December 2016 - tor-commits - lists.torproject.org

[tor/master] whitespace fixes
by nickm＠torproject.org 14 Dec '16

14 Dec '16

commit 81360c4a5fde6d66a81c506af657df77d2e63cff Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 15:41:08 2016 -0500 whitespace fixes --- src/or/hs_circuitmap.h | 1 + src/or/hs_common.h | 1 + src/or/hs_intropoint.c | 2 +- src/or/hs_intropoint.h | 6 ++++-- src/or/hs_service.c | 4 +++- src/or/hs_service.h | 1 + src/or/rendservice.c | 1 + src/test/test_hs_service.c | 1 - 8 files changed, 12 insertions(+), 5 deletions(-) diff --git a/src/or/hs_circuitmap.h b/src/or/hs_circuitmap.h index a2be97c..79767dd 100644 --- a/src/or/hs_circuitmap.h +++ b/src/or/hs_circuitmap.h @@ -67,3 +67,4 @@ hs_circuitmap_ht *get_hs_circuitmap(void); #endif /* TOR_UNIT_TESTS */ #endif /* TOR_HS_CIRCUITMAP_H */ + diff --git a/src/or/hs_common.h b/src/or/hs_common.h index 55710b7..8158d27 100644 --- a/src/or/hs_common.h +++ b/src/or/hs_common.h @@ -42,3 +42,4 @@ const uint8_t *rend_data_get_pk_digest(const rend_data_t *rend_data, int hs_v3_protocol_is_enabled(void); #endif /* TOR_HS_COMMON_H */ + diff --git a/src/or/hs_intropoint.c b/src/or/hs_intropoint.c index 67355bc..bfc7ec3 100644 --- a/src/or/hs_intropoint.c +++ b/src/or/hs_intropoint.c @@ -232,7 +232,6 @@ handle_establish_intro(or_circuit_t *circ, const uint8_t *request, return retval; } - /* Return True if circuit is suitable for becoming an intro circuit. */ int hs_intro_circuit_is_suitable(const or_circuit_t *circ) @@ -286,3 +285,4 @@ hs_intro_received_establish_intro(or_circuit_t *circ, const uint8_t *request, circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_TORPROTOCOL); return -1; } + diff --git a/src/or/hs_intropoint.h b/src/or/hs_intropoint.h index b7846a4..46d8d6f 100644 --- a/src/or/hs_intropoint.h +++ b/src/or/hs_intropoint.h @@ -16,8 +16,9 @@ enum hs_intro_auth_key_type { HS_INTRO_AUTH_KEY_TYPE_ED25519 = 0x02, }; -int hs_intro_received_establish_intro(or_circuit_t *circ, const uint8_t *request, - size_t request_len); +int hs_intro_received_establish_intro(or_circuit_t *circ, + const uint8_t *request, + size_t request_len); MOCK_DECL(int, hs_intro_send_intro_established_cell,(or_circuit_t *circ)); @@ -38,3 +39,4 @@ get_auth_key_from_establish_intro_cell(ed25519_public_key_t *auth_key_out, #endif /* HS_INTROPOINT_PRIVATE */ #endif /* TOR_HS_INTRO_H */ + diff --git a/src/or/hs_service.c b/src/or/hs_service.c index 6f0836c..3b5a3e7 100644 --- a/src/or/hs_service.c +++ b/src/or/hs_service.c @@ -126,7 +126,8 @@ generate_establish_intro_cell(const uint8_t *circuit_key_material, crypto_mac_sha3_256(mac, sizeof(mac), circuit_key_material, circuit_key_material_len, cell_bytes_tmp, - encoded_len - (ED25519_SIG_LEN + 2 + TRUNNEL_SHA3_256_LEN)); + encoded_len - + (ED25519_SIG_LEN + 2 + TRUNNEL_SHA3_256_LEN)); /* Write the MAC to the cell */ uint8_t *handshake_ptr = hs_cell_establish_intro_getarray_handshake_mac(cell); @@ -173,3 +174,4 @@ generate_establish_intro_cell(const uint8_t *circuit_key_material, } #endif /* TOR_UNIT_TESTS */ + diff --git a/src/or/hs_service.h b/src/or/hs_service.h index a54a960..994521f 100644 --- a/src/or/hs_service.h +++ b/src/or/hs_service.h @@ -29,3 +29,4 @@ get_establish_intro_payload(uint8_t *buf, size_t buf_len, #endif /* HS_SERVICE_PRIVATE */ #endif /* TOR_HS_SERVICE_H */ + diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 9a39090..00ede48 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -4484,3 +4484,4 @@ rend_service_non_anonymous_mode_enabled(const or_options_t *options) tor_assert(rend_service_non_anonymous_mode_consistent(options)); return options->HiddenServiceNonAnonymousMode ? 1 : 0; } + diff --git a/src/test/test_hs_service.c b/src/test/test_hs_service.c index 195e506..8890c11 100644 --- a/src/test/test_hs_service.c +++ b/src/test/test_hs_service.c @@ -106,7 +106,6 @@ struct testcase_t hs_service_tests[] = { { "gen_establish_intro_cell_bad", test_gen_establish_intro_cell_bad, TT_FORK, NULL, NULL }, - END_OF_TESTCASES };

1 0

[tor/master] prop224 prepwork: Introduce HS circuitmap subsystem.
by nickm＠torproject.org 14 Dec '16

