tor-commits August 2013

tor-commits@lists.torproject.org

19 participants
1224 discussions

[torspec/master] Introduce the "bridge-transports" extra-info descriptor field.
by nickm＠torproject.org 15 Aug '13

15 Aug '13

commit a01bb8e8e285d644c2e59c0ea788e45bf37470f4 Author: George Kadianakis <desnacked(a)riseup.net> Date: Thu Jan 24 15:04:10 2013 +0200 Introduce the "bridge-transports" extra-info descriptor field. --- dir-spec.txt | 22 ++++++++++++++++++++++ pt-spec.txt | 5 ++++- 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/dir-spec.txt b/dir-spec.txt index 09a5967..e143b2d 100644 --- a/dir-spec.txt +++ b/dir-spec.txt @@ -680,6 +680,28 @@ List of unique IP addresses that have connected to the bridge per protocol family. + "bridge-ip-transports" PT=N,PT=N,... NL + [At most once.] + + List of mappings from pluggable transport names to the number + of unique IP addresses that have connected using that + pluggable transport. Unobfuscated connections are counted + using the reserved pluggable transport name "<OR>" (without + quotes). If we received a connection from a transport proxy + but we couldn't figure out the name of the pluggable + transport, we use the reserved pluggable transport name + "<??>". + + ("<OR>" and "<??>" are reserved because normal pluggable + transport names MUST match the following regular expression: + "[a-zA-Z_][a-zA-Z0-9_]*" ) + + The pluggable transport name list is sorted into lexically + ascending order. + + If no clients have connected to the bridge yet, we only write + "bridge-ip-transports" to the stats file. + "dirreq-stats-end" YYYY-MM-DD HH:MM:SS (NSEC s) NL [At most once.] diff --git a/pt-spec.txt b/pt-spec.txt index 72662b6..ed136ef 100644 --- a/pt-spec.txt +++ b/pt-spec.txt @@ -38,7 +38,10 @@ Specifications: Client behavior as necessary. If a key or value value must contain a semicolon or a backslash, it is escaped with a backslash. - Method names must be C identifiers. + Method names MUST be C identifiers. That is, method names must begin + with a letter or underscore and the rest of the characters can be + letters, numbers or underscores. No length limit is imposed. The + relevant regular expression is: "[a-zA-Z_][a-zA-Z0-9_]*". For reference, the old bridge format was Bridge address[:port] [id-fingerprint]

1 0

[torspec/master] Merge branch 'bug8045_take3_squashed'
by nickm＠torproject.org 15 Aug '13

15 Aug '13

commit fef346f33a579f7f4014fac94685938755d2f3b2 Merge: 8e2cfca a01bb8e Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Aug 15 12:22:21 2013 -0400 Merge branch 'bug8045_take3_squashed' dir-spec.txt | 22 ++++++++++++++++++++++ pt-spec.txt | 5 ++++- 2 files changed, 26 insertions(+), 1 deletion(-)

1 0

[torspec/master] Pass name of transport to the Extended ORPort.
by nickm＠torproject.org 15 Aug '13

15 Aug '13

commit 1656e00cabb9d638c705494bbd3cfe40244eaee6 Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Dec 24 20:32:51 2012 +0200 Pass name of transport to the Extended ORPort. --- proposals/196-transport-control-ports.txt | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/proposals/196-transport-control-ports.txt b/proposals/196-transport-control-ports.txt index 549e8ce..0488934 100644 --- a/proposals/196-transport-control-ports.txt +++ b/proposals/196-transport-control-ports.txt @@ -67,8 +67,11 @@ Target: 0.2.4.x bytes sent by the transport will be those tunneled over it. (body ignored) - [0x0001] USERADDR: an address:port string that represents the user's - address. + [0x0001] USERADDR: an address:port string that represents the + user's address. + + [0x0002] TRANSPORT: a string of the name of the pluggable + transport currently in effect on the connection. Replies sent from tor to the proxy are: @@ -82,7 +85,10 @@ Target: 0.2.4.x the TransportControlPort. See the 'Association and identifier creation' section below. - Parties should ignore command codes that they do not understand. + Parties MUST ignore command codes that they do not understand. + + If the server receives a recognized command that does not parse, it + MUST close the connection to the client. 3.2. The new TransportControlPort protocol

