tor-commits August 2013

tor-commits@lists.torproject.org

19 participants
1224 discussions

[stem/master] Minor formatting changes for DNSEL addition
by atagar＠torproject.org 22 Aug '13

22 Aug '13

commit d7833f31c392623f8dad5a30e7b16713cff510aa Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Aug 22 09:20:20 2013 -0700 Minor formatting changes for DNSEL addition Nothing functional, just rearranging a few things to satisfy my OCD. :) --- stem/descriptor/tordnsel.py | 33 +++++++++------------- test/unit/descriptor/tordnsel.py | 58 ++++++++++++++++++++++---------------- 2 files changed, 47 insertions(+), 44 deletions(-) diff --git a/stem/descriptor/tordnsel.py b/stem/descriptor/tordnsel.py index ddeef2e..6e6b36d 100644 --- a/stem/descriptor/tordnsel.py +++ b/stem/descriptor/tordnsel.py @@ -1,8 +1,9 @@ -# Copyright 2012-2013, Damian Johnson +# Copyright 2013, Damian Johnson # See LICENSE for licensing information """ -Parsing for TorDNSEL files. +Parsing for `TorDNSEL <https://www.torproject.org/projects/tordnsel.html.en>`_ +exit list files. """ import datetime @@ -36,6 +37,7 @@ def _parse_file(tordnsel_file, validate = True, **kwargs): while True: contents = _read_until_keywords("ExitAddress", tordnsel_file) contents += _read_until_keywords("ExitNode", tordnsel_file) + if contents: yield TorDNSEL(bytes.join(b"", contents), validate, **kwargs) else: @@ -79,42 +81,35 @@ class TorDNSEL(Descriptor): if keyword == "ExitNode": if validate and not stem.util.tor_tools.is_valid_fingerprint(value): raise ValueError("Tor relay fingerprints consist of forty hex digits: %s" % value) - self.fingerprint = value + self.fingerprint = value elif keyword == "Published": try: self.published = datetime.datetime.strptime(value, "%Y-%m-%d %H:%M:%S") except ValueError: if validate: raise ValueError("Published time wasn't parsable: %s" % value) - elif keyword == "LastStatus": try: self.last_status = datetime.datetime.strptime(value, "%Y-%m-%d %H:%M:%S") except ValueError: if validate: raise ValueError("LastStatus time wasn't parsable: %s" % value) - elif keyword == "ExitAddress": for value, block_content in values: - - if validate and block_content: - raise ValueError("Unexpected block content: %s" % block_content) - address, date = value.split(" ", 1) - if validate and not stem.util.connection.is_valid_ipv4_address(address): - raise ValueError("ExitAddress isn't a valid IPv4 address: %s" % address) + if validate: + if not stem.util.connection.is_valid_ipv4_address(address): + raise ValueError("ExitAddress isn't a valid IPv4 address: %s" % address) + elif block_content: + raise ValueError("Unexpected block content: %s" % block_content) + try: date = datetime.datetime.strptime(date, "%Y-%m-%d %H:%M:%S") + self.exit_addresses.append((address, date)) except ValueError: if validate: raise ValueError("ExitAddress found time wasn't parsable: %s" % value) - else: - continue - - self.exit_addresses.append((address, date)) - - else: - if validate: - raise ValueError("Saw a keyword that wasn't expected.") + elif validate: + raise ValueError("Unrecognized keyword: %s" % keyword) diff --git a/test/unit/descriptor/tordnsel.py b/test/unit/descriptor/tordnsel.py index 4861b38..4944a4b 100644 --- a/test/unit/descriptor/tordnsel.py +++ b/test/unit/descriptor/tordnsel.py @@ -9,13 +9,7 @@ import datetime from stem.util.tor_tools import is_valid_fingerprint from stem.descriptor.tordnsel import TorDNSEL, _parse_file - -class TestTorDNSELDescriptor(unittest.TestCase): - def test_parse_file(self): - """ - Try parsing a document via the _parse_file() function. - """ - desc_text = """ +TEST_DESC = """\ @type tordnsel 1.0 Downloaded 2013-08-19 04:02:03 ExitNode 003A71137D959748C8157C4A76ECA639CEF5E33E @@ -34,8 +28,31 @@ LastStatus 2013-08-18 13:02:57 ExitAddress 46.10.211.205 2013-08-18 13:18:48 """ +MALFORMED_ENTRY_1 = """\ +ExitNode 030B22437D99B2DB2908B747B6962EAD13AB4038 +Published Today! +LastStatus 2013-08-18 13:02:57 +ExitAddress 46.10.211.205 2013-08-18 13:18:48 +""" + +MALFORMED_ENTRY_2 = """\ +@type tordnsel 1.0 +ExitNode 030B22437D99B2DB2908B747B6962EAD13AB4038 +Published Today! +LastStatus 2013-08-18 13:02:57 +ExitAddress 46.10.211.205 2013-08-18 Never +""" + + +class TestTorDNSELDescriptor(unittest.TestCase): + def test_parse_file(self): + """ + Try parsing a document via the _parse_file() function. + """ + # parse file and assert values - descriptors = list(_parse_file(io.BytesIO(desc_text))) + + descriptors = list(_parse_file(io.BytesIO(TEST_DESC))) self.assertEqual(3, len(descriptors)) self.assertTrue(isinstance(descriptors[0], TorDNSEL)) desc = descriptors[1] @@ -49,32 +66,23 @@ ExitAddress 46.10.211.205 2013-08-18 13:18:48 self.assertEqual(datetime.datetime(2013, 8, 18, 8, 3, 1), exit[1]) # block content raises value error + extra = "ExtraContent goes here\n" - descriptors = _parse_file(io.BytesIO(desc_text + extra)) + descriptors = _parse_file(io.BytesIO(TEST_DESC + extra)) self.assertRaises(ValueError, list, descriptors) # malformed fingerprint raises value errors + extra = "ExitNode 030B22437D99B2DB2908B747B6" - self.assertRaises(ValueError, list, _parse_file(io.BytesIO(desc_text + extra))) + self.assertRaises(ValueError, list, _parse_file(io.BytesIO(TEST_DESC + extra))) # malformed date raises value errors - extra = """ -ExitNode 030B22437D99B2DB2908B747B6962EAD13AB4038 -Published Today! -LastStatus 2013-08-18 13:02:57 -ExitAddress 46.10.211.205 2013-08-18 13:18:48 -""" - self.assertRaises(ValueError, list, _parse_file(io.BytesIO(desc_text + extra))) + + self.assertRaises(ValueError, list, _parse_file(io.BytesIO(TEST_DESC + MALFORMED_ENTRY_1))) # skip exit address if malformed date and validate is False - extra = """ -@type tordnsel 1.0 -ExitNode 030B22437D99B2DB2908B747B6962EAD13AB4038 -Published Today! -LastStatus 2013-08-18 13:02:57 -ExitAddress 46.10.211.205 2013-08-18 Never -""" - desc = _parse_file(io.BytesIO(extra), validate=False).next() + + desc = _parse_file(io.BytesIO(MALFORMED_ENTRY_2), validate=False).next() self.assertTrue(is_valid_fingerprint(desc.fingerprint)) self.assertEqual("030B22437D99B2DB2908B747B6962EAD13AB4038", desc.fingerprint) self.assertEqual(0, len(desc.exit_addresses))

