December 2012 - tor-commits - lists.torproject.org

[tor/master] Nick's Code review #3 part 2.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit 406d59a9c93e46bcb5be0e0a5c087f4860522d56 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Dec 18 14:16:01 2012 -0800 Nick's Code review #3 part 2. --- src/or/circuitbuild.c | 15 +++++++++++---- src/or/entrynodes.c | 6 +++--- 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 58020f2..804782d 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1350,7 +1350,7 @@ pathbias_count_build_success(origin_circuit_t *circ) circ->path_state = PATH_STATE_BUILD_SUCCEEDED; guard->circ_successes++; - log_info(LD_CIRC, "Got success count %lf/%lf for guard %s=%s", + log_info(LD_CIRC, "Got success count %f/%f for guard %s=%s", guard->circ_successes, guard->circ_attempts, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); } else { @@ -1368,7 +1368,7 @@ pathbias_count_build_success(origin_circuit_t *circ) } if (guard->circ_attempts < guard->circ_successes) { - log_notice(LD_BUG, "Unexpectedly high successes counts (%lf/%lf) " + log_notice(LD_BUG, "Unexpectedly high successes counts (%f/%f) " "for guard %s=%s", guard->circ_successes, guard->circ_attempts, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); @@ -1407,6 +1407,13 @@ pathbias_count_build_success(origin_circuit_t *circ) /** * Check if a circuit was used and/or closed successfully. + * + * If we attempted to use the circuit to carry a stream but failed + * for whatever reason, or if the circuit mysteriously died before + * we could attach any streams, record these two cases. + * + * If we *have* successfully used the circuit, or it appears to + * have been closed by us locally, count it as a success. */ void pathbias_check_close(origin_circuit_t *ocirc, int reason) @@ -1751,7 +1758,7 @@ entry_guard_inc_circ_attempt_count(entry_guard_t *guard) const int scale_factor = pathbias_get_scale_factor(options); const int mult_factor = pathbias_get_mult_factor(options); log_info(LD_CIRC, - "Scaling pathbias counts to (%lf/%lf)*(%d/%d) for guard %s=%s", + "Scaling pathbias counts to (%f/%f)*(%d/%d) for guard %s=%s", guard->circ_successes, guard->circ_attempts, mult_factor, scale_factor, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); @@ -1771,7 +1778,7 @@ entry_guard_inc_circ_attempt_count(entry_guard_t *guard) guard->unusable_circuits /= scale_factor; } guard->circ_attempts++; - log_info(LD_CIRC, "Got success count %lf/%lf for guard %s=%s", + log_info(LD_CIRC, "Got success count %f/%f for guard %s=%s", guard->circ_successes, guard->circ_attempts, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); return 0; diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index fc7f6ed..7aa4d7a 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1060,7 +1060,7 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) node->collapsed_circuits = collapsed; node->unusable_circuits = unusable; - log_info(LD_GENERAL, "Read %lf/%lf path bias for node %s", + log_info(LD_GENERAL, "Read %f/%f path bias for node %s", node->circ_successes, node->circ_attempts, node->nickname); /* Note: We rely on the < comparison here to allow us to set a 0 * rate and disable the feature entirely. If refactoring, don't @@ -1070,7 +1070,7 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) pathbias_get_dropguards(options)) { node->path_bias_disabled = 1; log_info(LD_GENERAL, - "Path bias is too high (%lf/%lf); disabling node %s", + "Path bias is too high (%f/%f); disabling node %s", node->circ_successes, node->circ_attempts, node->nickname); } @@ -1200,7 +1200,7 @@ entry_guards_update_state(or_state_t *state) /* In the long run: circuit_success ~= successful_circuit_close + * collapsed_circuits + * unusable_circuits */ - tor_asprintf(&line->value, "%lf %lf %lf %lf %lf %lf", + tor_asprintf(&line->value, "%f %f %f %f %f %f", e->circ_attempts, e->circ_successes, pathbias_get_closed_count(e), e->collapsed_circuits, e->unusable_circuits, e->timeouts);

