March 2021 - tor-commits - lists.torproject.org

[tor/release-0.4.4] Merge branch 'maint-0.4.4' into release-0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit b3c891119c7853410005f26aa86a296da3d0b889 Merge: 4a538847a8 2eb900f7e2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:54:00 2021 -0400 Merge branch 'maint-0.4.4' into release-0.4.4 changes/ticket40286_minimal | 7 ++++--- src/feature/dirparse/unparseable.c | 7 +++++-- 2 files changed, 9 insertions(+), 5 deletions(-)

1 0

[tor/master] Merge branch 'bug40316_035_v2' into maint-0.3.5
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit f078aab71ef56e1942caec5f27e0f336f2a7c7d1 Merge: efca9ce41c 890ae4fb1a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:58:54 2021 -0400 Merge branch 'bug40316_035_v2' into maint-0.3.5 changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/master] Merge branch 'maint-0.4.5'
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 3268403ba1fac9366575f4511b9f46d2b7738039 Merge: cfeb063f24 61731e3550 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:01:59 2021 -0400 Merge branch 'maint-0.4.5' changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/master] Fix detection of point to insert signatures on a pending consensus.
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 890ae4fb1adfa13e37aaf5261e089e8c195a75cf Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 3 15:14:31 2021 -0500 Fix detection of point to insert signatures on a pending consensus. We were looking for the first instance of "directory-signature " when instead the correct behavior is to look for the first instance of "directory-signature " at the start of a line. Unfortunately, this can be exploited as to crash authorities while they're voting. Fixes #40316; bugfix on 0.2.2.4-alpha. This is TROVE-2021-002, also tracked as CVE-2021-28090. --- changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug40316 b/changes/bug40316 new file mode 100644 index 0000000000..cd275b5c9c --- /dev/null +++ b/changes/bug40316 @@ -0,0 +1,5 @@ + o Major bugfixes (security, denial of service): + - Fix a bug in appending detached signatures to a pending consensus + document that could be used to crash a directory authority. + Fixes bug 40316; bugfix on 0.2.2.6-alpha. Tracked as + TROVE-2021-002 and CVE-2021-28090. diff --git a/src/feature/dirauth/dirvote.c b/src/feature/dirauth/dirvote.c index af8b3dc207..9e01cee42a 100644 --- a/src/feature/dirauth/dirvote.c +++ b/src/feature/dirauth/dirvote.c @@ -3520,7 +3520,7 @@ dirvote_add_signatures_to_pending_consensus( strlen(pc->body) + strlen(new_signatures) + 1; pc->body = tor_realloc(pc->body, new_consensus_len); dst_end = pc->body + new_consensus_len; - dst = strstr(pc->body, "directory-signature "); + dst = (char *) find_str_at_start_of_line(pc->body, "directory-signature "); tor_assert(dst); strlcpy(dst, new_signatures, dst_end-dst);

1 0

[tor/master] Fold ticket40314 into ChangeLog.
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 2022d974af6201c64dd5cc2e054bead5735e9531 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:35:40 2021 -0400 Fold ticket40314 into ChangeLog. --- ChangeLog | 10 +++++++++- changes/ticket40314 | 4 ---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 965f2001d8..eea5d88b60 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,9 +1,12 @@ -Changes in version 0.4.6.1-alpha - 2021-03-?? +Changes in version 0.4.6.1-alpha - 2021-03-18 Tor 0.4.6.1-alpha is the first alpha release in the 0.4.6.x series. It improves client circuit performance, adds missing features, and improves some of our DoS handling and statistics reporting. It also includes numerous smaller bugfixes. + Below are the changes since 0.4.5.7. (Note that this release DOES + include the fixes for the security bugs already fixed in 0.4.5.7.) + o Major features (control port, onion services): - Add controller support for creating version 3 onion services with client authorization. Previously, only v2 onion services could be @@ -101,6 +104,11 @@ Changes in version 0.4.6.1-alpha - 2021-03-?? versions of python. Closes ticket 40213. Patch from Samanta Navarro. + o Minor features (vote document): + - Add a "stats" line to directory authority votes, to report various + statistics that authorities computed about the relays. This will + help us diagnose the network better. Closes ticket 40314. + o Minor bugfixes (build): - Mini-report in the configure script now shows whether or not lzma and zstd have been used, not just if enable flag passed in. Fixes diff --git a/changes/ticket40314 b/changes/ticket40314 deleted file mode 100644 index 328687c265..0000000000 --- a/changes/ticket40314 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor feature (Vote document): - - Add the "stats" line in a directory authority vote in order to report - various statistics that the authority has computed for the relays. This - will help us diagnose better the network. Close ticket 40314.

