- tor-commits - lists.torproject.org

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2'
by nickm＠torproject.org 07 Jun '11

07 Jun '11

commit 8cd5a3c1865c2115d88b08041a27e2cfdd7d24d2 Merge: 96da10a 9e3fc5f Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 6 16:20:22 2011 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' changes/bug3306 | 9 +++++++++ src/common/crypto.c | 5 +++-- src/or/circuitbuild.c | 10 +++++++++- 3 files changed, 21 insertions(+), 3 deletions(-)

1 0

[tor/maint-0.2.2] Detect insanely large circuit build state; don't give its length to rand_int
by nickm＠torproject.org 07 Jun '11

07 Jun '11

commit 42e4e156d95a1c28a666a5346d491c4ed71435dd Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 1 12:12:01 2011 -0400 Detect insanely large circuit build state; don't give its length to rand_int --- changes/bug3306 | 4 ++++ src/or/circuitbuild.c | 10 +++++++++- 2 files changed, 13 insertions(+), 1 deletions(-) diff --git a/changes/bug3306 b/changes/bug3306 index b1bb103..f868a24 100644 --- a/changes/bug3306 +++ b/changes/bug3306 @@ -3,3 +3,7 @@ correctly. Previously, it accepted values up to UINT_MAX, but could return a negative number if given a value above INT_MAX+1. Found by George Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14. + + - Avoid a segfault when reading a malformed circuit build state + with more than INT_MAX entries. Found by wanoskarnet. Bugfix on + 0.2.2.4-alpha. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 3f08448..6d7e711 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -678,7 +678,15 @@ circuit_build_times_shuffle_and_store_array(circuit_build_times_t *cbt, log_notice(LD_CIRC, "The number of circuit times that this Tor version " "uses to calculate build times is less than the number stored " "in your state file. Decreasing the circuit time history from " - "%d to %d.", num_times, CBT_NCIRCUITS_TO_OBSERVE); + "%lu to %d.", (unsigned long)num_times, + CBT_NCIRCUITS_TO_OBSERVE); + } + + if (n > INT_MAX-1) { + log_warn(LD_CIRC, "For some insane reasons, you had %lu circuit build " + "observations in your state file. That's far too many; probably " + "there's a bug here.", (unsigned long)n); + n = INT_MAX-1; } /* This code can only be run on a compact array */

1 0

[tor/maint-0.2.2] Check maximum properly in crypto_rand_int()
by nickm＠torproject.org 07 Jun '11

07 Jun '11

commit 5afab5ca197112b01135980d6cb3694a4519e3cf Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 1 11:48:39 2011 -0400 Check maximum properly in crypto_rand_int() George Kadianakis notes that if you give crypto_rand_int() a value above INT_MAX, it can return a negative number, which is not what the documentation would imply. The simple solution is to assert that the input is in [1,INT_MAX+1]. If in the future we need a random-value function that can return values up to UINT_MAX, we can add one. Fixes bug 3306; bugfix on 0.2.2pre14. --- changes/bug3306 | 5 +++++ src/common/crypto.c | 5 +++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/changes/bug3306 b/changes/bug3306 new file mode 100644 index 0000000..b1bb103 --- /dev/null +++ b/changes/bug3306 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - Make our crypto_rand_int() function check the value of its input + correctly. Previously, it accepted values up to UINT_MAX, but + could return a negative number if given a value above INT_MAX+1. + Found by George Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14. diff --git a/src/common/crypto.c b/src/common/crypto.c index d8e6619..851f11b 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -2145,13 +2145,14 @@ crypto_rand(char *to, size_t n) } /** Return a pseudorandom integer, chosen uniformly from the values - * between 0 and <b>max</b>-1. */ + * between 0 and <b>max</b>-1 inclusive. <b>max</b> must be between 1 and + * INT_MAX+1, inclusive. */ int crypto_rand_int(unsigned int max) { unsigned int val; unsigned int cutoff; - tor_assert(max < UINT_MAX); + tor_assert(max <= ((unsigned int)INT_MAX)+1); tor_assert(max > 0); /* don't div by 0 */ /* We ignore any values that are >= 'cutoff,' to avoid biasing the

