September 2017 - tor-commits - lists.torproject.org

[websocket/master] Expose the entire ws request instead of just the URL
by dcf＠torproject.org 13 Sep '17

13 Sep '17

commit 02a8eb6d7a236f8b805dbd086f1c46f5dfb51149 Author: Hooman <hoomanm(a)princeton.edu> Date: Fri Jul 28 17:29:04 2017 -0700 Expose the entire ws request instead of just the URL --- websocket/websocket.go | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/websocket/websocket.go b/websocket/websocket.go index b74e3ae..fac649b 100644 --- a/websocket/websocket.go +++ b/websocket/websocket.go @@ -43,7 +43,6 @@ import ( "net" "net/http" "strings" - "net/url" ) // Settings for potential WebSocket connections. Subprotocols is a list of @@ -88,9 +87,12 @@ type WebSocket struct { // Buffer for message payloads, which may be interrupted by control // messages. messageBuf bytes.Buffer - // Request URL - ReqURL url.URL + // Request + request http.Request +} +func (ws *WebSocket) Request() http.Request { + return ws.request } func applyMask(payload []byte, maskKey [4]byte) { @@ -338,13 +340,6 @@ func (handler *HTTPHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) return } - /* URLs are accepted - if req.URL.Path != "/" { - httpError(w, bufrw, http.StatusNotFound) - return - } - */ - // 2. A |Host| header field containing the server's authority. // We deliberately skip this test. // 3. An |Upgrade| header field containing the value "websocket", @@ -395,7 +390,7 @@ func (handler *HTTPHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) ws.Bufrw = bufrw ws.IsClient = false ws.MaxMessageSize = handler.Config.MaxMessageSize - ws.ReqURL = *req.URL + ws.request = *req // See RFC 6455 section 4.2.2, item 5 for these steps.

1 0

[websocket/master] Added support for passing URLs
by dcf＠torproject.org 13 Sep '17

13 Sep '17

commit 0446621630483a656f179963ca77451f04aeaf01 Author: Hooman <hoomanm(a)princeton.edu> Date: Thu Jul 20 15:31:27 2017 -0700 Added support for passing URLs --- websocket/websocket.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/websocket/websocket.go b/websocket/websocket.go index 7c649e3..b74e3ae 100644 --- a/websocket/websocket.go +++ b/websocket/websocket.go @@ -43,6 +43,7 @@ import ( "net" "net/http" "strings" + "net/url" ) // Settings for potential WebSocket connections. Subprotocols is a list of @@ -87,6 +88,9 @@ type WebSocket struct { // Buffer for message payloads, which may be interrupted by control // messages. messageBuf bytes.Buffer + // Request URL + ReqURL url.URL + } func applyMask(payload []byte, maskKey [4]byte) { @@ -333,10 +337,14 @@ func (handler *HTTPHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) httpError(w, bufrw, http.StatusMethodNotAllowed) return } + + /* URLs are accepted if req.URL.Path != "/" { httpError(w, bufrw, http.StatusNotFound) return } + */ + // 2. A |Host| header field containing the server's authority. // We deliberately skip this test. // 3. An |Upgrade| header field containing the value "websocket", @@ -387,6 +395,7 @@ func (handler *HTTPHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) ws.Bufrw = bufrw ws.IsClient = false ws.MaxMessageSize = handler.Config.MaxMessageSize + ws.ReqURL = *req.URL // See RFC 6455 section 4.2.2, item 5 for these steps.

1 0

[websocket/master] Change request to *http.Request
by dcf＠torproject.org 13 Sep '17

13 Sep '17

commit e0bb5efd8d78d372711652ec061923debe7f5cb0 Author: Hooman <hoomanm(a)princeton.edu> Date: Tue Sep 12 21:52:44 2017 -0400 Change request to *http.Request --- websocket/websocket.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/websocket/websocket.go b/websocket/websocket.go index fac649b..73b1ce7 100644 --- a/websocket/websocket.go +++ b/websocket/websocket.go @@ -88,10 +88,10 @@ type WebSocket struct { // messages. messageBuf bytes.Buffer // Request - request http.Request + request *http.Request } -func (ws *WebSocket) Request() http.Request { +func (ws *WebSocket) Request() *http.Request { return ws.request } @@ -390,7 +390,7 @@ func (handler *HTTPHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) ws.Bufrw = bufrw ws.IsClient = false ws.MaxMessageSize = handler.Config.MaxMessageSize - ws.request = *req + ws.request = req // See RFC 6455 section 4.2.2, item 5 for these steps.

