January 2015 - tor-commits - lists.torproject.org

[tor/master] Handle config options for AF_UNIX hidden services rendservice.c
by nickm＠torproject.org 28 Jan '15

28 Jan '15

commit 6564291601540bf61c1ca3294b6c22f0c5021a20 Author: Andrea Shepard <andrea(a)torproject.org> Date: Fri Jan 23 14:45:12 2015 +0000 Handle config options for AF_UNIX hidden services rendservice.c --- src/or/rendservice.c | 58 ++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 51 insertions(+), 7 deletions(-) diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 2e0f83c..fac782b 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -308,10 +308,26 @@ rend_add_service(rend_service_t *service) } } +/** Return a new rend_service_port_config_t with its path set to + * socket_path or empty if socket_path is NULL */ +static rend_service_port_config_t * +rend_service_port_config_new(const char *socket_path) +{ + if (!socket_path) + return tor_malloc_zero(sizeof(rend_service_port_config_t)); + + const size_t pathlen = strlen(socket_path) + 1; + rend_service_port_config_t *conf = + tor_malloc_zero(sizeof(rend_service_port_config_t) + pathlen); + memcpy(conf->unix_addr, socket_path, pathlen); + conf->is_unix_addr = 1; + return conf; +} + /** Parses a real-port to virtual-port mapping and returns a new * rend_service_port_config_t. * - * The format is: VirtualPort (IP|RealPort|IP:RealPort)? + * The format is: VirtualPort (IP|RealPort|IP:RealPort|'socket':path)? * * IP defaults to 127.0.0.1; RealPort defaults to VirtualPort. */ @@ -325,6 +341,9 @@ parse_port_config(const char *string) tor_addr_t addr; const char *addrport; rend_service_port_config_t *result = NULL; + const char *socket_prefix = "socket:"; + unsigned int is_unix_addr = 0; + char *socket_path = NULL; sl = smartlist_new(); smartlist_split_string(sl, string, " ", @@ -347,7 +366,26 @@ parse_port_config(const char *string) tor_addr_from_ipv4h(&addr, 0x7F000001u); /* 127.0.0.1 */ } else { addrport = smartlist_get(sl,1); - if (strchr(addrport, ':') || strchr(addrport, '.')) { + /* If it starts with socket:, try to parse it as a socket path */ + if (!strcmpstart(addrport, socket_prefix)) { + if (strlen(addrport + strlen(socket_prefix)) > 0) { +#ifdef HAVE_SYS_UN_H + is_unix_addr = 1; + socket_path = tor_strdup(addrport + strlen(socket_prefix)); +#else + log_warn(LD_CONFIG, + "Hidden service port configuration %s is for an AF_UNIX " + "socket, but we have no support available on this platform", + escaped(addrport)); + goto err; +#endif /* defined(HAVE_SYS_UN_H) */ + } else { + log_warn(LD_CONFIG, + "Empty socket path in hidden service port configuration."); + goto err; + } + } else if (strchr(addrport, ':') || strchr(addrport, '.')) { + /* else try it as an IP:port pair if it has a : or . in it */ if (tor_addr_port_lookup(addrport, &addr, &p)<0) { log_warn(LD_CONFIG,"Unparseable address in hidden service port " "configuration."); @@ -366,15 +404,21 @@ parse_port_config(const char *string) } } - result = tor_malloc(sizeof(rend_service_port_config_t)); + /* Allow room for unix_addr */ + result = rend_service_port_config_new(socket_path); result->virtual_port = virtport; - /* TODO actually support AF_UNIX here */ - result->is_unix_addr = 0; - result->real_port = realport; - tor_addr_copy(&result->real_addr, &addr); + result->is_unix_addr = is_unix_addr; + if (!is_unix_addr) { + result->real_port = realport; + tor_addr_copy(&result->real_addr, &addr); + result->unix_addr[0] = '\0'; + } + err: SMARTLIST_FOREACH(sl, char *, c, tor_free(c)); smartlist_free(sl); + if (socket_path) tor_free(socket_path); + return result; }

