July 2017 - tor-commits - lists.torproject.org

[tor/master] Respond meaningfully to HTTP requests on the control port. Fix #1667
by nickm＠torproject.org 05 Jul '17

05 Jul '17

commit 417d778652770a8f4b0b6f8e5d8e139e193b8b1e Author: Ravi Chandra Padmala <neenaoffline(a)gmail.com> Date: Tue Feb 21 08:52:03 2012 +0530 Respond meaningfully to HTTP requests on the control port. Fix #1667 (Squashed with bufferevents portions removed, by nickm) --- changes/bug1667 | 4 ++++ src/or/buffers.c | 25 +++++++++++++++++++++++++ src/or/buffers.h | 2 ++ src/or/control.c | 38 ++++++++++++++++++++++++++++++++++++++ 4 files changed, 69 insertions(+) diff --git a/changes/bug1667 b/changes/bug1667 new file mode 100644 index 0000000..195993d --- /dev/null +++ b/changes/bug1667 @@ -0,0 +1,4 @@ + o Minor features: + - If the control port is used as the HTTP proxy, responds with + a meaningful "This is the Tor control port" message, and logs + the event. Fixes bug 1667. diff --git a/src/or/buffers.c b/src/or/buffers.c index 3692ed4..af1b67e 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -2022,6 +2022,31 @@ parse_socks_client(const uint8_t *data, size_t datalen, return -1; } +/** Return true if <b>cmd</b> looks like a HTTP (proxy) request. */ +int +peek_buf_has_http_command(buf_t *buf) +{ + if (peek_buf_startswith(buf, "CONNECT ") || + peek_buf_startswith(buf, "DELETE ") || + peek_buf_startswith(buf, "GET ") || + peek_buf_startswith(buf, "POST ") || + peek_buf_startswith(buf, "PUT " )) + return 1; + return 0; +} + +/** Return 1 iff <b>buf</b> starts with <b>cmd</b>. <b>cmd</b> must be a null + * terminated string */ +int +peek_buf_startswith(buf_t *buf, const char *cmd) +{ + int clen = strlen(cmd); + if (buf->datalen >= clen) + if (!strncasecmp((buf->head)->data, cmd, (size_t) clen)) + return 1; + return 0; +} + /** Return 1 iff buf looks more like it has an (obsolete) v0 controller * command on it than any valid v1 controller command. */ int diff --git a/src/or/buffers.h b/src/or/buffers.h index 23b58a5..5650bea 100644 --- a/src/or/buffers.h +++ b/src/or/buffers.h @@ -53,6 +53,8 @@ int fetch_from_buf_socks_client(buf_t *buf, int state, char **reason); int fetch_from_buf_line(buf_t *buf, char *data_out, size_t *data_len); int peek_buf_has_control0_command(buf_t *buf); +int peek_buf_startswith(buf_t *buf, const char *cmd); +int peek_buf_has_http_command(buf_t *buf); int fetch_ext_or_command_from_buf(buf_t *buf, ext_or_cmd_t **out); diff --git a/src/or/control.c b/src/or/control.c index 9454a7a..3e31f17 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -4882,6 +4882,12 @@ peek_connection_has_control0_command(connection_t *conn) return peek_buf_has_control0_command(conn->inbuf); } +static int +peek_connection_has_http_command(connection_t *conn) +{ + return peek_buf_has_http_command(conn->inbuf); +} + /** Called when data has arrived on a v1 control connection: Try to fetch * commands from conn->inbuf, and execute them. */ @@ -4921,6 +4927,38 @@ connection_control_process_inbuf(control_connection_t *conn) return 0; } + /* If the user has the HTTP proxy port and the control port confused. */ + if (conn->_base.state == CONTROL_CONN_STATE_NEEDAUTH && + peek_connection_has_http_command(TO_CONN(conn))) { + connection_write_str_to_buf("HTTP/1.0 501 Tor ControlPort is not a proxy" +"\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n" +"<html>\n" +"<head>\n" +"<title>Tor's ControlPort is not proxy</title>\n" +"</head>\n" +"<body>\n" +"<h1>Tor's ControlPort is not a proxy</h1>\n" +"<p>\n" +"It appears you have configured your web browser to use Tor's control port" +" as an HTTP proxy.\n" +"This is not correct: Tor's default SOCKS proxy port is 9050.\n" +"Please configure your client accordingly.\n" +"</p>\n" +"<p>\n" +"See <a href=\"https://www.torproject.org/documentation.html\">" + "https://www.torproject.org/documentation.html</a> for more " + "information.\n" +"\n" +"</p>\n" +"</body>\n" +"</html>\n", conn); + log_notice(LD_CONTROL, "Received HTTP request on ControlPort"); + connection_mark_and_flush(TO_CONN(conn)); + return 0; + } + again: while (1) { size_t last_idx;

