December 2016 - tor-commits - lists.torproject.org

[tor/master] Add a separate, non-fractional, limit to the sampled guard set size.
by nickm＠torproject.org 16 Dec '16

16 Dec '16

commit 2e2f3a4d99885c0d348024dc85ed6ef064a62ace Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 8 10:02:19 2016 -0500 Add a separate, non-fractional, limit to the sampled guard set size. Letting the maximum sample size grow proportionally to the number of guards defeats its purpose to a certain extent. Noted by asn during code review. Fixes bug 20920; bug not in any released (or merged) version of Tor. --- src/or/entrynodes.c | 14 +++++++++++++- src/or/entrynodes.h | 8 +++++++- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index f41464a..3249ce2 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -402,6 +402,16 @@ get_max_sample_threshold(void) return pct / 100.0; } /** + * We never let our sampled guard set grow larger than this number. + */ +STATIC int +get_max_sample_size_absolute(void) +{ + return (int) networkstatus_get_param(NULL, "guard-max-sample-size", + DFLT_MAX_SAMPLE_SIZE, + 1, INT32_MAX); +} +/** * We always try to make our sample contain at least this many guards. * * XXXX prop271 spec deviation There was a MIN_SAMPLE_THRESHOLD in the @@ -937,7 +947,9 @@ get_max_sample_size(guard_selection_t *gs, if (using_bridges) return n_guards; - const int max_sample = (int)(n_guards * get_max_sample_threshold()); + const int max_sample_by_pct = (int)(n_guards * get_max_sample_threshold()); + const int max_sample_absolute = get_max_sample_size_absolute(); + const int max_sample = MIN(max_sample_by_pct, max_sample_absolute); if (max_sample < min_sample) // XXXX prop271 spec deviation return min_sample; else diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index 1133525..d7dc014 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -440,7 +440,12 @@ int num_bridges_usable(void); * We never let our sampled guard set grow larger than this percentage * of the guards on the network. */ -#define DFLT_MAX_SAMPLE_THRESHOLD_PERCENT 30 +#define DFLT_MAX_SAMPLE_THRESHOLD_PERCENT 20 +/** + * We never let our sampled guard set grow larger than this number of + * guards. + */ +#define DFLT_MAX_SAMPLE_SIZE 60 /** * We always try to make our sample contain at least this many guards. * @@ -495,6 +500,7 @@ int num_bridges_usable(void); /**@}*/ STATIC double get_max_sample_threshold(void); +STATIC int get_max_sample_size_absolute(void); STATIC int get_min_filtered_sample_size(void); STATIC int get_remove_unlisted_guards_after_days(void); STATIC int get_guard_lifetime_days(void);

1 0

[tor/master] guard->nickname is never NULL.
by nickm＠torproject.org 16 Dec '16

16 Dec '16

commit 4ec9751c144465f6f70450545d68372f35f2ba78 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Dec 16 11:25:59 2016 -0500 guard->nickname is never NULL. --- src/or/entrynodes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 4c68247..ee904ac 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -341,7 +341,7 @@ entry_guard_describe(const entry_guard_t *guard) static char buf[256]; tor_snprintf(buf, sizeof(buf), "%s ($%s)", - guard->nickname ? guard->nickname : "[bridge]", + strlen(guard->nickname) ? guard->nickname : "[bridge]", hex_str(guard->identity, DIGEST_LEN)); return buf; }

1 0

[tor/master] Tests for choosing which guard_selection to use
by nickm＠torproject.org 16 Dec '16

