June 2020 - tor-commits - lists.torproject.org

[translation/support-portal] https://gitweb.torproject.org/translation.git/commit/?h=support-portal
by translation＠torproject.org 25 Jun '20

25 Jun '20

commit 597b3f9e5f24f67a7b49155d14d20c2e8dcb5cd1 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Jun 25 03:47:55 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=support-portal --- contents+zh-CN.po | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/contents+zh-CN.po b/contents+zh-CN.po index 875b1d360e..9198eb34f1 100644 --- a/contents+zh-CN.po +++ b/contents+zh-CN.po @@ -6152,6 +6152,7 @@ msgid "" "since the Tor network can't handle the load (e.g. default file-sharing " "ports)." msgstr "" +"默认的出口中继协议允许许多流行服务的获取权（如网页浏览），但出于滥用的潜在风险，限制了一些服务（如邮箱），还有一些是因为流量大小超出了Tor网络的承受范围（如默认文件共享端口）。" #: https//support.torproject.org/operators/exit-policies/ #: (content/operators/exit-policies/contents+en.lrquestion.description) @@ -6323,6 +6324,10 @@ msgid "" " in their [torrc](https://support.torproject.org/tbb/tbb-editing-torrc/) " "configuration files when IPv6 connectivity is available." msgstr "" +"Tor[部分支持IPv6网络] " +"(https://trac.torproject.org/projects/tor/wiki/org/roadmaps/Tor/IPv6Features…" +"/tbb-editing-torrc/) [支持IPv6功能] " +"(https://trac.torproject.org/projects/tor/wiki/TorRelayGuide#IPv6)。" #: https//support.torproject.org/operators/ipv6-relay/ #: (content/operators/ipv6-relay/contents+en.lrquestion.description)

1 0

[tor-browser-build/maint-9.5] Pickup build2 for client auth stability
by sysrqb＠torproject.org 24 Jun '20

24 Jun '20

commit e94ba3a7677f7051a14b2304427ec8393a450fdc Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Jun 24 20:11:37 2020 +0000 Pickup build2 for client auth stability --- rbm.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rbm.conf b/rbm.conf index 3e8689b..c65d3a8 100644 --- a/rbm.conf +++ b/rbm.conf @@ -25,7 +25,7 @@ buildconf: var: torbrowser_version: '9.5.1' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 9.5 project_name: tor-browser

1 0

[tor-browser-build/maint-9.5] Add #40009 in ChangeLog
by gk＠torproject.org 24 Jun '20

24 Jun '20

commit e6b52336481796573e88e082c15142370a4ee8ae Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Jun 24 19:37:04 2020 +0000 Add #40009 in ChangeLog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index 7a589d9..c204a38 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -3,6 +3,7 @@ Tor Browser 9.5.1 -- June 30 2020 * Update Firefox to 68.10.0esr * Update NoScript to 11.0.32 * Translations update + * Bug 40009: Improve tor's client auth stability * Windows + OS X + Linux * Bug 34361: "Prioritize .onion sites when known" appears under General * Bug 34362: Improve Onion Service Authentication prompt

1 0

[tor-browser-build/maint-9.5] Bug 40009: Improve tor's client auth stability
by gk＠torproject.org 24 Jun '20

