January 2019 - tor-commits - lists.torproject.org

[tor/release-0.3.5] Merge remote-tracking branch 'tor-github/pr/636' into maint-0.3.5
by nickm＠torproject.org 09 Jan '19

09 Jan '19

commit 694e3c57fd1af2cdaa4650d69c50f4108a8612f6 Merge: 380ae2b74 c59b572e9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 9 09:38:22 2019 -0500 Merge remote-tracking branch 'tor-github/pr/636' into maint-0.3.5 changes/bug28995 | 5 +++++ src/lib/net/socketpair.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/master] Merge branch 'maint-0.3.5'
by nickm＠torproject.org 09 Jan '19

09 Jan '19

commit d890ec29aac33848a3965585965af5f2080206a4 Merge: 3df1d29d9 380ae2b74 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 9 09:35:40 2019 -0500 Merge branch 'maint-0.3.5' changes/bug28895 | 5 +++++ src/feature/client/circpathbias.c | 14 +++++++------- 2 files changed, 12 insertions(+), 7 deletions(-)

1 0

[tor/release-0.3.5] Merge branch 'maint-0.3.5' into release-0.3.5
by nickm＠torproject.org 09 Jan '19

09 Jan '19

commit 7db07d67411202bf16b9bacec2b12d5f93999209 Merge: 7ce8548c2 380ae2b74 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 9 09:35:40 2019 -0500 Merge branch 'maint-0.3.5' into release-0.3.5 changes/bug28895 | 5 +++++ src/feature/client/circpathbias.c | 14 +++++++------- 2 files changed, 12 insertions(+), 7 deletions(-)

1 0

[tor/maint-0.3.5] Stop logging 'Your Guard' in circpathbias.c
by nickm＠torproject.org 09 Jan '19

09 Jan '19

commit 380ae2b74b8c8762acc075d8d22bc5d6320655e1 Author: rl1987 <rl1987(a)sdf.lonestar.org> Date: Sun Dec 23 19:21:37 2018 +0200 Stop logging 'Your Guard' in circpathbias.c --- changes/bug28895 | 5 +++++ src/feature/client/circpathbias.c | 14 +++++++------- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/changes/bug28895 b/changes/bug28895 new file mode 100644 index 000000000..25fb167b2 --- /dev/null +++ b/changes/bug28895 @@ -0,0 +1,5 @@ + o Minor bugfixes (usability): + - Stop saying "Your Guard ..." in pathbias_measure_{use,close}_rate() + as that confusingly suggests that mentioned guard node is under control + and responsibility of end user, which it is not. Fixes bug 28895; + bugfix on Tor 0.3.0.1-alpha. diff --git a/src/feature/client/circpathbias.c b/src/feature/client/circpathbias.c index 9f2ed9347..eaeef5fe5 100644 --- a/src/feature/client/circpathbias.c +++ b/src/feature/client/circpathbias.c @@ -1332,7 +1332,7 @@ pathbias_measure_use_rate(entry_guard_t *guard) if (pathbias_get_dropguards(options)) { if (!pb->path_bias_disabled) { log_warn(LD_CIRC, - "Your Guard %s is failing to carry an extremely large " + "Guard %s is failing to carry an extremely large " "amount of stream on its circuits. " "To avoid potential route manipulation attacks, Tor has " "disabled use of this guard. " @@ -1356,7 +1356,7 @@ pathbias_measure_use_rate(entry_guard_t *guard) } else if (!pb->path_bias_use_extreme) { pb->path_bias_use_extreme = 1; log_warn(LD_CIRC, - "Your Guard %s is failing to carry an extremely large " + "Guard %s is failing to carry an extremely large " "amount of streams on its circuits. " "This could indicate a route manipulation attack, network " "overload, bad local network connectivity, or a bug. " @@ -1380,7 +1380,7 @@ pathbias_measure_use_rate(entry_guard_t *guard) if (!pb->path_bias_use_noticed) { pb->path_bias_use_noticed = 1; log_notice(LD_CIRC, - "Your Guard %s is failing to carry more streams on its " + "Guard %s is failing to carry more streams on its " "circuits than usual. " "Most likely this means the Tor network is overloaded " "or your network connection is poor. " @@ -1437,7 +1437,7 @@ pathbias_measure_close_rate(entry_guard_t *guard) if (pathbias_get_dropguards(options)) { if (!pb->path_bias_disabled) { log_warn(LD_CIRC, - "Your Guard %s is failing an extremely large " + "Guard %s is failing an extremely large " "amount of circuits. " "To avoid potential route manipulation attacks, Tor has " "disabled use of this guard. " @@ -1461,7 +1461,7 @@ pathbias_measure_close_rate(entry_guard_t *guard) } else if (!pb->path_bias_extreme) { pb->path_bias_extreme = 1; log_warn(LD_CIRC, - "Your Guard %s is failing an extremely large " + "Guard %s is failing an extremely large " "amount of circuits. " "This could indicate a route manipulation attack, " "extreme network overload, or a bug. " @@ -1485,7 +1485,7 @@ pathbias_measure_close_rate(entry_guard_t *guard) if (!pb->path_bias_warned) { pb->path_bias_warned = 1; log_warn(LD_CIRC, - "Your Guard %s is failing a very large " + "Guard %s is failing a very large " "amount of circuits. " "Most likely this means the Tor network is " "overloaded, but it could also mean an attack against " @@ -1510,7 +1510,7 @@ pathbias_measure_close_rate(entry_guard_t *guard) if (!pb->path_bias_noticed) { pb->path_bias_noticed = 1; log_notice(LD_CIRC, - "Your Guard %s is failing more circuits than " + "Guard %s is failing more circuits than " "usual. " "Most likely this means the Tor network is overloaded. " "Success counts are %ld/%ld. Use counts are %ld/%ld. "

