August 2016 - tor-commits - lists.torproject.org

[tor/master] Use tor_assert, not assert.
by nickm＠torproject.org 23 Aug '16

23 Aug '16

commit e8d7953c611200835d4011b12e210e878f0d13fd Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Aug 23 09:24:20 2016 -0400 Use tor_assert, not assert. --- src/or/router.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/or/router.c b/src/or/router.c index 40aae29..e9961d4 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -1970,8 +1970,8 @@ static void router_check_descriptor_address_port_consistency(uint32_t ipv4h_desc_addr, int listener_type) { - assert(listener_type == CONN_TYPE_OR_LISTENER || - listener_type == CONN_TYPE_DIR_LISTENER); + tor_assert(listener_type == CONN_TYPE_OR_LISTENER || + listener_type == CONN_TYPE_DIR_LISTENER); /* The first advertised Port may be the magic constant CFG_AUTO_PORT. */ @@ -1985,7 +1985,7 @@ router_check_descriptor_address_port_consistency(uint32_t ipv4h_desc_addr, AF_INET); /* If we're building a descriptor with no advertised address, * something is terribly wrong. */ - assert(port_addr); + tor_assert(port_addr); tor_addr_t desc_addr; char port_addr_str[TOR_ADDR_BUF_LEN];

1 0

[tor/master] Make log message clearer
by nickm＠torproject.org 23 Aug '16

23 Aug '16

commit 4d2b3164ec922916d01d6772ef86b7041e7c7d78 Author: s7r <s7r(a)sky-ip.org> Date: Mon Aug 15 09:50:10 2016 +0000 Make log message clearer Longer and more explicit log message so we don't confuse users with behind NAT with working configurations and state that public IP addresses only should be provided with "Address", won't work with internal addresses. --- src/or/router.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/src/or/router.c b/src/or/router.c index d48bd05..c6bbafb 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -1947,8 +1947,13 @@ router_check_descriptor_address_consistency(uint32_t ipv4h_desc_addr) log_warn(LD_CONFIG, "The configured IPv4 ORPort address %s does not " "match the address %s in the descriptor. Please configure " - "matching IPv4 addresses for the Address and ORPort options. " - "Use NoListen on the ORPort if you are behind a NAT.", + "the matching IPv4 addresses for this Tor relay as " + "Address <IPv4 address> in the torrc configuration file if " + "you have multiple public IP addresses. If you are behind a " + "NAT and have the right ports forwarded, you can ignore this " + "warning or, to remove it, use 2 ORPort lines with options " + "NoListen (for the public IPv4 address line) and NoAdvertise " + "(for the internal NAT IPv4 address line).", port_addr_str, desc_addr_str); } @@ -1969,8 +1974,13 @@ router_check_descriptor_address_consistency(uint32_t ipv4h_desc_addr) log_warn(LD_CONFIG, "The configured IPv4 DirPort address %s does not " "match the address %s in the descriptor. Please configure " - "matching IPv4 addresses for the Address and DirPort options. " - "Use NoListen on the DirPort if you are behind a NAT.", + "the matching IPv4 addresses for this Tor relay as " + "Address <IPv4 address> in the torrc configuration file if " + "you have multiple public IP addresses. If you are behind a " + "NAT and have the right ports forwarded, you can ignore this " + "warning or, to remove it, use 2 DirPort lines with options " + "NoListen (for the public IPv4 address line) and NoAdvertise " + "(for the internal NAT IPv4 address line).", port_addr_str, desc_addr_str); } }

1 0

[tor/master] Refactor duplicate code in config.c into port_binds_ipv4/6
by nickm＠torproject.org 23 Aug '16

