June 2013 - tor-commits - lists.torproject.org

[tor-ramdisk/master] Switch from sh to bash
by blueness＠torproject.org 16 Jun '13

16 Jun '13

commit 1c0022ce326261a5bcddaa8f3079e436faf84fef Author: Anthony G. Basile <blueness(a)gentoo.org> Date: Sun Jun 16 09:59:23 2013 -0400 Switch from sh to bash --- build-arm.sh | 34 +++++++++++++++++----------------- build-mips.sh | 40 ++++++++++++++++++++-------------------- build.sh | 50 +++++++++++++++++++++++++------------------------- 3 files changed, 62 insertions(+), 62 deletions(-) diff --git a/build-arm.sh b/build-arm.sh index 43aa9a7..20c37f6 100755 --- a/build-arm.sh +++ b/build-arm.sh @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash RELEASE=ar7161.testing @@ -11,8 +11,8 @@ OPENSSH=openssh-6.1p1 set_start() { - [ "x$CLEAN" = "xyes" ] && rm -rf release - [ "x$DEBUG" = "x" ] && unset DEBUG + [[ "x$CLEAN" = "xyes" ]] && rm -rf release + [[ "x$DEBUG" = "x" ]] && unset DEBUG } ################################################################################ @@ -32,12 +32,12 @@ get_configs() mkdir -p configs cd configs - if [ "x$DEBUG" = "xyes" ] ; then - [ ! -f $BUSYBOX.debug.config ] && echo "Missing busybox config" && exit + if [[ "x$DEBUG" = "xyes" ]] ; then + [[ ! -f $BUSYBOX.debug.config ]] && echo "Missing busybox config" && exit else - [ ! -f $BUSYBOX.config ] && echo "Missing busybox config" && exit + [[ ! -f $BUSYBOX.config ]] && echo "Missing busybox config" && exit fi - [ ! -f setup ] && echo "Missing setup script" && exit + [[ ! -f setup ]] && echo "Missing setup script" && exit } ################################################################################ @@ -48,10 +48,10 @@ get_sources() mkdir -p sources cd sources - [ ! -f $BUSYBOX.tar.bz2 ] && wget http://www.busybox.net/downloads/$BUSYBOX.tar.bz2 - [ ! -f $TOR.tar.gz ] && wget http://www.torproject.org/dist/$TOR.tar.gz - [ ! -f $NTPD.tar.gz ] && wget ftp://ftp.openbsd.org/pub/OpenBSD/OpenNTPD/$NTPD.tar.gz - [ ! -f $OPENSSH.tar.gz ] && wget ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/$OPENSSH.tar.gz + [[ ! -f $BUSYBOX.tar.bz2 ]] && wget http://www.busybox.net/downloads/$BUSYBOX.tar.bz2 + [[ ! -f $TOR.tar.gz ]] && wget http://www.torproject.org/dist/$TOR.tar.gz + [[ ! -f $NTPD.tar.gz ]] && wget ftp://ftp.openbsd.org/pub/OpenBSD/OpenNTPD/$NTPD.tar.gz + [[ ! -f $OPENSSH.tar.gz ]] && wget ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/$OPENSSH.tar.gz } ################################################################################ @@ -59,11 +59,11 @@ get_sources() build_busybox() { cd $WORKING - [ -f $BUSYBOX/busybox ] && return 0 + [[ -f $BUSYBOX/busybox ]] && return 0 tar jxvf $WORKING/../sources/$BUSYBOX.tar.bz2 cd $BUSYBOX for i in $WORKING/../configs/busybox-*.patch; do patch -p 1 < $i ; done - if [ "x$DEBUG" = "xyes" ] ; then + if [[ "x$DEBUG" = "xyes" ]] ; then cp $WORKING/../configs/$BUSYBOX.debug.config .config else cp $WORKING/../configs/$BUSYBOX.config .config @@ -77,7 +77,7 @@ build_busybox() build_tor() { cd $WORKING - [ -f $TOR/src/or/tor ] && return 0 + [[ -f $TOR/src/or/tor ]] && return 0 tar zxvf $WORKING/../sources/$TOR.tar.gz cd $TOR for i in $WORKING/../configs/tor-*.patch; do