tor-commits March 2021

tor-commits@lists.torproject.org

17 participants
2169 discussions

[tor/release-0.4.4] Merge branch 'maint-0.3.5' into maint-0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 2eb900f7e2ca64e6ce16fc86410cafd935e7cd1e Merge: b9f6539008 efca9ce41c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:54:00 2021 -0400 Merge branch 'maint-0.3.5' into maint-0.4.4 changes/ticket40286_minimal | 7 ++++--- src/feature/dirparse/unparseable.c | 7 +++++-- 2 files changed, 9 insertions(+), 5 deletions(-)

1 0

[tor/release-0.4.4] Bump to 0.4.4.8
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit fb2c889a388e85ca808e30106fd8a8194ed72f07 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 07:40:48 2021 -0400 Bump to 0.4.4.8 --- configure.ac | 4 ++-- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/configure.ac b/configure.ac index db5bfee202..731fb29f28 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2019, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.4.4.7-dev]) +AC_INIT([tor],[0.4.4.8]) AC_CONFIG_SRCDIR([src/app/main/tor_main.c]) AC_CONFIG_MACRO_DIR([m4]) @@ -16,7 +16,7 @@ configure_flags="$*" # version number changes. Tor uses it to make sure that it # only shuts down for missing "required protocols" when those protocols # are listed as required by a consensus after this date. -AC_DEFINE(APPROX_RELEASE_DATE, ["2021-02-03"], # for 0.4.4.7-dev +AC_DEFINE(APPROX_RELEASE_DATE, ["2021-03-15"], # for 0.4.4.8 [Approximate date when this software was released. (Updated when the version changes.)]) # "foreign" means we don't follow GNU package layout standards diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index 39b7999fd1..06a204fe5b 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.4.4.7-dev" +!define VERSION "0.4.4.8" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index d1d60bffa2..b7e1cdff48 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -217,7 +217,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.4.4.7-dev" +#define VERSION "0.4.4.8" #define HAVE_STRUCT_SOCKADDR_IN6 #define HAVE_STRUCT_IN6_ADDR

1 0

[tor/release-0.4.4] Clarify new intended strategy with TROVE-2021-001
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit efca9ce41c96bb0044f504ced36a2734b1689ee2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:53:36 2021 -0400 Clarify new intended strategy with TROVE-2021-001 We're going to disable this feature in all versions for now. --- changes/ticket40286_minimal | 7 ++++--- src/feature/dirparse/unparseable.c | 7 +++++-- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/changes/ticket40286_minimal b/changes/ticket40286_minimal index b8669debaa..6a04ca79eb 100644 --- a/changes/ticket40286_minimal +++ b/changes/ticket40286_minimal @@ -1,5 +1,6 @@ - o Major bugfixes (denial of service): + o Major bugfixes (security, denial of service): - Disable the dump_desc() function that we used to dump unparseable information to disk. It was called incorrectly in several places, - in a way that could lead to excessive CPU usage. - Fixes bug 40286; bugfix on 0.2.2.1-alpha. + in a way that could lead to excessive CPU usage. Fixes bug 40286; + bugfix on 0.2.2.1-alpha. This bug is also tracked as + TROVE-2021-001 and CVE-2021-28089. diff --git a/src/feature/dirparse/unparseable.c b/src/feature/dirparse/unparseable.c index a547335452..1d623fe701 100644 --- a/src/feature/dirparse/unparseable.c +++ b/src/feature/dirparse/unparseable.c @@ -493,8 +493,11 @@ dump_desc,(const char *desc, const char *type)) tor_assert(desc); tor_assert(type); #ifndef TOR_UNIT_TESTS - /* On older versions of Tor we are disabling this function, since it - * can be called with strings that are far too long. */ + /* For now, we are disabling this function, since it can be called with + * strings that are far too long. We can turn it back on if we fix it + * someday, but we'd need to give it a length argument. A likelier + * resolution here is simply to remove this module entirely. See tor#40286 + * for background. */ if (1) return; #endif