1 0

[stem/master] Parse exit list entry.
by atagar＠torproject.org 22 Aug '13

22 Aug '13

commit 4631228400e0cca43d8c7ba514c40cbcbf2bda34 Author: Arlo Breault <arlolra(a)gmail.com> Date: Mon Aug 19 22:49:40 2013 -0700 Parse exit list entry. Published by DNSEL or TorBEL to indicate what ip address exit relay X had at timestamp Y. See #8255 --- stem/descriptor/__init__.py | 9 ++- stem/descriptor/tordnsel.py | 120 ++++++++++++++++++++++++++++++++++++++ test/settings.cfg | 1 + test/unit/descriptor/tordnsel.py | 80 +++++++++++++++++++++++++ 4 files changed, 209 insertions(+), 1 deletion(-) diff --git a/stem/descriptor/__init__.py b/stem/descriptor/__init__.py index cd1f42a..b4fc54a 100644 --- a/stem/descriptor/__init__.py +++ b/stem/descriptor/__init__.py @@ -46,6 +46,7 @@ __all__ = [ "microdescriptor", "networkstatus", "router_status_entry", + "tordnsel", "parse_file", "Descriptor", ] @@ -115,7 +116,7 @@ def parse_file(descriptor_file, descriptor_type = None, validate = True, documen bridge-extra-info 1.1 :class:`~stem.descriptor.extrainfo_descriptor.BridgeExtraInfoDescriptor` torperf 1.0 **unsupported** bridge-pool-assignment 1.0 **unsupported** - tordnsel 1.0 **unsupported** + tordnsel 1.0 :class:`~stem.descriptor.tordnsel.TorDNSEL` ========================================= ===== If you're using **python 3** then beware that the open() function defaults to @@ -255,6 +256,11 @@ def _parse_metrics_file(descriptor_type, major_version, minor_version, descripto for desc in stem.descriptor.networkstatus._parse_file(descriptor_file, document_type, validate = validate, document_handler = document_handler, **kwargs): yield desc + elif descriptor_type == "tordnsel" and major_version == 1: + document_type = stem.descriptor.tordnsel.TorDNSEL + + for desc in stem.descriptor.tordnsel._parse_file(descriptor_file, validate = validate, **kwargs): + yield desc else: raise TypeError("Unrecognized metrics descriptor format. type: '%s', version: '%i.%i'" % (descriptor_type, major_version, minor_version)) @@ -542,3 +548,4 @@ import stem.descriptor.server_descriptor import stem.descriptor.extrainfo_descriptor import stem.descriptor.networkstatus import stem.descriptor.microdescriptor +import stem.descriptor.tordnsel diff --git a/stem/descriptor/tordnsel.py b/stem/descriptor/tordnsel.py new file mode 100644 index 0000000..ddeef2e --- /dev/null +++ b/stem/descriptor/tordnsel.py @@ -0,0 +1,120 @@ +# Copyright 2012-2013, Damian Johnson +# See LICENSE for licensing information + +""" +Parsing for TorDNSEL files. +""" + +import datetime + +import stem.util.connection +import stem.util.str_tools +import stem.util.tor_tools + +from stem.descriptor import ( + Descriptor, + _read_until_keywords, + _get_descriptor_components, +) + + +def _parse_file(tordnsel_file, validate = True, **kwargs): + """ + Iterates over a tordnsel file. + + :returns: iterator for :class:`~stem.descriptor.tordnsel.TorDNSEL` + instances in the file + + :raises: + * **ValueError** if the contents is malformed and validate is **True** + * **IOError** if the file can't be read + """ + + # skip content prior to the first ExitNode + _read_until_keywords("ExitNode", tordnsel_file, skip = True) + + while True: + contents = _read_until_keywords("ExitAddress", tordnsel_file) + contents += _read_until_keywords("ExitNode", tordnsel_file) + if contents: + yield TorDNSEL(bytes.join(b"", contents), validate, **kwargs) + else: + break # done parsing file + + +class TorDNSEL(Descriptor): + """ + TorDNSEL descriptor (`exitlist specification + <https://www.torproject.org/tordnsel/exitlist-spec.txt>`_) + + :var str fingerprint: **\*** authority's fingerprint + :var datetime published: **\*** time in UTC when this descriptor was made + :var datetime last_status: **\*** time in UTC when the relay was seen in a v2 network status + :var list exit_addresses: **\*** list of (str address, datetime date) tuples consisting of the found IPv4 exit address and the time + + **\*** attribute is either required when we're parsed with validation or has + a default value, others are left as **None** if undefined + """ + + def __init__(self, raw_contents, validate): + super(TorDNSEL, self).__init__(raw_contents) + raw_contents = stem.util.str_tools._to_unicode(raw_contents) + entries = _get_descriptor_components(raw_contents, validate) + + self.fingerprint = None + self.published = None + self.last_status = None + self.exit_addresses = [] + + self._parse(entries, validate) + + def _parse(self, entries, validate): + + for keyword, values in entries.items(): + value, block_content = values[0] + + if validate and block_content: + raise ValueError("Unexpected block content: %s" % block_content) + + if keyword == "ExitNode": + if validate and not stem.util.tor_tools.is_valid_fingerprint(value): + raise ValueError("Tor relay fingerprints consist of forty hex digits: %s" % value) + self.fingerprint = value + + elif keyword == "Published": + try: + self.published = datetime.datetime.strptime(value, "%Y-%m-%d %H:%M:%S") + except ValueError: + if validate: + raise ValueError("Published time wasn't parsable: %s" % value) + + elif keyword == "LastStatus": + try: + self.last_status = datetime.datetime.strptime(value, "%Y-%m-%d %H:%M:%S") + except ValueError: + if validate: + raise ValueError("LastStatus time wasn't parsable: %s" % value) + + elif keyword == "ExitAddress": + for value, block_content in values: + + if validate and block_content: + raise ValueError("Unexpected block content: %s" % block_content) + + address, date = value.split(" ", 1) + + if validate and not stem.util.connection.is_valid_ipv4_address(address): + raise ValueError("ExitAddress isn't a valid IPv4 address: %s" % address) + try: + date = datetime.datetime.strptime(date, "%Y-%m-%d %H:%M:%S") + except ValueError: + if validate: + raise ValueError("ExitAddress found time wasn't parsable: %s" % value) + else: + continue + + self.exit_addresses.append((address, date)) + + else: + if validate: + raise ValueError("Saw a keyword that wasn't expected.") diff --git a/test/settings.cfg b/test/settings.cfg index 80aaf9a..b97c57f 100644 --- a/test/settings.cfg +++ b/test/settings.cfg @@ -161,6 +161,7 @@ test.unit_tests |test.unit.descriptor.extrainfo_descriptor.TestExtraInfoDescriptor |test.unit.descriptor.microdescriptor.TestMicrodescriptor |test.unit.descriptor.router_status_entry.TestRouterStatusEntry +|test.unit.descriptor.tordnsel.TestTorDNSELDescriptor |test.unit.descriptor.networkstatus.directory_authority.TestDirectoryAuthority |test.unit.descriptor.networkstatus.key_certificate.TestKeyCertificate |test.unit.descriptor.networkstatus.document_v2.TestNetworkStatusDocument diff --git a/test/unit/descriptor/tordnsel.py b/test/unit/descriptor/tordnsel.py new file mode 100644 index 0000000..4861b38 --- /dev/null +++ b/test/unit/descriptor/tordnsel.py @@ -0,0 +1,80 @@ +""" +Unit tests for stem.descriptor.tordnsel. +""" + +import io +import unittest +import datetime + +from stem.util.tor_tools import is_valid_fingerprint +from stem.descriptor.tordnsel import TorDNSEL, _parse_file + + +class TestTorDNSELDescriptor(unittest.TestCase): + def test_parse_file(self): + """ + Try parsing a document via the _parse_file() function. + """ + desc_text = """ +@type tordnsel 1.0 +Downloaded 2013-08-19 04:02:03 +ExitNode 003A71137D959748C8157C4A76ECA639CEF5E33E +Published 2013-08-19 02:13:53 +LastStatus 2013-08-19 03:02:47 +ExitAddress 66.223.170.168 2013-08-19 03:18:51 +ExitNode 00FF300624FECA7F40515C8D854EE925332580D6 +Published 2013-08-18 07:02:14 +LastStatus 2013-08-18 09:02:58 +ExitAddress 82.252.181.153 2013-08-18 08:03:01 +ExitAddress 82.252.181.154 2013-08-18 08:03:02 +ExitAddress 82.252.181.155 2013-08-18 08:03:03 +ExitNode 030B22437D99B2DB2908B747B6962EAD13AB4039 +Published 2013-08-18 12:44:20 +LastStatus 2013-08-18 13:02:57 +ExitAddress 46.10.211.205 2013-08-18 13:18:48 +""" + + # parse file and assert values + descriptors = list(_parse_file(io.BytesIO(desc_text))) + self.assertEqual(3, len(descriptors)) + self.assertTrue(isinstance(descriptors[0], TorDNSEL)) + desc = descriptors[1] + self.assertTrue(is_valid_fingerprint(desc.fingerprint)) + self.assertEqual("00FF300624FECA7F40515C8D854EE925332580D6", desc.fingerprint) + self.assertEqual(datetime.datetime(2013, 8, 18, 7, 2, 14), desc.published) + self.assertEqual(datetime.datetime(2013, 8, 18, 9, 2, 58), desc.last_status) + self.assertEqual(3, len(desc.exit_addresses)) + exit = desc.exit_addresses[0] + self.assertEqual("82.252.181.153", exit[0]) + self.assertEqual(datetime.datetime(2013, 8, 18, 8, 3, 1), exit[1]) + + # block content raises value error + extra = "ExtraContent goes here\n" + descriptors = _parse_file(io.BytesIO(desc_text + extra)) + self.assertRaises(ValueError, list, descriptors) + + # malformed fingerprint raises value errors + extra = "ExitNode 030B22437D99B2DB2908B747B6" + self.assertRaises(ValueError, list, _parse_file(io.BytesIO(desc_text + extra))) + + # malformed date raises value errors + extra = """ +ExitNode 030B22437D99B2DB2908B747B6962EAD13AB4038 +Published Today! +LastStatus 2013-08-18 13:02:57 +ExitAddress 46.10.211.205 2013-08-18 13:18:48 +""" + self.assertRaises(ValueError, list, _parse_file(io.BytesIO(desc_text + extra))) + + # skip exit address if malformed date and validate is False + extra = """ +@type tordnsel 1.0 +ExitNode 030B22437D99B2DB2908B747B6962EAD13AB4038 +Published Today! +LastStatus 2013-08-18 13:02:57 +ExitAddress 46.10.211.205 2013-08-18 Never +""" + desc = _parse_file(io.BytesIO(extra), validate=False).next() + self.assertTrue(is_valid_fingerprint(desc.fingerprint)) + self.assertEqual("030B22437D99B2DB2908B747B6962EAD13AB4038", desc.fingerprint) + self.assertEqual(0, len(desc.exit_addresses))