16 Dec '16

commit 72dc2ae319f66d3b4dec59709c28605912c6bc56 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Nov 30 14:11:36 2016 -0500 Tests for choosing which guard_selection to use --- src/test/test_entrynodes.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/src/test/test_entrynodes.c b/src/test/test_entrynodes.c index e443210..fbb3b13 100644 --- a/src/test/test_entrynodes.c +++ b/src/test/test_entrynodes.c @@ -1528,6 +1528,48 @@ test_entry_guard_get_guard_selection_by_name(void *arg) } static void +test_entry_guard_choose_selection_initial(void *arg) +{ + /* Tests for picking our initial guard selection (based on having had + * no previous selection */ + (void)arg; + guard_selection_type_t type = GS_TYPE_INFER; + const char *name = choose_guard_selection(get_options(), + dummy_consensus, NULL, &type); + tt_str_op(name, OP_EQ, "default"); + tt_int_op(type, OP_EQ, GS_TYPE_NORMAL); + + /* If we're using bridges, we get the bridge selection. */ + get_options_mutable()->UseBridges = 1; + name = choose_guard_selection(get_options(), + dummy_consensus, NULL, &type); + tt_str_op(name, OP_EQ, "bridges"); + tt_int_op(type, OP_EQ, GS_TYPE_BRIDGE); + get_options_mutable()->UseBridges = 0; + + /* If we're using legacy guards, we get the legacy selection */ + get_options_mutable()->UseDeprecatedGuardAlgorithm = 1; + name = choose_guard_selection(get_options(), + dummy_consensus, NULL, &type); + tt_str_op(name, OP_EQ, "legacy"); + tt_int_op(type, OP_EQ, GS_TYPE_LEGACY); + get_options_mutable()->UseDeprecatedGuardAlgorithm = 0; + + /* If we discard >99% of our guards, though, we should be in the restricted + * set. */ + tt_assert(get_options_mutable()->EntryNodes == NULL); + get_options_mutable()->EntryNodes = routerset_new(); + routerset_parse(get_options_mutable()->EntryNodes, "1.0.0.0/8", "foo"); + name = choose_guard_selection(get_options(), + dummy_consensus, NULL, &type); + tt_str_op(name, OP_EQ, "restricted"); + tt_int_op(type, OP_EQ, GS_TYPE_RESTRICTED); + + done: + ; +} + +static void test_entry_guard_add_single_guard(void *arg) { (void)arg; @@ -3360,6 +3402,7 @@ struct testcase_t entrynodes_tests[] = { test_entry_guard_parse_from_state_broken, TT_FORK, NULL, NULL }, { "get_guard_selection_by_name", test_entry_guard_get_guard_selection_by_name, TT_FORK, NULL, NULL }, + BFN_TEST(choose_selection_initial), BFN_TEST(add_single_guard), BFN_TEST(node_filter), BFN_TEST(expand_sample),

1 0

[tor/master] Don't make $hexid nicknames persistent.
by nickm＠torproject.org 16 Dec '16

16 Dec '16

commit 52e196bab56d97f31e3fd24f187f842ac08cf7b7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Nov 30 13:10:35 2016 -0500 Don't make $hexid nicknames persistent. (That's asking for trouble, and also totally completely redundant.) --- src/or/entrynodes.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 1f6d562..78257ca 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -2420,7 +2420,7 @@ entry_guard_encode_for_state(entry_guard_t *guard) fmt_and_decorate_addr(&guard->bridge_addr->addr), guard->bridge_addr->port); } - if (strlen(guard->nickname)) { + if (strlen(guard->nickname) && is_legal_nickname(guard->nickname)) { smartlist_add_asprintf(result, "nickname=%s", guard->nickname); }

1 0

[tor/master] Move a TODO comment into doxygen comments.
by nickm＠torproject.org 16 Dec '16

