June 2015 - tor-commits - lists.torproject.org

[tor/master] Add instructions for clang sanitizers, static analyzer, and coverity
by nickm＠torproject.org 08 Jun '15

08 Jun '15

commit bc0a9843e5cd8ed407e79d7f7e7b5404210924c4 Author: teor <teor2345(a)gmail.com> Date: Sat Jun 6 04:04:23 2015 +1000 Add instructions for clang sanitizers, static analyzer, and coverity Document use of coverity, clang static analyzer, and clang dynamic undefined behavior and address sanitizers in doc/HACKING. Add clang dynamic sanitizer blacklist in contrib/clang/sanitizer_blacklist.txt to exempt known undefined behavior. Include detailed usage instructions in this blacklist file. Patch by "teor". --- changes/feature15817-clang-sanitizers | 7 +++ contrib/clang/sanitize_blacklist.txt | 89 +++++++++++++++++++++++++++++++++ doc/HACKING | 26 ++++++++++ 3 files changed, 122 insertions(+) diff --git a/changes/feature15817-clang-sanitizers b/changes/feature15817-clang-sanitizers new file mode 100644 index 0000000..8bdf061 --- /dev/null +++ b/changes/feature15817-clang-sanitizers @@ -0,0 +1,7 @@ + o Minor enhancements (correctness, testing): + - Document use of coverity, clang static analyzer, and clang dynamic + undefined behavior and address sanitizers in doc/HACKING. + Add clang dynamic sanitizer blacklist in + contrib/clang/sanitizer_blacklist.txt to exempt known undefined + behavior. Include detailed usage instructions in the blacklist. + Patch by "teor". diff --git a/contrib/clang/sanitize_blacklist.txt b/contrib/clang/sanitize_blacklist.txt new file mode 100644 index 0000000..d4f6cf6 --- /dev/null +++ b/contrib/clang/sanitize_blacklist.txt @@ -0,0 +1,89 @@ +# clang sanitizer special case list +# syntax specified in http://clang.llvm.org/docs/SanitizerSpecialCaseList.html +# for more info see http://clang.llvm.org/docs/AddressSanitizer.html + +# usage: +# 1. configure tor build: +# ./configure \ +# CC=clang \ +# CFLAGS="-fsanitize-blacklist=contrib/clang/sanitize_blacklist.txt -fsanitize=undefined -fsanitize=address -fno-sanitize-recover=all -fno-omit-frame-pointer -fno-optimize-sibling-calls -fno-inline" \ +# LDFLAGS="-fsanitize=address" \ +# --disable-gcc-hardening +# and any other flags required to build tor on your OS. +# +# 2. build tor: +# make +# +# 3. test tor: +# ASAN_OPTIONS=allow_user_segv_handler=1 make test +# ASAN_OPTIONS=allow_user_segv_handler=1 make check +# make test-network # requires chutney +# +# 4. the tor binary is now instrumented with clang sanitizers, +# and can be run just like a standard tor binary + +# Compatibility: +# This blacklist has been tested with clang 3.7's UndefinedBehaviorSanitizer +# and AddressSanitizer on OS X 10.10 Yosemite, with all tests passing +# on both x86_64 and i386 (using CC="clang -arch i386") +# It has not been tested with ThreadSanitizer or MemorySanitizer +# Success report and patches for other sanitizers or OSs are welcome + +# Configuration Flags: +# -fno-sanitize-recover=all +# causes clang to crash on undefined behavior, rather than printing +# a warning and continuing (the AddressSanitizer always crashes) +# -fno-omit-frame-pointer -fno-optimize-sibling-calls -fno-inline +# make clang backtraces easier to read +# --disable-gcc-hardening +# disables warnings about the redefinition of _FORTIFY_SOURCE +# (it conflicts with the sanitizers) + +# Turning the sanitizers off for particular functions: +# (Unfortunately, exempting functions doesn't work for the blacklisted +# functions below, and we can't turn the code off because it's essential) +# +# #if defined(__has_feature) +# #if __has_feature(address_sanitizer) +# /* tell clang AddressSanitizer not to instrument this function */ +# #define NOASAN __attribute__((no_sanitize_address)) +# #define _CLANG_ASAN_ +# #else +# #define NOASAN +# #endif +# #else +# #define NOASAN +# #endif +# +# /* Telling AddressSanitizer to not instrument a function */ +# void func(void) NOASAN; +# +# /* Including or excluding sections of code */ +# #ifdef _CLANG_ASAN_ +# /* code that only runs under address sanitizer */ +# #else +# /* code that doesn't run under address sanitizer */ +# #endif + +# Blacklist Entries: + +# we need to allow the tor bt handler to catch SIGSEGV +# otherwise address sanitizer munges the expected output and the test fails +# we can do this by setting an environmental variable +# See https://code.google.com/p/address-sanitizer/wiki/Flags +# ASAN_OPTIONS=allow_user_segv_handler=1 + +# test-memwipe.c checks if a freed buffer was properly wiped +fun:vmemeq +fun:check_a_buffer + +# test_bt_cl.c stores to a NULL pointer to trigger a crash +fun:crash + +# curve25519-donna.c left-shifts 1 bits into and past the sign bit of signed +# integers. Until #13538 is resolved, we can exempt the entire file from all +# analysis under clang's undefined behavior sanitizer. +# This may be overkill, but it works, and is easier than listing every +# function in the file. +# Note that x86_64 uses curve25519-donna-c64.c instead of curve25519-donna.c +src:src/ext/curve25519_donna/curve25519-donna.c diff --git a/doc/HACKING b/doc/HACKING index 0d78f79..511e3fb 100644 --- a/doc/HACKING +++ b/doc/HACKING @@ -115,6 +115,32 @@ valgrind --leak-check=yes --error-limit=no --show-reachable=yes src/or/tor pass --undef-value-errors=no to valgrind, or rebuild your openssl with -DPURIFY.) +Coverity +~~~~~~~~ + +Nick regularly runs the coverity static analyzer on the Tor codebase. + +The preprocessor define __COVERITY__ is used to work around instances +where coverity picks up behavior that we wish to permit. + +clang Static Analyzer +~~~~~~~~~~~~~~~~~~~~~ + +The clang static analyzer can be run on the Tor codebase using Xcode (WIP) +or a command-line build. + +The preprocessor define __clang_analyzer__ is used to work around instances +where clang picks up behavior that we wish to permit. + +clang Runtime Sanitizers +~~~~~~~~~~~~~~~~ + +To build the Tor codebase with the clang Address and Undefined Behavior +sanitizers, see the file contrib/clang/sanitize_blacklist.txt. + +Preprocessor workarounds for instances where clang picks up behavior that +we wish to permit are also documented in the blacklist file. + Running lcov for unit test coverage ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

