June 2021 - tor-commits - lists.torproject.org

[tor/release-0.4.5] Fix TROVE-2021-006: Out-of-bounds read on v3 desc parsing
by nickm＠torproject.org 14 Jun '21

14 Jun '21

commit f57b5c48e0aa01acd84a194fe4657a0d1cee04cf Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue May 18 17:06:57 2021 +0300 Fix TROVE-2021-006: Out-of-bounds read on v3 desc parsing --- changes/bug40392 | 4 ++++ src/feature/hs/hs_descriptor.c | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug40392 b/changes/bug40392 new file mode 100644 index 0000000000..4dffa50bb2 --- /dev/null +++ b/changes/bug40392 @@ -0,0 +1,4 @@ + o Major bugfixes (security, denial of service, onion services): + - Fix an out-of-bounds memory access in v3 descriptor parsing. Fixes bug + 40392; bugfix on 0.3.0.1-alpha. This issue is also tracked as + TROVE-2021-006. Reported by Sergei Glazunov from Google's Project Zero. \ No newline at end of file diff --git a/src/feature/hs/hs_descriptor.c b/src/feature/hs/hs_descriptor.c index b6abf14a11..f74bb97ee2 100644 --- a/src/feature/hs/hs_descriptor.c +++ b/src/feature/hs/hs_descriptor.c @@ -135,7 +135,7 @@ static token_rule_t hs_desc_superencrypted_v3_token_table[] = { /* Descriptor ruleset for the encrypted section. */ static token_rule_t hs_desc_encrypted_v3_token_table[] = { T1_START(str_create2_formats, R3_CREATE2_FORMATS, CONCAT_ARGS, NO_OBJ), - T01(str_intro_auth_required, R3_INTRO_AUTH_REQUIRED, ARGS, NO_OBJ), + T01(str_intro_auth_required, R3_INTRO_AUTH_REQUIRED, GE(1), NO_OBJ), T01(str_single_onion, R3_SINGLE_ONION_SERVICE, ARGS, NO_OBJ), END_OF_TABLE }; @@ -2312,6 +2312,7 @@ desc_decode_encrypted_v3(const hs_descriptor_t *desc, /* Authentication type. It's optional but only once. */ tok = find_opt_by_keyword(tokens, R3_INTRO_AUTH_REQUIRED); if (tok) { + tor_assert(tok->n_args >= 1); if (!decode_auth_type(desc_encrypted_out, tok->args[0])) { log_warn(LD_REND, "Service descriptor authentication type has " "invalid entry(ies).");

1 0

[tor/release-0.4.5] Merge branch 'maint-0.3.5' into maint-0.4.4
by nickm＠torproject.org 14 Jun '21