1 0

[tor/master] Groundwork for AF_UNIX hidden services in rendservice.c
by nickm＠torproject.org 28 Jan '15

28 Jan '15

commit 03d6a31716dcdddd164391c7910cb3eb6f0083bc Author: Andrea Shepard <andrea(a)torproject.org> Date: Thu Jan 22 02:22:33 2015 +0000 Groundwork for AF_UNIX hidden services in rendservice.c --- src/or/rendservice.c | 60 +++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 55 insertions(+), 5 deletions(-) diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 5a12d07..2e0f83c 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -66,9 +66,16 @@ static ssize_t rend_service_parse_intro_for_v3( * a real port on some IP. */ typedef struct rend_service_port_config_t { + /* The incoming HS virtual port we're mapping */ uint16_t virtual_port; + /* Is this an AF_UNIX port? */ + unsigned int is_unix_addr:1; + /* The outgoing TCP port to use, if !is_unix_addr */ uint16_t real_port; + /* The outgoing IPv4 or IPv6 address to use, if !is_unix_addr */ tor_addr_t real_addr; + /* The socket path to connect to, if is_unix_addr */ + char unix_addr[FLEXIBLE_ARRAY_MEMBER]; } rend_service_port_config_t; /** Try to maintain this many intro points per service by default. */ @@ -279,8 +286,24 @@ rend_add_service(rend_service_t *service) service->directory); for (i = 0; i < smartlist_len(service->ports); ++i) { p = smartlist_get(service->ports, i); - log_debug(LD_REND,"Service maps port %d to %s", - p->virtual_port, fmt_addrport(&p->real_addr, p->real_port)); + if (!(p->is_unix_addr)) { + log_debug(LD_REND, + "Service maps port %d to %s", + p->virtual_port, + fmt_addrport(&p->real_addr, p->real_port)); + } else { +#ifdef HAVE_SYS_UN_H + log_debug(LD_REND, + "Service maps port %d to socket at \"%s\"", + p->virtual_port, p->unix_addr); +#else + log_debug(LD_REND, + "Service maps port %d to an AF_UNIX socket, but we " + "have no AF_UNIX support on this platform. This is " + "probably a bug.", + p->virtual_port); +#endif /* defined(HAVE_SYS_UN_H) */ + } } } } @@ -345,6 +368,8 @@ parse_port_config(const char *string) result = tor_malloc(sizeof(rend_service_port_config_t)); result->virtual_port = virtport; + /* TODO actually support AF_UNIX here */ + result->is_unix_addr = 0; result->real_port = realport; tor_addr_copy(&result->real_addr, &addr); err: @@ -3416,6 +3441,7 @@ rend_service_set_connection_addr_port(edge_connection_t *conn, char serviceid[REND_SERVICE_ID_LEN_BASE32+1]; smartlist_t *matching_ports; rend_service_port_config_t *chosen_port; + int unix_addrs; tor_assert(circ->base_.purpose == CIRCUIT_PURPOSE_S_REND_JOINED); tor_assert(circ->rend_data); @@ -3431,10 +3457,19 @@ rend_service_set_connection_addr_port(edge_connection_t *conn, return -2; } matching_ports = smartlist_new(); + unix_addrs = 0; SMARTLIST_FOREACH(service->ports, rend_service_port_config_t *, p, { + /* + * TODO don't just ignore AF_UNIX ports, but set up edge_connection_t + * properly to use them. + */ if (conn->base_.port == p->virtual_port) { - smartlist_add(matching_ports, p); + if (!(p->is_unix_addr)) { + smartlist_add(matching_ports, p); + } else { + ++unix_addrs; + } } }); chosen_port = smartlist_choose(matching_ports); @@ -3444,8 +3479,23 @@ rend_service_set_connection_addr_port(edge_connection_t *conn, conn->base_.port = chosen_port->real_port; return 0; } - log_info(LD_REND, "No virtual port mapping exists for port %d on service %s", - conn->base_.port,serviceid); + if (!unix_addrs) { + log_info(LD_REND, + "No virtual port mapping exists for port %d on service %s", + conn->base_.port, serviceid); + } else { +#ifdef HAVE_SYS_UN_H + log_info(LD_REND, + "Only AF_UNIX virtual port mappings exists for port %d " + "on service %s, and support is not yet implemented", + conn->base_.port, serviceid); +#else + log_info(LD_REND, + "Only AF_UNIX virtual port mappings exists for port %d " + "on service %s, and support is not available on this platform", + conn->base_.port, serviceid); +#endif /* defined(HAVE_SYS_UN_H) */ + } if (service->allow_unknown_ports) return -1; else