16 Dec '16

commit b7088e5b5add8bf3b6f783ec37ce7cd231476b35 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Dec 7 13:57:04 2016 -0500 Move a TODO comment into doxygen comments. --- src/or/entrynodes.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index bcf4182..ad9242e 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -630,8 +630,9 @@ choose_guard_selection(const or_options_t *options, * Check whether we should switch from our current guard selection to a * different one. If so, switch and return 1. Return 0 otherwise. * - * On a 1 return, the caller should mark all currently live circuits - * unusable for new streams. + * On a 1 return, the caller should mark all currently live circuits unusable + * for new streams, by calling circuit_mark_all_unused_circs() and + * circuit_mark_all_dirty_circs_as_unusable(). */ int update_guard_selection_choice(const or_options_t *options) @@ -665,12 +666,6 @@ update_guard_selection_choice(const or_options_t *options) tor_assert(new_guard_context != curr_guard_context); curr_guard_context = new_guard_context; - /* - Be sure to call: - circuit_mark_all_unused_circs(); - circuit_mark_all_dirty_circs_as_unusable(); - */ - return 1; } @@ -4879,7 +4874,9 @@ entries_retry_all(const or_options_t *options) /** Helper: Update the status of all entry guards, in whatever algorithm * is used. Return true if we should stop using all previously generated - * circuits. */ + * circuits, by calling circuit_mark_all_unused_circs() and + * circuit_mark_all_dirty_circs_as_unusable(). + */ int guards_update_all(void) {

1 0

[tor/master] Rewrite state transition logic in entry_guards_note_success()
by nickm＠torproject.org 16 Dec '16

16 Dec '16

commit fc7751a989681fbf0f94387c070cced261a83c9c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 8 10:22:23 2016 -0500 Rewrite state transition logic in entry_guards_note_success() asn found while testing that this function can be reached with GUARD_STATE_COMPLETE circuits; I believe this happens when cannibalization occurs. The added complexity of handling one more state made it reasonable to turn the main logic here into a switch statement. --- src/or/entrynodes.c | 40 +++++++++++++++++++++++----------------- 1 file changed, 23 insertions(+), 17 deletions(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 3249ce2..cf85dad 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1927,25 +1927,31 @@ entry_guards_note_guard_success(guard_selection_t *gs, } unsigned new_state; - if (old_state == GUARD_CIRC_STATE_USABLE_ON_COMPLETION) { - new_state = GUARD_CIRC_STATE_COMPLETE; - } else { - tor_assert_nonfatal( - old_state == GUARD_CIRC_STATE_USABLE_IF_NO_BETTER_GUARD); - - if (guard->is_primary) { - /* XXXX prop271 -- I don't actually like this logic. It seems to make us - * a little more susceptible to evil-ISP attacks. The mitigations I'm - * thinking of, however, aren't local to this point, so I'll leave it - * alone. */ - /* This guard may have become primary by virtue of being confirmed. - If so, the circuit for it is now complete. - */ + switch (old_state) { + case GUARD_CIRC_STATE_COMPLETE: + case GUARD_CIRC_STATE_USABLE_ON_COMPLETION: new_state = GUARD_CIRC_STATE_COMPLETE; - } else { - new_state = GUARD_CIRC_STATE_WAITING_FOR_BETTER_GUARD; - } + break; + default: + tor_assert_nonfatal_unreached(); + /* Fall through. */ + case GUARD_CIRC_STATE_USABLE_IF_NO_BETTER_GUARD: + if (guard->is_primary) { + /* XXXX prop271 -- I don't actually like this logic. It seems to make + * us a little more susceptible to evil-ISP attacks. The mitigations + * I'm thinking of, however, aren't local to this point, so I'll leave + * it alone. */ + /* This guard may have become primary by virtue of being confirmed. + * If so, the circuit for it is now complete. + */ + new_state = GUARD_CIRC_STATE_COMPLETE; + } else { + new_state = GUARD_CIRC_STATE_WAITING_FOR_BETTER_GUARD; + } + break; + } + if (! guard->is_primary) { if (last_time_on_internet + get_internet_likely_down_interval() < approx_time()) { mark_primary_guards_maybe_reachable(gs);

1 0

[tor/master] No need to say success/failure when recording failure; remove returnval
by nickm＠torproject.org 16 Dec '16