14 Dec '16

commit 2b9abbef2e5d0e58e5a15b7cf8cd03965aa70117 Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Sep 5 18:48:15 2016 +0300 prop224 prepwork: Introduce HS circuitmap subsystem. The HS circuitmap is a hash table that maps introduction and rendezvous tokens to specific circuits such that given a token it's easy to find the corresponding circuit. It supports rend circuits and v2/v3 intro circuits. It will be used by the prop224 ESTABLISH_INTRO code to register and lookup v3 introduction circuits. The next commit after this removes the old code and fixes the unittests. Please consult both commits while reviewing functionality differences between the old and new code. Let me know if you want this rebased differently :) WRT architectural differences, this commit removes the rendinfo pointer from or_circuit_t. It then adds an hs_token_t pointer and a hashtable node for the HS circuitmap. IIUC, this adds another pointer to the weight of or_circuit_t. Let me know if you don't like this, or if you have suggestions on improving it. --- src/or/hs_circuitmap.c | 328 +++++++++++++++++++++++++++++++++++++++++++++++++ src/or/hs_circuitmap.h | 69 +++++++++++ src/or/or.h | 8 +- 3 files changed, 404 insertions(+), 1 deletion(-) diff --git a/src/or/hs_circuitmap.c b/src/or/hs_circuitmap.c new file mode 100644 index 0000000..790c4d3 --- /dev/null +++ b/src/or/hs_circuitmap.c @@ -0,0 +1,328 @@ +/* Copyright (c) 2016, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * \file hs_circuitmap.c + * + * \brief Manage the hidden service circuitmap: A hash table that maps binary + * tokens to introduction and rendezvous circuits. + **/ + +#define HS_CIRCUITMAP_PRIVATE + +#include "or.h" +#include "config.h" +#include "circuitlist.h" +#include "hs_circuitmap.h" + +/************************** HS circuitmap code *******************************/ + +/* This is the hidden service circuitmap. It's a hash table that maps + introduction and rendezvous tokens to specific circuits such that given a + token it's easy to find the corresponding circuit. */ +static struct hs_circuitmap_ht *the_hs_circuitmap = NULL; + +/* This is a helper function used by the hash table code (HT_). It returns 1 if + * two circuits have the same HS token. */ +static int +hs_circuits_have_same_token(const or_circuit_t *first_circuit, + const or_circuit_t *second_circuit) +{ + const hs_token_t *first_token; + const hs_token_t *second_token; + + tor_assert(first_circuit); + tor_assert(second_circuit); + + first_token = first_circuit->hs_token; + second_token = second_circuit->hs_token; + + /* Both circs must have a token */ + if (BUG(!first_token) || BUG(!second_token)) { + return 0; + } + + if (first_token->type != second_token->type) { + return 0; + } + + if (first_token->token_len != second_token->token_len) + return 0; + + return tor_memeq(first_token->token, + second_token->token, + first_token->token_len); +} + +/* This is a helper function for the hash table code (HT_). It hashes a circuit + * HS token into an unsigned int for use as a key by the hash table routines.*/ +static inline unsigned int +hs_circuit_hash_token(const or_circuit_t *circuit) +{ + tor_assert(circuit->hs_token); + + return (unsigned) siphash24g(circuit->hs_token->token, + circuit->hs_token->token_len); +} + +/* Register the circuitmap hash table */ +HT_PROTOTYPE(hs_circuitmap_ht, // The name of the hashtable struct + or_circuit_t, // The name of the element struct, + hs_circuitmap_node, // The name of HT_ENTRY member + hs_circuit_hash_token, hs_circuits_have_same_token); + +HT_GENERATE2(hs_circuitmap_ht, or_circuit_t, hs_circuitmap_node, + hs_circuit_hash_token, hs_circuits_have_same_token, + 0.6, tor_reallocarray, tor_free_); + +#ifdef TOR_UNIT_TESTS + +/* Return the global HS circuitmap. Used by unittests. */ +hs_circuitmap_ht * +get_hs_circuitmap(void) +{ + return the_hs_circuitmap; +} + +#endif + +/****************** HS circuitmap utility functions **************************/ + +/** Return a new HS token of type type containing token. */ +static hs_token_t * +hs_token_new(hs_token_type_t type, size_t token_len, + const uint8_t *token) +{ + tor_assert(token); + + hs_token_t *hs_token = tor_malloc_zero(sizeof(hs_token_t)); + hs_token->type = type; + hs_token->token_len = token_len; + hs_token->token = tor_memdup(token, token_len); + + return hs_token; +} + +/** Free memory allocated by this hs_token. */ +static void +hs_token_free(hs_token_t *hs_token) +{ + if (!hs_token) { + return; + } + + tor_free(hs_token->token); + tor_free(hs_token); +} + +/** Return the circuit from the circuitmap with token search_token. */ +static or_circuit_t * +get_circuit_with_token(hs_token_t *search_token) +{ + tor_assert(the_hs_circuitmap); + + /* We use a dummy circuit object for the hash table search routine. */ + or_circuit_t search_circ; + search_circ.hs_token = search_token; + return HT_FIND(hs_circuitmap_ht, the_hs_circuitmap, &search_circ); +} + +/* Helper function that registers circ with token on the HS + circuitmap. This function steals reference of token. */ +static void +hs_circuitmap_register_impl(or_circuit_t *circ, hs_token_t *token) +{ + tor_assert(circ); + tor_assert(token); + tor_assert(the_hs_circuitmap); + + /* If this circuit already has a token, clear it. */ + if (circ->hs_token) { + hs_circuitmap_remove_circuit(circ); + } + + /* Kill old circuits with the same token. We want new intro/rend circuits to + take precedence over old ones, so that HSes and clients and reestablish + killed circuits without changing the HS token. */ + { + or_circuit_t *found_circ; + found_circ = get_circuit_with_token(token); + if (found_circ) { + hs_circuitmap_remove_circuit(found_circ); + if (!found_circ->base_.marked_for_close) { + circuit_mark_for_close(TO_CIRCUIT(found_circ), + END_CIRC_REASON_FINISHED); + } + } + } + + /* Register circuit and token to circuitmap. */ + circ->hs_token = token; + HT_INSERT(hs_circuitmap_ht, the_hs_circuitmap, circ); +} + +/** Helper function: Register circ of type on the HS + * circuitmap. Use the HS token as the key to the hash table. If + * token is not set, clear the circuit of any HS tokens. */ +static void +hs_circuitmap_register_circuit(or_circuit_t *circ, + hs_token_type_t type, size_t token_len, + const uint8_t *token) +{ + hs_token_t *hs_token = NULL; + + /* Create a new token and register it to the circuitmap */ + tor_assert(token); + hs_token = hs_token_new(type, token_len, token); + tor_assert(hs_token); + hs_circuitmap_register_impl(circ, hs_token); +} + +/* Query circuitmap for circuit with token of size token_len. + * Only returns a circuit with purpose equal to the wanted_circ_purpose + * parameter and if it is NOT marked for close. Return NULL if no such circuit + * is found. */ +static or_circuit_t * +hs_circuitmap_get_circuit(hs_token_type_t type, + size_t token_len, + const uint8_t *token, + uint8_t wanted_circ_purpose) +{ + or_circuit_t *found_circ = NULL; + + tor_assert(the_hs_circuitmap); + + /* Check the circuitmap if we have a circuit with this token */ + { + hs_token_t *search_hs_token = hs_token_new(type, token_len, token); + tor_assert(search_hs_token); + found_circ = get_circuit_with_token(search_hs_token); + hs_token_free(search_hs_token); + } + + /* Check that the circuit is useful to us */ + if (!found_circ || + found_circ->base_.purpose != wanted_circ_purpose || + found_circ->base_.marked_for_close) { + return NULL; + } + + return found_circ; +} + +/************** Public circuitmap API ****************************************/ + +/* Public function: Return v3 introduction circuit with auth_key. Return + * NULL if no such circuit is found in the circuitmap. */ +or_circuit_t * +hs_circuitmap_get_intro_circ_v3(const ed25519_public_key_t *auth_key) +{ + tor_assert(auth_key); + + return hs_circuitmap_get_circuit(HS_TOKEN_INTRO_V3, + ED25519_PUBKEY_LEN, auth_key->pubkey, + CIRCUIT_PURPOSE_INTRO_POINT); +} + +/* Public function: Return v2 introduction circuit with digest. Return + * NULL if no such circuit is found in the circuitmap. */ +or_circuit_t * +hs_circuitmap_get_intro_circ_v2(const uint8_t *digest) +{ + tor_assert(digest); + + return hs_circuitmap_get_circuit(HS_TOKEN_INTRO_V2, + REND_TOKEN_LEN, digest, + CIRCUIT_PURPOSE_INTRO_POINT); +} + +/* Public function: Return rendezvous circuit with rendezvous + * cookie. Return NULL if no such circuit is found in the circuitmap. */ +or_circuit_t * +hs_circuitmap_get_rend_circ(const uint8_t *cookie) +{ + tor_assert(cookie); + + return hs_circuitmap_get_circuit(HS_TOKEN_REND, + REND_TOKEN_LEN, cookie, + CIRCUIT_PURPOSE_REND_POINT_WAITING); +} + +/* Public function: Register rendezvous circuit with key cookie to the + * circuitmap. */ +void +hs_circuitmap_register_rend_circ(or_circuit_t *circ, const uint8_t *cookie) +{ + hs_circuitmap_register_circuit(circ, + HS_TOKEN_REND, + REND_TOKEN_LEN, cookie); +} + +/* Public function: Register v2 intro circuit with key digest to the + * circuitmap. */ +void +hs_circuitmap_register_intro_circ_v2(or_circuit_t *circ, const uint8_t *digest) +{ + hs_circuitmap_register_circuit(circ, + HS_TOKEN_INTRO_V2, + REND_TOKEN_LEN, digest); +} + +/* Public function: Register v3 intro circuit with key auth_key to the + * circuitmap. */ +void +hs_circuitmap_register_intro_circ_v3(or_circuit_t *circ, + const ed25519_public_key_t *auth_key) +{ + hs_circuitmap_register_circuit(circ, + HS_TOKEN_INTRO_V3, + ED25519_PUBKEY_LEN, auth_key->pubkey); +} + +/** Remove this circuit from the HS circuitmap. Clear its HS token, and remove + * it from the hashtable. */ +void +hs_circuitmap_remove_circuit(or_circuit_t *circ) +{ + tor_assert(the_hs_circuitmap); + + if (!circ || !circ->hs_token) { + return; + } + + /* Remove circ from circuitmap */ + or_circuit_t *tmp; + tmp = HT_REMOVE(hs_circuitmap_ht, the_hs_circuitmap, circ); + /* ... and ensure the removal was successful. */ + if (tmp) { + tor_assert(tmp == circ); + } else { + log_warn(LD_BUG, "Could not find circuit (%u) in circuitmap.", + circ->p_circ_id); + } + + /* Clear token from circ */ + hs_token_free(circ->hs_token); + circ->hs_token = NULL; +} + +/* Initialize the global HS circuitmap. */ +void +hs_circuitmap_init(void) +{ + tor_assert(!the_hs_circuitmap); + + the_hs_circuitmap = tor_malloc_zero(sizeof(struct hs_circuitmap_ht)); + HT_INIT(hs_circuitmap_ht, the_hs_circuitmap); +} + +/* Free all memory allocated by the global HS circuitmap. */ +void +hs_circuitmap_free_all(void) +{ + tor_assert(the_hs_circuitmap); + + HT_CLEAR(hs_circuitmap_ht, the_hs_circuitmap); + tor_free(the_hs_circuitmap); +} + diff --git a/src/or/hs_circuitmap.h b/src/or/hs_circuitmap.h new file mode 100644 index 0000000..a2be97c --- /dev/null +++ b/src/or/hs_circuitmap.h @@ -0,0 +1,69 @@ +/* Copyright (c) 2016, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * \file hs_circuitmap.h + * \brief Header file for hs_circuitmap.c. + **/ + +#ifndef TOR_HS_CIRCUITMAP_H +#define TOR_HS_CIRCUITMAP_H + +typedef HT_HEAD(hs_circuitmap_ht, or_circuit_t) hs_circuitmap_ht; + +typedef struct hs_token_s hs_token_t; +typedef struct or_circuit_t or_circuit_t; + +/** Public HS circuitmap API: */ + +or_circuit_t *hs_circuitmap_get_rend_circ(const uint8_t *cookie); +or_circuit_t * +hs_circuitmap_get_intro_circ_v3(const ed25519_public_key_t *auth_key); +or_circuit_t *hs_circuitmap_get_intro_circ_v2(const uint8_t *digest); + +void hs_circuitmap_register_rend_circ(or_circuit_t *circ, + const uint8_t *cookie); +void hs_circuitmap_register_intro_circ_v2(or_circuit_t *circ, + const uint8_t *digest); +void hs_circuitmap_register_intro_circ_v3(or_circuit_t *circ, + const ed25519_public_key_t *auth_key); + +void hs_circuitmap_remove_circuit(or_circuit_t *circ); + +void hs_circuitmap_init(void); +void hs_circuitmap_free_all(void); + +#ifdef HS_CIRCUITMAP_PRIVATE + +/** Represents the type of HS token. */ +typedef enum { + /** A rendezvous cookie (128bit)*/ + HS_TOKEN_REND, + /** A v2 introduction point pubkey (160bit) */ + HS_TOKEN_INTRO_V2, + /** A v3 introduction point pubkey (256bit) */ + HS_TOKEN_INTRO_V3, +} hs_token_type_t; + +/** Represents a token used in the HS protocol. Each such token maps to a + * specific introduction or rendezvous circuit. */ +struct hs_token_s { + /* Type of HS token. */ + hs_token_type_t type; + + /* The size of the token (depends on the type). */ + size_t token_len; + + /* The token itself. Memory allocated at runtime. */ + uint8_t *token; +}; + +#endif /* HS_CIRCUITMAP_PRIVATE */ + +#ifdef TOR_UNIT_TESTS + +hs_circuitmap_ht *get_hs_circuitmap(void); + +#endif /* TOR_UNIT_TESTS */ + +#endif /* TOR_HS_CIRCUITMAP_H */ diff --git a/src/or/or.h b/src/or/or.h index eb94f63..9581c6d 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -80,6 +80,7 @@ #include "crypto_ed25519.h" #include "tor_queue.h" #include "util_format.h" +#include "hs_circuitmap.h" /* These signals are defined to help handle_control_signal work. */ @@ -3352,7 +3353,12 @@ typedef struct or_circuit_t { * is not marked for close. */ struct or_circuit_t *rend_splice; - struct or_circuit_rendinfo_s *rendinfo; + /** If set, points to an HS token that this circuit might be carrying. + * Used by the HS circuitmap. */ + hs_token_t *hs_token; + /** Hashtable node: used to look up the circuit by its HS token using the HS + circuitmap. */ + HT_ENTRY(or_circuit_t) hs_circuitmap_node; /** Stores KH for the handshake. */ char rend_circ_nonce[DIGEST_LEN];/* KH in tor-spec.txt */

