April 2013 - tor-commits - lists.torproject.org

[tor/master] Prefer SOCKS_USER_PASS over SOCKS_NO_AUTH
by nickm＠torproject.org 11 Apr '13

11 Apr '13

commit a264c4fedab87ce7c8cbb94632657a90e95e7a4e Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 20 15:37:47 2013 -0400 Prefer SOCKS_USER_PASS over SOCKS_NO_AUTH --- src/or/buffers.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/or/buffers.c b/src/or/buffers.c index ad5ab83..4554a02 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -1783,19 +1783,19 @@ parse_socks(const char *data, size_t datalen, socks_request_t *req, return -1; req->replylen = 2; /* 2 bytes of response */ req->reply[0] = 5; /* socks5 reply */ - if (memchr(data+2, SOCKS_NO_AUTH, nummethods)) { - req->reply[1] = SOCKS_NO_AUTH; /* tell client to use "none" auth - method */ - req->socks_version = 5; /* remember we've already negotiated auth */ - log_debug(LD_APP,"socks5: accepted method 0 (no authentication)"); - r=0; - } else if (memchr(data+2, SOCKS_USER_PASS, nummethods)) { + if (memchr(data+2, SOCKS_USER_PASS, nummethods)) { req->auth_type = SOCKS_USER_PASS; req->reply[1] = SOCKS_USER_PASS; /* tell client to use "user/pass" auth method */ req->socks_version = 5; /* remember we've already negotiated auth */ log_debug(LD_APP,"socks5: accepted method 2 (username/password)"); r=0; + } else if (memchr(data+2, SOCKS_NO_AUTH, nummethods)) { + req->reply[1] = SOCKS_NO_AUTH; /* tell client to use "none" auth + method */ + req->socks_version = 5; /* remember we've already negotiated auth */ + log_debug(LD_APP,"socks5: accepted method 0 (no authentication)"); + r=0; } else { log_warn(LD_APP, "socks5: offered methods don't include 'no auth' or "

1 0

[tor/master] Per-SOCKSPort configuration for bug 8117 fix.
by nickm＠torproject.org 11 Apr '13

