September 2017 - tor-commits - lists.torproject.org

[nyx/master] Move chroot out of starter
by atagar＠torproject.org 12 Sep '17

12 Sep '17

commit ee4a3205d8d9c3001b43cf802cbba2f6c5fdb714 Author: Damian Johnson <atagar(a)torproject.org> Date: Fri Sep 8 03:43:27 2017 -0700 Move chroot out of starter There's a few things to consult to determine our chroot so making this a helper rather than part of the starter. --- nyx/__init__.py | 37 +++++++++++++++++++++++++++++++++---- nyx/panel/header.py | 8 ++++---- nyx/starter.py | 28 +--------------------------- test/__init__.py | 34 ++++++++++++++++++++++++++++------ 4 files changed, 66 insertions(+), 41 deletions(-) diff --git a/nyx/__init__.py b/nyx/__init__.py index 2239956..c5736c1 100644 --- a/nyx/__init__.py +++ b/nyx/__init__.py @@ -14,6 +14,7 @@ Tor curses monitoring application. input_prompt - prompts the user for text input init_controller - initializes our connection to tor expand_path - expands path with respect to our chroot + chroot - provides the chroot path we reside within join - joins a series of strings up to a set length Cache - application cache @@ -44,6 +45,7 @@ Tor curses monitoring application. import contextlib import distutils.spawn import os +import platform import sqlite3 import sys import threading @@ -99,6 +101,7 @@ CONFIG = stem.util.conf.config_dict('nyx', { NYX_INTERFACE = None TOR_CONTROLLER = None CACHE = None +CHROOT = None BASE_DIR = os.path.sep.join(__file__.split(os.path.sep)[:-1]) # technically can change but we use this query a *lot* so needs to be cached @@ -294,8 +297,7 @@ def data_directory(filename, config): return os.path.join(data_dir, filename) -@uses_settings -def expand_path(path, config): +def expand_path(path): """ Expands relative paths and include our chroot if one was set. @@ -308,14 +310,41 @@ def expand_path(path, config): return None try: - chroot = config.get('tor_chroot', '') tor_cwd = stem.util.system.cwd(tor_controller().get_pid(None)) - return chroot + stem.util.system.expand_path(path, tor_cwd) + return chroot() + stem.util.system.expand_path(path, tor_cwd) except IOError as exc: stem.util.log.info('Unable to expand a relative path (%s): %s' % (path, exc)) return path +@uses_settings +def chroot(config): + global CHROOT + + if CHROOT is None: + # If the user provided us with a chroot then validate and normalize the + # path. + + chroot = config.get('tor_chroot', '').strip().rstrip(os.path.sep) + + if chroot and not os.path.exists(chroot): + stem.util.log.notice("The chroot path set in your config (%s) doesn't exist." % chroot) + chroot = '' + + if not chroot and platform.system() == 'FreeBSD': + controller = tor_controller() + pid = controller.get_pid(None) if controller else stem.util.system.pid_by_name('tor') + jail_chroot = stem.util.system.bsd_jail_path(pid) if pid else None + + if jail_chroot and os.path.exists(jail_chroot): + stem.util.log.info('Adjusting paths to account for Tor running in a FreeBSD jail at: %s' % jail_chroot) + chroot = jail_chroot + + CHROOT = chroot + + return CHROOT + + def join(entries, joiner = ' ', size = None): """ Joins a series of strings similar to str.join(), but only up to a given size. diff --git a/nyx/panel/header.py b/nyx/panel/header.py index cf11b67..b1cbfbf 100644 --- a/nyx/panel/header.py +++ b/nyx/panel/header.py @@ -16,13 +16,14 @@ import stem.util.proc import stem.util.str_tools import stem.util.system +import nyx import nyx.curses import nyx.panel import nyx.popups import nyx.tracker from stem.util import conf, log -from nyx import nyx_interface, tor_controller, input_prompt +from nyx import nyx_interface, tor_controller from nyx.curses import RED, GREEN, YELLOW, CYAN, WHITE, BOLD, HIGHLIGHT @@ -33,7 +34,6 @@ UPDATE_RATE = 5 # rate in seconds at which we refresh CONFIG = conf.config_dict('nyx', { 'attr.flag_colors': {}, 'attr.version_status_colors': {}, - 'tor_chroot': '', }) @@ -129,9 +129,9 @@ class HeaderPanel(nyx.panel.DaemonPanel): try: try: - controller.reconnect(chroot_path = CONFIG['tor_chroot']) + controller.reconnect(chroot_path = nyx.chroot()) except