- tor-commits - lists.torproject.org

[tor/master] Do not assert when comparing a null address/port against a policy
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 11:52:51 2012 -0400 Do not assert when comparing a null address/port against a policy This can create a remote crash opportunity for/against directory authorities. --- changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-) diff --git a/changes/bug6690 b/changes/bug6690 new file mode 100644 index 0000000..99d4297 --- /dev/null +++ b/changes/bug6690 @@ -0,0 +1,7 @@ + o Major bugfixes (security): + - Do not crash when comparing an address with port value 0 to an + address policy. This bug could have been used to cause a remote + assertion failure by or against directory authorities, or to + allow some applications to crash clients. Fixes bug 6690; bugfix + on 0.2.1.10-alpha. + diff --git a/src/or/policies.c b/src/or/policies.c index c870360..55d08af 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -685,7 +685,11 @@ compare_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port, /* no policy? accept all. */ return ADDR_POLICY_ACCEPTED; } else if (tor_addr_is_null(addr)) { - tor_assert(port != 0); + if (port == 0) { + log_info(LD_BUG, "Rejecting null address with 0 port (family %d)", + addr ? tor_addr_family(addr) : -1); + return ADDR_POLICY_REJECTED; + } return compare_unknown_tor_addr_to_addr_policy(port, policy); } else if (port == 0) { return compare_known_tor_addr_to_addr_policy_noport(addr, policy);

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 443e4ae1ee0520cead27dd3a21e9f79b1bed8f8b Merge: ce4add4 1c30e6a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:07:04 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3 Conflicts: src/or/policies.c changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-) diff --cc src/or/policies.c index 3018803,55d08af..6e98421 --- a/src/or/policies.c +++ b/src/or/policies.c @@@ -711,8 -684,12 +711,12 @@@ compare_tor_addr_to_addr_policy(const t if (!policy) { /* no policy? accept all. */ return ADDR_POLICY_ACCEPTED; - } else if (tor_addr_is_null(addr)) { + } else if (addr == NULL || tor_addr_is_null(addr)) { - tor_assert(port != 0); + if (port == 0) { + log_info(LD_BUG, "Rejecting null address with 0 port (family %d)", + addr ? tor_addr_family(addr) : -1); + return ADDR_POLICY_REJECTED; + } return compare_unknown_tor_addr_to_addr_policy(port, policy); } else if (port == 0) { return compare_known_tor_addr_to_addr_policy_noport(addr, policy);

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3'
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit e232938ec82c8c35b99331995d1aeaca67ba9ec1 Merge: 0ccd57f 443e4ae Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:09:29 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-)

1 0

[tor/maint-0.2.3] Do not assert when comparing a null address/port against a policy
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 11:52:51 2012 -0400 Do not assert when comparing a null address/port against a policy This can create a remote crash opportunity for/against directory authorities. --- changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-) diff --git a/changes/bug6690 b/changes/bug6690 new file mode 100644 index 0000000..99d4297 --- /dev/null +++ b/changes/bug6690 @@ -0,0 +1,7 @@ + o Major bugfixes (security): + - Do not crash when comparing an address with port value 0 to an + address policy. This bug could have been used to cause a remote + assertion failure by or against directory authorities, or to + allow some applications to crash clients. Fixes bug 6690; bugfix + on 0.2.1.10-alpha. + diff --git a/src/or/policies.c b/src/or/policies.c index c870360..55d08af 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -685,7 +685,11 @@ compare_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port, /* no policy? accept all. */ return ADDR_POLICY_ACCEPTED; } else if (tor_addr_is_null(addr)) { - tor_assert(port != 0); + if (port == 0) { + log_info(LD_BUG, "Rejecting null address with 0 port (family %d)", + addr ? tor_addr_family(addr) : -1); + return ADDR_POLICY_REJECTED; + } return compare_unknown_tor_addr_to_addr_policy(port, policy); } else if (port == 0) { return compare_known_tor_addr_to_addr_policy_noport(addr, policy);

