August 2020 - tor-commits - lists.torproject.org

[tor/master] manual: Describe Sandbox more accurately.
by asn＠torproject.org 11 Aug '20

11 Aug '20

commit d89c1799af4551af5c8f819d0fc79812a0bc80aa Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Aug 4 14:06:25 2020 -0400 manual: Describe Sandbox more accurately. Closes #23378 --- changes/ticket23378 | 4 ++++ doc/man/tor.1.txt | 9 +++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/changes/ticket23378 b/changes/ticket23378 new file mode 100644 index 0000000000..783d02edfc --- /dev/null +++ b/changes/ticket23378 @@ -0,0 +1,4 @@ + o Documentation (manual page): + - Describe the status of the "Sandbox" option more accurately. It is no + longer "experimental", but it _is_ dependent on kernel and libc + versions. Closes ticket 23378. diff --git a/doc/man/tor.1.txt b/doc/man/tor.1.txt index 6e504c8a82..318d31ac24 100644 --- a/doc/man/tor.1.txt +++ b/doc/man/tor.1.txt @@ -839,10 +839,11 @@ forward slash (/) in the configuration file and on the command line. [[Sandbox]] **Sandbox** **0**|**1**:: If set to 1, Tor will run securely through the use of a syscall sandbox. - Otherwise the sandbox will be disabled. The option is currently an - experimental feature. It only works on Linux-based operating systems, - and only when Tor has been built with the libseccomp library. This option - can not be changed while tor is running. + + Otherwise the sandbox will be disabled. The option only works on + Linux-based operating systems, and only when Tor has been built with the + libseccomp library. Note that this option may be incompatible with some + versions of libc, and some kernel versions. This option can not be + changed while tor is running. + + When the **Sandbox** is 1, the following options can not be changed when tor is running:

1 0

[tor/master] Merge remote-tracking branch 'tor-gitlab/mr/109'
by asn＠torproject.org 11 Aug '20

11 Aug '20

commit b46942d37fa0f67bb2367e11280dc35844a50935 Merge: f971a8fbad d89c1799af Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue Aug 11 15:09:12 2020 +0300 Merge remote-tracking branch 'tor-gitlab/mr/109' changes/ticket23378 | 4 ++++ doc/man/tor.1.txt | 9 +++++---- 2 files changed, 9 insertions(+), 4 deletions(-)

1 0

[tor/master] Only log port self-testing message when we are _starting_ to test.
by asn＠torproject.org 11 Aug '20

