October 2019 - tor-commits - lists.torproject.org

[tor/maint-0.3.5] Merge remote-tracking branch 'tor-github/pr/1284' into maint-0.3.5
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit 27965f1ef2ff44e2ce7e3f1af72f9112fb30bde5 Merge: 003be727c 05fa1689e Author: teor <teor(a)torproject.org> Date: Wed Oct 23 08:30:48 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1284' into maint-0.3.5 changes/bug12399 | 3 +++ src/feature/rend/rendmid.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.3.5] Merge branch 'maint-0.2.9' into maint-0.3.5
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit d175e70817ccff01cd9eb73d8da9e306745fb469 Merge: c77162e4e 8682442c7 Author: teor <teor(a)torproject.org> Date: Wed Oct 23 08:47:01 2019 +1000 Merge branch 'maint-0.2.9' into maint-0.3.5

1 0

[tor/maint-0.3.5] Merge remote-tracking branch 'tor-github/pr/1360' into maint-0.3.5
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit c77162e4e95fdfd6a5cc422802dee943750b14b7 Merge: 27965f1ef da5c8277e Author: teor <teor(a)torproject.org> Date: Wed Oct 23 08:32:52 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1360' into maint-0.3.5 .appveyor.yml | 6 +++--- .travis.yml | 6 ++++-- changes/ticket31372_appveyor | 4 ++++ changes/ticket31372_travis | 4 ++++ 4 files changed, 15 insertions(+), 5 deletions(-) diff --cc .travis.yml index 1523ba8ca,64f8380bc..8f7e8e4be --- a/.travis.yml +++ b/.travis.yml @@@ -15,13 -15,17 +15,15 @@@ compiler os: - linux - - osx -## The build matrix in the following stanza expands into builds for each -## OS and compiler. +## We don't use the build matrix cross-product, because it makes too many jobs +## Instead, we list each job under matrix: include: env: global: - ## The Travis CI environment allows us two cores, so let's use both. - - MAKEFLAGS="-j 2" + ## The Travis CI environment allows us two cores, so let's use both. Also, + ## let's use the "-k" flag so that we get all of the compilation failures, + ## not just the first one. + - MAKEFLAGS="-k -j 2" ## We turn on hardening by default ## Also known as --enable-fragile-hardening in 0.3.0.3-alpha and later - HARDENING_OPTIONS="--enable-expensive-hardening"

1 0

[tor/maint-0.3.5] Merge remote-tracking branch 'tor-github/pr/1351' into maint-0.2.9
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit 8682442c7629c2ede5198a00ab1cf8f4e21991d6 Merge: 7660a7cf7 6ed3d8dbd Author: teor <teor(a)torproject.org> Date: Wed Oct 23 08:32:22 2019 +1000 Merge remote-tracking branch 'tor-github/pr/1351' into maint-0.2.9 .travis.yml | 6 ++++-- changes/ticket31372_travis | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --cc .travis.yml index 7c7fcf4f6,759710737..d429e1537 --- a/.travis.yml +++ b/.travis.yml @@@ -8,13 -8,17 +8,15 @@@ compiler os: - linux - - osx -## The build matrix in the following stanza expands into builds for each -## OS and compiler. +## We don't use the build matrix cross-product, because it makes too many jobs +## Instead, we list each job under matrix: include: env: global: - ## The Travis CI environment allows us two cores, so let's use both. - - MAKEFLAGS="-j 2" + ## The Travis CI environment allows us two cores, so let's use both. Also, + ## let's use the "-k" flag so that we get all of the compilation failures, + ## not just the first one. + - MAKEFLAGS="-k -j 2" ## We turn on hardening by default ## Also known as --enable-fragile-hardening in 0.3.0.3-alpha and later - HARDENING_OPTIONS="--enable-expensive-hardening"

1 0

[tor/maint-0.3.5] changes: file for 23818, v3 onion service fix
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit 084245134b022aa983c45aa3fc0ace9fd7ae21a9 Author: teor <teor(a)torproject.org> Date: Fri Aug 23 15:10:45 2019 +1000 changes: file for 23818, v3 onion service fix --- changes/bug23818_v3 | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/changes/bug23818_v3 b/changes/bug23818_v3 new file mode 100644 index 000000000..c430144d8 --- /dev/null +++ b/changes/bug23818_v3 @@ -0,0 +1,6 @@ + o Minor bugfixes (v3 single onion services): + - Always retry v3 single onion service intro and rend circuits with a + 3-hop path. Previously, v3 single onion services used a 3-hop path + when rend circuits were retried after a remote or delayed failure, + but a 1-hop path for immediate retries. Fixes bug 23818; + bugfix on 0.3.2.1-alpha.

