- tor-commits - lists.torproject.org

[tor/release-0.2.3] Whitespace and build fixes on 6475 patch
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit a74d4182f106b1b89367cf1a640b1140d3d35d2c Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Aug 17 12:10:31 2012 -0400 Whitespace and build fixes on 6475 patch --- src/or/circuitbuild.c | 20 ++++++++++---------- 1 files changed, 10 insertions(+), 10 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 2fa3dd5..39a223b 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2609,14 +2609,14 @@ pathbias_get_scale_factor(const or_options_t *options) DFLT_PATH_BIAS_SCALE_THRESHOLD, 1, INT32_MAX); } -const char * +static const char * pathbias_state_to_string(path_state_t state) { - switch(state) { + switch (state) { case PATH_STATE_NEW_CIRC: - return "new"; + return "new"; case PATH_STATE_DID_FIRST_HOP: - return "first hop"; + return "first hop"; case PATH_STATE_SUCCEEDED: return "succeeded"; } @@ -2624,7 +2624,6 @@ pathbias_state_to_string(path_state_t state) return "unknown"; } - /** * Check our circuit state to see if this is a successful first hop. * If so, record it in the current guard's path bias first_hop count. @@ -2635,7 +2634,8 @@ static int pathbias_count_first_hop(origin_circuit_t *circ) { #define FIRST_HOP_NOTICE_INTERVAL (600) - static ratelim_t first_hop_notice_limit = RATELIM_INIT(FIRST_HOP_NOTICE_INTERVAL); + static ratelim_t first_hop_notice_limit = + RATELIM_INIT(FIRST_HOP_NOTICE_INTERVAL); char *rate_msg = NULL; /* Completely ignore one hop circuits */ @@ -2706,7 +2706,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) "A %s circuit is in cpath state %d (opened: %d). " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), - circ->cpath->state, circ->has_opened, + circ->cpath->state, circ->has_opened, circuit_purpose_to_string(circ->_base.purpose), circuit_state_to_string(circ->_base.state), rate_msg); @@ -2728,7 +2728,8 @@ static void pathbias_count_success(origin_circuit_t *circ) { #define SUCCESS_NOTICE_INTERVAL (600) - static ratelim_t success_notice_limit = RATELIM_INIT(SUCCESS_NOTICE_INTERVAL); + static ratelim_t success_notice_limit = + RATELIM_INIT(SUCCESS_NOTICE_INTERVAL); char *rate_msg = NULL; /* Ignore one hop circuits */ @@ -2796,7 +2797,6 @@ pathbias_count_success(origin_circuit_t *circ) } } - /** Increment the number of times we successfully extended a circuit to * 'guard', first checking if the failure rate is high enough that we should * eliminate the guard. Return -1 if the guard looks no good; return 0 if the @@ -2866,7 +2866,7 @@ circuit_finish_handshake(origin_circuit_t *circ, uint8_t reply_type, crypt_path_t *hop; int rv; - if((rv = pathbias_count_first_hop(circ)) < 0) + if ((rv = pathbias_count_first_hop(circ)) < 0) return rv; if (circ->cpath->state == CPATH_STATE_AWAITING_KEYS) {

1 0

[tor/release-0.2.3] Consider IPv6 OR ports when deciding whether a routerinfo change is cosmetic.
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit 9ed87b37d04705983b11cd995140e8864454bf5e Author: Linus Nordberg <linus(a)torproject.org> Date: Thu Jul 19 20:41:23 2012 +0200 Consider IPv6 OR ports when deciding whether a routerinfo change is cosmetic. Closes #6423. --- changes/bug6423 | 3 +++ src/or/routerlist.c | 2 ++ 2 files changed, 5 insertions(+), 0 deletions(-) diff --git a/changes/bug6423 b/changes/bug6423 new file mode 100644 index 0000000..2ea4f14 --- /dev/null +++ b/changes/bug6423 @@ -0,0 +1,3 @@ + o Minor features: + - Consider new, removed or changed IPv6 OR ports a non cosmetic + change. diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 4979b93..3c39e36 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -5160,6 +5160,8 @@ router_differences_are_cosmetic(const routerinfo_t *r1, const routerinfo_t *r2) if (strcasecmp(r1->address, r2->address) || strcasecmp(r1->nickname, r2->nickname) || r1->or_port != r2->or_port || + !tor_addr_eq(&r1->ipv6_addr, &r2->ipv6_addr) || + r1->ipv6_orport != r2->ipv6_orport || r1->dir_port != r2->dir_port || r1->purpose != r2->purpose || crypto_pk_cmp_keys(r1->onion_pkey, r2->onion_pkey) ||