23 Aug '16

commit faec7956a96b143f8ba7192e7ff2a996469935e0 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Sat May 7 10:17:46 2016 -0700 Refactor duplicate code in config.c into port_binds_ipv4/6 No behavioural change Preserves and documents behaviour when passed AF_UNSPEC. --- src/or/config.c | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index 2e14ba6..7ca9277 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -6841,6 +6841,22 @@ parse_ports(or_options_t *options, int validate_only, return retval; } +/* Does port bind to IPv4? */ +static int port_binds_ipv4(const port_cfg_t *port) +{ + return tor_addr_family(&port->addr) == AF_INET || + (tor_addr_family(&port->addr) == AF_UNSPEC + && !port->server_cfg.bind_ipv6_only); +} + +/* Does port bind to IPv6? */ +static int port_binds_ipv6(const port_cfg_t *port) +{ + return tor_addr_family(&port->addr) == AF_INET6 || + (tor_addr_family(&port->addr) == AF_UNSPEC + && !port->server_cfg.bind_ipv4_only); +} + /** Given a list of port_cfg_t in ports, check them for internal * consistency and warn as appropriate. Set *n_low_ports_out to the * number of sub-1024 ports we will be binding. */ @@ -6866,9 +6882,7 @@ check_server_ports(const smartlist_t *ports, } else if (port->type == CONN_TYPE_OR_LISTENER) { if (! port->server_cfg.no_advertise) { ++n_orport_advertised; - if (tor_addr_family(&port->addr) == AF_INET || - (tor_addr_family(&port->addr) == AF_UNSPEC && - !port->server_cfg.bind_ipv6_only)) + if (port_binds_ipv4(port)) ++n_orport_advertised_ipv4; } if (! port->server_cfg.no_listen) @@ -7002,20 +7016,20 @@ get_first_listener_addrport_string(int listener_type) } /** Return the first advertised port of type listener_type in - address_family. */ + * address_family. Returns 0 when no port is found, and when passed + * AF_UNSPEC. */ int get_first_advertised_port_by_type_af(int listener_type, int address_family) { + if (address_family == AF_UNSPEC) + return 0; if (!configured_ports) return 0; SMARTLIST_FOREACH_BEGIN(configured_ports, const port_cfg_t *, cfg) { if (cfg->type == listener_type && - !cfg->server_cfg.no_advertise && - (tor_addr_family(&cfg->addr) == address_family || - tor_addr_family(&cfg->addr) == AF_UNSPEC)) { - if (tor_addr_family(&cfg->addr) != AF_UNSPEC || - (address_family == AF_INET && !cfg->server_cfg.bind_ipv6_only) || - (address_family == AF_INET6 && !cfg->server_cfg.bind_ipv4_only)) { + !cfg->server_cfg.no_advertise) { + if ((address_family == AF_INET && port_binds_ipv4(cfg)) || + (address_family == AF_INET6 && port_binds_ipv6(cfg))) { return cfg->port; } }

1 0

[tor/master] Warn users when addresses in ports and descriptor are inconsistent
by nickm＠torproject.org 23 Aug '16