1 0

[tor/maint-0.3.5] Try using make -k in Travis configuration
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit 6ed3d8dbd180aa72e2c9b3fa4835fb82e0f60556 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 23 15:04:54 2019 -0400 Try using make -k in Travis configuration Frequently, when a patch fails, it has failures in several files. Using the "-k" flag will let us learn all the compilation errors, not just the first one that the compiler hits. Based on a patch by rl1987. --- .travis.yml | 6 ++++-- changes/ticket31372_travis | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index a2bc6395d..759710737 100644 --- a/.travis.yml +++ b/.travis.yml @@ -15,8 +15,10 @@ os: ## OS and compiler. env: global: - ## The Travis CI environment allows us two cores, so let's use both. - - MAKEFLAGS="-j 2" + ## The Travis CI environment allows us two cores, so let's use both. Also, + ## let's use the "-k" flag so that we get all of the compilation failures, + ## not just the first one. + - MAKEFLAGS="-k -j 2" ## We turn on hardening by default ## Also known as --enable-fragile-hardening in 0.3.0.3-alpha and later - HARDENING_OPTIONS="--enable-expensive-hardening" diff --git a/changes/ticket31372_travis b/changes/ticket31372_travis new file mode 100644 index 000000000..403869b2e --- /dev/null +++ b/changes/ticket31372_travis @@ -0,0 +1,4 @@ + o Minor features (continuous integration): + - When building on Travis, pass the "-k" flag to make, so that + we are informed of all compilation failures, not just the first + one or two. Closes part of ticket 31372.

1 0

[tor/maint-0.3.5] Merge branch 'ticket31372_029' into ticket31372_035
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit da5c8277eacc3a18234373228da1397f36112e19 Merge: 49a11f8a8 6ed3d8dbd Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 24 08:01:43 2019 -0400 Merge branch 'ticket31372_029' into ticket31372_035 .travis.yml | 6 ++++-- changes/ticket31372_travis | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-)