1 0

[torspec/master] Proposal 222-remove-client-timestamps
by nickm＠torproject.org 22 Aug '13

22 Aug '13

commit 6a0694fea80168bb8d6a90fda4bf0c0af1bfe2ca Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Aug 22 11:45:26 2013 -0400 Proposal 222-remove-client-timestamps --- proposals/222-remove-client-timestamps.txt | 244 ++++++++++++++++++++++++++++ 1 file changed, 244 insertions(+) diff --git a/proposals/222-remove-client-timestamps.txt b/proposals/222-remove-client-timestamps.txt new file mode 100644 index 0000000..dd84bf2 --- /dev/null +++ b/proposals/222-remove-client-timestamps.txt @@ -0,0 +1,244 @@ +Filename: 222-remove-client-timestamps.txt +Title: Stop sending client timestamps +Authors: Nick Mathewson +Created: 22 August 2013 +Target: 0.2.5.x +Status: Open + +0. Summary + + There are a few places in Tor where clients and servers send + timestamps. I list them and discuss how to eliminate them. + +1. Introduction + + Despite this late date, many hosts aren't running NTP and + don't have very well synchronized clocks. Even more hosts + aren't running a secure NTP; it's probably easy to + desynchronize target hosts. + + Given all of this, it's probably a fingerprinting opportunity + whenever clients send their view of the current time. + Let's try to avoid that. + + I'm also going to list the places where servers send their + view of the current time, and propose that we eliminate some + of those. + + Scope: This proposal is about eliminating passive timestamp + exposure, not about tricky active detection mechanisms where + you do something like offering a client a large number of + about-to-expire/just-expired certificates to see which ones + they accept. + +2. The Tor link protocol + +2.1. NETINFO (client and server) + + NETINFO cells specify that both parties include a 4-byte + timestamp. + + Instead, let's say that clients should set this timestamp to + 0. Nothing currently looks at a client's setting for this + field, so this change should be safe. + +2.2. AUTHENTICATE (server) + + The AUTHENTICATE cell is not ordinarily sent by clients. It + contains an 8-byte timestamp and a 16-byte random value. + Instead, let's replace both with a 24-byte (truncated) HMAC of + the current time, using a random key. + + This will achieve the goal of including a timestamp in the + cell (preventing replays even in the presence of bad entropy), + while at the same time not including the time here. + +2.3. TLS + +2.3.1. ClientRandom in the TLS handshake + + See TLS proposal in appendix A. + + This presents a TLS fingerprinting/censorship opportunity. I + propose that we investigate whether "random " or "zero" is + more common on the wire, choose that, and lobby for changes to + TLS implementations. + +2.3.2. Certificate validity intervals + + Servers use the current time in setting certificate validity + for their initial certificates. They randomize this value + somewhat. I propose that we don't change this, since it's a + server-only issue, and already somewhat mitigated. + +3. Directory protocol + +3.1. Published + + This field in descriptors is generated by servers only; I + propose no change. + +3.2. The Date header + + This HTTP header is sent by directory servers only; I propose + no change. + +4. The hidden service protocol + +4.1. Descriptor publication time + + Hidden service descriptors include a publication time. I + propose that we round this time down to the nearest N minutes, + perhaps for N=30. + +4.2. INTRODUCE2 cell timestamp + + INTRODUCE2 cells once limited the duration of their replay + caches by including a timestamp in the INTRODUCE2 cells. Since + 0.2.3.9-alpha, this timestamp is ignored, and key lifetime is + used instead. + + When we determine that no hidden services are running on + 0.2.2.x (and really, no hidden services should be running on + 0.2.2.x!), we can simply send 0 instead. (See ticket #7803). + + This might be a good place to use a consensus parameter, so + that a large number of clients switch at the same time. + + I claim this would be suitable for backport to 0.2.4. + +5. The application layer + + The application layer is mostly out of scope for this proposal, + except: + + TorBrowser already (I hear) drops the timestamp from the + ClientRandom field in TLS. We should encourage other TLS + applications to do so. (See Appendix A.) + + + +================================================================= +APPENDIX A: "Let's replace gmt_unix_time in TLS" + +PROBLEM: + +The gmt_unix_time field in the Random field in the TLS handshake +provides a way for an observer to fingerprint clients. + +Despite the late date, much of the world is still not +synchronized to the second via an ntp-like service. This means +that different clients have different views of the current time, +which provides a fingerprint that helps to track and distinguish +them. This fingerprint is useful for tracking clients as they +move around. It can also distinguish clients using a single VPN, +NAT, or privacy network. (Tor's modified firefox avoids this by +not sending the time.) + +Worse, some implementations don't send the current time, but the +process time, or the computer's uptime, both of which are far +more distinguishing than the current time() value. + +The information fingerprint here is strong enough to uniquely +identify some TLS users (the ones whose clocks are hours off). +Even for the ones whose clocks are mostly right (within a second +or two), the field leaks a bit of information, and it only takes +so many bits to make a user unique. + + +WHY gmt_unix_time IN THE FIRST PLACE? + +According to third-hand reports -- (and correct me if I'm wrong!) +it was introduced in SSL 3.0 to prevent complete failure in cases +where the PRNG was completely broken, by making a part of the +Random field that would definitely vary between TLS handshakes. + +I doubt that this goal is really achieved: on modern desktop +environments, it's not really so strange to start two TLS +connections within the same second. + +WHY ELSE IS gmt_unix_time USED? + +The consensus among implementors seems to be that it's unwise to +depend on any particular value or interpretation for the field. +The TLS 1.2 standard, RFC 5246, says that "Clocks are not +required to be set correctly by the basic TLS protocol; +higher-level or application protocols may define additional +requirements." + +Some implementations set the entire field randomly; this appears +not to have broken TLS on the internet. + +At least one tool (tlsdate) uses the server-side value of the +field as an authenticated view of the current time. + + + +PROPOSAL 1: + +Declare that implementations MAY replace gmt_unix_time either +with four more random bytes, or four bytes of zeroes. + +Make your implementation just do that. + +(Rationale: some implementations (like TorBrowser) are already +doing this in practice. It's sensible and simple. You're +unlikely to mess it up, or cause trouble.) + + + +PROPOSAL 2: + +Okay, if you really want to preserve the security allegedly +provided by gmt_unix_time, allow the following approach instead: + +Set the Random field, not to 32 bytes from your PRNG, but to the +HMAC-SHA256 of any high resolution timer that you have, using 32 +bytes from your PRNG as a key. In other words, replace this: + + Random.gmt_unix_time = time(); + Random.random_bytes = get_random_bytes(28) + +with this: + + now = hires_time(); // clock_gettime(), or concatenate time() + // with a CPU timer, or process + // uptime, or whatever. + key = get_random_bytes(32); + Random = hmac_sha256(key, now); + +This approach is better than the status quo on the following +counts: + + * It doesn't leak your view of the current time, assuming that + your PRNG isn't busted. + + * It actually fixes the problem that gmt_unix_time purported to + fix, by using a high-resolution time that's much less likely to + be used twice. Even if the PRNG is broken, the value is still + nonrepeating. + +It is not worse than the status quo: + + * It is unpredictable from an attacker's POV, assuming that the + PRNG works. (Because an HMAC, even of known data, with an + unknown random key is supposed to look random). + + +CONSIDERATIONS: + +I'd personally suggest proposal 1 (just set the field at random) for +most users. Yes, it makes things a little worse if your PRNG can +generate repeat values... but nearly everything in cryptography +fails if your PRNG is broken. + + +You might want to apply this fix on clients only. With a few +exceptions (like hidden services) the server's view of the current +time is not sensitive. + + +Implementors might want to make this feature optional and +on-by-default, just in case some higher-level application protocol +really does depend on it. +==================================================================