11 Aug '20

commit 7df52b71bfaa966dcd3f497f67c4c08e3bbe0347 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Aug 4 12:36:18 2020 -0400 Only log port self-testing message when we are _starting_ to test. (Unlike approaches in earlier versions of Tor, this one logs if and only if we are launching a test, and we haven't said that we're testing this port.) Fixes bug 40068; bug not in any released version. Closes #40068. --- src/feature/relay/selftest.c | 46 ++++++++++++++++++++++++++++++++++++-------- 1 file changed, 38 insertions(+), 8 deletions(-) diff --git a/src/feature/relay/selftest.c b/src/feature/relay/selftest.c index 13264d4a24..87ba29c130 100644 --- a/src/feature/relay/selftest.c +++ b/src/feature/relay/selftest.c @@ -57,11 +57,24 @@ static bool can_reach_or_port_ipv6 = false; /** Whether we can reach our DirPort from the outside. */ static bool can_reach_dir_port = false; +/** Has informed_testing_reachable logged a message about testing our IPv4 + * ORPort? */ +static bool have_informed_testing_or_port_ipv4 = false; +/** Has informed_testing_reachable logged a message about testing our IPv6 + * ORPort? */ +static bool have_informed_testing_or_port_ipv6 = false; +/** Has informed_testing_reachable logged a message about testing our + * DirPort? */ +static bool have_informed_testing_dir_port = false; + /** Forget what we have learned about our reachability status. */ void router_reset_reachability(void) { can_reach_or_port_ipv4 = can_reach_or_port_ipv6 = can_reach_dir_port = false; + have_informed_testing_or_port_ipv4 = + have_informed_testing_or_port_ipv6 = + have_informed_testing_dir_port = false; } /** Return 1 if we won't do reachability checks, because: @@ -260,12 +273,9 @@ router_do_orport_reachability_checks(const routerinfo_t *me, log_info(LD_CIRC, "Testing %s of my %s ORPort: %s.", !orport_reachable ? "reachability" : "bandwidth", family_name, fmt_addrport_ap(ap)); - if (!orport_reachable) { - /* This is only a 'reachability test' if we don't already think that - * the port is reachable. If we _do_ think it's reachable, then - * it counts as a 'bandwidth test'. */ - inform_testing_reachability(&ap->addr, ap->port, false); - } + + inform_testing_reachability(&ap->addr, ap->port, false); + circuit_launch_by_extend_info(CIRCUIT_PURPOSE_TESTING, ei, CIRCLAUNCH_NEED_CAPACITY| CIRCLAUNCH_IS_INTERNAL| @@ -349,10 +359,13 @@ router_do_reachability_checks(int test_or, int test_dir) } /** Log a message informing the user that we are testing a port for - * reachability. + * reachability, if we have not already logged such a message. * * If @a is_dirport is true, then the port is a DirPort; otherwise it is an - * ORPort. */ + * ORPort. + * + * Calls to router_reset_reachability() will reset our view of whether we have + * logged this message for a given port. */ static void inform_testing_reachability(const tor_addr_t *addr, uint16_t port, @@ -361,6 +374,21 @@ inform_testing_reachability(const tor_addr_t *addr, if (!router_get_my_routerinfo()) return; + bool *have_informed_ptr; + if (is_dirport) { + have_informed_ptr = &have_informed_testing_dir_port; + } else if (tor_addr_family(addr) == AF_INET) { + have_informed_ptr = &have_informed_testing_or_port_ipv4; + } else { + have_informed_ptr = &have_informed_testing_or_port_ipv6; + } + + if (*have_informed_ptr) { + /* We already told the user that we're testing this port; no need to + * do it again. */ + return; + } + char addr_buf[TOR_ADDRPORT_BUF_LEN]; strlcpy(addr_buf, fmt_addrport(addr, port), sizeof(addr_buf)); @@ -377,6 +405,8 @@ inform_testing_reachability(const tor_addr_t *addr, "messages indicating success)", afname, port_type, addr_buf, TIMEOUT_UNTIL_UNREACHABILITY_COMPLAINT/60); + + *have_informed_ptr = true; } /**

1 0

[tor/master] Merge branch 'mr/105'
by asn＠torproject.org 11 Aug '20

11 Aug '20

commit f971a8fbaddb7b67daeda0ff6b6c27b0f47fd895 Merge: b8003fbe99 7df52b71bf Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue Aug 11 15:04:15 2020 +0300 Merge branch 'mr/105' src/feature/relay/selftest.c | 46 ++++++++++++++++++++++++++++++++++++-------- 1 file changed, 38 insertions(+), 8 deletions(-)

1 0

[tor/maint-0.4.4] Merge remote-tracking branch 'tor-gitlab/mr/102' into maint-0.4.4
by asn＠torproject.org 11 Aug '20

11 Aug '20

commit ab9c35f04353c00323068ec5dc46b2995a9b69bf Merge: 7d80bf80fe ea876ab00e Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue Aug 11 14:53:03 2020 +0300 Merge remote-tracking branch 'tor-gitlab/mr/102' into maint-0.4.4 changes/ticket6198 | 3 +++ src/core/mainloop/connection.c | 8 ++++---- src/lib/crypt_ops/crypto_util.c | 14 ++++++++++++++ src/lib/crypt_ops/crypto_util.h | 10 ++++++++++ 4 files changed, 31 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.4.4] Add a tor_str_wipe_and_free() function.
by asn＠torproject.org 11 Aug '20