1 0

[tor/release-0.4.4] Fix detection of point to insert signatures on a pending consensus.
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 890ae4fb1adfa13e37aaf5261e089e8c195a75cf Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 3 15:14:31 2021 -0500 Fix detection of point to insert signatures on a pending consensus. We were looking for the first instance of "directory-signature " when instead the correct behavior is to look for the first instance of "directory-signature " at the start of a line. Unfortunately, this can be exploited as to crash authorities while they're voting. Fixes #40316; bugfix on 0.2.2.4-alpha. This is TROVE-2021-002, also tracked as CVE-2021-28090. --- changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug40316 b/changes/bug40316 new file mode 100644 index 0000000000..cd275b5c9c --- /dev/null +++ b/changes/bug40316 @@ -0,0 +1,5 @@ + o Major bugfixes (security, denial of service): + - Fix a bug in appending detached signatures to a pending consensus + document that could be used to crash a directory authority. + Fixes bug 40316; bugfix on 0.2.2.6-alpha. Tracked as + TROVE-2021-002 and CVE-2021-28090. diff --git a/src/feature/dirauth/dirvote.c b/src/feature/dirauth/dirvote.c index af8b3dc207..9e01cee42a 100644 --- a/src/feature/dirauth/dirvote.c +++ b/src/feature/dirauth/dirvote.c @@ -3520,7 +3520,7 @@ dirvote_add_signatures_to_pending_consensus( strlen(pc->body) + strlen(new_signatures) + 1; pc->body = tor_realloc(pc->body, new_consensus_len); dst_end = pc->body + new_consensus_len; - dst = strstr(pc->body, "directory-signature "); + dst = (char *) find_str_at_start_of_line(pc->body, "directory-signature "); tor_assert(dst); strlcpy(dst, new_signatures, dst_end-dst);

1 0

[tor/release-0.3.5] Changelog for 0.3.5.14.
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 0c66af2e69ab1ddf02a645d33eba3ce14c6cc4a8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:27:26 2021 -0400 Changelog for 0.3.5.14. --- ChangeLog | 48 +++++++++++++++++++++++++++++++++++++++++++++ changes/bug40316 | 5 ----- changes/geoip-2021-03-12 | 9 --------- changes/ticket40286_minimal | 6 ------ changes/ticket40309 | 3 --- 5 files changed, 48 insertions(+), 23 deletions(-) diff --git a/ChangeLog b/ChangeLog index 48402f4ed2..40ac842b84 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,51 @@ +Changes in version 0.3.5.14 - 2021-03-16 + Tor 0.3.5.14 backports fixes for two important denial-of-service bugs + in earlier versions of Tor. + + One of these vulnerabilities (TROVE-2021-001) would allow an attacker + who can send directory data to a Tor instance to force that Tor + instance to consume huge amounts of CPU. This is easiest to exploit + against authorities, since anybody can upload to them, but directory + caches could also exploit this vulnerability against relays or clients + when they download. The other vulnerability (TROVE-2021-002) only + affects directory authorities, and would allow an attacker to remotely + crash the authority with an assertion failure. Patches have already + been provided to the authority operators, to help ensure + network stability. + + We recommend that everybody upgrade to one of the releases that fixes + these issues (0.3.5.14, 0.4.4.8, or 0.4.5.7) as they become available + to you. + + This release also updates our GeoIP data source, and fixes a + compatibility issue. + + o Major bugfixes (security, denial of service, backport from 0.4.5.7): + - Disable the dump_desc() function that we used to dump unparseable + information to disk. It was called incorrectly in several places, + in a way that could lead to excessive CPU usage. Fixes bug 40286; + bugfix on 0.2.2.1-alpha. This bug is also tracked as TROVE-2021- + 001 and CVE-2021-28089. + - Fix a bug in appending detached signatures to a pending consensus + document that could be used to crash a directory authority. Fixes + bug 40316; bugfix on 0.2.2.6-alpha. Tracked as TROVE-2021-002 + and CVE-2021-28090. + + o Minor features (geoip data, backport from 0.4.5.7): + - We have switched geoip data sources. Previously we shipped IP-to- + country mappings from Maxmind's GeoLite2, but in 2019 they changed + their licensing term, so we were unable to update them after that + point. We now ship geoip files based on the IPFire Location + Database instead. (See https://location.ipfire.org/ for more + information). This release updates our geoip files to match the + IPFire Location Database as retrieved on 2021/03/12. Closes + ticket 40224. + + o Removed features (mallinfo deprecated, backport from 0.4.5.7): + - Remove mallinfo() usage entirely. Libc 2.33+ now deprecates it. + Closes ticket 40309. + + Changes in version 0.3.5.13 - 2020-02-03 Tor 0.3.5.13 backports numerous bugfixes from later releases, including one that made v3 onion services more susceptible to diff --git a/changes/bug40316 b/changes/bug40316 deleted file mode 100644 index cd275b5c9c..0000000000 --- a/changes/bug40316 +++ /dev/null @@ -1,5 +0,0 @@ - o Major bugfixes (security, denial of service): - - Fix a bug in appending detached signatures to a pending consensus - document that could be used to crash a directory authority. - Fixes bug 40316; bugfix on 0.2.2.6-alpha. Tracked as - TROVE-2021-002 and CVE-2021-28090. diff --git a/changes/geoip-2021-03-12 b/changes/geoip-2021-03-12 deleted file mode 100644 index 01c1b0f162..0000000000 --- a/changes/geoip-2021-03-12 +++ /dev/null @@ -1,9 +0,0 @@ - o Minor features (geoip data): - - We have switched geoip data sources. Previously we shipped - IP-to-country mappings from Maxmind's GeoLite2, but in 2019 they - changed their licensing term, so we were unable to update them after - that point. We now ship geoip files based on the IPFire Location - Database instead. (See https://location.ipfire.org/ for more - information). This release updates our geoip files to match the - IPFire Location Database as retrieved on 2021/03/12. Closes - ticket 40224. diff --git a/changes/ticket40286_minimal b/changes/ticket40286_minimal deleted file mode 100644 index 6a04ca79eb..0000000000 --- a/changes/ticket40286_minimal +++ /dev/null @@ -1,6 +0,0 @@ - o Major bugfixes (security, denial of service): - - Disable the dump_desc() function that we used to dump unparseable - information to disk. It was called incorrectly in several places, - in a way that could lead to excessive CPU usage. Fixes bug 40286; - bugfix on 0.2.2.1-alpha. This bug is also tracked as - TROVE-2021-001 and CVE-2021-28089. diff --git a/changes/ticket40309 b/changes/ticket40309 deleted file mode 100644 index 087ac36a4f..0000000000 --- a/changes/ticket40309 +++ /dev/null @@ -1,3 +0,0 @@ - o New system requirements (mallinfo() deprecated): - - Remove mallinfo() usage entirely. Libc 2.33+ now deprecates it. Closes - ticket 40309.