1 0

[torspec/master] Add descriptions for the commands of the Extended ORPort.
by nickm＠torproject.org 15 Aug '13

15 Aug '13

commit 3fe179789a9c0e86fe69240cf183fd7a196f3a5f Author: George Kadianakis <desnacked(a)riseup.net> Date: Wed Feb 6 00:42:23 2013 +0000 Add descriptions for the commands of the Extended ORPort. --- proposals/196-transport-control-ports.txt | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/proposals/196-transport-control-ports.txt b/proposals/196-transport-control-ports.txt index 0488934..db97ea7 100644 --- a/proposals/196-transport-control-ports.txt +++ b/proposals/196-transport-control-ports.txt @@ -55,6 +55,8 @@ Target: 0.2.4.x 3.1. The new extended ORPort protocol +3.1.1. Protocol + The extended server port protocol is as follows: COMMAND [2 bytes, big-endian] @@ -68,7 +70,7 @@ Target: 0.2.4.x (body ignored) [0x0001] USERADDR: an address:port string that represents the - user's address. + client's address. [0x0002] TRANSPORT: a string of the name of the pluggable transport currently in effect on the connection. @@ -90,6 +92,28 @@ Target: 0.2.4.x If the server receives a recognized command that does not parse, it MUST close the connection to the client. +3.1.2. Command descriptions + +3.1.2.1. USERADDR + + An ASCII string holding the TCP/IP address of the client of the + pluggable transport proxy. A Tor bridge SHOULD use that address to + collect statistics about its clients. + + The string MUST not be NUL-terminated. + +3.1.2.2. TRANSPORT + + An ASCII string holding the name of the pluggable transport used by + the client of the pluggable transport proxy. A Tor bridge that + supports multiple transports SHOULD use that information to collect + statistics about the popularity of individual pluggable transports. + + The string MUST not be NUL-terminated. + + Pluggable transport names are C-identifiers and Tor MUST check them + for correctness. + 3.2. The new TransportControlPort protocol The TransportControlPort protocol is as follows:

1 0

[torspec/master] Merge branch 'bug7751_take2_squashed'
by nickm＠torproject.org 15 Aug '13

15 Aug '13

commit 8e2cfca81a0e67ee90c8df55e97da02fe71494f7 Merge: 5380544 3fe1797 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Aug 15 12:20:39 2013 -0400 Merge branch 'bug7751_take2_squashed' proposals/196-transport-control-ports.txt | 36 ++++++++++++++++++++++++++--- 1 file changed, 33 insertions(+), 3 deletions(-)

1 0

r26309: {website} i put newer pt ttb's up (website/trunk/include)
by Roger Dingledine 15 Aug '13

