November 2016 - tor-commits - lists.torproject.org

[tor/maint-0.2.9] Rename routerstatus_version_supports_ntor to *_supports_extend2_cells
by nickm＠torproject.org 01 Nov '16

01 Nov '16

commit 3158777d35d8e03fdd77d9c227c2d04538d5fff3 Author: teor <teor2345(a)gmail.com> Date: Thu Oct 27 15:53:49 2016 +1100 Rename routerstatus_version_supports_ntor to *_supports_extend2_cells This helps avoid the confusion that caused bug 20472. Bugfix on commit 10aa913 from #19163 in tor-0.2.9.3-alpha. --- src/or/networkstatus.c | 6 +++--- src/or/routerlist.c | 14 ++++++++------ src/or/routerlist.h | 4 ++-- 3 files changed, 13 insertions(+), 11 deletions(-) diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c index f30fe16..49baeb8 100644 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@ -2360,10 +2360,10 @@ client_would_use_router(const routerstatus_t *rs, time_t now, /* We'd drop it immediately for being too old. */ return 0; } - if (!routerstatus_version_supports_ntor(rs, 1)) { - /* We'd ignore it because it doesn't support ntor. + if (!routerstatus_version_supports_extend2_cells(rs, 1)) { + /* We'd ignore it because it doesn't support EXTEND2 cells. * If we don't know the version, download the descriptor so we can - * check if it supports ntor. */ + * check if it supports EXTEND2 cells and ntor. */ return 0; } return 1; diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 85eb999..56c0522 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -2344,9 +2344,10 @@ router_add_running_nodes_to_smartlist(smartlist_t *sl, int allow_invalid, continue; if (node_is_unreliable(node, need_uptime, need_capacity, need_guard)) continue; - /* Don't choose nodes if we are certain they can't do ntor */ - if (node->rs && !routerstatus_version_supports_ntor(node->rs, 1)) + /* Don't choose nodes if we are certain they can't do EXTEND2 cells */ + if (node->rs && !routerstatus_version_supports_extend2_cells(node->rs, 1)) continue; + /* Don't choose nodes if we are certain they can't do ntor. */ if ((node->ri || node->md) && !node_has_curve25519_onion_key(node)) continue; /* Choose a node with an OR address that matches the firewall rules */ @@ -5609,13 +5610,14 @@ routerinfo_has_curve25519_onion_key(const routerinfo_t *ri) return 1; } -/* Is rs running a tor version known to support ntor? +/* Is rs running a tor version known to support EXTEND2 cells? * If allow_unknown_versions is true, return true if we can't tell - * (from a versions line or a protocols line) whether it supports ntor. + * (from a versions line or a protocols line) whether it supports extend2 + * cells. * Otherwise, return false if the version is unknown. */ int -routerstatus_version_supports_ntor(const routerstatus_t *rs, - int allow_unknown_versions) +routerstatus_version_supports_extend2_cells(const routerstatus_t *rs, + int allow_unknown_versions) { if (!rs) { return allow_unknown_versions; diff --git a/src/or/routerlist.h b/src/or/routerlist.h index 47e5445..606e908 100644 --- a/src/or/routerlist.h +++ b/src/or/routerlist.h @@ -207,8 +207,8 @@ int routerinfo_incompatible_with_extrainfo(const crypto_pk_t *ri, signed_descriptor_t *sd, const char **msg); int routerinfo_has_curve25519_onion_key(const routerinfo_t *ri); -int routerstatus_version_supports_ntor(const routerstatus_t *rs, - int allow_unknown_versions); +int routerstatus_version_supports_extend2_cells(const routerstatus_t *rs, + int allow_unknown_versions); void routerlist_assert_ok(const routerlist_t *rl); const char *esc_router_info(const routerinfo_t *router);

1 0

[tor/maint-0.2.9] Refactor circuit_pick_create_handshake
by nickm＠torproject.org 01 Nov '16