1 0

[tor/master] Fix compilation on 1667 code.
by nickm＠torproject.org 05 Jul '17

05 Jul '17

commit acf65544bb0cb0473d1f846985ae2807123fbbbd Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 21 10:35:35 2017 -0400 Fix compilation on 1667 code. --- src/or/buffers.c | 2 +- src/or/control.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/or/buffers.c b/src/or/buffers.c index af1b67e..060f58c 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -2040,7 +2040,7 @@ peek_buf_has_http_command(buf_t *buf) int peek_buf_startswith(buf_t *buf, const char *cmd) { - int clen = strlen(cmd); + size_t clen = strlen(cmd); if (buf->datalen >= clen) if (!strncasecmp((buf->head)->data, cmd, (size_t) clen)) return 1; diff --git a/src/or/control.c b/src/or/control.c index 3e31f17..ee9a3ae 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -4928,7 +4928,7 @@ connection_control_process_inbuf(control_connection_t *conn) } /* If the user has the HTTP proxy port and the control port confused. */ - if (conn->_base.state == CONTROL_CONN_STATE_NEEDAUTH && + if (conn->base_.state == CONTROL_CONN_STATE_NEEDAUTH && peek_connection_has_http_command(TO_CONN(conn))) { connection_write_str_to_buf("HTTP/1.0 501 Tor ControlPort is not a proxy" "\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n"

1 0

[tor/master] Extract "not an HTTP proxy" messages.
by nickm＠torproject.org 05 Jul '17