1 0

[tor/master] Actually make connections to HSes on AF_UNIX sockets
by nickm＠torproject.org 28 Jan '15

28 Jan '15

commit bce824a9ad10b9a9d6ecc8363084ca3aef4e636a Author: Andrea Shepard <andrea(a)torproject.org> Date: Tue Jan 27 13:12:40 2015 +0000 Actually make connections to HSes on AF_UNIX sockets --- src/or/rendservice.c | 63 +++++++++++++++++++++++++++++++------------------- 1 file changed, 39 insertions(+), 24 deletions(-) diff --git a/src/or/rendservice.c b/src/or/rendservice.c index fac782b..920a8cf 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -3485,7 +3485,9 @@ rend_service_set_connection_addr_port(edge_connection_t *conn, char serviceid[REND_SERVICE_ID_LEN_BASE32+1]; smartlist_t *matching_ports; rend_service_port_config_t *chosen_port; - int unix_addrs; +#ifndef HAVE_SYS_UN_H + int unix_addrs_rejected; +#endif /* !defined(HAVE_SYS_UN_H) */ tor_assert(circ->base_.purpose == CIRCUIT_PURPOSE_S_REND_JOINED); tor_assert(circ->rend_data); @@ -3501,45 +3503,58 @@ rend_service_set_connection_addr_port(edge_connection_t *conn, return -2; } matching_ports = smartlist_new(); - unix_addrs = 0; +#ifndef HAVE_SYS_UN_H + unix_addrs_rejected = 0; +#endif /* !defined(HAVE_SYS_UN_H) */ SMARTLIST_FOREACH(service->ports, rend_service_port_config_t *, p, { - /* - * TODO don't just ignore AF_UNIX ports, but set up edge_connection_t - * properly to use them. - */ if (conn->base_.port == p->virtual_port) { +#ifdef HAVE_SYS_UN_H + smartlist_add(matching_ports, p); +#else if (!(p->is_unix_addr)) { smartlist_add(matching_ports, p); } else { - ++unix_addrs; + if (unix_addrs_rejected == 0) { + /* If we have no support, bitch about it for just the first one */ + log_warn(LD_REND, + "Saw AF_UNIX virtual port mapping for port %d on service " + "%s, which is unsupported on this platform. Ignoring it.", + conn->base_.port, serviceid); + } + ++unix_addrs_rejected; } +#endif /* defined(HAVE_SYS_UN_H) */ } }); chosen_port = smartlist_choose(matching_ports); smartlist_free(matching_ports); if (chosen_port) { - tor_addr_copy(&conn->base_.addr, &chosen_port->real_addr); - conn->base_.port = chosen_port->real_port; - return 0; - } - if (!unix_addrs) { - log_info(LD_REND, - "No virtual port mapping exists for port %d on service %s", - conn->base_.port, serviceid); - } else { #ifdef HAVE_SYS_UN_H - log_info(LD_REND, - "Only AF_UNIX virtual port mappings exists for port %d " - "on service %s, and support is not yet implemented", - conn->base_.port, serviceid); + if (!(chosen_port->is_unix_addr)) { #else - log_info(LD_REND, - "Only AF_UNIX virtual port mappings exists for port %d " - "on service %s, and support is not available on this platform", - conn->base_.port, serviceid); + { #endif /* defined(HAVE_SYS_UN_H) */ + /* Get a non-AF_UNIX connection ready for connection_exit_connect() */ + tor_addr_copy(&conn->base_.addr, &chosen_port->real_addr); + conn->base_.port = chosen_port->real_port; +#ifdef HAVE_SYS_UN_H + } else { + /* Get an AF_UNIX connection ready for connection_exit_connect() */ + conn->base_.socket_family = AF_UNIX; + tor_addr_make_unspec(&conn->base_.addr); + conn->base_.port = 1; + conn->base_.address = tor_strdup(chosen_port->unix_addr); +#endif /* defined(HAVE_SYS_UN_H) */ + } + + return 0; } + + log_info(LD_REND, + "No virtual port mapping exists for port %d on service %s", + conn->base_.port, serviceid); + if (service->allow_unknown_ports) return -1; else

