tor-commits May 2017

tor-commits@lists.torproject.org

16 participants
1135 discussions

[tor/master] hs: Refactor rend_add_service()
by nickm＠torproject.org 05 May '17

05 May '17

commit 6f27843d578a830e9dbf44dfe9aa4d84cdcc6d15 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Apr 24 14:51:34 2017 -0400 hs: Refactor rend_add_service() Remove duplicate code that validates a service object which is now in rend_validate_service(). Add some comments on why we nullify a service in the code path of rend_config_services(). Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/rendservice.c | 142 +++++++++… [View More]++++++------------------------------------ 1 file changed, 40 insertions(+), 102 deletions(-) diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 9012fff..53901fc 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -320,11 +320,9 @@ rend_validate_service(const smartlist_t *service_list, return -1; } -/** Validate <b>service</b> and add it to <b>service_list</b>, or to - * the global rend_service_list if <b>service_list</b> is NULL. - * Return 0 on success. On failure, free <b>service</b> and return -1. - * Takes ownership of <b>service</b>. - */ +/** Add it to <b>service_list</b>, or to the global rend_service_list if + * <b>service_list</b> is NULL. Return 0 on success. On failure, free + * <b>service</b> and return -1. Takes ownership of <b>service</b>. */ static int rend_add_service(smartlist_t *service_list, rend_service_t *service) { @@ -343,100 +341,35 @@ rend_add_service(smartlist_t *service_list, rend_service_t *service) service->intro_nodes = smartlist_new(); service->expiring_nodes = smartlist_new(); - if (service->max_streams_per_circuit < 0) { - log_warn(LD_CONFIG, "Hidden service (%s) configured with negative max " - "streams per circuit.", - rend_service_escaped_dir(service)); - rend_service_free(service); - return -1; - } - - if (service->max_streams_close_circuit < 0 || - service->max_streams_close_circuit > 1) { - log_warn(LD_CONFIG, "Hidden service (%s) configured with invalid " - "max streams handling.", - rend_service_escaped_dir(service)); - rend_service_free(service); - return -1; - } - - if (service->auth_type != REND_NO_AUTH && - (!service->clients || - smartlist_len(service->clients) == 0)) { - log_warn(LD_CONFIG, "Hidden service (%s) with client authorization but no " - "clients.", - rend_service_escaped_dir(service)); - rend_service_free(service); - return -1; - } - - if (!service->ports || !smartlist_len(service->ports)) { - log_warn(LD_CONFIG, "Hidden service (%s) with no ports configured.", - rend_service_escaped_dir(service)); - rend_service_free(service); - return -1; - } else { - int dupe = 0; - /* XXX This duplicate check has two problems: - * - * a) It's O(n^2), but the same comment from the bottom of - * rend_config_services() should apply. - * - * b) We only compare directory paths as strings, so we can't - * detect two distinct paths that specify the same directory - * (which can arise from symlinks, case-insensitivity, bind - * mounts, etc.). - * - * It also can't detect that two separate Tor instances are trying - * to use the same HiddenServiceDir; for that, we would need a - * lock file. But this is enough to detect a simple mistake that - * at least one person has actually made. - */ - tor_assert(s_list); - if (!rend_service_is_ephemeral(service)) { - /* Skip dupe for ephemeral services. */ - SMARTLIST_FOREACH(s_list, rend_service_t*, ptr, - dupe = dupe || - !strcmp(ptr->directory, service->directory)); - if (dupe) { - log_warn(LD_REND, "Another hidden service is already configured for " - "directory %s.", - rend_service_escaped_dir(service)); - rend_service_free(service); - return -1; - } - } - log_debug(LD_REND,"Configuring service with directory %s", - rend_service_escaped_dir(service)); - for (i = 0; i < smartlist_len(service->ports); ++i) { - p = smartlist_get(service->ports, i); - if (!