- tor-commits - lists.torproject.org

[torbrowser/master] bump libpng and noscript versions
by erinn＠torproject.org 06 Jul '12

06 Jul '12

commit 57fd7addc26d46d04ea29b7a98ba5777baac06a3 Author: Erinn Clark <erinn(a)torproject.org> Date: Fri Jul 6 15:07:24 2012 +0200 bump libpng and noscript versions --- build-scripts/versions.mk | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/build-scripts/versions.mk b/build-scripts/versions.mk index 327b873..d7507d8 100644 --- a/build-scripts/versions.mk +++ b/build-scripts/versions.mk @@ -4,7 +4,7 @@ RELEASE_VER=2.2.37 ZLIB_VER=1.2.7 OPENSSL_VER=1.0.1c -LIBPNG_VER=1.5.10 +LIBPNG_VER=1.5.11 QT_VER=4.8.1 VIDALIA_VER=0.2.19 LIBEVENT_VER=2.0.19-stable @@ -14,7 +14,7 @@ FIREFOX_VER=10.0.5esr MOZBUILD_VER=1.5.1 PYMAKE_VER=87d436cd8974 TORBUTTON_VER=1.4.6 -NOSCRIPT_VER=2.4.4 +NOSCRIPT_VER=2.4.7 HTTPSEVERYWHERE_VER=2.0.5 OTR_VER=3.2.0 OBFSPROXY_VER=0.1.4

1 0

[torbrowser/master] disable the firefox crashreporter on Windows and Linux
by erinn＠torproject.org 06 Jul '12

06 Jul '12

commit a17203c8c017fbac1a643057b41618329f94fb76 Author: Erinn Clark <erinn(a)torproject.org> Date: Fri Jul 6 15:09:26 2012 +0200 disable the firefox crashreporter on Windows and Linux --- build-scripts/config/dot_mozconfig | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/build-scripts/config/dot_mozconfig b/build-scripts/config/dot_mozconfig index bb500b8..2cb11ed 100755 --- a/build-scripts/config/dot_mozconfig +++ b/build-scripts/config/dot_mozconfig @@ -12,3 +12,4 @@ ac_add_options --enable-strip ac_add_options --disable-tests ac_add_options --disable-debug ac_add_options --disable-maintenance-service +ac_add_options --disable-crashreporter

1 0

[torbrowser/master] Merge branch 'maint-2.2' into maint-2.3
by erinn＠torproject.org 06 Jul '12

06 Jul '12

commit f4fae2b474aacc7d5eeb940ea37072fe4b44c3e8 Merge: 75d8523 57fd7ad Author: Erinn Clark <erinn(a)torproject.org> Date: Fri Jul 6 15:07:44 2012 +0200 Merge branch 'maint-2.2' into maint-2.3 build-scripts/versions.mk | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)

1 0

[torbrowser/master] Merge branch 'maint-2.2' into maint-2.3
by erinn＠torproject.org 06 Jul '12

06 Jul '12

commit 349f942f6fd4eafaefa5c28c3d8563126214317a Merge: f4fae2b a17203c Author: Erinn Clark <erinn(a)torproject.org> Date: Fri Jul 6 15:09:44 2012 +0200 Merge branch 'maint-2.2' into maint-2.3 build-scripts/config/dot_mozconfig | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)

1 0

[tor/release-0.2.3] bump to 0.2.3.19-rc
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 513ae1941f22e32d8cb7a128ed6f8ffa95316ad1 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jul 6 09:01:18 2012 -0400 bump to 0.2.3.19-rc --- configure.in | 2 +- contrib/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.in b/configure.in index 1db7d08..344cf28 100644 --- a/configure.in +++ b/configure.in @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2012, The Tor Project, Inc. dnl See LICENSE for licensing information AC_INIT -AM_INIT_AUTOMAKE(tor, 0.2.3.18-rc-dev) +AM_INIT_AUTOMAKE(tor, 0.2.3.19-rc) AM_CONFIG_HEADER(orconfig.h) AC_CANONICAL_HOST diff --git a/contrib/tor-mingw.nsi.in b/contrib/tor-mingw.nsi.in index 2133a47..26442af 100644 --- a/contrib/tor-mingw.nsi.in +++ b/contrib/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.3.18-rc-dev" +!define VERSION "0.2.3.19-rc" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index d780d5d..e410dde 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -232,7 +232,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.3.18-rc-dev" +#define VERSION "0.2.3.19-rc"

