November 2014 - tor-commits - lists.torproject.org

[doctor/master] Drop config option for ignoring authorities
by atagar＠torproject.org 12 Nov '14

12 Nov '14

commit cf116bb9d3ef6f4cf75d6f94b9a3bb99ef304598 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Nov 12 09:01:32 2014 -0800 Drop config option for ignoring authorities We just had this due to turtles. Now that Stem no longer includes it among the authorities it enumerates there's no need for this. Dropping support for the config option since I hope we won't need this again! --- consensus_health_checker.py | 22 ++++++++-------------- data/consensus_health.cfg | 4 ---- 2 files changed, 8 insertions(+), 18 deletions(-) diff --git a/consensus_health_checker.py b/consensus_health_checker.py index 0719fd6..13497bf 100755 --- a/consensus_health_checker.py +++ b/consensus_health_checker.py @@ -33,7 +33,6 @@ EMAIL_SUBJECT = 'Consensus issues' CONFIG = stem.util.conf.config_dict('consensus_health', { 'msg': {}, 'suppression': {}, - 'ignored_authorities': [], 'bandwidth_authorities': [], 'known_params': [], }) @@ -182,11 +181,6 @@ def rate_limit_notice(issue): config.save() -@lru_cache() -def directory_authorities(): - return dict((k, v) for (k, v) in DIRECTORY_AUTHORITIES.items() if k not in CONFIG['ignored_authorities']) - - def main(): start_time = time.time() @@ -492,7 +486,7 @@ def has_all_signatures(latest_consensus, consensuses, votes): missing_authority = missing_signature - for authority in directory_authorities().values(): + for authority in DIRECTORY_AUTHORITIES.values(): if authority.v3ident == missing_signature: missing_authority = authority.nickname break @@ -570,9 +564,9 @@ def has_authority_flag(latest_consensus, consensuses, votes): if Flag.AUTHORITY in desc.flags: seen_authorities.add(desc.nickname) - known_authorities = set(directory_authorities().keys()) + known_authorities = set(DIRECTORY_AUTHORITIES.keys()) missing_authorities = known_authorities.difference(seen_authorities) - extra_authorities = seen_authorities.difference(known_authorities) - set(CONFIG['ignored_authorities']) + extra_authorities = seen_authorities.difference(known_authorities) issues = [] @@ -590,8 +584,8 @@ def has_expected_fingerprints(latest_consensus, consensuses, votes): issues = [] for desc in latest_consensus.routers.values(): - if desc.nickname in directory_authorities() and Flag.NAMED in desc.flags: - expected_fingerprint = directory_authorities()[desc.nickname].fingerprint + if desc.nickname in DIRECTORY_AUTHORITIES and Flag.NAMED in desc.flags: + expected_fingerprint = DIRECTORY_AUTHORITIES[desc.nickname].fingerprint if desc.fingerprint != expected_fingerprint: issues.append(Issue(Runlevel.ERROR, 'FINGERPRINT_MISMATCH', authority = desc.nickname, expected = desc.fingerprint, actual = expected_fingerprint)) @@ -605,7 +599,7 @@ def is_recommended_versions(latest_consensus, consensuses, votes): outdated_authorities = {} min_version = min(latest_consensus.server_versions) - for authority in directory_authorities().values(): + for authority in DIRECTORY_AUTHORITIES.values(): desc = latest_consensus.routers.get(authority.fingerprint) if desc and desc.version and desc.version < min_version: @@ -694,7 +688,7 @@ def get_votes(): def _get_documents(label, resource): queries, documents, issues = {}, {}, [] - for authority in directory_authorities().values(): + for authority in DIRECTORY_AUTHORITIES.values(): if authority.v3ident is None: continue # not a voting authority @@ -711,7 +705,7 @@ def _get_documents(label, resource): if label == 'vote': # try to download the vote via the other authorities - v3ident = directory_authorities()[authority].v3ident + v3ident = DIRECTORY_AUTHORITIES[authority].v3ident query = downloader.query( '/tor/status-vote/current/%s' % v3ident, diff --git a/data/consensus_health.cfg b/data/consensus_health.cfg index 3320129..c417287 100644 --- a/data/consensus_health.cfg +++ b/data/consensus_health.cfg @@ -26,10 +26,6 @@ suppression MISSING_AUTHORITIES => 24 # 1 day suppression TOR_OUT_OF_DATE => 24 # 1 day suppression AUTHORITY_UNAVAILABLE => 24 # 1 day -# directory authorities for which to not provide notifications - -ignored_authorities turtles - # directory authorities that run bandwidth scanners bandwidth_authorities moria1

