April 2013 - tor-commits - lists.torproject.org

[tor/release-0.2.4] Warn at configure time when time_t is unsigned
by arma＠torproject.org 11 Apr '13

11 Apr '13

commit 2f98bf5c9fac4dfd1bb07564ce08b13d1e330252 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 11 15:33:44 2013 -0400 Warn at configure time when time_t is unsigned Inspired by #8042. As far as I know, OpenVMS is the only place you're likely to hit an unsigned time_t these days, and Tor's VMS support is... lacking. Still worth letting people know about it, though. --- changes/warn-unsigned-time_t | 5 +++++ configure.ac | 4 ++++ 2 files changed, 9 insertions(+), 0 deletions(-) diff --git a/changes/warn-unsigned-time_t b/changes/warn-unsigned-time_t new file mode 100644 index 0000000..5f0c36d --- /dev/null +++ b/changes/warn-unsigned-time_t @@ -0,0 +1,5 @@ + o Build improvements: + - Warn if building on a platform with an unsigned time_t: there + are too many places where Tor currently assumes that time_t can + hold negative values. We'd like to fix them all, but probably + some will remain. diff --git a/configure.ac b/configure.ac index 864477b..21a83bc 100644 --- a/configure.ac +++ b/configure.ac @@ -972,6 +972,10 @@ AX_CHECK_SIGN([time_t], #endif ]) +if test "$ax_cv_decl_time_t_signed" = no; then + AC_MSG_WARN([You have an unsigned time_t; some things will probably break. Please tell the Tor developers about your interesting platform.]) +fi + AX_CHECK_SIGN([size_t], [ tor_cv_size_t_signed=yes ], [ tor_cv_size_t_signed=no ], [

1 0

[tor/release-0.2.4] Use fds, not stdio, to manage microdescriptor files
by arma＠torproject.org 11 Apr '13