stem.connection.MissingPassword: - password = input_prompt('Controller Password: ') + password = nyx.input_prompt('Controller Password: ') if password: controller.authenticate(password) diff --git a/nyx/starter.py b/nyx/starter.py index 88cf9f5..22e985e 100644 --- a/nyx/starter.py +++ b/nyx/starter.py @@ -69,7 +69,7 @@ def main(config): control_port = args.control_port, control_socket = args.control_socket, password_prompt = True, - chroot_path = config.get('tor_chroot', ''), + chroot_path = nyx.chroot(), ) if controller is None: @@ -78,7 +78,6 @@ def main(config): _warn_if_root(controller) _warn_if_unable_to_get_pid(controller) _warn_about_unused_config_keys() - _setup_freebsd_chroot(controller) _use_english_subcommands() _use_no_esc_delay() _use_unicode() @@ -143,17 +142,6 @@ def _load_user_nyxrc(path, config): if os.path.exists(path): try: config.load(path) - - # If the user provided us with a chroot then validate and normalize the - # path. - - chroot = config.get('tor_chroot', '').strip().rstrip(os.path.sep) - - if chroot and not os.path.exists(chroot): - stem.util.log.notice("The chroot path set in your config (%s) doesn't exist." % chroot) - config.set('tor_chroot', '') - else: - config.set('tor_chroot', chroot) # use the normalized path except IOError as exc: stem.util.log.warn('Failed to load configuration (using defaults): "%s"' % exc.strerror) else: @@ -194,20 +182,6 @@ def _warn_about_unused_config_keys(config): stem.util.log.notice('Unused configuration entry: %s' % key) -@uses_settings -def _setup_freebsd_chroot(controller, config): - """ - If we're running under FreeBSD then check the system for a chroot path. - """ - - if not config.get('tor_chroot', None) and platform.system() == 'FreeBSD': - jail_chroot = stem.util.system.bsd_jail_path(controller.get_pid(0)) - - if jail_chroot and os.path.exists(jail_chroot): - stem.util.log.info('Adjusting paths to account for Tor running in a FreeBSD jail at: %s' % jail_chroot) - config.set('tor_chroot', jail_chroot) - - def _use_english_subcommands(): """ Make subcommands we run (ps, netstat, etc) provide us with English results. diff --git a/test/__init__.py b/test/__init__.py index 6e3ade3..4a998f0 100644 --- a/test/__init__.py +++ b/test/__init__.py @@ -9,7 +9,7 @@ import unittest import nyx.curses -from nyx import expand_path, join, uses_settings +from nyx import expand_path, chroot, join, uses_settings from mock import patch, Mock __all__ = [ @@ -107,18 +107,40 @@ def render(func, *args, **kwargs): class TestBaseUtil(unittest.TestCase): - @patch('nyx.tor_controller') + def setUp(self): + nyx.CHROOT = None + + def tearDown(self): + nyx.CHROOT = None + + @patch('nyx.chroot', Mock(return_value = '')) + @patch('nyx.tor_controller', Mock()) @patch('stem.util.system.cwd', Mock(return_value = '/your_cwd')) - @uses_settings - def test_expand_path(self, tor_controller_mock, config): - tor_controller_mock().get_pid.return_value = 12345 + def test_expand_path(self): self.assertEqual('/absolute/path/to/torrc', expand_path('/absolute/path/to/torrc')) self.assertEqual('/your_cwd/torrc', expand_path('torrc')) - config.set('tor_chroot', '/chroot') + @patch('nyx.chroot', Mock(return_value = '/chroot')) + @patch('nyx.tor_controller', Mock()) + @patch('stem.util.system.cwd', Mock(return_value = '/your_cwd')) + def test_expand_path_with_chroot(self): self.assertEqual('/chroot/absolute/path/to/torrc', expand_path('/absolute/path/to/torrc')) self.assertEqual('/chroot/your_cwd/torrc', expand_path('torrc')) + @patch('platform.system', Mock(return_value = 'Linux')) + @patch('os.path.exists', Mock(return_value = True)) + @uses_settings + def test_chroot_uses_config(self, config): + config.set('tor_chroot', '/chroot/path') + self.assertEqual('/chroot/path', chroot()) + config.set('tor_chroot', None) + + @patch('platform.system', Mock(return_value = 'Linux')) + @patch('os.path.exists', Mock(return_value = False)) + @uses_settings + def test_chroot_requires_path_to_exist(self, config): + config.set('tor_chroot', '/chroot/path') + self.assertEqual('', chroot()) config.set('tor_chroot', None) def test_join(self):