05 Jul '17

commit 03b6cfd5911740471eac13e82f678fe50b4d18f9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 5 11:01:17 2017 -0400 Extract "not an HTTP proxy" messages. --- src/or/buffers.c | 54 ++++++++++++++++++++++++++++-------------------------- src/or/control.c | 51 +++++++++++++++++++++++++++------------------------ 2 files changed, 55 insertions(+), 50 deletions(-) diff --git a/src/or/buffers.c b/src/or/buffers.c index b071725..aff113f 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -1478,6 +1478,32 @@ socks_request_set_socks5_error(socks_request_t *req, req->reply[3] = 0x01; // ATYP field. } +const char SOCKS_PROXY_IS_NOT_AN_HTTP_PROXY_MSG[] = + "HTTP/1.0 501 Tor is not an HTTP Proxy\r\n" + "Content-Type: text/html; charset=iso-8859-1\r\n\r\n" + "<html>\n" + "<head>\n" + "<title>Tor is not an HTTP Proxy</title>\n" + "</head>\n" + "<body>\n" + "<h1>Tor is not an HTTP Proxy</h1>\n" + "<p>\n" + "It appears you have configured your web browser to use Tor as " + "an HTTP proxy.\n\n" + "This is not correct: Tor is a SOCKS proxy, not an HTTP proxy.\n" + "Please configure your client accordingly.\n" + "</p>\n" + "<p>\n" + "See <a href=\"https://www.torproject.org/documentation.html\">" + "https://www.torproject.org/documentation.html</a> for more " + "information.\n" + "\n" + "</p>\n" + "</body>\n" + "</html>\n"; + /** Implementation helper to implement fetch_from_*_socks. Instead of looking * at a buffer's contents, we look at the <b>datalen</b> bytes of data in * <b>data</b>. Instead of removing data from the buffer, we set @@ -1834,32 +1860,8 @@ parse_socks(const char *data, size_t datalen, socks_request_t *req, case 'H': /* head */ case 'P': /* put/post */ case 'C': /* connect */ - strlcpy((char*)req->reply, -"HTTP/1.0 501 Tor is not an HTTP Proxy\r\n" -"Content-Type: text/html; charset=iso-8859-1\r\n\r\n" -"<html>\n" -"<head>\n" -"<title>Tor is not an HTTP Proxy</title>\n" -"</head>\n" -"<body>\n" -"<h1>Tor is not an HTTP Proxy</h1>\n" -"<p>\n" -"It appears you have configured your web browser to use Tor as an HTTP proxy." -"\n" -"This is not correct: Tor is a SOCKS proxy, not an HTTP proxy.\n" -"Please configure your client accordingly.\n" -"</p>\n" -"<p>\n" -"See <a href=\"https://www.torproject.org/documentation.html\">" - "https://www.torproject.org/documentation.html</a> for more " - "information.\n" -"\n" -"</p>\n" -"</body>\n" -"</html>\n" - , MAX_SOCKS_REPLY_LEN); + strlcpy((char*)req->reply, SOCKS_PROXY_IS_NOT_AN_HTTP_PROXY_MSG, + MAX_SOCKS_REPLY_LEN); req->replylen = strlen((char*)req->reply)+1; /* fall through */ default: /* version is not socks4 or socks5 */ diff --git a/src/or/control.c b/src/or/control.c index ee9a3ae..20a0b0b 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -4888,6 +4888,32 @@ peek_connection_has_http_command(connection_t *conn) return peek_buf_has_http_command(conn->inbuf); } +const char CONTROLPORT_IS_NOT_AN_HTTP_PROXY_MSG[] = + "HTTP/1.0 501 Tor ControlPort is not an HTTP proxy" + "\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n" + "<html>\n" + "<head>\n" + "<title>Tor's ControlPort is not an HTTP proxy</title>\n" + "</head>\n" + "<body>\n" + "<h1>Tor's ControlPort is not an HTTP proxy</h1>\n" + "<p>\n" + "It appears you have configured your web browser to use Tor's control port" + " as an HTTP proxy.\n" + "This is not correct: Tor's default SOCKS proxy port is 9050.\n" + "Please configure your client accordingly.\n" + "</p>\n" + "<p>\n" + "See <a href=\"https://www.torproject.org/documentation.html\">" + "https://www.torproject.org/documentation.html</a> for more " + "information.\n" + "\n" + "</p>\n" + "</body>\n" + "</html>\n"; + /** Called when data has arrived on a v1 control connection: Try to fetch * commands from conn->inbuf, and execute them. */ @@ -4930,30 +4956,7 @@ connection_control_process_inbuf(control_connection_t *conn) /* If the user has the HTTP proxy port and the control port confused. */ if (conn->base_.state == CONTROL_CONN_STATE_NEEDAUTH && peek_connection_has_http_command(TO_CONN(conn))) { - connection_write_str_to_buf("HTTP/1.0 501 Tor ControlPort is not a proxy" -"\r\nContent-Type: text/html; charset=iso-8859-1\r\n\r\n" -"<html>\n" -"<head>\n" -"<title>Tor's ControlPort is not proxy</title>\n" -"</head>\n" -"<body>\n" -"<h1>Tor's ControlPort is not a proxy</h1>\n" -"<p>\n" -"It appears you have configured your web browser to use Tor's control port" -" as an HTTP proxy.\n" -"This is not correct: Tor's default SOCKS proxy port is 9050.\n" -"Please configure your client accordingly.\n" -"</p>\n" -"<p>\n" -"See <a href=\"https://www.torproject.org/documentation.html\">" - "https://www.torproject.org/documentation.html</a> for more " - "information.\n" -"\n" -"</p>\n" -"</body>\n" -"</html>\n", conn); + connection_write_str_to_buf(CONTROLPORT_IS_NOT_AN_HTTP_PROXY_MSG, conn); log_notice(LD_CONTROL, "Received HTTP request on ControlPort"); connection_mark_and_flush(TO_CONN(conn)); return 0;

1 0

[tor/master] Merge branch 'neena-fix-1667'
by nickm＠torproject.org 05 Jul '17

05 Jul '17

commit cd77ea782ede057c2086f25b3e2084c78dbde805 Merge: 46e8347 03b6cfd Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 5 11:01:36 2017 -0400 Merge branch 'neena-fix-1667' changes/bug1667 | 4 +++ src/or/buffers.c | 82 +++++++++++++++++++++++++++++++++---------------- src/or/buffers.h | 3 ++ src/or/control.c | 41 +++++++++++++++++++++++++ src/test/test_buffers.c | 27 ++++++++++++++++ 5 files changed, 131 insertions(+), 26 deletions(-)