1 0

[tor/master] prop224: Use LOG_PROTOCOL_WARN instead of log_warn(LD_PROTOCOL, ...) in hs_intropoint.c
by nickm＠torproject.org 14 Dec '16

14 Dec '16

commit a4eb17ed89d4761146280490e838cf850bc81296 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Dec 14 10:39:33 2016 -0500 prop224: Use LOG_PROTOCOL_WARN instead of log_warn(LD_PROTOCOL, ...) in hs_intropoint.c Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/hs_intropoint.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/src/or/hs_intropoint.c b/src/or/hs_intropoint.c index b5f62aa..67355bc 100644 --- a/src/or/hs_intropoint.c +++ b/src/or/hs_intropoint.c @@ -11,6 +11,7 @@ #include "or.h" #include "circuitlist.h" #include "circuituse.h" +#include "config.h" #include "relay.h" #include "rendmid.h" #include "rephist.h" @@ -70,7 +71,8 @@ verify_establish_intro_cell(const hs_cell_establish_intro_t *cell, const uint8_t *sig_array = hs_cell_establish_intro_getconstarray_sig(cell); if (hs_cell_establish_intro_getlen_sig(cell) != sizeof(sig_struct.sig)) { - log_warn(LD_PROTOCOL, "ESTABLISH_INTRO sig len is invalid"); + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "ESTABLISH_INTRO sig len is invalid"); return -1; } /* We are now sure that sig_len is of the right size. */ @@ -85,7 +87,8 @@ verify_establish_intro_cell(const hs_cell_establish_intro_t *cell, ESTABLISH_INTRO_SIG_PREFIX, &auth_key); if (sig_mismatch) { - log_warn(LD_PROTOCOL, "ESTABLISH_INTRO signature not as expected"); + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "ESTABLISH_INTRO signature not as expected"); return -1; } } @@ -98,7 +101,8 @@ verify_establish_intro_cell(const hs_cell_establish_intro_t *cell, circuit_key_material, circuit_key_material_len, msg, auth_msg_len); if (tor_memneq(mac, cell->handshake_mac, sizeof(mac))) { - log_warn(LD_PROTOCOL, "ESTABLISH_INTRO handshake_auth not as expected"); + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "ESTABLISH_INTRO handshake_auth not as expected"); return -1; } } @@ -192,8 +196,9 @@ handle_establish_intro(or_circuit_t *circ, const uint8_t *request, ssize_t parsing_result = hs_cell_establish_intro_parse(&parsed_cell, request, request_len); if (parsing_result < 0) { - log_warn(LD_PROTOCOL, "Rejecting %s ESTABLISH_INTRO cell.", - parsing_result == -1 ? "invalid" : "truncated"); + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Rejecting %s ESTABLISH_INTRO cell.", + parsing_result == -1 ? "invalid" : "truncated"); goto err; } @@ -201,7 +206,8 @@ handle_establish_intro(or_circuit_t *circ, const uint8_t *request, (uint8_t *) circ->rend_circ_nonce, sizeof(circ->rend_circ_nonce)); if (cell_ok < 0) { - log_warn(LD_PROTOCOL, "Failed to verify ESTABLISH_INTRO cell."); + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Failed to verify ESTABLISH_INTRO cell."); goto err; } @@ -233,12 +239,14 @@ hs_intro_circuit_is_suitable(const or_circuit_t *circ) { /* Basic circuit state sanity checks. */ if (circ->base_.purpose != CIRCUIT_PURPOSE_OR) { - log_warn(LD_PROTOCOL, "Rejecting ESTABLISH_INTRO on non-OR circuit."); + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Rejecting ESTABLISH_INTRO on non-OR circuit."); return 0; } if (circ->base_.n_chan) { - log_warn(LD_PROTOCOL, "Rejecting ESTABLISH_INTRO on non-edge circuit."); + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Rejecting ESTABLISH_INTRO on non-edge circuit."); return 0; } @@ -255,7 +263,7 @@ hs_intro_received_establish_intro(or_circuit_t *circ, const uint8_t *request, tor_assert(request); if (request_len == 0) { - log_warn(LD_PROTOCOL, "Empty ESTABLISH_INTRO cell."); + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Empty ESTABLISH_INTRO cell."); goto err; } @@ -269,7 +277,8 @@ hs_intro_received_establish_intro(or_circuit_t *circ, const uint8_t *request, case HS_INTRO_AUTH_KEY_TYPE_ED25519: return handle_establish_intro(circ, request, request_len); default: - log_warn(LD_PROTOCOL, "Unrecognized AUTH_KEY_TYPE %u.", first_byte); + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Unrecognized AUTH_KEY_TYPE %u.", first_byte); goto err; }

1 0

[tor/master] Merge branch 'dgoulet_ticket19043_030_03_squashed'
by nickm＠torproject.org 14 Dec '16

14 Dec '16

commit c838d34921f3e86841ff75ca8ad78c95bd1e2996 Merge: 963e706 a4eb17e Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 15:28:28 2016 -0500 Merge branch 'dgoulet_ticket19043_030_03_squashed' changes/bug19043 | 5 + src/common/crypto.c | 29 ++++ src/common/crypto.h | 4 + src/common/crypto_ed25519.c | 10 +- src/common/crypto_ed25519.h | 11 +- src/or/circuitlist.c | 179 +-------------------- src/or/circuitlist.h | 4 - src/or/hs_circuitmap.c | 328 ++++++++++++++++++++++++++++++++++++++ src/or/hs_circuitmap.h | 69 ++++++++ src/or/hs_common.h | 7 +- src/or/hs_intropoint.c | 288 +++++++++++++++++++++++++++++++++ src/or/hs_intropoint.h | 40 +++++ src/or/hs_service.c | 175 ++++++++++++++++++++ src/or/hs_service.h | 31 ++++ src/or/include.am | 6 + src/or/main.c | 5 + src/or/or.h | 22 +-- src/or/rendcommon.c | 3 +- src/or/rendmid.c | 32 ++-- src/or/rendmid.h | 4 +- src/or/rendservice.c | 103 +++++++----- src/or/rendservice.h | 3 + src/test/include.am | 2 + src/test/test.c | 4 +- src/test/test.h | 2 + src/test/test_circuitlist.c | 63 ++++---- src/test/test_crypto.c | 49 ++++++ src/test/test_hs_intropoint.c | 361 ++++++++++++++++++++++++++++++++++++++++++ src/test/test_hs_service.c | 112 +++++++++++++ 29 files changed, 1660 insertions(+), 291 deletions(-) diff --cc src/or/rendservice.h index 3b18567,8fb3e8f..4e6b9a2 --- a/src/or/rendservice.h +++ b/src/or/rendservice.h @@@ -119,16 -119,9 +119,19 @@@ typedef struct rend_service_t STATIC void rend_service_free(rend_service_t *service); STATIC char *rend_service_sos_poison_path(const rend_service_t *service); +STATIC int rend_service_check_dir_and_add(smartlist_t *service_list, + const or_options_t *options, + rend_service_t *service, + int validate_only); +STATIC int rend_service_verify_single_onion_poison( + const rend_service_t *s, + const or_options_t *options); +STATIC int rend_service_poison_new_single_onion_dir( + const rend_service_t *s, + const or_options_t* options); + STATIC ssize_t encode_establish_intro_cell_legacy(char *cell_body_out, + crypto_pk_t *intro_key, + char *rend_circ_nonce); #endif int num_rend_services(void);

1 0

[tor/master] Fix a "make check" regression in --list-fingerprint.
by nickm＠torproject.org 14 Dec '16

14 Dec '16

commit a675ef8eeabcd6c2ab05cfadc59a95de578be380 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 14 15:39:31 2016 -0500 Fix a "make check" regression in --list-fingerprint. --- src/or/hs_circuitmap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/or/hs_circuitmap.c b/src/or/hs_circuitmap.c index 790c4d3..321c8dd 100644 --- a/src/or/hs_circuitmap.c +++ b/src/or/hs_circuitmap.c @@ -320,9 +320,9 @@ hs_circuitmap_init(void) void hs_circuitmap_free_all(void) { - tor_assert(the_hs_circuitmap); - - HT_CLEAR(hs_circuitmap_ht, the_hs_circuitmap); - tor_free(the_hs_circuitmap); + if (the_hs_circuitmap) { + HT_CLEAR(hs_circuitmap_ht, the_hs_circuitmap); + tor_free(the_hs_circuitmap); + } }

1 0

[tor/master] prop224: Add unittests handling v3 ESTABLISH_INTRO cells.
by nickm＠torproject.org 14 Dec '16

