March 2013 - tor-commits - lists.torproject.org

[tor/maint-0.2.4] Merge remote-tracking branch 'public/bug8290' into maint-0.2.4
by nickm＠torproject.org 18 Mar '13

18 Mar '13

commit 7e9b6a19d4cdc605039f4e0107cbd5f4781fe150 Merge: 26639b7 4740d2e Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 18 15:07:02 2013 -0400 Merge remote-tracking branch 'public/bug8290' into maint-0.2.4 changes/bug8290 | 9 +++++++++ contrib/include.am | 3 --- contrib/tor-tsocks.conf | 13 ------------- doc/tor.1.txt | 2 +- doc/torify.1.txt | 18 +++--------------- 5 files changed, 13 insertions(+), 32 deletions(-)

1 0

[tor/maint-0.2.4] Remove some lingering tsocks cruft.
by nickm＠torproject.org 18 Mar '13

18 Mar '13

commit 4740d2e8bcf72cc92bae72762ccae904015b9b2f Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 27 19:38:32 2013 -0500 Remove some lingering tsocks cruft. Now the manpages no longer refer to tsocks or tsocks.conf, and we no longer have or ship a tor-tsocks.conf. The only remaining instances of "tsocks" in our repository are old ChangeLog and ReleaseNotes entries, and the torify script saying that it doesn't support tsocks. Fixes bug 8290. --- changes/bug8290 | 9 +++++++++ contrib/include.am | 3 --- contrib/tor-tsocks.conf | 13 ------------- doc/tor.1.txt | 2 +- doc/torify.1.txt | 18 +++--------------- 5 files changed, 13 insertions(+), 32 deletions(-) diff --git a/changes/bug8290 b/changes/bug8290 new file mode 100644 index 0000000..d1fce7d --- /dev/null +++ b/changes/bug8290 @@ -0,0 +1,9 @@ + o Removed files: + - The tor-tsocks.conf is no longer distributed or installed. We + recommend that tsocks users use torsocks instead. Resolves + ticket 8290. + + o Documentation fixes: + - The torify manpage no longer refers to tsocks; torify hasn't + supported tsocks since 0.2.3.14-alpha. + - The manpages no longer reference tsocks. diff --git a/contrib/include.am b/contrib/include.am index 4a995a3..6d7fb16 100644 --- a/contrib/include.am +++ b/contrib/include.am @@ -9,12 +9,9 @@ EXTRA_DIST+= \ contrib/tor-ctrl.sh \ contrib/tor-exit-notice.html \ contrib/tor-mingw.nsi.in \ - contrib/tor-tsocks.conf \ contrib/tor.ico \ contrib/tor.nsi.in \ contrib/tor.sh \ contrib/torctl -conf_DATA+= contrib/tor-tsocks.conf - bin_SCRIPTS+= contrib/torify diff --git a/contrib/tor-tsocks.conf b/contrib/tor-tsocks.conf deleted file mode 100644 index 3dddadd..0000000 --- a/contrib/tor-tsocks.conf +++ /dev/null @@ -1,13 +0,0 @@ -# This is the configuration for libtsocks (transparent socks) for use -# with tor, which is providing a socks server on port 9050 by default. -# -# See tsocks.conf(5) and torify(1) manpages. - -server = 127.0.0.1 -server_port = 9050 - -# We specify local as 127.0.0.0 - 127.191.255.255 because the -# Tor MAPADDRESS virtual IP range is the rest of net 127. -local = 127.0.0.0/255.128.0.0 -local = 127.128.0.0/255.192.0.0 - diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 75bca79..b598a54 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2134,7 +2134,7 @@ __HiddenServiceDirectory__**/client_keys**:: SEE ALSO -------- -**privoxy**(1), **tsocks**(1), **torify**(1) + +**privoxy**(1), **torsocks**(1), **torify**(1) + **https://www.torproject.org/** diff --git a/doc/torify.1.txt b/doc/torify.1.txt index 22b3fe5..8dca901 100644 --- a/doc/torify.1.txt +++ b/doc/torify.1.txt @@ -9,7 +9,7 @@ torify(1) NAME ---- -torify - wrapper for torsocks or tsocks and tor +torify - wrapper for torsocks and tor SYNOPSIS -------- @@ -18,36 +18,24 @@ SYNOPSIS DESCRIPTION ----------- **torify** is a simple wrapper that attempts to find the best underlying Tor -wrapper available on a system. It calls torsocks or tsocks with a tor specific +wrapper available on a system. It calls torsocks with a tor specific configuration file. + torsocks is an improved wrapper that explicitly rejects UDP, safely resolves DNS lookups and properly socksifies your TCP connections. + -tsocks itself is a wrapper between the tsocks library and the application that -you would like to run socksified. + - Please note that since both method use LD_PRELOAD, torify cannot be applied to suid binaries. WARNING ------- -You should also be aware that the way tsocks currently works only TCP -connections are socksified. Be aware that this will in most circumstances not -include hostname lookups which would still be routed through your normal system -resolver to your usual resolving nameservers. The **tor-resolve**(1) tool can be -useful as a workaround in some cases. The Tor FAQ at -https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ might have further -information on this subject. + - When used with torsocks, torify should not leak DNS requests or UDP data. + Both will leak ICMP data. SEE ALSO -------- -**tor**(1), **tor-resolve**(1), **torsocks**(1), **tsocks**(1), -**tsocks.conf**(5). +**tor**(1), **tor-resolve**(1), **torsocks**(1) AUTHORS -------

