- tor-commits - lists.torproject.org

[tor/release-0.2.2] Merge branch 'maint-0.2.2' into release-0.2.2
by arma＠torproject.org 11 Jan '12

11 Jan '12

commit 6cd68895fb373cc10825368ecfa345a100da7ac4 Merge: 0a77d53 c78a314 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Jan 10 20:26:50 2012 -0500 Merge branch 'maint-0.2.2' into release-0.2.2 changes/bug4856 | 3 +++ src/common/tortls.c | 13 ++++--------- src/or/rendservice.c | 2 +- 3 files changed, 8 insertions(+), 10 deletions(-)

1 0

[tor/release-0.2.2] Fix comment about TLSv1_method() per comments by wanoskarnet
by arma＠torproject.org 11 Jan '12

11 Jan '12

commit c78a314e95ef7f0d05e9d58066ee6bf6795ee9d7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 9 16:40:21 2012 -0500 Fix comment about TLSv1_method() per comments by wanoskarnet --- src/common/tortls.c | 13 ++++--------- 1 files changed, 4 insertions(+), 9 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index 37074de..f7a15b0 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -777,15 +777,10 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime, } #if 0 - /* Tell OpenSSL to only use TLS1. This would actually break compatibility - * with clients that are configured to use SSLv23_method(), so we should - * probably never use it. - */ - /* XXX wanoskarnet says this comment is bunk -- that even if we turn - * this line on, clients configured to use SSLv23 would still able to - * talk to us. But he also says it's ok to leave it out. I suggest we - * delete this whole clause (the one that's #if 0'ed out). I'll leave - * it in place until Nick expresses an opinion. -RD */ + /* Tell OpenSSL to only use TLS1. This may have subtly different results + * from SSLv23_method() with SSLv2 and SSLv3 disabled, so we need to do some + * investigation before we consider adjusting it. It should be compatible + * with existing Tors. */ if (!(result->ctx = SSL_CTX_new(TLSv1_method()))) goto error; #endif

1 0

[tor/master] Chop out the intro point calculation until it is simple enough for nickm to grok
by nickm＠torproject.org 11 Jan '12

11 Jan '12

commit fe4811471d0ab823ee722f8dd747c87ad48e11de Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 10 18:50:48 2012 -0500 Chop out the intro point calculation until it is simple enough for nickm to grok --- src/or/rendservice.c | 13 ++++++++----- 1 files changed, 8 insertions(+), 5 deletions(-) diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 1f72c61..dc51d68 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -974,11 +974,14 @@ rend_service_note_removing_intro_point(rend_service_t *service, * service->n_intro_points_wanted and let rend_services_introduce * create the new intro points we want (if any). */ - double fractional_n_intro_points_wanted_to_replace_this_one = - (1.5 * ((intro_point_accepted_intro_count(intro) / - (double)INTRO_POINT_LIFETIME_INTRODUCTIONS) / - (((double)now - intro->time_published) / - INTRO_POINT_LIFETIME_MIN_SECONDS))); + const double intro_point_usage = + intro_point_accepted_intro_count(intro) / + (double)(now - intro->time_published); + const double intro_point_target_usage = + INTRO_POINT_LIFETIME_INTRODUCTIONS / + (double)INTRO_POINT_LIFETIME_MIN_SECONDS; + const double fractional_n_intro_points_wanted_to_replace_this_one = + (1.5 * (intro_point_usage / intro_point_target_usage)); unsigned int n_intro_points_wanted_to_replace_this_one; unsigned int n_intro_points_wanted_now; unsigned int n_intro_points_really_wanted_now;

1 0

[tor/master] Merge branch 'bug3825c_squashed'
by nickm＠torproject.org 11 Jan '12

11 Jan '12

commit 53d88eb1ecf7714772d9cb54a1d649e518dd5f47 Merge: 5e9d349 fe48114 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 10 19:23:44 2012 -0500 Merge branch 'bug3825c_squashed' src/or/rendservice.c | 30 ++++++++++++++++-------------- 1 files changed, 16 insertions(+), 14 deletions(-)

1 0

[tor/master] Use my original formula for number of replacements for an intro point
by nickm＠torproject.org 11 Jan '12