[tor/release-0.2.6] Start changelog for 0.2.6.9 (lintchanges, sortchanges, formatchangelog).
by nickm＠torproject.org 08 Jun '15

08 Jun '15

commit 41db4bffd69f7de99c2381d56de8c3b6e348fd79 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 8 10:50:54 2015 -0400 Start changelog for 0.2.6.9 (lintchanges, sortchanges, formatchangelog). --- ChangeLog | 36 ++++++++++++++++++++++++++++++++++++ changes/bug16030 | 3 --- changes/bug16164 | 4 ---- changes/bug16212 | 5 ----- changes/bug16244 | 7 ------- changes/bug16247 | 5 ----- changes/ticket8243 | 7 ------- 7 files changed, 36 insertions(+), 31 deletions(-) diff --git a/ChangeLog b/ChangeLog index 8135c78..0670977 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,39 @@ +Changes in version 0.2.6.9 - 2015-06-?? + Blurb goes here. + + o Major bugfixes (client-side privacy): + - Properly separate out each SOCKSPort when applying stream + isolation. The error occured because each port's session group was + being overwritten by a default value. Fixes bug 16247; bugfix on + 0.2.6.3-alpha. Patch by "jojelino". + + o Minor feature (directory aurhorities, security): + - The HSDir flag given by authorities now requires the Stable flag. + For the current network, this results in going from 2887 to 2806 + HSDirs. Also, it makes it harder for an attacker to launch a sybil + attack by raising the effort for a relay to become Stable which + takes at the very least 7 days to do so and by keeping the 96 + hours uptime requirement for HSDir. Implements ticket 8243. + + o Minor bugfixes (compilation): + - Build with --enable-systemd correctly when libsystemd is + installed, but systemd is not. Fixes bug 16164; bugfix on + 0.2.6.3-alpha. Patch from Peter Palfrader. + + o Minor bugfixes (Linux seccomp2 sandbox): + - Fix sandboxing to work when running as a relay again. This + includes correctly allowing renaming secret_id_key and allowing + the eventfd2 and futex syscalls. Fixes bug 16244; bugfix on + 0.2.6.1-alpha. Patch by Peter Palfrader. + - Allow systemd connections to work with the Linux seccomp2 sandbox + code. Fixes bug 16212; bugfix on 0.2.6.2-alpha. Patch by + Peter Palfrader. + + o Minor bugfixes (tests): + - Fix a crash in the unit tests on MSVC2013. Fixes bug 16030; bugfix + on 0.2.6.2-alpha. Patch from "NewEraCracker". + + Changes in version 0.2.6.8 - 2015-05-21 Tor 0.2.6.8 fixes a bit of dodgy code in parsing INTRODUCE2 cells, and fixes an authority-side bug in assigning the HSDir flag. All directory diff --git a/changes/bug16030 b/changes/bug16030 deleted file mode 100644 index c14fd62..0000000 --- a/changes/bug16030 +++ /dev/null @@ -1,3 +0,0 @@ - o Minor bugfixes (tests): - - Fix a crash in the unit tests on MSVC2013. Fixes bug 16030; bugfix on - 0.2.6.2-alpha. Patch from "NewEraCracker". \ No newline at end of file diff --git a/changes/bug16164 b/changes/bug16164 deleted file mode 100644 index fbb383c..0000000 --- a/changes/bug16164 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor bugfixes (compilation): - - Build with --enable-systemd correctly when libsystemd is installed, - but systemd is not. Fixes bug 16164, bugfix on 0.2.6.3-alpha. Patch - from Peter Palfrader. diff --git a/changes/bug16212 b/changes/bug16212 deleted file mode 100644 index bc12463..0000000 --- a/changes/bug16212 +++ /dev/null @@ -1,5 +0,0 @@ - o Minor bugfixes (sandbox, systemd): - - Allow systemd connections to work with the Linux seccomp2 sandbox - code. Fixes bug 16212; bugfix on 0.2.6.2-alpha. - Patch by Peter Palfrader. - diff --git a/changes/bug16244 b/changes/bug16244 deleted file mode 100644 index 00bc557..0000000 --- a/changes/bug16244 +++ /dev/null @@ -1,7 +0,0 @@ - o Minor bugfixes (sandbox, relay): - - Fix sandboxing to work when running as a relay again. This - includes correctly allowing renaming secret_id_key and - allowing the eventfd2 and futex syscalls. - Fixes bug 16244; bugfix on 0.2.6.1-alpha. - Patch by Peter Palfrader. - diff --git a/changes/bug16247 b/changes/bug16247 deleted file mode 100644 index 9464b1c..0000000 --- a/changes/bug16247 +++ /dev/null @@ -1,5 +0,0 @@ - o Minor bugfixes (client-side privacy): - - Properly separate out each SOCKSPort when applying stream isolation. - The error occured because each port's session group was being - overwritten by a default value. Fixes bug 16247; bugfix on - 0.2.6.3-alpha. Patch by "jojelino". diff --git a/changes/ticket8243 b/changes/ticket8243 deleted file mode 100644 index 8946a21..0000000 --- a/changes/ticket8243 +++ /dev/null @@ -1,7 +0,0 @@ - o Minor feature: - - The HSDir flag given by authorities now requires the Stable flag. For - the current network, this results in going from 2887 to 2806 HSDirs. - Also, it makes it harder for an attacker to launch a sybil attack by - raising the effort for a relay to become Stable which takes at the - very least 7 days to do so and by keeping the 96 hours uptime - requirement for HSDir. Implements ticket #8243.

