April 2014 - tor-commits - lists.torproject.org

[translation/tails-misc] Update translations for tails-misc
by translation＠torproject.org 03 Apr '14

03 Apr '14

commit 395730e1f7d449987d043a737b1e3a0a82dcf656 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Apr 3 06:15:40 2014 +0000 Update translations for tails-misc --- ar.po | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/ar.po b/ar.po index e3655c1..2ad6964 100644 --- a/ar.po +++ b/ar.po @@ -5,6 +5,7 @@ # Translators: # skygazer <abudayeh.saleh(a)gmail.com>, 2014 # anchor <al3arbe1(a)gmail.com>, 2013 +# Arwa M, 2014 # matt_santy <matt_santy(a)hotmail.com>, 2013 # Mohammed ALDOUB <voulnet(a)gmail.com>, 2013 # Osamah Qashou <osamah_owis(a)windowslive.com>, 2014 @@ -16,8 +17,8 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2014-03-23 08:55+0100\n" -"PO-Revision-Date: 2014-04-02 20:20+0000\n" -"Last-Translator: Osamah Qashou <osamah_owis(a)windowslive.com>\n" +"PO-Revision-Date: 2014-04-03 06:00+0000\n" +"Last-Translator: Arwa M\n" "Language-Team: Arabic (http://www.transifex.com/projects/p/torproject/language/ar/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -326,7 +327,7 @@ msgstr "كرت الشبكة ${nic} معطّل" msgid "" "MAC spoofing failed for network card ${nic_name} (${nic}) so it is temporarily disabled.\n" "You might prefer to restart Tails and disable MAC spoofing. See the <a href='file:///usr/share/doc/tails/website/doc/first_steps/startup_options/mac_spoofing.en.html'>documentation</a>." -msgstr "" +msgstr "فشلت عملية انتحال وحدة تحكم وصول الوسائط لبطاقة الشبكة ${nic_name} (${nic}) لذا فقد تم تعطيلها مؤقتا.\nربما تفضل إعادة تشغيل Tails وتعطيل انتحال وحدة تحكم وصول الوسائط. راجع <a href='file:///usr/share/doc/tails/website/doc/first_steps/startup_options/mac_spoofing.en.html'>الوثائق</a>." #: config/chroot_local-includes/usr/local/sbin/tails-spoof-mac:39 msgid "All networking disabled" @@ -337,7 +338,7 @@ msgstr "جميع الشبكات معطّلة" msgid "" "MAC spoofing failed for network card ${nic_name} (${nic}). The error recovery also failed so all networking is disabled.\n" "You might prefer to restart Tails and disable MAC spoofing. See the <a href='file:///usr/share/doc/first_steps/startup_options/mac_spoofing.en.html'>documentation</a>." -msgstr "" +msgstr "فشلت عملية انتحال وحدة تحكم وصول الوسائط لبطاقة الشبكة ${nic_name} (${nic}). كما فشلت عملية إصلاح الأخطاء لذا فقد تم تعطيل كل عمليات الشبكة.\nربما تفضل إعادة تشغيل Tails وتعطيل انتحال وحدة تحكم وصول الوسائط. راجع<a href='file:///usr/share/doc/first_steps/startup_options/mac_spoofing.en.html'>الوثائق</a>." #: config/chroot_local-includes/usr/local/bin/tails-start-i2p:62 msgid "Starting I2P..."

1 0

[translation/tails-greeter] Update translations for tails-greeter
by translation＠torproject.org 03 Apr '14

03 Apr '14

commit 97174742464b53f2f434487f14be003a6b220785 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Apr 3 06:15:23 2014 +0000 Update translations for tails-greeter --- ar/ar.po | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/ar/ar.po b/ar/ar.po index 16009c5..9af2447 100644 --- a/ar/ar.po +++ b/ar/ar.po @@ -4,6 +4,7 @@ # # Translators: # kraim <biskraim(a)gmail.com>, 2013 +# Arwa M, 2014 # Mohammed Guessous <guessousuni(a)gmail.com>, 2014 # alshara3 <hsn.ali91(a)gmail.com>, 2013 # Mohammed ALDOUB <voulnet(a)gmail.com>, 2013 @@ -13,9 +14,9 @@ msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2014-03-06 17:16+0100\n" -"PO-Revision-Date: 2014-03-13 13:31+0000\n" -"Last-Translator: Mohammed Guessous <guessousuni(a)gmail.com>\n" +"POT-Creation-Date: 2014-03-17 13:54+0100\n" +"PO-Revision-Date: 2014-04-03 06:13+0000\n" +"Last-Translator: Arwa M\n" "Language-Team: Arabic (http://www.transifex.com/projects/p/torproject/language/ar/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -41,7 +42,7 @@ msgstr "هل ترغب في استخدام مساحة دائمة علي القر #: ../glade/persistencewindow.glade.h:5 msgid "<a href=\"doc/first_steps/persistence/use.en.html\">Documentation</a>" -msgstr "" +msgstr "<a href=\"doc/first_steps/persistence/use.en.html\">الوثائق</a>" #: ../glade/persistencewindow.glade.h:6 msgid "Yes" @@ -75,7 +76,7 @@ msgstr "كلمة السر الخاصة بالإدارة" msgid "" "<a " "href=\"doc/first_steps/startup_options/administration_password.en.html\">Documentation</a>" -msgstr "" +msgstr "<a href=\"doc/first_steps/startup_options/administration_password.en.html\">الوثائق</a>" #: ../glade/optionswindow.glade.h:5 msgid "" @@ -135,11 +136,11 @@ msgstr "" msgid "" "It is generally safer to spoof MAC addresses, but it might also raise " "suspicion or cause network connection problems." -msgstr "" +msgstr "انتحال عناوين وحدات التحكم في وصول الوسائط أأمن بشكل عام ولكنه أيضا قد يثير الشكوك أو يسبب مشاكل في الاتصال بالشبكة." #: ../glade/optionswindow.glade.h:18 msgid "Spoof all MAC addresses" -msgstr "" +msgstr "انتحال عناوين جميع وحدات التحكم في وصول الوسائط" #: ../glade/optionswindow.glade.h:19 msgid "Network configuration"