1 0

[tor/master] Add the ability to count circuit timeouts for guards.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit 954f263ed5eb451a0742f8888681e10e64dd193a Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed Oct 24 17:34:18 2012 -0700 Add the ability to count circuit timeouts for guards. This is purely for informational reasons for debugging. --- src/or/circuitbuild.c | 67 +++++++++++++++++++++++++++++++++++++++++++++++++ src/or/circuituse.c | 2 + src/or/entrynodes.c | 18 +++++++++---- src/or/entrynodes.h | 2 + src/or/or.h | 2 + 5 files changed, 85 insertions(+), 6 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 7301874..c8c8db3 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1057,6 +1057,53 @@ pathbias_state_to_string(path_state_t state) } /** + * Decide if the path bias code should count a circuit. + * + * @returns 1 if we should count it, 0 otherwise. + */ +static int +pathbias_should_count(origin_circuit_t *circ) +{ +#define PATHBIAS_COUNT_INTERVAL (600) + static ratelim_t count_limit = + RATELIM_INIT(PATHBIAS_COUNT_INTERVAL); + char *rate_msg = NULL; + + /* We can't do path bias accounting without entry guards. + * Testing and controller circuits also have no guards. */ + if (get_options()->UseEntryGuards == 0 || + circ->base_.purpose == CIRCUIT_PURPOSE_TESTING || + circ->base_.purpose == CIRCUIT_PURPOSE_CONTROLLER) { + return 0; + } + + /* Completely ignore one hop circuits */ + if (circ->build_state->onehop_tunnel || + circ->build_state->desired_path_len == 1) { + /* Check for inconsistency */ + if (circ->build_state->desired_path_len != 1 || + !circ->build_state->onehop_tunnel) { + if ((rate_msg = rate_limit_log(&count_limit, approx_time()))) { + log_notice(LD_BUG, + "One-hop circuit has length %d. Path state is %s. " + "Circuit is a %s currently %s.%s", + circ->build_state->desired_path_len, + pathbias_state_to_string(circ->path_state), + circuit_purpose_to_string(circ->base_.purpose), + circuit_state_to_string(circ->base_.state), + rate_msg); + tor_free(rate_msg); + } + tor_fragile_assert(); + } + return 0; + } + + return 1; +} + + +/** * Check our circuit state to see if this is a successful first hop. * If so, record it in the current guard's path bias first_hop count. * @@ -1290,6 +1337,26 @@ pathbias_count_success(origin_circuit_t *circ) } } +/** + * Count timeouts for path bias log messages. + * + * These counts are purely informational. + */ +void +pathbias_count_timeout(origin_circuit_t *circ) +{ + if(!pathbias_should_count(circ)) { + return; + } + entry_guard_t *guard = + entry_guard_get_by_id_digest(circ->base_.n_chan->identity_digest); + + if (guard) { + guard->timeouts++; + entry_guards_changed(); + } +} + /** Increment the number of times we successfully extended a circuit to * 'guard', first checking if the failure rate is high enough that we should * eliminate the guard. Return -1 if the guard looks no good; return 0 if the diff --git a/src/or/circuituse.c b/src/or/circuituse.c index e14f9d0..77822a3 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -663,6 +663,8 @@ circuit_expire_building(void) circuit_mark_for_close(victim, END_CIRC_REASON_MEASUREMENT_EXPIRED); else circuit_mark_for_close(victim, END_CIRC_REASON_TIMEOUT); + + pathbias_count_timeout(TO_ORIGIN_CIRCUIT(victim)); } } diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 8712241..d9a06a6 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1021,7 +1021,7 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) digestmap_set(added_by, d, tor_strdup(line->value+HEX_DIGEST_LEN+1)); } else if (!strcasecmp(line->key, "EntryGuardPathBias")) { const or_options_t *options = get_options(); - unsigned hop_cnt, success_cnt; + unsigned hop_cnt, success_cnt, timeouts; if (!node) { *msg = tor_strdup("Unable to parse entry nodes: " @@ -1029,14 +1029,20 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) break; } - if (tor_sscanf(line->value, "%u %u", &success_cnt, &hop_cnt) != 2) { - log_warn(LD_GENERAL, "Unable to parse guard path bias info: " + /* First try 3 params, then 2. */ + if (tor_sscanf(line->value, "%u %u %u", &success_cnt, &hop_cnt, + &timeouts) != 3) { + timeouts = 0; + if (tor_sscanf(line->value, "%u %u", &success_cnt, &hop_cnt) != 2) { + log_warn(LD_GENERAL, "Unable to parse guard path bias info: " "Misformated EntryGuardPathBias %s", escaped(line->value)); - continue; + continue; + } } node->first_hops = hop_cnt; node->circuit_successes = success_cnt; + node->timeouts = timeouts; log_info(LD_GENERAL, "Read %u/%u path bias for node %s", node->circuit_successes, node->first_hops, node->nickname); /* Note: We rely on the < comparison here to allow us to set a 0 @@ -1173,8 +1179,8 @@ entry_guards_update_state(or_state_t *state) if (e->first_hops) { *next = line = tor_malloc_zero(sizeof(config_line_t)); line->key = tor_strdup("EntryGuardPathBias"); - tor_asprintf(&line->value, "%u %u", - e->circuit_successes, e->first_hops); + tor_asprintf(&line->value, "%u %u %u", + e->circuit_successes, e->first_hops, e->timeouts); next = &(line->next); } diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index 4d031c3..b347441 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -47,6 +47,8 @@ typedef struct entry_guard_t { unsigned first_hops; /**< Number of first hops this guard has completed */ unsigned circuit_successes; /**< Number of successfully built circuits using * this guard as first hop. */ + unsigned timeouts; /**< Number of 'right-censored' timeouts + for this guard. */ } entry_guard_t; entry_guard_t *entry_guard_get_by_id_digest(const char *digest); diff --git a/src/or/or.h b/src/or/or.h index 195cb2b..5920210 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4067,6 +4067,8 @@ typedef struct { double close_ms; } circuit_build_times_t; +void pathbias_count_timeout(origin_circuit_t *circ); + /********************************* config.c ***************************/ /** An error from options_trial_assign() or options_init_from_string(). */