14 Dec '16

commit 297213825b288c954e13c3bccb3b3210063d244a Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Sep 5 19:03:30 2016 +0300 prop224: Add unittests handling v3 ESTABLISH_INTRO cells. Test for both v2 and v3 ESTABLISH_INTRO handling. --- src/common/crypto_ed25519.c | 10 +- src/common/crypto_ed25519.h | 11 +- src/test/include.am | 2 + src/test/test.c | 4 +- src/test/test.h | 2 + src/test/test_hs_intropoint.c | 360 ++++++++++++++++++++++++++++++++++++++++++ src/test/test_hs_service.c | 112 +++++++++++++ 7 files changed, 490 insertions(+), 11 deletions(-) diff --git a/src/common/crypto_ed25519.c b/src/common/crypto_ed25519.c index 30ed772..1be225d 100644 --- a/src/common/crypto_ed25519.c +++ b/src/common/crypto_ed25519.c @@ -267,11 +267,11 @@ ed25519_sign(ed25519_signature_t *signature_out, * Like ed25519_sign(), but also prefix msg with prefix_str * before signing. prefix_str must be a NUL-terminated string. */ -int -ed25519_sign_prefixed(ed25519_signature_t *signature_out, - const uint8_t *msg, size_t msg_len, - const char *prefix_str, - const ed25519_keypair_t *keypair) +MOCK_IMPL(int, +ed25519_sign_prefixed,(ed25519_signature_t *signature_out, + const uint8_t *msg, size_t msg_len, + const char *prefix_str, + const ed25519_keypair_t *keypair)) { int retval; size_t prefixed_msg_len; diff --git a/src/common/crypto_ed25519.h b/src/common/crypto_ed25519.h index 31afc49..08ba9be 100644 --- a/src/common/crypto_ed25519.h +++ b/src/common/crypto_ed25519.h @@ -55,11 +55,12 @@ int ed25519_checksig(const ed25519_signature_t *signature, const uint8_t *msg, size_t len, const ed25519_public_key_t *pubkey); -int -ed25519_sign_prefixed(ed25519_signature_t *signature_out, - const uint8_t *msg, size_t len, - const char *prefix_str, - const ed25519_keypair_t *keypair); +MOCK_DECL(int, +ed25519_sign_prefixed,(ed25519_signature_t *signature_out, + const uint8_t *msg, size_t len, + const char *prefix_str, + const ed25519_keypair_t *keypair)); + int ed25519_checksig_prefixed(const ed25519_signature_t *signature, const uint8_t *msg, size_t len, diff --git a/src/test/include.am b/src/test/include.am index f6e4314..6177e5f 100644 --- a/src/test/include.am +++ b/src/test/include.am @@ -96,6 +96,8 @@ src_test_test_SOURCES = \ src/test/test_guardfraction.c \ src/test/test_extorport.c \ src/test/test_hs.c \ + src/test/test_hs_service.c \ + src/test/test_hs_intropoint.c \ src/test/test_handles.c \ src/test/test_hs_cache.c \ src/test/test_hs_descriptor.c \ diff --git a/src/test/test.c b/src/test/test.c index b02ecb9..b49180c 100644 --- a/src/test/test.c +++ b/src/test/test.c @@ -1204,9 +1204,11 @@ struct testgroup_t testgroups[] = { { "entrynodes/", entrynodes_tests }, { "guardfraction/", guardfraction_tests }, { "extorport/", extorport_tests }, - { "hs/", hs_tests }, + { "legacy_hs/", hs_tests }, { "hs_cache/", hs_cache }, { "hs_descriptor/", hs_descriptor }, + { "hs_service/", hs_service_tests }, + { "hs_intropoint/", hs_intropoint_tests }, { "introduce/", introduce_tests }, { "keypin/", keypin_tests }, { "link-handshake/", link_handshake_tests }, diff --git a/src/test/test.h b/src/test/test.h index 49b4499..cf47351 100644 --- a/src/test/test.h +++ b/src/test/test.h @@ -201,6 +201,8 @@ extern struct testcase_t extorport_tests[]; extern struct testcase_t hs_tests[]; extern struct testcase_t hs_cache[]; extern struct testcase_t hs_descriptor[]; +extern struct testcase_t hs_service_tests[]; +extern struct testcase_t hs_intropoint_tests[]; extern struct testcase_t introduce_tests[]; extern struct testcase_t keypin_tests[]; extern struct testcase_t link_handshake_tests[]; diff --git a/src/test/test_hs_intropoint.c b/src/test/test_hs_intropoint.c new file mode 100644 index 0000000..76f9dba --- /dev/null +++ b/src/test/test_hs_intropoint.c @@ -0,0 +1,360 @@ +/* Copyright (c) 2016, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * \file test_hs_service.c + * \brief Test hidden service functionality. + */ + +#define HS_SERVICE_PRIVATE +#define HS_INTROPOINT_PRIVATE +#define RENDSERVICE_PRIVATE +#define CIRCUITLIST_PRIVATE + +#include "test.h" +#include "crypto.h" + +#include "or.h" +#include "ht.h" + +#include "hs/cell_establish_intro.h" +#include "hs_service.h" +#include "hs_circuitmap.h" +#include "hs_intropoint.h" + +#include "circuitlist.h" +#include "circuituse.h" +#include "rendservice.h" + +/* Mock function to avoid networking in unittests */ +static int +mock_send_intro_established_cell(or_circuit_t *circ) +{ + (void) circ; + return 0; +} + +/* Try sending an ESTABLISH_INTRO cell on a circuit that is already an intro + * point. Should fail. */ +static void +test_establish_intro_wrong_purpose(void *arg) +{ + int retval; + hs_cell_establish_intro_t *establish_intro_cell = NULL; + or_circuit_t *intro_circ = or_circuit_new(0,NULL);; + uint8_t cell_body[RELAY_PAYLOAD_SIZE]; + ssize_t cell_len = 0; + char circuit_key_material[DIGEST_LEN] = {0}; + + (void)arg; + + /* Get the auth key of the intro point */ + crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + memcpy(intro_circ->rend_circ_nonce, circuit_key_material, DIGEST_LEN); + + /* Set a bad circuit purpose!! :) */ + circuit_change_purpose(TO_CIRCUIT(intro_circ), CIRCUIT_PURPOSE_INTRO_POINT); + + /* Create outgoing ESTABLISH_INTRO cell and extract its payload so that we + attempt to parse it. */ + establish_intro_cell = generate_establish_intro_cell(circuit_key_material, + sizeof(circuit_key_material)); + tt_assert(establish_intro_cell); + cell_len = get_establish_intro_payload(cell_body, sizeof(cell_body), + establish_intro_cell); + tt_int_op(cell_len, >, 0); + + /* Receive the cell */ + retval = hs_intro_received_establish_intro(intro_circ, cell_body, cell_len); + tt_int_op(retval, ==, -1); + + done: + hs_cell_establish_intro_free(establish_intro_cell); + circuit_free(TO_CIRCUIT(intro_circ)); +} + +/* Prepare a circuit for accepting an ESTABLISH_INTRO cell */ +static void +helper_prepare_circ_for_intro(or_circuit_t *circ, char *circuit_key_material) +{ + /* Prepare the circuit for the incoming ESTABLISH_INTRO */ + circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_OR); + memcpy(circ->rend_circ_nonce, circuit_key_material, DIGEST_LEN); +} + +/* Send an empty ESTABLISH_INTRO cell. Should fail. */ +static void +test_establish_intro_wrong_keytype(void *arg) +{ + int retval; + or_circuit_t *intro_circ = or_circuit_new(0,NULL);; + char circuit_key_material[DIGEST_LEN] = {0}; + + (void)arg; + + /* Get the auth key of the intro point */ + crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + helper_prepare_circ_for_intro(intro_circ, circuit_key_material); + + /* Receive the cell. Should fail. */ + retval = hs_intro_received_establish_intro(intro_circ, (uint8_t*)"", 0); + tt_int_op(retval, ==, -1); + + done: + circuit_free(TO_CIRCUIT(intro_circ)); +} + +/* Send an ESTABLISH_INTRO cell with an unknown auth key type. Should fail. */ +static void +test_establish_intro_wrong_keytype2(void *arg) +{ + int retval; + hs_cell_establish_intro_t *establish_intro_cell = NULL; + or_circuit_t *intro_circ = or_circuit_new(0,NULL);; + uint8_t cell_body[RELAY_PAYLOAD_SIZE]; + ssize_t cell_len = 0; + char circuit_key_material[DIGEST_LEN] = {0}; + + (void)arg; + + /* Get the auth key of the intro point */ + crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + helper_prepare_circ_for_intro(intro_circ, circuit_key_material); + + /* Create outgoing ESTABLISH_INTRO cell and extract its payload so that we + attempt to parse it. */ + establish_intro_cell = generate_establish_intro_cell(circuit_key_material, + sizeof(circuit_key_material)); + tt_assert(establish_intro_cell); + cell_len = get_establish_intro_payload(cell_body, sizeof(cell_body), + establish_intro_cell); + tt_int_op(cell_len, >, 0); + + /* Mutate the auth key type! :) */ + cell_body[0] = 42; + + /* Receive the cell. Should fail. */ + retval = hs_intro_received_establish_intro(intro_circ, cell_body, cell_len); + tt_int_op(retval, ==, -1); + + done: + hs_cell_establish_intro_free(establish_intro_cell); + circuit_free(TO_CIRCUIT(intro_circ)); +} + +/* Send a legit ESTABLISH_INTRO cell but slightly change the signature. Should + * fail. */ +static void +test_establish_intro_wrong_sig(void *arg) +{ + int retval; + hs_cell_establish_intro_t *establish_intro_cell = NULL; + or_circuit_t *intro_circ = or_circuit_new(0,NULL);; + uint8_t cell_body[RELAY_PAYLOAD_SIZE]; + ssize_t cell_len = 0; + char circuit_key_material[DIGEST_LEN] = {0}; + + (void)arg; + + /* Get the auth key of the intro point */ + crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + helper_prepare_circ_for_intro(intro_circ, circuit_key_material); + + /* Create outgoing ESTABLISH_INTRO cell and extract its payload so that we + attempt to parse it. */ + establish_intro_cell = generate_establish_intro_cell(circuit_key_material, + sizeof(circuit_key_material)); + tt_assert(establish_intro_cell); + cell_len = get_establish_intro_payload(cell_body, sizeof(cell_body), + establish_intro_cell); + tt_int_op(cell_len, >, 0); + + /* Mutate the last byte (signature)! :) */ + cell_body[cell_len-1]++; + + /* Receive the cell. Should fail. */ + retval = hs_intro_received_establish_intro(intro_circ, cell_body, cell_len); + tt_int_op(retval, ==, -1); + + done: + hs_cell_establish_intro_free(establish_intro_cell); + circuit_free(TO_CIRCUIT(intro_circ)); +} + +/* Helper function: Send a well-formed v3 ESTABLISH_INTRO cell to + * intro_circ. Return the cell. */ +static hs_cell_establish_intro_t * +helper_establish_intro_v3(or_circuit_t *intro_circ) +{ + int retval; + hs_cell_establish_intro_t *establish_intro_cell = NULL; + uint8_t cell_body[RELAY_PAYLOAD_SIZE]; + ssize_t cell_len = 0; + char circuit_key_material[DIGEST_LEN] = {0}; + + tt_assert(intro_circ); + + /* Prepare the circuit for the incoming ESTABLISH_INTRO */ + crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + helper_prepare_circ_for_intro(intro_circ, circuit_key_material); + + /* Create outgoing ESTABLISH_INTRO cell and extract its payload so that we + attempt to parse it. */ + establish_intro_cell = generate_establish_intro_cell(circuit_key_material, + sizeof(circuit_key_material)); + tt_assert(establish_intro_cell); + cell_len = get_establish_intro_payload(cell_body, sizeof(cell_body), + establish_intro_cell); + tt_int_op(cell_len, >, 0); + + /* Receive the cell */ + retval = hs_intro_received_establish_intro(intro_circ, cell_body, cell_len); + tt_int_op(retval, ==, 0); + + done: + return establish_intro_cell; +} + +/* Helper function: Send a well-formed v2 ESTABLISH_INTRO cell to + * intro_circ. Return the public key advertised in the cell. */ +static crypto_pk_t * +helper_establish_intro_v2(or_circuit_t *intro_circ) +{ + crypto_pk_t *key1 = NULL; + int retval; + uint8_t cell_body[RELAY_PAYLOAD_SIZE]; + ssize_t cell_len = 0; + char circuit_key_material[DIGEST_LEN] = {0}; + + tt_assert(intro_circ); + + /* Prepare the circuit for the incoming ESTABLISH_INTRO */ + crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + helper_prepare_circ_for_intro(intro_circ, circuit_key_material); + + /* Send legacy establish_intro */ + key1 = pk_generate(0); + + /* Use old circuit_key_material why not */ + cell_len = encode_establish_intro_cell_legacy((char*)cell_body, + key1, + circuit_key_material); + tt_int_op(cell_len, >, 0); + + /* Receive legacy establish_intro */ + retval = hs_intro_received_establish_intro(intro_circ, + cell_body, cell_len); + tt_int_op(retval, ==, 0); + + done: + return key1; +} + +/** Successfuly register a v2 intro point and a v3 intro point. Ensure that HS + * circuitmap is maintained properly. */ +static void +test_intro_point_registration(void *arg) +{ + int retval; + hs_circuitmap_ht *the_hs_circuitmap = NULL; + + or_circuit_t *intro_circ = NULL; + hs_cell_establish_intro_t *establish_intro_cell = NULL; + ed25519_public_key_t auth_key; + + crypto_pk_t *legacy_auth_key = NULL; + or_circuit_t *legacy_intro_circ = NULL; + + or_circuit_t *returned_intro_circ = NULL; + + (void) arg; + + MOCK(hs_intro_send_intro_established_cell, mock_send_intro_established_cell); + + hs_circuitmap_init(); + + /* Check that the circuitmap is currently empty */ + { + the_hs_circuitmap = get_hs_circuitmap(); + tt_assert(the_hs_circuitmap); + tt_int_op(0, ==, HT_SIZE(the_hs_circuitmap)); + /* Do a circuitmap query in any case */ + returned_intro_circ = hs_circuitmap_get_intro_circ_v3(&auth_key); + tt_ptr_op(returned_intro_circ, ==, NULL); + } + + /* Create a v3 intro point */ + { + intro_circ = or_circuit_new(0, NULL); + tt_assert(intro_circ); + establish_intro_cell = helper_establish_intro_v3(intro_circ); + + /* Check that the intro point was registered on the HS circuitmap */ + the_hs_circuitmap = get_hs_circuitmap(); + tt_assert(the_hs_circuitmap); + tt_int_op(1, ==, HT_SIZE(the_hs_circuitmap)); + get_auth_key_from_establish_intro_cell(&auth_key, establish_intro_cell); + returned_intro_circ = hs_circuitmap_get_intro_circ_v3(&auth_key); + tt_ptr_op(intro_circ, ==, returned_intro_circ); + } + + /* Create a v2 intro point */ + { + char key_digest[DIGEST_LEN]; + + legacy_intro_circ = or_circuit_new(1, NULL); + tt_assert(legacy_intro_circ); + legacy_auth_key = helper_establish_intro_v2(legacy_intro_circ); + tt_assert(legacy_auth_key); + + /* Check that the circuitmap now has two elements */ + the_hs_circuitmap = get_hs_circuitmap(); + tt_assert(the_hs_circuitmap); + tt_int_op(2, ==, HT_SIZE(the_hs_circuitmap)); + + /* Check that the new element is our legacy intro circuit. */ + retval = crypto_pk_get_digest(legacy_auth_key, key_digest); + tt_int_op(retval, ==, 0); + returned_intro_circ= hs_circuitmap_get_intro_circ_v2((uint8_t*)key_digest); + tt_ptr_op(legacy_intro_circ, ==, returned_intro_circ); + } + + /* XXX Continue test and try to register a second v3 intro point with the + * same auth key. Make sure that old intro circuit gets closed. */ + + done: + crypto_pk_free(legacy_auth_key); + circuit_free(TO_CIRCUIT(intro_circ)); + circuit_free(TO_CIRCUIT(legacy_intro_circ)); + hs_cell_establish_intro_free(establish_intro_cell); + + { /* Test circuitmap free_all function. */ + the_hs_circuitmap = get_hs_circuitmap(); + tt_assert(the_hs_circuitmap); + hs_circuitmap_free_all(); + the_hs_circuitmap = get_hs_circuitmap(); + tt_assert(!the_hs_circuitmap); + } + + UNMOCK(hs_intro_send_intro_established_cell); +} + +struct testcase_t hs_intropoint_tests[] = { + { "intro_point_registration", + test_intro_point_registration, TT_FORK, NULL, NULL }, + + { "receive_establish_intro_wrong_keytype", + test_establish_intro_wrong_keytype, TT_FORK, NULL, NULL }, + + { "receive_establish_intro_wrong_keytype2", + test_establish_intro_wrong_keytype2, TT_FORK, NULL, NULL }, + + { "receive_establish_intro_wrong_purpose", + test_establish_intro_wrong_purpose, TT_FORK, NULL, NULL }, + + { "receive_establish_intro_wrong_sig", + test_establish_intro_wrong_sig, TT_FORK, NULL, NULL }, + + END_OF_TESTCASES +}; + diff --git a/src/test/test_hs_service.c b/src/test/test_hs_service.c new file mode 100644 index 0000000..88c7ef2 --- /dev/null +++ b/src/test/test_hs_service.c @@ -0,0 +1,112 @@ +/* Copyright (c) 2016, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * \file test_hs_service.c + * \brief Test hidden service functionality. + */ + +#define HS_SERVICE_PRIVATE +#define HS_INTROPOINT_PRIVATE + +#include "test.h" +#include "log_test_helpers.h" +#include "crypto.h" + +#include "hs/cell_establish_intro.h" +#include "hs_service.h" +#include "hs_intropoint.h" + +/** We simulate the creation of an outgoing ESTABLISH_INTRO cell, and then we + * parse it from the receiver side. */ +static void +test_gen_establish_intro_cell(void *arg) +{ + (void) arg; + int retval; + char circuit_key_material[DIGEST_LEN] = {0}; + uint8_t buf[RELAY_PAYLOAD_SIZE]; + hs_cell_establish_intro_t *cell_out = NULL; + hs_cell_establish_intro_t *cell_in = NULL; + + crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + + /* Create outgoing ESTABLISH_INTRO cell and extract its payload so that we + attempt to parse it. */ + { + cell_out = generate_establish_intro_cell(circuit_key_material, + sizeof(circuit_key_material)); + tt_assert(cell_out); + + retval = get_establish_intro_payload(buf, sizeof(buf), cell_out); + tt_int_op(retval, >=, 0); + } + + /* Parse it as the receiver */ + { + ssize_t parse_result = hs_cell_establish_intro_parse(&cell_in, + buf, sizeof(buf)); + tt_int_op(parse_result, >=, 0); + + retval = verify_establish_intro_cell(cell_in, + circuit_key_material, + sizeof(circuit_key_material)); + tt_int_op(retval, >=, 0); + } + + done: + hs_cell_establish_intro_free(cell_out); + hs_cell_establish_intro_free(cell_in); +} + +/* Mocked ed25519_sign_prefixed() function that always fails :) */ +static int +mock_ed25519_sign_prefixed(ed25519_signature_t *signature_out, + const uint8_t *msg, size_t msg_len, + const char *prefix_str, + const ed25519_keypair_t *keypair) { + (void) signature_out; + (void) msg; + (void) msg_len; + (void) prefix_str; + (void) keypair; + return -1; +} + +/** We simulate a failure to create an ESTABLISH_INTRO cell */ +static void +test_gen_establish_intro_cell_bad(void *arg) +{ + (void) arg; + hs_cell_establish_intro_t *cell = NULL; + char circuit_key_material[DIGEST_LEN] = {0}; + + MOCK(ed25519_sign_prefixed, mock_ed25519_sign_prefixed); + + crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + + setup_full_capture_of_logs(LOG_WARN); + /* Easiest way to make that function fail is to mock the + ed25519_sign_prefixed() function and make it fail. */ + cell = generate_establish_intro_cell(circuit_key_material, + sizeof(circuit_key_material)); + expect_log_msg_containing("Unable to gen signature for " + "ESTABLISH_INTRO cell."); + teardown_capture_of_logs(); + tt_assert(!cell); + + done: + hs_cell_establish_intro_free(cell); + UNMOCK(ed25519_sign_prefixed); +} + +struct testcase_t hs_service_tests[] = { + { "gen_establish_intro_cell", test_gen_establish_intro_cell, TT_FORK, + NULL, NULL }, + { "gen_establish_intro_cell_bad", test_gen_establish_intro_cell_bad, TT_FORK, + NULL, NULL }, + + + END_OF_TESTCASES +}; +

