- tor-commits - lists.torproject.org

[tor/release-0.2.8] Fix out-of-bounds write during voting with duplicate ed25519 keys
by nickm＠torproject.org 12 May '16

12 May '16

commit bf3e32a45288b64e5535e02f40bd2bcb93c8a520 Author: John Brooks <special(a)torproject.org> Date: Wed May 11 12:13:22 2016 -0400 Fix out-of-bounds write during voting with duplicate ed25519 keys In dirserv_compute_performance_thresholds, we allocate arrays based on the length of 'routers', a list of routerinfo_t, but loop over the nodelist. The 'routers' list may be shorter when relays were filtered by routers_make_ed_keys_unique, leading to an out-of-bounds write on directory authorities. This bug was originally introduced in 26e89742, but it doesn't look possible to trigger until routers_make_ed_keys_unique was introduced in 13a31e72. Fixes bug 19032; bugfix on tor 0.2.8.2-alpha. --- changes/bug19032 | 4 ++++ src/or/dirserv.c | 31 ++++++++++++++++--------------- src/or/dirserv.h | 2 +- src/or/networkstatus.c | 3 +-- 4 files changed, 22 insertions(+), 18 deletions(-) diff --git a/changes/bug19032 b/changes/bug19032 new file mode 100644 index 0000000..93f17c2 --- /dev/null +++ b/changes/bug19032 @@ -0,0 +1,4 @@ + o Major bugfixes (security, directory authorities): + - Fix a crash and out-of-bounds write during authority voting, when the + list of relays includes duplicate ed25519 identity keys. Fixes bug 19032; + bugfix on 0.2.8.2-alpha. diff --git a/src/or/dirserv.c b/src/or/dirserv.c index ae67e8e..a367669 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -1422,13 +1422,13 @@ router_counts_toward_thresholds(const node_t *node, time_t now, * * Also, set the is_exit flag of each router appropriately. */ static void -dirserv_compute_performance_thresholds(const smartlist_t *routers, - digestmap_t *omit_as_sybil) +dirserv_compute_performance_thresholds(digestmap_t *omit_as_sybil) { int n_active, n_active_nonexit, n_familiar; uint32_t *uptimes, *bandwidths_kb, *bandwidths_excluding_exits_kb; long *tks; double *mtbfs, *wfus; + smartlist_t *nodelist; time_t now = time(NULL); const or_options_t *options = get_options(); @@ -1446,27 +1446,28 @@ dirserv_compute_performance_thresholds(const smartlist_t *routers, guard_tk = 0; guard_wfu = 0; + nodelist_assert_ok(); + nodelist = nodelist_get_list(); + /* Initialize arrays that will hold values for each router. We'll * sort them and use that to compute thresholds. */ n_active = n_active_nonexit = 0; /* Uptime for every active router. */ - uptimes = tor_calloc(smartlist_len(routers), sizeof(uint32_t)); + uptimes = tor_calloc(smartlist_len(nodelist), sizeof(uint32_t)); /* Bandwidth for every active router. */ - bandwidths_kb = tor_calloc(smartlist_len(routers), sizeof(uint32_t)); + bandwidths_kb = tor_calloc(smartlist_len(nodelist), sizeof(uint32_t)); /* Bandwidth for every active non-exit router. */ bandwidths_excluding_exits_kb = - tor_calloc(smartlist_len(routers), sizeof(uint32_t)); + tor_calloc(smartlist_len(nodelist), sizeof(uint32_t)); /* Weighted mean time between failure for each active router. */ - mtbfs = tor_calloc(smartlist_len(routers), sizeof(double)); + mtbfs = tor_calloc(smartlist_len(nodelist), sizeof(double)); /* Time-known for each active router. */ - tks = tor_calloc(smartlist_len(routers), sizeof(long)); + tks = tor_calloc(smartlist_len(nodelist), sizeof(long)); /* Weighted fractional uptime for each active router. */ - wfus = tor_calloc(smartlist_len(routers), sizeof(double)); - - nodelist_assert_ok(); + wfus = tor_calloc(smartlist_len(nodelist), sizeof(double)); /* Now, fill in the arrays. */ - SMARTLIST_FOREACH_BEGIN(nodelist_get_list(), node_t *, node) { + SMARTLIST_FOREACH_BEGIN(nodelist, node_t *, node) { if (options->BridgeAuthoritativeDir && node->ri && node->ri->purpose != ROUTER_PURPOSE_BRIDGE) @@ -1542,7 +1543,7 @@ dirserv_compute_performance_thresholds(const smartlist_t *routers, * fill wfus with the wfu of every such "familiar" router. */ n_familiar = 0; - SMARTLIST_FOREACH_BEGIN(nodelist_get_list(), node_t *, node) { + SMARTLIST_FOREACH_BEGIN(nodelist, node_t *, node) { if (router_counts_toward_thresholds(node, now, omit_as_sybil, require_mbw)) { routerinfo_t *ri = node->ri; @@ -1596,11 +1597,11 @@ dirserv_compute_performance_thresholds(const smartlist_t *routers, * networkstatus_getinfo_by_purpose(). */ void -dirserv_compute_bridge_flag_thresholds(const smartlist_t *routers) +dirserv_compute_bridge_flag_thresholds() { digestmap_t *omit_as_sybil = digestmap_new(); - dirserv_compute_performance_thresholds(routers, omit_as_sybil); + dirserv_compute_performance_thresholds(omit_as_sybil); digestmap_free(omit_as_sybil, NULL); } @@ -2870,7 +2871,7 @@ dirserv_generate_networkstatus_vote_obj(crypto_pk_t *private_key, * this must come before dirserv_compute_performance_thresholds() */ dirserv_count_measured_bws(routers); - dirserv_compute_performance_thresholds(routers, omit_as_sybil); + dirserv_compute_performance_thresholds(omit_as_sybil); routerstatuses = smartlist_new(); microdescriptors = smartlist_new(); diff --git a/src/or/dirserv.h b/src/or/dirserv.h index b16a67c..4bb3072 100644 --- a/src/or/dirserv.h +++ b/src/or/dirserv.h @@ -50,7 +50,7 @@ int list_server_status_v1(smartlist_t *routers, char **router_status_out, int dirserv_dump_directory_to_string(char **dir_out, crypto_pk_t *private_key); char *dirserv_get_flag_thresholds_line(void); -void dirserv_compute_bridge_flag_thresholds(const smartlist_t *routers); +void dirserv_compute_bridge_flag_thresholds(void); int directory_fetches_from_authorities(const or_options_t *options); int directory_fetches_dir_info_early(const or_options_t *options); diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c index a9b22ed..f72e9d5 100644 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@ -1697,11 +1697,10 @@ networkstatus_dump_bridge_status_to_file(time_t now) char *fname = NULL; char *thresholds = NULL; char *published_thresholds_and_status = NULL; - routerlist_t *rl = router_get_routerlist(); char published[ISO_TIME_LEN+1]; format_iso_time(published, now); - dirserv_compute_bridge_flag_thresholds(rl->routers); + dirserv_compute_bridge_flag_thresholds(); thresholds = dirserv_get_flag_thresholds_line(); tor_asprintf(&published_thresholds_and_status, "published %s\nflag-thresholds %s\n%s",