1 0

[tor/master] Update pathbias parameters to match Proposal 209.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit 248fbc3619664e1d9f4b16732ccbdb484939624d Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed Oct 24 18:03:09 2012 -0700 Update pathbias parameters to match Proposal 209. Needs manpage update and testing still.. --- src/or/circuitbuild.c | 77 +++++++++++++++++++++++++++++++++++++----------- src/or/circuitbuild.h | 3 +- src/or/config.c | 5 ++- src/or/entrynodes.c | 5 ++- src/or/or.h | 5 ++- 5 files changed, 72 insertions(+), 23 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index c8c8db3..65c6492 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -985,7 +985,7 @@ circuit_init_cpath_crypto(crypt_path_t *cpath, const char *key_data, static int pathbias_get_min_circs(const or_options_t *options) { -#define DFLT_PATH_BIAS_MIN_CIRC 20 +#define DFLT_PATH_BIAS_MIN_CIRC 150 if (options->PathBiasCircThreshold >= 5) return options->PathBiasCircThreshold; else @@ -997,7 +997,7 @@ pathbias_get_min_circs(const or_options_t *options) static double pathbias_get_notice_rate(const or_options_t *options) { -#define DFLT_PATH_BIAS_NOTICE_PCT 40 +#define DFLT_PATH_BIAS_NOTICE_PCT 70 if (options->PathBiasNoticeRate >= 0.0) return options->PathBiasNoticeRate; else @@ -1007,22 +1007,45 @@ pathbias_get_notice_rate(const or_options_t *options) /* XXXX024 I'd like to have this be static again, but entrynodes.c needs it. */ double -pathbias_get_disable_rate(const or_options_t *options) +pathbias_get_warn_rate(const or_options_t *options) { -// XXX: This needs tuning based on use + experimentation before we set it -#define DFLT_PATH_BIAS_DISABLE_PCT 0 - if (options->PathBiasDisableRate >= 0.0) - return options->PathBiasDisableRate; +#define DFLT_PATH_BIAS_WARN_PCT 50 + if (options->PathBiasWarnRate >= 0.0) + return options->PathBiasWarnRate; else - return networkstatus_get_param(NULL, "pb_disablepct", - DFLT_PATH_BIAS_DISABLE_PCT, 0, 100)/100.0; + return networkstatus_get_param(NULL, "pb_warnpct", + DFLT_PATH_BIAS_WARN_PCT, 0, 100)/100.0; +} + +/* XXXX024 I'd like to have this be static again, but entrynodes.c needs it. */ +double +pathbias_get_crit_rate(const or_options_t *options) +{ +#define DFLT_PATH_BIAS_CRIT_PCT 30 + if (options->PathBiasCritRate >= 0.0) + return options->PathBiasCritRate; + else + return networkstatus_get_param(NULL, "pb_critpct", + DFLT_PATH_BIAS_CRIT_PCT, 0, 100)/100.0; +} + +/* XXXX024 I'd like to have this be static again, but entrynodes.c needs it. */ +int +pathbias_get_dropguards(const or_options_t *options) +{ +#define DFLT_PATH_BIAS_DROP_GUARDS 0 + if (options->PathBiasDropGuards >= 0) + return options->PathBiasDropGuards; + else + return networkstatus_get_param(NULL, "pb_dropguards", + DFLT_PATH_BIAS_DROP_GUARDS, 0, 100)/100.0; } static int pathbias_get_scale_threshold(const or_options_t *options) { -#define DFLT_PATH_BIAS_SCALE_THRESHOLD 200 - if (options->PathBiasScaleThreshold >= 2) +#define DFLT_PATH_BIAS_SCALE_THRESHOLD 300 + if (options->PathBiasScaleThreshold >= 10) return options->PathBiasScaleThreshold; else return networkstatus_get_param(NULL, "pb_scalecircs", @@ -1041,6 +1064,18 @@ pathbias_get_scale_factor(const or_options_t *options) DFLT_PATH_BIAS_SCALE_FACTOR, 1, INT32_MAX); } +static int +pathbias_get_mult_factor(const or_options_t *options) +{ +#define DFLT_PATH_BIAS_MULT_FACTOR 1 + if (options->PathBiasMultFactor >= 1) + return options->PathBiasMultFactor; + else + return networkstatus_get_param(NULL, "pb_multfactor", + DFLT_PATH_BIAS_MULT_FACTOR, 1, + pathbias_get_scale_factor(options)-1); +} + static const char * pathbias_state_to_string(path_state_t state) { @@ -1373,7 +1408,7 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) * rate and disable the feature entirely. If refactoring, don't * change to <= */ if (guard->circuit_successes/((double)guard->first_hops) - < pathbias_get_disable_rate(options)) { + < pathbias_get_crit_rate(options)) { /* This message is currently disabled by default. */ log_warn(LD_PROTOCOL, @@ -1383,8 +1418,10 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); - guard->path_bias_disabled = 1; - guard->bad_since = approx_time(); + if (pathbias_get_dropguards(options)) { + guard->path_bias_disabled = 1; + guard->bad_since = approx_time(); + } return -1; } else if (guard->circuit_successes/((double)guard->first_hops) < pathbias_get_notice_rate(options) @@ -1400,15 +1437,19 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) /* If we get a ton of circuits, just scale everything down */ if (guard->first_hops > (unsigned)pathbias_get_scale_threshold(options)) { const int scale_factor = pathbias_get_scale_factor(options); + const int mult_factor = pathbias_get_mult_factor(options); /* For now, only scale if there will be no rounding error... * XXX024: We want to switch to a real moving average for 0.2.4. */ - if ((guard->first_hops % scale_factor) == 0 && - (guard->circuit_successes % scale_factor) == 0) { + if (((mult_factor*guard->first_hops) % scale_factor) == 0 && + ((mult_factor*guard->circuit_successes) % scale_factor) == 0) { log_info(LD_PROTOCOL, - "Scaling pathbias counts to (%u/%u)/%d for guard %s=%s", - guard->circuit_successes, guard->first_hops, + "Scaling pathbias counts to (%u/%u)*(%d/%d) for guard %s=%s", + guard->circuit_successes, guard->first_hops, mult_factor, scale_factor, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); + guard->first_hops *= mult_factor; + guard->circuit_successes *= mult_factor; + guard->first_hops /= scale_factor; guard->circuit_successes /= scale_factor; } diff --git a/src/or/circuitbuild.h b/src/or/circuitbuild.h index 78575af..52f9f79 100644 --- a/src/or/circuitbuild.h +++ b/src/or/circuitbuild.h @@ -53,7 +53,8 @@ const char *build_state_get_exit_nickname(cpath_build_state_t *state); const node_t *choose_good_entry_server(uint8_t purpose, cpath_build_state_t *state); -double pathbias_get_disable_rate(const or_options_t *options); +double pathbias_get_crit_rate(const or_options_t *options); +int pathbias_get_dropguards(const or_options_t *options); #endif diff --git a/src/or/config.c b/src/or/config.c index 75f6193..fffe14c 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -316,9 +316,12 @@ static config_var_t option_vars_[] = { V(PathBiasCircThreshold, INT, "-1"), V(PathBiasNoticeRate, DOUBLE, "-1"), - V(PathBiasDisableRate, DOUBLE, "-1"), + V(PathBiasWarnRate, DOUBLE, "-1"), + V(PathBiasCritRate, DOUBLE, "-1"), V(PathBiasScaleThreshold, INT, "-1"), V(PathBiasScaleFactor, INT, "-1"), + V(PathBiasMultFactor, INT, "-1"), + V(PathBiasDropGuards, BOOL, "0"), OBSOLETE("PathlenCoinWeight"), V(PerConnBWBurst, MEMUNIT, "0"), diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index d9a06a6..faf5269 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1048,8 +1048,9 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) /* Note: We rely on the < comparison here to allow us to set a 0 * rate and disable the feature entirely. If refactoring, don't * change to <= */ - if (node->circuit_successes/((double)node->first_hops) - < pathbias_get_disable_rate(options)) { + if ((node->circuit_successes/((double)node->first_hops) + < pathbias_get_crit_rate(options)) && + pathbias_get_dropguards(options)) { node->path_bias_disabled = 1; log_info(LD_GENERAL, "Path bias is too high (%u/%u); disabling node %s", diff --git a/src/or/or.h b/src/or/or.h index 5920210..cef5201 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3784,9 +3784,12 @@ typedef struct { */ int PathBiasCircThreshold; double PathBiasNoticeRate; - double PathBiasDisableRate; + double PathBiasWarnRate; + double PathBiasCritRate; + int PathBiasDropGuards; int PathBiasScaleThreshold; int PathBiasScaleFactor; + int PathBiasMultFactor; /** @} */ int IPv6Exit; /**< Do we support exiting to IPv6 addresses? */

