- tor-commits - lists.torproject.org

[tor/release-0.2.2] log when we finish ssl handshake and move to renegotiation
by arma＠torproject.org 20 Jun '11

20 Jun '11

commit 64bfbcb918a59edf8e7167954171f311d032fc4b Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jun 17 03:31:59 2011 -0400 log when we finish ssl handshake and move to renegotiation debug-level since it will be quite common. logged at both client and server side. this step should help us track what's going on with people filtering tor connections by our ssl habits. --- src/or/connection_or.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/src/or/connection_or.c b/src/or/connection_or.c index ed174c9..c019f65 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -929,13 +929,16 @@ connection_tls_continue_handshake(or_connection_t *conn) if (! tor_tls_used_v1_handshake(conn->tls)) { if (!tor_tls_is_server(conn->tls)) { if (conn->_base.state == OR_CONN_STATE_TLS_HANDSHAKING) { - // log_notice(LD_OR,"Done. state was TLS_HANDSHAKING."); + log_debug(LD_OR, "Done with initial SSL handshake (client-side). " + "Requesting renegotiation."); conn->_base.state = OR_CONN_STATE_TLS_CLIENT_RENEGOTIATING; goto again; } // log_notice(LD_OR,"Done. state was %d.", conn->_base.state); } else { /* improved handshake, but not a client. */ + log_debug(LD_OR, "Done with initial SSL handshake (server-side). " + "Expecting renegotiation."); tor_tls_set_renegotiate_callback(conn->tls, connection_or_tls_renegotiated_cb, conn);

1 0

[tor/release-0.2.2] Merge branch 'bug3407' into maint-0.2.2
by arma＠torproject.org 20 Jun '11

20 Jun '11

commit 209229f100d20958d0826d4f6773d7f6b3a43ade Merge: 64bfbcb 227896e Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 17 14:59:39 2011 -0400 Merge branch 'bug3407' into maint-0.2.2 changes/fix-connection_printf_to_buf | 15 ++++++++ src/or/control.c | 66 +++++++++++---------------------- 2 files changed, 37 insertions(+), 44 deletions(-)

1 0

[tor/release-0.2.2] Merge remote-tracking branch 'public/bug3369' into maint-0.2.2
by arma＠torproject.org 20 Jun '11

20 Jun '11

commit a25c0a5bf81768c4d4f6fe377cea48f47333a8c8 Merge: e70e836 e470f6a Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jun 14 13:46:10 2011 -0400 Merge remote-tracking branch 'public/bug3369' into maint-0.2.2 changes/bug3369 | 4 ++++ src/or/dnsserv.c | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-)

1 0

[tor/release-0.2.2] Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2
by arma＠torproject.org 20 Jun '11

20 Jun '11

commit 85d4c290d79264d334baa9e5c8fdf3b06d0b3d79 Merge: 209229f 010b8dd Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 17 15:24:23 2011 -0400 Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2 changes/abandon-rend-circs-on-newnym | 8 ++++++++ src/or/circuituse.c | 3 ++- 2 files changed, 10 insertions(+), 1 deletions(-)

1 0

[tor/release-0.2.2] Revert "Add an "auto" option to UseBridges"
by arma＠torproject.org 20 Jun '11