1 0

[tor/master] crypto: Change crypto_mac_sha3_256 to use the key length in the construction
by nickm＠torproject.org 14 Dec '16

14 Dec '16

commit 118691cd47e53521319cdcbf994f29ecca3db4d1 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Dec 12 16:45:28 2016 -0500 crypto: Change crypto_mac_sha3_256 to use the key length in the construction Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/common/crypto.c | 25 ++++++++++++++++--------- src/common/crypto.h | 7 ++++--- src/or/hs_intropoint.c | 18 +++++++++--------- src/or/hs_intropoint.h | 2 +- src/or/hs_service.c | 6 +++--- src/or/hs_service.h | 2 +- src/test/test_crypto.c | 24 +++++++++++++++--------- src/test/test_hs_intropoint.c | 29 +++++++++++++++-------------- src/test/test_hs_service.c | 8 ++++---- 9 files changed, 68 insertions(+), 53 deletions(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index e4ef52d..1b1f1f9 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -2109,25 +2109,32 @@ crypto_hmac_sha256(char *hmac_out, tor_assert(rv); } -/** Compute an SHA3 MAC of msg using key as the key. The format - * used for our MAC is SHA3(k | m). Write the DIGEST256_LEN-byte result into - * mac_out of size mac_out_len. */ +/** Compute a MAC using SHA3-256 of msg_len bytes in msg using a + * key of length key_len and a salt of length + * salt_len. Store the result of len_out bytes in in + * mac_out. This function can't fail. */ void -crypto_mac_sha3_256(char *mac_out, size_t mac_out_len, - const char *key, size_t key_len, - const char *msg, size_t msg_len) +crypto_mac_sha3_256(uint8_t *mac_out, size_t len_out, + const uint8_t *key, size_t key_len, + const uint8_t *msg, size_t msg_len) { crypto_digest_t *digest; + const uint64_t key_len_netorder = tor_htonll(key_len); + tor_assert(mac_out); tor_assert(key); tor_assert(msg); digest = crypto_digest256_new(DIGEST_SHA3_256); - crypto_digest_add_bytes(digest, key, key_len); - crypto_digest_add_bytes(digest, msg, msg_len); - crypto_digest_get_digest(digest, mac_out, mac_out_len); + /* Order matters here that is any subsystem using this function should + * expect this very precise ordering in the MAC construction. */ + crypto_digest_add_bytes(digest, (const char *) &key_len_netorder, + sizeof(key_len_netorder)); + crypto_digest_add_bytes(digest, (const char *) key, key_len); + crypto_digest_add_bytes(digest, (const char *) msg, msg_len); + crypto_digest_get_digest(digest, (char *) mac_out, len_out); crypto_digest_free(digest); } diff --git a/src/common/crypto.h b/src/common/crypto.h index 32b6531..bf2fa06 100644 --- a/src/common/crypto.h +++ b/src/common/crypto.h @@ -255,9 +255,10 @@ void crypto_digest_assign(crypto_digest_t *into, void crypto_hmac_sha256(char *hmac_out, const char *key, size_t key_len, const char *msg, size_t msg_len); -void crypto_mac_sha3_256(char *mac_out, size_t mac_out_len, - const char *key, size_t key_len, - const char *msg, size_t msg_len); +void crypto_mac_sha3_256(uint8_t *mac_out, size_t len_out, + const uint8_t *key, size_t key_len, + const uint8_t *msg, size_t msg_len); + crypto_xof_t *crypto_xof_new(void); void crypto_xof_add_bytes(crypto_xof_t *xof, const uint8_t *data, size_t len); void crypto_xof_squeeze_bytes(crypto_xof_t *xof, uint8_t *out, size_t len); diff --git a/src/or/hs_intropoint.c b/src/or/hs_intropoint.c index fb8637b..b5f62aa 100644 --- a/src/or/hs_intropoint.c +++ b/src/or/hs_intropoint.c @@ -42,7 +42,7 @@ get_auth_key_from_establish_intro_cell(ed25519_public_key_t *auth_key_out, * given circuit_key_material. Return 0 on success else -1 on error. */ STATIC int verify_establish_intro_cell(const hs_cell_establish_intro_t *cell, - const char *circuit_key_material, + const uint8_t *circuit_key_material, size_t circuit_key_material_len) { /* We only reach this function if the first byte of the cell is 0x02 which @@ -62,7 +62,7 @@ verify_establish_intro_cell(const hs_cell_establish_intro_t *cell, return -1; } - const char *msg = (char*) cell->start_cell; + const uint8_t *msg = cell->start_cell; /* Verify the sig */ { @@ -79,7 +79,7 @@ verify_establish_intro_cell(const hs_cell_establish_intro_t *cell, ed25519_public_key_t auth_key; get_auth_key_from_establish_intro_cell(&auth_key, cell); - const size_t sig_msg_len = (char*) (cell->end_sig_fields) - msg; + const size_t sig_msg_len = cell->end_sig_fields - msg; int sig_mismatch = ed25519_checksig_prefixed(&sig_struct, (uint8_t*) msg, sig_msg_len, ESTABLISH_INTRO_SIG_PREFIX, @@ -92,11 +92,11 @@ verify_establish_intro_cell(const hs_cell_establish_intro_t *cell, /* Verify the MAC */ { - const size_t auth_msg_len = (char*) (cell->end_mac_fields) - msg; - char mac[DIGEST256_LEN]; + const size_t auth_msg_len = cell->end_mac_fields - msg; + uint8_t mac[DIGEST256_LEN]; crypto_mac_sha3_256(mac, sizeof(mac), - circuit_key_material, circuit_key_material_len, - msg, auth_msg_len); + circuit_key_material, circuit_key_material_len, + msg, auth_msg_len); if (tor_memneq(mac, cell->handshake_mac, sizeof(mac))) { log_warn(LD_PROTOCOL, "ESTABLISH_INTRO handshake_auth not as expected"); return -1; @@ -198,8 +198,8 @@ handle_establish_intro(or_circuit_t *circ, const uint8_t *request, } cell_ok = verify_establish_intro_cell(parsed_cell, - circ->rend_circ_nonce, - sizeof(circ->rend_circ_nonce)); + (uint8_t *) circ->rend_circ_nonce, + sizeof(circ->rend_circ_nonce)); if (cell_ok < 0) { log_warn(LD_PROTOCOL, "Failed to verify ESTABLISH_INTRO cell."); goto err; diff --git a/src/or/hs_intropoint.h b/src/or/hs_intropoint.h index 651e2dc..b7846a4 100644 --- a/src/or/hs_intropoint.h +++ b/src/or/hs_intropoint.h @@ -28,7 +28,7 @@ int hs_intro_circuit_is_suitable(const or_circuit_t *circ); STATIC int verify_establish_intro_cell(const hs_cell_establish_intro_t *out, - const char *circuit_key_material, + const uint8_t *circuit_key_material, size_t circuit_key_material_len); STATIC void diff --git a/src/or/hs_service.c b/src/or/hs_service.c index 69f83cf..6f0836c 100644 --- a/src/or/hs_service.c +++ b/src/or/hs_service.c @@ -60,7 +60,7 @@ set_cell_extensions(hs_cell_establish_intro_t *cell) * returned cell is allocated on the heap and it's the responsibility of the * caller to free it. */ STATIC hs_cell_establish_intro_t * -generate_establish_intro_cell(const char *circuit_key_material, +generate_establish_intro_cell(const uint8_t *circuit_key_material, size_t circuit_key_material_len) { hs_cell_establish_intro_t *cell = NULL; @@ -109,7 +109,7 @@ generate_establish_intro_cell(const char *circuit_key_material, /* To calculate HANDSHAKE_AUTH, we dump the cell in bytes, and then derive the MAC from it. */ uint8_t cell_bytes_tmp[RELAY_PAYLOAD_SIZE] = {0}; - char mac[TRUNNEL_SHA3_256_LEN]; + uint8_t mac[TRUNNEL_SHA3_256_LEN]; encoded_len = hs_cell_establish_intro_encode(cell_bytes_tmp, sizeof(cell_bytes_tmp), @@ -125,7 +125,7 @@ generate_establish_intro_cell(const char *circuit_key_material, /* Calculate MAC of all fields before HANDSHAKE_AUTH */ crypto_mac_sha3_256(mac, sizeof(mac), circuit_key_material, circuit_key_material_len, - (const char*)cell_bytes_tmp, + cell_bytes_tmp, encoded_len - (ED25519_SIG_LEN + 2 + TRUNNEL_SHA3_256_LEN)); /* Write the MAC to the cell */ uint8_t *handshake_ptr = diff --git a/src/or/hs_service.h b/src/or/hs_service.h index 4a76007..a54a960 100644 --- a/src/or/hs_service.h +++ b/src/or/hs_service.h @@ -17,7 +17,7 @@ #ifdef TOR_UNIT_TESTS