May 2018 - tor-commits - lists.torproject.org

[tor/master] Bug 25870: Allow the last hop in a vanguard circuit to be our guard.
by nickm＠torproject.org 08 May '18

08 May '18

commit d634c1ba6b3b5b4773ee2bc7095a004818431541 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Apr 20 18:58:15 2018 +0000 Bug 25870: Allow the last hop in a vanguard circuit to be our guard. The last hop in vanguard circuits can be an RP/IP/HSDir. Since vanguard circuits are at least 3 hops (sometimes 4) before this node, this change will not cause A - B - A paths. --- src/or/circuitbuild.c | 2 +- src/or/entrynodes.c | 11 +++++++++-- src/or/entrynodes.h | 1 + 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 54446bb01..75540e5d3 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2628,7 +2628,7 @@ choose_good_entry_server(uint8_t purpose, cpath_build_state_t *state, /* This request is for an entry server to use for a regular circuit, * and we use entry guard nodes. Just return one of the guard nodes. */ tor_assert(guard_state_out); - return guards_choose_guard(state, guard_state_out); + return guards_choose_guard(state, purpose, guard_state_out); } excluded = smartlist_new(); diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 88d1b94de..34868846f 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -118,6 +118,7 @@ #include "circpathbias.h" #include "circuitbuild.h" #include "circuitlist.h" +#include "circuituse.h" #include "circuitstats.h" #include "config.h" #include "confparse.h" @@ -3473,12 +3474,18 @@ guards_update_all(void) used. */ const node_t * guards_choose_guard(cpath_build_state_t *state, - circuit_guard_state_t **guard_state_out) + uint8_t purpose, + circuit_guard_state_t **guard_state_out) { const node_t *r = NULL; const uint8_t *exit_id = NULL; entry_guard_restriction_t *rst = NULL; - if (state && (exit_id = build_state_get_exit_rsa_id(state))) { + + /* Only apply restrictions if we have a specific exit node in mind, and only + * if we are not doing vanguard circuits: we don't want to apply guard + * restrictions to vanguard circuits. */ + if (state && !circuit_should_use_vanguards(purpose) && + (exit_id = build_state_get_exit_rsa_id(state))) { /* We're building to a targeted exit node, so that node can't be * chosen as our guard for this circuit. Remember that fact in a * restriction. */ diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index d56249831..e8c91da41 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -322,6 +322,7 @@ struct circuit_guard_state_t { /* Common entry points for old and new guard code */ int guards_update_all(void); const node_t *guards_choose_guard(cpath_build_state_t *state, + uint8_t purpose, circuit_guard_state_t **guard_state_out); const node_t *guards_choose_dirguard(uint8_t dir_purpose, circuit_guard_state_t **guard_state_out);

1 0

[tor/master] Bug 25870: Allow 4th hop of vanguard circuits to be the guard.
by nickm＠torproject.org 08 May '18

08 May '18

commit 289c04b065b7b36734d73fc11a516b3cdc9dd702 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue May 1 00:59:21 2018 +0000 Bug 25870: Allow 4th hop of vanguard circuits to be the guard. This prevents a malicious RP/IP from learning the guard node in the case that we are using only one (because we aren't using two guards, or because one of those two guards is temporarily down). This ensures the "strong" version of Property #6 from https://lists.torproject.org/pipermail/tor-dev/2018-April/013098.html (Information about the guard(s) does not leak to the website/RP at all). --- src/or/circuitbuild.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 4bdc8a3ee..68ff964f6 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2447,8 +2447,10 @@ cpath_get_n_hops(crypt_path_t **head_ptr) /** * Build the exclude list for vanguard circuits. * - * For vanguard circuits we exclude all the already chosen nodes (including - * the exit) from being middle hops. + * For vanguard circuits we exclude all the already chosen nodes (including the + * exit) from being middle hops to prevent the creation of A - B - A subpaths. + * We also allow the 4th hop to be the same as the guard node so as to not leak + * guard information to RP/IP/HSDirs. * * For vanguard circuits, we don't apply any subnet or family restrictions. * This is to avoid impossible-to-build circuit paths, or just situations where @@ -2483,6 +2485,19 @@ build_vanguard_middle_exclude_list(uint8_t purpose, smartlist_add(excluded, (node_t*)r); } + /* If we are picking the 4th hop, allow that node to be the guard too. + * This prevents us from avoiding the Guard for those hops, which + * gives the adversary information about our guard if they control + * the RP, IP, or HSDIR. We don't do this check based on purpose + * because we also want to allow HS_VANGUARDS pre-build circuits + * to use the guard for that last hop. + */ + if (cur_len == DEFAULT_ROUTE_LEN+1) { + /* Skip the first hop for the exclude list below */ + head = head->next; + cur_len--; + } + for (i = 0, cpath = head; cpath && i < cur_len; ++i, cpath=cpath->next) { if ((r = node_get_by_id(cpath->extend_info->identity_digest))) { smartlist_add(excluded, (node_t*)r);