15 Aug '13

Author: arma Date: 2013-08-15 16:17:06 +0000 (Thu, 15 Aug 2013) New Revision: 26309 Modified: website/trunk/include/versions.wmi Log: i put newer pt ttb's up Modified: website/trunk/include/versions.wmi =================================================================== --- website/trunk/include/versions.wmi 2013-08-13 13:10:57 UTC (rev 26308) +++ website/trunk/include/versions.wmi 2013-08-15 16:17:06 UTC (rev 26309) @@ -33,7 +33,7 @@ <define-tag version-torbrowser-vidalia whitespace=delete>0.2.21</define-tag> <define-tag version-torimbrowserbundle whitespace=delete>1.3.21</define-tag> <define-tag version-torbrowserbundlealpha whitespace=delete>2.4.16-beta-1</define-tag> -<define-tag version-torobfsbundlealpha whitespace=delete>2.4.15-beta-2-pt1</define-tag> +<define-tag version-torobfsbundlealpha whitespace=delete>2.4.16-beta-1-pt1</define-tag> <define-tag version-torbrowserbundlelinux32 whitespace=delete>2.3.25-12</define-tag> <define-tag version-torbrowserbundlelinux64 whitespace=delete>2.3.25-12</define-tag> @@ -44,8 +44,8 @@ <define-tag version-gnu-torbrowser-vidalia whitespace=delete>0.2.21</define-tag> <define-tag version-torbrowserbundlelinux32alpha whitespace=delete>2.4.16-beta-1</define-tag> <define-tag version-torbrowserbundlelinux64alpha whitespace=delete>2.4.16-beta-1</define-tag> -<define-tag version-torobfsbundlelinux32alpha whitespace=delete>2.4.15-beta-2-pt1</define-tag> -<define-tag version-torobfsbundlelinux64alpha whitespace=delete>2.4.15-beta-2-pt1</define-tag> +<define-tag version-torobfsbundlelinux32alpha whitespace=delete>2.4.16-beta-1-pt1</define-tag> +<define-tag version-torobfsbundlelinux64alpha whitespace=delete>2.4.16-beta-1-pt1</define-tag> <define-tag version-torbrowserbundleosx32 whitespace=delete>2.3.25-12</define-tag> <define-tag version-torbrowserbundleosx64 whitespace=delete>2.3.25-12</define-tag> @@ -55,8 +55,8 @@ <define-tag version-osx-torbrowser-vidalia whitespace=delete>0.2.21</define-tag> <define-tag version-torbrowserbundleosx32alpha whitespace=delete>2.4.16-beta-1</define-tag> <define-tag version-torbrowserbundleosx64alpha whitespace=delete>2.4.16-beta-1</define-tag> -<define-tag version-torobfsbundleosx32alpha whitespace=delete>2.4.15-beta-2-pt1</define-tag> -<define-tag version-torobfsbundleosx64alpha whitespace=delete>2.4.15-beta-2-pt1</define-tag> +<define-tag version-torobfsbundleosx32alpha whitespace=delete>2.4.16-beta-1-pt1</define-tag> +<define-tag version-torobfsbundleosx64alpha whitespace=delete>2.4.16-beta-1-pt1</define-tag> <define-tag version-vidalia-stable whitespace=delete>0.2.21</define-tag> <define-tag version-vidalia-alpha whitespace=delete>0.3.1</define-tag>

1 0

[tor/master] Fix a wide line in test_geoip_with_pt
by nickm＠torproject.org 15 Aug '13

15 Aug '13

commit 172a55d9d6056a67a6e860c241fb0f5884a85fd0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Aug 15 12:10:10 2013 -0400 Fix a wide line in test_geoip_with_pt --- src/test/test.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/test/test.c b/src/test/test.c index 8693180..f895563 100644 --- a/src/test/test.c +++ b/src/test/test.c @@ -1334,7 +1334,8 @@ test_geoip_with_pt(void) /* Test the transport history string. */ s = geoip_get_transport_history(); tor_assert(s); - test_streq(s, "<OR>=8,alpha=16,beta=8,charlie=16,ddr=136,entropy=8,fire=8,google=8"); + test_streq(s, "<OR>=8,alpha=16,beta=8,charlie=16,ddr=136," + "entropy=8,fire=8,google=8"); /* Stop collecting entry statistics. */ geoip_entry_stats_term();

1 0

[tor/master] Add changes file for #4773.
by nickm＠torproject.org 15 Aug '13

15 Aug '13

commit 1743144c341218e4af88423cccd2bf93e72730a1 Author: George Kadianakis <desnacked(a)riseup.net> Date: Thu Aug 15 19:15:34 2013 +0300 Add changes file for #4773. --- changes/bug5040 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changes/bug5040 b/changes/bug5040 index a2c37e7..720665b 100644 --- a/changes/bug5040 +++ b/changes/bug5040 @@ -1,4 +1,8 @@ o Minor features: + - Bridges now track GeoIP information and the number of their + users even when pluggable transports are in use. These + statistics are reported in their extra-info descriptors like + normal bridges do. Resolves ticket 4773. - Bridges now track the usage of their pluggable transports and report statistics in their extra-info descriptors. Resolves ticket 5040.