patch -p 1 < $i ; done @@ -91,7 +91,7 @@ build_tor() build_ntpd() { cd $WORKING - [ -f $NTPD/ntpd ] && return 0 + [[ -f $NTPD/ntpd ]] && return 0 tar zxvf $WORKING/../sources/$NTPD.tar.gz cd $NTPD sed -i '/NTPD_USER/s:_ntp:ntp:' ntpd.h @@ -105,7 +105,7 @@ build_ntpd() build_scp() { cd $WORKING - [ -f $OPENSSH/ssh -a -f $OPENSSH/scp ] && return 0 + [[ -f $OPENSSH/ssh && -f $OPENSSH/scp ]] && return 0 tar zxvf $WORKING/../sources/$OPENSSH.tar.gz cd $OPENSSH ./configure --prefix= @@ -238,7 +238,7 @@ EOF cat << EOF > group root:x:0: tor:x:500: -ntp:x:500: +ntp:x:501: EOF cat << EOF > gshadow diff --git a/build-mips.sh b/build-mips.sh index b28344b..274dbe4 100755 --- a/build-mips.sh +++ b/build-mips.sh @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash RELEASE=ar7161.testing @@ -11,8 +11,8 @@ OPENSSH=openssh-6.1p1 set_start() { - [ "x$CLEAN" = "xyes" ] && rm -rf release - [ "x$DEBUG" = "x" ] && unset DEBUG + [[ "x$CLEAN" = "xyes" ]] && rm -rf release + [[ "x$DEBUG" = "x" ]] && unset DEBUG } ################################################################################ @@ -32,12 +32,12 @@ get_configs() mkdir -p configs cd configs - if [ "x$DEBUG" = "xyes" ] ; then - [ ! -f $BUSYBOX.debug.config ] && echo "Missing busybox config" && exit + if [[ "x$DEBUG" = "xyes" ]] ; then + [[ ! -f $BUSYBOX.debug.config ]] && echo "Missing busybox config" && exit else - [ ! -f $BUSYBOX.config ] && echo "Missing busybox config" && exit + [[ ! -f $BUSYBOX.config ]] && echo "Missing busybox config" && exit fi - [ ! -f setup ] && echo "Missing setup script" && exit + [[ ! -f setup ]] && echo "Missing setup script" && exit } ################################################################################ @@ -48,10 +48,10 @@ get_sources() mkdir -p sources cd sources - [ ! -f $BUSYBOX.tar.bz2 ] && wget http://www.busybox.net/downloads/$BUSYBOX.tar.bz2 - [ ! -f $TOR.tar.gz ] && wget http://www.torproject.org/dist/$TOR.tar.gz - [ ! -f $NTPD.tar.gz ] && wget ftp://ftp.openbsd.org/pub/OpenBSD/OpenNTPD/$NTPD.tar.gz - [ ! -f $OPENSSH.tar.gz ] && wget ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/$OPENSSH.tar.gz + [[ ! -f $BUSYBOX.tar.bz2 ]] && wget http://www.busybox.net/downloads/$BUSYBOX.tar.bz2 + [[ ! -f $TOR.tar.gz ]] && wget http://www.torproject.org/dist/$TOR.tar.gz + [[ ! -f $NTPD.tar.gz ]] && wget ftp://ftp.openbsd.org/pub/OpenBSD/OpenNTPD/$NTPD.tar.gz + [[ ! -f $OPENSSH.tar.gz ]] && wget ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/$OPENSSH.tar.gz } ################################################################################ @@ -59,11 +59,11 @@ get_sources() build_busybox() { cd $WORKING - [ -f $BUSYBOX/busybox ] && return 0 + [[ -f $BUSYBOX/busybox ]] && return 0 tar jxvf $WORKING/../sources/$BUSYBOX.tar.bz2 cd $BUSYBOX for i in $WORKING/../configs/busybox-*.patch; do patch -p 1 < $i ; done - if [ "x$DEBUG" = "xyes" ] ; then + if [[ "x$DEBUG" = "xyes" ]] ; then cp $WORKING/../configs/$BUSYBOX.debug.config .config else cp $WORKING/../configs/$BUSYBOX.config .config @@ -77,7 +77,7 @@ build_busybox() build_tor() { cd $WORKING - [ -f $TOR/src/or/tor ] && return 0 + [[ -f $TOR/src/or/tor ]] && return 