March 2016 - tor-commits - lists.torproject.org

[doctor/master] Only give BadExit sync notification if relay is in the consensus
by atagar＠torproject.org 24 Mar '16

24 Mar '16

commit 2db42c80d42bf6e1c4f2ea745e4d157bb230070e Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Mar 24 07:34:15 2016 -0700 Only give BadExit sync notification if relay is in the consensus We suppressed this check if the relay was new and not in votes, but guess that's not enough. Changed this to check if the relay's in the latest overall consensus instead. --- consensus_health_checker.py | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/consensus_health_checker.py b/consensus_health_checker.py index d122c27..c521e64 100755 --- a/consensus_health_checker.py +++ b/consensus_health_checker.py @@ -663,7 +663,7 @@ def bad_exits_in_sync(latest_consensus, consensuses, votes): for fingerprint in disagreed_bad_exits: with_flag = set([authority for authority, flagged in bad_exits.items() if fingerprint in flagged]) without_flag = [] - not_in_consensus = [] + not_in_vote = [] for authority in voting_authorities.difference(with_flag): vote = votes[authority] @@ -671,16 +671,13 @@ def bad_exits_in_sync(latest_consensus, consensuses, votes): if fingerprint in vote.routers: without_flag.append(authority) else: - not_in_consensus.append(authority) + not_in_vote.append(authority) - # If this relay's missing from a consensus and has been active for less - # than an hour then don't bother. It gets negligable traffic and is likely - # part of normal network churn. + # If this relay's missing from a consensus then don't bother. It gets + # negligable traffic and is likely part of normal network churn. - desc = votes[list(with_flag)[0]].routers[fingerprint] - uptime = (datetime.datetime.now() - desc.published).total_seconds() - - if not_in_consensus and uptime < 3600: + if fingerprint not in latest_consensus.routers: + log.debug("BadExit sync check is skipping %s because it's not in the latest consensus" % fingerprint) continue attr = ['with flag: %s' % ', '.join(with_flag)] @@ -688,8 +685,8 @@ def bad_exits_in_sync(latest_consensus, consensuses, votes): if without_flag: attr.append('without flag: %s' % ', '.join(without_flag)) - if not_in_consensus: - attr.append('not in consensus: %s' % ', '.join(not_in_consensus)) + if not_in_vote: + attr.append('not in consensus: %s' % ', '.join(not_in_vote)) issues.append(Issue(Runlevel.NOTICE, 'BADEXIT_OUT_OF_SYNC', fingerprint = fingerprint, counts = ', '.join(attr), to = bad_exits.keys()))

1 0

[tor/master] Avoid overflow in tor_timegm on 32 bit platforms due to year 2038
by nickm＠torproject.org 24 Mar '16

24 Mar '16

commit e71e8e005a533ad519d6b226541ede115e0a5b79 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Thu Feb 25 11:02:39 2016 +0800 Avoid overflow in tor_timegm on 32 bit platforms due to year 2038 --- changes/bug18479 | 5 +++++ src/common/util.c | 23 ++++++++++++++++++++--- 2 files changed, 25 insertions(+), 3 deletions(-) diff --git a/changes/bug18479 b/changes/bug18479 new file mode 100644 index 0000000..d7a935b --- /dev/null +++ b/changes/bug18479 @@ -0,0 +1,5 @@ + o Minor bugfixes (time parsing): + - Avoid overflow in tor_timegm when parsing dates in and after 2038 + on platforms with 32-bit time_t. + Fixes bug 18479; bugfix on 3c4b4c8ca in tor-0.0.2pre14. + Patch by "teor". diff --git a/src/common/util.c b/src/common/util.c index fda5993..6e90f25 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -1475,9 +1475,19 @@ tor_timegm(const struct tm *tm, time_t *time_out) { /* This is a pretty ironclad timegm implementation, snarfed from Python2.2. * It's way more brute-force than fiddling with tzset(). - */ - time_t year, days, hours, minutes, seconds; + * + * We use int64_t rather than time_t to avoid overflow on multiplication on + * platforms with 32-bit time_t. Since year is clipped to INT32_MAX, and + * since 365 * 24 * 60 * 60 is approximately 31 million, it's not possible + * for INT32_MAX years to overflow int64_t when converted to seconds. */ + int64_t year, days, hours, minutes, seconds; int i, invalid_year, dpm; + + /* Initialize time_out to 0 for now, to avoid bad usage in case this function + fails and the caller ignores the return value. */ + tor_assert(time_out); + *time_out = 0; + /* avoid int overflow on addition */ if (tm->tm_year < INT32_MAX-1900) { year = tm->tm_year + 1900; @@ -1516,7 +1526,14 @@ tor_timegm(const struct tm *tm, time_t *time_out) minutes = hours*60 + tm->tm_min; seconds = minutes*60 + tm->tm_sec; - *time_out = seconds; + /* Check that "seconds" will fit in a time_t. On platforms where time_t is + * 32-bit, this check will fail for dates in and after 2038. + * "seconds" can't be negative, because "year" >= 1970. */ + if (seconds < TIME_MIN || seconds > TIME_MAX) { + log_warn(LD_BUG, "Result does not fit in tor_timegm"); + return -1; + } + *time_out = (time_t)seconds; return 0; }

