May 2019 - tor-commits - lists.torproject.org

[tor/master] Bug 29203: Provide ReducedCircuitPadding torrc and consensus params
by nickm＠torproject.org 13 May '19

13 May '19

commit 621ea2315b3f53a9ef4ace9f3f6cb2f03a241042 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Apr 17 06:09:06 2019 +0000 Bug 29203: Provide ReducedCircuitPadding torrc and consensus params --- doc/tor.1.txt | 6 ++++++ src/app/config/config.c | 5 +++++ src/app/config/or_options_st.h | 6 ++++++ src/core/or/circuitpadding.c | 13 +++++++++++++ src/core/or/circuitpadding.h | 11 +++++++++++ 5 files changed, 41 insertions(+) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 6c125e374..13a85f995 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -963,6 +963,12 @@ The following options are useful only for clients (that is, if support (unlike ConnectionPadding, CircuitPadding cannot be force-enabled). (Default: 1) +[[ReducedCircuitPadding]] **ReducedCircuitPadding** **0**|**1**:: + If set to 1, Tor will only use circuit padding algorithms that have low + overhead. Only clients may set this option. This option should be offered + via the UI to mobile users for use where bandwidth may be expensive. + (Default: 0) + [[ExcludeNodes]] **ExcludeNodes** __node__,__node__,__...__:: A list of identity fingerprints, country codes, and address patterns of nodes to avoid when building a circuit. Country codes are diff --git a/src/app/config/config.c b/src/app/config/config.c index 7ad970625..1c7cb1d57 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -597,6 +597,7 @@ static config_var_t option_vars_[] = { V(ConnectionPadding, AUTOBOOL, "auto"), V(RefuseUnknownExits, AUTOBOOL, "auto"), V(CircuitPadding, BOOL, "1"), + V(ReducedCircuitPadding, BOOL, "0"), V(RejectPlaintextPorts, CSV, ""), V(RelayBandwidthBurst, MEMUNIT, "0"), V(RelayBandwidthRate, MEMUNIT, "0"), @@ -3746,6 +3747,10 @@ options_validate(or_options_t *old_options, or_options_t *options, REJECT("Relays cannot set CircuitPadding to 0. "); } + if (server_mode(options) && options->ReducedCircuitPadding == 1) { + REJECT("Relays cannot set ReducedCircuitPadding. "); + } + if (options->BridgeDistribution) { if (!options->BridgeRelay) { REJECT("You set BridgeDistribution, but you didn't set BridgeRelay!"); diff --git a/src/app/config/or_options_st.h b/src/app/config/or_options_st.h index 0fdeb94b4..4e03bec7f 100644 --- a/src/app/config/or_options_st.h +++ b/src/app/config/or_options_st.h @@ -253,6 +253,12 @@ struct or_options_t { * disabled. */ int CircuitPadding; + /** Boolean: if true, then this client will only use circuit padding + * algorithms that are known to use a low amount of overhead. If false, + * we will use all available circuit padding algorithms. + */ + int ReducedCircuitPadding; + /** To what authority types do we publish our descriptor? Choices are * "v1", "v2", "v3", "bridge", or "". */ struct smartlist_t *PublishServerDescriptor; diff --git a/src/core/or/circuitpadding.c b/src/core/or/circuitpadding.c index dcd8f645c..8d2749906 100644 --- a/src/core/or/circuitpadding.c +++ b/src/core/or/circuitpadding.c @@ -82,6 +82,7 @@ static double circpad_distribution_sample(circpad_distribution_t dist); /** Cached consensus params */ static uint8_t circpad_padding_disabled; +static uint8_t circpad_padding_reduced; static uint8_t circpad_global_max_padding_percent; static uint16_t circpad_global_allowed_cells; static uint16_t circpad_max_circ_queued_cells; @@ -1086,6 +1087,10 @@ circpad_new_consensus_params(const networkstatus_t *ns) networkstatus_get_param(ns, "circpad_padding_disabled", 0, 0, 1); + circpad_padding_reduced = + networkstatus_get_param(ns, "circpad_padding_reduced", + 0, 0, 1); + circpad_global_allowed_cells = networkstatus_get_param(ns, "circpad_global_allowed_cells", 0, 0, UINT16_MAX-1); @@ -1662,6 +1667,14 @@ circpad_machine_conditions_met(origin_circuit_t *circ, if (circpad_padding_disabled || !get_options()->CircuitPadding) return 0; + /* If the consensus or our torrc has selected reduced connection padding, + * then only allow this machine if it is flagged as acceptable under + * reduced padding conditions */ + if (circpad_padding_reduced || get_options()->ReducedCircuitPadding) { + if (!machine->conditions.reduced_padding_ok) + return 0; + } + if (!(circpad_circ_purpose_to_mask(TO_CIRCUIT(circ)->purpose) & machine->conditions.purpose_mask)) return 0; diff --git a/src/core/or/circuitpadding.h b/src/core/or/circuitpadding.h index bc2522c21..f00369eb0 100644 --- a/src/core/or/circuitpadding.h +++ b/src/core/or/circuitpadding.h @@ -152,6 +152,17 @@ typedef struct circpad_machine_conditions_t { /** Only apply the machine *if* vanguards are enabled */ unsigned requires_vanguards : 1; + /** + * This machine is ok to use if reduced padding is set in consensus + * or torrc. This machine will still be applied even if reduced padding + * is not set; this flag only acts to exclude machines that don't have + * it set when reduced padding is requested. Therefore, reduced padding + * machines should appear at the lowest priority in the padding machine + * lists (aka first in the list), so that non-reduced padding machines + * for the same purpose are given a chance to apply when reduced padding + * is not requested. */ + unsigned reduced_padding_ok : 1; + /** Only apply the machine *if* the circuit's state matches any of * the bits set in this bitmask. */ circpad_circuit_state_t state_mask;