1 0

[tor/master] Stop logging 'Your Guard' in circpathbias.c
by nickm＠torproject.org 09 Jan '19

09 Jan '19

commit 380ae2b74b8c8762acc075d8d22bc5d6320655e1 Author: rl1987 <rl1987(a)sdf.lonestar.org> Date: Sun Dec 23 19:21:37 2018 +0200 Stop logging 'Your Guard' in circpathbias.c --- changes/bug28895 | 5 +++++ src/feature/client/circpathbias.c | 14 +++++++------- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/changes/bug28895 b/changes/bug28895 new file mode 100644 index 000000000..25fb167b2 --- /dev/null +++ b/changes/bug28895 @@ -0,0 +1,5 @@ + o Minor bugfixes (usability): + - Stop saying "Your Guard ..." in pathbias_measure_{use,close}_rate() + as that confusingly suggests that mentioned guard node is under control + and responsibility of end user, which it is not. Fixes bug 28895; + bugfix on Tor 0.3.0.1-alpha. diff --git a/src/feature/client/circpathbias.c b/src/feature/client/circpathbias.c index 9f2ed9347..eaeef5fe5 100644 --- a/src/feature/client/circpathbias.c +++ b/src/feature/client/circpathbias.c @@ -1332,7 +1332,7 @@ pathbias_measure_use_rate(entry_guard_t *guard) if (pathbias_get_dropguards(options)) { if (!pb->path_bias_disabled) { log_warn(LD_CIRC, - "Your Guard %s is failing to carry an extremely large " + "Guard %s is failing to carry an extremely large " "amount of stream on its circuits. " "To avoid potential route manipulation attacks, Tor has " "disabled use of this guard. " @@ -1356,7 +1356,7 @@ pathbias_measure_use_rate(entry_guard_t *guard) } else if (!pb->path_bias_use_extreme) { pb->path_bias_use_extreme = 1; log_warn(LD_CIRC, - "Your Guard %s is failing to carry an extremely large " + "Guard %s is failing to carry an extremely large " "amount of streams on its circuits. " "This could indicate a route manipulation attack, network " "overload, bad local network connectivity, or a bug. " @@ -1380,7 +1380,7 @@ pathbias_measure_use_rate(entry_guard_t *guard) if (!pb->path_bias_use_noticed) { pb->path_bias_use_noticed = 1; log_notice(LD_CIRC, - "Your Guard %s is failing to carry more streams on its " + "Guard %s is failing to carry more streams on its " "circuits than usual. " "Most likely this means the Tor network is overloaded " "or your network connection is poor. " @@ -1437,7 +1437,7 @@ pathbias_measure_close_rate(entry_guard_t *guard) if (pathbias_get_dropguards(options)) { if (!pb->path_bias_disabled) { log_warn(LD_CIRC, - "Your Guard %s is failing an extremely large " + "Guard %s is failing an extremely large " "amount of circuits. " "To avoid potential route manipulation attacks, Tor has " "disabled use of this guard. " @@ -1461,7 +1461,7 @@ pathbias_measure_close_rate(entry_guard_t *guard) } else if (!pb->path_bias_extreme) { pb->path_bias_extreme = 1; log_warn(LD_CIRC, - "Your Guard %s is failing an extremely large " + "Guard %s is failing an extremely large " "amount of circuits. " "This could indicate a route manipulation attack, " "extreme network overload, or a bug. " @@ -1485,7 +1485,7 @@ pathbias_measure_close_rate(entry_guard_t *guard) if (!pb->path_bias_warned) { pb->path_bias_warned = 1; log_warn(LD_CIRC, - "Your Guard %s is failing a very large " + "Guard %s is failing a very large " "amount of circuits. " "Most likely this means the Tor network is " "overloaded, but it could also mean an attack against " @@ -1510,7 +1510,7 @@ pathbias_measure_close_rate(entry_guard_t *guard) if (!pb->path_bias_noticed) { pb->path_bias_noticed = 1; log_notice(LD_CIRC, - "Your Guard %s is failing more circuits than " + "Guard %s is failing more circuits than " "usual. " "Most likely this means the Tor network is overloaded. " "Success counts are %ld/%ld. Use counts are %ld/%ld. "

1 0

[tor/release-0.3.5] Stop logging 'Your Guard' in circpathbias.c
by nickm＠torproject.org 09 Jan '19