01 Nov '16

commit d81f2b5d81814b296e04e1964acf7eed79327970 Author: teor <teor2345(a)gmail.com> Date: Mon Oct 31 17:01:33 2016 +1100 Refactor circuit_pick_create_handshake Make the structure of circuit_pick_create_handshake consistent with circuit_pick_extend_handshake. No behaviour change. --- src/or/circuitbuild.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 9893215..cb9c146 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -829,11 +829,11 @@ circuit_pick_create_handshake(uint8_t *cell_type_out, if (extend_info_supports_ntor(ei)) { *cell_type_out = CELL_CREATE2; *handshake_type_out = ONION_HANDSHAKE_TYPE_NTOR; - return; + } else { + /* XXXX030 Remove support for deciding to use TAP and EXTEND. */ + *cell_type_out = CELL_CREATE; + *handshake_type_out = ONION_HANDSHAKE_TYPE_TAP; } - - *cell_type_out = CELL_CREATE; - *handshake_type_out = ONION_HANDSHAKE_TYPE_TAP; } /** Decide whether to use a TAP or ntor handshake for extending to ei

1 0

[tor/maint-0.2.9] In circuit_pick_extend_handshake, assume all hops support EXTEND2 and ntor
by nickm＠torproject.org 01 Nov '16

01 Nov '16

commit 26d7a07ad773713403a0db1c49ccb58e071763b2 Author: teor <teor2345(a)gmail.com> Date: Thu Oct 27 15:52:46 2016 +1100 In circuit_pick_extend_handshake, assume all hops support EXTEND2 and ntor This simplifies the function: if we have an ntor key, use ntor/EXTEND2, otherwise, use TAP/EXTEND. Bugfix on commit 10aa913 from 19163 in 0.2.9.3-alpha. --- changes/bug20472 | 4 ++++ src/or/circuitbuild.c | 57 +++++++++++++++++---------------------------------- 2 files changed, 23 insertions(+), 38 deletions(-) diff --git a/changes/bug20472 b/changes/bug20472 new file mode 100644 index 0000000..b035037 --- /dev/null +++ b/changes/bug20472 @@ -0,0 +1,4 @@ + o Minor bugfixes (circuits): + - Remove a BUG warning in circuit_pick_extend_handshake. Instead, assume + all nodes support EXTEND2. Use ntor whenever a key is available. + Bugfix on commit 10aa913 from 19163 in 0.2.9.3-alpha. Fixes bug 20472. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index cc9b184..9893215 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -814,7 +814,8 @@ circuit_timeout_want_to_count_circ(origin_circuit_t *circ) /** Decide whether to use a TAP or ntor handshake for connecting to ei * directly, and set *cell_type_out and *handshake_type_out * accordingly. - * Note that TAP handshakes are only used for direct connections: + * Note that TAP handshakes in CREATE cells are only used for direct + * connections: * - from Tor2web to intro points not in the client's consensus, and * - from Single Onions to rend points not in the service's consensus. * This is checked in onion_populate_cpath. */ @@ -823,7 +824,8 @@ circuit_pick_create_handshake(uint8_t *cell_type_out, uint16_t *handshake_type_out, const extend_info_t *ei) { - /* XXXX030 Remove support for deciding to use TAP. */ + /* torspec says: In general, clients SHOULD use CREATE whenever they are + * using the TAP handshake, and CREATE2 otherwise. */ if (extend_info_supports_ntor(ei)) { *cell_type_out = CELL_CREATE2; *handshake_type_out = ONION_HANDSHAKE_TYPE_NTOR; @@ -834,47 +836,31 @@ circuit_pick_create_handshake(uint8_t *cell_type_out, *handshake_type_out = ONION_HANDSHAKE_TYPE_TAP; } -/** Decide whether to use a TAP or ntor handshake for connecting to ei - * directly, and set *handshake_type_out accordingly. Decide whether, - * in extending through node to do so, we should use an EXTEND2 or an - * EXTEND cell to do so, and set *cell_type_out and - * *create_cell_type_out accordingly. - * Note that TAP handshakes are only used for extend handshakes: +/** Decide whether to use a TAP or ntor handshake for extending to ei + * and set *handshake_type_out accordingly. Decide whether we should + * use an EXTEND2 or an EXTEND cell to do so, and set *cell_type_out + * and *create_cell_type_out accordingly. + * Note that TAP handshakes in EXTEND cells are only used: * - from clients to intro points, and * - from hidden services to rend points. - * This is checked in onion_populate_cpath. */ + * This is checked in onion_populate_cpath. + */ static void circuit_pick_extend_handshake(uint8_t *cell_type_out, uint8_t *create_cell_type_out, uint16_t *handshake_type_out, - const node_t *node_prev, const extend_info_t *ei) { uint8_t t; circuit_pick_create_handshake(&t, handshake_type_out, ei); - /* XXXX030 Remove support for deciding to use TAP. */ - - /* It is an error to extend if there is no previous node. */ - if (BUG(node_prev == NULL)) { - *cell_type_out = RELAY_COMMAND_EXTEND; - *create_cell_type_out = CELL_CREATE; - return; - } - - /* It is an error for a node with a known version to be so old it does not - * support ntor. */ - tor_assert_nonfatal(routerstatus_version_supports_ntor(node_prev->rs, 1)); - - /* Assume relays without tor versions or routerstatuses support ntor. - * The authorities enforce ntor support, and assuming and failing is better - * than allowing a malicious node to perform a protocol downgrade to TAP. */ - if (*handshake_type_out != ONION_HANDSHAKE_TYPE_TAP && - (node_has_curve25519_onion_key(node_prev) || - (routerstatus_version_supports_ntor(node_prev->rs, 1)))) { + /* torspec says: Clients SHOULD use the EXTEND format whenever sending a TAP + * handshake... In other cases, clients SHOULD use EXTEND2. */ + if (*handshake_type_out != ONION_HANDSHAKE_TYPE_TAP) { *cell_type_out = RELAY_COMMAND_EXTEND2; *create_cell_type_out = CELL_CREATE2; } else { + /* XXXX030 Remove support for deciding to use TAP and EXTEND. */ *cell_type_out = RELAY_COMMAND_EXTEND; *create_cell_type_out = CELL_CREATE; } @@ -1030,15 +1016,10 @@ circuit_send_next_onion_skin(origin_circuit_t *circ) return - END_CIRC_REASON_INTERNAL; } - { - const node_t *prev_node; - prev_node = node_get_by_id(hop->prev->extend_info->identity_digest); - circuit_pick_extend_handshake(&ec.cell_type, - &ec.create_cell.cell_type, - &ec.create_cell.handshake_type, - prev_node, - hop->extend_info); - } + circuit_pick_extend_handshake(&ec.cell_type, + &ec.create_cell.cell_type, + &ec.create_cell.handshake_type, + hop->extend_info); tor_addr_copy(&ec.orport_ipv4.addr, &hop->extend_info->addr); ec.orport_ipv4.port = hop->extend_info->port;

