- tor-commits - lists.torproject.org

[tor-browser-build/maint-9.0] Picking up 68.8.0esr rc2
by gk＠torproject.org 30 Apr '20

30 Apr '20

commit 545e9783a2faf9d577036ddc4f102c5a52dcb467 Author: Georg Koppen <gk(a)torproject.org> Date: Thu Apr 30 06:08:46 2020 +0000 Picking up 68.8.0esr rc2 --- projects/firefox-langpacks/config | 2 +- projects/firefox-locale-bundle/config | 2 +- projects/firefox/config | 2 +- rbm.conf | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/projects/firefox-langpacks/config b/projects/firefox-langpacks/config index 34d6fad..17a707a 100644 --- a/projects/firefox-langpacks/config +++ b/projects/firefox-langpacks/config @@ -4,7 +4,7 @@ filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/buil var: ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build2 input_filename: 'dl-langpack-[% c("var/ff_arch") %]-[% c("version") %]' targets: diff --git a/projects/firefox-locale-bundle/config b/projects/firefox-locale-bundle/config index 2f4997f..2ea6db6 100644 --- a/projects/firefox-locale-bundle/config +++ b/projects/firefox-locale-bundle/config @@ -5,4 +5,4 @@ filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' var: use_container: 0 ff_version: '[% pc("firefox", "var/firefox_version") %]' - ff_build: build1 + ff_build: build2 diff --git a/projects/firefox/config b/projects/firefox/config index 75efe0d..9d7c3c2 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,7 +1,7 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build1' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-2-build1' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git git_submodule: 1 diff --git a/rbm.conf b/rbm.conf index e23a15b..88a6565 100644 --- a/rbm.conf +++ b/rbm.conf @@ -25,7 +25,7 @@ buildconf: var: torbrowser_version: '9.0.10' - torbrowser_build: 'build1' + torbrowser_build: 'build2' torbrowser_incremental_from: - 9.0.9 project_name: tor-browser

1 0

[tor/master] practracker: Accept the connection buf refactor
by teor＠torproject.org 30 Apr '20

30 Apr '20

commit efcae919aea4611d9f4ec5815170c48fc67134cf Author: teor <teor(a)torproject.org> Date: Thu Apr 30 13:55:26 2020 +1000 practracker: Accept the connection buf refactor Accept a few extra lines from the connection_buf_read_from_socket() refactor. Cleanup after 33131. --- scripts/maint/practracker/exceptions.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/maint/practracker/exceptions.txt b/scripts/maint/practracker/exceptions.txt index bf37d476f..8f718deff 100644 --- a/scripts/maint/practracker/exceptions.txt +++ b/scripts/maint/practracker/exceptions.txt @@ -68,7 +68,7 @@ problem function-size /src/core/mainloop/connection.c:connection_handle_listener problem function-size /src/core/mainloop/connection.c:connection_read_proxy_handshake() 153 problem function-size /src/core/mainloop/connection.c:retry_listener_ports() 112 problem function-size /src/core/mainloop/connection.c:connection_handle_read_impl() 111 -problem function-size /src/core/mainloop/connection.c:connection_buf_read_from_socket() 180 +problem function-size /src/core/mainloop/connection.c:connection_buf_read_from_socket() 186 problem function-size /src/core/mainloop/connection.c:connection_handle_write_impl() 241 problem function-size /src/core/mainloop/connection.c:assert_connection_ok() 143 problem dependency-violation /src/core/mainloop/connection.c 47

1 0

[tor/master] relay: Fix a comment typo in the selftest.c header
by teor＠torproject.org 30 Apr '20

30 Apr '20

commit 3eca667ae4ab7dfd4d6f87858808b2775ffb1340 Author: teor <teor(a)torproject.org> Date: Thu Apr 30 13:54:40 2020 +1000 relay: Fix a comment typo in the selftest.c header --- src/feature/relay/selftest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/feature/relay/selftest.c b/src/feature/relay/selftest.c index 8aaf068f9..402ce0e3d 100644 --- a/src/feature/relay/selftest.c +++ b/src/feature/relay/selftest.c @@ -8,7 +8,7 @@ * \file selftest.c * \brief Relay self-testing * - * Relays need to make sure that their own ports are reasonable, and estimate + * Relays need to make sure that their own ports are reachable, and estimate * their own bandwidth, before publishing. */