1 0

[stem/master] Replacing turtles with longclaw
by atagar＠torproject.org 12 Nov '14

12 Nov '14

commit 08c00c073821202549237d4681c95d3890a25444 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Nov 12 08:53:24 2014 -0800 Replacing turtles with longclaw In the next day or two we'll be replacing turtles with longclaw... https://lists.torproject.org/pipermail/tor-talk/2014-November/035650.html Sebastian would find it to be helpful for DocTor alerts to be changed in advance of this so swapping us over now. --- docs/change_log.rst | 1 + stem/descriptor/remote.py | 16 ++++++++-------- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/docs/change_log.rst b/docs/change_log.rst index 369806a..e11c316 100644 --- a/docs/change_log.rst +++ b/docs/change_log.rst @@ -54,6 +54,7 @@ The following are only available within Stem's `git repository * Improved speed for parsing consensus documents by around 30% (:trac:`12859`) * Don't fail if consensus method 1 is not present, as it is no longer required (:spec:`fc8a6f0`) + * Updated the authorities we list, `replacing turtles with longclaw <https://lists.torproject.org/pipermail/tor-talk/2014-November/035650.html>`_ and `updating gabelmoo's address <https://lists.torproject.org/pipermail/tor-talk/2014-September/034898.html>`_ * **Utilities** diff --git a/stem/descriptor/remote.py b/stem/descriptor/remote.py index 4f44608..1e1a29e 100644 --- a/stem/descriptor/remote.py +++ b/stem/descriptor/remote.py @@ -696,14 +696,6 @@ DIRECTORY_AUTHORITIES = { fingerprint = '4A0CCD2DDC7995083D73F5D667100C8A5831F16D', v3ident = None, # does not vote in the consensus ), - 'turtles': DirectoryAuthority( - nickname = 'turtles', - address = '76.73.17.194', - or_port = 9090, - dir_port = 9030, - fingerprint = 'F397038ADC51336135E7B80BD99CA3844360292B', - v3ident = '27B6B5996C426270A5C95488AA5BCEB6BCC86956', - ), 'gabelmoo': DirectoryAuthority( nickname = 'gabelmoo', address = '131.188.40.189', @@ -744,6 +736,14 @@ DIRECTORY_AUTHORITIES = { fingerprint = 'CF6D0AAFB385BE71B8E111FC5CFF4B47923733BC', v3ident = 'EFCBE720AB3A82B99F9E953CD5BF50F7EEFC7B97', ), + 'longclaw': DirectoryAuthority( + nickname = 'longclaw', + address = '202.85.227.202', + or_port = 443, + dir_port = 80, + fingerprint = '74A910646BCEEFBCD2E874FC1DC997430F968145', + v3ident = '23D15D965BC35114467363C165C4F724B64B4F66', + ), }

1 0

[translation/torbutton-torbuttondtd] Update translations for torbutton-torbuttondtd
by translation＠torproject.org 12 Nov '14

