June 2020 - tor-commits - lists.torproject.org

[tor/master] Add circuit_extend_add_ipv(4/6)_helper() test
by nickm＠torproject.org 22 Jun '20

22 Jun '20

commit 3bb955a02f3a5a8e1eb70976e2124842a4f8d35f Author: Neel Chauhan <neel(a)neelc.org> Date: Thu Jun 11 11:04:24 2020 -0700 Add circuit_extend_add_ipv(4/6)_helper() test --- src/test/test_circuitbuild.c | 73 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) diff --git a/src/test/test_circuitbuild.c b/src/test/test_circuitbuild.c index 88e46af13..e1fbd333d 100644 --- a/src/test/test_circuitbuild.c +++ b/src/test/test_circuitbuild.c @@ -36,6 +36,7 @@ #… [View More]include "feature/relay/routermode.h" #include "feature/nodelist/node_st.h" +#include "feature/nodelist/routerinfo_st.h" /* Dummy nodes smartlist for testing */ static smartlist_t dummy_nodes; @@ -823,6 +824,77 @@ test_circuit_extend_lspec_valid(void *arg) tor_free(p_chan); } +#define NODE_SET_IPV4(node, ipv4_addr, ipv4_port) { \ + tor_addr_t addr; \ + tor_addr_parse(&addr, ipv4_addr); \ + node->ri->addr = tor_addr_to_ipv4h(&addr); \ + node->ri->or_port = ipv4_port; \ + } + +#define NODE_CLEAR_IPV4(node) { \ + node->ri->addr = 0; \ + node->ri->or_port = 0; \ + } + +#define NODE_SET_IPV6(node, ipv6_addr_str, ipv6_port) { \ + tor_addr_parse(&node->ri->ipv6_addr, ipv6_addr_str); \ + node->ri->ipv6_orport = ipv6_port; \ + } + +/* Test the different cases in circuit_extend_add_ed25519_helper(). */ +static void +test_circuit_extend_add_ip(void *arg) +{ + (void) arg; + tor_addr_t ipv4_tmp; + extend_cell_t *ec = tor_malloc_zero(sizeof(extend_cell_t)); + extend_cell_t *old_ec = tor_malloc_zero(sizeof(extend_cell_t)); + + node_t *fake_node = tor_malloc_zero(sizeof(node_t)); + routerinfo_t *ri = tor_malloc_zero(sizeof(routerinfo_t)); + + MOCK(node_get_by_id, mock_node_get_by_id); + + /* Set up the fake variables for the IPv4 test */ + fake_node->ri = ri; + mocked_node = fake_node; + memset(ec->node_id, 0xAA, sizeof(ec->node_id)); + memcpy(old_ec, ec, sizeof(extend_cell_t)); + NODE_SET_IPV4(fake_node, PUBLIC_IPV4, VALID_PORT); + + /* Do the IPv4 test */ + tt_int_op(circuit_extend_add_ipv4_helper(ec), OP_EQ, 0); + tor_addr_from_ipv4h(&ipv4_tmp, fake_node->ri->addr); + /* The IPv4 should match */ + tt_int_op(tor_addr_compare(&ec->orport_ipv4.addr, &ipv4_tmp, CMP_SEMANTIC), + OP_EQ, 0); + tt_int_op(ec->orport_ipv4.port, OP_EQ, VALID_PORT); + + /* Set up the fake variables for the IPv6 test */ + memcpy(ec, old_ec, sizeof(extend_cell_t)); + NODE_CLEAR_IPV4(fake_node); + NODE_SET_IPV6(fake_node, PUBLIC_IPV6, VALID_PORT); + + /* Do the IPv6 test */ + tt_int_op(circuit_extend_add_ipv6_helper(ec), OP_EQ, 0); + /* The IPv6 should match */ + tt_int_op(tor_addr_compare(&ec->orport_ipv6.addr, &fake_node->ri->ipv6_addr, + CMP_SEMANTIC), OP_EQ, 0); + tt_int_op(ec->orport_ipv6.port, OP_EQ, VALID_PORT); + + /* Cleanup */ + mocked_node = NULL; + + done: + UNMOCK(node_get_by_id); + + tor_free(ec); + tor_free(old_ec); + + tor_free(ri); + tor_free(fake_node); +} + static bool can_extend_over_ipv6_result = false; static int mock_router_can_extend_over_ipv6_calls = 0; static bool @@ -1902,6 +1974,7 @@ struct testcase_t circuitbuild_tests[] = { TEST_CIRCUIT(extend_state_valid, TT_FORK), TEST_CIRCUIT(extend_add_ed25519, TT_FORK), TEST_CIRCUIT(extend_lspec_valid, TT_FORK), + TEST_CIRCUIT(extend_add_ip, TT_FORK), TEST_CIRCUIT(choose_ip_ap_for_extend, 0), TEST_CIRCUIT_PASSTHROUGH(open_connection_for_extend, TT_FORK, "4"), [View Less]

