November 2011 - tor-commits - lists.torproject.org

[tor/master] Add some more documentation
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit db648fe886fd8ae4f42bb13d0219ca7fa690bdc1 Author: Arturo Filastò <art(a)torproject.org> Date: Thu Nov 24 10:28:38 2011 +0100 Add some more documentation --- doc/tor.1.txt | 5 ++++- src/or/config.c | 3 ++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 22c8e88..c73b8d3 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -960,7 +960,10 @@ The following options are useful only for clients (that is, if **Tor2webMode** **0**|**1**:: When this option is set, Tor connects to hidden services **non-anonymously**. This option also disables client connections to - non-hidden-service hostnames through Tor. (Default: 0) + non-hidden-service hostnames through Tor. It **must only** be used when + running a tor2web Hidden Service web proxy. + To enable this option the compile time flag --enable-tor2webmode must be + specified. (Default: 0) SERVER OPTIONS -------------- diff --git a/src/or/config.c b/src/or/config.c index 1dd5ed7..adfde81 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1310,7 +1310,8 @@ options_act(const or_options_t *old_options) if (options->Tor2webMode) { log_err(LD_CONFIG, "This copy of Tor was not compiled to run in " "'tor2web mode'. It cannot be run with the Tor2webMode torrc " - "option enabled."); + "option enabled. To enable Tor2webMode recompile with the " + "--enable-tor2webmode option."); return -1; } #endif

1 0

[tor/master] Add Tor2webMode configuration option
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit b2212bf9b4e7f06d7383eb9235392cbdf735bbdb Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Wed Jun 1 07:03:01 2011 -0700 Add Tor2webMode configuration option --- doc/tor.1.txt | 4 ++++ src/or/config.c | 1 + src/or/or.h | 5 +++++ 3 files changed, 10 insertions(+), 0 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index f5be391..22c8e88 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -957,6 +957,10 @@ The following options are useful only for clients (that is, if Tor will look at the UseOptimisticData parameter in the networkstatus. (Default: auto) +**Tor2webMode** **0**|**1**:: + When this option is set, Tor connects to hidden services + **non-anonymously**. This option also disables client connections to + non-hidden-service hostnames through Tor. (Default: 0) SERVER OPTIONS -------------- diff --git a/src/or/config.c b/src/or/config.c index 06d7d5c..b2de15e 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -394,6 +394,7 @@ static config_var_t _option_vars[] = { V(TestSocks, BOOL, "0"), OBSOLETE("TestVia"), V(TokenBucketRefillInterval, MSEC_INTERVAL, "100 msec"), + V(Tor2webMode, BOOL, "0"), V(TrackHostExits, CSV, NULL), V(TrackHostExitsExpire, INTERVAL, "30 minutes"), OBSOLETE("TrafficShaping"), diff --git a/src/or/or.h b/src/or/or.h index 67ba62b..8515db6 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3008,6 +3008,11 @@ typedef struct { int AllDirActionsPrivate; /**< Should every directory action be sent * through a Tor circuit? */ + /** Run in 'tor2web mode'? (I.e. only make client connections to hidden + * services, and use a single hop for all hidden-service-related + * circuits.) */ + int Tor2webMode; + int ConnLimit; /**< Demanded minimum number of simultaneous connections. */ int _ConnLimit; /**< Maximum allowed number of simultaneous connections. */ int RunAsDaemon; /**< If true, run in the background. (Unix only) */

1 0

[tor/master] Add a compile-time #define to control whether Tor runs in 'tor2web mode'
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 543a36a55ba04e860582e6db53d17e49814ebb81 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Wed Nov 23 16:58:15 2011 -0800 Add a compile-time #define to control whether Tor runs in 'tor2web mode' The Tor2webMode torrc option is still required to run a Tor client in 'tor2web mode', but now it can't be turned on at runtime in a normal build of Tor. (And a tor2web build of Tor can't be used as a normal Tor client, so we don't have to worry as much about someone distributing packages with this particular pistol accessible to normal users.) --- src/or/config.c | 16 ++++++++++++++++ src/or/or.h | 4 ++++ 2 files changed, 20 insertions(+), 0 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index b2de15e..bddae6f 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1294,6 +1294,22 @@ options_act(const or_options_t *old_options) if (consider_adding_dir_authorities(options, old_options) < 0) return -1; +#ifdef ENABLE_TOR2WEB_MODE + if (!options->Tor2webMode) { + log_err(LD_CONFIG, "This copy of Tor was compiled to run in " + "'tor2web mode'. It can only be run with the Tor2webMode torrc " + "option enabled."); + return -1; + } +#else + if (options->Tor2webMode) { + log_err(LD_CONFIG, "This copy of Tor was not compiled to run in " + "'tor2web mode'. It cannot be run with the Tor2webMode torrc " + "option enabled."); + return -1; + } +#endif + if (options->Bridges) { mark_bridge_list(); for (cl = options->Bridges; cl; cl = cl->next) { diff --git a/src/or/or.h b/src/or/or.h index 8515db6..8117ee1 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -130,6 +130,10 @@ #define cell_t tor_cell_t #endif +#ifdef ENABLE_TOR2WEB_MODE +#define NON_ANONYMOUS_MODE_ENABLED 1 +#endif + /** Length of longest allowable configured nickname. */ #define MAX_NICKNAME_LEN 19 /** Length of a router identity encoded as a hexadecimal digest, plus