1 0

[tor/release-0.2.6] Fix --enable-systemd builds on systems with libsystemd but not systemd
by nickm＠torproject.org 08 Jun '15

08 Jun '15

commit 08e8c21b1f0acac5e023d05d59f175f2f5716288 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 26 09:39:53 2015 -0400 Fix --enable-systemd builds on systems with libsystemd but not systemd Fixes bug 16164; bugfix on 0.2.6.3-alpha. Patch from Peter Palfrader. --- changes/bug16164 | 4 ++++ configure.ac | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/changes/bug16164 b/changes/bug16164 new file mode 100644 index 0000000..fbb383c --- /dev/null +++ b/changes/bug16164 @@ -0,0 +1,4 @@ + o Minor bugfixes (compilation): + - Build with --enable-systemd correctly when libsystemd is installed, + but systemd is not. Fixes bug 16164, bugfix on 0.2.6.3-alpha. Patch + from Peter Palfrader. diff --git a/configure.ac b/configure.ac index 81ef2c7..156bb3f 100644 --- a/configure.ac +++ b/configure.ac @@ -131,7 +131,7 @@ if test x$have_systemd = xyes; then AC_DEFINE(HAVE_SYSTEMD,1,[Have systemd]) TOR_SYSTEMD_CFLAGS="${SYSTEMD_CFLAGS}" TOR_SYSTEMD_LIBS="${SYSTEMD_LIBS}" - PKG_CHECK_MODULES(SYSTEMD209, [systemd >= 209], + PKG_CHECK_MODULES(LIBSYSTEMD209, [libsystemd >= 209], [AC_DEFINE(HAVE_SYSTEMD_209,1,[Have systemd v209 or more])], []) fi AC_SUBST(TOR_SYSTEMD_CFLAGS)

1 0

[tor/release-0.2.6] Fix unit tests on MSVC2013.
by nickm＠torproject.org 08 Jun '15

08 Jun '15

commit 8ca3773f686c43328f3c05a35d4d0e61a30b980c Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 26 10:24:21 2015 -0400 Fix unit tests on MSVC2013. Patch from "NewEraCracker." Fixes bug16030; bugfix on 0.2.6.2-alpha. --- changes/bug16030 | 3 +++ src/test/test_channel.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/changes/bug16030 b/changes/bug16030 new file mode 100644 index 0000000..c14fd62 --- /dev/null +++ b/changes/bug16030 @@ -0,0 +1,3 @@ + o Minor bugfixes (tests): + - Fix a crash in the unit tests on MSVC2013. Fixes bug 16030; bugfix on + 0.2.6.2-alpha. Patch from "NewEraCracker". \ No newline at end of file diff --git a/src/test/test_channel.c b/src/test/test_channel.c index 6cf6649..e11ac3f 100644 --- a/src/test/test_channel.c +++ b/src/test/test_channel.c @@ -420,6 +420,7 @@ new_fake_channel(void) chan->close = chan_test_close; chan->get_overhead_estimate = chan_test_get_overhead_estimate; + chan->get_remote_descr = chan_test_get_remote_descr; chan->num_bytes_queued = chan_test_num_bytes_queued; chan->num_cells_writeable = chan_test_num_cells_writeable; chan->write_cell = chan_test_write_cell; @@ -615,7 +616,6 @@ test_channel_dumpstats(void *arg) /* Test channel_dump_statistics */ ch->describe_transport = chan_test_describe_transport; ch->dumpstats = chan_test_dumpstats; - ch->get_remote_descr = chan_test_get_remote_descr; ch->is_canonical = chan_test_is_canonical; old_count = test_dumpstats_calls; channel_dump_statistics(ch, LOG_DEBUG);

