- tor-commits - lists.torproject.org

[tor/maint-0.2.3] Discard extraneous renegotiation attempts in the v3 link protocol
by nickm＠torproject.org 19 Oct '12

19 Oct '12

commit f357ef9dccccfb5ce2408dbd5f8456de02bac895 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Oct 16 12:55:50 2012 -0400 Discard extraneous renegotiation attempts in the v3 link protocol Failure to do so left us open to a remotely triggerable assertion failure. Fixes CVE-2012-2249; bugfix on 0.2.3.6-alpha. Reported by "some guy from France". --- changes/cve-2012-2249 | 5 +++++ src/or/command.c | 1 + src/or/connection_or.c | 14 ++++++++++++-- src/or/connection_or.h | 1 + 4 files changed, 19 insertions(+), 2 deletions(-) diff --git a/changes/cve-2012-2249 b/changes/cve-2012-2249 new file mode 100644 index 0000000..625bfa2 --- /dev/null +++ b/changes/cve-2012-2249 @@ -0,0 +1,5 @@ + o Major bugfixes (security): + - Discard extraneous renegotiation attempts once the V3 link + protocol has been initiated. Failure to do so left us open to + a remotely triggerable assertion failure. Fixes CVE-2012-2249; + bugfix on 0.2.3.6-alpha. Reported by "some guy from France". diff --git a/src/or/command.c b/src/or/command.c index d8a409b..975af04 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -649,6 +649,7 @@ enter_v3_handshake_with_cell(var_cell_t *cell, or_connection_t *conn) "Received a cell while TLS-handshaking, not in " "OR_HANDSHAKING_V3, on a connection we originated."); } + connection_or_block_renegotiation(conn); conn->_base.state = OR_CONN_STATE_OR_HANDSHAKING_V3; if (connection_init_or_handshake_state(conn, started_here) < 0) { connection_mark_for_close(TO_CONN(conn)); diff --git a/src/or/connection_or.c b/src/or/connection_or.c index d016387..6293fe8 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -1186,6 +1186,17 @@ connection_tls_start_handshake(or_connection_t *conn, int receiving) return 0; } +/** Block all future attempts to renegotiate on 'conn' */ +void +connection_or_block_renegotiation(or_connection_t *conn) +{ + tor_tls_t *tls = conn->tls; + if (!tls) + return; + tor_tls_set_renegotiate_callback(tls, NULL, NULL); + tor_tls_block_renegotiation(tls); +} + /** Invoked on the server side from inside tor_tls_read() when the server * gets a successful TLS renegotiation from the client. */ static void @@ -1195,8 +1206,7 @@ connection_or_tls_renegotiated_cb(tor_tls_t *tls, void *_conn) (void)tls; /* Don't invoke this again. */ - tor_tls_set_renegotiate_callback(tls, NULL, NULL); - tor_tls_block_renegotiation(tls); + connection_or_block_renegotiation(conn); if (connection_tls_finish_handshake(conn) < 0) { /* XXXX_TLS double-check that it's ok to do this from inside read. */ diff --git a/src/or/connection_or.h b/src/or/connection_or.h index 3e98f5c..b78c444 100644 --- a/src/or/connection_or.h +++ b/src/or/connection_or.h @@ -21,6 +21,7 @@ or_connection_t *connection_or_get_for_extend(const char *digest, int *launch_out); void connection_or_set_bad_connections(const char *digest, int force); +void connection_or_block_renegotiation(or_connection_t *conn); int connection_or_reached_eof(or_connection_t *conn); int connection_or_process_inbuf(or_connection_t *conn); int connection_or_flushed_some(or_connection_t *conn);

1 0

[tor/maint-0.2.3] Merge branch 'block_renegotiate_023' into maint-0.2.3
by nickm＠torproject.org 19 Oct '12

19 Oct '12

commit 1cc06bd35e4203569ecc72ff314a1dd543f60651 Merge: b6931b0 f357ef9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Oct 19 14:30:31 2012 -0400 Merge branch 'block_renegotiate_023' into maint-0.2.3 changes/cve-2012-2249 | 5 +++++ src/or/command.c | 1 + src/or/connection_or.c | 14 ++++++++++++-- src/or/connection_or.h | 1 + 4 files changed, 19 insertions(+), 2 deletions(-)

1 0

[translation/https_everywhere_completed] Update translations for https_everywhere_completed
by translation＠torproject.org 19 Oct '12