14 Jun '21

commit 0f2d45328dfcb16acb4a517711413a6f0386487a Merge: 31eaa81f59 adb248b6d6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 10 08:52:39 2021 -0400 Merge branch 'maint-0.3.5' into maint-0.4.4 Conflicts resolved: src/core/or/relay.c changes/ticket40389 | 3 +++ src/core/or/relay.c | 39 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+) diff --cc src/core/or/relay.c index 75d2d479e7,00353f47a9..78fda99a45 --- a/src/core/or/relay.c +++ b/src/core/or/relay.c @@@ -1503,108 -1428,104 +1503,127 @@@ connection_edge_process_relay_cell_not_ // return -1; } + /** + * Return true iff our decryption layer_hint is from the last hop + * in a circuit. + */ + static bool + relay_crypt_from_last_hop(origin_circuit_t *circ, crypt_path_t *layer_hint) + { + tor_assert(circ); + tor_assert(layer_hint); + tor_assert(circ->cpath); + + if (layer_hint != circ->cpath->prev) { + log_fn(LOG_PROTOCOL_WARN, LD_CIRC, + "Got unexpected relay data from intermediate hop"); + return false; + } + return true; + } + -/** An incoming relay cell has arrived on circuit circ. If - * conn is NULL this is a control cell, else cell is - * destined for conn. +/** Process a SENDME cell that arrived on circ. If it is a stream level + * cell, it is destined for the given conn. If it is a circuit level + * cell, it is destined for the layer_hint. The domain is the + * logging domain that should be used. * - * If layer_hint is defined, then we're the origin of the - * circuit, and it specifies the hop that packaged cell. - * - * Return -reason if you want to warn and tear down the circuit, else 0. - */ -STATIC int -connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, - edge_connection_t *conn, - crypt_path_t *layer_hint) + * Return 0 if everything went well or a negative value representing a circuit + * end reason on error for which the caller is responsible for closing it. */ +static int +process_sendme_cell(const relay_header_t *rh, const cell_t *cell, + circuit_t *circ, edge_connection_t *conn, + crypt_path_t *layer_hint, int domain) { - static int num_seen=0; - relay_header_t rh; - unsigned domain = layer_hint?LD_APP:LD_EXIT; - int reason; - int optimistic_data = 0; /* Set to 1 if we receive data on a stream - * that's in the EXIT_CONN_STATE_RESOLVING - * or EXIT_CONN_STATE_CONNECTING states. */ + int ret; - tor_assert(cell); - tor_assert(circ); - - relay_header_unpack(&rh, cell->payload); -// log_fn(LOG_DEBUG,"command %d stream %d", rh.command, rh.stream_id); - num_seen++; - log_debug(domain, "Now seen %d relay cells here (command %d, stream %d).", - num_seen, rh.command, rh.stream_id); + tor_assert(rh); - if (rh.length > RELAY_PAYLOAD_SIZE) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Relay cell length field too long. Closing circuit."); - return - END_CIRC_REASON_TORPROTOCOL; + if (!rh->stream_id) { + /* Circuit level SENDME cell. */ + ret = sendme_process_circuit_level(layer_hint, circ, + cell->payload + RELAY_HEADER_SIZE, + rh->length); + if (ret < 0) { + return ret; + } + /* Resume reading on any streams now that we've processed a valid + * SENDME cell that updated our package window. */ + circuit_resume_edge_reading(circ, layer_hint); + /* We are done, the rest of the code is for the stream level. */ + return 0; } - if (rh.stream_id == 0) { - switch (rh.command) { - case RELAY_COMMAND_BEGIN: - case RELAY_COMMAND_CONNECTED: - case RELAY_COMMAND_END: - case RELAY_COMMAND_RESOLVE: - case RELAY_COMMAND_RESOLVED: - case RELAY_COMMAND_BEGIN_DIR: - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Relay command %d with zero " - "stream_id. Dropping.", (int)rh.command); - return 0; - default: - ; + /* No connection, might be half edge state. We are done if so. */ + if (!conn) { + if (CIRCUIT_IS_ORIGIN(circ)) { + origin_circuit_t *ocirc = TO_ORIGIN_CIRCUIT(circ); + if (connection_half_edge_is_valid_sendme(ocirc->half_streams, + rh->stream_id)) { + circuit_read_valid_data(ocirc, rh->length); + log_info(domain, "Sendme cell on circ %u valid on half-closed " + "stream id %d", + ocirc->global_identifier, rh->stream_id); + } } + + log_info(domain, "SENDME cell dropped, unknown stream (streamid %d).", + rh->stream_id); + return 0; } - /* either conn is NULL, in which case we've got a control cell, or else - * conn points to the