1 0

[tor/master] Changes file for ticket #11485
by nickm＠torproject.org 28 Jan '15

28 Jan '15

commit 603708d747c39ef90ae4123b3a712fcf165d38b5 Author: Andrea Shepard <andrea(a)torproject.org> Date: Tue Jan 27 13:18:22 2015 +0000 Changes file for ticket #11485 --- changes/ticket11485 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/changes/ticket11485 b/changes/ticket11485 new file mode 100644 index 0000000..9d341c5 --- /dev/null +++ b/changes/ticket11485 @@ -0,0 +1,3 @@ + o Features (hidden services): + - Support mapping hidden service virtual ports to AF_UNIX sockets on + suitable platforms. Resolves ticket #11485.

1 0

[stem/master] ExitPolicy's behavior around 'strictness' was incorrect
by atagar＠torproject.org 28 Jan '15

28 Jan '15

commit db0518c03e2b79500a9132fa82e077fa978972fa Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Jan 28 10:15:51 2015 -0800 ExitPolicy's behavior around 'strictness' was incorrect Our docs state that... * 'strict' is true: we can exit to *all* instances of the given address or port * 'strict' is false: we can exit to *any* instances of the given address or port Caught thanks to nskinkel... https://trac.torproject.org/projects/tor/ticket/14314 --- docs/change_log.rst | 4 ++++ stem/exit_policy.py | 19 ++++++++++++++----- test/unit/exit_policy/policy.py | 11 +++++++++++ test/unit/exit_policy/rule.py | 32 ++++++++++++++++---------------- 4 files changed, 45 insertions(+), 21 deletions(-) diff --git a/docs/change_log.rst b/docs/change_log.rst index e60dd35..21c2105 100644 --- a/docs/change_log.rst +++ b/docs/change_log.rst @@ -49,6 +49,10 @@ performance Stem also now runs directly under both python2 and python3 without a 2to3 conversion (:trac:`14075`). + * **Controller** + + * The 'strict' argument of :func:`~stem.exit_policy.ExitPolicy.can_exit_to` didn't behave as documented (:trac:`14314`) + * **Descriptors** * Lazy-loading descriptors, improving performance by 25-70% depending on what type it is (:trac:`14011`) diff --git a/stem/exit_policy.py b/stem/exit_policy.py index 53d0043..16f8721 100644 --- a/stem/exit_policy.py +++ b/stem/exit_policy.py @@ -748,14 +748,21 @@ class ExitPolicyRule(object): if port is not None and not stem.util.connection.is_valid_port(port): raise ValueError("'%s' isn't a valid port" % port) + # If we're not matching against an address or port but the rule has one + # then we're a fuzzy match. When that happens... + # + # * If strict and a reject rule then we're a match ('can exit to *all* instances'). + # * If not strict and an accept rule then match ('an exit ot *any* instance'). + + fuzzy_match = False + if not self.is_address_wildcard(): # Already got the integer representation of our mask and our address # with the mask applied. Just need to check if this address with the # mask applied matches. if address is None: - if strict: - return False + fuzzy_match = True else: comparison_addr_bin = int(stem.util.connection._get_address_binary(address), 2) comparison_addr_bin &= self._get_mask_bin() @@ -765,12 +772,14 @@ class ExitPolicyRule(object): if not self.is_port_wildcard(): if port is None: - if strict: - return False + fuzzy_match = True elif port < self.min_port or port > self.max_port: return False - return True + if fuzzy_match: + return strict != self.is_accept + else: + return True def get_address_type(self): """ diff --git a/test/unit/exit_policy/policy.py b/test/unit/exit_policy/policy.py index d4eaa75..79f99e1 100644 --- a/test/unit/exit_policy/policy.py +++ b/test/unit/exit_policy/policy.py @@ -65,6 +65,17 @@ class