May 2017 - tor-commits - lists.torproject.org

[tor/master] Fix a compilation warning about duplicate typedef
by nickm＠torproject.org 22 May '17

22 May '17

commit cfe0a45750341c33f6f523f7eec734a7b551ad25 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 22 10:39:43 2017 -0400 Fix a compilation warning about duplicate typedef --- src/or/directory.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/or/directory.h b/src/or/directory.h index 9561ad7..9c977ea 100644 --- a/src/or/directory.h +++ b/src/or/directory.h @@ -47,7 +47,6 @@ int directory_must_use_begindir(const or_options_t *options); * directory we're going to ask for it, how we're going to contact that * directory, and (in some cases) what to do with it when we're done. */ -typedef struct circuit_guard_state_t circuit_guard_state_t; typedef struct directory_request_t directory_request_t; directory_request_t *directory_request_new(uint8_t dir_purpose); void directory_request_free(directory_request_t *req); @@ -58,7 +57,7 @@ void directory_request_set_dir_addr_port(directory_request_t *req, void directory_request_set_directory_id_digest(directory_request_t *req, const char *digest); void directory_request_set_guard_state(directory_request_t *req, - circuit_guard_state_t *state); + struct circuit_guard_state_t *state); void directory_request_set_router_purpose(directory_request_t *req, uint8_t router_purpose); void directory_request_set_indirection(directory_request_t *req,

1 0

[atlas/master] Improves the "Not recommended" tooltip text
by irl＠torproject.org 22 May '17

22 May '17

commit abd945a809090e248e5690c901ff80aadef158c2 Author: Iain R. Learmonth <irl(a)fsfe.org> Date: Fri May 19 00:22:20 2017 +0100 Improves the "Not recommended" tooltip text * This renames the "Not recommended" property to "Outdated Tor Version" * The description is amended to also point out that a version may be not recommended because it has known issues Fixes: #22294 --- templates/details/bridge.html | 4 ++-- templates/details/router.html | 4 ++-- templates/search/do.html | 6 +++++- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/templates/details/bridge.html b/templates/details/bridge.html index c2e5b80..c4b93c0 100644 --- a/templates/details/bridge.html +++ b/templates/details/bridge.html @@ -65,9 +65,9 @@ <% if (relay.get('recommended_version') === false) { propertyCount++; %> - + <img class="inline" alt="" src="img/properties/not_recommended_16x16.png"/> - Not recommended + Outdated Tor version <% } %> <%=propertyCount==0?'none':''%> diff --git a/templates/details/router.html b/templates/details/router.html index 7ea26bf..76b8ff6 100644 --- a/templates/details/router.html +++ b/templates/details/router.html @@ -97,9 +97,9 @@ <% if (relay.get('recommended_version') === false) { propertyCount++; %> - + <img class="inline" alt="" src="img/properties/not_recommended_16x16.png"/> - Not recommended + Outdated Tor version <% } %> <%=propertyCount==0?'none':''%> diff --git a/templates/search/do.html b/templates/search/do.html index a117d0e..56d8396 100644 --- a/templates/search/do.html +++ b/templates/search/do.html @@ -108,7 +108,11 @@ </td> <td> <% if (relay.get('recommended_version') === false) { %> - <img class="tip inline flags" src="img/properties/not_recommended_16x16.png" alt="Not recommended" title="Not recommended This relay is running a software version that is not recommended by the directory authorities."/> + <% if (relay.get('is_bridge')) { %> + <img class="tip" src="img/properties/not_recommended_16x16.png" alt="Outdated Tor version" title="Outdated Tor version This bridge is running a Tor version that is not recommended by the directory authorities and may contain known issues."/> + <% } else { %> + <img class="tip" src="img/properties/not_recommended_16x16.png" alt="Outdated Tor version" title="Outdated Tor version This relay is running a Tor version that is not recommended by the directory authorities and may contain known issues."/> + <% } %> <% } %> </td> <td><%= relay.get('or_port') %></td>

1 0

[atlas/master] Adds Vim swap files to the .gitignore
by irl＠torproject.org 22 May '17

22 May '17

commit 3a72c09363bd6f2ebe3f7669c97444c211cd4d3d Author: Iain R. Learmonth <irl(a)fsfe.org> Date: Mon May 22 14:52:35 2017 +0100 Adds Vim swap files to the .gitignore --- .gitignore | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.gitignore b/.gitignore index 66685a5..ebb65bf 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,5 @@ # Ignore git mergetool backup files *.orig + +# Ignore Vim swap files +*.swp