20 Jun '11

commit 3b41551b61a604b555891ecc7cb6f8bbde65d128 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 17 16:45:53 2011 -0400 Revert "Add an "auto" option to UseBridges" This reverts commit 507c1257a4d9c629fefc2adbad8db73607749734. --- src/or/config.c | 19 ++++--------------- src/or/or.h | 12 +----------- 2 files changed, 5 insertions(+), 26 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index 8ab23a3..e0ecab2 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -376,7 +376,7 @@ static config_var_t _option_vars[] = { V(TransPort, PORT, "0"), V(TunnelDirConns, BOOL, "1"), V(UpdateBridgesFromAuthority, BOOL, "0"), - VAR("UseBridges", STRING, UseBridges_, "auto"), + V(UseBridges, BOOL, "0"), V(UseEntryGuards, BOOL, "1"), V(User, STRING, NULL), VAR("V1AuthoritativeDirectory",BOOL, V1AuthoritativeDir, "0"), @@ -3234,19 +3234,6 @@ options_validate(or_options_t *old_options, or_options_t *options, "of the Internet, so they must not set Reachable*Addresses " "or FascistFirewall."); - /* XXX023 use autobool instead. */ - if (!strcmp(options->UseBridges_, "auto")) { - options->UseBridges = (options->Bridges && - !server_mode(options) && - !options->EntryNodes); - } else if (!strcmp(options->UseBridges_, "0")) { - options->UseBridges = 0; - } else if (!strcmp(options->UseBridges_, "1")) { - options->UseBridges = 1; - } else { - REJECT("UseBridges must be 0, 1, or auto"); - } - if (options->UseBridges && server_mode(options)) REJECT("Servers must be able to freely connect to the rest " @@ -3581,8 +3568,10 @@ options_validate(or_options_t *old_options, or_options_t *options, if (validate_dir_authorities(options, old_options) < 0) REJECT("Directory authority line did not parse. See logs for details."); + if (options->UseBridges && !options->Bridges) + REJECT("If you set UseBridges, you must specify at least one bridge."); if (options->UseBridges && !options->TunnelDirConns) - REJECT("TunnelDirConns set to 0 only works with UseBridges set to 0"); + REJECT("If you set UseBridges, you must set TunnelDirConns."); if (options->Bridges) { for (cl = options->Bridges; cl; cl = cl->next) { if (parse_bridge_line(cl->value, 1)<0) diff --git a/src/or/or.h b/src/or/or.h index 456dce2..97fecd1 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2480,17 +2480,7 @@ typedef struct { * when doing so. */ char *BridgePassword; - /** Whether we should start all circuits with a bridge. "1" means strictly - * yes, "0" means strictly no, and "auto" means that we do iff any bridges - * are configured, we are not running a server and have not specified a list - * of entry nodes. */ - char *UseBridges_; - /** Effective value of UseBridges. Will be set equally for UseBridges set to - * 1 or 0, but for 'auto' it will be set to 1 iff any bridges are - * configured, we are not running a server and have not specified a list of - * entry nodes. */ - int UseBridges; - + int UseBridges; /**< Boolean: should we start all circuits with a bridge? */ config_line_t *Bridges; /**< List of bootstrap bridge addresses. */ int BridgeRelay; /**< Boolean: are we acting as a bridge relay? We make

1 0

[tor/release-0.2.2] Abandon rendezvous circuits on SIGNAL NEWNYM
by arma＠torproject.org 20 Jun '11

20 Jun '11

commit 010b8dd4f6e8e3c3d2e44ff589ff61cbf64b952a Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Thu Jun 9 19:56:40 2011 -0700 Abandon rendezvous circuits on SIGNAL NEWNYM --- changes/abandon-rend-circs-on-newnym | 8 ++++++++ src/or/circuituse.c | 3 ++- 2 files changed, 10 insertions(+), 1 deletions(-) diff --git a/changes/abandon-rend-circs-on-newnym b/changes/abandon-rend-circs-on-newnym new file mode 100644 index 0000000..67cb2dc --- /dev/null +++ b/changes/abandon-rend-circs-on-newnym @@ -0,0 +1,8 @@ + o Security fixes: + - Don't attach new streams to old rendezvous circuits after SIGNAL + NEWNYM. Previously, we would keep using an existing rendezvous + circuit if it remained open (i.e. if it were kept open by a + long-lived stream or if a new stream were attached to it before + Tor could notice that it was old and no longer in use and close + it). Bugfix on 0.1.1.15-rc; fixes bug 3375. + diff --git a/src/or/circuituse.c b/src/or/circuituse.c index 41c1899..48fc198 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -59,7 +59,8 @@ circuit_is_acceptable(circuit_t *circ, edge_connection_t *conn, return 0; } - if (purpose == CIRCUIT_PURPOSE_C_GENERAL) + if (purpose == CIRCUIT_PURPOSE_C_GENERAL || + purpose == CIRCUIT_PURPOSE_C_REND_JOINED) if (circ->timestamp_dirty && circ->timestamp_dirty+get_options()->MaxCircuitDirtiness <= now) return 0;

1 0

[tor/release-0.2.2] Make ControlSocketsGroupWritable work with User.
by arma＠torproject.org 20 Jun '11

