May 2017 - tor-commits - lists.torproject.org

[tor/master] Fix some channelpadding test issues.
by nickm＠torproject.org 08 May '17

08 May '17

commit 9f8e462c89a8320f161f5a77661d573d889651cf Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Apr 28 16:50:24 2017 -0400 Fix some channelpadding test issues. asan was finding an alignment issue with a cast, so set the field in the trunnel struct and then encode it instead. Also, enable log capture and verification. --- src/test/test_channelpadding.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/src/test/test_channelpadding.c b/src/test/test_channelpadding.c index 9b04f55..8ea0f17 100644 --- a/src/test/test_channelpadding.c +++ b/src/test/test_channelpadding.c @@ -11,6 +11,7 @@ #include "config.h" #include <event.h> #include "compat_time.h" +#include "log_test_helpers.h" extern smartlist_t *connection_array; extern networkstatus_t *current_ns_consensus; @@ -231,7 +232,8 @@ dummy_timer_cb(tor_timer_t *t, void *arg, const monotime_t *now_mono) // actually returns when we don't expect any timers to fire. Otherwise, // the global_timer_event gets scheduled an hour from now, and the // base loop never returns. -void dummy_nop_timer(void) +void +dummy_nop_timer(void) { tor_timer_t *dummy_timer = timer_new(dummy_timer_cb, NULL); struct timeval timeout; @@ -633,16 +635,14 @@ test_channelpadding_negotiation(void *arg) cell.command = CELL_PADDING_NEGOTIATE; channelpadding_negotiate_set_command(&disable, CHANNELPADDING_COMMAND_STOP); + disable.version = 1; channelpadding_negotiate_encode(cell.payload, CELL_PAYLOAD_SIZE, &disable); - ((channelpadding_negotiate_t*)cell.payload)->version = 1; client_relay3->write_cell(client_relay3, &cell); tt_assert(relay3_client->padding_enabled); - disable.version = 1; tt_int_op(channelpadding_update_padding_for_channel(client_relay3, &disable), OP_EQ, -1); tt_assert(client_relay3->padding_enabled); - ((channelpadding_negotiate_t*)cell.payload)->version = 0; disable.version = 0; channelpadding_negotiate_encode(cell.payload, CELL_PAYLOAD_SIZE, &disable); client_relay3->write_cell(client_relay3, &cell); @@ -724,6 +724,7 @@ test_channelpadding_decide_to_pad_channel(void *arg) monotime_init(); timers_initialize(); + setup_full_capture_of_logs(LOG_WARN); channelpadding_new_consensus_params(NULL); chan = (channel_t*)new_fake_channeltls(0); @@ -786,6 +787,8 @@ test_channelpadding_decide_to_pad_channel(void *arg) tried_to_write_cell = 0; chan->next_padding_time_ms = monotime_coarse_absolute_msec() - 100; decision = channelpadding_decide_to_pad_channel(chan); + expect_log_msg("Channel padding timeout scheduled 100ms in the past. " + "Did the monotonic clock just jump?\n"); tt_int_op(decision, OP_EQ, CHANNELPADDING_PADDING_SENT); tt_int_op(tried_to_write_cell, OP_EQ, 1); tt_assert(!chan->pending_padding_callback); @@ -868,6 +871,7 @@ test_channelpadding_decide_to_pad_channel(void *arg) done: smartlist_free(connection_array); + teardown_capture_of_logs(); timers_shutdown(); channel_free_all();

1 0

[tor/master] Fix a breakage in test_options.c.
by nickm＠torproject.org 08 May '17

08 May '17

commit ae4d8c9c745b396049c3064b7dc764bbd9a58058 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Sep 22 17:35:33 2016 -0400 Fix a breakage in test_options.c. IMO, these tests should be calling options_init() to properly set everything to default values, but when that is done, about a dozen tests fail. Setting the one default value that broke the tests for my branch. Sorry for being lame. --- src/test/test_options.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/test/test_options.c b/src/test/test_options.c index ea929e5..ecf311d 100644 --- a/src/test/test_options.c +++ b/src/test/test_options.c @@ -354,6 +354,12 @@ get_options_test_data(const char *conf) result->opt = options_new(); result->old_opt = options_new(); result->def_opt = options_new(); + + // XXX: Really, all of these options should be set to defaults + // with options_init(), but about a dozen tests break when I do that. + // Being kinda lame and just fixing the immedate breakage for now.. + result->opt->ConnectionPadding = -1; // default must be "auto" + rv = config_get_lines(conf, &cl, 1); tt_assert(rv == 0); rv = config_assign(&options_format, result->opt, cl, 0, &msg);

