- tor-commits - lists.torproject.org

[tor/release-0.2.2] add a blurb for 0.2.2.36; add it to releasenotes too
by arma＠torproject.org 24 Apr '12

24 Apr '12

commit 7a55105dcfe7aa864b6770147de5eb1c6813e635 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Apr 24 10:51:44 2012 -0400 add a blurb for 0.2.2.36; add it to releasenotes too --- ChangeLog | 12 +++-- ReleaseNotes | 123 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 130 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index ff0ef21..bd3e90e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,10 +1,12 @@ Changes in version 0.2.2.36 - 2012-04-?? - - With this release, we remind everyone that 0.2.1.x has reached its - formal end-of-life. Those Tor versions have many known flaws, and - nobody should be using them. You should upgrade. If you're using a - Linux or BSD and its packages are obsolete, stop using those packages - and upgrade anyway. + Tor 0.2.2.36 updates the addresses for two of the eight directory + authorities, fixes some potential anonymity and security issues, + and fixes several crash bugs. + + Tor 0.2.1.x has reached its end-of-life. Those Tor versions have many + known flaws, and nobody should be using them. You should upgrade. If + you're using a Linux or BSD and its packages are obsolete, stop using + those packages and upgrade anyway. o Directory authority changes: - Change IP address for maatuska (v3 directory authority). diff --git a/ReleaseNotes b/ReleaseNotes index 13bd018..bfb1374 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -3,6 +3,129 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.2.2.36 - 2012-04-?? + Tor 0.2.2.36 updates the addresses for two of the eight directory + authorities, fixes some potential anonymity and security issues, + and fixes several crash bugs. + + Tor 0.2.1.x has reached its end-of-life. Those Tor versions have many + known flaws, and nobody should be using them. You should upgrade. If + you're using a Linux or BSD and its packages are obsolete, stop using + those packages and upgrade anyway. + + o Directory authority changes: + - Change IP address for maatuska (v3 directory authority). + - Change IP address for ides (v3 directory authority), and rename + it to turtles. + + o Security fixes: + - When building or running with any version of OpenSSL earlier + than 0.9.8s or 1.0.0f, disable SSLv3 support. These OpenSSL + versions have a bug (CVE-2011-4576) in which their block cipher + padding includes uninitialized data, potentially leaking sensitive + information to any peer with whom they make a SSLv3 connection. Tor + does not use SSL v3 by default, but a hostile client or server + could force an SSLv3 connection in order to gain information that + they shouldn't have been able to get. The best solution here is to + upgrade to OpenSSL 0.9.8s or 1.0.0f (or later). But when building + or running with a non-upgraded OpenSSL, we disable SSLv3 entirely + to make sure that the bug can't happen. + - Never use a bridge or a controller-supplied node as an exit, even + if its exit policy allows it. Found by wanoskarnet. Fixes bug + 5342. Bugfix on 0.1.1.15-rc (for controller-purpose descriptors) + and 0.2.0.3-alpha (for bridge-purpose descriptors). + - Only build circuits if we have a sufficient threshold of the total + descriptors that are marked in the consensus with the "Exit" + flag. This mitigates an attack proposed by wanoskarnet, in which + all of a client's bridges collude to restrict the exit nodes that + the client knows about. Fixes bug 5343. + - Provide controllers with a safer way to implement the cookie + authentication mechanism. With the old method, if another locally + running program could convince a controller that it was the Tor + process, then that program could trick the contoller into telling + it the contents of an arbitrary 32-byte file. The new "SAFECOOKIE" + authentication method uses a challenge-response approach to prevent + this attack. Fixes bug 5185, implements proposal 193. + + o Major bugfixes: + - Avoid logging uninitialized data when unable to decode a hidden + service descriptor cookie. Fixes bug 5647; bugfix on 0.2.1.5-alpha. + - Avoid a client-side assertion failure