1 0

[tor/master] Prepare codebase for the implementation of Extended ORPort auth.
by nickm＠torproject.org 15 Aug '13

15 Aug '13

commit 93b9f85d410aba1202b72e169ce386c783136b26 Author: George Kadianakis <desnacked(a)riseup.net> Date: Wed Dec 5 18:38:42 2012 +0200 Prepare codebase for the implementation of Extended ORPort auth. --- src/or/connection.c | 10 ++++++++-- src/or/or.h | 28 ++++++++++++++++++++++------ 2 files changed, 30 insertions(+), 8 deletions(-) diff --git a/src/or/connection.c b/src/or/connection.c index ad8e39c..9aea501 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -170,6 +170,12 @@ conn_state_to_string(int type, int state) break; case CONN_TYPE_EXT_OR: switch (state) { + case EXT_OR_CONN_STATE_AUTH_WAIT_AUTH_TYPE: + return "waiting for authentication type"; + case EXT_OR_CONN_STATE_AUTH_WAIT_CLIENT_NONCE: + return "waiting for client nonce"; + case EXT_OR_CONN_STATE_AUTH_WAIT_CLIENT_HASH: + return "waiting for client hash"; case EXT_OR_CONN_STATE_OPEN: return "open"; case EXT_OR_CONN_STATE_FLUSHING: return "flushing final OKAY"; } @@ -1398,8 +1404,7 @@ connection_init_accepted_conn(connection_t *conn, switch (conn->type) { case CONN_TYPE_EXT_OR: - conn->state = EXT_OR_CONN_STATE_OPEN; - break; + return connection_ext_or_start_auth(TO_OR_CONN(conn)); case CONN_TYPE_OR: control_event_or_conn_status(TO_OR_CONN(conn), OR_CONN_EVENT_NEW, 0); rv = connection_tls_start_handshake(TO_OR_CONN(conn), 1); @@ -4450,6 +4455,7 @@ assert_connection_ok(connection_t *conn, time_t now) case CONN_TYPE_OR: tor_assert(conn->state >= OR_CONN_STATE_MIN_); tor_assert(conn->state <= OR_CONN_STATE_MAX_); + break; case CONN_TYPE_EXT_OR: tor_assert(conn->state >= EXT_OR_CONN_STATE_MIN_); tor_assert(conn->state <= EXT_OR_CONN_STATE_MAX_); diff --git a/src/or/or.h b/src/or/or.h index e81d7a9..63d137c 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -315,14 +315,24 @@ typedef enum { #define OR_CONN_STATE_OPEN 8 #define OR_CONN_STATE_MAX_ 8 -/** States of Extended ORPort. */ +/** States of the Extended ORPort protocol. Be careful before changing + * the numbers: they matter. */ #define EXT_OR_CONN_STATE_MIN_ 1 -/** Extended ORPort just launched, and is accepting connections. */ -#define EXT_OR_CONN_STATE_OPEN 1 +/** Extended ORPort authentication is waiting for the authentication + * type selected by the client. */ +#define EXT_OR_CONN_STATE_AUTH_WAIT_AUTH_TYPE 1 +/** Extended ORPort authentication is waiting for the client nonce. */ +#define EXT_OR_CONN_STATE_AUTH_WAIT_CLIENT_NONCE 2 +/** Extended ORPort authentication is waiting for the client hash. */ +#define EXT_OR_CONN_STATE_AUTH_WAIT_CLIENT_HASH 3 +#define EXT_OR_CONN_STATE_AUTH_MAX 3 +/** Authentication finished and the Extended ORPort is now accepting + * traffic. */ +#define EXT_OR_CONN_STATE_OPEN 4 /** Extended ORPort is flushing its last messages and preparing to * start accepting OR connections. */ -#define EXT_OR_CONN_STATE_FLUSHING 2 -#define EXT_OR_CONN_STATE_MAX_ 2 +#define EXT_OR_CONN_STATE_FLUSHING 5 +#define EXT_OR_CONN_STATE_MAX_ 5 #define EXIT_CONN_STATE_MIN_ 1 /** State for an exit connection: waiting for response from DNS farm. */ @@ -1440,6 +1450,9 @@ typedef struct or_connection_t { char identity_digest[DIGEST_LEN]; /** Extended ORPort connection identifier. */ char *ext_or_conn_id; + /** Client hash of the Extended ORPort authentication scheme */ + char *ext_or_auth_correct_client_hash; + char *nickname; /**< Nickname of OR on other side (if any). */ tor_tls_t *tls; /**< TLS connection state. */ @@ -3771,7 +3784,10 @@ typedef struct { int CookieAuthentication; /**< Boolean: do we enable cookie-based auth for * the control system? */ - char *CookieAuthFile; /**< Location of a cookie authentication file. */ + char *CookieAuthFile; /**< Filesystem location of a ControlPort + * authentication cookie. */ + char *ExtORPortCookieAuthFile; /**< Filesystem location of Extended + * ORPort authentication cookie. */ int CookieAuthFileGroupReadable; /**< Boolean: Is the CookieAuthFile g+r? */ int LeaveStreamsUnattached; /**< Boolean: Does Tor attach new streams to * circuits itself (0), or does it expect a controller

