November 2018 - tor-commits - lists.torproject.org

[translation/tbmanual-contentspot] Update translations for tbmanual-contentspot
by translation＠torproject.org 16 Nov '18

16 Nov '18

commit e79afabe5ead91516984257666e2ec6cd56e0466 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Nov 16 14:17:12 2018 +0000 Update translations for tbmanual-contentspot --- contents+es-AR.po | 72 ++++++++++++++++++++++++++++++++++++++++++++----------- contents+it.po | 20 +++++++++++++--- 2 files changed, 75 insertions(+), 17 deletions(-) diff --git a/contents+es-AR.po b/contents+es-AR.po index 85d3e851e..10a66c8ac 100644 --- a/contents+es-AR.po +++ b/contents+es-AR.po @@ -19,7 +19,7 @@ msgstr "" #: http//localhost/ (content/contents+en.lrshowcase.title) msgid "How can we help?" -msgstr "" +msgstr "¿Cómo podemos ayudarte?" #: http//localhost/about/ (content/about/contents+en.lrtopic.title) msgid "About Tor Browser" @@ -45,6 +45,9 @@ msgid "" "locally, will not be able to track your internet activity, including the " "names and addresses of the websites you visit." msgstr "" +"Tu proveedor de internet, y cualquiera que esté observando tu conexión " +"local, no podrá rastrear tu actividad en internet, incluyendo los nombres y " +"direcciones de los sitios web que visités. " #: http//localhost/about/ (content/about/contents+en.lrtopic.body) msgid "" @@ -53,6 +56,10 @@ msgid "" "your real Internet (IP) address, and will not know who you are unless you " "explicitly identify yourself." msgstr "" +"Los operadores de los sitios web y servicios que usés, y cualquiera que los " +"esté observando, verán una conexión proveniente de la red de Tor, en lugar " +"de tu dirección (IP) real, y no sabrán quién sos, a no ser que te " +"identifiques explícitamente. " #: http//localhost/about/ (content/about/contents+en.lrtopic.body) msgid "" @@ -69,10 +76,14 @@ msgid "" " valid for a single session (until Tor Browser is exited or a <a href" "=\"/managing-identities.html#new-identity\">New Identity</a> is requested)." msgstr "" +"Por defecto, el Navegador Tor no guarda ningún historial de navegación. Las " +"Cookies son válidas para una sola sesión (hasta que el Navegador Tor sea " +"cerrado o una <link xref=\"managing-identities#new-identity\">Nueva " +"Identidad</link>) sea solicitada." #: http//localhost/about/ (content/about/contents+en.lrtopic.body) msgid "##### How Tor works" -msgstr "" +msgstr "##### Cómo funciona Tor" #: http//localhost/about/ (content/about/contents+en.lrtopic.body) msgid "" @@ -93,6 +104,8 @@ msgid "" "<img class=\"\" src=\"/static/images/how-tor-works.png\" alt=\"How Tor " "Browser works\">" msgstr "" +"<img class=\"\" src=\"/static/images/how-tor-works.png\" alt=\"How Tor " +"Browser works\">" #: http//localhost/about/ (content/about/contents+en.lrtopic.body) msgid "" @@ -147,7 +160,7 @@ msgstr "" #: http//localhost/downloading/ (content/downloading/contents+en.lrtopic.body) msgid "##### GetTor" -msgstr "" +msgstr "##### GetTor" #: http//localhost/downloading/ (content/downloading/contents+en.lrtopic.body) msgid "" @@ -161,7 +174,7 @@ msgstr "" #: http//localhost/downloading/ (content/downloading/contents+en.lrtopic.body) msgid "###### To use GetTor via email:" -msgstr "" +msgstr "##### Usar GetTor vía correo electrónico:" #: http//localhost/downloading/ (content/downloading/contents+en.lrtopic.body) msgid "" @@ -191,7 +204,7 @@ msgstr "" #: http//localhost/downloading/ (content/downloading/contents+en.lrtopic.body) msgid "###### To use GetTor via Twitter:" -msgstr "" +msgstr "##### Usar GetTor vía Twitter:" #: http//localhost/downloading/ (content/downloading/contents+en.lrtopic.body) msgid "" @@ -205,7 +218,7 @@ msgstr "" #: http//localhost/downloading/ (content/downloading/contents+en.lrtopic.body) msgid "###### To use GetTor via Jabber/XMPP (Jitsi, CoyIM, etc.):" -msgstr "" +msgstr "##### Usar GetTor vía Jabber/XMPP (Jitsi, CoyIM, etc.):" #: http//localhost/downloading/ (content/downloading/contents+en.lrtopic.body) msgid "" @@ -274,11 +287,19 @@ msgid "" "/first-time.html\">begin using Tor Browser</a>. If they do not match, you " "may need to try downloading again, or from a different source." msgstr "" +"Seleccioná el archivo del navegador Tor descargado. Satori mostrará la suma " +"de verificación del archivo, la cual debieras comparar con la suma de " +"verificación original del programa: podés encontrar ésto cliqueando la " +"palabra \"suma de verificación\" después del vínculo que cliqueaste para " +"empezar la descarga. Si las sumas de verificación coinciden, tu descarga fue" +" exitosa, y podés <a href=\"https://tb-manual.torproject.org/en-US/first-" +"time.html\">empezar a usar el navegador Tor</a>. Si no coinciden, puede que " +"necesités intentar descargarlo de nuevo, o de una fuente diferente." #: http//localhost/downloading/ #: (content/downloading/contents+en.lrtopic.seo_slug) msgid "downloading" -msgstr "" +msgstr "descargando" #: http//localhost/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.title) @@ -304,14 +325,14 @@ msgstr "" #: http//localhost/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.body) msgid "##### Connect" -msgstr "" +msgstr "##### Conectar" #: http//localhost/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.body) #: http//localhost/troubleshooting/ #: (content/troubleshooting/contents+en.lrtopic.body) msgid "<img class=\"col-md-6\" src=\"/static/images/connect.png\">" -msgstr "" +msgstr "<img class=\"col-md-6\" src=\"/static/images/connect.png\">" #: http//localhost/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.body) @@ -323,18 +344,25 @@ msgid "" "href=\"/troubleshooting\">Troubleshooting</a> page for help solving the " "problem." msgstr "" +"En la mayoría de los casos, eligiendo \"Conectar\" te permitirá conectar a " +"la red de Tor sin ninguna configuración ulterior. Una vez cliqueado, " +"aparecerá una barra de estado, mostrando el progreso de conexión de Tor. Si " +"estás en una conexión relativamente rápida, pero esta barra pareciera quedar" +" trabada en cierto punto, mirá la página <a " +"href=\"/troubleshooting\">Resolución de problemas</a> por ayuda en cómo " +"resolver el problema." #: http//localhost/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.body) msgid "##### Configure" -msgstr "" +msgstr "##### Configurar" #: http//localhost/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.body) #: http//localhost/circumvention/ #: (content/circumvention/contents+en.lrtopic.body) msgid "<img class=\"col-md-6\" src=\"/static/images/configure.png\">" -msgstr "" +msgstr "<img class=\"col-md-6\" src=\"/static/images/configure.png\">" #: http//localhost/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.body) @@ -357,6 +385,13 @@ msgid "" " You will then be taken to the <a href=\"/circumvention\">Circumvention</a> " "screen to configure a pluggable transport." msgstr "" +"La primera pantalla pregunta si el acceso a la red de Tor está bloqueado o " +"censurado en tu conexión. Si no creés que éste es el caso, seleccioná " +"\"No\". Si sabés que tu conexión está censurada, o has intentado y fallado " +"en conectar a la red de Tor y ninguna otra posibilidad ha funcionado, " +"seleccioná \"Sí\". Luego serás llevado a la pantalla <a " +"href=\"/circumvention\">Evitar obstáculos</a> para configurar un transporte " +"insertable." #: http//localhost/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.body) @@ -376,17 +411,17 @@ msgstr "" #: http//localhost/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.body) msgid "<img class=\"col-md-6\" src=\"/static/images/proxy_question.png\">" -msgstr "" +msgstr "<img class=\"col-md-6\" src=\"/static/images/proxy_question.png\">" #: http//localhost/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.body) msgid "<img class=\"col-md-6\" src=\"/static/images/proxy.png\">" -msgstr "" +msgstr "<img class=\"col-md-6\" src=\"/static/images/proxy.png\">" #: http//localhost/running-tor-browser/ #: (content/running-tor-browser/contents+en.lrtopic.seo_slug) msgid "running-tor-browser" -msgstr "" +msgstr "correr-navegador-tor" #: http//localhost/bridges/ (content/bridges/contents+en.lrtopic.title) msgid "Bridges" @@ -397,6 +432,8 @@ msgid "" "Most Pluggable Transports, such as obfs3 and obfs4, rely on the use of " "“bridge” relays." msgstr "" +"La mayoría de los transportes insertables, tales como obfs3 y obfs4, se " +"apoyan para su funcionamiento en el uso de relevos \"puente\"." #: http//localhost/bridges/ (content/bridges/contents+en.lrtopic.body) msgid "" @@ -407,6 +444,13 @@ msgid "" "combination with pluggable transports helps to disguise the fact that you " "are using Tor." msgstr "" +"La mayoría de los <a href=\"/transports\">transportes insertables</a>, tales" +" como obfs3 y obfs4, se apoyan para su funcionamiento en el uso de relevos " +"\"puente\". Como los relevos Tor ordinarios, los puentes son operados por " +"voluntarios; sin embargo, y a diferencia de éstos, no son listados " +"públicamente, por lo que un adversario no puede identificarlos fácilmente. " +"Usando puentes en combinación con transportes insertables ayuda a enmascarar" +" el hecho de que estás usando Tor." #: http//localhost/bridges/ (content/bridges/contents+en.lrtopic.body) msgid "" diff --git a/contents+it.po b/contents+it.po index 79aaae627..ad997cb12 100644 --- a/contents+it.po +++ b/contents+it.po @@ -475,7 +475,7 @@ msgstr "" #: http//localhost/bridges/ (content/bridges/contents+en.lrtopic.body) msgid "" "* Visit https://bridges.torproject.org/ and follow the instructions, or" -msgstr "Visita https://bridges.torproject.org/ e segui le istruzioni" +msgstr "* Visita https://bridges.torproject.org/ e segui le istruzioni" #: http//localhost/bridges/ (content/bridges/contents+en.lrtopic.body) msgid "" @@ -528,6 +528,9 @@ msgid "" "If the connection fails, the bridges you received may be down. Please use " "one of the above methods to obtain more bridge addresses, and try again." msgstr "" +"Se la connessione non va a buon fine, il ponte che hai ricevuto potrebbe " +"essere disattivo. Utilizza uno dei metodi qui sopra per ottenere più ponti e" +" riprova." #: http//localhost/bridges/ (content/bridges/contents+en.lrtopic.seo_slug) msgid "bridges" @@ -1552,7 +1555,7 @@ msgstr "" #: http//localhost/updating/ (content/updating/contents+en.lrtopic.body) msgid "##### Updating Tor Browser automatically" -msgstr "" +msgstr "##### Aggiorna il Browser Tor automaticamente" #: http//localhost/updating/ (content/updating/contents+en.lrtopic.body) msgid "<img width=\"400\" src=\"media/updating/update1.png\" />" @@ -1592,7 +1595,7 @@ msgstr "" #: http//localhost/updating/ (content/updating/contents+en.lrtopic.body) msgid "##### Updating Tor Browser manually" -msgstr "" +msgstr "##### Aggiorna il Browser Tor manualmente" #: http//localhost/updating/ (content/updating/contents+en.lrtopic.body) msgid "" @@ -1608,6 +1611,9 @@ msgid "" "(see the <a href='uninstalling'>Uninstalling</a> section for more " "information)." msgstr "" +"Rimuovi il browser Tor dal tuo sistema la cancellando la directory che lo " +"contiene ( guarda la sezione <a href='uninstalling'>Disinstalla</a> per " +"maggiori informazioni)" #: http//localhost/updating/ (content/updating/contents+en.lrtopic.body) msgid "" @@ -1616,6 +1622,10 @@ msgid "" " and download a copy of the latest Tor Browser release, then install it as " "before." msgstr "" +"Visitate <a " +"href=\"https://www.torproject.org/projects/torbrowser.html.en\">https://www.torproject.org/projects/torbrowser.html.en</a>" +" e scaricate una copia dell'ultima versione del browser Tor, quindi " +"installatela come prima." #: http//localhost/updating/ (content/updating/contents+en.lrtopic.seo_slug) msgid "updating" @@ -1683,6 +1693,10 @@ msgid "" "JavaScript (and other scripts) that runs on individual web pages, or block " "it entirely." msgstr "" +"Tor Browser include un componente aggiuntivo chiamato NoScript, accessibile " +"tramite l'icona \"S\" in alto a destra della finestra. NoScript ti permette " +"di controllare JavaScript (e altri script) che gira su singole pagine web, o" +" di bloccarlo completamente." #: http//localhost/plugins/ (content/plugins/contents+en.lrtopic.body) msgid "<img class=\"col-md-6\" src=\"/static/images/noscript_menu.png\">"