1 0

[tor/release-0.2.6] Fix sandbox use with systemd. bug 16212.
by nickm＠torproject.org 08 Jun '15

08 Jun '15

commit 97330ced0c2e0eeae9bb2bc576bb72190237819d Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 28 14:05:46 2015 -0400 Fix sandbox use with systemd. bug 16212. --- changes/bug16212 | 5 +++++ src/common/sandbox.c | 10 ++++++++++ 2 files changed, 15 insertions(+) diff --git a/changes/bug16212 b/changes/bug16212 new file mode 100644 index 0000000..bc12463 --- /dev/null +++ b/changes/bug16212 @@ -0,0 +1,5 @@ + o Minor bugfixes (sandbox, systemd): + - Allow systemd connections to work with the Linux seccomp2 sandbox + code. Fixes bug 16212; bugfix on 0.2.6.2-alpha. + Patch by Peter Palfrader. + diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 49316c6..a32bd0d 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -170,6 +170,7 @@ static int filter_nopar_gen[] = { SCMP_SYS(read), SCMP_SYS(rt_sigreturn), SCMP_SYS(sched_getaffinity), + SCMP_SYS(sendmsg), SCMP_SYS(set_robust_list), #ifdef __NR_sigreturn SCMP_SYS(sigreturn), @@ -547,6 +548,15 @@ sb_socket(scmp_filter_ctx ctx, sandbox_cfg_t *filter) SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX), SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_STREAM), SCMP_CMP(2, SCMP_CMP_EQ, 0)); + if (rc) + return rc; + + rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), + SCMP_CMP(0, SCMP_CMP_EQ, PF_UNIX), + SCMP_CMP_MASKED(1, SOCK_CLOEXEC|SOCK_NONBLOCK, SOCK_DGRAM), + SCMP_CMP(2, SCMP_CMP_EQ, 0)); + if (rc) + return rc; rc = seccomp_rule_add_3(ctx, SCMP_ACT_ALLOW, SCMP_SYS(socket), SCMP_CMP(0, SCMP_CMP_EQ, PF_NETLINK),

1 0

[tor/release-0.2.6] Fix sandboxing to work when running as a relay
by nickm＠torproject.org 08 Jun '15

08 Jun '15

commit a68e5323f809056cae9fcefc06357f9646595d89 Author: Peter Palfrader <peter(a)palfrader.org> Date: Tue Jun 2 20:06:49 2015 +0200 Fix sandboxing to work when running as a relay This includes correctly allowing renaming secret_id_key and allowing the eventfd2 and futex syscalls. Fixes bug 16244; bugfix on 0.2.6.1-alpha. --- changes/bug16244 | 7 +++++++ src/common/sandbox.c | 2 ++ src/or/main.c | 2 +- 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/changes/bug16244 b/changes/bug16244 new file mode 100644 index 0000000..00bc557 --- /dev/null +++ b/changes/bug16244 @@ -0,0 +1,7 @@ + o Minor bugfixes (sandbox, relay): + - Fix sandboxing to work when running as a relay again. This + includes correctly allowing renaming secret_id_key and + allowing the eventfd2 and futex syscalls. + Fixes bug 16244; bugfix on 0.2.6.1-alpha. + Patch by Peter Palfrader. + diff --git a/src/common/sandbox.c b/src/common/sandbox.c index a32bd0d..cdb4521 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -129,11 +129,13 @@ static int filter_nopar_gen[] = { SCMP_SYS(clone), SCMP_SYS(epoll_create), SCMP_SYS(epoll_wait), + SCMP_SYS(eventfd2), SCMP_SYS(fcntl), SCMP_SYS(fstat), #ifdef __NR_fstat64 SCMP_SYS(fstat64), #endif + SCMP_SYS(futex), SCMP_SYS(getdents64), SCMP_SYS(getegid), #ifdef __NR_getegid32 diff --git a/src/or/main.c b/src/or/main.c index d0fe8cb..8aa9a15 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2984,7 +2984,7 @@ sandbox_init_filter(void) // orport if (server_mode(get_options())) { - OPEN_DATADIR2_SUFFIX("keys", "secret_id_key", "tmp"); + OPEN_DATADIR2_SUFFIX("keys", "secret_id_key", ".tmp"); OPEN_DATADIR2_SUFFIX("keys", "secret_onion_key", ".tmp"); OPEN_DATADIR2_SUFFIX("keys", "secret_onion_key_ntor", ".tmp"); OPEN_DATADIR2("keys", "secret_id_key.old");