1 0

[tor/master] Cache netflow-related consensus parameters.
by nickm＠torproject.org 08 May '17

08 May '17

commit 687a85950afc25010c80cd14539728b3a7ae5675 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Sep 22 17:52:25 2016 -0400 Cache netflow-related consensus parameters. Checking all of these parameter lists for every single connection every second seems like it could be an expensive waste. Updating globally cached versions when there is a new consensus will still allow us to apply consensus parameter updates to all existing connections immediately. --- src/or/channelpadding.c | 148 +++++++++++++++++++++++++++-------------- src/or/channelpadding.h | 1 + src/or/main.c | 4 ++ src/or/networkstatus.c | 2 + src/test/test_channelpadding.c | 11 +++ src/test/testing_common.c | 3 + 6 files changed, 118 insertions(+), 51 deletions(-) diff --git a/src/or/channelpadding.c b/src/or/channelpadding.c index 3156051..a84994a 100644 --- a/src/or/channelpadding.c +++ b/src/or/channelpadding.c @@ -29,6 +29,87 @@ STATIC int64_t channelpadding_compute_time_until_pad_for_netflow(channel_t *); /** The total number of pending channelpadding timers */ static uint64_t total_timers_pending; +/** These are cached consensus parameters for netflow */ +/** The timeout lower bound that is allowed before sending padding */ +static int consensus_nf_ito_low; +/** The timeout upper bound that is allowed before sending padding */ +static int consensus_nf_ito_high; +/** The timeout lower bound that is allowed before sending reduced padding */ +static int consensus_nf_ito_low_reduced; +/** The timeout upper bound that is allowed before sending reduced padding */ +static int consensus_nf_ito_high_reduced; +/** The connection timeout between relays */ +static int consensus_nf_conntimeout_relays; +/** The connection timeout for client connections */ +static int consensus_nf_conntimeout_clients; +/** Should we pad before circuits are actually used for client data? */ +static int consensus_nf_pad_before_usage; +/** Should we pad relay-to-relay connections? */ +static int consensus_nf_pad_relays; + +/** + * This function is called to update cached consensus parameters every time + * there is a consensus update. This allows us to move the consensus param + * search off of the critical path, so it does not need to be evaluated + * for every single connection, every second. + */ +void +channelpadding_new_consensus_params(networkstatus_t *ns) +{ +#define DFLT_NETFLOW_INACTIVE_KEEPALIVE_LOW 1500 +#define DFLT_NETFLOW_INACTIVE_KEEPALIVE_HIGH 9500 +#define DFLT_NETFLOW_INACTIVE_KEEPALIVE_MIN 0 +#define DFLT_NETFLOW_INACTIVE_KEEPALIVE_MAX 60000 + consensus_nf_ito_low = networkstatus_get_param(ns, "nf_ito_low", + DFLT_NETFLOW_INACTIVE_KEEPALIVE_LOW, + DFLT_NETFLOW_INACTIVE_KEEPALIVE_MIN, + DFLT_NETFLOW_INACTIVE_KEEPALIVE_MAX); + consensus_nf_ito_high = networkstatus_get_param(NULL, "nf_ito_high", + DFLT_NETFLOW_INACTIVE_KEEPALIVE_HIGH, + consensus_nf_ito_low, + DFLT_NETFLOW_INACTIVE_KEEPALIVE_MAX); + +#define DFLT_NETFLOW_REDUCED_KEEPALIVE_LOW 9000 +#define DFLT_NETFLOW_REDUCED_KEEPALIVE_HIGH 14000 +#define