1 0

[tor/release-0.3.5] Fold in the 27471 changelog entry
by nickm＠torproject.org 16 Nov '18

16 Nov '18

commit a2ecc19ab923f34cc2363fa6f8c6e8d2bf9d350b Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 16 09:01:17 2018 -0500 Fold in the 27471 changelog entry --- ChangeLog | 4 ++++ changes/ticket27471 | 5 ----- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 2d1a08394..4c776f716 100644 --- a/ChangeLog +++ b/ChangeLog @@ -59,6 +59,10 @@ Changes in version 0.3.5.5-alpha - 2018-11-16 whether to reuse the circuit or discard it. Previously, we closed intro circuits when sending NACKs. Fixes bug 27841; bugfix on 0.3.2.1-alpha. Patch by Neel Chaunan. + - When replacing a descriptor in the client cache, make sure to + close all client introduction circuits for the old descriptor, so + we don't end up with unusable leftover circuits. Fixes bug 27471; + bugfix on 0.3.2.1-alpha. Changes in version 0.3.5.4-alpha - 2018-11-08 diff --git a/changes/ticket27471 b/changes/ticket27471 deleted file mode 100644 index ffe77d268..000000000 --- a/changes/ticket27471 +++ /dev/null @@ -1,5 +0,0 @@ - o Minor bugfixes (hidden service v3, client): - - When replacing a descriptor in the client cache with a newer descriptor, - make sure to close all client introduction circuits of the old - descriptor so we don't end up with unusable leftover circuits. Fixes bug - 27471; bugfix on 0.3.2.1-alpha.

1 0

[tor/release-0.3.5] test: Add test for closing intro circuits when storing a new descriptor
by nickm＠torproject.org 16 Nov '18

16 Nov '18

commit 8b2e72106ae87c8018d9bae25f826c7bd92a88e8 Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Oct 12 10:30:33 2018 -0400 test: Add test for closing intro circuits when storing a new descriptor This is client side and related to 27471 for previous commit that fixes this issue. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/test/test_hs_client.c | 103 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 103 insertions(+) diff --git a/src/test/test_hs_client.c b/src/test/test_hs_client.c index 25cb991a7..91b3ed1ec 100644 --- a/src/test/test_hs_client.c +++ b/src/test/test_hs_client.c @@ -885,6 +885,107 @@ test_desc_has_arrived_cleanup(void *arg) UNMOCK(router_have_minimum_dir_info); } +static void +test_close_intro_circuits_new_desc(void *arg) +{ + int ret; + ed25519_keypair_t service_kp; + circuit_t *circ = NULL; + origin_circuit_t *ocirc = NULL; + hs_descriptor_t *desc1 = NULL, *desc2 = NULL; + + (void) arg; + + hs_init(); + + /* This is needed because of the client cache expiration timestamp is based + * on having a consensus. See cached_client_descriptor_has_expired(). */ + MOCK(networkstatus_get_live_consensus, + mock_networkstatus_get_live_consensus); + + /* Set consensus time */ + parse_rfc1123_time("Sat, 26 Oct 1985 13:00:00 UTC", + &mock_ns.valid_after); + parse_rfc1123_time("Sat, 26 Oct 1985 14:00:00 UTC", + &mock_ns.fresh_until); + parse_rfc1123_time("Sat, 26 Oct 1985 16:00:00 UTC", + &mock_ns.valid_until); + + /* Generate service keypair */ + tt_int_op(0, OP_EQ, ed25519_keypair_generate(&service_kp, 0)); + + /* Create and add to the global list a dummy client introduction circuits. + * We'll then make sure the hs_ident is attached to a dummy descriptor. */ + circ = dummy_origin_circuit_new(0); + tt_assert(circ); + circ->purpose = CIRCUIT_PURPOSE_C_INTRODUCING; + ocirc = TO_ORIGIN_CIRCUIT(circ); + + /* Build the first descriptor and cache it. */ + { + char *encoded; + desc1 = hs_helper_build_hs_desc_with_ip(&service_kp); + tt_assert(desc1); + ret = hs_desc_encode_descriptor(desc1, &service_kp, NULL, &encoded); + tt_int_op(ret, OP_EQ, 0); + tt_assert(encoded); + + /* Store it */ + ret = hs_cache_store_as_client(encoded, &service_kp.pubkey); + tt_int_op(ret, OP_EQ, 0); + tor_free(encoded); + tt_assert(hs_cache_lookup_as_client(&service_kp.pubkey)); + } + + /* We'll pick one introduction point and associate it with the circuit. */ + { + const hs_desc_intro_point_t *ip = + smartlist_get(desc1->encrypted_data.intro_points, 0); + tt_assert(ip); + ocirc->hs_ident = hs_ident_circuit_new(&service_kp.pubkey, + HS_IDENT_CIRCUIT_INTRO); + ed25519_pubkey_copy(&ocirc->hs_ident->intro_auth_pk, + &ip->auth_key_cert->signed_key); + } + + /* Before we are about to clean up the intro circuits, make sure it is + * actually there. */ + tt_assert(circuit_get_next_intro_circ(NULL, true)); + + /* Build the second descriptor for the same service and cache it. */ + { + char *encoded; + desc2 = hs_helper_build_hs_desc_with_ip(&service_kp); + tt_assert(desc2); + tt_mem_op(&desc1->plaintext_data.signing_pubkey, OP_EQ, + &desc2->plaintext_data.signing_pubkey, ED25519_PUBKEY_LEN); + /* To replace the existing descriptor, the revision counter needs to be + * bigger. */ + desc2->plaintext_data.revision_counter = + desc1->plaintext_data.revision_counter + 1; + + ret = hs_desc_encode_descriptor(desc2, &service_kp, NULL, &encoded); + tt_int_op(ret, OP_EQ, 0); + tt_assert(encoded); + + hs_cache_store_as_client(encoded, &service_kp.pubkey); + tt_int_op(ret, OP_EQ, 0); + tor_free(encoded); + tt_assert(hs_cache_lookup_as_client(&service_kp.pubkey)); + } + + /* Once stored, our intro circuit should be closed because it is related to + * an old introduction point that doesn't exists anymore. */ + tt_assert(!circuit_get_next_intro_circ(NULL, true)); + + done: + circuit_free(circ); + hs_descriptor_free(desc1); + hs_descriptor_free(desc2); + hs_free_all(); + UNMOCK(networkstatus_get_live_consensus); +} + struct testcase_t hs_client_tests[] = { { "e2e_rend_circuit_setup_legacy", test_e2e_rend_circuit_setup_legacy, TT_FORK, NULL, NULL }, @@ -902,6 +1003,8 @@ struct testcase_t hs_client_tests[] = { TT_FORK, NULL, NULL }, { "desc_has_arrived_cleanup", test_desc_has_arrived_cleanup, TT_FORK, NULL, NULL }, + { "close_intro_circuits_new_desc", test_close_intro_circuits_new_desc, + TT_FORK, NULL, NULL }, END_OF_TESTCASES };

