- tor-commits - lists.torproject.org

[tor/release-0.2.2] add a release blurb
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit 135ad197aead90adac887201fc99ec537c03e40a Author: Roger Dingledine <arma(a)torproject.org> Date: Wed Oct 26 20:20:43 2011 -0400 add a release blurb --- ChangeLog | 32 +++++++++++++++- ReleaseNotes | 114 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 144 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 80b48d3..2c20536 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,31 @@ Changes in version 0.2.2.34 - 2011-10-26 - o Privacy/anonymity fixes: + Tor 0.2.2.34 fixes a critical anonymity vulnerability where an attacker + can deanonymize Tor users. Everybody should upgrade. + + The attack relies on four components: 1) Clients reuse their TLS cert + when talking to different relays, so relays can recognize a user by + the identity key in her cert. 2) An attacker who knows the client's + identity key can probe each guard relay to see if that identity key + is connected to that guard relay right now. 3) A variety of active + attacks in the literature (starting from "Low-Cost Traffic Analysis + of Tor" by Murdoch and Danezis in 2005) allow a malicious website to + discover the guard relays that a Tor user visiting the website is using. + 4) Clients typically pick three guards at random, so the set of guards + for a given user could well be a unique fingerprint for her. This + release fixes components #1 and #2, which is enough to block the attack; + the other two remain as open research problems. Special thanks to + "frosty_un" for reporting the issue to us! + + Clients should upgrade so they are no longer recognizable by the TLS + certs they present. Relays should upgrade so they no longer allow a + remote attacker to probe them to test whether unpatched clients are + currently connected to them. + + This release also fixes several vulnerabilities that allow an attacker + to enumerate bridge relays. Some bridge enumeration attacks still + remain; see for example proposal 188. + + o Privacy/anonymity fixes (clients): - Clients and bridges no longer send TLS certificate chains on outgoing OR connections. Previously, each client or bridge would use the same cert chain for all outgoing OR connections @@ -18,6 +44,8 @@ Changes in version 0.2.2.34 - 2011-10-26 "GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays" config option to let us transition smoothly, else tomorrow there would be no guard relays. + + o Privacy/anonymity fixes (bridge enumeration): - Bridge relays now do their directory fetches inside Tor TLS connections, like all the other clients do, rather than connecting directly to the DirPort like public relays do. Removes another @@ -27,7 +55,7 @@ Changes in version 0.2.2.34 - 2011-10-26 enumerating bridges. Fixes bug 4124; bugfix on 0.2.0.3-alpha, when bridges were introduced. - Bridges now refuse CREATE or CREATE_FAST cells on OR connections - that they initiated. Relays could distinguish incoming bridge + that they initiated. Relays could distinguish incoming bridge connections from client connections, creating another avenue for enumerating bridges. Fixes CVE-2011-2769. Bugfix on 0.2.0.3-alpha. Found by "frosty_un". diff --git a/ReleaseNotes b/ReleaseNotes index a04bfae..8e3a60b 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -3,6 +3,120 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.2.2.34 - 2011-10-26 + Tor 0.2.2.34 fixes a critical anonymity vulnerability where an attacker + can deanonymize Tor users. Everybody should upgrade. + + The attack relies on four components: 1) Clients reuse their TLS cert + when talking to different relays, so relays can recognize a user by + the identity key in her cert. 2) An attacker who knows the client's + identity key can probe each guard relay to see if that identity key + is connected to that guard relay right now. 3) A variety of active + attacks in the literature (starting from "Low-Cost Traffic Analysis + of Tor" by Murdoch and Danezis in 2005) allow a malicious website to + discover the guard relays that a Tor user visiting the website is using. + 4) Clients typically pick three guards at random, so the set of guards + for a given user could well be a unique fingerprint for her. This + release fixes components #1 and #2, which is enough to block the attack; + the other two remain as open research problems. Special thanks to + "frosty_un" for reporting the issue to us! + + Clients should upgrade so they are no longer recognizable by the TLS + certs they present. Relays should upgrade so they no longer allow a + remote attacker to probe them to test whether unpatched clients are + currently connected to them. + + This release also fixes several vulnerabilities that allow an attacker + to enumerate bridge relays. Some bridge enumeration attacks still + remain; see for example proposal 