11 Apr '13

commit fa3c23773944788125db2f67bcb048376c17fec9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 20 16:17:06 2013 -0400 Per-SOCKSPort configuration for bug 8117 fix. This might be necessary if the bug8117 fix confuses any applications. Also add a changes file. --- changes/bug8117 | 13 +++++++++++++ doc/tor.1.txt | 14 +++++++++++++- src/or/buffers.c | 7 +++++-- src/or/config.c | 9 +++++++++ src/or/connection.c | 6 ++++++ src/or/or.h | 12 ++++++++++++ 6 files changed, 58 insertions(+), 3 deletions(-) diff --git a/changes/bug8117 b/changes/bug8117 new file mode 100644 index 0000000..910e805 --- /dev/null +++ b/changes/bug8117 @@ -0,0 +1,13 @@ + o Major bugfixes: + + - Many SOCKS5 clients, when configured to offer a username/password, + offer both username/password authentication and "no authentication". + Tor had previously preferred no authentication, but this was + problematic when trying to make applications get proper stream + isolation with IsolateSOCKSAuth. Now, on any SOCKS port with + IsolateSOCKSAuth turned on (which is the default), Tor selects + username/password authentication if it's offered. If this confuses your + application, you can disable it on a per-SOCKSPort basis via + PreferSOCKSNoAuth. Fixes bug 8117; bugfix on 0.2.3.3-alpha. + + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 773fccf..85f0835 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -860,7 +860,7 @@ The following options are useful only for clients (that is, if the same circuit. Currently, two addresses are "too close" if they lie in the same /16 range. (Default: 1) -**SOCKSPort** \['address':]__port__|**auto** [_isolation flags_]:: +**SOCKSPort** \['address':]__port__|**auto** [_flags_] [_isolation flags_]:: Open this port to listen for connections from SOCKS-speaking applications. Set this to 0 if you don't want to allow application connections via SOCKS. Set it to "auto" to have Tor pick a port for @@ -894,6 +894,18 @@ The following options are useful only for clients (that is, if port with the same session group. (By default, streams received on different SOCKSPorts, TransPorts, etc are always isolated from one another. This option overrides that behavior.) ++ + Other recognized _flags_ for a SOCKSPort are: + **PreferSOCKSNoAuth**;; + Ordinarily, when an application offers both "username/password + authentication" and "no authentication" to Tor via SOCKS5, Tor + selects username/password authentication so that IsolateSOCKSAuth can + work. This can confuse some applications, if they offer a + username/password combination then get confused when asked for + one. You can disable this behavior, so that Tor will select "No + authentication" when IsolateSOCKSAuth is disabled, or when this + option is set. + **SOCKSListenAddress** __IP__[:__PORT__]:: Bind to this address to listen for connections from Socks-speaking diff --git a/src/or/buffers.c b/src/or/buffers.c index 4554a02..c0868f4 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -1773,6 +1773,7 @@ parse_socks(const char *data, size_t datalen, socks_request_t *req, if (req->socks_version != 5) { /* we need to negotiate a method */ unsigned char nummethods = (unsigned char)*(data+1); + int have_user_pass, have_no_auth; int r=0; tor_assert(!req->socks_version); if (datalen < 2u+nummethods) { @@ -1783,14 +1784,16 @@ parse_socks(const char *data, size_t datalen, socks_request_t *req, return -1; req->replylen = 2; /* 2 bytes of response */ req->reply[0] = 5; /* socks5 reply */ - if (memchr(data+2, SOCKS_USER_PASS, nummethods)) { + have_user_pass = (memchr(data+2, SOCKS_USER_PASS, nummethods) !=NULL); + have_no_auth = (memchr(data+2, SOCKS_NO_AUTH, nummethods) !=NULL); + if (have_user_pass && !(have_no_auth && req->socks_prefer_no_auth)) { req->auth_type = SOCKS_USER_PASS; req->reply[1] = SOCKS_USER_PASS; /* tell client to use "user/pass" auth method */ req->socks_version = 5; /* remember we've already negotiated auth */ log_debug(LD_APP,"socks5: accepted method 2 (username/password)"); r=0; - } else if (memchr(data+2, SOCKS_NO_AUTH, nummethods)) { + } else if (have_no_auth) { req->reply[1] = SOCKS_NO_AUTH; /* tell client to use "none" auth method */ req->socks_version = 5; /* remember we've already negotiated auth */ diff --git a/src/or/config.c b/src/or/config.c index 90a5dfb..a80576e 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -5787,6 +5787,7 @@ parse_port_config(smartlist_t *out, int port; int sessiongroup = SESSION_GROUP_UNSET; unsigned isolation = ISO_DEFAULT; + int prefer_no_auth = 0; char *addrport; uint16_t ptmp=0; @@ -5916,6 +5917,11 @@ parse_port_config(smartlist_t *out, no = 1; elt += 2; } + if (!strcasecmp(elt, "PreferSOCKSNoAuth")) { + prefer_no_auth = ! no; + continue; + } + if (!strcasecmpend(elt, "s")) elt[strlen(elt)-1] = '\0'; /* kill plurals. */ @@ -5959,6 +5965,9 @@ parse_port_config(smartlist_t *out, cfg->all_addrs = all_addrs; cfg->ipv4_only = ipv4_only; cfg->ipv6_only = ipv6_only; + cfg->socks_prefer_no_auth = prefer_no_auth; + if (! (isolation & ISO_SOCKSAUTH)) + cfg->socks_prefer_no_auth = 1; smartlist_add(out, cfg); } diff --git a/src/or/connection.c b/src/or/connection.c index eac9c4f..aeb4949 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -1056,6 +1056,7 @@ connection_listener_new(const struct sockaddr *listensockaddr, lis_conn->session_group = global_next_session_group--; } } + lis_conn->socks_prefer_no_auth = port_cfg->socks_prefer_no_auth; if (connection_add(conn) < 0) { /* no space, forget it */ log_warn(LD_NET,"connection_add for listener failed. Giving up."); @@ -1238,6 +1239,11 @@ connection_handle_listener_read(connection_t *conn, int new_type) newconn->port = port; newconn->address = tor_dup_addr(&addr); + if (new_type == CONN_TYPE_AP) { + TO_ENTRY_CONN(newconn)->socks_request->socks_prefer_no_auth = + TO_LISTENER_CONN(conn)->socks_prefer_no_auth; + } + } else if (conn->socket_family == AF_UNIX) { /* For now only control ports can be Unix domain sockets * and listeners at the same time */ diff --git a/src/or/or.h b/src/or/or.h index 51c23d3..ca28c0e 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1085,6 +1085,10 @@ typedef struct listener_connection_t { /** One or more ISO_ flags to describe how to isolate streams. */ uint8_t isolation_flags; /**@}*/ + /** For SOCKS connections only: If this is set, we will choose "no + * authentication" instead of "username/password" authentication if both + * are offered. Used as input to parse_socks. */ + unsigned int socks_prefer_no_auth : 1; } listener_connection_t; @@ -2910,6 +2914,10 @@ typedef struct port_cfg_t { uint8_t isolation_flags; /**< Zero or more isolation flags */ int session_group; /**< A session group, or -1 if this port is not in a * session group. */ + /* Socks only: */ + /** When both no-auth and user/pass are advertised by a SOCKS client, select + * no-auth. */ + unsigned int socks_prefer_no_auth : 1; /* Server port types (or, dir) only: */ unsigned int no_advertise : 1; @@ -3729,6 +3737,10 @@ struct socks_request_t { * make sure we send back a socks reply for * every connection. */ unsigned int got_auth : 1; /**< Have we received any authentication data? */ + /** If this is set, we will choose "no authentication" instead of + * "username/password" authentication if both are offered. Used as input to + * parse_socks. */ + unsigned int socks_prefer_no_auth : 1; /** Number of bytes in username; 0 if username is NULL */ size_t usernamelen;

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.4'
by nickm＠torproject.org 11 Apr '13

11 Apr '13

commit 3dfd1ebf12671323e97b002f66484544d90f1bae Merge: 8e7226c 7f50af1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Apr 11 01:40:31 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' changes/bug8117 | 13 +++++++++++++ doc/tor.1.txt | 9 +++++++++ src/or/buffers.c | 17 ++++++++++------- src/or/config.c | 7 +++++++ src/or/connection.c | 6 ++++++ src/or/or.h | 12 ++++++++++++ 6 files changed, 57 insertions(+), 7 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'public/bug8117_023' into maint-0.2.4
by nickm＠torproject.org 11 Apr '13