23 Aug '16

commit c75bf388b5fc3555dd21d44b7856358f771292a4 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Sat May 7 10:18:52 2016 -0700 Warn users when addresses in ports and descriptor are inconsistent This mitigates bug 13953. --- changes/bug13953 | 3 ++ src/or/config.c | 81 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ src/or/config.h | 6 ++++ src/or/router.c | 83 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 173 insertions(+) diff --git a/changes/bug13953 b/changes/bug13953 new file mode 100644 index 0000000..42b013f --- /dev/null +++ b/changes/bug13953 @@ -0,0 +1,3 @@ + o Minor bugfixes (config): + - Warn users when descriptor and port addresses are inconsistent. + Mitigates bug 13953; patch by teor. diff --git a/src/or/config.c b/src/or/config.c index 7ca9277..2fd97de 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -7037,6 +7037,87 @@ get_first_advertised_port_by_type_af(int listener_type, int address_family) return 0; } +/** Return the first advertised address of type listener_type in + * address_family. Returns NULL if there is no advertised address, + * and when passed AF_UNSPEC. */ +const tor_addr_t * +get_first_advertised_addr_by_type_af(int listener_type, int address_family) +{ + if (address_family == AF_UNSPEC) + return NULL; + if (!configured_ports) + return NULL; + SMARTLIST_FOREACH_BEGIN(configured_ports, const port_cfg_t *, cfg) { + if (cfg->type == listener_type && + !cfg->server_cfg.no_advertise) { + if ((address_family == AF_INET && port_binds_ipv4(cfg)) || + (address_family == AF_INET6 && port_binds_ipv6(cfg))) { + return &cfg->addr; + } + } + } SMARTLIST_FOREACH_END(cfg); + return NULL; +} + +/** Return 1 if a port exists of type listener_type on addr and + * port. If check_wildcard is true, INADDR[6]_ANY and AF_UNSPEC + * addresses match any address of the appropriate family; and port -1 matches + * any port. + * To match auto ports, pass CFG_PORT_AUTO. (Does not match on the actual + * automatically chosen listener ports.) */ +int +port_exists_by_type_addr_port(int listener_type, const tor_addr_t *addr, + int port, int check_wildcard) +{ + if (!configured_ports || !addr) + return 0; + SMARTLIST_FOREACH_BEGIN(configured_ports, const port_cfg_t *, cfg) { + if (cfg->type == listener_type) { + if (cfg->port == port || (check_wildcard && port == -1)) { + /* Exact match */ + if (tor_addr_eq(&cfg->addr, addr)) { + return 1; + } + /* Skip wildcard matches if we're not doing them */ + if (!check_wildcard) { + continue; + } + /* Wildcard matches IPv4 */ + const int cfg_v4 = port_binds_ipv4(cfg); + const int cfg_any_v4 = tor_addr_is_null(&cfg->addr) && cfg_v4; + const int addr_v4 = tor_addr_family(addr) == AF_INET || + tor_addr_family(addr) == AF_UNSPEC; + const int addr_any_v4 = tor_addr_is_null(&cfg->addr) && addr_v4; + if ((cfg_any_v4 && addr_v4) || (cfg_v4 && addr_any_v4)) { + return 1; + } + /* Wildcard matches IPv6 */ + const int cfg_v6 = port_binds_ipv6(cfg); + const int cfg_any_v6 = tor_addr_is_null(&cfg->addr) && cfg_v6; + const int addr_v6 = tor_addr_family(addr) == AF_INET6 || + tor_addr_family(addr) == AF_UNSPEC; + const int addr_any_v6 = tor_addr_is_null(&cfg->addr) && addr_v6; + if ((cfg_any_v6 && addr_v6) || (cfg_v6 && addr_any_v6)) { + return 1; + } + } + } + } SMARTLIST_FOREACH_END(cfg); + return 0; +} + +/* Like port_exists_by_type_addr_port, but accepts a host-order IPv4 address + * instead. */ +int +port_exists_by_type_addr32h_port(int listener_type, uint32_t addr_ipv4h, + int port, int check_wildcard) +{ + tor_addr_t ipv4; + tor_addr_from_ipv4h(&ipv4, addr_ipv4h); + return port_exists_by_type_addr_port(listener_type, &ipv4, port, + check_wildcard); +} + /** Adjust the value of options->DataDirectory, or fill it in if it's * absent. Return 0 on success, -1 on failure. */ static int diff --git a/src/or/config.h b/src/or/config.h index 02121cf..168e7d9 100644 --- a/src/or/config.h +++ b/src/or/config.h @@ -87,6 +87,12 @@ int get_first_advertised_port_by_type_af(int listener_type, (get_first_advertised_port_by_type_af(CONN_TYPE_OR_LISTENER, AF_INET)) #define get_primary_dir_port() \ (get_first_advertised_port_by_type_af(CONN_TYPE_DIR_LISTENER, AF_INET)) +const tor_addr_t *get_first_advertised_addr_by_type_af(int listener_type, + int address_family); +int port_exists_by_type_addr_port(int listener_type, const tor_addr_t *addr, + int port, int check_wildcard); +int port_exists_by_type_addr32h_port(int listener_type, uint32_t addr_ipv4h, + int port, int check_wildcard); char *get_first_listener_addrport_string(int listener_type); diff --git a/src/or/router.c b/src/or/router.c index 68bcf13..d48bd05 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -1896,6 +1896,85 @@ router_pick_published_address,(const or_options_t *options, uint32_t *addr)) return 0; } +/* Tor relays only have one IPv4 address in the descriptor, which is derived + * from the Address torrc option, or guessed using various methods in + * router_pick_published_address(). + * Warn the operator if there is no ORPort on the descriptor address + * ipv4h_desc_addr. + * Warn the operator if there is no DirPort on the descriptor address. + * This catches a few common config errors: + * - operators who expect ORPorts and DirPorts to be advertised on the + * ports' listen addresses, rather than the torrc Address (or guessed + * addresses in the absence of an Address config). This includes + * operators who attempt to put their ORPort and DirPort on different + * addresses; + * - discrepancies between guessed addresses and configured listen + * addresses (when the Address option isn't set). + * If a listener is listening on all IPv4 addresses, it is assumed that it + * is listening on the configured Address, and no messages are logged. + * If an operators has specified NoAdvertise ORPorts in a NAT setting, + * no messages are logged, unless they have specified other advertised + * addresses. + * The message tells operators to configure an ORPort and DirPort that match + * the Address (using NoListen if needed). + */ +static void +router_check_descriptor_address_consistency(uint32_t ipv4h_desc_addr) +{ + + /* The first configured ORPort and DirPort, which may be CFG_AUTO_PORT. */ + int orport_v4_cfg = get_first_advertised_port_by_type_af( + CONN_TYPE_OR_LISTENER, + AF_INET); + int dirport_v4_cfg = get_first_advertised_port_by_type_af( + CONN_TYPE_DIR_LISTENER, + AF_INET); + + if (orport_v4_cfg != 0 && + !port_exists_by_type_addr32h_port(CONN_TYPE_OR_LISTENER, + ipv4h_desc_addr, orport_v4_cfg, 1)) { + const tor_addr_t *port_addr = get_first_advertised_addr_by_type_af( + CONN_TYPE_OR_LISTENER, + AF_INET); + tor_addr_t desc_addr; + char port_addr_str[TOR_ADDR_BUF_LEN]; + char desc_addr_str[TOR_ADDR_BUF_LEN]; + + tor_addr_to_str(port_addr_str, port_addr, TOR_ADDR_BUF_LEN, 0); + + tor_addr_from_ipv4h(&desc_addr, ipv4h_desc_addr); + tor_addr_to_str(desc_addr_str, &desc_addr, TOR_ADDR_BUF_LEN, 0); + + log_warn(LD_CONFIG, "The configured IPv4 ORPort address %s does not " + "match the address %s in the descriptor. Please configure " + "matching IPv4 addresses for the Address and ORPort options. " + "Use NoListen on the ORPort if you are behind a NAT.", + port_addr_str, desc_addr_str); + } + + if (dirport_v4_cfg != 0 && + !port_exists_by_type_addr32h_port(CONN_TYPE_DIR_LISTENER, + ipv4h_desc_addr, dirport_v4_cfg, 1)) { + const tor_addr_t *port_addr = get_first_advertised_addr_by_type_af( + CONN_TYPE_DIR_LISTENER, + AF_INET); + tor_addr_t desc_addr; + char port_addr_str[TOR_ADDR_BUF_LEN]; + char desc_addr_str[TOR_ADDR_BUF_LEN]; + + tor_addr_to_str(port_addr_str, port_addr, TOR_ADDR_BUF_LEN, 0); + + tor_addr_from_ipv4h(&desc_addr, ipv4h_desc_addr); + tor_addr_to_str(desc_addr_str, &desc_addr, TOR_ADDR_BUF_LEN, 0); + + log_warn(LD_CONFIG, "The configured IPv4 DirPort address %s does not " + "match the address %s in the descriptor. Please configure " + "matching IPv4 addresses for the Address and DirPort options. " + "Use NoListen on the DirPort if you are behind a NAT.", + port_addr_str, desc_addr_str); + } +} + /** Build a fresh routerinfo, signed server descriptor, and extra-info document * for this OR. Set r to the generated routerinfo, e to the generated * extra-info document. Return 0 on success, -1 on temporary error. Failure to @@ -1918,6 +1997,10 @@ router_build_fresh_descriptor(routerinfo_t **r, extrainfo_t **e) return -1; } + /* Log a message if the address in the descriptor doesn't match the ORPort + * and DirPort addresses configured by the operator. */ + router_check_descriptor_address_consistency(addr); + ri = tor_malloc_zero(sizeof(routerinfo_t)); ri->cache_info.routerlist_index = -1; ri->nickname = tor_strdup(options->Nickname);