24 Jun '20

commit bf0065b5c36c6b37fd493e408c220c7757c8eeec Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Jun 24 18:38:18 2020 +0000 Bug 40009: Improve tor's client auth stability --- ...ve-accessor-semantic-of-client-cached-obj.patch | 212 +++++++++++++++++++++ projects/tor/build | 4 + projects/tor/config | 1 + 3 files changed, 217 insertions(+) diff --git a/projects/tor/0001-hs-v3-Improve-accessor-semantic-of-client-cached-obj.patch b/projects/tor/0001-hs-v3-Improve-accessor-semantic-of-client-cached-obj.patch new file mode 100644 index 0000000..1432039 --- /dev/null +++ b/projects/tor/0001-hs-v3-Improve-accessor-semantic-of-client-cached-obj.patch @@ -0,0 +1,212 @@ +From 1810771799dd0b434ac2b5926297d64e383582e1 Mon Sep 17 00:00:00 2001 +From: David Goulet <dgoulet(a)torproject.org> +Date: Tue, 10 Mar 2020 10:58:51 -0400 +Subject: [PATCH] hs-v3: Improve accessor semantic of client cached object + +Add an inline helper function that indicates if the cached object contains a +decrypted descriptor or not. + +The descriptor object is NULL if tor is unable to decrypt it (lacking client +authorization) and some actions need to be done only when we have a decrypted +object. + +This improves code semantic. + +Fixes #33458 + +Signed-off-by: David Goulet <dgoulet(a)torproject.org> +--- + src/feature/hs/hs_cache.c | 64 +++++++++++++++++++++++++++++++-------- + src/test/test_hs_client.c | 46 ++++++++++++++++++++++++++++ + 2 files changed, 98 insertions(+), 12 deletions(-) + +diff --git a/src/feature/hs/hs_cache.c b/src/feature/hs/hs_cache.c +index 9cf408ca3e..44cd2505fd 100644 +--- a/src/feature/hs/hs_cache.c ++++ b/src/feature/hs/hs_cache.c +@@ -27,6 +27,21 @@ + static int cached_client_descriptor_has_expired(time_t now, + const hs_cache_client_descriptor_t *cached_desc); + ++/** Helper function: Return true iff the cache entry has a decrypted ++ * descriptor. ++ * ++ * A NULL desc object in the entry means that we were not able to decrypt the ++ * descriptor because we are likely lacking client authorization. It is still ++ * a valid entry but some operations can't be done without the decrypted ++ * descriptor thus this function MUST be used to safe guard access to the ++ * decrypted desc object. */ ++static inline bool ++entry_has_decrypted_descriptor(const hs_cache_client_descriptor_t *entry) ++{ ++ tor_assert(entry); ++ return (entry->desc != NULL); ++} ++ + /********************** Directory HS cache ******************/ + + /** Directory descriptor cache. Map indexed by blinded key. */ +@@ -341,8 +356,23 @@ static digest256map_t *hs_cache_client_intro_state; + static size_t + cache_get_client_entry_size(const hs_cache_client_descriptor_t *entry) + { +- return sizeof(*entry) + +- strlen(entry->encoded_desc) + hs_desc_obj_size(entry->desc); ++ size_t size = 0; ++ ++ if (entry == NULL) { ++ goto end; ++ } ++ size += sizeof(*entry); ++ ++ if (entry->encoded_desc) { ++ size += strlen(entry->encoded_desc); ++ } ++ ++ if (entry_has_decrypted_descriptor(entry)) { ++ size += hs_desc_obj_size(entry->desc); ++ } ++ ++ end: ++ return size; + } + + /** Remove a given descriptor from our cache. */ +@@ -659,14 +689,20 @@ cache_store_as_client(hs_cache_client_descriptor_t *client_desc) + * client authorization. */ + cache_entry = lookup_v3_desc_as_client(client_desc->key.pubkey); + if (cache_entry != NULL) { +- /* Signalling an undecrypted descriptor. We'll always replace the one we +- * have with the new one just fetched. */ +- if (cache_entry->desc == NULL) { ++ /* If the current or the new cache entry don't have a decrypted descriptor ++ * (missing client authorization), we always replace the current one with ++ * the new one. Reason is that we can't inspect the revision counter ++ * within the plaintext data so we blindly replace. */ ++ if (!entry_has_decrypted_descriptor(cache_entry) || ++ !entry_has_decrypted_descriptor(client_desc)) { + remove_v3_desc_as_client(cache_entry); + cache_client_desc_free(cache_entry); + goto store; + } + ++ /* From this point on, we know that the decrypted descriptor is in the ++ * current entry and new object thus safe to access. */ ++ + /* If we have an entry in our cache that has a revision counter greater + * than the one we just fetched, discard the one we fetched. */ + if (cache_entry->desc->plaintext_data.revision_counter > +@@ -740,11 +776,15 @@ cache_clean_v3_as_client(time_t now) + MAP_DEL_CURRENT(key); + entry_size = cache_get_client_entry_size(entry); + bytes_removed += entry_size; ++ + /* We just removed an old descriptor. We need to close all intro circuits +- * so we don't have leftovers that can be selected while lacking a +- * descriptor. We leave the rendezvous circuits opened because they could +- * be in use. */ +- hs_client_close_intro_circuits_from_desc(entry->desc); ++ * if the descriptor is decrypted so we don't have leftovers that can be ++ * selected while lacking a descriptor. Circuits are selected by intro ++ * authentication