11 Apr '13

commit 7f50af116f2497a73fe9113e814a5765047cf3ca Merge: 6acf0ac fa3c237 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Apr 11 01:39:26 2013 -0400 Merge remote-tracking branch 'public/bug8117_023' into maint-0.2.4 Conflicts: doc/tor.1.txt src/or/config.c src/or/connection.c changes/bug8117 | 13 +++++++++++++ doc/tor.1.txt | 9 +++++++++ src/or/buffers.c | 17 ++++++++++------- src/or/config.c | 7 +++++++ src/or/connection.c | 6 ++++++ src/or/or.h | 12 ++++++++++++ 6 files changed, 57 insertions(+), 7 deletions(-) diff --cc doc/tor.1.txt index c502c57,85f0835..f35d639 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@@ -927,52 -893,20 +927,61 @@@ The following options are useful only f on this port to share circuits with streams from every other port with the same session group. (By default, streams received on different SOCKSPorts, TransPorts, etc are always isolated from one - another. This option overrides that behavior.) + another. This option overrides that behavior.) + + Other recognized _flags_ for a SOCKSPort are: + **NoIPv4Traffic**;; + Tell exits to not connect to IPv4 addresses in response to SOCKS + requests on this connection. + **IPv6Traffic**;; + Tell exits to allow IPv6 addresses in response to SOCKS requests on + this connection, so long as SOCKS5 is in use. (SOCKS4 can't handle + IPv6.) + **PreferIPv6**;; + Tells exits that, if a host has both an IPv4 and an IPv6 address, + we would prefer to connect to it via IPv6. (IPv4 is the default.) + ++ + NOTE: Although this option allows you to specify an IP address + other than localhost, you should do so only with extreme caution. + The SOCKS protocol is unencrypted and (as we use it) + unauthenticated, so exposing it in this way could leak your + information to anybody watching your network, and allow anybody + to use your computer as an open proxy. + **CacheIPv4DNS**;; + Tells the client to remember IPv4 DNS answers we receive from exit + nodes via this connection. (On by default.) + **CacheIPv6DNS**;; + Tells the client to remember IPv6 DNS answers we receive from exit + nodes via this connection. + **CacheDNS**;; + Tells the client to remember all DNS answers we receive from exit + nodes via this connection. + **UseIPv4Cache**;; + Tells the client to use any cached IPv4 DNS answers we have when making + requests via this connection. (NOTE: This option, along UseIPv6Cache + and UseDNSCache, can harm your anonymity, and probably + won't help performance as much as you might expect. Use with care!) + **UseIPv6Cache**;; + Tells the client to use any cached IPv6 DNS answers we have when making + requests via this connection. + **UseDNSCache**;; + Tells the client to use any cached DNS answers we have when making + requests via this connection. + **PreferIPv6Automap**;; + When serving a hostname lookup request on this port that + should get automapped (according to AutomapHostsOnResove), + if we could return either an IPv4 or an IPv6 answer, prefer + an IPv6 answer. (On by default.) + **PreferSOCKSNoAuth**;; + Ordinarily, when an application offers both "username/password + authentication" and "no authentication" to Tor via SOCKS5, Tor + selects username/password authentication so that IsolateSOCKSAuth can + work. This can confuse some applications, if they offer a + username/password combination then get confused when asked for + one. You can disable this behavior, so that Tor will select "No + authentication" when IsolateSOCKSAuth is disabled, or when this + option is set. - **SOCKSListenAddress** __IP__[:__PORT__]:: Bind to this address to listen for connections from Socks-speaking applications. (Default: 127.0.0.1) You can also specify a port (e.g. diff --cc src/or/config.c index ffa984b,a80576e..20a3c20 --- a/src/or/config.c +++ b/src/or/config.c @@@ -5142,40 -5917,9 +5143,43 @@@ parse_port_config(smartlist_t *out no = 1; elt += 2; } - if (!strcasecmp(elt, "PreferSOCKSNoAuth")) { + + if (takes_hostnames) { + if (!strcasecmp(elt, "IPv4Traffic")) { + ipv4_traffic = ! no; + continue; + } else if (!strcasecmp(elt, "IPv6Traffic")) { + ipv6_traffic = ! no; + continue; + } else if (!strcasecmp(elt, "PreferIPv6")) { + prefer_ipv6 = ! no; + continue; + } + } + if (!strcasecmp(elt, "CacheIPv4DNS")) { + cache_ipv4 = ! no; + continue; + } else if (!strcasecmp(elt, "CacheIPv6DNS")) { + cache_ipv6 = ! no; + continue; + } else if (!strcasecmp(elt, "CacheDNS")) { + cache_ipv4 = cache_ipv6 = ! no; + continue; + } else if (!strcasecmp(elt, "UseIPv4Cache")) { + use_cached_ipv4 = ! no; + continue; + } else if (!strcasecmp(elt, "UseIPv6Cache")) { + use_cached_ipv6 = ! no; + continue; + } else if (!strcasecmp(elt, "UseDNSCache")) { + use_cached_ipv4 = use_cached_ipv6 = ! no; + continue; + } else if (!strcasecmp(elt, "PreferIPv6Automap")) { + prefer_ipv6_automap = ! no; + continue; ++ } else if (!strcasecmp(elt, "PreferSOCKSNoAuth")) { + prefer_no_auth = ! no; + continue; } if (!strcasecmpend(elt, "s")) @@@ -5225,16 -5963,11 +5229,19 @@@ cfg->no_advertise = no_advertise; cfg->no_listen = no_listen; cfg->all_addrs = all_addrs; - cfg->ipv4_only = ipv4_only; - cfg->ipv6_only = ipv6_only; + cfg->bind_ipv4_only = bind_ipv4_only; + cfg->bind_ipv6_only = bind_ipv6_only; + cfg->ipv4_traffic = ipv4_traffic; + cfg->ipv6_traffic = ipv6_traffic; + cfg->prefer_ipv6 = prefer_ipv6; + cfg->cache_ipv4_answers = cache_ipv4; + cfg->cache_ipv6_answers = cache_ipv6; + cfg->use_cached_ipv4_answers = use_cached_ipv4; + cfg->use_cached_ipv6_answers = use_cached_ipv6; + cfg->prefer_ipv6_virtaddr = prefer_ipv6_automap; + cfg->socks_prefer_no_auth = prefer_no_auth; + if (! (isolation & ISO_SOCKSAUTH)) + cfg->socks_prefer_no_auth = 1; smartlist_add(out, cfg); } diff --cc src/or/connection.c index 2cc3d74,aeb4949..358a4ee --- a/src/or/connection.c +++ b/src/or/connection.c @@@ -1132,19 -1056,7 +1132,20 @@@ connection_listener_new(const struct so lis_conn->session_group = global_next_session_group--; } } + if (type == CONN_TYPE_AP_LISTENER) { + lis_conn->socks_ipv4_traffic = port_cfg->ipv4_traffic; + lis_conn->socks_ipv6_traffic = port_cfg->ipv6_traffic; + lis_conn->socks_prefer_ipv6 = port_cfg->prefer_ipv6; + } else { + lis_conn->socks_ipv4_traffic = 1; + lis_conn->socks_ipv6_traffic = 1; + } + lis_conn->cache_ipv4_answers = port_cfg->cache_ipv4_answers; + lis_conn->cache_ipv6_answers = port_cfg->cache_ipv6_answers; + lis_conn->use_cached_ipv4_answers = port_cfg->use_cached_ipv4_answers; + lis_conn->use_cached_ipv6_answers = port_cfg->use_cached_ipv6_answers; + lis_conn->prefer_ipv6_virtaddr = port_cfg->prefer_ipv6_virtaddr; + lis_conn->socks_prefer_no_auth = port_cfg->socks_prefer_no_auth; if (connection_add(conn) < 0) { /* no space, forget it */ log_warn(LD_NET,"connection_add for listener failed. Giving up."); diff --cc src/or/or.h index 4e19140,ca28c0e..ece2bc7 --- a/src/or/or.h +++ b/src/or/or.h @@@ -1247,37 -1085,11 +1247,41 @@@ typedef struct listener_connection_t /** One or more ISO_ flags to describe how to isolate streams. */ uint8_t isolation_flags; /**@}*/ + /** For SOCKS connections only: If this is set, we will choose "no + * authentication" instead of "username/password" authentication if both + * are offered. Used as input to parse_socks. */ + unsigned int socks_prefer_no_auth : 1; + /** For a SOCKS listeners, these fields describe whether we should + * allow IPv4 and IPv6 addresses from our exit nodes, respectively. + * + * @{ + */ + unsigned int socks_ipv4_traffic : 1; + unsigned int socks_ipv6_traffic : 1; + /** @} */ + /** For a socks listener: should we tell the exit that we prefer IPv6 + * addresses? */ + unsigned int socks_prefer_ipv6 : 1; + + /** For a socks listener: should we cache IPv4/IPv6 DNS information that + * exit nodes tell us? + * + * @{ */ + unsigned int cache_ipv4_answers : 1; + unsigned int cache_ipv6_answers : 1; + /** @} */ + /** For a socks listeners: if we find an answer in our client-side DNS cache, + * should we use it? + * + * @{ */ + unsigned int use_cached_ipv4_answers : 1; + unsigned int use_cached_ipv6_answers : 1; + /** @} */ + /** For socks listeners: When we can automap an address to IPv4 or IPv6, + * do we prefer IPv6? */ + unsigned int prefer_ipv6_virtaddr : 1; + } listener_connection_t; /** Minimum length of the random part of an AUTH_CHALLENGE cell. */