1 0

[tor/master] Refactor duplicate code in router_check_descriptor_address_consistency
by nickm＠torproject.org 23 Aug '16

23 Aug '16

commit 427663428bf91dca0dfa2ede151cdb7eb9007408 Author: teor <teor2345(a)gmail.com> Date: Tue Aug 16 14:05:46 2016 +1000 Refactor duplicate code in router_check_descriptor_address_consistency No behaviour change --- src/or/router.c | 107 ++++++++++++++++++++++++-------------------------------- 1 file changed, 45 insertions(+), 62 deletions(-) diff --git a/src/or/router.c b/src/or/router.c index c6bbafb..db800b8 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -1896,6 +1896,47 @@ router_pick_published_address,(const or_options_t *options, uint32_t *addr)) return 0; } +/* Like router_check_descriptor_address_consistency, but specifically for the + * ORPort or DirPort. + * listener_type is either CONN_TYPE_OR_LISTENER or CONN_TYPE_DIR_LISTENER. */ +static void +router_check_descriptor_address_port_consistency(uint32_t ipv4h_desc_addr, + int listener_type) +{ + /* The first configured Port, which may be the magic constant CFG_AUTO_PORT. + */ + int port_v4_cfg = get_first_advertised_port_by_type_af(listener_type, + AF_INET); + if (port_v4_cfg != 0 && + !port_exists_by_type_addr32h_port(listener_type, + ipv4h_desc_addr, port_v4_cfg, 1)) { + const tor_addr_t *port_addr = get_first_advertised_addr_by_type_af( + listener_type, + AF_INET); + tor_addr_t desc_addr; + char port_addr_str[TOR_ADDR_BUF_LEN]; + char desc_addr_str[TOR_ADDR_BUF_LEN]; + + tor_addr_to_str(port_addr_str, port_addr, TOR_ADDR_BUF_LEN, 0); + + tor_addr_from_ipv4h(&desc_addr, ipv4h_desc_addr); + tor_addr_to_str(desc_addr_str, &desc_addr, TOR_ADDR_BUF_LEN, 0); + + log_warn(LD_CONFIG, "The configured IPv4 %sPort address %s does not " + "match the address %s in the descriptor. Please configure " + "the matching IPv4 addresses for this Tor relay as " + "Address <IPv4 address> in the torrc configuration file if " + "you have multiple public IP addresses. If you are behind a " + "NAT and have the right ports forwarded, you can ignore this " + "warning or, to remove it, use 2 %sPort lines with options " + "NoListen (for the public IPv4 address line) and NoAdvertise " + "(for the internal NAT IPv4 address line).", + listener_type ? "OR" : "Dir", + port_addr_str, desc_addr_str, + listener_type ? "OR" : "Dir"); + } +} + /* Tor relays only have one IPv4 address in the descriptor, which is derived * from the Address torrc option, or guessed using various methods in * router_pick_published_address(). @@ -1921,68 +1962,10 @@ router_pick_published_address,(const or_options_t *options, uint32_t *addr)) static void router_check_descriptor_address_consistency(uint32_t ipv4h_desc_addr) { - - /* The first configured ORPort and DirPort, which may be CFG_AUTO_PORT. */ - int orport_v4_cfg = get_first_advertised_port_by_type_af( - CONN_TYPE_OR_LISTENER, - AF_INET); - int dirport_v4_cfg = get_first_advertised_port_by_type_af( - CONN_TYPE_DIR_LISTENER, - AF_INET); - - if (orport_v4_cfg != 0 && - !port_exists_by_type_addr32h_port(CONN_TYPE_OR_LISTENER, - ipv4h_desc_addr, orport_v4_cfg, 1)) { - const tor_addr_t *port_addr = get_first_advertised_addr_by_type_af( - CONN_TYPE_OR_LISTENER, - AF_INET); - tor_addr_t desc_addr; - char port_addr_str[TOR_ADDR_BUF_LEN]; - char desc_addr_str[TOR_ADDR_BUF_LEN]; - - tor_addr_to_str(port_addr_str, port_addr, TOR_ADDR_BUF_LEN, 0); - - tor_addr_from_ipv4h(&desc_addr, ipv4h_desc_addr); - tor_addr_to_str(desc_addr_str, &desc_addr, TOR_ADDR_BUF_LEN, 0); - - log_warn(LD_CONFIG, "The configured IPv4 ORPort address %s does not " - "match the address %s in the descriptor. Please configure " - "the matching IPv4 addresses for this Tor relay as " - "Address <IPv4 address> in the torrc configuration file if " - "you have multiple public IP addresses. If you are behind a " - "NAT and have the right ports forwarded, you can ignore this " - "warning or, to remove it, use 2 ORPort lines with options " - "NoListen (for the public IPv4 address line) and NoAdvertise " - "(for the internal NAT IPv4 address line).", - port_addr_str, desc_addr_str); - } - - if (dirport_v4_cfg != 0 && - !port_exists_by_type_addr32h_port(CONN_TYPE_DIR_LISTENER, - ipv4h_desc_addr, dirport_v4_cfg, 1)) { - const tor_addr_t *port_addr = get_first_advertised_addr_by_type_af( - CONN_TYPE_DIR_LISTENER, - AF_INET); - tor_addr_t desc_addr; - char port_addr_str[TOR_ADDR_BUF_LEN]; - char desc_addr_str[TOR_ADDR_BUF_LEN]; - - tor_addr_to_str(port_addr_str, port_addr, TOR_ADDR_BUF_LEN, 0); - - tor_addr_from_ipv4h(&desc_addr, ipv4h_desc_addr); - tor_addr_to_str(desc_addr_str, &desc_addr, TOR_ADDR_BUF_LEN, 0); - - log_warn(LD_CONFIG, "The configured IPv4 DirPort address %s does not " - "match the address %s in the descriptor. Please configure " - "the matching IPv4 addresses for this Tor relay as " - "Address <IPv4 address> in the torrc configuration file if " - "you have multiple public IP addresses. If you are behind a " - "NAT and have the right ports forwarded, you can ignore this " - "warning or, to remove it, use 2 DirPort lines with options " - "NoListen (for the public IPv4 address line) and NoAdvertise " - "(for the internal NAT IPv4 address line).", - port_addr_str, desc_addr_str); - } + router_check_descriptor_address_port_consistency(ipv4h_desc_addr, + CONN_TYPE_OR_LISTENER); + router_check_descriptor_address_port_consistency(ipv4h_desc_addr, + CONN_TYPE_DIR_LISTENER); } /** Build a fresh routerinfo, signed server descriptor, and extra-info document

1 0

[tor/master] Check parameters to router_check_descriptor_address_port_consistency
by nickm＠torproject.org 23 Aug '16