1 0

[translation/torbutton-torbuttonproperties_completed] https://gitweb.torproject.org/translation.git/commit/?h=torbutton-torbuttonproperties_completed
by translation＠torproject.org 30 Apr '20

30 Apr '20

commit 811444e263378d4c2c802240f94b02ca49954e4f Author: Translation commit bot <translation(a)torproject.org> Date: Thu Apr 30 02:51:52 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=torbutton-torbutton… --- sv-SE/torbutton.properties | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sv-SE/torbutton.properties b/sv-SE/torbutton.properties index fec775e55e..af27571723 100644 --- a/sv-SE/torbutton.properties +++ b/sv-SE/torbutton.properties @@ -20,9 +20,9 @@ torbutton.popup.external.title = Ladda ned en extern filtyp? torbutton.popup.external.app = Tor Browser kan inte visa filen. Du behöver öppna den i ett annat program.\n\n torbutton.popup.external.note = Vissa typer av filer kan få program att ansluta till internet utan att använda Tor.\n\n torbutton.popup.external.suggest = Det är säkrast att öppna filer du har hämtat hem bara när du är offline, eller så kan du använda en Tor Live CD som till exempel Tails.\n -torbutton.popup.launch = Hämta hem filen +torbutton.popup.launch = Hämta fil torbutton.popup.cancel = Avbryt -torbutton.popup.dontask = Hämta hem filer automatiskt i fortsättningen +torbutton.popup.dontask = Hämta filer automatiskt i fortsättningen torbutton.popup.no_newnym = Torbutton kan inte säkert ge dig en ny identitet. Det har inte tillgång till Tor Control Port.\n\nKör du Tor Browser Bundle? # torbutton.security_settings.menu.title = Security Settings torbutton.title.prompt_torbrowser = Viktig information om Torbutton

1 0

[translation/torbutton-torbuttonproperties] https://gitweb.torproject.org/translation.git/commit/?h=torbutton-torbuttonproperties
by translation＠torproject.org 30 Apr '20

30 Apr '20

commit aba524eb27e69f7bacf851c40800ddcb7115cdce Author: Translation commit bot <translation(a)torproject.org> Date: Thu Apr 30 02:51:46 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=torbutton-torbutton… --- sv-SE/torbutton.properties | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/sv-SE/torbutton.properties b/sv-SE/torbutton.properties index c33b4dc49d..78fff3a93e 100644 --- a/sv-SE/torbutton.properties +++ b/sv-SE/torbutton.properties @@ -20,9 +20,9 @@ torbutton.popup.external.title = Ladda ned en extern filtyp? torbutton.popup.external.app = Tor Browser kan inte visa filen. Du behöver öppna den i ett annat program.\n\n torbutton.popup.external.note = Vissa typer av filer kan få program att ansluta till internet utan att använda Tor.\n\n torbutton.popup.external.suggest = Det är säkrast att öppna filer du har hämtat hem bara när du är offline, eller så kan du använda en Tor Live CD som till exempel Tails.\n -torbutton.popup.launch = Hämta hem filen +torbutton.popup.launch = Hämta fil torbutton.popup.cancel = Avbryt -torbutton.popup.dontask = Hämta hem filer automatiskt i fortsättningen +torbutton.popup.dontask = Hämta filer automatiskt i fortsättningen torbutton.popup.no_newnym = Torbutton kan inte säkert ge dig en ny identitet. Det har inte tillgång till Tor Control Port.\n\nKör du Tor Browser Bundle? torbutton.security_settings.menu.title = Säkerhetsinställningar torbutton.title.prompt_torbrowser = Viktig information om Torbutton @@ -55,7 +55,7 @@ profileMigrationFailed=Migrering av din befintliga %S profil misslyckades.\nNya # "Downloading update" string for the hamburger menu (see #28885). # This string is kept here for ease of translation. # LOCALIZATION NOTE: %S is the application name. -updateDownloadingPanelUILabel=Hämtar % s-uppdatering +updateDownloadingPanelUILabel=Hämtar %S-uppdatering # .Onion Page Info prompt. Strings are kept here for ease of translation. pageInfo_OnionEncryptionWithBitsAndProtocol=Anslutning krypterad (Onion-tjänst, %1$S, %2$S bit nycklar, %3$S)