1 0

[tor/maint-0.2.4] Prefer SOCKS_USER_PASS over SOCKS_NO_AUTH
by nickm＠torproject.org 11 Apr '13

11 Apr '13

commit a264c4fedab87ce7c8cbb94632657a90e95e7a4e Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 20 15:37:47 2013 -0400 Prefer SOCKS_USER_PASS over SOCKS_NO_AUTH --- src/or/buffers.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/or/buffers.c b/src/or/buffers.c index ad5ab83..4554a02 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -1783,19 +1783,19 @@ parse_socks(const char *data, size_t datalen, socks_request_t *req, return -1; req->replylen = 2; /* 2 bytes of response */ req->reply[0] = 5; /* socks5 reply */ - if (memchr(data+2, SOCKS_NO_AUTH, nummethods)) { - req->reply[1] = SOCKS_NO_AUTH; /* tell client to use "none" auth - method */ - req->socks_version = 5; /* remember we've already negotiated auth */ - log_debug(LD_APP,"socks5: accepted method 0 (no authentication)"); - r=0; - } else if (memchr(data+2, SOCKS_USER_PASS, nummethods)) { + if (memchr(data+2, SOCKS_USER_PASS, nummethods)) { req->auth_type = SOCKS_USER_PASS; req->reply[1] = SOCKS_USER_PASS; /* tell client to use "user/pass" auth method */ req->socks_version = 5; /* remember we've already negotiated auth */ log_debug(LD_APP,"socks5: accepted method 2 (username/password)"); r=0; + } else if (memchr(data+2, SOCKS_NO_AUTH, nummethods)) { + req->reply[1] = SOCKS_NO_AUTH; /* tell client to use "none" auth + method */ + req->socks_version = 5; /* remember we've already negotiated auth */ + log_debug(LD_APP,"socks5: accepted method 0 (no authentication)"); + r=0; } else { log_warn(LD_APP, "socks5: offered methods don't include 'no auth' or "

1 0

[tor/maint-0.2.4] Per-SOCKSPort configuration for bug 8117 fix.
by nickm＠torproject.org 11 Apr '13

11 Apr '13

commit fa3c23773944788125db2f67bcb048376c17fec9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 20 16:17:06 2013 -0400 Per-SOCKSPort configuration for bug 8117 fix. This might be necessary if the bug8117 fix confuses any applications. Also add a changes file. --- changes/bug8117 | 13 +++++++++++++ doc/tor.1.txt | 14 +++++++++++++- src/or/buffers.c | 7 +++++-- src/or/config.c | 9 +++++++++ src/or/connection.c | 6 ++++++ src/or/or.h | 12 ++++++++++++ 6 files changed, 58 insertions(+), 3 deletions(-) diff --git a/changes/bug8117 b/changes/bug8117 new file mode 100644 index 0000000..910e805 --- /dev/null +++ b/changes/bug8117 @@ -0,0 +1,13 @@ + o Major bugfixes: + + - Many SOCKS5 clients, when configured to offer a username/password, + offer both username/password authentication and "no authentication". + Tor had previously preferred no authentication, but this was + problematic when trying to make applications get proper stream + isolation with IsolateSOCKSAuth. Now, on any SOCKS port with + IsolateSOCKSAuth turned on (which is the default), Tor selects + username/password authentication if it's offered. If this confuses your + application, you can disable it on a per-SOCKSPort basis via + PreferSOCKSNoAuth. Fixes bug 8117; bugfix on 0.2.3.3-alpha. + + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 773fccf..85f0835 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -860,7 +860,7 @@ The following options are useful only for clients (that is, if the same circuit. Currently, two addresses are "too close" if they lie in the same /16 range. (Default: 1) -**SOCKSPort** \['address':]__port__|**auto** [_isolation flags_]:: +**SOCKSPort** \['address':]__port__|**auto** [_flags_] [_isolation flags_]:: Open this port to listen for connections from SOCKS-speaking applications. Set this to 0 if you don't want to allow application connections via SOCKS. Set it to "auto" to have Tor pick a port for @@ -894,6 +894,18 @@ The following options are useful only for clients (that is, if port with the same session group. (By default, streams received on different SOCKSPorts, TransPorts, etc are always isolated from one another. This option overrides that behavior.) ++ + Other recognized _flags_ for a SOCKSPort are: + **PreferSOCKSNoAuth**;; + Ordinarily, when an application offers both "username/password + authentication" and "no authentication" to Tor via SOCKS5, Tor + selects username/password authentication so that IsolateSOCKSAuth can + work. This can confuse some applications, if they offer a + username/password combination then get confused when asked for + one. You can disable this behavior, so that Tor will select "No + authentication" when IsolateSOCKSAuth is disabled, or when this + option is set. + **SOCKSListenAddress** __IP__[:__PORT__]:: Bind to this address to listen for connections