1 0

[tor/master] unit tests for peek_buf_startswith()
by nickm＠torproject.org 05 Jul '17

05 Jul '17

commit 6595f55020e4a73e2ccf7e87dcea4c1f0362f4aa Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 21 11:20:33 2017 -0400 unit tests for peek_buf_startswith() --- src/test/test_buffers.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/src/test/test_buffers.c b/src/test/test_buffers.c index 07114a8..3989a45 100644 --- a/src/test/test_buffers.c +++ b/src/test/test_buffers.c @@ -838,10 +838,37 @@ test_buffers_find_contentlen(void *arg) ; } +static void +test_buffer_peek_startswith(void *arg) +{ + (void)arg; + buf_t *buf; + buf = buf_new(); + tt_ptr_op(buf, OP_NE, NULL); + + tt_assert(peek_buf_startswith(buf, "")); + tt_assert(! peek_buf_startswith(buf, "X")); + + write_to_buf("Tor", 3, buf); + + tt_assert(peek_buf_startswith(buf, "")); + tt_assert(peek_buf_startswith(buf, "T")); + tt_assert(peek_buf_startswith(buf, "To")); + tt_assert(peek_buf_startswith(buf, "Tor")); + tt_assert(! peek_buf_startswith(buf, "Top")); + tt_assert(! peek_buf_startswith(buf, "For")); + tt_assert(! peek_buf_startswith(buf, "Tork")); + tt_assert(! peek_buf_startswith(buf, "Torpor")); + + done: + buf_free(buf); +} + struct testcase_t buffer_tests[] = { { "basic", test_buffers_basic, TT_FORK, NULL, NULL }, { "copy", test_buffer_copy, TT_FORK, NULL, NULL }, { "pullup", test_buffer_pullup, TT_FORK, NULL, NULL }, + { "startswith", test_buffer_peek_startswith, 0, NULL, NULL }, { "ext_or_cmd", test_buffer_ext_or_cmd, TT_FORK, NULL, NULL }, { "allocation_tracking", test_buffer_allocation_tracking, TT_FORK, NULL, NULL },

1 0

[tor/master] Replace peek_buf_startswith() with a safe version
by nickm＠torproject.org 05 Jul '17

05 Jul '17

commit ed4bc554503d1a18cb6764943eea98aaf43bf2da Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 21 11:10:58 2017 -0400 Replace peek_buf_startswith() with a safe version It's not okay to assume that the data in a buf_t is contiguous in the first chunk. --- src/or/buffers.c | 17 ++++++++++------- src/or/buffers.h | 5 +++-- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/src/or/buffers.c b/src/or/buffers.c index 060f58c..b071725 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -2024,7 +2024,7 @@ parse_socks_client(const uint8_t *data, size_t datalen, /** Return true if <b>cmd</b> looks like a HTTP (proxy) request. */ int -peek_buf_has_http_command(buf_t *buf) +peek_buf_has_http_command(const buf_t *buf) { if (peek_buf_startswith(buf, "CONNECT ") || peek_buf_startswith(buf, "DELETE ") || @@ -2036,15 +2036,18 @@ peek_buf_has_http_command(buf_t *buf) } /** Return 1 iff <b>buf</b> starts with <b>cmd</b>. <b>cmd</b> must be a null - * terminated string */ + * terminated string, of no more than PEEK_BUF_STARTSWITH_MAX bytes. */ int -peek_buf_startswith(buf_t *buf, const char *cmd) +peek_buf_startswith(const buf_t *buf, const char *cmd) { + char tmp[PEEK_BUF_STARTSWITH_MAX]; size_t clen = strlen(cmd); - if (buf->datalen >= clen) - if (!strncasecmp((buf->head)->data, cmd, (size_t) clen)) - return 1; - return 0; + if (BUG(clen > sizeof(tmp))) + return 0; + if (buf->datalen < clen) + return 0; + peek_from_buf(tmp, clen, buf); + return fast_memeq(tmp, cmd, clen); } /** Return 1 iff buf looks more like it has an (obsolete) v0 controller diff --git a/src/or/buffers.h b/src/or/buffers.h index 5650bea..d884084 100644 --- a/src/or/buffers.h +++ b/src/or/buffers.h @@ -53,8 +53,9 @@ int fetch_from_buf_socks_client(buf_t *buf, int state, char **reason); int fetch_from_buf_line(buf_t *buf, char *data_out, size_t *data_len); int peek_buf_has_control0_command(buf_t *buf); -int peek_buf_startswith(buf_t *buf, const char *cmd); -int peek_buf_has_http_command(buf_t *buf); +#define PEEK_BUF_STARTSWITH_MAX 16 +int peek_buf_startswith(const buf_t *buf, const char *cmd); +int peek_buf_has_http_command(const buf_t *buf); int fetch_ext_or_command_from_buf(buf_t *buf, ext_or_cmd_t **out);