1 0

[tor/release-0.3.5] Merge remote-tracking branch 'dgoulet/ticket27471_035_02' into maint-0.3.5
by nickm＠torproject.org 16 Nov '18

16 Nov '18

commit 35558c39dd162902a0e007b6e9dbd66d979043fd Merge: c9906cc3f 8b2e72106 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 16 08:57:56 2018 -0500 Merge remote-tracking branch 'dgoulet/ticket27471_035_02' into maint-0.3.5 changes/ticket27471 | 5 ++ src/core/or/circuitlist.c | 49 +++++++++++++++----- src/core/or/circuitlist.h | 3 +- src/feature/hs/hs_cache.c | 7 +++ src/feature/hs/hs_client.c | 32 +++++++++++++ src/feature/hs/hs_client.h | 1 + src/feature/rend/rendservice.c | 2 +- src/test/test_hs_client.c | 103 +++++++++++++++++++++++++++++++++++++++++ 8 files changed, 188 insertions(+), 14 deletions(-)

1 0

[tor/release-0.3.5] Merge branch 'maint-0.3.5' into release-0.3.5
by nickm＠torproject.org 16 Nov '18

16 Nov '18

commit 7c5d7dbe8c60ce5b9356f3f590815b48f6001719 Merge: 346f117b8 35558c39d Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 16 08:58:25 2018 -0500 Merge branch 'maint-0.3.5' into release-0.3.5 changes/ticket27471 | 5 ++ src/core/or/circuitlist.c | 49 +++++++++++++++----- src/core/or/circuitlist.h | 3 +- src/feature/hs/hs_cache.c | 7 +++ src/feature/hs/hs_client.c | 32 +++++++++++++ src/feature/hs/hs_client.h | 1 + src/feature/rend/rendservice.c | 2 +- src/test/test_hs_client.c | 103 +++++++++++++++++++++++++++++++++++++++++ 8 files changed, 188 insertions(+), 14 deletions(-)

1 0

[tor/release-0.3.5] hs-v3: Close client intro circuits if the descriptor is replaced
by nickm＠torproject.org 16 Nov '18