(p->is_unix_addr)) { - log_debug(LD_REND, - "Service maps port %d to %s", - p->virtual_port, - fmt_addrport(&p->real_addr, p->real_port)); - } else { + log_debug(LD_REND,"Configuring service with directory %s", + rend_service_escaped_dir(service)); + for (i = 0; i < smartlist_len(service->ports); ++i) { + p = smartlist_get(service->ports, i); + if (!(p->is_unix_addr)) { + log_debug(LD_REND, + "Service maps port %d to %s", + p->virtual_port, + fmt_addrport(&p->real_addr, p->real_port)); + } else { #ifdef HAVE_SYS_UN_H - log_debug(LD_REND, - "Service maps port %d to socket at \"%s\"", - p->virtual_port, p->unix_addr); + log_debug(LD_REND, + "Service maps port %d to socket at \"%s\"", + p->virtual_port, p->unix_addr); #else - log_warn(LD_BUG, - "Service maps port %d to an AF_UNIX socket, but we " - "have no AF_UNIX support on this platform. This is " - "probably a bug.", - p->virtual_port); - rend_service_free(service); - return -1; + log_warn(LD_BUG, + "Service maps port %d to an AF_UNIX socket, but we " + "have no AF_UNIX support on this platform. This is " + "probably a bug.", + p->virtual_port); + rend_service_free(service); + return -1; #endif /* defined(HAVE_SYS_UN_H) */ - } } - /* The service passed all the checks */ - tor_assert(s_list); - smartlist_add(s_list, service); - return 0; } - /* NOTREACHED */ + /* The service passed all the checks */ + tor_assert(s_list); + smartlist_add(s_list, service); + return 0; } /** Return a new rend_service_port_config_t with its path set to @@ -747,17 +680,18 @@ rend_config_services(const or_options_t *options, int validate_only) for (line = options->RendConfigLines; line; line = line->next) { if (!strcasecmp(line->key, "HiddenServiceDir")) { if (service) { + /* Validate and register the service we just finished parsing this + * code registers every service except the last one parsed, which is + * validated and registered below the loop. */ if (rend_validate_service(rend_service_staging_list, service) < 0) { goto free_and_return; } - } - /* register the service we just finished parsing - * this code registers every service except the last one parsed, - * which is registered below the loop */ - if (rend_service_check_dir_and_add(rend_service_staging_list, options, - service, validate_only) < 0) { - service = NULL; - goto free_and_return; + if (rend_service_check_dir_and_add(rend_service_staging_list, options, + service, validate_only) < 0) { + /* The above frees the service on error so nullify the pointer. */ + service = NULL; + goto free_and_return; + } } service = tor_malloc_zero(sizeof(rend_service_t)); service->directory = tor_strdup(line->value); @@ -962,9 +896,13 @@ rend_config_services(const or_options_t *options, int validate_only) * within the loop. It is ok for this service to be NULL, it is ignored. */ if (rend_service_check_dir_and_add(rend_service_staging_list, options, service, validate_only) < 0) { + /* Service object is freed on error so nullify pointer. */ service = NULL; goto free_and_return; } + /* The service is in the staging list so nullify pointer to avoid double + * free of this object in case of error because we lost ownership of it at + * this point. */ service = NULL; /* Free the newly added services if validating */ [View Less]