11 Apr '13

commit d54ccbe9fd5c9ca6ff53ad7d0efc4d0e837062ab Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 11 14:37:44 2013 -0400 Use fds, not stdio, to manage microdescriptor files This is part of an attempt to mitigate 8031. --- src/or/microdesc.c | 40 ++++++++++++++++++++-------------------- 1 files changed, 20 insertions(+), 20 deletions(-) diff --git a/src/or/microdesc.c b/src/or/microdesc.c index b4d22c1..0a9724f 100644 --- a/src/or/microdesc.c +++ b/src/or/microdesc.c @@ -70,7 +70,7 @@ HT_GENERATE(microdesc_map, microdesc_t, node, * *annotation_len_out to the number of bytes written as * annotations. */ static ssize_t -dump_microdescriptor(FILE *f, microdesc_t *md, size_t *annotation_len_out) +dump_microdescriptor(int fd, microdesc_t *md, size_t *annotation_len_out) { ssize_t r = 0; size_t written; @@ -80,10 +80,10 @@ dump_microdescriptor(FILE *f, microdesc_t *md, size_t *annotation_len_out) char annotation[ISO_TIME_LEN+32]; format_iso_time(buf, md->last_listed); tor_snprintf(annotation, sizeof(annotation), "@last-listed %s\n", buf); - if (fputs(annotation, f) < 0) { + if (write_all(fd, annotation, strlen(annotation), 0) < 0) { log_warn(LD_DIR, "Couldn't write microdescriptor annotation: %s", - strerror(ferror(f))); + strerror(errno)); return -1; } r += strlen(annotation); @@ -92,13 +92,13 @@ dump_microdescriptor(FILE *f, microdesc_t *md, size_t *annotation_len_out) *annotation_len_out = 0; } - md->off = (off_t) ftell(f); - written = fwrite(md->body, 1, md->bodylen, f); + md->off = tor_fd_getpos(fd); + written = write_all(fd, md->body, md->bodylen, 0); if (written != md->bodylen) { log_warn(LD_DIR, "Couldn't dump microdescriptor (wrote %lu out of %lu): %s", (unsigned long)written, (unsigned long)md->bodylen, - strerror(ferror(f))); + strerror(errno)); return -1; } r += md->bodylen; @@ -197,15 +197,15 @@ microdescs_add_list_to_cache(microdesc_cache_t *cache, { smartlist_t *added; open_file_t *open_file = NULL; - FILE *f = NULL; + int fd = -1; // int n_added = 0; ssize_t size = 0; if (where == SAVED_NOWHERE && !no_save) { - f = start_writing_to_stdio_file(cache->journal_fname, - OPEN_FLAGS_APPEND|O_BINARY, - 0600, &open_file); - if (!f) { + fd = start_writing_to_file(cache->journal_fname, + OPEN_FLAGS_APPEND|O_BINARY, + 0600, &open_file); + if (fd < 0) { log_warn(LD_DIR, "Couldn't append to journal in %s: %s", cache->journal_fname, strerror(errno)); return NULL; @@ -227,9 +227,9 @@ microdescs_add_list_to_cache(microdesc_cache_t *cache, } /* Okay, it's a new one. */ - if (f) { + if (fd >= 0) { size_t annotation_len; - size = dump_microdescriptor(f, md, &annotation_len); + size = dump_microdescriptor(fd, md, &annotation_len); if (size < 0) { /* we already warned in dump_microdescriptor; */ abort_writing_to_file(open_file); @@ -251,7 +251,7 @@ microdescs_add_list_to_cache(microdesc_cache_t *cache, cache->total_len_seen += md->bodylen; } SMARTLIST_FOREACH_END(md); - if (f) + if (fd >= 0) finish_writing_to_file(open_file); /*XXX Check me.*/ { @@ -405,7 +405,7 @@ int microdesc_cache_rebuild(microdesc_cache_t *cache, int force) { open_file_t *open_file; - FILE *f; + int fd = -1; microdesc_t **mdp; smartlist_t *wrote; ssize_t size; @@ -429,10 +429,10 @@ microdesc_cache_rebuild(microdesc_cache_t *cache, int force) orig_size = (int)(cache->cache_content ? cache->cache_content->size : 0); orig_size += (int)cache->journal_len; - f = start_writing_to_stdio_file(cache->cache_fname, - OPEN_FLAGS_REPLACE|O_BINARY, - 0600, &open_file); - if (!f) + fd = start_writing_to_file(cache->cache_fname, + OPEN_FLAGS_REPLACE|O_BINARY, + 0600, &open_file); + if (fd < 0) return -1; wrote = smartlist_new(); @@ -443,7 +443,7 @@ microdesc_cache_rebuild(microdesc_cache_t *cache, int force) if (md->no_save) continue; - size = dump_microdescriptor(f, md, &annotation_len); + size = dump_microdescriptor(fd, md, &annotation_len); if (size < 0) { /* XXX handle errors from dump_microdescriptor() */ /* log? return -1? die? coredump the universe? */

1 0

[tor/release-0.2.4] Look at the right variable when warning about signed size_t.
by arma＠torproject.org 11 Apr '13

11 Apr '13

commit 051b1e8ac4114fb23904cdf8dead72d585904e0a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 11 16:29:06 2013 -0400 Look at the right variable when warning about signed size_t. In 81d69f4c2d8a451 (0.2.21-alpha) we added a compile-time check for a (totally broken) signed size_t. In 0e597471af (not yet released) I switched to a better configure-time check, which stored its output in a different variable. I didn't change the code which looked at the output, however. This bug is not in any released version of Tor, and would not affect anybody with a working Tor. --- configure.ac | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/configure.ac b/configure.ac index 864477b..4bc0db3 100644 --- a/configure.ac +++ b/configure.ac @@ -980,7 +980,7 @@ AX_CHECK_SIGN([size_t], #endif ]) -if test "$tor_cv_size_t_signed" = yes; then +if test "$ax_cv_decl_size_t_signed" = yes; then AC_MSG_ERROR([You have a signed size_t; that's grossly nonconformant.]) fi

1 0

[tor/release-0.2.4] Fix option names in tor-fw-helper manpage
by arma＠torproject.org 11 Apr '13

