July 2014 - tor-commits - lists.torproject.org

[tor/release-0.2.5] Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5
by arma＠torproject.org 24 Jul '14

24 Jul '14

commit e0aa88d10662d2ea7cc54f0fd53f5789fdd9a3da Merge: fa8bb25 75501db Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jul 21 14:30:09 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5 changes/geoip-july2014 | 3 + changes/geoip6-july2014 | 2 + src/config/geoip | 3600 ++++++++++++++++++++++++++++++++-------------- src/config/geoip6 | 3674 ++++++++++++----------------------------------- 4 files changed, 3439 insertions(+), 3840 deletions(-)

1 0

[tor/release-0.2.5] Merge branch 'maint-0.2.4' into maint-0.2.5
by arma＠torproject.org 24 Jul '14

24 Jul '14

commit a4c641cce91acb673f81db2b6093fde425039eaf Merge: 5c200d9 71c62b1 Author: Roger Dingledine <arma(a)torproject.org> Date: Thu Jul 24 16:23:08 2014 -0400 Merge branch 'maint-0.2.4' into maint-0.2.5 changes/ticket12688 | 6 ++++++ doc/tor.1.txt | 8 ++++++-- src/or/config.c | 5 +---- src/or/entrynodes.c | 20 ++++++++++++++++---- 4 files changed, 29 insertions(+), 10 deletions(-)

1 0

[tor/release-0.2.5] Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5
by arma＠torproject.org 24 Jul '14

24 Jul '14

commit 5c200d9be28ac9e53caac333ddd334539524d9e1 Merge: e0aa88d 303d7f5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 23 21:28:42 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5 changes/curve25519-donna32-bug | 12 ++ src/ext/curve25519_donna/curve25519-donna.c | 292 ++++++++++++++++++++------- 2 files changed, 228 insertions(+), 76 deletions(-)

1 0

[tor/release-0.2.5] Merge branch 'curve25519-donna32' into maint-0.2.4
by arma＠torproject.org 24 Jul '14

24 Jul '14

commit 303d7f55d9ec8c7dbd9784171cf4df97cc5d7eef Merge: 75501db ad0cf55 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 23 21:28:18 2014 -0400 Merge branch 'curve25519-donna32' into maint-0.2.4 changes/curve25519-donna32-bug | 12 ++ src/ext/curve25519_donna/curve25519-donna.c | 292 ++++++++++++++++++++------- 2 files changed, 228 insertions(+), 76 deletions(-)

1 0

[tor/release-0.2.5] update manpage for numentryguards / numdirectoryguards
by arma＠torproject.org 24 Jul '14

24 Jul '14

commit 71c62b15ca809105cbba0bf2fa86484793701b64 Author: Roger Dingledine <arma(a)torproject.org> Date: Thu Jul 24 12:19:15 2014 -0400 update manpage for numentryguards / numdirectoryguards --- doc/tor.1.txt | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index eb9ad67..779db61 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1054,12 +1054,16 @@ The following options are useful only for clients (that is, if [[NumEntryGuards]] **NumEntryGuards** __NUM__:: If UseEntryGuards is set to 1, we will try to pick a total of NUM routers - as long-term entries for our circuits. (Default: 3) + as long-term entries for our circuits. If NUM is 0, we try to learn + the number from the NumEntryGuards consensus parameter, and default + to 3 if the consensus parameter isn't set. (Default: 0) [[NumDirectoryGuards]] **NumDirectoryGuards** __NUM__:: If UseEntryGuardsAsDirectoryGuards is enabled, we try to make sure we have at least NUM routers to use as directory guards. If this option - is set to 0, use the value from NumEntryGuards. (Default: 0) + is set to 0, use the value from the NumDirectoryGuards consensus + parameter, falling back to the value from NumEntryGuards if the + consensus parameter is 0 or isn't set. (Default: 0) [[GuardLifetime]] **GuardLifetime** __N__ **days**|**weeks**|**months**:: If nonzero, and UseEntryGuards is set, minimum time to keep a guard before

1 0

[tor/release-0.2.5] add a NumDirectoryGuards consensus param too
by arma＠torproject.org 24 Jul '14