key thus we need the descriptor. We leave the rendezvous ++ * circuits opened because they could be in use. */ ++ if (entry_has_decrypted_descriptor(entry)) { ++ hs_client_close_intro_circuits_from_desc(entry->desc); ++ } + /* Entry is not in the cache anymore, destroy it. */ + cache_client_desc_free(entry); + /* Update our OOM. We didn't use the remove() function because we are in +@@ -793,7 +833,7 @@ hs_cache_lookup_as_client(const ed25519_public_key_t *key) + tor_assert(key); + + cached_desc = lookup_v3_desc_as_client(key->pubkey); +- if (cached_desc && cached_desc->desc) { ++ if (cached_desc && entry_has_decrypted_descriptor(cached_desc)) { + return cached_desc->desc; + } + +@@ -866,7 +906,7 @@ hs_cache_remove_as_client(const ed25519_public_key_t *key) + /* If we have a decrypted/decoded descriptor, attempt to close its + * introduction circuit(s). We shouldn't have circuit(s) without a + * descriptor else it will lead to a failure. */ +- if (cached_desc->desc) { ++ if (entry_has_decrypted_descriptor(cached_desc)) { + hs_client_close_intro_circuits_from_desc(cached_desc->desc); + } + /* Remove and free. */ +@@ -995,7 +1035,7 @@ hs_cache_client_new_auth_parse(const ed25519_public_key_t *service_pk) + } + + cached_desc = lookup_v3_desc_as_client(service_pk->pubkey); +- if (cached_desc == NULL || cached_desc->desc != NULL) { ++ if (cached_desc == NULL || entry_has_decrypted_descriptor(cached_desc)) { + /* No entry for that service or the descriptor is already decoded. */ + goto end; + } +diff --git a/src/test/test_hs_client.c b/src/test/test_hs_client.c +index 5f7fe9c404..bff71d2645 100644 +--- a/src/test/test_hs_client.c ++++ b/src/test/test_hs_client.c +@@ -965,6 +965,7 @@ test_close_intro_circuits_new_desc(void *arg) + (void) arg; + + hs_init(); ++ rend_cache_init(); + + /* This is needed because of the client cache expiration timestamp is based + * on having a consensus. See cached_client_descriptor_has_expired(). */ +@@ -989,6 +990,51 @@ test_close_intro_circuits_new_desc(void *arg) + circ->purpose = CIRCUIT_PURPOSE_C_INTRODUCING; + ocirc = TO_ORIGIN_CIRCUIT(circ); + ++ /* Build a descriptor _without_ client authorization and thus not ++ * decryptable. Make sure the close circuit code path is not triggered. */ ++ { ++ char *desc_encoded = NULL; ++ uint8_t descriptor_cookie[HS_DESC_DESCRIPTOR_COOKIE_LEN]; ++ curve25519_keypair_t client_kp; ++ hs_descriptor_t *desc = NULL; ++ ++ tt_int_op(0, OP_EQ, curve25519_keypair_generate(&client_kp, 0)); ++ crypto_rand((char *) descriptor_cookie, sizeof(descriptor_cookie)); ++ ++ desc = hs_helper_build_hs_desc_with_client_auth(descriptor_cookie, ++ &client_kp.pubkey, ++ &service_kp); ++ tt_assert(desc); ++ ret = hs_desc_encode_descriptor(desc, &service_kp, descriptor_cookie, ++ &desc_encoded); ++ tt_int_op(ret, OP_EQ, 0); ++ /* Associate descriptor intro key with the dummy circuit. */ ++ const hs_desc_intro_point_t *ip = ++ smartlist_get(desc->encrypted_data.intro_points, 0); ++ tt_assert(ip); ++ ocirc->hs_ident = hs_ident_circuit_new(&service_kp.pubkey); ++ ed25519_pubkey_copy(&ocirc->hs_ident->intro_auth_pk, ++ &ip->auth_key_cert->signed_key); ++ hs_descriptor_free(desc); ++ tt_assert(desc_encoded); ++ /* Put it in the cache. Should not be decrypted since the client ++ * authorization creds were not added to the global map. */ ++ ret = hs_cache_store_as_client(desc_encoded, &service_kp.pubkey); ++ tor_free(desc_encoded); ++ tt_int_op(ret, OP_EQ, HS_DESC_DECODE_NEED_CLIENT_AUTH); ++ ++ /* Clean cache with a future timestamp. It will trigger the clean up and ++ * attempt to close the circuit but only if the descriptor is decryptable. ++ * Cache object should be removed and circuit untouched. */ ++ hs_cache_clean_as_client(mock_ns.valid_after + (60 * 60 * 24)); ++ tt_assert(!hs_cache_lookup_as_client(&service_kp.pubkey)); ++ ++ /* Make sure the circuit still there. */ ++ tt_assert(circuit_get_next_intro_circ(NULL, true)); ++ /* Get rid of the ident, it will be replaced in the next tests. */ ++ hs_ident_circuit_free(ocirc->hs_ident); ++ } ++ + /* Build the first descriptor and cache it. */ + { + char *encoded; +-- +2.20.1 + diff --git a/projects/tor/build b/projects/tor/build index 30ecc7e..012ec98 100644 --- a/projects/tor/build +++ b/projects/tor/build @@ -91,6 +91,10 @@ openssldir=/var/tmp/dist/openssl/openssl [% END %] cd /var/tmp/build/[% project %]-[% c('version') %] + +# Cherry-pick patch until 0.4.3.6 is released. +patch -p1 < $rootdir/0001-hs-v3-Improve-accessor-semantic-of-client-cached-obj.patch + # add git hash to micro-revision.i for #24995 echo '"[% c("abbrev", { abbrev_length => 16 }) %]"' > micro-revision.i ./autogen.sh diff --git a/projects/tor/config b/projects/tor/config index 912f839..1f57465 100644 --- a/projects/tor/config +++ b/projects/tor/config @@ -68,3 +68,4 @@ input_files: - name: zstd project: zstd enable: '[% c("var/android") %]' + - filename: 0001-hs-v3-Improve-accessor-semantic-of-client-cached-obj.patch

