March 2013 - tor-commits - lists.torproject.org

[tor/maint-0.2.4] Merge branch 'bug7350_redux' into maint-0.2.4
by nickm＠torproject.org 19 Mar '13

19 Mar '13

commit f1caa2f2146ac750962e6506fe672b03749c50f9 Merge: 323cb65 ca50fb4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 19 16:43:00 2013 -0400 Merge branch 'bug7350_redux' into maint-0.2.4 changes/bug7350 | 4 ++++ src/or/channel.c | 24 ++++++++++++++++++++++++ 2 files changed, 28 insertions(+), 0 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'public/bug7164_diagnostic' into maint-0.2.4
by nickm＠torproject.org 19 Mar '13

19 Mar '13

commit 323cb655be7802a3f527bfa4278478d9fbd23944 Merge: 6f20a74 adfc3de Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 19 16:16:48 2013 -0400 Merge remote-tracking branch 'public/bug7164_diagnostic' into maint-0.2.4 changes/bug7164_diagnostic | 4 ++++ src/or/microdesc.c | 20 +++++++++++--------- src/or/microdesc.h | 4 +++- 3 files changed, 18 insertions(+), 10 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.4'
by nickm＠torproject.org 19 Mar '13

19 Mar '13

commit 96e8e30ee3ea805b933af63459656644f2c60911 Merge: c547502 323cb65 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 19 16:17:42 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' changes/bug7164_diagnostic | 4 ++++ src/or/microdesc.c | 20 +++++++++++--------- src/or/microdesc.h | 4 +++- 3 files changed, 18 insertions(+), 10 deletions(-)

1 0

[tor/master] Log fname:lineno in log messages for #7164
by nickm＠torproject.org 19 Mar '13

19 Mar '13

commit adfc3de83308982f91c88e1e6c68dc37d2467746 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 13 10:42:58 2013 -0400 Log fname:lineno in log messages for #7164 This should help us track down #7164 at last. --- changes/bug7164_diagnostic | 4 ++++ src/or/microdesc.c | 20 +++++++++++--------- src/or/microdesc.h | 4 +++- 3 files changed, 18 insertions(+), 10 deletions(-) diff --git a/changes/bug7164_diagnostic b/changes/bug7164_diagnostic new file mode 100644 index 0000000..8bedfc4 --- /dev/null +++ b/changes/bug7164_diagnostic @@ -0,0 +1,4 @@ + o Minor features (bug diagnostic): + - If we fail to free a microdescriptor because of bug #7164, log + the filename and line number from which we tried to free it. + This should help us finally fix #7164. diff --git a/src/or/microdesc.c b/src/or/microdesc.c index ac48930..e835f98 100644 --- a/src/or/microdesc.c +++ b/src/or/microdesc.c @@ -532,7 +532,7 @@ microdesc_check_counts(void) /** Deallocate a single microdescriptor. Note: the microdescriptor MUST have * previously been removed from the cache if it had ever been inserted. */ void -microdesc_free(microdesc_t *md) +microdesc_free_(microdesc_t *md, const char *fname, int lineno) { if (!md) return; @@ -543,12 +543,12 @@ microdesc_free(microdesc_t *md) microdesc_cache_t *cache = get_microdesc_cache(); microdesc_t *md2 = HT_FIND(microdesc_map, &cache->map, md); if (md2 == md) { - log_warn(LD_BUG, "microdesc_free() called, but md was still in " - "microdesc_map"); + log_warn(LD_BUG, "microdesc_free() called from %s:%d, but md was still " + "in microdesc_map", fname, lineno); HT_REMOVE(microdesc_map, &cache->map, md); } else { - log_warn(LD_BUG, "microdesc_free() called with held_in_map set, but " - "microdesc was not in the map."); + log_warn(LD_BUG, "microdesc_free() called from %s:%d with held_in_map " + "set, but microdesc was not in the map.", fname, lineno); } tor_fragile_assert(); } @@ -562,11 +562,13 @@ microdesc_free(microdesc_t *md) } }); if (found) { - log_warn(LD_BUG, "microdesc_free() called, but md was still referenced " - "%d node(s); held_by_nodes == %u", found, md->held_by_nodes); + log_warn(LD_BUG, "microdesc_free() called from %s:%d, but md was still " + "referenced %d node(s); held_by_nodes == %u", + fname, lineno, found, md->held_by_nodes); } else { - log_warn(LD_BUG, "microdesc_free() called with held_by_nodes set to %u, " - "but md was not referenced by any nodes", md->held_by_nodes); + log_warn(LD_BUG, "microdesc_free() called from %s:%d with held_by_nodes " + "set to %u, but md was not referenced by any nodes", + fname, lineno, md->held_by_nodes); } tor_fragile_assert(); } diff --git a/src/or/microdesc.h b/src/or/microdesc.h index 4e58aa3..7adb8c6 100644 --- a/src/or/microdesc.h +++ b/src/or/microdesc.h @@ -39,7 +39,9 @@ smartlist_t *microdesc_list_missing_digest256(networkstatus_t *ns, int downloadable_only, digestmap_t *skip); -void microdesc_free(microdesc_t *md); +void microdesc_free_(microdesc_t *md, const char *fname, int line); +#define microdesc_free(md) \ + microdesc_free_((md), __FILE__, __LINE__) void microdesc_free_all(void); void update_microdesc_downloads(time_t now);