20 Jun '11

commit 54d7d31cba84232b50fef4287951b2c4bfa746c2 Author: Jérémy Bobbio <lunar(a)debian.org> Date: Tue Jun 14 12:18:32 2011 -0400 Make ControlSocketsGroupWritable work with User. Original message from bug3393: check_private_dir() to ensure that ControlSocketsGroupWritable is safe to use. Unfortunately, check_private_dir() only checks against the currently running user… which can be root until privileges are dropped to the user and group configured by the User config option. The attached patch fixes the issue by adding a new effective_user argument to check_private_dir() and updating the callers. It might not be the best way to fix the issue, but it did in my tests. (Code by lunar; changelog by nickm) --- src/common/util.c | 33 ++++++++++++++++++++++++++------- src/common/util.h | 3 ++- src/or/config.c | 6 ++++-- src/or/connection.c | 2 +- src/or/geoip.c | 6 +++--- src/or/rendservice.c | 2 +- src/or/rephist.c | 4 ++-- src/or/router.c | 4 ++-- 8 files changed, 41 insertions(+), 19 deletions(-) diff --git a/src/common/util.c b/src/common/util.c index 6f323dd..36aa9cc 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -1677,15 +1677,20 @@ file_status(const char *fname) * is group-readable, but in all cases we create the directory mode 0700. * If CPD_CHECK_MODE_ONLY is set, then we don't alter the directory permissions * if they are too permissive: we just return -1. + * When effective_user is not NULL, check permissions against the given user and + * its primary group. */ int -check_private_dir(const char *dirname, cpd_check_t check) +check_private_dir(const char *dirname, cpd_check_t check, const char *effective_user) { int r; struct stat st; char *f; #ifndef MS_WINDOWS int mask; + struct passwd *pw = NULL; + uid_t running_uid; + gid_t running_gid; #endif tor_assert(dirname); @@ -1724,33 +1729,47 @@ check_private_dir(const char *dirname, cpd_check_t check) return -1; } #ifndef MS_WINDOWS - if (st.st_uid != getuid()) { + if (effective_user) { + /* Lookup the user and group information, if we have a problem, bail out. */ + pw = getpwnam(effective_user); + if (pw == NULL) { + log_warn(LD_CONFIG, "Error setting configured user: %s not found", effective_user); + return -1; + } + running_uid = pw->pw_uid; + running_gid = pw->pw_gid; + } else { + running_uid = getuid(); + running_gid = getgid(); + } + + if (st.st_uid != running_uid) { struct passwd *pw = NULL; char *process_ownername = NULL; - pw = getpwuid(getuid()); + pw = getpwuid(running_uid); process_ownername = pw ? tor_strdup(pw->pw_name) : tor_strdup("<unknown>"); pw = getpwuid(st.st_uid); log_warn(LD_FS, "%s is not owned by this user (%s, %d) but by " "%s (%d). Perhaps you are running Tor as the wrong user?", - dirname, process_ownername, (int)getuid(), + dirname, process_ownername, (int)running_uid, pw ? pw->pw_name : "<unknown>", (int)st.st_uid); tor_free(process_ownername); return -1; } - if ((check & CPD_GROUP_OK) && st.st_gid != getgid()) { + if ((check & CPD_GROUP_OK) && st.st_gid != running_gid) { struct group *gr; char *process_groupname = NULL; - gr = getgrgid(getgid()); + gr = getgrgid(running_gid); process_groupname = gr ? tor_strdup(gr->gr_name) : tor_strdup("<unknown>"); gr = getgrgid(st.st_gid); log_warn(LD_FS, "%s is not owned by this group (%s, %d) but by group " "%s (%d). Are you running Tor as the wrong user?", - dirname, process_groupname, (int)getgid(), + dirname, process_groupname, (int)running_gid, gr ? gr->gr_name : "<unknown>", (int)st.st_gid); tor_free(process_groupname); diff --git a/src/common/util.h b/src/common/util.h index d657db6..b9db25c 100644 --- a/src/common/util.h +++ b/src/common/util.h @@ -292,7 +292,8 @@ typedef unsigned int cpd_check_t; #define CPD_CHECK 2 #define CPD_GROUP_OK 4 #define CPD_CHECK_MODE_ONLY 8 -int check_private_dir(const char *dirname, cpd_check_t check); +int check_private_dir(const char *dirname, cpd_check_t check, + const char *effective_user); #define OPEN_FLAGS_REPLACE (O_WRONLY|O_CREAT|O_TRUNC) #define OPEN_FLAGS_APPEND (O_WRONLY|O_CREAT|O_APPEND) typedef struct open_file_t open_file_t; diff --git a/src/or/config.c b/src/or/config.c index 44cecf3..8ab23a3 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1025,7 +1025,8 @@ options_act_reversible(or_options_t *old_options, char **msg) /* Ensure data directory is private; create if possible. */ if (check_private_dir(options->DataDirectory, - running_tor ? CPD_CREATE : CPD_CHECK)<0) { + running_tor ? CPD_CREATE : CPD_CHECK, + options->User)<0) { tor_asprintf(msg, "Couldn't access/create private data directory \"%s\"", options->DataDirectory); @@ -1038,7 +1039,8 @@ options_act_reversible(or_options_t *old_options, char **msg) char *fn = tor_malloc(len); tor_snprintf(fn, len, "%s"PATH_SEPARATOR"cached-status", options->DataDirectory); - if (check_private_dir(fn, running_tor ? CPD_CREATE : CPD_CHECK) < 0) { + if (check_private_dir(fn, running_tor ? CPD_CREATE : CPD_CHECK, + options->User) < 0) { tor_asprintf(msg, "Couldn't access/create private data directory \"%s\"", fn); tor_free(fn); diff --git a/src/or/connection.c b/src/or/connection.c index 3f4ca1d..a9e3a74 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -867,7 +867,7 @@ check_location_for_unix_socket(or_options_t *options, const char *path) if (options->ControlSocketsGroupWritable) flags |= CPD_GROUP_OK; - if (check_private_dir(p, flags) < 0) { + if (check_private_dir(p, flags, options->User) < 0) { char *escpath, *escdir; escpath = esc_for_log(path); escdir = esc_for_log(p); diff --git a/src/or/geoip.c b/src/or/geoip.c index 5bb2410..c621ea8 100644 --- a/src/or/geoip.c +++ b/src/or/geoip.c @@ -970,7 +970,7 @@ geoip_dirreq_stats_write(time_t now) geoip_remove_old_clients(start_of_dirreq_stats_interval); statsdir = get_datadir_fname("stats"); - if (check_private_dir(statsdir, CPD_CREATE) < 0) + if (check_private_dir(statsdir, CPD_CREATE, get_options()->User) < 0) goto done; filename = get_datadir_fname2("stats", "dirreq-stats"); data_v2 = geoip_get_client_history(GEOIP_CLIENT_NETWORKSTATUS_V2); @@ -1209,7 +1209,7 @@ geoip_bridge_stats_write(time_t now) /* Write it to disk. */ statsdir = get_datadir_fname("stats"); - if (check_private_dir(statsdir, CPD_CREATE) < 0) + if (check_private_dir(statsdir, CPD_CREATE, get_options()->User) < 0) goto done; filename = get_datadir_fname2("stats", "bridge-stats"); @@ -1304,7 +1304,7 @@ geoip_entry_stats_write(time_t now) geoip_remove_old_clients(start_of_entry_stats_interval); statsdir = get_datadir_fname("stats"); - if (check_private_dir(statsdir, CPD_CREATE) < 0) + if (check_private_dir(statsdir, CPD_CREATE, get_options()->User) < 0) goto done; filename = get_datadir_fname2("stats", "entry-stats"); data = geoip_get_client_history(GEOIP_CLIENT_CONNECT); diff --git a/src/or/rendservice.c b/src/or/rendservice.c index a10e43f..d9a9364 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -569,7 +569,7 @@ rend_service_load_keys(void) s->directory); /* Check/create directory */ - if (check_private_dir(s->directory, CPD_CREATE) < 0) + if (check_private_dir(s->directory, CPD_CREATE, get_options()->User) < 0) return -1; /* Load key */ diff --git a/src/or/rephist.c b/src/or/rephist.c index 54593a0..b7341f3 100644 --- a/src/or/rephist.c +++ b/src/or/rephist.c @@ -2307,7 +2307,7 @@ rep_hist_exit_stats_write(time_t now) /* Try to write to disk. */ statsdir = get_datadir_fname("stats"); - if (check_private_dir(statsdir, CPD_CREATE) < 0) { + if (check_private_dir(statsdir, CPD_CREATE, get_options()->User) < 0) { log_warn(LD_HIST, "Unable to create stats/ directory!"); goto done; } @@ -2497,7 +2497,7 @@ rep_hist_buffer_stats_write(time_t now) smartlist_clear(circuits_for_buffer_stats); /* write to file */ statsdir = get_datadir_fname("stats"); - if (check_private_dir(statsdir, CPD_CREATE) < 0) + if (check_private_dir(statsdir, CPD_CREATE, get_options()->User) < 0) goto done; filename = get_datadir_fname2("stats", "buffer-stats"); out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND, diff --git a/src/or/router.c b/src/or/router.c index 68e29bb..2165e6e 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -533,12 +533,12 @@ init_keys(void) return 0; } /* Make sure DataDirectory exists, and is private. */ - if (check_private_dir(options->DataDirectory, CPD_CREATE)) { + if (check_private_dir(options->DataDirectory, CPD_CREATE, options->User)) { return -1; } /* Check the key directory. */ keydir = get_datadir_fname("keys"); - if (check_private_dir(keydir, CPD_CREATE)) { + if (check_private_dir(keydir, CPD_CREATE, options->User)) { tor_free(keydir); return -1; }