16 Nov '18

commit 9ba16c4d03a39bcd369ccd59f6bfa351f4b527d5 Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Oct 12 09:22:30 2018 -0400 hs-v3: Close client intro circuits if the descriptor is replaced When storing a descriptor in the client cache, if we are about to replace an existing descriptor, make sure to close every introduction circuits of the old descriptor so we don't have leftovers lying around. Ticket 27471 describes a situation where tor is sending an INTRODUCE1 cell on an introduction circuit for which it doesn't have a matching intro point object (taken from the descriptor). The main theory is that, after a new descriptor showed up, the introduction points changed which led to selecting an introduction circuit not used by the service anymore thus for which we are unable to find the corresponding introduction point within the descriptor we just fetched. Closes #27471. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket27471 | 5 +++++ src/core/or/circuitlist.c | 49 +++++++++++++++++++++++++++++++----------- src/core/or/circuitlist.h | 3 ++- src/feature/hs/hs_cache.c | 7 ++++++ src/feature/hs/hs_client.c | 32 +++++++++++++++++++++++++++ src/feature/hs/hs_client.h | 1 + src/feature/rend/rendservice.c | 2 +- 7 files changed, 85 insertions(+), 14 deletions(-) diff --git a/changes/ticket27471 b/changes/ticket27471 new file mode 100644 index 000000000..ffe77d268 --- /dev/null +++ b/changes/ticket27471 @@ -0,0 +1,5 @@ + o Minor bugfixes (hidden service v3, client): + - When replacing a descriptor in the client cache with a newer descriptor, + make sure to close all client introduction circuits of the old + descriptor so we don't end up with unusable leftover circuits. Fixes bug + 27471; bugfix on 0.3.2.1-alpha. diff --git a/src/core/or/circuitlist.c b/src/core/or/circuitlist.c index 5ff142c15..35efc6541 100644 --- a/src/core/or/circuitlist.c +++ b/src/core/or/circuitlist.c @@ -1644,15 +1644,24 @@ circuit_get_ready_rend_circ_by_rend_data(const rend_data_t *rend_data) return NULL; } -/** Return the first service introduction circuit originating from the global - * circuit list after start or at the start of the list if start - * is NULL. Return NULL if no circuit is found. +/** Return the first introduction circuit originating from the global circuit + * list after start or at the start of the list if start is + * NULL. Return NULL if no circuit is found. + * + * If want_client_circ is true, then we are looking for client-side + * introduction circuits: A client introduction point circuit has a purpose of + * either CIRCUIT_PURPOSE_C_INTRODUCING, CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT + * or CIRCUIT_PURPOSE_C_INTRODUCE_ACKED. This does not return a circuit marked + * for close, but it returns circuits regardless of their circuit state. * - * A service introduction point circuit has a purpose of either - * CIRCUIT_PURPOSE_S_ESTABLISH_INTRO or CIRCUIT_PURPOSE_S_INTRO. This does not - * return a circuit marked for close and its state must be open. */ + * If want_client_circ is false, then we are looking for service-side + * introduction circuits: A service introduction point circuit has a purpose of + * either CIRCUIT_PURPOSE_S_ESTABLISH_INTRO or CIRCUIT_PURPOSE_S_INTRO. This + * does not return circuits marked for close, or in any state other than open. + */ origin_circuit_t * -circuit_get_next_service_intro_circ(origin_circuit_t *start) +circuit_get_next_intro_circ(const origin_circuit_t *start, + bool want_client_circ) { int idx = 0; smartlist_t *lst = circuit_get_global_list(); @@ -1664,13 +1673,29 @@ circuit_get_next_service_intro_circ(origin_circuit_t *start) for ( ; idx < smartlist_len(lst); ++idx) { circuit_t *circ = smartlist_get(lst, idx); - /* Ignore a marked for close circuit or purpose not matching a service - * intro point or if the state is not open. */ - if (circ->marked_for_close || circ->state != CIRCUIT_STATE_OPEN || - (circ->purpose != CIRCUIT_PURPOSE_S_ESTABLISH_INTRO && - circ->purpose != CIRCUIT_PURPOSE_S_INTRO)) { + /* Ignore a marked for close circuit or if the state is not open. */ + if (circ->marked_for_close) { continue; } + + /* Depending on whether we are looking for client or service circs, skip + * circuits with other purposes. */ + if (want_client_circ) { + if (circ->purpose != CIRCUIT_PURPOSE_C_INTRODUCING && + circ->purpose != CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT && + circ->purpose != CIRCUIT_PURPOSE_C_INTRODUCE_ACKED) { + continue; + } + } else { /* we are looking for service-side circs */ + if (circ->state != CIRCUIT_STATE_OPEN) { + continue; + } + if (circ->purpose != CIRCUIT_PURPOSE_S_ESTABLISH_INTRO && + circ->purpose != CIRCUIT_PURPOSE_S_INTRO) { + continue; + } + } + /* The purposes we are looking for are only for origin circuits so the * following is valid. */ return TO_ORIGIN_CIRCUIT(circ); diff --git a/src/core/or/circuitlist.h b/src/core/or/circuitlist.h index dac11431c..cb89d1820 100644 --- a/src/core/or/circuitlist.h +++ b/src/core/or/circuitlist.h @@ -202,7 +202,8 @@ origin_circuit_t *circuit_get_ready_rend_circ_by_rend_data( const rend_data_t *rend_data); origin_circuit_t *circuit_get_next_by_pk_and_purpose(origin_circuit_t *start, const uint8_t *digest, uint8_t purpose); -origin_circuit_t *circuit_get_next_service_intro_circ(origin_circuit_t *start); +origin_circuit_t *circuit_get_next_intro_circ(const origin_circuit_t *start, + bool want_client_circ); origin_circuit_t *circuit_get_next_service_rp_circ(origin_circuit_t *start); origin_circuit_t *circuit_get_next_service_hsdir_circ(origin_circuit_t *start); origin_circuit_t *circuit_find_to_cannibalize(uint8_t purpose, diff --git a/src/feature/hs/hs_cache.c b/src/feature/hs/hs_cache.c index b9bcb446a..afd69e1be 100644 --- a/src/feature/hs/hs_cache.c +++ b/src/feature/hs/hs_cache.c @@ -647,6 +647,13 @@ cache_store_as_client(hs_cache_client_descriptor_t *client_desc) } /* Remove old entry. Make space for the new one! */ remove_v3_desc_as_client(cache_entry); + + /* We just removed an old descriptor and will replace it. We'll close all + * intro circuits related to this old one so we don't have leftovers. We + * leave the rendezvous circuits opened because they could be in use. */ + hs_client_close_intro_circuits_from_desc(cache_entry->desc); + + /* Free it. */ cache_client_desc_free(cache_entry); } diff --git a/src/feature/hs/hs_client.c b/src/feature/hs/hs_client.c index 11e24a366..dfad216ab 100644 --- a/src/feature/hs/hs_client.c +++ b/src/feature/hs/hs_client.c @@ -1844,6 +1844,38 @@ hs_client_reextend_intro_circuit(origin_circuit_t *circ) return ret; } +/* Close all client introduction circuits related to the given descriptor. + * This is called with a descriptor that is about to get replaced in the + * client cache. + * + * Even though the introduction point might be exactly the same, we'll rebuild + * them if needed but the odds are very low that an existing matching + * introduction circuit exists at that stage. */ +void +hs_client_close_intro_circuits_from_desc(const hs_descriptor_t *desc) +{ + origin_circuit_t *ocirc = NULL; + + tor_assert(desc); + + /* We iterate over all client intro circuits because they aren't kept in the + * HS circuitmap. That is probably something we want to do one day. */ + while ((ocirc = circuit_get_next_intro_circ(ocirc, true))) { + if (ocirc->hs_ident == NULL) { + /* Not a v3 circuit, ignore it. */ + continue; + } + + /* Does it match any IP in the given descriptor? If not, ignore. */ + if (find_desc_intro_point_by_ident(ocirc->hs_ident, desc) == NULL) { + continue; + } + + /* We have a match. Close the circuit as consider it expired. */ + circuit_mark_for_close(TO_CIRCUIT(ocirc), END_CIRC_REASON_FINISHED); + } +} + /* Release all the storage held by the client subsystem. */ void hs_client_free_all(void) diff --git a/src/feature/hs/hs_client.h b/src/feature/hs/hs_client.h index fb4f9e9e9..f6fb167ea 100644 --- a/src/feature/hs/hs_client.h +++ b/src/feature/hs/hs_client.h @@ -77,6 +77,7 @@ int hs_config_client_authorization(const or_options_t *options, int validate_only); int hs_client_reextend_intro_circuit(origin_circuit_t *circ); +void hs_client_close_intro_circuits_from_desc(const hs_descriptor_t *desc); void hs_client_purge_state(void); diff --git a/src/feature/rend/rendservice.c b/src/feature/rend/rendservice.c index bae9da3fe..d13558106 100644 --- a/src/feature/rend/rendservice.c +++ b/src/feature/rend/rendservice.c @@ -631,7 +631,7 @@ rend_service_prune_list_impl_(void) /* For every service introduction circuit we can find, see if we have a * matching surviving configured service. If not, close the circuit. */ - while ((ocirc = circuit_get_next_service_intro_circ(ocirc))) { + while ((ocirc = circuit_get_next_intro_circ(ocirc, false))) { int keep_it = 0; if (ocirc->rend_data == NULL) { /* This is a v3 circuit, ignore it. */