1 0

[websocket/bug18628] Change request to *http.Request
by dcf＠torproject.org 13 Sep '17

13 Sep '17

commit e0bb5efd8d78d372711652ec061923debe7f5cb0 Author: Hooman <hoomanm(a)princeton.edu> Date: Tue Sep 12 21:52:44 2017 -0400 Change request to *http.Request --- websocket/websocket.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/websocket/websocket.go b/websocket/websocket.go index fac649b..73b1ce7 100644 --- a/websocket/websocket.go +++ b/websocket/websocket.go @@ -88,10 +88,10 @@ type WebSocket struct { // messages. messageBuf bytes.Buffer // Request - request http.Request + request *http.Request } -func (ws *WebSocket) Request() http.Request { +func (ws *WebSocket) Request() *http.Request { return ws.request } @@ -390,7 +390,7 @@ func (handler *HTTPHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) ws.Bufrw = bufrw ws.IsClient = false ws.MaxMessageSize = handler.Config.MaxMessageSize - ws.request = *req + ws.request = req // See RFC 6455 section 4.2.2, item 5 for these steps.

1 0

[nyx/master] Interface initially rendered incorrectly
by atagar＠torproject.org 13 Sep '17

13 Sep '17

commit 2cfd31b61b571dde0a532e2646e9f3415d1cd966 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Sep 13 12:54:42 2017 -0700 Interface initially rendered incorrectly Our daemon panels draw themselves. Since we started them before calling redraw() the first time (which sets the 'top' positions of panels) we rendered things out of place. This caused our log to render where the header panel should be for a few seconds when we started up. --- nyx/__init__.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/nyx/__init__.py b/nyx/__init__.py index c5736c1..745ce31 100644 --- a/nyx/__init__.py +++ b/nyx/__init__.py @@ -155,6 +155,15 @@ def draw_loop(): interface = nyx_interface() next_key = None # use this as the next user input + # Redrawing before starting daemons is important so our interface is rendered + # right away and the 'top' positions are set for our panels. + + interface.redraw() + + for panel in interface: + if isinstance(panel, nyx.panel.DaemonPanel): + panel.start() + stem.util.log.info('nyx started (initialization took %0.1f seconds)' % (time.time() - CONFIG['start_time'])) while not interface._quit: @@ -567,9 +576,6 @@ class Interface(object): for panel in self: panel.set_visible(panel in visible_panels) - if isinstance(panel, nyx.panel.DaemonPanel): - panel.start() - def get_page(self): """ Provides the page we're showing.

1 0

[tor/master] prop224: Improve docs in time period funcs.
by nickm＠torproject.org 13 Sep '17

13 Sep '17

commit f13ca360c9593fa9dfc94830996329dcb31c2324 Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue Sep 12 12:24:10 2017 +0300 prop224: Improve docs in time period funcs. --- src/or/hs_common.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/src/or/hs_common.c b/src/or/hs_common.c index 291d8ae8d..f10fc4d5a 100644 --- a/src/or/hs_common.c +++ b/src/or/hs_common.c @@ -235,7 +235,7 @@ get_time_period_length(void) } /** Get the HS time period number at time now. If now is not set, - * we try to get the time ourselves. */ + * we try to get the time ourselves from a live consensus. */ uint64_t hs_get_time_period_num(time_t now) { @@ -269,22 +269,26 @@ hs_get_time_period_num(time_t now) } /** Get the number of the _upcoming_ HS time period, given that the current - * time is now. */ + * time is now. If now is not set, we try to get the time from a + * live consensus. */ uint64_t hs_get_next_time_period_num(time_t now) { return hs_get_time_period_num(now) + 1; } -/* Get the number of the _previous_ HS time period, given that the current - * time is now. */ +/* Get the number of the _previous_ HS time period, given that the current time + * is now. If now is not set, we try to get the time from a live + * consensus. */ uint64_t hs_get_previous_time_period_num(time_t now) { return hs_get_time_period_num(now) - 1; } -/* Return the start time of the upcoming time period based on now. */ +/* Return the start time of the upcoming time period based on now. If + now is not set, we try to get the time ourselves from a live + consensus. */ time_t hs_get_start_time_of_next_time_period(time_t now) {

1 0

[tor/master] prop224: Set stricter expiration time of cached client descriptors.
by nickm＠torproject.org 13 Sep '17