1 0

[tor/maint-0.2.3] Merge branch 'bug6690_022' into maint-0.2.2
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 1c30e6abc93fa086a14d01d838066581a3657285 Merge: d48cebc 62d9628 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:03:48 2012 -0400 Merge branch 'bug6690_022' into maint-0.2.2 changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-)

1 0

[tor/maint-0.2.3] Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 443e4ae1ee0520cead27dd3a21e9f79b1bed8f8b Merge: ce4add4 1c30e6a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:07:04 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3 Conflicts: src/or/policies.c changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-) diff --cc src/or/policies.c index 3018803,55d08af..6e98421 --- a/src/or/policies.c +++ b/src/or/policies.c @@@ -711,8 -684,12 +711,12 @@@ compare_tor_addr_to_addr_policy(const t if (!policy) { /* no policy? accept all. */ return ADDR_POLICY_ACCEPTED; - } else if (tor_addr_is_null(addr)) { + } else if (addr == NULL || tor_addr_is_null(addr)) { - tor_assert(port != 0); + if (port == 0) { + log_info(LD_BUG, "Rejecting null address with 0 port (family %d)", + addr ? tor_addr_family(addr) : -1); + return ADDR_POLICY_REJECTED; + } return compare_unknown_tor_addr_to_addr_policy(port, policy); } else if (port == 0) { return compare_known_tor_addr_to_addr_policy_noport(addr, policy);

1 0

[tor/maint-0.2.2] Merge branch 'bug6690_022' into maint-0.2.2
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 1c30e6abc93fa086a14d01d838066581a3657285 Merge: d48cebc 62d9628 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:03:48 2012 -0400 Merge branch 'bug6690_022' into maint-0.2.2 changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-)

1 0

[tor/maint-0.2.2] Do not assert when comparing a null address/port against a policy
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 62d96284f7e0f81c40d5df7e53dd7b4dfe7e56a5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 11:52:51 2012 -0400 Do not assert when comparing a null address/port against a policy This can create a remote crash opportunity for/against directory authorities. --- changes/bug6690 | 7 +++++++ src/or/policies.c | 6 +++++- 2 files changed, 12 insertions(+), 1 deletions(-) diff --git a/changes/bug6690 b/changes/bug6690 new file mode 100644 index 0000000..99d4297 --- /dev/null +++ b/changes/bug6690 @@ -0,0 +1,7 @@ + o Major bugfixes (security): + - Do not crash when comparing an address with port value 0 to an + address policy. This bug could have been used to cause a remote + assertion failure by or against directory authorities, or to + allow some applications to crash clients. Fixes bug 6690; bugfix + on 0.2.1.10-alpha. + diff --git a/src/or/policies.c b/src/or/policies.c index c870360..55d08af 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -685,7 +685,11 @@ compare_tor_addr_to_addr_policy(const tor_addr_t *addr, uint16_t port, /* no policy? accept all. */ return ADDR_POLICY_ACCEPTED; } else if (tor_addr_is_null(addr)) { - tor_assert(port != 0); + if (port == 0) { + log_info(LD_BUG, "Rejecting null address with 0 port (family %d)", + addr ? tor_addr_family(addr) : -1); + return ADDR_POLICY_REJECTED; + } return compare_unknown_tor_addr_to_addr_policy(port, policy); } else if (port == 0) { return compare_known_tor_addr_to_addr_policy_noport(addr, policy);

1 0

[compass/master] Add tooltips and expand some table headers
by karsten＠torproject.org 27 Aug '12