1 0

[tor/master] Add unit tests with dates from 2035 to 2039
by nickm＠torproject.org 24 Mar '16

24 Mar '16

commit b99bd3e7ff0220420ab792be5e9fe02b10d780ea Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Fri Mar 4 18:14:00 2016 +0100 Add unit tests with dates from 2035 to 2039 Platforms with 32-bit time_t sometimes give different results. They don't always indicate failure on overflow, #18480 should fix these. --- src/test/test_util.c | 107 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 107 insertions(+) diff --git a/src/test/test_util.c b/src/test/test_util.c index 37f7d93..f0b9476 100644 --- a/src/test/test_util.c +++ b/src/test/test_util.c @@ -328,6 +328,25 @@ test_util_time(void *arg) tor_gmtime_r(&t_res, &b_time); TM_EQUAL(a_time, b_time); + /* This value is in range with 32 bit and 64 bit time_t */ + a_time.tm_year = 2037-1900; + t_res = 2115180895UL; + tt_int_op(t_res, OP_EQ, tor_timegm(&a_time)); + tor_gmtime_r(&t_res, &b_time); + TM_EQUAL(a_time, b_time); + + /* This value is out of range with 32 bit time_t, but in range for 64 bit + * time_t */ + a_time.tm_year = 2039-1900; +#if SIZEOF_TIME_T == 4 + tt_int_op((time_t) -1,OP_EQ, tor_timegm(&a_time)); +#elif SIZEOF_TIME_T == 8 + t_res = 2178252895UL; + tt_int_op(t_res, OP_EQ, tor_timegm(&a_time)); + tor_gmtime_r(&t_res, &b_time); + TM_EQUAL(a_time, b_time); +#endif + /* Test tor_timegm out of range */ /* year */ @@ -548,6 +567,37 @@ test_util_time(void *arg) i = parse_rfc1123_time(timestr, &t_res); tt_int_op(0,OP_EQ, i); tt_int_op(t_res,OP_EQ, (time_t)1091580502UL); + + /* This value is in range with 32 bit and 64 bit time_t */ + format_rfc1123_time(timestr, (time_t)2080000000UL); + tt_str_op("Fri, 30 Nov 2035 01:46:40 GMT",OP_EQ, timestr); + + t_res = 0; + i = parse_rfc1123_time(timestr, &t_res); + tt_int_op(0,OP_EQ, i); + tt_int_op(t_res,OP_EQ, (time_t)2080000000UL); + + /* This value is out of range with 32 bit time_t, but in range for 64 bit + * time_t */ + format_rfc1123_time(timestr, (time_t)2150000000UL); +#if SIZEOF_TIME_T == 4 + /* format_rfc1123_time should indicate failure on overflow, but it doesn't + * yet. Hopefully #18480 will improve the failure semantics in this case. + tt_str_op("Wed, 17 Feb 2038 06:13:20 GMT",OP_EQ, timestr); + */ + + t_res = 0; + i = parse_rfc1123_time(timestr, &t_res); + tt_int_op(-1,OP_EQ, i); +#elif SIZEOF_TIME_T == 8 + tt_str_op("Wed, 17 Feb 2038 06:13:20 GMT",OP_EQ, timestr); + + t_res = 0; + i = parse_rfc1123_time(timestr, &t_res); + tt_int_op(0,OP_EQ, i); + tt_int_op(t_res,OP_EQ, (time_t)2150000000UL); +#endif + /* The timezone doesn't matter */ t_res = 0; tt_int_op(0,OP_EQ, @@ -595,6 +645,24 @@ test_util_time(void *arg) i = parse_iso_time("2004-8-4 0:48:22", &t_res); tt_int_op(0,OP_EQ, i); tt_int_op(t_res,OP_EQ, (time_t)1091580502UL); + + /* This value is in range with 32 