1 0

r26689: {website} Updated front page's fake RSS feed. (website/trunk/en)
by Matt Pagan 03 Apr '14

03 Apr '14

Author: mttp Date: 2014-04-03 03:41:33 +0000 (Thu, 03 Apr 2014) New Revision: 26689 Modified: website/trunk/en/index.wml Log: Updated front page's fake RSS feed. Modified: website/trunk/en/index.wml =================================================================== --- website/trunk/en/index.wml 2014-03-30 18:32:08 UTC (rev 26688) +++ website/trunk/en/index.wml 2014-04-03 03:41:33 UTC (rev 26689) @@ -158,8 +158,14 @@ <table> <tr> <td> + <div class="calendar"><span class="month">Apr</span><br><span class="day">2</span></div> + <p>Mission Impossible: Hardening Android for Security and Privacy. Read the <a href="https://blog.torproject.org/blog/mission-impossible-hardening-android-secur…">technical HOWTO</a> by Mike Perry.</p> + </td> + </tr> + <tr> + <td> <div class="calendar"><span class="month">Mar</span><br><span class="day">29</span></div> - <p>Ways to get the Tor Browser Bundle. Read the new <a href="https://blog.torproject.org/blog/ways-get-tor-browser-bundle">blog post</a> on the many ways you can get Tor up and running.</p> + <p>Read the new <a href="https://blog.torproject.org/blog/ways-get-tor-browser-bundle">blog post</a> on ways to get the Tor Browser Bundle.</p> </td> </tr> <tr> @@ -174,12 +180,6 @@ <p>Tails 0.23 is out. Read the <a href="https://blog.torproject.org/blog/tails-023-out">Tor blog post</a> or visit the <a href="https://tails.boum.org">Tails project page</a> for more information.</p> </td> </tr> - <tr> - <td> - <div class="calendar"><span class="month">Mar</span><br><span class="day">17</span></div> - <p>A <a href="https://blog.torproject.org/blog/how-to-read-our-china-usage-graphs">new blog post</a> explores how many Tor users are in China, how to read our <a href="https://metrics.torproject.org/users.html?graph=userstats-bridge-country&st…">users graph</a>, and how censorship circumvention techniques are being deployed.</p> - </td> - </tr> </table> </div> <div id="home-users">

1 0

[tor/master] Fix make_socket_reusable() on windows. Bug not in any released Tor
by nickm＠torproject.org 03 Apr '14

03 Apr '14

commit d290e36576c07b288a6347385d144a493869bd97 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 2 21:11:45 2014 -0400 Fix make_socket_reusable() on windows. Bug not in any released Tor --- src/or/connection.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/or/connection.c b/src/or/connection.c index ad5f9a1..1be4c45 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -965,6 +965,7 @@ make_socket_reuseable(tor_socket_t sock) { #ifdef _WIN32 (void) sock; + return 0; #else int one=1;

1 0

[translation/tails-misc] Update translations for tails-misc
by translation＠torproject.org 02 Apr '14

02 Apr '14

commit 40440579db604998bf722a7ec5289d398f2cfe82 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Apr 2 20:45:36 2014 +0000 Update translations for tails-misc --- ar.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ar.po b/ar.po index d5f6d70..e3655c1 100644 --- a/ar.po +++ b/ar.po @@ -16,7 +16,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2014-03-23 08:55+0100\n" -"PO-Revision-Date: 2014-04-02 20:14+0000\n" +"PO-Revision-Date: 2014-04-02 20:20+0000\n" "Last-Translator: Osamah Qashou <osamah_owis(a)windowslive.com>\n" "Language-Team: Arabic (http://www.transifex.com/projects/p/torproject/language/ar/)\n" "MIME-Version: 1.0\n"

