David Goulet
82e73df8f7
Merge branch 'maint-0.4.8'
2023-12-08 14:14:06 -05:00
Tor CI Release
eff176544d
version: Bump version to 0.4.8.10-dev
2023-12-08 14:13:56 -05:00
David Goulet
fc0141e158
Merge branch 'maint-0.4.8'
2023-12-08 13:49:32 -05:00
Tor CI Release
e759de90a5
version: Bump version to 0.4.8.10
2023-12-08 13:48:24 -05:00
David Goulet
4d7ca89fc3
Merge branch 'maint-0.4.8'
2023-12-08 13:45:36 -05:00
Tor CI Release
4c97dc1626
fallbackdir: Update list generated on December 08, 2023
2023-12-08 13:45:00 -05:00
Tor CI Release
ad22b60ff1
Update geoip files to match ipfire location db, 2023/12/08.
2023-12-08 13:44:45 -05:00
David Goulet
64e6458c87
Merge branch 'maint-0.4.8'
2023-12-08 13:26:16 -05:00
David Goulet
6fbbcdde35
Merge remote-tracking branch 'mikeperry-private/bug40897' into maint-0.4.8
2023-12-08 13:19:40 -05:00
Alexander Færøy
ae11abfe92
Merge branch 'maint-0.4.8'
2023-12-07 21:38:32 +00:00
Alexander Færøy
1b1f6e8574
Merge remote-tracking branch 'origin/merge-requests/776' into maint-0.4.8
2023-12-07 21:38:03 +00:00
Mike Perry
97b4264f39
Bug 40897: Changes file
2023-12-07 18:54:51 +00:00
Mike Perry
cc52f7e5b7
Bug 40897 Bug Bounty: Double the number of max conflux circs
...
We strongly suspect that bug 40897 was caused by a custom Tor client that
tried to use more than the default number of conflux circuits, for either
performance or traffic analysis defense gains, or both.
This entity hit a safety check on the exit side, which caused a UAF. Our
"belt and suspenders" snapped off, and hit us in the face... again...
Since there are good reasons to try more than 2 conflux legs, and research has
found some traffic analysis benefits with as many as 5, we're going to raise
and parameterize this limit as a form of bug bounty for finding this UAF, so
that this entity can try out a little more confluxing.
This should also make it easier for researchers to try things like gathering
traces with larger amounts of confluxing than normal, to measure real-world
traffic analysis impacts of conflux.
Shine on, you yoloing anonymous diamond. Let us know if you find out anything
interesting!
2023-12-07 18:37:30 +00:00
Mike Perry
03778a0f34
Bug 40897: Add more checks to free paths
...
Similar double-frees would be caught earlier by these, so long as the pointers
remain nulled out.
2023-12-07 18:37:30 +00:00
Mike Perry
d02eb4502a
Bug 40897: Move safety check to proper location and give it error handling.
2023-12-07 18:37:26 +00:00
trinity-1686a
1291d2fca7
update changes file with correct introduced version
2023-12-06 17:42:41 +01:00
David Goulet
d07810a3c9
Merge branch 'fix-bridge-exit-warn' into 'main'
...
Fix bridge exit warn
Closes #40884
See merge request tpo/core/tor!783
2023-11-22 15:02:14 +00:00
David Goulet
0ea2e15d84
Merge branch 'did-sanity-memmem' into 'main'
...
add sanity check in tor_memmem
Closes #40854
See merge request tpo/core/tor!785
2023-11-22 15:01:03 +00:00
trinity-1686a
42742d55c7
add changes entry
2023-11-21 20:13:18 +01:00
Alexander Færøy
45c1a36acb
Merge branch 'eol-config-no-spurious-warn' into 'main'
...
don't warn for empty RecommendedServerVersion
Closes #40888
See merge request tpo/core/tor!787
2023-11-21 18:04:38 +00:00
juga
d8aa699253
bwauth: Allow "node_id" KeyValue without "$"
...
Allow "node_id" KeyValue without the dollar sign at the start of the
hexdigit in the BandwidthFiles, in order to easier database queries
combining Tor documents in which the relays fingerprint doesn't
include it.
Bugfix on all supported versions of Tor.
