tor-commits May 2018

tor-commits@lists.torproject.org

17 participants
1514 discussions

[tor/master] Bug 25870: Allow 4th hop of vanguard circuits to be the guard.
by nickm＠torproject.org 08 May '18

08 May '18

commit 289c04b065b7b36734d73fc11a516b3cdc9dd702 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue May 1 00:59:21 2018 +0000 Bug 25870: Allow 4th hop of vanguard circuits to be the guard. This prevents a malicious RP/IP from learning the guard node in the case that we are using only one (because we aren't using two guards, or because one of those two guards is temporarily down). This ensures the "strong" version of Property #6 from https://lists.torproject.org/pipermail/tor-dev/2018-April/013098.html (Information about the guard(s) does not leak to the website/RP at all). --- src/or/circuitbuild.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 4bdc8a3ee..68ff964f6 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2447,8 +2447,10 @@ cpath_get_n_hops(crypt_path_t **head_ptr) /** * Build the exclude list for vanguard circuits. * - * For vanguard circuits we exclude all the already chosen nodes (including - * the exit) from being middle hops. + * For vanguard circuits we exclude all the already chosen nodes (including the + * exit) from being middle hops to prevent the creation of A - B - A subpaths. + * We also allow the 4th hop to be the same as the guard node so as to not leak + * guard information to RP/IP/HSDirs. * * For vanguard circuits, we don't apply any subnet or family restrictions. * This is to avoid impossible-to-build circuit paths, or just situations where @@ -2483,6 +2485,19 @@ build_vanguard_middle_exclude_list(uint8_t purpose, smartlist_add(excluded, (node_t*)r); } + /* If we are picking the 4th hop, allow that node to be the guard too. + * This prevents us from avoiding the Guard for those hops, which + * gives the adversary information about our guard if they control + * the RP, IP, or HSDIR. We don't do this check based on purpose + * because we also want to allow HS_VANGUARDS pre-build circuits + * to use the guard for that last hop. + */ + if (cur_len == DEFAULT_ROUTE_LEN+1) { + /* Skip the first hop for the exclude list below */ + head = head->next; + cur_len--; + } + for (i = 0, cpath = head; cpath && i < cur_len; ++i, cpath=cpath->next) { if ((r = node_get_by_id(cpath->extend_info->identity_digest))) { smartlist_add(excluded, (node_t*)r);

1 0

[tor/master] Bug 25870: Allow the last hop in a vanguard circuit to be our guard.
by nickm＠torproject.org 08 May '18

08 May '18

commit d634c1ba6b3b5b4773ee2bc7095a004818431541 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Apr 20 18:58:15 2018 +0000 Bug 25870: Allow the last hop in a vanguard circuit to be our guard. The last hop in vanguard circuits can be an RP/IP/HSDir. Since vanguard circuits are at least 3 hops (sometimes 4) before this node, this change will not cause A - B - A paths. --- src/or/circuitbuild.c | 2 +- src/or/entrynodes.c | 11 +++++++++-- src/or/entrynodes.h | 1 + 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 54446bb01..75540e5d3 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2628,7 +2628,7 @@ choose_good_entry_server(uint8_t purpose, cpath_build_state_t *state, /* This request is for an entry server to use for a regular circuit, * and we use entry guard nodes. Just return one of the guard nodes. */ tor_assert(guard_state_out); - return guards_choose_guard(state, guard_state_out); + return guards_choose_guard(state, purpose, guard_state_out); } excluded = smartlist_new(); diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 88d1b94de..34868846f 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -118,6 +118,7 @@ #include "circpathbias.h" #include "circuitbuild.h" #include "circuitlist.h" +#include "circuituse.h" #include "circuitstats.h" #include "config.h" #include "confparse.h" @@ -3473,12 +3474,18 @@ guards_update_all(void) used. */ const node_t * guards_choose_guard(cpath_build_state_t *state, - circuit_guard_state_t **guard_state_out) + uint8_t purpose, + circuit_guard_state_t **guard_state_out) { const node_t *r = NULL; const uint8_t *exit_id = NULL; entry_guard_restriction_t *rst = NULL; - if (state && (exit_id = build_state_get_exit_rsa_id(state))) { + + /* Only apply restrictions if we have a specific exit node in mind, and only + * if we are not doing vanguard circuits: we don't want to apply guard + * restrictions to vanguard circuits. */ + if (state && !circuit_should_use_vanguards(purpose) && + (exit_id = build_state_get_exit_rsa_id(state))) { /* We're building to a targeted exit node, so that node can't be * chosen as our guard for this circuit. Remember that fact in a * restriction. */ diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index d56249831..e8c91da41 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -322,6 +322,7 @@ struct circuit_guard_state_t { /* Common entry points for old and new guard code */ int guards_update_all(void); const node_t *guards_choose_guard(cpath_build_state_t *state, + uint8_t purpose, circuit_guard_state_t **guard_state_out); const node_t *guards_choose_dirguard(uint8_t dir_purpose, circuit_guard_state_t **guard_state_out);