1 0

[tor/master] Add some code to bluntly prevent duplicate guards from getting added
by nickm＠torproject.org 18 Mar '13

18 Mar '13

commit 91027218e29090b18d42e1868367cc2a9e149900 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 14 11:48:47 2013 -0500 Add some code to bluntly prevent duplicate guards from getting added Apparently something in the directory guard code made it possible for the same node to get added as a guard over and over when there were no actual running guard nodes. --- src/or/entrynodes.c | 29 +++++++++++++++++++++++++++++ src/or/or.h | 3 +++ 2 files changed, 32 insertions(+), 0 deletions(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 4ca56cb..3e471ed 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -369,6 +369,15 @@ add_an_entry_guard(const node_t *chosen, int reset_status, int prepend, if (!node) return NULL; } + if (node->using_as_guard) + return NULL; + if (entry_guard_get_by_id_digest(node->identity) != NULL) { + log_info(LD_CIRC, "I was about to add a duplicate entry guard."); + /* This can happen if we choose a guard, then the node goes away, then + * comes back. */ + ((node_t*) node)->using_as_guard = 1; + return NULL; + } entry = tor_malloc_zero(sizeof(entry_guard_t)); log_info(LD_CIRC, "Chose %s as new entry guard.", node_describe(node)); @@ -384,6 +393,7 @@ add_an_entry_guard(const node_t *chosen, int reset_status, int prepend, * this guard. For details, see the Jan 2010 or-dev thread. */ entry->chosen_on_date = time(NULL) - crypto_rand_int(3600*24*30); entry->chosen_by_version = tor_strdup(VERSION); + ((node_t*)node)->using_as_guard = 1; if (prepend) smartlist_insert(entry_guards, 0, entry); else @@ -723,6 +733,21 @@ entry_nodes_should_be_added(void) should_add_entry_nodes = 1; } +/** Update the using_as_guard fields of all the nodes. We do this after we + * remove entry guards from the list: This is the only function that clears + * the using_as_guard field. */ +static void +update_node_guard_status(void) +{ + smartlist_t *nodes = nodelist_get_list(); + SMARTLIST_FOREACH(nodes, node_t *, node, node->using_as_guard = 0); + SMARTLIST_FOREACH_BEGIN(entry_guards, entry_guard_t *, entry) { + node_t *node = node_get_mutable_by_id(entry->identity); + if (node) + node->using_as_guard = 1; + } SMARTLIST_FOREACH_END(entry); +} + /** Adjust the entry guards list so that it only contains entries from * EntryNodes, adding new entries from EntryNodes to the list as needed. */ static void @@ -807,6 +832,8 @@ entry_guards_set_from_config(const or_options_t *options) SMARTLIST_FOREACH(old_entry_guards_not_on_list, entry_guard_t *, e, entry_guard_free(e)); + update_node_guard_status(); + smartlist_free(entry_nodes); smartlist_free(worse_entry_nodes); smartlist_free(entry_fps); @@ -1231,6 +1258,8 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) * few lines, so we don't have to re-dirty it */ if (remove_obsolete_entry_guards(now)) entry_guards_dirty = 1; + + update_node_guard_status(); } digestmap_free(added_by, tor_free_); return *msg ? -1 : 0; diff --git a/src/or/or.h b/src/or/or.h index 04640d0..df69674 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2233,6 +2233,9 @@ typedef struct node_t { /** Local info: we treat this node as if it rejects everything */ unsigned int rejects_all:1; + /** Local info: this node is in our list of guards */ + unsigned int using_as_guard:1; + /* Local info: derived. */ /** True if the IPv6 OR port is preferred over the IPv4 OR port. */