16 Dec '16

commit 4689096ed165e893a541b11520b347fc03e39db0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 21 17:19:29 2016 -0500 No need to say success/failure when recording failure; remove returnval (We can fail at succeeding, but there's no plausible way to fail at failing) --- src/or/entrynodes.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 2b6fd51..cda5540 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1350,10 +1350,9 @@ entry_guard_succeeded(guard_selection_t *gs, /** * Called by the circuit building module when a circuit has succeeded: * informs the guards code that the guard in *guard_state_p is - * not working, and advances the state of the guard module. Return -1 on - * bug or inconsistency; 0 on success. + * not working, and advances the state of the guard module. */ -int +void entry_guard_failed(guard_selection_t *gs, circuit_guard_state_t **guard_state_p) { @@ -1361,16 +1360,17 @@ entry_guard_failed(guard_selection_t *gs, return; if (BUG(*guard_state_p == NULL)) - return -1; + return; entry_guard_t *guard = entry_guard_handle_get((*guard_state_p)->guard); if (! guard) - return -1; + return; entry_guards_note_guard_failure(gs, guard); (*guard_state_p)->state = GUARD_CIRC_STATE_DEAD; (*guard_state_p)->state_set_at = approx_time(); +} /** * Run the entry_guard_failed() function on every circuit that is

1 0

[tor/master] New entry_guard_chan_failed function
by nickm＠torproject.org 16 Dec '16

16 Dec '16

commit af1918d28999c2c38ace984296927d9244c7c7b1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 21 17:18:35 2016 -0500 New entry_guard_chan_failed function To be called when an entire channel has failed: tell any/all circuits pending for the guard of that channel that they have failed. --- src/or/entrynodes.c | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 4a99897..2b6fd51 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -124,6 +124,7 @@ #include "bridges.h" #include "circpathbias.h" #include "circuitbuild.h" +#include "circuitlist.h" #include "circuitstats.h" #include "config.h" #include "confparse.h" @@ -1371,7 +1372,30 @@ entry_guard_failed(guard_selection_t *gs, (*guard_state_p)->state = GUARD_CIRC_STATE_DEAD; (*guard_state_p)->state_set_at = approx_time(); - return 0; +/** + * Run the entry_guard_failed() function on every circuit that is + * pending on chan. + */ +void +entry_guard_chan_failed(guard_selection_t *gs, + channel_t *chan) +{ + tor_assert(gs); + if (!chan) + return; + if (get_options()->UseDeprecatedGuardAlgorithm) + return; + + smartlist_t *pending = smartlist_new(); + circuit_get_all_pending_on_channel(pending, chan); + SMARTLIST_FOREACH_BEGIN(pending, circuit_t *, circ) { + if (!CIRCUIT_IS_ORIGIN(circ)) + continue; + + origin_circuit_t *origin_circ = TO_ORIGIN_CIRCUIT(circ); + entry_guard_failed(gs, &origin_circ->guard_state); + } SMARTLIST_FOREACH_END(circ); + smartlist_free(pending); } /**

1 0

[tor/master] Function to cancel a guard state.
by nickm＠torproject.org 16 Dec '16