11 Jan '12

commit 31d6350737437c61da82647f7ac5a41edaa16c3e Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sun Jan 8 01:48:39 2012 -0800 Use my original formula for number of replacements for an intro point A fixup commit which was intended to make this formula easier to read broke it instead. --- src/or/rendservice.c | 25 ++++++++++++------------- 1 files changed, 12 insertions(+), 13 deletions(-) diff --git a/src/or/rendservice.c b/src/or/rendservice.c index dcd962d..1f72c61 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -958,15 +958,14 @@ rend_service_note_removing_intro_point(rend_service_t *service, * _LIFETIME_INTRODUCTIONS introductions that it has handled by * the fraction of _LIFETIME_MIN_SECONDS for which it existed. * - * Then we take the reciprocal of that fraction of desired usage, - * then multiply by a fudge factor of 1.5, to decide how many new - * introduction points should ideally replace intro (which is now - * closed or soon to be closed). In theory, assuming that - * introduction load is distributed equally across all intro - * points and ignoring the fact that different intro points are - * established and closed at different times, that number of intro - * points should bring all of our intro points exactly to our - * target usage. + * Then we multiply that fraction of desired usage by a fudge + * factor of 1.5, to decide how many new introduction points + * should ideally replace intro (which is now closed or soon to be + * closed). In theory, assuming that introduction load is + * distributed equally across all intro points and ignoring the + * fact that different intro points are established and closed at + * different times, that number of intro points should bring all + * of our intro points exactly to our target usage. * * Then we clamp that number to a number of intro points we might * be willing to replace this intro point with and turn it into an @@ -976,10 +975,10 @@ rend_service_note_removing_intro_point(rend_service_t *service, * create the new intro points we want (if any). */ double fractional_n_intro_points_wanted_to_replace_this_one = - ((((double)now - intro->time_published) / - INTRO_POINT_LIFETIME_MIN_SECONDS) * - ((intro_point_accepted_intro_count(intro)) / - INTRO_POINT_LIFETIME_INTRODUCTIONS)) * 1.5; + (1.5 * ((intro_point_accepted_intro_count(intro) / + (double)INTRO_POINT_LIFETIME_INTRODUCTIONS) / + (((double)now - intro->time_published) / + INTRO_POINT_LIFETIME_MIN_SECONDS))); unsigned int n_intro_points_wanted_to_replace_this_one; unsigned int n_intro_points_wanted_now; unsigned int n_intro_points_really_wanted_now;