1 0

[tor/master] Be more robust when excluding existing nodes as new dirguards
by nickm＠torproject.org 18 Mar '13

18 Mar '13

commit 1070a720ad7f45fa82b77be0512056a06e535b72 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 14 12:06:59 2013 -0500 Be more robust when excluding existing nodes as new dirguards In addition to rejecting them post-hoc, avoid picking them in the first place. This makes us less likely to decide that we can't add guards at all. --- src/or/circuitbuild.c | 1 + src/or/entrynodes.c | 2 +- src/or/or.h | 4 ++++ src/or/routerlist.c | 3 +++ 4 files changed, 9 insertions(+), 1 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 163afd3..c2f3953 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -3397,6 +3397,7 @@ choose_good_entry_server(uint8_t purpose, cpath_build_state_t *state) }); } /* and exclude current entry guards and their families, if applicable */ + /*XXXX025 use the using_as_guard flag to accomplish this.*/ if (options->UseEntryGuards) { SMARTLIST_FOREACH(get_entry_guards(), const entry_guard_t *, entry, { diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 3e471ed..5dd2790 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -362,7 +362,7 @@ add_an_entry_guard(const node_t *chosen, int reset_status, int prepend, } else { const routerstatus_t *rs; rs = router_pick_directory_server(MICRODESC_DIRINFO|V3_DIRINFO, - PDS_PREFER_TUNNELED_DIR_CONNS_); + PDS_PREFER_TUNNELED_DIR_CONNS_|PDS_FOR_GUARD); if (!rs) return NULL; node = node_get_by_id(rs->identity_digest); diff --git a/src/or/or.h b/src/or/or.h index df69674..1cb9ef2 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4760,6 +4760,10 @@ typedef struct dir_server_t { #define PDS_NO_EXISTING_SERVERDESC_FETCH (1<<3) #define PDS_NO_EXISTING_MICRODESC_FETCH (1<<4) +/** This node is to be chosen as a directory guard, so don't choose any + * node that's currently a guard. */ +#define PDS_FOR_GUARD (1<<5) + #define PDS_PREFER_TUNNELED_DIR_CONNS_ (1<<16) /** Possible ways to weight routers when choosing one randomly. See diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 90b707b..837245d 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -1153,6 +1153,7 @@ router_pick_directory_server_impl(dirinfo_type_t type, int flags) int requireother = ! (flags & PDS_ALLOW_SELF); int fascistfirewall = ! (flags & PDS_IGNORE_FASCISTFIREWALL); int prefer_tunnel = (flags & PDS_PREFER_TUNNELED_DIR_CONNS_); + int for_guard = (flags & PDS_FOR_GUARD); int try_excluding = 1, n_excluded = 0; if (!consensus) @@ -1192,6 +1193,8 @@ router_pick_directory_server_impl(dirinfo_type_t type, int flags) if ((type & MICRODESC_DIRINFO) && !is_trusted && !node->rs->version_supports_microdesc_cache) continue; + if (for_guard && node->using_as_guard) + continue; /* Don't make the same node a guard twice. */ if (try_excluding && routerset_contains_routerstatus(options->ExcludeNodes, status, country)) {

1 0

[tor/master] Changes file for bug8231 (duplicate directory guards)
by nickm＠torproject.org 18 Mar '13

18 Mar '13

commit 44095312fa63c2623418346eb0cb487b45cf9c50 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 14 12:12:48 2013 -0500 Changes file for bug8231 (duplicate directory guards) --- changes/bug8231 | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/changes/bug8231 b/changes/bug8231 new file mode 100644 index 0000000..fd87a1d --- /dev/null +++ b/changes/bug8231 @@ -0,0 +1,5 @@ + o Major bugfixes: + - When unable to find any working directory nodes to use as a + directory guard, give up rather than adding the same non-working + nodes to the list over and over. Fixes bug 8231; bugfix on + 0.2.4.8-alpha.