1 0

[tor/master] test/cell_formats: Expand the IPv6-only EXTEND2 test
by nickm＠torproject.org 29 Apr '20

29 Apr '20

commit f6c8a8c5387eaf35470f08e9cd9b35f05bdc1057 Author: teor <teor(a)torproject.org> Date: Tue Apr 14 18:44:06 2020 +1000 test/cell_formats: Expand the IPv6-only EXTEND2 test Part of 33901. --- src/test/test_cell_formats.c | 41 ++++++++++++++++++++++++++++++++++------- 1 file changed, 34 insertions(+), 7 deletions(-) diff --git a/src/test/test_cell_formats.c b/src/test/test_cell_formats.c index 3d3f151fc..f9ff101c9 100644 --- a/src/test/test_cell_formats.c +++ b/src/test/test_cell_formats.c @@ -769,6 +769,40 @@ test_cfmt_extend_cells(void *arg) tt_mem_op("brownshoesdontmakeit/brownshoesd", OP_EQ, ec.ed_pubkey.pubkey, 32); + /* Now try IPv6 without IPv4 */ + memset(p, 0, sizeof(p)); + memcpy(p, "\x02", 1); + memcpy(p+1, "\x02\x14" "anthropomorphization", 22); + memcpy(p+23, "\x01\x12" "xxxxxxxxxxxxxxxxYY", 20); + memcpy(p+43, "\xff\xff\x00\x20", 4); + tt_int_op(0, OP_EQ, extend_cell_parse(&ec, RELAY_COMMAND_EXTEND2, + p, sizeof(p))); + tt_int_op(RELAY_COMMAND_EXTEND2, OP_EQ, ec.cell_type); + tt_assert(fast_mem_is_zero((const char *)&ec.orport_ipv4.addr, + sizeof(tor_addr_t))); + tt_int_op(0, OP_EQ, ec.orport_ipv4.port); + tt_str_op("7878:7878:7878:7878:7878:7878:7878:7878", + OP_EQ, fmt_addr(&ec.orport_ipv6.addr)); + tt_int_op(22873, OP_EQ, ec.orport_ipv6.port); + tt_assert(ed25519_public_key_is_zero(&ec.ed_pubkey)); + tt_mem_op(ec.node_id,OP_EQ, "anthropomorphization", 20); + tt_int_op(cc->cell_type, OP_EQ, CELL_CREATE2); + tt_int_op(cc->handshake_type, OP_EQ, 0xffff); + tt_int_op(cc->handshake_len, OP_EQ, 32); + tt_int_op(0, OP_EQ, extend_cell_format(&p2_cmd, &p2_len, p2, &ec)); + tt_int_op(p2_cmd, OP_EQ, RELAY_COMMAND_EXTEND2); + tt_int_op(p2_len, OP_EQ, 47+32); + test_memeq_hex(p2, + /* Two items */ + "02" + /* The next is an RSA digest: anthropomorphization */ + "0214" "616e7468726f706f6d6f727068697a6174696f6e" + /*IPv6 address */ + "0112" "78787878787878787878787878787878" "5959" + /* Now the handshake prologue */ + "ffff0020"); + tt_int_op(0, OP_EQ, create_cell_format_relayed(&cell, cc)); + /* == Now try parsing some junk */ /* Try a too-long handshake */ @@ -824,13 +858,6 @@ test_cfmt_extend_cells(void *arg) memcpy(p+48, "\xff\xff\x00\x20", 4); tt_int_op(-1, OP_EQ, extend_cell_parse(&ec, RELAY_COMMAND_EXTEND2, p, sizeof(p))); - memset(p, 0, sizeof(p)); - memcpy(p, "\x02", 1); - memcpy(p+1, "\x02\x14" "anarchoindividualist", 22); - memcpy(p+23, "\x01\x12" "xxxxxxxxxxxxxxxxYY", 18); - memcpy(p+41, "\xff\xff\x00\x20", 4); - tt_int_op(0, OP_EQ, extend_cell_parse(&ec, RELAY_COMMAND_EXTEND2, - p, sizeof(p))); /* Running out of space in specifiers */ memset(p,0,sizeof(p));