0 tar zxvf $WORKING/../sources/$TOR.tar.gz cd $TOR for i in $WORKING/../configs/tor-*.patch; do patch -p 1 < $i ; done @@ -91,7 +91,7 @@ build_tor() build_ntpd() { cd $WORKING - [ -f $NTPD/ntpd ] && return 0 + [[ -f $NTPD/ntpd ]] && return 0 tar zxvf $WORKING/../sources/$NTPD.tar.gz cd $NTPD sed -i '/NTPD_USER/s:_ntp:ntp:' ntpd.h @@ -105,7 +105,7 @@ build_ntpd() build_scp() { cd $WORKING - [ -f $OPENSSH/ssh -a -f $OPENSSH/scp ] && return 0 + [[ -f $OPENSSH/ssh && -f $OPENSSH/scp ]] && return 0 tar zxvf $WORKING/../sources/$OPENSSH.tar.gz cd $OPENSSH ./configure --prefix= @@ -150,7 +150,7 @@ populate_bin() get_needed() { - local A=$(readelf -a $1 | grep NEEDED | sed -e 's/^.*library://' -e 's/\[//' -e 's/\]//') + local A=$(readelf && $1 | grep NEEDED | sed -e 's/^.*library://' -e 's/\[[//' -e 's/\]]//') echo $A } @@ -160,8 +160,8 @@ populate_lib() for i in busybox ntpd ssh tor; do A=$(get_needed ../bin/$i) for j in $A ; do - [ -e /lib/$j ] && cp -f /lib/$j . - [ -e /usr/lib/$j ] && cp -f /usr/lib/$j . + [[ -e /lib/$j ]] && cp -f /lib/$j . + [[ -e /usr/lib/$j ]] && cp -f /usr/lib/$j . done done @@ -247,7 +247,7 @@ EOF cat << EOF > group root:x:0: tor:x:500: -ntp:x:500: +ntp:x:501: EOF cat << EOF > gshadow diff --git a/build.sh b/build.sh index c1128f5..7f2a2f3 100755 --- a/build.sh +++ b/build.sh @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash BUSYBOX=busybox-1.20.2 TOR=tor-0.2.3.25 @@ -13,23 +13,23 @@ PATCHES=hardened-patches-${KVERSION}-1.extras set_start() { - [ "x$CLEAN" = "xyes" ] && rm -rf release - [ "x$DEBUG" = "x" ] && unset DEBUG + [[ "x$CLEAN" = "xyes" ]] && rm -rf release + [[ "x$DEBUG" = "x" ]] && unset DEBUG } ################################################################################ set_target() { - [ "x$TARGET" = "x" ] && TARGET="x86" - [ "x$TARGET" != "xx86" -a "x$TARGET" != "xx86_64" ] && echo "Unknown ARCH" && exit + [[ "x$TARGET" = "x" ]] && TARGET="x86" + [[ "x$TARGET" != "xx86" && "x$TARGET" != "xx86_64" ]] && echo "Unknown ARCH" && exit } ################################################################################ set_release() { - [ "x$RELEASE" = "x" ] && RELEASE="testing" + [[ "x$RELEASE" = "x" ]] && RELEASE="testing" } ################################################################################ @@ -49,13 +49,13 @@ get_configs() mkdir -p configs cd configs - if [ "x$DEBUG" = "xyes" ] ; then - [ ! -f $BUSYBOX.debug.config ] && echo "Missing busybox config" && exit + if [[ "x$DEBUG" = "xyes" ]] ; then + [[ ! -f $BUSYBOX.debug.config ]] && echo "Missing busybox config" && exit else - [ ! -f $BUSYBOX.config ] && echo "Missing busybox config" && exit + [[ ! -f $BUSYBOX.config ]] && echo "Missing busybox config" && exit fi - [ ! -f setup ] && echo "Missing setup script" && exit - [ ! -f kernel-$KVERSION.$TARGET.config ] && echo "Missing kernel config" && exit + [[ ! -f setup ]] && echo "Missing setup script" && exit + [[ ! -f kernel-$KVERSION.