1 0

[tor/master] Add log message checks for different rates.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit 9bf5582e7368bf91e2b9bf9e88ee71d2ba51a335 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed Oct 24 18:15:41 2012 -0700 Add log message checks for different rates. May want to squash this forward or back.. --- src/or/circuitbuild.c | 17 ++++++++++++++--- src/or/entrynodes.h | 6 +++++- 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 65c6492..3423432 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1408,7 +1408,8 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) * rate and disable the feature entirely. If refactoring, don't * change to <= */ if (guard->circuit_successes/((double)guard->first_hops) - < pathbias_get_crit_rate(options)) { + < pathbias_get_crit_rate(options) + && !guard->path_bias_crited) { /* This message is currently disabled by default. */ log_warn(LD_PROTOCOL, @@ -1417,6 +1418,7 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) "a bug.", guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); + guard->path_bias_crited = 1; if (pathbias_get_dropguards(options)) { guard->path_bias_disabled = 1; @@ -1424,14 +1426,23 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) } return -1; } else if (guard->circuit_successes/((double)guard->first_hops) + < pathbias_get_warn_rate(options) + && !guard->path_bias_warned) { + guard->path_bias_warned = 1; + log_notice(LD_PROTOCOL, + "Low circuit success rate %u/%u for guard %s=%s.", + guard->circuit_successes, guard->first_hops, guard->nickname, + hex_str(guard->identity, DIGEST_LEN)); + } else if (guard->circuit_successes/((double)guard->first_hops) < pathbias_get_notice_rate(options) - && !guard->path_bias_notice) { - guard->path_bias_notice = 1; + && !guard->path_bias_noticed) { + guard->path_bias_noticed = 1; log_notice(LD_PROTOCOL, "Low circuit success rate %u/%u for guard %s=%s.", guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); } + } /* If we get a ton of circuits, just scale everything down */ diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index b347441..6fdb3f7 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -31,7 +31,11 @@ typedef struct entry_guard_t { * router, 1 if we have. */ unsigned int can_retry : 1; /**< Should we retry connecting to this entry, * in spite of having it marked as unreachable?*/ - unsigned int path_bias_notice : 1; /**< Did we alert the user about path bias + unsigned int path_bias_noticed : 1; /**< Did we alert the user about path bias + * for this node already? */ + unsigned int path_bias_warned : 1; /**< Did we alert the user about path bias + * for this node already? */ + unsigned int path_bias_crited : 1; /**< Did we alert the user about path bias * for this node already? */ unsigned int path_bias_disabled : 1; /**< Have we disabled this node because * of path bias issues? */

1 0

[tor/master] Update Path Bias log messages to match Proposal 209.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit ab9c83c949bd415271281f96c04ff598a9a3b7b5 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu Oct 25 13:42:37 2012 -0700 Update Path Bias log messages to match Proposal 209. --- src/or/circuitbuild.c | 51 +++++++++++++++++++++++++++++++++--------------- 1 files changed, 35 insertions(+), 16 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 3423432..6f91fc3 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1410,37 +1410,56 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) if (guard->circuit_successes/((double)guard->first_hops) < pathbias_get_crit_rate(options) && !guard->path_bias_crited) { - - /* This message is currently disabled by default. */ - log_warn(LD_PROTOCOL, - "Extremely low circuit success rate %u/%u for guard %s=%s. " - "This indicates either an overloaded guard, an attack, or " - "a bug.", - guard->circuit_successes, guard->first_hops, guard->nickname, - hex_str(guard->identity, DIGEST_LEN)); guard->path_bias_crited = 1; - + if (pathbias_get_dropguards(options)) { + /* This message is currently disabled by default. */ + log_warn(LD_PROTOCOL, + "Your Guard %s=%s is failing an extremely large amount of " + "circuits. Tor has disabled use of this guard. Success " + "counts are %d/%d, with %d timeouts. For reference, your " + "timeout cutoff is %ld.", + guard->nickname, hex_str(guard->identity, DIGEST_LEN), + guard->circuit_successes, guard->first_hops, guard->timeouts, + (long)circ_times.close_ms/1000); guard->path_bias_disabled = 1; guard->bad_since = approx_time(); + } else { + log_warn(LD_PROTOCOL, + "Your Guard %s=%s is failing an extremely large amount of " + "circuits. Success counts are %d/%d, with %d timeouts. " + "For reference, your timeout cutoff is %ld.", + guard->nickname, hex_str(guard->identity, DIGEST_LEN), + guard->circuit_successes, guard->first_hops, guard->timeouts, + (long)circ_times.close_ms/1000); } return -1; } else if (guard->circuit_successes/((double)guard->first_hops) < pathbias_get_warn_rate(options) && !guard->path_bias_warned) { guard->path_bias_warned = 1; - log_notice(LD_PROTOCOL, - "Low circuit success rate %u/%u for guard %s=%s.", - guard->circuit_successes, guard->first_hops, guard->nickname, - hex_str(guard->identity, DIGEST_LEN)); + log_warn(LD_PROTOCOL, + "Your Guard %s=%s is failing a very large amount of " + "circuits. Most likely this means the Tor network is " + "overloaded, but it could also mean an attack against " + "you or the potentially the guard itself. Success counts " + "are %d/%d, with %d timeouts. For reference, your timeout " + "cutoff is %ld.", + guard->nickname, hex_str(guard->identity, DIGEST_LEN), + guard->circuit_successes, guard->first_hops, guard->timeouts, + (long)circ_times.close_ms/1000); } else if (guard->circuit_successes/((double)guard->first_hops) < pathbias_get_notice_rate(options) && !guard->path_bias_noticed) { guard->path_bias_noticed = 1; log_notice(LD_PROTOCOL, - "Low circuit success rate %u/%u for guard %s=%s.", - guard->circuit_successes, guard->first_hops, guard->nickname, - hex_str(guard->identity, DIGEST_LEN)); + "Your Guard %s=%s is failing more circuits than usual. Most " + "likely this means the Tor network is overloaded. Success " + "counts are %d/%d, with %d timeouts. For reference, your " + "timeout cutoff is %ld.", + guard->nickname, hex_str(guard->identity, DIGEST_LEN), + guard->circuit_successes, guard->first_hops, guard->timeouts, + (long)circ_times.close_ms/1000); } }

