- tor-commits - lists.torproject.org

[tor/release-0.2.3] Revert "Detect bug 6252 (unexpected sendme cell)"
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit d13389b30ec2e17a8f08a00f82fac420ae968cd1 Author: Roger Dingledine <arma(a)torproject.org> Date: Sun Jul 1 17:36:35 2012 -0400 Revert "Detect bug 6252 (unexpected sendme cell)" This reverts commit c32ec9c425e9539bcc8ede95612e2d331c2cc2dd. It turns out the two sides of the circuit don't actually stay in sync, so it is perfectly normal for the circuit window on the exit relay to grow to 2000+. We should fix that bug and then reconsider this patch. --- changes/bug6252 | 8 -------- src/or/relay.c | 14 -------------- 2 files changed, 0 insertions(+), 22 deletions(-) diff --git a/changes/bug6252 b/changes/bug6252 deleted file mode 100644 index 0d29203..0000000 --- a/changes/bug6252 +++ /dev/null @@ -1,8 +0,0 @@ - o Security fixes: - - Tear down the circuit if we get an unexpected SENDME cell. Clients - could use this trick to make their circuits receive cells faster - than our flow control would have allowed, or to gum up the network, - or possibly to do targeted memory denial-of-service attacks on - entry nodes. Fixes bug 6252. Bugfix on the 54th commit on Tor -- - from July 2002, before the release of Tor 0.0.0. - diff --git a/src/or/relay.c b/src/or/relay.c index 4ab4403..3f894bf 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1265,25 +1265,11 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, case RELAY_COMMAND_SENDME: if (!conn) { if (layer_hint) { - if (layer_hint->package_window + CIRCWINDOW_INCREMENT > - CIRCWINDOW_START_MAX) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Bug/attack: unexpected sendme cell from exit relay. " - "Closing circ."); - return -END_CIRC_REASON_TORPROTOCOL; - } layer_hint->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP,"circ-level sendme at origin, packagewindow %d.", layer_hint->package_window); circuit_resume_edge_reading(circ, layer_hint); } else { - if (circ->package_window + CIRCWINDOW_INCREMENT > - CIRCWINDOW_START_MAX) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Bug/attack: unexpected sendme cell from client. " - "Closing circ."); - return -END_CIRC_REASON_TORPROTOCOL; - } circ->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP, "circ-level sendme at non-origin, packagewindow %d.",

1 0

[tor/release-0.2.3] On windows, ENOBUFS starts with WSA. #6296. Fix on 0.2.18-rc
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit e9b33ed1bf4140e3aeda5eb9126027fbe5a3ec5a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jul 5 05:01:00 2012 -0400 On windows, ENOBUFS starts with WSA. #6296. Fix on 0.2.18-rc --- changes/bug6296 | 4 ++++ src/common/compat.h | 3 +++ src/or/connection.c | 4 ++-- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/changes/bug6296 b/changes/bug6296 new file mode 100644 index 0000000..b452b17 --- /dev/null +++ b/changes/bug6296 @@ -0,0 +1,4 @@ + o Minor bugfixes: + + - Instead of ENOBUFS on Windows, say WSAENOBUFS. Fixes + compilation on Windows. Fixes bug 6296; bugfix on 0.2.3.18-rc. diff --git a/src/common/compat.h b/src/common/compat.h index 4efb0c8..42648bb 100644 --- a/src/common/compat.h +++ b/src/common/compat.h @@ -500,6 +500,8 @@ int network_init(void); * the actual errno after a socket operation fails. */ #if defined(_WIN32) +/** Expands to WSA<b>e</b> on Windows, and to <b>e</b> elsewhere. */ +#define SOCK_ERRNO(e) WSA##e /** Return true if e is EAGAIN or the local equivalent. */ #define ERRNO_IS_EAGAIN(e) ((e) == EAGAIN || (e) == WSAEWOULDBLOCK) /** Return true if e is EINPROGRESS or the local equivalent. */ @@ -520,6 +522,7 @@ int network_init(void); int tor_socket_errno(tor_socket_t sock); const char *tor_socket_strerror(int e); #else +#define SOCK_ERRNO(e) e #define ERRNO_IS_EAGAIN(e) ((e) == EAGAIN) #define ERRNO_IS_EINPROGRESS(e) ((e) == EINPROGRESS) #define ERRNO_IS_CONN_EINPROGRESS(e) ((e) == EINPROGRESS) diff --git a/src/or/connection.c b/src/or/connection.c index af5c011..95101ef 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -1336,7 +1336,7 @@ connection_connect(connection_t *conn, const char *address, if (get_n_open_sockets() >= get_options()->_ConnLimit-1) { warn_too_many_conns(); - *socket_error = ENOBUFS; + *socket_error = SOCK_ERRNO(ENOBUFS); return -1; } @@ -1431,7 +1431,7 @@ connection_connect(connection_t *conn, const char *address, conn->s = s; if (connection_add_connecting(conn) < 0) { /* no space, forget it */ - *socket_error = ENOBUFS; + *socket_error = SOCK_ERRNO(ENOBUFS); return -1; } return inprogress ? 0 : 1;