$TARGET.config ]] && echo "Missing kernel config" && exit } ################################################################################ @@ -66,12 +66,12 @@ get_sources() mkdir -p sources cd sources - [ ! -f $BUSYBOX.tar.bz2 ] && wget http://www.busybox.net/downloads/$BUSYBOX.tar.bz2 - [ ! -f $TOR.tar.gz ] && wget http://www.torproject.org/dist/$TOR.tar.gz - [ ! -f $NTPD.tar.gz ] && wget ftp://ftp.openbsd.org/pub/OpenBSD/OpenNTPD/$NTPD.tar.gz - [ ! -f $LINUX.tar.bz2 ] && wget http://www.kernel.org/pub/linux/kernel/v3.x/$LINUX.tar.bz2 - [ ! -f $PATCHES.tar.bz2 ] && wget http://dev.gentoo.org/~blueness/hardened-sources/hardened-patches/$PATCHES.… - [ ! -f $OPENSSH.tar.gz ] && wget ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/$OPENSSH.tar.gz + [[ ! -f $BUSYBOX.tar.bz2 ]] && wget http://www.busybox.net/downloads/$BUSYBOX.tar.bz2 + [[ ! -f $TOR.tar.gz ]] && wget http://www.torproject.org/dist/$TOR.tar.gz + [[ ! -f $NTPD.tar.gz ]] && wget ftp://ftp.openbsd.org/pub/OpenBSD/OpenNTPD/$NTPD.tar.gz + [[ ! -f $LINUX.tar.bz2 ]] && wget http://www.kernel.org/pub/linux/kernel/v3.x/$LINUX.tar.bz2 + [[ ! -f $PATCHES.tar.bz2 ]] && wget http://dev.gentoo.org/~blueness/hardened-sources/hardened-patches/$PATCHES.… + [[ ! -f $OPENSSH.tar.gz ]] && wget ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/$OPENSSH.tar.gz } ################################################################################ @@ -79,11 +79,11 @@ get_sources() build_busybox() { cd $WORKING - [ -f $BUSYBOX/busybox ] && return 0 + [[ -f $BUSYBOX/busybox ]] && return 0 tar jxvf $WORKING/../sources/$BUSYBOX.tar.bz2 cd $BUSYBOX for i in $WORKING/../configs/busybox-*.patch; do patch -p 1 < $i ; done - if [ "x$DEBUG" = "xyes" ] ; then + if [[ "x$DEBUG" = "xyes" ]] ; then cp $WORKING/../configs/$BUSYBOX.debug.config .config else cp $WORKING/../configs/$BUSYBOX.config .config @@ -96,7 +96,7 @@ build_busybox() build_tor() { cd $WORKING - [ -f $TOR/src/or/tor ] && return 0 + [[ -f $TOR/src/or/tor ]] && return 0 tar zxvf $WORKING/../sources/$TOR.tar.gz cd $TOR for i in $WORKING/../configs/tor-*.patch; do patch -p 1 < $i ; done @@ -110,7 +110,7 @@ build_tor() build_ntpd() { cd $WORKING - [ -f $NTPD/ntpd ] && return 0 + [[ -f $NTPD/ntpd ]] && return 0 tar zxvf $WORKING/../sources/$NTPD.tar.gz cd $NTPD sed -i '/NTPD_USER/s:_ntp:ntp:' ntpd.h @@ -124,7 +124,7 @@ build_ntpd() build_scp() { cd $WORKING - [ -f $OPENSSH/ssh -a -f $OPENSSH/scp ] && return 0 + [[ -f $OPENSSH/ssh && -f $OPENSSH/scp ]] && return 0 tar zxvf $WORKING/../sources/$OPENSSH.tar.gz cd $OPENSSH ./configure --prefix= @@ -191,7 +191,7 @@ cat << EOF > fstab none /proc proc defaults 0 0 EOF -if [ "x$DEBUG" = "xyes" ] ; then +if [[ "x$DEBUG" = "xyes" ]] ; then cat << EOF > inittab ::sysinit:/etc/rcS tty1::respawn:/bin/setup @@ -338,7 +338,7 @@ finish_initramfs() compile_kernel() { cd $WORKING - [ -f $LINUX/arch/$TARGET/boot/bzImage ] && return 0 + [[ -f $LINUX/arch/$TARGET/boot/bzImage ]] && return 0 tar jxvf $WORKING/../sources/$LINUX.tar.bz2 tar jxvf $WORKING/../sources/$PATCHES.tar.bz2 cd $LINUX @@ -371,7 +371,7 @@ EOF mkisofs -R -b boot/grub/stage2_eltorito -no-emul-boot -boot-load-size 4 -boot-info-table -o tor.iso iso.tor - if [ "x$DEBUG" = "xyes" ] ; then + if [[ "x$DEBUG" = "xyes" ]] ; then mv tor.iso tor.uclibc.$TARGET.debug.$RELEASE.iso md5sum tor.uclibc.$TARGET.debug.$RELEASE.iso > tor.uclibc.$TARGET.debug.$RELEASE.iso.md5 else