1 0

[nyx/master] Move interaction of --interface and --socket to arguments
by atagar＠torproject.org 12 Sep '17

12 Sep '17

commit 305f575eb060ed31e51f5e9b537cbb5f13e96bf7 Author: Damian Johnson <atagar(a)torproject.org> Date: Tue Sep 5 11:22:01 2017 -0700 Move interaction of --interface and --socket to arguments When interface is set we unset the socket, and vic versa. Doing this in the arguments module both makes sense and lets us clean up the starter a bit. --- nyx/arguments.py | 29 +++++++++++++++++------------ nyx/panel/connection.py | 4 ++-- nyx/starter.py | 15 ++------------- test/arguments.py | 25 ++++++++++++++++++++----- web/changelog/index.html | 1 + 5 files changed, 42 insertions(+), 32 deletions(-) diff --git a/nyx/arguments.py b/nyx/arguments.py index e55b653..698328f 100644 --- a/nyx/arguments.py +++ b/nyx/arguments.py @@ -15,11 +15,8 @@ import nyx.log import stem.util.connection DEFAULT_ARGS = { - 'control_address': '127.0.0.1', - 'control_port': 9051, - 'user_provided_port': False, + 'control_port': ('127.0.0.1', 9051), 'control_socket': '/var/run/tor/control', - 'user_provided_socket': False, 'config': os.path.join(os.path.expanduser('~/.nyx'), 'config'), 'debug_path': None, 'logged_events': 'NOTICE,WARN,ERR,NYX_NOTICE,NYX_WARNING,NYX_ERROR', @@ -81,27 +78,27 @@ def parse(argv): except getopt.GetoptError as exc: raise ValueError('%s (for usage provide --help)' % exc) + has_port_arg, has_socket_arg = False, False + for opt, arg in recognized_args: if opt in ('-i', '--interface'): if ':' in arg: address, port = arg.split(':', 1) else: - address, port = None, arg + address, port = args['control_port'][0], arg if address is not None: if not stem.util.connection.is_valid_ipv4_address(address): raise ValueError("'%s' isn't a valid IPv4 address" % address) - args['control_address'] = address - if not stem.util.connection.is_valid_port(port): raise ValueError("'%s' isn't a valid port number" % port) - args['control_port'] = int(port) - args['user_provided_port'] = True + args['control_port'] = (address, int(port)) + has_port_arg = True elif opt in ('-s', '--socket'): args['control_socket'] = arg - args['user_provided_socket'] = True + has_socket_arg = True elif opt in ('-c', '--config'): args['config'] = arg elif opt in ('-d', '--debug'): @@ -113,6 +110,14 @@ def parse(argv): elif opt in ('-h', '--help'): args['print_help'] = True + # If the user explicitely specified an endpoint then just try to connect to + # that. + + if has_socket_arg and not has_port_arg: + args['control_port'] = None + elif has_port_arg and not has_socket_arg: + args['control_socket'] = None + # translates our args dict into a named tuple Args = collections.namedtuple('Args', args.keys()) @@ -127,8 +132,8 @@ def get_help(): """ return HELP_OUTPUT.format( - address = DEFAULT_ARGS['control_address'], - port = DEFAULT_ARGS['control_port'], + address = DEFAULT_ARGS['control_port'][0], + port = DEFAULT_ARGS['control_port'][1], socket = DEFAULT_ARGS['control_socket'], config_path = DEFAULT_ARGS['config'], ) diff --git a/nyx/panel/connection.py b/nyx/panel/connection.py index 41577b6..4683dcc 100644 --- a/nyx/panel/connection.py +++ b/nyx/panel/connection.py @@ -5,11 +5,11 @@ Listing of the currently established connections tor has made. """ -import re -import time import collections import curses import