TestExitPolicy(unittest.TestCase): self.assertEqual(expected_result, policy.can_exit_to(ip_addr, index)) self.assertEqual(expected_result, policy.can_exit_to(port = index)) + def test_can_exit_to_strictness(self): + # Check our 'strict' argument. + + policy = ExitPolicy('reject 1.0.0.0/8:80', 'accept *:*') + self.assertEqual(False, policy.can_exit_to(None, 80, strict = True)) # can't exit to *all* instances of port 80 + self.assertEqual(True, policy.can_exit_to(None, 80, strict = False)) # can exit to *an* instance of port 80 + + policy = ExitPolicy('accept 1.0.0.0/8:80', 'reject *:*') + self.assertEqual(False, policy.can_exit_to(None, 80, strict = True)) # can't exit to *all* instances of port 80 + self.assertEqual(True, policy.can_exit_to(None, 80, strict = False)) # can exit to *an* instance of port 80 + def test_is_exiting_allowed(self): test_inputs = { (): True, diff --git a/test/unit/exit_policy/rule.py b/test/unit/exit_policy/rule.py index 1661442..5458c10 100644 --- a/test/unit/exit_policy/rule.py +++ b/test/unit/exit_policy/rule.py @@ -239,10 +239,10 @@ class TestExitPolicyRule(unittest.TestCase): ('FE80:0000:0000:0000:0202:B3FF:FE1E:8329', 80): False, ('[FE80:0000:0000:0000:0202:B3FF:FE1E:8329]', 80): False, ('192.168.0.1', None): True, - (None, 80, False): True, - (None, 80, True): False, - (None, None, False): True, - (None, None, True): False, + (None, 80, False): False, + (None, 80, True): True, + (None, None, False): False, + (None, None, True): True, }, } @@ -265,8 +265,8 @@ class TestExitPolicyRule(unittest.TestCase): ('192.168.0.50', 80): True, ('192.168.0.51', 80): False, ('192.168.0.49', 80): False, - (None, 80, False): True, - (None, 80, True): False, + (None, 80, False): False, + (None, 80, True): True, ('192.168.0.50', None): True, }, 'reject 0.0.0.0/24:*': { @@ -276,8 +276,8 @@ class TestExitPolicyRule(unittest.TestCase): ('0.0.1.0', 80): False, ('0.1.0.0', 80): False, ('1.0.0.0', 80): False, - (None, 80, False): True, - (None, 80, True): False, + (None, 80, False): False, + (None, 80, True): True, ('0.0.0.0', None): True, }, } @@ -296,8 +296,8 @@ class TestExitPolicyRule(unittest.TestCase): ('[FE80:0000:0000:0000:0202:B3FF:FE1E:8329]', 80): True, ('FE80:0000:0000:0000:0202:B3FF:FE1E:8330', 80): False, ('FE80:0000:0000:0000:0202:B3FF:FE1E:8328', 80): False, - (None, 80, False): True, - (None, 80, True): False, + (None, 80, False): False, + (None, 80, True): True, ('FE80:0000:0000:0000:0202:B3FF:FE1E:8329', None): True, }, 'reject [FE80:0000:0000:0000:0202:B3FF:FE1E:8329]/112:*': { @@ -306,8 +306,8 @@ class TestExitPolicyRule(unittest.TestCase): ('FE80:0000:0000:0000:0202:B3FF:FE1E:FFFF', 80): True, ('FE80:0000:0000:0000:0202:B3FF:FE1F:8329', 80): False, ('FE81:0000:0000:0000:0202:B3FF:FE1E:8329', 80): False, - (None, 80, False): True, - (None, 80, True): False, + (None, 80, False): False, + (None, 80, True): True, ('FE80:0000:0000:0000:0202:B3FF:FE1E:8329', None, False): True, ('FE80:0000:0000:0000:0202:B3FF:FE1E:8329', None, True): True, }, @@ -326,8 +326,8 @@ class TestExitPolicyRule(unittest.TestCase): ('192.168.0.50', 81): False, ('192.168.0.50', 79): False, (None, 80): True, - ('192.168.0.50', None, False): True, - ('192.168.0.50', None, True): False, + ('192.168.0.50', None, False): False, + ('192.168.0.50', None, True): True, }, 'reject *:80-85': { ('192.168.0.50', 79): False, @@ -336,8 +336,8 @@ class TestExitPolicyRule(unittest.TestCase): ('192.168.0.50', 85): True, ('192.168.0.50', 86): False, (None, 83): True, - ('192.168.0.50', None, False): True, - ('192.168.0.50', None, True): False, + ('192.168.0.50', None, False): False, + ('192.168.0.50', None, True): True, }, }

