December 2016 - tor-commits - lists.torproject.org

[torspec/master] Merge remote-tracking branch 'dgoulet/ticket20803_01'
by nickm＠torproject.org 02 Dec '16

02 Dec '16

commit 73eaa66b3571564c9805087cdde54a292f09ea56 Merge: 2b650b6 72023fc Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 2 12:11:58 2016 -0500 Merge remote-tracking branch 'dgoulet/ticket20803_01' dir-spec.txt | 82 +++++++++++++++++ proposals/000-index.txt | 4 +- proposals/264-subprotocol-versions.txt | 2 +- tor-spec.txt | 155 +++++++++++++++++++++++++++++++++ 4 files changed, 240 insertions(+), 3 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.2.9'
by nickm＠torproject.org 02 Dec '16

02 Dec '16

commit ca4a0ae0b18c2f3f14eb7a6243b52f5769216aa0 Merge: ed4213f 907cd8a Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 2 12:10:39 2016 -0500 Merge branch 'maint-0.2.9' changes/bug20810 | 4 ++++ src/or/protover.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.2.9] protover: Fix old tor hardcoded version check
by nickm＠torproject.org 02 Dec '16

02 Dec '16

commit 907cd8a0cfb6da08450902ebb2f21db3cd65e7f7 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Nov 28 10:58:03 2016 -0500 protover: Fix old tor hardcoded version check When computing old Tor protocol line version in protover, we were looking at 0.2.7.5 twice instead of the specific case for 0.2.9.1-alpha. Fixes #20810 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/bug20810 | 4 ++++ src/or/protover.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/changes/bug20810 b/changes/bug20810 new file mode 100644 index 0000000..5420a73 --- /dev/null +++ b/changes/bug20810 @@ -0,0 +1,4 @@ + o Minor bugfixes (relay) + - When computing old Tor protocol line version in protover, we were + looking at 0.2.7.5 twice instead of a specific case for 0.2.9.1-alpha. + Bugfix on tor-0.2.9.4-alpha. diff --git a/src/or/protover.c b/src/or/protover.c index 4d7e9f6..0a4d4fb 100644 --- a/src/or/protover.c +++ b/src/or/protover.c @@ -697,7 +697,7 @@ protover_compute_for_old_tor(const char *version) if (tor_version_as_new_as(version, FIRST_TOR_VERSION_TO_ADVERTISE_PROTOCOLS)) { return ""; - } else if (tor_version_as_new_as(version, "0.2.7.5")) { + } else if (tor_version_as_new_as(version, "0.2.9.1-alpha")) { /* 0.2.9.1-alpha HSRend=2 */ return "Cons=1-2 Desc=1-2 DirCache=1 HSDir=1 HSIntro=3 HSRend=1-2 " "Link=1-4 LinkAuth=1 "

1 0

[tor/release-0.2.9] protover: Fix old tor hardcoded version check
by nickm＠torproject.org 02 Dec '16

02 Dec '16

commit 907cd8a0cfb6da08450902ebb2f21db3cd65e7f7 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Nov 28 10:58:03 2016 -0500 protover: Fix old tor hardcoded version check When computing old Tor protocol line version in protover, we were looking at 0.2.7.5 twice instead of the specific case for 0.2.9.1-alpha. Fixes #20810 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/bug20810 | 4 ++++ src/or/protover.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/changes/bug20810 b/changes/bug20810 new file mode 100644 index 0000000..5420a73 --- /dev/null +++ b/changes/bug20810 @@ -0,0 +1,4 @@ + o Minor bugfixes (relay) + - When computing old Tor protocol line version in protover, we were + looking at 0.2.7.5 twice instead of a specific case for 0.2.9.1-alpha. + Bugfix on tor-0.2.9.4-alpha. diff --git a/src/or/protover.c b/src/or/protover.c index 4d7e9f6..0a4d4fb 100644 --- a/src/or/protover.c +++ b/src/or/protover.c @@ -697,7 +697,7 @@ protover_compute_for_old_tor(const char *version) if (tor_version_as_new_as(version, FIRST_TOR_VERSION_TO_ADVERTISE_PROTOCOLS)) { return ""; - } else if (tor_version_as_new_as(version, "0.2.7.5")) { + } else if (tor_version_as_new_as(version, "0.2.9.1-alpha")) { /* 0.2.9.1-alpha HSRend=2 */ return "Cons=1-2 Desc=1-2 DirCache=1 HSDir=1 HSIntro=3 HSRend=1-2 " "Link=1-4 LinkAuth=1 "