from Socks-speaking diff --git a/src/or/buffers.c b/src/or/buffers.c index 4554a02..c0868f4 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -1773,6 +1773,7 @@ parse_socks(const char *data, size_t datalen, socks_request_t *req, if (req->socks_version != 5) { /* we need to negotiate a method */ unsigned char nummethods = (unsigned char)*(data+1); + int have_user_pass, have_no_auth; int r=0; tor_assert(!req->socks_version); if (datalen < 2u+nummethods) { @@ -1783,14 +1784,16 @@ parse_socks(const char *data, size_t datalen, socks_request_t *req, return -1; req->replylen = 2; /* 2 bytes of response */ req->reply[0] = 5; /* socks5 reply */ - if (memchr(data+2, SOCKS_USER_PASS, nummethods)) { + have_user_pass = (memchr(data+2, SOCKS_USER_PASS, nummethods) !=NULL); + have_no_auth = (memchr(data+2, SOCKS_NO_AUTH, nummethods) !=NULL); + if (have_user_pass && !(have_no_auth && req->socks_prefer_no_auth)) { req->auth_type = SOCKS_USER_PASS; req->reply[1] = SOCKS_USER_PASS; /* tell client to use "user/pass" auth method */ req->socks_version = 5; /* remember we've already negotiated auth */ log_debug(LD_APP,"socks5: accepted method 2 (username/password)"); r=0; - } else if (memchr(data+2, SOCKS_NO_AUTH, nummethods)) { + } else if (have_no_auth) { req->reply[1] = SOCKS_NO_AUTH; /* tell client to use "none" auth method */ req->socks_version = 5; /* remember we've already negotiated auth */ diff --git a/src/or/config.c b/src/or/config.c index 90a5dfb..a80576e 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -5787,6 +5787,7 @@ parse_port_config(smartlist_t *out, int port; int sessiongroup = SESSION_GROUP_UNSET; unsigned isolation = ISO_DEFAULT; + int prefer_no_auth = 0; char *addrport; uint16_t ptmp=0; @@ -5916,6 +5917,11 @@ parse_port_config(smartlist_t *out, no = 1; elt += 2; } + if (!strcasecmp(elt, "PreferSOCKSNoAuth")) { + prefer_no_auth = ! no; + continue; + } + if (!strcasecmpend(elt, "s")) elt[strlen(elt)-1] = '\0'; /* kill plurals. */ @@ -5959,6 +5965,9 @@ parse_port_config(smartlist_t *out, cfg->all_addrs = all_addrs; cfg->ipv4_only = ipv4_only; cfg->ipv6_only = ipv6_only; + cfg->socks_prefer_no_auth = prefer_no_auth; + if (! (isolation & ISO_SOCKSAUTH)) + cfg->socks_prefer_no_auth = 1; smartlist_add(out, cfg); } diff --git a/src/or/connection.c b/src/or/connection.c index eac9c4f..aeb4949 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -1056,6 +1056,7 @@ connection_listener_new(const struct sockaddr *listensockaddr, lis_conn->session_group = global_next_session_group--; } } + lis_conn->socks_prefer_no_auth = port_cfg->socks_prefer_no_auth; if (connection_add(conn) < 0) { /* no space, forget it */ log_warn(LD_NET,"connection_add for listener failed. Giving up."); @@ -1238,6 +1239,11 @@ connection_handle_listener_read(connection_t *conn, int new_type) newconn->port = port; newconn->address = tor_dup_addr(&addr); + if (new_type == CONN_TYPE_AP) { + TO_ENTRY_CONN(newconn)->socks_request->socks_prefer_no_auth = + TO_LISTENER_CONN(conn)->socks_prefer_no_auth; + } + } else if (conn->socket_family == AF_UNIX) { /* For now only control ports can be Unix domain sockets * and listeners at the same time */ diff --git a/src/or/or.h b/src/or/or.h index 51c23d3..ca28c0e 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1085,6 +1085,10 @@ typedef struct listener_connection_t { /** One or more ISO_ flags to describe how to isolate streams. */ uint8_t isolation_flags; /**@}*/ + /** For SOCKS connections only: If this is set, we will choose "no + * authentication" instead of "username/password" authentication if both + * are offered. Used as input to parse_socks. */ + unsigned int socks_prefer_no_auth : 1; } listener_connection_t; @@ -2910,6 +2914,10 @@ typedef struct port_cfg_t { uint8_t isolation_flags; /**< Zero or more isolation flags */ int session_group; /**< A session group, or -1 if this port is not in a * session group. */ + /* Socks only: */ + /** When both no-auth and user/pass are advertised by a SOCKS client, select + * no-auth. */ + unsigned int socks_prefer_no_auth : 1; /* Server port types (or, dir) only: */ unsigned int no_advertise : 1; @@ -3729,6 +3737,10 @@ struct socks_request_t { * make sure we send back a socks reply for * every connection. */ unsigned int got_auth : 1; /**< Have we received any authentication data? */ + /** If this is set, we will choose "no authentication" instead of + * "username/password" authentication if both are offered. Used as input to + * parse_socks. */ + unsigned int socks_prefer_no_auth : 1; /** Number of bytes in username; 0 if username is NULL */ size_t usernamelen;