Closes #40891
2023-11-21 10:43:36 -05:00
trinity-1686a
0be627890c
add changes file for sanity check on memmem
2023-11-21 00:22:51 +01:00
David Goulet
8bb7d681ae
Merge branch 'new-changelogs' into 'main'
...
forward-port the 0.4.8.x change stanzas
See merge request tpo/core/tor!784
2023-11-20 18:43:36 +00:00
trinity-1686a
635220734d
don't warn for empty RecommendedServerVersion
2023-11-16 19:15:25 +01:00
trinity-1686a
f2ddfdd50e
add sanity check in tor_memmem
...
it's believed most libc already have those, but just in case, it can't
hurt
2023-11-15 02:01:34 +01:00
Roger Dingledine
0465707d93
fix small typo and missing period while i'm here
2023-11-12 16:03:06 -05:00
Roger Dingledine
30989374b3
forward-port the 0.4.8.x change stanzas
...
somehow our release process is not moving these into git main
2023-11-12 15:51:20 -05:00
trinity-1686a
8fafdca11e
don't warn when ExitRelay is set to 0
2023-11-12 18:24:33 +01:00
David Goulet
cec6f9919d
Merge branch 'maint-0.4.8'
2023-11-09 10:11:27 -05:00
Tor CI Release
c97d0b46d1
version: Bump version to 0.4.8.9-dev
2023-11-09 10:10:33 -05:00
David Goulet
f087f92d4f
Merge branch 'maint-0.4.8'
2023-11-09 09:44:02 -05:00
Tor CI Release
b9283067ca
version: Bump version to 0.4.8.9
2023-11-09 09:41:10 -05:00
David Goulet
7703c94756
Merge branch 'maint-0.4.8'
2023-11-09 09:24:22 -05:00
Tor CI Release
825aa705b1
fallbackdir: Update list generated on November 09, 2023
2023-11-09 09:23:59 -05:00
Tor CI Release
f822f24599
Update geoip files to match ipfire location db, 2023/11/09.
2023-11-09 09:23:54 -05:00
David Goulet
12723de00b
Merge branch 'maint-0.4.8'
2023-11-09 09:17:51 -05:00
David Goulet
be751a46e3
Merge branch 'ticket40883_048_01' into maint-0.4.8
2023-11-09 09:14:19 -05:00
David Goulet
525a1cfb70
Merge branch 'maint-0.4.8'
2023-11-09 09:10:58 -05:00
David Goulet
6df27ae953
Merge branch 'tor-gitlab/mr/778' into maint-0.4.8
2023-11-09 09:10:52 -05:00
David Goulet
54e37a013b
Merge branch 'fix-man-typos' into 'main'
...
fix man page typos
See merge request tpo/core/tor!781
2023-11-09 13:41:53 +00:00
David Goulet
83aecca561
hs: Always check if the hs_ident is available when processing a cell
...
Signed-off-by: David Goulet <dgoulet@torproject.org>
2023-11-08 11:17:48 -05:00
David Goulet
e62b8bce5a
hs: Fix assert in hs_metrics_update_by_ident()
...
The hs_metrics_failed_rdv() macro could pass a NULL value for the identity key
when a building circuit would end up in a failure path *before* the "hs_ident"
was able to be set which leading to this assert.
This was introduced in 0.4.8.1-alpha with the addition of rendezvous circuit
failure metrics for the MetricsPort.
This fixes TROVE-2023-006 for which its severity is considered high.
Signed-off-by: David Goulet <dgoulet@torproject.org>
2023-11-07 13:50:28 -05:00
Alex Xu (Hello71)
25ac40b2b7
fix man page typos
2023-11-04 08:51:08 -04:00
David Goulet
769fa450ed
Merge branch 'maint-0.4.8'
2023-11-03 10:54:06 -04:00
Tor CI Release
c7d8501da8
version: Bump version to 0.4.8.8-dev
2023-11-03 10:54:00 -04:00
David Goulet
3737585a54
Merge branch 'maint-0.4.7' into maint-0.4.8
2023-11-03 10:53:57 -04:00
Tor CI Release
7c354390f9
version: Bump version to 0.4.7.16-dev
2023-11-03 10:51:10 -04:00
David Goulet
8257cd10f3
Merge branch 'maint-0.4.8'
2023-11-03 09:41:12 -04:00
Tor CI Release
f1df34193b
Update geoip files to match ipfire location db, 2023/11/03.
2023-11-03 09:38:29 -04:00
Tor CI Release
ea6d6568e7
fallbackdir: Update list generated on November 03, 2023
2023-11-03 09:38:21 -04:00