1 0

[tor/release-0.2.9] Merge branch 'maint-0.2.9' into release-0.2.9
by nickm＠torproject.org 02 Dec '16

02 Dec '16

commit 567852fcde278c5be4ec1bea8b2ed8144fd48e62 Merge: ef7df10 907cd8a Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 2 12:10:33 2016 -0500 Merge branch 'maint-0.2.9' into release-0.2.9 changes/bug20810 | 4 ++++ src/or/protover.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-)

1 0

[tor/master] protover: Fix old tor hardcoded version check
by nickm＠torproject.org 02 Dec '16

02 Dec '16

commit 907cd8a0cfb6da08450902ebb2f21db3cd65e7f7 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Nov 28 10:58:03 2016 -0500 protover: Fix old tor hardcoded version check When computing old Tor protocol line version in protover, we were looking at 0.2.7.5 twice instead of the specific case for 0.2.9.1-alpha. Fixes #20810 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/bug20810 | 4 ++++ src/or/protover.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/changes/bug20810 b/changes/bug20810 new file mode 100644 index 0000000..5420a73 --- /dev/null +++ b/changes/bug20810 @@ -0,0 +1,4 @@ + o Minor bugfixes (relay) + - When computing old Tor protocol line version in protover, we were + looking at 0.2.7.5 twice instead of a specific case for 0.2.9.1-alpha. + Bugfix on tor-0.2.9.4-alpha. diff --git a/src/or/protover.c b/src/or/protover.c index 4d7e9f6..0a4d4fb 100644 --- a/src/or/protover.c +++ b/src/or/protover.c @@ -697,7 +697,7 @@ protover_compute_for_old_tor(const char *version) if (tor_version_as_new_as(version, FIRST_TOR_VERSION_TO_ADVERTISE_PROTOCOLS)) { return ""; - } else if (tor_version_as_new_as(version, "0.2.7.5")) { + } else if (tor_version_as_new_as(version, "0.2.9.1-alpha")) { /* 0.2.9.1-alpha HSRend=2 */ return "Cons=1-2 Desc=1-2 DirCache=1 HSDir=1 HSIntro=3 HSRend=1-2 " "Link=1-4 LinkAuth=1 "

1 0

[tor/master] Fetch unknown certificates if FetchUselessDescriptors is true
by nickm＠torproject.org 02 Dec '16