1 0

[tor/master] Add changes file for ticket 33816
by nickm＠torproject.org 22 Jun '20

22 Jun '20

commit 5a89fd2a046a76bc21afbf6af01047c653f993a4 Author: Neel Chauhan <neel(a)neelc.org> Date: Thu Jun 11 11:08:18 2020 -0700 Add changes file for ticket 33816 --- changes/ticket33816 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changes/ticket33816 b/changes/ticket33816 new file mode 100644 index 000000000..6412e7844 --- /dev/null +++ b/changes/ticket33816 @@ -0,0 +1,4 @@ + o Code simplification and refactoring: + - When an extend cell is missing an IPv4 or IPv6 … [View More]

1 0

[tor/master] Consistently use 'address' in Invalid v3 address responses to ONION_CLIENT_AUTH commands
by dgoulet＠torproject.org 22 Jun '20

22 Jun '20

commit 3d0e1c42d931a593ee326d17473700ba663cb48e Author: Miguel Jacq <mig(a)mig5.net> Date: Thu Jun 18 13:47:15 2020 +1000 Consistently use 'address' in Invalid v3 address responses to ONION_CLIENT_AUTH commands --- changes/ticket40005 | 3 +++ src/feature/control/control_hs.c | 3 ++- src/test/test_hs_control.c | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/changes/ticket40005 b/changes/ticket40005 new file mode 100644 index 000000000..… [View More]

1 0

[tor/maint-0.4.4] Consistently use 'address' in Invalid v3 address responses to ONION_CLIENT_AUTH commands
by dgoulet＠torproject.org 22 Jun '20

22 Jun '20

commit 3d0e1c42d931a593ee326d17473700ba663cb48e Author: Miguel Jacq <mig(a)mig5.net> Date: Thu Jun 18 13:47:15 2020 +1000 Consistently use 'address' in Invalid v3 address responses to ONION_CLIENT_AUTH commands --- changes/ticket40005 | 3 +++ src/feature/control/control_hs.c | 3 ++- src/test/test_hs_control.c | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/changes/ticket40005 b/changes/ticket40005 new file mode 100644 index 000000000..… [View More]

1 0

[tor/master] Merge branch 'maint-0.4.4'
by dgoulet＠torproject.org 22 Jun '20

22 Jun '20

commit 033f8044292b74e6a46a719476b9633e5d79d978 Merge: 48ff6a41a 3d0e1c42d Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Jun 22 14:57:50 2020 -0400 Merge branch 'maint-0.4.4' changes/ticket40005 | 3 +++ src/feature/control/control_hs.c | 3 ++- src/test/test_hs_control.c | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-)

1 0

[tor/release-0.4.4] Merge branch 'maint-0.4.4' into release-0.4.4
by dgoulet＠torproject.org 22 Jun '20

22 Jun '20

commit 961a0887808cad6ce1308223c0321a39388e67e0 Merge: 8d094f2d2 3d0e1c42d Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Jun 22 14:57:50 2020 -0400 Merge branch 'maint-0.4.4' into release-0.4.4 changes/ticket40005 | 3 +++ src/feature/control/control_hs.c | 3 ++- src/test/test_hs_control.c | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-)