1 0

[tor/master] Warn loudly on startup and SIGHUP if Tor is built for a non-anonymous mode
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 5f3e6eb0b9b450c81bd54d5dd87ff786a6d1ffea Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Wed Nov 23 16:46:38 2011 -0800 Warn loudly on startup and SIGHUP if Tor is built for a non-anonymous mode --- src/or/config.c | 5 +++++ src/or/main.c | 5 +++++ 2 files changed, 10 insertions(+), 0 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index bddae6f..734efdf 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1294,6 +1294,11 @@ options_act(const or_options_t *old_options) if (consider_adding_dir_authorities(options, old_options) < 0) return -1; +#ifdef NON_ANONYMOUS_MODE_ENABLED + log(LOG_WARN, LD_GENERAL, "This copy of Tor was compiled to run in a " + "non-anonymous mode. It will provide NO ANONYMITY."); +#endif + #ifdef ENABLE_TOR2WEB_MODE if (!options->Tor2webMode) { log_err(LD_CONFIG, "This copy of Tor was compiled to run in " diff --git a/src/or/main.c b/src/or/main.c index 7008d38..266356a 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2256,6 +2256,11 @@ tor_init(int argc, char *argv[]) "Expect more bugs than usual."); } +#ifdef NON_ANONYMOUS_MODE_ENABLED + log(LOG_WARN, LD_GENERAL, "This copy of Tor was compiled to run in a " + "non-anonymous mode. It will provide NO ANONYMITY."); +#endif + if (network_init()<0) { log_err(LD_BUG,"Error initializing network; exiting."); return -1;

1 0

[tor/master] Don't allow tor2web-mode Tors to connect to non-HS addresses
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit ebf524b48b0340ed3b2bfc1d652e3d65b3aee11c Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Tue May 31 07:05:40 2011 -0700 Don't allow tor2web-mode Tors to connect to non-HS addresses The client's anonymity when accessing a non-HS address in tor2web-mode would be easily nuked by inserting an inline image with a .onion URL, so don't even pretend to access non-HS addresses through Tor. --- src/or/connection_edge.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index efaad79..bba666d 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1892,6 +1892,14 @@ connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn, return -1; } + if (options->Tor2webMode) { + log_warn(LD_APP, "Refusing to connect to non-hidden-service hostname %s " + "because tor2web mode is enabled.", + safe_str_client(socks->address)); + connection_mark_unattached_ap(conn, END_STREAM_REASON_ENTRYPOLICY); + return -1; + } + if (socks->command == SOCKS_COMMAND_RESOLVE) { uint32_t answer; struct in_addr in;

1 0

[tor/master] Perform single-hop HS desc fetches when in tor2web mode
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 29287ed0edf925fd9e05d5fbed53eb37bc8799c7 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Wed Jun 1 01:45:24 2011 -0700 Perform single-hop HS desc fetches when in tor2web mode --- src/or/rendclient.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/or/rendclient.c b/src/or/rendclient.c index 6a45207..fae9df0 100644 --- a/src/or/rendclient.c +++ b/src/or/rendclient.c @@ -529,6 +529,7 @@ directory_get_from_hs_dir(const char *desc_id, const rend_data_t *rend_query) char desc_id_base32[REND_DESC_ID_V2_LEN_BASE32 + 1]; time_t now = time(NULL); char descriptor_cookie_base64[3*REND_DESC_COOKIE_LEN_BASE64]; + int tor2web_mode = get_options()->Tor2webMode; tor_assert(desc_id); tor_assert(rend_query); /* Determine responsible dirs. Even if we can't get all we want, @@ -587,7 +588,8 @@ directory_get_from_hs_dir(const char *desc_id, const rend_data_t *rend_query) directory_initiate_command_routerstatus_rend(hs_dir, DIR_PURPOSE_FETCH_RENDDESC_V2, ROUTER_PURPOSE_GENERAL, - 1, desc_id_base32, NULL, 0, 0, + !tor2web_mode, desc_id_base32, + NULL, 0, 0, rend_query); log_info(LD_REND, "Sending fetch request for v2 descriptor for " "service '%s' with descriptor ID '%s', auth type %d, "

1 0

[tor/master] Use single-hop intro and rend circuits when in tor2web mode
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 826f1d5b0ab1faa0c75d2fd6560b4983adec33c8 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Wed Jun 1 02:00:59 2011 -0700 Use single-hop intro and rend circuits when in tor2web mode --- src/or/circuituse.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/src/or/circuituse.c b/src/or/circuituse.c index 23efe05..f9931d8 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -1489,6 +1489,12 @@ circuit_get_open_circ_or_launch(entry_connection_t *conn, else new_circ_purpose = desired_circuit_purpose; + if (options->Tor2webMode && + (new_circ_purpose == CIRCUIT_PURPOSE_C_ESTABLISH_REND || + new_circ_purpose == CIRCUIT_PURPOSE_C_INTRODUCING)) { + want_onehop = 1; + } + { int flags = CIRCLAUNCH_NEED_CAPACITY; if (want_onehop) flags |= CIRCLAUNCH_ONEHOP_TUNNEL;