1 0

[translation/tails-misc] Update translations for tails-misc
by translation＠torproject.org 02 Apr '14

02 Apr '14

commit 217d12c977a1a529b19f9c64863961c2ff28db90 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Apr 2 20:15:35 2014 +0000 Update translations for tails-misc --- ar.po | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/ar.po b/ar.po index 927bcd9..d5f6d70 100644 --- a/ar.po +++ b/ar.po @@ -7,6 +7,7 @@ # anchor <al3arbe1(a)gmail.com>, 2013 # matt_santy <matt_santy(a)hotmail.com>, 2013 # Mohammed ALDOUB <voulnet(a)gmail.com>, 2013 +# Osamah Qashou <osamah_owis(a)windowslive.com>, 2014 # Sherief Alaa <sheriefalaa.w(a)gmail.com>, 2013 # uzumaki <tx99h4(a)hotmail.com>, 2014 # uzumaki <tx99h4(a)hotmail.com>, 2014 @@ -15,8 +16,8 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2014-03-23 08:55+0100\n" -"PO-Revision-Date: 2014-04-01 14:51+0000\n" -"Last-Translator: uzumaki <tx99h4(a)hotmail.com>\n" +"PO-Revision-Date: 2014-04-02 20:14+0000\n" +"Last-Translator: Osamah Qashou <osamah_owis(a)windowslive.com>\n" "Language-Team: Arabic (http://www.transifex.com/projects/p/torproject/language/ar/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -309,7 +310,7 @@ msgid "" "MAC spoofing feature. For more information, see the <a " "href=\\\"file:///usr/share/doc/tails/website/doc/first_steps/startup_options/mac_spoofing.en.html#blocked\\\">MAC" " spoofing documentation</a>." -msgstr "" +msgstr "يبدوا أنّك محجوب من الشّبكة. هذا قد يكون له علاقة بخاصيّة تغيير الـMAC. لمزيد من المعلومات، زر <a href=\\\"file:///usr/share/doc/tails/website/doc/first_steps/startup_options/mac_spoofing.en.html#blocked\\\">وثائق تغيير الـMAC</a>." #: config/chroot_local-includes/usr/local/bin/tails-security-check:145 msgid "This version of Tails has known security issues:" @@ -318,7 +319,7 @@ msgstr "هذه النسخة من تيلز تحتوي مشاكل أمنية:" #: config/chroot_local-includes/usr/local/sbin/tails-spoof-mac:29 #, sh-format msgid "Network card ${nic} disabled" -msgstr "" +msgstr "كرت الشبكة ${nic} معطّل" #: config/chroot_local-includes/usr/local/sbin/tails-spoof-mac:30 #, sh-format @@ -329,7 +330,7 @@ msgstr "" #: config/chroot_local-includes/usr/local/sbin/tails-spoof-mac:39 msgid "All networking disabled" -msgstr "" +msgstr "جميع الشبكات معطّلة" #: config/chroot_local-includes/usr/local/sbin/tails-spoof-mac:40 #, sh-format @@ -384,7 +385,7 @@ msgid "" "\n" "Or do a manual upgrade.\n" "See https://tails.boum.org/doc/first_steps/upgrade#manual" -msgstr "" +msgstr "<b>لا يوجد ذاكرة كافية متاحة لفحص وجود ترقيات.</b>\n\nتأكّد من أنّ نظامك يلبّي حاجات تشغيل Tails.\nأنظر للملف file:///usr/share/doc/tails/website/doc/about/requirements.en.html\n\nقم بإعادة تشغيل Tails لإعادة التحقق من وجود ترقيات\n\nأو قم بالترقية يدويًّا.\nأنظر https://tails.boum.org/doc/first_steps/upgrade#manual" #: config/chroot_local-includes/usr/local/bin/tails-virt-notify-user:53 msgid "Warning: virtual machine detected!"

1 0

[tor/master] Don't warn when setsockopt(SO_REUSEABLE) on accept()ed socket says EINVAL
by nickm＠torproject.org 02 Apr '14