1 0

[tor/master] Bug 30173: Add consensus param to disable padding.
by nickm＠torproject.org 13 May '19

13 May '19

commit 21a4438c58d2c3923499b0a8c3f2240eeca5e2a8 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Apr 17 02:44:42 2019 +0000 Bug 30173: Add consensus param to disable padding. Disable padding via limit check and machine condition. Limits cause us to stop sending padding. Machine conditions cause the machines to be shut down, and not restarted. --- src/core/or/circuitpadding.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/src/core/or/circuitpadding.c b/src/core/or/circuitpadding.c index d30edf9db..f6385f32e 100644 --- a/src/core/or/circuitpadding.c +++ b/src/core/or/circuitpadding.c @@ -81,6 +81,7 @@ static void circpad_setup_machine_on_circ(circuit_t *on_circ, static double circpad_distribution_sample(circpad_distribution_t dist); /** Cached consensus params */ +static uint8_t circpad_padding_disabled; static uint8_t circpad_global_max_padding_percent; static uint16_t circpad_global_allowed_cells; static uint16_t circpad_max_circ_queued_cells; @@ -1081,6 +1082,10 @@ circpad_send_padding_callback(tor_timer_t *timer, void *args, void circpad_new_consensus_params(const networkstatus_t *ns) { + circpad_padding_disabled = + networkstatus_get_param(ns, "circpad_padding_disabled", + 0, 0, 1); + circpad_global_allowed_cells = networkstatus_get_param(ns, "circpad_global_allowed_cells", 0, 0, UINT16_MAX-1); @@ -1112,10 +1117,19 @@ circpad_machine_reached_padding_limit(circpad_machine_runtime_t *mi) { const circpad_machine_spec_t *machine = CIRCPAD_GET_MACHINE(mi); + /* If padding has been disabled in the consensus, don't send any more + * padding. Technically the machine should be shut down when the next + * machine condition check happens, but machine checks only happen on + * certain circuit events, and if padding is disabled due to some + * network overload or DoS condition, we really want to stop ASAP. */ + if (circpad_padding_disabled) { + return 1; + } + /* If machine_padding_pct is non-zero, and we've sent more * than the allowed count of padding cells, then check our * percent limits for this machine. */ - if (machine->max_padding_percent && + if (machine->max_padding_percent && mi->padding_sent >= machine->allowed_padding_count) { uint32_t total_cells = mi->padding_sent + mi->nonpadding_sent; @@ -1621,6 +1635,11 @@ static inline bool circpad_machine_conditions_met(origin_circuit_t *circ, const circpad_machine_spec_t *machine) { + /* If padding is disabled, no machines should match/apply. This has + * the effect of shutting down all machines, and not adding any more. */ + if (circpad_padding_disabled) + return 0; + if (!(circpad_circ_purpose_to_mask(TO_CIRCUIT(circ)->purpose) & machine->conditions.purpose_mask)) return 0;

1 0

[tor/master] Bug 30173: Rate limit padding rate limit log message.
by nickm＠torproject.org 13 May '19