1 0

[atlas/master] Reverts not recommended icon to red (from black)
by irl＠torproject.org 22 May '17

22 May '17

commit cec47db1f15825ffb64c22995b4ea2750927fb23 Author: Iain R. Learmonth <irl(a)fsfe.org> Date: Mon May 22 15:20:41 2017 +0100 Reverts not recommended icon to red (from black) Closes: #22293 --- img/properties/not_recommended_16x16.png | Bin 260 -> 323 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/img/properties/not_recommended_16x16.png b/img/properties/not_recommended_16x16.png index 8d702c5..b8a3634 100644 Binary files a/img/properties/not_recommended_16x16.png and b/img/properties/not_recommended_16x16.png differ

1 0

[atlas/master] Ignore git mergetool backup files
by irl＠torproject.org 22 May '17

22 May '17

commit 46fb73bf4d3b3e654c71ba8dd195d53a05e2fe5c Author: cypherpunks <cypherpunks(a)torproject.org> Date: Sat May 20 17:16:16 2017 +0000 Ignore git mergetool backup files Closes #22314. --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..66685a5 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +# Ignore git mergetool backup files +*.orig

1 0

[tor/master] Set guard state on bridge descriptor fetches.
by nickm＠torproject.org 22 May '17

22 May '17

commit 52498b8183a2ab1da525180ee76f704d8257ebc6 Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon May 22 14:10:38 2017 +0300 Set guard state on bridge descriptor fetches. We used to not set the guard state in launch_direct_bridge_descriptor_fetch(). So when a bridge descriptor fetch failed, the guard subsystem would never learn about the fail (and hence the guard's reachability state would not be updated). --- changes/bug21969 | 3 +++ src/or/bridges.c | 6 ++++++ src/or/directory.c | 4 +--- src/or/directory.h | 3 +++ src/or/entrynodes.c | 28 ++++++++++++++++++++++++++++ src/or/entrynodes.h | 4 ++++ 6 files changed, 45 insertions(+), 3 deletions(-) diff --git a/changes/bug21969 b/changes/bug21969 new file mode 100644 index 0000000..9b116fc --- /dev/null +++ b/changes/bug21969 @@ -0,0 +1,3 @@ + o Major bugfixes (entry guards): + - Don't block bootstrapping when a primary bridge is offline and we can't + get its descriptor. Fixes bug 21969; bugfix on 0.3.0.3-alpha. diff --git a/src/or/bridges.c b/src/or/bridges.c index ef0638c..0818fb0 100644 --- a/src/or/bridges.c +++ b/src/or/bridges.c @@ -547,6 +547,7 @@ static void launch_direct_bridge_descriptor_fetch(bridge_info_t *bridge) { const or_options_t *options = get_options(); + circuit_guard_state_t *guard_state = NULL; if (connection_get_by_type_addr_port_purpose( CONN_TYPE_DIR, &bridge->addr, bridge->port, @@ -574,12 +575,17 @@ launch_direct_bridge_descriptor_fetch(bridge_info_t *bridge) memcpy(&bridge_addrport.addr, &bridge->addr, sizeof(tor_addr_t)); bridge_addrport.port = bridge->port; + guard_state = get_guard_state_for_bridge_desc_fetch(bridge->identity); + directory_request_t *req = directory_request_new(DIR_PURPOSE_FETCH_SERVERDESC); directory_request_set_or_addr_port(req, &bridge_addrport); directory_request_set_directory_id_digest(req, bridge->identity); directory_request_set_router_purpose(req, ROUTER_PURPOSE_BRIDGE); directory_request_set_resource(req, "authority.z"); + if (guard_state) { + directory_request_set_guard_state(req, guard_state); + } directory_initiate_request(req); directory_request_free(req); } diff --git a/src/or/directory.c b/src/or/directory.c index ef74c0f..960d864 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -123,8 +123,6 @@ static int client_likes_consensus(const struct consensus_cache_entry_t *ent, static void connection_dir_close_consensus_fetches( dir_connection_t *except_this_one, const char *resource); -static void directory_request_set_guard_state(directory_request_t *req, - struct circuit_guard_state_t *state); /********* START VARIABLES **********/ @@ -1273,7 +1271,7 @@ directory_request_set_rend_query(directory_request_t *req, /** Set a static circuit_guard_state_t object to affliate with the request in * req. This object will receive notification when the attempt to * connect to the guard either succeeds or fails. */ -static void +void directory_request_set_guard_state(directory_request_t *req, circuit_guard_state_t *state) { diff --git a/src/or/directory.h b/src/or/directory.h index a015c70..9561ad7 100644 --- a/src/or/directory.h +++ b/src/or/directory.h @@ -47,6 +47,7 @@ int directory_must_use_begindir(const or_options_t *options); * directory we're going to ask for it, how we're going to contact that * directory, and (in some cases) what to do with it when we're done. */ +typedef struct circuit_guard_state_t circuit_guard_state_t; typedef struct directory_request_t directory_request_t; directory_request_t *directory_request_new(uint8_t dir_purpose); void directory_request_free(directory_request_t *req); @@ -56,6 +57,8 @@ void directory_request_set_dir_addr_port(directory_request_t *req, const tor_addr_port_t *p); void directory_request_set_directory_id_digest(directory_request_t *req, const char *digest); +void directory_request_set_guard_state(directory_request_t *req, + circuit_guard_state_t *state); void directory_request_set_router_purpose(directory_request_t *req, uint8_t router_purpose); void directory_request_set_indirection(directory_request_t *req, diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 7a27cd0..a0a595b 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -2926,6 +2926,34 @@ entry_guard_get_by_id_digest(const char *digest) get_guard_selection_info(), digest); } +/** We are about to connect to bridge with identity digest to fetch its + * descriptor. Create a new guard state for this connection and return it. */ +circuit_guard_state_t * +get_guard_state_for_bridge_desc_fetch(const char *digest) +{ + circuit_guard_state_t *guard_state = NULL; + entry_guard_t *guard = NULL; + + guard = entry_guard_get_by_id_digest_for_guard_selection( + get_guard_selection_info(), digest); + if (!guard) { + return NULL; + } + + /* Update the guard last_tried_to_connect time since it's checked by the + * guard susbsystem. */ + guard->last_tried_to_connect = approx_time(); + + /* Create the guard state */ + guard_state = tor_malloc_zero(sizeof(circuit_guard_state_t)); + guard_state->guard = entry_guard_handle_new(guard); + guard_state->state = GUARD_CIRC_STATE_USABLE_ON_COMPLETION; + guard_state->state_set_at = approx_time(); + guard_state->restrictions = NULL; + + return guard_state; +} + /** Release all storage held by e. */ STATIC void entry_guard_free(entry_guard_t *e) diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index 400a842..11b618b 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -323,6 +323,10 @@ const node_t *guards_choose_dirguard(circuit_guard_state_t **guard_state_out); entry_guard_t *entry_guard_get_by_id_digest_for_guard_selection( guard_selection_t *gs, const char *digest); entry_guard_t *entry_guard_get_by_id_digest(const char *digest); + +circuit_guard_state_t * +get_guard_state_for_bridge_desc_fetch(const char *digest); + void entry_guards_changed_for_guard_selection(guard_selection_t *gs); void entry_guards_changed(void); guard_selection_t * get_guard_selection_info(void);