1 0

[tor/master] Changes file for bug25870.
by nickm＠torproject.org 08 May '18

08 May '18

commit 98dea0bc638e6338b7a1c5d84fcc4b4e7455ded2 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Fri Apr 20 19:38:48 2018 +0000 Changes file for bug25870. --- changes/bug25870 | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/changes/bug25870 b/changes/bug25870 new file mode 100644 index 000000000..aea5a1e30 --- /dev/null +++ b/changes/bug25870 @@ -0,0 +1,6 @@ + o Minor bugfixes (vanguards): + - Allow the last hop in a vanguard circuit to be the same as our first, + to prevent the adversary from influencing guard node choice by choice + of last hop. Also prevent the creation of A - B - A paths, or A - A + paths, which are forbidden by relays. Fixes bug 25870; bugfix on + 0.3.3.1-alpha.

1 0

[tor/master] Merge branch 'ticket26008'
by nickm＠torproject.org 08 May '18

08 May '18

commit 2a4439adf37ed75c8f7d2db3134d0263f70de796 Merge: bf5eaa82d 6e3e96d2f Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 8 14:09:38 2018 -0400 Merge branch 'ticket26008' changes/ticket26008 | 7 +++++++ src/test/test_workqueue.c | 12 +++++++++--- 2 files changed, 16 insertions(+), 3 deletions(-)

1 0

[tor/master] Fix the selection of events to cancel in test_workqueue.c
by nickm＠torproject.org 08 May '18

08 May '18

commit 6e3e96d2ff0c1b83bdd3f2059d1b4a2b96a53341 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun May 6 21:03:26 2018 -0400 Fix the selection of events to cancel in test_workqueue.c Our previous algorithm had a nonzero probability of picking no events to cancel, which is of course incorrect. The new code uses Vitter's good old reservoir sampling "algorithm R" from 1985. Fixes bug 26008; bugfix on 0.2.6.3-alpha. --- changes/ticket26008 | 7 +++++++ src/test/test_workqueue.c | 12 +++++++++--- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/changes/ticket26008 b/changes/ticket26008 new file mode 100644 index 000000000..7550c959e --- /dev/null +++ b/changes/ticket26008 @@ -0,0 +1,7 @@ + o Minor bugfixes (test): + - When testing workqueue event-cancellation, make sure that we actually + cancel an event, and that cancel each event with equal probability. + (It was previously possible, though extremely unlikely, for our + event-canceling test not to cancel any events.) Fixes bug 26008; + bugfix on 0.2.6.3-alpha. + diff --git a/src/test/test_workqueue.c b/src/test/test_workqueue.c index 8d29d2062..cc7073850 100644 --- a/src/test/test_workqueue.c +++ b/src/test/test_workqueue.c @@ -224,7 +224,8 @@ add_n_work_items(threadpool_t *tp, int n) workqueue_entry_t **to_cancel; workqueue_entry_t *ent; - to_cancel = tor_malloc(sizeof(workqueue_entry_t*) * opt_n_cancel); + // We'll choose randomly which entries to cancel. + to_cancel = tor_calloc(opt_n_cancel, sizeof(workqueue_entry_t*)); while (n_queued++ < n) { ent = add_work(tp); @@ -233,9 +234,14 @@ add_n_work_items(threadpool_t *tp, int n) tor_libevent_exit_loop_after_delay(tor_libevent_get_base(), NULL); return -1; } - if (n_try_cancel < opt_n_cancel && - tor_weak_random_range(&weak_rng, n) < opt_n_cancel) { + + if (n_try_cancel < opt_n_cancel) { to_cancel[n_try_cancel++] = ent; + } else { + int p = tor_weak_random_range(&weak_rng, n_queued); + if (p < n_try_cancel) { + to_cancel[p] = ent; + } } }