1 0

[tor/release-0.4.4] Consistently use 'address' in Invalid v3 address responses to ONION_CLIENT_AUTH commands
by dgoulet＠torproject.org 22 Jun '20

22 Jun '20

commit 3d0e1c42d931a593ee326d17473700ba663cb48e Author: Miguel Jacq <mig(a)mig5.net> Date: Thu Jun 18 13:47:15 2020 +1000 Consistently use 'address' in Invalid v3 address responses to ONION_CLIENT_AUTH commands --- changes/ticket40005 | 3 +++ src/feature/control/control_hs.c | 3 ++- src/test/test_hs_control.c | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/changes/ticket40005 b/changes/ticket40005 new file mode 100644 index 000000000..… [View More]

1 0

[tor-browser-build/master] Merge remote-tracking branch 'gktpo/bug_32895_v4'
by sysrqb＠torproject.org 22 Jun '20

22 Jun '20

commit b74754a3fb0af3c9b015a3113aba1d9f8671fa32 Merge: a6e6caf a3c272d Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Sat Jun 20 17:14:56 2020 +0000 Merge remote-tracking branch 'gktpo/bug_32895_v4' tools/marsigning_check.sh | 127 +++++++++++++++++++++++++++++++++------------- 1 file changed, 91 insertions(+), 36 deletions(-)

1 0

[tor-browser-build/master] Bug 32895: Improve MAR-signing check script
by sysrqb＠torproject.org 22 Jun '20