STATIC hs_cell_establish_intro_t * -generate_establish_intro_cell(const char *circuit_key_material, +generate_establish_intro_cell(const uint8_t *circuit_key_material, size_t circuit_key_material_len); STATIC ssize_t diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index 91c55d8..d66ddcc 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -1147,28 +1147,34 @@ test_crypto_mac_sha3(void *arg) const char msg[] = "i am in a library somewhere using my computer"; const char key[] = "i'm from the past talking to the future."; - char hmac_test[DIGEST256_LEN]; + uint8_t hmac_test[DIGEST256_LEN]; char hmac_manual[DIGEST256_LEN]; (void) arg; /* First let's use our nice HMAC-SHA3 function */ crypto_mac_sha3_256(hmac_test, sizeof(hmac_test), - key, strlen(key), - msg, strlen(msg)); + (uint8_t *) key, strlen(key), + (uint8_t *) msg, strlen(msg)); - /* Now let's try a manual H(k || m) construction */ + /* Now let's try a manual H(len(k) || k || m) construction */ { - char *key_msg_concat = NULL; + char *key_msg_concat = NULL, *all = NULL; int result; + const uint64_t key_len_netorder = tor_htonll(strlen(key)); + size_t all_len; tor_asprintf(&key_msg_concat, "%s%s", key, msg); + all_len = sizeof(key_len_netorder) + strlen(key_msg_concat); + all = tor_malloc_zero(all_len); + memcpy(all, &key_len_netorder, sizeof(key_len_netorder)); + memcpy(all + sizeof(key_len_netorder), key_msg_concat, + strlen(key_msg_concat)); - result = crypto_digest256(hmac_manual, - key_msg_concat, strlen(key_msg_concat), - DIGEST_SHA3_256); - tt_int_op(result, ==, 0); + result = crypto_digest256(hmac_manual, all, all_len, DIGEST_SHA3_256); tor_free(key_msg_concat); + tor_free(all); + tt_int_op(result, ==, 0); } /* Now compare the two results */ diff --git a/src/test/test_hs_intropoint.c b/src/test/test_hs_intropoint.c index 76f9dba..608988b 100644 --- a/src/test/test_hs_intropoint.c +++ b/src/test/test_hs_intropoint.c @@ -44,12 +44,12 @@ test_establish_intro_wrong_purpose(void *arg) or_circuit_t *intro_circ = or_circuit_new(0,NULL);; uint8_t cell_body[RELAY_PAYLOAD_SIZE]; ssize_t cell_len = 0; - char circuit_key_material[DIGEST_LEN] = {0}; + uint8_t circuit_key_material[DIGEST_LEN] = {0}; (void)arg; /* Get the auth key of the intro point */ - crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + crypto_rand((char *) circuit_key_material, sizeof(circuit_key_material)); memcpy(intro_circ->rend_circ_nonce, circuit_key_material, DIGEST_LEN); /* Set a bad circuit purpose!! :) */ @@ -75,7 +75,8 @@ test_establish_intro_wrong_purpose(void *arg) /* Prepare a circuit for accepting an ESTABLISH_INTRO cell */ static void -helper_prepare_circ_for_intro(or_circuit_t *circ, char *circuit_key_material) +helper_prepare_circ_for_intro(or_circuit_t *circ, + uint8_t *circuit_key_material) { /* Prepare the circuit for the incoming ESTABLISH_INTRO */ circuit_change_purpose(TO_CIRCUIT(circ), CIRCUIT_PURPOSE_OR); @@ -88,12 +89,12 @@ test_establish_intro_wrong_keytype(void *arg) { int retval; or_circuit_t *intro_circ = or_circuit_new(0,NULL);; - char circuit_key_material[DIGEST_LEN] = {0}; + uint8_t circuit_key_material[DIGEST_LEN] = {0}; (void)arg; /* Get the auth key of the intro point */ - crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + crypto_rand((char *) circuit_key_material, sizeof(circuit_key_material)); helper_prepare_circ_for_intro(intro_circ, circuit_key_material); /* Receive the cell. Should fail. */ @@ -113,12 +114,12 @@ test_establish_intro_wrong_keytype2(void *arg) or_circuit_t *intro_circ = or_circuit_new(0,NULL);; uint8_t cell_body[RELAY_PAYLOAD_SIZE]; ssize_t cell_len = 0; - char circuit_key_material[DIGEST_LEN] = {0}; + uint8_t circuit_key_material[DIGEST_LEN] = {0}; (void)arg; /* Get the auth key of the intro point */ - crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + crypto_rand((char *) circuit_key_material, sizeof(circuit_key_material)); helper_prepare_circ_for_intro(intro_circ, circuit_key_material); /* Create outgoing ESTABLISH_INTRO cell and extract its payload so that we @@ -152,12 +153,12 @@ test_establish_intro_wrong_sig(void *arg) or_circuit_t *intro_circ = or_circuit_new(0,NULL);; uint8_t cell_body[RELAY_PAYLOAD_SIZE]; ssize_t cell_len = 0; - char circuit_key_material[DIGEST_LEN] = {0}; + uint8_t circuit_key_material[DIGEST_LEN] = {0}; (void)arg; /* Get the auth key of the intro point */ - crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + crypto_rand((char *) circuit_key_material, sizeof(circuit_key_material)); helper_prepare_circ_for_intro(intro_circ, circuit_key_material); /* Create outgoing ESTABLISH_INTRO cell and extract its payload so that we @@ -190,12 +191,12 @@ helper_establish_intro_v3(or_circuit_t *intro_circ) hs_cell_establish_intro_t *establish_intro_cell = NULL; uint8_t cell_body[RELAY_PAYLOAD_SIZE]; ssize_t cell_len = 0; - char circuit_key_material[DIGEST_LEN] = {0}; + uint8_t circuit_key_material[DIGEST_LEN] = {0}; tt_assert(intro_circ); /* Prepare the circuit for the incoming ESTABLISH_INTRO */ - crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + crypto_rand((char *) circuit_key_material, sizeof(circuit_key_material)); helper_prepare_circ_for_intro(intro_circ, circuit_key_material); /* Create outgoing ESTABLISH_INTRO cell and extract its payload so that we @@ -224,12 +225,12 @@ helper_establish_intro_v2(or_circuit_t *intro_circ) int retval; uint8_t cell_body[RELAY_PAYLOAD_SIZE]; ssize_t cell_len = 0; - char circuit_key_material[DIGEST_LEN] = {0}; + uint8_t circuit_key_material[DIGEST_LEN] = {0}; tt_assert(intro_circ); /* Prepare the circuit for the incoming ESTABLISH_INTRO */ - crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + crypto_rand((char *) circuit_key_material, sizeof(circuit_key_material)); helper_prepare_circ_for_intro(intro_circ, circuit_key_material); /* Send legacy establish_intro */ @@ -238,7 +239,7 @@ helper_establish_intro_v2(or_circuit_t *intro_circ) /* Use old circuit_key_material why not */ cell_len = encode_establish_intro_cell_legacy((char*)cell_body, key1, - circuit_key_material); + (char *) circuit_key_material); tt_int_op(cell_len, >, 0); /* Receive legacy establish_intro */ diff --git a/src/test/test_hs_service.c b/src/test/test_hs_service.c index 88c7ef2..195e506 100644 --- a/src/test/test_hs_service.c +++ b/src/test/test_hs_service.c @@ -24,12 +24,12 @@ test_gen_establish_intro_cell(void *arg) { (void) arg; int retval; - char circuit_key_material[DIGEST_LEN] = {0}; + uint8_t circuit_key_material[DIGEST_LEN] = {0}; uint8_t buf[RELAY_PAYLOAD_SIZE]; hs_cell_establish_intro_t *cell_out = NULL; hs_cell_establish_intro_t *cell_in = NULL; - crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + crypto_rand((char *) circuit_key_material, sizeof(circuit_key_material)); /* Create outgoing ESTABLISH_INTRO cell and extract its payload so that we attempt to parse it. */ @@ -79,11 +79,11 @@ test_gen_establish_intro_cell_bad(void *arg) { (void) arg; hs_cell_establish_intro_t *cell = NULL; - char circuit_key_material[DIGEST_LEN] = {0}; + uint8_t circuit_key_material[DIGEST_LEN] = {0}; MOCK(ed25519_sign_prefixed, mock_ed25519_sign_prefixed); - crypto_rand(circuit_key_material, sizeof(circuit_key_material)); + crypto_rand((char *) circuit_key_material, sizeof(circuit_key_material)); setup_full_capture_of_logs(LOG_WARN); /* Easiest way to make that function fail is to mock the