itertools +import re +import time import nyx.curses import nyx.panel diff --git a/nyx/starter.py b/nyx/starter.py index 077ca36..88cf9f5 100644 --- a/nyx/starter.py +++ b/nyx/starter.py @@ -65,20 +65,9 @@ def main(config): _load_user_nyxrc(args.config) - control_port = (args.control_address, args.control_port) - control_socket = args.control_socket - - # If the user explicitely specified an endpoint then just try to connect to - # that. - - if args.user_provided_socket and not args.user_provided_port: - control_port = None - elif args.user_provided_port and not args.user_provided_socket: - control_socket = None - controller = init_controller( - control_port = control_port, - control_socket = control_socket, + control_port = args.control_port, + control_socket = args.control_socket, password_prompt = True, chroot_path = config.get('tor_chroot', ''), ) diff --git a/test/arguments.py b/test/arguments.py index c146e7d..454c3ca 100644 --- a/test/arguments.py +++ b/test/arguments.py @@ -16,12 +16,10 @@ class TestArgumentParsing(unittest.TestCase): def test_that_we_load_arguments(self): args = parse(['--interface', '10.0.0.25:80']) - self.assertEqual('10.0.0.25', args.control_address) - self.assertEqual(80, args.control_port) + self.assertEqual(('10.0.0.25', 80), args.control_port) args = parse(['--interface', '80']) - self.assertEqual(DEFAULT_ARGS['control_address'], args.control_address) - self.assertEqual(80, args.control_port) + self.assertEqual((DEFAULT_ARGS['control_port'][0], 80), args.control_port) args = parse(['--socket', '/tmp/my_socket', '--config', '/tmp/my_config']) self.assertEqual('/tmp/my_socket', args.control_socket) @@ -41,7 +39,7 @@ class TestArgumentParsing(unittest.TestCase): def test_examples(self): args = parse(['-i', '1643']) - self.assertEqual(1643, args.control_port) + self.assertEqual((DEFAULT_ARGS['control_port'][0], 1643), args.control_port) args = parse(['-l', 'WARN,ERR', '-c', '/tmp/cfg']) self.assertEqual('WARN,ERR', args.logged_events) @@ -50,6 +48,23 @@ class TestArgumentParsing(unittest.TestCase): def test_that_we_reject_unrecognized_arguments(self): self.assertRaises(ValueError, parse, ['--blarg', 'stuff']) + def test_that_port_and_socket_unset_other(self): + args = parse([]) + self.assertEqual(DEFAULT_ARGS['control_port'], args.control_port) + self.assertEqual(DEFAULT_ARGS['control_socket'], args.control_socket) + + args = parse(['--interface', '10.0.0.25:80']) + self.assertEqual(('10.0.0.25', 80), args.control_port) + self.assertEqual(None, args.control_socket) + + args = parse(['--socket', '/tmp/my_socket']) + self.assertEqual(None, args.control_port) + self.assertEqual('/tmp/my_socket', args.control_socket) + + args = parse(['--interface', '10.0.0.25:80', '--socket', '/tmp/my_socket']) + self.assertEqual(('10.0.0.25', 80), args.control_port) + self.assertEqual('/tmp/my_socket', args.control_socket) + def test_that_we_reject_invalid_interfaces(self): invalid_inputs = ( '', diff --git a/web/changelog/index.html b/web/changelog/index.html index 3bc4641..7977afd 100644 --- a/web/changelog/index.html +++ b/web/changelog/index.html @@ -60,6 +60,7 @@ <li><span class="component">Startup</span> <ul> <li>Startup is several seconds faster when ran for the first time</li> + <li>Halved startup time and reduced memory by caching consensus data to disk</li> </ul> </li>

