November 2019 - tor-commits - lists.torproject.org

[tor/maint-0.3.5] Merge remote-tracking branch 'tor-github/pr/1340' into maint-0.3.5
by teor＠torproject.org 06 Nov '19

06 Nov '19

commit d2e4262ebc134f4c6ae9e702a14da45489575b4f Merge: 6bfdd0967 2da4d64a6 Author: teor <teor(a)torproject.org> Date: Wed Nov 6 11:17:01 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1340' into maint-0.3.5 changes/bug30916 | 4 ++++ src/feature/relay/router.c | 18 ++++++++---------- 2 files changed, 12 insertions(+), 10 deletions(-)

1 0

[tor/maint-0.3.5] Merge remote-tracking branch 'tor-github/pr/1348' into maint-0.3.5
by teor＠torproject.org 06 Nov '19

06 Nov '19

commit 0e2834a3718a3932cfe8d3148d203a0604451073 Merge: d2e4262eb 0614f8390 Author: teor <teor(a)torproject.org> Date: Wed Nov 6 11:17:43 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1348' into maint-0.3.5 changes/bug31408 | 5 ++++ src/lib/fs/conffile.c | 10 +++++--- src/test/test_config.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 79 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.3.5] Merge remote-tracking branch 'tor-github/pr/1354' into maint-0.3.5
by teor＠torproject.org 06 Nov '19

06 Nov '19

commit 4abfcb7997e4a753643fd969317c502efc6be06e Merge: 0e2834a37 cf2b00d3f Author: teor <teor(a)torproject.org> Date: Wed Nov 6 11:18:09 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1354' into maint-0.3.5 changes/bug31837 | 5 +++++ src/test/test_rebind.py | 16 +++++++++------- 2 files changed, 14 insertions(+), 7 deletions(-)

1 0

[tor/maint-0.3.5] Treat an unexpected constant-sized VERSIONS cell as a PROTOCOL_WARN.
by teor＠torproject.org 06 Nov '19

06 Nov '19

commit 3c97ab3c24ba4a133377c7ec6ec89cc6903ffb2e Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 17 09:09:36 2019 -0400 Treat an unexpected constant-sized VERSIONS cell as a PROTOCOL_WARN. We previously used tor_fragile_assert() to declare that this case could not happen: VERSIONS cells are always supposed to be variable-sized, right? This is incorrect, though. On a v1 link protocol connection, all cells are fixed-sized. There aren't supposed to be any VERSIONS cells with this version of the protocol, but apparently, somebody was messing up. (The v1 link protocol is obsolete, so probably the implementer responsible didn't mean to be using it.) Fixes bug 31107. Bugfix on 0.2.4.4-alpha, when we introduced a tor_fragile_assert() for this case. --- changes/bug31107 | 4 ++++ src/or/channeltls.c | 10 +++++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/changes/bug31107 b/changes/bug31107 new file mode 100644 index 000000000..9652927c3 --- /dev/null +++ b/changes/bug31107 @@ -0,0 +1,4 @@ + o Minor bugfixes (logging, protocol violations): + - Do not log a nonfatal assertion failure when receiving a VERSIONS + cell on a connection using the obsolete v1 link protocol. Log a + protocol_warn instead. Fixes bug 31107; bugfix on 0.2.4.4-alpha. diff --git a/src/or/channeltls.c b/src/or/channeltls.c index d44f71913..6f4e413dc 100644 --- a/src/or/channeltls.c +++ b/src/or/channeltls.c @@ -1098,7 +1098,15 @@ channel_tls_handle_cell(cell_t *cell, or_connection_t *conn) /* do nothing */ break; case CELL_VERSIONS: - tor_fragile_assert(); + /* A VERSIONS cell should always be a variable-length cell, and + * so should never reach this function (which handles constant-sized + * cells). But if the connection is using the (obsolete) v1 link + * protocol, all cells will be treated as constant-sized, and so + * it's possible we'll reach this code. + */ + log_fn(LOG_PROTOCOL_WARN, LD_CHANNEL, + "Received unexpected VERSIONS cell on a channel using link " + "protocol %d; ignoring.", conn->link_proto); break; case CELL_NETINFO: ++stats_n_netinfo_cells_processed;

1 0

[tor/maint-0.3.5] Extract expressions in construct_ntor_key_map()
by teor＠torproject.org 06 Nov '19