09 Jan '19

commit 380ae2b74b8c8762acc075d8d22bc5d6320655e1 Author: rl1987 <rl1987(a)sdf.lonestar.org> Date: Sun Dec 23 19:21:37 2018 +0200 Stop logging 'Your Guard' in circpathbias.c --- changes/bug28895 | 5 +++++ src/feature/client/circpathbias.c | 14 +++++++------- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/changes/bug28895 b/changes/bug28895 new file mode 100644 index 000000000..25fb167b2 --- /dev/null +++ b/changes/bug28895 @@ -0,0 +1,5 @@ + o Minor bugfixes (usability): + - Stop saying "Your Guard ..." in pathbias_measure_{use,close}_rate() + as that confusingly suggests that mentioned guard node is under control + and responsibility of end user, which it is not. Fixes bug 28895; + bugfix on Tor 0.3.0.1-alpha. diff --git a/src/feature/client/circpathbias.c b/src/feature/client/circpathbias.c index 9f2ed9347..eaeef5fe5 100644 --- a/src/feature/client/circpathbias.c +++ b/src/feature/client/circpathbias.c @@ -1332,7 +1332,7 @@ pathbias_measure_use_rate(entry_guard_t *guard) if (pathbias_get_dropguards(options)) { if (!pb->path_bias_disabled) { log_warn(LD_CIRC, - "Your Guard %s is failing to carry an extremely large " + "Guard %s is failing to carry an extremely large " "amount of stream on its circuits. " "To avoid potential route manipulation attacks, Tor has " "disabled use of this guard. " @@ -1356,7 +1356,7 @@ pathbias_measure_use_rate(entry_guard_t *guard) } else if (!pb->path_bias_use_extreme) { pb->path_bias_use_extreme = 1; log_warn(LD_CIRC, - "Your Guard %s is failing to carry an extremely large " + "Guard %s is failing to carry an extremely large " "amount of streams on its circuits. " "This could indicate a route manipulation attack, network " "overload, bad local network connectivity, or a bug. " @@ -1380,7 +1380,7 @@ pathbias_measure_use_rate(entry_guard_t *guard) if (!pb->path_bias_use_noticed) { pb->path_bias_use_noticed = 1; log_notice(LD_CIRC, - "Your Guard %s is failing to carry more streams on its " + "Guard %s is failing to carry more streams on its " "circuits than usual. " "Most likely this means the Tor network is overloaded " "or your network connection is poor. " @@ -1437,7 +1437,7 @@ pathbias_measure_close_rate(entry_guard_t *guard) if (pathbias_get_dropguards(options)) { if (!pb->path_bias_disabled) { log_warn(LD_CIRC, - "Your Guard %s is failing an extremely large " + "Guard %s is failing an extremely large " "amount of circuits. " "To avoid potential route manipulation attacks, Tor has " "disabled use of this guard. " @@ -1461,7 +1461,7 @@ pathbias_measure_close_rate(entry_guard_t *guard) } else if (!pb->path_bias_extreme) { pb->path_bias_extreme = 1; log_warn(LD_CIRC, - "Your Guard %s is failing an extremely large " + "Guard %s is failing an extremely large " "amount of circuits. " "This could indicate a route manipulation attack, " "extreme network overload, or a bug. " @@ -1485,7 +1485,7 @@ pathbias_measure_close_rate(entry_guard_t *guard) if (!pb->path_bias_warned) { pb->path_bias_warned = 1; log_warn(LD_CIRC, - "Your Guard %s is failing a very large " + "Guard %s is failing a very large " "amount of circuits. " "Most likely this means the Tor network is " "overloaded, but it could also mean an attack against " @@ -1510,7 +1510,7 @@ pathbias_measure_close_rate(entry_guard_t *guard) if (!pb->path_bias_noticed) { pb->path_bias_noticed = 1; log_notice(LD_CIRC, - "Your Guard %s is failing more circuits than " + "Guard %s is failing more circuits than " "usual. " "Most likely this means the Tor network is overloaded. " "Success counts are %ld/%ld. Use counts are %ld/%ld. "

1 0

[sbws/master] CI: change to Ubuntu Xenial
by juga＠torproject.org 09 Jan '19

09 Jan '19

commit cd61cb3c0b219ad94f7a95cb4abd141b17c08d77 Author: juga0 <juga(a)riseup.net> Date: Wed Jan 9 14:25:47 2019 +0000 CI: change to Ubuntu Xenial since deb.torproject.org does not support anymore Trusty. --- .travis.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index 6d117c9..aa477ef 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,4 +1,5 @@ sudo: true +dist: xenial language: python python: - "3.5" @@ -14,8 +15,7 @@ script: before_install: - gpg --version - sudo apt-key add tests/deb.torproject.org.asc - - echo "deb https://deb.torproject.org/torproject.org trusty main" | sudo tee -a /etc/apt/sources.list - - echo "deb-src https://deb.torproject.org/torproject.org trusty main" | sudo tee -a /etc/apt/sources.list + - echo "deb https://deb.torproject.org/torproject.org xenial main" | sudo tee -a /etc/apt/sources.list - sudo apt-get update -qq - sudo apt-get install tor -y

1 0

[tor/master] Dir: Refactor ns expiry check to remove duplicate code
by nickm＠torproject.org 09 Jan '19