13 May '19

commit 17a164a8275970aed53076ba58296ffc424c3b75 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Apr 17 02:51:48 2019 +0000 Bug 30173: Rate limit padding rate limit log message. Gotta limit to the limit when the limit is reached. --- src/core/or/circuitpadding.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/core/or/circuitpadding.c b/src/core/or/circuitpadding.c index f6385f32e..bf74ecc3f 100644 --- a/src/core/or/circuitpadding.c +++ b/src/core/or/circuitpadding.c @@ -1196,7 +1196,8 @@ circpad_machine_schedule_padding,(circpad_machine_runtime_t *mi)) "Padding machine has reached padding limit on circuit %u", TO_ORIGIN_CIRCUIT(mi->on_circ)->global_identifier); } else { - log_fn(LOG_INFO, LD_CIRC, + static ratelim_t padding_lim = RATELIM_INIT(600); + log_fn_ratelim(&padding_lim,LOG_INFO,LD_CIRC, "Padding machine has reached padding limit on circuit %"PRIu64 ", %d", mi->on_circ->n_chan ? mi->on_circ->n_chan->global_identifier : 0,

1 0

[tor/master] Bug 28693: Provide Torrc option to disable circuit padding.
by nickm＠torproject.org 13 May '19

13 May '19

commit f4064d6ce214b4b79017280a6c9db9b3f945ece1 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Apr 17 05:51:39 2019 +0000 Bug 28693: Provide Torrc option to disable circuit padding. --- doc/tor.1.txt | 8 ++++++++ src/app/config/config.c | 5 +++++ src/app/config/or_options_st.h | 5 +++++ src/core/or/circuitpadding.c | 41 +++++++++++++++++++++++++++++++---------- 4 files changed, 49 insertions(+), 10 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index f99217240..6c125e374 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -955,6 +955,14 @@ The following options are useful only for clients (that is, if this option. This option should be offered via the UI to mobile users for use where bandwidth may be expensive. (Default: 0) +[[CircuitPadding]] **CircuitPadding** **0**|**1**:: + If set to 0, Tor will not pad client circuits with additional cover + traffic. Only clients may set this option. This option should be offered + via the UI to mobile users for use where bandwidth may be expensive. If + set to 1, padding will be negotiated as per the consensus and relay + support (unlike ConnectionPadding, CircuitPadding cannot be force-enabled). + (Default: 1) + [[ExcludeNodes]] **ExcludeNodes** __node__,__node__,__...__:: A list of identity fingerprints, country codes, and address patterns of nodes to avoid when building a circuit. Country codes are diff --git a/src/app/config/config.c b/src/app/config/config.c index 46dc15b06..7ad970625 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -596,6 +596,7 @@ static config_var_t option_vars_[] = { V(ReducedConnectionPadding, BOOL, "0"), V(ConnectionPadding, AUTOBOOL, "auto"), V(RefuseUnknownExits, AUTOBOOL, "auto"), + V(CircuitPadding, BOOL, "1"), V(RejectPlaintextPorts, CSV, ""), V(RelayBandwidthBurst, MEMUNIT, "0"), V(RelayBandwidthRate, MEMUNIT, "0"), @@ -3741,6 +3742,10 @@ options_validate(or_options_t *old_options, or_options_t *options, REJECT("Relays cannot set ReducedConnectionPadding. "); } + if (server_mode(options) && options->CircuitPadding == 0) { + REJECT("Relays cannot set CircuitPadding to 0. "); + } + if (options->BridgeDistribution) { if (!options->BridgeRelay) { REJECT("You set BridgeDistribution, but you didn't set BridgeRelay!"); diff --git a/src/app/config/or_options_st.h