1 0

[tor/master] Merge remote-tracking branch 'dgoulet/ticket27471_035_02' into maint-0.3.5
by nickm＠torproject.org 16 Nov '18

16 Nov '18

commit 35558c39dd162902a0e007b6e9dbd66d979043fd Merge: c9906cc3f 8b2e72106 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 16 08:57:56 2018 -0500 Merge remote-tracking branch 'dgoulet/ticket27471_035_02' into maint-0.3.5 changes/ticket27471 | 5 ++ src/core/or/circuitlist.c | 49 +++++++++++++++----- src/core/or/circuitlist.h | 3 +- src/feature/hs/hs_cache.c | 7 +++ src/feature/hs/hs_client.c | 32 +++++++++++++ src/feature/hs/hs_client.h | 1 + src/feature/rend/rendservice.c | 2 +- src/test/test_hs_client.c | 103 +++++++++++++++++++++++++++++++++++++++++ 8 files changed, 188 insertions(+), 14 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.3.5'
by nickm＠torproject.org 16 Nov '18

16 Nov '18

commit 5065a685049f46a955299c69fb98448630ba75d5 Merge: 306098f85 35558c39d Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 16 08:58:25 2018 -0500 Merge branch 'maint-0.3.5'

1 0

[tor/maint-0.3.5] test: Add test for closing intro circuits when storing a new descriptor
by nickm＠torproject.org 16 Nov '18

16 Nov '18

commit 8b2e72106ae87c8018d9bae25f826c7bd92a88e8 Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Oct 12 10:30:33 2018 -0400 test: Add test for closing intro circuits when storing a new descriptor This is client side and related to 27471 for previous commit that fixes this issue. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/test/test_hs_client.c | 103 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 103 insertions(+) diff --git a/src/test/test_hs_client.c b/src/test/test_hs_client.c index 25cb991a7..91b3ed1ec 100644 --- a/src/test/test_hs_client.c +++ b/src/test/test_hs_client.c @@ -885,6 +885,107 @@ test_desc_has_arrived_cleanup(void *arg) UNMOCK(router_have_minimum_dir_info); } +static void +test_close_intro_circuits_new_desc(void *arg) +{ + int ret; + ed25519_keypair_t service_kp; + circuit_t *circ = NULL; + origin_circuit_t *ocirc = NULL; + hs_descriptor_t *desc1 = NULL, *desc2 = NULL; + + (void) arg; + + hs_init(); + + /* This is needed because of the client cache expiration timestamp is based + * on having a consensus. See cached_client_descriptor_has_expired(). */ + MOCK(networkstatus_get_live_consensus, + mock_networkstatus_get_live_consensus); + + /* Set consensus time */ + parse_rfc1123_time("Sat, 26 Oct 1985 13:00:00 UTC", + &mock_ns.valid_after); + parse_rfc1123_time("Sat, 26 Oct 1985 14:00:00 UTC", + &mock_ns.fresh_until); + parse_rfc1123_time("Sat, 26 Oct 1985 16:00:00 UTC", + &mock_ns.valid_until); + + /* Generate service keypair */ + tt_int_op(0, OP_EQ, ed25519_keypair_generate(&service_kp, 0)); + + /* Create and add to the global list a dummy client introduction circuits. + * We'll then make sure the hs_ident is attached to a dummy descriptor. */ + circ = dummy_origin_circuit_new(0); + tt_assert(circ); + circ->purpose = CIRCUIT_PURPOSE_C_INTRODUCING; + ocirc = TO_ORIGIN_CIRCUIT(circ); + + /* Build the first descriptor and cache it. */ + { + char *encoded; + desc1 = hs_helper_build_hs_desc_with_ip(&service_kp); + tt_assert(desc1); + ret = hs_desc_encode_descriptor(desc1, &service_kp, NULL, &encoded); + tt_int_op(ret, OP_EQ, 0); + tt_assert(encoded); + + /* Store it */ + ret = hs_cache_store_as_client(encoded, &service_kp.pubkey); + tt_int_op(ret, OP_EQ, 0); + tor_free(encoded); + tt_assert(hs_cache_lookup_as_client(&service_kp.pubkey)); + } + + /* We'll pick one introduction point and associate it with the circuit. */ + { + const hs_desc_intro_point_t *ip = + smartlist_get(desc1->encrypted_data.intro_points, 0); + tt_assert(ip); + ocirc->hs_ident = hs_ident_circuit_new(&service_kp.pubkey, + HS_IDENT_CIRCUIT_INTRO); + ed25519_pubkey_copy(&ocirc->hs_ident->intro_auth_pk, + &ip->auth_key_cert->signed_key); + } + + /* Before we are about to clean up the intro circuits, make sure it is + * actually there. */ + tt_assert(circuit_get_next_intro_circ(NULL, true)); + + /* Build the second descriptor for the same service and cache it. */ + { + char *encoded; + desc2 = hs_helper_build_hs_desc_with_ip(&service_kp); + tt_assert(desc2); + tt_mem_op(&desc1->plaintext_data.signing_pubkey, OP_EQ, + &desc2->plaintext_data.signing_pubkey, ED25519_PUBKEY_LEN); + /* To replace the existing descriptor, the revision counter needs to be + * bigger. */ + desc2->plaintext_data.revision_counter = + desc1->plaintext_data.revision_counter + 1; + + ret = hs_desc_encode_descriptor(desc2, &service_kp, NULL, &encoded); + tt_int_op(ret, OP_EQ, 0); + tt_assert(encoded); + + hs_cache_store_as_client(encoded, &service_kp.pubkey); + tt_int_op(ret, OP_EQ, 0); + tor_free(encoded); + tt_assert(hs_cache_lookup_as_client(&service_kp.pubkey)); + } + + /* Once stored, our intro circuit should be closed because it is related to + * an old introduction point that doesn't exists anymore. */ + tt_assert(!circuit_get_next_intro_circ(NULL, true)); + + done: + circuit_free(circ); + hs_descriptor_free(desc1); + hs_descriptor_free(desc2); + hs_free_all(); + UNMOCK(networkstatus_get_live_consensus); +} + struct testcase_t hs_client_tests[] = { { "e2e_rend_circuit_setup_legacy", test_e2e_rend_circuit_setup_legacy, TT_FORK, NULL, NULL }, @@ -902,6 +1003,8 @@ struct testcase_t hs_client_tests[] = { TT_FORK, NULL, NULL }, { "desc_has_arrived_cleanup", test_desc_has_arrived_cleanup, TT_FORK, NULL, NULL }, + { "close_intro_circuits_new_desc", test_close_intro_circuits_new_desc, + TT_FORK, NULL, NULL }, END_OF_TESTCASES };