when receiving an INTRODUCE2 + cell on a general purpose circuit. Fixes bug 5644; bugfix on + 0.2.1.6-alpha. + - Fix builds when the path to sed, openssl, or sha1sum contains + spaces, which is pretty common on Windows. Fixes bug 5065; bugfix + on 0.2.2.1-alpha. + - Correct our replacements for the timeradd() and timersub() functions + on platforms that lack them (for example, Windows). The timersub() + function is used when expiring circuits, while timeradd() is + currently unused. Bug report and patch by Vektor. Fixes bug 4778; + bugfix on 0.2.2.24-alpha. + - Fix the SOCKET_OK test that we use to tell when socket + creation fails so that it works on Win64. Fixes part of bug 4533; + bugfix on 0.2.2.29-beta. Bug found by wanoskarnet. + + o Minor bugfixes: + - Older Linux kernels erroneously respond to strange nmap behavior + by having accept() return successfully with a zero-length + socket. When this happens, just close the connection. Previously, + we would try harder to learn the remote address: but there was + no such remote address to learn, and our method for trying to + learn it was incorrect. Fixes bugs 1240, 4745, and 4747. Bugfix + on 0.1.0.3-rc. Reported and diagnosed by "r1eo". + - Change the BridgePassword feature (part of the "bridge community" + design, which is not yet implemented) to use a time-independent + comparison. The old behavior might have allowed an adversary + to use timing to guess the BridgePassword value. Fixes bug 5543; + bugfix on 0.2.0.14-alpha. + - Detect and reject certain misformed escape sequences in + configuration values. Previously, these values would cause us + to crash if received in a torrc file or over an authenticated + control port. Bug found by Esteban Manchado Velázquez, and + independently by Robert Connolly from Matta Consulting who further + noted that it allows a post-authentication heap overflow. Patch + by Alexander Schrijver. Fixes bugs 5090 and 5402 (CVE 2012-1668); + bugfix on 0.2.0.16-alpha. + - Fix a compile warning when using the --enable-openbsd-malloc + configure option. Fixes bug 5340; bugfix on 0.2.0.20-rc. + - During configure, detect when we're building with clang version + 3.0 or lower and disable the -Wnormalized=id and -Woverride-init + CFLAGS. clang doesn't support them yet. + - When sending an HTTP/1.1 proxy request, include a Host header. + Fixes bug 5593; bugfix on 0.2.2.1-alpha. + + o Minor bugfixes (documentation and log messages): + - Fix a typo in a log message in rend_service_rendezvous_has_opened(). + Fixes bug 4856; bugfix on Tor 0.0.6. + - Update "ClientOnly" man page entry to explain that there isn't + really any point to messing with it. Resolves ticket 5005. + - Document the GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays + directory authority option (introduced in Tor 0.2.2.34). + - Downgrade the "We're missing a certificate" message from notice + to info: people kept mistaking it for a real problem, whereas it + is seldom the problem even when we are failing to bootstrap. Fixes + bug 5067; bugfix on 0.2.0.10-alpha. + - Correctly spell "connect" in a log message on failure to create a + controlsocket. Fixes bug 4803; bugfix on 0.2.2.26-beta. + + o Minor features: + - Directory authorities now reject versions of Tor older than + 0.2.1.30, and Tor versions between 0.2.2.1-alpha and 0.2.2.20-alpha + inclusive. These versions accounted for only a small fraction of + the Tor network, and have numerous known security issues. Resolves + issue 4788. + - Update to the April 3 2012 Maxmind GeoLite Country database. + + - Feature removal: + - When sending or relaying a RELAY_EARLY cell, we used to convert + it to a RELAY cell if the connection was using the v1 link + protocol. This was a workaround for older versions of Tor, which + didn't handle RELAY_EARLY cells properly. Now that all supported + versions can handle RELAY_EARLY cells, and now that we're enforcing + the "no RELAY_EXTEND commands except in RELAY_EARLY cells" rule, + remove this workaround. Addresses bug 4786. + + Changes in version 0.2.2.35 - 2011-12-16 Tor 0.2.2.35 fixes a critical heap-overflow security issue in Tor's buffers code. Absolutely everybody should upgrade.