27 Aug '12

commit 4b6a138bcbba4d91e8056694d800f29e5dac74d0 Author: Sathyanarayanan Gunasekaran <gsathya.ceg(a)gmail.com> Date: Mon Aug 27 20:47:01 2012 +0530 Add tooltips and expand some table headers Tooltips now explain what some of the non-obvious table headers stand for. Some of the abbreviated table headers are expanded. --- static/js/bootstrap-tooltip.js | 275 ++++++++++++++++++++++++++++++++++++++++ templates/result.html | 23 ++-- 2 files changed, 287 insertions(+), 11 deletions(-) diff --git a/static/js/bootstrap-tooltip.js b/static/js/bootstrap-tooltip.js new file mode 100755 index 0000000..b476f1c --- /dev/null +++ b/static/js/bootstrap-tooltip.js @@ -0,0 +1,275 @@ +/* =========================================================== + * bootstrap-tooltip.js v2.0.4 + * http://twitter.github.com/bootstrap/javascript.html#tooltips + * Inspired by the original jQuery.tipsy by Jason Frame + * =========================================================== + * Copyright 2012 Twitter, Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ========================================================== */ + + +!function ($) { + + "use strict"; // jshint ;_; + + + /* TOOLTIP PUBLIC CLASS DEFINITION + * =============================== */ + + var Tooltip = function (element, options) { + this.init('tooltip', element, options) + } + + Tooltip.prototype = { + + constructor: Tooltip + + , init: function (type, element, options) { + var eventIn + , eventOut + + this.type = type + this.$element = $(element) + this.options = this.getOptions(options) + this.enabled = true + + if (this.options.trigger != 'manual') { + eventIn = this.options.trigger == 'hover' ? 'mouseenter' : 'focus' + eventOut = this.options.trigger == 'hover' ? 'mouseleave' : 'blur' + this.$element.on(eventIn, this.options.selector, $.proxy(this.enter, this)) + this.$element.on(eventOut, this.options.selector, $.proxy(this.leave, this)) + } + + this.options.selector ? + (this._options = $.extend({}, this.options, { trigger: 'manual', selector: '' })) : + this.fixTitle() + } + + , getOptions: function (options) { + options = $.extend({}, $.fn[this.type].defaults, options, this.$element.data()) + + if (options.delay && typeof options.delay == 'number') { + options.delay = { + show: options.delay + , hide: options.delay + } + } + + return options + } + + , enter: function (e) { + var self = $(e.currentTarget)[this.type](this._options).data(this.type) + + if (!self.options.delay || !self.options.delay.show) return self.show() + + clearTimeout(this.timeout) + self.hoverState = 'in' + this.timeout = setTimeout(function() { + if (self.hoverState == 'in') self.show() + }, self.options.delay.show) + } + + , leave: function (e) { + var self = $(e.currentTarget)[this.type](this._options).data(this.type) + + if (this.timeout) clearTimeout(this.timeout) + if (!self.options.delay || !self.options.delay.hide) return self.hide() + + self.hoverState = 'out' + this.timeout = setTimeout(function() { + if (self.hoverState == 'out') self.hide() + }, self.options.delay.hide) + } + + , show: function () { + var $tip + , inside + , pos + , actualWidth + , actualHeight + , placement + , tp + + if (this.hasContent() && this.enabled) { + $tip = this.tip() + this.setContent() + + if (this.options.animation) { + $tip.addClass('fade') + } + + placement = typeof this.options.placement == 'function' ? + this.options.placement.call(this, $tip[0], this.$element[0]) : + this.options.placement + + inside = /in/.test(placement) + + $tip + .remove() + .css({ top: 0, left: 0, display: 'block' }) + .appendTo(inside ? this.$element : document.body) + + pos = this.getPosition(inside) + + actualWidth = $tip[0].offsetWidth + actualHeight = $tip[0].offsetHeight + + switch (inside ? placement.split(' ')[1] : placement) { + case 'bottom': + tp = {top: pos.top + pos.height, left: pos.left + pos.width / 2 - actualWidth / 2} + break + case 'top': + tp = {top: pos.top - actualHeight, left: pos.left + pos.width / 2 - actualWidth / 2} + break + case 'left': + tp = {top: pos.top + pos.height / 2 - actualHeight / 2, left: pos.left - actualWidth} + break + case 'right': + tp = {top: pos.top + pos.height / 2 - actualHeight / 2, left: pos.left + pos.width} + break + } + + $tip + .css(tp) + .addClass(placement) + .addClass('in') + } + } + + , isHTML: function(text) { + // html string detection logic adapted from jQuery + return typeof text != 'string' + || ( text.charAt(0) === "<" + && text.charAt( text.length - 1 ) === ">" + && text.length >= 3 + ) || /^(?:[^<]*<[\w\W]+>[^>]*$)/.exec(text) + } + + , setContent: function () { + var $tip = this.tip() + , title = this.getTitle() + + $tip.find('.tooltip-inner')[this.isHTML(title) ? 