24 Jul '14

commit 9fc276a1c7f94d1e0a48e00a358536027a9a7820 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed Jul 23 15:28:40 2014 -0400 add a NumDirectoryGuards consensus param too --- changes/ticket12688 | 5 +++-- src/or/entrynodes.c | 12 ++++++++++-- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/changes/ticket12688 b/changes/ticket12688 index d8e56c1..88228e5 100644 --- a/changes/ticket12688 +++ b/changes/ticket12688 @@ -1,5 +1,6 @@ Major features: - - Make the number of entry guards (and thus, by default, directory - guards too) configurable via a new NumEntryGuards consensus + - Make the number of entry guards configurable via a new + NumEntryGuards consensus parameter, and the number of directory + guards configurable via a new NumDirectoryGuards consensus parameter. Implements ticket 12688. diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index abd10e3..484b88d 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -433,10 +433,18 @@ add_an_entry_guard(const node_t *chosen, int reset_status, int prepend, static int decide_num_guards(const or_options_t *options, int for_directory) { - if (for_directory && options->NumDirectoryGuards != 0) - return options->NumDirectoryGuards; + if (for_directory) { + int answer; + if (options->NumDirectoryGuards != 0) + return options->NumDirectoryGuards; + answer = networkstatus_get_param(NULL, "NumDirectoryGuards", 0, 0, 10); + if (answer) /* non-zero means use the consensus value */ + return answer; + } + if (options->NumEntryGuards) return options->NumEntryGuards; + /* Use the value from the consensus, or 3 if no guidance. */ return networkstatus_get_param(NULL, "NumEntryGuards", 3, 1, 10); }

1 0

[tor/release-0.2.5] Raise guard threshold to top 25% or 2000 kilounits
by arma＠torproject.org 24 Jul '14

24 Jul '14

commit a57c07b21098da4a97d586ffdedca71babe4daaa Author: Roger Dingledine <arma(a)torproject.org> Date: Thu Jul 24 00:35:47 2014 -0400 Raise guard threshold to top 25% or 2000 kilounits Authorities now assign the Guard flag to the fastest 25% of the network (it used to be the fastest 50%). Also raise the consensus weight that guarantees the Guard flag from 250 to 2000. For the current network, this results in about 1100 guards, down from 2500. This step paves the way for moving the number of entry guards down to 1 (proposal 236) while still providing reasonable expected performance for most users. Implements ticket 12690. --- changes/ticket12690 | 9 +++++++++ src/or/config.c | 2 +- src/or/dirserv.c | 5 +++-- 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/changes/ticket12690 b/changes/ticket12690 new file mode 100644 index 0000000..5091883 --- /dev/null +++ b/changes/ticket12690 @@ -0,0 +1,9 @@ + o Minor features: + - Authorities now assign the Guard flag to the fastest 25% of the + network (it used to be the fastest 50%). Also raise the consensus + weight that guarantees the Guard flag from 250 to 2000. For the + current network, this results in about 1100 guards, down from 2500. + This step paves the way for moving the number of entry guards + down to 1 (proposal 236) while still providing reasonable expected + performance for most users. Implements ticket 12690. + diff --git a/src/or/config.c b/src/or/config.c index 4182411..2661ce3 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -147,7 +147,7 @@ static config_var_t option_vars_[] = { V(AuthDirInvalid, LINELIST, NULL), V(AuthDirInvalidCCs, CSV, ""), V(AuthDirFastGuarantee, MEMUNIT, "100 KB"), - V(AuthDirGuardBWGuarantee, MEMUNIT, "250 KB"), + V(AuthDirGuardBWGuarantee, MEMUNIT, "2 MB"), V(AuthDirReject, LINELIST, NULL), V(AuthDirRejectCCs, CSV, ""), V(AuthDirRejectUnlisted, BOOL, "0"), diff --git a/src/or/dirserv.c b/src/or/dirserv.c index aedd092..49fafaf 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -1588,7 +1588,7 @@ dirserv_compute_performance_thresholds(routerlist_t *rl, /* (Now bandwidths is sorted.) */ if (fast_bandwidth_kb < ROUTER_REQUIRED_MIN_BANDWIDTH/(2 * 1000)) fast_bandwidth_kb = bandwidths_kb[n_active/4]; - guard_bandwidth_including_exits_kb = bandwidths_kb[(n_active-1)/2]; + guard_bandwidth_including_exits_kb = bandwidths_kb[n_active*3/4]; guard_tk = find_nth_long(tks, n_active, n_active/8); } @@ -1646,7 +1646,8 @@ dirserv_compute_performance_thresholds(routerlist_t *rl, if (n_active_nonexit) { guard_bandwidth_excluding_exits_kb = - median_uint32(bandwidths_excluding_exits_kb, n_active_nonexit); + find_nth_uint32(bandwidths_excluding_exits_kb, + n_active_nonexit, n_active_nonexit*3/4); } log_info(LD_DIRSERV,