1 0

[metrics-db/master] Fix build errors on Debian systems
by karsten＠torproject.org 22 Aug '13

22 Aug '13

commit 12cdab447ab65fb0044ecc1818d37b2523187708 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Thu Aug 22 16:04:42 2013 +0200 Fix build errors on Debian systems This ports commit 3e60ccdaaba598cabb7281d45f9a415299b8e3e3 from metrics-lib over, originally written by Jens-Michael Hoffmann <jmho(a)jmho.de>, with minor tweaks by Karsten Loesing. The local lib directory is not used anymore and respective references were removed. The java dependencies are now specified in the build.xml and taken from their installed locations. In addition to git, openjdk-6-jdk and ant the following java packages have to be installed: - libcommons-codec-java - libcommons-compress-java Slighty tweaked by Sebastian Hahn to remove references to unused junit. --- build.xml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/build.xml b/build.xml index afdc195..4b5c2ff 100644 --- a/build.xml +++ b/build.xml @@ -5,10 +5,10 @@ <property name="name" value="ERNIE"/> <path id="classpath"> <pathelement path="${classes}"/> - <pathelement location="lib/commons-codec-1.4.jar"/> - <pathelement location="lib/commons-compress-1.3.jar"/> - <pathelement location="lib/junit-4.8.2.jar"/> - <pathelement location="lib/descriptor.jar"/> + <fileset dir="/usr/share/java"> + <include name="commons-codec.jar"/> + <include name="commons-compress.jar"/> + </fileset> </path> <target name="init"> <mkdir dir="${classes}"/>

1 0

[metrics-db/master] Add metrics-lib submodule
by karsten＠torproject.org 22 Aug '13