02 Apr '14

commit 60abc4804fbeb15c612717fea386c726eba2b82a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 27 13:55:18 2014 -0400 Don't warn when setsockopt(SO_REUSEABLE) on accept()ed socket says EINVAL This should fix bug10081. I believe this bug pertains to OSX behavior, not any Tor behavior change. --- changes/bug10081 | 5 +++++ src/or/connection.c | 33 ++++++++++++++++++++++++++------- 2 files changed, 31 insertions(+), 7 deletions(-) diff --git a/changes/bug10081 b/changes/bug10081 new file mode 100644 index 0000000..654b83c --- /dev/null +++ b/changes/bug10081 @@ -0,0 +1,5 @@ + o Minor features: + - When reporting a failure from make_socket_reuseable(), don't + report a warning when we get a failure from an incoming socket + on OSX. Fix for bug 10081. + diff --git a/src/or/connection.c b/src/or/connection.c index 8c697d6..ad5f9a1 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -958,8 +958,9 @@ check_location_for_unix_socket(const or_options_t *options, const char *path) #endif /** Tell the TCP stack that it shouldn't wait for a long time after - * <b>sock</b> has closed before reusing its port. */ -static void + * <b>sock</b> has closed before reusing its port. Return 0 on success, + * -1 on failure. */ +static int make_socket_reuseable(tor_socket_t sock) { #ifdef _WIN32 @@ -973,9 +974,9 @@ make_socket_reuseable(tor_socket_t sock) * already has it bound_. So, don't do that on Win32. */ if (setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void*) &one, (socklen_t)sizeof(one)) == -1) { - log_warn(LD_NET, "Error setting SO_REUSEADDR flag: %s", - tor_socket_strerror(errno)); + return -1; } + return 0; #endif } @@ -1049,7 +1050,11 @@ connection_listener_new(const struct sockaddr *listensockaddr, goto err; } - make_socket_reuseable(s); + if (make_socket_reuseable(s) < 0) { + log_warn(LD_NET, "Error setting SO_REUSEADDR flag on %s: %s", + conn_type_to_string(type), + tor_socket_strerror(errno)); + } #if defined USE_TRANSPARENT && defined(IP_TRANSPARENT) if (options->TransProxyType_parsed == TPT_TPROXY && @@ -1354,7 +1359,18 @@ connection_handle_listener_read(connection_t *conn, int new_type) "Connection accepted on socket %d (child of fd %d).", (int)news,(int)conn->s); - make_socket_reuseable(news); + if (make_socket_reuseable(news) < 0) { + if (tor_socket_errno(news) == EINVAL) { + /* This can happen on OSX if we get a badly timed shutdown. */ + log_debug(LD_NET, "make_socket_reuseable returned EINVAL"); + } else { + log_warn(LD_NET, "Error setting SO_REUSEADDR flag on %s: %s", + conn_type_to_string(new_type), + tor_socket_strerror(errno)); + } + tor_close_socket(news); + return 0; + } if (options->ConstrainedSockets) set_constrained_socket_buffers(news, (int)options->ConstrainedSockSize); @@ -1563,7 +1579,10 @@ connection_connect(connection_t *conn, const char *address, return -1; } - make_socket_reuseable(s); + if (make_socket_reuseable(s) < 0) { + log_warn(LD_NET, "Error setting SO_REUSEADDR flag on new connection: %s", + tor_socket_strerror(errno)); + } if (!tor_addr_is_loopback(addr)) { const tor_addr_t *ext_addr = NULL;

1 0

[tor/master] Merge remote-tracking branch 'public/bug10081'
by nickm＠torproject.org 02 Apr '14

02 Apr '14

commit 24c4b56a39551ba46ba5d0c9d0ebfbce4c12f378 Merge: da908a5 60abc48 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 2 15:45:20 2014 -0400 Merge remote-tracking branch 'public/bug10081' changes/bug10081 | 5 +++++ src/or/connection.c | 33 ++++++++++++++++++++++++++------- 2 files changed, 31 insertions(+), 7 deletions(-)

1 0

[tor/master] Extract code to handle RESOLVED cells
by nickm＠torproject.org 02 Apr '14