188. + + o Privacy/anonymity fixes (clients): + - Clients and bridges no longer send TLS certificate chains on + outgoing OR connections. Previously, each client or bridge + would use the same cert chain for all outgoing OR connections + for up to 24 hours, which allowed any relay that the client or + bridge contacted to determine which entry guards it is using. + Fixes CVE-2011-2768. Bugfix on 0.0.9pre5; found by "frosty_un". + - If a relay receives a CREATE_FAST cell on a TLS connection, it + no longer considers that connection as suitable for satisfying a + circuit EXTEND request. Now relays can protect clients from the + CVE-2011-2768 issue even if the clients haven't upgraded yet. + - Directory authorities no longer assign the Guard flag to relays + that haven't upgraded to the above "refuse EXTEND requests + to client connections" fix. Now directory authorities can + protect clients from the CVE-2011-2768 issue even if neither + the clients nor the relays have upgraded yet. There's a new + "GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays" config option + to let us transition smoothly, else tomorrow there would be no + guard relays. + + o Privacy/anonymity fixes (bridge enumeration): + - Bridge relays now do their directory fetches inside Tor TLS + connections, like all the other clients do, rather than connecting + directly to the DirPort like public relays do. Removes another + avenue for enumerating bridges. Fixes bug 4115; bugfix on 0.2.0.35. + - Bridges relays now build circuits for themselves in a more similar + way to how clients build them. Removes another avenue for + enumerating bridges. Fixes bug 4124; bugfix on 0.2.0.3-alpha, + when bridges were introduced. + - Bridges now refuse CREATE or CREATE_FAST cells on OR connections + that they initiated. Relays could distinguish incoming bridge + connections from client connections, creating another avenue for + enumerating bridges. Fixes CVE-2011-2769. Bugfix on 0.2.0.3-alpha. + Found by "frosty_un". + + o Major bugfixes: + - Fix a crash bug when changing node restrictions while a DNS lookup + is in-progress. Fixes bug 4259; bugfix on 0.2.2.25-alpha. Bugfix + by "Tey'". + - Don't launch a useless circuit after failing to use one of a + hidden service's introduction points. Previously, we would + launch a new introduction circuit, but not set the hidden service + which that circuit was intended to connect to, so it would never + actually be used. A different piece of code would then create a + new introduction circuit correctly. Bug reported by katmagic and + found by Sebastian Hahn. Bugfix on 0.2.1.13-alpha; fixes bug 4212. + + o Minor bugfixes: + - Change an integer overflow check in the OpenBSD_Malloc code so + that GCC is less likely to eliminate it as impossible. Patch + from Mansour Moufid. Fixes bug 4059. + - When a hidden service turns an extra service-side introduction + circuit into a general-purpose circuit, free the rend_data and + intro_key fields first, so we won't leak memory if the circuit + is cannibalized for use as another service-side introduction + circuit. Bugfix on 0.2.1.7-alpha; fixes bug 4251. + - Bridges now skip DNS self-tests, to act a little more stealthily. + Fixes bug 4201; bugfix on 0.2.0.3-alpha, which first introduced + bridges. Patch by "warms0x". + - Fix internal bug-checking logic that was supposed to catch + failures in digest generation so that it will fail more robustly + if we ask for a nonexistent algorithm. Found by Coverity Scan. + Bugfix on 0.2.2.1-alpha; fixes Coverity CID 479. + - Report any failure in init_keys() calls launched because our + IP address has changed. Spotted by Coverity Scan. Bugfix on + 0.1.1.4-alpha; fixes CID 484. + + o Minor bugfixes (log messages and documentation): + - Remove a confusing dollar sign from the example fingerprint in the + man page, and also make the example fingerprint a valid one. Fixes + bug 4309; bugfix on 0.2.1.3-alpha. + - The next version of Windows will be called Windows 8, and it has + a major version of 6, minor version of 2. Correctly identify that + version instead of calling it "Very recent version". Resolves + ticket 4153; reported by funkstar. + - Downgrade log messages about circuit timeout calibration from + "notice" to "info": they don't require or suggest any human + intervention. Patch from Tom Lowenthal. Fixes bug 4063; + bugfix on 0.2.2.14-alpha. + + o Minor features: + - Turn on directory request statistics by default and include them in + extra-info descriptors. Don't break if we have no GeoIP database. + Backported from 0.2.3.1-alpha; implements ticket 3951. + - Update to the October 4 2011 Maxmind GeoLite Country database. + + Changes in version 0.2.2.33 - 2011-09-13 Tor 0.2.2.33 fixes several bugs, and includes a slight tweak to Tor's TLS handshake that makes relays and bridges that run this new version