1 0

[tor/release-0.2.2] Detect insanely large circuit build state; don't give its length to rand_int
by arma＠torproject.org 20 Jun '11

20 Jun '11

commit 42e4e156d95a1c28a666a5346d491c4ed71435dd Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 1 12:12:01 2011 -0400 Detect insanely large circuit build state; don't give its length to rand_int --- changes/bug3306 | 4 ++++ src/or/circuitbuild.c | 10 +++++++++- 2 files changed, 13 insertions(+), 1 deletions(-) diff --git a/changes/bug3306 b/changes/bug3306 index b1bb103..f868a24 100644 --- a/changes/bug3306 +++ b/changes/bug3306 @@ -3,3 +3,7 @@ correctly. Previously, it accepted values up to UINT_MAX, but could return a negative number if given a value above INT_MAX+1. Found by George Kadianakis. Fixes bug 3306; bugfix on 0.2.2pre14. + + - Avoid a segfault when reading a malformed circuit build state + with more than INT_MAX entries. Found by wanoskarnet. Bugfix on + 0.2.2.4-alpha. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 3f08448..6d7e711 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -678,7 +678,15 @@ circuit_build_times_shuffle_and_store_array(circuit_build_times_t *cbt, log_notice(LD_CIRC, "The number of circuit times that this Tor version " "uses to calculate build times is less than the number stored " "in your state file. Decreasing the circuit time history from " - "%d to %d.", num_times, CBT_NCIRCUITS_TO_OBSERVE); + "%lu to %d.", (unsigned long)num_times, + CBT_NCIRCUITS_TO_OBSERVE); + } + + if (n > INT_MAX-1) { + log_warn(LD_CIRC, "For some insane reasons, you had %lu circuit build " + "observations in your state file. That's far too many; probably " + "there's a bug here.", (unsigned long)n); + n = INT_MAX-1; } /* This code can only be run on a compact array */

1 0

[tor/release-0.2.2] Merge branch 'bug3306_nm_squashed' into maint-0.2.2
by arma＠torproject.org 20 Jun '11

20 Jun '11

commit 9e3fc5f61685f937d76e60c5fa1781b80aa5bf68 Merge: 83e3975 42e4e15 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 6 16:18:24 2011 -0400 Merge branch 'bug3306_nm_squashed' into maint-0.2.2 changes/bug3306 | 9 +++++++++ src/common/crypto.c | 5 +++-- src/or/circuitbuild.c | 10 +++++++++- 3 files changed, 21 insertions(+), 3 deletions(-)

1 0

[tor/release-0.2.2] Don't use signed 1-bit bitfields
by arma＠torproject.org 20 Jun '11

20 Jun '11

commit 680646e0de29454f92d57bc3a4895d75c95e158c Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Wed Jun 8 21:27:32 2011 +0200 Don't use signed 1-bit bitfields This was harmless, we never compared it to anything but itself or 0. But Coverity complained, and it had a point. --- changes/coverity_maint | 1 + src/or/policies.c | 2 +- 2 files changed, 2 insertions(+), 1 deletions(-) diff --git a/changes/coverity_maint b/changes/coverity_maint index fd8c440..6d60355 100644 --- a/changes/coverity_maint +++ b/changes/coverity_maint @@ -4,4 +4,5 @@ o Minor bugfixes: - Add some forgotten return value checks during unit tests. Found by coverity. + - Don't use 1-bit wide signed bit fields. Found by coverity. diff --git a/src/or/policies.c b/src/or/policies.c index e48f420..c870360 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -45,7 +45,7 @@ typedef struct policy_summary_item_t { uint16_t prt_max; /**< Highest port number to accept/reject. */ uint64_t reject_count; /**< Number of IP-Addresses that are rejected to this port range. */ - int accepted:1; /** Has this port already been accepted */ + unsigned int accepted:1; /** Has this port already been accepted */ } policy_summary_item_t; /** Private networks. This list is used in two places, once to expand the

1 0