09 Jan '19

commit bd29b3531a48b41f6eee5b4a29769a13ef199298 Author: teor <teor(a)torproject.org> Date: Thu Nov 29 01:06:19 2018 +1000 Dir: Refactor ns expiry check to remove duplicate code Instead of checking NS_EXPIRY_SLOP, use networkstatus_consensus_reasonably_live(). Preparation for 28591. --- src/core/mainloop/mainloop.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/src/core/mainloop/mainloop.c b/src/core/mainloop/mainloop.c index 7eff82fee..af2bc8262 100644 --- a/src/core/mainloop/mainloop.c +++ b/src/core/mainloop/mainloop.c @@ -2028,11 +2028,9 @@ check_expired_networkstatus_callback(time_t now, const or_options_t *options) (void)options; /* Check whether our networkstatus has expired. */ networkstatus_t *ns = networkstatus_get_latest_consensus(); - /*XXXX RD: This value needs to be the same as REASONABLY_LIVE_TIME in - * networkstatus_get_reasonably_live_consensus(), but that value is way - * way too high. Arma: is the bridge issue there resolved yet? -NM */ -#define NS_EXPIRY_SLOP (24*60*60) - if (ns && ns->valid_until < (now - NS_EXPIRY_SLOP) && + /* Use reasonably live consensuses until they are no longer reasonably live. + */ + if (ns && !networkstatus_consensus_reasonably_live(ns, now) && router_have_minimum_dir_info()) { router_dir_info_changed(); }

1 0

[tor/master] Dir: allow directory mirrors to serve future consensuses
by nickm＠torproject.org 09 Jan '19