1 0

[tor/maint-0.2.2] Merge branch 'bug3306_nm_squashed' into maint-0.2.2
by nickm＠torproject.org 07 Jun '11

07 Jun '11

commit 9e3fc5f61685f937d76e60c5fa1781b80aa5bf68 Merge: 83e3975 42e4e15 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 6 16:18:24 2011 -0400 Merge branch 'bug3306_nm_squashed' into maint-0.2.2 changes/bug3306 | 9 +++++++++ src/common/crypto.c | 5 +++-- src/or/circuitbuild.c | 10 +++++++++- 3 files changed, 21 insertions(+), 3 deletions(-)

1 0

r24810: {projects} give my crypto 2011 paper a cc-by license. try not to screw (projects/articles/crypto2011)
by Roger Dingledine 06 Jun '11

06 Jun '11

Author: arma Date: 2011-06-06 03:47:46 +0000 (Mon, 06 Jun 2011) New Revision: 24810 Modified: projects/articles/crypto2011/crypto2011-tor.bib projects/articles/crypto2011/crypto2011-tor.pdf projects/articles/crypto2011/crypto2011-tor.tex Log: give my crypto 2011 paper a cc-by license. try not to screw up the rest of the formatting too much. Modified: projects/articles/crypto2011/crypto2011-tor.bib =================================================================== --- projects/articles/crypto2011/crypto2011-tor.bib 2011-06-06 00:58:54 UTC (rev 24809) +++ projects/articles/crypto2011/crypto2011-tor.bib 2011-06-06 03:47:46 UTC (rev 24810) @@ -1,10 +1,9 @@ @inproceedings{dingledine2004tor, author = {Roger Dingledine and Nick Mathewson and Paul Syverson}, title = {Tor: The Second-Generation Onion Router}, - booktitle = {Proceedings of the 13th USENIX Security Symposium}, + booktitle = {Proc 13th USENIX Security Symposium}, year = {2004}, month = {August}, - pages = {303--320}, } @inproceedings{mccoy2008shining, Modified: projects/articles/crypto2011/crypto2011-tor.pdf =================================================================== (Binary files differ) Modified: projects/articles/crypto2011/crypto2011-tor.tex =================================================================== --- projects/articles/crypto2011/crypto2011-tor.tex 2011-06-06 00:58:54 UTC (rev 24809) +++ projects/articles/crypto2011/crypto2011-tor.tex 2011-06-06 03:47:46 UTC (rev 24810) @@ -6,6 +6,9 @@ \usepackage{color} \pagestyle{empty} +\long\def\symbolfootnote[#1]#2{\begingroup% +\def\thefootnote{\fnsymbol{footnote}}\footnote[#1]{#2}\endgroup} + %\usepackage[pdftex,% % breaklinks=true,% % colorlinks=true,% @@ -72,8 +75,13 @@ research, please talk to us (https://torproject.org/research) so we can explain what's available and help interpret your results. -\subsection*{Some open questions from the anonymity field} +\subsubsection*{Some open questions from the anonymity field.} +% this is smashed into the middle of the paper so the footnote shows +% up on page 2 rather than ruining the formatting on page 1. +\symbolfootnote[0]{This work is available under the Creative Commons +Attribution (CC-BY) License.} + Here are a few examples of open anonymity and blocking-resistance problems:

1 0

[torbrowser/maint-2.2] add that windows suite to the changelog
by erinn＠torproject.org 06 Jun '11