1 0

[tor/release-0.2.3] Fix more warnings from openbsd_malloc
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit 4c8fcba86c35bd8e2cfde4c65f394c7837638ff0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Aug 17 13:49:52 2012 -0400 Fix more warnings from openbsd_malloc Apparently, (void)writev is not enough to suppress the "you are ignoring the return value!" warnings on Linux. Instead, remove the whole warning/error logic when compiling openbsd_malloc for Tor: we can't use it. --- src/common/OpenBSD_malloc_Linux.c | 13 +++++++++++-- 1 files changed, 11 insertions(+), 2 deletions(-) diff --git a/src/common/OpenBSD_malloc_Linux.c b/src/common/OpenBSD_malloc_Linux.c index 39c8f8b..da82729 100644 --- a/src/common/OpenBSD_malloc_Linux.c +++ b/src/common/OpenBSD_malloc_Linux.c @@ -450,6 +450,7 @@ extern char *__progname; static void wrterror(const char *p) { +#ifndef BUILDING_FOR_TOR const char *q = " error: "; struct iovec iov[5]; @@ -463,8 +464,10 @@ wrterror(const char *p) iov[3].iov_len = strlen(p); iov[4].iov_base = (char*)"\n"; iov[4].iov_len = 1; - (void) writev(STDERR_FILENO, iov, 5); - + writev(STDERR_FILENO, iov, 5); +#else + (void)p; +#endif suicide = 1; #ifdef MALLOC_STATS if (malloc_stats) @@ -478,14 +481,17 @@ wrterror(const char *p) static void wrtwarning(const char *p) { +#ifndef BUILDING_FOR_TOR const char *q = " warning: "; struct iovec iov[5]; +#endif if (malloc_abort) wrterror(p); else if (malloc_silent) return; +#ifndef BUILDING_FOR_TOR iov[0].iov_base = __progname; iov[0].iov_len = strlen(__progname); iov[1].iov_base = (char*)malloc_func; @@ -498,6 +504,9 @@ wrtwarning(const char *p) iov[4].iov_len = 1; (void) writev(STDERR_FILENO, iov, 5); +#else + (void)p; +#endif } #ifdef MALLOC_STATS

1 0

[tor/release-0.2.3] Do not assert when comparing a null address/port against a policy
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit 62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 11:52:51 2012 -0400 Do not assert when comparing a null address/port against a policy This can create a remote crash opportunity for/against directory authorities. --- changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-) diff --git a/changes/bug6690 b/changes/bug6690 new file mode 100644 index 0000000..99d4297 --- /dev/null +++ b/changes/bug6690 @@ -0,0 +1,7 @@ + o Major bugfixes (security): + - Do not crash when comparing an address with port value 0 to an + address policy. This bug could have been used to cause a remote + assertion failure by or against directory authorities, or to + allow some applications to crash clients. Fixes bug 6690; bugfix + on 0.2.1.10-alpha. + diff --git a/src/or/policies.c b/src/or/policies.c index c870360..55d08af 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -685,7 +685,11 @@ compare_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port, /* no policy? accept all. */ return ADDR_POLICY_ACCEPTED; } else if (tor_addr_is_null(addr)) { - tor_assert(port != 0); + if (port == 0) { + log_info(LD_BUG, "Rejecting null address with 0 port (family %d)", + addr ? tor_addr_family(addr) : -1); + return ADDR_POLICY_REJECTED; + } return compare_unknown_tor_addr_to_addr_policy(port, policy); } else if (port == 0) { return compare_known_tor_addr_to_addr_policy_noport(addr, policy);

1 0

[tor/release-0.2.3] Merge remote-tracking branch 'public/bug6404' into maint-0.2.3
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit 991a8acba2e2148a576465c3e07e9f6ce4864ea1 Merge: 88859b2 a4fbfa8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Aug 21 10:35:40 2012 -0400 Merge remote-tracking branch 'public/bug6404' into maint-0.2.3 changes/bug6404 | 16 ++++++++++++++++ src/or/dirvote.c | 48 ++++++++++++++++++++++++++++++------------------ src/or/microdesc.c | 7 +------ src/or/routerparse.c | 5 +++++ 4 files changed, 52 insertions(+), 24 deletions(-)