11 Apr '13

commit 8c211c3cdae1c6cb0f2d004f8dfaf15569b7501a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 11 17:57:27 2013 -0400 Fix option names in tor-fw-helper manpage fix for bug 7768 --- changes/bug7768 | 3 +++ doc/tor-fw-helper.1.txt | 10 +++++----- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/changes/bug7768 b/changes/bug7768 new file mode 100644 index 0000000..f523b5b --- /dev/null +++ b/changes/bug7768 @@ -0,0 +1,3 @@ + o Documentation fixes: + - Update tor-fw-helper.1.txt to describe its options with their + correct names. Fixes bug 7768. diff --git a/doc/tor-fw-helper.1.txt b/doc/tor-fw-helper.1.txt index cf769d9..f51ffc4 100644 --- a/doc/tor-fw-helper.1.txt +++ b/doc/tor-fw-helper.1.txt @@ -15,8 +15,7 @@ tor-fw-helper - Manage upstream firewall/NAT devices SYNOPSIS -------- **tor-fw-helper** [-h|--help] [-T|--test] [-v|--verbose] [-g|--fetch-public-ip] - -i|--internal-or-port __TCP port__ [-e|--external-or-port _TCP port_] - [-d|--internal-dir-port _TCP port_] [-p|--external-dir-port _TCP port_] + [-p __external port__:__internal_port__] DESCRIPTION ----------- @@ -31,7 +30,7 @@ OPTIONS **-h** or **--help**:: Display help text and exit. -**-v**:: +**-v** or **--verbose**:: Display verbose output. **-T** or **--test**:: @@ -41,8 +40,9 @@ OPTIONS **-g** or **--fetch-public-ip**:: Fetch the the public ip address for each supported NAT helper method. -**-p** or **--forward-port** __external_port__:__internal_port__:: - Forward external_port to internal_port. +**-p** or **--port** __external_port__:__internal_port__:: + Forward external_port to internal_port. This option can appear + more than once. BUGS ----

1 0

[tor/release-0.2.4] Track TLS overhead: diagnostic for bug 7707
by arma＠torproject.org 11 Apr '13

11 Apr '13

commit 452cfaacfc6e6b4313d2170c29e18d6399038999 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 11 22:06:07 2013 -0400 Track TLS overhead: diagnostic for bug 7707 --- changes/bug7707_diagnostic | 5 +++++ src/common/tortls.c | 25 +++++++++++++++++++++++++ src/common/tortls.h | 2 ++ src/or/status.c | 6 ++++++ 4 files changed, 38 insertions(+), 0 deletions(-) diff --git a/changes/bug7707_diagnostic b/changes/bug7707_diagnostic new file mode 100644 index 0000000..0c3138e --- /dev/null +++ b/changes/bug7707_diagnostic @@ -0,0 +1,5 @@ + o Minor features: + - Add another diagnostic to the heartbeat message: track and log + overhead that TLS is adding to the data we write. If this is + high, we are sending too little data to SSL_write at a time. + Diagnostic for bug 7707. diff --git a/src/common/tortls.c b/src/common/tortls.c index a08910b..b7e5bc1 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1997,6 +1997,10 @@ tor_tls_free(tor_tls_t *tls) if (!tls) return; tor_assert(tls->ssl); + { + size_t r,w; + tor_tls_get_n_raw_bytes(tls,&r,&w); /* ensure written_by_tls is updated */ + } #ifdef SSL_set_tlsext_host_name SSL_set_tlsext_host_name(tls->ssl, NULL); #endif @@ -2048,6 +2052,13 @@ tor_tls_read(tor_tls_t *tls, char *cp, size_t len) } } +/** Total number of bytes that we've used TLS to send. Used to track TLS + * overhead. */ +static uint64_t total_bytes_written_over_tls = 0; +/** Total number of bytes that TLS has put on the network for us. Used to + * track TLS overhead. */ +static uint64_t total_bytes_written_by_tls = 0; + /** Underlying function for TLS writing. Write up to n * characters from cp onto tls. On success, returns the * number of characters written. On failure, returns TOR_TLS_ERROR, @@ -2074,6 +2085,7 @@ tor_tls_write(tor_tls_t *tls, const char *cp, size_t n) r = SSL_write(tls->ssl, cp, (int)n); err = tor_tls_get_error(tls, r, 0, "writing", LOG_INFO, LD_NET); if (err == TOR_TLS_DONE) { + total_bytes_written_over_tls += r; return r; } if (err == TOR_TLS_WANTWRITE || err == TOR_TLS_WANTREAD) { @@ -2563,10 +2575,23 @@ tor_tls_get_n_raw_bytes(tor_tls_t *tls, size_t *n_read, size_t *n_written) "r=%lu, last_read=%lu, w=%lu, last_written=%lu", r, tls->last_read_count, w, tls->last_write_count); } + total_bytes_written_by_tls += *n_written; tls->last_read_count = r; tls->last_write_count = w; } +/** Return a ratio of the bytes that TLS has sent to the bytes that we've told + * it to send. Used to track whether our TLS records are getting too tiny. */ +double +tls_get_write_overhead_ratio(void) +{ + if (total_bytes_written_over_tls == 0) + return 1.0; + + return U64_TO_DBL(total_bytes_written_by_tls) / + U64_TO_DBL(total_bytes_written_over_tls); +} + /** Implement check_no_tls_errors: If there are any pending OpenSSL * errors, log an error message. */ void diff --git a/src/common/tortls.h b/src/common/tortls.h index 1ae6344..49c488b 100644 --- a/src/common/tortls.h +++ b/src/common/tortls.h @@ -95,6 +95,8 @@ void tor_tls_get_buffer_sizes(tor_tls_t *tls, size_t *rbuf_capacity, size_t *rbuf_bytes, size_t *wbuf_capacity, size_t *wbuf_bytes); +double tls_get_write_overhead_ratio(void); + int tor_tls_used_v1_handshake(tor_tls_t *tls); int tor_tls_received_v3_certificate(tor_tls_t *tls); int tor_tls_get_num_server_handshakes(tor_tls_t *tls); diff --git a/src/or/status.c b/src/or/status.c index 126167d..e44de63 100644 --- a/src/or/status.c +++ b/src/or/status.c @@ -85,6 +85,7 @@ log_heartbeat(time_t now) char *bw_rcvd = NULL; char *uptime = NULL; const routerinfo_t *me; + double r = tls_get_write_overhead_ratio(); const or_options_t *options = get_options(); (void)now; @@ -112,6 +113,11 @@ log_heartbeat(time_t now) 100*(U64_TO_DBL(stats_n_data_bytes_packaged) / U64_TO_DBL(stats_n_data_cells_packaged*RELAY_PAYLOAD_SIZE)) ); + if (r > 1.0) { + double overhead = ( r - 1.0 ) * 100.0; + log_notice(LD_HEARTBEAT, "TLS write overhead: %.f%%", overhead); + } + tor_free(uptime); tor_free(bw_sent); tor_free(bw_rcvd);