1 0

r26218: {website} HS websites are also actual websites. changed to normal (website/trunk/docs/en)
by Moritz Bartl 16 Jun '13

16 Jun '13

Author: moritz Date: 2013-06-16 12:34:03 +0000 (Sun, 16 Jun 2013) New Revision: 26218 Modified: website/trunk/docs/en/tor-hidden-service.wml Log: HS websites are also actual websites. changed to normal Modified: website/trunk/docs/en/tor-hidden-service.wml =================================================================== --- website/trunk/docs/en/tor-hidden-service.wml 2013-06-14 23:07:06 UTC (rev 26217) +++ website/trunk/docs/en/tor-hidden-service.wml 2013-06-16 12:34:03 UTC (rev 26218) @@ -70,7 +70,7 @@ server here. If you get stuck or want to do more, find a friend who can help you. We recommend you install a new separate web server for your hidden service, since even if you already have one installed, - you may be using it (or want to use it later) for an actual website. + you may be using it (or want to use it later) for a normal website.

1 0

[tor/master] Disable middle relay queue overfill detection code due to possible guard discovery attack
by andrea＠torproject.org 16 Jun '13

16 Jun '13

commit 2a95f3171681ee53c97ccba9d80f4454b462aaa7 Author: Andrea Shepard <andrea(a)torproject.org> Date: Sat Jun 15 02:16:00 2013 -0700 Disable middle relay queue overfill detection code due to possible guard discovery attack --- changes/bug9072 | 3 +++ src/or/relay.c | 5 +++++ 2 files changed, 8 insertions(+) diff --git a/changes/bug9072 b/changes/bug9072 new file mode 100644 index 0000000..e594a38 --- /dev/null +++ b/changes/bug9072 @@ -0,0 +1,3 @@ + o Critical bugfixes: + - Disable middle relay queue overfill detection code due to possible + guard discovery attack, pending further analysis. Fixes bug #9072. diff --git a/src/or/relay.c b/src/or/relay.c index 087459c..fdb4bff 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -2548,6 +2548,10 @@ append_cell_to_circuit_queue(circuit_t *circ, or_connection_t *orconn, streams_blocked = circ->streams_blocked_on_p_conn; } + /* + * Disabling this for now because of a possible guard discovery attack + */ +#if 0 /* Are we a middle circuit about to exceed ORCIRC_MAX_MIDDLE_CELLS? */ if ((circ->n_conn != NULL) && CIRCUIT_IS_ORCIRC(circ)) { orcirc = TO_OR_CIRCUIT(circ); @@ -2566,6 +2570,7 @@ append_cell_to_circuit_queue(circuit_t *circ, or_connection_t *orconn, } } } +#endif cell_queue_append_packed_copy(queue, cell);

1 0

[tor/master] Merge branch 'bug9072-024' into bug9072-025
by andrea＠torproject.org 16 Jun '13

16 Jun '13

commit 469bd7a3cfbe6c5ca5c2602a10ee1854714e93c5 Merge: 7f67bec 9e45d94 Author: Andrea Shepard <andrea(a)torproject.org> Date: Sat Jun 15 02:27:23 2013 -0700 Merge branch 'bug9072-024' into bug9072-025 changes/bug9072 | 3 +++ src/or/relay.c | 11 +++++++++++ 2 files changed, 14 insertions(+) diff --cc src/or/relay.c index 58ca4e9,0f21663..38776bc --- a/src/or/relay.c +++ b/src/or/relay.c @@@ -58,7 -58,6 +58,9 @@@ static void adjust_exit_policy_from_exi entry_connection_t *conn, node_t *node, const tor_addr_t *addr); ++#if 0 +static int get_max_middle_cells(void); ++#endif /** Stop reading on edge connections when we have this many cells * waiting on the appropriate queue. */ @@@ -2473,18 -2459,6 +2475,20 @@@ channel_flush_from_first_active_circuit return n_flushed; } ++#if 0 +/** Indicate the current preferred cap for middle circuits; zero disables + * the cap. Right now it's just a constant, ORCIRC_MAX_MIDDLE_CELLS, but + * the logic in append_cell_to_circuit_queue() is written to be correct + * if we want to base it on a consensus param or something that might change + * in the future. + */ +static int +get_max_middle_cells(void) +{ + return ORCIRC_MAX_MIDDLE_CELLS; +} ++#endif + /** Add cell to the queue of circ writing to chan * transmitting in direction. */ void @@@ -2495,7 -2469,6 +2499,9 @@@ append_cell_to_circuit_queue(circuit_t or_circuit_t *orcirc = NULL; cell_queue_t *queue; int streams_blocked; ++#if 0 + uint32_t tgt_max_middle_cells, p_len, n_len, tmp, hard_max_middle_cells; ++#endif if (circ->marked_for_close) return; @@@ -2585,8 -2509,9 +2595,9 @@@ } } } + #endif - cell_queue_append_packed_copy(queue, cell, chan->wide_circ_ids); + cell_queue_append_packed_copy(queue, cell, chan->wide_circ_ids, 1); /* If we have too many cells on the circuit, we should stop reading from * the edge streams for a while. */

1 0

[tor/master] Merge branch 'bug9072-023' into bug9072-024
by andrea＠torproject.org 16 Jun '13