1 0

[tor/release-0.2.2] Don't send a certificate chain on outgoing TLS connections from non-relays
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit 638fdedcf16cf7d6f7c586d36f7ef335c1c9714f Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 23 16:06:06 2011 +0000 Don't send a certificate chain on outgoing TLS connections from non-relays --- changes/issue-2011-10-19L | 12 ++++++ src/common/tortls.c | 93 ++++++++++++++++++++++++++------------------- 2 files changed, 66 insertions(+), 39 deletions(-) diff --git a/changes/issue-2011-10-19L b/changes/issue-2011-10-19L new file mode 100644 index 0000000..972823e --- /dev/null +++ b/changes/issue-2011-10-19L @@ -0,0 +1,12 @@ + o Security fixes: + + - Don't send TLS certificate chains on outgoing OR connections + from clients and bridges. Previously, each client or bridge + would use a single cert chain for all outgoing OR connections + for up to 24 hours, which allowed any relay connected to by a + client or bridge to determine which entry guards it is using. + This is a potential user-tracing bug for *all* users; everyone + who uses Tor's client or hidden service functionality should + upgrade. Fixes CVE-2011-2768. Bugfix on FIXME; found by + frosty_un. + diff --git a/src/common/tortls.c b/src/common/tortls.c index c78a9ec..cc805f8 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -186,9 +186,11 @@ static X509* tor_tls_create_certificate(crypto_pk_env_t *rsa, static void tor_tls_unblock_renegotiation(tor_tls_t *tls); static int tor_tls_context_init_one(tor_tls_context_t **ppcontext, crypto_pk_env_t *identity, - unsigned int key_lifetime); + unsigned int key_lifetime, + int is_client); static tor_tls_context_t *tor_tls_context_new(crypto_pk_env_t *identity, - unsigned int key_lifetime); + unsigned int key_lifetime, + int is_client); /** Global TLS contexts. We keep them here because nobody else needs * to touch them. */ @@ -624,7 +626,7 @@ tor_tls_context_init(int is_public_server, rv1 = tor_tls_context_init_one(&server_tls_context, server_identity, - key_lifetime); + key_lifetime, 0); if (rv1 >= 0) { new_ctx = server_tls_context; @@ -640,7 +642,8 @@ tor_tls_context_init(int is_public_server, if (server_identity != NULL) { rv1 = tor_tls_context_init_one(&server_tls_context, server_identity, - key_lifetime); + key_lifetime, + 0); } else { tor_tls_context_t *old_ctx = server_tls_context; server_tls_context = NULL; @@ -652,7 +655,8 @@ tor_tls_context_init(int is_public_server, rv2 = tor_tls_context_init_one(&client_tls_context, client_identity, - key_lifetime); + key_lifetime, + 1); } return rv1 < rv2 ? rv1 : rv2; @@ -669,10 +673,12 @@ tor_tls_context_init(int is_public_server, static int tor_tls_context_init_one(tor_tls_context_t **ppcontext, crypto_pk_env_t *identity, - unsigned int key_lifetime) + unsigned int key_lifetime, + int is_client) { tor_tls_context_t *new_ctx = tor_tls_context_new(identity, - key_lifetime); + key_lifetime, + is_client); tor_tls_context_t *old_ctx = *ppcontext; if (new_ctx != NULL) { @@ -694,7 +700,8 @@ tor_tls_context_init_one(tor_tls_context_t **ppcontext, * certificate. */ static tor_tls_context_t * -tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime) +tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime, + int is_client) { crypto_pk_env_t *rsa = NULL; EVP_PKEY *pkey = NULL; @@ -711,22 +718,26 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime) goto error; if (crypto_pk_generate_key(rsa)<0) goto error; - /* Create certificate signed by identity key. */ - cert = tor_tls_create_certificate(rsa, identity, nickname, nn2, - key_lifetime); - /* Create self-signed certificate for identity key. */ - idcert = tor_tls_create_certificate(identity, identity, nn2, nn2, - IDENTITY_CERT_LIFETIME); - if (!cert || !idcert) { - log(LOG_WARN, LD_CRYPTO, "Error creating certificate"); - goto error; + if (!is_client) { + /* Create certificate signed by identity key. */ + cert = tor_tls_create_certificate(rsa, identity, nickname, nn2, + key_lifetime); + /* Create self-signed certificate for identity key. */ + idcert = tor_tls_create_certificate(identity, identity, nn2, nn2, + IDENTITY_CERT_LIFETIME); + if (!cert || !idcert) { + log(LOG_WARN, LD_CRYPTO, "Error creating certificate"); + goto error; + } } result = tor_malloc_zero(sizeof(tor_tls_context_t)); result->refcnt = 1; - result->my_cert = X509_dup(cert); - result->my_id_cert = X509_dup(idcert); - result->key = crypto_pk_dup_key(rsa); + if (!is_client) { + result->my_cert = X509_dup(cert); + result->my_id_cert = X509_dup(idcert); + result->key = crypto_pk_dup_key(rsa); + } #ifdef EVERYONE_HAS_AES /* Tell OpenSSL to only use TLS1 */ @@ -758,27 +769,31 @@ tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime) #ifdef SSL_MODE_RELEASE_BUFFERS SSL_CTX_set_mode(result->ctx, SSL_MODE_RELEASE_BUFFERS); #endif - if (cert && !SSL_CTX_use_certificate(result->ctx,cert)) - goto error; - X509_free(cert); /* We just added a reference to cert. */ - cert=NULL; - if (idcert) { - X509_STORE *s = SSL_CTX_get_cert_store(result->ctx); - tor_assert(s); - X509_STORE_add_cert(s, idcert); - X509_free(idcert); /* The context now owns the reference to idcert */ - idcert = NULL; + if (! is_client) { + if (cert && !SSL_CTX_use_certificate(result->ctx,cert)) + goto error; + X509_free(cert); /* We just added a reference to cert. */ + cert=NULL; + if (idcert) { + X509_STORE *s = SSL_CTX_get_cert_store(result->ctx); + tor_assert(s); + X509_STORE_add_cert(s, idcert); + X509_free(idcert); /* The context now owns the reference to idcert */ + idcert = NULL; + } } SSL_CTX_set_session_cache_mode(result->ctx, SSL_SESS_CACHE_OFF); - tor_assert(rsa); - if (!(pkey = _crypto_pk_env_get_evp_pkey(rsa,1))) - goto error; - if (!SSL_CTX_use_PrivateKey(result->ctx, pkey)) - goto error; - EVP_PKEY_free(pkey); - pkey = NULL; - if (!SSL_CTX_check_private_key(result->ctx)) - goto error; + if (!is_client) { + tor_assert(rsa); + if (!(pkey = _crypto_pk_env_get_evp_pkey(rsa,1))) + goto error; + if (!SSL_CTX_use_PrivateKey(result->ctx, pkey)) + goto error; + EVP_PKEY_free(pkey); + pkey = NULL; + if (!SSL_CTX_check_private_key(result->ctx)) + goto error; + } { crypto_dh_env_t *dh = crypto_dh_new(DH_TYPE_TLS); SSL_CTX_set_tmp_dh(result->ctx, _crypto_dh_env_get_dh(dh));