23 Aug '16

commit 4b4389280e397e4c79c0ceea97094d8593419d7b Author: teor <teor2345(a)gmail.com> Date: Tue Aug 16 14:39:46 2016 +1000 Check parameters to router_check_descriptor_address_port_consistency --- src/or/router.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/or/router.c b/src/or/router.c index db800b8..8fed36c 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -1903,7 +1903,10 @@ static void router_check_descriptor_address_port_consistency(uint32_t ipv4h_desc_addr, int listener_type) { - /* The first configured Port, which may be the magic constant CFG_AUTO_PORT. + assert(listener_type == CONN_TYPE_OR_LISTENER || + listener_type == CONN_TYPE_DIR_LISTENER); + + /* The first advertised Port may be the magic constant CFG_AUTO_PORT. */ int port_v4_cfg = get_first_advertised_port_by_type_af(listener_type, AF_INET); @@ -1913,6 +1916,10 @@ router_check_descriptor_address_port_consistency(uint32_t ipv4h_desc_addr, const tor_addr_t *port_addr = get_first_advertised_addr_by_type_af( listener_type, AF_INET); + /* If we're building a descriptor with no advertised address, + * something is terribly wrong. */ + assert(port_addr); + tor_addr_t desc_addr; char port_addr_str[TOR_ADDR_BUF_LEN]; char desc_addr_str[TOR_ADDR_BUF_LEN];

1 0

[tor/master] Introduce ed25519_{sign, checksig}_prefixed functions().
by nickm＠torproject.org 23 Aug '16

23 Aug '16

commit b8bfdf638e9448ecda9dda1a2c02d7bbf4778341 Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue Aug 23 14:53:01 2016 +0300 Introduce ed25519_{sign,checksig}_prefixed functions(). --- src/common/crypto_ed25519.c | 95 +++++++++++++++++++++++++++++++++++++++++++++ src/common/crypto_ed25519.h | 11 ++++++ src/test/test_crypto.c | 35 +++++++++++++++++ 3 files changed, 141 insertions(+) diff --git a/src/common/crypto_ed25519.c b/src/common/crypto_ed25519.c index 84c3eec..817c1a2 100644 --- a/src/common/crypto_ed25519.c +++ b/src/common/crypto_ed25519.c @@ -184,9 +184,43 @@ ed25519_keypair_generate(ed25519_keypair_t *keypair_out, int extra_strong) return 0; } +/* Return a heap-allocated array that contains msg prefixed by the + * string prefix_str. Set final_msg_len_out to the size of the + * final array. If an error occured, return NULL. It's the resonsibility of the + * caller to free the returned array. */ +static uint8_t * +get_prefixed_msg(const uint8_t *msg, size_t msg_len, + const char *prefix_str, + size_t *final_msg_len_out) +{ + size_t prefixed_msg_len, prefix_len; + uint8_t *prefixed_msg; + + tor_assert(prefix_str); + tor_assert(final_msg_len_out); + + prefix_len = strlen(prefix_str); + + /* msg_len + strlen(prefix_str) must not overflow. */ + if (msg_len > SIZE_T_CEILING - prefix_len) { + return NULL; + } + + prefixed_msg_len = msg_len + prefix_len; + prefixed_msg = tor_malloc_zero(prefixed_msg_len); + + memcpy(prefixed_msg, prefix_str, prefix_len); + memcpy(prefixed_msg + prefix_len, msg, msg_len); + + *final_msg_len_out = prefixed_msg_len; + return prefixed_msg; +} + /** * Set signature_out to a signature of the len-byte message * msg, using the secret and public key in keypair. + * + * Return 0 if we successfuly signed the message, otherwise return -1. */ int ed25519_sign(ed25519_signature_t *signature_out, @@ -203,6 +237,37 @@ ed25519_sign(ed25519_signature_t *signature_out, } /** + * Like ed25519_sign(), but also prefix msg with prefix_str + * before signing. prefix_str must be a NUL-terminated string. + */ +int +ed25519_sign_prefixed(ed25519_signature_t *signature_out, + const uint8_t *msg, size_t msg_len, + const char *prefix_str, + const ed25519_keypair_t *keypair) +{ + int retval; + size_t prefixed_msg_len; + uint8_t *prefixed_msg; + + tor_assert(prefix_str); + + prefixed_msg = get_prefixed_msg(msg, msg_len, prefix_str, + &prefixed_msg_len); + if (!prefixed_msg) { + log_warn(LD_GENERAL, "Failed to get prefixed msg."); + return -1; + } + + retval = ed25519_sign(signature_out, + prefixed_msg, prefixed_msg_len, + keypair); + tor_free(prefixed_msg); + + return retval; +} + +/** * Check whether if signature is a valid signature for the * len-byte message in msg made with the key pubkey. * @@ -217,6 +282,36 @@ ed25519_checksig(const ed25519_signature_t *signature, get_ed_impl()->open(signature->sig, msg, len, pubkey->pubkey) < 0 ? -1 : 0; } +/** + * Like ed2519_checksig(), but also prefix msg with prefix_str + * before verifying signature. prefix_str must be a NUL-terminated + * string. + */ +int +ed25519_checksig_prefixed(const ed25519_signature_t *signature, + const uint8_t *msg, size_t msg_len, + const char *prefix_str, + const ed25519_public_key_t *pubkey) +{ + int retval; + size_t prefixed_msg_len; + uint8_t *prefixed_msg; + + prefixed_msg = get_prefixed_msg(msg, msg_len, prefix_str, + &prefixed_msg_len); + if (!prefixed_msg) { + log_warn(LD_GENERAL, "Failed to get prefixed msg."); + return -1; + } + + retval = ed25519_checksig(signature, + prefixed_msg, prefixed_msg_len, + pubkey); + tor_free(prefixed_msg); + + return retval; +} + /** Validate every signature among those in checkable, which contains * exactly n_checkable elements. If okay_out is non-NULL, set * the i'th element of okay_out to 1 if the i'th element of diff --git a/src/common/crypto_ed25519.h b/src/common/crypto_ed25519.h index 44c2ad9..31afc49 100644 --- a/src/common/crypto_ed25519.h +++ b/src/common/crypto_ed25519.h @@ -55,6 +55,17 @@ int ed25519_checksig(const ed25519_signature_t *signature, const uint8_t *msg, size_t len, const ed25519_public_key_t *pubkey); +int +ed25519_sign_prefixed(ed25519_signature_t *signature_out, + const uint8_t *msg, size_t len, + const char *prefix_str, + const ed25519_keypair_t *keypair); +int +ed25519_checksig_prefixed(const ed25519_signature_t *signature, + const uint8_t *msg, size_t len, + const char *prefix_str, + const ed25519_public_key_t *pubkey); + /** * A collection of information necessary to check an Ed25519 signature. Used * for batch verification. diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index ba2fb86..542512b 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -2242,6 +2242,41 @@ test_crypto_ed25519_simple(void *arg) tt_int_op(0, OP_EQ, ed25519_checksig_batch(NULL, ch, 2)); } + /* Test the string-prefixed sign/checksig functions */ + { + ed25519_signature_t manual_sig; + char *prefixed_msg; + + /* Generate a signature with a prefixed msg. */ + tt_int_op(0, OP_EQ, ed25519_sign_prefixed(&sig1, msg, msg_len, + "always in the mood", + &kp1)); + + /* First, check that ed25519_sign_prefixed() returns the exact same sig as + if we had manually prefixed the msg ourselves. */ + tor_asprintf(&prefixed_msg, "%s%s", "always in the mood", msg); + tt_int_op(0, OP_EQ, ed25519_sign(&manual_sig, (uint8_t *)prefixed_msg, + strlen(prefixed_msg), &kp1)); + tor_free(prefixed_msg); + tt_assert(!memcmp(sig1.sig, manual_sig.sig, sizeof(sig1.sig))); + + /* Test that prefixed checksig verifies it properly. */ + tt_int_op(0, OP_EQ, ed25519_checksig_prefixed(&sig1, msg, msg_len, + "always in the mood", + &pub1)); + + /* Test that checksig with wrong prefix fails. */ + tt_int_op(-1, OP_EQ, ed25519_checksig_prefixed(&sig1, msg, msg_len, + "always in the moo", + &pub1)); + tt_int_op(-1, OP_EQ, ed25519_checksig_prefixed(&sig1, msg, msg_len, + "always in the moon", + &pub1)); + tt_int_op(-1, OP_EQ, ed25519_checksig_prefixed(&sig1, msg, msg_len, + "always in the mood!", + &pub1)); + } + done: ; }