bit and 64 bit time_t */ + t_res = 0; + i = parse_iso_time("2035-11-30 01:46:40", &t_res); + tt_int_op(0,OP_EQ, i); + tt_int_op(t_res,OP_EQ, (time_t)2080000000UL); + + /* This value is out of range with 32 bit time_t, but in range for 64 bit + * time_t */ + t_res = 0; + i = parse_iso_time("2038-02-17 06:13:20", &t_res); +#if SIZEOF_TIME_T == 4 + tt_int_op(-1,OP_EQ, i); +#elif SIZEOF_TIME_T == 8 + tt_int_op(0,OP_EQ, i); + tt_int_op(t_res,OP_EQ, (time_t)2150000000UL); +#endif + tt_int_op(-1,OP_EQ, parse_iso_time("2004-08-zz 99-99x99", &t_res)); tt_int_op(-1,OP_EQ, parse_iso_time("2011-03-32 00:00:00", &t_res)); tt_int_op(-1,OP_EQ, parse_iso_time("2011-03-30 24:00:00", &t_res)); @@ -639,6 +707,25 @@ test_util_time(void *arg) tt_str_op("2012-01-11T15:38:58.003060",OP_EQ, timestr); tt_int_op(strlen(timestr),OP_EQ, ISO_TIME_USEC_LEN); + tv.tv_usec = 0; + /* This value is in range with 32 bit and 64 bit time_t */ + tv.tv_sec = (time_t)2080000000UL; + format_iso_time(timestr, (time_t)tv.tv_sec); + tt_str_op("2035-11-30 01:46:40",OP_EQ, timestr); + + /* This value is out of range with 32 bit time_t, but in range for 64 bit + * time_t */ + tv.tv_sec = (time_t)2150000000UL; + format_iso_time(timestr, (time_t)tv.tv_sec); +#if SIZEOF_TIME_T == 4 + /* format_iso_time should indicate failure on overflow, but it doesn't yet. + * Hopefully #18480 will improve the failure semantics in this case. + tt_str_op("2038-02-17 06:13:20",OP_EQ, timestr); + */ +#elif SIZEOF_TIME_T == 8 + tt_str_op("2038-02-17 06:13:20",OP_EQ, timestr); +#endif + done: ; } @@ -712,6 +799,26 @@ test_util_parse_http_time(void *arg) tt_int_op(0,OP_EQ,parse_http_time("Mon, 31 Dec 2012 00:00:00 GMT", &a_time)); tt_int_op((time_t)1356912000UL,OP_EQ, tor_timegm(&a_time)); T("2012-12-31 00:00:00"); + + /* This value is in range with 32 bit and 64 bit time_t */ + tt_int_op(0,OP_EQ,parse_http_time("Fri, 30 Nov 2035 01:46:40 GMT", &a_time)); + tt_int_op((time_t)2080000000UL,OP_EQ, tor_timegm(&a_time)); + T("2035-11-30 01:46:40"); + + /* This value is out of range with 32 bit time_t, but in range for 64 bit + * time_t */ +#if SIZEOF_TIME_T == 4 + /* parse_http_time should indicate failure on overflow, but it doesn't yet. + * Hopefully #18480 will improve the failure semantics in this case. */ + tt_int_op(0,OP_EQ,parse_http_time("Wed, 17 Feb 2038 06:13:20 GMT", &a_time)); + tt_int_op((time_t)-1,OP_EQ, tor_timegm(&a_time)); +#elif SIZEOF_TIME_T == 8 + tt_int_op(0,OP_EQ,parse_http_time("Wed, 17 Feb 2038 06:13:20 GMT", &a_time)); + tt_int_op((time_t)2150000000UL,OP_EQ, tor_timegm(&a_time)); + T("2038-02-17 06:13:20"); +#endif + + tt_int_op(-1,OP_EQ, parse_http_time("2004-08-zz 99-99x99 GMT", &a_time)); tt_int_op(-1,OP_EQ, parse_http_time("2011-03-32 00:00:00 GMT", &a_time)); tt_int_op(-1,OP_EQ, parse_http_time("2011-03-30 24:00:00 GMT", &a_time));