1 0

[tor/release-0.2.2] bump to 0.2.2.36
by arma＠torproject.org 24 Apr '12

24 Apr '12

commit 66cd361703e75dbeca09b5f9fd72c7e6de4df325 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Apr 24 11:20:22 2012 -0400 bump to 0.2.2.36 --- configure.in | 2 +- contrib/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.in b/configure.in index 0a43c5c..d16f9e4 100644 --- a/configure.in +++ b/configure.in @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2008, The Tor Project, Inc. dnl See LICENSE for licensing information AC_INIT -AM_INIT_AUTOMAKE(tor, 0.2.2.35) +AM_INIT_AUTOMAKE(tor, 0.2.2.36) AM_CONFIG_HEADER(orconfig.h) AC_CANONICAL_HOST diff --git a/contrib/tor-mingw.nsi.in b/contrib/tor-mingw.nsi.in index fe39f30..417973b 100644 --- a/contrib/tor-mingw.nsi.in +++ b/contrib/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.2.35" +!define VERSION "0.2.2.36" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 3acaf60..705fa2f 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -233,5 +233,5 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.2.35" +#define VERSION "0.2.2.36"

1 0

[tor/master] peel off some unnecessary parens
by arma＠torproject.org 24 Apr '12

24 Apr '12

commit 1cbde0bd504c49043fd6b4a9f09752b02cbbd908 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Apr 24 12:26:00 2012 -0400 peel off some unnecessary parens --- src/or/dirserv.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/or/dirserv.c b/src/or/dirserv.c index 5b6087c..1c25798 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -2417,7 +2417,7 @@ set_routerstatus_from_routerinfo(routerstatus_t *rs, routerbw >= options->AuthDirGuardBWGuarantee) || routerbw >= MIN(guard_bandwidth_including_exits, guard_bandwidth_excluding_exits)) && - (is_router_version_good_for_possible_guard(ri->platform))) { + is_router_version_good_for_possible_guard(ri->platform)) { long tk = rep_hist_get_weighted_time_known( node->identity, now); double wfu = rep_hist_get_weighted_fractional_uptime(

1 0

[tor/master] Twiddle ROUTER_{MAX_COSMETIC_TIME_DIFFERENCE, MAX_AGE_TO_PUBLISH}
by arma＠torproject.org 24 Apr '12

24 Apr '12

commit cc3515780529277a5f9d788e8a256798e5cd144f Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 30 15:38:16 2012 -0400 Twiddle ROUTER_{MAX_COSMETIC_TIME_DIFFERENCE,MAX_AGE_TO_PUBLISH} This is ticket 2479. Roger's original explanation was: We have a series of bugs where relays publish a descriptor within 12 hours of their last descriptor, but the authorities drop it because it's not different "enough" from the last one and it's too close to the last one. The original goal of this idea was to a) reduce the number of new descriptors authorities accept (and thus have to store) and b) reduce the total number of descriptors that clients and mirrors fetch. It's a defense against bugs where relays publish a new descriptor every minute. Now that we're putting out one consensus per hour, we're doing better at the total damage that can be caused by 'b'. There are broader-scale design changes that would help here, and we've had a trac entry open for years about how relays should recognize that they're not in the consensus, or recognize when their publish failed, and republish sooner. In the mean time, I think we should change some of the parameters to make the problem less painful. --- changes/bug2749 | 8 ++++++++ src/or/or.h | 2 +- src/or/routerlist.c | 2 +- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/changes/bug2749 b/changes/bug2749 new file mode 100644 index 0000000..964a828 --- /dev/null +++ b/changes/bug2749 @@ -0,0 +1,8 @@ + o Changed parameters (authorities): + - Authorities are now a little more lenient at accepting older + router descriptors, or newer router descriptors that don't make + big changes. This should help ameliorate past and future issues + where routers think they have uploaded valid descriptors, but the + authorities don't think so. Fix for ticket 2479. + + diff --git a/src/or/or.h b/src/or/or.h index 4996fd3..6053acb 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -187,7 +187,7 @@ #define ROUTER_MAX_AGE (60*60*48) /** How old can a router get before we (as a server) will no longer * consider it live? In seconds. */ -#define ROUTER_MAX_AGE_TO_PUBLISH (60*60*20) +#define ROUTER_MAX_AGE_TO_PUBLISH (60*60*24) /** How old do we let a saved descriptor get before force-removing it? */ #define OLD_ROUTER_DESC_MAX_AGE (60*60*24*5) diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 160f340..a64b93f 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -5082,7 +5082,7 @@ router_reset_descriptor_download_failures(void) /** Any changes in a router descriptor's publication time larger than this are * automatically non-cosmetic. */ -#define ROUTER_MAX_COSMETIC_TIME_DIFFERENCE (12*60*60) +#define ROUTER_MAX_COSMETIC_TIME_DIFFERENCE (2*60*60) /** We allow uptime to vary from how much it ought to be by this much. */ #define ROUTER_ALLOW_UPTIME_DRIFT (6*60*60)