16 Dec '16

commit 8e43398986313f31bfda53aa798263972bf24c11 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Nov 22 10:03:18 2016 -0500 Function to cancel a guard state. We'll want to use this if we allocate a guard state then decide, "whoops, we don't want to use this." --- src/or/entrynodes.c | 23 +++++++++++++++++++++++ src/or/entrynodes.h | 2 ++ 2 files changed, 25 insertions(+) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index cda5540..24a3448 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1347,6 +1347,29 @@ entry_guard_succeeded(guard_selection_t *gs, } } +/** Cancel the selection of *guard_state_p without declaring + * success or failure. It is safe to call this function if success or + * failure _has_ already been declared. */ +void +entry_guard_cancel(guard_selection_t *gs, + circuit_guard_state_t **guard_state_p) +{ + (void) gs; + if (get_options()->UseDeprecatedGuardAlgorithm) + return; + if (BUG(*guard_state_p == NULL)) + return; + entry_guard_t *guard = entry_guard_handle_get((*guard_state_p)->guard); + if (! guard) + return; + + /* XXXX prop271 -- last_tried_to_connect_at will be erroneous here, but this + * function will only get called in "bug" cases anyway. */ + guard->is_pending = 0; + circuit_guard_state_free(*guard_state_p); + *guard_state_p = NULL; +} + /** * Called by the circuit building module when a circuit has succeeded: * informs the guards code that the guard in *guard_state_p is diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index 7119d54..60191ab 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -322,6 +322,8 @@ int entry_guard_succeeded(guard_selection_t *gs, circuit_guard_state_t **guard_state_p); void entry_guard_failed(guard_selection_t *gs, circuit_guard_state_t **guard_state_p); +void entry_guard_cancel(guard_selection_t *gs, + circuit_guard_state_t **guard_state_p); void entry_guard_chan_failed(guard_selection_t *gs, channel_t *chan); void entry_guards_update_all(guard_selection_t *gs);

1 0

[tor/master] Rebuild the guard lists as appropriate on torrc change.
by nickm＠torproject.org 16 Dec '16

