June 2014 - tor-commits - lists.torproject.org

[orbot/master] tune bind/create service logic
by n8fr8＠torproject.org 12 Jun '14

12 Jun '14

commit 328c6af2c68a789ded01c58a2b19b56a4bb7ea9c Author: Nathan Freitas <nathan(a)freitas.net> Date: Wed Jun 11 20:24:08 2014 -0400 tune bind/create service logic --- src/org/torproject/android/Orbot.java | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/src/org/torproject/android/Orbot.java b/src/org/torproject/android/Orbot.java index cd7a392..c1e755c 100644 --- a/src/org/torproject/android/Orbot.java +++ b/src/org/torproject/android/Orbot.java @@ -106,10 +106,13 @@ public class Orbot extends ActionBarActivity implements TorConstants, OnLongClic } + Intent torService; + private void startService () { - Intent torService = new Intent(this, TorService.class); - + torService = new Intent(this, TorService.class); + startService(torService); + /* if (Build.VERSION.SDK_INT > 14) { @@ -120,11 +123,9 @@ public class Orbot extends ActionBarActivity implements TorConstants, OnLongClic else { */ - bindService(torService, - mConnection, Context.BIND_AUTO_CREATE); + //} - startService(torService); } @@ -463,6 +464,8 @@ public class Orbot extends ActionBarActivity implements TorConstants, OnLongClic if (aDialog != null) aDialog.dismiss(); + + unbindService(mConnection); } private void doTorCheck () @@ -796,6 +799,9 @@ public class Orbot extends ActionBarActivity implements TorConstants, OnLongClic protected void onResume() { super.onResume(); + bindService(torService, + mConnection, 0); + if (mService != null) { try {

1 0

[orbot/master] make transport settings dynamic (remove from torrc)
by n8fr8＠torproject.org 12 Jun '14

12 Jun '14

commit 4716696515528665248fbbcacb7e5ab8b4c4b918 Author: Nathan Freitas <nathan(a)freitas.net> Date: Wed Jun 11 20:23:38 2014 -0400 make transport settings dynamic (remove from torrc) --- res/raw/torrc | 9 +-------- res/raw/torrcdiag | 18 +++--------------- 2 files changed, 4 insertions(+), 23 deletions(-) diff --git a/res/raw/torrc b/res/raw/torrc index aade84c..1ebabf7 100644 --- a/res/raw/torrc +++ b/res/raw/torrc @@ -1,11 +1,4 @@ Log notice stdout ControlPortWriteToFile /data/data/org.torproject.android/app_bin/control.txt ControlPort auto -CookieAuthentication 1 -TransPort 9040 -TransListenAddress 127.0.0.1 -DNSPort 5400 -DNSListenAddress 127.0.0.1 -AvoidDiskWrites 1 -VirtualAddrNetwork 10.192.0.0/10 -AutomapHostsOnResolve 1 \ No newline at end of file +CookieAuthentication 1 \ No newline at end of file diff --git a/res/raw/torrcdiag b/res/raw/torrcdiag index 2edd200..df37970 100644 --- a/res/raw/torrcdiag +++ b/res/raw/torrcdiag @@ -1,16 +1,4 @@ -SocksPort 9050 -SOCKSListenAddress 127.0.0.1 -SafeSocks 0 -TestSocks 1 -WarnUnsafeSocks 1 -Log info stdout -ControlListenAddress 127.0.0.1 -ControlPort 9051 +Log debug stdout +ControlPortWriteToFile /data/data/org.torproject.android/app_bin/control.txt +ControlPort auto CookieAuthentication 1 -TransPort 9040 -TransListenAddress 127.0.0.1 -DNSPort 5400 -DNSListenAddress 127.0.0.1 -AvoidDiskWrites 1 -VirtualAddrNetwork 10.192.0.0/10 -AutomapHostsOnResolve 1 \ No newline at end of file