16 Jun '13

commit 9e45d940d466bcefcd1490fc2ae0e5a6298a846f Merge: 8b6d0bd 2a95f31 Author: Andrea Shepard <andrea(a)torproject.org> Date: Sat Jun 15 02:20:19 2013 -0700 Merge branch 'bug9072-023' into bug9072-024 changes/bug9072 | 3 +++ src/or/relay.c | 5 +++++ 2 files changed, 8 insertions(+) diff --cc src/or/relay.c index a26d418,fdb4bff..0f21663 --- a/src/or/relay.c +++ b/src/or/relay.c @@@ -2474,18 -2540,22 +2474,22 @@@ append_cell_to_circuit_queue(circuit_t return; if (direction == CELL_DIRECTION_OUT) { - queue = &circ->n_conn_cells; - streams_blocked = circ->streams_blocked_on_n_conn; + queue = &circ->n_chan_cells; + streams_blocked = circ->streams_blocked_on_n_chan; } else { orcirc = TO_OR_CIRCUIT(circ); - queue = &orcirc->p_conn_cells; - streams_blocked = circ->streams_blocked_on_p_conn; + queue = &orcirc->p_chan_cells; + streams_blocked = circ->streams_blocked_on_p_chan; } + /* + * Disabling this for now because of a possible guard discovery attack + */ + #if 0 /* Are we a middle circuit about to exceed ORCIRC_MAX_MIDDLE_CELLS? */ - if ((circ->n_conn != NULL) && CIRCUIT_IS_ORCIRC(circ)) { + if ((circ->n_chan != NULL) && CIRCUIT_IS_ORCIRC(circ)) { orcirc = TO_OR_CIRCUIT(circ); - if (orcirc->p_conn) { + if (orcirc->p_chan) { if (queue->n + 1 >= ORCIRC_MAX_MIDDLE_CELLS) { /* Queueing this cell would put queue over the cap */ log_warn(LD_CIRC, @@@ -2505,8 -2570,9 +2509,9 @@@ } } } + #endif - cell_queue_append_packed_copy(queue, cell); + cell_queue_append_packed_copy(queue, cell, chan->wide_circ_ids); /* If we have too many cells on the circuit, we should stop reading from * the edge streams for a while. */

1 0

[tor/maint-0.2.4] Disable middle relay queue overfill detection code due to possible guard discovery attack
by andrea＠torproject.org 16 Jun '13

16 Jun '13

commit 2a95f3171681ee53c97ccba9d80f4454b462aaa7 Author: Andrea Shepard <andrea(a)torproject.org> Date: Sat Jun 15 02:16:00 2013 -0700 Disable middle relay queue overfill detection code due to possible guard discovery attack --- changes/bug9072 | 3 +++ src/or/relay.c | 5 +++++ 2 files changed, 8 insertions(+) diff --git a/changes/bug9072 b/changes/bug9072 new file mode 100644 index 0000000..e594a38 --- /dev/null +++ b/changes/bug9072 @@ -0,0 +1,3 @@ + o Critical bugfixes: + - Disable middle relay queue overfill detection code due to possible + guard discovery attack, pending further analysis. Fixes bug #9072. diff --git a/src/or/relay.c b/src/or/relay.c index 087459c..fdb4bff 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -2548,6 +2548,10 @@ append_cell_to_circuit_queue(circuit_t *circ, or_connection_t *orconn, streams_blocked = circ->streams_blocked_on_p_conn; } + /* + * Disabling this for now because of a possible guard discovery attack + */ +#if 0 /* Are we a middle circuit about to exceed ORCIRC_MAX_MIDDLE_CELLS? */ if ((circ->n_conn != NULL) && CIRCUIT_IS_ORCIRC(circ)) { orcirc = TO_OR_CIRCUIT(circ); @@ -2566,6 +2570,7 @@ append_cell_to_circuit_queue(circuit_t *circ, or_connection_t *orconn, } } } +#endif cell_queue_append_packed_copy(queue, cell);

1 0

[tor/maint-0.2.4] Merge branch 'bug9072-023' into bug9072-024
by andrea＠torproject.org 16 Jun '13