1 0

[tor/master] Add a missing UL on a long in a unit test
by nickm＠torproject.org 24 Mar '16

24 Mar '16

commit 19fb86a2dc0a95c6b009f977c35a01b7a2211546 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Fri Mar 4 18:16:09 2016 +0100 Add a missing UL on a long in a unit test --- src/test/test_util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/test_util.c b/src/test/test_util.c index f0b9476..58ffdea 100644 --- a/src/test/test_util.c +++ b/src/test/test_util.c @@ -690,7 +690,7 @@ test_util_time(void *arg) /* Test format_iso_time */ - tv.tv_sec = (time_t)1326296338; + tv.tv_sec = (time_t)1326296338UL; tv.tv_usec = 3060; format_iso_time(timestr, (time_t)tv.tv_sec); tt_str_op("2012-01-11 15:38:58",OP_EQ, timestr);

1 0

[tor/master] Merge branch 'timegm_overflow_squashed'
by nickm＠torproject.org 24 Mar '16

24 Mar '16

commit 6256c61d959dc2aa84752ac7903b827fffd53583 Merge: 424af93 19fb86a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 24 10:18:00 2016 -0400 Merge branch 'timegm_overflow_squashed' changes/bug18479 | 5 +++ src/common/util.c | 23 +++++++++-- src/test/test_util.c | 109 ++++++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 133 insertions(+), 4 deletions(-)

1 0

[tor/master] Always allow OR connections to bridges on private addresses
by nickm＠torproject.org 24 Mar '16