1 0

[tor/release-0.2.2] Mark which OR connections are outgoing
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit c05bb53508f5fe3e570a285e6c9ead452ded0e43 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sun Oct 23 14:58:00 2011 -0700 Mark which OR connections are outgoing --- src/or/connection_or.c | 2 ++ src/or/or.h | 2 ++ 2 files changed, 4 insertions(+), 0 deletions(-) diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 35f6da9..f019c79 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -776,6 +776,8 @@ connection_or_connect(const tor_addr_t *_addr, uint16_t port, conn->_base.state = OR_CONN_STATE_CONNECTING; control_event_or_conn_status(conn, OR_CONN_EVENT_LAUNCHED, 0); + conn->is_outgoing = 1; + if (options->HttpsProxy) { /* we shouldn't connect directly. use the https proxy instead. */ tor_addr_from_ipv4h(&addr, options->HttpsProxyAddr); diff --git a/src/or/or.h b/src/or/or.h index 72e4c63..edbb73c 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1035,6 +1035,8 @@ typedef struct or_connection_t { * is a client. Connections with this flag set should never be used * to satisfy an EXTEND request. */ unsigned int is_connection_with_client:1; + /** True iff this is an outgoing connection. */ + unsigned int is_outgoing:1; uint8_t link_proto; /**< What protocol version are we using? 0 for * "none negotiated yet." */ circid_t next_circ_id; /**< Which circ_id do we try to use next on

1 0

[tor/release-0.2.2] Don't use any OR connection which sent us a CREATE_FAST cell for an EXTEND
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit af12c39d6de5bbcd24915db3c4cc9404f102ac02 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sun Oct 23 14:27:56 2011 -0700 Don't use any OR connection which sent us a CREATE_FAST cell for an EXTEND Fix suggested by Nick Mathewson. --- changes/issue-2011-10-19L | 9 +++++++++ src/or/command.c | 6 ++++++ src/or/connection_or.c | 5 +++++ src/or/or.h | 4 ++++ 4 files changed, 24 insertions(+), 0 deletions(-) diff --git a/changes/issue-2011-10-19L b/changes/issue-2011-10-19L index 972823e..1fefd72 100644 --- a/changes/issue-2011-10-19L +++ b/changes/issue-2011-10-19L @@ -10,3 +10,12 @@ upgrade. Fixes CVE-2011-2768. Bugfix on FIXME; found by frosty_un. + - Don't use any OR connection on which we have received a + CREATE_FAST cell to satisfy an EXTEND request. Previously, we + would not consider whether a connection appears to be from a + client or bridge when deciding whether to use that connection to + satisfy an EXTEND request. Mitigates CVE-2011-2768, by + preventing an attacker from determining whether an unpatched + client is connected to a patched relay. Bugfix on FIXME; found + by frosty_un. + diff --git a/src/or/command.c b/src/or/command.c index 61b898c..a17a3a6 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -285,7 +285,13 @@ command_process_create_cell(cell_t *cell, or_connection_t *conn) * a CPU worker. */ char keys[CPATH_KEY_MATERIAL_LEN]; char reply[DIGEST_LEN*2]; + tor_assert(cell->command == CELL_CREATE_FAST); + + /* Make sure we never try to use the OR connection on which we + * received this cell to satisfy an EXTEND request, */ + conn->is_connection_with_client = 1; + if (fast_server_handshake(cell->payload, (uint8_t*)reply, (uint8_t*)keys, sizeof(keys))<0) { log_warn(LD_OR,"Failed to generate key material. Closing."); diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 95cc02e..35f6da9 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -519,6 +519,11 @@ connection_or_get_for_extend(const char *digest, tor_assert(tor_memeq(conn->identity_digest, digest, DIGEST_LEN)); if (conn->_base.marked_for_close) continue; + /* Never return a connection on which the other end appears to be + * a client. */ + if (conn->is_connection_with_client) { + continue; + } /* Never return a non-open connection. */ if (conn->_base.state != OR_CONN_STATE_OPEN) { /* If the address matches, don't launch a new connection for this diff --git a/src/or/or.h b/src/or/or.h index 4105ff4..72e4c63 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1031,6 +1031,10 @@ typedef struct or_connection_t { * because the connection is too old, or because there's a better one, etc. */ unsigned int is_bad_for_new_circs:1; + /** True iff we have decided that the other end of this connection + * is a client. Connections with this flag set should never be used + * to satisfy an EXTEND request. */ + unsigned int is_connection_with_client:1; uint8_t link_proto; /**< What protocol version are we using? 0 for * "none negotiated yet." */ circid_t next_circ_id; /**< Which circ_id do we try to use next on