1 0

[tor/master] Implement Extended ORPort authentication.
by nickm＠torproject.org 15 Aug '13

15 Aug '13

commit 4a55e39997a9fbe5a5b03432bd85140ed193eb93 Author: George Kadianakis <desnacked(a)riseup.net> Date: Wed Dec 5 18:39:21 2012 +0200 Implement Extended ORPort authentication. --- src/or/connection_or.c | 244 +++++++++++++++++++++++++++++++++++++++++++++++- src/or/connection_or.h | 2 + 2 files changed, 243 insertions(+), 3 deletions(-) diff --git a/src/or/connection_or.c b/src/or/connection_or.c index e6fbb79..db2ac9f 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -2495,6 +2495,10 @@ connection_ext_or_transition(or_connection_t *conn) #define EXT_OR_PORT_AUTH_COOKIE_HEADER_LEN 32 #define EXT_OR_PORT_AUTH_COOKIE_FILE_LEN EXT_OR_PORT_AUTH_COOKIE_LEN+EXT_OR_PORT_AUTH_COOKIE_HEADER_LEN #define EXT_OR_PORT_AUTH_COOKIE_HEADER "! Extended ORPort Auth Cookie !\x0a" +#define EXT_OR_PORT_AUTH_HASH_LEN DIGEST256_LEN +#define EXT_OR_PORT_AUTH_NONCE_LEN 32 +#define EXT_OR_PORT_AUTH_SERVER_TO_CLIENT_CONST "ExtORPort authentication server-to-client hash" +#define EXT_OR_PORT_AUTH_CLIENT_TO_SERVER_CONST "ExtORPort authentication client-to-server hash" /** If true, we've set ext_or_auth_cookie to a secret code and stored * it to disk. */ @@ -2569,6 +2573,194 @@ init_ext_or_auth_cookie_authentication(int is_enabled) #define EXT_OR_CMD_BT_DENY 0x1001 #define EXT_OR_CMD_BT_CONTROL 0x1002 +/** DOCDOCDOC + Return -1 on error. 0 on unsufficient data. 1 on correct. +*/ +static int +connection_ext_or_auth_neg_auth_type(connection_t *conn) /* XXX unit tests */ +{ + char authtype[1] = {0}; + + if (connection_get_inbuf_len(conn) < 1) + return 0; + + if (connection_fetch_from_buf(authtype, 1, conn) < 0) + return -1; + + log_warn(LD_GENERAL, "Client wants us to use %d auth type", authtype[0]); + if (authtype[0] != 1) /* '1' is the only auth type supported atm */ + return -1; + + conn->state = EXT_OR_CONN_STATE_AUTH_WAIT_CLIENT_NONCE; /* XXX maybe do state transition in process_inbuf ? */ + return 1; +} + +static int +connection_ext_or_auth_handle_client_nonce(connection_t *conn) +{ + char server_hash[EXT_OR_PORT_AUTH_HASH_LEN] = {0}; + char client_nonce[EXT_OR_PORT_AUTH_NONCE_LEN] = {0}; + char server_nonce[EXT_OR_PORT_AUTH_NONCE_LEN] = {0}; + char reply[EXT_OR_PORT_AUTH_COOKIE_LEN+EXT_OR_PORT_AUTH_NONCE_LEN] = {0}; + + if (!ext_or_auth_cookie_is_set) { /* this should not happen */ + log_warn(LD_BUG, "Extended ORPort authentication cookie was not set. " + "That's weird since we should have done that on startup. " + "This might be a Tor bug, please file a bug report. "); + return -1; + } + + if (connection_get_inbuf_len(conn) < EXT_OR_PORT_AUTH_NONCE_LEN) + return 0; + + if (connection_fetch_from_buf(client_nonce, EXT_OR_PORT_AUTH_NONCE_LEN, conn) < 0) /* XXX