1 0

[nyx/master] Provide url for sample nyxrc
by atagar＠torproject.org 12 Sep '17

12 Sep '17

commit b9bf1f9340a7b2f8189fc3874c5a312d7be20901 Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Sep 10 03:39:18 2017 -0700 Provide url for sample nyxrc Most folks install via things like apt-get, and as such have no clue where the 'nyxrc.sample' is. Our website provides it so giving 'em a link to that. --- nyx/starter.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nyx/starter.py b/nyx/starter.py index 22e985e..90aa947 100644 --- a/nyx/starter.py +++ b/nyx/starter.py @@ -145,7 +145,7 @@ def _load_user_nyxrc(path, config): except IOError as exc: stem.util.log.warn('Failed to load configuration (using defaults): "%s"' % exc.strerror) else: - stem.util.log.notice('No nyxrc loaded, using defaults. You can customize nyx by placing a configuration file at %s (see the nyxrc.sample for its options).' % path) + stem.util.log.notice('No nyxrc loaded, using defaults. You can customize nyx by placing a configuration file at %s (see https://nyx.torproject.org/nyxrc.sample for its options).' % path) def _warn_if_root(controller):

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 12 Sep '17

12 Sep '17

commit 26eeab0a0fa27ae662b1526781e396d29532bf63 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Sep 12 16:45:32 2017 +0000 Update translations for https_everywhere --- uz/https-everywhere.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/uz/https-everywhere.dtd b/uz/https-everywhere.dtd index 809845d97..07536033b 100644 --- a/uz/https-everywhere.dtd +++ b/uz/https-everywhere.dtd @@ -49,7 +49,7 @@ <!ENTITY https-everywhere.prefs.ruleset_howto "You can learn how to write your own rulesets (to add support for other web sites)"> <!ENTITY https-everywhere.prefs.here_link "here"> <!ENTITY https-everywhere.prefs.toggle "Toggle"> -<!ENTITY https-everywhere.prefs.reset_default "Reset to Default"> +<!ENTITY https-everywhere.prefs.reset_default "Standart sozlamalarni tiklash"> <!ENTITY https-everywhere.prefs.view_xml_source "View XML Source"> <!ENTITY https-everywhere.chrome.stable_rules "Stable rules">

1 0

[tor/master] hs-v3: Rate limit some log statements
by nickm＠torproject.org 12 Sep '17

12 Sep '17

commit 98953b1fc29a693aa797989402f7205523448408 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Sep 12 11:02:40 2017 -0400 hs-v3: Rate limit some log statements Also fix an indentation issue. Closes #23480 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/hs_service.c | 10 ++++++++-- src/or/nodelist.c | 6 ++++-- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/src/or/hs_service.c b/src/or/hs_service.c index 5759aa812..a8883e03a 100644 --- a/src/or/hs_service.c +++ b/src/or/hs_service.c @@ -2978,8 +2978,14 @@ hs_service_lists_fnames_for_sandbox(smartlist_t *file_list, void hs_service_dir_info_changed(void) { - log_info(LD_REND, "New dirinfo arrived: consider reuploading descriptor"); - consider_republishing_hs_descriptors = 1; + if (hs_service_get_num_services() > 0) { + /* New directory information usually goes every consensus so rate limit + * every 30 minutes to not be too conservative. */ + static struct ratelim_t dir_info_changed_ratelim = RATELIM_INIT(30 * 60); + log_fn_ratelim(&dir_info_changed_ratelim, LOG_INFO, LD_REND, + "New dirinfo arrived: consider reuploading descriptor"); + consider_republishing_hs_descriptors = 1; + } } /* Called when we get an INTRODUCE2 cell on the circ. Respond to the cell and diff --git a/src/or/nodelist.c b/src/or/nodelist.c index 01a0e9e85..df735a9d2 100644 --- a/src/or/nodelist.c +++ b/src/or/nodelist.c @@ -300,14 +300,16 @@ node_set_hsdir_index(node_t *node, const networkstatus_t *ns) tor_assert(ns); if (!networkstatus_is_live(ns, now)) { - log_info(LD_GENERAL, "Not setting hsdir index with a non-live consensus."); + static struct ratelim_t live_consensus_ratelim = RATELIM_INIT(30 * 60); + log_fn_ratelim(&live_consensus_ratelim, LOG_INFO, LD_GENERAL, + "Not setting hsdir index with a non-live consensus."); goto done; } node_identity_pk = node_get_ed25519_id(node); if (node_identity_pk == NULL) { log_debug(LD_GENERAL, "ed25519 identity public key not found when " - "trying to build the hsdir indexes for node %s", + "trying to build the hsdir indexes for node %s", node_describe(node)); goto done; }