24 Mar '16

commit f2153f9716876b87bfcc53ff13b86b878edaae86 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Wed Mar 23 13:37:35 2016 +1100 Always allow OR connections to bridges on private addresses Regardless of the setting of ExtendAllowPrivateAddresses. This fixes a bug with pluggable transports that ignore the (potentially private) address in their bridge line. Fixes bug 18517; bugfix on 23b088907f in tor-0.2.8.1-alpha. --- changes/bug18517 | 6 ++++++ doc/tor.1.txt | 19 ++++++++++++------- src/or/circuitbuild.c | 11 +++++++++-- src/or/entrynodes.c | 24 +++++++++++++++++++++++- src/or/entrynodes.h | 3 +++ 5 files changed, 53 insertions(+), 10 deletions(-) diff --git a/changes/bug18517 b/changes/bug18517 new file mode 100644 index 0000000..b82b5a4 --- /dev/null +++ b/changes/bug18517 @@ -0,0 +1,6 @@ + o Major bugfixes (bridges, pluggable transports): + - Modify the check for OR connections to private addresses. + Allow bridges on private addresses, including pluggable transports + that ignore the (potentially private) address in the bridge line. + Fixes bug 18517; bugfix on 23b088907f in tor-0.2.8.1-alpha. + Reported by "gk", patch by "teor". diff --git a/doc/tor.1.txt b/doc/tor.1.txt index a71b04f..413af96 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -747,9 +747,12 @@ The following options are useful only for clients (that is, if fingerprint to look up the bridge descriptor at the bridge authority, if it's provided and if UpdateBridgesFromAuthority is set too. + + - If "transport" is provided, and matches to a ClientTransportPlugin - line, we use that pluggable transports proxy to transfer data to - the bridge. + If "transport" is provided, it must match a ClientTransportPlugin line. We + then use that pluggable transport's proxy to transfer data to the bridge, + rather than connecting to the bridge directly. Some transports use a + transport-specific method to work out the remote address to connect to. + These transports typically ignore the "IP:ORPort" specified in the bridge + line. [[LearnCircuitBuildTimeout]] **LearnCircuitBuildTimeout** **0**|**1**:: If 0, CircuitBuildTimeout adaptive learning is disabled. (Default: 1) @@ -1974,10 +1977,12 @@ is non-zero): (Default: 1) [[ExtendAllowPrivateAddresses]] **ExtendAllowPrivateAddresses** **0**|**1**:: - When this option is enabled, Tor will connect to localhost, RFC1918 - addresses, and so on. In particular, Tor will make direct connections, and - Tor routers allow EXTEND requests, to these private addresses. This can - create security issues; you should probably leave it off. + When this option is enabled, Tor will connect to relays on localhost, + RFC1918 addresses, and so on. In particular, Tor will make direct OR + connections, and Tor routers allow EXTEND requests, to these private + addresses. (Tor will always allow connections to bridges, proxies, and + pluggable transports configured on private addresses.) Enabling this + option can create security issues; you should probably leave it off. (Default: 0) [[MaxMemInQueues]] **MaxMemInQueues** __N__ **bytes**|**KB**|**MB**|**GB**:: diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 237b61a..a5a933e 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -495,14 +495,21 @@ circuit_handle_first_hop(origin_circuit_t *circ) int err_reason = 0; const char *msg = NULL; int should_launch = 0; + const or_options_t *options = get_options(); firsthop = onion_next_hop_in_cpath(circ->cpath); tor_assert(firsthop); tor_assert(firsthop->extend_info); - /* XX/teor - does tor ever need build a circuit directly to itself? */ + /* Some bridges are on private addresses. Others pass a dummy private + * address to the pluggable transport, which ignores it. + * Deny the connection if: + * - the address is internal, and + * - we're not connecting to a configured bridge, and + * - we're not configured to allow extends to private addresses. */ if (tor_addr_is_internal(&firsthop->extend_info->addr, 0) && - !get_options()->ExtendAllowPrivateAddresses) { + !extend_info_is_a_configured_bridge(firsthop->extend_info) && + !options->ExtendAllowPrivateAddresses) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Client asked me to connect directly to a private address"); return -END_CIRC_REASON_TORPROTOCOL; diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 3287fcd..8dbfeae 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1795,7 +1795,7 @@ get_configured_bridge_by_orports_digest(const char *digest, } /** If we have a bridge configured whose digest matches digest, or a - * bridge with no known digest whose address matches addr:/port, + * bridge with no known digest whose address matches addr:port, * return that bridge. Else return NULL. If digest is NULL, check for * address/port matches only. */ static bridge_info_t * @@ -1818,6 +1818,28 @@ get_configured_bridge_by_addr_port_digest(const tor_addr_t *addr, return NULL; } +/** If we have a bridge configured whose digest matches digest, or a + * bridge with no known digest whose address matches addr:port, + * return 1. Else return 0. If digest is NULL, check for + * address/port matches only. */ +int addr_is_a_configured_bridge(const tor_addr_t *addr, + uint16_t port, + const char *digest) +{ + tor_assert(addr); + return get_configured_bridge_by_addr_port_digest(addr, port, digest) ? 1 : 0; +} + +/** If we have a bridge configured whose digest matches + * ei->identity_digest, or a bridge with no known digest whose address + * matches ei->addr:ei->port, return 1. Else return 0. + * If ei->onion_key is NULL, check for address/port matches only. */ +int extend_info_is_a_configured_bridge(const extend_info_t *ei) +{ + const char *digest = ei->onion_key ? ei->identity_digest : NULL; + return addr_is_a_configured_bridge(&ei->addr, ei->port, digest); +} + /** Wrapper around get_configured_bridge_by_addr_port_digest() to look * it up via router descriptor ri. */ static bridge_info_t * diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index 59147d1..247c809 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -127,6 +127,9 @@ int getinfo_helper_entry_guards(control_connection_t *conn, void mark_bridge_list(void); void sweep_bridge_list(void); +int addr_is_a_configured_bridge(const tor_addr_t *addr, uint16_t port, + const char *digest); +int extend_info_is_a_configured_bridge(const extend_info_t *ei); int routerinfo_is_a_configured_bridge(const routerinfo_t *ri); int node_is_a_configured_bridge(const node_t *node); void learned_router_identity(const tor_addr_t *addr, uint16_t port,

