November 2017 - tor-commits - lists.torproject.org

[tor/release-0.3.2] Check number of usable guards when applying md restrictions.
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 69f93f806c4531e9498257578a10935e7859390f Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Nov 20 18:11:59 2017 +0200 Check number of usable guards when applying md restrictions. We used to check whether we have enough filtered guards (guard set when torrc is applied) but that's not good enough, since that might be bad in some cases where many guards are not reachable (might cause overblocking and hence reacahbility issues). We now check if we have enough reachable filtered guards before applying md restrictions which should prevent overblocking. --- src/or/entrynodes.c | 30 ++++++++++++++---------------- src/or/entrynodes.h | 2 +- 2 files changed, 15 insertions(+), 17 deletions(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index dc02557b5..d63d9291b 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -966,7 +966,7 @@ entry_guard_learned_bridge_identity(const tor_addr_port_t *addrport, * violate it. */ STATIC int -num_reachable_filtered_guards(guard_selection_t *gs, +num_reachable_filtered_guards(const guard_selection_t *gs, const entry_guard_restriction_t *rst) { int n_reachable_filtered_guards = 0; @@ -1472,30 +1472,28 @@ guard_create_exit_restriction(const uint8_t *exit_id) return rst; } -/** If we have fewer than this many possible guards, don't set - * MD-availability-based restrictions: we might blacklist all of - * them. */ +/** If we have fewer than this many possible usable guards, don't set + * MD-availability-based restrictions: we might blacklist all of them. */ #define MIN_GUARDS_FOR_MD_RESTRICTION 10 /** Return true if we should set md dirserver restrictions. We might not want - * to set those if our network is too restricted, since we don't want to - * blacklist all our nodes. */ + * to set those if our guard options are too restricted, since we don't want + * to blacklist all of them. */ static int should_set_md_dirserver_restriction(void) { const guard_selection_t *gs = get_guard_selection_info(); + int num_usable_guards = num_reachable_filtered_guards(gs, NULL); - /* Compute the number of filtered guards */ - int n_filtered_guards = 0; - SMARTLIST_FOREACH_BEGIN(gs->sampled_entry_guards, entry_guard_t *, guard) { - if (guard->is_filtered_guard) { - ++n_filtered_guards; - } - } SMARTLIST_FOREACH_END(guard); + /* Don't set restriction if too few reachable filtered guards. */ + if (num_usable_guards < MIN_GUARDS_FOR_MD_RESTRICTION) { + log_info(LD_GUARD, "Not setting md restriction: only %d" + " usable guards.", num_usable_guards); + return 0; + } - /* Do we have enough filtered guards that we feel okay about blacklisting - * some for MD restriction? */ - return (n_filtered_guards >= MIN_GUARDS_FOR_MD_RESTRICTION); + /* We have enough usable guards: set MD restriction */ + return 1; } /** Allocate and return an outdated md guard restriction. Return NULL if no diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index 29de627de..39bff1438 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -521,7 +521,7 @@ STATIC void entry_guard_consider_retry(entry_guard_t *guard); STATIC void make_guard_confirmed(guard_selection_t *gs, entry_guard_t *guard); STATIC void entry_guards_update_confirmed(guard_selection_t *gs); STATIC void entry_guards_update_primary(guard_selection_t *gs); -STATIC int num_reachable_filtered_guards(guard_selection_t *gs, +STATIC int num_reachable_filtered_guards(const guard_selection_t *gs, const entry_guard_restriction_t *rst); STATIC void sampled_guards_update_from_consensus(guard_selection_t *gs); /**