1 0

[tor/master] Bug 25870: Prevent the creation of A - B - A vanguard sub-paths.
by nickm＠torproject.org 08 May '18

08 May '18

commit e34bf50604903fa54458a2e57271604440c5ad3e Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue May 1 00:59:10 2018 +0000 Bug 25870: Prevent the creation of A - B - A vanguard sub-paths. These paths are illegal in Tor and relays will reject them. We do this by using specific nodes in the exclude list (but ignore /16 and family). --- src/or/circuitbuild.c | 81 ++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 57 insertions(+), 24 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 75540e5d3..4bdc8a3ee 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2445,12 +2445,56 @@ cpath_get_n_hops(crypt_path_t **head_ptr) #endif /* defined(TOR_UNIT_TESTS) */ /** + * Build the exclude list for vanguard circuits. + * + * For vanguard circuits we exclude all the already chosen nodes (including + * the exit) from being middle hops. + * + * For vanguard circuits, we don't apply any subnet or family restrictions. + * This is to avoid impossible-to-build circuit paths, or just situations where + * our earlier guards prevent us from using most of our later ones. + * + * The alternative is building the circuit in reverse. Reverse calls to + * onion_extend_cpath() (ie: select outer hops first) would then have the + * property that you don't gain information about inner hops by observing + * outer ones. See https://trac.torproject.org/projects/tor/ticket/24487 + * for this. + * + * (Note further that we still exclude the exit to prevent A - B - A + * at the end of the path. */ +static smartlist_t * +build_vanguard_middle_exclude_list(uint8_t purpose, + cpath_build_state_t *state, + crypt_path_t *head, + int cur_len) +{ + smartlist_t *excluded; + const node_t *r; + crypt_path_t *cpath; + int i; + + (void) purpose; + + excluded = smartlist_new(); + + /* Add the exit to the exclude list (note that the exit/last hop is always + * chosen first in circuit_establish_circuit()). */ + if ((r = build_state_get_exit_node(state))) { + smartlist_add(excluded, (node_t*)r); + } + + for (i = 0, cpath = head; cpath && i < cur_len; ++i, cpath=cpath->next) { + if ((r = node_get_by_id(cpath->extend_info->identity_digest))) { + smartlist_add(excluded, (node_t*)r); + } + } + + return excluded; +} + +/** * Build a list of nodes to exclude from the choice of this middle * hop, based on already chosen nodes. - * - * XXX: At present, this function does not exclude any nodes from - * the vanguard circuits. See - * https://trac.torproject.org/projects/tor/ticket/24487 */ static smartlist_t * build_middle_exclude_list(uint8_t purpose, @@ -2463,32 +2507,21 @@ build_middle_exclude_list(uint8_t purpose, crypt_path_t *cpath; int i; + /** Vanguard circuits have their own path selection rules */ + if (circuit_should_use_vanguards(purpose)) { + return build_vanguard_middle_exclude_list(purpose, state, head, cur_len); + } + excluded = smartlist_new(); - /* Add the exit to the exclude list (note that the exit/last hop is always - * chosen first in circuit_establish_circuit()). */ + /* For non-vanguard circuits, add the exit and its family to the exclude list + * (note that the exit/last hop is always chosen first in + * circuit_establish_circuit()). */ if ((r = build_state_get_exit_node(state))) { nodelist_add_node_and_family(excluded, r); } - /* XXX: We don't apply any other previously selected node restrictions for - * vanguards, and allow nodes to be reused for those hop positions in the - * same circuit. This is because after many rotations, you get to learn - * inner guard nodes through the nodes that are not selected for outer - * hops. - * - * The alternative is building the circuit in reverse. Reverse calls to - * onion_extend_cpath() (ie: select outer hops first) would then have the - * property that you don't gain information about inner hops by observing - * outer ones. See https://trac.torproject.org/projects/tor/ticket/24487 - * for this. - * - * (Note further that we can and do still exclude the exit in the block - * above, because it is chosen first in circuit_establish_circuit()..) */ - if (circuit_should_use_vanguards(purpose)) { - return excluded; - } - + /* also exclude all other already chosen nodes and their family */ for (i = 0, cpath = head; cpath && i < cur_len; ++i, cpath=cpath->next) { if ((r = node_get_by_id(cpath->extend_info->identity_digest))) { nodelist_add_node_and_family(excluded, r);