recognized stream. */ + /* Stream level SENDME cell. */ + ret = sendme_process_stream_level(conn, circ, rh->length); + if (ret < 0) { + /* Means we need to close the circuit with reason ret. */ + return ret; + } - if (conn && !connection_state_is_open(TO_CONN(conn))) { - if (conn->base_.type == CONN_TYPE_EXIT && - (conn->base_.state == EXIT_CONN_STATE_CONNECTING || - conn->base_.state == EXIT_CONN_STATE_RESOLVING) && - rh.command == RELAY_COMMAND_DATA) { - /* Allow DATA cells to be delivered to an exit node in state - * EXIT_CONN_STATE_CONNECTING or EXIT_CONN_STATE_RESOLVING. - * This speeds up HTTP, for example. */ - optimistic_data = 1; - } else if (rh.stream_id == 0 && rh.command == RELAY_COMMAND_DATA) { - log_warn(LD_BUG, "Somehow I had a connection that matched a " - "data cell with stream ID 0."); - } else { - return connection_edge_process_relay_cell_not_open( - &rh, cell, circ, conn, layer_hint); - } + /* We've now processed properly a SENDME cell, all windows have been + * properly updated, we'll read on the edge connection to see if we can + * get data out towards the end point (Exit or client) since we are now + * allowed to deliver more cells. */ + + if (circuit_queue_streams_are_blocked(circ)) { + /* Still waiting for queue to flush; don't touch conn */ + return 0; } + connection_start_reading(TO_CONN(conn)); + /* handle whatever might still be on the inbuf */ + if (connection_edge_package_raw_inbuf(conn, 1, NULL) < 0) { + /* (We already sent an end cell if possible) */ + connection_mark_for_close(TO_CONN(conn)); + return 0; + } + return 0; +} - switch (rh.command) { - case RELAY_COMMAND_DROP: - rep_hist_padding_count_read(PADDING_TYPE_DROP); -// log_info(domain,"Got a relay-level padding cell. Dropping."); - return 0; +/** A helper for connection_edge_process_relay_cell(): Actually handles the + * cell that we received on the connection. + * + * The arguments are the same as in the parent function + * connection_edge_process_relay_cell(), plus the relay header rh as + * unpacked by the parent function, and optimistic_data as set by the + * parent function. + */ +STATIC int +handle_relay_cell_command(cell_t *cell, circuit_t *circ, + edge_connection_t *conn, crypt_path_t *layer_hint, + relay_header_t *rh, int optimistic_data) +{ + unsigned domain = layer_hint?LD_APP:LD_EXIT; + int reason; + + tor_assert(rh); + + /* First pass the cell to the circuit padding subsystem, in case it's a + * padding cell or circuit that should be handled there. */ + if (circpad_check_received_cell(cell, circ, layer_hint, rh) == 0) { + log_debug(domain, "Cell handled as circuit padding"); + return 0; + } + + /* Now handle all the other commands */ + switch (rh->command) { case RELAY_COMMAND_BEGIN: case RELAY_COMMAND_BEGIN_DIR: if (layer_hint && @@@ -1716,10 -1635,11 +1735,19 @@@ if (!conn) { if (CIRCUIT_IS_ORIGIN(circ)) { origin_circuit_t *ocirc = TO_ORIGIN_CIRCUIT(circ); ++<<<<<<< HEAD + if (connection_half_edge_is_valid_end(ocirc->half_streams, + rh->stream_id)) { ++||||||| d71bf986b4faf7 ++ if (connection_half_edge_is_valid_end(ocirc->half_streams, ++ rh.stream_id)) { ++======= + if (relay_crypt_from_last_hop(ocirc, layer_hint) && + connection_half_edge_is_valid_end(ocirc->half_streams, + rh.stream_id)) { ++>>>>>>> maint-0.3.5 - circuit_read_valid_data(ocirc, rh.length); + circuit_read_valid_data(ocirc, rh->length); log_info(domain, "end cell (%s) on circ %u valid on half-closed " "stream id %d", @@@ -1926,12 -1938,13 +1954,23 @@@ if (CIRCUIT_IS_ORIGIN(circ)) { origin_circuit_t *ocirc = TO_ORIGIN_CIRCUIT(circ); ++<<<<<<< HEAD + if (connection_half_edge_is_valid_resolved(ocirc->half_streams, + rh->stream_id)) { + circuit_read_valid_data(ocirc, rh->length); ++||||||| d71bf986b4faf7 ++ if (connection_half_edge_is_valid_resolved(ocirc->half_streams, ++ rh.stream_id)) { ++ circuit_read_valid_data(ocirc, rh.length); ++======= + if (relay_crypt_from_last_hop(ocirc, layer_hint) && + connection_half_edge_is_valid_resolved(ocirc->half_streams, + rh.stream_id)) { + circuit_read_valid_data(ocirc, rh.length); ++>>>>>>> maint-0.3.5 log_info(domain, "resolved cell on circ %u valid on half-closed " - "stream id %d", ocirc->global_identifier, rh.stream_id); + "stream id %d", ocirc->global_identifier, rh->stream_id); return 0; } }