1 0

[tor/master] Check number of usable guards when applying md restrictions.
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 69f93f806c4531e9498257578a10935e7859390f Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Nov 20 18:11:59 2017 +0200 Check number of usable guards when applying md restrictions. We used to check whether we have enough filtered guards (guard set when torrc is applied) but that's not good enough, since that might be bad in some cases where many guards are not reachable (might cause overblocking and hence reacahbility issues). We now check if we have enough reachable filtered guards before applying md restrictions which should prevent overblocking. --- src/or/entrynodes.c | 30 ++++++++++++++---------------- src/or/entrynodes.h | 2 +- 2 files changed, 15 insertions(+), 17 deletions(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index dc02557b5..d63d9291b 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -966,7 +966,7 @@ entry_guard_learned_bridge_identity(const tor_addr_port_t *addrport, * violate it. */ STATIC int -num_reachable_filtered_guards(guard_selection_t *gs, +num_reachable_filtered_guards(const guard_selection_t *gs, const entry_guard_restriction_t *rst) { int n_reachable_filtered_guards = 0; @@ -1472,30 +1472,28 @@ guard_create_exit_restriction(const uint8_t *exit_id) return rst; } -/** If we have fewer than this many possible guards, don't set - * MD-availability-based restrictions: we might blacklist all of - * them. */ +/** If we have fewer than this many possible usable guards, don't set + * MD-availability-based restrictions: we might blacklist all of them. */ #define MIN_GUARDS_FOR_MD_RESTRICTION 10 /** Return true if we should set md dirserver restrictions. We might not want - * to set those if our network is too restricted, since we don't want to - * blacklist all our nodes. */ + * to set those if our guard options are too restricted, since we don't want + * to blacklist all of them. */ static int should_set_md_dirserver_restriction(void) { const guard_selection_t *gs = get_guard_selection_info(); + int num_usable_guards = num_reachable_filtered_guards(gs, NULL); - /* Compute the number of filtered guards */ - int n_filtered_guards = 0; - SMARTLIST_FOREACH_BEGIN(gs->sampled_entry_guards, entry_guard_t *, guard) { - if (guard->is_filtered_guard) { - ++n_filtered_guards; - } - } SMARTLIST_FOREACH_END(guard); + /* Don't set restriction if too few reachable filtered guards. */ + if (num_usable_guards < MIN_GUARDS_FOR_MD_RESTRICTION) { + log_info(LD_GUARD, "Not setting md restriction: only %d" + " usable guards.", num_usable_guards); + return 0; + } - /* Do we have enough filtered guards that we feel okay about blacklisting - * some for MD restriction? */ - return (n_filtered_guards >= MIN_GUARDS_FOR_MD_RESTRICTION); + /* We have enough usable guards: set MD restriction */ + return 1; } /** Allocate and return an outdated md guard restriction. Return NULL if no diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index 29de627de..39bff1438 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -521,7 +521,7 @@ STATIC void entry_guard_consider_retry(entry_guard_t *guard); STATIC void make_guard_confirmed(guard_selection_t *gs, entry_guard_t *guard); STATIC void entry_guards_update_confirmed(guard_selection_t *gs); STATIC void entry_guards_update_primary(guard_selection_t *gs); -STATIC int num_reachable_filtered_guards(guard_selection_t *gs, +STATIC int num_reachable_filtered_guards(const guard_selection_t *gs, const entry_guard_restriction_t *rst); STATIC void sampled_guards_update_from_consensus(guard_selection_t *gs); /**

1 0

[tor/release-0.3.2] Merge branch 'maint-0.3.2' into release-0.3.2
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit b9be385fd686dd46ff51a403a0c2ac1d23c9002a Merge: e343cb8f6 da82e0b57 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 20 14:35:26 2017 -0500 Merge branch 'maint-0.3.2' into release-0.3.2 src/or/entrynodes.c | 30 ++++++++++++++---------------- src/or/entrynodes.h | 2 +- 2 files changed, 15 insertions(+), 17 deletions(-)

1 0

[tor/maint-0.3.2] Merge branch 'bug23783' into maint-0.3.2
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit e2d8300c1060050dad9092e211c6753376b87ad6 Merge: 846df5b3c 1bf36c183 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 20 14:25:12 2017 -0500 Merge branch 'bug23783' into maint-0.3.2 changes/bug23783 | 5 +++++ configure.ac | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.3.2] Include ws2_32 when trying to link openssl on windows in autoconf
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 1bf36c18374cdf97d52e0b3382a80457973514d0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 20 13:37:22 2017 -0500 Include ws2_32 when trying to link openssl on windows in autoconf Fixes bug 23783; bugfix on 0.3.2.2-alpha when we started looking for TLSv1_1_method(). --- changes/bug23783 | 5 +++++ configure.ac | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug23783 b/changes/bug23783 new file mode 100644 index 000000000..98c583a12 --- /dev/null +++ b/changes/bug23783 @@ -0,0 +1,5 @@ + o Minor bugfixes (compilation, windows): + - When detecting OpenSSL on Windows from our configure script, make sure + to try linking with the ws2_32 library. Fixes bug 23783; bugfix on + 0.3.2.2-alpha. + diff --git a/configure.ac b/configure.ac index 677470081..2ce16ff12 100644 --- a/configure.ac +++ b/configure.ac @@ -724,7 +724,7 @@ AC_ARG_WITH(ssl-dir, ]) AC_MSG_NOTICE([Now, we'll look for OpenSSL >= 1.0.1]) -TOR_SEARCH_LIBRARY(openssl, $tryssldir, [-lssl -lcrypto $TOR_LIB_GDI], +TOR_SEARCH_LIBRARY(openssl, $tryssldir, [-lssl -lcrypto $TOR_LIB_GDI $TOR_LIB_WS32], [#include <openssl/ssl.h>], [struct ssl_method_st; const struct ssl_method_st *TLSv1_1_method(void);], [TLSv1_1_method();], [],