1 0

[tor/release-0.2.3] Fix a bug handling SENDME cells on nonexistent streams.
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 419f541aa737d3ab230ec2595d0614e2d94a5e44 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jul 6 07:29:54 2012 -0400 Fix a bug handling SENDME cells on nonexistent streams. This could result in bizarre window values. Report and patch contributed pseudymously. Fixes part of bug 6271. This bug was introduced before the first Tor release, in svn commit r152. (bug 6271, part a.) --- changes/bug6271 | 7 +++++++ src/or/relay.c | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletions(-) diff --git a/changes/bug6271 b/changes/bug6271 new file mode 100644 index 0000000..06b129f --- /dev/null +++ b/changes/bug6271 @@ -0,0 +1,7 @@ + o Major bugfixes + + - Fix a bug handling SENDME cells on nonexistent streams that + could result in bizarre window values. Report and patch + contributed pseudymously. Fixes part of bug 6271. This bug + was introduced before the first Tor release, in svn commit + r152. diff --git a/src/or/relay.c b/src/or/relay.c index b637fad..50c1455 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1220,7 +1220,7 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, "'connected' received, no conn attached anymore. Ignoring."); return 0; case RELAY_COMMAND_SENDME: - if (!conn) { + if (!rh.stream_id) { if (layer_hint) { layer_hint->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP,"circ-level sendme at origin, packagewindow %d.", @@ -1235,6 +1235,11 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, } return 0; } + if (!conn) { + log_info(domain,"sendme cell dropped, unknown stream (streamid %d).", + rh.stream_id); + return 0; + } conn->package_window += STREAMWINDOW_INCREMENT; log_debug(domain,"stream-level sendme, packagewindow now %d.", conn->package_window);

1 0

[tor/release-0.2.3] Merge remote-tracking branch 'nickm/bug6271_part_a' into maint-0.2.3
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 27ec0248d2460cdfc52462d313272c206ab46f02 Merge: 62c1311 419f541 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jul 6 08:57:29 2012 -0400 Merge remote-tracking branch 'nickm/bug6271_part_a' into maint-0.2.3 changes/bug6271 | 7 +++++++ src/or/relay.c | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletions(-)

1 0

[tor/release-0.2.3] Fix port range in parse_port_range().
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 62c1311b3ab57c61488ecfc8c94fabb5f2c70e6e Author: George Kadianakis <desnacked(a)riseup.net> Date: Fri Jun 22 18:24:06 2012 +0300 Fix port range in parse_port_range(). --- changes/bug6218 | 3 +++ src/common/address.c | 2 +- 2 files changed, 4 insertions(+), 1 deletions(-) diff --git a/changes/bug6218 b/changes/bug6218 new file mode 100644 index 0000000..5d5d108 --- /dev/null +++ b/changes/bug6218 @@ -0,0 +1,3 @@ + o Minor bugfixes: + - Fix wrong TCP port range in parse_port_range(). Fixes bug 6218; + bugfix on 0.2.1.10-alpha. diff --git a/src/common/address.c b/src/common/address.c index 30665fa..e88869f 100644 --- a/src/common/address.c +++ b/src/common/address.c @@ -1526,7 +1526,7 @@ parse_port_range(const char *port, uint16_t *port_min_out, } else if (endptr && *endptr == '-') { port = endptr+1; endptr = NULL; - port_max = (int)tor_parse_long(port, 10, 1, 65536, &ok, &endptr); + port_max = (int)tor_parse_long(port, 10, 1, 65535, &ok, &endptr); if (!ok) { log_warn(LD_GENERAL, "Malformed port %s on address range; rejecting.",

