September 2013 - tor-commits - lists.torproject.org

[tor/release-0.2.4] fold in changes entries
by arma＠torproject.org 30 Sep '13

30 Sep '13

commit 63bef6c6abd35dc0744eb9b9ac814d7b8fd1dd21 Author: Roger Dingledine <arma(a)torproject.org> Date: Mon Sep 30 00:55:01 2013 -0400 fold in changes entries --- ChangeLog | 27 +++++++++++++++++++++++++++ changes/bug9776 | 5 ----- changes/geoip-september2013 | 3 --- changes/no_client_timestamps_024 | 14 -------------- 4 files changed, 27 insertions(+), 22 deletions(-) diff --git a/ChangeLog b/ChangeLog index 1faa2b0..98f1d63 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,30 @@ +Changes in version 0.2.4.18-rc - 2013-10-?? + Tor 0.2.4.18-rc is the fourth release candidate for the Tor 0.2.4.x + series. [...] + + o Minor bugfixes: + - Always call circuit_n_chan_done(chan, 0) from channel_closed(), + so we can't leak pending circuits in some cases where + run_connection_housekeeping() calls connection_or_close_normally(). + Fixes bug 9776; bugfix on 0.2.4.17. + + o Minor features: + - Clients no longer send timestamps in their NETINFO cells. These were + not used for anything, and they provided one small way for clients + to be distinguished from each other as they moved from network to + network or behind NAT. Implements part of proposal 222. + - Clients now round timestamps in INTRODUCE cells down to the nearest + 10 minutes. If a new Support022HiddenServices option is set to 0, or + if it's set to "auto" and the feature is disabled in the consensus, + the timestamp is sent as 0 instead. Implements part of proposal 222. + - Stop sending timestamps in AUTHENTICATE cells. This is not such + a big deal from a security point of view, but it achieves no actual + good purpose, and isn't needed. Implements part of proposal 222. + - Reduce down accuracy of timestamps in hidden service descriptors. + Implements part of proposal 222. + - Update to the September 4 2013 Maxmind GeoLite Country database. + + Changes in version 0.2.4.17-rc - 2013-09-05 Tor 0.2.4.17-rc is the third release candidate for the Tor 0.2.4.x series. It adds an emergency step to help us tolerate the massive diff --git a/changes/bug9776 b/changes/bug9776 deleted file mode 100644 index ea3a96a..0000000 --- a/changes/bug9776 +++ /dev/null @@ -1,5 +0,0 @@ - o Normal bugfixes: - - Always call circuit_n_chan_done(chan, 0) from channel_closed(), so we - can't leak pending circuits in some cases where - run_connection_housekeeping() calls connection_or_close_normally(). - Fixes bug #9776; bugfix on 0.2.4.17. diff --git a/changes/geoip-september2013 b/changes/geoip-september2013 deleted file mode 100644 index 0173f4c..0000000 --- a/changes/geoip-september2013 +++ /dev/null @@ -1,3 +0,0 @@ - o Minor features: - - Update to the September 4 2013 Maxmind GeoLite Country database. - diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 deleted file mode 100644 index 41dea2f..0000000 --- a/changes/no_client_timestamps_024 +++ /dev/null @@ -1,14 +0,0 @@ - o Minor features (security, timestamp avoidance, proposal 222): - - Clients no longer send timestamps in their NETINFO cells. These were - not used for anything, and they provided one small way for clients - to be distinguished from each other as they moved from network to - network or behind NAT. Implements part of proposal 222. - - Clients now round timestamps in INTRODUCE cells down to the nearest - 10 minutes. If a new Support022HiddenServices option is set to 0, - or if it's set to "auto" and the feature is disabled in the consensus, - the timestamp is sent as 0 instead. Implements part of proposal 222. - - Stop sending timestamps in AUTHENTICATE cells. This is not such - a big deal from a security point of view, but it achieves no actual - good purpose, and isn't needed. Implements part of proposal 222. - - Reduce down accuracy of timestamps in hidden service descriptors. - Implements part of proposal 222.