06 Nov '19

commit 1e9488f2fd829d48eb5ef6c2170e0f7163061136 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 18 11:11:05 2019 -0400 Extract expressions in construct_ntor_key_map() No behavioral change here: this is just refactoring. --- src/feature/relay/router.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c index dad2c6a50..88a30cef0 100644 --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@ -278,19 +278,16 @@ construct_ntor_key_map(void) { di_digest256_map_t *m = NULL; - if (!tor_mem_is_zero((const char*) - curve25519_onion_key.pubkey.public_key, - CURVE25519_PUBKEY_LEN)) { - dimap_add_entry(&m, - curve25519_onion_key.pubkey.public_key, + const uint8_t *cur_pk = curve25519_onion_key.pubkey.public_key; + const uint8_t *last_pk = last_curve25519_onion_key.pubkey.public_key; + + if (!tor_mem_is_zero((const char *)cur_pk, CURVE25519_PUBKEY_LEN)) { + dimap_add_entry(&m, cur_pk, tor_memdup(&curve25519_onion_key, sizeof(curve25519_keypair_t))); } - if (!tor_mem_is_zero((const char*) - last_curve25519_onion_key.pubkey.public_key, - CURVE25519_PUBKEY_LEN)) { - dimap_add_entry(&m, - last_curve25519_onion_key.pubkey.public_key, + if (!tor_mem_is_zero((const char*)last_pk, CURVE25519_PUBKEY_LEN)) { + dimap_add_entry(&m, last_pk, tor_memdup(&last_curve25519_onion_key, sizeof(curve25519_keypair_t))); }

1 0

[tor/maint-0.3.5] Avoid a crash if our "current" and "old" ntor onion keys are equal
by teor＠torproject.org 06 Nov '19

06 Nov '19

commit 2da4d64a64a803f4b0a6d56e517b4288bef6c4f8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 18 11:14:45 2019 -0400 Avoid a crash if our "current" and "old" ntor onion keys are equal Our dimap code asserts if you try to add the same key twice; this can't happen if everything is running smoothly, but it's possible if you try to start a relay where secret_onion_key_ntor is the same as secret_onion_key_ntor.old. Fixes bug 30916; bugfix on 0.2.4.8-alpha when ntor keys were introduced. --- changes/bug30916 | 4 ++++ src/feature/relay/router.c | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug30916 b/changes/bug30916 new file mode 100644 index 000000000..b006bfc75 --- /dev/null +++ b/changes/bug30916 @@ -0,0 +1,4 @@ + o Minor bugfixes (relay): + - Avoid crashing when starting with a corrupt keys directory where + the old ntor key and the new ntor key are identical. Fixes bug 30916; + bugfix on 0.2.4.8-alpha. diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c index 88a30cef0..1dbaf2ed6 100644 --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@ -286,7 +286,8 @@ construct_ntor_key_map(void) tor_memdup(&curve25519_onion_key, sizeof(curve25519_keypair_t))); } - if (!tor_mem_is_zero((const char*)last_pk, CURVE25519_PUBKEY_LEN)) { + if (!tor_mem_is_zero((const char*)last_pk, CURVE25519_PUBKEY_LEN) && + tor_memneq(cur_pk, last_pk, CURVE25519_PUBKEY_LEN)) { dimap_add_entry(&m, last_pk, tor_memdup(&last_curve25519_onion_key, sizeof(curve25519_keypair_t)));

1 0

[tor/maint-0.3.5] Add a rate-limit to our warning about the disabled .exit notation
by teor＠torproject.org 06 Nov '19

06 Nov '19

commit f0e4120996d3a96252200ea5302dcde3af6e0bc0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 18 15:38:33 2019 -0400 Add a rate-limit to our warning about the disabled .exit notation This warning would previously be given every time we tried to open a connection to a foo.exit address, which could potentially be used to flood the logs. Now, we don't allow this warning to appear more than once every 15 minutes. Fixes bug 31466; bugfix on 0.2.2.1-alpha, when .exit was first deprecated. --- changes/ticket31466 | 5 +++++ src/or/connection_edge.c | 8 +++++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/changes/ticket31466 b/changes/ticket31466 new file mode 100644 index 000000000..e535b4502 --- /dev/null +++ b/changes/ticket31466 @@ -0,0 +1,5 @@ + o Minor bugfixes (logging): + - Rate-limit our the logging message about the obsolete .exit notation. + Previously, there was no limit on this warning, which could potentially + be triggered many times by a hostile website. Fixes bug 31466; + bugfix on 0.2.2.1-alpha. diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 7a97c632d..5638d9a1b 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1186,9 +1186,11 @@ connection_ap_handshake_rewrite(entry_connection_t *conn, * disallowed when they're coming straight from the client, but you're * allowed to have them in MapAddress commands and so forth. */ if (!strcmpend(socks->address, ".exit") && !options->AllowDotExit) { - log_warn(LD_APP, "The \".exit\" notation is disabled in Tor due to " - "security risks. Set AllowDotExit in your torrc to enable " - "it (at your own risk)."); + static ratelim_t exit_warning_limit = RATELIM_INIT(60*15); + log_fn_ratelim(&exit_warning_limit, LOG_WARN, LD_APP, + "The \".exit\" notation is disabled in Tor due to " + "security risks. Set AllowDotExit in your torrc to enable " + "it (at your own risk)."); control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s", escaped(socks->address)); out->end_reason = END_STREAM_REASON_TORPROTOCOL;

1 0

[tor/maint-0.2.9] Treat an unexpected constant-sized VERSIONS cell as a PROTOCOL_WARN.
by teor＠torproject.org 06 Nov '19