02 Dec '16

commit 65d793fab2bf0a58d00080df8320693cb3a2dbeb Author: teor <teor2345(a)gmail.com> Date: Wed Nov 30 11:07:48 2016 +1100 Fetch unknown certificates if FetchUselessDescriptors is true --- src/or/dirserv.c | 4 +++- src/or/networkstatus.c | 23 +++++++++++++++++++++++ src/or/networkstatus.h | 1 + src/or/routerlist.c | 9 +++++---- 4 files changed, 32 insertions(+), 5 deletions(-) diff --git a/src/or/dirserv.c b/src/or/dirserv.c index 57ef1b1..e2a6943 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -1069,8 +1069,10 @@ directory_fetches_dir_info_later(const or_options_t *options) return options->UseBridges != 0; } -/** Return true iff we want to fetch and keep certificates for authorities +/** Return true iff we want to serve certificates for authorities * that we don't acknowledge as authorities ourself. + * Use we_want_to_fetch_unknown_auth_certs to check if we want to fetch + * and keep these certificates. */ int directory_caches_unknown_auth_certs(const or_options_t *options) diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c index 6cbcaf8..10157c6 100644 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@ -840,6 +840,29 @@ we_want_to_fetch_flavor(const or_options_t *options, int flavor) return flavor == usable_consensus_flavor(); } +/** Return true iff, given the options listed in options, we would like + * to fetch and store unknown authority certificates. + * + * For consensus and descriptor fetches, use we_want_to_fetch_flavor, and + * for serving fetched certificates, use directory_caches_unknown_auth_certs. + */ +int +we_want_to_fetch_unknown_auth_certs(const or_options_t *options) +{ + if (authdir_mode_v3(options) || + directory_caches_unknown_auth_certs((options))) { + /* We want to serve all certs to others, regardless if we would use + * them ourselves. */ + return 1; + } + if (options->FetchUselessDescriptors) { + /* Unknown certificates are definitely useless. */ + return 1; + } + /* Otherwise, don't fetch unknown certificates. */ + return 0; +} + /** How long will we hang onto a possibly live consensus for which we're * fetching certs before we check whether there is a better one? */ #define DELAY_WHILE_FETCHING_CERTS (20*60) diff --git a/src/or/networkstatus.h b/src/or/networkstatus.h index e23eeef..454356e 100644 --- a/src/or/networkstatus.h +++ b/src/or/networkstatus.h @@ -67,6 +67,7 @@ const routerstatus_t *router_get_consensus_status_by_nickname( const char *networkstatus_get_router_digest_by_nickname(const char *nickname); int networkstatus_nickname_is_unnamed(const char *nickname); int we_want_to_fetch_flavor(const or_options_t *options, int flavor); +int we_want_to_fetch_unknown_auth_certs(const or_options_t *options); void networkstatus_consensus_download_failed(int status_code, const char *flavname); void update_consensus_networkstatus_fetch_time(time_t now); diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 7508c4b..9d5b74d 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -586,7 +586,7 @@ trusted_dirs_load_certs_from_string(const char *contents, int source, "signing key %s", from_store ? "cached" : "downloaded", ds->nickname, hex_str(cert->signing_key_digest,DIGEST_LEN)); } else { - int adding = directory_caches_unknown_auth_certs(get_options()); + int adding = we_want_to_fetch_unknown_auth_certs(get_options()); log_info(LD_DIR, "%s %s certificate for unrecognized directory " "authority with signing key %s", adding ? "Adding" : "Not adding", @@ -1012,7 +1012,7 @@ authority_certs_fetch_missing(networkstatus_t *status, time_t now, char *resource = NULL; cert_list_t *cl; const or_options_t *options = get_options(); - const int cache = directory_caches_unknown_auth_certs(options); + const int keep_unknown = we_want_to_fetch_unknown_auth_certs(options); fp_pair_t *fp_tmp = NULL; char id_digest_str[2*DIGEST_LEN+1]; char sk_digest_str[2*DIGEST_LEN+1]; @@ -1084,9 +1084,10 @@ authority_certs_fetch_missing(networkstatus_t *status, time_t now, if (!smartlist_len(voter->sigs)) continue; /* This authority never signed this consensus, so don't * go looking for a cert with key digest 0000000000. */ - if (!cache && + if (!keep_unknown && !trusteddirserver_get_by_v3_auth_digest(voter->identity_digest)) - continue; /* We are not a cache, and we don't know this authority.*/ + continue; /* We don't want unknown certs, and we don't know this + * authority.*/ /* * If we don't know *any* cert for this authority, and a download by ID

1 0

[tor/master] Stop discarding consensus flavors and descriptors we wanted to fetch
by nickm＠torproject.org 02 Dec '16