1 0

[tor/master] Fix the selection of events to cancel in test_workqueue.c
by nickm＠torproject.org 08 May '18

08 May '18

commit 6e3e96d2ff0c1b83bdd3f2059d1b4a2b96a53341 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun May 6 21:03:26 2018 -0400 Fix the selection of events to cancel in test_workqueue.c Our previous algorithm had a nonzero probability of picking no events to cancel, which is of course incorrect. The new code uses Vitter's good old reservoir sampling "algorithm R" from 1985. Fixes bug 26008; bugfix on 0.2.6.3-alpha. --- changes/ticket26008 | 7 +++++++ src/test/test_workqueue.c | 12 +++++++++--- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/changes/ticket26008 b/changes/ticket26008 new file mode 100644 index 000000000..7550c959e --- /dev/null +++ b/changes/ticket26008 @@ -0,0 +1,7 @@ + o Minor bugfixes (test): + - When testing workqueue event-cancellation, make sure that we actually + cancel an event, and that cancel each event with equal probability. + (It was previously possible, though extremely unlikely, for our + event-canceling test not to cancel any events.) Fixes bug 26008; + bugfix on 0.2.6.3-alpha. + diff --git a/src/test/test_workqueue.c b/src/test/test_workqueue.c index 8d29d2062..cc7073850 100644 --- a/src/test/test_workqueue.c +++ b/src/test/test_workqueue.c @@ -224,7 +224,8 @@ add_n_work_items(threadpool_t *tp, int n) workqueue_entry_t **to_cancel; workqueue_entry_t *ent; - to_cancel = tor_malloc(sizeof(workqueue_entry_t*) * opt_n_cancel); + // We'll choose randomly which entries to cancel. + to_cancel = tor_calloc(opt_n_cancel, sizeof(workqueue_entry_t*)); while (n_queued++ < n) { ent = add_work(tp); @@ -233,9 +234,14 @@ add_n_work_items(threadpool_t *tp, int n) tor_libevent_exit_loop_after_delay(tor_libevent_get_base(), NULL); return -1; } - if (n_try_cancel < opt_n_cancel && - tor_weak_random_range(&weak_rng, n) < opt_n_cancel) { + + if (n_try_cancel < opt_n_cancel) { to_cancel[n_try_cancel++] = ent; + } else { + int p = tor_weak_random_range(&weak_rng, n_queued); + if (p < n_try_cancel) { + to_cancel[p] = ent; + } } }

1 0

[tor/master] Merge branch 'ticket26008'
by nickm＠torproject.org 08 May '18

08 May '18

commit 2a4439adf37ed75c8f7d2db3134d0263f70de796 Merge: bf5eaa82d 6e3e96d2f Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 8 14:09:38 2018 -0400 Merge branch 'ticket26008' changes/ticket26008 | 7 +++++++ src/test/test_workqueue.c | 12 +++++++++--- 2 files changed, 16 insertions(+), 3 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.3.3'
by arma＠torproject.org 08 May '18

08 May '18

commit bf5eaa82da4214be681cf0674f24376b7c4c0e34 Merge: c3ae14549 b979415e8 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue May 8 13:49:56 2018 -0400 Merge branch 'maint-0.3.3' changes/bug26052 | 6 ++++++ doc/tor.1.txt | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-)

1 0

[tor/master] manpage fix to stop saying CacheIPv4DNS is on by default
by arma＠torproject.org 08 May '18

08 May '18

commit b979415e8bf4c33e6d540c780edeeb40bce5e512 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue May 8 13:13:45 2018 -0400 manpage fix to stop saying CacheIPv4DNS is on by default Stop saying in the manual that clients cache ipv4 dns answers from exit relays. We haven't used them since 0.2.6.3-alpha, and in ticket 24050 we stopped even caching them as of 0.3.2.6-alpha, but we forgot to say so in the man page. Fixes bug 26052; bugfix on 0.3.2.6-alpha. --- changes/bug26052 | 6 ++++++ doc/tor.1.txt | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/changes/bug26052 b/changes/bug26052 new file mode 100644 index 000000000..4721933fa --- /dev/null +++ b/changes/bug26052 @@ -0,0 +1,6 @@ + o Minor bugfixes (documentation): + - Stop saying in the manual that clients cache ipv4 dns answers + from exit relays. We haven't used them since 0.2.6.3-alpha, and + in ticket 24050 we stopped even caching them as of 0.3.2.6-alpha, + but we forgot to say so in the man page. Fixes bug 26052; bugfix + on 0.3.2.6-alpha. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 53a8c8fe5..f89406180 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1237,7 +1237,7 @@ The following options are useful only for clients (that is, if flag is not supported. **CacheIPv4DNS**;; Tells the client to remember IPv4 DNS answers we receive from exit - nodes via this connection. (On by default.) + nodes via this connection. **CacheIPv6DNS**;; Tells the client to remember IPv6 DNS answers we receive from exit nodes via this connection.