02 Apr '14

commit 4fb3ae69a6f81d45843998bd1fb6cecf541ef5b8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 27 19:58:06 2014 -0400 Extract code to handle RESOLVED cells No other changes have been made; only code has been moved. --- src/or/relay.c | 131 ++++++++++++++++++++++++++++++-------------------------- 1 file changed, 71 insertions(+), 60 deletions(-) diff --git a/src/or/relay.c b/src/or/relay.c index 8c009b5..3e28077 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1009,6 +1009,76 @@ connected_cell_parse(const relay_header_t *rh, const cell_t *cell, return 0; } +/** DOCDOC */ +static void +connection_edge_process_resolved_cell(edge_connection_t *conn, + const cell_t *cell, + const relay_header_t *rh) +{ + int ttl; + int answer_len; + uint8_t answer_type; + entry_connection_t *entry_conn = EDGE_TO_ENTRY_CONN(conn); + if (conn->base_.state != AP_CONN_STATE_RESOLVE_WAIT) { + log_fn(LOG_PROTOCOL_WARN, LD_APP, "Got a 'resolved' cell while " + "not in state resolve_wait. Dropping."); + return; + } + tor_assert(SOCKS_COMMAND_IS_RESOLVE(entry_conn->socks_request->command)); + answer_len = cell->payload[RELAY_HEADER_SIZE+1]; + if (rh->length < 2 || answer_len+2>rh->length) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Dropping malformed 'resolved' cell"); + connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TORPROTOCOL); + return; + } + + answer_type = cell->payload[RELAY_HEADER_SIZE]; + if (rh->length >= answer_len+6) + ttl = (int)ntohl(get_uint32(cell->payload+RELAY_HEADER_SIZE+ + 2+answer_len)); + else + ttl = -1; + if (answer_type == RESOLVED_TYPE_IPV4 || + answer_type == RESOLVED_TYPE_IPV6) { + tor_addr_t addr; + if (decode_address_from_payload(&addr, cell->payload+RELAY_HEADER_SIZE, + rh->length) && + tor_addr_is_internal(&addr, 0) && + get_options()->ClientDNSRejectInternalAddresses) { + log_info(LD_APP,"Got a resolve with answer %s. Rejecting.", + fmt_addr(&addr)); + connection_ap_handshake_socks_resolved(entry_conn, + RESOLVED_TYPE_ERROR_TRANSIENT, + 0, NULL, 0, TIME_MAX); + connection_mark_unattached_ap(entry_conn, + END_STREAM_REASON_TORPROTOCOL); + return; + } + } + connection_ap_handshake_socks_resolved(entry_conn, + answer_type, + cell->payload[RELAY_HEADER_SIZE+1], /*answer_len*/ + cell->payload+RELAY_HEADER_SIZE+2, /*answer*/ + ttl, + -1); + if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) { + tor_addr_t addr; + tor_addr_from_ipv4n(&addr, + get_uint32(cell->payload+RELAY_HEADER_SIZE+2)); + remap_event_helper(entry_conn, &addr); + } else if (answer_type == RESOLVED_TYPE_IPV6 && answer_len == 16) { + tor_addr_t addr; + tor_addr_from_ipv6_bytes(&addr, + (char*)(cell->payload+RELAY_HEADER_SIZE+2)); + remap_event_helper(entry_conn, &addr); + } + connection_mark_unattached_ap(entry_conn, + END_STREAM_REASON_DONE | + END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED); + +} + /** An incoming relay cell has arrived from circuit <b>circ</b> to * stream <b>conn</b>. * @@ -1133,66 +1203,7 @@ connection_edge_process_relay_cell_not_open( } if (conn->base_.type == CONN_TYPE_AP && rh->command == RELAY_COMMAND_RESOLVED) { - int ttl; - int answer_len; - uint8_t answer_type; - entry_connection_t *entry_conn = EDGE_TO_ENTRY_CONN(conn); - if (conn->base_.state != AP_CONN_STATE_RESOLVE_WAIT) { - log_fn(LOG_PROTOCOL_WARN, LD_APP, "Got a 'resolved' cell while " - "not in state resolve_wait. Dropping."); - return 0; - } - tor_assert(SOCKS_COMMAND_IS_RESOLVE(entry_conn->socks_request->command)); - answer_len = cell->payload[RELAY_HEADER_SIZE+1]; - if (rh->length < 2 || answer_len+2>rh->length) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Dropping malformed 'resolved' cell"); - connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TORPROTOCOL); - return 0; - } - answer_type = cell->payload[RELAY_HEADER_SIZE]; - if (rh->length >= answer_len+6) - ttl = (int)ntohl(get_uint32(cell->payload+RELAY_HEADER_SIZE+ - 2+answer_len)); - else - ttl = -1; - if (answer_type == RESOLVED_TYPE_IPV4 || - answer_type == RESOLVED_TYPE_IPV6) { - tor_addr_t addr; - if (decode_address_from_payload(&addr, cell->payload+RELAY_HEADER_SIZE, - rh->length) && - tor_addr_is_internal(&addr, 0) && - get_options()->ClientDNSRejectInternalAddresses) { - log_info(LD_APP,"Got a resolve with answer %s. Rejecting.", - fmt_addr(&addr)); - connection_ap_handshake_socks_resolved(entry_conn, - RESOLVED_TYPE_ERROR_TRANSIENT, - 0, NULL, 0, TIME_MAX); - connection_mark_unattached_ap(entry_conn, - END_STREAM_REASON_TORPROTOCOL); - return 0; - } - } - connection_ap_handshake_socks_resolved(entry_conn, - answer_type, - cell->payload[RELAY_HEADER_SIZE+1], /*answer_len*/ - cell->payload+RELAY_HEADER_SIZE+2, /*answer*/ - ttl, - -1); - if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) { - tor_addr_t addr; - tor_addr_from_ipv4n(&addr, - get_uint32(cell->payload+RELAY_HEADER_SIZE+2)); - remap_event_helper(entry_conn, &addr); - } else if (answer_type == RESOLVED_TYPE_IPV6 && answer_len == 16) { - tor_addr_t addr; - tor_addr_from_ipv6_bytes(&addr, - (char*)(cell->payload+RELAY_HEADER_SIZE+2)); - remap_event_helper(entry_conn, &addr); - } - connection_mark_unattached_ap(entry_conn, - END_STREAM_REASON_DONE | - END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED); + connection_edge_process_resolved_cell(conn, cell, rh); return 0; }

