torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity
38,988 Commits 53 Branches 631 Tags
4d7ca89fc343f7b3a537b78bc3147735fa7d6fe9
Commit Graph
38988 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
David Goulet 4d7ca89fc3 Merge branch 'maint-0.4.8' 2023-12-08 13:45:36 -05:00
Tor CI Release 4c97dc1626 fallbackdir: Update list generated on December 08, 2023 2023-12-08 13:45:00 -05:00
Tor CI Release ad22b60ff1 Update geoip files to match ipfire location db, 2023/12/08. 2023-12-08 13:44:45 -05:00
David Goulet 64e6458c87 Merge branch 'maint-0.4.8' 2023-12-08 13:26:16 -05:00
David Goulet 6fbbcdde35 Merge remote-tracking branch 'mikeperry-private/bug40897' into maint-0.4.8 2023-12-08 13:19:40 -05:00
Alexander Færøy ae11abfe92 Merge branch 'maint-0.4.8' 2023-12-07 21:38:32 +00:00
Alexander Færøy 1b1f6e8574 Merge remote-tracking branch 'origin/merge-requests/776' into maint-0.4.8 2023-12-07 21:38:03 +00:00
Mike Perry 97b4264f39 Bug 40897: Changes file 2023-12-07 18:54:51 +00:00
Mike Perry cc52f7e5b7 Bug 40897 Bug Bounty: Double the number of max conflux circs 
We strongly suspect that bug 40897 was caused by a custom Tor client that
tried to use more than the default number of conflux circuits, for either
performance or traffic analysis defense gains, or both.

This entity hit a safety check on the exit side, which caused a UAF. Our
"belt and suspenders" snapped off, and hit us in the face... again...

Since there are good reasons to try more than 2 conflux legs, and research has
found some traffic analysis benefits with as many as 5, we're going to raise
and parameterize this limit as a form of bug bounty for finding this UAF, so
that this entity can try out a little more confluxing.

This should also make it easier for researchers to try things like gathering
traces with larger amounts of confluxing than normal, to measure real-world
traffic analysis impacts of conflux.

Shine on, you yoloing anonymous diamond. Let us know if you find out anything
interesting!
 2023-12-07 18:37:30 +00:00
Mike Perry 03778a0f34 Bug 40897: Add more checks to free paths 
Similar double-frees would be caught earlier by these, so long as the pointers
remain nulled out.
 2023-12-07 18:37:30 +00:00
Mike Perry d02eb4502a Bug 40897: Move safety check to proper location and give it error handling. 2023-12-07 18:37:26 +00:00
trinity-1686a 1291d2fca7 update changes file with correct introduced version 2023-12-06 17:42:41 +01:00
David Goulet d07810a3c9 Merge branch 'fix-bridge-exit-warn' into 'main' 
Fix bridge exit warn

Closes #40884

See merge request tpo/core/tor!783
 2023-11-22 15:02:14 +00:00
David Goulet 0ea2e15d84 Merge branch 'did-sanity-memmem' into 'main' 
add sanity check in tor_memmem

Closes #40854

See merge request tpo/core/tor!785
 2023-11-22 15:01:03 +00:00
trinity-1686a 42742d55c7 add changes entry 2023-11-21 20:13:18 +01:00
Alexander Færøy 45c1a36acb Merge branch 'eol-config-no-spurious-warn' into 'main' 
don't warn for empty RecommendedServerVersion

Closes #40888

See merge request tpo/core/tor!787
 2023-11-21 18:04:38 +00:00
juga d8aa699253 bwauth: Allow "node_id" KeyValue without "$" 
Allow "node_id" KeyValue without the dollar sign at the start of the
hexdigit in the BandwidthFiles, in order to easier database queries
combining Tor documents in which the relays fingerprint doesn't
include it.
Bugfix on all supported versions of Tor.