1 0

[tor/master] core/or: Support IPv6 EXTEND2 cells
by nickm＠torproject.org 29 Apr '20

29 Apr '20

commit bd6ab90ad4b40a64c604c1a4b6b37da6991fad9e Author: teor <teor(a)torproject.org> Date: Tue Apr 14 15:08:42 2020 +1000 core/or: Support IPv6 EXTEND2 cells Allow clients and relays to send dual-stack and IPv6-only EXTEND2 cells. Parse dual-stack and IPv6-only EXTEND2 cells on relays. Relays do not make connections or extend circuits via IPv6: that's the next step. Closes ticket 33901. --- changes/ticket33901 | 4 ++++ src/core/or/onion.c | 41 ++++++++++++++++++++++++++++++++++------- src/lib/net/address.c | 14 ++++++++++++++ src/lib/net/address.h | 1 + src/test/test_cell_formats.c | 39 ++++++++++++++++++++++++++------------- 5 files changed, 79 insertions(+), 20 deletions(-) diff --git a/changes/ticket33901 b/changes/ticket33901 new file mode 100644 index 000000000..b824cc5b0 --- /dev/null +++ b/changes/ticket33901 @@ -0,0 +1,4 @@ + o Minor features (IPv6, relay): + - Allow clients and relays to send dual-stack and IPv6-only EXTEND2 cells. + Parse dual-stack and IPv6-only EXTEND2 cells on relays. + Closes ticket 33901. diff --git a/src/core/or/onion.c b/src/core/or/onion.c index 45144b5e6..543d9f3e4 100644 --- a/src/core/or/onion.c +++ b/src/core/or/onion.c @@ -240,11 +240,21 @@ created_cell_parse(created_cell_t *cell_out, const cell_t *cell_in) static int check_extend_cell(const extend_cell_t *cell) { + const bool is_extend2 = (cell->cell_type == RELAY_COMMAND_EXTEND2); + if (tor_digest_is_zero((const char*)cell->node_id)) return -1; - /* We don't currently allow EXTEND2 cells without an IPv4 address */ - if (tor_addr_family(&cell->orport_ipv4.addr) == AF_UNSPEC) - return -1; + if (tor_addr_family(&cell->orport_ipv4.addr) == AF_UNSPEC) { + /* EXTEND cells must have an IPv4 address. */ + if (!is_extend2) { + return -1; + } + /* EXTEND2 cells must have at least one IP address. + * It can be IPv4 or IPv6. */ + if (tor_addr_family(&cell->orport_ipv6.addr) == AF_UNSPEC) { + return -1; + } + } if (cell->create_cell.cell_type == CELL_CREATE) { if (cell->cell_type != RELAY_COMMAND_EXTEND) return -1; @@ -364,7 +374,12 @@ extend_cell_from_extend2_cell_body(extend_cell_t *cell_out, } } - if (!found_rsa_id || !found_ipv4) /* These are mandatory */ + /* EXTEND2 cells must have an RSA ID */ + if (!found_rsa_id) + return -1; + + /* EXTEND2 cells must have at least one IP address */ + if (!found_ipv4 && !found_ipv6) return -1; return create_cell_from_create2_cell_body(&cell_out->create_cell, @@ -620,12 +635,13 @@ extend_cell_format(uint8_t *command_out, uint16_t *len_out, break; case