1 0

[tor/release-0.2.4] Get ready to stop sending timestamps in INTRODUCE cells
by arma＠torproject.org 30 Sep '13

30 Sep '13

commit f8b44eedf725cadb15c3a0ad1bc5a0fa1dbbc21d Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 17 18:05:48 2013 -0400 Get ready to stop sending timestamps in INTRODUCE cells For now, round down to the nearest 10 minutes. Later, eliminate entirely by setting a consensus parameter. (This rounding is safe because, in 0.2.2, where the timestamp mattered, REND_REPLAY_TIME_INTERVAL was a nice generous 60 minutes.) --- changes/no_client_timestamps_024 | 9 +++++++-- doc/tor.1.txt | 9 +++++++++ src/or/config.c | 1 + src/or/or.h | 3 +++ src/or/rendclient.c | 20 +++++++++++++++++++- 5 files changed, 39 insertions(+), 3 deletions(-) diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 index 6df5307..fe8f419 100644 --- a/changes/no_client_timestamps_024 +++ b/changes/no_client_timestamps_024 @@ -1,5 +1,10 @@ - o Minor features (security): + o Minor features (security, timestamp avoidance, proposal 222): - Clients no longer send timestamps in their NETINFO cells. These were not used for anything, and they provided one small way for clients to be distinguished from each other as they moved from network to - network or behind NAT. + network or behind NAT. Implements part of proposal 222. + - Clients now round timestamps in INTRODUCE2 cells to the nearest + 10 minutes. If a new Support022HiddenServices option is set to 0, + or if it's set to "auto" and the feature is disabled in the consensus, + the timestamp is sent as 0 instead. + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index d53ff2e..ff760d4 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1338,6 +1338,15 @@ The following options are useful only for clients (that is, if Tor will use a default value chosen by the directory authorities. (Default: -1.) +**Support022HiddenServices** **0**|**1**|**auto**:: + Tor hidden services running versions before 0.2.3.x required clients to + send timestamps, which can potentially be used to distinguish clients + whose view of the current time is skewed. If this option is set to 0, we + do not send this timestamp, and hidden services on obsolete Tor versions + will not work. If this option is set to 1, we send the timestamp. If + this optoin is "auto", we take a recommendation from the latest consensus + document. (Default: auto) + SERVER OPTIONS -------------- diff --git a/src/or/config.c b/src/or/config.c index 4e08f3c..18f1c29 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -388,6 +388,7 @@ static config_var_t option_vars_[] = { V(SSLKeyLifetime, INTERVAL, "0"), OBSOLETE("StatusFetchPeriod"), V(StrictNodes, BOOL, "0"), + V(Support022HiddenServices, AUTOBOOL, "auto"), OBSOLETE("SysLog"), V(TestSocks, BOOL, "0"), OBSOLETE("TestVia"), diff --git a/src/or/or.h b/src/or/or.h index 8c6c1e3..eff5a6d 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4099,6 +4099,9 @@ typedef struct { /** How long (seconds) do we keep a guard before picking a new one? */ int GuardLifetime; + + /** Should we send the timestamps that pre-023 hidden services want? */ + int Support022HiddenServices; } or_options_t; /** Persistent state for an onion router, as saved to disk. */ diff --git a/src/or/rendclient.c b/src/or/rendclient.c index 7115bf2..9d48b9c 100644 --- a/src/or/rendclient.c +++ b/src/or/rendclient.c @@ -16,6 +16,7 @@ #include "connection_edge.h" #include "directory.h" #include "main.h" +#include "networkstatus.h" #include "nodelist.h" #include "relay.h" #include "rendclient.h" @@ -127,6 +128,16 @@ rend_client_reextend_intro_circuit(origin_circuit_t *circ) return result; } +/** Return true iff we should send timestamps in our INTRODUCE1 cells */ +static int +rend_client_should_send_timestamp(void) +{ + if (get_options()->Support022HiddenServices >= 0) + return get_options()->Support022HiddenServices; + + return networkstatus_get_param(NULL, "Support022HiddenServices", 1, 0, 1); +} + /** Called when we're trying to connect an ap conn; sends an INTRODUCE1 cell * down introcirc if possible. */ @@ -238,7 +249,14 @@ rend_client_send_introduction(origin_circuit_t *introcirc, REND_DESC_COOKIE_LEN); v3_shift += 2+REND_DESC_COOKIE_LEN; } - set_uint32(tmp+v3_shift+1, htonl((uint32_t)time(NULL))); + if (rend_client_should_send_timestamp()) { + time_t now = (uint32_t)time(NULL); + now += 300; + now -= now % 600; + set_uint32(tmp+v3_shift+1, htonl(now)); + } else { + set_uint32(tmp+v3_shift+1, 0); + } v3_shift += 4; } /* if version 2 only write version number */ else if (entry->parsed->protocols & (1<<2)) {