13 Sep '17

commit cf8a2b156769023e583b6c6374ac6de0134712f1 Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue Sep 12 12:45:27 2017 +0300 prop224: Set stricter expiration time of cached client descriptors. In #23466 we discovered that cached descriptors can stay around on the client-side for up to 72 hours. In reality we only want those descs to get cached for the duration of the current time period, since after that TP is gone the client needs to compute a new blinded key to use for the HS. In this commit we start using the consensus time (if available) when cleaning up cached client descriptor entries. That makes sense because the client uses consensus time anyway for connecting to hidden services (e.g. computing blinded keys and time periods). If no recent consensus is available, we consider descriptors to be expired since we will want to fetch new ones when we get a live consensus to avoid the Roger bug. If we didn't do that, when Roger desuspends his laptop there would be a race between Tor fetching a new consensus, and Tor connecting to the HS which would still cause reachability issues. We also turned a rev counter check into a BUG, since we should never receive a descriptor with a strictly smaller rev counter than the one we already have, except if there is a bug or if the HSDir wants to mess with us. In any case, let's turn this into a BUG so that we can detect and debug such cases easily. --- src/or/hs_cache.c | 63 +++++++++++++++++++++++++++++++++++++++++++++---------- src/or/hs_cache.h | 6 ++++-- 2 files changed, 56 insertions(+), 13 deletions(-) diff --git a/src/or/hs_cache.c b/src/or/hs_cache.c index 7f2a9cbbb..3ebe13fb4 100644 --- a/src/or/hs_cache.c +++ b/src/or/hs_cache.c @@ -20,6 +20,9 @@ #include "hs_cache.h" +static int cached_client_descriptor_has_expired(time_t now, + const hs_cache_client_descriptor_t *cached_desc); + /********************** Directory HS cache ******************/ /* Directory descriptor cache. Map indexed by blinded key. */ @@ -356,12 +359,27 @@ store_v3_desc_as_client(hs_cache_client_descriptor_t *desc) rend_cache_increment_allocation(cache_get_client_entry_size(desc)); } -/* Query our cache and return the entry or NULL if not found. */ +/* Query our cache and return the entry or NULL if not found or if expired. */ STATIC hs_cache_client_descriptor_t * lookup_v3_desc_as_client(const uint8_t *key) { + time_t now = approx_time(); + hs_cache_client_descriptor_t *cached_desc; + tor_assert(key); - return digest256map_get(hs_cache_v3_client, key); + + /* Do the lookup */ + cached_desc = digest256map_get(hs_cache_v3_client, key); + if (!cached_desc) { + return NULL; + } + + /* Don't return expired entries */ + if (cached_client_descriptor_has_expired(now, cached_desc)) { + return NULL; + } + + return cached_desc; } /* Parse the encoded descriptor in desc_str using @@ -388,7 +406,10 @@ cache_client_desc_new(const char *desc_str, /* All is good: make a cache object for this descriptor */ client_desc = tor_malloc_zero(sizeof(hs_cache_client_descriptor_t)); ed25519_pubkey_copy(&client_desc->key, service_identity_pk); - client_desc->created_ts = approx_time(); + /* Set expiration time for this cached descriptor to be the start of the next + * time period since that's when clients need to start using the next blinded + * pk of the service (and hence will need its next descriptor). */ + client_desc->expiration_ts = hs_get_start_time_of_next_time_period(0); client_desc->desc = desc; client_desc->encoded_desc = tor_strdup(desc_str); @@ -603,9 +624,8 @@ cache_store_as_client(hs_cache_client_descriptor_t *client_desc) if (cache_entry != NULL) { /* If we have an entry in our cache that has a revision counter greater * than the one we just fetched, discard the one we fetched. */ - if (cache_entry->desc->plaintext_data.revision_counter > - client_desc->desc->plaintext_data.revision_counter) { - log_info(LD_REND, "We already have fresher descriptor. Ignoring."); + if (BUG(cache_entry->desc->plaintext_data.revision_counter > + client_desc->desc->plaintext_data.revision_counter)) { cache_client_desc_free(client_desc); goto done; } @@ -621,7 +641,30 @@ cache_store_as_client(hs_cache_client_descriptor_t *client_desc) return 0; } -/* Clean the client cache using now as the current time. Return the total size +/* Return true iff the cached client descriptor at cached_desc</b has + * expired. */ +static int +cached_client_descriptor_has_expired(time_t now, + const hs_cache_client_descriptor_t *cached_desc) +{ + /* We use the current consensus time to see if we should expire this + * descriptor since we use consensus time for all other parts of the protocol + * as well (e.g. to build the blinded key and compute time periods). */ + const networkstatus_t *ns = networkstatus_get_live_consensus(now); + /* If we don't have a recent consensus, consider this entry expired since we + * will want to fetch a new HS desc when we get a live consensus. */ + if (!ns) { + return 1; + } + + if (cached_desc->expiration_ts <= ns->valid_after) { + return 1; + } + + return 0; +} + +/* clean the client cache using now as the current time. Return the total size * of removed bytes from the cache. */ static size_t cache_clean_v3_as_client(time_t now) @@ -635,11 +678,9 @@ cache_clean_v3_as_client(time_t now) DIGEST256MAP_FOREACH_MODIFY(hs_cache_v3_client, key, hs_cache_client_descriptor_t *, entry) { size_t entry_size; - time_t cutoff = now - rend_cache_max_entry_lifetime(); - /* If the entry has been created _after_ the cutoff, not expired so - * continue to the next entry in our v3 cache. */ - if (entry->created_ts > cutoff) { + /* If the entry has not expired, continue to the next cached entry */ + if (!cached_client_descriptor_has_expired(now, entry)) { continue; } /* Here, our entry has expired, remove and free. */ diff --git a/src/or/hs_cache.h b/src/or/hs_cache.h index 8dbc842b9..a6beaebc1 100644 --- a/src/or/hs_cache.h +++ b/src/or/hs_cache.h @@ -103,8 +103,10 @@ typedef struct hs_cache_client_descriptor_t { /* This object is indexed using the service identity public key */ ed25519_public_key_t key; - /* When was this entry created. Used to expire entries. */ - time_t created_ts; + /* When will this entry expire? We expire cached client descriptors in the + * start of the next time period, since that's when clients need to start + * using the next blinded key of the service. */ + time_t expiration_ts; /* The cached descriptor, this object is the owner. It can't be NULL. A * cache object without a valid descriptor is not possible. */