1 0

[tor/master] prop224 prepwork: Finish decoupling old ESTABLISH_INTRO creation logic.
by nickm＠torproject.org 14 Dec '16

14 Dec '16

commit e17cc3f0a6283bf9aa04e845f23ccfb8b2db24c3 Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Sep 5 17:36:12 2016 +0200 prop224 prepwork: Finish decoupling old ESTABLISH_INTRO creation logic. --- src/or/rendservice.c | 67 ++++++++++++++++++++++++++++++++++++---------------- src/or/rendservice.h | 4 +++- 2 files changed, 49 insertions(+), 22 deletions(-) diff --git a/src/or/rendservice.c b/src/or/rendservice.c index ecb1e27..e483a49 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -2986,38 +2986,55 @@ count_intro_point_circuits(const rend_service_t *service) return num_ipos; } -static size_t +/* Given a buffer of at least RELAY_PAYLOAD_SIZE bytes in cell_body_out, + write the body of a legacy ESTABLISH_INTRO cell in it. Use intro_key + as the intro point auth key, and rend_circ_nonce as the circuit + crypto material. On success, fill cell_body_out and return the number + of bytes written. On fail, return -1. + */ +STATIC ssize_t encode_establish_intro_cell_legacy(char *cell_body_out, crypto_pk_t *intro_key, char *rend_circ_nonce) { -/* Use the intro key instead of the service key in ESTABLISH_INTRO. */ - crypto_pk_t *intro_key = circuit->intro_key; + int retval = -1; + int r; + int len = 0; + char auth[DIGEST_LEN + 9]; + + tor_assert(intro_key); + tor_assert(rend_circ_nonce); + /* Build the payload for a RELAY_ESTABLISH_INTRO cell. */ - r = crypto_pk_asn1_encode(intro_key, buf+2, + r = crypto_pk_asn1_encode(intro_key, cell_body_out+2, RELAY_PAYLOAD_SIZE-2); if (r < 0) { log_warn(LD_BUG, "Internal error; failed to establish intro point."); - reason = END_CIRC_REASON_INTERNAL; goto err; } len = r; - set_uint16(buf, htons((uint16_t)len)); + set_uint16(cell_body_out, htons((uint16_t)len)); len += 2; - memcpy(auth, circuit->cpath->prev->rend_circ_nonce, DIGEST_LEN); + memcpy(auth, rend_circ_nonce, DIGEST_LEN); memcpy(auth+DIGEST_LEN, "INTRODUCE", 9); - if (crypto_digest(buf+len, auth, DIGEST_LEN+9)) - + if (crypto_digest(cell_body_out+len, auth, DIGEST_LEN+9)) goto err; len += 20; note_crypto_pk_op(REND_SERVER); - r = crypto_pk_private_sign_digest(intro_key, buf+len, sizeof(buf)-len, - buf, len); + r = crypto_pk_private_sign_digest(intro_key, cell_body_out+len, + sizeof(cell_body_out)-len, + cell_body_out, len); if (r<0) { log_warn(LD_BUG, "Internal error: couldn't sign introduction request."); - reason = END_CIRC_REASON_INTERNAL; goto err; } len += r; + + retval = len; + + err: + memwipe(auth, 0, sizeof(auth)); + + return retval; } /** Called when we're done building a circuit to an introduction point: @@ -3027,8 +3044,7 @@ void rend_service_intro_has_opened(origin_circuit_t *circuit) { rend_service_t *service; - int r; - char auth[DIGEST_LEN + 9]; + char buf[RELAY_PAYLOAD_SIZE]; char serviceid[REND_SERVICE_ID_LEN_BASE32+1]; int reason = END_CIRC_REASON_TORPROTOCOL; const char *rend_pk_digest; @@ -3103,13 +3119,24 @@ rend_service_intro_has_opened(origin_circuit_t *circuit) (unsigned)circuit->base_.n_circ_id, serviceid); circuit_log_path(LOG_INFO, LD_REND, circuit); - if (relay_send_command_from_edge(0, TO_CIRCUIT(circuit), - RELAY_COMMAND_ESTABLISH_INTRO, - buf, len, circuit->cpath->prev)<0) { - log_info(LD_GENERAL, + /* Send the ESTABLISH_INTRO cell */ + { + ssize_t len; + len = encode_establish_intro_cell_legacy(buf, circuit->intro_key, + circuit->cpath->prev->rend_circ_nonce); + if (len < 0) { + reason = END_CIRC_REASON_INTERNAL; + goto err; + } + + if (relay_send_command_from_edge(0, TO_CIRCUIT(circuit), + RELAY_COMMAND_ESTABLISH_INTRO, + buf, len, circuit->cpath->prev)<0) { + log_info(LD_GENERAL, "Couldn't send introduction request for service %s on circuit %u", serviceid, (unsigned)circuit->base_.n_circ_id); - goto done; + goto done; + } } /* We've attempted to use this circuit */ @@ -3121,7 +3148,6 @@ rend_service_intro_has_opened(origin_circuit_t *circuit) circuit_mark_for_close(TO_CIRCUIT(circuit), reason); done: memwipe(buf, 0, sizeof(buf)); - memwipe(auth, 0, sizeof(auth)); memwipe(serviceid, 0, sizeof(serviceid)); return; @@ -4284,4 +4310,3 @@ rend_service_non_anonymous_mode_enabled(const or_options_t *options) tor_assert(rend_service_non_anonymous_mode_consistent(options)); return options->HiddenServiceNonAnonymousMode ? 1 : 0; } - diff --git a/src/or/rendservice.h b/src/or/rendservice.h index 630191e..8fb3e8f 100644 --- a/src/or/rendservice.h +++ b/src/or/rendservice.h @@ -119,7 +119,9 @@ typedef struct rend_service_t { STATIC void rend_service_free(rend_service_t *service); STATIC char *rend_service_sos_poison_path(const rend_service_t *service); - +STATIC ssize_t encode_establish_intro_cell_legacy(char *cell_body_out, + crypto_pk_t *intro_key, + char *rend_circ_nonce); #endif int num_rend_services(void);

1 0

[sandboxed-tor-browser/master] Bug 20973: Silence Gdk warnings on systems with integrated png loader.
by yawning＠torproject.org 14 Dec '16

14 Dec '16

commit 0debf69a155c0c00aba63ddff0624506dcf115bf Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Wed Dec 14 20:34:31 2016 +0000 Bug 20973: Silence Gdk warnings on systems with integrated png loader. Simple enough. Do minor cleanups in the routine as well. --- ChangeLog | 1 + .../internal/sandbox/application.go | 18 ++++++++++-------- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/ChangeLog b/ChangeLog index 81e7f23..127ea5b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,5 @@ Changes in version 0.0.3 - UNRELEASED: + * Bug 20973: Silence Gdk warnings on systems with integrated png loader. * Bug 20806: Try even harder to exclude gstreamer. * Per the browser developers, the initial 7.0 alpha builds will not be ESR52 based, with a switch mid-alpha series, so keep the Grsec PaX override diff --git a/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go b/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go index 36c303e..9df10e6 100644 --- a/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go +++ b/src/cmd/sandboxed-tor-browser/internal/sandbox/application.go @@ -138,7 +138,6 @@ func RunTorBrowser(cfg *config.Config, manif *config.Manifest, tor *tor.Tor) (cm // Env vars taken from start-tor-browser. // h.setenv("LD_LIBRARY_PATH", filepath.Join(browserHome, "TorBrowser", "Tor")) - h.setenv("LD_LIBRARY_PATH", filepath.Join(browserHome, "TorBrowser", "Tor")) h.setenv("FONTCONFIG_PATH", filepath.Join(browserHome, "TorBrowser", "Data", "fontconfig")) h.setenv("FONTCONFIG_FILE", "fonts.conf") if manif.Channel == "hardened" { @@ -661,10 +660,11 @@ func (h *hugbox) appendRestrictedGtk2() ([]string, string, error) { // Figure out where the system keeps the Gtk+-2.0 theme libraries, // and bind mount in Adwaita and Pixmap. + normGtkDir := filepath.Join(restrictedLibDir, "gtk-2.0", "2.10.0") adwaitaPath := findDistributionDependentLibs(nil, engineSubDir, libAdwaita) if adwaitaPath != "" { gtkEngineDir, _ := filepath.Split(adwaitaPath) - normGtkEngineDir := filepath.Join(restrictedLibDir, "gtk-2.0", "2.10.0", "engines") + normGtkEngineDir := filepath.Join(normGtkDir, "engines") h.roBind(adwaitaPath, filepath.Join(normGtkEngineDir, libAdwaita), false) h.roBind(filepath.Join(gtkEngineDir, libPixmap), filepath.Join(normGtkEngineDir, libPixmap), true) @@ -680,7 +680,7 @@ func (h *hugbox) appendRestrictedGtk2() ([]string, string, error) { printFilePath := findDistributionDependentLibs(nil, printSubDir, libPrintFile) if printFilePath != "" { gtkPrintDir, _ := filepath.Split(printFilePath) - normGtkPrintDir := filepath.Join(restrictedLibDir, "gtk-2.0", "2.10.0", "printbackends") + normGtkPrintDir := filepath.Join(normGtkDir, "printbackends") h.roBind(printFilePath, filepath.Join(normGtkPrintDir, libPrintFile), false) setGtkPath = true @@ -697,21 +697,23 @@ func (h *hugbox) appendRestrictedGtk2() ([]string, string, error) { // Figure out if the system gdk-pixbuf-2.0 needs loaders for common // file formats. Arch and Fedora 25 do not. Debian does. As far as // I can tell, the only file format we actually care about is PNG. + normGdkDir := filepath.Join(restrictedLibDir, "gdk-pixbuf-2.0", "2.10.0") pngLoaderPath := findDistributionDependentLibs(nil, gdkSubDir, libPngLoader) if pngLoaderPath != "" { loaderDir, _ := filepath.Split(pngLoaderPath) - normGdkPath := filepath.Join(restrictedLibDir, "gdk-pixbuf-2.0", "2.10.0") - normPngLoaderPath := filepath.Join(normGdkPath, "loaders", libPngLoader) + normPngLoaderPath := filepath.Join(normGdkDir, "loaders", libPngLoader) h.roBind(pngLoaderPath, normPngLoaderPath, false) - // GDK doesn't have a nice equivalent to `GTK_PATH`, and instead has - // an env var pointing to a `loaders.cache` file. - loaderCachePath := filepath.Join(normGdkPath, "loaders.cache") + loaderCachePath := filepath.Join(normGdkDir, "loaders.cache") h.assetFile(loaderCachePath, "loaders.cache") h.setenv("GDK_PIXBUF_MODULE_FILE", loaderCachePath) gtkLibs = append(gtkLibs, libPngLoader) gtkLibPath = gtkLibPath + ":" + loaderDir + } else { + // gdk-pixbuf can display an annoying warning if, it thinks it should + // have a `loaders.cache` but doesnot. Shut it up. + h.setenv("GDK_PIXBUF_MODULE_FILE", "/dev/null") } return gtkLibs, gtkLibPath, nil

1 0

[translation/tor-browser-manual] Update translations for tor-browser-manual
by translation＠torproject.org 14 Dec '16

14 Dec '16

commit f8fe72512a37aa2de3deb45b5bacd109b4149bba Author: Translation commit bot <translation(a)torproject.org> Date: Wed Dec 14 19:18:27 2016 +0000 Update translations for tor-browser-manual --- tr/tr.po | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/tr/tr.po b/tr/tr.po index 753f91f..9b71ccd 100644 --- a/tr/tr.po +++ b/tr/tr.po @@ -7,12 +7,13 @@ # Yasin Özel <iletisim(a)yasinozel.com.tr>, 2016 # runasand <inactive+runasand(a)transifex.com>, 2016 # Ercan Erden <ercerden(a)gmail.com>, 2016 +# alibildir <alibildir(a)gmail.com>, 2016 msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "POT-Creation-Date: 2016-12-06 16:36-0600\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" -"Last-Translator: Ercan Erden <ercerden(a)gmail.com>, 2016\n" +"Last-Translator: alibildir <alibildir(a)gmail.com>, 2016\n" "Language-Team: Turkish (https://www.transifex.com/otf/teams/1519/tr/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -1099,7 +1100,7 @@ msgstr "" #: security-slider.page:73 msgid "Low" -msgstr "" +msgstr "Düşük" #: security-slider.page:74 msgid "" @@ -1193,7 +1194,7 @@ msgstr "" #: troubleshooting.page:21 msgid "Quick fixes" -msgstr "" +msgstr "Hızlı düzeltmeler" #: troubleshooting.page:22 msgid "" @@ -1286,7 +1287,7 @@ msgstr "" #: uninstalling.page:35 msgid "Empty your Trash" -msgstr "" +msgstr "çöp kutunu boşalt" #: uninstalling.page:39 msgid "" @@ -1373,7 +1374,7 @@ msgstr "" #: updating.page:58 msgid "Updating Tor Browser manually" -msgstr "" +msgstr "Tor Tarayıcı manuel güncelleniyor" #: updating.page:61 msgid ""

1 0