1 0

[tor/release-0.2.8] Merge remote-tracking branch 'special/bug19032-027' into maint-0.2.7
by nickm＠torproject.org 12 May '16

12 May '16

commit 4e94580591da579e53461aeedfb1340836427c02 Merge: 039fc84 bf3e32a Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 11 13:13:23 2016 -0400 Merge remote-tracking branch 'special/bug19032-027' into maint-0.2.7 changes/bug19032 | 4 ++++ src/or/dirserv.c | 31 ++++++++++++++++--------------- src/or/dirserv.h | 2 +- src/or/networkstatus.c | 3 +-- 4 files changed, 22 insertions(+), 18 deletions(-)

1 0

[tor/release-0.2.8] Merge branch 'maint-0.2.7' into maint-0.2.8
by nickm＠torproject.org 12 May '16

12 May '16

commit 24fbb9a81b19cc20df9a204d3203d1b914fb267d Merge: 28e1aa1 4e94580 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 11 13:15:17 2016 -0400 Merge branch 'maint-0.2.7' into maint-0.2.8 changes/bug19032 | 4 ++++ src/or/dirserv.c | 31 ++++++++++++++++--------------- src/or/dirserv.h | 2 +- src/or/networkstatus.c | 3 +-- 4 files changed, 22 insertions(+), 18 deletions(-)

1 0

[tor/release-0.2.8] Merge remote-tracking branch 'teor/bug18816_simplify' into maint-0.2.8
by nickm＠torproject.org 12 May '16

12 May '16

commit 8d962233f65022dc7fbc0466c981e3e7f2aea0c8 Merge: 24fbb9a 797ece0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 11 13:20:51 2016 -0400 Merge remote-tracking branch 'teor/bug18816_simplify' into maint-0.2.8 changes/bug18816 | 2 -- src/or/routerlist.c | 16 ++++++---------- 2 files changed, 6 insertions(+), 12 deletions(-)

1 0

[tor/release-0.2.8] Merge branch 'maint-0.2.7' into maint-0.2.8
by nickm＠torproject.org 12 May '16

12 May '16

commit 163cee1b6489c8966681b420d6da49e8ff4a9d1f Merge: 8d96223 d40e869 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed May 11 13:42:40 2016 -0400 Merge branch 'maint-0.2.7' into maint-0.2.8 src/or/dirserv.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)

1 0

[tor/release-0.2.8] minor touchups on nick's ticket 17621 changes
by nickm＠torproject.org 12 May '16

12 May '16

commit 4a62d7aabc4e00d22f27d188f4cb2bb6efb3b674 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed May 11 16:35:36 2016 -0400 minor touchups on nick's ticket 17621 changes --- changes/doc17621 | 2 +- doc/tor.1.txt | 11 +++++------ 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/changes/doc17621 b/changes/doc17621 index af61d81..ab37d29 100644 --- a/changes/doc17621 +++ b/changes/doc17621 @@ -1,3 +1,3 @@ o Documentation: - Document the contents of the 'datadir/keys' subdirectory in the manual - page. Closes ticekt 17621. + page. Closes ticket 17621. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 5d85935..74915b7 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2703,18 +2703,18 @@ __DataDirectory__**/keys/***:: Only used by servers. Holds identity keys and onion keys. __DataDirectory__**/keys/authority_identity_key**:: - A directory authority's master identity key, used to authenticate its + A v3 directory authority's master identity key, used to authenticate its signing key. Tor doesn't use this while it's running. The tor-gencert program uses this. If you're running an authority, you should keep this key offline, and not actually put it here. __DataDirectory__**/keys/authority_certificate**:: - A directory authority's certificate, which authenticates the authority's + A v3 directory authority's certificate, which authenticates the authority's current vote- and consensus-signing key using its master identity key. Only directory authorities use this file. __DataDirectory__**/keys/authority_signing_key**:: - A directory authority's signing key, used to sign votes and consensuses. + A v3 directory authority's signing key, used to sign votes and consensuses. Only directory authorities use this file. Corresponds to the **authority_certificate** cert. @@ -2765,9 +2765,8 @@ __DataDirectory__**/hashed-fingerprint**:: identity key. (That is, the hash of the hash of the identity key.) __DataDirectory__**/v3-status-votes**:: - Only for authoritative directory servers. This file contains status votes - from all the authoritative directory servers and is used to generate the - network consensus document. + Only for v3 authoritative directory servers. This file contains + status votes from all the authoritative directory servers. __DataDirectory__**/unverified-consensus**:: This file contains a network consensus document that has been downloaded,

1 0

[tor/release-0.2.8] Merge branch 'bug18977_024_v2' into bug18977_026_v2
by nickm＠torproject.org 12 May '16