1 0

[tor/master] Look at all of a RESOLVED cell; not just the first answer.
by nickm＠torproject.org 02 Apr '14

02 Apr '14

commit c230ff4ca97ae6bf8ddbf2d19a1a7d33371cde3a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 27 22:24:48 2014 -0400 Look at all of a RESOLVED cell; not just the first answer. Also, stop accepting the old kind of RESOLVED cells with no TTL fields; they haven't been sent since 0.1.1.6-alpha. This patch won't work without the fix to #10468 -- it will break DNSPorts unless they set the proper ipv4/6 flags on entry_connection_t. --- src/or/connection_edge.c | 7 +- src/or/connection_edge.h | 4 + src/or/relay.c | 269 ++++++++++++++++++++++++++++++++++++++-------- src/or/relay.h | 13 +++ 4 files changed, 241 insertions(+), 52 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 630c3b9..1ecc553 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -62,11 +62,6 @@ static int connection_ap_process_natd(entry_connection_t *conn); static int connection_exit_connect_dir(edge_connection_t *exitconn); static int consider_plaintext_ports(entry_connection_t *conn, uint16_t port); static int connection_ap_supports_optimistic_data(const entry_connection_t *); -static void connection_ap_handshake_socks_resolved_addr( - entry_connection_t *conn, - const tor_addr_t *answer, - int ttl, - time_t expires); /** An AP stream has failed/finished. If it hasn't already sent back * a socks reply, send one now (based on endreason). Also set @@ -2065,7 +2060,7 @@ tell_controller_about_resolved_result(entry_connection_t *conn, * As connection_ap_handshake_socks_resolved, but take a tor_addr_t to send * as the answer. */ -static void +void connection_ap_handshake_socks_resolved_addr(entry_connection_t *conn, const tor_addr_t *answer, int ttl, diff --git a/src/or/connection_edge.h b/src/or/connection_edge.h index e3a95ad..cbca31a 100644 --- a/src/or/connection_edge.h +++ b/src/or/connection_edge.h @@ -50,6 +50,10 @@ void connection_ap_handshake_socks_resolved(entry_connection_t *conn, const uint8_t *answer, int ttl, time_t expires); +void connection_ap_handshake_socks_resolved_addr(entry_connection_t *conn, + const tor_addr_t *answer, + int ttl, + time_t expires); int connection_exit_begin_conn(cell_t *cell, circuit_t *circ); int connection_exit_begin_resolve(cell_t *cell, or_circuit_t *circ); diff --git a/src/or/relay.c b/src/or/relay.c index 3e28077..ed24397 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1009,74 +1009,252 @@ connected_cell_parse(const relay_header_t *rh, const cell_t *cell, return 0; } -/** DOCDOC */ -static void +/** Drop all storage held by <b>addr</b>. */ +STATIC void +address_ttl_free(address_ttl_t *addr) +{ + if (!addr) + return; + tor_free(addr->hostname); + tor_free(addr); +} + +/** Parse a resolved cell in <b>cell</b>, with parsed header in <b>rh</b>. + * Return -1 on parse error. On success, add one or more newly allocated + * address_ttl_t to <b>addresses_out</b>; set *<b>errcode_out</b> to + * one of 0, RESOLVED_TYPE_ERROR, or RESOLVED_TYPE_ERROR_TRANSIENT, and + * return 0. */ +STATIC int +resolved_cell_parse(const cell_t *cell, const relay_header_t *rh, + smartlist_t *addresses_out, int *errcode_out) +{ + const uint8_t *cp; + uint8_t answer_type; + size_t answer_len; + address_ttl_t *addr; + size_t remaining; + int errcode = 0; + smartlist_t *addrs; + + tor_assert(cell); + tor_assert(rh); + tor_assert(addresses_out); + tor_assert(errcode_out); + + *errcode_out = 0; + + if (rh->length > RELAY_PAYLOAD_SIZE) + return -1; + + addrs = smartlist_new(); + + cp = cell->payload + RELAY_HEADER_SIZE; + + remaining = rh->length; + while (remaining) { + const uint8_t *cp_orig = cp; + if (remaining < 2) + goto err; + answer_type = *cp++; + answer_len = *cp++; + if (remaining < 2 + answer_len + 4) { + goto err; + } + if (answer_type == RESOLVED_TYPE_IPV4) { + if (answer_len != 4) { + goto err; + } + addr = tor_malloc_zero(sizeof(*addr)); + tor_addr_from_ipv4n(&addr->addr, get_uint32(cp)); + cp += 4; + addr->ttl = ntohl(get_uint32(cp)); + cp += 4; + smartlist_add(addrs, addr); + } else