1 0

[tor/release-0.3.5] Merge branch 'bug40316_035_v2' into maint-0.3.5
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit f078aab71ef56e1942caec5f27e0f336f2a7c7d1 Merge: efca9ce41c 890ae4fb1a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:58:54 2021 -0400 Merge branch 'bug40316_035_v2' into maint-0.3.5 changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/release-0.4.4] Merge branch 'maint-0.4.4' into release-0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 4a538847a802650b1d5ced8c97372d60f5ec0906 Merge: c63e09043a b9f6539008 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:52:28 2021 -0400 Merge branch 'maint-0.4.4' into release-0.4.4 changes/ticket40286_minimal | 5 +++++ src/feature/dirparse/unparseable.c | 6 ++++++ 2 files changed, 11 insertions(+)

1 0

[tor/release-0.3.5] changelog updates from arma
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 21a4e649af48c8b3342bae601a1cc173d9596e03 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 17:12:36 2021 -0400 changelog updates from arma --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 40ac842b84..b1a7b2d8b1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,7 +34,7 @@ Changes in version 0.3.5.14 - 2021-03-16 o Minor features (geoip data, backport from 0.4.5.7): - We have switched geoip data sources. Previously we shipped IP-to- country mappings from Maxmind's GeoLite2, but in 2019 they changed - their licensing term, so we were unable to update them after that + their licensing terms, so we were unable to update them after that point. We now ship geoip files based on the IPFire Location Database instead. (See https://location.ipfire.org/ for more information). This release updates our geoip files to match the

1 0

[tor/release-0.4.4] Merge branch 'bug40316_035_v2' into maint-0.3.5
by nickm＠torproject.org 16 Mar '21

16 Mar '21

1 0

[tor/release-0.3.5] Merge branch 'maint-0.3.5' into release-0.3.5
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 0d04a9a82945680788cff446215b98fd68b9f055 Merge: 2b1c08567d f078aab71e Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:01:59 2021 -0400 Merge branch 'maint-0.3.5' into release-0.3.5 changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits March 2021