1 0

[tor/release-0.2.4] Don't warn about not sending a socks reply if we get a write error
by arma＠torproject.org 11 Apr '13

11 Apr '13

commit 16f2e4aa8ce76387c19687dd0c78c97929a852d6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 12 17:36:09 2013 -0400 Don't warn about not sending a socks reply if we get a write error If we get a write error on a SOCKS connection, we can't send a SOCKS reply, now can we? This bug has been here since 36baf7219, where we added the "hey, I'm closing an AP connection but I haven't finished the socks handshake!" message. It's bug 8427. --- changes/bug8427 | 5 +++++ src/or/connection.c | 4 ++++ 2 files changed, 9 insertions(+), 0 deletions(-) diff --git a/changes/bug8427 b/changes/bug8427 new file mode 100644 index 0000000..22b003f --- /dev/null +++ b/changes/bug8427 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - If we encounter a write failure on a SOCKS connection before we + finish our SOCKS handshake, don't warn that we closed the + connection before we could send a SOCKS reply. Fixes bug 8427; + bugfix on 0.1.0.1-rc. diff --git a/src/or/connection.c b/src/or/connection.c index eac9c4f..75c1656 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -3286,6 +3286,10 @@ connection_handle_write_impl(connection_t *conn, int force) if (result < 0) { if (CONN_IS_EDGE(conn)) connection_edge_end_errno(TO_EDGE_CONN(conn)); + if (conn->type == CONN_TYPE_AP) { + /* writing failed; we couldn't send a SOCKS reply if we wanted to */ + TO_ENTRY_CONN(conn)->socks_request->has_finished = 1; + } connection_close_immediate(conn); /* Don't flush; connection is dead. */ connection_mark_for_close(conn);

1 0

[tor/release-0.2.4] Simplify the logic of circuit_build_times_get_initial_timeout.
by arma＠torproject.org 11 Apr '13