1 0

[tor/release-0.2.2] Reject create cells on outgoing OR connections from bridges
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit a74e7fd40f1a77eb4000d8216bb5b80cdd8a6193 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sun Oct 23 15:21:49 2011 -0700 Reject create cells on outgoing OR connections from bridges --- changes/issue-2011-10-23G | 9 +++++++++ src/or/command.c | 7 +++++-- 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/changes/issue-2011-10-23G b/changes/issue-2011-10-23G new file mode 100644 index 0000000..45f8675 --- /dev/null +++ b/changes/issue-2011-10-23G @@ -0,0 +1,9 @@ + o Security fixes: + + - Reject CREATE and CREATE_FAST cells on outgoing OR connections + from a bridge to a relay. Previously, we would accept them and + handle them normally, thereby allowing a malicious relay to + easily distinguish bridges which connect to it from clients. + Fixes CVE-2011-2769. Bugfix on 0.2.0.3-alpha, when bridges were + implemented; found by frosty_un. + diff --git a/src/or/command.c b/src/or/command.c index a17a3a6..54f23bb 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -219,6 +219,7 @@ static void command_process_create_cell(cell_t *cell, or_connection_t *conn) { or_circuit_t *circ; + or_options_t *options = get_options(); int id_is_high; if (we_are_hibernating()) { @@ -230,9 +231,11 @@ command_process_create_cell(cell_t *cell, or_connection_t *conn) return; } - if (!server_mode(get_options())) { + if (!server_mode(options) || + (!public_server_mode(options) && conn->is_outgoing)) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Received create cell (type %d) from %s:%d, but we're a client. " + "Received create cell (type %d) from %s:%d, but we're connected " + "to it as a client. " "Sending back a destroy.", (int)cell->command, conn->_base.address, conn->_base.port); connection_or_send_destroy(cell->circ_id, conn,

1 0

[tor/maint-0.2.2] Don't give the Guard flag to relays without the CVE-2011-2768 fix
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit 00fffbc1a15e2696a89c721d0c94dc333ff419ef Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Tue Oct 25 00:24:15 2011 -0700 Don't give the Guard flag to relays without the CVE-2011-2768 fix --- changes/issue-2011-10-19L | 7 ++++ src/or/dirserv.c | 71 ++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 77 insertions(+), 1 deletions(-) diff --git a/changes/issue-2011-10-19L b/changes/issue-2011-10-19L index 1fefd72..b879c9d 100644 --- a/changes/issue-2011-10-19L +++ b/changes/issue-2011-10-19L @@ -19,3 +19,10 @@ client is connected to a patched relay. Bugfix on FIXME; found by frosty_un. + - Don't assign the Guard flag to relays running a version of Tor + which would use an OR connection on which it has received a + CREATE_FAST cell to satisfy an EXTEND request. Mitigates + CVE-2011-2768, by ensuring that clients will not connect + directly to any relay which an attacker could probe for an + unpatched client's connections. + diff --git a/src/or/dirserv.c b/src/or/dirserv.c index 6607901..fa7f693 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -2251,6 +2251,74 @@ get_possible_sybil_list(const smartlist_t *routers) return omit_as_sybil; } +/** Return non-zero iff a relay running the Tor version specified in + * platform is suitable for use as a potential entry guard. */ +static int +is_router_version_good_for_possible_guard(const char *platform) +{ + static int parsed_versions_initialized = 0; + static tor_version_t first_good_0_2_1_guard_version; + static tor_version_t first_good_0_2_2_guard_version; + static tor_version_t first_good_later_guard_version; + + tor_version_t router_version; + + /* XXX023 This block should be extracted into its own function. */ + /* XXXX Begin code copied from tor_version_as_new_as (in routerparse.c) */ + { + char *s, *s2, *start; + char tmp[128]; + + tor_assert(platform); + + if (strcmpstart(platform,"Tor ")) /* nonstandard Tor; be safe and say yes */ + return 1; + + start = (char *)eat_whitespace(platform+3); + if (!*start) return 0; + s = (char *)find_whitespace(start); /* also finds '\0', which is fine */ + s2 = (char*)eat_whitespace(s); + if (!strcmpstart(s2, "(r") || !strcmpstart(s2, "(git-")) + s = (char*)find_whitespace(s2); + + if ((size_t)(s-start+1) >= sizeof(tmp)) /* too big, no */ + return 0; + strlcpy(tmp, start, s-start+1); + + if (tor_version_parse(tmp, &router_version)<0) { + log_info(LD_DIR,"Router version '%s' unparseable.",tmp); + return 1; /* be safe and say yes */ + } + } + /* XXXX End code copied from tor_version_as_new_as (in routerparse.c) */ + + if (!parsed_versions_initialized) { + /* CVE-2011-2769 was fixed on the relay side in Tor versions + * 0.2.1.31, 0.2.2.34, and 0.2.3.6-alpha. */ + tor_assert(tor_version_parse("0.2.1.31", + &first_good_0_2_1_guard_version)>=0); + tor_assert(tor_version_parse("0.2.2.34", + &first_good_0_2_2_guard_version)>=0); + tor_assert(tor_version_parse("0.2.3.6-alpha", + &first_good_later_guard_version)>=0); + + /* Don't parse these constant version strings once for every relay + * for every vote. */ + parsed_versions_initialized = 1; + } + + return ((tor_version_same_series(&first_good_0_2_1_guard_version, + &router_version) && + tor_version_compare(&first_good_0_2_1_guard_version, + &router_version) <= 0) || + (tor_version_same_series(&first_good_0_2_2_guard_version, + &router_version) && + tor_version_compare(&first_good_0_2_2_guard_version, + &router_version) <= 0) || + (tor_version_compare(&first_good_later_guard_version, + &router_version) <= 0)); +} + /** Extract status information from ri and from other authority * functions and store it in rs>. If naming, consider setting * the named flag in rs. @@ -2294,7 +2362,8 @@ set_routerstatus_from_routerinfo(routerstatus_t *rs, (router_get_advertised_bandwidth(ri) >= BANDWIDTH_TO_GUARANTEE_GUARD || router_get_advertised_bandwidth(ri) >= MIN(guard_bandwidth_including_exits, - guard_bandwidth_excluding_exits))) { + guard_bandwidth_excluding_exits)) && + is_router_version_good_for_possible_guard(ri->platform)) { long tk = rep_hist_get_weighted_time_known( ri->cache_info.identity_digest, now); double wfu = rep_hist_get_weighted_fractional_uptime(

