July 2014 - tor-commits - lists.torproject.org

[tor/master] circuit_build_failed: distinguish "first hop chan failed", "CREATE failed"
by arma＠torproject.org 25 Jul '14

25 Jul '14

commit d5558f00729992a9abeeb1cb1512004de35ec007 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 31 16:53:31 2013 -0400 circuit_build_failed: distinguish "first hop chan failed", "CREATE failed" Roger spotted this on tor-dev in his comments on proposal 221. (Actually, detect DESTROY vs everything else, since arma likes network timeout indicating failure but not overload indicating failure.) --- src/or/circuituse.c | 9 +++++---- src/or/command.c | 1 + src/or/or.h | 3 +++ 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/src/or/circuituse.c b/src/or/circuituse.c index c2d2b2e..06a51a0 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -1382,10 +1382,11 @@ circuit_build_failed(origin_circuit_t *circ) failed_at_last_hop = 1; } if (circ->cpath && - circ->cpath->state != CPATH_STATE_OPEN) { - /* We failed at the first hop. If there's an OR connection - * to blame, blame it. Also, avoid this relay for a while, and - * fail any one-hop directory fetches destined for it. */ + circ->cpath->state != CPATH_STATE_OPEN && + ! circ->base_.received_destroy) { + /* We failed at the first hop for some reason other than a DESTROY cell. + * If there's an OR connection to blame, blame it. Also, avoid this relay + * for a while, and fail any one-hop directory fetches destined for it. */ const char *n_chan_id = circ->cpath->extend_info->identity_digest; int already_marked = 0; if (circ->base_.n_chan) { diff --git a/src/or/command.c b/src/or/command.c index 699b02f..51d07b0 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -499,6 +499,7 @@ command_process_destroy_cell(cell_t *cell, channel_t *chan) log_debug(LD_OR,"Received for circID %u.",(unsigned)cell->circ_id); reason = (uint8_t)cell->payload[0]; + circ->received_destroy = 1; if (!CIRCUIT_IS_ORIGIN(circ) && cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id) { diff --git a/src/or/or.h b/src/or/or.h index 3eaf344..34f055c 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2785,6 +2785,9 @@ typedef struct circuit_t { * allowing n_streams to add any more cells. (OR circuit only.) */ unsigned int streams_blocked_on_p_chan : 1; + /** True iff this circuit has received a DESTROY cell in either direction */ + unsigned int received_destroy : 1; + uint8_t state; /**< Current status of this circuit. */ uint8_t purpose; /**< Why are we creating this circuit? */

1 0

[tor/master] Merge branch 'maint-0.2.5'
by arma＠torproject.org 25 Jul '14

25 Jul '14

commit 3f39c0e63e5b5460ea52b6a217aa4cc658d7a425 Merge: bdc2cef 2126fea Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jul 25 12:22:41 2014 -0400 Merge branch 'maint-0.2.5'

1 0

[tor/master] Merge branch 'maint-0.2.4' into maint-0.2.5
by arma＠torproject.org 25 Jul '14

25 Jul '14

commit b350ac0860f461028a373a7ff6ce5c1468ef75a6 Merge: 472696e d5558f0 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jul 25 12:15:47 2014 -0400 Merge branch 'maint-0.2.4' into maint-0.2.5 Conflicts: src/or/or.h changes/prop221 | 6 ++++++ 1 file changed, 6 insertions(+)

1 0

[tor/master] get rid of already-merged prop221 changes file
by arma＠torproject.org 25 Jul '14

25 Jul '14

commit 2126feaabc3e07dc8f7ad712256de496fbcfb976 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jul 25 12:22:05 2014 -0400 get rid of already-merged prop221 changes file --- changes/prop221 | 6 ------ 1 file changed, 6 deletions(-) diff --git a/changes/prop221 b/changes/prop221 deleted file mode 100644 index b2bf44b..0000000 --- a/changes/prop221 +++ /dev/null @@ -1,6 +0,0 @@ - o Minor features: - - Stop sending the CREATE_FAST cells by default; instead, use a - parameter in the consensus to decide whether to use - CREATE_FAST. This can improve security on connections where - Tor's circuit handshake is stronger than the available TLS - connection security levels. Implements proposal 221.