16 Dec '16

commit 897626953b15ac216d27b3814804524caa9fdd1c Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Nov 23 09:09:30 2016 -0500 Rebuild the guard lists as appropriate on torrc change. (Also, prepare to tie guard changes into the mark-all-old-circuits logic.) --- src/or/config.c | 43 +++++++++++++++++++++++++++++++++++++++++++ src/or/entrynodes.c | 17 ++++++++++++----- src/or/entrynodes.h | 4 ++-- src/or/main.c | 5 ++++- 4 files changed, 61 insertions(+), 8 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index f77f4d1..b7b5cff 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -1561,6 +1561,36 @@ options_transition_requires_fresh_tls_context(const or_options_t *old_options, return 0; } +/** + * Return true if changing the configuration from old to new + * affects the guard susbsystem. + */ +static int +options_transition_affects_guards(const or_options_t *old, + const or_options_t *new) +{ + /* NOTE: Make sure this function stays in sync with + * entry_guards_set_filtered_flags */ + + tor_assert(old); + tor_assert(new); + + return + (old->UseEntryGuards != new->UseEntryGuards || + old->UseDeprecatedGuardAlgorithm != new->UseDeprecatedGuardAlgorithm || + old->UseBridges != new->UseBridges || + old->UseEntryGuards != new->UseEntryGuards || + old->ClientUseIPv4 != new->ClientUseIPv4 || + old->ClientUseIPv6 != new->ClientUseIPv6 || + old->FascistFirewall != new->FascistFirewall || + !routerset_equal(old->ExcludeNodes, new->ExcludeNodes) || + !routerset_equal(old->EntryNodes, new->EntryNodes) || + !smartlist_strings_eq(old->FirewallPorts, new->FirewallPorts) || + !config_lines_eq(old->Bridges, new->Bridges) || + !config_lines_eq(old->ReachableORAddresses, new->ReachableORAddresses) || + !config_lines_eq(old->ReachableDirAddresses, new->ReachableDirAddresses)); +} + /** Fetch the active option list, and take actions based on it. All of the * things we do should survive being done repeatedly. If present, * old_options contains the previous value of the options. @@ -1580,6 +1610,8 @@ options_act(const or_options_t *old_options) const int transition_affects_workers = old_options && options_transition_affects_workers(old_options, options); int old_ewma_enabled; + const int transition_affects_guards = + old_options && options_transition_affects_guards(old_options, options); /* disable ptrace and later, other basic debugging techniques */ { @@ -1875,6 +1907,7 @@ options_act(const or_options_t *old_options) if (old_options) { int revise_trackexithosts = 0; int revise_automap_entries = 0; + int abandon_circuits = 0; if ((options->UseEntryGuards && !old_options->UseEntryGuards) || options->UseBridges != old_options->UseBridges || (options->UseBridges && @@ -1891,6 +1924,16 @@ options_act(const or_options_t *old_options) "Changed to using entry guards or bridges, or changed " "preferred or excluded node lists. " "Abandoning previous circuits."); + abandon_circuits = 1; + } + + if (transition_affects_guards) { + if (guards_update_all()) { + abandon_circuits = 1; + } + } + + if (abandon_circuits) { circuit_mark_all_unused_circs(); circuit_mark_all_dirty_circs_as_unusable(); revise_trackexithosts = 1; diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 81751f5..9a753e6 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -91,7 +91,7 @@ * * [x] Whenever we get a new consensus, call update_from_consensus(). (LATER.) * - * [ ] Whenever the configuration changes in a relevant way, update the + * [x] Whenever the configuration changes in a relevant way, update the * filtered/usable flags. (LATER.) * * [x] Whenever we add a guard to the sample, make sure its filtered/usable @@ -696,6 +696,9 @@ static int node_passes_guard_filter(const or_options_t *options, guard_selection_t *gs, const node_t *node) { + /* NOTE: Make sure that this function stays in sync with + * options_transition_affects_entry_guards */ + (void)gs; if (routerset_contains_node(options->ExcludeNodes, node)) return 0; @@ -1636,14 +1639,16 @@ entry_guards_upgrade_waiting_circuits(guard_selection_t *gs, /** * Update all derived pieces of the guard selection state in gs. + * Return true iff we should stop using all previously generated circuits. */ -void +int entry_guards_update_all(guard_selection_t *gs) { sampled_guards_update_from_consensus(gs); entry_guards_update_filtered_sets(gs); entry_guards_update_confirmed(gs); entry_guards_update_primary(gs); + return 0; } /** @@ -4020,14 +4025,16 @@ entries_retry_all(const or_options_t *options) } /** Helper: Update the status of all entry guards, in whatever algorithm - is used. */ -void + * is used. Return true if we should stop using all previously generated + * circuits. */ +int guards_update_all(void) { if (get_options()->UseDeprecatedGuardAlgorithm) { entry_guards_compute_status(get_options(), approx_time()); + return 0; } else { - entry_guards_update_all(get_guard_selection_info()); + return entry_guards_update_all(get_guard_selection_info()); } } diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index d8468eb..4cbfbf5 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -294,7 +294,7 @@ struct circuit_guard_state_t { #endif /* Common entry points for old and new guard code */ -void guards_update_all(void); +int guards_update_all(void); const node_t *guards_choose_guard(cpath_build_state_t *state, circuit_guard_state_t **guard_state_out); const node_t *guards_choose_dirguard(dirinfo_type_t info, @@ -336,7 +336,7 @@ void entry_guard_cancel(guard_selection_t *gs, circuit_guard_state_t **guard_state_p); void entry_guard_chan_failed(guard_selection_t *gs, channel_t *chan); -void entry_guards_update_all(guard_selection_t *gs); +int entry_guards_update_all(guard_selection_t *gs); int entry_guards_upgrade_waiting_circuits(guard_selection_t *gs, const smartlist_t *all_circuits, smartlist_t *newly_complete_out); diff --git a/src/or/main.c b/src/or/main.c index 65d1c1f..1610661 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -979,7 +979,10 @@ directory_info_has_arrived(time_t now, int from_cache, int suppress_logs) /* if we have enough dir info, then update our guard status with * whatever we just learned. */ - guards_update_all(); + int invalidate_circs = guards_update_all(); + // This shouldn't be able to occur at this point. + tor_assert_nonfatal(! invalidate_circs); + /* Don't even bother trying to get extrainfo until the rest of our * directory info is up-to-date */ if (options->DownloadExtraInfo)

1 0