1 0

[tor/master] hs: Add rend_validate_service() function
by nickm＠torproject.org 05 May '17

05 May '17

commit ed7c0170c48fe4c0d86734969cf24c94d442cfcb Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Apr 24 14:39:54 2017 -0400 hs: Add rend_validate_service() function This new function validates a service object and is used everytime a service is successfully loaded from the configuration file. It is currently copying the validation that rend_add_service() also does which means both functions validate. It will be decoupled in the next commit. … [View More] Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/rendservice.c | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+) diff --git a/src/or/rendservice.c b/src/or/rendservice.c index c19c85f..9012fff 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -245,6 +245,81 @@ rend_service_free_all(void) rend_service_list = NULL; } +/* Validate a <b>service</b>. Use the <b>service_list</b> to make sure there + * is no duplicate entry for the given service object. Return 0 if valid else + * -1 if not.*/ +static int +rend_validate_service(const smartlist_t *service_list, + const rend_service_t *service) +{ + int dupe = 0; + + tor_assert(service_list); + tor_assert(service); + + if (service->max_streams_per_circuit < 0) { + log_warn(LD_CONFIG, "Hidden service (%s) configured with negative max " + "streams per circuit.", + rend_service_escaped_dir(service)); + goto invalid; + } + + if (service->max_streams_close_circuit < 0 || + service->max_streams_close_circuit > 1) { + log_warn(LD_CONFIG, "Hidden service (%s) configured with invalid " + "max streams handling.", + rend_service_escaped_dir(service)); + goto invalid; + } + + if (service->auth_type != REND_NO_AUTH && + (!service->clients || smartlist_len(service->clients) == 0)) { + log_warn(LD_CONFIG, "Hidden service (%s) with client authorization but " + "no clients.", + rend_service_escaped_dir(service)); + goto invalid; + } + + if (!service->ports || !smartlist_len(service->ports)) { + log_warn(LD_CONFIG, "Hidden service (%s) with no ports configured.", + rend_service_escaped_dir(service)); + goto invalid; + } + + /* XXX This duplicate check has two problems: + * + * a) It's O(n^2), but the same comment from the bottom of + * rend_config_services() should apply. + * + * b) We only compare directory paths as strings, so we can't + * detect two distinct paths that specify the same directory + * (which can arise from symlinks, case-insensitivity, bind + * mounts, etc.). + * + * It also can't detect that two separate Tor instances are trying + * to use the same HiddenServiceDir; for that, we would need a + * lock file. But this is enough to detect a simple mistake that + * at least one person has actually made. + */ + if (!rend_service_is_ephemeral(service)) { + /* Skip dupe for ephemeral services. */ + SMARTLIST_FOREACH(service_list, rend_service_t *, ptr, + dupe = dupe || + !strcmp(ptr->directory, service->directory)); + if (dupe) { + log_warn(LD_REND, "Another hidden service is already configured for " + "directory %s.", + rend_service_escaped_dir(service)); + goto invalid; + } + } + + /* Valid. */ + return 0; + invalid: + return -1; +} + /** Validate <b>service</b> and add it to <b>service_list</b>, or to * the global rend_service_list if <b>service_list</b> is NULL. * Return 0 on success. On failure, free <b>service</b> and return -1. @@ -671,6 +746,11 @@ rend_config_services(const or_options_t *options, int validate_only) for (line = options->RendConfigLines; line; line = line->next) { if (!strcasecmp(line->key, "HiddenServiceDir")) { + if (service) { + if (rend_validate_service(rend_service_staging_list, service) < 0) { + goto free_and_return; + } + } /* register the service we just finished parsing * this code registers every service except the last one parsed, * which is registered below the loop */ @@ -872,6 +952,11 @@ rend_config_services(const or_options_t *options, int validate_only) } } } + /* Validate the last service that we just parsed. */ + if (service && + rend_validate_service(rend_service_staging_list, service) < 0) { + goto free_and_return; + } /* register the final service after we have finished parsing all services * this code only registers the last service, other services are registered * within the loop. It is ok for this service to be NULL, it is ignored. */ [View Less]

1 0

[tor/master] Merge remote-tracking branch 'dgoulet/ticket21978_031_02'
by nickm＠torproject.org 05 May '17

05 May '17

commit 9decf86711133acf7ed2679831b21e53c9cb92ca Merge: 60e9795 6f27843 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 5 16:32:25 2017 -0400 Merge remote-tracking branch 'dgoulet/ticket21978_031_02' src/or/rendservice.c | 209 ++++++++++++++++++++++++++++----------------------- 1 file changed, 116 insertions(+), 93 deletions(-)

1 0

[depictor/master] Promote limegreen for the linegraphs and demote yellow. Closes 22108
by tom＠torproject.org 05 May '17

05 May '17

commit 1a9fc3ed6490777b3eed01bbca11d6cdcd2a609e Author: Tom Ritter <tom(a)ritter.vg> Date: Fri May 5 12:00:24 2017 -0500 Promote limegreen for the linegraphs and demote yellow. Closes 22108 --- graphs.py | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/graphs.py b/graphs.py index 65de394..0e2a94e 100755 --- a/graphs.py +++ b/graphs.py @@ -87,14 +87,14 @@ class GraphWriter(WebsiteWriter): + " .orange {\n" + " fill: orange;\n"… [View More]

1 0

[tor-browser-build/master] Bug 21824: use runc instead of docker
by boklm＠torproject.org 05 May '17