1 0

[torspec/master] Add #8405 changes to control-spec
by nickm＠torproject.org 28 Jan '15

28 Jan '15

commit 29759745fe1a3a216af7eb9e7ddfa20a10e60f47 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 28 12:06:49 2015 -0500 Add #8405 changes to control-spec --- control-spec.txt | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/control-spec.txt b/control-spec.txt index 1950b44..e4c98f5 100644 --- a/control-spec.txt +++ b/control-spec.txt @@ -1318,7 +1318,10 @@ [SP "BUILD_FLAGS=" BuildFlags] [SP "PURPOSE=" Purpose] [SP "HS_STATE=" HSState] [SP "REND_QUERY=" HSAddress] [SP "TIME_CREATED=" TimeCreated] - [SP "REASON=" Reason [SP "REMOTE_REASON=" Reason]] CRLF + [SP "REASON=" Reason [SP "REMOTE_REASON=" Reason]] + [SP "SOCKS_USERNAME=" EscapedUsername] + [SP "SOCKS_PASSWORD=" EscapedPassword] + CRLF CircStatus = "LAUNCHED" / ; circuit ID assigned to new circuit @@ -1347,6 +1350,8 @@ "HSSI_CONNECTING" / "HSSI_ESTABLISHED" / "HSSR_CONNECTING" / "HSSR_JOINED" + SocksUsername = SocksPassword = a quoted string + HSAddress = 16*Base32Character Base32Character = ALPHA / "2" / "3" / "4" / "5" / "6" / "7"

1 0

[torspec/master] update and clarify prop227
by nickm＠torproject.org 28 Jan '15

28 Jan '15

commit ce4939a11caa8067a1a4b4e18161c4c85b31aa2c Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 28 12:07:01 2015 -0500 update and clarify prop227 --- proposals/227-vote-on-package-fingerprints.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/proposals/227-vote-on-package-fingerprints.txt b/proposals/227-vote-on-package-fingerprints.txt index 83ac3da..9c5f0da 100644 --- a/proposals/227-vote-on-package-fingerprints.txt +++ b/proposals/227-vote-on-package-fingerprints.txt @@ -35,7 +35,7 @@ Status: Open NONSPACE = one or more non-space printing characters - DIGESTVAL = any number of non-=, non-" " characters. + DIGESTVAL = DIGESTTYPE = any number of non-=, non-" " characters. SP = " " NL = a newline @@ -49,7 +49,7 @@ Status: Open (If a vote contains multiple entries with the same PACKAGENAME and VERSION, then only the last one is considered.) - If the consensus-method is at least (TBD), then when computing + If the consensus-method is at least 19, then when computing the consensus, package lines for a given PACKAGENAME/VERSION pair should be included if at least three authorities list such a package in their votes. (Call these lines the "input" lines for