1 0

[tor/maint-0.2.2] Add option to give guard flag to relays without the CVE-2011-2768 fix
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit 4684ced1b3fced0543fa65bf01f75c5d81eaf464 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Tue Oct 25 12:33:21 2011 -0700 Add option to give guard flag to relays without the CVE-2011-2768 fix This way, all of the DA operators can upgrade immediately, without nuking every client's set of entry guards as soon as a majority of them upgrade. Until enough guards have upgraded, a majority of dirauths should set this config option so that there are still enough guards in the network. After a few days pass, all dirauths should use the default. --- src/or/config.c | 2 ++ src/or/dirserv.c | 4 +++- src/or/or.h | 4 ++++ 3 files changed, 9 insertions(+), 1 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index 230ccf2..78e4336 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -269,6 +269,8 @@ static config_var_t _option_vars[] = { V(GeoIPFile, FILENAME, SHARE_DATADIR PATH_SEPARATOR "tor" PATH_SEPARATOR "geoip"), #endif + V(GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays, + BOOL, "0"), OBSOLETE("Group"), V(HardwareAccel, BOOL, "0"), V(AccelName, STRING, NULL), diff --git a/src/or/dirserv.c b/src/or/dirserv.c index fa7f693..c427fe2 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -2332,6 +2332,7 @@ set_routerstatus_from_routerinfo(routerstatus_t *rs, int naming, int listbadexits, int listbaddirs, int vote_on_hsdirs) { + const or_options_t *options = get_options(); int unstable_version = !tor_version_as_new_as(ri->platform,"0.1.1.16-rc-cvs"); memset(rs, 0, sizeof(routerstatus_t)); @@ -2363,7 +2364,8 @@ set_routerstatus_from_routerinfo(routerstatus_t *rs, router_get_advertised_bandwidth(ri) >= MIN(guard_bandwidth_including_exits, guard_bandwidth_excluding_exits)) && - is_router_version_good_for_possible_guard(ri->platform)) { + (options->GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays || + is_router_version_good_for_possible_guard(ri->platform))) { long tk = rep_hist_get_weighted_time_known( ri->cache_info.identity_digest, now); double wfu = rep_hist_get_weighted_fractional_uptime( diff --git a/src/or/or.h b/src/or/or.h index 8638f20..7d50e1f 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2672,6 +2672,10 @@ typedef struct { * number of servers per IP address shared * with an authority. */ + /** Should we assign the Guard flag to relays which would allow + * exploitation of CVE-2011-2768 against their clients? */ + int GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays; + char *AccountingStart; /**< How long is the accounting interval, and when * does it start? */ uint64_t AccountingMax; /**< How many bytes do we allow per accounting