05 May '17

commit 2d98c063010fc5b0f8da3e386587a501e27507b9 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Tue Apr 25 22:06:10 2017 +0200 Bug 21824: use runc instead of docker --- README | 25 ++---- keyring/ubuntu.gpg | Bin 0 -> 32904 bytes projects/binutils/config | 5 +- projects/cmake/config | 6 +- projects/common/runc-config.json | 179 ++++++++++++++++++++++++++++++++++++++ projects/container-image/build … [View More]

1 0

[onionoo/master] Fix two typographical errors in the documentation
by karsten＠torproject.org 05 May '17

05 May '17

commit 1e506dd321136e3a5b1cc8bfecf902f0f88a0de6 Author: cypherpunks <cypherpunks(a)torproject.org> Date: Fri May 5 12:13:46 2017 +0000 Fix two typographical errors in the documentation Closes #22169. --- src/main/resources/web/index.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/resources/web/index.html b/src/main/resources/web/index.html index d8fe74a..ab79638 100644 --- a/src/main/resources/web/index.html +++ b/src/main/resources/… [View More]

1 0

[onionoo/master] Remove unused protocol page.
by karsten＠torproject.org 05 May '17

05 May '17

commit 7bbbaf4f8f52f0d68cc7ee59ef835554526445f6 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Fri May 5 15:01:12 2017 +0200 Remove unused protocol page. --- src/main/resources/web/protocol.html | 156 ----------------------------------- 1 file changed, 156 deletions(-) diff --git a/src/main/resources/web/protocol.html b/src/main/resources/web/protocol.html deleted file mode 100644 index bafeeb1..0000000 --- a/src/main/resources/web/protocol.html +++ /dev/null @@ -1,… [View More]156 +0,0 @@ -<!DOCTYPE HTML> -<html lang="en" style="min-height:100%;"> -<head> - - <title>Onionoo</title> - - <meta charset="utf-8"> - <link href="images/favicon.ico" type="image/x-icon" rel="shortcut icon"> - -  - <meta name="HandheldFriendly" content="True"> - <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"> - <meta name="apple-mobile-web-app-capable" content="yes"> - -  - <link rel="apple-touch-icon" href="images/apple-touch-icon-152x152.png"> - <link rel="shortcut icon" href="images/android-icon.png" sizes="196x196"> - <meta name="msapplication-square70x70logo" content="images/smalltile.png"> - <meta name="msapplication-square150x150logo" content="images/mediumtile.png"> - <meta name="msapplication-wide310x150logo" content="images/widetile.png"> - <meta name="msapplication-square310x310logo" content="images/largetile.png"> - -  - <script src="js/jquery-3.1.1.min.js"></script> - -  - <link rel="stylesheet" href="css/bootstrap.min.css"> - <script src="js/bootstrap.min.js"></script> - -  - <link rel="stylesheet" href="css/font-awesome.min.css"> - <link rel="stylesheet" href="fonts/source-sans-pro.css"> - -  - <link rel="stylesheet" href="css/style.css"> - <script src="js/script.js"></script> - -</head> - -<body class="noscript" style="background-image:url(images/ajax-loader.gif);background-repeat:no-repeat;background-position:center center;"> - - - -<div id="wrapper" style="display:none;"> - - - - -<nav class="navbar navbar-default navbar-secondary"> - <div class="container-fluid visible-xs"> - <input type="checkbox" id="navbar-toggle-checkbox"> - <div class="navbar-header"> - <label for="navbar-toggle-checkbox" type="button" class="navbar-toggle collapsed" data-toggle="collapse" data-target="#bs-example-navbar-secondary" aria-expanded="false"> - <span class="sr-only">Toggle navigation</span> - <span class="icon-bar"></span> - <span class="icon-bar"></span> - <span class="icon-bar"></span> - </label> - <a class="navbar-brand visible-xs" href="/"><img src="images/onionoo-wordmark-white.png" width="221" height="40" alt="Onionoo"></a> - </div> -  - <div class="collapse navbar-collapse" id="bs-example-navbar-secondary"> - <ul class="nav navbar-nav navbar-right"> - - -  - <li><a href="#general">General</a></li> - <li><a href="#versions">Protocol versions</a></li> - <li><a href="#methods">Methods</a></li> - <li><a href="#responses">Responses</a></li> - <li><a href="#summary">Summary documents</a></li> - <li><a href="#details">Details documents</a></li> - <li><a href="#history">History objects</a></li> - <li><a href="#bandwidth">Bandwidth documents</a></li> - <li><a href="#weights">Weights documents</a></li> - <li><a href="#clients">Clients documents</a></li> - <li><a href="#uptime">Uptime documents</a></li> - <li><a href="#examples">Example usage</a></li> -  - - </ul> - </div> - - </div> -</nav> - - - - - -<div class="page-header hidden-xs"> - <a href="/"><img src="images/tor-logo-weiss.png" width="162" height="100" alt="" id="onionoo-logo"></a> - <span style="display:inline-block;width:20px;"></span> - <a href="/"><img src="images/onionoo-wordmark-white.png" width="221" height="40" alt="Onionoo" id="onionoo-wordmark"></a> - <div> - <p> - <i>The Tor network status protocol providing the<br> - data for other applications and websites.</i> - </p> - </div> - <div class="clearfix"></div> -</div> - - - - - <body> - <div class="container"> - <div class="row"> - <div class="col-xs-12"> - <h2>The page you requested doesn't exist anymore</h2> - <p>Sorry, but the content on this page was moved to the - <a href="/">Onionoo start page.</a></p> - <p>Please update your bookmarks to point to - <a href="/">https://onionoo.torproject.org/</a>. - </p> - <p>This page will be removed after March 31, 2017.</p> - </div> - </div> - </div> - - - - - <div class="container-fluid" id="footer"> - - <div class="container no-gutter"> - <div class="col-xs-6"> - <p> - © 2017 The Tor Project - </p> - </div> - <div class="col-xs-6"> - <p class="pull-right"> - - <a href="https://metrics.torproject.org/about.html#contact">Contact</a> - - </p> - </div> - </div> - - <div class="container small"> - - <p>Data on this site is freely available under a <a href="http://creativecommons.org/publicdomain/zero/1.0/">CC0 no copyright declaration</a>: To the extent possible under law, the Tor Project has waived all copyright and related or neighboring rights in the data. "Tor" and the "Onion Logo" are <a href="https://www.torproject.org/docs/trademark-faq.html.en">registered trademarks</a> of The Tor Project, Inc.</p> - - </div> - - </div> - - - -</div> - -</body> -</html> - [View Less]

