fixes bug 31466; bugfix on 0.2.2.1-alpha, when .exit was first deprecated. --- changes/ticket31466 | 5 +++++ src/or/connection_edge.c | 8 +++++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/changes/ticket31466 b/changes/ticket31466 new file mode 100644 index 000000000..e535b4502 --- /dev/null +++ b/changes/ticket31466 @@ -0,0 +1,5 @@ + o Minor bugfixes (logging): + - Rate-limit our the logging message about the obsolete .exit notation. + Previously, there was no limit on this warning, which could potentially + be triggered many times by a hostile website. Fixes bug 31466; + bugfix on 0.2.2.1-alpha. diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 7a97c632d..5638d9a1b 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1186,9 +1186,11 @@ connection_ap_handshake_rewrite(entry_connection_t *conn, * disallowed when they're coming straight from the client, but you're * allowed to have them in MapAddress commands and so forth. */ if (!strcmpend(socks->address, ".exit") && !options->AllowDotExit) { - log_warn(LD_APP, "The \".exit\" notation is disabled in Tor due to " - "security risks. Set AllowDotExit in your torrc to enable " - "it (at your own risk)."); + static ratelim_t exit_warning_limit = RATELIM_INIT(60*15); + log_fn_ratelim(&exit_warning_limit, LOG_WARN, LD_APP, + "The \".exit\" notation is disabled in Tor due to " + "security risks. Set AllowDotExit in your torrc to enable " + "it (at your own risk)."); control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s", escaped(socks->address)); out->end_reason = END_STREAM_REASON_TORPROTOCOL;

1 0