1 0

[tor/maint-0.2.4] Merge remote-tracking branch 'public/bug8117_023' into maint-0.2.4
by nickm＠torproject.org 11 Apr '13

11 Apr '13

commit 7f50af116f2497a73fe9113e814a5765047cf3ca Merge: 6acf0ac fa3c237 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Apr 11 01:39:26 2013 -0400 Merge remote-tracking branch 'public/bug8117_023' into maint-0.2.4 Conflicts: doc/tor.1.txt src/or/config.c src/or/connection.c changes/bug8117 | 13 +++++++++++++ doc/tor.1.txt | 9 +++++++++ src/or/buffers.c | 17 ++++++++++------- src/or/config.c | 7 +++++++ src/or/connection.c | 6 ++++++ src/or/or.h | 12 ++++++++++++ 6 files changed, 57 insertions(+), 7 deletions(-) diff --cc doc/tor.1.txt index c502c57,85f0835..f35d639 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@@ -927,52 -893,20 +927,61 @@@ The following options are useful only f on this port to share circuits with streams from every other port with the same session group. (By default, streams received on different SOCKSPorts, TransPorts, etc are always isolated from one - another. This option overrides that behavior.) + another. This option overrides that behavior.) + + Other recognized _flags_ for a SOCKSPort are: + **NoIPv4Traffic**;; + Tell exits to not connect to IPv4 addresses in response to SOCKS + requests on this connection. + **IPv6Traffic**;; + Tell exits to allow IPv6 addresses in response to SOCKS requests on + this connection, so long as SOCKS5 is in use. (SOCKS4 can't handle + IPv6.) + **PreferIPv6**;; + Tells exits that, if a host has both an IPv4 and an IPv6 address, + we would prefer to connect to it via IPv6. (IPv4 is the default.) + ++ + NOTE: Although this option allows you to specify an IP address + other than localhost, you should do so only with extreme caution. + The SOCKS protocol is unencrypted and (as we use it) + unauthenticated, so exposing it in this way could leak your + information to anybody watching your network, and allow anybody + to use your computer as an open proxy. + **CacheIPv4DNS**;; + Tells the client to remember IPv4 DNS answers we receive from exit + nodes via this connection. (On by default.) + **CacheIPv6DNS**;; + Tells the client to remember IPv6 DNS answers we receive from exit + nodes via this connection. + **CacheDNS**;; + Tells the client to remember all DNS answers we receive from exit + nodes via this connection. + **UseIPv4Cache**;; + Tells the client to use any cached IPv4 DNS answers we have when making + requests via this connection. (NOTE: This option, along UseIPv6Cache + and UseDNSCache, can harm your anonymity, and probably + won't help performance as much as you might expect. Use with care!) + **UseIPv6Cache**;; + Tells the client to use any cached IPv6 DNS answers we have when making + requests via this connection. + **UseDNSCache**;; + Tells the client to use any cached DNS answers we have when making + requests via this connection. + **PreferIPv6Automap**;; + When serving a hostname lookup request on this port that + should get automapped (according to AutomapHostsOnResove), + if we could return either an IPv4 or an IPv6 answer, prefer + an IPv6 answer. (On by default.) + **PreferSOCKSNoAuth**;; + Ordinarily, when an application offers both "username/password + authentication" and "no authentication" to Tor via SOCKS5, Tor + selects username/password authentication so that IsolateSOCKSAuth can + work. This can confuse some applications, if they offer a + username/password combination then get confused when asked for + one. You can disable this behavior, so that Tor will select "No + authentication" when IsolateSOCKSAuth is disabled, or when this + option is set. - **SOCKSListenAddress** __IP__[:__PORT__]:: Bind to this address to listen for connections from Socks-speaking applications. (Default: 127.0.0.1) You can also specify a port (e.g. diff --cc src/or/config.c index ffa984b,a80576e..20a3c20 --- a/src/or/config.c +++ b/src/or/config.c @@@ -5142,40 -5917,9 +5143,43 @@@ parse_port_config(smartlist_t *out no = 1; elt += 2; } - if (!strcasecmp(elt, "PreferSOCKSNoAuth")) { + + if (takes_hostnames) { + if (!strcasecmp(elt, "IPv4Traffic")) { + ipv4_traffic = ! no; + continue; + } else if (!strcasecmp(elt, "IPv6Traffic")) { + ipv6_traffic = ! no; + continue; + } else if (!strcasecmp(elt, "PreferIPv6")) { + prefer_ipv6 = ! no; + continue; + } + } + if (!strcasecmp(elt, "CacheIPv4DNS")) { + cache_ipv4 = ! no; + continue; + } else if (!strcasecmp(elt, "CacheIPv6DNS")) { + cache_ipv6 = ! no; + continue; + } else if (!strcasecmp(elt, "CacheDNS")) { + cache_ipv4 = cache_ipv6 = ! no; + continue; + } else if (!strcasecmp(elt, "UseIPv4Cache")) { + use_cached_ipv4 = ! no; + continue; + } else if (!strcasecmp(elt, "UseIPv6Cache")) { + use_cached_ipv6 = ! no; + continue; + } else if (!strcasecmp(elt, "UseDNSCache")) { + use_cached_ipv4 = use_cached_ipv6 = ! no; + continue; + } else if (!strcasecmp(elt, "PreferIPv6Automap")) { + prefer_ipv6_automap = ! no; + continue; ++ } else if (!strcasecmp(elt, "PreferSOCKSNoAuth")) { + prefer_no_auth = ! no; + continue; } if (!strcasecmpend(elt, "s")) @@@ -5225,16 -5963,11 +5229,19 @@@ cfg->no_advertise = no_advertise; cfg->no_listen = no_listen; cfg->all_addrs = all_addrs; - cfg->ipv4_only = ipv4_only; - cfg->ipv6_only = ipv6_only; + cfg->bind_ipv4_only = bind_ipv4_only; + cfg->bind_ipv6_only = bind_ipv6_only; + cfg->ipv4_traffic = ipv4_traffic; + cfg->ipv6_traffic = ipv6_traffic; + cfg->prefer_ipv6 = prefer_ipv6; + cfg->cache_ipv4_answers = cache_ipv4; + cfg->cache_ipv6_answers = cache_ipv6; + cfg->use_cached_ipv4_answers = use_cached_ipv4; + cfg->use_cached_ipv6_answers = use_cached_ipv6; + cfg->prefer_ipv6_virtaddr = prefer_ipv6_automap; + cfg->socks_prefer_no_auth = prefer_no_auth; + if (! (isolation & ISO_SOCKSAUTH)) + cfg->socks_prefer_no_auth = 1; smartlist_add(out, cfg); } diff --cc src/or/connection.c index 2cc3d74,aeb4949..358a4ee --- a/src/or/connection.c +++ b/src/or/connection.c @@@ -1132,19 -1056,7 +1132,20 @@@ connection_listener_new(const struct so lis_conn->session_group = global_next_session_group--; } } + if (type == CONN_TYPE_AP_LISTENER) { + lis_conn->socks_ipv4_traffic = port_cfg->ipv4_traffic; + lis_conn->socks_ipv6_traffic = port_cfg->ipv6_traffic; + lis_conn->socks_prefer_ipv6 = port_cfg->prefer_ipv6; + } else { + lis_conn->socks_ipv4_traffic = 1; + lis_conn->socks_ipv6_traffic = 1; + } + lis_conn->cache_ipv4_answers = port_cfg->cache_ipv4_answers; + lis_conn->cache_ipv6_answers = port_cfg->cache_ipv6_answers; + lis_conn->use_cached_ipv4_answers = port_cfg->use_cached_ipv4_answers; + lis_conn->use_cached_ipv6_answers = port_cfg->use_cached_ipv6_answers; + lis_conn->prefer_ipv6_virtaddr = port_cfg->prefer_ipv6_virtaddr; + lis_conn->socks_prefer_no_auth = port_cfg->socks_prefer_no_auth; if (connection_add(conn) < 0) { /* no space, forget it */ log_warn(LD_NET,"connection_add for listener failed. Giving up."); diff --cc src/or/or.h index 4e19140,ca28c0e..ece2bc7 --- a/src/or/or.h +++ b/src/or/or.h @@@ -1247,37 -1085,11 +1247,41 @@@ typedef struct listener_connection_t /** One or more ISO_ flags to describe how to isolate streams. */ uint8_t isolation_flags; /**@}*/ + /** For SOCKS connections only: If this is set, we will choose "no + * authentication" instead of "username/password" authentication if both + * are offered. Used as input to parse_socks. */ + unsigned int socks_prefer_no_auth : 1; + /** For a SOCKS listeners, these fields describe whether we should + * allow IPv4 and IPv6 addresses from our exit nodes, respectively. + * + * @{ + */ + unsigned int socks_ipv4_traffic : 1; + unsigned int socks_ipv6_traffic : 1; + /** @} */ + /** For a socks listener: should we tell the exit that we prefer IPv6 + * addresses? */ + unsigned int socks_prefer_ipv6 : 1; + + /** For a socks listener: should we cache IPv4/IPv6 DNS information that + * exit nodes tell us? + * + * @{ */ + unsigned int cache_ipv4_answers : 1; + unsigned int cache_ipv6_answers : 1; + /** @} */ + /** For a socks listeners: if we find an answer in our client-side DNS cache, + * should we use it? + * + * @{ */ + unsigned int use_cached_ipv4_answers : 1; + unsigned int use_cached_ipv6_answers : 1; + /** @} */ + /** For socks listeners: When we can automap an address to IPv4 or IPv6, + * do we prefer IPv6? */ + unsigned int prefer_ipv6_virtaddr : 1; + } listener_connection_t; /** Minimum length of the random part of an AUTH_CHALLENGE cell. */