1 0

[tor/maint-0.2.3] Fix a bug handling SENDME cells on nonexistent streams.
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 419f541aa737d3ab230ec2595d0614e2d94a5e44 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jul 6 07:29:54 2012 -0400 Fix a bug handling SENDME cells on nonexistent streams. This could result in bizarre window values. Report and patch contributed pseudymously. Fixes part of bug 6271. This bug was introduced before the first Tor release, in svn commit r152. (bug 6271, part a.) --- changes/bug6271 | 7 +++++++ src/or/relay.c | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletions(-) diff --git a/changes/bug6271 b/changes/bug6271 new file mode 100644 index 0000000..06b129f --- /dev/null +++ b/changes/bug6271 @@ -0,0 +1,7 @@ + o Major bugfixes + + - Fix a bug handling SENDME cells on nonexistent streams that + could result in bizarre window values. Report and patch + contributed pseudymously. Fixes part of bug 6271. This bug + was introduced before the first Tor release, in svn commit + r152. diff --git a/src/or/relay.c b/src/or/relay.c index b637fad..50c1455 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1220,7 +1220,7 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, "'connected' received, no conn attached anymore. Ignoring."); return 0; case RELAY_COMMAND_SENDME: - if (!conn) { + if (!rh.stream_id) { if (layer_hint) { layer_hint->package_window += CIRCWINDOW_INCREMENT; log_debug(LD_APP,"circ-level sendme at origin, packagewindow %d.", @@ -1235,6 +1235,11 @@ connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, } return 0; } + if (!conn) { + log_info(domain,"sendme cell dropped, unknown stream (streamid %d).", + rh.stream_id); + return 0; + } conn->package_window += STREAMWINDOW_INCREMENT; log_debug(domain,"stream-level sendme, packagewindow now %d.", conn->package_window);

1 0

[tor/maint-0.2.3] Merge remote-tracking branch 'nickm/bug6271_part_a' into maint-0.2.3
by arma＠torproject.org 06 Jul '12

06 Jul '12

commit 27ec0248d2460cdfc52462d313272c206ab46f02 Merge: 62c1311 419f541 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jul 6 08:57:29 2012 -0400 Merge remote-tracking branch 'nickm/bug6271_part_a' into maint-0.2.3 changes/bug6271 | 7 +++++++ src/or/relay.c | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletions(-)

1 0

[onionoo/master] Don't escape ' in JSON strings.
by karsten＠torproject.org 06 Jul '12