22 Aug '13

commit 399a9a76dcf9407145268d0548f9d40a01d1b1be Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Thu Aug 22 16:44:36 2013 +0200 Add metrics-lib submodule --- .gitmodules | 3 +++ deps/metrics-lib | 1 + 2 files changed, 4 insertions(+) diff --git a/.gitmodules b/.gitmodules new file mode 100644 index 0000000..c6b6388 --- /dev/null +++ b/.gitmodules @@ -0,0 +1,3 @@ +[submodule "deps/metrics-lib"] + path = deps/metrics-lib + url = https://git.torproject.org/metrics-lib diff --git a/deps/metrics-lib b/deps/metrics-lib new file mode 160000 index 0000000..3e60ccd --- /dev/null +++ b/deps/metrics-lib @@ -0,0 +1 @@ +Subproject commit 3e60ccdaaba598cabb7281d45f9a415299b8e3e3

1 0

[metrics-db/master] Support building from the submodule
by karsten＠torproject.org 22 Aug '13

22 Aug '13

commit 5ad88084abec6671403c9fa46d5ce3d43dc93e7b Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Thu Aug 22 16:42:42 2013 +0200 Support building from the submodule --- build.xml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/build.xml b/build.xml index 4b5c2ff..218d6b5 100644 --- a/build.xml +++ b/build.xml @@ -9,12 +9,18 @@ <include name="commons-codec.jar"/> <include name="commons-compress.jar"/> </fileset> + <fileset dir="deps/metrics-lib"> + <include name="descriptor.jar"/> + </fileset> </path> <target name="init"> <mkdir dir="${classes}"/> <copy file="config.template" tofile="config"/> </target> - <target name="compile" depends="init"> + <target name="metrics-lib"> + <ant dir="deps/metrics-lib"/> + </target> + <target name="compile" depends="metrics-lib,init"> <javac srcdir="${sources}" destdir="${classes}" excludes="org/torproject/ernie/web/"

1 0

[metrics-db/master] Remove now unused lib/ from .gitignore.
by karsten＠torproject.org 22 Aug '13

22 Aug '13

commit e7eea812af39a459b6dcd5f46f58f034e02ed26a Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Thu Aug 22 17:09:39 2013 +0200 Remove now unused lib/ from .gitignore. --- .gitignore | 1 - 1 file changed, 1 deletion(-) diff --git a/.gitignore b/.gitignore index dd63dac..10681a4 100644 --- a/.gitignore +++ b/.gitignore @@ -7,7 +7,6 @@ in/ out/ doc/manual.aux doc/manual.log -lib/ log/ rsync/ stats/

1 0

[tor/master] Separate mutable/const accessors for circuit_build_times
by nickm＠torproject.org 22 Aug '13