1 0

[tor/master] Add test that parses a hardcoded v2 descriptor.
by nickm＠torproject.org 05 Jul '17

05 Jul '17

commit 17bd118b4c3785873e61c2d0b03845e5bd6fefb3 Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue Jun 20 17:29:20 2017 +0300 Add test that parses a hardcoded v2 descriptor. --- src/or/rendcommon.c | 4 ++- src/or/rendcommon.h | 7 ++++ src/test/test_hs.c | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++--- 3 files changed, 104 insertions(+), 5 deletions(-) diff --git a/src/or/rendcommon.c b/src/or/rendcommon.c index e1236bd..986bfde 100644 --- a/src/or/rendcommon.c +++ b/src/or/rendcommon.c @@ -8,6 +8,8 @@ * introducers, services, clients, and rendezvous points. **/ +#define RENDCOMMON_PRIVATE + #include "or.h" #include "circuitbuild.h" #include "config.h" @@ -395,7 +397,7 @@ rend_encrypt_v2_intro_points_stealth(char **encrypted_out, /** Attempt to parse the given <b>desc_str</b> and return true if this * succeeds, false otherwise. */ -static int +STATIC int rend_desc_v2_is_parsable(rend_encoded_v2_service_descriptor_t *desc) { rend_service_descriptor_t *test_parsed = NULL; diff --git a/src/or/rendcommon.h b/src/or/rendcommon.h index 94c2480..292f927 100644 --- a/src/or/rendcommon.h +++ b/src/or/rendcommon.h @@ -63,5 +63,12 @@ int rend_non_anonymous_mode_enabled(const or_options_t *options); void assert_circ_anonymity_ok(origin_circuit_t *circ, const or_options_t *options); +#ifdef RENDCOMMON_PRIVATE + +STATIC int +rend_desc_v2_is_parsable(rend_encoded_v2_service_descriptor_t *desc); + +#endif + #endif diff --git a/src/test/test_hs.c b/src/test/test_hs.c index b4817a2..178f94d 100644 --- a/src/test/test_hs.c +++ b/src/test/test_hs.c @@ -8,6 +8,7 @@ #define CONTROL_PRIVATE #define CIRCUITBUILD_PRIVATE +#define RENDCOMMON_PRIVATE #define RENDSERVICE_PRIVATE #include "or.h" @@ -32,8 +33,9 @@ #define STR_HSDIR_NONE_EXIST_LONGNAME \ "$BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB" -/* DuckDuckGo descriptor as an example. */ -static const char *hs_desc_content = "\ +/* DuckDuckGo descriptor as an example. This one has extra "\r" at the end so + * the control port is happy. */ +static const char *hs_desc_content_control = "\ rendezvous-service-descriptor g5ojobzupf275beh5ra72uyhb3dkpxwg\r\n\ version 2\r\n\ permanent-key\r\n\ @@ -94,6 +96,68 @@ PcftsZf2ztN0sbNCtPgDL3d0PqvxY3iHTQAI8EbaGq/IAJUZ8U4y963dD5+Bn6JQ\r\n\ myE3ctmh0vy5+QxSiRjmQBkuEpCyks7LvWvHYrhnmcg=\r\n\ -----END SIGNATURE-----"; +/* DuckDuckGo descriptor as an example. */ +static const char *hs_desc_content = "\ +rendezvous-service-descriptor g5ojobzupf275beh5ra72uyhb3dkpxwg\n\ +version 2\n\ +permanent-key\n\ +-----BEGIN RSA PUBLIC KEY-----\n\ +MIGJAoGBAJ/SzzgrXPxTlFrKVhXh3buCWv2QfcNgncUpDpKouLn3AtPH5Ocys0jE\n\ +aZSKdvaiQ62md2gOwj4x61cFNdi05tdQjS+2thHKEm/KsB9BGLSLBNJYY356bupg\n\ +I5gQozM65ENelfxYlysBjJ52xSDBd8C4f/p9umdzaaaCmzXG/nhzAgMBAAE=\n\ +-----END RSA PUBLIC KEY-----\n\ +secret-id-part anmjoxxwiupreyajjt5yasimfmwcnxlf\n\ +publication-time 2015-03-11 19:00:00\n\ +protocol-versions 2,3\n\ +introduction-points\n\ +-----BEGIN MESSAGE-----\n\ +aW50cm9kdWN0aW9uLXBvaW50IDd1bnd4cmg2dG5kNGh6eWt1Z3EzaGZzdHduc2ll\n\ +cmhyCmlwLWFkZHJlc3MgMTg4LjEzOC4xMjEuMTE4Cm9uaW9uLXBvcnQgOTAwMQpv\n\ +bmlvbi1rZXkKLS0tLS1CRUdJTiBSU0EgUFVCTElDIEtFWS0tLS0tCk1JR0pBb0dC\n\ +QUxGRVVyeVpDbk9ROEhURmV5cDVjMTRObWVqL1BhekFLTTBxRENTNElKUWh0Y3g1\n\ +NXpRSFdOVWIKQ2hHZ0JqR1RjV3ZGRnA0N3FkdGF6WUZhVXE2c0lQKzVqeWZ5b0Q4\n\ +UmJ1bzBwQmFWclJjMmNhYUptWWM0RDh6Vgpuby9sZnhzOVVaQnZ1cWY4eHIrMDB2\n\ +S0JJNmFSMlA2OE1WeDhrMExqcUpUU2RKOE9idm9yQWdNQkFBRT0KLS0tLS1FTkQg\n\ +UlNBIFBVQkxJQyBLRVktLS0tLQpzZXJ2aWNlLWtleQotLS0tLUJFR0lOIFJTQSBQ\n\ +VUJMSUMgS0VZLS0tLS0KTUlHSkFvR0JBTnJHb0ozeTlHNXQzN2F2ekI1cTlwN1hG\n\ +VUplRUVYMUNOaExnWmJXWGJhVk5OcXpoZFhyL0xTUQppM1Z6dW5OaUs3cndUVnE2\n\ +K2QyZ1lRckhMMmIvMXBBY3ZKWjJiNSs0bTRRc0NibFpjRENXTktRbHJnRWN5WXRJ\n\ +CkdscXJTbFFEaXA0ZnNrUFMvNDVkWTI0QmJsQ3NGU1k3RzVLVkxJck4zZFpGbmJr\n\ +NEZIS1hBZ01CQUFFPQotLS0tLUVORCBSU0EgUFVCTElDIEtFWS0tLS0tCmludHJv\n\ +ZHVjdGlvbi1wb2ludCBiNGM3enlxNXNheGZzN2prNXFibG1wN3I1b3pwdHRvagpp\n\ +cC1hZGRyZXNzIDEwOS4xNjkuNDUuMjI2Cm9uaW9uLXBvcnQgOTAwMQpvbmlvbi1r\n\ +ZXkKLS0tLS1CRUdJTiBSU0EgUFVCTElDIEtFWS0tLS0tCk1JR0pBb0dCQU8xSXpw\n\ +WFFUTUY3RXZUb1NEUXpzVnZiRVFRQUQrcGZ6NzczMVRXZzVaUEJZY1EyUkRaeVp4\n\ +OEQKNUVQSU1FeUE1RE83cGd0ak5LaXJvYXJGMC8yempjMkRXTUlSaXZyU29YUWVZ\n\ +ZXlMM1pzKzFIajJhMDlCdkYxZAp6MEswblRFdVhoNVR5V3lyMHdsbGI1SFBnTlI0\n\ +MS9oYkprZzkwZitPVCtIeGhKL1duUml2QWdNQkFBRT0KLS0tLS1FTkQgUlNBIFBV\n\ +QkxJQyBLRVktLS0tLQpzZXJ2aWNlLWtleQotLS0tLUJFR0lOIFJTQSBQVUJMSUMg\n\ +S0VZLS0tLS0KTUlHSkFvR0JBSzNWZEJ2ajFtQllLL3JrcHNwcm9Ub0llNUtHVmth\n\ +QkxvMW1tK1I2YUVJek1VZFE1SjkwNGtyRwpCd3k5NC8rV0lGNFpGYXh5Z2phejl1\n\ +N2pKY1k3ZGJhd1pFeG1hYXFCRlRwL2h2ZG9rcHQ4a1ByRVk4OTJPRHJ1CmJORUox\n\ +N1FPSmVMTVZZZk5Kcjl4TWZCQ3JQai8zOGh2RUdrbWVRNmRVWElvbVFNaUJGOVRB\n\ +Z01CQUFFPQotLS0tLUVORCBSU0EgUFVCTElDIEtFWS0tLS0tCmludHJvZHVjdGlv\n\ +bi1wb2ludCBhdjVtcWl0Y2Q3cjJkandsYmN0c2Jlc2R3eGt0ZWtvegppcC1hZGRy\n\ +ZXNzIDE0NC43Ni44LjczCm9uaW9uLXBvcnQgNDQzCm9uaW9uLWtleQotLS0tLUJF\n\ +R0lOIFJTQSBQVUJMSUMgS0VZLS0tLS0KTUlHSkFvR0JBTzVweVZzQmpZQmNmMXBE\n\ +dklHUlpmWXUzQ05nNldka0ZLMGlvdTBXTGZtejZRVDN0NWhzd3cyVwpjejlHMXhx\n\ +MmN0Nkd6VWkrNnVkTDlITTRVOUdHTi9BbW8wRG9GV1hKWHpBQkFXd2YyMVdsd1lW\n\ +eFJQMHRydi9WCkN6UDkzcHc5OG5vSmdGUGRUZ05iMjdKYmVUZENLVFBrTEtscXFt\n\ +b3NveUN2RitRa25vUS9BZ01CQUFFPQotLS0tLUVORCBSU0EgUFVCTElDIEtFWS0t\n\ +LS0tCnNlcnZpY2Uta2V5Ci0tLS0tQkVHSU4gUlNBIFBVQkxJQyBLRVktLS0tLQpN\n\ +SUdKQW9HQkFMVjNKSmtWN3lTNU9jc1lHMHNFYzFQOTVRclFRR3ZzbGJ6Wi9zRGxl\n\ +RlpKYXFSOUYvYjRUVERNClNGcFMxcU1GbldkZDgxVmRGMEdYRmN2WVpLamRJdHU2\n\ +SndBaTRJeEhxeXZtdTRKdUxrcXNaTEFLaXRLVkx4eGsKeERlMjlDNzRWMmJrOTRJ\n\ +MEgybTNKS2tzTHVwc3VxWWRVUmhOVXN0SElKZmgyZmNIalF0bEFnTUJBQUU9Ci0t\n\ +LS0tRU5EIFJTQSBQVUJMSUMgS0VZLS0tLS0KCg==\n\ +-----END MESSAGE-----\n\ +signature\n\ +-----BEGIN SIGNATURE-----\n\ +d4OuCE5OLAOnRB6cQN6WyMEmg/BHem144Vec+eYgeWoKwx3MxXFplUjFxgnMlmwN\n\ +PcftsZf2ztN0sbNCtPgDL3d0PqvxY3iHTQAI8EbaGq/IAJUZ8U4y963dD5+Bn6JQ\n\ +myE3ctmh0vy5+QxSiRjmQBkuEpCyks7LvWvHYrhnmcg=\n\ +-----END SIGNATURE-----"; + /* Helper global variable for hidden service descriptor event test. * It's used as a pointer to dynamically created message buffer in * send_control_event_string_replacement function, which mocks @@ -125,6 +189,30 @@ node_describe_longname_by_id_replacement(const char *id_digest) } } +/** Test that we can parse a hardcoded v2 HS desc. */ +static void +test_hs_parse_static_v2_desc(void *arg) +{ + int ret; + rend_encoded_v2_service_descriptor_t desc; + + (void) arg; + + /* Test an obviously not parseable string */ + desc.desc_str = tor_strdup("ceci n'est pas un HS descriptor"); + ret = rend_desc_v2_is_parsable(&desc); + tor_free(desc.desc_str); + tt_int_op(ret, OP_EQ, 0); + + /* Test an actual descriptor */ + desc.desc_str = tor_strdup(hs_desc_content); + ret = rend_desc_v2_is_parsable(&desc); + tor_free(desc.desc_str); + tt_int_op(ret, OP_EQ, 1); + + done: ; +} + /** Make sure each hidden service descriptor async event generation * * function generates the message in expected format. @@ -235,10 +323,10 @@ test_hs_desc_event(void *arg) /* test valid content. */ control_event_hs_descriptor_content(rend_query.onion_address, STR_HS_CONTENT_DESC_ID, HSDIR_EXIST_ID, - hs_desc_content); + hs_desc_content_control); tor_asprintf(&exp_msg, "650+HS_DESC_CONTENT " STR_HS_ADDR " "\ STR_HS_CONTENT_DESC_ID " " STR_HSDIR_EXIST_LONGNAME\ - "\r\n%s\r\n.\r\n650 OK\r\n", hs_desc_content); + "\r\n%s\r\n.\r\n650 OK\r\n", hs_desc_content_control); tt_assert(received_msg); tt_str_op(received_msg, OP_EQ, exp_msg); @@ -941,6 +1029,8 @@ test_prune_services_on_reload(void *arg) struct testcase_t hs_tests[] = { { "hs_rend_data", test_hs_rend_data, TT_FORK, NULL, NULL }, + { "hs_parse_static_v2_desc", test_hs_parse_static_v2_desc, TT_FORK, + NULL, NULL }, { "hs_desc_event", test_hs_desc_event, TT_FORK, NULL, NULL }, { "pick_tor2web_rendezvous_node", test_pick_tor2web_rendezvous_node, TT_FORK,