1 0

[tor/master] Merge branch 'bug18517_squashed'
by nickm＠torproject.org 24 Mar '16

24 Mar '16

commit 424af93ded7e1d9d98733ed17b2b6fee143262b9 Merge: 54559e5 f2153f9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 24 10:14:05 2016 -0400 Merge branch 'bug18517_squashed' changes/bug18517 | 6 ++++++ doc/tor.1.txt | 19 ++++++++++++------- src/or/circuitbuild.c | 11 +++++++++-- src/or/entrynodes.c | 24 +++++++++++++++++++++++- src/or/entrynodes.h | 3 +++ 5 files changed, 53 insertions(+), 10 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'teor/bug18351'
by nickm＠torproject.org 24 Mar '16

24 Mar '16

commit 54559e5845f42c51600b80de6b67467627451fcb Merge: ea9472d 355f783 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Mar 24 09:33:58 2016 -0400 Merge remote-tracking branch 'teor/bug18351' changes/bug18351 | 6 ++++++ src/or/connection.c | 15 ++++++++++----- src/or/directory.c | 34 ++++++++++++++++++++++++---------- src/or/routerlist.c | 14 +++++++++----- 4 files changed, 49 insertions(+), 20 deletions(-)

1 0

[tor/master] Downgrade IP version warnings to avoid filling logs
by nickm＠torproject.org 24 Mar '16

24 Mar '16

commit f2a344e3974eeba860434884bd70f8d11cca94ea Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Thu Mar 24 10:38:07 2016 +1100 Downgrade IP version warnings to avoid filling logs Downgrade logs and backtraces about IP versions to info-level. Only log backtraces once each time tor runs. Assists in diagnosing bug 18351; bugfix on c3cc8e16e in tor-0.2.8.1-alpha. Reported by "sysrqb" and "Christian", patch by "teor". --- changes/bug18351 | 6 ++++++ src/or/connection.c | 8 ++++++-- src/or/directory.c | 21 ++++++++++++++++----- src/or/routerlist.c | 9 ++++++--- 4 files changed, 34 insertions(+), 10 deletions(-) diff --git a/changes/bug18351 b/changes/bug18351 new file mode 100644 index 0000000..f2e21ea --- /dev/null +++ b/changes/bug18351 @@ -0,0 +1,6 @@ + o Minor bugfixes (logging): + - Downgrade logs and backtraces about IP versions to + info-level. Only log backtraces once each time tor runs. + Assists in diagnosing bug 18351; bugfix on c3cc8e16e in + tor-0.2.8.1-alpha. + Reported by "sysrqb" and "Christian", patch by "teor". diff --git a/src/or/connection.c b/src/or/connection.c index 4e915f1..fc9ec13 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -1793,11 +1793,15 @@ connection_connect_log_client_use_ip_version(const connection_t *conn) /* Check if we broke a mandatory address family restriction */ if ((must_ipv4 && tor_addr_family(&real_addr) == AF_INET6) || (must_ipv6 && tor_addr_family(&real_addr) == AF_INET)) { - log_warn(LD_BUG, "%s connection to %s violated ClientUseIPv%s 0.", + static int logged_backtrace = 0; + log_info(LD_BUG, "%s connection to %s violated ClientUseIPv%s 0.", conn->type == CONN_TYPE_OR ? "OR" : "Dir", fmt_addr(&real_addr), options->ClientUseIPv4 == 0 ? "4" : "6"); - log_backtrace(LOG_WARN, LD_BUG, "Address came from"); + if (!logged_backtrace) { + log_backtrace(LOG_INFO, LD_BUG, "Address