1 0

[tor/maint-0.2.2] Don't use any OR connection which sent us a CREATE_FAST cell for an EXTEND
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit af12c39d6de5bbcd24915db3c4cc9404f102ac02 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sun Oct 23 14:27:56 2011 -0700 Don't use any OR connection which sent us a CREATE_FAST cell for an EXTEND Fix suggested by Nick Mathewson. --- changes/issue-2011-10-19L | 9 +++++++++ src/or/command.c | 6 ++++++ src/or/connection_or.c | 5 +++++ src/or/or.h | 4 ++++ 4 files changed, 24 insertions(+), 0 deletions(-) diff --git a/changes/issue-2011-10-19L b/changes/issue-2011-10-19L index 972823e..1fefd72 100644 --- a/changes/issue-2011-10-19L +++ b/changes/issue-2011-10-19L @@ -10,3 +10,12 @@ upgrade. Fixes CVE-2011-2768. Bugfix on FIXME; found by frosty_un. + - Don't use any OR connection on which we have received a + CREATE_FAST cell to satisfy an EXTEND request. Previously, we + would not consider whether a connection appears to be from a + client or bridge when deciding whether to use that connection to + satisfy an EXTEND request. Mitigates CVE-2011-2768, by + preventing an attacker from determining whether an unpatched + client is connected to a patched relay. Bugfix on FIXME; found + by frosty_un. + diff --git a/src/or/command.c b/src/or/command.c index 61b898c..a17a3a6 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -285,7 +285,13 @@ command_process_create_cell(cell_t *cell, or_connection_t *conn) * a CPU worker. */ char keys[CPATH_KEY_MATERIAL_LEN]; char reply[DIGEST_LEN*2]; + tor_assert(cell->command == CELL_CREATE_FAST); + + /* Make sure we never try to use the OR connection on which we + * received this cell to satisfy an EXTEND request, */ + conn->is_connection_with_client = 1; + if (fast_server_handshake(cell->payload, (uint8_t*)reply, (uint8_t*)keys, sizeof(keys))<0) { log_warn(LD_OR,"Failed to generate key material. Closing."); diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 95cc02e..35f6da9 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -519,6 +519,11 @@ connection_or_get_for_extend(const char *digest, tor_assert(tor_memeq(conn->identity_digest, digest, DIGEST_LEN)); if (conn->_base.marked_for_close) continue; + /* Never return a connection on which the other end appears to be + * a client. */ + if (conn->is_connection_with_client) { + continue; + } /* Never return a non-open connection. */ if (conn->_base.state != OR_CONN_STATE_OPEN) { /* If the address matches, don't launch a new connection for this diff --git a/src/or/or.h b/src/or/or.h index 4105ff4..72e4c63 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1031,6 +1031,10 @@ typedef struct or_connection_t { * because the connection is too old, or because there's a better one, etc. */ unsigned int is_bad_for_new_circs:1; + /** True iff we have decided that the other end of this connection + * is a client. Connections with this flag set should never be used + * to satisfy an EXTEND request. */ + unsigned int is_connection_with_client:1; uint8_t link_proto; /**< What protocol version are we using? 0 for * "none negotiated yet." */ circid_t next_circ_id; /**< Which circ_id do we try to use next on

1 0

[tor/maint-0.2.2] Mark which OR connections are outgoing
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit c05bb53508f5fe3e570a285e6c9ead452ded0e43 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sun Oct 23 14:58:00 2011 -0700 Mark which OR connections are outgoing --- src/or/connection_or.c | 2 ++ src/or/or.h | 2 ++ 2 files changed, 4 insertions(+), 0 deletions(-) diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 35f6da9..f019c79 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -776,6 +776,8 @@ connection_or_connect(const tor_addr_t *_addr, uint16_t port, conn->_base.state = OR_CONN_STATE_CONNECTING; control_event_or_conn_status(conn, OR_CONN_EVENT_LAUNCHED, 0); + conn->is_outgoing = 1; + if (options->HttpsProxy) { /* we shouldn't connect directly. use the https proxy instead. */ tor_addr_from_ipv4h(&addr, options->HttpsProxyAddr); diff --git a/src/or/or.h b/src/or/or.h index 72e4c63..edbb73c 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1035,6 +1035,8 @@ typedef struct or_connection_t { * is a client. Connections with this flag set should never be used * to satisfy an EXTEND request. */ unsigned int is_connection_with_client:1; + /** True iff this is an outgoing connection. */ + unsigned int is_outgoing:1; uint8_t link_proto; /**< What protocol version are we using? 0 for * "none negotiated yet." */ circid_t next_circ_id; /**< Which circ_id do we try to use next on

1 0

[tor/maint-0.2.2] Merge branch 'maint-0.2.1_secfix' into maint-0.2.2_secfix
by arma＠torproject.org 27 Oct '11