22 Aug '13

commit 775c491502e43f0490023b2917c4e1a05b38b5b8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 21 12:10:05 2013 -0400 Separate mutable/const accessors for circuit_build_times (These have proved invaluable for other global accessors.) --- src/or/channel.c | 2 +- src/or/circuitbuild.c | 6 +++--- src/or/circuitlist.c | 2 +- src/or/circuitstats.c | 22 ++++++++++++++-------- src/or/circuitstats.h | 13 +++++++------ src/or/circuituse.c | 12 +++++++----- src/or/connection_or.c | 8 ++++---- src/or/entrynodes.c | 2 +- src/or/networkstatus.c | 2 +- src/or/statefile.c | 2 +- 10 files changed, 40 insertions(+), 31 deletions(-) diff --git a/src/or/channel.c b/src/or/channel.c index 8743437..7f39549 100644 --- a/src/or/channel.c +++ b/src/or/channel.c @@ -2361,7 +2361,7 @@ channel_do_open_actions(channel_t *chan) started_here = channel_is_outgoing(chan); if (started_here) { - circuit_build_times_network_is_live(get_circuit_build_times()); + circuit_build_times_network_is_live(get_circuit_build_times_mutable()); rep_hist_note_connect_succeeded(chan->identity_digest, now); if (entry_guard_register_connect_status( chan->identity_digest, 1, 0, now) < 0) { diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index cb2f423..a203cee 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -782,14 +782,14 @@ circuit_send_next_onion_skin(origin_circuit_t *circ) /* Only count circuit times if the network is live */ if (circuit_build_times_network_check_live( get_circuit_build_times())) { - circuit_build_times_add_time(get_circuit_build_times(), + circuit_build_times_add_time(get_circuit_build_times_mutable(), (build_time_t)timediff); - circuit_build_times_set_timeout(get_circuit_build_times()); + circuit_build_times_set_timeout(get_circuit_build_times_mutable()); } if (circ->base_.purpose != CIRCUIT_PURPOSE_C_MEASURE_TIMEOUT) { circuit_build_times_network_circ_success( - get_circuit_build_times()); + get_circuit_build_times_mutable()); } } } diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c index 1edea85..50caf37 100644 --- a/src/or/circuitlist.c +++ b/src/or/circuitlist.c @@ -678,7 +678,7 @@ origin_circuit_new(void) init_circuit_base(TO_CIRCUIT(circ)); - get_circuit_build_times()->last_circ_at = approx_time(); + get_circuit_build_times_mutable()->last_circ_at = approx_time(); return circ; } diff --git a/src/or/circuitstats.c b/src/or/circuitstats.c index 25813de..0d60a19 100644 --- a/src/or/circuitstats.c +++ b/src/or/circuitstats.c @@ -36,12 +36,18 @@ static int unit_tests = 0; #define unit_tests 0 #endif -circuit_build_times_t * +const circuit_build_times_t * get_circuit_build_times(void) { return &circ_times; } +circuit_build_times_t * +get_circuit_build_times_mutable(void) +{ + return &circ_times; +} + double get_circuit_build_close_time_ms(void) { @@ -175,7 +181,7 @@ circuit_build_times_min_circs_to_observe(void) /** Return true iff <b>cbt</b> has recorded enough build times that we * want to start acting on the timeout it implies. */ int -circuit_build_times_enough_to_compute(circuit_build_times_t *cbt) +circuit_build_times_enough_to_compute(const circuit_build_times_t *cbt) { return cbt->total_build_times >= circuit_build_times_min_circs_to_observe(); } @@ -578,7 +584,7 @@ circuit_build_times_add_time(circuit_build_times_t *cbt, build_time_t time) * Return maximum circuit build time */ static build_time_t -circuit_build_times_max(circuit_build_times_t *cbt) +circuit_build_times_max(const circuit_build_times_t *cbt) { int i = 0; build_time_t max_build_time = 0; @@ -619,7 +625,7 @@ circuit_build_times_min(circuit_build_times_t *cbt) * The return value must be freed by the caller. */ static uint32_t * -circuit_build_times_create_histogram(circuit_build_times_t *cbt, +circuit_build_times_create_histogram(const circuit_build_times_t *cbt, build_time_t *nbins) { uint32_t *histogram; @@ -709,7 +715,7 @@ circuit_build_times_get_xm(circuit_build_times_t *cbt) * the or_state_t state structure. */ void -circuit_build_times_update_state(circuit_build_times_t *cbt, +circuit_build_times_update_state(const circuit_build_times_t *cbt, or_state_t *state) { uint32_t *histogram; @@ -1146,7 +1152,7 @@ circuit_build_times_initial_alpha(circuit_build_times_t *cbt, * Returns true if we need circuits to be built */ int -circuit_build_times_needs_circuits(circuit_build_times_t *cbt) +circuit_build_times_needs_circuits(const circuit_build_times_t *cbt) { /* Return true if < MIN_CIRCUITS_TO_OBSERVE */ return !circuit_build_times_enough_to_compute(cbt); @@ -1157,7 +1163,7 @@ circuit_build_times_needs_circuits(circuit_build_times_t *cbt) * right now. */ int -circuit_build_times_needs_circuits_now(circuit_build_times_t *cbt) +circuit_build_times_needs_circuits_now(const circuit_build_times_t *cbt) { return circuit_build_times_needs_circuits(cbt) && approx_time()-cbt->last_circ_at > circuit_build_times_test_frequency(); @@ -1290,7 +1296,7 @@ circuit_build_times_network_close(circuit_build_times_t *cbt, * in the case of recent liveness changes. */ int -circuit_build_times_network_check_live(circuit_build_times_t *cbt) +circuit_build_times_network_check_live(const circuit_build_times_t *cbt) { if (cbt->liveness.nonlive_timeouts > 0) { return 0; diff --git a/src/or/circuitstats.h b/src/or/circuitstats.h index 4115b68..196af3f 100644 --- a/src/or/circuitstats.h +++ b/src/or/circuitstats.h @@ -12,13 +12,14 @@ #ifndef TOR_CIRCUITSTATS_H #define TOR_CIRCUITSTATS_H -circuit_build_times_t *get_circuit_build_times(void); +const circuit_build_times_t *get_circuit_build_times(void); +circuit_build_times_t *get_circuit_build_times_mutable(void); double get_circuit_build_close_time_ms(void); double get_circuit_build_timeout_ms(void); int circuit_build_times_disabled(void); -int circuit_build_times_enough_to_compute(circuit_build_times_t *cbt); -void circuit_build_times_update_state(circuit_build_times_t *cbt, +int circuit_build_times_enough_to_compute(const circuit_build_times_t *cbt); +void circuit_build_times_update_state(const circuit_build_times_t *cbt, or_state_t *state); int circuit_build_times_parse_state(circuit_build_times_t *cbt, or_state_t *state); @@ -29,9 +30,9 @@ int circuit_build_times_count_close(circuit_build_times_t *cbt, void circuit_build_times_set_timeout(circuit_build_times_t *cbt); int circuit_build_times_add_time(circuit_build_times_t *cbt, build_time_t time); -int circuit_build_times_needs_circuits(circuit_build_times_t *cbt); +int circuit_build_times_needs_circuits(const circuit_build_times_t *cbt); -int circuit_build_times_needs_circuits_now(circuit_build_times_t *cbt); +int circuit_build_times_needs_circuits_now(const circuit_build_times_t *cbt); void circuit_build_times_init(circuit_build_times_t *cbt); void circuit_build_times_free_timeouts(circuit_build_times_t *cbt); void circuit_build_times_new_consensus_params(circuit_build_times_t *cbt, @@ -61,7 +62,7 @@ void circuitbuild_running_unit_tests(void); /* Network liveness functions */ void circuit_build_times_network_is_live(circuit_build_times_t *cbt); -int circuit_build_times_network_check_live(circuit_build_times_t *cbt); +int circuit_build_times_network_check_live(const circuit_build_times_t *cbt); void circuit_build_times_network_circ_success(circuit_build_times_t *cbt); #endif diff --git a/src/or/circuituse.c b/src/or/circuituse.c index 919ca35..e3c0d0c 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -545,7 +545,7 @@ circuit_expire_building(void) * was a timeout, and the timeout value needs to reset if we * see enough of them. Note this means we also need to avoid * double-counting below, too. */ - circuit_build_times_count_timeout(get_circuit_build_times(), + circuit_build_times_count_timeout(get_circuit_build_times_mutable(), first_hop_succeeded); TO_ORIGIN_CIRCUIT(victim)->relaxed_timeout = 1; } @@ -658,8 +658,9 @@ circuit_expire_building(void) * have a timeout. We also want to avoid double-counting * already "relaxed" circuits, which are counted above. */ if (!TO_ORIGIN_CIRCUIT(victim)->relaxed_timeout) { - circuit_build_times_count_timeout(get_circuit_build_times(), - first_hop_succeeded); + circuit_build_times_count_timeout( + get_circuit_build_times_mutable(), + first_hop_succeeded); } continue; } @@ -676,10 +677,11 @@ circuit_expire_building(void) (long)(now.tv_sec - victim->timestamp_began.tv_sec), victim->purpose, circuit_purpose_to_string(victim->purpose)); - } else if (circuit_build_times_count_close(get_circuit_build_times(), + } else if (circuit_build_times_count_close( + get_circuit_build_times_mutable(), first_hop_succeeded, victim->timestamp_created.tv_sec)) { - circuit_build_times_set_timeout(get_circuit_build_times()); + circuit_build_times_set_timeout(get_circuit_build_times_mutable()); } } } diff --git a/src/or/connection_or.c b/src/or/connection_or.c index b7e72fd..7912bfb 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -1749,7 +1749,7 @@ connection_tls_finish_handshake(or_connection_t *conn) digest_rcvd) < 0) return -1; - circuit_build_times_network_is_live(get_circuit_build_times()); + circuit_build_times_network_is_live(get_circuit_build_times_mutable()); if (tor_tls_used_v1_handshake(conn->tls)) { conn->link_proto = 1; @@ -1783,7 +1783,7 @@ connection_or_launch_v3_or_handshake(or_connection_t *conn) tor_assert(connection_or_nonopen_was_started_here(conn)); tor_assert(tor_tls_received_v3_certificate(conn->tls)); - circuit_build_times_network_is_live(get_circuit_build_times()); + circuit_build_times_network_is_live(get_circuit_build_times_mutable()); connection_or_change_state(conn, OR_CONN_STATE_OR_HANDSHAKING_V3); if (connection_init_or_handshake_state(conn, 1) < 0) @@ -2016,7 +2016,7 @@ connection_or_process_cells_from_inbuf(or_connection_t *conn) if (conn->chan) channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan)); - circuit_build_times_network_is_live(get_circuit_build_times()); + circuit_build_times_network_is_live(get_circuit_build_times_mutable()); channel_tls_handle_var_cell(var_cell, conn); var_cell_free(var_cell); } else { @@ -2032,7 +2032,7 @@ connection_or_process_cells_from_inbuf(or_connection_t *conn) if (conn->chan) channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan)); - circuit_build_times_network_is_live(get_circuit_build_times()); + circuit_build_times_network_is_live(get_circuit_build_times_mutable()); connection_fetch_from_buf(buf, cell_network_size, TO_CONN(conn)); /* retrieve cell info from buf (create the host-order struct from the diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index b3764a9..b66cc2b 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -2279,6 +2279,6 @@ entry_guards_free_all(void) clear_bridge_list(); smartlist_free(bridge_list); bridge_list = NULL; - circuit_build_times_free_timeouts(get_circuit_build_times()); + circuit_build_times_free_timeouts(get_circuit_build_times_mutable()); } diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c index 8b4a791..35a20b0 100644 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@ -1822,7 +1822,7 @@ networkstatus_set_current_consensus(const char *consensus, * current consensus really alter our view of any OR's rate limits? */ connection_or_update_token_buckets(get_connection_array(), options); - circuit_build_times_new_consensus_params(get_circuit_build_times(), + circuit_build_times_new_consensus_params(get_circuit_build_times_mutable(), current_consensus); } diff --git a/src/or/statefile.c b/src/or/statefile.c index 4b61fde..db9091c 100644 --- a/src/or/statefile.c +++ b/src/or/statefile.c @@ -239,7 +239,7 @@ or_state_set(or_state_t *new_state) ret = -1; } if (circuit_build_times_parse_state( - get_circuit_build_times(),global_state) < 0) { + get_circuit_build_times_mutable(),global_state) < 0) { ret = -1; } return ret;