RELAY_COMMAND_EXTEND2: { - uint8_t n_specifiers = 2; + uint8_t n_specifiers = 1; *command_out = RELAY_COMMAND_EXTEND2; extend2_cell_body_t *cell = extend2_cell_body_new(); link_specifier_t *ls; - { - /* IPv4 specifier first. */ + if (tor_addr_port_is_valid_ap(&cell_in->orport_ipv4, 0)) { + /* Maybe IPv4 specifier first. */ + ++n_specifiers; ls = link_specifier_new(); extend2_cell_body_add_ls(cell, ls); ls->ls_type = LS_IPV4; @@ -651,6 +667,17 @@ extend_cell_format(uint8_t *command_out, uint16_t *len_out, ls->ls_len = 32; memcpy(ls->un_ed25519_id, cell_in->ed_pubkey.pubkey, 32); } + if (tor_addr_port_is_valid_ap(&cell_in->orport_ipv6, 0)) { + /* Then maybe IPv6 specifier. */ + ++n_specifiers; + ls = link_specifier_new(); + extend2_cell_body_add_ls(cell, ls); + ls->ls_type = LS_IPV6; + ls->ls_len = 18; + tor_addr_get_ipv6_bytes((char *)ls->un_ipv6_addr, + &cell_in->orport_ipv6.addr); + ls->un_ipv6_port = cell_in->orport_ipv6.port; + } cell->n_spec = n_specifiers; /* Now, the handshake */ diff --git a/src/lib/net/address.c b/src/lib/net/address.c index 5dbef6a79..5fe9abca1 100644 --- a/src/lib/net/address.c +++ b/src/lib/net/address.c @@ -903,6 +903,20 @@ tor_addr_from_in6(tor_addr_t *dest, const struct in6_addr *in6) tor_addr_from_ipv6_bytes(dest, (const char*)in6->s6_addr); } +/** Set the 16 bytes at dest to equal the IPv6 address src. + * src must be an IPv6 address, if it is not, log a warning, and clear + * dest. */ +void +tor_addr_get_ipv6_bytes(char *dest, const tor_addr_t *src) +{ + tor_assert(dest); + tor_assert(src); + memset(dest, 0, 16); + IF_BUG_ONCE(src->family != AF_INET6) + return; + memcpy(dest, src->addr.in6_addr.s6_addr, 16); +} + /** Copy a tor_addr_t from src to dest. */ void diff --git a/src/lib/net/address.h b/src/lib/net/address.h index 498449493..f1c223310 100644 --- a/src/lib/net/address.h +++ b/src/lib/net/address.h @@ -303,6 +303,7 @@ void tor_addr_from_ipv6_bytes(tor_addr_t *dest, const char *bytes); #define tor_addr_from_in(dest, in) \ tor_addr_from_ipv4n((dest), (in)->s_addr); void tor_addr_from_in6(tor_addr_t *dest, const struct in6_addr *in6); +void tor_addr_get_ipv6_bytes(char *dest, const tor_addr_t *src); int tor_addr_is_null(const tor_addr_t *addr); int tor_addr_is_loopback(const tor_addr_t *addr); diff --git a/src/test/test_cell_formats.c b/src/test/test_cell_formats.c index 8d6d1940f..3d3f151fc 100644 --- a/src/test/test_cell_formats.c +++ b/src/test/test_cell_formats.c @@ -713,16 +713,20 @@ test_cfmt_extend_cells(void *arg) tt_mem_op(cc->onionskin,OP_EQ, b, 99+20); tt_int_op(0, OP_EQ, extend_cell_format(&p2_cmd, &p2_len, p2, &ec)); tt_int_op(p2_cmd, OP_EQ, RELAY_COMMAND_EXTEND2); - /* We'll