1 0

[orbot/master] ensure diag/test mode stop's Tor on activity exit
by n8fr8＠torproject.org 12 Jun '14

12 Jun '14

commit fc6392932f354498bc89b263fcdc5bfe4cd29bbd Author: Nathan Freitas <nathan(a)freitas.net> Date: Wed Jun 11 20:24:21 2014 -0400 ensure diag/test mode stop's Tor on activity exit --- src/org/torproject/android/OrbotDiagnosticsActivity.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/org/torproject/android/OrbotDiagnosticsActivity.java b/src/org/torproject/android/OrbotDiagnosticsActivity.java index db7ab21..717d3ee 100644 --- a/src/org/torproject/android/OrbotDiagnosticsActivity.java +++ b/src/org/torproject/android/OrbotDiagnosticsActivity.java @@ -57,8 +57,9 @@ public class OrbotDiagnosticsActivity extends Activity { @Override protected void onPause() { - // TODO Auto-generated method stub super.onPause(); + + stopTor(); } @Override

1 0

[orbot/master] don't stop tor when service onStartCommand() is called again
by n8fr8＠torproject.org 12 Jun '14

12 Jun '14

commit 42e069800ad3cce3ba8789c57dec8c04dae4147b Author: Nathan Freitas <nathan(a)freitas.net> Date: Wed Jun 11 20:24:32 2014 -0400 don't stop tor when service onStartCommand() is called again --- src/org/torproject/android/service/TorService.java | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/src/org/torproject/android/service/TorService.java b/src/org/torproject/android/service/TorService.java index aac581b..e9029c3 100644 --- a/src/org/torproject/android/service/TorService.java +++ b/src/org/torproject/android/service/TorService.java @@ -553,8 +553,6 @@ public class TorService extends Service implements TorServiceConstants, TorConst String version = prefs.getString(PREF_BINARY_TOR_VERSION_INSTALLED,null); logNotice("checking binary version: " + version); - - stopTor(); TorResourceInstaller installer = new TorResourceInstaller(this, appBinHome); @@ -676,14 +674,24 @@ public class TorService extends Service implements TorServiceConstants, TorConst } + + + logMessage ("Transparent Proxying: updating Tor settings..."); + + mBinder.updateConfiguration("TransPort","9040",false); + mBinder.updateConfiguration("DNSPort","5400",false); + mBinder.updateConfiguration("VirtualAddrNetwork","10.192.0.0/10",false); + mBinder.updateConfiguration("AutomapHostsOnResolve","1",false); + mBinder.saveConfiguration(); - logMessage ("Transparent Proxying: enabling..."); //TODO: Find a nice place for the next (commented) line //TorTransProxy.setDNSProxying(); int code = 0; // Default state is "okay" + logMessage ("Transparent Proxying: clearing existing rules..."); + //clear rules first mTransProxy.clearTransparentProxyingAll(this);

1 0

[orbot/master] update to 14.0.3
by n8fr8＠torproject.org 12 Jun '14

12 Jun '14

commit c04fc9599c80deaea8f3882394bb5b9a79d8f926 Author: Nathan Freitas <nathan(a)freitas.net> Date: Wed Jun 11 20:25:05 2014 -0400 update to 14.0.3 --- AndroidManifest.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AndroidManifest.xml b/AndroidManifest.xml index 6a4d51e..368b03b 100644 --- a/AndroidManifest.xml +++ b/AndroidManifest.xml @@ -1,8 +1,8 @@ <?xml version="1.0" encoding="utf-8"?> <manifest xmlns:android="http://schemas.android.com/apk/res/android" package="org.torproject.android" - android:versionName="14.0.2.1" - android:versionCode="103" + android:versionName="14.0.3" + android:versionCode="104" android:installLocation="auto" >

1 0

[translation/gettor_completed] Update translations for gettor_completed
by translation＠torproject.org 11 Jun '14