11 Apr '13

commit 7543fb61e34e9235c6c330270d0c370c64c3322a Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 13 09:11:31 2013 -0400 Simplify the logic of circuit_build_times_get_initial_timeout. --- src/or/circuitbuild.c | 23 ++++++++--------------- 1 files changed, 8 insertions(+), 15 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 2436246..fb8240b 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -540,23 +540,16 @@ circuit_build_times_get_initial_timeout(void) * Check if we have LearnCircuitBuildTimeout, and if we don't, * always use CircuitBuildTimeout, no questions asked. */ - /*XXXX025 this logic could be cleaned up a lot. */ - if (get_options()->LearnCircuitBuildTimeout) { - if (!unit_tests && get_options()->CircuitBuildTimeout) { - timeout = get_options()->CircuitBuildTimeout*1000; - if (timeout < circuit_build_times_min_timeout()) { - log_warn(LD_CIRC, "Config CircuitBuildTimeout too low. Setting to %ds", - circuit_build_times_min_timeout()/1000); - timeout = circuit_build_times_min_timeout(); - } - } else { - timeout = circuit_build_times_initial_timeout(); + if (!unit_tests && get_options()->CircuitBuildTimeout) { + timeout = get_options()->CircuitBuildTimeout*1000; + if (get_options()->LearnCircuitBuildTimeout && + timeout < circuit_build_times_min_timeout()) { + log_warn(LD_CIRC, "Config CircuitBuildTimeout too low. Setting to %ds", + circuit_build_times_min_timeout()/1000); + timeout = circuit_build_times_min_timeout(); } } else { - if (get_options()->CircuitBuildTimeout > 0) - timeout = get_options()->CircuitBuildTimeout*1000; - else - timeout = circuit_build_times_initial_timeout(); + timeout = circuit_build_times_initial_timeout(); } return timeout;

1 0

[tor/release-0.2.4] On END_REASON_EXITPOLICY, mark circuit as unusable for that address.
by arma＠torproject.org 11 Apr '13