1 0

[tor/maint-0.3.5] hs: v3 single onion services fall back to 3-hop intro for unreachable nodes
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit e2e1c07fd25c96a83b38f5d84d2c063b98ed8f46 Author: teor <teor(a)torproject.org> Date: Fri Aug 23 16:17:47 2019 +1000 hs: v3 single onion services fall back to 3-hop intro for unreachable nodes Previously, v3 single onion services failed when all intro nodes were unreachable via a 1-hop path. Now, we select intros that are only available via a 3-hop path, and use a 3-hop path to connect to them. Fixes bug 23507; bugfix on 0.3.2.1-alpha. --- src/feature/hs/hs_circuit.c | 25 +++++++++++++++---------- src/feature/hs/hs_circuit.h | 3 ++- src/feature/hs/hs_service.c | 30 +++++++++++++++++++++++------- 3 files changed, 40 insertions(+), 18 deletions(-) diff --git a/src/feature/hs/hs_circuit.c b/src/feature/hs/hs_circuit.c index d74b088f0..8acfcbd65 100644 --- a/src/feature/hs/hs_circuit.c +++ b/src/feature/hs/hs_circuit.c @@ -758,13 +758,16 @@ hs_circ_retry_service_rendezvous_point(origin_circuit_t *circ) } /* For a given service and a service intro point, launch a circuit to the - * extend info ei. If the service is a single onion, a one-hop circuit will be - * requested. Return 0 if the circuit was successfully launched and tagged + * extend info ei. If the service is a single onion, and direct_conn is true, + * a one-hop circuit will be requested. + * + * Return 0 if the circuit was successfully launched and tagged * with the correct identifier. On error, a negative value is returned. */ int hs_circ_launch_intro_point(hs_service_t *service, const hs_service_intro_point_t *ip, - extend_info_t *ei) + extend_info_t *ei, + bool direct_conn) { /* Standard flags for introduction circuit. */ int ret = -1, circ_flags = CIRCLAUNCH_NEED_UPTIME | CIRCLAUNCH_IS_INTERNAL; @@ -775,15 +778,17 @@ hs_circ_launch_intro_point(hs_service_t *service, tor_assert(ei); /* Update circuit flags in case of a single onion service that requires a - * direct connection. - * - * We only use a one-hop path on the first attempt. If the first attempt + * direct connection. */ + tor_assert_nonfatal(ip->circuit_retries > 0); + /* Only single onion services can make direct conns */ + if (BUG(!service->config.is_single_onion && direct_conn)) { + goto end; + } + /* We only use a one-hop path on the first attempt. If the first attempt * fails, we use a 3-hop path for reachability / reliability. * (Unlike v2, retries is incremented by the caller before it calls this - * function.) - */ - tor_assert_nonfatal(ip->circuit_retries > 0); - if (service->config.is_single_onion && ip->circuit_retries == 1) { + * function.) */ + if (direct_conn && ip->circuit_retries == 1) { circ_flags |= CIRCLAUNCH_ONEHOP_TUNNEL; } diff --git a/src/feature/hs/hs_circuit.h b/src/feature/hs/hs_circuit.h index b8d8b25ad..e168b301f 100644 --- a/src/feature/hs/hs_circuit.h +++ b/src/feature/hs/hs_circuit.h @@ -26,7 +26,8 @@ void hs_circ_service_rp_has_opened(const hs_service_t *service, origin_circuit_t *circ); int hs_circ_launch_intro_point(hs_service_t *service, const hs_service_intro_point_t *ip, - extend_info_t *ei); + extend_info_t *ei, + bool direct_conn); int hs_circ_launch_rendezvous_point(const hs_service_t *service, const curve25519_public_key_t *onion_key, const uint8_t *rendezvous_cookie); diff --git a/src/feature/hs/hs_service.c b/src/feature/hs/hs_service.c index 402929036..b05f20366 100644 --- a/src/feature/hs/hs_service.c +++ b/src/feature/hs/hs_service.c @@ -2105,6 +2105,7 @@ build_all_descriptors(time_t now) static hs_service_intro_point_t * pick_intro_point(unsigned int direct_conn, smartlist_t *exclude_nodes) { + const or_options_t *options = get_options(); const node_t *node; extend_info_t *info = NULL; hs_service_intro_point_t *ip = NULL; @@ -2113,11 +2114,19 @@ pick_intro_point(unsigned int direct_conn, smartlist_t *exclude_nodes) /* Single onion flags. */ router_crn_flags_t direct_flags = flags | CRN_PREF_ADDR | CRN_DIRECT_CONN; - node = router_choose_random_node(exclude_nodes, get_options()->ExcludeNodes, + node = router_choose_random_node(exclude_nodes, options->ExcludeNodes, direct_conn ? direct_flags : flags); - /* Unable to find a node. When looking for a node for a direct connection, - * we could try a 3-hop path instead. We'll add support for this in a later - * release. */ + + /* If we are in single onion mode, retry node selection for a 3-hop + * path */ + if (direct_conn && !node) { + log_info(LD_REND, + "Unable to find an intro point that we can connect to " + "directly, falling back to a 3-hop path."); + node = router_choose_random_node(exclude_nodes, options->ExcludeNodes, + flags); + } + if (!node) { goto err; } @@ -2644,7 +2653,7 @@ launch_intro_point_circuits(hs_service_t *service) * circuits using the current map. */ FOR_EACH_DESCRIPTOR_BEGIN(service, desc) { /* Keep a ref on if we need a direct connection. We use this often. */ - unsigned int direct_conn = service->config.is_single_onion; + bool direct_conn = service->config.is_single_onion; DIGEST256MAP_FOREACH_MODIFY(desc->intro_points.map, key, hs_service_intro_point_t *, ip) { @@ -2655,8 +2664,15 @@ launch_intro_point_circuits(hs_service_t *service) if (hs_circ_service_get_intro_circ(ip)) { continue; } - ei = get_extend_info_from_intro_point(ip, direct_conn); + + /* If we can't connect directly to the intro point, get an extend_info + * for a multi-hop path instead. */ + if (ei == NULL && direct_conn) { + direct_conn = false; + ei = get_extend_info_from_intro_point(ip, 0); + } + if (ei == NULL) { /* This is possible if we can get a node_t but not the extend info out * of it. In this case, we remove the intro point and a new one will @@ -2668,7 +2684,7 @@ launch_intro_point_circuits(hs_service_t *service) /* Launch a circuit to the intro point. */ ip->circuit_retries++; - if (hs_circ_launch_intro_point(service, ip, ei) < 0) { + if (hs_circ_launch_intro_point(service, ip, ei, direct_conn) < 0) { log_info(LD_REND, "Unable to launch intro circuit to node %s " "for service %s.", safe_str_client(extend_info_describe(ei)),