1 0

[torspec/master] Merge remote-tracking branch 'dgoulet/ticket20278_01'
by nickm＠torproject.org 01 Nov '16

01 Nov '16

commit 048f26a007e54d811c6577143ab8cb6fd7bc92bb Merge: e788b8f bd8b94b Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Nov 1 13:00:29 2016 -0400 Merge remote-tracking branch 'dgoulet/ticket20278_01' cert-spec.txt | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)

1 0

[torspec/master] cert-spec: Clarify certificate types
by nickm＠torproject.org 01 Nov '16

01 Nov '16

commit bd8b94b1916c0b2b19cc4eaf9987e2854d781eef Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Oct 14 10:38:34 2016 -0400 cert-spec: Clarify certificate types Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- cert-spec.txt | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/cert-spec.txt b/cert-spec.txt index b242022..42b7efa 100644 --- a/cert-spec.txt +++ b/cert-spec.txt @@ -102,17 +102,20 @@ A.1. List of certificate types **[00],[01],[02],[03] - Reserved to avoid conflict with types used in CERTS cells. - [04] - signing a signing key with an identity key (Section 2.5) + [04] - Ed25519 signing key with an identity key + (see prop220 section 4.2) [05] - TLS link certificate signed with ed25519 signing key - (Section 4.2) + (see prop220 section 4.2) [06] - Ed25519 authentication key signed with ed25519 signing key - (Section 4.2) + (see prop220 section 4.2) - **[07] - reserved for RSA identity cross-certification (Section 4.2) + [07] - RSA identity cross-certification + (see prop220 section 4.2) [0A] - ntor onion key cross-certifying ntor identity key + (see prop228 section 2.3) A.2. List of extension types