1 0

[tor/master] changes file for 8405
by nickm＠torproject.org 28 Jan '15

28 Jan '15

commit b63bf0925530005f629d6616c67b3a29875bd64b Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 28 12:06:28 2015 -0500 changes file for 8405 --- changes/feature8405 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changes/feature8405 b/changes/feature8405 new file mode 100644 index 0000000..ac4a361 --- /dev/null +++ b/changes/feature8405 @@ -0,0 +1,4 @@ + o Minor features (controller): + - Include SOCKS_USERNAME and SOCKS_PASSWORD values in controller + events to let controllers observe circuit isolation inputs. + Closes ticket 8405.

1 0

[tor/master] Bug #8405: Report SOCKS username/password in CIRC status events
by nickm＠torproject.org 28 Jan '15

28 Jan '15

commit cb714d896c4436f80bca9e82fc978a245d802eb3 Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Jul 15 21:27:59 2014 -0700 Bug #8405: Report SOCKS username/password in CIRC status events Introduces two new circuit status name-value parameters: SOCKS_USERNAME and SOCKS_PASSWORD. Values are enclosing in quotes and unusual characters are escaped. Example: 650 CIRC 5 EXTENDED [...] SOCKS_USERNAME="my_username" SOCKS_PASSWORD="my_password" --- src/common/util.c | 14 ++++++++++++++ src/common/util.h | 1 + src/or/control.c | 14 ++++++++++++++ 3 files changed, 29 insertions(+) diff --git a/src/common/util.c b/src/common/util.c index be866a5..442d57a 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -1381,6 +1381,20 @@ esc_for_log(const char *s) return result; } +/** Similar to esc_for_log. Allocate and return a new string representing + * the first n characters in chars, surround by quotes and using + * standard C escapes. If a NUL character is encountered in chars, + * the resulting string will be terminated there. + */ +char * +esc_for_log_len(const char *chars, size_t n) +{ + char *string = tor_strndup(chars, n); + char *string_escaped = esc_for_log(string); + tor_free(string); + return string_escaped; +} + /** Allocate and return a new string representing the contents of s, * surrounded by quotes and using standard C escapes. * diff --git a/src/common/util.h b/src/common/util.h index 89c1400..175a078 100644 --- a/src/common/util.h +++ b/src/common/util.h @@ -239,6 +239,7 @@ int tor_mem_is_zero(const char *mem, size_t len); int tor_digest_is_zero(const char *digest); int tor_digest256_is_zero(const char *digest); char *esc_for_log(const char *string) ATTR_MALLOC; +char *esc_for_log_len(const char *chars, size_t n) ATTR_MALLOC; const char *escaped(const char *string); char *tor_escape_str_for_pt_args(const char *string, diff --git a/src/or/control.c b/src/or/control.c index 00cb431..e963aea 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -1882,6 +1882,20 @@ circuit_describe_status_for_controller(origin_circuit_t *circ) smartlist_add_asprintf(descparts, "TIME_CREATED=%s", tbuf); } + // Show username and/or password if available. + if (circ->socks_username_len > 0) { + char* socks_username_escaped = esc_for_log_len(circ->socks_username, + (size_t) circ->socks_username_len); + smartlist_add_asprintf(descparts, "SOCKS_USERNAME=%s", socks_username_escaped); + tor_free(socks_username_escaped); + } + if (circ->socks_password_len > 0) { + char* socks_password_escaped = esc_for_log_len(circ->socks_password, + (size_t) circ->socks_password_len); + smartlist_add_asprintf(descparts, "SOCKS_PASSWORD=%s", socks_password_escaped); + tor_free(socks_password_escaped); + } + rv = smartlist_join_strings(descparts, " ", 0, NULL); SMARTLIST_FOREACH(descparts, char *, cp, tor_free(cp));