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.4' into maint-0.4.5
by nickm＠torproject.org 14 Jun '21

14 Jun '21

commit ec696a95e58870862625a44f2c9152be2526414c Merge: 1da8621c0a 0f2d45328d Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 10 08:53:07 2021 -0400 Merge branch 'maint-0.4.4' into maint-0.4.5 changes/ticket40389 | 3 +++ src/core/or/relay.c | 39 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+)

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.5' into release-0.4.5
by nickm＠torproject.org 14 Jun '21

14 Jun '21

commit 5e043118736aba96a5186fd6c3523b4fefec5cc5 Merge: e4ca6427e1 ae2254e490 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 10 09:55:55 2021 -0400 Merge branch 'maint-0.4.5' into release-0.4.5 src/core/or/relay.c | 24 +++--------------------- 1 file changed, 3 insertions(+), 21 deletions(-)

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.4' into maint-0.4.5
by nickm＠torproject.org 14 Jun '21

14 Jun '21

commit ae2254e490ebfed746bed7e5ec359737cbb14085 Merge: ec696a95e5 014345ed6a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 10 09:55:55 2021 -0400 Merge branch 'maint-0.4.4' into maint-0.4.5 src/core/or/relay.c | 24 +++--------------------- 1 file changed, 3 insertions(+), 21 deletions(-)

1 0

[tor/release-0.4.5] Pick a date, draft a blurb
by nickm＠torproject.org 14 Jun '21

14 Jun '21

commit fc2582f203fcec44a7402986d5216bad2b826d14 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 10 13:19:55 2021 -0400 Pick a date, draft a blurb --- ChangeLog | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 8bee9f12df..9836e644b2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,8 @@ -Changes in version 0.4.5.9 - 2021-06-1? - BLURB HERE +Changes in version 0.4.5.9 - 2021-06-14 + Tor 0.4.5.9 fixes several security issues, including a + denial-of-service attack against onion service clients, and another + denial-of-service attack against relays. Everybody should upgrade to + one of 0.3.5.15, 0.4.4.9, 0.4.5.9, or 0.4.6.5. o Major bugfixes (security, backport from 0.4.6.5): - Don't allow relays to spoof RELAY_END or RELAY_RESOLVED cell on

1 0

[tor/release-0.4.5] Merge branch 'maint-0.3.5' into maint-0.4.4
by nickm＠torproject.org 14 Jun '21