1 0

[tor/master] bug933 - Match against super-domains in MapAddress
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit c6d8c6baaa983aecd6a5121ec6ed8e2d9a2a24be Author: Robert Hogan <robert(a)webkit.org> Date: Mon Aug 2 20:09:37 2010 +0100 bug933 - Match against super-domains in MapAddress Allow MapAddress to handle directives such as: MapAddress .torproject.org .torserver.exit MapAddress .org 1.1.1.1 Add tests for addressmap_rewrite. --- changes/bug933 | 4 ++ doc/tor.1.txt | 7 ++- src/or/connection_edge.c | 41 ++++++++++++++- src/test/Makefile.am | 1 + src/test/test.c | 2 + src/test/test_config.c | 127 ++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 178 insertions(+), 4 deletions(-) diff --git a/changes/bug933 b/changes/bug933 new file mode 100644 index 0000000..b646858 --- /dev/null +++ b/changes/bug933 @@ -0,0 +1,4 @@ + o Minor features: + - Allow MapAddress directives to specify matches against super-domains, + as in 'MapAddress *.torproject.org *.torproject.org.torserver.exit'. + Implements issue 933. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 4edee80..4d4ad9f 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -659,7 +659,12 @@ The following options are useful only for clients (that is, if before processing it. For example, if you always want connections to www.indymedia.org to exit via __torserver__ (where __torserver__ is the nickname of the server), use "MapAddress www.indymedia.org - www.indymedia.org.torserver.exit". + www.indymedia.org.torserver.exit". If the value is prepended with a \'.\', + it is treated as matching an entire domain.For example, if you always + want connections to any sub-domain of indymedia.org to exit via + __torserver__ (where __torserver__ is the nickname of the server), use + "MapAddress .indymedia.org .torserver.exit". (Note the leading '.' in + each part of the directive.) **NewCircuitPeriod** __NUM__:: Every NUM seconds consider whether to build a new circuit. (Default: 30 diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index f59f44c..4bb49c8 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1037,6 +1037,29 @@ addressmap_free_all(void) virtaddress_reversemap = NULL; } +/** Try to find a match for AddressMap directives that use + * domain notation such as '.torproject.org .exitnode.exit'. + */ +static addressmap_entry_t * +addressmap_match_superdomains(char *address) +{ + strmap_iter_t *iter; + const char *key; + void *_val; + addressmap_entry_t *val; + + for (iter = strmap_iter_init(addressmap); !strmap_iter_done(iter); ) { + strmap_iter_get(iter, &key, &_val); + val = _val; + if (key[0] == '.') { /* match end */ + if (!strcasecmpend(address, key) || !strcasecmp(address, &key[1])) + return val; + } + iter = strmap_iter_next(addressmap,iter); + } + return 0; +} + /** Look at address, and rewrite it until it doesn't want any * more rewrites; but don't get into an infinite loop. * Don't write more than maxlen chars into address. Return true if the @@ -1050,24 +1073,36 @@ addressmap_rewrite(char *address, size_t maxlen, time_t *expires_out) addressmap_entry_t *ent; int rewrites; char *cp; + char *s; time_t expires = TIME_MAX; for (rewrites = 0; rewrites < 16; rewrites++) { ent = strmap_get(addressmap, address); + if (!ent || !ent->new_address) + ent = addressmap_match_superdomains(address); + if (!ent || !ent->new_address) { if (expires_out) *expires_out = expires; return (rewrites > 0); /* done, no rewrite needed */ } - cp = tor_strdup(escaped_safe_str_client(ent->new_address)); + cp = tor_strdup(escaped_safe_str_client(address)); + /* If the address to rewrite to is in the form '.exitnode.exit' + then append it to the given address */ + s = strrchr(ent->new_address,'.'); + if (ent->new_address[0] == '.' && !strcmp(s+1,"exit")) + strlcpy(address + strlen(address), ent->new_address, + (maxlen - strlen(address))); + else + strlcpy(address, ent->new_address, maxlen); + log_info(LD_APP, "Addressmap: rewriting %s to %s", - escaped_safe_str_client(address), cp); + cp, escaped_safe_str_client(address)); if (ent->expires > 1 && ent->expires < expires) expires = ent->expires; tor_free(cp); - strlcpy(address, ent->new_address, maxlen); } log_warn(LD_CONFIG, "Loop detected: we've rewritten %s 16 times! Using it as-is.", diff --git a/src/test/Makefile.am b/src/test/Makefile.am index 8527150..e675431 100644 --- a/src/test/Makefile.am +++ b/src/test/Makefile.am @@ -20,6 +20,7 @@ test_SOURCES = \ test_dir.c \ test_microdesc.c \ test_util.c \ + test_config.c \ tinytest.c test_LDFLAGS = @TOR_LDFLAGS_zlib@ @TOR_LDFLAGS_openssl@ \ diff --git a/src/test/test.c b/src/test/test.c index 605e44c..76644a7 100644 --- a/src/test/test.c +++ b/src/test/test.c @@ -1941,6 +1941,7 @@ extern struct testcase_t container_tests[]; extern struct testcase_t util_tests[]; extern struct testcase_t dir_tests[]; extern struct testcase_t microdesc_tests[]; +extern struct testcase_t config_tests[]; static struct testgroup_t testgroups[] = { { "", test_array }, @@ -1951,6 +1952,7 @@ static struct testgroup_t testgroups[] = { { "util/", util_tests }, { "dir/", dir_tests }, { "dir/md/", microdesc_tests }, + { "config/", config_tests }, END_OF_GROUPS }; diff --git a/src/test/test_config.c b/src/test/test_config.c new file mode 100644 index 0000000..f39a9ef --- /dev/null +++ b/src/test/test_config.c @@ -0,0 +1,127 @@ +/* Copyright (c) 2001-2004, Roger Dingledine. + * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. + * Copyright (c) 2007-2010, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +#include "orconfig.h" +#include "or.h" +#include "config.h" +#include "connection_edge.h" +#include "test.h" + +static void +test_config_addressmap(void) +{ + char buf[1024]; + char address[256]; + time_t expires = TIME_MAX; + strlcpy(buf, "MapAddress .google.com .torserver.exit\n" + "MapAddress www.torproject.org 1.1.1.1\n" + "MapAddress other.torproject.org " + "this.torproject.org.otherserver.exit\n" + "MapAddress test.torproject.org 2.2.2.2\n" + "MapAddress www.google.com 3.3.3.3\n" + "MapAddress www.example.org 4.4.4.4\n" + "MapAddress 4.4.4.4 5.5.5.5\n" + "MapAddress www.infiniteloop.org 6.6.6.6\n" + "MapAddress 6.6.6.6 www.infiniteloop.org\n" + , sizeof(buf)); + + config_get_lines(buf, &(get_options()->AddressMap)); + config_register_addressmaps(get_options()); + + /* Where no mapping for FQDN match on top-level domain */ + strlcpy(address, "reader.google.com", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "reader.google.com.torserver.exit"); + + /* Where mapping for FQDN match on FQDN */ + strlcpy(address, "www.google.com", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "3.3.3.3"); + + strlcpy(address, "www.torproject.org", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "1.1.1.1"); + + strlcpy(address, "other.torproject.org", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "this.torproject.org.otherserver.exit"); + + strlcpy(address, "test.torproject.org", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "2.2.2.2"); + + /* Test a chain of address mappings */ + strlcpy(address, "www.example.org", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "5.5.5.5"); + + /* Test infinite address mapping results in no change */ + strlcpy(address, "www.infiniteloop.org", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "www.infiniteloop.org"); + + /* Test we don't find false positives */ + strlcpy(address, "www.example.com", sizeof(address)); + test_assert(!addressmap_rewrite(address, sizeof(address), &expires)); + + /* Test top-level-domain matching a bit harder */ + addressmap_clear_configured(); + strlcpy(buf, "MapAddress .com .torserver.exit\n" + "MapAddress .torproject.org 1.1.1.1\n" + "MapAddress .net 2.2.2.2\n" + , sizeof(buf)); + config_get_lines(buf, &(get_options()->AddressMap)); + config_register_addressmaps(get_options()); + + strlcpy(address, "www.abc.com", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "www.abc.com.torserver.exit"); + + strlcpy(address, "www.def.com", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "www.def.com.torserver.exit"); + + strlcpy(address, "www.torproject.org", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "1.1.1.1"); + + strlcpy(address, "test.torproject.org", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "1.1.1.1"); + + strlcpy(address, "torproject.net", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "2.2.2.2"); + + /* We don't support '.' as a mapping directive */ + addressmap_clear_configured(); + strlcpy(buf, "MapAddress . .torserver.exit\n", sizeof(buf)); + config_get_lines(buf, &(get_options()->AddressMap)); + config_register_addressmaps(get_options()); + + strlcpy(address, "www.abc.com", sizeof(address)); + test_assert(!addressmap_rewrite(address, sizeof(address), &expires)); + + strlcpy(address, "www.def.net", sizeof(address)); + test_assert(!addressmap_rewrite(address, sizeof(address), &expires)); + + strlcpy(address, "www.torproject.org", sizeof(address)); + test_assert(!addressmap_rewrite(address, sizeof(address), &expires)); + +done: + ; +} + +#define CONFIG_LEGACY(name) \ + { #name, legacy_test_helper, 0, &legacy_setup, test_config_ ## name } + +#define CONFIG_TEST(name, flags) \ + { #name, test_config_ ## name, flags, NULL, NULL } + +struct testcase_t config_tests[] = { + CONFIG_LEGACY(addressmap), + END_OF_TESTCASES +}; +