generate it minus the IPv6 address and minus the konami code */ - tt_int_op(p2_len, OP_EQ, 89+99-34-20); + /* We'll generate it minus the konami code */ + tt_int_op(p2_len, OP_EQ, 89+99-34); test_memeq_hex(p2, - /* Two items: one that same darn IP address. */ - "02000612F40001F0F1" - /* The next is a digest : anthropomorphization */ - "0214616e7468726f706f6d6f727068697a6174696f6e" + /* Three items */ + "03" + /* IPv4 address */ + "0006" "12F40001" "F0F1" + /* The next is an RSA digest: anthropomorphization */ + "0214" "616e7468726f706f6d6f727068697a6174696f6e" + /*IPv6 address */ + "0112" "20020000000000000000000000f0c51e" "1112" /* Now the handshake prologue */ "01050063"); - tt_mem_op(p2+1+8+22+4,OP_EQ, b, 99+20); + tt_mem_op(p2+1+8+22+20+4, OP_EQ, b, 99+20); tt_int_op(0, OP_EQ, create_cell_format_relayed(&cell, cc)); /* Now let's add an ed25519 key to that extend2 cell. */ @@ -732,22 +736,31 @@ test_cfmt_extend_cells(void *arg) /* As before, since we aren't extending by ed25519. */ get_options_mutable()->ExtendByEd25519ID = 0; tt_int_op(0, OP_EQ, extend_cell_format(&p2_cmd, &p2_len, p2, &ec)); - tt_int_op(p2_len, OP_EQ, 89+99-34-20); + tt_int_op(p2_len, OP_EQ, 89+99-34); test_memeq_hex(p2, - "02000612F40001F0F1" + "03" + "000612F40001F0F1" "0214616e7468726f706f6d6f727068697a6174696f6e" + "011220020000000000000000000000f0c51e1112" "01050063"); /* Now try with the ed25519 ID. */ get_options_mutable()->ExtendByEd25519ID = 1; tt_int_op(0, OP_EQ, extend_cell_format(&p2_cmd, &p2_len, p2, &ec)); - tt_int_op(p2_len, OP_EQ, 89+99-34-20 + 34); + tt_int_op(p2_len, OP_EQ, 89+99); test_memeq_hex(p2, - "03000612F40001F0F1" + /* Four items */ + "04" + /* IPv4 address */ + "0006" "12F40001" "F0F1" + /* The next is an RSA digest: anthropomorphization */ "0214616e7468726f706f6d6f727068697a6174696f6e" - // ed digest follows: + /* Then an ed public key: brownshoesdontmakeit/brownshoesd */ "0320" "62726f776e73686f6573646f6e746d616b656" "9742f62726f776e73686f657364" + /*IPv6 address */ + "0112" "20020000000000000000000000f0c51e" "1112" + /* Now the handshake prologue */ "01050063"); /* Can we parse that? Did the key come through right? */ memset(&ec, 0, sizeof(ec)); @@ -816,7 +829,7 @@ test_cfmt_extend_cells(void *arg) memcpy(p+1, "\x02\x14" "anarchoindividualist", 22); memcpy(p+23, "\x01\x12" "xxxxxxxxxxxxxxxxYY", 18); memcpy(p+41, "\xff\xff\x00\x20", 4); - tt_int_op(-1, OP_EQ, extend_cell_parse(&ec, RELAY_COMMAND_EXTEND2, + tt_int_op(0, OP_EQ, extend_cell_parse(&ec, RELAY_COMMAND_EXTEND2, p, sizeof(p))); /* Running out of space in specifiers */