b/src/app/config/or_options_st.h index bd707fd19..0fdeb94b4 100644 --- a/src/app/config/or_options_st.h +++ b/src/app/config/or_options_st.h @@ -248,6 +248,11 @@ struct or_options_t { * pad to the server regardless of server support. */ int ConnectionPadding; + /** Boolean: if true, then circuit padding will be negotiated by client + * and server, subject to consenus limits (default). If 0, it will be fully + * disabled. */ + int CircuitPadding; + /** To what authority types do we publish our descriptor? Choices are * "v1", "v2", "v3", "bridge", or "". */ struct smartlist_t *PublishServerDescriptor; diff --git a/src/core/or/circuitpadding.c b/src/core/or/circuitpadding.c index bf74ecc3f..dcd8f645c 100644 --- a/src/core/or/circuitpadding.c +++ b/src/core/or/circuitpadding.c @@ -1100,6 +1100,24 @@ circpad_new_consensus_params(const networkstatus_t *ns) } /** + * Return true if padding is allowed by torrc and consensus. + */ +STATIC bool +circpad_is_padding_allowed(void) +{ + /* If padding has been disabled in the consensus, don't send any more + * padding. Technically the machine should be shut down when the next + * machine condition check happens, but machine checks only happen on + * certain circuit events, and if padding is disabled due to some + * network overload or DoS condition, we really want to stop ASAP. */ + if (circpad_padding_disabled || !get_options()->CircuitPadding) { + return 0; + } + + return 1; +} + +/** * Check this machine against its padding limits, as well as global * consensus limits. * @@ -1117,15 +1135,6 @@ circpad_machine_reached_padding_limit(circpad_machine_runtime_t *mi) { const circpad_machine_spec_t *machine = CIRCPAD_GET_MACHINE(mi); - /* If padding has been disabled in the consensus, don't send any more - * padding. Technically the machine should be shut down when the next - * machine condition check happens, but machine checks only happen on - * certain circuit events, and if padding is disabled due to some - * network overload or DoS condition, we really want to stop ASAP. */ - if (circpad_padding_disabled) { - return 1; - } - /* If machine_padding_pct is non-zero, and we've sent more * than the allowed count of padding cells, then check our * percent limits for this machine. */ @@ -1176,6 +1185,18 @@ circpad_machine_schedule_padding,(circpad_machine_runtime_t *mi)) struct timeval timeout; tor_assert(mi); + /* Don't schedule padding if it is disabled */ + if (!circpad_is_padding_allowed()) { + static ratelim_t padding_lim = RATELIM_INIT(600); + log_fn_ratelim(&padding_lim,LOG_INFO,LD_CIRC, + "Padding has been disabled, but machine still on circuit %"PRIu64 + ", %d", + mi->on_circ->n_chan ? mi->on_circ->n_chan->global_identifier : 0, + mi->on_circ->n_circ_id); + + return CIRCPAD_STATE_UNCHANGED; + } + /* Don't schedule padding if we are currently in dormant mode. */ if (!is_participating_on_network()) { log_info(LD_CIRC, "Not scheduling padding because we are dormant."); @@ -1638,7 +1659,7 @@ circpad_machine_conditions_met(origin_circuit_t *circ, { /* If padding is disabled, no machines should match/apply. This has * the effect of shutting down all machines, and not adding any more. */ - if (circpad_padding_disabled) + if (circpad_padding_disabled || !get_options()->CircuitPadding) return 0; if (!(circpad_circ_purpose_to_mask(TO_CIRCUIT(circ)->purpose)