check-spaces */ + return -1; + + /* Get our nonce */ + if (crypto_rand(server_nonce, EXT_OR_PORT_AUTH_NONCE_LEN) < 0) + return -1; + + { /* set up macs */ + size_t hmac_s_msg_len = strlen(EXT_OR_PORT_AUTH_SERVER_TO_CLIENT_CONST) + + 2*EXT_OR_PORT_AUTH_NONCE_LEN; + size_t hmac_c_msg_len = strlen(EXT_OR_PORT_AUTH_CLIENT_TO_SERVER_CONST) + + 2*EXT_OR_PORT_AUTH_NONCE_LEN; + + char *hmac_s_msg = tor_malloc_zero(hmac_s_msg_len); + char *hmac_c_msg = tor_malloc_zero(hmac_c_msg_len); + char *correct_client_hash = tor_malloc_zero(EXT_OR_PORT_AUTH_HASH_LEN); + + memcpy(hmac_s_msg, + EXT_OR_PORT_AUTH_SERVER_TO_CLIENT_CONST, + strlen(EXT_OR_PORT_AUTH_SERVER_TO_CLIENT_CONST)); + memcpy(hmac_s_msg + strlen(EXT_OR_PORT_AUTH_SERVER_TO_CLIENT_CONST), + client_nonce, EXT_OR_PORT_AUTH_NONCE_LEN); + memcpy(hmac_s_msg + strlen(EXT_OR_PORT_AUTH_SERVER_TO_CLIENT_CONST) + + EXT_OR_PORT_AUTH_NONCE_LEN, + server_nonce, EXT_OR_PORT_AUTH_NONCE_LEN); + + memcpy(hmac_c_msg, + EXT_OR_PORT_AUTH_CLIENT_TO_SERVER_CONST, + strlen(EXT_OR_PORT_AUTH_CLIENT_TO_SERVER_CONST)); + memcpy(hmac_c_msg + strlen(EXT_OR_PORT_AUTH_CLIENT_TO_SERVER_CONST), + client_nonce, EXT_OR_PORT_AUTH_NONCE_LEN); + memcpy(hmac_c_msg + strlen(EXT_OR_PORT_AUTH_CLIENT_TO_SERVER_CONST) + + EXT_OR_PORT_AUTH_NONCE_LEN, + server_nonce, EXT_OR_PORT_AUTH_NONCE_LEN); + + crypto_hmac_sha256(server_hash, + ext_or_auth_cookie, + EXT_OR_PORT_AUTH_COOKIE_LEN, + hmac_s_msg, + hmac_s_msg_len); + + crypto_hmac_sha256(correct_client_hash, + ext_or_auth_cookie, + EXT_OR_PORT_AUTH_COOKIE_LEN, + hmac_c_msg, + hmac_c_msg_len); + + /* Store the client hash we generated. We will need to compare it + with the hash sent by the client. */ + TO_OR_CONN(conn)->ext_or_auth_correct_client_hash = correct_client_hash; + + tor_free(hmac_s_msg); + tor_free(hmac_c_msg); + } + + { /* debug logging */ /* XXX disable this codepath if not logging on debug? */ + char server_hash_encoded[(2*EXT_OR_PORT_AUTH_HASH_LEN) + 1]; + char server_nonce_encoded[(2*EXT_OR_PORT_AUTH_NONCE_LEN) + 1]; + char client_nonce_encoded[(2*EXT_OR_PORT_AUTH_NONCE_LEN) + 1]; + + base16_encode(server_hash_encoded, sizeof(server_hash_encoded), + server_hash, sizeof(server_hash)); + base16_encode(server_nonce_encoded, sizeof(server_nonce_encoded), + server_nonce, sizeof(server_nonce)); + base16_encode(client_nonce_encoded, sizeof(client_nonce_encoded), + client_nonce, sizeof(client_nonce)); + + log_warn(LD_GENERAL, "server_hash: '%s'\nserver_nonce: '%s'\nclient_nonce: '%s'", + server_hash_encoded, server_nonce_encoded, client_nonce_encoded); + } + + { /* write reply: (server_hash, server_nonce) */ + memcpy(reply, server_hash, EXT_OR_PORT_AUTH_HASH_LEN); + memcpy(reply + EXT_OR_PORT_AUTH_HASH_LEN, server_nonce, EXT_OR_PORT_AUTH_NONCE_LEN); + connection_write_to_buf(reply, sizeof(reply), conn); + } + + log_warn(LD_GENERAL, "Got