1 0

[tor/master] Disallow disabling DisableDebuggerAttachment on runnning Tor
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 98959f63aca84e605fb98f10d943f2d28d627039 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Thu Dec 8 09:19:09 2011 +0100 Disallow disabling DisableDebuggerAttachment on runnning Tor Also, have tor_disable_debugger_attach() return a tristate of success/failure/don't-know-how , and only log appropriately. --- doc/tor.1.txt | 4 ++-- src/common/compat.c | 9 +++++---- src/or/config.c | 33 +++++++++++++++++++++++++++------ 3 files changed, 34 insertions(+), 12 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 91a7c69..fcc566e 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -282,8 +282,8 @@ Other options can be specified either on the command-line (--option to alter the system wide ptrace scope as it may not even exist. If you wish to attach to Tor with a debugger such as gdb or strace you will want to set this to 0 for the duration of your debugging. Normal users should leave it - on. (Default: 1) - + on. Disabling this option while Tor is running is prohibited. (Default: 1) + **FetchDirInfoEarly** **0**|**1**:: If set to 1, Tor will always fetch directory information like other directory caches, even if you don't meet the normal criteria for fetching diff --git a/src/common/compat.c b/src/common/compat.c index 27e0060..ff9d877 100644 --- a/src/common/compat.c +++ b/src/common/compat.c @@ -1542,8 +1542,8 @@ switch_id(const char *user) * CAP_SYS_PTRACE and so it is very likely that root will still be able to * attach to the Tor process. */ -/** Attempt to disable debugger attachment: return 0 on success, -1 on - * failure. */ +/** Attempt to disable debugger attachment: return 1 on success, -1 on + * failure, and 0 if we don't know how to try on this platform. */ int tor_disable_debugger_attach(void) { @@ -1568,11 +1568,12 @@ tor_disable_debugger_attach(void) // XXX: TODO - Mac OS X has dtrace and this may be disabled. // XXX: TODO - Windows probably has something similar - if (r == 0) { + if (r == 0 && attempted) { log_debug(LD_CONFIG,"Debugger attachment disabled for " "unprivileged users."); + return 1; } else if (attempted) { - log_warn(LD_CONFIG, "Unable to disable ptrace attach: %s", + log_warn(LD_CONFIG, "Unable to disable debugger attaching: %s", strerror(errno)); } return r; diff --git a/src/or/config.c b/src/or/config.c index 740a9db..b118f30 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1326,12 +1326,26 @@ options_act(const or_options_t *old_options) const int transition_affects_workers = old_options && options_transition_affects_workers(old_options, options); - /* disable ptrace and later, other basic debugging techniques */ - if (options->DisableDebuggerAttachment) { - tor_disable_debugger_attach(); - } else { - log_notice(LD_CONFIG,"Debugger attachment enabled " - "for unprivileged users."); + /* disable ptrace and later, other basic debugging techniques */ + { + /* Remember if we already disabled debugger attachment */ + static int disabled_debugger_attach = 0; + /* Remember if we already warned about being configured not to disable + * debugger attachment */ + static int warned_debugger_attach = 0; + if (options->DisableDebuggerAttachment && !disabled_debugger_attach) { + int ok = tor_disable_debugger_attach(); + if (warned_debugger_attach && ok == 1) { + log_notice(LD_CONFIG, "Disabled attaching debuggers for unprivileged " + "users."); + } + disabled_debugger_attach = (ok == 1); + } else if (!options->DisableDebuggerAttachment && + !warned_debugger_attach) { + log_notice(LD_CONFIG, "Not disabling debugger attaching for " + "unprivileged users."); + warned_debugger_attach = 1; + } } if (running_tor && !have_lockfile()) { @@ -4170,6 +4184,13 @@ options_transition_allowed(const or_options_t *old, return -1; } + if (old->DisableDebuggerAttachment && + !new_val->DisableDebuggerAttachment) { + *msg = tor_strdup("While Tor is running, disabling " + "DisableDebuggerAttachment is not allowed."); + return -1; + } + return 0; }

1 0

[tor/master] changes file for bug4650
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit ff282a11266601bf2690d34a4a74622192b9bbfa Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 4 15:12:02 2012 -0500 changes file for bug4650 --- changes/bug4650 | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/changes/bug4650 b/changes/bug4650 new file mode 100644 index 0000000..44161f8 --- /dev/null +++ b/changes/bug4650 @@ -0,0 +1,7 @@ + o Minor features: + - Log more useful messages when we fail to disable debugger attachment. + + o Minor bugfixes: + - Reject attempts to disable DisableDebuggerAttachment while Tor is + running. Fixes bug 4650; bugfix on 0.2.3.9-alpha. +

1 0

[tor/master] Merge remote-tracking branch 'public/bug4650_nm_squashed'
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 5e9d349979f550474ba105491ba463a8b69a88ae Merge: 73d4dbe ff282a1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 10 17:59:49 2012 -0500 Merge remote-tracking branch 'public/bug4650_nm_squashed' changes/bug4650 | 7 +++++++ doc/tor.1.txt | 4 ++-- src/common/compat.c | 9 +++++---- src/or/config.c | 33 +++++++++++++++++++++++++++------ 4 files changed, 41 insertions(+), 12 deletions(-)