DFLT_NETFLOW_REDUCED_KEEPALIVE_MIN 0 +#define DFLT_NETFLOW_REDUCED_KEEPALIVE_MAX 60000 + consensus_nf_ito_low_reduced = + networkstatus_get_param(NULL, "nf_ito_low_reduced", + DFLT_NETFLOW_REDUCED_KEEPALIVE_LOW, + DFLT_NETFLOW_REDUCED_KEEPALIVE_MIN, + DFLT_NETFLOW_REDUCED_KEEPALIVE_MAX); + + consensus_nf_ito_high_reduced = + networkstatus_get_param(NULL, "nf_ito_high_reduced", + DFLT_NETFLOW_REDUCED_KEEPALIVE_HIGH, + consensus_nf_ito_low_reduced, + DFLT_NETFLOW_REDUCED_KEEPALIVE_MAX); + +#define CONNTIMEOUT_RELAYS_DFLT (60*60) // 1 hour +#define CONNTIMEOUT_RELAYS_MIN 60 +#define CONNTIMEOUT_RELAYS_MAX (7*24*60*60) // 1 week + consensus_nf_conntimeout_relays = + networkstatus_get_param(NULL, "nf_conntimeout_relays", + CONNTIMEOUT_RELAYS_DFLT, + CONNTIMEOUT_RELAYS_MIN, + CONNTIMEOUT_RELAYS_MAX); + +#define CIRCTIMEOUT_CLIENTS_DFLT (30*60) // 30 minutes +#define CIRCTIMEOUT_CLIENTS_MIN 60 +#define CIRCTIMEOUT_CLIENTS_MAX (24*60*60) // 24 hours + consensus_nf_conntimeout_clients = + networkstatus_get_param(NULL, "nf_conntimeout_clients", + CIRCTIMEOUT_CLIENTS_DFLT, + CIRCTIMEOUT_CLIENTS_MIN, + CIRCTIMEOUT_CLIENTS_MAX); + + consensus_nf_pad_before_usage = + networkstatus_get_param(NULL, "nf_pad_before_usage", 1, 0, 1); + + consensus_nf_pad_relays = + networkstatus_get_param(NULL, "nf_pad_relays", 0, 0, 1); +} + /** * Get a random netflow inactive timeout keepalive period in milliseconds, * the range for which is determined by consensus parameters, negotiation, @@ -47,21 +128,11 @@ static uint64_t total_timers_pending; * Returns the next timeout period (in milliseconds) after which we should * send a padding packet, or 0 if padding is disabled. */ -#define DFLT_NETFLOW_INACTIVE_KEEPALIVE_LOW 1500 -#define DFLT_NETFLOW_INACTIVE_KEEPALIVE_HIGH 9500 -#define DFLT_NETFLOW_INACTIVE_KEEPALIVE_MIN 0 -#define DFLT_NETFLOW_INACTIVE_KEEPALIVE_MAX 60000 STATIC int channelpadding_get_netflow_inactive_timeout_ms(const channel_t *chan) { - int low_timeout = networkstatus_get_param(NULL, "nf_ito_low", - DFLT_NETFLOW_INACTIVE_KEEPALIVE_LOW, - DFLT_NETFLOW_INACTIVE_KEEPALIVE_MIN, - DFLT_NETFLOW_INACTIVE_KEEPALIVE_MAX); - int high_timeout = networkstatus_get_param(NULL, "nf_ito_high", - DFLT_NETFLOW_INACTIVE_KEEPALIVE_HIGH, - low_timeout, - DFLT_NETFLOW_INACTIVE_KEEPALIVE_MAX); + int low_timeout = consensus_nf_ito_low; + int high_timeout = consensus_nf_ito_high; int X1, X2; if (low_timeout == 0 && low_timeout == high_timeout) @@ -162,12 +233,8 @@ channelpadding_update_padding_for_channel(channel_t *chan, /* Min must not be lower than the current consensus parameter nf_ito_low. */ - chan->padding_timeout_low_ms = MAX(networkstatus_get_param(NULL, - "nf_ito_low", - DFLT_NETFLOW_INACTIVE_KEEPALIVE_LOW, - DFLT_NETFLOW_INACTIVE_KEEPALIVE_MIN, - DFLT_NETFLOW_INACTIVE_KEEPALIVE_MAX), - pad_vars->ito_low_ms); + chan->padding_timeout_low_ms = MAX(consensus_nf_ito_low, + pad_vars->ito_low_ms); /* Max must not be lower than ito_low_ms */ chan->padding_timeout_high_ms = MAX(chan->padding_timeout_low_ms, @@ -399,6 +466,12 @@ channelpadding_compute_time_until_pad_for_netflow(channel_t *chan) uint64_t long_now = monotime_coarse_absolute_msec(); if (!chan->next_padding_time_ms) { + /* If the below line or crypto_rand_int() shows up on a profile, + * we can avoid getting a timeout until we're at least nt_ito_lo + * from a timeout window. That will prevent us from setting timers + * on connections that were active up to 1.5 seconds ago. + * Idle connections should only call this once every 5.5s on average + * though, so that might be a micro-optimization for little gain. */ int64_t padding_timeout = channelpadding_get_netflow_inactive_timeout_ms(chan); @@ -475,14 +548,7 @@ channelpadding_get_channel_idle_timeout(const channel_t *chan, + crypto_rand_int(CONNTIMEOUT_CLIENTS_BASE/2); } else { // Canonical relay-to-relay channels // 45..75min or consensus +/- 25% -#define CONNTIMEOUT_RELAYS_DFLT (60*60) // 1 hour -#define CONNTIMEOUT_RELAYS_MIN 60 -#define CONNTIMEOUT_RELAYS_MAX (7*24*60*60) // 1 week - timeout = networkstatus_get_param(NULL, "nf_conntimeout_relays", - CONNTIMEOUT_RELAYS_DFLT, - CONNTIMEOUT_RELAYS_MIN, - CONNTIMEOUT_RELAYS_MAX); - + timeout = consensus_nf_conntimeout_relays; timeout = 3*timeout/4 + crypto_rand_int(timeout/2); } @@ -522,13 +588,7 @@ channelpadding_get_circuits_available_timeout(void) int timeout = options->CircuitsAvailableTimeout; if (!timeout) { -#define CIRCTIMEOUT_CLIENTS_DFLT (30*60) // 30 minutes -#define CIRCTIMEOUT_CLIENTS_MIN 60 -#define CIRCTIMEOUT_CLIENTS_MAX (24*60*60) // 24 hours - timeout = networkstatus_get_param(NULL, "nf_conntimeout_clients", - CIRCTIMEOUT_CLIENTS_DFLT, - CIRCTIMEOUT_CLIENTS_MIN, - CIRCTIMEOUT_CLIENTS_MAX); + timeout = consensus_nf_conntimeout_clients; /* If ReducedConnectionPadding is set, we want to halve the duration of * the channel idle timeout, since reducing the additional time that @@ -579,21 +639,8 @@ channelpadding_reduce_padding_on_channel(channel_t *chan) channelpadding_send_disable_command(chan); } -#define DFLT_NETFLOW_REDUCED_KEEPALIVE_LOW 9000 -#define DFLT_NETFLOW_REDUCED_KEEPALIVE_HIGH 14000 -#define DFLT_NETFLOW_REDUCED_KEEPALIVE_MIN 0 -#define DFLT_NETFLOW_REDUCED_KEEPALIVE_MAX 60000 - chan->padding_timeout_low_ms = - networkstatus_get_param(NULL, "nf_ito_low_reduced", - DFLT_NETFLOW_REDUCED_KEEPALIVE_LOW, - DFLT_NETFLOW_REDUCED_KEEPALIVE_MIN, - DFLT_NETFLOW_REDUCED_KEEPALIVE_MAX); - - chan->padding_timeout_high_ms = - networkstatus_get_param(NULL, "nf_ito_high_reduced", - DFLT_NETFLOW_REDUCED_KEEPALIVE_HIGH, - chan->padding_timeout_low_ms, - DFLT_NETFLOW_REDUCED_KEEPALIVE_MAX); + chan->padding_timeout_low_ms = consensus_nf_ito_low_reduced; + chan->padding_timeout_high_ms = consensus_nf_ito_high_reduced; log_fn(LOG_INFO,LD_OR, "Reduced padding on channel "U64_FORMAT": lo=%d, hi=%d", @@ -621,7 +668,7 @@ channelpadding_decide_to_pad_channel(channel_t *chan) return CHANNELPADDING_WONTPAD; if (chan->channel_usage == CHANNEL_USED_FOR_FULL_CIRCS) { - if (!networkstatus_get_param(NULL, "nf_pad_before_usage", 1, 0, 1)) + if (!consensus_nf_pad_before_usage) return CHANNELPADDING_WONTPAD; } else if (chan->channel_usage != CHANNEL_USED_FOR_USER_TRAFFIC) { return CHANNELPADDING_WONTPAD; @@ -649,8 +696,7 @@ channelpadding_decide_to_pad_channel(channel_t *chan) /* If nf_pad_relays=1 is set in the consensus, we pad * on *all* idle connections, relay-relay or relay-client. * Otherwise pad only for client+bridge cons */ - if (is_client_channel || - networkstatus_get_param(NULL, "nf_pad_relays", 0, 0, 1)) { + if (is_client_channel || consensus_nf_pad_relays) { int64_t pad_time_ms = channelpadding_compute_time_until_pad_for_netflow(chan); diff --git a/src/or/channelpadding.h b/src/or/channelpadding.h index 07af7a6..e08f7a2 100644 --- a/src/or/channelpadding.h +++ b/src/or/channelpadding.h @@ -33,6 +33,7 @@ int channelpadding_send_enable_command(channel_t *chan, uint16_t low_timeout, int channelpadding_get_circuits_available_timeout(void); unsigned int channelpadding_get_channel_idle_timeout(const channel_t *, int); +void channelpadding_new_consensus_params(networkstatus_t *ns); #endif diff --git a/src/or/main.c b/src/or/main.c index 5bc132a..b729e0b 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -3033,6 +3033,10 @@ tor_init(int argc, char *argv[]) /* The options are now initialised */ const or_options_t *options = get_options(); + /* Initialize channelpadding parameters to defaults until we get + * a consensus */ + channelpadding_new_consensus_params(NULL); + /* Initialize predicted ports list after loading options */ predicted_ports_init(); diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c index 76b968a..4107542 100644 --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@ -63,6 +63,7 @@ #include "shared_random.h" #include "transports.h" #include "torcert.h" +#include "channelpadding.h" /** Map from lowercase nickname to identity digest of named server, if any. */ static strmap_t *named_server_map = NULL; @@ -1966,6 +1967,7 @@ networkstatus_set_current_consensus(const char *consensus, circuit_build_times_new_consensus_params( get_circuit_build_times_mutable(), c); + channelpadding_new_consensus_params(c); } /* Reset the failure count only if this consensus is actually valid. */ diff --git a/src/test/test_channelpadding.c b/src/test/test_channelpadding.c index de88bb2..9b04f55 100644 --- a/src/test/test_channelpadding.c +++ b/src/test/test_channelpadding.c @@ -174,6 +174,7 @@ setup_mock_network(void) = tor_malloc_zero(sizeof(networkstatus_t)); current_md_consensus->net_params = smartlist_new(); current_md_consensus->routerstatus_list = smartlist_new(); + channelpadding_new_consensus_params(current_md_consensus); relay1_relay2 = (channel_t*)new_fake_channeltls(2); relay1_relay2->write_cell = mock_channel_write_cell_relay1; @@ -259,6 +260,7 @@ test_channelpadding_timers(void *arg) monotime_init(); timers_initialize(); + channelpadding_new_consensus_params(NULL); for (int i = 0; i < CHANNELS_TO_TEST; i++) { chans[i] = (channel_t*)new_fake_channeltls(0); @@ -374,6 +376,7 @@ test_channelpadding_consensus(void *arg) = tor_malloc_zero(sizeof(networkstatus_t)); current_md_consensus->net_params = smartlist_new(); current_md_consensus->routerstatus_list = smartlist_new(); + channelpadding_new_consensus_params(current_md_consensus); get_options_mutable()->ORPort_set = 