1 0

[tor/master] Merge remote-tracking branch 'nickm/bug2497'
by arma＠torproject.org 24 Apr '12

24 Apr '12

commit ae94e36a1ddc792fcf8953ea7932f2a9c408dbdf Merge: 5184170 cc35157 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Apr 24 12:19:07 2012 -0400 Merge remote-tracking branch 'nickm/bug2497' changes/bug2749 | 8 ++++++++ src/or/or.h | 2 +- src/or/routerlist.c | 2 +- 3 files changed, 10 insertions(+), 2 deletions(-)

1 0

[tor/master] Fix --enable-static-tor on OpenBSD
by nickm＠torproject.org 24 Apr '12

24 Apr '12

commit b3abf153428b8f0bbcaeb245207742f7df5fad38 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Feb 12 19:54:13 2012 -0500 Fix --enable-static-tor on OpenBSD Previously we'd been using "we have clock_gettime()" as a proxy for "we need -lrt to link a static libevent". But that's not really accurate: we should only add -lrt if searching for clock_gettime function adds -lrt to our libraries. --- changes/bug5103 | 3 +++ configure.in | 7 ++++++- 2 files changed, 9 insertions(+), 1 deletions(-) diff --git a/changes/bug5103 b/changes/bug5103 new file mode 100644 index 0000000..dbc462c --- /dev/null +++ b/changes/bug5103 @@ -0,0 +1,3 @@ + o Minor bugfixes (build): + - When building with --enable-static-tor on OpenBSD, do not + erroneously attempt to link -lrt. diff --git a/configure.in b/configure.in index ef571b8..b37a89d 100644 --- a/configure.in +++ b/configure.in @@ -280,7 +280,12 @@ AC_SEARCH_LIBS(socket, [socket network]) AC_SEARCH_LIBS(gethostbyname, [nsl]) AC_SEARCH_LIBS(dlopen, [dl]) AC_SEARCH_LIBS(inet_aton, [resolv]) -AC_SEARCH_LIBS([clock_gettime], [rt], [have_rt=yes]) +saved_LIBS="$LIBS" +AC_SEARCH_LIBS([clock_gettime], [rt]) +if test "$LIBS" != "$saved_LIBS"; then + # Looks like we need -lrt for clock_gettime(). + have_rt=yes +fi if test "$enable_threads" = "yes"; then AC_SEARCH_LIBS(pthread_create, [pthread])

1 0

[tor/master] Obsolete GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays
by nickm＠torproject.org 24 Apr '12