1 0

[tor/master] Update man page that HS directory does not need to exist
by nickm＠torproject.org 01 Nov '16

01 Nov '16

commit d8d6d8c2066fbc2d23f2afc965a6e9f77efecb6e Author: Matt Traudt <sirmatt(a)ksu.edu> Date: Tue Nov 1 12:32:50 2016 -0400 Update man page that HS directory does not need to exist --- changes/ticket20486 | 3 +++ doc/tor.1.txt | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/changes/ticket20486 b/changes/ticket20486 new file mode 100644 index 0000000..9c1bb1e --- /dev/null +++ b/changes/ticket20486 @@ -0,0 +1,3 @@ + o Documentation (Onion Services): + - tor's man page incorrectly states that HiddenServiceDir must already + exist. This is not true. Fixes 20486. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 221c798..1d7958d 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2334,9 +2334,9 @@ The following options are used to configure a hidden service. [[HiddenServiceDir]] **HiddenServiceDir** __DIRECTORY__:: Store data files for a hidden service in DIRECTORY. Every hidden service must have a separate directory. You may use this option multiple times to - specify multiple services. DIRECTORY must be an existing directory. + specify multiple services. If DIRECTORY does not exist, Tor will create it. (Note: in current versions of Tor, if DIRECTORY is a relative path, - it will be relative to current + it will be relative to the current working directory of Tor instance, not to its DataDirectory. Do not rely on this behavior; it is not guaranteed to remain the same in future versions.)

1 0

[tor/master] Merge remote-tracking branch 'pastly/ticket20486'
by nickm＠torproject.org 01 Nov '16

01 Nov '16

commit db67867a81c18901b161d23696bbecf965107089 Merge: e6d84ac d8d6d8c Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Nov 1 12:55:14 2016 -0400 Merge remote-tracking branch 'pastly/ticket20486' changes/ticket20486 | 3 +++ doc/tor.1.txt | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-)

1 0

[tor/maint-0.2.9] Merge branch 'bug20487_029' into maint-0.2.9
by nickm＠torproject.org 01 Nov '16

01 Nov '16

commit 9248466f0a020e661cad185fc8eec28a18aca36c Merge: e712b5d b858452 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Nov 1 12:44:20 2016 -0400 Merge branch 'bug20487_029' into maint-0.2.9 changes/bug20487 | 4 ++++ doc/tor.1.txt | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-)

1 0

[tor/master] Merge branch 'bug20487_029' into maint-0.2.9
by nickm＠torproject.org 01 Nov '16

01 Nov '16

commit 9248466f0a020e661cad185fc8eec28a18aca36c Merge: e712b5d b858452 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Nov 1 12:44:20 2016 -0400 Merge branch 'bug20487_029' into maint-0.2.9 changes/bug20487 | 4 ++++ doc/tor.1.txt | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-)

1 0

[tor/release-0.2.9] Add a sentence to the manpage about nonanonymous=>Socksport 0.
by nickm＠torproject.org 01 Nov '16

01 Nov '16

commit b858452f944e33b175e1ef16bf94b35dcf64bf31 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 31 15:13:27 2016 -0400 Add a sentence to the manpage about nonanonymous=>Socksport 0. Closes 20487. --- changes/bug20487 | 4 ++++ doc/tor.1.txt | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/changes/bug20487 b/changes/bug20487 new file mode 100644 index 0000000..4435f14 --- /dev/null +++ b/changes/bug20487 @@ -0,0 +1,4 @@ + o Documentation: + - Clarify that setting HiddenServiceNonAnonymousMode requires + you to also set "SOCKSPort 0". Fixes bug 20487; bugfix on + 0.2.9.3-alpha. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 9d8b631..b502e44 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2434,7 +2434,9 @@ The following options are used to configure a hidden service. [[HiddenServiceNonAnonymousMode]] **HiddenServiceNonAnonymousMode** **0**|**1**:: Makes hidden services non-anonymous on this tor instance. Allows the non-anonymous HiddenServiceSingleHopMode. Enables direct connections in the - server-side hidden service protocol. + server-side hidden service protocol. If you are using this option, + you need to disable all client-side services on your Tor instance, + including setting SOCKSPort to "0". (Default: 0) TESTING NETWORK OPTIONS

1 0