March 2020 - tor-commits - lists.torproject.org

[tor/release-0.4.2] Merge branch 'maint-0.4.1' into maint-0.4.2
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit 758deaa472b879645828c1ee585eb6ce8b8a9a50 Merge: 85141a3a7 4ad3f17c2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 18 08:20:16 2020 -0400 Merge branch 'maint-0.4.1' into maint-0.4.2 src/lib/crypt_ops/crypto_rsa_openssl.c | 7 +++++++ 1 file changed, 7 insertions(+)

1 0

[tor/release-0.4.2] Merge branch 'trove_2020_002_035' into trove_2020_002_041
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit 9163781039b96e859fc102f003a274e9716cc02d Merge: dd6e2277e f958b537a Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 17 10:45:03 2020 -0400 Merge branch 'trove_2020_002_035' into trove_2020_002_041 src/lib/crypt_ops/crypto_rsa_nss.c | 2 +- src/lib/crypt_ops/crypto_rsa_openssl.c | 57 +++++++++++++++++++++++++++++++--- src/test/test_crypto.c | 15 +++++++++ 3 files changed, 68 insertions(+), 6 deletions(-)

1 0

[tor/release-0.4.2] Add off-by-one checks for key length.
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit 2328c79a5fbc2f1995390dd08002244bc952246d Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 17 10:07:54 2020 -0400 Add off-by-one checks for key length. --- src/test/test_crypto.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index 2373e5bf8..5af0cce13 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -1505,6 +1505,21 @@ test_crypto_pk_bad_size(void *arg) pk2 = crypto_pk_asn1_decode_private(buf, n, 1020); tt_assert(! pk2); + /* Set the max bit count one bit smaller: we should refuse to decode the + key.*/ + pk2 = crypto_pk_asn1_decode_private(buf, n, 1023); + tt_assert(! pk2); + + /* Correct size: should work. */ + pk2 = crypto_pk_asn1_decode_private(buf, n, 1024); + tt_assert(pk2); + crypto_pk_free(pk2); + + /* One bit larger: should work. */ + pk2 = crypto_pk_asn1_decode_private(buf, n, 1025); + tt_assert(pk2); + crypto_pk_free(pk2); + /* Set the max bit count larger: it should decode fine. */ pk2 = crypto_pk_asn1_decode_private(buf, n, 2048); tt_assert(pk2);

1 0

[tor/release-0.4.2] Merge branch 'trove_2020_002_035' into maint-0.3.5
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit fe3d8ec38e3c4c2a992280c2847cdd8e05f81d36 Merge: 089e57d22 f958b537a Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 17 15:21:48 2020 -0400 Merge branch 'trove_2020_002_035' into maint-0.3.5 changes/ticket33119 | 8 +++++ src/feature/dirparse/parsecommon.c | 9 ++++- src/lib/crypt_ops/crypto_rsa.c | 27 +++++++++++---- src/lib/crypt_ops/crypto_rsa.h | 5 ++- src/lib/crypt_ops/crypto_rsa_nss.c | 14 +++++++- src/lib/crypt_ops/crypto_rsa_openssl.c | 63 ++++++++++++++++++++++++++++++++-- src/test/test_crypto.c | 39 +++++++++++++++++++++ 7 files changed, 154 insertions(+), 11 deletions(-)

1 0

[tor/release-0.4.2] Merge branch 'maint-0.3.5' into maint-0.4.1
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit 4ad3f17c26166b898cd768a6e1835fad2ef67005 Merge: 57b1d0848 0526801ed Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 18 08:20:16 2020 -0400 Merge branch 'maint-0.3.5' into maint-0.4.1 src/lib/crypt_ops/crypto_rsa_openssl.c | 7 +++++++ 1 file changed, 7 insertions(+)

1 0

[tor/release-0.4.2] Fix memory leak in crypto_pk_asn1_decode_private.
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit 29c9675bdeb5a63564e9a76dcd7162bef884b240 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Mar 14 14:17:33 2020 -0400 Fix memory leak in crypto_pk_asn1_decode_private. (Deep, deep thanks to Taylor for reminding me to test this!) --- src/lib/crypt_ops/crypto_rsa_openssl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/lib/crypt_ops/crypto_rsa_openssl.c b/src/lib/crypt_ops/crypto_rsa_openssl.c index 39b7aaf0c..0db25f347 100644 --- a/src/lib/crypt_ops/crypto_rsa_openssl.c +++ b/src/lib/crypt_ops/crypto_rsa_openssl.c @@ -590,6 +590,7 @@ crypto_pk_asn1_decode_private(const char *str, size_t len, int max_bits) if (max_bits >= 0 && rsa->n && BN_num_bits(rsa->n) > max_bits) { #endif log_info(LD_CRYPTO, "Private key longer than expected."); + RSA_free(rsa); return NULL; } crypto_pk_t *result = crypto_new_pk_from_openssl_rsa_(rsa);