14 Jun '21

commit 0ae9fd62fdc5ffd41bf5bbf2f4a3c1e2a151fa2d Merge: 014345ed6a f57b5c48e0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 10 12:30:11 2021 -0400 Merge branch 'maint-0.3.5' into maint-0.4.4 changes/bug40392 | 4 ++++ src/feature/hs/hs_descriptor.c | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --cc src/feature/hs/hs_descriptor.c index 50a46fb40f,f74bb97ee2..c1e6553398 --- a/src/feature/hs/hs_descriptor.c +++ b/src/feature/hs/hs_descriptor.c @@@ -133,10 -132,10 +133,10 @@@ static token_rule_t hs_desc_superencryp END_OF_TABLE }; -/* Descriptor ruleset for the encrypted section. */ +/** Descriptor ruleset for the encrypted section. */ static token_rule_t hs_desc_encrypted_v3_token_table[] = { T1_START(str_create2_formats, R3_CREATE2_FORMATS, CONCAT_ARGS, NO_OBJ), - T01(str_intro_auth_required, R3_INTRO_AUTH_REQUIRED, ARGS, NO_OBJ), + T01(str_intro_auth_required, R3_INTRO_AUTH_REQUIRED, GE(1), NO_OBJ), T01(str_single_onion, R3_SINGLE_ONION_SERVICE, ARGS, NO_OBJ), END_OF_TABLE };

1 0

[tor/release-0.4.5] Resolve remaining merge conflicts in relay.c
by nickm＠torproject.org 14 Jun '21

14 Jun '21

commit 014345ed6abca3305fcbdea3b75a23adc3976926 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 10 09:55:35 2021 -0400 Resolve remaining merge conflicts in relay.c (My bad!) --- src/core/or/relay.c | 24 +++--------------------- 1 file changed, 3 insertions(+), 21 deletions(-) diff --git a/src/core/or/relay.c b/src/core/or/relay.c index 78fda99a45..892dbe2d0a 100644 --- a/src/core/or/relay.c +++ b/src/core/or/relay.c @@ -1735,17 +1735,9 @@ handle_relay_cell_command(cell_t *cell, circuit_t *circ, if (!conn) { if (CIRCUIT_IS_ORIGIN(circ)) { origin_circuit_t *ocirc = TO_ORIGIN_CIRCUIT(circ); -<<<<<<< HEAD - if (connection_half_edge_is_valid_end(ocirc->half_streams, - rh->stream_id)) { -||||||| d71bf986b4faf7 - if (connection_half_edge_is_valid_end(ocirc->half_streams, - rh.stream_id)) { -======= if (relay_crypt_from_last_hop(ocirc, layer_hint) && connection_half_edge_is_valid_end(ocirc->half_streams, - rh.stream_id)) { ->>>>>>> maint-0.3.5 + rh->stream_id)) { circuit_read_valid_data(ocirc, rh->length); log_info(domain, @@ -1954,20 +1946,10 @@ handle_relay_cell_command(cell_t *cell, circuit_t *circ, if (CIRCUIT_IS_ORIGIN(circ)) { origin_circuit_t *ocirc = TO_ORIGIN_CIRCUIT(circ); -<<<<<<< HEAD - if (connection_half_edge_is_valid_resolved(ocirc->half_streams, - rh->stream_id)) { - circuit_read_valid_data(ocirc, rh->length); -||||||| d71bf986b4faf7 - if (connection_half_edge_is_valid_resolved(ocirc->half_streams, - rh.stream_id)) { - circuit_read_valid_data(ocirc, rh.length); -======= if (relay_crypt_from_last_hop(ocirc, layer_hint) && connection_half_edge_is_valid_resolved(ocirc->half_streams, - rh.stream_id)) { - circuit_read_valid_data(ocirc, rh.length); ->>>>>>> maint-0.3.5 + rh->stream_id)) { + circuit_read_valid_data(ocirc, rh->length); log_info(domain, "resolved cell on circ %u valid on half-closed " "stream id %d", ocirc->global_identifier, rh->stream_id);

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.5' into release-0.4.5
by nickm＠torproject.org 14 Jun '21

14 Jun '21

commit 1451861cd2c68bb47faad34c5185c29d4075612f Merge: 5e04311873 200e9a55e0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 10 12:30:29 2021 -0400 Merge branch 'maint-0.4.5' into release-0.4.5 changes/bug40392 | 4 ++++ src/feature/hs/hs_descriptor.c | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/release-0.4.5] Copy ChangeLog into ReleaseNotes.
by nickm＠torproject.org 14 Jun '21