1 0

[tor/release-0.2.6] Set session_group after the port's data structure has been populated.
by nickm＠torproject.org 08 Jun '15

08 Jun '15

commit f2ff8145820243a05803367d31c8b34e03048706 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Thu Jun 4 13:53:35 2015 +0000 Set session_group after the port's data structure has been populated. Fixes #16247, patch by "jojelino". --- changes/bug16247 | 5 +++++ src/or/connection.c | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/changes/bug16247 b/changes/bug16247 new file mode 100644 index 0000000..9464b1c --- /dev/null +++ b/changes/bug16247 @@ -0,0 +1,5 @@ + o Minor bugfixes (client-side privacy): + - Properly separate out each SOCKSPort when applying stream isolation. + The error occured because each port's session group was being + overwritten by a default value. Fixes bug 16247; bugfix on + 0.2.6.3-alpha. Patch by "jojelino". diff --git a/src/or/connection.c b/src/or/connection.c index 7db0238..721ee20 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -1284,6 +1284,8 @@ connection_listener_new(const struct sockaddr *listensockaddr, conn->port = gotPort; tor_addr_copy(&conn->addr, &addr); + memcpy(&lis_conn->entry_cfg, &port_cfg->entry_cfg, sizeof(entry_port_cfg_t)); + if (port_cfg->entry_cfg.isolation_flags) { lis_conn->entry_cfg.isolation_flags = port_cfg->entry_cfg.isolation_flags; if (port_cfg->entry_cfg.session_group >= 0) { @@ -1299,8 +1301,6 @@ connection_listener_new(const struct sockaddr *listensockaddr, } } - memcpy(&lis_conn->entry_cfg, &port_cfg->entry_cfg, sizeof(entry_port_cfg_t)); - if (type != CONN_TYPE_AP_LISTENER) { lis_conn->entry_cfg.ipv4_traffic = 1; lis_conn->entry_cfg.ipv6_traffic = 1;

1 0

[tor/release-0.2.6] HSDir flag now requires the Stable flag
by nickm＠torproject.org 08 Jun '15