'html' : 'text'](title) + $tip.removeClass('fade in top bottom left right') + } + + , hide: function () { + var that = this + , $tip = this.tip() + + $tip.removeClass('in') + + function removeWithAnimation() { + var timeout = setTimeout(function () { + $tip.off($.support.transition.end).remove() + }, 500) + + $tip.one($.support.transition.end, function () { + clearTimeout(timeout) + $tip.remove() + }) + } + + $.support.transition && this.$tip.hasClass('fade') ? + removeWithAnimation() : + $tip.remove() + } + + , fixTitle: function () { + var $e = this.$element + if ($e.attr('title') || typeof($e.attr('data-original-title')) != 'string') { + $e.attr('data-original-title', $e.attr('title') || '').removeAttr('title') + } + } + + , hasContent: function () { + return this.getTitle() + } + + , getPosition: function (inside) { + return $.extend({}, (inside ? {top: 0, left: 0} : this.$element.offset()), { + width: this.$element[0].offsetWidth + , height: this.$element[0].offsetHeight + }) + } + + , getTitle: function () { + var title + , $e = this.$element + , o = this.options + + title = $e.attr('data-original-title') + || (typeof o.title == 'function' ? o.title.call($e[0]) : o.title) + + return title + } + + , tip: function () { + return this.$tip = this.$tip || $(this.options.template) + } + + , validate: function () { + if (!this.$element[0].parentNode) { + this.hide() + this.$element = null + this.options = null + } + } + + , enable: function () { + this.enabled = true + } + + , disable: function () { + this.enabled = false + } + + , toggleEnabled: function () { + this.enabled = !this.enabled + } + + , toggle: function () { + this[this.tip().hasClass('in') ? 'hide' : 'show']() + } + + } + + + /* TOOLTIP PLUGIN DEFINITION + * ========================= */ + + $.fn.tooltip = function ( option ) { + return this.each(function () { + var $this = $(this) + , data = $this.data('tooltip') + , options = typeof option == 'object' && option + if (!data) $this.data('tooltip', (data = new Tooltip(this, options))) + if (typeof option == 'string') data[option]() + }) + } + + $.fn.tooltip.Constructor = Tooltip + + $.fn.tooltip.defaults = { + animation: true + , placement: 'top' + , selector: false + , template: '<div class="tooltip"><div class="tooltip-arrow"></div><div class="tooltip-inner"></div></div>' + , trigger: 'hover' + , title: '' + , delay: 0 + } + +}(window.jQuery); diff --git a/templates/result.html b/templates/result.html index c3c9c44..8dc3b6e 100644 --- a/templates/result.html +++ b/templates/result.html @@ -48,24 +48,23 @@ </div> <div class="container"> - <div class="hero-unit"> <table class="table table-striped table-condensed table-hover table-bordered"> <thead> <tr> <th>#</th> - <th>CW</th> - <th>Advertised Bandwidth</th> - <th>P_Guard</th> - <th>P_Middle</th> - <th>P_Exit</th> + <th><span rel="tooltip" title="Relative bandwidth weight assigned to this relay by the directory authorities">Consensus Weights</span></th> + <th><span rel="tooltip" title="Relative advertised bandwidth of this relay compared to the total advertised bandwidth in the network">Advertised Bandwidth</span></th> + <th><span rel="tooltip" title=" Probability of this relay to be selected for the guard position">Guard Probability</span></th> + <th><span rel="tooltip" title="Probability of this relay to be selected for the middle position">Middle Probability</span></th> + <th><span rel="tooltip" title="Probability of this relay to be selected for the exit position">Exit Probability</span></th> <th>Nickname</th> <th>Fingerprint</th> <th>Exit</th> <th>Guard</th> - <th>CC</th> - <th>AS number</th> - <th>AS name</th> + <th>Country</th> + <th>Autonomous System Number</th> + <th>Autonomous System Name</th> </tr> </thead> <tbody> @@ -114,11 +113,14 @@  <script src="{{ url_for('static', filename='js/jquery-1.8.0.min.js') }}"></script> + <script src="{{ url_for('static', filename='js/bootstrap.min.js') }}"></script> <script src="{{ url_for('static', filename='js/custom.js') }}"></script> + <script src="{{ url_for('static', filename='js/bootstrap-tooltip.js') }}"></script> - <script> + <script> $(document).ready(function() { addListener(); + $('span[rel=tooltip]').tooltip(); }); </script> <!-- @@ -128,7 +130,6 @@ <script src="{{ url_for('static', filename='js/bootstrap-dropdown.js') }}"></script> <script src="{{ url_for('static', filename='js/bootstrap-scrollspy.js') }}"></script> <script src="{{ url_for('static', filename='js/bootstrap-tab.js') }}"></script> - <script src="{{ url_for('static', filename='js/bootstrap-tooltip.js') }}"></script> <script src="{{ url_for('static', filename='js/bootstrap-popover.js') }}"></script> <script src="{{ url_for('static', filename='js/bootstrap-button.js') }}"></script> <script src="{{ url_for('static', filename='js/bootstrap-collapse.js') }}"></script>