1 0

[tor/master] Tests for bugs 28683, 30173, and 29203.
by nickm＠torproject.org 13 May '19

13 May '19

commit 42eb02a32730099e0320c7ee8b9fb0035d948bb4 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Apr 17 23:21:54 2019 +0000 Tests for bugs 28683, 30173, and 29203. --- src/core/or/circuitpadding.c | 1 + src/test/test_circuitpadding.c | 157 ++++++++++++++++++++++++++++++++++++++++- src/test/test_options.c | 1 + 3 files changed, 157 insertions(+), 2 deletions(-) diff --git a/src/core/or/circuitpadding.c b/src/core/or/circuitpadding.c index 8d2749906..7094e48d9 100644 --- a/src/core/or/circuitpadding.c +++ b/src/core/or/circuitpadding.c @@ -2220,6 +2220,7 @@ circpad_circ_client_machine_init(void) circ_client_machine->conditions.state_mask = CIRCPAD_CIRC_BUILDING|CIRCPAD_CIRC_OPENED|CIRCPAD_CIRC_HAS_RELAY_EARLY; circ_client_machine->conditions.purpose_mask = CIRCPAD_PURPOSE_ALL; + circ_client_machine->conditions.reduced_padding_ok = 1; circ_client_machine->target_hopnum = 2; circ_client_machine->is_origin_side = 1; diff --git a/src/test/test_circuitpadding.c b/src/test/test_circuitpadding.c index 3289c866c..dd84c4aff 100644 --- a/src/test/test_circuitpadding.c +++ b/src/test/test_circuitpadding.c @@ -1683,8 +1683,11 @@ static void helper_create_conditional_machines(void) { circpad_machine_spec_t *add = helper_create_conditional_machine(); - origin_padding_machines = smartlist_new(); - relay_padding_machines = smartlist_new(); + + if (!origin_padding_machines) + origin_padding_machines = smartlist_new(); + if (!relay_padding_machines) + relay_padding_machines = smartlist_new(); add->machine_num = 2; add->is_origin_side = 1; @@ -2396,6 +2399,155 @@ test_circuitpadding_global_rate_limiting(void *arg) smartlist_free(vote1.net_params); } +/* Test reduced and disabled padding */ +static void +test_circuitpadding_reduce_disable(void *arg) +{ + (void) arg; + int64_t actual_mocked_monotime_start; + + MOCK(circuitmux_attach_circuit, circuitmux_attach_circuit_mock); + + nodes_init(); + dummy_channel.cmux = circuitmux_alloc(); + relay_side = (circuit_t *)new_fake_orcirc(&dummy_channel, + &dummy_channel); + client_side = (circuit_t *)origin_circuit_new(); + relay_side->purpose = CIRCUIT_PURPOSE_OR; + client_side->purpose = CIRCUIT_PURPOSE_C_GENERAL; + + circpad_machines_init(); + helper_create_conditional_machines(); + + monotime_init(); + monotime_enable_test_mocking(); + actual_mocked_monotime_start = MONOTIME_MOCK_START; + monotime_set_mock_time_nsec(actual_mocked_monotime_start); + monotime_coarse_set_mock_time_nsec(actual_mocked_monotime_start); + curr_mocked_time = actual_mocked_monotime_start; + timers_initialize(); + + /* This is needed so that we are not considered to be dormant */ + note_user_activity(20); + + MOCK(circuit_package_relay_cell, + circuit_package_relay_cell_mock); + MOCK(node_get_by_id, + node_get_by_id_mock); + + /* Simulate extend. This should result in the original machine getting + * added, since the circuit is not built */ + simulate_single_hop_extend(client_side, relay_side, 1); + simulate_single_hop_extend(client_side, relay_side, 1); + + /* Verify that machine #2 is added */ + tt_int_op(client_side->padding_machine[0]->machine_num, OP_EQ, 2); + tt_int_op(relay_side->padding_machine[0]->machine_num, OP_EQ, 2); + + /* Deliver a padding cell to the client, to trigger burst state */ + circpad_cell_event_padding_sent(client_side); + + /* This should have trigger length shutdown condition on client.. */ + tt_ptr_op(client_side->padding_info[0], OP_EQ, NULL); + tt_ptr_op(client_side->padding_machine[0], OP_EQ, NULL); + + /* Verify machine is gone from both sides */ + tt_ptr_op(relay_side->padding_info[0], OP_EQ, NULL); + tt_ptr_op(relay_side->padding_machine[0], OP_EQ, NULL); + + /* Now test the reduced padding machine by setting up the consensus */ + networkstatus_t vote1; + vote1.net_params = smartlist_new(); + smartlist_split_string(vote1.net_params, + "circpad_padding_reduced=1", NULL, 0, 0); + + /* Register reduced padding machine with the padding subsystem */ + circpad_new_consensus_params(&vote1); + + simulate_single_hop_extend(client_side, relay_side, 1); + + /* Verify that machine #0 is added */ + tt_int_op(client_side->padding_machine[0]->machine_num, OP_EQ, 0); + tt_int_op(relay_side->padding_machine[0]->machine_num, OP_EQ, 0); + + tt_int_op( + circpad_machine_reached_padding_limit(client_side->padding_info[0]), + OP_EQ, 