1 0

[tor/release-0.2.5] Add and use a new NumEntryGuards consensus parameter.
by arma＠torproject.org 24 Jul '14

24 Jul '14

commit 56ee61b8aed058c20edc9c7e10dc48f1ab798bbc Author: Roger Dingledine <arma(a)torproject.org> Date: Wed Jul 23 12:23:49 2014 -0400 Add and use a new NumEntryGuards consensus parameter. When specified, it overrides our default of 3 entry guards. (By default, it overrides the number of directory guards too.) Implements ticket 12688. --- changes/ticket12688 | 5 +++++ src/or/config.c | 5 +---- src/or/entrynodes.c | 8 ++++++-- 3 files changed, 12 insertions(+), 6 deletions(-) diff --git a/changes/ticket12688 b/changes/ticket12688 new file mode 100644 index 0000000..d8e56c1 --- /dev/null +++ b/changes/ticket12688 @@ -0,0 +1,5 @@ + Major features: + - Make the number of entry guards (and thus, by default, directory + guards too) configurable via a new NumEntryGuards consensus + parameter. Implements ticket 12688. + diff --git a/src/or/config.c b/src/or/config.c index 09fdc0c..a2811eb 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -315,7 +315,7 @@ static config_var_t option_vars_[] = { VAR("NodeFamily", LINELIST, NodeFamilies, NULL), V(NumCPUs, UINT, "0"), V(NumDirectoryGuards, UINT, "0"), - V(NumEntryGuards, UINT, "3"), + V(NumEntryGuards, UINT, "0"), V(ORListenAddress, LINELIST, NULL), VPORT(ORPort, LINELIST, NULL), V(OutboundBindAddress, LINELIST, NULL), @@ -3031,9 +3031,6 @@ options_validate(or_options_t *old_options, or_options_t *options, "have it group-readable."); } - if (options->UseEntryGuards && ! options->NumEntryGuards) - REJECT("Cannot enable UseEntryGuards with NumEntryGuards set to 0"); - if (options->MyFamily && options->BridgeRelay) { log_warn(LD_CONFIG, "Listing a family for a bridge relay is not " "supported: it can reveal bridge fingerprints to censors. " diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 59770fa..abd10e3 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -435,7 +435,10 @@ decide_num_guards(const or_options_t *options, int for_directory) { if (for_directory && options->NumDirectoryGuards != 0) return options->NumDirectoryGuards; - return options->NumEntryGuards; + if (options->NumEntryGuards) + return options->NumEntryGuards; + /* Use the value from the consensus, or 3 if no guidance. */ + return networkstatus_get_param(NULL, "NumEntryGuards", 3, 1, 10); } /** If the use of entry guards is configured, choose more entry guards @@ -815,6 +818,7 @@ entry_guards_set_from_config(const or_options_t *options) { smartlist_t *entry_nodes, *worse_entry_nodes, *entry_fps; smartlist_t *old_entry_guards_on_list, *old_entry_guards_not_on_list; + const int numentryguards = decide_num_guards(options, 0); tor_assert(entry_guards); should_add_entry_nodes = 0; @@ -883,7 +887,7 @@ entry_guards_set_from_config(const or_options_t *options) /* Next, the rest of EntryNodes */ SMARTLIST_FOREACH_BEGIN(entry_nodes, const node_t *, node) { add_an_entry_guard(node, 0, 0, 1, 0); - if (smartlist_len(entry_guards) > options->NumEntryGuards * 10) + if (smartlist_len(entry_guards) > numentryguards * 10) break; } SMARTLIST_FOREACH_END(node); log_notice(LD_GENERAL, "%d entries in guards", smartlist_len(entry_guards));

1 0

[tor/release-0.2.5] Remove executable bit from control.c, router.c
by arma＠torproject.org 24 Jul '14

24 Jul '14

commit 35791f4238bd6853c038d5fc68976dd74c93c577 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 9 08:54:08 2014 -0400 Remove executable bit from control.c, router.c Fix for 12512. --- 0 files changed diff --git a/src/or/control.c b/src/or/control.c old mode 100755 new mode 100644 diff --git a/src/or/router.c b/src/or/router.c old mode 100755 new mode 100644