1 0

[tor/master] Merge remote-tracking branch 'asn/bug21969_bridges'
by nickm＠torproject.org 22 May '17

22 May '17

commit b2e9a107b7a69f29f88d9c5f67fea3cee3082cf0 Merge: 90894c8 52498b8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 22 09:09:16 2017 -0400 Merge remote-tracking branch 'asn/bug21969_bridges' changes/bug21969 | 3 +++ src/or/bridges.c | 6 ++++++ src/or/directory.c | 4 +--- src/or/directory.h | 3 +++ src/or/entrynodes.c | 28 ++++++++++++++++++++++++++++ src/or/entrynodes.h | 4 ++++ 6 files changed, 45 insertions(+), 3 deletions(-)

1 0

[tor/master] amend changes file to note that one case is still unfixed
by nickm＠torproject.org 22 May '17

22 May '17

commit 3d27954f2e932cf1965fabd2672a52f0ea13d940 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 22 09:10:00 2017 -0400 amend changes file to note that one case is still unfixed --- changes/bug21969 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changes/bug21969 b/changes/bug21969 index 9b116fc..5da8c4d 100644 --- a/changes/bug21969 +++ b/changes/bug21969 @@ -1,3 +1,3 @@ o Major bugfixes (entry guards): - Don't block bootstrapping when a primary bridge is offline and we can't - get its descriptor. Fixes bug 21969; bugfix on 0.3.0.3-alpha. + get its descriptor. Fixes one case of bug 21969; bugfix on 0.3.0.3-alpha.