client nonce, and sent our own nonce and hash."); + + conn->state = EXT_OR_CONN_STATE_AUTH_WAIT_CLIENT_HASH; + return 1; +} + +#define connection_ext_or_auth_send_result_success(c) \ + connection_ext_or_auth_send_result(c, 1) +#define connection_ext_or_auth_send_result_fail(c) \ + connection_ext_or_auth_send_result(c, 0) + +static void +connection_ext_or_auth_send_result(connection_t *conn, int success) +{ + if (success) + connection_write_to_buf("\x01", 1, conn); + else + connection_write_to_buf("\x00", 1, conn); +} + +static int +connection_ext_or_auth_handle_client_hash(connection_t *conn) +{ + char provided_client_hash[EXT_OR_PORT_AUTH_HASH_LEN] = {0}; + + if (connection_get_inbuf_len(conn) < EXT_OR_PORT_AUTH_HASH_LEN) + return 0; + + if (connection_fetch_from_buf(provided_client_hash, EXT_OR_PORT_AUTH_HASH_LEN, conn) < 0) + return -1; + + if (tor_memneq(TO_OR_CONN(conn)->ext_or_auth_correct_client_hash, + provided_client_hash, EXT_OR_PORT_AUTH_HASH_LEN)) { + log_warn(LD_GENERAL, "Incorrect client hash. Authentication failed."); + connection_ext_or_auth_send_result_fail(conn); + return -1; + } + + log_warn(LD_GENERAL, "Got client's hash and it was legit."); + + /* send positive auth result */ + connection_ext_or_auth_send_result_success(conn); + conn->state = EXT_OR_CONN_STATE_OPEN; + return 1; +} + +/** DOCDOCDOC + Return -1 on error. 0 on unsufficient data. 1 on correct. +*/ +static int +connection_ext_or_auth_process_inbuf(or_connection_t *or_conn) +{ + connection_t *conn = TO_CONN(or_conn); + + switch (conn->state) { /* Functionify */ + case EXT_OR_CONN_STATE_AUTH_WAIT_AUTH_TYPE: + return connection_ext_or_auth_neg_auth_type(conn); + + case EXT_OR_CONN_STATE_AUTH_WAIT_CLIENT_NONCE: + return connection_ext_or_auth_handle_client_nonce(conn); + + case EXT_OR_CONN_STATE_AUTH_WAIT_CLIENT_HASH: + return connection_ext_or_auth_handle_client_hash(conn); + + default: + log_warn(LD_BUG, "Encountered unexpected connection state %d while trying " + "to process Extended ORPort authentication data.", conn->state); + return -1; + } +} + /** Process Extended ORPort messages from <b>or_conn</b>. */ int connection_ext_or_process_inbuf(or_connection_t *or_conn) @@ -2577,11 +2769,27 @@ connection_ext_or_process_inbuf(or_connection_t *or_conn) ext_or_cmd_t *command; int r; + /* If we are still in the authentication stage, process traffic as + authentication data: */ + while (conn->state <= EXT_OR_CONN_STATE_AUTH_MAX) { + log_warn(LD_GENERAL, "Got Extended ORPort authentication data (%u).", + (unsigned int) connection_get_inbuf_len(conn)); + r = connection_ext_or_auth_process_inbuf(or_conn); + if (r < 0) { + connection_mark_for_close(conn); + return -1; + } else if (r == 0) { + return 0; + } + /* if r > 0, loop