1 0

[tor/master] hs: Fix digest256 to base64 issue in a log statement
by nickm＠torproject.org 12 Sep '17

12 Sep '17

commit 184bd2258673f9e33e43cfc1264da78f74ad78a4 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Sep 12 09:43:34 2017 -0400 hs: Fix digest256 to base64 issue in a log statement Part of #23480. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/hs_cache.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/src/or/hs_cache.c b/src/or/hs_cache.c index 78e2adacf..7f2a9cbbb 100644 --- a/src/or/hs_cache.c +++ b/src/or/hs_cache.c @@ -234,8 +234,7 @@ cache_clean_v3_as_dir(time_t now, time_t global_cutoff) /* Logging. */ { char key_b64[BASE64_DIGEST256_LEN + 1]; - base64_encode(key_b64, sizeof(key_b64), (const char *) key, - DIGEST256_LEN, 0); + digest256_to_base64(key_b64, (const char *) key); log_info(LD_REND, "Removing v3 descriptor '%s' from HSDir cache", safe_str_client(key_b64)); } @@ -655,8 +654,7 @@ cache_clean_v3_as_client(time_t now) /* Logging. */ { char key_b64[BASE64_DIGEST256_LEN + 1]; - base64_encode(key_b64, sizeof(key_b64), (const char *) key, - DIGEST256_LEN, 0); + digest256_to_base64(key_b64, (const char *) key); log_info(LD_REND, "Removing hidden service v3 descriptor '%s' " "from client cache", safe_str_client(key_b64));

1 0

[tor/master] Merge remote-tracking branch 'dgoulet/ticket23480_032_01'
by nickm＠torproject.org 12 Sep '17

12 Sep '17

commit d71a00e91f3921f6bdf160811313e7b32f890b6c Merge: 6c5c74e11 98953b1fc Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 12 11:20:27 2017 -0400 Merge remote-tracking branch 'dgoulet/ticket23480_032_01' src/or/hs_cache.c | 6 ++---- src/or/hs_service.c | 10 ++++++++-- src/or/nodelist.c | 6 ++++-- 3 files changed, 14 insertions(+), 8 deletions(-)

1 0

[translation/tails-iuk] Update translations for tails-iuk
by translation＠torproject.org 12 Sep '17

12 Sep '17

commit 490ddcbfce0166a39d93383c59ee1b29e50ef0b2 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Sep 12 15:17:17 2017 +0000 Update translations for tails-iuk --- my.po | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/my.po b/my.po index f1f13a86c..1bdbeb007 100644 --- a/my.po +++ b/my.po @@ -7,8 +7,8 @@ msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: Tails developers <tails(a)boum.org>\n" -"POT-Creation-Date: 2016-05-25 16:55+0200\n" -"PO-Revision-Date: 2016-05-26 08:49+0000\n" +"POT-Creation-Date: 2017-04-18 12:13+0200\n" +"PO-Revision-Date: 2017-09-12 14:52+0000\n" "Last-Translator: carolyn <carolyn(a)anhalt.org>\n" "Language-Team: Burmese (http://www.transifex.com/otf/torproject/language/my/)\n" "MIME-Version: 1.0\n" @@ -201,7 +201,7 @@ msgstr "" #: ../lib/Tails/IUK/Frontend.pm:614 msgid "Restart now" -msgstr "" +msgstr "ယခုပင်အစမှပြန်ဖွင့်ရန်" #: ../lib/Tails/IUK/Frontend.pm:615 msgid "Restart later"

