0d3aa8a691
Merge branch 'maint-0.4.8' into release-0.4.8
2023-12-08 13:45:36 -05:00
4c97dc1626
fallbackdir: Update list generated on December 08, 2023
2023-12-08 13:45:00 -05:00
ad22b60ff1
Update geoip files to match ipfire location db, 2023/12/08.
2023-12-08 13:44:45 -05:00
a3f4486d7f
Merge branch 'maint-0.4.8' into release-0.4.8
2023-12-08 13:26:16 -05:00
6fbbcdde35
Merge remote-tracking branch 'mikeperry-private/bug40897' into maint-0.4.8
2023-12-08 13:19:40 -05:00
8255139694
Merge branch 'maint-0.4.8' into release-0.4.8
2023-12-07 21:38:32 +00:00
1b1f6e8574
Merge remote-tracking branch 'origin/merge-requests/776' into maint-0.4.8
2023-12-07 21:38:03 +00:00
97b4264f39
Bug 40897: Changes file
2023-12-07 18:54:51 +00:00
cc52f7e5b7
Bug 40897 Bug Bounty: Double the number of max conflux circs
...
We strongly suspect that bug 40897 was caused by a custom Tor client that
tried to use more than the default number of conflux circuits, for either
performance or traffic analysis defense gains, or both.
This entity hit a safety check on the exit side, which caused a UAF. Our
"belt and suspenders" snapped off, and hit us in the face... again...
Since there are good reasons to try more than 2 conflux legs, and research has
found some traffic analysis benefits with as many as 5, we're going to raise
and parameterize this limit as a form of bug bounty for finding this UAF, so
that this entity can try out a little more confluxing.
This should also make it easier for researchers to try things like gathering
traces with larger amounts of confluxing than normal, to measure real-world
traffic analysis impacts of conflux.
Shine on, you yoloing anonymous diamond. Let us know if you find out anything
interesting!
2023-12-07 18:37:30 +00:00
03778a0f34
Bug 40897: Add more checks to free paths
...
Similar double-frees would be caught earlier by these, so long as the pointers
remain nulled out.
2023-12-07 18:37:30 +00:00
d02eb4502a
Bug 40897: Move safety check to proper location and give it error handling.
2023-12-07 18:37:26 +00:00
1291d2fca7
update changes file with correct introduced version
2023-12-06 17:42:41 +01:00
c97d0b46d1
version: Bump version to 0.4.8.9-dev
2023-11-09 10:10:33 -05:00
af511c6ffa
Merge branch 'maint-0.4.8' into release-0.4.8
2023-11-09 09:44:10 -05:00
b9283067ca
version: Bump version to 0.4.8.9
2023-11-09 09:41:10 -05:00
b645e95a38
release: ChangeLog and ReleaseNotes for 0.4.8.9
2023-11-09 09:35:38 -05:00
1eccfbdcc4
Merge branch 'maint-0.4.8' into release-0.4.8
2023-11-09 09:24:22 -05:00
825aa705b1
fallbackdir: Update list generated on November 09, 2023
2023-11-09 09:23:59 -05:00
f822f24599
Update geoip files to match ipfire location db, 2023/11/09.
2023-11-09 09:23:54 -05:00
5d2293c5ce
Merge branch 'maint-0.4.8' into release-0.4.8
2023-11-09 09:17:51 -05:00
be751a46e3
Merge branch 'ticket40883_048_01' into maint-0.4.8
2023-11-09 09:14:19 -05:00
a18f3b8fb6
Merge branch 'maint-0.4.8' into release-0.4.8
2023-11-09 09:10:58 -05:00
6df27ae953
Merge branch 'tor-gitlab/mr/778' into maint-0.4.8
2023-11-09 09:10:52 -05:00
83aecca561
hs: Always check if the hs_ident is available when processing a cell
...