1 0

[tor/release-0.2.3] whitespace fix
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit 88859b2ff1fdd4e5f4fab8ad818131ea3c2dd1c8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Aug 17 17:10:03 2012 -0400 whitespace fix --- src/or/config.h | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/src/or/config.h b/src/or/config.h index 48f4e86..dd76edc 100644 --- a/src/or/config.h +++ b/src/or/config.h @@ -102,6 +102,5 @@ int addressmap_register_auto(const char *from, const char *to, addressmap_entry_source_t addrmap_source, const char **msg); - #endif

1 0

[tor/release-0.2.3] Merge remote-tracking branch 'public/bug6472' into maint-0.2.3
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit ce4add498f6af197a0e856d262825d547f898305 Merge: 991a8ac 223e7cf Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Aug 24 12:51:02 2012 -0400 Merge remote-tracking branch 'public/bug6472' into maint-0.2.3 changes/bug6472 | 4 ++++ src/or/dns.c | 16 ++++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-)

1 0

[tor/release-0.2.3] When iterating over connections pending DNS, skip marked ones
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit 223e7cfabec5a75a7acd919210f838511e39cb16 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Aug 17 16:46:11 2012 -0400 When iterating over connections pending DNS, skip marked ones Failure to do this would lead to double-free cases and similar, especially when the exit's DNS was broken. See bug 6472 for full details; this is a fix for 6472. Anonymous patch from "cypherpunks" on trac. --- changes/bug6472 | 4 ++++ src/or/dns.c | 16 ++++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-) diff --git a/changes/bug6472 b/changes/bug6472 new file mode 100644 index 0000000..dcd42eb --- /dev/null +++ b/changes/bug6472 @@ -0,0 +1,4 @@ + o Minor bugfixes: + - Avoid a pair of double-free and use-after-mark bugs that can + occur with certain timings in canceled and re-received DNS + requests. Fix for bug 6472; bugfix on 0.0.7rc1. diff --git a/src/or/dns.c b/src/or/dns.c index 3e88fad..78893bf 100644 --- a/src/or/dns.c +++ b/src/or/dns.c @@ -450,16 +450,17 @@ purge_expired_resolves(time_t now) if (resolve->pending_connections) { log_debug(LD_EXIT, "Closing pending connections on timed-out DNS resolve!"); - tor_fragile_assert(); while (resolve->pending_connections) { pend = resolve->pending_connections; resolve->pending_connections = pend->next; /* Connections should only be pending if they have no socket. */ tor_assert(!SOCKET_OK(pend->conn->_base.s)); pendconn = pend->conn; - connection_edge_end(pendconn, END_STREAM_REASON_TIMEOUT); - circuit_detach_stream(circuit_get_by_edge_conn(pendconn), pendconn); - connection_free(TO_CONN(pendconn)); + if (!pendconn->_base.marked_for_close) { + connection_edge_end(pendconn, END_STREAM_REASON_TIMEOUT); + circuit_detach_stream(circuit_get_by_edge_conn(pendconn), pendconn); + connection_free(TO_CONN(pendconn)); + } tor_free(pend); } } @@ -1091,6 +1092,13 @@ dns_found_answer(const char *address, uint8_t is_reverse, uint32_t addr, pendconn = pend->conn; /* don't pass complex things to the connection_mark_for_close macro */ assert_connection_ok(TO_CONN(pendconn),time(NULL)); + if (pendconn->_base.marked_for_close) { + /* prevent double-remove. */ + pendconn->_base.state = EXIT_CONN_STATE_RESOLVEFAILED; + resolve->pending_connections = pend->next; + tor_free(pend); + continue; + } tor_addr_from_ipv4h(&pendconn->_base.addr, addr); pendconn->address_ttl = ttl;