1 0

[tor/master] Merge remote-tracking branch 'public/no_dup_guards' into maint-0.2.4
by nickm＠torproject.org 18 Mar '13

18 Mar '13

commit 26639b7798b5f5dae93e40bd7d050cb218a8aad2 Merge: 173efa1 4409531 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 18 14:50:01 2013 -0400 Merge remote-tracking branch 'public/no_dup_guards' into maint-0.2.4 changes/bug8231 | 5 +++++ src/or/circuitbuild.c | 1 + src/or/entrynodes.c | 31 ++++++++++++++++++++++++++++++- src/or/or.h | 7 +++++++ src/or/routerlist.c | 3 +++ 5 files changed, 46 insertions(+), 1 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.4'
by nickm＠torproject.org 18 Mar '13

18 Mar '13

commit f15d9cf5db290f4e1c9ee80214674414238eabff Merge: 1512747 26639b7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 18 14:50:36 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' changes/bug8231 | 5 +++++ src/or/circuitbuild.c | 1 + src/or/entrynodes.c | 31 ++++++++++++++++++++++++++++++- src/or/or.h | 7 +++++++ src/or/routerlist.c | 3 +++ 5 files changed, 46 insertions(+), 1 deletions(-)

1 0

[tor/maint-0.2.4] Add some code to bluntly prevent duplicate guards from getting added
by nickm＠torproject.org 18 Mar '13

18 Mar '13

commit 91027218e29090b18d42e1868367cc2a9e149900 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 14 11:48:47 2013 -0500 Add some code to bluntly prevent duplicate guards from getting added Apparently something in the directory guard code made it possible for the same node to get added as a guard over and over when there were no actual running guard nodes. --- src/or/entrynodes.c | 29 +++++++++++++++++++++++++++++ src/or/or.h | 3 +++ 2 files changed, 32 insertions(+), 0 deletions(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 4ca56cb..3e471ed 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -369,6 +369,15 @@ add_an_entry_guard(const node_t *chosen, int reset_status, int prepend, if (!node) return NULL; } + if (node->using_as_guard) + return NULL; + if (entry_guard_get_by_id_digest(node->identity) != NULL) { + log_info(LD_CIRC, "I was about to add a duplicate entry guard."); + /* This can happen if we choose a guard, then the node goes away, then + * comes back. */ + ((node_t*) node)->using_as_guard = 1; + return NULL; + } entry = tor_malloc_zero(sizeof(entry_guard_t)); log_info(LD_CIRC, "Chose %s as new entry guard.", node_describe(node)); @@ -384,6 +393,7 @@ add_an_entry_guard(const node_t *chosen, int reset_status, int prepend, * this guard. For details, see the Jan 2010 or-dev thread. */ entry->chosen_on_date = time(NULL) - crypto_rand_int(3600*24*30); entry->chosen_by_version = tor_strdup(VERSION); + ((node_t*)node)->using_as_guard = 1; if (prepend) smartlist_insert(entry_guards, 0, entry); else @@ -723,6 +733,21 @@ entry_nodes_should_be_added(void) should_add_entry_nodes = 1; } +/** Update the using_as_guard fields of all the nodes. We do this after we + * remove entry guards from the list: This is the only function that clears + * the using_as_guard field. */ +static void +update_node_guard_status(void) +{ + smartlist_t *nodes = nodelist_get_list(); + SMARTLIST_FOREACH(nodes, node_t *, node, node->using_as_guard = 0); + SMARTLIST_FOREACH_BEGIN(entry_guards, entry_guard_t *, entry) { + node_t *node = node_get_mutable_by_id(entry->identity); + if (node) + node->using_as_guard = 1; + } SMARTLIST_FOREACH_END(entry); +} + /** Adjust the entry guards list so that it only contains entries from * EntryNodes, adding new entries from EntryNodes to the list as needed. */ static void @@ -807,6 +832,8 @@ entry_guards_set_from_config(const or_options_t *options) SMARTLIST_FOREACH(old_entry_guards_not_on_list, entry_guard_t *, e, entry_guard_free(e)); + update_node_guard_status(); + smartlist_free(entry_nodes); smartlist_free(worse_entry_nodes); smartlist_free(entry_fps); @@ -1231,6 +1258,8 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) * few lines, so we don't have to re-dirty it */ if (remove_obsolete_entry_guards(now)) entry_guards_dirty = 1; + + update_node_guard_status(); } digestmap_free(added_by, tor_free_); return *msg ? -1 : 0; diff --git a/src/or/or.h b/src/or/or.h index 04640d0..df69674 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2233,6 +2233,9 @@ typedef struct node_t { /** Local info: we treat this node as if it rejects everything */ unsigned int rejects_all:1; + /** Local info: this node is in our list of guards */ + unsigned int using_as_guard:1; + /* Local info: derived. */ /** True if the IPv6 OR port is preferred over the IPv4 OR port. */