came from"); + logged_backtrace = 1; + } } /* Bridges are allowed to break IPv4/IPv6 ORPort preferences to connect to diff --git a/src/or/directory.c b/src/or/directory.c index e4feda4..c95944b 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -674,13 +674,17 @@ directory_choose_address_routerstatus(const routerstatus_t *status, /* We rejected both addresses. This isn't great. */ if (!have_or && !have_dir) { - log_warn(LD_BUG, "Rejected all OR and Dir addresses from %s when " + static int logged_backtrace = 0; + log_info(LD_BUG, "Rejected all OR and Dir addresses from %s when " "launching a directory connection to: IPv4 %s OR %d Dir %d " "IPv6 %s OR %d Dir %d", routerstatus_describe(status), fmt_addr32(status->addr), status->or_port, status->dir_port, fmt_addr(&status->ipv6_addr), status->ipv6_orport, status->dir_port); - log_backtrace(LOG_WARN, LD_BUG, "Addresses came from"); + if (!logged_backtrace) { + log_backtrace(LOG_INFO, LD_BUG, "Addresses came from"); + logged_backtrace = 1; + } return -1; } @@ -1100,14 +1104,21 @@ directory_initiate_command_rend(const tor_addr_port_t *or_addr_port, if (or_connection && (!or_addr_port->port || tor_addr_is_null(&or_addr_port->addr))) { + static int logged_backtrace = 0; log_warn(LD_DIR, "Cannot make an OR connection without an OR port."); - log_backtrace(LOG_WARN, LD_BUG, "Address came from"); + if (!logged_backtrace) { + log_backtrace(LOG_INFO, LD_BUG, "Address came from"); + logged_backtrace = 1; + } return; } else if (!or_connection && (!dir_addr_port->port || tor_addr_is_null(&dir_addr_port->addr))) { + static int logged_backtrace = 0; log_warn(LD_DIR, "Cannot make a Dir connection without a Dir port."); - log_backtrace(LOG_WARN, LD_BUG, "Address came from"); - + if (!logged_backtrace) { + log_backtrace(LOG_INFO, LD_BUG, "Address came from"); + logged_backtrace = 1; + } return; } diff --git a/src/or/routerlist.c b/src/or/routerlist.c index bc5e2e9..f065c3c 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -1560,9 +1560,13 @@ router_picked_poor_directory_log(const routerstatus_t *rs) /* We couldn't find a node, or the one we have doesn't fit our preferences. * This might be a bug. */ if (!rs) { - log_warn(LD_BUG, "Firewall denied all OR and Dir addresses for all relays " + static int logged_backtrace = 0; + log_info(LD_BUG, "Firewall denied all OR and Dir addresses for all relays " "when searching for a directory."); - log_backtrace(LOG_WARN, LD_BUG, "Node search initiated by"); + if (!logged_backtrace) { + log_backtrace(LOG_INFO, LD_BUG, "Node search initiated by"); + logged_backtrace = 1; + } } else if (!fascist_firewall_allows_rs(rs, FIREWALL_OR_CONNECTION, 1) && !fascist_firewall_allows_rs(rs, FIREWALL_DIR_CONNECTION, 1) ) { @@ -1573,7 +1577,6 @@ router_picked_poor_directory_log(const routerstatus_t *rs) fmt_addr32(rs->addr), rs->or_port, rs->dir_port, fmt_addr(&rs->ipv6_addr), rs->ipv6_orport, rs->dir_port); - log_backtrace(LOG_INFO, LD_BUG, "Node search initiated by"); } }