11 Jun '14

commit 48b957da8f27d75a5654e397eaa1bed728c82d20 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Jun 11 16:15:11 2014 +0000 Update translations for gettor_completed --- ro/gettor.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ro/gettor.po b/ro/gettor.po index 6077186..5253c2b 100644 --- a/ro/gettor.po +++ b/ro/gettor.po @@ -13,7 +13,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2013-01-19 13:40+0100\n" -"PO-Revision-Date: 2014-06-11 14:08+0000\n" +"PO-Revision-Date: 2014-06-11 16:01+0000\n" "Last-Translator: Alexandru Geana <alex(a)alegen.net>\n" "Language-Team: Romanian (http://www.transifex.com/projects/p/torproject/language/ro/)\n" "MIME-Version: 1.0\n"

1 0

[translation/gettor] Update translations for gettor
by translation＠torproject.org 11 Jun '14

11 Jun '14

commit 7e8281924475d8a48a180023ef4719977b5588b9 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Jun 11 16:15:08 2014 +0000 Update translations for gettor --- ro/gettor.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ro/gettor.po b/ro/gettor.po index 6077186..5253c2b 100644 --- a/ro/gettor.po +++ b/ro/gettor.po @@ -13,7 +13,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2013-01-19 13:40+0100\n" -"PO-Revision-Date: 2014-06-11 14:08+0000\n" +"PO-Revision-Date: 2014-06-11 16:01+0000\n" "Last-Translator: Alexandru Geana <alex(a)alegen.net>\n" "Language-Team: Romanian (http://www.transifex.com/projects/p/torproject/language/ro/)\n" "MIME-Version: 1.0\n"

1 0

[translation/bridgedb] Update translations for bridgedb
by translation＠torproject.org 11 Jun '14

11 Jun '14

commit 51444430c820b5a98d90555e8497acf314e60823 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Jun 11 16:15:02 2014 +0000 Update translations for bridgedb --- fr/LC_MESSAGES/bridgedb.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fr/LC_MESSAGES/bridgedb.po b/fr/LC_MESSAGES/bridgedb.po index be4b0f9..9eb6077 100644 --- a/fr/LC_MESSAGES/bridgedb.po +++ b/fr/LC_MESSAGES/bridgedb.po @@ -16,7 +16,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: 'https://trac.torproject.org/projects/tor/newticket?component=BridgeDB&keywo…'\n" "POT-Creation-Date: 2014-06-06 21:46+0000\n" -"PO-Revision-Date: 2014-06-11 14:15+0000\n" +"PO-Revision-Date: 2014-06-11 16:02+0000\n" "Last-Translator: hpatte <hadrien.44(a)gmail.com>\n" "Language-Team: French (http://www.transifex.com/projects/p/torproject/language/fr/)\n" "MIME-Version: 1.0\n"

1 0

[tor/master] Tweak changes entry for 6799
by nickm＠torproject.org 11 Jun '14

11 Jun '14

commit bbb8f12ee4efd6f1c2bc8b34dfaf50e314863476 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 11 11:52:58 2014 -0400 Tweak changes entry for 6799 --- changes/bug6799 | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/changes/bug6799 b/changes/bug6799 index 14ba4ae..72b6519 100644 --- a/changes/bug6799 +++ b/changes/bug6799 @@ -1,8 +1,8 @@ o Major features: - Increase the base amount of time that a canonical connection - (one that we have made to a known OR) is allowed to stay open - from a 3 minutes to 15 minutes. This leaks less information + (one that we have made to a known OR) is allowed to stay idle + from 3 minutes to 15 minutes. This leaks less information about when circuits have closed, and avoids unnecessary overhead from renegotiating connections. Part of a fix for ticket 6799. @@ -14,7 +14,7 @@ - Base connection idleness tests on the actual time elapsed since the connection last had circuits, not on the time when we last - added non-padding. This also makes it harder to tell when the last - circuit closed by looking at when a connection closes. Part of a - fix for ticket 6799. + added non-padding. This change also makes it harder for an + observer to tell when the last circuit closed by looking at when + a connection closes. Part of a fix for ticket 6799. Incidentally fixes bug 12023; bugfix on 0.2.5.1-alpha.