14 Jun '21

commit d0ed04d50e80fe1c1ef1bf89edebc51581a6039f Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 14 10:51:06 2021 -0400 Copy ChangeLog into ReleaseNotes. --- ReleaseNotes | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) diff --git a/ReleaseNotes b/ReleaseNotes index 1f98d1776a..f0e37e5513 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -2,6 +2,69 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.4.5.9 - 2021-06-14 + Tor 0.4.5.9 fixes several security issues, including a + denial-of-service attack against onion service clients, and another + denial-of-service attack against relays. Everybody should upgrade to + one of 0.3.5.15, 0.4.4.9, 0.4.5.9, or 0.4.6.5. + + o Major bugfixes (security, backport from 0.4.6.5): + - Don't allow relays to spoof RELAY_END or RELAY_RESOLVED cell on + half-closed streams. Previously, clients failed to validate which + hop sent these cells: this would allow a relay on a circuit to end + a stream that wasn't actually built with it. Fixes bug 40389; + bugfix on 0.3.5.1-alpha. This issue is also tracked as TROVE-2021- + 003 and CVE-2021-34548. + + o Major bugfixes (security, defense-in-depth, backport from 0.4.6.5): + - Detect more failure conditions from the OpenSSL RNG code. + Previously, we would detect errors from a missing RNG + implementation, but not failures from the RNG code itself. + Fortunately, it appears those failures do not happen in practice + when Tor is using OpenSSL's default RNG implementation. Fixes bug + 40390; bugfix on 0.2.8.1-alpha. This issue is also tracked as + TROVE-2021-004. Reported by Jann Horn at Google's Project Zero. + + o Major bugfixes (security, denial of service, backport from 0.4.6.5): + - Resist a hashtable-based CPU denial-of-service attack against + relays. Previously we used a naive unkeyed hash function to look + up circuits in a circuitmux object. An attacker could exploit this + to construct circuits with chosen circuit IDs, to create + collisions and make the hash table inefficient. Now we use a + SipHash construction here instead. Fixes bug 40391; bugfix on + 0.2.4.4-alpha. This issue is also tracked as TROVE-2021-005 and + CVE-2021-34549. Reported by Jann Horn from Google's Project Zero. + - Fix an out-of-bounds memory access in v3 onion service descriptor + parsing. An attacker could exploit this bug by crafting an onion + service descriptor that would crash any client that tried to visit + it. Fixes bug 40392; bugfix on 0.3.0.1-alpha. This issue is also + tracked as TROVE-2021-006 and CVE-2021-34550. Reported by Sergei + Glazunov from Google's Project Zero. + + o Minor features (compatibility, backport from 0.4.6.4-rc): + - Remove an assertion function related to TLS renegotiation. It was + used nowhere outside the unit tests, and it was breaking + compilation with recent alpha releases of OpenSSL 3.0.0. Closes + ticket 40399. + + o Minor features (geoip data): + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2021/06/10. + + o Minor bugfixes (control, sandbox, backport from 0.4.6.4-rc): + - Allow the control command SAVECONF to succeed when the seccomp + sandbox is enabled, and make SAVECONF keep only one backup file to + simplify implementation. Previously SAVECONF allowed a large + number of backup files, which made it incompatible with the + sandbox. Fixes bug 40317; bugfix on 0.2.5.4-alpha. Patch by + Daniel Pinto. + + o Minor bugfixes (metrics port, backport from 0.4.6.4-rc): + - Fix a bug that made tor try to re-bind() on an already open + MetricsPort every 60 seconds. Fixes bug 40370; bugfix + on 0.4.5.1-alpha. + + Changes in version 0.4.5.8 - 2021-05-10 Tor 0.4.5.8 fixes several bugs in earlier version, backporting fixes from the 0.4.6.x series.

1 0