02 Dec '16

commit e5c608e535ef9a4c4fe951a277e3891c77de4908 Author: teor <teor2345(a)gmail.com> Date: Wed Nov 30 11:06:36 2016 +1100 Stop discarding consensus flavors and descriptors we wanted to fetch Instead, fetch and store consensus flavors and descriptors we wanted to fetch. And serve them if we are a directory cache (or authority). --- src/or/control.c | 2 +- src/or/dirserv.c | 5 ++++- src/or/networkstatus.c | 15 +++++++++------ src/or/networkstatus.h | 1 + src/or/routerlist.c | 2 +- 5 files changed, 16 insertions(+), 9 deletions(-) diff --git a/src/or/control.c b/src/or/control.c index f0cb435..a221131 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -2029,7 +2029,7 @@ getinfo_helper_dir(control_connection_t *control_conn, } else if (!strcmpstart(question, "dir/status/")) { *answer = tor_strdup(""); } else if (!strcmp(question, "dir/status-vote/current/consensus")) { /* v3 */ - if (directory_caches_dir_info(get_options())) { + if (we_want_to_fetch_flavor(get_options(), FLAV_NS)) { const cached_dir_t *consensus = dirserv_get_consensus("ns"); if (consensus) *answer = tor_strdup(consensus->dir); diff --git a/src/or/dirserv.c b/src/or/dirserv.c index 7ff37b4..57ef1b1 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -1078,11 +1078,14 @@ directory_caches_unknown_auth_certs(const or_options_t *options) return dir_server_mode(options) || options->BridgeRelay; } -/** Return 1 if we want to keep descriptors, networkstatuses, etc around. +/** Return 1 if we want to fetch and serve descriptors, networkstatuses, etc * Else return 0. * Check options->DirPort_set and directory_permits_begindir_requests() * to see if we are willing to serve these directory documents to others via * the DirPort and begindir-over-ORPort, respectively. + * + * To check if we should fetch documents, use we_want_to_fetch_flavor and + * we_want_to_fetch_unknown_auth_certs instead of this function. */ int directory_caches_dir_info(const or_options_t *options) diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c index 316ce48..6cbcaf8 100644 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@ -814,8 +814,11 @@ networkstatus_nickname_is_unnamed(const char *nickname) #define NONAUTHORITY_NS_CACHE_INTERVAL (60*60) /** Return true iff, given the options listed in options, flavor - * is the flavor of a consensus networkstatus that we would like to fetch. */ -static int + * is the flavor of a consensus networkstatus that we would like to fetch. + * + * For certificate fetches, use we_want_to_fetch_unknown_auth_certs, and + * for serving fetched documents, use directory_caches_dir_info. */ +int we_want_to_fetch_flavor(const or_options_t *options, int flavor) { if (flavor < 0 || flavor > N_CONSENSUS_FLAVORS) { @@ -1728,9 +1731,9 @@ networkstatus_set_current_consensus(const char *consensus, } if (flav != usable_consensus_flavor() && - !directory_caches_dir_info(options)) { - /* This consensus is totally boring to us: we won't use it, and we won't - * serve it. Drop it. */ + !we_want_to_fetch_flavor(options, flav)) { + /* This consensus is totally boring to us: we won't use it, we didn't want + * it, and we won't serve it. Drop it. */ goto done; } @@ -1932,7 +1935,7 @@ networkstatus_set_current_consensus(const char *consensus, download_status_failed(&consensus_dl_status[flav], 0); } - if (directory_caches_dir_info(options)) { + if (we_want_to_fetch_flavor(options, flav)) { dirserv_set_cached_consensus_networkstatus(consensus, flavor, &c->digests, diff --git a/src/or/networkstatus.h b/src/or/networkstatus.h index 71f36b6..e23eeef 100644 --- a/src/or/networkstatus.h +++ b/src/or/networkstatus.h @@ -66,6 +66,7 @@ const routerstatus_t *router_get_consensus_status_by_nickname( int warn_if_unnamed); const char *networkstatus_get_router_digest_by_nickname(const char *nickname); int networkstatus_nickname_is_unnamed(const char *nickname); +int we_want_to_fetch_flavor(const or_options_t *options, int flavor); void networkstatus_consensus_download_failed(int status_code, const char *flavname); void update_consensus_networkstatus_fetch_time(time_t now); diff --git a/src/or/routerlist.c b/src/or/routerlist.c index c99d22e..7508c4b 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -5154,7 +5154,7 @@ update_consensus_router_descriptor_downloads(time_t now, int is_vote, ++n_would_reject; continue; /* We would throw it out immediately. */ } - if (!directory_caches_dir_info(options) && + if (!we_want_to_fetch_flavor(options, consensus->flavor) && !client_would_use_router(rs, now, options)) { ++n_wouldnt_use; continue; /* We would never use it ourself. */