11 Apr '13

commit 2b22c0aeef6e71d56b12411d10484aaece769178 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 11 23:37:47 2013 -0400 On END_REASON_EXITPOLICY, mark circuit as unusable for that address. Also, don't call the exit node 'reject *' unless our decision to pick that node was based on a non-summarized version of that node's exit policy. rransom and arma came up with the ideas for this fix. Fix for 7582; the summary-related part is a bugfix on 0.2.3.2-alpha. --- changes/bug7582 | 9 ++++++ src/or/circuituse.c | 13 +++++++-- src/or/nodelist.c | 18 +++++++++++++ src/or/nodelist.h | 1 + src/or/or.h | 4 +++ src/or/policies.c | 18 +++++++++++++ src/or/policies.h | 2 + src/or/relay.c | 68 ++++++++++++++++++++++++++++++++++++++++---------- 8 files changed, 116 insertions(+), 17 deletions(-) diff --git a/changes/bug7582 b/changes/bug7582 new file mode 100644 index 0000000..f3b0635 --- /dev/null +++ b/changes/bug7582 @@ -0,0 +1,9 @@ + o Major bugfixes: + + - When an exit node tells us that it is rejecting because of its + exit policy a stream we expected it to accept (because of its exit + policy), do not mark the node as useless for exiting if our + expectation was only based on an exit policy summary. Instead, + mark the circuit as unsuitable for that particular address. Fixes + part of bug 7582; bugfix on 0.2.3.2-alpha. + diff --git a/src/or/circuituse.c b/src/or/circuituse.c index 51d8716..6b5ca90 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -105,6 +105,8 @@ circuit_is_acceptable(const origin_circuit_t *origin_circ, return 0; if (purpose == CIRCUIT_PURPOSE_C_GENERAL) { + tor_addr_t addr; + const int family = tor_addr_parse(&addr, conn->socks_request->address); if (!exitnode && !build_state->onehop_tunnel) { log_debug(LD_CIRC,"Not considering circuit with unknown router."); return 0; /* this circuit is screwed and doesn't know it yet, @@ -125,9 +127,7 @@ circuit_is_acceptable(const origin_circuit_t *origin_circ, return 0; /* this is a circuit to somewhere else */ if (tor_digest_is_zero(digest)) { /* we don't know the digest; have to compare addr:port */ - tor_addr_t addr; - int r = tor_addr_parse(&addr, conn->socks_request->address); - if (r < 0 || + if (family < 0 || !tor_addr_eq(&build_state->chosen_exit->addr, &addr) || build_state->chosen_exit->port != conn->socks_request->port) return 0; @@ -139,6 +139,13 @@ circuit_is_acceptable(const origin_circuit_t *origin_circ, return 0; } } + if (origin_circ->prepend_policy && family != -1) { + int r = compare_tor_addr_to_addr_policy(&addr, + conn->socks_request->port, + origin_circ->prepend_policy); + if (r == ADDR_POLICY_REJECTED) + return 0; + } if (exitnode && !connection_ap_can_use_exit(conn, exitnode)) { /* can't exit from this router */ return 0; diff --git a/src/or/nodelist.c b/src/or/nodelist.c index ee1bc39..5f3b843 100644 --- a/src/or/nodelist.c +++ b/src/or/nodelist.c @@ -688,6 +688,24 @@ node_exit_policy_rejects_all(const node_t *node) return 1; } +/** Return true iff the exit policy for node is such that we can treat + * rejecting an address of type family unexpectedly as a sign of that + * node's failure. */ +int +node_exit_policy_is_exact(const node_t *node, sa_family_t family) +{ + if (family == AF_UNSPEC) { + return 1; /* Rejecting an address but not telling us what address + * is a bad sign. */ + } else if (family == AF_INET) { + return node->ri != NULL; + } else if (family == AF_INET6) { + return 0; + } + tor_fragile_assert(); + return 1; +} + /** Return list of tor_addr_port_t with all OR ports (in the sense IP * addr + TCP port) for node. Caller must free all elements * using tor_free() and free the list using smartlist_free(). diff --git a/src/or/nodelist.h b/src/or/nodelist.h index 65cf0d0..8a4665a 100644 --- a/src/or/nodelist.h +++ b/src/or/nodelist.h @@ -41,6 +41,7 @@ int node_get_purpose(const node_t *node); (node_get_purpose((node)) == ROUTER_PURPOSE_BRIDGE) int node_is_me(const node_t *node); int node_exit_policy_rejects_all(const node_t *node); +int node_exit_policy_is_exact(const node_t *node, sa_family_t family); smartlist_t *node_get_all_orports(const node_t *node); int node_allows_single_hop_exits(const node_t *node); const char *node_get_nickname(const node_t *node); diff --git a/src/or/or.h b/src/or/or.h index c7d2598..c893fba 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3059,6 +3059,10 @@ typedef struct origin_circuit_t { * ISO_STREAM. */ uint64_t associated_isolated_stream_global_id; /**@}*/ + /** A list of addr_policy_t for this circuit in particular. Used by + * adjust_exit_policy_from_exitpolicy_failure. + */ + smartlist_t *prepend_policy; } origin_circuit_t; struct onion_queue_t; diff --git a/src/or/policies.c b/src/or/policies.c index 9696b81..be4da55 100644 --- a/src/or/policies.c +++ b/src/or/policies.c @@ -837,6 +837,24 @@ append_exit_policy_string(smartlist_t **policy, const char *more) } } +/** Add "reject addr:*" to dest, creating the list as needed. */ +void +addr_policy_append_reject_addr(smartlist_t **dest, const tor_addr_t *addr) +{ + addr_policy_t p, *add; + memset(&p, 0, sizeof(p)); + p.policy_type = ADDR_POLICY_REJECT; + p.maskbits = tor_addr_family(addr) == AF_INET6 ? 