1 0

[tor/maint-0.2.4] Be more robust when excluding existing nodes as new dirguards
by nickm＠torproject.org 18 Mar '13

18 Mar '13

commit 1070a720ad7f45fa82b77be0512056a06e535b72 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 14 12:06:59 2013 -0500 Be more robust when excluding existing nodes as new dirguards In addition to rejecting them post-hoc, avoid picking them in the first place. This makes us less likely to decide that we can't add guards at all. --- src/or/circuitbuild.c | 1 + src/or/entrynodes.c | 2 +- src/or/or.h | 4 ++++ src/or/routerlist.c | 3 +++ 4 files changed, 9 insertions(+), 1 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 163afd3..c2f3953 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -3397,6 +3397,7 @@ choose_good_entry_server(uint8_t purpose, cpath_build_state_t *state) }); } /* and exclude current entry guards and their families, if applicable */ + /*XXXX025 use the using_as_guard flag to accomplish this.*/ if (options->UseEntryGuards) { SMARTLIST_FOREACH(get_entry_guards(), const entry_guard_t *, entry, { diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 3e471ed..5dd2790 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -362,7 +362,7 @@ add_an_entry_guard(const node_t *chosen, int reset_status, int prepend, } else { const routerstatus_t *rs; rs = router_pick_directory_server(MICRODESC_DIRINFO|V3_DIRINFO, - PDS_PREFER_TUNNELED_DIR_CONNS_); + PDS_PREFER_TUNNELED_DIR_CONNS_|PDS_FOR_GUARD); if (!rs) return NULL; node = node_get_by_id(rs->identity_digest); diff --git a/src/or/or.h b/src/or/or.h index df69674..1cb9ef2 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4760,6 +4760,10 @@ typedef struct dir_server_t { #define PDS_NO_EXISTING_SERVERDESC_FETCH (1<<3) #define PDS_NO_EXISTING_MICRODESC_FETCH (1<<4) +/** This node is to be chosen as a directory guard, so don't choose any + * node that's currently a guard. */ +#define PDS_FOR_GUARD (1<<5) + #define PDS_PREFER_TUNNELED_DIR_CONNS_ (1<<16) /** Possible ways to weight routers when choosing one randomly. See diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 90b707b..837245d 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -1153,6 +1153,7 @@ router_pick_directory_server_impl(dirinfo_type_t type, int flags) int requireother = ! (flags & PDS_ALLOW_SELF); int fascistfirewall = ! (flags & PDS_IGNORE_FASCISTFIREWALL); int prefer_tunnel = (flags & PDS_PREFER_TUNNELED_DIR_CONNS_); + int for_guard = (flags & PDS_FOR_GUARD); int try_excluding = 1, n_excluded = 0; if (!consensus) @@ -1192,6 +1193,8 @@ router_pick_directory_server_impl(dirinfo_type_t type, int flags) if ((type & MICRODESC_DIRINFO) && !is_trusted && !node->rs->version_supports_microdesc_cache) continue; + if (for_guard && node->using_as_guard) + continue; /* Don't make the same node a guard twice. */ if (try_excluding && routerset_contains_routerstatus(options->ExcludeNodes, status, country)) {

1 0

[tor/maint-0.2.4] Changes file for bug8231 (duplicate directory guards)
by nickm＠torproject.org 18 Mar '13

18 Mar '13

commit 44095312fa63c2623418346eb0cb487b45cf9c50 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Feb 14 12:12:48 2013 -0500 Changes file for bug8231 (duplicate directory guards) --- changes/bug8231 | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/changes/bug8231 b/changes/bug8231 new file mode 100644 index 0000000..fd87a1d --- /dev/null +++ b/changes/bug8231 @@ -0,0 +1,5 @@ + o Major bugfixes: + - When unable to find any working directory nodes to use as a + directory guard, give up rather than adding the same non-working + nodes to the list over and over. Fixes bug 8231; bugfix on + 0.2.4.8-alpha.

1 0