1 0

[tor/master] whitespace and warning fixes for bug4746
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit 73d4dbe103db639cf806e1610a79e4a781428d1f Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 10 16:53:37 2012 -0500 whitespace and warning fixes for bug4746 --- src/common/crypto.c | 9 +++++---- 1 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index b1fc5ed..e377b01 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1839,8 +1839,9 @@ crypto_store_dynamic_dh_modulus(const char *fname) char *base64_encoded_dh = NULL; char *file_string = NULL; int retval = -1; - const static char *file_header = "# This file contains stored Diffie-Hellman" - " parameters for future use.\n# You *do not* need to edit this file.\n\n"; + static const char file_header[] = "# This file contains stored Diffie-" + "Hellman parameters for future use.\n# You *do not* need to edit this " + "file.\n\n"; tor_assert(fname); @@ -1880,10 +1881,10 @@ crypto_store_dynamic_dh_modulus(const char *fname) } /* concatenate file header and the dh parameters blob */ - tor_asprintf(&file_string, "%s%s", file_header, base64_encoded_dh); + new_len = tor_asprintf(&file_string, "%s%s", file_header, base64_encoded_dh); /* write to file */ - if (write_bytes_to_new_file(fname, file_string, strlen(file_string), 0) < 0) { + if (write_bytes_to_new_file(fname, file_string, new_len, 0) < 0) { log_info(LD_CRYPTO, "'%s' was already occupied.", fname); goto done; }

1 0

[tor/master] Add an informative header on the 'keys/dynamic_dh_params' file.
by nickm＠torproject.org 10 Jan '12

10 Jan '12

commit d05bc02192b571e57c1568af45165dd7847a2f91 Author: George Kadianakis <desnacked(a)gmail.com> Date: Mon Dec 19 16:06:22 2011 +0100 Add an informative header on the 'keys/dynamic_dh_params' file. --- src/common/crypto.c | 25 +++++++++++++++++++++---- 1 files changed, 21 insertions(+), 4 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 673fc0c..63e4f26 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1833,7 +1833,10 @@ crypto_store_dynamic_dh_modulus(const char *fname) DH *dh = NULL; unsigned char *dh_string_repr = NULL, *cp = NULL; char *base64_encoded_dh = NULL; + char *file_string = NULL; int retval = -1; + const static char *file_header = "# This file contains stored Diffie-Hellman" + " parameters for future use.\n# You *do not* need to edit this file.\n\n"; tor_assert(fname); @@ -1872,7 +1875,11 @@ crypto_store_dynamic_dh_modulus(const char *fname) goto done; } - if (write_bytes_to_new_file(fname, base64_encoded_dh, new_len, 0) < 0) { + /* concatenate file header and the dh parameters blob */ + tor_asprintf(&file_string, "%s%s", file_header, base64_encoded_dh); + + /* write to file */ + if (write_bytes_to_new_file(fname, file_string, strlen(file_string), 0) < 0) { log_info(LD_CRYPTO, "'%s' was already occupied.", fname); goto done; } @@ -1884,6 +1891,7 @@ crypto_store_dynamic_dh_modulus(const char *fname) DH_free(dh); tor_free(dh_string_repr); tor_free(base64_encoded_dh); + tor_free(file_string); return retval; } @@ -1895,6 +1903,7 @@ crypto_get_stored_dynamic_dh_modulus(const char *fname) { int retval; char *contents = NULL; + const char *contents_tmp = NULL; int dh_codes; char *fname_new = NULL; DH *stored_dh = NULL; @@ -1911,15 +1920,23 @@ crypto_get_stored_dynamic_dh_modulus(const char *fname) goto done; /*usually means that ENOENT. don't try to move file to broken.*/ } + /* skip the file header */ + contents_tmp = eat_whitespace(contents); + if (!*contents_tmp) { + log_warn(LD_CRYPTO, "Stored dynamic DH modulus file " + "seems corrupted (eat_whitespace)."); + goto err; + } + /* 'fname' contains the DH parameters stored in base64-ed DER * format. We are only interested in the DH modulus. * NOTE: We allocate more storage here than we need. Since we're already * doing that, we can also add 1 byte extra to appease Coverity's * scanner. */ - cp = base64_decoded_dh = tor_malloc_zero(strlen(contents) + 1); - length = base64_decode((char *)base64_decoded_dh, strlen(contents), - contents, strlen(contents)); + cp = base64_decoded_dh = tor_malloc_zero(strlen(contents_tmp) + 1); + length = base64_decode((char *)base64_decoded_dh, strlen(contents_tmp), + contents_tmp, strlen(contents_tmp)); if (length < 0) { log_warn(LD_CRYPTO, "Stored dynamic DH modulus seems corrupted (base64)."); goto err;

1 0