Signed-off-by: David Goulet <dgoulet@torproject.org >
2023-11-08 11:17:48 -05:00
e62b8bce5a
hs: Fix assert in hs_metrics_update_by_ident()
...
The hs_metrics_failed_rdv() macro could pass a NULL value for the identity key
when a building circuit would end up in a failure path *before* the "hs_ident"
was able to be set which leading to this assert.
This was introduced in 0.4.8.1-alpha with the addition of rendezvous circuit
failure metrics for the MetricsPort.
This fixes TROVE-2023-006 for which its severity is considered high.
Signed-off-by: David Goulet <dgoulet@torproject.org >
2023-11-07 13:50:28 -05:00
b223eb125e
Merge branch 'maint-0.4.8' into release-0.4.8
2023-11-03 10:54:13 -04:00
c7d8501da8
version: Bump version to 0.4.8.8-dev
2023-11-03 10:54:00 -04:00
3737585a54
Merge branch 'maint-0.4.7' into maint-0.4.8
2023-11-03 10:53:57 -04:00
7c354390f9
version: Bump version to 0.4.7.16-dev
2023-11-03 10:51:10 -04:00
167cc1ce6a
release: ChangeLog and ReleaseNotes for 0.4.8.8
2023-11-03 09:41:02 -04:00
8c9034d3d3
Merge branch 'maint-0.4.8' into release-0.4.8
2023-11-03 09:38:55 -04:00
f1df34193b
Update geoip files to match ipfire location db, 2023/11/03.
2023-11-03 09:38:29 -04:00
ea6d6568e7
fallbackdir: Update list generated on November 03, 2023
2023-11-03 09:38:21 -04:00
ab50fb1f31
Merge branch 'maint-0.4.8' into release-0.4.8
2023-11-03 09:29:01 -04:00
f15408f487
Merge branch 'maint-0.4.7' into maint-0.4.8
2023-11-03 09:28:37 -04:00
3e82c462ef
version: Bump version to 0.4.8.8
2023-11-03 09:27:51 -04:00
3eb98d91e9
version: Bump version to 0.4.7.16
2023-11-03 09:27:38 -04:00
6901949d38
fallbackdir: Update list generated on November 03, 2023
2023-11-03 09:25:34 -04:00
ee152a421e
Update geoip files to match ipfire location db, 2023/11/03.
2023-11-03 09:25:28 -04:00
5d2a6149d4
Merge branch 'maint-0.4.8' into release-0.4.8
2023-11-03 09:13:11 -04:00
a231461ad3
Merge branch 'maint-0.4.7' into maint-0.4.8
2023-11-03 09:13:11 -04:00
4ce54614dd
Sync geoip and fallbackdir from maint 048 before release
...
Signed-off-by: David Goulet <dgoulet@torproject.org >
2023-11-03 09:13:05 -04:00
cfc7087848
Merge branch 'maint-0.4.8' into release-0.4.8
2023-11-03 09:04:27 -04:00
24dc829b9a
Merge branch 'maint-0.4.7' into maint-0.4.8
2023-11-03 09:04:27 -04:00
7aa496a2e0
Fix TROVE-2023-004: Remote crash when compiled against OpenSSL
...
Fixes #40874
Signed-off-by: David Goulet <dgoulet@torproject.org >
2023-11-03 08:52:38 -04:00
d4d78f5033
Bug 40876 changes file
2023-11-01 19:57:08 +00:00
6bfadc7a5d
Bug 40876: Extra logging
2023-11-01 19:57:08 +00:00
d7f14a54fb
Bug 40876: Don't reduce primary list for temporary restrictions
2023-11-01 19:57:07 +00:00
389b7d4903
Merge branch 'maint-0.4.8' into release-0.4.8
2023-10-30 13:46:19 -04:00
09685fa038
Changes file for bug 40878
2023-10-30 16:55:11 +00:00
David Goulet
Tor CI Release
Alexander Færøy
Mike Perry
trinity-1686a