and process more data (if any). */ + } + while (1) { + log_warn(LD_GENERAL, "Got Extended ORPort data."); command = NULL; r = connection_fetch_ext_or_cmd_from_buf(conn, &command); if (r < 0) - return -1; + goto err; else if (r == 0) return 0; /* need to wait for more data */ @@ -2602,6 +2810,9 @@ connection_ext_or_process_inbuf(or_connection_t *or_conn) conn->state = EXT_OR_CONN_STATE_FLUSHING; connection_stop_reading(conn); } else if (command->cmd == EXT_OR_CMD_TB_USERADDR) { + /* XXX Put this in a function of its own. We need to empasize + that we change the address and port of this connection. */ + /* Copy address string. */ tor_addr_t addr; uint16_t port; @@ -2612,8 +2823,6 @@ connection_ext_or_process_inbuf(or_connection_t *or_conn) memcpy(addr_str, command->body, command->len); addr_str[command->len] = 0; - log_debug(LD_NET, "Received USERADDR: '%s'!", addr_str); - res = tor_addr_port_split(LOG_INFO, addr_str, &address_part, &port); tor_free(addr_str); if (res<0) @@ -2624,6 +2833,18 @@ connection_ext_or_process_inbuf(or_connection_t *or_conn) if (res<0) goto err; + { + char *old_address = tor_dup_addr(&conn->addr); + char *new_address = tor_dup_addr(&addr); + + log_warn(LD_NET, "Received USERADDR." /* XXX FIX ALL LOG SEVERITIES AND MESSAGES */ + "We rewrite our address from '%s:%u' to '%s:%u'.", + safe_str(old_address), conn->port, safe_str(new_address), port); + + tor_free(old_address); + tor_free(new_address); + } + /* record the address */ tor_addr_copy(&conn->addr, &addr); conn->port = port; @@ -2639,6 +2860,7 @@ connection_ext_or_process_inbuf(or_connection_t *or_conn) err: ext_or_cmd_free(command); + connection_mark_for_close(conn); return -1; } @@ -2654,3 +2876,19 @@ connection_ext_or_finished_flushing(or_connection_t *conn) } return 0; } + +/* DOCDOCDOC */ +int +connection_ext_or_start_auth(or_connection_t *or_conn) +{ + connection_t *conn = TO_CONN(or_conn); + char authtypes[2] = "\x01\x00"; /* We only support authtype '1' for now. */ + + log_warn(LD_GENERAL, + "ExtORPort authentication: Sending supported authentication types"); + + connection_write_to_buf(authtypes, sizeof(authtypes), conn); + conn->state = EXT_OR_CONN_STATE_AUTH_WAIT_AUTH_TYPE; + + return 0; +} diff --git a/src/or/connection_or.h b/src/or/connection_or.h index 1e9a652..d420dc7 100644 --- a/src/or/connection_or.h +++ b/src/or/connection_or.h @@ -45,6 +45,8 @@ void connection_or_close_for_error(or_connection_t *orconn, int flush); void connection_or_report_broken_states(int severity, int domain); +int connection_ext_or_start_auth(or_connection_t *or_conn); + int connection_tls_start_handshake(or_connection_t *conn, int receiving); int connection_tls_continue_handshake(or_connection_t *conn);

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits August 2013