1; @@ -398,6 +401,7 @@ test_channelpadding_consensus(void *arg) smartlist_add(current_md_consensus->net_params, (void*)"nf_ito_high=0"); get_options_mutable()->ConnectionPadding = 1; + channelpadding_new_consensus_params(current_md_consensus); decision = channelpadding_decide_to_pad_channel(chan); tt_int_op(decision, OP_EQ, CHANNELPADDING_WONTPAD); @@ -427,6 +431,7 @@ test_channelpadding_consensus(void *arg) (void*)"nf_ito_low=100"); smartlist_add(current_md_consensus->net_params, (void*)"nf_ito_high=200"); + channelpadding_new_consensus_params(current_md_consensus); tried_to_write_cell = 0; decision = channelpadding_decide_to_pad_channel(chan); @@ -449,6 +454,7 @@ test_channelpadding_consensus(void *arg) (void*)"nf_ito_low=1500"); smartlist_add(current_md_consensus->net_params, (void*)"nf_ito_high=4500"); + channelpadding_new_consensus_params(current_md_consensus); channelpadding_send_enable_command(chan, 100, 200); tried_to_write_cell = 0; @@ -474,6 +480,7 @@ test_channelpadding_consensus(void *arg) smartlist_add(current_md_consensus->net_params, (void*)"nf_pad_relays=1"); + channelpadding_new_consensus_params(current_md_consensus); decision = channelpadding_decide_to_pad_channel(chan); tt_int_op(decision, OP_EQ, CHANNELPADDING_PADLATER); @@ -487,6 +494,7 @@ test_channelpadding_consensus(void *arg) /* Test 5: If we disable padding before channel usage, does that work? */ smartlist_add(current_md_consensus->net_params, (void*)"nf_pad_before_usage=0"); + channelpadding_new_consensus_params(current_md_consensus); tried_to_write_cell = 0; decision = channelpadding_decide_to_pad_channel(chan); tt_int_op(decision, OP_EQ, CHANNELPADDING_WONTPAD); @@ -508,6 +516,7 @@ test_channelpadding_consensus(void *arg) options->ORPort_set = 1; smartlist_add(current_md_consensus->net_params, (void*)"nf_conntimeout_relays=600"); + channelpadding_new_consensus_params(current_md_consensus); val = channelpadding_get_channel_idle_timeout(chan, 1); tt_int_op(val, OP_GE, 450); tt_int_op(val, OP_LE, 750); @@ -519,6 +528,7 @@ test_channelpadding_consensus(void *arg) options->ReducedConnectionPadding = 1; smartlist_add(current_md_consensus->net_params, (void*)"nf_conntimeout_clients=600"); + channelpadding_new_consensus_params(current_md_consensus); val = channelpadding_get_circuits_available_timeout(); tt_int_op(val, OP_GE, 600/2); tt_int_op(val, OP_LE, 600*2/2); @@ -714,6 +724,7 @@ test_channelpadding_decide_to_pad_channel(void *arg) monotime_init(); timers_initialize(); + channelpadding_new_consensus_params(NULL); chan = (channel_t*)new_fake_channeltls(0); channel_timestamp_active(chan); diff --git a/src/test/testing_common.c b/src/test/testing_common.c index 43cf0aa..07fd9e0 100644 --- a/src/test/testing_common.c +++ b/src/test/testing_common.c @@ -21,6 +21,7 @@ const char tor_git_revision[] = ""; #include "rephist.h" #include "backtrace.h" #include "test.h" +#include "channelpadding.h" #include <stdio.h> #ifdef HAVE_FCNTL_H @@ -309,6 +310,8 @@ main(int c, const char **v) init_pregenerated_keys(); + channelpadding_new_consensus_params(NULL); + predicted_ports_init(); atexit(remove_directory);