1 0

[tor/master] Address nickm's comments at https://trac.torproject.org/projects/tor/ticket/933#comment:4
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 909e9769ece9e89ad0c4bbb558a6f8247c6a62bd Author: Robert Hogan <robert(a)roberthogan.net> Date: Mon Dec 13 22:13:01 2010 +0000 Address nickm's comments at https://trac.torproject.org/projects/tor/ticket/933#comment:4 1. Implement the following mapping rules: MapAddress a.b.c d.e.f # This is what we have now MapAddress .a.b.c d.e.f # Replaces any address ending with .a.b.c with d.e.f MapAddress .a.b.c .d.e.f # Replaces the .a.b.c at the end of any addr with .d.e.f (Note that 'a.b.c .d.e.f' is invalid, and will be rejected.) 2. Add tests for the new rules. 3. Allow proper wildcard annotation, i.e. '*.d.e' '.d.e' will still work. 4. Update addressmap_entry_t with an is_wildcard member. --- doc/tor.1.txt | 10 ++++++---- src/or/config.c | 13 ++++++++++++- src/or/connection_edge.c | 25 ++++++++++++++++--------- src/test/test_config.c | 33 +++++++++++++++++++++++++++++++-- 4 files changed, 65 insertions(+), 16 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 4d4ad9f..1c9d387 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -659,12 +659,14 @@ The following options are useful only for clients (that is, if before processing it. For example, if you always want connections to www.indymedia.org to exit via __torserver__ (where __torserver__ is the nickname of the server), use "MapAddress www.indymedia.org - www.indymedia.org.torserver.exit". If the value is prepended with a \'.\', - it is treated as matching an entire domain.For example, if you always + www.indymedia.org.torserver.exit". If the value is prepended with a \'*.\', + it is treated as matching an entire domain. For example, if you always want connections to any sub-domain of indymedia.org to exit via __torserver__ (where __torserver__ is the nickname of the server), use - "MapAddress .indymedia.org .torserver.exit". (Note the leading '.' in - each part of the directive.) + "MapAddress *.indymedia.org *.indymedia.org.torserver.exit". (Note the + leading '*.' in each part of the directive.) You can also redirect all + subdomains of a domain to a single address. For example, "MapAddress + *.indymedia.org www.indymedia.org". **NewCircuitPeriod** __NUM__:: Every NUM seconds consider whether to build a new circuit. (Default: 30 diff --git a/src/or/config.c b/src/or/config.c index afcea1f..1744b84 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -4464,7 +4464,18 @@ config_register_addressmaps(const or_options_t *options) if (smartlist_len(elts) >= 2) { from = smartlist_get(elts,0); to = smartlist_get(elts,1); - if (address_is_invalid_destination(to, 1)) { + + /* Remove leading asterisk in expressions of type: '*.example.com' */ + if (from[0] == '*' && strlen(from) > 1) + from++; + if (to[0] == '*' && strlen(to) > 1) + to++; + if (to[0] == '.' && from[0] != '.') { + log_warn(LD_CONFIG, + "Skipping invalid argument '%s' to MapAddress: " + "can only use wildcard (i.e. '.' or '*.') if 'from' address " + "uses wildcard also", to); + } else if (address_is_invalid_destination(to, 1)) { log_warn(LD_CONFIG, "Skipping invalid argument '%s' to MapAddress", to); } else { diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 4bb49c8..2c8c9da 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -794,6 +794,7 @@ typedef struct { char *new_address; time_t expires; addressmap_entry_source_t source:3; + int is_wildcard:1; short num_resolve_failures; } addressmap_entry_t; @@ -1037,8 +1038,12 @@ addressmap_free_all(void) virtaddress_reversemap = NULL; } -/** Try to find a match for AddressMap directives that use - * domain notation such as '.torproject.org .exitnode.exit'. +/** Try to find a match for AddressMap expressions that use + * wildcard notation such as '*.c.d *.e.f' (so 'a.c.d' will map to 'a.e.f') or + * '*.c.d a.b.c' (so 'a.c.d' will map to a.b.c). + * Returns the matching entry in AddressMap or 0 if no match is found. + * For expressions such as '*.c.d *.e.f' the <b>address</b> 'a.c.d' will + * get truncated to 'a' before we return the matching AddressMap entry. */ static addressmap_entry_t * addressmap_match_superdomains(char *address) @@ -1047,13 +1052,18 @@ addressmap_match_superdomains(char *address) const char *key; void *_val; addressmap_entry_t *val; + char *matched_domains = 0; for (iter = strmap_iter_init(addressmap); !strmap_iter_done(iter); ) { strmap_iter_get(iter, &key, &_val); val = _val; - if (key[0] == '.') { /* match end */ - if (!strcasecmpend(address, key) || !strcasecmp(address, &key[1])) + if (key[0] == '.') { + if (!strcasecmpend(address, key) || !strcasecmp(address, &key[1])) { + matched_domains = strstr(address, key); + if (val->is_wildcard && matched_domains) + *matched_domains = '\0'; return val; + } } iter = strmap_iter_next(addressmap,iter); } @@ -1073,7 +1083,6 @@ addressmap_rewrite(char *address, size_t maxlen, time_t *expires_out) addressmap_entry_t *ent; int rewrites; char *cp; - char *s; time_t expires = TIME_MAX; for (rewrites = 0; rewrites < 16; rewrites++) { @@ -1089,10 +1098,7 @@ addressmap_rewrite(char *address, size_t maxlen, time_t *expires_out) } cp = tor_strdup(escaped_safe_str_client(address)); - /* If the address to rewrite to is in the form '.exitnode.exit' - then append it to the given address */ - s = strrchr(ent->new_address,'.'); - if (ent->new_address[0] == '.' && !strcmp(s+1,"exit")) + if (ent->is_wildcard) strlcpy(address + strlen(address), ent->new_address, (maxlen - strlen(address))); else @@ -1211,6 +1217,7 @@ addressmap_register(const char *address, char *new_address, time_t expires, ent->expires = expires==2 ? 1 : expires; ent->num_resolve_failures = 0; ent->source = source; + ent->is_wildcard = (new_address[0] == '.') ? 1 : 0; log_info(LD_CONFIG, "Addressmap: (re)mapped '%s' to '%s'", safe_str_client(address), diff --git a/src/test/test_config.c b/src/test/test_config.c index f39a9ef..a7b5d03 100644 --- a/src/test/test_config.c +++ b/src/test/test_config.c @@ -16,6 +16,11 @@ test_config_addressmap(void) char address[256]; time_t expires = TIME_MAX; strlcpy(buf, "MapAddress .google.com .torserver.exit\n" + "MapAddress *.yahoo.com *.google.com.torserver.exit\n" + "MapAddress .cn.com www.cnn.com\n" + "MapAddress *.cnn.com www.cnn.com\n" + "MapAddress ex.com www.cnn.com\n" + "MapAddress ey.com *.cnn.com\n" "MapAddress www.torproject.org 1.1.1.1\n" "MapAddress other.torproject.org " "this.torproject.org.otherserver.exit\n" @@ -31,10 +36,34 @@ test_config_addressmap(void) config_register_addressmaps(get_options()); /* Where no mapping for FQDN match on top-level domain */ + /* MapAddress .google.com .torserver.exit */ strlcpy(address, "reader.google.com", sizeof(address)); test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "reader.torserver.exit"); + + /* MapAddress *.yahoo.com *.google.com.torserver.exit */ + strlcpy(address, "reader.yahoo.com", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); test_streq(address, "reader.google.com.torserver.exit"); + /*MapAddress *.cnn.com www.cnn.com */ + strlcpy(address, "cnn.com", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "www.cnn.com"); + + /* MapAddress .cn.com www.cnn.com */ + strlcpy(address, "www.cn.com", sizeof(address)); + test_assert(addressmap_rewrite(address, sizeof(address), &expires)); + test_streq(address, "www.cnn.com"); + + /* MapAddress ex.com www.cnn.com - no match */ + strlcpy(address, "www.ex.com", sizeof(address)); + test_assert(!addressmap_rewrite(address, sizeof(address), &expires)); + + /* MapAddress ey.com *.cnn.com - invalid expression */ + strlcpy(address, "ey.com", sizeof(address)); + test_assert(!addressmap_rewrite(address, sizeof(address), &expires)); + /* Where mapping for FQDN match on FQDN */ strlcpy(address, "www.google.com", sizeof(address)); test_assert(addressmap_rewrite(address, sizeof(address), &expires)); @@ -77,11 +106,11 @@ test_config_addressmap(void) strlcpy(address, "www.abc.com", sizeof(address)); test_assert(addressmap_rewrite(address, sizeof(address), &expires)); - test_streq(address, "www.abc.com.torserver.exit"); + test_streq(address, "www.abc.torserver.exit"); strlcpy(address, "www.def.com", sizeof(address)); test_assert(addressmap_rewrite(address, sizeof(address), &expires)); - test_streq(address, "www.def.com.torserver.exit"); + test_streq(address, "www.def.torserver.exit"); strlcpy(address, "www.torproject.org", sizeof(address)); test_assert(addressmap_rewrite(address, sizeof(address), &expires));