128 : 32; + tor_addr_copy(&p.addr, addr); + p.prt_min = 1; + p.prt_max = 65535; + + add = addr_policy_get_canonical_entry(&p); + if (!*dest) + *dest = smartlist_new(); + smartlist_add(*dest, add); +} + /** Detect and excise "dead code" from the policy *dest. */ static void exit_policy_remove_redundancies(smartlist_t *dest) diff --git a/src/or/policies.h b/src/or/policies.h index da375c4..c0e7a9e 100644 --- a/src/or/policies.h +++ b/src/or/policies.h @@ -47,6 +47,8 @@ int policies_parse_exit_policy(config_line_t *cfg, smartlist_t **dest, int rejectprivate, const char *local_address, int add_default_policy); void policies_exit_policy_append_reject_star(smartlist_t **dest); +void addr_policy_append_reject_addr(smartlist_t **dest, + const tor_addr_t *addr); void policies_set_node_exitpolicy_to_reject_all(node_t *exitrouter); int exit_policy_is_general_exit(smartlist_t *policy); int policy_is_reject_star(const smartlist_t *policy, sa_family_t family); diff --git a/src/or/relay.c b/src/or/relay.c index 9ff9e1e..a4f402d 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -53,6 +53,10 @@ static int circuit_resume_edge_reading_helper(edge_connection_t *conn, static int circuit_consider_stop_edge_reading(circuit_t *circ, crypt_path_t *layer_hint); static int circuit_queue_streams_are_blocked(circuit_t *circ); +static void adjust_exit_policy_from_exitpolicy_failure(origin_circuit_t *circ, + entry_connection_t *conn, + node_t *node, + const tor_addr_t *addr); /** Stop reading on edge connections when we have this many cells * waiting on the appropriate queue. */ @@ -710,7 +714,6 @@ connection_ap_process_end_not_open( relay_header_t *rh, cell_t *cell, origin_circuit_t *circ, entry_connection_t *conn, crypt_path_t *layer_hint) { - struct in_addr in; node_t *exitrouter; int reason = *(cell->payload+RELAY_HEADER_SIZE); int control_reason; @@ -753,10 +756,10 @@ connection_ap_process_end_not_open( stream_end_reason_to_string(reason)); exitrouter = node_get_mutable_by_id(chosen_exit_digest); switch (reason) { - case END_STREAM_REASON_EXITPOLICY: + case END_STREAM_REASON_EXITPOLICY: { + tor_addr_t addr; + tor_addr_make_unspec(&addr); if (rh->length >= 5) { - tor_addr_t addr; - int ttl = -1; tor_addr_make_unspec(&addr); if (rh->length == 5 || rh->length == 9) { @@ -808,16 +811,11 @@ connection_ap_process_end_not_open( } } /* check if he *ought* to have allowed it */ - if (exitrouter && - (rh->length < 5 || - (tor_inet_aton(conn->socks_request->address, &in) && - !conn->chosen_exit_name))) { - log_info(LD_APP, - "Exitrouter %s seems to be more restrictive than its exit " - "policy. Not using this router as exit for now.", - node_describe(exitrouter)); - policies_set_node_exitpolicy_to_reject_all(exitrouter); - } + + adjust_exit_policy_from_exitpolicy_failure(circ, + conn, + exitrouter, + &addr); if (conn->chosen_exit_optional || conn->chosen_exit_retries) { @@ -837,6 +835,7 @@ connection_ap_process_end_not_open( return 0; /* else, conn will get closed below */ break; + } case END_STREAM_REASON_CONNECTREFUSED: if (!conn->chosen_exit_optional) break; /* break means it'll close, below */ @@ -901,6 +900,47 @@ connection_ap_process_end_not_open( return 0; } +/** Called when we have gotten an END_REASON_EXITPOLICY failure on circ + * for conn, while attempting to connect via node. If the node + * told us which address it rejected, then addr is that address; + * otherwise it is AF_UNSPEC. + * + * If we are sure the node should have allowed this address, mark the node as + * having a reject *:* exit policy. Otherwise, mark the circuit as unusable + * for this particular address. + **/ +static void +adjust_exit_policy_from_exitpolicy_failure(origin_circuit_t *circ, + entry_connection_t *conn, + node_t *node, + const tor_addr_t *addr) +{ + int make_reject_all = 0; + const sa_family_t family = tor_addr_family(addr); + + if (node) { + tor_addr_t tmp; + int asked_for_family = tor_addr_parse(&tmp, conn->socks_request->address); + if (family == AF_UNSPEC) { + make_reject_all = 1; + } else if (node_exit_policy_is_exact(node, family) && + asked_for_family != -1 && !conn->chosen_exit_name) { + make_reject_all = 1; + } + + if (make_reject_all) { + log_info(LD_APP, + "Exitrouter %s seems to be more restrictive than its exit " + "policy. Not using this router as exit for now.", + node_describe(node)); + policies_set_node_exitpolicy_to_reject_all(node); + } + } + + if (family != AF_UNSPEC) + addr_policy_append_reject_addr(&circ->prepend_policy, addr); +} + /** Helper: change the socks_request->address field on conn to the * dotted-quad representation of new_addr, * and send an appropriate REMAP event. */