1 0

[tor/master] manpage fix to stop saying CacheIPv4DNS is on by default
by arma＠torproject.org 08 May '18

08 May '18

commit b979415e8bf4c33e6d540c780edeeb40bce5e512 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue May 8 13:13:45 2018 -0400 manpage fix to stop saying CacheIPv4DNS is on by default Stop saying in the manual that clients cache ipv4 dns answers from exit relays. We haven't used them since 0.2.6.3-alpha, and in ticket 24050 we stopped even caching them as of 0.3.2.6-alpha, but we forgot to say so in the man page. Fixes bug 26052; bugfix on 0.3.2.6-alpha. --- changes/bug26052 | 6 ++++++ doc/tor.1.txt | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/changes/bug26052 b/changes/bug26052 new file mode 100644 index 000000000..4721933fa --- /dev/null +++ b/changes/bug26052 @@ -0,0 +1,6 @@ + o Minor bugfixes (documentation): + - Stop saying in the manual that clients cache ipv4 dns answers + from exit relays. We haven't used them since 0.2.6.3-alpha, and + in ticket 24050 we stopped even caching them as of 0.3.2.6-alpha, + but we forgot to say so in the man page. Fixes bug 26052; bugfix + on 0.3.2.6-alpha. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 53a8c8fe5..f89406180 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1237,7 +1237,7 @@ The following options are useful only for clients (that is, if flag is not supported. **CacheIPv4DNS**;; Tells the client to remember IPv4 DNS answers we receive from exit - nodes via this connection. (On by default.) + nodes via this connection. **CacheIPv6DNS**;; Tells the client to remember IPv6 DNS answers we receive from exit nodes via this connection.

1 0

[tor/master] Merge branch 'maint-0.3.3'
by arma＠torproject.org 08 May '18

08 May '18

commit bf5eaa82da4214be681cf0674f24376b7c4c0e34 Merge: c3ae14549 b979415e8 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue May 8 13:49:56 2018 -0400 Merge branch 'maint-0.3.3' changes/bug26052 | 6 ++++++ doc/tor.1.txt | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.3] Merge branch 'maint-0.3.3' into release-0.3.3
by arma＠torproject.org 08 May '18

08 May '18

commit 6db0c006b2d4d1244f9e4fa486ff7ad66a7ccb47 Merge: 0e4f7b56a b979415e8 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue May 8 13:49:34 2018 -0400 Merge branch 'maint-0.3.3' into release-0.3.3 changes/bug26052 | 6 ++++++ doc/tor.1.txt | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-)

1 0

[tor/release-0.3.3] manpage fix to stop saying CacheIPv4DNS is on by default
by arma＠torproject.org 08 May '18

08 May '18

1 0

[tor/maint-0.3.3] manpage fix to stop saying CacheIPv4DNS is on by default
by arma＠torproject.org 08 May '18

08 May '18

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits May 2018