1 0

[tor/maint-0.3.5] Try using make -k in the Appveyor configuration
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit 49a11f8a8a61a4d8b8657a98291862ffc96e99d9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 23 15:04:54 2019 -0400 Try using make -k in the Appveyor configuration Frequently, when a patch fails, it has failures in several files. Using the "-k" flag will let us learn all the compilation errors, not just the first one that the compiler hits. Based on a patch by rl1987. Closes ticket 31372. --- .appveyor.yml | 6 +++--- changes/ticket31372_appveyor | 4 ++++ 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/.appveyor.yml b/.appveyor.yml index 9913bf3bd..25f87fa45 100644 --- a/.appveyor.yml +++ b/.appveyor.yml @@ -83,8 +83,8 @@ build_script: # configure its flags. liblzma just works. #> Execute-Bash "ZSTD_CFLAGS='-L/${env:compiler_path}/include' ZSTD_LIBS='-L/${env:compiler_path}/lib -lzstd' ../configure --prefix=/${env:compiler_path} --build=${env:target} --host=${env:target} --with-openssl-dir=/${env:compiler_path} --disable-asciidoc --enable-fatal-warnings ${env:hardening}" - Execute-Bash "V=1 make -j2" - Execute-Bash "V=1 make -j2 install" + Execute-Bash "V=1 make -k -j2" + Execute-Bash "V=1 make -k -j2 install" } test_script: @@ -95,7 +95,7 @@ test_script: $buildpath = @("C:\msys64\${env:compiler_path}\bin") + $oldpath $env:Path = $buildpath -join ';' Set-Location "${env:build}" - Execute-Bash "VERBOSE=1 make -j2 check" + Execute-Bash "VERBOSE=1 make -k -j2 check" } on_finish: diff --git a/changes/ticket31372_appveyor b/changes/ticket31372_appveyor new file mode 100644 index 000000000..e7bb03182 --- /dev/null +++ b/changes/ticket31372_appveyor @@ -0,0 +1,4 @@ + o Minor features (continuous integration): + - When building on Appveyor, pass the "-k" flag to make, so that + we are informed of all compilation failures, not just the first + one or two. Closes part of ticket 31372.

1 0

[tor/maint-0.3.5] hs: Always use a 3-hop path when a v3 single onion rend fails
by teor＠torproject.org 22 Oct '19

22 Oct '19

commit c94904b35982a73a652d9bed8b195ce625bbb962 Author: teor <teor(a)torproject.org> Date: Fri Aug 23 14:41:24 2019 +1000 hs: Always use a 3-hop path when a v3 single onion rend fails Previously, we used a 1-hop path when a single onion rend failed immediately, and a 3-hop path when it failed after trying to build a circuit. Fixes bug 23818; bugfix on 0.3.2.1-alpha. --- src/feature/hs/hs_circuit.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/feature/hs/hs_circuit.c b/src/feature/hs/hs_circuit.c index e3873d2f1..f7996a24f 100644 --- a/src/feature/hs/hs_circuit.c +++ b/src/feature/hs/hs_circuit.c @@ -405,8 +405,12 @@ launch_rendezvous_point_circuit(const hs_service_t *service, if (circ_needs_uptime) { circ_flags |= CIRCLAUNCH_NEED_UPTIME; } - /* Firewall and policies are checked when getting the extend info. */ - if (service->config.is_single_onion) { + /* Firewall and policies are checked when getting the extend info. + * + * We only use a one-hop path on the first attempt. If the first attempt + * fails, we use a 3-hop path for reachability / reliability. + * See the comment in retry_service_rendezvous_point() for details. */ + if (service->config.is_single_onion && i == 0) { circ_flags |= CIRCLAUNCH_ONEHOP_TUNNEL; }

1 0