1 0

[tor/release-0.2.4] Fix the warning about LearnCircuitBuildTimeout && !CircuitBuildTimeout
by arma＠torproject.org 11 Apr '13

11 Apr '13

commit b9a8f8c17ce11dd867e0afec7cbb65c55a3d7e8c Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 13 09:17:43 2013 -0400 Fix the warning about LearnCircuitBuildTimeout && !CircuitBuildTimeout This is for bug 6304. Add a changes file too --- changes/bug6304 | 4 ++++ src/or/config.c | 12 ++++++++---- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/changes/bug6304 b/changes/bug6304 new file mode 100644 index 0000000..445560a --- /dev/null +++ b/changes/bug6304 @@ -0,0 +1,4 @@ + o Minor bugfixes: + - Behave correctly when the user disables LearnCircuitBuildTimeout + but doesn't tell us what they would like the timeout to be. Fixes + bug 6304; bugfix on 0.2.2.14-alpha. diff --git a/src/or/config.c b/src/or/config.c index 90a5dfb..b04a874 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -3761,15 +3761,19 @@ options_validate(or_options_t *old_options, or_options_t *options, options->LearnCircuitBuildTimeout = 0; } - if (!(options->LearnCircuitBuildTimeout) && - options->CircuitBuildTimeout < RECOMMENDED_MIN_CIRCUIT_BUILD_TIMEOUT) { + if (!options->LearnCircuitBuildTimeout && options->CircuitBuildTimeout && + options->CircuitBuildTimeout < RECOMMENDED_MIN_CIRCUIT_BUILD_TIMEOUT) { log_warn(LD_CONFIG, - "CircuitBuildTimeout is shorter (%d seconds) than recommended " - "(%d seconds), and LearnCircuitBuildTimeout is disabled. " + "CircuitBuildTimeout is shorter (%d seconds) than the recommended " + "minimum (%d seconds), and LearnCircuitBuildTimeout is disabled. " "If tor isn't working, raise this value or enable " "LearnCircuitBuildTimeout.", options->CircuitBuildTimeout, RECOMMENDED_MIN_CIRCUIT_BUILD_TIMEOUT ); + } else if (!options->LearnCircuitBuildTimeout && + !options->CircuitBuildTimeout) { + log_notice(LD_CONFIG, "You disabled LearnCircuitBuildTimeout, but didn't " + "a CircuitBuildTimeout. I'll pick a plausible default."); } if (options->MaxCircuitDirtiness < MIN_MAX_CIRCUIT_DIRTINESS) {

1 0

[tor/release-0.2.4] Apply ClientDNSRejectInternalAddresses to IPv6 in RESOLVED cells
by arma＠torproject.org 11 Apr '13

11 Apr '13

commit 1b28f366b8796a9e6d27af74146dbc7836100263 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 14 11:19:08 2013 -0400 Apply ClientDNSRejectInternalAddresses to IPv6 in RESOLVED cells Fixes bug 8475; bugfix on 0.2.0.7-alpha. --- changes/bug8475 | 4 ++++ src/or/relay.c | 13 ++++++++----- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/changes/bug8475 b/changes/bug8475 new file mode 100644 index 0000000..eb8debe --- /dev/null +++ b/changes/bug8475 @@ -0,0 +1,4 @@ + o Major bugfixes: + - If configured via ClientDNSRejectInternalAddresses not to report + DNS queries which have resolved to internal addresses, apply that + rule to IPv6 as well. Fixes bug 8475; bugfix on 0.2.0.7-alpha. diff --git a/src/or/relay.c b/src/or/relay.c index a17c333..e69eade 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -969,12 +969,15 @@ connection_edge_process_relay_cell_not_open( 2+answer_len)); else ttl = -1; - if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) { - uint32_t addr = ntohl(get_uint32(cell->payload+RELAY_HEADER_SIZE+2)); - if (get_options()->ClientDNSRejectInternalAddresses && - is_internal_IP(addr, 0)) { + if (answer_type == RESOLVED_TYPE_IPV4 || + answer_type == RESOLVED_TYPE_IPV6) { + tor_addr_t addr; + if (decode_address_from_payload(&addr, cell->payload+RELAY_HEADER_SIZE, + rh->length) && + tor_addr_is_internal(&addr, 0) && + get_options()->ClientDNSRejectInternalAddresses) { log_info(LD_APP,"Got a resolve with answer %s. Rejecting.", - fmt_addr32(addr)); + fmt_addr(&addr)); connection_ap_handshake_socks_resolved(entry_conn, RESOLVED_TYPE_ERROR_TRANSIENT, 0, NULL, 0, TIME_MAX);

1 0