16 Jun '13

commit 9e45d940d466bcefcd1490fc2ae0e5a6298a846f Merge: 8b6d0bd 2a95f31 Author: Andrea Shepard <andrea(a)torproject.org> Date: Sat Jun 15 02:20:19 2013 -0700 Merge branch 'bug9072-023' into bug9072-024 changes/bug9072 | 3 +++ src/or/relay.c | 5 +++++ 2 files changed, 8 insertions(+) diff --cc src/or/relay.c index a26d418,fdb4bff..0f21663 --- a/src/or/relay.c +++ b/src/or/relay.c @@@ -2474,18 -2540,22 +2474,22 @@@ append_cell_to_circuit_queue(circuit_t return; if (direction == CELL_DIRECTION_OUT) { - queue = &circ->n_conn_cells; - streams_blocked = circ->streams_blocked_on_n_conn; + queue = &circ->n_chan_cells; + streams_blocked = circ->streams_blocked_on_n_chan; } else { orcirc = TO_OR_CIRCUIT(circ); - queue = &orcirc->p_conn_cells; - streams_blocked = circ->streams_blocked_on_p_conn; + queue = &orcirc->p_chan_cells; + streams_blocked = circ->streams_blocked_on_p_chan; } + /* + * Disabling this for now because of a possible guard discovery attack + */ + #if 0 /* Are we a middle circuit about to exceed ORCIRC_MAX_MIDDLE_CELLS? */ - if ((circ->n_conn != NULL) && CIRCUIT_IS_ORCIRC(circ)) { + if ((circ->n_chan != NULL) && CIRCUIT_IS_ORCIRC(circ)) { orcirc = TO_OR_CIRCUIT(circ); - if (orcirc->p_conn) { + if (orcirc->p_chan) { if (queue->n + 1 >= ORCIRC_MAX_MIDDLE_CELLS) { /* Queueing this cell would put queue over the cap */ log_warn(LD_CIRC, @@@ -2505,8 -2570,9 +2509,9 @@@ } } } + #endif - cell_queue_append_packed_copy(queue, cell); + cell_queue_append_packed_copy(queue, cell, chan->wide_circ_ids); /* If we have too many cells on the circuit, we should stop reading from * the edge streams for a while. */

1 0

[tor/maint-0.2.3] Disable middle relay queue overfill detection code due to possible guard discovery attack
by andrea＠torproject.org 16 Jun '13

16 Jun '13

commit 2a95f3171681ee53c97ccba9d80f4454b462aaa7 Author: Andrea Shepard <andrea(a)torproject.org> Date: Sat Jun 15 02:16:00 2013 -0700 Disable middle relay queue overfill detection code due to possible guard discovery attack --- changes/bug9072 | 3 +++ src/or/relay.c | 5 +++++ 2 files changed, 8 insertions(+) diff --git a/changes/bug9072 b/changes/bug9072 new file mode 100644 index 0000000..e594a38 --- /dev/null +++ b/changes/bug9072 @@ -0,0 +1,3 @@ + o Critical bugfixes: + - Disable middle relay queue overfill detection code due to possible + guard discovery attack, pending further analysis. Fixes bug #9072. diff --git a/src/or/relay.c b/src/or/relay.c index 087459c..fdb4bff 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -2548,6 +2548,10 @@ append_cell_to_circuit_queue(circuit_t *circ, or_connection_t *orconn, streams_blocked = circ->streams_blocked_on_p_conn; } + /* + * Disabling this for now because of a possible guard discovery attack + */ +#if 0 /* Are we a middle circuit about to exceed ORCIRC_MAX_MIDDLE_CELLS? */ if ((circ->n_conn != NULL) && CIRCUIT_IS_ORCIRC(circ)) { orcirc = TO_OR_CIRCUIT(circ); @@ -2566,6 +2570,7 @@ append_cell_to_circuit_queue(circuit_t *circ, or_connection_t *orconn, } } } +#endif cell_queue_append_packed_copy(queue, cell);

1 0

[stem/master] FAQ entry about how to get information about your present exits
by atagar＠torproject.org 15 Jun '13