1 0

[tor/master] and fix them here too
by arma＠torproject.org 27 Aug '12

27 Aug '12

commit 0ccd57f0f247171d43e325d29bfcc102d877ca1c Author: Roger Dingledine <arma(a)torproject.org> Date: Mon Aug 27 14:28:00 2012 -0400 and fix them here too --- ChangeLog | 5 ++--- ReleaseNotes | 5 ++--- changes/note-releasenote-fix | 10 ---------- 3 files changed, 4 insertions(+), 16 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3a1ad77..fa320a5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,6 @@ Changes in version 0.2.2.38 - 2012-08-12 - Tor 0.2.2.38 fixes a rare race condition that can crash exit relays; - fixes a remotely triggerable crash bug; and fixes a timing attack that - could in theory leak path information. + Tor 0.2.2.38 fixes a remotely triggerable crash bug, and fixes a timing + attack that could in theory leak path information. o Security fixes: - Avoid an uninitialized memory read when reading a vote or consensus diff --git a/ReleaseNotes b/ReleaseNotes index 2782d37..0d710d9 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -4,9 +4,8 @@ of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. Changes in version 0.2.2.38 - 2012-08-12 - Tor 0.2.2.38 fixes a rare race condition that can crash exit relays; - fixes a remotely triggerable crash bug; and fixes a timing attack that - could in theory leak path information. + Tor 0.2.2.38 fixes a remotely triggerable crash bug, and fixes a timing + attack that could in theory leak path information. o Security fixes: - Avoid an uninitialized memory read when reading a vote or consensus diff --git a/changes/note-releasenote-fix b/changes/note-releasenote-fix deleted file mode 100644 index 586e2d2..0000000 --- a/changes/note-releasenote-fix +++ /dev/null @@ -1,10 +0,0 @@ - - o Documentation fix: - Remove the following entry from the 0.2.2.38 changelog, since the patch - was not, in fact, included in 0.2.2.38: - . - - Avoid read-from-freed-memory and double-free bugs that could occur - when a DNS request fails while launching it. Fixes bug 6480; - bugfix on 0.2.0.1-alpha. - . - Fixes bug 6657; bugfix on 0.2.2.38.

1 0