12 Nov '14

commit 678cb68a5c0094249ee3cb8b580c140ae4b327d0 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Nov 12 15:45:47 2014 +0000 Update translations for torbutton-torbuttondtd --- pt/torbutton.dtd | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/pt/torbutton.dtd b/pt/torbutton.dtd index c7388a2..d2b83a9 100644 --- a/pt/torbutton.dtd +++ b/pt/torbutton.dtd @@ -44,7 +44,7 @@ <!ENTITY torbutton.context_menu.openTorWindow.key "d"> <!ENTITY torbutton.button.label "Torbutton"> <!ENTITY torbutton.button.tooltip "Clique para iniciar o Torbutton"> -<!ENTITY torbutton.prefs.privacy_security_settings "Privacy and Security Settings"> +<!ENTITY torbutton.prefs.privacy_security_settings "Privacidade e Definições de Segurança"> <!ENTITY torbutton.prefs.block_thread "Bloquear leitura do histórico durante a utilização do Tor (crucial)"> <!ENTITY torbutton.prefs.block_thwrite "Bloquear escrita no histórico durante a utilização do Tor (recomendado)"> <!ENTITY torbutton.prefs.block_nthread "Bloquear leitura do histórico durante a não utilização do Tor (opcional)"> @@ -149,9 +149,9 @@ <!ENTITY torbutton.prefs.restrict_thirdparty "Restrict third party cookies and other tracking data"> <!ENTITY torbutton.prefs.block_plugins "Desabilitar plugins (como o Flash)"> <!ENTITY torbutton.prefs.resist_fingerprinting "Change details that distinguish you from other Tor Browser users"> -<!ENTITY torbutton.prefs.sec_caption "Security Level"> -<!ENTITY torbutton.prefs.sec_low "Low (default)"> -<!ENTITY torbutton.prefs.sec_med_low "Medium-Low"> -<!ENTITY torbutton.prefs.sec_med_high "Medium-High"> -<!ENTITY torbutton.prefs.sec_high "High"> -<!ENTITY torbutton.prefs.sec_custom "Custom Values"> +<!ENTITY torbutton.prefs.sec_caption "Nível de Segurança"> +<!ENTITY torbutton.prefs.sec_low "Baixo (pré-definido)"> +<!ENTITY torbutton.prefs.sec_med_low "Médio-Baixo"> +<!ENTITY torbutton.prefs.sec_med_high "Médio-Alto"> +<!ENTITY torbutton.prefs.sec_high "Alto"> +<!ENTITY torbutton.prefs.sec_custom "Valores definidos">

1 0

[tor/master] tweak 9812 changes file
by nickm＠torproject.org 12 Nov '14

12 Nov '14

commit ccc54d545ec15205d3ed3a92ad4c783adbdc97d1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Nov 12 10:28:33 2014 -0500 tweak 9812 changes file --- changes/bug9812 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changes/bug9812 b/changes/bug9812 index 308af8c..8791589 100644 --- a/changes/bug9812 +++ b/changes/bug9812 @@ -2,5 +2,5 @@ - Downgrade warnings about RSA signature failures to info log level. Emit a warning when extra info document is found incompatible with a corresponding router descriptor. Fixes bug - 9812. + 9812; bugfix on 0.0.6rc3.

1 0

[tor/master] Downgrade RSA signature verification failure error message to info loglevel.
by nickm＠torproject.org 12 Nov '14

12 Nov '14

commit 4b18d8931b0c719b52ce0e2ac39a03dbf2b0adb0 Author: rl1987 <rl1987(a)sdf.lonestar.org> Date: Sun Nov 9 17:39:23 2014 +0200 Downgrade RSA signature verification failure error message to info loglevel. --- src/common/crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 90a16fa..7138ba0 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1012,7 +1012,7 @@ crypto_pk_public_checksig(crypto_pk_t *env, char *to, env->key, RSA_PKCS1_PADDING); if (r<0) { - crypto_log_errors(LOG_WARN, "checking RSA signature"); + crypto_log_errors(LOG_INFO, "checking RSA signature"); return -1; } return r;

1 0

[tor/master] Print a warning when extra info document is found incompatible with router descriptor.
by nickm＠torproject.org 12 Nov '14

12 Nov '14

commit 7025f2dc5928050d4b6659d6d7341549be974094 Author: rl1987 <rl1987(a)sdf.lonestar.org> Date: Sun Nov 9 17:41:18 2014 +0200 Print a warning when extra info document is found incompatible with router descriptor. --- src/or/routerlist.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/or/routerlist.c b/src/or/routerlist.c index d81dae4..fb39b6e 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -2945,6 +2945,7 @@ MOCK_IMPL(STATIC was_router_added_t, extrainfo_insert,(routerlist_t *rl, extrainfo_t *ei)) { was_router_added_t r; + const char *compatibility_error_msg; routerinfo_t *ri = rimap_get(rl->identity_map, ei->cache_info.identity_digest); signed_descriptor_t *sd = @@ -2961,9 +2962,14 @@ extrainfo_insert,(routerlist_t *rl, extrainfo_t *ei)) r = ROUTER_NOT_IN_CONSENSUS; goto done; } - if (routerinfo_incompatible_with_extrainfo(ri, ei, sd, NULL)) { + if (routerinfo_incompatible_with_extrainfo(ri, ei, sd, + &compatibility_error_msg)) { r = (ri->cache_info.extrainfo_is_bogus) ? ROUTER_BAD_EI : ROUTER_NOT_IN_CONSENSUS; + + log_warn(LD_DIR,"router info incompatible with extra info (reason: %s)", + compatibility_error_msg); + goto done; }