1 0

[tor/release-0.2.4] Merge branch 'no_client_timestamps_024_v2' into maint-0.2.4
by arma＠torproject.org 30 Sep '13

30 Sep '13

commit 07bb17185681f875be461c4fea6c661fae2dfde9 Merge: 0c807cf 39bb59d Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 20 11:00:43 2013 -0400 Merge branch 'no_client_timestamps_024_v2' into maint-0.2.4 changes/no_client_timestamps_024 | 14 ++++++++++++++ doc/tor.1.txt | 9 +++++++++ src/or/config.c | 1 + src/or/connection_or.c | 23 ++++++++--------------- src/or/or.h | 3 +++ src/or/rendclient.c | 20 +++++++++++++++++++- src/or/rendservice.c | 1 + 7 files changed, 55 insertions(+), 16 deletions(-)

1 0

[tor/release-0.2.4] Round down hidden service descriptor publication times to nearest hour
by arma＠torproject.org 30 Sep '13

30 Sep '13

commit fd2954d06d2e9b8b0d33bcd0a2e3dfb947ff662e Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 18 11:09:34 2013 -0400 Round down hidden service descriptor publication times to nearest hour Implements part of proposal 222. We can do this safely, since REND_CACHE_MAX_SKEW is 24 hours. --- changes/no_client_timestamps_024 | 2 ++ src/or/rendservice.c | 1 + 2 files changed, 3 insertions(+) diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 index 9ded8b3..488630f 100644 --- a/changes/no_client_timestamps_024 +++ b/changes/no_client_timestamps_024 @@ -10,3 +10,5 @@ - Stop sending timestamps in AUTHENTICATE cells. This is not such a big deal from a security point of view, but it achieves no actual good purpose, and isn't needed. Implements part of proposal 222. + - Reduce down accuracy of timestamps in hidden service descriptors. + Implements part of proposal 222. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 00bca17..8a4a11e 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -593,6 +593,7 @@ rend_service_update_descriptor(rend_service_t *service) d = service->desc = tor_malloc_zero(sizeof(rend_service_descriptor_t)); d->pk = crypto_pk_dup_key(service->private_key); d->timestamp = time(NULL); + d->timestamp -= d->timestamp % 3600; /* Round down to nearest hour */ d->intro_nodes = smartlist_new(); /* Support intro protocols 2 and 3. */ d->protocols = (1 << 2) + (1 << 3);

1 0

[tor/release-0.2.4] Remove the timestamp from AUTHENTICATE cells; replace with random bytes
by arma＠torproject.org 30 Sep '13