11 Aug '20

commit 5b9508c9a5d757223c62749c51eaf7453ff26691 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 3 10:11:03 2020 -0400 Add a tor_str_wipe_and_free() function. Frequently we want to do if (s) { memwipe(s, 0, sizeof(s)); tor_free(s); } and it's good to have a way to do this concisely. --- src/lib/crypt_ops/crypto_util.c | 14 ++++++++++++++ src/lib/crypt_ops/crypto_util.h | 10 ++++++++++ 2 files changed, 24 insertions(+) diff --git a/src/lib/crypt_ops/crypto_util.c b/src/lib/crypt_ops/crypto_util.c index 67a1a9eb92..2f821fa024 100644 --- a/src/lib/crypt_ops/crypto_util.c +++ b/src/lib/crypt_ops/crypto_util.c @@ -109,3 +109,17 @@ memwipe(void *mem, uint8_t byte, size_t sz) **/ memset(mem, byte, sz); } + +/** + * Securely all memory in str, then free it. + * + * As tor_free(), tolerates null pointers. + **/ +void +tor_str_wipe_and_free_(char *str) +{ + if (!str) + return; + memwipe(str, 0, strlen(str)); + tor_free_(str); +} diff --git a/src/lib/crypt_ops/crypto_util.h b/src/lib/crypt_ops/crypto_util.h index 613a1bd0dd..b5d7f62521 100644 --- a/src/lib/crypt_ops/crypto_util.h +++ b/src/lib/crypt_ops/crypto_util.h @@ -14,8 +14,18 @@ #define TOR_CRYPTO_UTIL_H #include "lib/cc/torint.h" +#include "lib/malloc/malloc.h" /** OpenSSL-based utility functions. */ void memwipe(void *mem, uint8_t byte, size_t sz); +void tor_str_wipe_and_free_(char *str); +/** + * Securely all memory in str, then free it. + * + * As tor_free(), tolerates null pointers, and sets str to NULL. + **/ +#define tor_str_wipe_and_free(str) \ + FREE_AND_NULL(char, tor_str_wipe_and_free_, (str)) + #endif /* !defined(TOR_CRYPTO_UTIL_H) */

1 0

[tor/master] Add a tor_str_wipe_and_free() function.
by asn＠torproject.org 11 Aug '20

11 Aug '20

commit 5b9508c9a5d757223c62749c51eaf7453ff26691 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 3 10:11:03 2020 -0400 Add a tor_str_wipe_and_free() function. Frequently we want to do if (s) { memwipe(s, 0, sizeof(s)); tor_free(s); } and it's good to have a way to do this concisely. --- src/lib/crypt_ops/crypto_util.c | 14 ++++++++++++++ src/lib/crypt_ops/crypto_util.h | 10 ++++++++++ 2 files changed, 24 insertions(+) diff --git a/src/lib/crypt_ops/crypto_util.c b/src/lib/crypt_ops/crypto_util.c index 67a1a9eb92..2f821fa024 100644 --- a/src/lib/crypt_ops/crypto_util.c +++ b/src/lib/crypt_ops/crypto_util.c @@ -109,3 +109,17 @@ memwipe(void *mem, uint8_t byte, size_t sz) **/ memset(mem, byte, sz); } + +/** + * Securely all memory in str, then free it. + * + * As tor_free(), tolerates null pointers. + **/ +void +tor_str_wipe_and_free_(char *str) +{ + if (!str) + return; + memwipe(str, 0, strlen(str)); + tor_free_(str); +} diff --git a/src/lib/crypt_ops/crypto_util.h b/src/lib/crypt_ops/crypto_util.h index 613a1bd0dd..b5d7f62521 100644 --- a/src/lib/crypt_ops/crypto_util.h +++ b/src/lib/crypt_ops/crypto_util.h @@ -14,8 +14,18 @@ #define TOR_CRYPTO_UTIL_H #include "lib/cc/torint.h" +#include "lib/malloc/malloc.h" /** OpenSSL-based utility functions. */ void memwipe(void *mem, uint8_t byte, size_t sz); +void tor_str_wipe_and_free_(char *str); +/** + * Securely all memory in str, then free it. + * + * As tor_free(), tolerates null pointers, and sets str to NULL. + **/ +#define tor_str_wipe_and_free(str) \ + FREE_AND_NULL(char, tor_str_wipe_and_free_, (str)) + #endif /* !defined(TOR_CRYPTO_UTIL_H) */

1 0

[tor/maint-0.4.4] Wipe address strings from connections before freeing them them.
by asn＠torproject.org 11 Aug '20