1 0

[tor/master] Clarify ReachableAddress log messages
by nickm＠torproject.org 24 Mar '16

24 Mar '16

commit 355f78364a7d1fa3c2de0a93e68153ae65526e02 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Thu Mar 24 20:59:49 2016 +1100 Clarify ReachableAddress log messages Make it clearer that they are about outgoing connection attempts. Specify the options involved where they were missing from one log message. Clarify a comment. --- src/or/connection.c | 9 +++++---- src/or/directory.c | 13 ++++++++----- src/or/routerlist.c | 7 ++++--- 3 files changed, 17 insertions(+), 12 deletions(-) diff --git a/src/or/connection.c b/src/or/connection.c index fc9ec13..82fc1ba 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -1794,7 +1794,7 @@ connection_connect_log_client_use_ip_version(const connection_t *conn) if ((must_ipv4 && tor_addr_family(&real_addr) == AF_INET6) || (must_ipv6 && tor_addr_family(&real_addr) == AF_INET)) { static int logged_backtrace = 0; - log_info(LD_BUG, "%s connection to %s violated ClientUseIPv%s 0.", + log_info(LD_BUG, "Outgoing %s connection to %s violated ClientUseIPv%s 0.", conn->type == CONN_TYPE_OR ? "OR" : "Dir", fmt_addr(&real_addr), options->ClientUseIPv4 == 0 ? "4" : "6"); @@ -1814,9 +1814,10 @@ connection_connect_log_client_use_ip_version(const connection_t *conn) /* Check if we couldn't satisfy an address family preference */ if ((!pref_ipv6 && tor_addr_family(&real_addr) == AF_INET6) || (pref_ipv6 && tor_addr_family(&real_addr) == AF_INET)) { - log_info(LD_NET, "Connection to %s doesn't satisfy ClientPreferIPv6%sPort " - "%d, with ClientUseIPv4 %d, and fascist_firewall_use_ipv6 %d " - "(ClientUseIPv6 %d and UseBridges %d).", + log_info(LD_NET, "Outgoing connection to %s doesn't satisfy " + "ClientPreferIPv6%sPort %d, with ClientUseIPv4 %d, and " + "fascist_firewall_use_ipv6 %d (ClientUseIPv6 %d and UseBridges " + "%d).", fmt_addr(&real_addr), conn->type == CONN_TYPE_OR ? "OR" : "Dir", conn->type == CONN_TYPE_OR ? options->ClientPreferIPv6ORPort diff --git a/src/or/directory.c b/src/or/directory.c index c95944b..7f30726 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -672,12 +672,13 @@ directory_choose_address_routerstatus(const routerstatus_t *status, FIREWALL_DIR_CONNECTION, 0, use_dir_ap); - /* We rejected both addresses. This isn't great. */ + /* We rejected all addresses in the relay's status. This means we can't + * connect to it. */ if (!have_or && !have_dir) { static int logged_backtrace = 0; log_info(LD_BUG, "Rejected all OR and Dir addresses from %s when " - "launching a directory connection to: IPv4 %s OR %d Dir %d " - "IPv6 %s OR %d Dir %d", routerstatus_describe(status), + "launching an outgoing directory connection to: IPv4 %s OR %d " + "Dir %d IPv6 %s OR %d Dir %d", routerstatus_describe(status), fmt_addr32(status->addr), status->or_port, status->dir_port, fmt_addr(&status->ipv6_addr), status->ipv6_orport, status->dir_port); @@ -1105,7 +1106,8 @@ directory_initiate_command_rend(const tor_addr_port_t *or_addr_port, if (or_connection && (!or_addr_port->port || tor_addr_is_null(&or_addr_port->addr))) { static int logged_backtrace = 0; - log_warn(LD_DIR, "Cannot make an OR connection without an OR port."); + log_warn(LD_DIR, "Cannot make an outgoing OR connection without an OR " + "port."); if (!logged_backtrace) { log_backtrace(LOG_INFO, LD_BUG, "Address came from"); logged_backtrace = 1; @@ -1114,7 +1116,8 @@ directory_initiate_command_rend(const tor_addr_port_t *or_addr_port, } else if (!or_connection && (!dir_addr_port->port || tor_addr_is_null(&dir_addr_port->addr))) { static int logged_backtrace = 0; - log_warn(LD_DIR, "Cannot make a Dir connection without a Dir port."); + log_warn(LD_DIR, "Cannot make an outgoing Dir connection without a Dir " + "port."); if (!logged_backtrace) { log_backtrace(LOG_INFO, LD_BUG, "Address came from"); logged_backtrace = 1; diff --git a/src/or/routerlist.c b/src/or/routerlist.c index f065c3c..1024623 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -1561,8 +1561,9 @@ router_picked_poor_directory_log(const routerstatus_t *rs) * This might be a bug. */ if (!rs) { static int logged_backtrace = 0; - log_info(LD_BUG, "Firewall denied all OR and Dir addresses for all relays " - "when searching for a directory."); + log_info(LD_BUG, "Wanted to make an outgoing directory connection, but " + "all OR and Dir addresses for all relays were not reachable. " + "Check ReachableAddresses, ClientUseIPv4, and similar options."); if (!logged_backtrace) { log_backtrace(LOG_INFO, LD_BUG, "Node search initiated by"); logged_backtrace = 1; @@ -1571,7 +1572,7 @@ router_picked_poor_directory_log(const routerstatus_t *rs) && !fascist_firewall_allows_rs(rs, FIREWALL_DIR_CONNECTION, 1) ) { log_info(LD_BUG, "Selected a directory %s with non-preferred OR and Dir " - "addresses for launching a connection: " + "addresses for launching an outgoing connection: " "IPv4 %s OR %d Dir %d IPv6 %s OR %d Dir %d", routerstatus_describe(rs), fmt_addr32(rs->addr), rs->or_port,

1 0