1 0

[tor/master] Stop discarding downloaded full descriptors when using microdescs for circuits
by nickm＠torproject.org 02 Dec '16

02 Dec '16

commit 04f794489107bab6316d60ade7228d4443beb3a6 Author: teor <teor2345(a)gmail.com> Date: Wed Nov 30 12:20:28 2016 +1100 Stop discarding downloaded full descriptors when using microdescs for circuits This affects clients with FetchUselessDescriptors 1. It might also cause subtle bugs on directory mirrors and authorities, causing them to consider all full descriptors as failed or old. --- changes/bug20839 | 5 +++++ src/or/routerlist.c | 9 +++++---- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/changes/bug20839 b/changes/bug20839 new file mode 100644 index 0000000..c290097 --- /dev/null +++ b/changes/bug20839 @@ -0,0 +1,5 @@ + o Minor bugfixes (descriptors): + - Correctly recognise downloaded full descriptors as valid, even when + using microdescriptors as circuits. This affects clients with + FetchUselessDescriptors set, and may affect directory authorities. + Fixes bug 20839; bugfix on commit 6083276 in 0.2.3.2-alpha. diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 9d5b74d..9bcca76 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -3896,7 +3896,7 @@ router_add_to_routerlist(routerinfo_t *router, const char **msg, router_describe(router)); *msg = "Router descriptor is not referenced by any network-status."; - /* Only journal this desc if we'll be serving it. */ + /* Only journal this desc if we want to keep old descriptors */ if (!from_cache && should_cache_old_descriptors()) signed_desc_append_to_journal(&router->cache_info, &routerlist->desc_store); @@ -4526,13 +4526,14 @@ router_load_extrainfo_from_string(const char *s, const char *eos, smartlist_free(extrainfo_list); } -/** Return true iff any networkstatus includes a descriptor whose digest - * is that of desc. */ +/** Return true iff the latest ns-flavored consensus includes a descriptor + * whose digest is that of desc. */ static int signed_desc_digest_is_recognized(signed_descriptor_t *desc) { const routerstatus_t *rs; - networkstatus_t *consensus = networkstatus_get_latest_consensus(); + networkstatus_t *consensus = networkstatus_get_latest_consensus_by_flavor( + FLAV_NS); if (consensus) { rs = networkstatus_vote_find_entry(consensus, desc->identity_digest);

1 0

[tor/master] Remove an unneccessary FetchUselessDescriptors check in client_would_use_router
by nickm＠torproject.org 02 Dec '16

02 Dec '16

commit e061cf4d1d7e9d8533cde936f0904d4f7b877746 Author: teor <teor2345(a)gmail.com> Date: Wed Nov 30 11:43:04 2016 +1100 Remove an unneccessary FetchUselessDescriptors check in client_would_use_router --- src/or/networkstatus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c index 10157c6..bfb3641 100644 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@ -2407,9 +2407,9 @@ int client_would_use_router(const routerstatus_t *rs, time_t now, const or_options_t *options) { - if (!rs->is_flagged_running && !options->FetchUselessDescriptors) { + if (!rs->is_flagged_running) { /* If we had this router descriptor, we wouldn't even bother using it. - * But, if we want to have a complete list, fetch it anyway. */ + * (Fetching and storing depends on by we_want_to_fetch_flavor().) */ return 0; } if (rs->published_on + options->TestingEstimatedDescriptorPropagationTime

1 0