1 0

[tor/master] hs-v3: Cancel active descriptor directory connections before uploading
by nickm＠torproject.org 12 Sep '17

12 Sep '17

commit 7150214baf2385d0e64fd11fe4138932675d444f Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Sep 11 13:16:23 2017 -0400 hs-v3: Cancel active descriptor directory connections before uploading It is possible that two descriptor upload requests are launched in a very short time frame which can lead to the second request finishing before the first one and where that first one will make the HSDir send back a 400 malformed descriptor leading to a warning. To avoid such, cancel all active directory connections for the specific descriptor we are about to upload. Note that this race is still possible on the HSDir side which triggers a log info to be printed out but that is fine. Fixes #23457 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/hs_client.c | 3 ++- src/or/hs_ident.c | 16 ++++++++++++++++ src/or/hs_ident.h | 8 ++++++++ src/or/hs_service.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++- 4 files changed, 72 insertions(+), 2 deletions(-) diff --git a/src/or/hs_client.c b/src/or/hs_client.c index f85ebc847..2f8953ba7 100644 --- a/src/or/hs_client.c +++ b/src/or/hs_client.c @@ -156,7 +156,8 @@ directory_launch_v3_desc_fetch(const ed25519_public_key_t *onion_identity_pk, } /* Copy onion pk to a dir_ident so that we attach it to the dir conn */ - ed25519_pubkey_copy(&hs_conn_dir_ident.identity_pk, onion_identity_pk); + hs_ident_dir_conn_init(onion_identity_pk, &blinded_pubkey, + &hs_conn_dir_ident); /* Setup directory request */ directory_request_t *req = diff --git a/src/or/hs_ident.c b/src/or/hs_ident.c index df3928515..b0e4e36a9 100644 --- a/src/or/hs_ident.c +++ b/src/or/hs_ident.c @@ -65,6 +65,22 @@ hs_ident_dir_conn_free(hs_ident_dir_conn_t *ident) tor_free(ident); } +/* Initialized the allocated ident object with identity_pk and blinded_pk. + * None of them can be NULL since a valid directory connection identifier must + * have all fields set. */ +void +hs_ident_dir_conn_init(const ed25519_public_key_t *identity_pk, + const ed25519_public_key_t *blinded_pk, + hs_ident_dir_conn_t *ident) +{ + tor_assert(identity_pk); + tor_assert(blinded_pk); + tor_assert(ident); + + ed25519_pubkey_copy(&ident->identity_pk, identity_pk); + ed25519_pubkey_copy(&ident->blinded_pk, blinded_pk); +} + /* Return a newly allocated edge connection identifier. The given public key * identity_pk is copied into the identifier. */ hs_ident_edge_conn_t * diff --git a/src/or/hs_ident.h b/src/or/hs_ident.h index cfcde781d..101c1cfff 100644 --- a/src/or/hs_ident.h +++ b/src/or/hs_ident.h @@ -96,6 +96,11 @@ typedef struct hs_ident_dir_conn_t { * in the onion address. */ ed25519_public_key_t identity_pk; + /* The blinded public key used to uniquely identify the descriptor that this + * directory connection identifier is for. Only used by the service-side code + * to fine control descriptor uploads. */ + ed25519_public_key_t blinded_pk; + /* XXX: Client authorization. */ } hs_ident_dir_conn_t; @@ -120,6 +125,9 @@ hs_ident_circuit_t *hs_ident_circuit_dup(const hs_ident_circuit_t *src); /* Directory connection identifier API. */ hs_ident_dir_conn_t *hs_ident_dir_conn_dup(const hs_ident_dir_conn_t *src); void hs_ident_dir_conn_free(hs_ident_dir_conn_t *ident); +void hs_ident_dir_conn_init(const ed25519_public_key_t *identity_pk, + const ed25519_public_key_t *blinded_pk, + hs_ident_dir_conn_t *ident); /* Edge