1 0

[tor/master] Fix a bug handling SENDME cells on nonexistent streams.
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 419f541aa737d3ab230ec2595d0614e2d94a5e44 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jul 6 07:29:54 2012 -0400 Fix a bug handling SENDME cells on nonexistent streams. This could result in bizarre window values. Report and patch contributed pseudymously. Fixes part of bug 6271. This bug was introduced before the first Tor release, in svn commit r152. (bug 6271, part a.) --- changes/bug6271 | 7 +++++++ src/or/relay.c | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletions(-) diff --git a/changes/bug6271 b/changes/bug6271 new file mode 100644 index 0000000..06b129f --- /dev/null +++ b/changes/bug6271 @@ -0,0 +1,7 @@ + o Major bugfixes + + - Fix a bug handling SENDME cells on nonexistent streams that + could result in bizarre window values. Report and patch + contributed pseudymously. Fixes part of bug 6271. This bug + was introduced before the first Tor release, in svn commit + r152. diff --git a/src/or/relay.c b/src/or/relay.c index b637fad..50c1455 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1220,7 +1220,7 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, "'connected' received, no conn attached anymore. Ignoring."); return 0; case RELAY_COMMAND_SENDME: - if (!conn) { + if (!rh.stream_id) { if (layer_hint) { layer_hint->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP,"circ-level sendme at origin, packagewindow %d.", @@ -1235,6 +1235,11 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, } return 0; } + if (!conn) { + log_info(domain,"sendme cell dropped, unknown stream (streamid %d).", + rh.stream_id); + return 0; + } conn->package_window += STREAMWINDOW_INCREMENT; log_debug(domain,"stream-level sendme, packagewindow now %d.", conn->package_window);

1 0

[tor/master] Merge remote-tracking branch 'nickm/bug6271_part_a' into maint-0.2.3
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 27ec0248d2460cdfc52462d313272c206ab46f02 Merge: 62c1311 419f541 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jul 6 08:57:29 2012 -0400 Merge remote-tracking branch 'nickm/bug6271_part_a' into maint-0.2.3 changes/bug6271 | 7 +++++++ src/or/relay.c | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.2.3'
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 1fee920999bb51e2831b03faff7dabbcf20355e7 Merge: 7e1a0bb 27ec024 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jul 6 08:59:26 2012 -0400 Merge branch 'maint-0.2.3' changes/bug6271 | 7 +++++++ src/or/relay.c | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletions(-)

1 0

[tor/release-0.2.3] bump version to 0.2.3.18-rc-dev
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 9c5a118272bfbb7d4c287f4310237bf90a404c63 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 28 16:01:55 2012 -0400 bump version to 0.2.3.18-rc-dev --- configure.in | 2 +- contrib/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.in b/configure.in index e9ef4f8..1db7d08 100644 --- a/configure.in +++ b/configure.in @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2012, The Tor Project, Inc. dnl See LICENSE for licensing information AC_INIT -AM_INIT_AUTOMAKE(tor, 0.2.3.18-rc) +AM_INIT_AUTOMAKE(tor, 0.2.3.18-rc-dev) AM_CONFIG_HEADER(orconfig.h) AC_CANONICAL_HOST diff --git a/contrib/tor-mingw.nsi.in b/contrib/tor-mingw.nsi.in index 75b2567..2133a47 100644 --- a/contrib/tor-mingw.nsi.in +++ b/contrib/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.3.18-rc" +!define VERSION "0.2.3.18-rc-dev" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index a5bd2ee..d780d5d 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -232,7 +232,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.3.18-rc" +#define VERSION "0.2.3.18-rc-dev"

1 0

[tor/release-0.2.3] Detect bug 6252 (unexpected sendme cell)
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit c32ec9c425e9539bcc8ede95612e2d331c2cc2dd Author: Roger Dingledine <arma(a)torproject.org> Date: Thu Jun 28 14:00:01 2012 -0400 Detect bug 6252 (unexpected sendme cell) I only check on circuits, not streams, since bloating your stream window past the initial circuit window can't help you much. Also, I compare to CIRCWINDOW_START_MAX so we don't have surprising races if we lower CIRCWINDOW_START for an experiment. --- changes/bug6252 | 8 ++++++++ src/or/relay.c | 14 ++++++++++++++ 2 files changed, 22 insertions(+), 0 deletions(-) diff --git a/changes/bug6252 b/changes/bug6252 new file mode 100644 index 0000000..0d29203 --- /dev/null +++ b/changes/bug6252 @@ -0,0 +1,8 @@ + o Security fixes: + - Tear down the circuit if we get an unexpected SENDME cell. Clients + could use this trick to make their circuits receive cells faster + than our flow control would have allowed, or to gum up the network, + or possibly to do targeted memory denial-of-service attacks on + entry nodes. Fixes bug 6252. Bugfix on the 54th commit on Tor -- + from July 2002, before the release of Tor 0.0.0. + diff --git a/src/or/relay.c b/src/or/relay.c index 3f894bf..4ab4403 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1265,11 +1265,25 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, case RELAY_COMMAND_SENDME: if (!conn) { if (layer_hint) { + if (layer_hint->package_window + CIRCWINDOW_INCREMENT > + CIRCWINDOW_START_MAX) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Bug/attack: unexpected sendme cell from exit relay. " + "Closing circ."); + return -END_CIRC_REASON_TORPROTOCOL; + } layer_hint->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP,"circ-level sendme at origin, packagewindow %d.", layer_hint->package_window); circuit_resume_edge_reading(circ, layer_hint); } else { + if (circ->package_window + CIRCWINDOW_INCREMENT > + CIRCWINDOW_START_MAX) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Bug/attack: unexpected sendme cell from client. " + "Closing circ."); + return -END_CIRC_REASON_TORPROTOCOL; + } circ->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP, "circ-level sendme at non-origin, packagewindow %d.",

1 0