1 0

[tor/master] whitespace fixes
by nickm＠torproject.org 08 May '17

08 May '17

commit fb97f76e71ab06abe4b4927f743f6683e7aaedab Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 8 13:57:08 2017 -0400 whitespace fixes --- src/or/channel.c | 1 - src/or/channelpadding.c | 2 +- src/or/channeltls.c | 5 +++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/or/channel.c b/src/or/channel.c index 599b00a..5b184f1 100644 --- a/src/or/channel.c +++ b/src/or/channel.c @@ -86,7 +86,6 @@ static smartlist_t *active_listeners = NULL; /* All channel_listener_t instances in LISTENING state */ static smartlist_t *finished_listeners = NULL; - /** Map from channel->global_identifier to channel. Contains the same * elements as all_channels. */ HT_HEAD(channel_gid_map, channel_s) channel_gid_map = HT_INITIALIZER(); diff --git a/src/or/channelpadding.c b/src/or/channelpadding.c index 2370827..e57408a 100644 --- a/src/or/channelpadding.c +++ b/src/or/channelpadding.c @@ -564,7 +564,7 @@ channelpadding_get_channel_idle_timeout(const channel_t *chan, unsigned int timeout; /* Non-canonical and client channels only last for 3-4.5 min when idle */ - if (!is_canonical || CHANNEL_IS_CLIENT(chan, options)) { + if (!is_canonical || CHANNEL_IS_CLIENT(chan, options)) { #define CONNTIMEOUT_CLIENTS_BASE 180 // 3 to 4.5 min timeout = CONNTIMEOUT_CLIENTS_BASE + crypto_rand_int(CONNTIMEOUT_CLIENTS_BASE/2); diff --git a/src/or/channeltls.c b/src/or/channeltls.c index 4cdd554..f44e4fc 100644 --- a/src/or/channeltls.c +++ b/src/or/channeltls.c @@ -1806,12 +1806,13 @@ channel_tls_process_netinfo_cell(cell_t *cell, channel_tls_t *chan) if (me && !TLS_CHAN_TO_BASE(chan)->is_canonical_to_peer && channel_is_canonical(TLS_CHAN_TO_BASE(chan))) { + const char *descr = + TLS_CHAN_TO_BASE(chan)->get_remote_descr(TLS_CHAN_TO_BASE(chan), 0); log_info(LD_OR, "We made a connection to a relay at %s (fp=%s) but we think " "they will not consider this connection canonical. They " "think we are at %s, but we think its %s.", - safe_str(TLS_CHAN_TO_BASE(chan)->get_remote_descr(TLS_CHAN_TO_BASE(chan), - 0)), + safe_str(descr), safe_str(hex_str(chan->conn->identity_digest, DIGEST_LEN)), safe_str(tor_addr_is_null(&my_apparent_addr) ? "<none>" : fmt_and_decorate_addr(&my_apparent_addr)),

1 0

[tor/master] Remove a PredictedPortsRelevantTime test.
by nickm＠torproject.org 08 May '17

08 May '17

commit 20a3d4efac725b5887ec4aea503a93a478fa8438 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Sep 6 11:38:00 2016 -0700 Remove a PredictedPortsRelevantTime test. The option was deprecated by bug #17592. --- src/test/test_options.c | 25 ------------------------- 1 file changed, 25 deletions(-) diff --git a/src/test/test_options.c b/src/test/test_options.c index d5782e9..ea929e5 100644 --- a/src/test/test_options.c +++ b/src/test/test_options.c @@ -2327,30 +2327,6 @@ test_options_validate__hidserv(void *ignored) } static void -test_options_validate__predicted_ports(void *ignored) -{ - (void)ignored; - int ret; - char *msg; - setup_capture_of_logs(LOG_WARN); - - options_test_data_t *tdata = get_options_test_data( - "PredictedPortsRelevanceTime 100000000\n" - TEST_OPTIONS_DEFAULT_VALUES); - ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg); - tt_int_op(ret, OP_EQ, 0); - expect_log_msg("PredictedPortsRelevanceTime is too " - "large; clipping to 3600s.\n"); - tt_int_op(tdata->opt->PredictedPortsRelevanceTime, OP_EQ, 3600); - - done: - teardown_capture_of_logs(); - policies_free_all(); - free_options_test_data(tdata); - tor_free(msg); -} - -static void test_options_validate__path_bias(void *ignored) { (void)ignored; @@ -4535,7 +4511,6 @@ struct testcase_t options_tests[] = { LOCAL_VALIDATE_TEST(publish_server_descriptor), LOCAL_VALIDATE_TEST(testing), LOCAL_VALIDATE_TEST(hidserv), - LOCAL_VALIDATE_TEST(predicted_ports), LOCAL_VALIDATE_TEST(path_bias), LOCAL_VALIDATE_TEST(bandwidth), LOCAL_VALIDATE_TEST(circuits),