1 0

[tor/release-0.4.2] fold in changelog and blurb for trove-2020-002
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit 8efddd8b00deae8d43c23f4684cf772f1da5c8be Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 17 15:37:39 2020 -0400 fold in changelog and blurb for trove-2020-002 --- ChangeLog | 42 ++++++++++++++++++++++++++++++++---------- 1 file changed, 32 insertions(+), 10 deletions(-) diff --git a/ChangeLog b/ChangeLog index 106b41c04..89bd916da 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,13 +1,35 @@ Changes in version 0.4.2.7 - 2020-03-?? - This is the third stable release in the 0.4.2.x series. - - Blurb. + This is the third stable release in the 0.4.2.x series. It backports + numerous fixes from later releases, including a fix for TROVE-2020- + 002, a major denial-of-service vulnerability that affected all + released Tor instances since 0.2.1.5-alpha. Using this vulnerability, + an attacker could cause Tor instances to consume a huge amount of CPU, + disrupting their operations for several seconds or minutes. This + attack could be launched by anybody against a relay, or by a directory + cache against any client that had connected to it. The attacker could + launch this attack as much as they wanted, thereby disrupting service + or creating patterns that could aid in traffic analysis. This issue + was found by OSS-Fuzz, and is also tracked as CVE-2020-10592. + + We do not have reason to believe that this attack is currently being + exploited in the wild, but nonetheless we advise everyone to upgrade + as soon as packages are available. + + o Major bugfixes (security, denial-of-service, backport from 0.4.3.3-alpha): + - Fix a denial-of-service bug that could be used by anyone to + consume a bunch of CPU on any Tor relay or authority, or by + directories to consume a bunch of CPU on clients or hidden + services. Because of the potential for CPU consumption to + introduce observable timing patterns, we are treating this as a + high-severity security issue. Fixes bug 33119; bugfix on + 0.2.1.5-alpha. Found by OSS-Fuzz. We are also tracking this issue + as TROVE-2020-002 and CVE-2020-10592. o Major bugfixes (circuit padding, memory leak, backport from 0.4.3.3-alpha): - Avoid a remotely triggered memory leak in the case that a circuit padding machine is somehow negotiated twice on the same circuit. Fixes bug 33619; bugfix on 0.4.0.1-alpha. Found by Tobias Pulls. - This is also tracked as TROVE-2020-004. + This is also tracked as TROVE-2020-004 and CVE-2020-10593. o Major bugfixes (directory authority, backport from 0.4.3.3-alpha): - Directory authorities will now send a 503 (not enough bandwidth) @@ -24,12 +46,6 @@ Changes in version 0.4.2.7 - 2020-03-?? - Lowercase the configured value of BridgeDistribution before adding it to the descriptor. Fixes bug 32753; bugfix on 0.3.2.3-alpha. - o Minor bugfixes (onion services v3, backport from 0.4.3.3-alpha): - - Fix an assertion failure that could result from a corrupted - ADD_ONION control port command. Found by Saibato. Fixes bug 33137; - bugfix on 0.3.3.1-alpha. This issue is also tracked - as TROVE-2020-003. - o Minor bugfixes (logging, backport from 0.4.3.2-alpha): - If we encounter a bug when flushing a buffer to a TLS connection, only log the bug once per invocation of the Tor process. @@ -37,6 +53,12 @@ Changes in version 0.4.2.7 - 2020-03-?? us to run out of disk space. Fixes bug 33093; bugfix on 0.3.2.2-alpha. + o Minor bugfixes (onion services v3, backport from 0.4.3.3-alpha): + - Fix an assertion failure that could result from a corrupted + ADD_ONION control port command. Found by Saibato. Fixes bug 33137; + bugfix on 0.3.3.1-alpha. This issue is also tracked + as TROVE-2020-003. + o Minor bugfixes (rust, build, backport from 0.4.3.2-alpha): - Fix a syntax warning given by newer versions of Rust that was creating problems for our continuous integration. Fixes bug 33212;

1 0

[tor/release-0.4.2] Merge branch 'maint-0.3.5' into maint-0.4.1
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit 57b1d0848e9b42670d6f33e37a2095740726e2b1 Merge: 3c8a4b8fb fe3d8ec38 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 17 15:22:36 2020 -0400 Merge branch 'maint-0.3.5' into maint-0.4.1