1 0

[tor/maint-0.2.5] get rid of already-merged prop221 changes file
by arma＠torproject.org 25 Jul '14

25 Jul '14

commit 2126feaabc3e07dc8f7ad712256de496fbcfb976 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jul 25 12:22:05 2014 -0400 get rid of already-merged prop221 changes file --- changes/prop221 | 6 ------ 1 file changed, 6 deletions(-) diff --git a/changes/prop221 b/changes/prop221 deleted file mode 100644 index b2bf44b..0000000 --- a/changes/prop221 +++ /dev/null @@ -1,6 +0,0 @@ - o Minor features: - - Stop sending the CREATE_FAST cells by default; instead, use a - parameter in the consensus to decide whether to use - CREATE_FAST. This can improve security on connections where - Tor's circuit handshake is stronger than the available TLS - connection security levels. Implements proposal 221.

1 0

[tor/maint-0.2.5] circuit_build_failed: distinguish "first hop chan failed", "CREATE failed"
by arma＠torproject.org 25 Jul '14

25 Jul '14

commit d5558f00729992a9abeeb1cb1512004de35ec007 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 31 16:53:31 2013 -0400 circuit_build_failed: distinguish "first hop chan failed", "CREATE failed" Roger spotted this on tor-dev in his comments on proposal 221. (Actually, detect DESTROY vs everything else, since arma likes network timeout indicating failure but not overload indicating failure.) --- src/or/circuituse.c | 9 +++++---- src/or/command.c | 1 + src/or/or.h | 3 +++ 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/src/or/circuituse.c b/src/or/circuituse.c index c2d2b2e..06a51a0 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -1382,10 +1382,11 @@ circuit_build_failed(origin_circuit_t *circ) failed_at_last_hop = 1; } if (circ->cpath && - circ->cpath->state != CPATH_STATE_OPEN) { - /* We failed at the first hop. If there's an OR connection - * to blame, blame it. Also, avoid this relay for a while, and - * fail any one-hop directory fetches destined for it. */ + circ->cpath->state != CPATH_STATE_OPEN && + ! circ->base_.received_destroy) { + /* We failed at the first hop for some reason other than a DESTROY cell. + * If there's an OR connection to blame, blame it. Also, avoid this relay + * for a while, and fail any one-hop directory fetches destined for it. */ const char *n_chan_id = circ->cpath->extend_info->identity_digest; int already_marked = 0; if (circ->base_.n_chan) { diff --git a/src/or/command.c b/src/or/command.c index 699b02f..51d07b0 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -499,6 +499,7 @@ command_process_destroy_cell(cell_t *cell, channel_t *chan) log_debug(LD_OR,"Received for circID %u.",(unsigned)cell->circ_id); reason = (uint8_t)cell->payload[0]; + circ->received_destroy = 1; if (!CIRCUIT_IS_ORIGIN(circ) && cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id) { diff --git a/src/or/or.h b/src/or/or.h index 3eaf344..34f055c 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2785,6 +2785,9 @@ typedef struct circuit_t { * allowing n_streams to add any more cells. (OR circuit only.) */ unsigned int streams_blocked_on_p_chan : 1; + /** True iff this circuit has received a DESTROY cell in either direction */ + unsigned int received_destroy : 1; + uint8_t state; /**< Current status of this circuit. */ uint8_t purpose; /**< Why are we creating this circuit? */

1 0

[tor/maint-0.2.5] Merge branch 'maint-0.2.4' into maint-0.2.5
by arma＠torproject.org 25 Jul '14

25 Jul '14

commit b350ac0860f461028a373a7ff6ce5c1468ef75a6 Merge: 472696e d5558f0 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jul 25 12:15:47 2014 -0400 Merge branch 'maint-0.2.4' into maint-0.2.5 Conflicts: src/or/or.h changes/prop221 | 6 ++++++ 1 file changed, 6 insertions(+)

1 0

[tor/maint-0.2.5] Implement proposal 221: Stop sending CREATE_FAST
by arma＠torproject.org 25 Jul '14