1 0

[tor/master] Refactor pathbias functions to use pathbias_should_count.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit a54873648f226fc9b16a3c1c192b0bae6559dbbc Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu Oct 25 14:05:44 2012 -0700 Refactor pathbias functions to use pathbias_should_count. --- src/or/circuitbuild.c | 58 +----------------------------------------------- 1 files changed, 2 insertions(+), 56 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 6f91fc3..299ca29 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1152,34 +1152,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) RATELIM_INIT(FIRST_HOP_NOTICE_INTERVAL); char *rate_msg = NULL; - /* We can't do path bias accounting without entry guards. - * Testing and controller circuits also have no guards. */ - if (get_options()->UseEntryGuards == 0 || - circ->base_.purpose == CIRCUIT_PURPOSE_TESTING || - circ->base_.purpose == CIRCUIT_PURPOSE_CONTROLLER) { - return 0; - } - - /* Completely ignore one hop circuits */ - if (circ->build_state->onehop_tunnel || - circ->build_state->desired_path_len == 1) { - /* Check for inconsistency */ - if (circ->build_state->desired_path_len != 1 || - !circ->build_state->onehop_tunnel) { - if ((rate_msg = rate_limit_log(&first_hop_notice_limit, - approx_time()))) { - log_notice(LD_BUG, - "One-hop circuit has length %d. Path state is %s. " - "Circuit is a %s currently %s.%s", - circ->build_state->desired_path_len, - pathbias_state_to_string(circ->path_state), - circuit_purpose_to_string(circ->base_.purpose), - circuit_state_to_string(circ->base_.state), - rate_msg); - tor_free(rate_msg); - } - tor_fragile_assert(); - } + if (!pathbias_should_count(circ)) { return 0; } @@ -1276,34 +1249,7 @@ pathbias_count_success(origin_circuit_t *circ) char *rate_msg = NULL; entry_guard_t *guard = NULL; - /* We can't do path bias accounting without entry guards. - * Testing and controller circuits also have no guards. */ - if (get_options()->UseEntryGuards == 0 || - circ->base_.purpose == CIRCUIT_PURPOSE_TESTING || - circ->base_.purpose == CIRCUIT_PURPOSE_CONTROLLER) { - return; - } - - /* Ignore one hop circuits */ - if (circ->build_state->onehop_tunnel || - circ->build_state->desired_path_len == 1) { - /* Check for consistency */ - if (circ->build_state->desired_path_len != 1 || - !circ->build_state->onehop_tunnel) { - if ((rate_msg = rate_limit_log(&success_notice_limit, - approx_time()))) { - log_notice(LD_BUG, - "One-hop circuit has length %d. Path state is %s. " - "Circuit is a %s currently %s.%s", - circ->build_state->desired_path_len, - pathbias_state_to_string(circ->path_state), - circuit_purpose_to_string(circ->base_.purpose), - circuit_state_to_string(circ->base_.state), - rate_msg); - tor_free(rate_msg); - } - tor_fragile_assert(); - } + if (!pathbias_should_count(circ)) { return; }