27 Oct '11

commit df05e5ef4d5e379e50b38e29fa23228e5b260e8a Merge: f85c561 a74e7fd Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Wed Oct 26 23:30:27 2011 +0200 Merge branch 'maint-0.2.1_secfix' into maint-0.2.2_secfix Conflicts: src/or/connection_or.c changes/issue-2011-10-19L | 21 ++++++++++ changes/issue-2011-10-23G | 9 ++++ src/common/tortls.c | 93 ++++++++++++++++++++++++++------------------- src/or/command.c | 13 +++++- src/or/connection_or.c | 7 +++ src/or/or.h | 6 +++ 6 files changed, 108 insertions(+), 41 deletions(-) diff --cc src/common/tortls.c index 10f4440,cc805f8..352c3d6 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@@ -681,13 -655,16 +684,14 @@@ tor_tls_context_init(int is_public_serv rv2 = tor_tls_context_init_one(&client_tls_context, client_identity, - key_lifetime); + key_lifetime, + 1); } - return rv1 < rv2 ? rv1 : rv2; + return MIN(rv1, rv2); } -/** Create a new TLS context for use with Tor TLS handshakes. - * identity should be set to the identity key used to sign the - * certificate. +/** Create a new global TLS context. * * You can call this function multiple times. Each time you call it, * it generates new certificates; all new connections will use @@@ -785,30 -769,33 +796,34 @@@ tor_tls_context_new(crypto_pk_env_t *id #ifdef SSL_MODE_RELEASE_BUFFERS SSL_CTX_set_mode(result->ctx, SSL_MODE_RELEASE_BUFFERS); #endif - if (cert && !SSL_CTX_use_certificate(result->ctx,cert)) - goto error; - X509_free(cert); /* We just added a reference to cert. */ - cert=NULL; - if (idcert) { - X509_STORE *s = SSL_CTX_get_cert_store(result->ctx); - tor_assert(s); - X509_STORE_add_cert(s, idcert); - X509_free(idcert); /* The context now owns the reference to idcert */ - idcert = NULL; + if (! is_client) { + if (cert && !SSL_CTX_use_certificate(result->ctx,cert)) + goto error; + X509_free(cert); /* We just added a reference to cert. */ + cert=NULL; + if (idcert) { + X509_STORE *s = SSL_CTX_get_cert_store(result->ctx); + tor_assert(s); + X509_STORE_add_cert(s, idcert); + X509_free(idcert); /* The context now owns the reference to idcert */ + idcert = NULL; + } } SSL_CTX_set_session_cache_mode(result->ctx, SSL_SESS_CACHE_OFF); - tor_assert(rsa); - if (!(pkey = _crypto_pk_env_get_evp_pkey(rsa,1))) - goto error; - if (!SSL_CTX_use_PrivateKey(result->ctx, pkey)) - goto error; - EVP_PKEY_free(pkey); - pkey = NULL; - if (!SSL_CTX_check_private_key(result->ctx)) - goto error; + if (!is_client) { + tor_assert(rsa); + if (!(pkey = _crypto_pk_env_get_evp_pkey(rsa,1))) + goto error; + if (!SSL_CTX_use_PrivateKey(result->ctx, pkey)) + goto error; + EVP_PKEY_free(pkey); + pkey = NULL; + if (!SSL_CTX_check_private_key(result->ctx)) + goto error; + } { crypto_dh_env_t *dh = crypto_dh_new(DH_TYPE_TLS); + tor_assert(dh); SSL_CTX_set_tmp_dh(result->ctx, _crypto_dh_env_get_dh(dh)); crypto_dh_free(dh); } diff --cc src/or/connection_or.c index c019f65,f019c79..27a34d3 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@@ -808,19 -776,12 +813,21 @@@ connection_or_connect(const tor_addr_t conn->_base.state = OR_CONN_STATE_CONNECTING; control_event_or_conn_status(conn, OR_CONN_EVENT_LAUNCHED, 0); + conn->is_outgoing = 1; + - if (options->HttpsProxy) { - /* we shouldn't connect directly. use the https proxy instead. */ - tor_addr_from_ipv4h(&addr, options->HttpsProxyAddr); - port = options->HttpsProxyPort; + /* use a proxy server if available */ + if (options->HTTPSProxy) { + using_proxy = 1; + tor_addr_copy(&addr, &options->HTTPSProxyAddr); + port = options->HTTPSProxyPort; + } else if (options->Socks4Proxy) { + using_proxy = 1; + tor_addr_copy(&addr, &options->Socks4ProxyAddr); + port = options->Socks4ProxyPort; + } else if (options->Socks5Proxy) { + using_proxy = 1; + tor_addr_copy(&addr, &options->Socks5ProxyAddr); + port = options->Socks5ProxyPort; } switch (connection_connect(TO_CONN(conn), conn->_base.address, diff --cc src/or/or.h index 31deb89,edbb73c..8638f20 --- a/src/or/or.h +++ b/src/or/or.h @@@ -1062,12 -1028,15 +1062,18 @@@ typedef struct or_connection_t * NETINFO cell listed the address we're connected to as recognized. */ unsigned int is_canonical:1; /** True iff this connection shouldn't get any new circs attached to it, - * because the connection is too old, or because there's a better one, etc. + * because the connection is too old, or because there's a better one. + * More generally, this flag is used to note an unhealthy connection; + * for example, if a bad connection fails we shouldn't assume that the + * router itself has a problem. */ unsigned int is_bad_for_new_circs:1; + /** True iff we have decided that the other end of this connection + * is a client. Connections with this flag set should never be used + * to satisfy an EXTEND request. */ + unsigned int is_connection_with_client:1; + /** True iff this is an outgoing connection. */ + unsigned int is_outgoing:1; uint8_t link_proto; /**< What protocol version are we using? 0 for * "none negotiated yet." */ circid_t next_circ_id; /**< Which circ_id do we try to use next on

1 0