25 Jul '14

commit e001610c99bea661dbefc693ec173a90fcb3ee5e Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 31 16:44:14 2013 -0400 Implement proposal 221: Stop sending CREATE_FAST This makes FastFirstHopPK an AUTOBOOL; makes the default "auto"; and makes the behavior of "auto" be "look at the consensus." --- changes/prop221 | 6 ++++++ doc/tor.1.txt | 8 +++++--- src/or/circuitbuild.c | 8 +++++--- src/or/config.c | 2 +- 4 files changed, 17 insertions(+), 7 deletions(-) diff --git a/changes/prop221 b/changes/prop221 new file mode 100644 index 0000000..b2bf44b --- /dev/null +++ b/changes/prop221 @@ -0,0 +1,6 @@ + o Minor features: + - Stop sending the CREATE_FAST cells by default; instead, use a + parameter in the consensus to decide whether to use + CREATE_FAST. This can improve security on connections where + Tor's circuit handshake is stronger than the available TLS + connection security levels. Implements proposal 221. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 779db61..4f3612b 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1119,15 +1119,17 @@ The following options are useful only for clients (that is, if the node "foo". Disabled by default since attacking websites and exit relays can use it to manipulate your path selection. (Default: 0) -[[FastFirstHopPK]] **FastFirstHopPK** **0**|**1**:: +[[FastFirstHopPK]] **FastFirstHopPK** **0**|**1**|**auto**:: When this option is disabled, Tor uses the public key step for the first hop of creating circuits. Skipping it is generally safe since we have already used TLS to authenticate the relay and to establish forward-secure - keys. Turning this option off makes circuit building slower. + + keys. Turning this option off makes circuit building a little + slower. Setting this option to "auto" takes advice from the authorities + in the latest consensus about whether to use this feature. + + Note that Tor will always use the public key step for the first hop if it's operating as a relay, and it will never use the public key step if it - doesn't yet know the onion key of the first hop. (Default: 1) + doesn't yet know the onion key of the first hop. (Default: auto) [[TransPort]] **TransPort** \['address':]__port__|**auto** [_isolation flags_]:: Open this port to listen for transparent proxy connections. Set this to diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 2b4d3c3..4603de0 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -663,16 +663,18 @@ should_use_create_fast_for_circuit(origin_circuit_t *circ) if (!circ->cpath->extend_info->onion_key) return 1; /* our hand is forced: only a create_fast will work. */ - if (!options->FastFirstHopPK) - return 0; /* we prefer to avoid create_fast */ if (public_server_mode(options)) { /* We're a server, and we know an onion key. We can choose. * Prefer to blend our circuit into the other circuits we are * creating on behalf of others. */ return 0; } + if (options->FastFirstHopPK == -1) { + /* option is "auto", so look at the consensus. */ + return networkstatus_get_param(NULL, "usecreatefast", 1, 0, 1); + } - return 1; + return options->FastFirstHopPK; } /** Return true if <b>circ</b> is the type of circuit we want to count diff --git a/src/or/config.c b/src/or/config.c index a2811eb..1de9187 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -236,7 +236,7 @@ static config_var_t option_vars_[] = { OBSOLETE("FallbackNetworkstatusFile"), V(FascistFirewall, BOOL, "0"), V(FirewallPorts, CSV, ""), - V(FastFirstHopPK, BOOL, "1"), + V(FastFirstHopPK, AUTOBOOL, "auto"), V(FetchDirInfoEarly, BOOL, "0"), V(FetchDirInfoExtraEarly, BOOL, "0"), V(FetchServerDescriptors, BOOL, "1"),

1 0

[tor/maint-0.2.4] Implement proposal 221: Stop sending CREATE_FAST
by arma＠torproject.org 25 Jul '14