1 0

[tor/master] Adding changes file for 9812.
by nickm＠torproject.org 12 Nov '14

12 Nov '14

commit e395783f23f58db7f27617014b7a3b4576251ada Author: rl1987 <rl1987(a)sdf.lonestar.org> Date: Sun Nov 9 17:55:35 2014 +0200 Adding changes file for 9812. --- changes/bug9812 | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/changes/bug9812 b/changes/bug9812 new file mode 100644 index 0000000..308af8c --- /dev/null +++ b/changes/bug9812 @@ -0,0 +1,6 @@ + o Minor bugfixes (logging): + - Downgrade warnings about RSA signature failures to info log + level. Emit a warning when extra info document is found + incompatible with a corresponding router descriptor. Fixes bug + 9812. +

1 0

[tor/master] Merge remote-tracking branch 'rl1987/bug9812'
by nickm＠torproject.org 12 Nov '14

12 Nov '14

commit 99e2a325f67c4c4ca904c76fe5345e35befabb9d Merge: a87c697 e395783 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Nov 12 10:27:12 2014 -0500 Merge remote-tracking branch 'rl1987/bug9812' changes/bug9812 | 6 ++++++ src/common/crypto.c | 2 +- src/or/routerlist.c | 8 +++++++- 3 files changed, 14 insertions(+), 2 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'public/bug13698_024_v1'
by nickm＠torproject.org 12 Nov '14

12 Nov '14

commit a87c697fb157f243bc48bba868a69a5182042822 Merge: 26e7e51 5e4174f Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Nov 12 10:23:55 2014 -0500 Merge remote-tracking branch 'public/bug13698_024_v1' changes/bug13698 | 6 ++++++ src/or/circuitlist.c | 41 +++++++++++++++++++++++------------------ src/or/or.h | 4 ++++ src/or/rendclient.c | 5 ++--- 4 files changed, 35 insertions(+), 21 deletions(-)

1 0

[tor/master] Fix: don't report timeout when closing parallel intro points
by nickm＠torproject.org 12 Nov '14