1 0

[tor/master] Give each or_connection_t a slightly randomized idle_timeout
by nickm＠torproject.org 11 Jun '14

11 Jun '14

commit 463f6628d316cecdd612b4a78cd5349ab4a824c5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 9 11:13:37 2014 -0400 Give each or_connection_t a slightly randomized idle_timeout Instead of killing an or_connection_t that has had no circuits for the last 3 minutes, give every or_connection_t a randomized timeout, so that an observer can't so easily infer from the connection close time the time at which its last circuit closed. Also, increase the base timeout for canonical connections from 3 minutes to 15 minutes. Fix for ticket 6799. --- changes/bug6799 | 13 +++++++++++++ src/or/channeltls.c | 2 +- src/or/connection.c | 2 ++ src/or/connection_or.c | 41 ++++++++++++++++++++++++++++++++++++++++- src/or/connection_or.h | 2 ++ src/or/main.c | 11 +---------- src/or/or.h | 5 ++++- 7 files changed, 63 insertions(+), 13 deletions(-) diff --git a/changes/bug6799 b/changes/bug6799 new file mode 100644 index 0000000..b50762b --- /dev/null +++ b/changes/bug6799 @@ -0,0 +1,13 @@ + o Major features: + + - Increate the base amount of time that a canonical connection + (one that we have made to a known OR) is allowed to stay open + from a 3 minutes to 15 minutes. This leaks less information + about when circuits have closed, and avoids unnecessary overhead + from renegotiating connections. Part of a fix for ticket 6799. + + - Instead of closing connections at a fixed interval after their + last circuit closed, randomly add up to 50% to each connection's + maximum timout. This makes it harder to tell when the last + circuit closed by looking at when a connection closes. Part of a + fix for ticket 6799. diff --git a/src/or/channeltls.c b/src/or/channeltls.c index d5428c1..92e51b2 100644 --- a/src/or/channeltls.c +++ b/src/or/channeltls.c @@ -1514,7 +1514,7 @@ channel_tls_process_netinfo_cell(cell_t *cell, channel_tls_t *chan) return; } if (tor_addr_eq(&addr, &(chan->conn->real_addr))) { - chan->conn->is_canonical = 1; + connection_or_set_canonical(chan->conn, 1); break; } cp = next; diff --git a/src/or/connection.c b/src/or/connection.c index 4f74a1d..b967eac 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -266,6 +266,8 @@ or_connection_new(int socket_family) or_conn->timestamp_last_added_nonpadding = time(NULL); + connection_or_set_canonical(or_conn, 0); + return or_conn; } diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 8e7cd9e..f03b18d 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -756,6 +756,45 @@ connection_or_update_token_buckets(smartlist_t *conns, }); } +/** How long do we wait before killing non-canonical OR connections with no + * circuits? In Tor versions up to 0.2.1.25 and 0.2.2.12-alpha, we waited 15 + * minutes before cancelling these connections, which caused fast relays to + * accrue many many idle connections. Hopefully 3-4.5 minutes is low enough + * that it kills most idle connections, without being so low that we cause + * clients to bounce on and off. + * + * For canonical connections, the limit is higher, at 15-22.5 minutes. + * + * For each OR connection, we randomly add up to 50% extra to its idle_timeout + * field, to avoid exposing when exactly the last circuit closed. Since we're + * storing idle_timeout in a uint16_t, don't let these values get higher than + * 12 hours or so without revising connection_or_set_canonical and/or expanding + * idle_timeout. + */ +#define IDLE_OR_CONN_TIMEOUT_NONCANONICAL 180 +#define IDLE_OR_CONN_TIMEOUT_CANONICAL 900 + +/* Mark <b>or_conn</b> as canonical if <b>is_canonical</b> is set, and + * non-canonical otherwise. Adjust