if (answer_type == RESOLVED_TYPE_IPV6) { + if (answer_len != 16) + goto err; + addr = tor_malloc_zero(sizeof(*addr)); + tor_addr_from_ipv6_bytes(&addr->addr, (const char*) cp); + cp += 16; + addr->ttl = ntohl(get_uint32(cp)); + cp += 4; + smartlist_add(addrs, addr); + } else if (answer_type == RESOLVED_TYPE_HOSTNAME) { + if (answer_len == 0) { + goto err; + } + addr = tor_malloc_zero(sizeof(*addr)); + addr->hostname = tor_memdup_nulterm(cp, answer_len); + cp += answer_len; + addr->ttl = ntohl(get_uint32(cp)); + cp += 4; + smartlist_add(addrs, addr); + } else if (answer_type == RESOLVED_TYPE_ERROR_TRANSIENT || + answer_type == RESOLVED_TYPE_ERROR) { + errcode = answer_type; + /* Ignore the error contents */ + cp += answer_len + 4; + } else { + cp += answer_len + 4; + } + tor_assert(((ssize_t)remaining) >= (cp - cp_orig)); + remaining -= (cp - cp_orig); + } + + if (errcode && smartlist_len(addrs) == 0) { + /* Report an error only if there were no results. */ + *errcode_out = errcode; + } + + smartlist_add_all(addresses_out, addrs); + smartlist_free(addrs); + + return 0; + + err: + /* On parse error, don't report any results */ + SMARTLIST_FOREACH(addrs, address_ttl_t *, a, address_ttl_free(a)); + smartlist_free(addrs); + return -1; +} + +/** Helper for connection_edge_process_resolved_cell: given an error code, + * an entry_connection, and a list of address_ttl_t *, report the best answer + * to the entry_connection. */ +STATIC void +connection_ap_handshake_socks_got_resolve_cell(entry_connection_t *conn, + int error_code, + smartlist_t *results) +{ + address_ttl_t *addr_ipv4 = NULL; + address_ttl_t *addr_ipv6 = NULL; + address_ttl_t *addr_hostname = NULL; + address_ttl_t *addr_best = NULL; + + /* If it's an error code, that's easy. */ + if (error_code) { + tor_assert(error_code == RESOLVED_TYPE_ERROR || + error_code == RESOLVED_TYPE_ERROR_TRANSIENT); + connection_ap_handshake_socks_resolved(conn, + error_code,0,NULL,-1,-1); + return; + } + + /* Get the first answer of each type. */ + SMARTLIST_FOREACH_BEGIN(results, address_ttl_t *, addr) { + if (addr->hostname) { + if (!addr_hostname) { + addr_hostname = addr; + } + } else if (tor_addr_family(&addr->addr) == AF_INET) { + if (!addr_ipv4 && conn->ipv4_traffic_ok) { + addr_ipv4 = addr; + } + } else if (tor_addr_family(&addr->addr) == AF_INET6) { + if (!addr_ipv6 && conn->ipv6_traffic_ok) { + addr_ipv6 = addr; + } + } + } SMARTLIST_FOREACH_END(addr); + + /* Now figure out which type we wanted to deliver. */ + if (conn->socks_request->command == SOCKS_COMMAND_RESOLVE_PTR) { + if (addr_hostname) { + connection_ap_handshake_socks_resolved(conn, + RESOLVED_TYPE_HOSTNAME, + strlen(addr_hostname->hostname), + (uint8_t*)addr_hostname->hostname, + addr_hostname->ttl,-1); + } else { + connection_ap_handshake_socks_resolved(conn, + RESOLVED_TYPE_ERROR,0,NULL,-1,-1); + } + return; + } + + if (conn->prefer_ipv6_traffic) { + addr_best = addr_ipv6 ? addr_ipv6 : addr_ipv4; + } else { + addr_best = addr_ipv4 ? addr_ipv4 : addr_ipv6; + } + + /* Now convert it to the ugly old interface */ + if (! addr_best) { + connection_ap_handshake_socks_resolved(conn, + RESOLVED_TYPE_ERROR,0,NULL,-1,-1); + return; + } + + connection_ap_handshake_socks_resolved_addr(conn, + &addr_best->addr, + addr_best->ttl, + -1); + + remap_event_helper(conn, &addr_best->addr); +} + +/** Handle a RELAY_COMMAND_RESOLVED cell that we received on a non-open AP + * stream. */ +static int connection_edge_process_resolved_cell(edge_connection_t *conn, const cell_t *cell, const relay_header_t *rh) { - int ttl; - int answer_len; - uint8_t answer_type; entry_connection_t *entry_conn = EDGE_TO_ENTRY_CONN(conn); + smartlist_t *resolved_addresses = NULL; + int errcode = 0; + if (conn->base_.state != AP_CONN_STATE_RESOLVE_WAIT) { log_fn(LOG_PROTOCOL_WARN, LD_APP, "Got a 'resolved' cell while " "not in state resolve_wait. Dropping."); - return; + return 0; } tor_assert(SOCKS_COMMAND_IS_RESOLVE(entry_conn->socks_request->command)); - answer_len = cell->payload[RELAY_HEADER_SIZE+1]; - if (rh->length < 2 || answer_len+2>rh->length) { + + resolved_addresses = smartlist_new(); + if (resolved_cell_parse(cell, rh, resolved_addresses, &errcode)) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Dropping malformed 'resolved' cell"); connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TORPROTOCOL); - return; - } - - answer_type = cell->payload[RELAY_HEADER_SIZE]; - if (rh->length >= answer_len+6) - ttl = (int)ntohl(get_uint32(cell->payload+RELAY_HEADER_SIZE+ - 2+answer_len)); - else - ttl = -1; - if (answer_type == RESOLVED_TYPE_IPV4 || - answer_type == RESOLVED_TYPE_IPV6) { - tor_addr_t addr; - if (decode_address_from_payload(&addr, cell->payload+RELAY_HEADER_SIZE, - rh->length) && - tor_addr_is_internal(&addr, 0) && - get_options()->ClientDNSRejectInternalAddresses) { - log_info(LD_APP,"Got a resolve with answer %s. Rejecting.", - fmt_addr(&addr)); + goto done; + } + + if (get_options()->ClientDNSRejectInternalAddresses) { + int orig_len = smartlist_len(resolved_addresses); + SMARTLIST_FOREACH_BEGIN(resolved_addresses, address_ttl_t *, addr) { + if (addr->hostname == NULL && tor_addr_is_internal(&addr->addr, 0)) { + log_info(LD_APP, "Got a resolved cell with answer %s; dropping that " + "answer.", + safe_str_client(fmt_addr(&addr->addr))); + address_ttl_free(addr); + SMARTLIST_DEL_CURRENT(resolved_addresses, addr); + } + } SMARTLIST_FOREACH_END(addr); + if (orig_len && smartlist_len(resolved_addresses) == 0) { + log_info(LD_APP, "Got a resolved cell with only private addresses; " + "dropping it."); connection_ap_handshake_socks_resolved(entry_conn, RESOLVED_TYPE_ERROR_TRANSIENT, 0, NULL, 0, TIME_MAX); connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_TORPROTOCOL); - return; + goto done; } } - connection_ap_handshake_socks_resolved(entry_conn, - answer_type, - cell->payload[RELAY_HEADER_SIZE+1], /*answer_len*/ - cell->payload+RELAY_HEADER_SIZE+2, /*answer*/ - ttl, - -1); - if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) { - tor_addr_t addr; - tor_addr_from_ipv4n(&addr, - get_uint32(cell->payload+RELAY_HEADER_SIZE+2)); - remap_event_helper(entry_conn, &addr); - } else if (answer_type == RESOLVED_TYPE_IPV6 && answer_len == 16) { - tor_addr_t addr; - tor_addr_from_ipv6_bytes(&addr, - (char*)(cell->payload+RELAY_HEADER_SIZE+2)); - remap_event_helper(entry_conn, &addr); - } + + connection_ap_handshake_socks_got_resolve_cell(entry_conn, + errcode, + resolved_addresses); + connection_mark_unattached_ap(entry_conn, END_STREAM_REASON_DONE | END_STREAM_REASON_FLAG_ALREADY_SOCKS_REPLIED); + done: + SMARTLIST_FOREACH(resolved_addresses, address_ttl_t *, addr, + address_ttl_free(addr)); + smartlist_free(resolved_addresses); + return 0; } /** An incoming relay cell has arrived from circuit <b>circ</b> to @@ -1203,8 +1381,7 @@ connection_edge_process_relay_cell_not_open( } if (conn->base_.type == CONN_TYPE_AP && rh->command == RELAY_COMMAND_RESOLVED) { - connection_edge_process_resolved_cell(conn, cell, rh); - return 0; + return connection_edge_process_resolved_cell(conn, cell, rh); } log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, diff --git a/src/or/relay.h b/src/or/relay.h index 4e1c7f5..bd5c908 100644 --- a/src/or/relay.h +++ b/src/or/relay.h @@ -83,6 +83,19 @@ int relay_crypt(circuit_t *circ, cell_t *cell, cell_direction_t cell_direction, #ifdef RELAY_PRIVATE STATIC int connected_cell_parse(const relay_header_t *rh, const cell_t *cell, tor_addr_t *addr_out, int *ttl_out); +/** An address-and-ttl tuple as yielded by resolved_cell_parse */ +typedef struct address_ttl_s { + tor_addr_t addr; + char *hostname; + int ttl; +} address_ttl_t; +STATIC void address_ttl_free(address_ttl_t *addr); +STATIC int resolved_cell_parse(const cell_t *cell, const relay_header_t *rh, + smartlist_t *addresses_out, int *errcode_out); +STATIC void connection_ap_handshake_socks_got_resolve_cell( + entry_connection_t *conn, + int error_code, + smartlist_t *results); STATIC packed_cell_t *packed_cell_new(void); STATIC packed_cell_t *cell_queue_pop(cell_queue_t *queue); STATIC size_t cell_queues_get_total_allocation(void);

1 0