1 0

[tor/master] Address nickm's comments at https://trac.torproject.org/projects/tor/ticket/933#comment:8
by nickm＠torproject.org 30 Nov '11

30 Nov '11

commit 53ce6bb52d29e80c7efd29b8604bdd680c9515ea Author: Robert Hogan <robert(a)roberthogan.net> Date: Mon Dec 27 17:35:16 2010 +0000 Address nickm's comments at https://trac.torproject.org/projects/tor/ticket/933#comment:8 1. Only allow '*.' in MapAddress expressions. Ignore '*ample.com' and '.example.com'. This has resulted in a slight refactoring of config_register_addressmaps. 2. Add some more detail to the man page entry for AddressMap. 3. Fix initialization of a pointer to NULL rather than 0. 4. Update the unit tests to cater for the changes in 1 and test more explicitly for recursive mapping. --- doc/tor.1.txt | 41 +++++++++++++++++++++++++----- src/or/config.c | 62 ++++++++++++++++++++++++++++----------------- src/or/connection_edge.c | 2 +- src/test/test_config.c | 31 +++++++++++++++++------ 4 files changed, 96 insertions(+), 40 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 1c9d387..eb79452 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -658,15 +658,42 @@ The following options are useful only for clients (that is, if When a request for address arrives to Tor, it will rewrite it to newaddress before processing it. For example, if you always want connections to www.indymedia.org to exit via __torserver__ (where __torserver__ is the - nickname of the server), use "MapAddress www.indymedia.org - www.indymedia.org.torserver.exit". If the value is prepended with a \'*.\', - it is treated as matching an entire domain. For example, if you always - want connections to any sub-domain of indymedia.org to exit via + nickname of the server), use MapAddress www.indymedia.org + www.indymedia.org.torserver.exit. If the value is prepended with a + '*.', it is treated as matching an entire domain. For example, if you + always want connections to any sub-domain of indymedia.org to exit via __torserver__ (where __torserver__ is the nickname of the server), use - "MapAddress *.indymedia.org *.indymedia.org.torserver.exit". (Note the + MapAddress *.indymedia.org *.indymedia.org.torserver.exit. (Note the leading '*.' in each part of the directive.) You can also redirect all - subdomains of a domain to a single address. For example, "MapAddress - *.indymedia.org www.indymedia.org". + subdomains of a domain to a single address. For example, MapAddress + *.indymedia.org www.indymedia.org. + + + + NOTES: + + 1. When evaluating MapAddress expressions Tor stops when it hits the most + recently added expression that matches the requested address. So if you + have the following in your torrc, www.torproject.org will map to 1.1.1.1: + + MapAddress www.torproject.org 2.2.2.2 + MapAddress www.torproject.org 1.1.1.1 + + 2. Tor evaluates the MapAddress configuration until it finds no matches. So + if you have the following in your torrc, www.torproject.org will map to + 2.2.2.2: + + MapAddress www.torproject.org 3.3.3.3 + MapAddress 1.1.1.1 4.4.4.4 + MapAddress 1.1.1.1 2.2.2.2 + MapAddress www.torproject.org 1.1.1.1 + + 3. The following MapAddress expression is invalid (and will be + ignored) because you cannot map from a specific address to a wildcarded + address: + + MapAddress www.torproject.org *.torproject.org.torserver.exit + + 4. Using a wildcard as a regular expression (e.g. *ample.com) is + also invalid. **NewCircuitPeriod** __NUM__:: Every NUM seconds consider whether to build a new circuit. (Default: 30 diff --git a/src/or/config.c b/src/or/config.c index 1744b84..1d42413 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -4461,33 +4461,47 @@ config_register_addressmaps(const or_options_t *options) for (opt = options->AddressMap; opt; opt = opt->next) { smartlist_split_string(elts, opt->value, NULL, SPLIT_SKIP_SPACE|SPLIT_IGNORE_BLANK, 2); - if (smartlist_len(elts) >= 2) { - from = smartlist_get(elts,0); - to = smartlist_get(elts,1); - - /* Remove leading asterisk in expressions of type: '*.example.com' */ - if (from[0] == '*' && strlen(from) > 1) - from++; - if (to[0] == '*' && strlen(to) > 1) - to++; - if (to[0] == '.' && from[0] != '.') { - log_warn(LD_CONFIG, - "Skipping invalid argument '%s' to MapAddress: " - "can only use wildcard (i.e. '.' or '*.') if 'from' address " - "uses wildcard also", to); - } else if (address_is_invalid_destination(to, 1)) { - log_warn(LD_CONFIG, - "Skipping invalid argument '%s' to MapAddress", to); - } else { - addressmap_register(from, tor_strdup(to), 0, ADDRMAPSRC_TORRC); - if (smartlist_len(elts)>2) { - log_warn(LD_CONFIG,"Ignoring extra arguments to MapAddress."); - } - } - } else { + if (smartlist_len(elts) < 2) { log_warn(LD_CONFIG,"MapAddress '%s' has too few arguments. Ignoring.", opt->value); + goto cleanup; + } + + from = smartlist_get(elts,0); + to = smartlist_get(elts,1); + + if (to[0] == '.' || from[0] == '.') { + log_warn(LD_CONFIG,"MapAddress '%s' is ambiguous - address starts with a" + "'.'