Closes #40891
 2023-11-21 10:43:36 -05:00
trinity-1686a 0be627890c add changes file for sanity check on memmem 2023-11-21 00:22:51 +01:00
David Goulet 8bb7d681ae Merge branch 'new-changelogs' into 'main' 
forward-port the 0.4.8.x change stanzas

See merge request tpo/core/tor!784
 2023-11-20 18:43:36 +00:00
trinity-1686a 635220734d don't warn for empty RecommendedServerVersion 2023-11-16 19:15:25 +01:00
trinity-1686a f2ddfdd50e add sanity check in tor_memmem 
it's believed most libc already have those, but just in case, it can't
hurt
 2023-11-15 02:01:34 +01:00
Roger Dingledine 0465707d93 fix small typo and missing period while i'm here 2023-11-12 16:03:06 -05:00
Roger Dingledine 30989374b3 forward-port the 0.4.8.x change stanzas 
somehow our release process is not moving these into git main
 2023-11-12 15:51:20 -05:00
trinity-1686a 8fafdca11e don't warn when ExitRelay is set to 0 2023-11-12 18:24:33 +01:00
David Goulet cec6f9919d Merge branch 'maint-0.4.8' 2023-11-09 10:11:27 -05:00
Tor CI Release c97d0b46d1 version: Bump version to 0.4.8.9-dev 2023-11-09 10:10:33 -05:00
David Goulet f087f92d4f Merge branch 'maint-0.4.8' 2023-11-09 09:44:02 -05:00
Tor CI Release b9283067ca version: Bump version to 0.4.8.9 2023-11-09 09:41:10 -05:00
David Goulet 7703c94756 Merge branch 'maint-0.4.8' 2023-11-09 09:24:22 -05:00
Tor CI Release 825aa705b1 fallbackdir: Update list generated on November 09, 2023 2023-11-09 09:23:59 -05:00
Tor CI Release f822f24599 Update geoip files to match ipfire location db, 2023/11/09. 2023-11-09 09:23:54 -05:00
David Goulet 12723de00b Merge branch 'maint-0.4.8' 2023-11-09 09:17:51 -05:00
David Goulet be751a46e3 Merge branch 'ticket40883_048_01' into maint-0.4.8 2023-11-09 09:14:19 -05:00
David Goulet 525a1cfb70 Merge branch 'maint-0.4.8' 2023-11-09 09:10:58 -05:00
David Goulet 6df27ae953 Merge branch 'tor-gitlab/mr/778' into maint-0.4.8 2023-11-09 09:10:52 -05:00
David Goulet 54e37a013b Merge branch 'fix-man-typos' into 'main' 
fix man page typos

See merge request tpo/core/tor!781
 2023-11-09 13:41:53 +00:00
David Goulet 83aecca561 hs: Always check if the hs_ident is available when processing a cell 
Signed-off-by: David Goulet <dgoulet@torproject.org>
 2023-11-08 11:17:48 -05:00
David Goulet e62b8bce5a hs: Fix assert in hs_metrics_update_by_ident() 
The hs_metrics_failed_rdv() macro could pass a NULL value for the identity key
when a building circuit would end up in a failure path *before* the "hs_ident"
was able to be set which leading to this assert.

This was introduced in 0.4.8.1-alpha with the addition of rendezvous circuit
failure metrics for the MetricsPort.

This fixes TROVE-2023-006 for which its severity is considered high.

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2023-11-07 13:50:28 -05:00
Alex Xu (Hello71) 25ac40b2b7 fix man page typos 2023-11-04 08:51:08 -04:00
David Goulet 769fa450ed Merge branch 'maint-0.4.8' 2023-11-03 10:54:06 -04:00
Tor CI Release c7d8501da8 version: Bump version to 0.4.8.8-dev 2023-11-03 10:54:00 -04:00
David Goulet 3737585a54 Merge branch 'maint-0.4.7' into maint-0.4.8 2023-11-03 10:53:57 -04:00
Tor CI Release 7c354390f9 version: Bump version to 0.4.7.16-dev 2023-11-03 10:51:10 -04:00
David Goulet 8257cd10f3 Merge branch 'maint-0.4.8' 2023-11-03 09:41:12 -04:00
Tor CI Release f1df34193b Update geoip files to match ipfire location db, 2023/11/03. 2023-11-03 09:38:29 -04:00
Tor CI Release ea6d6568e7 fallbackdir: Update list generated on November 03, 2023 2023-11-03 09:38:21 -04:00
David Goulet 3695e131d2 Merge branch 'maint-0.4.8' 2023-11-03 09:28:44 -04:00
David Goulet f15408f487 Merge branch 'maint-0.4.7' into maint-0.4.8 2023-11-03 09:28:37 -04:00
Tor CI Release 3e82c462ef version: Bump version to 0.4.8.8 tor-0.4.8.8 2023-11-03 09:27:51 -04:00
Tor CI Release 3eb98d91e9 version: Bump version to 0.4.7.16 tor-0.4.7.16 2023-11-03 09:27:38 -04:00