idle_timeout accordingly. + */ +void +connection_or_set_canonical(or_connection_t *or_conn, + int is_canonical) +{ + const unsigned int timeout_base = is_canonical ? + IDLE_OR_CONN_TIMEOUT_CANONICAL : IDLE_OR_CONN_TIMEOUT_NONCANONICAL; + + if (bool_eq(is_canonical, or_conn->is_canonical) && + or_conn->idle_timeout != 0) { + /* Don't recalculate an existing idle_timeout unless the canonical + * status changed. */ + return; + } + + or_conn->is_canonical = !! is_canonical; /* force to a 1-bit boolean */ + or_conn->idle_timeout = timeout_base + crypto_rand_int(timeout_base / 2); +} + /** If we don't necessarily know the router we're connecting to, but we * have an addr/port/id_digest, then fill in as much as we can. Start * by checking to see if this describes a router we know. @@ -780,7 +819,7 @@ connection_or_init_conn_from_address(or_connection_t *conn, /* XXXX proposal 186 is making this more complex. For now, a conn is canonical when it uses the _preferred_ address. */ if (tor_addr_eq(&conn->base_.addr, &node_ap.addr)) - conn->is_canonical = 1; + connection_or_set_canonical(conn, 1); if (!started_here) { /* Override the addr/port, so our log messages will make sense. * This is dangerous, since if we ever try looking up a conn by diff --git a/src/or/connection_or.h b/src/or/connection_or.h index 85e68f1..896556c 100644 --- a/src/or/connection_or.h +++ b/src/or/connection_or.h @@ -47,6 +47,8 @@ void connection_or_report_broken_states(int severity, int domain); int connection_tls_start_handshake(or_connection_t *conn, int receiving); int connection_tls_continue_handshake(or_connection_t *conn); +void connection_or_set_canonical(or_connection_t *or_conn, + int is_canonical); int connection_init_or_handshake_state(or_connection_t *conn, int started_here); diff --git a/src/or/main.c b/src/or/main.c index bd23141..8a653ca 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -993,15 +993,6 @@ directory_info_has_arrived(time_t now, int from_cache) consider_testing_reachability(1, 1); } -/** How long do we wait before killing OR connections with no circuits? - * In Tor versions up to 0.2.1.25 and 0.2.2.12-alpha, we waited 15 minutes - * before cancelling these connections, which caused fast relays to accrue - * many many idle connections. Hopefully 3 minutes is low enough that - * it kills most idle connections, without being so low that we cause - * clients to bounce on and off. - */ -#define IDLE_OR_CONN_TIMEOUT 180 - /** Perform regular maintenance tasks for a single connection. This * function gets run once per second per connection by run_scheduled_events. */ @@ -1088,7 +1079,7 @@ run_connection_housekeeping(int i, time_t now) connection_or_close_normally(TO_OR_CONN(conn), 1); } else if (!connection_or_get_num_circuits(or_conn) && now >= or_conn->timestamp_last_added_nonpadding + - IDLE_OR_CONN_TIMEOUT) { + or_conn->idle_timeout) { log_info(LD_OR,"Expiring non-used OR connection to fd %d (%s:%d) " "[idle %d].", (int)conn->s,conn->address, conn->port, (int)(now - or_conn->timestamp_last_added_nonpadding)); diff --git a/src/or/or.h b/src/or/or.h index 3eaf344..21ee185 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1424,7 +1424,10 @@ typedef struct or_connection_t { unsigned int wide_circ_ids:1; uint16_t link_proto; /**< What protocol version are we using? 0 for * "none negotiated yet." */ - + uint16_t idle_timeout; /**< How long can this connection sit with no + * circuits on it before we close it? Based on + * IDLE_CIRCUIT_TIMEOUT_{NON,}CANONICAL and + * on is_canonical, randomized. */ or_handshake_state_t *handshake_state; /**< If we are setting this connection * up, state information to do so. */

1 0