06 Jun '11

commit 58f8bbb9f75da2e183e8b00f28b0ced26bce9171 Author: Erinn Clark <erinn(a)torproject.org> Date: Sun Jun 5 21:10:54 2011 -0300 add that windows suite to the changelog --- build-scripts/osx.mk | 1 - changelog.win-2.2 | 2 +- 2 files changed, 1 insertions(+), 2 deletions(-) diff --git a/build-scripts/osx.mk b/build-scripts/osx.mk index 47ab77f..8bee9e1 100644 --- a/build-scripts/osx.mk +++ b/build-scripts/osx.mk @@ -213,7 +213,6 @@ all-compressed-bundles: compressed-bundle_ar \ ## clean: - rm -fr $(DISTDIR) rm -fr *.app rm -fr $(DEST) *.stamp rm -f *~ diff --git a/changelog.win-2.2 b/changelog.win-2.2 index d77cab1..2acec07 100644 --- a/changelog.win-2.2 +++ b/changelog.win-2.2 @@ -1,4 +1,4 @@ -Tor Browser Bundle (2.2.27-1) alpha; suite=osx +Tor Browser Bundle (2.2.27-1) alpha; suite=windows * Update Tor to 0.2.2.27-beta * Update HTTPS Everywhere to 0.9.9.development.5

1 0

[torbrowser/master] bump tbb osx to 1.0.18-dev, tor to 0.2.2.28-beta, and various other versions as well (libevent 2.0.12-stable, zlib 1.2.5, extensions)
by erinn＠torproject.org 06 Jun '11

06 Jun '11

commit bb70734bd0d166d80dbab4374144b871c6323ccf Author: Erinn Clark <erinn(a)torproject.org> Date: Sun Jun 5 22:08:17 2011 -0300 bump tbb osx to 1.0.18-dev, tor to 0.2.2.28-beta, and various other versions as well (libevent 2.0.12-stable, zlib 1.2.5, extensions) --- README.OSX | 13 ++++++++++--- build-scripts/osx.mk | 15 +++++++++------ 2 files changed, 19 insertions(+), 9 deletions(-) diff --git a/README.OSX b/README.OSX index 6e63c7c..000e7a4 100644 --- a/README.OSX +++ b/README.OSX @@ -5,13 +5,13 @@ Included applications --------------------- Vidalia 0.2.12 (with Qt 4.6.2) -Tor 0.2.2.27-beta (with libevent-2.0.10-stable, zlib-1.2.3 and openssl-0.9.8p) +Tor 0.2.2.28-beta (with libevent-2.0.12-stable, zlib-1.2.5 and openssl-0.9.8p) Polipo 1.0.4.1 Firefox 3.6.17 \_ Torbutton 1.2.5 - |_ NoScript 2.1.0.5 + |_ NoScript 2.1.1 |_ HTTPS-Everywhere 