22 Jun '20

commit a3c272d2e53ea60c1a596bc25189e6f63a535471 Author: Georg Koppen <gk(a)torproject.org> Date: Sat May 23 20:37:55 2020 +0000 Bug 32895: Improve MAR-signing check script We improve the script in the following ways: 1) Properly check the signature of the MAR files 2) Take #20254 into account 3) Fix all issues `shellcheck` found --- tools/marsigning_check.sh | 127 +++++++++++++++++++++++++++++++++------------- 1 file changed, 91 insertions(+), 36 … [View More]deletions(-) diff --git a/tools/marsigning_check.sh b/tools/marsigning_check.sh index 3e58249..fb5e4f6 100755 --- a/tools/marsigning_check.sh +++ b/tools/marsigning_check.sh @@ -1,6 +1,6 @@ #!/bin/sh -# Copyright (c) 2019, The Tor Project, Inc. +# Copyright (c) 2020, The Tor Project, Inc. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are @@ -33,9 +33,20 @@ # Usage: # 1) Let SIGNMAR point to your signmar binary # 2) Let LD_LIBRARY_PATH point to the mar-tools directory -# 3) Change into the directory containing the MAR files and the +# 3) Let NSS_DB_DIR point to the directory containing the database with the +# signing certificate to check against. +# +# To create the database to use for signature checking import the +# release*.der certificate of your choice found in +# toolkit/mozapps/update/updater by issuing the following commands: +# +# mkdir nssdb +# certutil -d nssdb -N --empty-password +# certutil -A -n "marsigner" -t,, -d nssdb -i /path/to/.der +# +# 4) Change into the directory containing the MAR files and the # sha256sums-unsigned-build.txt/sha256sums-unsigned-build.incrementals.txt. -# 4) Run /path/to/marsigning_check.sh +# 5) Run /path/to/marsigning_check.sh if [ -z "$SIGNMAR" ] then @@ -49,60 +60,104 @@ then exit 1 fi -UNSIGNED_MARS=0 -BADSIGNED_MARS=0 +if [ -z "$NSS_DB_DIR" ] +then + echo "The path to your nssdb directory is missing!" + exit 1 +fi + +unsigned_mars=0 +badsigned_mars=0 +not_reproduced_mars=0 +# XXX: Stripping the signature of signed macOS MAR files is currently not +# expected to be reproducible, see: #20254. +not_reproduced_mars_expected=0 mkdir tmp -for f in `ls *.mar`; do +for f in *.mar; do case $f in - *.incremental.mar) SHA256_TXT=`grep "$f" \ - sha256sums-unsigned-build.incrementals.txt`;; - *) SHA256_TXT=`grep "$f" sha256sums-unsigned-build.txt`;; + *.incremental.mar) sha256_txt=$(grep "$f" \ + sha256sums-unsigned-build.incrementals.txt);; + *) sha256_txt=$(grep "$f" sha256sums-unsigned-build.txt);; esac - # Test 1: Is the .mar file still unsigned? I.e. does its SHA-256 sum still - # match the one we had before we signed it? If so, notify us later and exit. - if [ "$SHA256_TXT" = "`sha256sum $f`" ] + # Test 1: Is the MAR file correctly signed? + echo "Verifying the MAR signature of $f..." + if ! $SIGNMAR -d "$NSS_DB_DIR" -n marsigner -v "$f" then - echo "$f has still the SHA-256 sum of the unsigned MAR file!" - UNSIGNED_MARS=`expr $UNSIGNED_MARS + 1` + # Something went wrong. Let's figure out what. + if [ "$sha256_txt" = "$(sha256sum "$f")" ] + then + echo "$f has still the SHA-256 sum of the unsigned MAR file!" + unsigned_mars=$((unsigned_mars + 1)) + else + echo "$f is either signed with the wrong key or the signature is" \ + "corrupted!" + badsigned_mars=$((badsigned_mars +1)) + fi fi - # Test 2: Do we get the old SHA-256 sum after stripping the MAR signature? If - # not, notify us later and exit. - if [ "$UNSIGNED_MARS" = "0" ] + # Test 2: Do we get the old SHA-256 sum after stripping the MAR signature? We + # want to have a test for that to be sure we've the signed MAR files in front + # of us which we actually want to ship to our users. + if [ "$unsigned_mars" = "0" ] && [ "$badsigned_mars" = "0" ] then - # At least we seem to have attempted to sign the MAR file. Let's see if we - # succeeded by stripping the signature. This behavior is reproducible. - # Thus, we know if we don't get the same SHA-256 sum we did not sign the - # bundle correctly. - echo "Trying to strip the MAR signature of $f..." - ${SIGNMAR} -r $f tmp/$f - cd tmp - if ! [ "$SHA256_TXT" = "`sha256sum $f`" ] + # At least we seem to have succeeded in signing the MAR file. Let's see if + # it is the expected one. + echo "Checking the SHA-256 sum of the stripped $f..." + ${SIGNMAR} -r "$f" tmp/"$f" + cd tmp || exit 1 + if ! [ "$sha256_txt" = "$(sha256sum "$f")" ] then - echo "$f does not have the SHA-256 sum of the unsigned MAR file!" - BADSIGNED_MARS=`expr $BADSIGNED_MARS + 1` + not_reproduced_mars=$((not_reproduced_mars + 1)) + case "$f" in + *osx64*) + not_reproduced_mars_expected=$((not_reproduced_mars_expected + 1)) + ;; + *) echo "$f does not have the SHA-256 sum of the unsigned MAR file!" + ;; + esac fi - rm $f + rm "$f" cd .. fi + echo "" done rm -rf tmp/ -if ! [ "$UNSIGNED_MARS" = "0" ] +if ! [ "$unsigned_mars" = "0" ] || ! [ "$badsigned_mars" = "0" ] then - echo "We got $UNSIGNED_MARS unsigned MAR file(s), exiting..." + echo "We got:" + if ! [ "$unsigned_mars" = "0" ] + then + echo "$unsigned_mars unsigned MAR file(s)" + fi + if ! [ "$badsigned_mars" = "0" ] + then + echo "$badsigned_mars badly signed MAR file(s)" + fi + echo "exiting..." exit 1 fi -if ! [ "$BADSIGNED_MARS" = "0" ] +if ! [ "$not_reproduced_mars" = "0" ] then - echo "We got $BADSIGNED_MARS badly signed MAR file(s), exiting..." - exit 1 + echo "We got $not_reproduced_mars non-matching, signed MAR files." + if [ "$not_reproduced_mars" -eq "$not_reproduced_mars_expected" ] + then + echo "This is currently expected as we got the same amount of" \ + "non-matching macOS MAR files." + echo "The signatures and non-macOS MAR files are fine." + exit 0 + else + echo "This is currently unexpected as we only got" \ + "$not_reproduced_mars_expected non-matching macOS MAR files," \ + "exiting..." + exit 1 + fi +else + echo "The signatures and MAR files are fine." + exit 0 fi - -echo "The signatures are fine." -exit 0 [View Less]

