April 2015 - tor-commits - lists.torproject.org

[tor/maint-0.2.5] Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 03 Apr '15

03 Apr '15

commit 3781955f079f25f8d6aa47cb746e339497076050 Merge: 9063f29 01e4bc8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Apr 3 09:38:54 2015 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5 changes/bug15515 | 4 ++++ src/or/or.h | 3 +++ src/or/rendmid.c | 14 ++++++++++++++ 3 files changed, 21 insertions(+)

1 0

[tor/maint-0.2.5] Merge branch 'bug15515_024' into maint-0.2.4
by nickm＠torproject.org 03 Apr '15

03 Apr '15

commit 01e4bc80cd75bbf2a4ce3b18ff17550eed993bb0 Merge: 5f46a59 bcb8393 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Apr 3 09:36:59 2015 -0400 Merge branch 'bug15515_024' into maint-0.2.4 changes/bug15515 | 4 ++++ src/or/or.h | 3 +++ src/or/rendmid.c | 14 ++++++++++++++ 3 files changed, 21 insertions(+)

1 0

[tor/maint-0.2.4] Block multiple introductions on the same intro circuit.
by nickm＠torproject.org 03 Apr '15

03 Apr '15

commit 8dba8a088d7c1402831ab5a7211a4a347a60ff7a Author: George Kadianakis <desnacked(a)riseup.net> Date: Wed Apr 1 14:33:09 2015 +0100 Block multiple introductions on the same intro circuit. --- changes/bug15515 | 4 ++++ src/or/or.h | 3 +++ src/or/rendmid.c | 13 +++++++++++++ 3 files changed, 20 insertions(+) diff --git a/changes/bug15515 b/changes/bug15515 new file mode 100644 index 0000000..dda7c2f --- /dev/null +++ b/changes/bug15515 @@ -0,0 +1,4 @@ + o Minor features (DoS-resistance): + - Make it harder for attackers to overwhelm hidden services with + introductions, by blocking multiple introduction requests on the + same circuit. Resolves ticket #15515. diff --git a/src/or/or.h b/src/or/or.h index 34f055c..4459957 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3157,6 +3157,9 @@ typedef struct or_circuit_t { * to the specification? */ unsigned int remaining_relay_early_cells : 4; + /* We have already received an INTRODUCE1 cell on this circuit. */ + unsigned int already_received_introduce1 : 1; + /** True iff this circuit was made with a CREATE_FAST cell. */ unsigned int is_first_hop : 1; diff --git a/src/or/rendmid.c b/src/or/rendmid.c index 1bd11f6..2f75ffb 100644 --- a/src/or/rendmid.c +++ b/src/or/rendmid.c @@ -149,6 +149,19 @@ rend_mid_introduce(or_circuit_t *circ, const uint8_t *request, goto err; } + /* We have already done an introduction on this circuit but we just + received a request for another one. We block it since this might + be an attempt to DoS a hidden service (#15515). */ + if (circ->already_received_introduce1) { + log_fn(LOG_PROTOCOL_WARN, LD_REND, + "Blocking multiple introductions on the same circuit. " + "Someone might be trying to attack a hidden service through " + "this relay."); + goto err; + } + + circ->already_received_introduce1 = 1; + /* We could change this to MAX_HEX_NICKNAME_LEN now that 0.0.9.x is * obsolete; however, there isn't much reason to do so, and we're going * to revise this protocol anyway.

1 0

[tor/maint-0.2.4] ... and if we do get multiple INTRODUCE1s on a circuit, kill the circuit
by nickm＠torproject.org 03 Apr '15

03 Apr '15

commit bcb839387ef65c0a87ca0a6b7957c3062188c601 Author: George Kadianakis <desnacked(a)riseup.net> Date: Thu Apr 2 13:38:52 2015 +0100 ... and if we do get multiple INTRODUCE1s on a circuit, kill the circuit (Sending a nak would be pointless.) See ticket 15515 for discussion. --- src/or/rendmid.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/or/rendmid.c b/src/or/rendmid.c index 2f75ffb..0a005a6 100644 --- a/src/or/rendmid.c +++ b/src/or/rendmid.c @@ -157,7 +157,8 @@ rend_mid_introduce(or_circuit_t *circ, const uint8_t *request, "Blocking multiple introductions on the same circuit. " "Someone might be trying to attack a hidden service through " "this relay."); - goto err; + circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_TORPROTOCOL); + return -1; } circ->already_received_introduce1 = 1;

1 0

[tor/maint-0.2.4] Merge branch 'bug15515_024' into maint-0.2.4
by nickm＠torproject.org 03 Apr '15

03 Apr '15

commit 01e4bc80cd75bbf2a4ce3b18ff17550eed993bb0 Merge: 5f46a59 bcb8393 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Apr 3 09:36:59 2015 -0400 Merge branch 'bug15515_024' into maint-0.2.4 changes/bug15515 | 4 ++++ src/or/or.h | 3 +++ src/or/rendmid.c | 14 ++++++++++++++ 3 files changed, 21 insertions(+)

1 0

[ooni-probe/master] Read the home directory for OONI from the HOME environment variable
by art＠torproject.org 03 Apr '15