1 0

[tor/release-0.2.5] Fix a bug where streams would linger forever when we had no dirinfo
by arma＠torproject.org 24 Jul '14

24 Jul '14

commit ed3d7892c721c9495215ecad2e18c026d29fbb9b Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 9 16:14:14 2014 -0400 Fix a bug where streams would linger forever when we had no dirinfo fixes bug 8387; fix on 0.1.1.11-alpha (code), or on 0.2.4.10-alpha (behavior). --- changes/bug8387 | 11 +++++++++++ src/or/circuituse.c | 27 ++++++++++++++++++++++----- src/or/circuituse.h | 1 + src/or/main.c | 5 ++++- 4 files changed, 38 insertions(+), 6 deletions(-) diff --git a/changes/bug8387 b/changes/bug8387 new file mode 100644 index 0000000..2ec0487 --- /dev/null +++ b/changes/bug8387 @@ -0,0 +1,11 @@ + o Major bugfixes (client): + + - Perform circuit cleanup operations even when circuit + construction operations are disabled (because the network is + disabled, or because there isn't enough directory information). + Previously, when we were not building predictive circuits, we + were not closing expired circuits either. + + Fixes bug 8387; bugfix on 0.1.1.11-alpha. This bug became visible + in 0.2.4.10-alpha when we became more strict about when we have + "enough directory information to build circuits". diff --git a/src/or/circuituse.c b/src/or/circuituse.c index c2d2b2e..9933b9c 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -969,7 +969,6 @@ circuit_predict_and_launch_new(void) void circuit_build_needed_circs(time_t now) { - static time_t time_to_new_circuit = 0; const or_options_t *options = get_options(); /* launch a new circ for any pending streams that need one */ @@ -978,14 +977,34 @@ circuit_build_needed_circs(time_t now) /* make sure any hidden services have enough intro points */ rend_services_introduce(); - if (time_to_new_circuit < now) { + circuit_expire_old_circs_as_needed(now); + + if (!options->DisablePredictedCircuits) + circuit_predict_and_launch_new(); +} + +/** + * Called once a second either directly or from + * circuit_build_needed_circs(). As appropriate (once per NewCircuitPeriod) + * resets failure counts and expires old circuits. + */ +void +circuit_expire_old_circs_as_needed(time_t now) +{ + static time_t time_to_expire_and_reset = 0; + + if (time_to_expire_and_reset < now) { circuit_reset_failure_count(1); - time_to_new_circuit = now + options->NewCircuitPeriod; + time_to_expire_and_reset = now + get_options()->NewCircuitPeriod; if (proxy_mode(get_options())) addressmap_clean(now); circuit_expire_old_circuits_clientside(); #if 0 /* disable for now, until predict-and-launch-new can cull leftovers */ + + /* If we ever re-enable, this has to move into + * circuit_build_needed_circs */ + circ = circuit_get_youngest_clean_open(CIRCUIT_PURPOSE_C_GENERAL); if (get_options()->RunTesting && circ && @@ -995,8 +1014,6 @@ circuit_build_needed_circs(time_t now) } #endif } - if (!options->DisablePredictedCircuits) - circuit_predict_and_launch_new(); } /** If the stream <b>conn</b> is a member of any of the linked diff --git a/src/or/circuituse.h b/src/or/circuituse.h index 11e5a64..1559a40 100644 --- a/src/or/circuituse.h +++ b/src/or/circuituse.h @@ -21,6 +21,7 @@ int circuit_conforms_to_options(const origin_circuit_t *circ, const or_options_t *options); #endif void circuit_build_needed_circs(time_t now); +void circuit_expire_old_circs_as_needed(time_t now); void circuit_detach_stream(circuit_t *circ, edge_connection_t *conn); void circuit_expire_old_circuits_serverside(time_t now); diff --git a/src/or/main.c b/src/or/main.c index bd23141..495a71f 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -1485,8 +1485,11 @@ run_scheduled_events(time_t now) * and we make a new circ if there are no clean circuits. */ have_dir_info = router_have_minimum_dir_info(); - if (have_dir_info && !net_is_disabled()) + if (have_dir_info && !net_is_disabled()) { circuit_build_needed_circs(now); + } else { + circuit_expire_old_circs_as_needed(now); + } /* every 10 seconds, but not at the same second as other such events */ if (now % 10 == 5)

1 0