1 0

[tor/master] Merge remote-tracking branch 'asn/bug19872_v2'
by nickm＠torproject.org 23 Aug '16

23 Aug '16

commit a3d419634bef0bbac4118d08272d59c9fe66a1bb Merge: b3f43a2 b8bfdf6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Aug 23 08:50:32 2016 -0400 Merge remote-tracking branch 'asn/bug19872_v2' src/common/crypto_ed25519.c | 95 +++++++++++++++++++++++++++++++++++++++++++++ src/common/crypto_ed25519.h | 11 ++++++ src/test/test_crypto.c | 35 +++++++++++++++++ 3 files changed, 141 insertions(+)

1 0

[translation/tor-messenger-prefsdtd_completed] Update translations for tor-messenger-prefsdtd_completed
by translation＠torproject.org 23 Aug '16

23 Aug '16

commit cb0c834e5f88f1351a87faa1184a29e6ba669f40 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Aug 23 11:48:19 2016 +0000 Update translations for tor-messenger-prefsdtd_completed --- zh_TW/prefs.dtd | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/zh_TW/prefs.dtd b/zh_TW/prefs.dtd index d8dda2a..a8081ae 100644 --- a/zh_TW/prefs.dtd +++ b/zh_TW/prefs.dtd @@ -1,13 +1,22 @@ <!ENTITY prefs.otrPreferences "OTR偏好設定"> +<!ENTITY prefs.otrLabel "OTR"> +<!ENTITY prefs.coniksLabel "CONIKS"> <!ENTITY prefs.otrSettings "OTR 設定"> <!ENTITY prefs.requireEncryption "請求加密"> -<!ENTITY prefs.otrKeys "我的密鑰"> -<!ENTITY prefs.keyForAccount "帳戶的密鑰："> +<!ENTITY prefs.otrKeys "我的私密金鑰"> +<!ENTITY prefs.keyForAccount "帳戶的金鑰："> <!ENTITY prefs.fingerprint "指紋:"> <!ENTITY prefs.knownFingers "已知的指紋"> <!ENTITY prefs.introFingers "管理你所見過的指紋"> <!ENTITY prefs.showFingers "查看"> -<!ENTITY prefs.introSettings "這些設定已套用到所有 1對1 的對話中。"> +<!ENTITY prefs.introSettings "這些設定已套用到所有一對一的對話中。"> <!ENTITY prefs.verifyNudge "請經常微調方法來驗證您的聯絡人身份"> <!ENTITY prefs.emptyAccountList "沒有任何已設定的帳號"> -<!ENTITY prefs.generate "產生"> \ No newline at end of file +<!ENTITY prefs.generate "產生"> +<!ENTITY prefs.coniksConnection "連線"> +<!ENTITY prefs.coniksServerAddress "伺服器位址"> +<!ENTITY prefs.coniksServerPort "埠"> +<!ENTITY prefs.coniksAccountPolicy "帳號政策"> +<!ENTITY prefs.coniksPoliciesForAccount "帳號政策"> +<!ENTITY prefs.coniksPrivateLookups "私下查詢"> +<!ENTITY prefs.coniksSignedKeyChange "已簽署金鑰變更"> \ No newline at end of file

1 0

[translation/tor-messenger-prefsdtd] Update translations for tor-messenger-prefsdtd
by translation＠torproject.org 23 Aug '16

23 Aug '16

commit c6b616c89079ed4a1b5746358fa6aca3347a96ea Author: Translation commit bot <translation(a)torproject.org> Date: Tue Aug 23 11:48:06 2016 +0000 Update translations for tor-messenger-prefsdtd --- zh_TW/prefs.dtd | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/zh_TW/prefs.dtd b/zh_TW/prefs.dtd index 7e84ba2..a8081ae 100644 --- a/zh_TW/prefs.dtd +++ b/zh_TW/prefs.dtd @@ -3,20 +3,20 @@ <!ENTITY prefs.coniksLabel "CONIKS"> <!ENTITY prefs.otrSettings "OTR 設定"> <!ENTITY prefs.requireEncryption "請求加密"> -<!ENTITY prefs.otrKeys "我的密鑰"> -<!ENTITY prefs.keyForAccount "帳戶的密鑰："> +<!ENTITY prefs.otrKeys "我的私密金鑰"> +<!ENTITY prefs.keyForAccount "帳戶的金鑰："> <!ENTITY prefs.fingerprint "指紋:"> <!ENTITY prefs.knownFingers "已知的指紋"> <!ENTITY prefs.introFingers "管理你所見過的指紋"> <!ENTITY prefs.showFingers "查看"> -<!ENTITY prefs.introSettings "這些設定已套用到所有 1對1 的對話中。"> +<!ENTITY prefs.introSettings "這些設定已套用到所有一對一的對話中。"> <!ENTITY prefs.verifyNudge "請經常微調方法來驗證您的聯絡人身份"> <!ENTITY prefs.emptyAccountList "沒有任何已設定的帳號"> <!ENTITY prefs.generate "產生"> -<!ENTITY prefs.coniksConnection "Connection"> -<!ENTITY prefs.coniksServerAddress "Server Address"> -<!ENTITY prefs.coniksServerPort "Port"> -<!ENTITY prefs.coniksAccountPolicy "Account Policy"> -<!ENTITY prefs.coniksPoliciesForAccount "Policies for account:"> -<!ENTITY prefs.coniksPrivateLookups "Private lookups"> -<!ENTITY prefs.coniksSignedKeyChange "Signed key change"> \ No newline at end of file +<!ENTITY prefs.coniksConnection "連線"> +<!ENTITY prefs.coniksServerAddress "伺服器位址"> +<!ENTITY prefs.coniksServerPort "埠"> +<!ENTITY prefs.coniksAccountPolicy "帳號政策"> +<!ENTITY prefs.coniksPoliciesForAccount "帳號政策"> +<!ENTITY prefs.coniksPrivateLookups "私下查詢"> +<!ENTITY prefs.coniksSignedKeyChange "已簽署金鑰變更"> \ No newline at end of file

1 0