1 0

[tor/master] Remove check-best-practices from check-local in 0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit f2cfd1ffad439350e907483255c150360ea37108 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:41:19 2021 -0400 Remove check-best-practices from check-local in 0.4.4 --- Makefile.am | 1 - 1 file changed, 1 deletion(-) diff --git a/Makefile.am b/Makefile.am index a723c167ef..a212ae19c6 100644 --- a/Makefile.am +++ b/Makefile.am @@ -275,7 +275,6 @@ check-local: \ check-spaces \ check-changes \ check-includes \ - check-best-practices \ shellcheck # test-network requires a copy of Chutney in $CHUTNEY_PATH.

1 0

[tor/master] Remove changes files that will appear in 0.4.5.7
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit fcd42982b2b8471e68d220504a3de5a30f3b9110 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:03:37 2021 -0400 Remove changes files that will appear in 0.4.5.7 (0.4.6.1-alpha will come out after the stable releases.) --- changes/bug40316 | 5 ----- changes/geoip-2021-03-12 | 9 --------- changes/ticket40286_minimal | 6 ------ 3 files changed, 20 deletions(-) diff --git a/changes/bug40316 b/changes/bug40316 deleted file mode 100644 index cd275b5c9c..0000000000 --- a/changes/bug40316 +++ /dev/null @@ -1,5 +0,0 @@ - o Major bugfixes (security, denial of service): - - Fix a bug in appending detached signatures to a pending consensus - document that could be used to crash a directory authority. - Fixes bug 40316; bugfix on 0.2.2.6-alpha. Tracked as - TROVE-2021-002 and CVE-2021-28090. diff --git a/changes/geoip-2021-03-12 b/changes/geoip-2021-03-12 deleted file mode 100644 index 01c1b0f162..0000000000 --- a/changes/geoip-2021-03-12 +++ /dev/null @@ -1,9 +0,0 @@ - o Minor features (geoip data): - - We have switched geoip data sources. Previously we shipped - IP-to-country mappings from Maxmind's GeoLite2, but in 2019 they - changed their licensing term, so we were unable to update them after - that point. We now ship geoip files based on the IPFire Location - Database instead. (See https://location.ipfire.org/ for more - information). This release updates our geoip files to match the - IPFire Location Database as retrieved on 2021/03/12. Closes - ticket 40224. diff --git a/changes/ticket40286_minimal b/changes/ticket40286_minimal deleted file mode 100644 index 6a04ca79eb..0000000000 --- a/changes/ticket40286_minimal +++ /dev/null @@ -1,6 +0,0 @@ - o Major bugfixes (security, denial of service): - - Disable the dump_desc() function that we used to dump unparseable - information to disk. It was called incorrectly in several places, - in a way that could lead to excessive CPU usage. Fixes bug 40286; - bugfix on 0.2.2.1-alpha. This bug is also tracked as - TROVE-2021-001 and CVE-2021-28089.

1 0

[tor/master] Merge branch 'maint-0.4.4' into maint-0.4.5
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 61731e35507fea1c932f80f0849dcae924113df1 Merge: a6533af9e8 5ec579610a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:01:59 2021 -0400 Merge branch 'maint-0.4.4' into maint-0.4.5 changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/master] Merge branch 'maint-0.3.5' into maint-0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 5ec579610ace4d3e4f0a6432b26e1e968beccf36 Merge: 2eb900f7e2 f078aab71e Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:01:59 2021 -0400 Merge branch 'maint-0.3.5' into maint-0.4.4 changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.5] Merge branch 'bug40286_disable_min_035' into maint-0.3.5
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit f46f4562cf6f47fe6c00752f61b04dc18a454253 Merge: 1a0b5fd569 ede88c374c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:41:03 2021 -0400 Merge branch 'bug40286_disable_min_035' into maint-0.3.5 changes/ticket40286_minimal | 5 +++++ src/feature/dirparse/unparseable.c | 6 ++++++ 2 files changed, 11 insertions(+)

1 0