25 Jul '14

commit e001610c99bea661dbefc693ec173a90fcb3ee5e Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 31 16:44:14 2013 -0400 Implement proposal 221: Stop sending CREATE_FAST This makes FastFirstHopPK an AUTOBOOL; makes the default "auto"; and makes the behavior of "auto" be "look at the consensus." --- changes/prop221 | 6 ++++++ doc/tor.1.txt | 8 +++++--- src/or/circuitbuild.c | 8 +++++--- src/or/config.c | 2 +- 4 files changed, 17 insertions(+), 7 deletions(-) diff --git a/changes/prop221 b/changes/prop221 new file mode 100644 index 0000000..b2bf44b --- /dev/null +++ b/changes/prop221 @@ -0,0 +1,6 @@ + o Minor features: + - Stop sending the CREATE_FAST cells by default; instead, use a + parameter in the consensus to decide whether to use + CREATE_FAST. This can improve security on connections where + Tor's circuit handshake is stronger than the available TLS + connection security levels. Implements proposal 221. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 779db61..4f3612b 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1119,15 +1119,17 @@ The following options are useful only for clients (that is, if the node "foo". Disabled by default since attacking websites and exit relays can use it to manipulate your path selection. (Default: 0) -[[FastFirstHopPK]] **FastFirstHopPK** **0**|**1**:: +[[FastFirstHopPK]] **FastFirstHopPK** **0**|**1**|**auto**:: When this option is disabled, Tor uses the public key step for the first hop of creating circuits. Skipping it is generally safe since we have already used TLS to authenticate the relay and to establish forward-secure - keys. Turning this option off makes circuit building slower. + + keys. Turning this option off makes circuit building a little + slower. Setting this option to "auto" takes advice from the authorities + in the latest consensus about whether to use this feature. + + Note that Tor will always use the public key step for the first hop if it's operating as a relay, and it will never use the public key step if it - doesn't yet know the onion key of the first hop. (Default: 1) + doesn't yet know the onion key of the first hop. (Default: auto) [[TransPort]] **TransPort** \['address':]__port__|**auto** [_isolation flags_]:: Open this port to listen for transparent proxy connections. Set this to diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 2b4d3c3..4603de0 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -663,16 +663,18 @@ should_use_create_fast_for_circuit(origin_circuit_t *circ) if (!circ->cpath->extend_info->onion_key) return 1; /* our hand is forced: only a create_fast will work. */ - if (!options->FastFirstHopPK) - return 0; /* we prefer to avoid create_fast */ if (public_server_mode(options)) { /* We're a server, and we know an onion key. We can choose. * Prefer to blend our circuit into the other circuits we are * creating on behalf of others. */ return 0; } + if (options->FastFirstHopPK == -1) { + /* option is "auto", so look at the consensus. */ + return networkstatus_get_param(NULL, "usecreatefast", 1, 0, 1); + } - return 1; + return options->FastFirstHopPK; } /** Return true if <b>circ</b> is the type of circuit we want to count diff --git a/src/or/config.c b/src/or/config.c index a2811eb..1de9187 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -236,7 +236,7 @@ static config_var_t option_vars_[] = { OBSOLETE("FallbackNetworkstatusFile"), V(FascistFirewall, BOOL, "0"), V(FirewallPorts, CSV, ""), - V(FastFirstHopPK, BOOL, "1"), + V(FastFirstHopPK, AUTOBOOL, "auto"), V(FetchDirInfoEarly, BOOL, "0"), V(FetchDirInfoExtraEarly, BOOL, "0"), V(FetchServerDescriptors, BOOL, "1"),

1 0

[tor/maint-0.2.4] circuit_build_failed: distinguish "first hop chan failed", "CREATE failed"
by arma＠torproject.org 25 Jul '14

25 Jul '14

commit d5558f00729992a9abeeb1cb1512004de35ec007 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 31 16:53:31 2013 -0400 circuit_build_failed: distinguish "first hop chan failed", "CREATE failed" Roger spotted this on tor-dev in his comments on proposal 221. (Actually, detect DESTROY vs everything else, since arma likes network timeout indicating failure but not overload indicating failure.) --- src/or/circuituse.c | 9 +++++---- src/or/command.c | 1 + src/or/or.h | 3 +++ 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/src/or/circuituse.c b/src/or/circuituse.c index c2d2b2e..06a51a0 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -1382,10 +1382,11 @@ circuit_build_failed(origin_circuit_t *circ) failed_at_last_hop = 1; } if (circ->cpath && - circ->cpath->state != CPATH_STATE_OPEN) { - /* We failed at the first hop. If there's an OR connection - * to blame, blame it. Also, avoid this relay for a while, and - * fail any one-hop directory fetches destined for it. */ + circ->cpath->state != CPATH_STATE_OPEN && + ! circ->base_.received_destroy) { + /* We failed at the first hop for some reason other than a DESTROY cell. + * If there's an OR connection to blame, blame it. Also, avoid this relay + * for a while, and fail any one-hop directory fetches destined for it. */ const char *n_chan_id = circ->cpath->extend_info->identity_digest; int already_marked = 0; if (circ->base_.n_chan) { diff --git a/src/or/command.c b/src/or/command.c index 699b02f..51d07b0 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -499,6 +499,7 @@ command_process_destroy_cell(cell_t *cell, channel_t *chan) log_debug(LD_OR,"Received for circID %u.",(unsigned)cell->circ_id); reason = (uint8_t)cell->payload[0]; + circ->received_destroy = 1; if (!CIRCUIT_IS_ORIGIN(circ) && cell->circ_id == TO_OR_CIRCUIT(circ)->p_circ_id) { diff --git a/src/or/or.h b/src/or/or.h index 3eaf344..34f055c 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2785,6 +2785,9 @@ typedef struct circuit_t { * allowing n_streams to add any more cells. (OR circuit only.) */ unsigned int streams_blocked_on_p_chan : 1; + /** True iff this circuit has received a DESTROY cell in either direction */ + unsigned int received_destroy : 1; + uint8_t state; /**< Current status of this circuit. */ uint8_t purpose; /**< Why are we creating this circuit? */

1 0