1 0

[tor/maint-0.2.4] Merge remote-tracking branch 'public/bug7164_diagnostic' into maint-0.2.4
by nickm＠torproject.org 19 Mar '13

19 Mar '13

commit 323cb655be7802a3f527bfa4278478d9fbd23944 Merge: 6f20a74 adfc3de Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 19 16:16:48 2013 -0400 Merge remote-tracking branch 'public/bug7164_diagnostic' into maint-0.2.4 changes/bug7164_diagnostic | 4 ++++ src/or/microdesc.c | 20 +++++++++++--------- src/or/microdesc.h | 4 +++- 3 files changed, 18 insertions(+), 10 deletions(-)

1 0

[tor/maint-0.2.4] Log fname:lineno in log messages for #7164
by nickm＠torproject.org 19 Mar '13

19 Mar '13

commit adfc3de83308982f91c88e1e6c68dc37d2467746 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 13 10:42:58 2013 -0400 Log fname:lineno in log messages for #7164 This should help us track down #7164 at last. --- changes/bug7164_diagnostic | 4 ++++ src/or/microdesc.c | 20 +++++++++++--------- src/or/microdesc.h | 4 +++- 3 files changed, 18 insertions(+), 10 deletions(-) diff --git a/changes/bug7164_diagnostic b/changes/bug7164_diagnostic new file mode 100644 index 0000000..8bedfc4 --- /dev/null +++ b/changes/bug7164_diagnostic @@ -0,0 +1,4 @@ + o Minor features (bug diagnostic): + - If we fail to free a microdescriptor because of bug #7164, log + the filename and line number from which we tried to free it. + This should help us finally fix #7164. diff --git a/src/or/microdesc.c b/src/or/microdesc.c index ac48930..e835f98 100644 --- a/src/or/microdesc.c +++ b/src/or/microdesc.c @@ -532,7 +532,7 @@ microdesc_check_counts(void) /** Deallocate a single microdescriptor. Note: the microdescriptor MUST have * previously been removed from the cache if it had ever been inserted. */ void -microdesc_free(microdesc_t *md) +microdesc_free_(microdesc_t *md, const char *fname, int lineno) { if (!md) return; @@ -543,12 +543,12 @@ microdesc_free(microdesc_t *md) microdesc_cache_t *cache = get_microdesc_cache(); microdesc_t *md2 = HT_FIND(microdesc_map, &cache->map, md); if (md2 == md) { - log_warn(LD_BUG, "microdesc_free() called, but md was still in " - "microdesc_map"); + log_warn(LD_BUG, "microdesc_free() called from %s:%d, but md was still " + "in microdesc_map", fname, lineno); HT_REMOVE(microdesc_map, &cache->map, md); } else { - log_warn(LD_BUG, "microdesc_free() called with held_in_map set, but " - "microdesc was not in the map."); + log_warn(LD_BUG, "microdesc_free() called from %s:%d with held_in_map " + "set, but microdesc was not in the map.", fname, lineno); } tor_fragile_assert(); } @@ -562,11 +562,13 @@ microdesc_free(microdesc_t *md) } }); if (found) { - log_warn(LD_BUG, "microdesc_free() called, but md was still referenced " - "%d node(s); held_by_nodes == %u", found, md->held_by_nodes); + log_warn(LD_BUG, "microdesc_free() called from %s:%d, but md was still " + "referenced %d node(s); held_by_nodes == %u", + fname, lineno, found, md->held_by_nodes); } else { - log_warn(LD_BUG, "microdesc_free() called with held_by_nodes set to %u, " - "but md was not referenced by any nodes", md->held_by_nodes); + log_warn(LD_BUG, "microdesc_free() called from %s:%d with held_by_nodes " + "set to %u, but md was not referenced by any nodes", + fname, lineno, md->held_by_nodes); } tor_fragile_assert(); } diff --git a/src/or/microdesc.h b/src/or/microdesc.h index 4e58aa3..7adb8c6 100644 --- a/src/or/microdesc.h +++ b/src/or/microdesc.h @@ -39,7 +39,9 @@ smartlist_t *microdesc_list_missing_digest256(networkstatus_t *ns, int downloadable_only, digestmap_t *skip); -void microdesc_free(microdesc_t *md); +void microdesc_free_(microdesc_t *md, const char *fname, int line); +#define microdesc_free(md) \ + microdesc_free_((md), __FILE__, __LINE__) void microdesc_free_all(void); void update_microdesc_downloads(time_t now);

1 0

[tor/master] Document the GuardLifetime option
by nickm＠torproject.org 19 Mar '13

19 Mar '13

commit aa040619d5d584d3dc1639b656f8ab6a619abe56 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 11 21:25:37 2013 -0400 Document the GuardLifetime option --- doc/tor.1.txt | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 5cf5a71..5639ad2 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -959,7 +959,7 @@ The following options are useful only for clients (that is, if If UseEntryGuards is set to 1, we will try to pick a total of NUM routers as long-term entries for our circuits. (Default: 3) -**HeartbeatPeriod** __N__ **days**|**weeks**|**months**:: +**GuardLifetime** __N__ **days**|**weeks**|**months**:: If nonzero, and UseEntryGuards is set, minimum time to keep a guard before picking a new one. If zero, we use the GuardLifetime parameter from the consensus directory. No value here may be less than 2 months or greater

1 0

[tor/master] Make the guard lifetime configurable and adjustable via the consensus
by nickm＠torproject.org 19 Mar '13