19 Oct '12

commit 0cd62a3848a44efb04f4352f6c8f309600efc24f Author: Translation commit bot <translation(a)torproject.org> Date: Fri Oct 19 18:15:38 2012 +0000 Update translations for https_everywhere_completed --- ru/https-everywhere.dtd | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/ru/https-everywhere.dtd b/ru/https-everywhere.dtd index 77e81e8..a577567 100644 --- a/ru/https-everywhere.dtd +++ b/ru/https-everywhere.dtd @@ -28,7 +28,7 @@ <!ENTITY https-everywhere.prefs.here_link "здесь"> <!ENTITY https-everywhere.prefs.toggle "Переключить"> <!ENTITY https-everywhere.prefs.reset_default "Сбросить к значению по-умолчанию"> -<!ENTITY https-everywhere.prefs.view_xml_source "Просмотр исходника XML"> +<!ENTITY https-everywhere.prefs.view_xml_source "Просмотреть исходник XML"> <!ENTITY https-everywhere.source.downloading "Загружается"> <!ENTITY https-everywhere.source.filename "Имя файла">

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 19 Oct '12

19 Oct '12

commit 3a2a4cc541e7723790919cb842e5683e4833100d Author: Translation commit bot <translation(a)torproject.org> Date: Fri Oct 19 18:15:32 2012 +0000 Update translations for https_everywhere --- ru/https-everywhere.dtd | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/ru/https-everywhere.dtd b/ru/https-everywhere.dtd index 77e81e8..a577567 100644 --- a/ru/https-everywhere.dtd +++ b/ru/https-everywhere.dtd @@ -28,7 +28,7 @@ <!ENTITY https-everywhere.prefs.here_link "здесь"> <!ENTITY https-everywhere.prefs.toggle "Переключить"> <!ENTITY https-everywhere.prefs.reset_default "Сбросить к значению по-умолчанию"> -<!ENTITY https-everywhere.prefs.view_xml_source "Просмотр исходника XML"> +<!ENTITY https-everywhere.prefs.view_xml_source "Просмотреть исходник XML"> <!ENTITY https-everywhere.source.downloading "Загружается"> <!ENTITY https-everywhere.source.filename "Имя файла">

1 0

[doctor/master] Add pb_disablepct to known consensus params.
by karsten＠torproject.org 19 Oct '12

19 Oct '12

commit 2ee49cd21d5a3dc9cb9d13569532a7dabfdf2b0e Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Fri Oct 19 09:30:27 2012 -0400 Add pb_disablepct to known consensus params. --- src/org/torproject/doctor/Checker.java | 2 +- .../torproject/doctor/MetricsWebsiteReport.java | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/org/torproject/doctor/Checker.java b/src/org/torproject/doctor/Checker.java index 13dbc05..2fbdcaf 100644 --- a/src/org/torproject/doctor/Checker.java +++ b/src/org/torproject/doctor/Checker.java @@ -262,7 +262,7 @@ public class Checker { + "cbtdisabled,cbtnummodes,cbtrecentcount,cbtmaxtimeouts," + "cbtmincircs,cbtquantile,cbtclosequantile,cbttestfreq," + "cbtmintimeout,cbtinitialtimeout,perconnbwburst,perconnbwrate," - + "UseOptimisticData").split(","))); + + "UseOptimisticData,pb_disablepct").split(","))); SortedSet<String> conflicts = new TreeSet<String>(); for (RelayNetworkStatusVote vote : this.downloadedVotes) { Map<String, Integer> voteConsensusParams = diff --git a/src/org/torproject/doctor/MetricsWebsiteReport.java b/src/org/torproject/doctor/MetricsWebsiteReport.java index d81c362..a03b5e1 100644 --- a/src/org/torproject/doctor/MetricsWebsiteReport.java +++ b/src/org/torproject/doctor/MetricsWebsiteReport.java @@ -427,7 +427,7 @@ public class MetricsWebsiteReport { + "cbtdisabled,cbtnummodes,cbtrecentcount,cbtmaxtimeouts," + "cbtmincircs,cbtquantile,cbtclosequantile,cbttestfreq," + "cbtmintimeout,cbtinitialtimeout,perconnbwburst," - + "perconnbwrate,UseOptimisticData").split(","))); + + "perconnbwrate,UseOptimisticData,pb_disablepct").split(","))); Map<String, Integer> consensusConsensusParams = downloadedConsensus.getConsensusParams(); for (RelayNetworkStatusVote vote : this.downloadedVotes.values()) {

1 0

[tor/master] Don't serve or accept v2 HS descs over a DirPort
by nickm＠torproject.org 19 Oct '12