. Ignoring.",opt->value); + goto cleanup; + } + + /* Remove leading asterisk in expressions of type: '*.example.com' */ + if (!strncmp(from,"*.",2)) + from++; + if (!strncmp(to,"*.",2)) + to++; + + if (to[0] == '.' && from[0] != '.') { + log_warn(LD_CONFIG, + "Skipping invalid argument '%s' to MapAddress: " + "can only use wildcard (i.e. '*.') if 'from' address " + "uses wildcard also", to); + goto cleanup; + } + + if (address_is_invalid_destination(to, 1)) { + log_warn(LD_CONFIG, + "Skipping invalid argument '%s' to MapAddress", to); + goto cleanup; } + + addressmap_register(from, tor_strdup(to), 0, ADDRMAPSRC_TORRC); + + if (smartlist_len(elts) > 2) + log_warn(LD_CONFIG,"Ignoring extra arguments to MapAddress."); + + cleanup: SMARTLIST_FOREACH(elts, char*, cp, tor_free(cp)); smartlist_clear(elts); } diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 2c8c9da..284b320 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1052,7 +1052,7 @@ addressmap_match_superdomains(char *address) const char *key; void *_val; addressmap_entry_t *val; - char *matched_domains = 0; + char *matched_domains = NULL; for (iter = strmap_iter_init(addressmap); !strmap_iter_done(iter); ) { strmap_iter_get(iter, &key, &_val); diff --git a/src/test/test_config.c b/src/test/test_config.c index a7b5d03..8880bd0 100644 --- a/src/test/test_config.c +++ b/src/test/test_config.c @@ -15,9 +15,11 @@ test_config_addressmap(void) char buf[1024]; char address[256]; time_t expires = TIME_MAX; - strlcpy(buf, "MapAddress .google.com .torserver.exit\n" + strlcpy(buf, "MapAddress .invalidwildcard.com *.torserver.exit\n" // invalid + "MapAddress *invalidasterisk.com *.torserver.exit\n" // invalid + "MapAddress *.google.com *.torserver.exit\n" "MapAddress *.yahoo.com *.google.com.torserver.exit\n" - "MapAddress .cn.com www.cnn.com\n" + "MapAddress *.cn.com www.cnn.com\n" "MapAddress *.cnn.com www.cnn.com\n" "MapAddress ex.com www.cnn.com\n" "MapAddress ey.com *.cnn.com\n" @@ -27,6 +29,7 @@ test_config_addressmap(void) "MapAddress test.torproject.org 2.2.2.2\n" "MapAddress www.google.com 3.3.3.3\n" "MapAddress www.example.org 4.4.4.4\n" + "MapAddress 4.4.4.4 7.7.7.7\n" "MapAddress 4.4.4.4 5.5.5.5\n" "MapAddress www.infiniteloop.org 6.6.6.6\n" "MapAddress 6.6.6.6 www.infiniteloop.org\n" @@ -35,6 +38,14 @@ test_config_addressmap(void) config_get_lines(buf, &(get_options()->AddressMap)); config_register_addressmaps(get_options()); + /* MapAddress .invalidwildcard.com .torserver.exit - no match */ + strlcpy(address, "www.invalidwildcard.com", sizeof(address)); + test_assert(!addressmap_rewrite(address, sizeof(address), &expires)); + + /* MapAddress *invalidasterisk.com .torserver.exit - no match */ + strlcpy(address, "www.invalidasterisk.com", sizeof(address)); + test_assert(!addressmap_rewrite(address, sizeof(address), &expires)); + /* Where no mapping for FQDN match on top-level domain */ /* MapAddress .google.com .torserver.exit */ strlcpy(address, "reader.google.com", sizeof(address)); @@ -81,7 +92,11 @@ test_config_addressmap(void) test_assert(addressmap_rewrite(address, sizeof(address), &expires)); test_streq(address, "2.2.2.2"); - /* Test a chain of address mappings */ + /* Test a chain of address mappings and the order in which they were added: + "MapAddress www.example.org 4.4.4.4" + "MapAddress 4.4.4.4 7.7.7.7" + "MapAddress 4.4.4.4 5.5.5.5" + */ strlcpy(address, "www.example.org", sizeof(address)); test_assert(addressmap_rewrite(address, sizeof(address), &expires)); test_streq(address, "5.5.5.5"); @@ -97,9 +112,9 @@ test_config_addressmap(void) /* Test top-level-domain matching a bit harder */ addressmap_clear_configured(); - strlcpy(buf, "MapAddress .com .torserver.exit\n" - "MapAddress .torproject.org 1.1.1.1\n" - "MapAddress .net 2.2.2.2\n" + strlcpy(buf, "MapAddress *.com *.torserver.exit\n" + "MapAddress *.torproject.org 1.1.1.1\n" + "MapAddress *.net 2.2.2.2\n" , sizeof(buf)); config_get_lines(buf, &(get_options()->AddressMap)); config_register_addressmaps(get_options()); @@ -124,9 +139,9 @@ test_config_addressmap(void) test_assert(addressmap_rewrite(address, sizeof(address), &expires)); test_streq(address, "2.2.2.2"); - /* We don't support '.' as a mapping directive */ + /* We don't support '*' as a mapping directive */ addressmap_clear_configured(); - strlcpy(buf, "MapAddress . .torserver.exit\n", sizeof(buf)); + strlcpy(buf, "MapAddress * *.torserver.exit\n", sizeof(buf)); config_get_lines(buf, &(get_options()->AddressMap)); config_register_addressmaps(get_options());

1 0