1 0

[tor/master] Fix memory leak found in CID #1405876.
by nickm＠torproject.org 05 May '17

05 May '17

commit 60e97953ef4b139f4af3fbd71db664c03961f2eb Author: Alexander Færøy <ahf(a)torproject.org> Date: Fri May 5 11:35:12 2017 +0200 Fix memory leak found in CID #1405876. --- src/or/directory.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/or/directory.c b/src/or/directory.c index 8b63e4d..67c28e1 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -3627,6 +3627,7 @@ parse_or_diff_from_header(smartlist_t **digests_out, const char *headers) } … [View More]

1 0

[support-portal/master] Adding duplicate question
by colin＠torproject.org 04 May '17

04 May '17

commit 9b17f62b9ff85c9571c19bd04b243bfc7347e6a3 Author: Colin Childs <colin(a)torproject.org> Date: Thu May 4 17:11:11 2017 -0500 Adding duplicate question --- plain/tormessenger.txt | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/plain/tormessenger.txt b/plain/tormessenger.txt index 804489e..03c46d5 100644 --- a/plain/tormessenger.txt +++ b/plain/tormessenger.txt @@ -1,10 +1,16 @@ ** UNREVIEWED ** Q. What is Tor Messenger? -A.Tor Messenger is a … [View More]

1 0

[translation/https_everywhere_completed] Update translations for https_everywhere_completed
by translation＠torproject.org 04 May '17

04 May '17

commit a17c612cd9e1a326332e8a2b97e714335f76b93b Author: Translation commit bot <translation(a)torproject.org> Date: Thu May 4 20:45:29 2017 +0000 Update translations for https_everywhere_completed --- sv/https-everywhere.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sv/https-everywhere.dtd b/sv/https-everywhere.dtd index 295bb35..5e07d68 100644 --- a/sv/https-everywhere.dtd +++ b/sv/https-everywhere.dtd @@ -9,7 +9,7 @@ <!ENTITY https-everywhere.about.… [View More]

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits May 2017