30 Sep '13

commit accadd8752bb26efeb31a5c866a16cc863963893 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 18 10:51:04 2013 -0400 Remove the timestamp from AUTHENTICATE cells; replace with random bytes This isn't actually much of an issue, since only relays send AUTHENTICATE cells, but while we're removing timestamps, we might as well do this too. Part of proposal 222. I didn't take the approach in the proposal of using a time-based HMAC, since that was a bad-prng-mitigation hack from SSL3, and in real life, if you don't have a good RNG, you're hopeless as a Tor server. --- changes/no_client_timestamps_024 | 8 +++++--- src/or/connection_or.c | 18 +++++------------- 2 files changed, 10 insertions(+), 16 deletions(-) diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 index fe8f419..9ded8b3 100644 --- a/changes/no_client_timestamps_024 +++ b/changes/no_client_timestamps_024 @@ -3,8 +3,10 @@ not used for anything, and they provided one small way for clients to be distinguished from each other as they moved from network to network or behind NAT. Implements part of proposal 222. - - Clients now round timestamps in INTRODUCE2 cells to the nearest + - Clients now round timestamps in INTRODUCE2 cells down to the nearest 10 minutes. If a new Support022HiddenServices option is set to 0, or if it's set to "auto" and the feature is disabled in the consensus, - the timestamp is sent as 0 instead. - + the timestamp is sent as 0 instead. Implements part of proposal 222. + - Stop sending timestamps in AUTHENTICATE cells. This is not such + a big deal from a security point of view, but it achieves no actual + good purpose, and isn't needed. Implements part of proposal 222. diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 95cb39a..39a5317 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -2287,19 +2287,11 @@ connection_or_compute_authenticate_cell_body(or_connection_t *conn, if (server) return V3_AUTH_FIXED_PART_LEN; // ptr-out - /* Time: 8 octets. */ - { - uint64_t now = time(NULL); - if ((time_t)now < 0) - return -1; - set_uint32(ptr, htonl((uint32_t)(now>>32))); - set_uint32(ptr+4, htonl((uint32_t)now)); - ptr += 8; - } - - /* Nonce: 16 octets. */ - crypto_rand((char*)ptr, 16); - ptr += 16; + /* 8 octets were reserved for the current time, but we're trying to get out + * of the habit of sending time around willynilly. Fortunately, nothing + * checks it. That's followed by 16 bytes of nonce. */ + crypto_rand((char*)ptr, 24); + ptr += 24; tor_assert(ptr - out == V3_AUTH_BODY_LEN);

1 0

[tor/release-0.2.4] Avoid error by not saying which intro cell type I mean
by arma＠torproject.org 30 Sep '13

30 Sep '13

commit 39bb59d36322f3092bcb8c80c54ce4930dddef3a Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 20 11:00:04 2013 -0400 Avoid error by not saying which intro cell type I mean --- changes/no_client_timestamps_024 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 index 488630f..41dea2f 100644 --- a/changes/no_client_timestamps_024 +++ b/changes/no_client_timestamps_024 @@ -3,7 +3,7 @@ not used for anything, and they provided one small way for clients to be distinguished from each other as they moved from network to network or behind NAT. Implements part of proposal 222. - - Clients now round timestamps in INTRODUCE2 cells down to the nearest + - Clients now round timestamps in INTRODUCE cells down to the nearest 10 minutes. If a new Support022HiddenServices option is set to 0, or if it's set to "auto" and the feature is disabled in the consensus, the timestamp is sent as 0 instead. Implements part of proposal 222.

1 0

[tor/release-0.2.4] back out most of 1d0ba9a
by arma＠torproject.org 30 Sep '13

30 Sep '13

commit 4f036acd274fe9e16b2b068575aa63e217db1dad Author: Roger Dingledine <arma(a)torproject.org> Date: Sat Sep 21 02:11:51 2013 -0400 back out most of 1d0ba9a this was causing directory authorities to send a time of 0 on all connections they generated themselves, which means everybody reachability test caused a time skew warning in the log for that relay. (i didn't just revert, because the changes file has been modified by other later commits.) --- src/or/connection_or.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 39a5317..9bf4e8d 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -2051,9 +2051,8 @@ connection_or_send_netinfo(or_connection_t *conn) memset(&cell, 0, sizeof(cell_t)); cell.command = CELL_NETINFO; - /* Timestamp, if we're a relay. */ - if (! conn->handshake_state->started_here) - set_uint32(cell.payload, htonl((uint32_t)now)); + /* Timestamp. */ + set_uint32(cell.payload, htonl((uint32_t)now)); /* Their address. */ out = cell.payload + 4;

1 0

[tor/release-0.2.4] Relays should send timestamp in NETINFO.
by arma＠torproject.org 30 Sep '13