11 Aug '20

commit ea876ab00e223b0c1ba022cc27861cfbbde31b64 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 3 10:15:08 2020 -0400 Wipe address strings from connections before freeing them them. This is a defense-in-depth fix; closes 6198. --- changes/ticket6198 | 3 +++ src/core/mainloop/connection.c | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/changes/ticket6198 b/changes/ticket6198 new file mode 100644 index 0000000000..7f3fdf2fa7 --- /dev/null +++ b/changes/ticket6198 @@ -0,0 +1,3 @@ + o Minor features (defense in depth): + - Wipe more data from connection address fields before returning them to + the memory heap. Closes ticket 6198. diff --git a/src/core/mainloop/connection.c b/src/core/mainloop/connection.c index 3595bba85c..4b321fe72f 100644 --- a/src/core/mainloop/connection.c +++ b/src/core/mainloop/connection.c @@ -637,7 +637,7 @@ connection_free_minimal(connection_t *conn) } } - tor_free(conn->address); + tor_str_wipe_and_free(conn->address); if (connection_speaks_cells(conn)) { or_connection_t *or_conn = TO_OR_CONN(conn); @@ -657,7 +657,7 @@ connection_free_minimal(connection_t *conn) } or_handshake_state_free(or_conn->handshake_state); or_conn->handshake_state = NULL; - tor_free(or_conn->nickname); + tor_str_wipe_and_free(or_conn->nickname); if (or_conn->chan) { /* Owww, this shouldn't happen, but... */ channel_t *base_chan = TLS_CHAN_TO_BASE(or_conn->chan); @@ -677,8 +677,8 @@ connection_free_minimal(connection_t *conn) } if (conn->type == CONN_TYPE_AP) { entry_connection_t *entry_conn = TO_ENTRY_CONN(conn); - tor_free(entry_conn->chosen_exit_name); - tor_free(entry_conn->original_dest_address); + tor_str_wipe_and_free(entry_conn->chosen_exit_name); + tor_str_wipe_and_free(entry_conn->original_dest_address); if (entry_conn->socks_request) socks_request_free(entry_conn->socks_request); if (entry_conn->pending_optimistic_data) {

1 0

[tor/master] Wipe address strings from connections before freeing them them.
by asn＠torproject.org 11 Aug '20

11 Aug '20

commit ea876ab00e223b0c1ba022cc27861cfbbde31b64 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 3 10:15:08 2020 -0400 Wipe address strings from connections before freeing them them. This is a defense-in-depth fix; closes 6198. --- changes/ticket6198 | 3 +++ src/core/mainloop/connection.c | 8 ++++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/changes/ticket6198 b/changes/ticket6198 new file mode 100644 index 0000000000..7f3fdf2fa7 --- /dev/null +++ b/changes/ticket6198 @@ -0,0 +1,3 @@ + o Minor features (defense in depth): + - Wipe more data from connection address fields before returning them to + the memory heap. Closes ticket 6198. diff --git a/src/core/mainloop/connection.c b/src/core/mainloop/connection.c index 3595bba85c..4b321fe72f 100644 --- a/src/core/mainloop/connection.c +++ b/src/core/mainloop/connection.c @@ -637,7 +637,7 @@ connection_free_minimal(connection_t *conn) } } - tor_free(conn->address); + tor_str_wipe_and_free(conn->address); if (connection_speaks_cells(conn)) { or_connection_t *or_conn = TO_OR_CONN(conn); @@ -657,7 +657,7 @@ connection_free_minimal(connection_t *conn) } or_handshake_state_free(or_conn->handshake_state); or_conn->handshake_state = NULL; - tor_free(or_conn->nickname); + tor_str_wipe_and_free(or_conn->nickname); if (or_conn->chan) { /* Owww, this shouldn't happen, but... */ channel_t *base_chan = TLS_CHAN_TO_BASE(or_conn->chan); @@ -677,8 +677,8 @@ connection_free_minimal(connection_t *conn) } if (conn->type == CONN_TYPE_AP) { entry_connection_t *entry_conn = TO_ENTRY_CONN(conn); - tor_free(entry_conn->chosen_exit_name); - tor_free(entry_conn->original_dest_address); + tor_str_wipe_and_free(entry_conn->chosen_exit_name); + tor_str_wipe_and_free(entry_conn->original_dest_address); if (entry_conn->socks_request) socks_request_free(entry_conn->socks_request); if (entry_conn->pending_optimistic_data) {

1 0

[tor/master] Merge remote-tracking branch 'tor-gitlab/mr/102' into maint-0.4.4
by asn＠torproject.org 11 Aug '20

11 Aug '20

commit ab9c35f04353c00323068ec5dc46b2995a9b69bf Merge: 7d80bf80fe ea876ab00e Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue Aug 11 14:53:03 2020 +0300 Merge remote-tracking branch 'tor-gitlab/mr/102' into maint-0.4.4 changes/ticket6198 | 3 +++ src/core/mainloop/connection.c | 8 ++++---- src/lib/crypt_ops/crypto_util.c | 14 ++++++++++++++ src/lib/crypt_ops/crypto_util.h | 10 ++++++++++ 4 files changed, 31 insertions(+), 4 deletions(-)

1 0