1 0

[tor/master] Merge branch 'bug23783' into maint-0.3.2
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit e2d8300c1060050dad9092e211c6753376b87ad6 Merge: 846df5b3c 1bf36c183 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 20 14:25:12 2017 -0500 Merge branch 'bug23783' into maint-0.3.2 changes/bug23783 | 5 +++++ configure.ac | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/master] Merge branch 'maint-0.3.2'
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 9068e55ce8c11c6500b44347fb9159bb5a8ef8bf Merge: 729f9a286 e2d8300c1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 20 14:25:17 2017 -0500 Merge branch 'maint-0.3.2' changes/bug23783 | 5 +++++ configure.ac | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/master] Include ws2_32 when trying to link openssl on windows in autoconf
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 1bf36c18374cdf97d52e0b3382a80457973514d0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 20 13:37:22 2017 -0500 Include ws2_32 when trying to link openssl on windows in autoconf Fixes bug 23783; bugfix on 0.3.2.2-alpha when we started looking for TLSv1_1_method(). --- changes/bug23783 | 5 +++++ configure.ac | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug23783 b/changes/bug23783 new file mode 100644 index 000000000..98c583a12 --- /dev/null +++ b/changes/bug23783 @@ -0,0 +1,5 @@ + o Minor bugfixes (compilation, windows): + - When detecting OpenSSL on Windows from our configure script, make sure + to try linking with the ws2_32 library. Fixes bug 23783; bugfix on + 0.3.2.2-alpha. + diff --git a/configure.ac b/configure.ac index 677470081..2ce16ff12 100644 --- a/configure.ac +++ b/configure.ac @@ -724,7 +724,7 @@ AC_ARG_WITH(ssl-dir, ]) AC_MSG_NOTICE([Now, we'll look for OpenSSL >= 1.0.1]) -TOR_SEARCH_LIBRARY(openssl, $tryssldir, [-lssl -lcrypto $TOR_LIB_GDI], +TOR_SEARCH_LIBRARY(openssl, $tryssldir, [-lssl -lcrypto $TOR_LIB_GDI $TOR_LIB_WS32], [#include <openssl/ssl.h>], [struct ssl_method_st; const struct ssl_method_st *TLSv1_1_method(void);], [TLSv1_1_method();], [],

1 0

[tor/release-0.3.2] Include ws2_32 when trying to link openssl on windows in autoconf
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit 1bf36c18374cdf97d52e0b3382a80457973514d0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 20 13:37:22 2017 -0500 Include ws2_32 when trying to link openssl on windows in autoconf Fixes bug 23783; bugfix on 0.3.2.2-alpha when we started looking for TLSv1_1_method(). --- changes/bug23783 | 5 +++++ configure.ac | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug23783 b/changes/bug23783 new file mode 100644 index 000000000..98c583a12 --- /dev/null +++ b/changes/bug23783 @@ -0,0 +1,5 @@ + o Minor bugfixes (compilation, windows): + - When detecting OpenSSL on Windows from our configure script, make sure + to try linking with the ws2_32 library. Fixes bug 23783; bugfix on + 0.3.2.2-alpha. + diff --git a/configure.ac b/configure.ac index 677470081..2ce16ff12 100644 --- a/configure.ac +++ b/configure.ac @@ -724,7 +724,7 @@ AC_ARG_WITH(ssl-dir, ]) AC_MSG_NOTICE([Now, we'll look for OpenSSL >= 1.0.1]) -TOR_SEARCH_LIBRARY(openssl, $tryssldir, [-lssl -lcrypto $TOR_LIB_GDI], +TOR_SEARCH_LIBRARY(openssl, $tryssldir, [-lssl -lcrypto $TOR_LIB_GDI $TOR_LIB_WS32], [#include <openssl/ssl.h>], [struct ssl_method_st; const struct ssl_method_st *TLSv1_1_method(void);], [TLSv1_1_method();], [],

1 0

[tor/release-0.3.2] Merge branch 'bug23783' into maint-0.3.2
by nickm＠torproject.org 20 Nov '17

20 Nov '17

commit e2d8300c1060050dad9092e211c6753376b87ad6 Merge: 846df5b3c 1bf36c183 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 20 14:25:12 2017 -0500 Merge branch 'bug23783' into maint-0.3.2 changes/bug23783 | 5 +++++ configure.ac | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0