1 0

[tor/master] Documentation for new cbt accessors
by nickm＠torproject.org 22 Aug '13

22 Aug '13

commit 79cad08b4f9afd13a7151b8e15ae6481df82478f Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 21 12:17:20 2013 -0400 Documentation for new cbt accessors --- src/or/circuitstats.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/or/circuitstats.c b/src/or/circuitstats.c index 0d60a19..e7b4b36 100644 --- a/src/or/circuitstats.c +++ b/src/or/circuitstats.c @@ -36,24 +36,31 @@ static int unit_tests = 0; #define unit_tests 0 #endif +/** Return a pointer to the data structure describing our current circuit + * build time history and computations. */ const circuit_build_times_t * get_circuit_build_times(void) { return &circ_times; } +/** As get_circuit_build_times, but return a mutable pointer. */ circuit_build_times_t * get_circuit_build_times_mutable(void) { return &circ_times; } +/** Return the time to wait before actually closing an under-construction, in + * milliseconds. */ double get_circuit_build_close_time_ms(void) { return circ_times.close_ms; } +/** Return the time to wait before giving up on an under-construction circuit, + * in milliseconds. */ double get_circuit_build_timeout_ms(void) {

1 0

[tor/master] changes file for 6153
by nickm＠torproject.org 22 Aug '13

22 Aug '13

commit 49b8acc61872a35165cc1375edc4dcdeabfc68b4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 21 12:12:21 2013 -0400 changes file for 6153 --- changes/6153_circuittime_accessor | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changes/6153_circuittime_accessor b/changes/6153_circuittime_accessor new file mode 100644 index 0000000..16f1f55 --- /dev/null +++ b/changes/6153_circuittime_accessor @@ -0,0 +1,4 @@ + o Code simplification and refactoring: + + - Add a set of accessor functions for the circuit timeout data + structure. Fixes ticket 6153; patch from "piet".

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits August 2013