15 Jun '13

commit e8a278cfed828be68d83486deefbff86fb548b0d Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Jun 15 20:40:01 2013 -0700 FAQ entry about how to get information about your present exits Answer for a question I like on Stack Overflow... http://stackoverflow.com/questions/9777192/how-do-i-get-the-tor-exit-node-i… --- docs/faq.rst | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 54 insertions(+) diff --git a/docs/faq.rst b/docs/faq.rst index f86bdda..b10e01a 100644 --- a/docs/faq.rst +++ b/docs/faq.rst @@ -12,6 +12,7 @@ Frequently Asked Questions * **Tasks** * :ref:`how_do_i_request_a_new_identity_from_tor` + * :ref:`how_do_i_get_information_about_my_exits` * **Development** @@ -106,6 +107,59 @@ And with stem... For lower level control over Tor's circuits and path selection see the `client usage tutorial <tutorials/to_russia_with_love.html>`_. +.. _how_do_i_get_information_about_my_exits: + +How do I get information about my exits? +---------------------------------------- + +To learn about the Tor relays you're presently using call :func:`stem.control.Controller.get_circuits`. The last relay in the circuit's path is your exit... + +:: + + from stem import CircStatus + from stem.control import Controller + + with Controller.from_port(port = 9051) as controller: + controller.authenticate() + + for circ in controller.get_circuits(): + if circ.status != CircStatus.BUILT: + continue + + exit_fp, exit_nickname = circ.path[-1] + + exit_desc = controller.get_network_status(exit_fp, None) + exit_address = exit_desc.address if exit_desc else 'unknown' + + print "Exit relay" + print " fingerprint: %s" % exit_fp + print " nickname: %s" % exit_nickname + print " address: %s" % exit_address + print + +:: + + % python example.py + Exit relay + fingerprint: 94AD3437EC49A31E8D6C17CC3BDE8316C90262BE + nickname: davidonet + address: 188.165.236.209 + + Exit relay + fingerprint: 6042CC1C69BBFE83A1DD2BCD4C15000A0DD5E1BC + nickname: Gnome5 + address: 178.209.50.230 + + Exit relay + fingerprint: 9634F910C2942A2E46720DD161A873E3A619AD90 + nickname: veebikaamera + address: 81.21.246.66 + + Exit relay + fingerprint: A59E1E7C7EAEE083D756EE1FF6EC31CA3D8651D7 + nickname: chaoscomputerclub19 + address: 31.172.30.2 + Development ===========

1 0

[stem/master] FAQ entry for how to request a new tor identity
by atagar＠torproject.org 15 Jun '13

15 Jun '13

commit 69ff2a6eec5b99a7b13a57f09de2e2abbd87b91d Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Jun 15 19:26:15 2013 -0700 FAQ entry for how to request a new tor identity A common question on Stack Overflow reguarding tor goes along the lines of 'how do I get a new identity?'. For instance... http://stackoverflow.com/questions/17013707/how-can-i-change-my-tor-process… http://stackoverflow.com/questions/16987518/how-to-request-new-tor-identity… Tor doesn't support cycling your IP, so adding a FAQ entry explaining why and telling them how NEWNYM works. --- docs/faq.rst | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/docs/faq.rst b/docs/faq.rst index 194896f..f86bdda 100644 --- a/docs/faq.rst +++ b/docs/faq.rst @@ -9,6 +9,10 @@ Frequently Asked Questions * :ref:`what_license_is_stem_under` * :ref:`where_can_i_get_help` +* **Tasks** + + * :ref:`how_do_i_request_a_new_identity_from_tor` + * **Development** * :ref:`how_do_i_get_started` @@ -58,6 +62,50 @@ Where can I get help? Do you have a tor related question or project that you would like to discuss? If so then find us on the `tor-dev@ email list <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev>`_ and `IRC <https://www.torproject.org/about/contact.html.en#irc>`_. +Tasks +===== + +.. _how_do_i_request_a_new_identity_from_tor: + +How do I request a new identity from Tor? +----------------------------------------- + +In Tor your identity is the three-hop **circuit** over which your traffic travels through the Tor network. + +Tor will create new circuits for you every ten minutes. When this happens your present circuits become **dirty**, which means that new connections will not use them. When all of the connections using a dirty circuit are done the circuit is closed. + +An important thing to note is that a new circuit does not necessarily mean a new IP address. Paths are randomly selected based on heuristics like speed and stability. There are only so many large exits in the Tor network, so it's not uncommon to reuse an exit you have had previously. + +Tor does not have a method for cycling your IP address. This is on purpose, and done for a couple reasons. The first is that this capability is usually requested for not-so-nice reasons such as ban evasion or SEO. Second, repeated circuit creation puts a very high load on the Tor network, so please don't! + +With all that out of the way, now do you create a new circuit? You can customise the rate at which Tor cycles circuits with the **MaxCircuitDirtiness** option in your `torrc <https://www.torproject.org/docs/faq.html.en#torrc>`_. `Vidalia <https://www.torproject.org/getinvolved/volunteer.html.en#project-vidalia>`_ and `arm <http://www.atagar.com/arm/>`_ both provide a method to request a new identity, and you can do so programmatically by sending Tor a NEWNYM signal. + +To do this with telnet... + +:: + + % telnet localhost 9051 + Trying 127.0.0.1... + Connected to localhost. + Escape character is '^]'. + AUTHENTICATE + 250 OK + SIGNAL NEWNYM + 250 OK + +And with stem... + +:: + + from stem import Signal + from stem.control import Controller + + with Controller.from_port(port = 9051) as controller: + controller.authenticate() + controller.signal(Signal.NEWNYM) + +For lower level control over Tor's circuits and path selection see the `client usage tutorial <tutorials/to_russia_with_love.html>`_. + Development ===========

1 0