09 Jan '19

commit 44db455cc894b4a0fda80a28ed5ea55bf4d41231 Author: teor <teor(a)torproject.org> Date: Thu Nov 29 01:03:03 2018 +1000 Dir: allow directory mirrors to serve future consensuses When Tor's clock is behind the clocks on the authorities, allow Tor to serve future consensuses. Fixes bug 28654; bugfix on 0.3.0.1-alpha. --- changes/bug28654 | 3 ++ src/feature/dircache/dircache.c | 73 ++++++++++++++++++++++++++++------------- 2 files changed, 54 insertions(+), 22 deletions(-) diff --git a/changes/bug28654 b/changes/bug28654 new file mode 100644 index 000000000..4ca843309 --- /dev/null +++ b/changes/bug28654 @@ -0,0 +1,3 @@ + o Minor bugfixes (directory mirror): + - When Tor's clock is behind the clocks on the authorities, allow Tor to + serve future consensuses. Fixes bug 28654; bugfix on 0.3.0.1-alpha. diff --git a/src/feature/dircache/dircache.c b/src/feature/dircache/dircache.c index 872a88018..ce90f4910 100644 --- a/src/feature/dircache/dircache.c +++ b/src/feature/dircache/dircache.c @@ -495,28 +495,47 @@ handle_get_frontpage(dir_connection_t *conn, const get_handler_args_t *args) } /** Warn that the cached consensus consensus of type - * flavor is too old and will not be served to clients. Rate-limit the - * warning to avoid logging an entry on every request. + * flavor too new or too old, based on is_too_new, + * and will not be served to clients. Rate-limit the warning to avoid logging + * an entry on every request. */ static void -warn_consensus_is_too_old(const struct consensus_cache_entry_t *consensus, - const char *flavor, time_t now) +warn_consensus_is_not_reasonably_live( + const struct consensus_cache_entry_t *consensus, + const char *flavor, time_t now, bool is_too_new) { -#define TOO_OLD_WARNING_INTERVAL (60*60) - static ratelim_t warned = RATELIM_INIT(TOO_OLD_WARNING_INTERVAL); +#define NOT_REASONABLY_LIVE_WARNING_INTERVAL (60*60) + static ratelim_t warned[2] = { RATELIM_INIT( + NOT_REASONABLY_LIVE_WARNING_INTERVAL), + RATELIM_INIT( + NOT_REASONABLY_LIVE_WARNING_INTERVAL) }; char timestamp[ISO_TIME_LEN+1]; - time_t valid_until; - char *dupes; + /* valid_after if is_too_new, valid_until if !is_too_new */ + time_t valid_time = 0; + char *dupes = NULL; - if (consensus_cache_entry_get_valid_until(consensus, &valid_until)) - return; - - if ((dupes = rate_limit_log(&warned, now))) { - format_local_iso_time(timestamp, valid_until); - log_warn(LD_DIRSERV, "Our %s%sconsensus is too old, so we will not " - "serve it to clients. It was valid until %s local time and we " - "continued to serve it for up to 24 hours after it expired.%s", - flavor ? flavor : "", flavor ? " " : "", timestamp, dupes); + if (is_too_new) { + if (consensus_cache_entry_get_valid_after(consensus, &valid_time)) + return; + dupes = rate_limit_log(&warned[1], now); + } else { + if (consensus_cache_entry_get_valid_until(consensus, &valid_time)) + return; + dupes = rate_limit_log(&warned[0], now); + } + + if (dupes) { + format_local_iso_time(timestamp, valid_time); + log_warn(LD_DIRSERV, "Our %s%sconsensus is too %s, so we will not " + "serve it to clients. It was valid %s %s local time and we " + "continued to serve it for up to 24 hours %s.