12 Nov '14

commit 34eb007d2201bad44bd6b72681f2c3552445dfc4 Author: David Goulet <dgoulet(a)ev0ke.net> Date: Mon Nov 10 14:38:53 2014 -0500 Fix: don't report timeout when closing parallel intro points When closing parallel introduction points, the given reason (timeout) was actually changed to "no reason" thus when the circuit purpose was CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT, we were reporting an introduction point failure and flagging it "unreachable". After three times, that intro point gets removed from the rend cache object. In the case of CIRCUIT_PURPOSE_C_INTRODUCING, the intro point was flagged has "timed out" and thus not used until the connection to the HS is closed where that flag gets reset. This commit adds an internal circuit reason called END_CIRC_REASON_IP_NOW_REDUNDANT which tells the closing circuit mechanism to not report any intro point failure. This has been observed while opening hundreds of connections to an HS on different circuit for each connection. This fix makes this use case to work like a charm. Fixes #13698. Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- changes/bug13698 | 4 ++++ src/or/circuitlist.c | 41 +++++++++++++++++++++++------------------ src/or/or.h | 4 ++++ src/or/rendclient.c | 5 ++--- 4 files changed, 33 insertions(+), 21 deletions(-) diff --git a/changes/bug13698 b/changes/bug13698 new file mode 100644 index 0000000..71e018b --- /dev/null +++ b/changes/bug13698 @@ -0,0 +1,4 @@ + o Bugfixes: + - When closing an introduction circuit that was opened in parallel, don't + mark it unreachable which can causes it to be removed from the rend cache + object thus not usable anymore. diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c index c7b15e4..6f12df8 100644 --- a/src/or/circuitlist.c +++ b/src/or/circuitlist.c @@ -1417,30 +1417,35 @@ circuit_mark_for_close_(circuit_t *circ, int reason, int line, tor_assert(circ->state == CIRCUIT_STATE_OPEN); tor_assert(ocirc->build_state->chosen_exit); tor_assert(ocirc->rend_data); - /* treat this like getting a nack from it */ - log_info(LD_REND, "Failed intro circ %s to %s (awaiting ack). %s", - safe_str_client(ocirc->rend_data->onion_address), - safe_str_client(build_state_get_exit_nickname(ocirc->build_state)), - timed_out ? "Recording timeout." : "Removing from descriptor."); - rend_client_report_intro_point_failure(ocirc->build_state->chosen_exit, - ocirc->rend_data, - timed_out ? - INTRO_POINT_FAILURE_TIMEOUT : - INTRO_POINT_FAILURE_GENERIC); + if (orig_reason != END_CIRC_REASON_IP_NOW_REDUNDANT) { + /* treat this like getting a nack from it */ + log_info(LD_REND, "Failed intro circ %s to %s (awaiting ack). %s", + safe_str_client(ocirc->rend_data->onion_address), + safe_str_client(build_state_get_exit_nickname(ocirc->build_state)), + timed_out ? "Recording timeout." : "Removing from descriptor."); + rend_client_report_intro_point_failure(ocirc->build_state->chosen_exit, + ocirc->rend_data, + timed_out ? + INTRO_POINT_FAILURE_TIMEOUT : + INTRO_POINT_FAILURE_GENERIC); + } } else if (circ->purpose == CIRCUIT_PURPOSE_C_INTRODUCING && reason != END_CIRC_REASON_TIMEOUT) { origin_circuit_t *ocirc = TO_ORIGIN_CIRCUIT(circ); if (ocirc->build_state->chosen_exit && ocirc->rend_data) { - log_info(LD_REND, "Failed intro circ %s to %s " - "(building circuit to intro point). " - "Marking intro point as possibly unreachable.", - safe_str_client(ocirc->rend_data->onion_address), - safe_str_client(build_state_get_exit_nickname(ocirc->build_state))); - rend_client_report_intro_point_failure(ocirc->build_state->chosen_exit, - ocirc->rend_data, - INTRO_POINT_FAILURE_UNREACHABLE); + if (orig_reason != END_CIRC_REASON_IP_NOW_REDUNDANT) { + log_info(LD_REND, "Failed intro circ %s to %s " + "(building circuit to intro point). " + "Marking intro point as possibly unreachable.", + safe_str_client(ocirc->rend_data->onion_address), + safe_str_client(build_state_get_exit_nickname(ocirc->build_state))); + rend_client_report_intro_point_failure(ocirc->build_state->chosen_exit, + ocirc->rend_data, + INTRO_POINT_FAILURE_UNREACHABLE); + } } } + if (circ->n_chan) { circuit_clear_cell_queue(circ, circ->n_chan); /* Only send destroy if the channel isn't closing anyway */ diff --git a/src/or/or.h b/src/or/or.h index 34f055c..f3e7b80 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -659,6 +659,10 @@ typedef enum { /* Negative reasons are internal: we never send them in a DESTROY or TRUNCATE * call; they only go to the controller for tracking */ + +/* Closing introduction point that were opened in parallel. */ +#define END_CIRC_REASON_IP_NOW_REDUNDANT -4 + /** Our post-timeout circuit time measurement period expired. * We must give up now */ #define END_CIRC_REASON_MEASUREMENT_EXPIRED -3 diff --git a/src/or/rendclient.c b/src/or/rendclient.c index 7abbfd6..4ff000d 100644 --- a/src/or/rendclient.c +++ b/src/or/rendclient.c @@ -368,8 +368,7 @@ rend_client_rendcirc_has_opened(origin_circuit_t *circ) } /** - * Called to close other intro circuits we launched in parallel - * due to timeout. + * Called to close other intro circuits we launched in parallel. */ static void rend_client_close_other_intros(const char *onion_address) @@ -387,7 +386,7 @@ rend_client_close_other_intros(const char *onion_address) log_info(LD_REND|LD_CIRC, "Closing introduction circuit %d that we " "built in parallel (Purpose %d).", oc->global_identifier, c->purpose); - circuit_mark_for_close(c, END_CIRC_REASON_TIMEOUT); + circuit_mark_for_close(c, END_CIRC_REASON_IP_NOW_REDUNDANT); } } }

1 0