0.9.9.development.5 - |_ BetterPrivacy 1.50 + |_ BetterPrivacy 1.51 Usage ----- @@ -24,6 +24,13 @@ To exit, close Firefox and Vidalia. Changelog --------- +1.0.18: Released 2011-06-05 + Update Tor to 0.2.2.28-beta + Update Libevent to 2.0.12-stable + Update zlib to 1.2.5 + Update NoScript to 2.1.1 + Update BetterPrivacy to 1.51 + 1.0.17: Released 2011-05-19 Update Tor to 0.2.2.27-beta Update NoScript to 2.1.0.5 diff --git a/build-scripts/osx.mk b/build-scripts/osx.mk index e89159e..94fffde 100644 --- a/build-scripts/osx.mk +++ b/build-scripts/osx.mk @@ -43,18 +43,18 @@ TBB_FINAL=$(BUILT_DIR)/TBBL ## Versions for our source packages HTTPSEVERY_VER=0.9.9.development.5 FIREFOX_VER=3.6.17 -LIBEVENT_VER=2.0.10-stable +LIBEVENT_VER=2.0.12-stable LIBPNG_VER=1.4.3 -NOSCRIPT_VER=2.1.0.5 +NOSCRIPT_VER=2.1.1 OPENSSL_VER=0.9.8p OTR_VER=3.2.0 PIDGIN_VER=2.6.4 POLIPO_VER=1.0.4.1 QT_VER=4.6.2 -TOR_VER=0.2.2.27-beta +TOR_VER=0.2.2.28-beta TORBUTTON_VER=1.2.5 VIDALIA_VER=0.2.12 -ZLIB_VER=1.2.3 +ZLIB_VER=1.2.5 ## Extension IDs FF_VENDOR_ID:=\{ec8030f7-c20a-464f-9b0e-13a3a9e97384\} @@ -101,10 +101,13 @@ unpack-source: source-dance: fetch-source unpack-source echo "We're ready for building now." + ZLIB_DIR=$(FETCH_DIR)/zlib-$(ZLIB_VER) ZLIB_OPTS=--prefix=$(BUILT_DIR) +ZLIB_CFLAGS="-mmacosx-version-min=10.4 -isysroot /Developer/SDKs/MacOSX10.4u.sdk -arch $(ARCH_TYPE)" +ZLIB_LDFLAGS="-Wl,-syslibroot,/Developer/SDKs/MacOSX10.4u.sdk" build-zlib: - cd $(ZLIB_DIR) && ./configure $(ZLIB_OPTS) + cd $(ZLIB_DIR) && CFLAGS=$(ZLIB_CFLAGS) LDFLAGS=$(ZLIB_LDFLAGS) ./configure $(ZLIB_OPTS) cd $(ZLIB_DIR) && make cd $(ZLIB_DIR) && make install @@ -208,7 +211,7 @@ NAME=TorBrowser DISTDIR=tbbosx-dist ## Version and name of the compressed bundle (also used for source) -VERSION=1.0.17-dev +VERSION=1.0.18-dev DEFAULT_COMPRESSED_BASENAME=TorBrowser-$(VERSION)-osx-$(ARCH_TYPE)- IM_COMPRESSED_BASENAME=TorBrowser-IM-$(VERSION)- DEFAULT_COMPRESSED_NAME=$(DEFAULT_COMPRESSED_BASENAME)