1 0

[tor/master] Update with code review changes from Nick.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit bb548134cd4fd7b4b330cea15111ff257859bba8 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed Oct 31 18:49:49 2012 -0700 Update with code review changes from Nick. --- src/or/circuitbuild.c | 113 ++++++++++++++++++++++++++++++++---------------- src/or/circuitbuild.h | 3 +- src/or/config.c | 3 +- src/or/entrynodes.c | 2 +- src/or/entrynodes.h | 4 +- src/or/or.h | 4 +- 6 files changed, 83 insertions(+), 46 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 4e9a974..feb8e9c 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -994,6 +994,7 @@ pathbias_get_min_circs(const or_options_t *options) 5, INT32_MAX); } +/** The circuit success rate below which we issue a notice */ static double pathbias_get_notice_rate(const or_options_t *options) { @@ -1006,6 +1007,7 @@ pathbias_get_notice_rate(const or_options_t *options) } /* XXXX024 I'd like to have this be static again, but entrynodes.c needs it. */ +/** The circuit success rate below which we issue a warn */ double pathbias_get_warn_rate(const or_options_t *options) { @@ -1018,18 +1020,26 @@ pathbias_get_warn_rate(const or_options_t *options) } /* XXXX024 I'd like to have this be static again, but entrynodes.c needs it. */ +/** + * The extreme rate is the rate at which we would drop the guard, + * if pb_dropguard is also set. Otherwise we just warn. + */ double -pathbias_get_crit_rate(const or_options_t *options) +pathbias_get_extreme_rate(const or_options_t *options) { -#define DFLT_PATH_BIAS_CRIT_PCT 30 - if (options->PathBiasCritRate >= 0.0) - return options->PathBiasCritRate; +#define DFLT_PATH_BIAS_EXTREME_PCT 30 + if (options->PathBiasExtremeRate >= 0.0) + return options->PathBiasExtremeRate; else - return networkstatus_get_param(NULL, "pb_critpct", - DFLT_PATH_BIAS_CRIT_PCT, 0, 100)/100.0; + return networkstatus_get_param(NULL, "pb_extremepct", + DFLT_PATH_BIAS_EXTREME_PCT, 0, 100)/100.0; } /* XXXX024 I'd like to have this be static again, but entrynodes.c needs it. */ +/** + * If 1, we actually disable use of guards that fall below + * the extreme_pct. + */ int pathbias_get_dropguards(const or_options_t *options) { @@ -1041,6 +1051,12 @@ pathbias_get_dropguards(const or_options_t *options) DFLT_PATH_BIAS_DROP_GUARDS, 0, 100)/100.0; } +/** + * This is the number of circuits at which we scale our + * counts by mult_factor/scale_factor. Note, this count is + * not exact, as we only perform the scaling in the event + * of no integer truncation. + */ static int pathbias_get_scale_threshold(const or_options_t *options) { @@ -1053,6 +1069,12 @@ pathbias_get_scale_threshold(const or_options_t *options) INT32_MAX); } +/** + * The scale factor is the denominator for our scaling + * of circuit counts for our path bias window. Note that + * we must be careful of the values we use here, as the + * code only scales in the event of no integer truncation. + */ static int pathbias_get_scale_factor(const or_options_t *options) { @@ -1064,6 +1086,11 @@ pathbias_get_scale_factor(const or_options_t *options) DFLT_PATH_BIAS_SCALE_FACTOR, 1, INT32_MAX); } +/** + * The mult factor is the numerator for our scaling + * of circuit counts for our path bias window. It + * allows us to scale by fractions. + */ static int pathbias_get_mult_factor(const or_options_t *options) { @@ -1076,6 +1103,9 @@ pathbias_get_mult_factor(const or_options_t *options) pathbias_get_scale_factor(options)-1); } +/** + * Convert a Guard's path state to string. + */ static const char * pathbias_state_to_string(path_state_t state) { @@ -1262,7 +1292,7 @@ pathbias_count_success(origin_circuit_t *circ) circ->path_state = PATH_STATE_SUCCEEDED; guard->circuit_successes++; - log_info(LD_PROTOCOL, "Got success count %u/%u for guard %s=%s", + log_info(LD_CIRC, "Got success count %u/%u for guard %s=%s", guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); } else { @@ -1353,26 +1383,29 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) * rate and disable the feature entirely. If refactoring, don't * change to <= */ if (guard->circuit_successes/((double)guard->first_hops) - < pathbias_get_crit_rate(options) - && !guard->path_bias_crited) { - guard->path_bias_crited = 1; - + < pathbias_get_extreme_rate(options)) { + /* Dropping is currently disabled by default. */ if (pathbias_get_dropguards(options)) { - /* This message is currently disabled by default. */ - log_warn(LD_PROTOCOL, + if (!guard->path_bias_disabled) { + log_warn(LD_CIRC, "Your Guard %s=%s is failing an extremely large amount of " - "circuits. Tor has disabled use of this guard. Success " + "circuits. To avoid potential route manipluation attacks, " + "Tor has disabled use of this guard. Success " "counts are %d/%d, with %d timeouts. For reference, your " "timeout cutoff is %ld.", guard->nickname, hex_str(guard->identity, DIGEST_LEN), guard->circuit_successes, guard->first_hops, guard->timeouts, (long)circ_times.close_ms/1000); - guard->path_bias_disabled = 1; - guard->bad_since = approx_time(); - } else { - log_warn(LD_PROTOCOL, + guard->path_bias_disabled = 1; + guard->bad_since = approx_time(); + } + } else if (!guard->path_bias_extreme) { + guard->path_bias_extreme = 1; + log_warn(LD_CIRC, "Your Guard %s=%s is failing an extremely large amount of " - "circuits. Success counts are %d/%d, with %d timeouts. " + "circuits. This could indicate a route manipulation attack, " + "extreme network overload, or a bug. " + "Success counts are %d/%d, with %d timeouts. " "For reference, your timeout cutoff is %ld.", guard->nickname, hex_str(guard->identity, DIGEST_LEN), guard->circuit_successes, guard->first_hops, guard->timeouts, @@ -1380,10 +1413,10 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) } return -1; } else if (guard->circuit_successes/((double)guard->first_hops) - < pathbias_get_warn_rate(options) - && !guard->path_bias_warned) { - guard->path_bias_warned = 1; - log_warn(LD_PROTOCOL, + < pathbias_get_warn_rate(options)) { + if (!guard->path_bias_warned) { + guard->path_bias_warned = 1; + log_warn(LD_CIRC, "Your Guard %s=%s is failing a very large amount of " "circuits. Most likely this means the Tor network is " "overloaded, but it could also mean an attack against " @@ -1393,18 +1426,20 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) guard->nickname, hex_str(guard->identity, DIGEST_LEN), guard->circuit_successes, guard->first_hops, guard->timeouts, (long)circ_times.close_ms/1000); + } } else if (guard->circuit_successes/((double)guard->first_hops) - < pathbias_get_notice_rate(options) - && !guard->path_bias_noticed) { - guard->path_bias_noticed = 1; - log_notice(LD_PROTOCOL, - "Your Guard %s=%s is failing more circuits than usual. Most " - "likely this means the Tor network is overloaded. Success " - "counts are %d/%d, with %d timeouts. For reference, your " - "timeout cutoff is %ld.", - guard->nickname, hex_str(guard->identity, DIGEST_LEN), - guard->circuit_successes, guard->first_hops, guard->timeouts, - (long)circ_times.close_ms/1000); + < pathbias_get_notice_rate(options)) { + if (!guard->path_bias_noticed) { + guard->path_bias_noticed = 1; + log_notice(LD_CIRC, + "Your Guard %s=%s is failing more circuits than usual. " + "Most likely this means the Tor network is overloaded. " + "Success counts are %d/%d, with %d timeouts. For " + "reference, your timeout cutoff is %ld.", + guard->nickname, hex_str(guard->identity, DIGEST_LEN), + guard->circuit_successes, guard->first_hops, + guard->timeouts, (long)circ_times.close_ms/1000); + } } } @@ -1412,24 +1447,26 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) if (guard->first_hops > (unsigned)pathbias_get_scale_threshold(options)) { const int scale_factor = pathbias_get_scale_factor(options); const int mult_factor = pathbias_get_mult_factor(options); - /* For now, only scale if there will be no rounding error... - * XXX024: We want to switch to a real moving average for 0.2.4. */ + /* Only scale if there will be no rounding error for our scaling + * factors */ if (((mult_factor*guard->first_hops) % scale_factor) == 0 && ((mult_factor*guard->circuit_successes) % scale_factor) == 0) { - log_info(LD_PROTOCOL, + log_info(LD_CIRC, "Scaling pathbias counts to (%u/%u)*(%d/%d) for guard %s=%s", guard->circuit_successes, guard->first_hops, mult_factor, scale_factor, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); guard->first_hops *= mult_factor; guard->circuit_successes *= mult_factor; + guard->timeouts *= mult_factor; guard->first_hops /= scale_factor; guard->circuit_successes /= scale_factor; + guard->timeouts /= scale_factor; } } guard->first_hops++; - log_info(LD_PROTOCOL, "Got success count %u/%u for guard %s=%s", + log_info(LD_CIRC, "Got success count %u/%u for guard %s=%s", guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); return 0; diff --git a/src/or/circuitbuild.h b/src/or/circuitbuild.h index 52f9f79..3338c9e 100644 --- a/src/or/circuitbuild.h +++ b/src/or/circuitbuild.h @@ -53,8 +53,9 @@ const char *build_state_get_exit_nickname(cpath_build_state_t *state); const node_t *choose_good_entry_server(uint8_t purpose, cpath_build_state_t *state); -double pathbias_get_crit_rate(const or_options_t *options); +double pathbias_get_extreme_rate(const or_options_t *options); int pathbias_get_dropguards(const or_options_t *options); +void pathbias_count_timeout(origin_circuit_t *circ); #endif diff --git a/src/or/config.c b/src/or/config.c index fffe14c..fb95642 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -314,10 +314,11 @@ static config_var_t option_vars_[] = { VPORT(ORPort, LINELIST, NULL), V(OutboundBindAddress, LINELIST, NULL), + OBSOLETE("PathBiasDisableRate"), V(PathBiasCircThreshold, INT, "-1"), V(PathBiasNoticeRate, DOUBLE, "-1"), V(PathBiasWarnRate, DOUBLE, "-1"), - V(PathBiasCritRate, DOUBLE, "-1"), + V(PathBiasExtremeRate, DOUBLE, "-1"), V(PathBiasScaleThreshold, INT, "-1"), V(PathBiasScaleFactor, INT, "-1"), V(PathBiasMultFactor, INT, "-1"), diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index faf5269..317a088 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1049,7 +1049,7 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) * rate and disable the feature entirely. If refactoring, don't * change to <= */ if ((node->circuit_successes/((double)node->first_hops) - < pathbias_get_crit_rate(options)) && + < pathbias_get_extreme_rate(options)) && pathbias_get_dropguards(options)) { node->path_bias_disabled = 1; log_info(LD_GENERAL, diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index dfabacb..f087f90 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -35,8 +35,8 @@ typedef struct entry_guard_t { * bias for this node already? */ unsigned int path_bias_warned : 1; /**< Did we alert the user about path bias * for this node already? */ - unsigned int path_bias_crited : 1; /**< Did we alert the user about path bias - * for this node already? */ + unsigned int path_bias_extreme : 1; /**< Did we alert the user about path + * bias for this node already? */ unsigned int path_bias_disabled : 1; /**< Have we disabled this node because * of path bias issues? */ time_t bad_since; /**< 0 if this guard is currently usable, or the time at diff --git a/src/or/or.h b/src/or/or.h index cef5201..a5e96b2 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3785,7 +3785,7 @@ typedef struct { int PathBiasCircThreshold; double PathBiasNoticeRate; double PathBiasWarnRate; - double PathBiasCritRate; + double PathBiasExtremeRate; int PathBiasDropGuards; int PathBiasScaleThreshold; int PathBiasScaleFactor; @@ -4070,8 +4070,6 @@ typedef struct { double close_ms; } circuit_build_times_t; -void pathbias_count_timeout(origin_circuit_t *circ); - /********************************* config.c ***************************/ /** An error from options_trial_assign() or options_init_from_string(). */