1 0

[tor/master] Raise common code for creating circuit_guard_state_t
by nickm＠torproject.org 22 May '17

22 May '17

commit e5a929fef8df61b41b0f2e4a12bbcbe8d931a5cf Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 22 09:13:18 2017 -0400 Raise common code for creating circuit_guard_state_t This will help if we ever need to add more fields or change the semantics of existing fields. --- src/or/entrynodes.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index c334a7a..dc2cab2 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -2073,6 +2073,23 @@ circuit_guard_state_free(circuit_guard_state_t *state) tor_free(state); } +/** Allocate and return a new circuit_guard_state_t to track the result + * of using guard for a given operation. */ +static circuit_guard_state_t * +circuit_guard_state_new(entry_guard_t *guard, unsigned state, + entry_guard_restriction_t *rst) +{ + circuit_guard_state_t *result; + + result = tor_malloc_zero(sizeof(circuit_guard_state_t)); + result->guard = entry_guard_handle_new(guard); + result->state = state; + result->state_set_at = approx_time(); + result->restrictions = rst; + + return result; +} + /** * Pick a suitable entry guard for a circuit in, and place that guard * in *chosen_node_out. Set *guard_state_out to an opaque @@ -2111,11 +2128,7 @@ entry_guard_pick_for_circuit(guard_selection_t *gs, goto fail; *chosen_node_out = node; - *guard_state_out = tor_malloc_zero(sizeof(circuit_guard_state_t)); - (*guard_state_out)->guard = entry_guard_handle_new(guard); - (*guard_state_out)->state = state; - (*guard_state_out)->state_set_at = approx_time(); - (*guard_state_out)->restrictions = rst; + *guard_state_out = circuit_guard_state_new(guard, state, rst); return 0; fail: @@ -2945,11 +2958,9 @@ get_guard_state_for_bridge_desc_fetch(const char *digest) guard->last_tried_to_connect = approx_time(); /* Create the guard state */ - guard_state = tor_malloc_zero(sizeof(circuit_guard_state_t)); - guard_state->guard = entry_guard_handle_new(guard); - guard_state->state = GUARD_CIRC_STATE_USABLE_ON_COMPLETION; - guard_state->state_set_at = approx_time(); - guard_state->restrictions = NULL; + guard_state = circuit_guard_state_new(guard, + GUARD_CIRC_STATE_USABLE_ON_COMPLETION, + NULL); return guard_state; }

1 0

[tor/maint-0.3.0] dir auths reject 0.2.9.x for x<5, due to bug 20499
by nickm＠torproject.org 22 May '17

22 May '17

commit 6e5486b11ac113ab7cf42d167dd5555b5916ddbc Author: Roger Dingledine <arma(a)torproject.org> Date: Sun May 21 02:05:32 2017 -0400 dir auths reject 0.2.9.x for x<5, due to bug 20499 Directory authorities now reject relays running versions 0.2.9.1-alpha through 0.2.9.4-alpha, because those relays suffer from bug 20499 and don't keep their consensus cache up-to-date. Resolves ticket 20509. --- changes/bug20509 | 5 +++++ src/or/dirserv.c | 11 +++++++++++ 2 files changed, 16 insertions(+) diff --git a/changes/bug20509 b/changes/bug20509 new file mode 100644 index 0000000..a39ca9f --- /dev/null +++ b/changes/bug20509 @@ -0,0 +1,5 @@ + o Minor features: + - Directory authorities now reject relays running versions + 0.2.9.1-alpha through 0.2.9.4-alpha, because those relays + suffer from bug 20499 and don't keep their consensus cache + up-to-date. Resolves ticket 20509. diff --git a/src/or/dirserv.c b/src/or/dirserv.c index fa3938b..fedbe51 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -383,6 +383,17 @@ dirserv_get_status_impl(const char *id_digest, const char *nickname, return FP_REJECT; } + /* Tor 0.2.9.x where x<5 suffers from bug #20499, where relays don't + * keep their consensus up to date so they make bad guards. + * The simple fix is to just drop them from the network. */ + if (platform && + tor_version_as_new_as(platform,"0.2.9.0-alpha") && + !tor_version_as_new_as(platform,"0.2.9.5-alpha")) { + if (msg) + *msg = "Tor version contains bug 20499. Please upgrade!"; + return FP_REJECT; + } + status_by_digest = digestmap_get(fingerprint_list->status_by_digest, id_digest); if (status_by_digest)

1 0