03 Apr '15

commit 1122b7a9fbb24824d082c862b08d85f7febcf62b Author: Arturo Filastò <art(a)fuffa.org> Date: Thu Apr 2 19:36:28 2015 +0200 Read the home directory for OONI from the HOME environment variable --- ooni/settings.py | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/ooni/settings.py b/ooni/settings.py index b0b032c..7fbc7af 100644 --- a/ooni/settings.py +++ b/ooni/settings.py @@ -79,10 +79,13 @@ class OConfig(object): @property def ooni_home(self): + home = expanduser('~'+self.current_user) + if os.getenv("HOME"): + home = os.getenv("HOME") if self._custom_home: return self._custom_home - return os.path.join(expanduser('~'+self.current_user), - '.ooni') + else: + return os.path.join(home, '.ooni') def get_data_file_path(self, file_name): for target_dir in self.data_directory_candidates: @@ -90,10 +93,7 @@ class OConfig(object): if os.path.isfile(file_path): return file_path - def set_paths(self, ooni_home=None): - if ooni_home: - self._custom_home = ooni_home - + def set_paths(self): self.nettest_directory = os.path.join(get_ooni_root(), 'nettests') self.inputs_directory = os.path.join(self.ooni_home, 'inputs') @@ -117,9 +117,9 @@ class OConfig(object): self.basic.logfile = expanduser(self.basic.logfile.replace( '~', '~'+self.current_user)) - def initialize_ooni_home(self, ooni_home=None): - if ooni_home: - self.set_paths(ooni_home) + def initialize_ooni_home(self, custom_home=None): + if custom_home: + self._custom_home = custom_home if not os.path.isdir(self.ooni_home): print "Ooni home directory does not exist." @@ -212,6 +212,6 @@ class OConfig(object): config = OConfig() if not os.path.isfile(config.config_file) \ - and os.path.isfile('/etc/ooni/ooniprobe.conf'): + and os.path.isfile('/etc/ooniprobe.conf'): config.global_options['configfile'] = '/etc/ooniprobe.conf' config.set_paths()

1 0

[ooni-probe/master] Expose inputs_dir and decks_dir from configuration file
by art＠torproject.org 03 Apr '15

03 Apr '15

commit 4b302ffaeb0704c728123a6a23b722a4cabbb74c Author: Arturo Filastò <art(a)fuffa.org> Date: Thu Apr 2 19:55:37 2015 +0200 Expose inputs_dir and decks_dir from configuration file --- data/ooniprobe.conf.sample | 2 ++ ooni/settings.py | 12 ++++++++++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/data/ooniprobe.conf.sample b/data/ooniprobe.conf.sample index 9f6d0f4..e68b449 100644 --- a/data/ooniprobe.conf.sample +++ b/data/ooniprobe.conf.sample @@ -49,6 +49,8 @@ advanced: reporting_concurrency: 15 oonid_api_port: 8042 report_log_file: null + inputs_dir: null + decks_dir: null tor: #socks_port: 8801 #control_port: 8802 diff --git a/ooni/settings.py b/ooni/settings.py index 7fbc7af..ebaa1ff 100644 --- a/ooni/settings.py +++ b/ooni/settings.py @@ -96,8 +96,16 @@ class OConfig(object): def set_paths(self): self.nettest_directory = os.path.join(get_ooni_root(), 'nettests') - self.inputs_directory = os.path.join(self.ooni_home, 'inputs') - self.decks_directory = os.path.join(self.ooni_home, 'decks') + if self.advanced.inputs_dir: + self.inputs_directory = self.advanced.inputs_dir + else: + self.inputs_directory = os.path.join(self.ooni_home, 'inputs') + + if self.advanced.decks_dir: + self.decks_directory = self.advanced.decks_dir + else: + self.decks_directory = os.path.join(self.ooni_home, 'decks') + self.reports_directory = os.path.join(self.ooni_home, 'reports') self.resources_directory = os.path.join(self.data_directory, "resources")

1 0

[ooni-probe/master] Call set paths after setting home
by art＠torproject.org 03 Apr '15

03 Apr '15

commit 081d6725cf08185c9e04700db673fd702050bf67 Author: Arturo Filastò <art(a)fuffa.org> Date: Thu Apr 2 19:59:12 2015 +0200 Call set paths after setting home --- ooni/settings.py | 1 + 1 file changed, 1 insertion(+) diff --git a/ooni/settings.py b/ooni/settings.py index ebaa1ff..6e0f9a5 100644 --- a/ooni/settings.py +++ b/ooni/settings.py @@ -128,6 +128,7 @@ class OConfig(object): def initialize_ooni_home(self, custom_home=None): if custom_home: self._custom_home = custom_home + self.set_paths() if not os.path.isdir(self.ooni_home): print "Ooni home directory does not exist."

1 0

[ooni-probe/master] Fix bug spotted by Lunar^ that leads to incomplete reports not appearing in the report log
by art＠torproject.org 03 Apr '15

03 Apr '15

commit 965d782db6232238662870aa5cb5bf1adfa0225c Author: Arturo Filastò <art(a)fuffa.org> Date: Thu Apr 2 20:10:31 2015 +0200 Fix bug spotted by Lunar^ that leads to incomplete reports not appearing in the report log --- ooni/reporter.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ooni/reporter.py b/ooni/reporter.py index bf4a645..36a0e88 100644 --- a/ooni/reporter.py +++ b/ooni/reporter.py @@ -407,6 +407,8 @@ class OONIBReportLog(object): os.kill(value['pid'], 0) except: reports.append((report_file, value)) + elif value['status'] in ('incomplete'): + reports.append((report_file, value)) return reports @property

1 0

[ooni-probe/master] OSX Homebrew formula to install
by art＠torproject.org 03 Apr '15

03 Apr '15

commit 1365444f753c4d8f6c3cc119e6d3f599302d0053 Author: Alexandre Espinosa Menor <aemenor(a)gmail.com> Date: Fri Apr 3 11:27:55 2015 +0200 OSX Homebrew formula to install --- README.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/README.rst b/README.rst index c2dec0a..c160695 100644 --- a/README.rst +++ b/README.rst @@ -129,6 +129,11 @@ without installing it is supported with the following commands:: ./setup-dependencies.sh python setup.py install +OSX +--- + + brew install ooniprobe + Other platforms (with Vagrant) ------------------------------

1 0