19 Mar '13

commit 343f7aa05967df43c3f7e5b392b66e21c08b7cb1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 15 17:24:13 2013 -0500 Make the guard lifetime configurable and adjustable via the consensus Fixes 8240. (Don't actually increase the default guard lifetime. It seems likely to break too many things if done precipitiously.) --- changes/ticket8240 | 4 ++++ doc/tor.1.txt | 6 ++++++ src/common/util.h | 11 +++++++++++ src/or/circuitbuild.c | 36 ++++++++++++++++++++++++++++++++---- src/or/config.c | 1 + src/or/or.h | 3 +++ 6 files changed, 57 insertions(+), 4 deletions(-) diff --git a/changes/ticket8240 b/changes/ticket8240 new file mode 100644 index 0000000..91e6f8c --- /dev/null +++ b/changes/ticket8240 @@ -0,0 +1,4 @@ + o Major security fixes: + - Make the default guard lifetime controllable via a new + GuardLifetime torrc option and a GuardLifetime consensus + parameter. Start of a fix for bug 8240; bugfix on 0.1.1.11-alpha. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 773fccf..5cf5a71 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -959,6 +959,12 @@ The following options are useful only for clients (that is, if If UseEntryGuards is set to 1, we will try to pick a total of NUM routers as long-term entries for our circuits. (Default: 3) +**HeartbeatPeriod** __N__ **days**|**weeks**|**months**:: + If nonzero, and UseEntryGuards is set, minimum time to keep a guard before + picking a new one. If zero, we use the GuardLifetime parameter from the + consensus directory. No value here may be less than 2 months or greater + than 5 years; out-of-range values are clamped. (Default: 0) + **SafeSocks** **0**|**1**:: When this option is enabled, Tor will reject application connections that use unsafe variants of the socks protocol -- ones that only provide an IP diff --git a/src/common/util.h b/src/common/util.h index 8977d27..4642e40 100644 --- a/src/common/util.h +++ b/src/common/util.h @@ -173,6 +173,17 @@ int n_bits_set_u8(uint8_t v); * overflow. */ #define CEIL_DIV(a,b) (((a)+(b)-1)/(b)) +/* Return v if it's between min and max. Otherwise + * return min if v is smaller than min, or max if + * b is larger than max. + * + * Requires that min is no more than max. May evaluate any of + * its arguments more than once! */ +#define CLAMP(min,v,max) \ + ( ((v) < (min)) ? (min) : \ + ((v) > (max)) ? (max) : \ + (v) ) + /* String manipulation */ /** Allowable characters in a hexadecimal string. */ diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index f8521c5..f07d428 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -4203,6 +4203,9 @@ control_event_guard_deferred(void) #endif } +/** Largest amount that we'll backdate chosen_on_date */ +#define CHOSEN_ON_DATE_SLOP (30*86400) + /** Add a new (preferably stable and fast) router to our * entry_guards list. Return a pointer to the router if we succeed, * or NULL if we can't find any more suitable entries. @@ -4241,7 +4244,7 @@ add_an_entry_guard(const node_t *chosen, int reset_status, int prepend) * don't