1 0

[tor/master] Tweak tor-resolve docs and logs
by nickm＠torproject.org 28 Jan '15

28 Jan '15

commit f75ca04520f9494e10ea8c4a5de584270efa3462 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 28 10:11:08 2015 -0500 Tweak tor-resolve docs and logs Resolves 14325 --- changes/ticket14325 | 5 +++++ doc/tor-resolve.1.txt | 5 ++++- src/tools/tor-resolve.c | 27 ++++++++++++++++----------- 3 files changed, 25 insertions(+), 12 deletions(-) diff --git a/changes/ticket14325 b/changes/ticket14325 new file mode 100644 index 0000000..38daa05 --- /dev/null +++ b/changes/ticket14325 @@ -0,0 +1,5 @@ + o Documentation fixes: + - Make the tor-resolve documentation match its help string and its + options. Resolves part of ticket 14325. + - Log a more useful error message from tor-resolve when failing to + look up a hidden service address. Resolves part of ticket 14325. diff --git a/doc/tor-resolve.1.txt b/doc/tor-resolve.1.txt index 341d302..30e16d5 100644 --- a/doc/tor-resolve.1.txt +++ b/doc/tor-resolve.1.txt @@ -14,7 +14,7 @@ tor-resolve - resolve a hostname to an IP address via tor SYNOPSIS -------- -**tor-resolve** [-4|-5] [-v] [-x] __hostname__ [__sockshost__[:__socksport__]] +**tor-resolve** [-4|-5] [-v] [-x] [-p __socksport__] __hostname__ [__sockshost__[:__socksport__]] DESCRIPTION ----------- @@ -40,6 +40,9 @@ OPTIONS Use the SOCKS4a protocol rather than the default SOCKS5 protocol. Doesn't support reverse DNS. +**-p** __socksport__:: + Override the default SOCKS port without setting the hostname. + SEE ALSO -------- **tor**(1), **torify**(1). + diff --git a/src/tools/tor-resolve.c b/src/tools/tor-resolve.c index e6eadf1..04815a6 100644 --- a/src/tools/tor-resolve.c +++ b/src/tools/tor-resolve.c @@ -108,6 +108,18 @@ build_socks_resolve_request(char **out, return len; } +static void +onion_warning(const char *hostname) +{ + log_warn(LD_NET, + "%s is a hidden service; those don't have IP addresses. " + "You can use the AutomapHostsOnResolve option to have Tor return a " + "fake address for hidden services. Or you can have your " + "application send the address to Tor directly; we recommend an " + "application that uses SOCKS 5 with hostnames.", + hostname); +} + /** Given a len-byte SOCKS4a response in response, set * *addr_out to the address it contains (in host order). * Return 0 on success, -1 on error. @@ -137,10 +149,7 @@ parse_socks4a_resolve_response(const char *hostname, if (status != 90) { log_warn(LD_NET,"Got status response '%d': socks request failed.", status); if (!strcasecmpend(hostname, ".onion")) { - log_warn(LD_NET, - "%s is a hidden service; those don't have IP addresses. " - "To connect to a hidden service, you need to send the hostname " - "to Tor; we suggest an application that uses SOCKS 4a.",hostname); + onion_warning(hostname); return -1; } return -1; @@ -276,11 +285,7 @@ do_resolve(const char *hostname, uint32_t sockshost, uint16_t socksport, (unsigned)reply_buf[1], socks5_reason_to_string(reply_buf[1])); if (reply_buf[1] == 4 && !strcasecmpend(hostname, ".onion")) { - log_warn(LD_NET, - "%s is a hidden service; those don't have IP addresses. " - "To connect to a hidden service, you need to send the hostname " - "to Tor; we suggest an application that uses SOCKS 4a.", - hostname); + onion_warning(hostname); } goto err; } @@ -326,8 +331,8 @@ do_resolve(const char *hostname, uint32_t sockshost, uint16_t socksport, static void usage(void) { - puts("Syntax: tor-resolve [-4] [-v] [-x] [-F] [-p port] " - "hostname [sockshost:socksport]"); + puts("Syntax: tor-resolve [-4] [-5] [-v] [-x] [-F] [-p port] " + "hostname [sockshost[:socksport]]"); exit(1); }

1 0