24 Apr '12

commit 77e51224faf1963241e207004133a2350ad23e5c Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 11 10:59:11 2012 -0400 Obsolete GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays Closes ticket 4572. --- changes/bug4572 | 6 ++++++ doc/tor.1.txt | 4 ---- src/or/config.c | 3 +-- src/or/dirserv.c | 3 +-- src/or/or.h | 4 ---- 5 files changed, 8 insertions(+), 12 deletions(-) diff --git a/changes/bug4572 b/changes/bug4572 new file mode 100644 index 0000000..3107bf9 --- /dev/null +++ b/changes/bug4572 @@ -0,0 +1,6 @@ + o Removed features + - Remove the GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays option; + authorities needed to use it for a while to keep the network working + as people upgraded to 0.2.1.31, 0.2.2.34, or 0.2.3.6-alpha, but that + was six months ago. As of now, it should no longer be needed or used. + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index e73377b..98c97e7 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1610,10 +1610,6 @@ DIRECTORY AUTHORITY SERVER OPTIONS votes on whether to accept relays as hidden service directories. (Default: 1) -GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays **0**|**1**:: - When this option is set to 0, do not vote to give the Guard flag to any - version of Tor vulnerable to CVE-2011-2769. (Default: 0) - HIDDEN SERVICE OPTIONS ---------------------- diff --git a/src/or/config.c b/src/or/config.c index 696bbd0..bfed4e5 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -295,8 +295,7 @@ static config_var_t _option_vars[] = { V(GeoIPFile, FILENAME, SHARE_DATADIR PATH_SEPARATOR "tor" PATH_SEPARATOR "geoip"), #endif - V(GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays, - BOOL, "0"), + OBSOLETE("GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays"), OBSOLETE("Group"), V(HardwareAccel, BOOL, "0"), V(HeartbeatPeriod, INTERVAL, "6 hours"), diff --git a/src/or/dirserv.c b/src/or/dirserv.c index 11f235c..5b6087c 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -2417,8 +2417,7 @@ set_routerstatus_from_routerinfo(routerstatus_t *rs, routerbw >= options->AuthDirGuardBWGuarantee) || routerbw >= MIN(guard_bandwidth_including_exits, guard_bandwidth_excluding_exits)) && - (options->GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays || - is_router_version_good_for_possible_guard(ri->platform))) { + (is_router_version_good_for_possible_guard(ri->platform))) { long tk = rep_hist_get_weighted_time_known( node->identity, now); double wfu = rep_hist_get_weighted_fractional_uptime( diff --git a/src/or/or.h b/src/or/or.h index c323595..a498a57 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3270,10 +3270,6 @@ typedef struct { * number of servers per IP address shared * with an authority. */ - /** Should we assign the Guard flag to relays which would allow - * exploitation of CVE-2011-2768 against their clients? */ - int GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays; - /** If non-zero, always vote the Fast flag for any relay advertising * this amount of capacity or more. */ uint64_t AuthDirFastGuarantee;

1 0

[tor/master] Merge remote-tracking branch 'public/bug5103'
by nickm＠torproject.org 24 Apr '12

24 Apr '12

commit 51841709bf2d709c54ee0fa27830533020b2a7d7 Merge: 4314d1a b3abf15 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Apr 24 11:41:24 2012 -0400 Merge remote-tracking branch 'public/bug5103' changes/bug5103 | 3 +++ configure.in | 7 ++++++- 2 files changed, 9 insertions(+), 1 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'public/bug4572'
by nickm＠torproject.org 24 Apr '12

24 Apr '12

commit 4314d1a15ab1697235d911c9c187e1f48983048a Merge: e0e4b84 77e5122 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Apr 24 11:38:51 2012 -0400 Merge remote-tracking branch 'public/bug4572' changes/bug4572 | 6 ++++++ doc/tor.1.txt | 4 ---- src/or/config.c | 3 +-- src/or/dirserv.c | 3 +-- src/or/or.h | 4 ---- 5 files changed, 8 insertions(+), 12 deletions(-)

1 0

[tor/master] Add a check_no_tls_errors() to read_to_buf_tls
by nickm＠torproject.org 24 Apr '12

24 Apr '12

commit e0e4b8475708729a57461bb7336931351b874842 Author: Arturo Filastò <hellais(a)gmail.com> Date: Wed Feb 22 00:29:16 2012 -0800 Add a check_no_tls_errors() to read_to_buf_tls Fixes bug #4528 "read_to_buf_tls(): Inconsistency in code". This check was added back in 0.1.0.3-rc, but somehow we forgot to leave it in when we refactored read_to_buf_tls in 0.1.0.5-rc. (patch by Arturo; commit message and changes file by nickm) --- changes/bug4528 | 6 ++++++ src/or/buffers.c | 3 +++ 2 files changed, 9 insertions(+), 0 deletions(-) diff --git a/changes/bug4528 b/changes/bug4528 new file mode 100644 index 0000000..8703d6a --- /dev/null +++ b/changes/bug4528 @@ -0,0 +1,6 @@ + + o Minor bugfixes: + - Make sure that there are no unhandled pending TLS errors before + reading from a TLS stream. We had checks in 0.1.0.3-rc, but + lost them in 0.1.0.5-rc when we refactored read_to_buf_tls(). + Bugfix on 0.1.0.5-rc; fixes bug 4528. diff --git a/src/or/buffers.c b/src/or/buffers.c index d4fc44b..d60e54e 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -744,6 +744,9 @@ read_to_buf_tls(tor_tls_t *tls, size_t at_most, buf_t *buf) { int r = 0; size_t total_read = 0; + + check_no_tls_errors(); + check(); while (at_most > total_read) {

1 0