1 0

[tor-browser-build/master] Bug 40001: Don't bundle geckodriver in debug builds
by sysrqb＠torproject.org 22 Jun '20

22 Jun '20

commit a6e6caf5f11b578d7a177c519ca0d2bbb9a154dd Author: Georg Koppen <gk(a)torproject.org> Date: Thu Jun 18 08:11:13 2020 +0000 Bug 40001: Don't bundle geckodriver in debug builds --- projects/firefox/build | 18 +++++++++++------- projects/tor-browser/build | 4 +++- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/projects/firefox/build b/projects/firefox/build index cd0d6b5..16984f3 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -160,7 +… [View More]160,7 @@ rm -f js/src/configure [% END %] [% IF c("var/linux") %] - [% IF c("var/linux-x86_64") %] + [% IF c("var/linux-x86_64") && !c("var/asan") %] cp obj-*/testing/geckodriver/x86_64-unknown-linux-gnu/release/geckodriver $distdir [% END %] cp -a obj-*/dist/firefox/* $distdir/Browser/ @@ -225,8 +225,10 @@ cp -p obj-*/dist/host/bin/mbsdiff $MARTOOLS/ cd $distdir [% IF c("var/linux-x86_64") %] - # No need for an unstripped geckodriver - strip geckodriver + [% IF !c("var/asan") %] + # No need for an unstripped geckodriver + strip geckodriver + [% END %] mkdir -p $distdir/Debug/Browser/gtk2 # Strip and generate debuginfo for the firefox binary that we keep, all *.so # files, the plugin-container, and the updater (see ticket #10126) @@ -272,10 +274,12 @@ END; tar_src => [ 'Debug' ], tar_args => '-cJf ' _ dest_dir _ '/' _ c('filename') _ '/tor-browser-debug.tar.xz', }) %] -[% c('tar', { - tar_src => [ 'geckodriver' ], - tar_args => '-cJf ' _ dest_dir _ '/' _ c('filename') _ '/geckodriver-linux64.tar.xz', - }) %] + [% IF !c("var/asan") %] + [% c('tar', { + tar_src => [ 'geckodriver' ], + tar_args => '-cJf ' _ dest_dir _ '/' _ c('filename') _ '/geckodriver-linux64.tar.xz', + }) %] + [% END %] [% END %] [% c('zip', { diff --git a/projects/tor-browser/build b/projects/tor-browser/build index b9732e8..386ea26 100644 --- a/projects/tor-browser/build +++ b/projects/tor-browser/build @@ -293,7 +293,9 @@ SCRIPT_EOF cp $rootdir/[% c('input_files_by_name/firefox') %]/mar-tools-*.zip "$OUTDIR"/ [% IF c("var/linux-x86_64") -%] cp $rootdir/[% c('input_files_by_name/firefox') %]/tor-browser-debug.tar.xz "$OUTDIR"/tor-browser-[% c("var/mar_osname") %]-debug.tar.xz - cp $rootdir/[% c('input_files_by_name/firefox') %]/geckodriver-linux64.tar.xz "$OUTDIR"/ + [% IF !c("var/asan") -%] + cp $rootdir/[% c('input_files_by_name/firefox') %]/geckodriver-linux64.tar.xz "$OUTDIR"/ + [% END -%] [% END -%] [% IF c("var/linux") -%] cp $rootdir/[% c('input_files_by_name/tor') %]/tor-debug.tar.xz "$OUTDIR"/tor-[% c("var/mar_osname") %]-debug.tar.xz [View Less]

1 0