06 Nov '19

commit 3c97ab3c24ba4a133377c7ec6ec89cc6903ffb2e Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 17 09:09:36 2019 -0400 Treat an unexpected constant-sized VERSIONS cell as a PROTOCOL_WARN. We previously used tor_fragile_assert() to declare that this case could not happen: VERSIONS cells are always supposed to be variable-sized, right? This is incorrect, though. On a v1 link protocol connection, all cells are fixed-sized. There aren't supposed to be any VERSIONS cells with this version of the protocol, but apparently, somebody was messing up. (The v1 link protocol is obsolete, so probably the implementer responsible didn't mean to be using it.) Fixes bug 31107. Bugfix on 0.2.4.4-alpha, when we introduced a tor_fragile_assert() for this case. --- changes/bug31107 | 4 ++++ src/or/channeltls.c | 10 +++++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/changes/bug31107 b/changes/bug31107 new file mode 100644 index 000000000..9652927c3 --- /dev/null +++ b/changes/bug31107 @@ -0,0 +1,4 @@ + o Minor bugfixes (logging, protocol violations): + - Do not log a nonfatal assertion failure when receiving a VERSIONS + cell on a connection using the obsolete v1 link protocol. Log a + protocol_warn instead. Fixes bug 31107; bugfix on 0.2.4.4-alpha. diff --git a/src/or/channeltls.c b/src/or/channeltls.c index d44f71913..6f4e413dc 100644 --- a/src/or/channeltls.c +++ b/src/or/channeltls.c @@ -1098,7 +1098,15 @@ channel_tls_handle_cell(cell_t *cell, or_connection_t *conn) /* do nothing */ break; case CELL_VERSIONS: - tor_fragile_assert(); + /* A VERSIONS cell should always be a variable-length cell, and + * so should never reach this function (which handles constant-sized + * cells). But if the connection is using the (obsolete) v1 link + * protocol, all cells will be treated as constant-sized, and so + * it's possible we'll reach this code. + */ + log_fn(LOG_PROTOCOL_WARN, LD_CHANNEL, + "Received unexpected VERSIONS cell on a channel using link " + "protocol %d; ignoring.", conn->link_proto); break; case CELL_NETINFO: ++stats_n_netinfo_cells_processed;

1 0

[tor/maint-0.2.9] Merge remote-tracking branch 'tor-github/pr/1342' into maint-0.2.9
by teor＠torproject.org 06 Nov '19

06 Nov '19

commit 0650bf3695ae2e118426f3f6ecf1f8a344562119 Merge: c06d540ff f0e412099 Author: teor <teor(a)torproject.org> Date: Wed Nov 6 11:15:45 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1342' into maint-0.2.9 changes/ticket31466 | 5 +++++ src/or/connection_edge.c | 8 +++++--- 2 files changed, 10 insertions(+), 3 deletions(-)

1 0

[tor/maint-0.2.9] Add a rate-limit to our warning about the disabled .exit notation
by teor＠torproject.org 06 Nov '19

06 Nov '19

commit f0e4120996d3a96252200ea5302dcde3af6e0bc0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 18 15:38:33 2019 -0400 Add a rate-limit to our warning about the disabled .exit notation This warning would previously be given every time we tried to open a connection to a foo.exit address, which could potentially be used to flood the logs. Now, we don't allow this warning to appear more than once every 15 minutes. Fixes bug 31466; bugfix on 0.2.2.1-alpha, when .exit was first deprecated. --- changes/ticket31466 | 5 +++++ src/or/connection_edge.c | 8 +++++--- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/changes/ticket31466 b/changes/ticket31466 new file mode 100644 index 000000000..e535b4502 --- /dev/null +++ b/changes/ticket31466 @@ -0,0 +1,5 @@ + o Minor bugfixes (logging): + - Rate-limit our the logging message about the obsolete .exit notation. + Previously, there was no limit on this warning, which could potentially + be triggered many times by a hostile website. Fixes bug 31466; + bugfix on 0.2.2.1-alpha. diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 7a97c632d..5638d9a1b 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1186,9 +1186,11 @@ connection_ap_handshake_rewrite(entry_connection_t *conn, * disallowed when they're coming straight from the client, but you're * allowed to have them in MapAddress commands and so forth. */ if (!strcmpend(socks->address, ".exit") && !options->AllowDotExit) { - log_warn(LD_APP, "The \".exit\" notation is disabled in Tor due to " - "security risks. Set AllowDotExit in your torrc to enable " - "it (at your own risk)."); + static ratelim_t exit_warning_limit = RATELIM_INIT(60*15); + log_fn_ratelim(&exit_warning_limit, LOG_WARN, LD_APP, + "The \".exit\" notation is disabled in Tor due to " + "security risks. Set AllowDotExit in your torrc to enable " + "it (at your own risk)."); control_event_client_status(LOG_WARN, "SOCKS_BAD_HOSTNAME HOSTNAME=%s", escaped(socks->address)); out->end_reason = END_STREAM_REASON_TORPROTOCOL;

1 0