19 Oct '12

commit d3bfdd6108d084c77f60b16319f6ef24ac447373 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Tue Sep 11 13:00:05 2012 -0700 Don't serve or accept v2 HS descs over a DirPort (changes file tweaked by nickm) --- changes/dirserv-BUGGY-a | 7 +++++++ src/or/directory.c | 2 ++ 2 files changed, 9 insertions(+), 0 deletions(-) diff --git a/changes/dirserv-BUGGY-a b/changes/dirserv-BUGGY-a new file mode 100644 index 0000000..35b492a --- /dev/null +++ b/changes/dirserv-BUGGY-a @@ -0,0 +1,7 @@ + o Minor bugfixes: + + - Don't serve or accept v2 hidden service descriptors over a + relay's DirPort. It's never correct to do so, and disabling it + might make it more annoying to exploit any bugs that turn up in the + descriptor-parsing code. Fixes bug 7149. + diff --git a/src/or/directory.c b/src/or/directory.c index f1510b9..f235bf3 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -3178,6 +3178,7 @@ directory_handle_command_get(dir_connection_t *conn, const char *headers, } if (options->HidServDirectoryV2 && + connection_dir_is_encrypted(conn) && !strcmpstart(url,"/tor/rendezvous2/")) { /* Handle v2 rendezvous descriptor fetch request. */ const char *descp; @@ -3364,6 +3365,7 @@ directory_handle_command_post(dir_connection_t *conn, const char *headers, /* Handle v2 rendezvous service publish request. */ if (options->HidServDirectoryV2 && + connection_dir_is_encrypted(conn) && !strcmpstart(url,"/tor/rendezvous2/publish")) { switch (rend_cache_store_v2_desc_as_dir(body)) { case -2:

1 0

[tor/master] Merge branch 'bug7149' into maint-0.2.3
by nickm＠torproject.org 19 Oct '12

19 Oct '12

commit b6931b010512d3d8cbda24c87a8cf379305e1457 Merge: a0e9dc9 d3bfdd6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Oct 19 03:02:57 2012 -0400 Merge branch 'bug7149' into maint-0.2.3 changes/dirserv-BUGGY-a | 7 +++++++ src/or/directory.c | 2 ++ 2 files changed, 9 insertions(+), 0 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3'
by nickm＠torproject.org 19 Oct '12

19 Oct '12

commit 0dac0d8ad68f17fa1803ebd82e402e5181e0532a Merge: 9f1b1ef b6931b0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Oct 19 03:06:15 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' changes/dirserv-BUGGY-a | 7 +++++++ src/or/directory.c | 2 ++ 2 files changed, 9 insertions(+), 0 deletions(-)

1 0

[tor/maint-0.2.3] Don't serve or accept v2 HS descs over a DirPort
by nickm＠torproject.org 19 Oct '12

19 Oct '12

commit d3bfdd6108d084c77f60b16319f6ef24ac447373 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Tue Sep 11 13:00:05 2012 -0700 Don't serve or accept v2 HS descs over a DirPort (changes file tweaked by nickm) --- changes/dirserv-BUGGY-a | 7 +++++++ src/or/directory.c | 2 ++ 2 files changed, 9 insertions(+), 0 deletions(-) diff --git a/changes/dirserv-BUGGY-a b/changes/dirserv-BUGGY-a new file mode 100644 index 0000000..35b492a --- /dev/null +++ b/changes/dirserv-BUGGY-a @@ -0,0 +1,7 @@ + o Minor bugfixes: + + - Don't serve or accept v2 hidden service descriptors over a + relay's DirPort. It's never correct to do so, and disabling it + might make it more annoying to exploit any bugs that turn up in the + descriptor-parsing code. Fixes bug 7149. + diff --git a/src/or/directory.c b/src/or/directory.c index f1510b9..f235bf3 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -3178,6 +3178,7 @@ directory_handle_command_get(dir_connection_t *conn, const char *headers, } if (options->HidServDirectoryV2 && + connection_dir_is_encrypted(conn) && !strcmpstart(url,"/tor/rendezvous2/")) { /* Handle v2 rendezvous descriptor fetch request. */ const char *descp; @@ -3364,6 +3365,7 @@ directory_handle_command_post(dir_connection_t *conn, const char *headers, /* Handle v2 rendezvous service publish request. */ if (options->HidServDirectoryV2 && + connection_dir_is_encrypted(conn) && !strcmpstart(url,"/tor/rendezvous2/publish")) { switch (rend_cache_store_v2_desc_as_dir(body)) { case -2:

1 0

[tor/maint-0.2.3] Merge branch 'bug7149' into maint-0.2.3
by nickm＠torproject.org 19 Oct '12

19 Oct '12

commit b6931b010512d3d8cbda24c87a8cf379305e1457 Merge: a0e9dc9 d3bfdd6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Oct 19 03:02:57 2012 -0400 Merge branch 'bug7149' into maint-0.2.3 changes/dirserv-BUGGY-a | 7 +++++++ src/or/directory.c | 2 ++ 2 files changed, 9 insertions(+), 0 deletions(-)

1 0