1 0

[torbrowser/master] bump tbb linux to 1.1.10-dev, tor to 0.2.2.28-beta, and various other versions as well (libevent 2.0.12-stable, zlib 1.2.5, extensions)
by erinn＠torproject.org 06 Jun '11

06 Jun '11

commit bcd3744e98962d27f0fb61b69f622dad81751b6e Author: Erinn Clark <erinn(a)torproject.org> Date: Sun Jun 5 22:26:27 2011 -0300 bump tbb linux to 1.1.10-dev, tor to 0.2.2.28-beta, and various other versions as well (libevent 2.0.12-stable, zlib 1.2.5, extensions) --- README.Linux | 13 ++++++++++--- build-scripts/linux.mk | 10 +++++----- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/README.Linux b/README.Linux index 1062aae..37c165c 100644 --- a/README.Linux +++ b/README.Linux @@ -5,11 +5,11 @@ Included applications --------------------- Vidalia 0.2.12 (with Qt 4.6.2) -Tor 0.2.2.27-beta (with libevent-2.0.10-stable, zlib-1.2.3 and openssl-0.9.8p) +Tor 0.2.2.28-beta (with libevent-2.0.12-stable, zlib-1.2.5 and openssl-0.9.8p) Firefox 3.6.17 \_ Torbutton 1.2.5 - |_ NoScript 2.1.0.5 - |_ BetterPrivacy 1.50 + |_ NoScript 2.1.1 + |_ BetterPrivacy 1.51 |_ HTTPS Everywhere 0.9.9.development.5 Usage @@ -29,6 +29,13 @@ To exit, close Firefox. Vidalia will automatically clean up and exit. Changelog --------- +1.1.10: Released 2011-06-05 + Update Tor to 0.2.2.28-beta + Update Libevent to 2.0.12-stable + Update zlib to 1.2.5 + Update NoScript to 2.1.1 + Update BetterPrivacy to 1.51 + 1.1.9: Released 2011-05-19 Update Tor to 0.2.2.27-beta Update NoScript to 2.1.0.5 diff --git a/build-scripts/linux.mk b/build-scripts/linux.mk index 0b2378d..a58756e 100644 --- a/build-scripts/linux.mk +++ b/build-scripts/linux.mk @@ -43,18 +43,18 @@ TBB_FINAL=$(BUILT_DIR)/TBBL ## Versions for our source packages HTTPSEVERY_VER=0.9.9.development.5 FIREFOX_VER=3.6.17 -LIBEVENT_VER=2.0.10-stable +LIBEVENT_VER=2.0.12-stable LIBPNG_VER=1.4.3 -NOSCRIPT_VER=2.1.0.5 +NOSCRIPT_VER=2.1.1 OPENSSL_VER=0.9.8p OTR_VER=3.2.0 PIDGIN_VER=2.6.4 POLIPO_VER=1.0.4.1 QT_VER=4.6.2 -TOR_VER=0.2.2.27-beta +TOR_VER=0.2.2.28-beta TORBUTTON_VER=1.2.5 VIDALIA_VER=0.2.12 -ZLIB_VER=1.2.3 +ZLIB_VER=1.2.5 ## Extension IDs FF_VENDOR_ID:=\{ec8030f7-c20a-464f-9b0e-13a3a9e97384\} @@ -216,7 +216,7 @@ NAME=tor-browser DISTDIR=tbbl-dist ## Version and name of the compressed bundle (also used for source) -VERSION=1.1.9-dev +VERSION=1.1.10-dev DEFAULT_COMPRESSED_BASENAME=tor-browser-gnu-linux-$(ARCH_TYPE)-$(VERSION)- IM_COMPRESSED_BASENAME=tor-im-browser-gnu-linux-$(VERSION)- DEFAULT_COMPRESSED_NAME=$(DEFAULT_COMPRESSED_BASENAME)$(VERSION)

1 0

r24809: {website} remove the open positions page, since we don't have them. (website/trunk/getinvolved/en)
by Andrew Lewman 06 Jun '11

06 Jun '11

Author: phobos Date: 2011-06-06 00:58:54 +0000 (Mon, 06 Jun 2011) New Revision: 24809 Modified: website/trunk/getinvolved/en/volunteer.wml Log: remove the open positions page, since we don't have them. Modified: website/trunk/getinvolved/en/volunteer.wml =================================================================== --- website/trunk/getinvolved/en/volunteer.wml 2011-06-06 00:54:52 UTC (rev 24808) +++ website/trunk/getinvolved/en/volunteer.wml 2011-06-06 00:58:54 UTC (rev 24809) @@ -27,9 +27,6 @@ we'd love to hear from you.</li> </ol> - <p>Tor has <a href="<page getinvolved/open-positions>">two open positions</a>. - Please <a href="<page about/contact>">contact us</a> if you are qualified!</p> - <a id="Documentation"></a> <h2><a class="anchor" href="#Documentation">Documentation</a></h2> <ol>

1 0

r24808: {website} tor 0.2.2.28-beta is out. (website/trunk)
by Andrew Lewman 06 Jun '11

06 Jun '11

Author: phobos Date: 2011-06-06 00:54:52 +0000 (Mon, 06 Jun 2011) New Revision: 24808 Modified: website/trunk/Makefile Log: tor 0.2.2.28-beta is out. Modified: website/trunk/Makefile =================================================================== --- website/trunk/Makefile 2011-06-06 00:54:21 UTC (rev 24807) +++ website/trunk/Makefile 2011-06-06 00:54:52 UTC (rev 24808) @@ -11,8 +11,8 @@ # 5. ./publish export TORGIT=/home/runa/tordev/tor/.git -export STABLETAG=tor-0.2.2.27-beta -export DEVTAG=tor-0.2.2.27-beta +export STABLETAG=tor-0.2.2.28-beta +export DEVTAG=tor-0.2.2.28-beta WMLBASE=. SUBDIRS=docs eff projects press about download getinvolved donate torbutton

1 0