connection identifier API. */ hs_ident_edge_conn_t *hs_ident_edge_conn_new( diff --git a/src/or/hs_service.c b/src/or/hs_service.c index 5759aa812..d32a120bc 100644 --- a/src/or/hs_service.c +++ b/src/or/hs_service.c @@ -14,6 +14,7 @@ #include "circuitlist.h" #include "circuituse.h" #include "config.h" +#include "connection.h" #include "directory.h" #include "main.h" #include "networkstatus.h" @@ -641,6 +642,41 @@ count_desc_circuit_established(const hs_service_descriptor_t *desc) return count; } +/* For a given service and descriptor of that service, close all active + * directory connections. */ +static void +close_directory_connections(const hs_service_t *service, + const hs_service_descriptor_t *desc) +{ + unsigned int count = 0; + smartlist_t *dir_conns; + + tor_assert(service); + tor_assert(desc); + + /* Close pending HS desc upload connections for the blinded key of 'desc'. */ + dir_conns = connection_list_by_type_purpose(CONN_TYPE_DIR, + DIR_PURPOSE_UPLOAD_HSDESC); + SMARTLIST_FOREACH_BEGIN(dir_conns, connection_t *, conn) { + dir_connection_t *dir_conn = TO_DIR_CONN(conn); + if (ed25519_pubkey_eq(&dir_conn->hs_ident->identity_pk, + &service->keys.identity_pk) && + ed25519_pubkey_eq(&dir_conn->hs_ident->blinded_pk, + &desc->blinded_kp.pubkey)) { + connection_mark_for_close(conn); + count++; + continue; + } + } SMARTLIST_FOREACH_END(conn); + + log_info(LD_REND, "Closed %u active service directory connections for " + "descriptor %s of service %s", + count, safe_str_client(ed25519_fmt(&desc->blinded_kp.pubkey)), + safe_str_client(service->onion_address)); + /* We don't have ownership of the objects in this list. */ + smartlist_free(dir_conns); +} + /* Close all rendezvous circuits for the given service. */ static void close_service_rp_circuits(hs_service_t *service) @@ -2137,7 +2173,9 @@ upload_descriptor_to_hsdir(const hs_service_t *service, } /* Setup the connection identifier. */ - ed25519_pubkey_copy(&ident.identity_pk, &service->keys.identity_pk); + hs_ident_dir_conn_init(&service->keys.identity_pk, &desc->blinded_kp.pubkey, + &ident); + /* This is our resource when uploading which is used to construct the URL * with the version number: "/tor/hs/<version>/publish". */ tor_snprintf(version_str, sizeof(version_str), "%u", @@ -2387,6 +2425,13 @@ upload_descriptor_to_all(const hs_service_t *service, tor_assert(service); tor_assert(desc); + /* We'll first cancel any directory request that are ongoing for this + * descriptor. It is possible that we can trigger multiple uploads in a + * short time frame which can lead to a race where the second upload arrives + * before the first one leading to a 400 malformed descriptor response from + * the directory. Closing all pending requests avoids that. */ + close_directory_connections(service, desc); + /* Get our list of responsible HSDir. */ responsible_dirs = smartlist_new(); /* The parameter 0 means that we aren't a client so tell the function to use

1 0

[tor/master] Merge remote-tracking branch 'asn/bug23457_032_01'
by nickm＠torproject.org 12 Sep '17

12 Sep '17

commit 6c5c74e11e63f8e1a924ac8de4784edaf56179fa Merge: 26d462c1f 7150214ba Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 12 11:10:48 2017 -0400 Merge remote-tracking branch 'asn/bug23457_032_01' src/or/hs_client.c | 3 ++- src/or/hs_ident.c | 16 ++++++++++++++++ src/or/hs_ident.h | 8 ++++++++ src/or/hs_service.c | 47 ++++++++++++++++++++++++++++++++++++++++++++++- 4 files changed, 72 insertions(+), 2 deletions(-)

1 0