1 0

[tor/master] changes file for 15554
by nickm＠torproject.org 05 Jul '17

05 Jul '17

commit 78ac713d6004ec933569b5df37d00d243b077828 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 5 10:15:17 2017 -0400 changes file for 15554 --- changes/15554 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changes/15554 b/changes/15554 new file mode 100644 index 0000000..c7ae7e5 --- /dev/null +++ b/changes/15554 @@ -0,0 +1,4 @@ + o Minor features (testing): + - Add a unit test to verify that we can parse a hardcoded v2 + hidden service descriptor. Closes ticket 15554. +

1 0

[tor/master] Merge branch 'bug15554_032_01_squashed'
by nickm＠torproject.org 05 Jul '17

05 Jul '17

commit 46e83477c15d547e0a8d3df2926adf8ee10b77a6 Merge: 13ccca6 78ac713 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 5 10:15:24 2017 -0400 Merge branch 'bug15554_032_01_squashed' changes/15554 | 4 +++ src/or/rendcommon.c | 4 ++- src/or/rendcommon.h | 7 ++++ src/test/test_hs.c | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++--- 4 files changed, 108 insertions(+), 5 deletions(-)

1 0

[tor/master] Document the new functions from the refactor
by nickm＠torproject.org 05 Jul '17

05 Jul '17

commit 9b44e2e50e8209f856dd1f1e7c66618acf419be6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jul 3 16:23:23 2017 -0400 Document the new functions from the refactor --- src/or/circuitbuild.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index ee33361..bf14d49 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -942,6 +942,12 @@ circuit_send_next_onion_skin(origin_circuit_t *circ) } } +/** + * Called from circuit_send_next_onion_skin() when we find ourselves connected + * to the first hop in <b>circ</b>: Send a CREATE or CREATE2 or CREATE_FAST + * cell to that hop. Return 0 on success; -reason on failure (if the circuit + * should be torn down). + */ static int circuit_send_first_onion_skin(origin_circuit_t *circ) { @@ -1003,6 +1009,12 @@ circuit_send_first_onion_skin(origin_circuit_t *circ) return 0; } +/** + * Called from circuit_send_next_onion_skin() when we find that we have no + * more hops: mark the circuit as finished, and perform the necessary + * bookkeeping. Return 0 on success; -reason on failure (if the circuit + * should be torn down). + */ static int circuit_build_no_more_hops(origin_circuit_t *circ) { @@ -1109,6 +1121,12 @@ circuit_build_no_more_hops(origin_circuit_t *circ) return 0; } +/** + * Called from circuit_send_next_onion_skin() when we find that we have a hop + * other than the first that we need to extend to: use <b>hop</b>'s + * information to extend the circuit another step. Return 0 on success; + * -reason on failure (if the circuit should be torn down). + */ static int circuit_send_intermediate_onion_skin(origin_circuit_t *circ, crypt_path_t *hop)

1 0