12 May '16

commit 20b01cece8cd2ceb7f8051aee04294bdba471f1a Merge: 0b477bf e57f26c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 12 14:39:06 2016 -0400 Merge branch 'bug18977_024_v2' into bug18977_026_v2 Had conflicts related to other correct_tm bugs in 0.2.6. Added wday for another case. changes/bug18977 | 4 ++++ src/common/compat.c | 4 ++++ src/common/util.c | 2 ++ 3 files changed, 10 insertions(+) diff --cc src/common/compat.c index 1788e32,90132fc..103ce24 --- a/src/common/compat.c +++ b/src/common/compat.c @@@ -2683,18 -2461,11 +2683,20 @@@ correct_tm(int islocal, const time_t *t r->tm_year = 8099; r->tm_mon = 11; r->tm_mday = 31; - r->tm_yday = 365; + r->tm_yday = 364; + r->tm_wday = 6; r->tm_hour = 23; r->tm_min = 59; r->tm_sec = 59; + } else if (r->tm_year < (1-1900)) { + r->tm_year = (1-1900); + r->tm_mon = 0; + r->tm_mday = 1; + r->tm_yday = 0; ++ r->tm_wday = 0; + r->tm_hour = 0; + r->tm_min = 0; + r->tm_sec = 0; } return r; } @@@ -2708,7 -2479,8 +2710,8 @@@ r->tm_year = 70; /* 1970 CE */ r->tm_mon = 0; r->tm_mday = 1; - r->tm_yday = 1; + r->tm_yday = 0; + r->tm_wday = 0; r->tm_hour = 0; r->tm_min = 0 ; r->tm_sec = 0; @@@ -2721,7 -2493,8 +2724,8 @@@ r->tm_year = 137; /* 2037 CE */ r->tm_mon = 11; r->tm_mday = 31; - r->tm_yday = 365; + r->tm_yday = 364; + r->tm_wday = 6; r->tm_hour = 23; r->tm_min = 59; r->tm_sec = 59;

1 0

[tor/release-0.2.8] Merge branch 'bug18977_026_v2' into maint-0.2.7
by nickm＠torproject.org 12 May '16

12 May '16

commit 4165b1a0da893a9f67a2ba32b4fcd54a7804ce14 Merge: d40e869 20b01ce Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 12 15:33:35 2016 -0400 Merge branch 'bug18977_026_v2' into maint-0.2.7 changes/bug18977 | 4 ++++ src/common/compat.c | 4 ++++ src/common/util.c | 2 ++ 3 files changed, 10 insertions(+)

1 0

[tor/release-0.2.8] unbreak the build (when warnings are enabled)
by nickm＠torproject.org 12 May '16

12 May '16

commit d40e8695f42959d180fe563d447422327535c753 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed May 11 13:42:00 2016 -0400 unbreak the build (when warnings are enabled) --- src/or/dirserv.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/or/dirserv.c b/src/or/dirserv.c index a367669..01b08ca 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -1597,9 +1597,8 @@ dirserv_compute_performance_thresholds(digestmap_t *omit_as_sybil) * networkstatus_getinfo_by_purpose(). */ void -dirserv_compute_bridge_flag_thresholds() +dirserv_compute_bridge_flag_thresholds(void) { - digestmap_t *omit_as_sybil = digestmap_new(); dirserv_compute_performance_thresholds(omit_as_sybil); digestmap_free(omit_as_sybil, NULL);

1 0

[tor/release-0.2.8] Merge remote-tracking branch 'arma/bug19003-try2' into maint-0.2.8
by nickm＠torproject.org 12 May '16

12 May '16

commit ce6f2d1c4da5125cdd4a69fcc4cd45f7c3d6ca8d Merge: d00d3f1 b8b5bcc Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 12 11:09:33 2016 -0400 Merge remote-tracking branch 'arma/bug19003-try2' into maint-0.2.8 changes/bug19003 | 5 +++++ src/or/circuituse.c | 6 +++++- src/or/router.c | 15 ++++++++++++--- 3 files changed, 22 insertions(+), 4 deletions(-)

1 0