1 0

[tor/maint-0.3.5] hs-v3: Close client intro circuits if the descriptor is replaced
by nickm＠torproject.org 16 Nov '18

16 Nov '18

commit 9ba16c4d03a39bcd369ccd59f6bfa351f4b527d5 Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Oct 12 09:22:30 2018 -0400 hs-v3: Close client intro circuits if the descriptor is replaced When storing a descriptor in the client cache, if we are about to replace an existing descriptor, make sure to close every introduction circuits of the old descriptor so we don't have leftovers lying around. Ticket 27471 describes a situation where tor is sending an INTRODUCE1 cell on an introduction circuit for which it doesn't have a matching intro point object (taken from the descriptor). The main theory is that, after a new descriptor showed up, the introduction points changed which led to selecting an introduction circuit not used by the service anymore thus for which we are unable to find the corresponding introduction point within the descriptor we just fetched. Closes #27471. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket27471 | 5 +++++ src/core/or/circuitlist.c | 49 +++++++++++++++++++++++++++++++----------- src/core/or/circuitlist.h | 3 ++- src/feature/hs/hs_cache.c | 7 ++++++ src/feature/hs/hs_client.c | 32 +++++++++++++++++++++++++++ src/feature/hs/hs_client.h | 1 + src/feature/rend/rendservice.c | 2 +- 7 files changed, 85 insertions(+), 14 deletions(-) diff --git a/changes/ticket27471 b/changes/ticket27471 new file mode 100644 index 000000000..ffe77d268 --- /dev/null +++ b/changes/ticket27471 @@ -0,0 +1,5 @@ + o Minor bugfixes (hidden service v3, client): + - When replacing a descriptor in the client cache with a newer descriptor, + make sure to close all client introduction circuits of the old + descriptor so we don't end up with unusable leftover circuits. Fixes bug + 27471; bugfix on 0.3.2.1-alpha. diff --git a/src/core/or/circuitlist.c b/src/core/or/circuitlist.c index 5ff142c15..35efc6541 100644 --- a/src/core/or/circuitlist.c +++ b/src/core/or/circuitlist.c @@ -1644,15 +1644,24 @@ circuit_get_ready_rend_circ_by_rend_data(const rend_data_t *rend_data) return NULL; } -/** Return the first service introduction circuit originating from the global - * circuit list after start or at the start of the list if start - * is NULL. Return NULL if no circuit is found. +/** Return the first introduction circuit originating from the global circuit + * list after start or at the start of the list if start is + * NULL. Return NULL if no circuit is found. + * + * If want_client_circ is true, then we are looking for client-side + * introduction circuits: A client introduction point circuit has a purpose of + * either CIRCUIT_PURPOSE_C_INTRODUCING, CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT + * or CIRCUIT_PURPOSE_C_INTRODUCE_ACKED. This does not return a circuit marked + * for close, but it returns circuits regardless of their circuit state. * - * A service introduction point circuit has a purpose of either - * CIRCUIT_PURPOSE_S_ESTABLISH_INTRO or CIRCUIT_PURPOSE_S_INTRO. This does not - * return a circuit marked for close and its state must be open. */ + * If want_client_circ is false, then we are looking for service-side + * introduction circuits: A service introduction point circuit has a purpose of + * either CIRCUIT_PURPOSE_S_ESTABLISH_INTRO or CIRCUIT_PURPOSE_S_INTRO. This + * does not return circuits marked for close, or in any state other than open. + */ origin_circuit_t * -circuit_get_next_service_intro_circ(origin_circuit_t *start) +circuit_get_next_intro_circ(const origin_circuit_t *start, + bool want_client_circ) { int idx = 0; smartlist_t *lst = circuit_get_global_list(); @@ -1664,13 +1673,29 @@ circuit_get_next_service_intro_circ(origin_circuit_t *start) for ( ; idx < smartlist_len(lst); ++idx) { circuit_t *circ = smartlist_get(lst, idx); - /* Ignore a marked for close circuit or purpose not matching a service - * intro point or if the state is not open. */ - if (circ->marked_for_close || circ->state != CIRCUIT_STATE_OPEN || - (circ->purpose != CIRCUIT_PURPOSE_S_ESTABLISH_INTRO && - circ->purpose != CIRCUIT_PURPOSE_S_INTRO)) { + /* Ignore a marked for close circuit or if the state is not open. */ + if (circ->marked_for_close) { continue; } + + /* Depending on whether we are looking for client or service circs, skip + * circuits with other purposes. */ + if (want_client_circ) { + if (circ->purpose != CIRCUIT_PURPOSE_C_INTRODUCING && + circ->purpose != CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT && + circ->purpose != CIRCUIT_PURPOSE_C_INTRODUCE_ACKED) { + continue; + } + } else { /* we are looking for service-side circs */ + if (circ->state != CIRCUIT_STATE_OPEN) { + continue; + } + if (circ->purpose != CIRCUIT_PURPOSE_S_ESTABLISH_INTRO && + circ->purpose != CIRCUIT_PURPOSE_S_INTRO) { + continue; + } + } + /* The purposes we are looking for are only for origin circuits so the * following is valid. */ return TO_ORIGIN_CIRCUIT(circ); diff --git a/src/core/or/circuitlist.h b/src/core/or/circuitlist.h index dac11431c..cb89d1820 100644 --- a/src/core/or/circuitlist.h +++ b/src/core/or/circuitlist.h @@ -202,7 +202,8 @@ origin_circuit_t *circuit_get_ready_rend_circ_by_rend_data( const rend_data_t *rend_data); origin_circuit_t *circuit_get_next_by_pk_and_purpose(origin_circuit_t *start, const uint8_t *digest, uint8_t purpose); -origin_circuit_t *circuit_get_next_service_intro_circ(origin_circuit_t *start); +origin_circuit_t *circuit_get_next_intro_circ(const origin_circuit_t *start, + bool want_client_circ); origin_circuit_t *circuit_get_next_service_rp_circ(origin_circuit_t *start); origin_circuit_t *circuit_get_next_service_hsdir_circ(origin_circuit_t *start); origin_circuit_t *circuit_find_to_cannibalize(uint8_t purpose, diff --git a/src/feature/hs/hs_cache.c b/src/feature/hs/hs_cache.c index b9bcb446a..afd69e1be 100644 --- a/src/feature/hs/hs_cache.c +++ b/src/feature/hs/hs_cache.c @@ -647,6 +647,13 @@ cache_store_as_client(hs_cache_client_descriptor_t *client_desc) } /* Remove old entry. Make space for the new one! */ remove_v3_desc_as_client(cache_entry); + + /* We just removed an old descriptor and will replace it. We'll close all + * intro circuits related to this old one so we don't have leftovers. We + * leave the rendezvous circuits opened because they could be in use. */ + hs_client_close_intro_circuits_from_desc(cache_entry->desc); + + /* Free it. */ cache_client_desc_free(cache_entry); } diff --git a/src/feature/hs/hs_client.c b/src/feature/hs/hs_client.c index 11e24a366..dfad216ab 100644 --- a/src/feature/hs/hs_client.c +++ b/src/feature/hs/hs_client.c @@ -1844,6 +1844,38 @@ hs_client_reextend_intro_circuit(origin_circuit_t *circ) return ret; } +/* Close all client introduction circuits related to the given descriptor. + * This is called with a descriptor that is about to get replaced in the + * client cache. + * + * Even though the introduction point might be exactly the same, we'll rebuild + * them if needed but the odds are very low that an existing matching + * introduction circuit exists at that stage. */ +void +hs_client_close_intro_circuits_from_desc(const hs_descriptor_t *desc) +{ + origin_circuit_t *ocirc = NULL; + + tor_assert(desc); + + /* We iterate over all client intro circuits because they aren't kept in the + * HS circuitmap. That is probably something we want to do one day. */ + while ((ocirc = circuit_get_next_intro_circ(ocirc, true))) { + if (ocirc->hs_ident == NULL) { + /* Not a v3 circuit, ignore it. */ + continue; + } + + /* Does it match any IP in the given descriptor? If not, ignore. */ + if (find_desc_intro_point_by_ident(ocirc->hs_ident, desc) == NULL) { + continue; + } + + /* We have a match. Close the circuit as consider it expired. */ + circuit_mark_for_close(TO_CIRCUIT(ocirc), END_CIRC_REASON_FINISHED); + } +} + /* Release all the storage held by the client subsystem. */ void hs_client_free_all(void) diff --git a/src/feature/hs/hs_client.h b/src/feature/hs/hs_client.h index fb4f9e9e9..f6fb167ea 100644 --- a/src/feature/hs/hs_client.h +++ b/src/feature/hs/hs_client.h @@ -77,6 +77,7 @@ int hs_config_client_authorization(const or_options_t *options, int validate_only); int hs_client_reextend_intro_circuit(origin_circuit_t *circ); +void hs_client_close_intro_circuits_from_desc(const hs_descriptor_t *desc); void hs_client_purge_state(void); diff --git a/src/feature/rend/rendservice.c b/src/feature/rend/rendservice.c index bae9da3fe..d13558106 100644 --- a/src/feature/rend/rendservice.c +++ b/src/feature/rend/rendservice.c @@ -631,7 +631,7 @@ rend_service_prune_list_impl_(void) /* For every service introduction circuit we can find, see if we have a * matching surviving configured service. If not, close the circuit. */ - while ((ocirc = circuit_get_next_service_intro_circ(ocirc))) { + while ((ocirc = circuit_get_next_intro_circ(ocirc, false))) { int keep_it = 0; if (ocirc->rend_data == NULL) { /* This is a v3 circuit, ignore it. */

1 0