1 0

[tor/maint-0.3.0] Add getpid() to the seccomp2 sandbox.
by nickm＠torproject.org 08 May '17

08 May '17

commit 99e943998dcfd1263301224104ef98596325f9f2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 26 12:56:06 2017 -0400 Add getpid() to the seccomp2 sandbox. We hadn't needed this before, because most getpid() callers on Linux were looking at the vDSO version of getpid(). I don't know why at least one version of OpenSSL seems to be ignoring the vDSO, but this change should fix it. Fixes bug 21943; bugfix on 0.2.5.1-alpha when the sandbox was introduced. --- src/common/sandbox.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index ebc843e..95c9f83 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -155,6 +155,7 @@ static int filter_nopar_gen[] = { #ifdef __NR_getgid32 SCMP_SYS(getgid32), #endif + SCMP_SYS(getpid), #ifdef __NR_getrlimit SCMP_SYS(getrlimit), #endif

1 0

[tor/release-0.3.0] Add getpid() to the seccomp2 sandbox.
by nickm＠torproject.org 08 May '17

08 May '17

commit 99e943998dcfd1263301224104ef98596325f9f2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Apr 26 12:56:06 2017 -0400 Add getpid() to the seccomp2 sandbox. We hadn't needed this before, because most getpid() callers on Linux were looking at the vDSO version of getpid(). I don't know why at least one version of OpenSSL seems to be ignoring the vDSO, but this change should fix it. Fixes bug 21943; bugfix on 0.2.5.1-alpha when the sandbox was introduced. --- src/common/sandbox.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index ebc843e..95c9f83 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -155,6 +155,7 @@ static int filter_nopar_gen[] = { #ifdef __NR_getgid32 SCMP_SYS(getgid32), #endif + SCMP_SYS(getpid), #ifdef __NR_getrlimit SCMP_SYS(getrlimit), #endif

1 0

[tor/maint-0.3.0] Merge branch 'maint-0.2.9' into maint-0.3.0
by nickm＠torproject.org 08 May '17

08 May '17

commit d792d2a14ddb7d2ff62dea8ed7d15416b1254348 Merge: f587691 0df22e8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 8 13:40:26 2017 -0400 Merge branch 'maint-0.2.9' into maint-0.3.0 changes/bug21943 | 6 ++++++ src/common/sandbox.c | 1 + 2 files changed, 7 insertions(+)

1 0

[tor/maint-0.3.0] Merge branch 'bug21943_029' into maint-0.2.9
by nickm＠torproject.org 08 May '17

08 May '17

commit 0df22e8f5f5c4e1a329f2930f6eb9ecde1cf9848 Merge: 5ff0b51 1cdad97 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 8 13:40:14 2017 -0400 Merge branch 'bug21943_029' into maint-0.2.9 changes/bug21943 | 6 ++++++ src/common/sandbox.c | 1 + 2 files changed, 7 insertions(+)

1 0

[tor/maint-0.3.0] Add a changes file for 21943.
by nickm＠torproject.org 08 May '17

08 May '17

commit 1cdad9782d31f10e8e622a642b49f39deebc3737 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 8 13:39:59 2017 -0400 Add a changes file for 21943. --- changes/bug21943 | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/changes/bug21943 b/changes/bug21943 new file mode 100644 index 0000000..dbe2c72 --- /dev/null +++ b/changes/bug21943 @@ -0,0 +1,6 @@ + o Minor bugfixes (Linux seccomp2 sandbox): + - The getpid() system call is now permitted under the Linux seccomp2 + sandbox, to avoid crashing with versions of OpenSSL (and other + libraries) that attempt to learn the process's PID by using the + syscall rather than the VDSO code. Fixes bug 21943; bugfix on + 0.2.5.1-alpha.

1 0