all select them on the same day, and b) avoid leaving a * precise timestamp in the state file about when we first picked * this guard. For details, see the Jan 2010 or-dev thread. */ - entry->chosen_on_date = time(NULL) - crypto_rand_int(3600*24*30); + entry->chosen_on_date = time(NULL) - crypto_rand_int(CHOSEN_ON_DATE_SLOP); entry->chosen_by_version = tor_strdup(VERSION); if (prepend) smartlist_insert(entry_guards, 0, entry); @@ -4285,15 +4288,40 @@ entry_guard_free(entry_guard_t *e) tor_free(e); } +/** + * Return the minimum lifetime of working entry guard, in seconds, + * as given in the consensus networkstatus. + */ +static int32_t +guards_get_lifetime(void) +{ + const or_options_t *options = get_options(); +#define DFLT_GUARD_LIFETIME (86400 * 60) /* Two months. */ +#define MIN_GUARD_LIFETIME (86400 * 60) /* Two months. */ +#define MAX_GUARD_LIFETIME (86400 * 1826) /* Five years. */ + + if (options->GuardLifetime >= 1) { + return CLAMP(MIN_GUARD_LIFETIME, + options->GuardLifetime, + MAX_GUARD_LIFETIME) + CHOSEN_ON_DATE_SLOP; + } + + return networkstatus_get_param(NULL, "GuardLifetime", + DFLT_GUARD_LIFETIME, + MIN_GUARD_LIFETIME, + MAX_GUARD_LIFETIME) + CHOSEN_ON_DATE_SLOP; +} + /** Remove any entry guard which was selected by an unknown version of Tor, * or which was selected by a version of Tor that's known to select - * entry guards badly, or which was selected more 2 months ago. */ + * entry guards badly, or which was selected a long time ago */ /* XXXX The "obsolete guards" and "chosen long ago guards" things should * probably be different functions. */ static int remove_obsolete_entry_guards(time_t now) { int changed = 0, i; + int32_t guard_lifetime = guards_get_lifetime(); for (i = 0; i < smartlist_len(entry_guards); ++i) { entry_guard_t *entry = smartlist_get(entry_guards, i); @@ -4324,8 +4352,8 @@ remove_obsolete_entry_guards(time_t now) } tor_free(tor_ver); } - if (!version_is_bad && entry->chosen_on_date + 3600*24*60 < now) { - /* It's been 2 months since the date listed in our state file. */ + if (!version_is_bad && entry->chosen_on_date + guard_lifetime < now) { + /* It's been too long since the date listed in our state file. */ msg = "was selected several months ago"; date_is_bad = 1; } diff --git a/src/or/config.c b/src/or/config.c index 90a5dfb..6ccd65a 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -302,6 +302,7 @@ static config_var_t _option_vars[] = { #endif OBSOLETE("GiveGuardFlagTo_CVE_2011_2768_VulnerableRelays"), OBSOLETE("Group"), + V(GuardLifetime, INTERVAL, "0 minutes"), V(HardwareAccel, BOOL, "0"), V(HeartbeatPeriod, INTERVAL, "6 hours"), V(AccelName, STRING, NULL), diff --git a/src/or/or.h b/src/or/or.h index 51c23d3..b54834d 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3605,6 +3605,9 @@ typedef struct { int PathBiasScaleFactor; /** @} */ + /** How long (seconds) do we keep a guard before picking a new one? */ + int GuardLifetime; + } or_options_t; /** Persistent state for an onion router, as saved to disk. */