1 0

[tor/master] Make HSFETCH take the decoded length into account, not the base32 one
by dgoulet＠torproject.org 24 Jun '20

24 Jun '20

commit c8fd7b7040b9c036438afc493352fbccb4c1d357 Author: Neel Chauhan <neel(a)neelc.org> Date: Tue Jun 16 14:38:08 2020 -0700 Make HSFETCH take the decoded length into account, not the base32 one --- changes/bug34400 | 5 +++++ src/feature/control/control_cmd.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug34400 b/changes/bug34400 new file mode 100644 index 000000000..e2b56688b --- /dev/null +++ b/changes/bug34400 @@ -0,0 +1,5 @@ + o Minor bugfixes (v2 onion services): + - For HSFETCH commands on v2 onion services addresses, check the length of + bytes decoded, not the base32 length. This takes the behavior introduced + in commit a517daa56f5848d25ba79617a1a7b82ed2b0a7c0 into consideration. + Fixes bug 34400; bugfix on 0.4.1.1-alpha. Patch by Neel Chauhan. diff --git a/src/feature/control/control_cmd.c b/src/feature/control/control_cmd.c index d9a38011d..eb14f101e 100644 --- a/src/feature/control/control_cmd.c +++ b/src/feature/control/control_cmd.c @@ -1430,7 +1430,7 @@ handle_control_hsfetch(control_connection_t *conn, rend_valid_descriptor_id(arg1 + v2_str_len) && base32_decode(digest, sizeof(digest), arg1 + v2_str_len, REND_DESC_ID_V2_LEN_BASE32) == - REND_DESC_ID_V2_LEN_BASE32) { + sizeof(digest)) { /* We have a well formed version 2 descriptor ID. Keep the decoded value * of the id. */ desc_id = digest;

1 0

[tor/master] Merge branch 'tor-github/pr/1935'
by dgoulet＠torproject.org 24 Jun '20

24 Jun '20

commit fd5b2d0f1c8a83d10e9a07f88cf8d9e69c98774a Merge: 7934dcc6f c8fd7b704 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Jun 24 15:48:47 2020 -0400 Merge branch 'tor-github/pr/1935' changes/bug34400 | 5 +++++ src/feature/control/control_cmd.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[torspec/master] Remove a very obsolete note about compatibility notes
by nickm＠torproject.org 24 Jun '20