1 0

[tor/master] prop224 test: Test client desc expiration in tests.
by nickm＠torproject.org 13 Sep '17

13 Sep '17

commit 6b794c7ed0a86e5c8de03b3a82b2299758f9e017 Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue Sep 12 12:50:36 2017 +0300 prop224 test: Test client desc expiration in tests. We enrich the test_client_cache() test in two ways: a) We check that transitioning time periods also cleans up expired descriptors in client memory. b) We test hs_cache_lookup_as_client() instead of lookup_v3_desc_as_client(). The former is a higher level function which calls the latter and allows us to test deeper into the subsystem. --- src/test/hs_test_helpers.c | 2 +- src/test/test_hs_cache.c | 57 ++++++++++++++++++++++++++++++++++++++++++---- 2 files changed, 53 insertions(+), 6 deletions(-) diff --git a/src/test/hs_test_helpers.c b/src/test/hs_test_helpers.c index 2753d2907..cab73196b 100644 --- a/src/test/hs_test_helpers.c +++ b/src/test/hs_test_helpers.c @@ -104,7 +104,7 @@ hs_helper_build_hs_desc_impl(unsigned int no_ip, memcpy(&desc->plaintext_data.signing_pubkey, &signing_kp->pubkey, sizeof(ed25519_public_key_t)); - uint64_t current_time_period = hs_get_time_period_num(approx_time()); + uint64_t current_time_period = hs_get_time_period_num(0); hs_build_blinded_keypair(signing_kp, NULL, 0, current_time_period, &blinded_kp); /* Copy only the public key into the descriptor. */ diff --git a/src/test/test_hs_cache.c b/src/test/test_hs_cache.c index 950c0483d..91b13be86 100644 --- a/src/test/test_hs_cache.c +++ b/src/test/test_hs_cache.c @@ -14,6 +14,7 @@ #include "hs_cache.h" #include "rendcache.h" #include "directory.h" +#include "networkstatus.h" #include "connection.h" #include "proto_http.h" @@ -433,6 +434,15 @@ test_hsdir_revision_counter_check(void *arg) tor_free(published_desc_str); } +static networkstatus_t mock_ns; + +static networkstatus_t * +mock_networkstatus_get_live_consensus(time_t now) +{ + (void) now; + return &mock_ns; +} + /** Test that we can store HS descriptors in the client HS cache. */ static void test_client_cache(void *arg) @@ -441,7 +451,7 @@ test_client_cache(void *arg) ed25519_keypair_t signing_kp; hs_descriptor_t *published_desc = NULL; char *published_desc_str = NULL; - + uint8_t wanted_subcredential[DIGEST256_LEN]; response_handler_args_t *args = NULL; dir_connection_t *conn = NULL; @@ -450,6 +460,17 @@ test_client_cache(void *arg) /* Initialize HSDir cache subsystem */ init_test(); + MOCK(networkstatus_get_live_consensus, + mock_networkstatus_get_live_consensus); + + /* Set consensus time */ + parse_rfc1123_time("Sat, 26 Oct 1985 13:00:00 UTC", + &mock_ns.valid_after); + parse_rfc1123_time("Sat, 26 Oct 1985 14:00:00 UTC", + &mock_ns.fresh_until); + parse_rfc1123_time("Sat, 26 Oct 1985 16:00:00 UTC", + &mock_ns.valid_until); + /* Generate a valid descriptor with normal values. */ { retval = ed25519_keypair_generate(&signing_kp, 0); @@ -459,6 +480,8 @@ test_client_cache(void *arg) retval = hs_desc_encode_descriptor(published_desc, &signing_kp, &published_desc_str); tt_int_op(retval, OP_EQ, 0); + memcpy(wanted_subcredential, published_desc->subcredential, DIGEST256_LEN); + tt_assert(!tor_mem_is_zero((char*)wanted_subcredential, DIGEST256_LEN)); } /* Test handle_response_fetch_hsdesc_v3() */ @@ -478,12 +501,36 @@ test_client_cache(void *arg) retval = handle_response_fetch_hsdesc_v3(conn, args); tt_int_op(retval, == , 0); - /* fetch the descriptor and make sure it's there */ + /* Progress time a bit and attempt to clean cache: our desc should not be + * cleaned since we still in the same TP. */ { - hs_cache_client_descriptor_t *cached_desc = NULL; - cached_desc = lookup_v3_desc_as_client(signing_kp.pubkey.pubkey); + parse_rfc1123_time("Sat, 27 Oct 1985 02:00:00 UTC", + &mock_ns.valid_after); + parse_rfc1123_time("Sat, 27 Oct 1985 03:00:00 UTC", + &mock_ns.fresh_until); + parse_rfc1123_time("Sat, 27 Oct 1985 05:00:00 UTC", + &mock_ns.valid_until); + + /* fetch the descriptor and make sure it's there */ + const hs_descriptor_t *cached_desc = NULL; + cached_desc = hs_cache_lookup_as_client(&signing_kp.pubkey); tt_assert(cached_desc); - tt_str_op(cached_desc->encoded_desc, OP_EQ, published_desc_str); + tt_mem_op(cached_desc->subcredential, OP_EQ, wanted_subcredential, + DIGEST256_LEN); + } + + /* Progress time to next TP and check that desc was cleaned */ + { + parse_rfc1123_time("Sat, 27 Oct 1985 12:00:00 UTC", + &mock_ns.valid_after); + parse_rfc1123_time("Sat, 27 Oct 1985 13:00:00 UTC", + &mock_ns.fresh_until); + parse_rfc1123_time("Sat, 27 Oct 1985 15:00:00 UTC", + &mock_ns.valid_until); + + const hs_descriptor_t *cached_desc = NULL; + cached_desc = hs_cache_lookup_as_client(&signing_kp.pubkey); + tt_assert(!cached_desc); } done:

1 0

[tor/master] Merge branch 'bug23466_squashed'
by nickm＠torproject.org 13 Sep '17

13 Sep '17

commit 00bf4ed592edfe73505499ce525aa3c96d35ae34 Merge: dcaf971a0 6b794c7ed Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Sep 13 14:54:56 2017 -0400 Merge branch 'bug23466_squashed' src/or/hs_cache.c | 63 ++++++++++++++++++++++++++++++++++++++-------- src/or/hs_cache.h | 6 +++-- src/or/hs_common.c | 14 +++++++---- src/test/hs_test_helpers.c | 2 +- src/test/test_hs_cache.c | 57 +++++++++++++++++++++++++++++++++++++---- 5 files changed, 118 insertions(+), 24 deletions(-)

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 13 Sep '17

13 Sep '17

commit f9662639130763d282e246f2599cb4f9d5d47138 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Sep 13 15:15:31 2017 +0000 Update translations for https_everywhere --- ky/https-everywhere.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ky/https-everywhere.dtd b/ky/https-everywhere.dtd index f704e2ae2..7cb20248d 100644 --- a/ky/https-everywhere.dtd +++ b/ky/https-everywhere.dtd @@ -49,7 +49,7 @@ <!ENTITY https-everywhere.prefs.ruleset_howto "You can learn how to write your own rulesets (to add support for other web sites)"> <!ENTITY https-everywhere.prefs.here_link "here"> <!ENTITY https-everywhere.prefs.toggle "Toggle"> -<!ENTITY https-everywhere.prefs.reset_default "Reset to Default"> +<!ENTITY https-everywhere.prefs.reset_default "Демейкиге кайтаруу"> <!ENTITY https-everywhere.prefs.view_xml_source "View XML Source"> <!ENTITY https-everywhere.chrome.stable_rules "Stable rules">

1 0