1 0

[tor/master] relay: Refactor address and port checks
by nickm＠torproject.org 29 Apr '20

29 Apr '20

commit 07c008c6723644553827140f2f8a863a1e2d071a Author: teor <teor(a)torproject.org> Date: Wed Apr 15 08:58:32 2020 +1000 relay: Refactor address and port checks tor_addr_port_is_valid_ap(ap, 0) checks if the address or port are zero, exactly like the previous code. Preparation for 33817. --- src/feature/relay/circuitbuild_relay.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index 2fa92eeac..96b46bb65 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -139,7 +139,7 @@ circuit_extend_lspec_valid_helper(const struct extend_cell_t *ec, return -1; } - if (!ec->orport_ipv4.port || tor_addr_is_null(&ec->orport_ipv4.addr)) { + if (!tor_addr_port_is_valid_ap(&ec->orport_ipv4, 0)) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Client asked me to extend to zero destination port or addr."); return -1;

1 0

[tor/master] relay: Refactor address checks into a function
by nickm＠torproject.org 29 Apr '20

29 Apr '20

commit ffc2fd001a306894bb8082d81de9b136937ef124 Author: teor <teor(a)torproject.org> Date: Wed Apr 15 09:13:16 2020 +1000 relay: Refactor address checks into a function No behaviour change. Part of 33817. --- src/feature/relay/circuitbuild_relay.c | 39 +++++++++++++++++++++++++--------- 1 file changed, 29 insertions(+), 10 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index 96b46bb65..dd38a2825 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -119,6 +119,33 @@ circuit_extend_add_ed25519_helper(struct extend_cell_t *ec) return 0; } +/* Check if the address and port in the tor_addr_port_t ap are valid, + * and are allowed by the current ExtendAllowPrivateAddresses config. + * + * If they are valid, return 0. + * Otherwise, if they are invalid, log a warning at log_level, + * and return -1. + */ +static int +circuit_extend_addr_port_helper(const struct tor_addr_port_t *ap, + int log_level) +{ + if (!tor_addr_port_is_valid_ap(ap, 0)) { + log_fn(log_level, LD_PROTOCOL, + "Client asked me to extend to zero destination port or addr."); + return -1; + } + + if (tor_addr_is_internal(&ap->addr, 0) && + !get_options()->ExtendAllowPrivateAddresses) { + log_fn(log_level, LD_PROTOCOL, + "Client asked me to extend to a private address."); + return -1; + } + + return 0; +} + /* Before replying to an extend cell, check the link specifiers in the extend * cell ec, which was received on the circuit circ. * @@ -139,16 +166,8 @@ circuit_extend_lspec_valid_helper(const struct extend_cell_t *ec, return -1; } - if (!tor_addr_port_is_valid_ap(&ec->orport_ipv4, 0)) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Client asked me to extend to zero destination port or addr."); - return -1; - } - - if (tor_addr_is_internal(&ec->orport_ipv4.addr, 0) && - !get_options()->ExtendAllowPrivateAddresses) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Client asked me to extend to a private address."); + if (circuit_extend_addr_port_helper(&ec->orport_ipv4, + LOG_PROTOCOL_WARN) < 0) { return -1; }

1 0

[tor/master] core/or: Check extends for zero addresses and ports
by nickm＠torproject.org 29 Apr '20

29 Apr '20

commit 587a7fbcf62447c7ade05c57220f1bfe2f3acdc1 Author: teor <teor(a)torproject.org> Date: Tue Apr 14 15:53:17 2020 +1000 core/or: Check extends for zero addresses and ports Check for invalid zero IPv4 addresses and ports, when sending and receiving extend cells. Fixes bug 33900; bugfix on 0.2.4.8-alpha. --- changes/bug33900 | 3 +++ src/core/or/onion.c | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/changes/bug33900 b/changes/bug33900 new file mode 100644 index 000000000..c1649d228 --- /dev/null +++ b/changes/bug33900 @@ -0,0 +1,3 @@ + o Minor bugfixes (IPv4, relay): + - Check for invalid zero IPv4 addresses and ports, when sending and + receiving extend cells. Fixes bug 33900; bugfix on 0.2.4.8-alpha. diff --git a/src/core/or/onion.c b/src/core/or/onion.c index 543d9f3e4..d73f981d2 100644 --- a/src/core/or/onion.c +++ b/src/core/or/onion.c @@ -244,14 +244,14 @@ check_extend_cell(const extend_cell_t *cell) if (tor_digest_is_zero((const char*)cell->node_id)) return -1; - if (tor_addr_family(&cell->orport_ipv4.addr) == AF_UNSPEC) { + if (!tor_addr_port_is_valid_ap(&cell->orport_ipv4, 0)) { /* EXTEND cells must have an IPv4 address. */ if (!is_extend2) { return -1; } /* EXTEND2 cells must have at least one IP address. * It can be IPv4 or IPv6. */ - if (tor_addr_family(&cell->orport_ipv6.addr) == AF_UNSPEC) { + if (!tor_addr_port_is_valid_ap(&cell->orport_ipv6, 0)) { return -1; } }

1 0