06 Jul '12

commit e20dd5be4a86760a21aad62d8a7b3adc3d976a45 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Fri Jul 6 11:27:46 2012 +0200 Don't escape ' in JSON strings. Fixes #6309, found by lunar. --- src/org/torproject/onionoo/DetailDataWriter.java | 26 +++++++++++---------- 1 files changed, 14 insertions(+), 12 deletions(-) diff --git a/src/org/torproject/onionoo/DetailDataWriter.java b/src/org/torproject/onionoo/DetailDataWriter.java index 8602093..155c4eb 100644 --- a/src/org/torproject/onionoo/DetailDataWriter.java +++ b/src/org/torproject/onionoo/DetailDataWriter.java @@ -314,6 +314,10 @@ public class DetailDataWriter { return result; } + private static String escapeJSON(String s) { + return StringEscapeUtils.escapeJavaScript(s).replaceAll("\\\\'", "'"); + } + private SortedMap<String, File> updateRelayDetailsFiles( SortedMap<String, File> remainingDetailsFiles) { SortedMap<String, File> result = @@ -395,13 +399,11 @@ public class DetailDataWriter { sb.append("\n]"); if (descriptor.getContact() != null) { sb.append(",\n\"contact\":\"" - + StringEscapeUtils.escapeJavaScript( - descriptor.getContact()) + "\""); + + escapeJSON(descriptor.getContact()) + "\""); } if (descriptor.getPlatform() != null) { sb.append(",\n\"platform\":\"" - + StringEscapeUtils.escapeJavaScript( - descriptor.getPlatform()) + "\""); + + escapeJSON(descriptor.getPlatform()) + "\""); } if (descriptor.getFamilyEntries() != null) { sb.append(",\n\"family\":["); @@ -473,23 +475,23 @@ public class DetailDataWriter { } if (countryName != null) { sb.append(",\n\"country_name\":\"" - + StringEscapeUtils.escapeJavaScript(countryName) + "\""); + + escapeJSON(countryName) + "\""); } if (regionName != null) { sb.append(",\n\"region_name\":\"" - + StringEscapeUtils.escapeJavaScript(regionName) + "\""); + + escapeJSON(regionName) + "\""); } if (cityName != null) { sb.append(",\n\"city_name\":\"" - + StringEscapeUtils.escapeJavaScript(cityName) + "\""); + + escapeJSON(cityName) + "\""); } if (aSNumber != null) { sb.append(",\n\"as_number\":\"" - + StringEscapeUtils.escapeJavaScript(aSNumber) + "\""); + + escapeJSON(aSNumber) + "\""); } if (aSName != null) { sb.append(",\n\"as_name\":\"" - + StringEscapeUtils.escapeJavaScript(aSName) + "\""); + + escapeJSON(aSName) + "\""); } if (consensusWeight >= 0L) { sb.append(",\n\"consensus_weight\":" @@ -497,7 +499,7 @@ public class DetailDataWriter { } if (hostName != null) { sb.append(",\n\"host_name\":\"" - + StringEscapeUtils.escapeJavaScript(hostName) + "\""); + + escapeJSON(hostName) + "\""); } /* Add exit addresses if at least one of them is distinct from the @@ -625,8 +627,8 @@ public class DetailDataWriter { sb.append("\"desc_published\":\"" + publishedDateTime + "\",\n" + "\"last_restarted\":\"" + lastRestartedString + "\",\n" + "\"advertised_bandwidth\":" + advertisedBandwidth + ",\n" - + "\"platform\":\"" + StringEscapeUtils.escapeJavaScript( - descriptor.getPlatform()) + "\""); + + "\"platform\":\"" + escapeJSON(descriptor.getPlatform()) + + "\""); descriptorParts = sb.toString(); }

1 0

[tor/master] Fix port range in parse_port_range().
by nickm＠torproject.org 06 Jul '12

06 Jul '12

commit 62c1311b3ab57c61488ecfc8c94fabb5f2c70e6e Author: George Kadianakis <desnacked(a)riseup.net> Date: Fri Jun 22 18:24:06 2012 +0300 Fix port range in parse_port_range(). --- changes/bug6218 | 3 +++ src/common/address.c | 2 +- 2 files changed, 4 insertions(+), 1 deletions(-) diff --git a/changes/bug6218 b/changes/bug6218 new file mode 100644 index 0000000..5d5d108 --- /dev/null +++ b/changes/bug6218 @@ -0,0 +1,3 @@ + o Minor bugfixes: + - Fix wrong TCP port range in parse_port_range(). Fixes bug 6218; + bugfix on 0.2.1.10-alpha. diff --git a/src/common/address.c b/src/common/address.c index 30665fa..e88869f 100644 --- a/src/common/address.c +++ b/src/common/address.c @@ -1526,7 +1526,7 @@ parse_port_range(const char *port, uint16_t *port_min_out, } else if (endptr && *endptr == '-') { port = endptr+1; endptr = NULL; - port_max = (int)tor_parse_long(port, 10, 1, 65536, &ok, &endptr); + port_max = (int)tor_parse_long(port, 10, 1, 65535, &ok, &endptr); if (!ok) { log_warn(LD_GENERAL, "Malformed port %s on address range; rejecting.",

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3'
by nickm＠torproject.org 06 Jul '12

06 Jul '12

commit 7e1a0bb24e40bbb02a458b5a903703c065792ddc Merge: d30783e 62c1311 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jul 6 08:03:16 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' changes/bug6218 | 3 +++ src/common/address.c | 2 +- 2 files changed, 4 insertions(+), 1 deletions(-)

1 0