30 Sep '13

commit d1dbaf247396fd18d758f8b7e06935830e38bf4a Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Sep 21 08:52:27 2013 -0400 Relays should send timestamp in NETINFO. This avoids skew warnings as authorities test reachability. Fix 9798; fix not on any released Tor. --- src/or/connection_or.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 9bf4e8d..0e9d06a 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -2051,8 +2051,9 @@ connection_or_send_netinfo(or_connection_t *conn) memset(&cell, 0, sizeof(cell_t)); cell.command = CELL_NETINFO; - /* Timestamp. */ - set_uint32(cell.payload, htonl((uint32_t)now)); + /* Timestamp, if we're a relay. */ + if (public_server_mode(get_options()) || ! conn->is_outgoing) + set_uint32(cell.payload, htonl((uint32_t)now)); /* Their address. */ out = cell.payload + 4;

1 0

[tor/release-0.2.4] Always call circuit_n_chan_done(chan, 0) from channel_closed()
by arma＠torproject.org 30 Sep '13

30 Sep '13

commit 938ee9b24dfda03a68a71d43b88e9fb00a90f9c8 Author: Andrea Shepard <andrea(a)torproject.org> Date: Mon Sep 23 09:37:26 2013 -0700 Always call circuit_n_chan_done(chan, 0) from channel_closed() --- changes/bug9776 | 5 +++++ src/or/channel.c | 9 ++++----- src/or/connection_or.c | 10 ++++++++++ 3 files changed, 19 insertions(+), 5 deletions(-) diff --git a/changes/bug9776 b/changes/bug9776 new file mode 100644 index 0000000..ea3a96a --- /dev/null +++ b/changes/bug9776 @@ -0,0 +1,5 @@ + o Normal bugfixes: + - Always call circuit_n_chan_done(chan, 0) from channel_closed(), so we + can't leak pending circuits in some cases where + run_connection_housekeeping() calls connection_or_close_normally(). + Fixes bug #9776; bugfix on 0.2.4.17. diff --git a/src/or/channel.c b/src/or/channel.c index 602797d..1fb39b8 100644 --- a/src/or/channel.c +++ b/src/or/channel.c @@ -1292,11 +1292,10 @@ channel_closed(channel_t *chan) if (chan->state == CHANNEL_STATE_CLOSED || chan->state == CHANNEL_STATE_ERROR) return; - if (chan->reason_for_closing == CHANNEL_CLOSE_FOR_ERROR) { - /* Inform any pending (not attached) circs that they should - * give up. */ - circuit_n_chan_done(chan, 0); - } + /* Inform any pending (not attached) circs that they should + * give up. */ + circuit_n_chan_done(chan, 0); + /* Now close all the attached circuits on it. */ circuit_unlink_all_from_channel(chan, END_CIRC_REASON_CHANNEL_CLOSED); diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 0e9d06a..3d16e14 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -1160,6 +1160,16 @@ connection_or_connect(const tor_addr_t *_addr, uint16_t port, /** Mark orconn for close and transition the associated channel, if any, to * the closing state. + * + * It's safe to call this and connection_or_close_for_error() any time, and + * channel layer will treat it as a connection closing for reasons outside + * its control, like the remote end closing it. It can also be a local + * reason that's specific to connection_t/or_connection_t rather than + * the channel mechanism, such as expiration of old connections in + * run_connection_housekeeping(). If you want to close a channel_t + * from somewhere that logically works in terms of generic channels + * rather than connections, use channel_mark_for_close(); see also + * the comment on that function in channel.c. */ void

1 0

[tor/release-0.2.4] Fix a compilation warning with older gcc
by arma＠torproject.org 30 Sep '13

30 Sep '13

commit 116e6af7a7024b4731ce6af75e8c5c5167314048 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 23 01:47:52 2013 -0400 Fix a compilation warning with older gcc --- src/or/rendclient.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/rendclient.c b/src/or/rendclient.c index 9d48b9c..bb4bd9b 100644 --- a/src/or/rendclient.c +++ b/src/or/rendclient.c @@ -250,7 +250,7 @@ rend_client_send_introduction(origin_circuit_t *introcirc, v3_shift += 2+REND_DESC_COOKIE_LEN; } if (rend_client_should_send_timestamp()) { - time_t now = (uint32_t)time(NULL); + uint32_t now = (uint32_t)time(NULL); now += 300; now -= now % 600; set_uint32(tmp+v3_shift+1, htonl(now));

1 0