1 0

[tor/master] Fix spaces.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit 192996690cd7bc3ae6c159901a3a9a6232e74514 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu Oct 25 14:14:28 2012 -0700 Fix spaces. --- src/or/circuitbuild.c | 6 ++---- src/or/entrynodes.h | 7 +++---- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 299ca29..4e9a974 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1137,7 +1137,6 @@ pathbias_should_count(origin_circuit_t *circ) return 1; } - /** * Check our circuit state to see if this is a successful first hop. * If so, record it in the current guard's path bias first_hop count. @@ -1326,7 +1325,7 @@ pathbias_count_success(origin_circuit_t *circ) void pathbias_count_timeout(origin_circuit_t *circ) { - if(!pathbias_should_count(circ)) { + if (!pathbias_should_count(circ)) { return; } entry_guard_t *guard = @@ -1357,7 +1356,7 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) < pathbias_get_crit_rate(options) && !guard->path_bias_crited) { guard->path_bias_crited = 1; - + if (pathbias_get_dropguards(options)) { /* This message is currently disabled by default. */ log_warn(LD_PROTOCOL, @@ -1407,7 +1406,6 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) guard->circuit_successes, guard->first_hops, guard->timeouts, (long)circ_times.close_ms/1000); } - } /* If we get a ton of circuits, just scale everything down */ diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index 6fdb3f7..dfabacb 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -31,8 +31,8 @@ typedef struct entry_guard_t { * router, 1 if we have. */ unsigned int can_retry : 1; /**< Should we retry connecting to this entry, * in spite of having it marked as unreachable?*/ - unsigned int path_bias_noticed : 1; /**< Did we alert the user about path bias - * for this node already? */ + unsigned int path_bias_noticed : 1; /**< Did we alert the user about path + * bias for this node already? */ unsigned int path_bias_warned : 1; /**< Did we alert the user about path bias * for this node already? */ unsigned int path_bias_crited : 1; /**< Did we alert the user about path bias @@ -51,8 +51,7 @@ typedef struct entry_guard_t { unsigned first_hops; /**< Number of first hops this guard has completed */ unsigned circuit_successes; /**< Number of successfully built circuits using * this guard as first hop. */ - unsigned timeouts; /**< Number of 'right-censored' timeouts - for this guard. */ + unsigned timeouts; /**< Number of 'right-censored' timeouts for this guard.*/ } entry_guard_t; entry_guard_t *entry_guard_get_by_id_digest(const char *digest);

1 0

[tor/master] Update manpage for new PathBias torrc options.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit df4aeaa0d63ecf8f282f54c8178cf48fee10bad0 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed Oct 31 18:50:45 2012 -0700 Update manpage for new PathBias torrc options. --- doc/tor.1.txt | 29 +++++++++++++++++++---------- 1 files changed, 19 insertions(+), 10 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index d268717..734bc64 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1173,28 +1173,37 @@ The following options are useful only for clients (that is, if **PathBiasNoticeRate** __NUM__ + -**PathBiasDisableRate** __NUM__ + +**PathBiasWarnRate** __NUM__ + + +**PathBiasExtremeRate** __NUM__ + + +**PathBiasDropGuards** __NUM__ + **PathBiasScaleThreshold** __NUM__ + +**PathBiasMultFactor** __NUM__ + + **PathBiasScaleFactor** __NUM__:: These options override the default behavior of Tor's (**currently experimental**) path bias detection algorithm. To try to find broken or misbehaving guard nodes, Tor looks for nodes where more than a certain fraction of circuits through that node fail after the first hop. The PathBiasCircThreshold option controls how many circuits we need to build - through a guard before we make these checks. The PathBiasNoticeRate and - PathBiasDisableRate options control what fraction of circuits must - succeed through a guard so we won't warn about it or disable it, - respectively. When we have seen more than PathBiasScaleThreshold - circuits through a guard, we divide our observations by - PathBiasScaleFactor, so that new observations don't get swamped by old - ones. + + through a guard before we make these checks. The PathBiasNoticeRate, + PathBiasWarnRate and PathBiasExtremeRate options control what fraction of + circuits must succeed through a guard so we won't write log messages. + If less than PathBiasExtremeRate circuits succeed *and* PathBiasDropGuards + is set to 1, we disable use of that guard. + + + + When we have seen more than PathBiasScaleThreshold + circuits through a guard, we scale our observations by + PathBiasMultFactor/PathBiasScaleFactor, so that new observations don't get + swamped by old ones. + + By default, or if a negative value is provided for one of these options, Tor uses reasonable defaults from the networkstatus consensus document. - If no defaults are available there, these options default to 20, .70, - 0.0, 200, and 4 respectively. + If no defaults are available there, these options default to 150, .70, + .50, .30, 0, 300, 1, and 2 respectively. **ClientUseIPv6** **0**|**1**:: If this option is set to 1, Tor might connect to entry nodes over

1 0

[tor/master] Add a changes file for bug7157.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit f215d1910517ad3d6bb0b7ba5280f9fa1a59c297 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed Oct 31 18:51:07 2012 -0700 Add a changes file for bug7157. --- changes/bug7157 | 15 +++++++++++++++ 1 files changed, 15 insertions(+), 0 deletions(-) diff --git a/changes/bug7157 b/changes/bug7157 new file mode 100644 index 0000000..fad3977 --- /dev/null +++ b/changes/bug7157 @@ -0,0 +1,15 @@ + + o Minor features: + - Alter the Path Bias log messages to be more descriptive in terms + of reporting timeouts and other statistics. + - Create three levels of Path Bias log messages, as opposed to just + two. These are configurable via consensus as well as via torrc + options PathBiasNoticeRate, PathBiasWarnRate, PathBiasExtremeRate. + The default values are 0.70, 0.50, and 0.30 respectively. + - Separate the log message levels from the decision to drop guards, + which also is available via torrc option PathBiasDropGuards. + PathBiasDropGuards defaults to 0 (off). + - Deprecate PathBiasDisableRate in favor of PathBiasDropGuards + in combination with PathBiasExtremeRate. + - Increase the default values for PathBiasScaleThreshold and + PathBiasCircThreshold from 200 and 20 to 300 and 150, respectively.

1 0