1 0

[torspec/master] Improve CBT network liveness section to match code.
by nickm＠torproject.org 11 Apr '13

11 Apr '13

commit cf98616491392dac55541987c545f8e894263718 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Mar 26 19:40:08 2013 -0700 Improve CBT network liveness section to match code. We simplified this code a while back and forgot to update the spec. --- path-spec.txt | 12 ++++-------- 1 files changed, 4 insertions(+), 8 deletions(-) diff --git a/path-spec.txt b/path-spec.txt index 7d19889..d04fc8b 100644 --- a/path-spec.txt +++ b/path-spec.txt @@ -395,14 +395,10 @@ of their choices. We attempt to detect both network connectivity loss and drastic changes in the timeout characteristics. - We assume that we've had network connectivity loss if 3 circuits - timeout and we've received no cells or TLS handshakes since those - circuits began. We then temporarily set the timeout to 60 seconds - and stop counting timeouts. - - If 3 more circuits timeout and the network still has not been - live within this new 60 second timeout window, we then discard - the previous timeouts during this period from our history. + We assume that we've had network connectivity loss if a circuit + times out and we've received no cells or TLS handshakes since that + circuit began. We then temporarily stop counting timeouts until + network activity resumes. To detect changing network conditions, we keep a history of the timeout or non-timeout status of the past 20 circuits that

1 0

[torspec/master] Merge remote-tracking branch 'mikeperry/bug5178'
by nickm＠torproject.org 11 Apr '13

11 Apr '13

commit 1e8be321233a5b3dcd05cf0e1bb34fd3d75c95fb Merge: 25b0d43 cf98616 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Apr 11 01:34:28 2013 -0400 Merge remote-tracking branch 'mikeperry/bug5178' path-spec.txt | 12 ++++-------- 1 files changed, 4 insertions(+), 8 deletions(-)

1 0

[tor/release-0.2.4] Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3
by arma＠torproject.org 11 Apr '13

11 Apr '13

commit 9630fb917f3549b3fcbd4a3885e0c47f4be9be36 Merge: ebb95d0 b41f03f Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Apr 8 11:09:26 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' into maint-0.2.3 changes/geoip-apr2013 | 3 + src/config/geoip |20949 ++++++++++++------------------------------------- 2 files changed, 5143 insertions(+), 15809 deletions(-)

1 0