1 0

[tor/master] Drop the minimum guard lifetime back down to one month
by nickm＠torproject.org 19 Mar '13

19 Mar '13

commit 18752bca5b57c11b6d843db671e1886ed0624848 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 11 22:16:25 2013 -0400 Drop the minimum guard lifetime back down to one month Mike believes that raising the default to 2 months with no way to lower it may create horrible load-balancing issues. --- doc/tor.1.txt | 2 +- src/or/circuitbuild.c | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 5639ad2..0c13a5c 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -962,7 +962,7 @@ The following options are useful only for clients (that is, if **GuardLifetime** __N__ **days**|**weeks**|**months**:: If nonzero, and UseEntryGuards is set, minimum time to keep a guard before picking a new one. If zero, we use the GuardLifetime parameter from the - consensus directory. No value here may be less than 2 months or greater + consensus directory. No value here may be less than 1 month or greater than 5 years; out-of-range values are clamped. (Default: 0) **SafeSocks** **0**|**1**:: diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index f07d428..d3a29fd 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -4290,13 +4290,15 @@ entry_guard_free(entry_guard_t *e) /** * Return the minimum lifetime of working entry guard, in seconds, - * as given in the consensus networkstatus. + * as given in the consensus networkstatus. (Plus CHOSEN_ON_DATE_SLOP, + * so that we can do the chosen_on_date randomization while achieving the + * desired minimum lifetime.) */ static int32_t guards_get_lifetime(void) { const or_options_t *options = get_options(); -#define DFLT_GUARD_LIFETIME (86400 * 60) /* Two months. */ +#define DFLT_GUARD_LIFETIME (86400 * 30) /* One month. */ #define MIN_GUARD_LIFETIME (86400 * 60) /* Two months. */ #define MAX_GUARD_LIFETIME (86400 * 1826) /* Five years. */

1 0

[tor/master] Add support for days of the week to intervals
by nickm＠torproject.org 19 Mar '13

19 Mar '13

commit cf734a08f60f141ce2c21c703a403aeb74017b1f Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 11 21:35:50 2013 -0400 Add support for days of the week to intervals --- src/or/config.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index 6ccd65a..adbd367 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -6534,6 +6534,8 @@ static struct unit_table_t time_units[] = { { "days", 24*60*60 }, { "week", 7*24*60*60 }, { "weeks", 7*24*60*60 }, + { "months", 2629728, }, /* about 30.437 days */ + { "months", 2629728, }, { NULL, 0 }, };

1 0