1 0

[tor/release-0.3.3] manpage fix to stop saying CacheIPv4DNS is on by default
by arma＠torproject.org 08 May '18

08 May '18

commit b979415e8bf4c33e6d540c780edeeb40bce5e512 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue May 8 13:13:45 2018 -0400 manpage fix to stop saying CacheIPv4DNS is on by default Stop saying in the manual that clients cache ipv4 dns answers from exit relays. We haven't used them since 0.2.6.3-alpha, and in ticket 24050 we stopped even caching them as of 0.3.2.6-alpha, but we forgot to say so in the man page. Fixes bug 26052; bugfix on 0.3.2.6-alpha. --- changes/bug26052 | 6 ++++++ doc/tor.1.txt | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/changes/bug26052 b/changes/bug26052 new file mode 100644 index 000000000..4721933fa --- /dev/null +++ b/changes/bug26052 @@ -0,0 +1,6 @@ + o Minor bugfixes (documentation): + - Stop saying in the manual that clients cache ipv4 dns answers + from exit relays. We haven't used them since 0.2.6.3-alpha, and + in ticket 24050 we stopped even caching them as of 0.3.2.6-alpha, + but we forgot to say so in the man page. Fixes bug 26052; bugfix + on 0.3.2.6-alpha. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 53a8c8fe5..f89406180 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1237,7 +1237,7 @@ The following options are useful only for clients (that is, if flag is not supported. **CacheIPv4DNS**;; Tells the client to remember IPv4 DNS answers we receive from exit - nodes via this connection. (On by default.) + nodes via this connection. **CacheIPv6DNS**;; Tells the client to remember IPv6 DNS answers we receive from exit nodes via this connection.

1 0

[tor/release-0.3.3] Merge branch 'maint-0.3.3' into release-0.3.3
by arma＠torproject.org 08 May '18

08 May '18

commit 6db0c006b2d4d1244f9e4fa486ff7ad66a7ccb47 Merge: 0e4f7b56a b979415e8 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue May 8 13:49:34 2018 -0400 Merge branch 'maint-0.3.3' into release-0.3.3 changes/bug26052 | 6 ++++++ doc/tor.1.txt | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.3.3] manpage fix to stop saying CacheIPv4DNS is on by default
by arma＠torproject.org 08 May '18

08 May '18

commit b979415e8bf4c33e6d540c780edeeb40bce5e512 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue May 8 13:13:45 2018 -0400 manpage fix to stop saying CacheIPv4DNS is on by default Stop saying in the manual that clients cache ipv4 dns answers from exit relays. We haven't used them since 0.2.6.3-alpha, and in ticket 24050 we stopped even caching them as of 0.3.2.6-alpha, but we forgot to say so in the man page. Fixes bug 26052; bugfix on 0.3.2.6-alpha. --- changes/bug26052 | 6 ++++++ doc/tor.1.txt | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/changes/bug26052 b/changes/bug26052 new file mode 100644 index 000000000..4721933fa --- /dev/null +++ b/changes/bug26052 @@ -0,0 +1,6 @@ + o Minor bugfixes (documentation): + - Stop saying in the manual that clients cache ipv4 dns answers + from exit relays. We haven't used them since 0.2.6.3-alpha, and + in ticket 24050 we stopped even caching them as of 0.3.2.6-alpha, + but we forgot to say so in the man page. Fixes bug 26052; bugfix + on 0.3.2.6-alpha. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 53a8c8fe5..f89406180 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1237,7 +1237,7 @@ The following options are useful only for clients (that is, if flag is not supported. **CacheIPv4DNS**;; Tells the client to remember IPv4 DNS answers we receive from exit - nodes via this connection. (On by default.) + nodes via this connection. **CacheIPv6DNS**;; Tells the client to remember IPv6 DNS answers we receive from exit nodes via this connection.

1 0