08 Jun '15

commit 6785f0b65a106561a36239d89140bf18be3d7c6c Author: David Goulet <dgoulet(a)ev0ke.net> Date: Mon May 11 11:27:30 2015 -0400 HSDir flag now requires the Stable flag Fixes #8243 --- changes/ticket8243 | 7 +++++++ src/or/dirserv.c | 6 ++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/changes/ticket8243 b/changes/ticket8243 new file mode 100644 index 0000000..8946a21 --- /dev/null +++ b/changes/ticket8243 @@ -0,0 +1,7 @@ + o Minor feature: + - The HSDir flag given by authorities now requires the Stable flag. For + the current network, this results in going from 2887 to 2806 HSDirs. + Also, it makes it harder for an attacker to launch a sybil attack by + raising the effort for a relay to become Stable which takes at the + very least 7 days to do so and by keeping the 96 hours uptime + requirement for HSDir. Implements ticket #8243. diff --git a/src/or/dirserv.c b/src/or/dirserv.c index a024be8..65bfafb 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -1278,8 +1278,9 @@ dirserv_thinks_router_is_unreliable(time_t now, } /** Return true iff <b>router</b> should be assigned the "HSDir" flag. - * Right now this means it advertises support for it, it has a high - * uptime, it has a DirPort open, and it's currently considered Running. + * Right now this means it advertises support for it, it has a high uptime, + * it has a DirPort open, it has the Stable flag and it's currently + * considered Running. * * This function needs to be called after router-\>is_running has * been set. @@ -1306,6 +1307,7 @@ dirserv_thinks_router_is_hs_dir(const routerinfo_t *router, uptime = real_uptime(router, now); return (router->wants_to_be_hs_dir && router->dir_port && + node->is_stable && uptime >= get_options()->MinUptimeHidServDirectoryV2 && router_is_active(router, node, now)); }

1 0

[tor/release-0.2.6] Merge branch 'maint-0.2.6' into release-0.2.6
by nickm＠torproject.org 08 Jun '15

08 Jun '15

commit 602e328dc33fec8eec976e497e04db810382b8b9 Merge: 2fe3afc 6785f0b Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 8 10:42:25 2015 -0400 Merge branch 'maint-0.2.6' into release-0.2.6 changes/bug16030 | 3 +++ changes/bug16164 | 4 ++++ changes/bug16212 | 5 +++++ changes/bug16244 | 7 +++++++ changes/bug16247 | 5 +++++ changes/ticket8243 | 7 +++++++ configure.ac | 2 +- src/common/sandbox.c | 12 ++++++++++++ src/or/connection.c | 4 ++-- src/or/dirserv.c | 6 ++++-- src/or/main.c | 2 +- src/test/test_channel.c | 2 +- 12 files changed, 52 insertions(+), 7 deletions(-)

1 0

[tor/master] HSDir flag now requires the Stable flag
by nickm＠torproject.org 08 Jun '15

08 Jun '15

commit 6785f0b65a106561a36239d89140bf18be3d7c6c Author: David Goulet <dgoulet(a)ev0ke.net> Date: Mon May 11 11:27:30 2015 -0400 HSDir flag now requires the Stable flag Fixes #8243 --- changes/ticket8243 | 7 +++++++ src/or/dirserv.c | 6 ++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/changes/ticket8243 b/changes/ticket8243 new file mode 100644 index 0000000..8946a21 --- /dev/null +++ b/changes/ticket8243 @@ -0,0 +1,7 @@ + o Minor feature: + - The HSDir flag given by authorities now requires the Stable flag. For + the current network, this results in going from 2887 to 2806 HSDirs. + Also, it makes it harder for an attacker to launch a sybil attack by + raising the effort for a relay to become Stable which takes at the + very least 7 days to do so and by keeping the 96 hours uptime + requirement for HSDir. Implements ticket #8243. diff --git a/src/or/dirserv.c b/src/or/dirserv.c index a024be8..65bfafb 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -1278,8 +1278,9 @@ dirserv_thinks_router_is_unreliable(time_t now, } /** Return true iff <b>router</b> should be assigned the "HSDir" flag. - * Right now this means it advertises support for it, it has a high - * uptime, it has a DirPort open, and it's currently considered Running. + * Right now this means it advertises support for it, it has a high uptime, + * it has a DirPort open, it has the Stable flag and it's currently + * considered Running. * * This function needs to be called after router-\>is_running has * been set. @@ -1306,6 +1307,7 @@ dirserv_thinks_router_is_hs_dir(const routerinfo_t *router, uptime = real_uptime(router, now); return (router->wants_to_be_hs_dir && router->dir_port && + node->is_stable && uptime >= get_options()->MinUptimeHidServDirectoryV2 && router_is_active(router, node, now)); }

1 0