1 0

[tor/release-0.2.3] Disable extending to private/internal addresses by default
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit b7c172c9ec762363562220a354feefc521970d7c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 11:16:44 2012 -0400 Disable extending to private/internal addresses by default This is important, since otherwise an attacker can use timing info to probe the internal network. Also, add an option (ExtendAllowPrivateAddresses) so that TestingTorNetwork won't break. Fix for bug 6710; bugfix on all released versions of Tor. --- changes/bug6710 | 7 +++++++ doc/tor.1.txt | 6 ++++++ src/or/circuitbuild.c | 7 +++++++ src/or/config.c | 2 ++ src/or/or.h | 4 +++- 5 files changed, 25 insertions(+), 1 deletions(-) diff --git a/changes/bug6710 b/changes/bug6710 new file mode 100644 index 0000000..69a3c7e --- /dev/null +++ b/changes/bug6710 @@ -0,0 +1,7 @@ + o Major bugfixes (security): + - Reject any attempt to extend to an internal address. Without + this fix, a router could be used to probe addresses on an + internal network to see whether they were accepting + connections. Fix for bug 6710; bugfix on all released versions + of Tor. + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index e7ba848..7e0751b 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1470,6 +1470,11 @@ is non-zero): its extra-info documents that it uploads to the directory authorities. (Default: 1) +**ExtendAllowPrivateAddresses** **0**|**1**:: + When this option is enabled, Tor routers allow EXTEND request to + localhost, RFC1918 addresses, and so on. This can create security issues; + you should probably leave it off. (Default: 0) + DIRECTORY SERVER OPTIONS ------------------------ @@ -1795,6 +1800,7 @@ The following options are used for running a testing Tor network. ClientRejectInternalAddresses 0 CountPrivateBandwidth 1 ExitPolicyRejectPrivate 0 + ExtendAllowPrivateAddresses 1 V3AuthVotingInterval 5 minutes V3AuthVoteDelay 20 seconds V3AuthDistDelay 20 seconds diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 39a223b..f11bebf 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2432,6 +2432,13 @@ circuit_extend(cell_t *cell, circuit_t *circ) return -1; } + if (tor_addr_is_internal(&n_addr, 0) && + !get_options()->ExtendAllowPrivateAddresses) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Client asked me to extend to a private address"); + return -1; + } + /* Check if they asked us for 0000..0000. We support using * an empty fingerprint for the first hop (e.g. for a bridge relay), * but we don't want to let people send us extend cells for empty diff --git a/src/or/config.c b/src/or/config.c index 3970808..d5e80cc 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -276,6 +276,7 @@ static config_var_t _option_vars[] = { V(ExitPolicy, LINELIST, NULL), V(ExitPolicyRejectPrivate, BOOL, "1"), V(ExitPortStatistics, BOOL, "0"), + V(ExtendAllowPrivateAddresses, BOOL, "0"), V(ExtraInfoStatistics, BOOL, "1"), #if defined (WINCE) @@ -473,6 +474,7 @@ static const config_var_t testing_tor_network_defaults[] = { V(ClientRejectInternalAddresses, BOOL, "0"), V(CountPrivateBandwidth, BOOL, "1"), V(ExitPolicyRejectPrivate, BOOL, "0"), + V(ExtendAllowPrivateAddresses, BOOL, "1"), V(V3AuthVotingInterval, INTERVAL, "5 minutes"), V(V3AuthVoteDelay, INTERVAL, "20 seconds"), V(V3AuthDistDelay, INTERVAL, "20 seconds"), diff --git a/src/or/or.h b/src/or/or.h index 908daa6..9074083 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3029,8 +3029,10 @@ typedef struct { config_line_t *RecommendedVersions; config_line_t *RecommendedClientVersions; config_line_t *RecommendedServerVersions; - /** Whether dirservers refuse router descriptors with private IPs. */ + /** Whether dirservers allow router descriptors with private IPs. */ int DirAllowPrivateAddresses; + /** Whether routers accept EXTEND cells to routers with private IPs. */ + int ExtendAllowPrivateAddresses; char *User; /**< Name of user to run Tor as. */ char *Group; /**< Name of group to run Tor as. */ config_line_t *ORPort_lines; /**< Ports to listen on for OR connections. */

1 0

[tor/release-0.2.3] Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3
by arma＠torproject.org 04 Sep '12

04 Sep '12

commit 443e4ae1ee0520cead27dd3a21e9f79b1bed8f8b Merge: ce4add4 1c30e6a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:07:04 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3 Conflicts: src/or/policies.c changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-) diff --cc src/or/policies.c index 3018803,55d08af..6e98421 --- a/src/or/policies.c +++ b/src/or/policies.c @@@ -711,8 -684,12 +711,12 @@@ compare_tor_addr_to_addr_policy(const t if (!policy) { /* no policy? accept all. */ return ADDR_POLICY_ACCEPTED; - } else if (tor_addr_is_null(addr)) { + } else if (addr == NULL || tor_addr_is_null(addr)) { - tor_assert(port != 0); + if (port == 0) { + log_info(LD_BUG, "Rejecting null address with 0 port (family %d)", + addr ? tor_addr_family(addr) : -1); + return ADDR_POLICY_REJECTED; + } return compare_unknown_tor_addr_to_addr_policy(port, policy); } else if (port == 0) { return compare_known_tor_addr_to_addr_policy_noport(addr, policy);

1 0