24 Jun '20

commit 7146ead1ecb564c00d1eac99f92b58e7674da40f Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 24 15:41:11 2020 -0400 Remove a very obsolete note about compatibility notes --- tor-spec.txt | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/tor-spec.txt b/tor-spec.txt index 372f9d0..9b2c7b3 100644 --- a/tor-spec.txt +++ b/tor-spec.txt @@ -7,9 +7,8 @@ Note: This document aims to specify Tor as currently implemented, though it may take it a little time to become fully up to date. Future versions of Tor may implement improved protocols, and compatibility is not guaranteed. -Compatibility notes are given for versions 0.1.1.15-rc and later. We may or -may not remove compatibility notes for other obsolete versions of Tor as they -become obsolete. +We may or may not remove compatibility notes for other obsolete versions of +Tor as they become obsolete. This specification is not a design document; most design criteria are not examined. For more information on why Tor acts as it does,

1 0

[tor/master] Merge branch 'ahf/gitlab-readme' into 'master'
by nickm＠torproject.org 24 Jun '20

24 Jun '20

commit 7934dcc6f38be52d09d5a2fec33efd6fb1b613a8 Merge: 86da0cfd3 8dc7ae113 Author: Alexander Færøy <ahf(a)torproject.org> Date: Wed Jun 24 19:34:32 2020 +0000 Merge branch 'ahf/gitlab-readme' into 'master' Update Trac links in README to point to Gitlab. See merge request tpo/core/tor!3 README | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

[tor/master] Update Trac links in README to point to Gitlab.
by nickm＠torproject.org 24 Jun '20

24 Jun '20

commit 8dc7ae113bd2deb25124e58fddb60e09c211bf08 Author: Alexander Færøy <ahf(a)torproject.org> Date: Mon Jun 22 19:41:52 2020 +0000 Update Trac links in README to point to Gitlab. --- README | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README b/README index 9bbf027d7..def546f25 100644 --- a/README +++ b/README @@ -19,13 +19,13 @@ Documentation, including links to installation and setup instructions: https://www.torproject.org/docs/documentation.html Making applications work with Tor: - https://wiki.torproject.org/projects/tor/wiki/doc/TorifyHOWTO + https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TorifyHOWTO Frequently Asked Questions: https://www.torproject.org/docs/faq.html Release timeline: - https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/CoreTor… + https://gitlab.torproject.org/tpo/core/tor/-/wikis/NetworkTeam/CoreTorRelea… To get started working on Tor development: See the doc/HACKING directory.

1 0

[tor-browser/tor-browser-68.9.0esr-10.0-1] fixup! Bug 23247: Communicating security expectations for .onion
by gk＠torproject.org 24 Jun '20

24 Jun '20

commit a745de73db61e6654554109b06ece81329a9244d Author: Alex Catarineu <acat(a)torproject.org> Date: Wed Jun 24 15:03:42 2020 +0200 fixup! Bug 23247: Communicating security expectations for .onion Fixes bug 34383. --- dom/security/nsMixedContentBlocker.cpp | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/dom/security/nsMixedContentBlocker.cpp b/dom/security/nsMixedContentBlocker.cpp index 2bbc2e8aecb3..fecbd5552ec3 100644 --- a/dom/security/nsMixedContentBlocker.cpp +++ b/dom/security/nsMixedContentBlocker.cpp @@ -746,16 +746,7 @@ nsresult nsMixedContentBlocker::ShouldLoad( return NS_OK; } if (!parentIsHttps) { - nsAutoCString parentHost; - rv = innerRequestingLocation->GetHost(parentHost); - if (NS_FAILED(rv)) { - NS_ERROR("requestingLocation->GetHost failed"); - *aDecision = REJECT_REQUEST; - return NS_OK; - } - - bool parentIsOnion = - StringEndsWith(parentHost, NS_LITERAL_CSTRING(".onion")); + bool parentIsOnion = IsPotentiallyTrustworthyOnion(innerRequestingLocation); if (!parentIsOnion) { *aDecision = ACCEPT; return NS_OK;

1 0