1 0

[tor/release-0.4.3] When parsing, reject >1024-bit RSA private keys sooner.
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit 9e1085c924133d7b73c7b0a42282fb13b34f28b8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 5 11:11:35 2020 -0500 When parsing, reject >1024-bit RSA private keys sooner. Private-key validation is fairly expensive for long keys in openssl, so we need to avoid it sooner. --- src/feature/dirparse/parsecommon.c | 3 ++- src/lib/crypt_ops/crypto_rsa.c | 27 +++++++++++++++++++++------ src/lib/crypt_ops/crypto_rsa.h | 5 ++++- src/lib/crypt_ops/crypto_rsa_nss.c | 14 +++++++++++++- src/lib/crypt_ops/crypto_rsa_openssl.c | 11 +++++++++-- 5 files changed, 49 insertions(+), 11 deletions(-) diff --git a/src/feature/dirparse/parsecommon.c b/src/feature/dirparse/parsecommon.c index 632f5adff..5b753f0f2 100644 --- a/src/feature/dirparse/parsecommon.c +++ b/src/feature/dirparse/parsecommon.c @@ -389,7 +389,8 @@ get_next_token(memarea_t *area, RET_ERR("Couldn't parse public key."); } else if (!strcmp(tok->object_type, "RSA PRIVATE KEY")) { /* private key */ tok->key = crypto_pk_new(); - if (crypto_pk_read_private_key_from_string(tok->key, obstart, eol-obstart)) + if (crypto_pk_read_private_key1024_from_string(tok->key, + obstart, eol-obstart)) RET_ERR("Couldn't parse private key."); } else { /* If it's something else, try to base64-decode it */ int r; diff --git a/src/lib/crypt_ops/crypto_rsa.c b/src/lib/crypt_ops/crypto_rsa.c index c9189b0df..8fd8a8aa7 100644 --- a/src/lib/crypt_ops/crypto_rsa.c +++ b/src/lib/crypt_ops/crypto_rsa.c @@ -490,7 +490,7 @@ crypto_pk_write_private_key_to_string(crypto_pk_t *env, static int crypto_pk_read_from_string_generic(crypto_pk_t *env, const char *src, size_t len, int severity, - bool private_key) + bool private_key, int max_bits) { if (len == (size_t)-1) // "-1" indicates "use the length of the string." len = strlen(src); @@ -510,7 +510,7 @@ crypto_pk_read_from_string_generic(crypto_pk_t *env, const char *src, } crypto_pk_t *pk = private_key - ? crypto_pk_asn1_decode_private((const char*)buf, n) + ? crypto_pk_asn1_decode_private((const char*)buf, n, max_bits) : crypto_pk_asn1_decode((const char*)buf, n); if (! pk) { log_fn(severity, LD_CRYPTO, @@ -539,7 +539,8 @@ int crypto_pk_read_public_key_from_string(crypto_pk_t *env, const char *src, size_t len) { - return crypto_pk_read_from_string_generic(env, src, len, LOG_INFO, false); + return crypto_pk_read_from_string_generic(env, src, len, LOG_INFO, false, + -1); } /** Read a PEM-encoded private key from the len-byte string src @@ -550,7 +551,21 @@ int crypto_pk_read_private_key_from_string(crypto_pk_t *env, const char *src, ssize_t len) { - return crypto_pk_read_from_string_generic(env, src, len, LOG_INFO, true); + return crypto_pk_read_from_string_generic(env, src, len, LOG_INFO, true, + -1); +} + +/** + * As crypto_pk_read_private_key_from_string(), but reject any key + * with a modulus longer than 1024 bits before doing any expensive + * validation on it. + */ +int +crypto_pk_read_private_key1024_from_string(crypto_pk_t *env, + const char *src, ssize_t len) +{ + return crypto_pk_read_from_string_generic(env, src, len, LOG_INFO, true, + 1024); } /** If a file is longer than this, we won't try to decode its private key */ @@ -578,7 +593,7 @@ crypto_pk_read_private_key_from_filename(crypto_pk_t *env, } int rv = crypto_pk_read_from_string_generic(env, buf, (ssize_t)st.st_size, - LOG_WARN, true); + LOG_WARN, true, -1); if (rv < 0) { log_warn(LD_CRYPTO, "Unable to decode private key from file %s", escaped(keyfile)); @@ -662,7 +677,7 @@ crypto_pk_base64_decode_private(const char *str, size_t len) goto out; } - pk = crypto_pk_asn1_decode_private(der, der_len); + pk = crypto_pk_asn1_decode_private(der, der_len, -1); out: memwipe(der, 0, len+1); diff --git a/src/lib/crypt_ops/crypto_rsa.h