%s", + flavor ? flavor : "", + flavor ? " " : "", + is_too_new ? "new" : "old", + is_too_new ? "after" : "until", + timestamp, + is_too_new ? "before it was valid" : "after it expired", + dupes); tor_free(dupes); } } @@ -859,7 +878,6 @@ handle_get_current_consensus(dir_connection_t *conn, if (req.diff_only && !cached_consensus) { write_short_http_response(conn, 404, "No such diff available"); - // XXXX warn_consensus_is_too_old(v, req.flavor, now); geoip_note_ns_response(GEOIP_REJECT_NOT_FOUND); goto done; } @@ -870,19 +888,30 @@ handle_get_current_consensus(dir_connection_t *conn, &compression_used); } - time_t fresh_until, valid_until; - int have_fresh_until = 0, have_valid_until = 0; + time_t valid_after, fresh_until, valid_until; + int have_valid_after = 0, have_fresh_until = 0, have_valid_until = 0; if (cached_consensus) { + have_valid_after = + !consensus_cache_entry_get_valid_after(cached_consensus, &valid_after); have_fresh_until = !consensus_cache_entry_get_fresh_until(cached_consensus, &fresh_until); have_valid_until = !consensus_cache_entry_get_valid_until(cached_consensus, &valid_until); } - if (cached_consensus && have_valid_until && + if (cached_consensus && have_valid_after && + !networkstatus_valid_after_is_reasonably_live(valid_after, now)) { + write_short_http_response(conn, 404, "Consensus is too new"); + warn_consensus_is_not_reasonably_live(cached_consensus, req.flavor, now, + 1); + geoip_note_ns_response(GEOIP_REJECT_NOT_FOUND); + goto done; + } else if ( + cached_consensus && have_valid_until && !networkstatus_valid_until_is_reasonably_live(valid_until, now)) { write_short_http_response(conn, 404, "Consensus is too old"); - warn_consensus_is_too_old(cached_consensus, req.flavor, now); + warn_consensus_is_not_reasonably_live(cached_consensus, req.flavor, now, + 0); geoip_note_ns_response(GEOIP_REJECT_NOT_FOUND); goto done; }

1 0

[tor/master] Merge branch 'bug28591_035_squashed'
by nickm＠torproject.org 09 Jan '19

09 Jan '19

commit 3df1d29d9b5ccb3b49760105ca7fd434e22d3924 Merge: e6a440120 44db455cc Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 9 09:33:31 2019 -0500 Merge branch 'bug28591_035_squashed' changes/bug28591 | 4 ++ changes/bug28654 | 3 ++ src/core/mainloop/mainloop.c | 8 ++-- src/feature/dircache/dircache.c | 73 +++++++++++++++++++++++++----------- src/feature/nodelist/microdesc.c | 10 +++-- src/feature/nodelist/networkstatus.c | 35 +++++++++++------ src/feature/nodelist/networkstatus.h | 2 + src/test/test_entrynodes.c | 32 +++++++++++----- src/test/test_routerlist.c | 1 - 9 files changed, 115 insertions(+), 53 deletions(-)

1 0