b/src/lib/crypt_ops/crypto_rsa.h index c1ea767f8..6d9cc8d30 100644 --- a/src/lib/crypt_ops/crypto_rsa.h +++ b/src/lib/crypt_ops/crypto_rsa.h @@ -61,6 +61,8 @@ int crypto_pk_read_public_key_from_string(crypto_pk_t *env, const char *src, size_t len); int crypto_pk_read_private_key_from_string(crypto_pk_t *env, const char *s, ssize_t len); +int crypto_pk_read_private_key1024_from_string(crypto_pk_t *env, + const char *src, ssize_t len); int crypto_pk_write_private_key_to_filename(crypto_pk_t *env, const char *fname); @@ -95,7 +97,8 @@ int crypto_pk_asn1_encode(const crypto_pk_t *pk, char *dest, size_t dest_len); crypto_pk_t *crypto_pk_asn1_decode(const char *str, size_t len); int crypto_pk_asn1_encode_private(const crypto_pk_t *pk, char *dest, size_t dest_len); -crypto_pk_t *crypto_pk_asn1_decode_private(const char *str, size_t len); +crypto_pk_t *crypto_pk_asn1_decode_private(const char *str, size_t len, + int max_bits); int crypto_pk_get_fingerprint(crypto_pk_t *pk, char *fp_out,int add_space); int crypto_pk_get_hashed_fingerprint(crypto_pk_t *pk, char *fp_out); void crypto_add_spaces_to_fp(char *out, size_t outlen, const char *in); diff --git a/src/lib/crypt_ops/crypto_rsa_nss.c b/src/lib/crypt_ops/crypto_rsa_nss.c index ad2ad38b6..4cf699067 100644 --- a/src/lib/crypt_ops/crypto_rsa_nss.c +++ b/src/lib/crypt_ops/crypto_rsa_nss.c @@ -679,9 +679,12 @@ crypto_pk_asn1_encode_private(const crypto_pk_t *pk, /** Given a buffer containing the DER representation of the * private key str, decode and return the result on success, or NULL * on failure. + * + * If max_bits is nonnegative, reject any key longer than max_bits + * without performing any expensive validation on it. */ crypto_pk_t * -crypto_pk_asn1_decode_private(const char *str, size_t len) +crypto_pk_asn1_decode_private(const char *str, size_t len, int max_bits) { tor_assert(str); tor_assert(len < INT_MAX); @@ -731,6 +734,15 @@ crypto_pk_asn1_decode_private(const char *str, size_t len) output = NULL; } + if (output) { + const int bits = SECKEY_PublicKeyStrengthInBits(output->pubkey); + if (max_bits > 0 && bits > max_bits) { + log_info(LD_CRYPTO, "Private key longer than expected."); + crypto_pk_free(output); + output = NULL; + } + } + if (slot) PK11_FreeSlot(slot); diff --git a/src/lib/crypt_ops/crypto_rsa_openssl.c b/src/lib/crypt_ops/crypto_rsa_openssl.c index fbdc76ccd..022a0dc09 100644 --- a/src/lib/crypt_ops/crypto_rsa_openssl.c +++ b/src/lib/crypt_ops/crypto_rsa_openssl.c @@ -566,9 +566,12 @@ crypto_pk_asn1_encode_private(const crypto_pk_t *pk, char *dest, /** Decode an ASN.1-encoded private key from str; return the result on * success and NULL on failure. + * + * If max_bits is nonnegative, reject any key longer than max_bits + * without performing any expensive validation on it. */ crypto_pk_t * -crypto_pk_asn1_decode_private(const char *str, size_t len) +crypto_pk_asn1_decode_private(const char *str, size_t len, int max_bits) { RSA *rsa; unsigned char *buf; @@ -578,7 +581,11 @@ crypto_pk_asn1_decode_private(const char *str, size_t len) rsa = d2i_RSAPrivateKey(NULL, &cp, len); tor_free(buf); if (!rsa) { - crypto_openssl_log_errors(LOG_WARN,"decoding public key"); + crypto_openssl_log_errors(LOG_WARN,"decoding private key"); + return NULL; + } + if (max_bits >= 0 && RSA_bits(rsa) > max_bits) { + log_info(LD_CRYPTO, "Private key longer than expected."); return NULL; } crypto_pk_t *result = crypto_new_pk_from_openssl_rsa_(rsa);

1 0

[tor/release-0.4.2] Merge branch 'maint-0.4.2' into release-0.4.2
by nickm＠torproject.org 18 Mar '20

18 Mar '20

commit e1e095b87023f7f40157263f8273419a730cb607 Merge: 8efddd8b0 758deaa47 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 18 08:20:16 2020 -0400 Merge branch 'maint-0.4.2' into release-0.4.2 src/lib/crypt_ops/crypto_rsa_openssl.c | 7 +++++++ 1 file changed, 7 insertions(+)

1 0