0); + tt_int_op( + circpad_machine_reached_padding_limit(relay_side->padding_info[0]), + OP_EQ, 0); + + /* Test that machines get torn down when padding is disabled */ + SMARTLIST_FOREACH(vote1.net_params, char *, cp, tor_free(cp)); + smartlist_free(vote1.net_params); + vote1.net_params = smartlist_new(); + smartlist_split_string(vote1.net_params, + "circpad_padding_disabled=1", NULL, 0, 0); + + /* Register reduced padding machine with the padding subsystem */ + circpad_new_consensus_params(&vote1); + + tt_int_op( + circpad_machine_schedule_padding(client_side->padding_info[0]), + OP_EQ, CIRCPAD_STATE_UNCHANGED); + tt_int_op( + circpad_machine_schedule_padding(relay_side->padding_info[0]), + OP_EQ, CIRCPAD_STATE_UNCHANGED); + + /* Signal that circuit is built: this event causes us to re-evaluate + * machine conditions (which don't apply because padding is disabled). */ + circpad_machine_event_circ_built(TO_ORIGIN_CIRCUIT(client_side)); + + tt_ptr_op(client_side->padding_info[0], OP_EQ, NULL); + tt_ptr_op(client_side->padding_machine[0], OP_EQ, NULL); + tt_ptr_op(relay_side->padding_info[0], OP_EQ, NULL); + tt_ptr_op(relay_side->padding_machine[0], OP_EQ, NULL); + + SMARTLIST_FOREACH(vote1.net_params, char *, cp, tor_free(cp)); + smartlist_free(vote1.net_params); + vote1.net_params = NULL; + circpad_new_consensus_params(&vote1); + + get_options_mutable()->ReducedCircuitPadding = 1; + + simulate_single_hop_extend(client_side, relay_side, 1); + + /* Verify that machine #0 is added */ + tt_int_op(client_side->padding_machine[0]->machine_num, OP_EQ, 0); + tt_int_op(relay_side->padding_machine[0]->machine_num, OP_EQ, 0); + + tt_int_op( + circpad_machine_reached_padding_limit(client_side->padding_info[0]), + OP_EQ, 0); + tt_int_op( + circpad_machine_reached_padding_limit(relay_side->padding_info[0]), + OP_EQ, 0); + + get_options_mutable()->CircuitPadding = 0; + + tt_int_op( + circpad_machine_schedule_padding(client_side->padding_info[0]), + OP_EQ, CIRCPAD_STATE_UNCHANGED); + tt_int_op( + circpad_machine_schedule_padding(relay_side->padding_info[0]), + OP_EQ, CIRCPAD_STATE_UNCHANGED); + + /* Signal that circuit is built: this event causes us to re-evaluate + * machine conditions (which don't apply because padding is disabled). */ + + circpad_machine_event_circ_built(TO_ORIGIN_CIRCUIT(client_side)); + + tt_ptr_op(client_side->padding_info[0], OP_EQ, NULL); + tt_ptr_op(client_side->padding_machine[0], OP_EQ, NULL); + tt_ptr_op(relay_side->padding_info[0], OP_EQ, NULL); + tt_ptr_op(relay_side->padding_machine[0], OP_EQ, NULL); + + done: + free_fake_orcirc(relay_side); + circuitmux_detach_all_circuits(dummy_channel.cmux, NULL); + circuitmux_free(dummy_channel.cmux); +} + #define TEST_CIRCUITPADDING(name, flags) \ { #name, test_##name, (flags), NULL, NULL } @@ -2410,6 +2562,7 @@ struct testcase_t circuitpadding_tests[] = { TEST_CIRCUITPADDING(circuitpadding_sample_distribution, TT_FORK), TEST_CIRCUITPADDING(circuitpadding_machine_rate_limiting, TT_FORK), TEST_CIRCUITPADDING(circuitpadding_global_rate_limiting, TT_FORK), + TEST_CIRCUITPADDING(circuitpadding_reduce_disable, TT_FORK), TEST_CIRCUITPADDING(circuitpadding_token_removal_lower, TT_FORK), TEST_CIRCUITPADDING(circuitpadding_token_removal_higher, TT_FORK), TEST_CIRCUITPADDING(circuitpadding_closest_token_removal, TT_FORK), diff --git a/src/test/test_options.c b/src/test/test_options.c index f12e6b676..396be6b18 100644 --- a/src/test/test_options.c +++ b/src/test/test_options.c @@ -430,6 +430,7 @@ get_options_test_data(const char *conf) // Being kinda lame and just fixing the immedate breakage for now.. result->opt->ConnectionPadding = -1; // default must be "auto" result->opt->DormantClientTimeout = 1800; // must be over 600. + result->opt->CircuitPadding = 1; // default must be "1" rv = config_get_lines(conf, &cl, 1); tt_int_op(rv, OP_EQ, 0);

1 0

[tor/master] The practracker beatings will continue until the functions get smaller.
by nickm＠torproject.org 13 May '19

13 May '19

commit 507df74b319f37462d1540495f04b9b0838cb3a3 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Thu Apr 18 18:14:31 2019 +0000 The practracker beatings will continue until the functions get smaller. --- scripts/maint/practracker/exceptions.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/maint/practracker/exceptions.txt b/scripts/maint/practracker/exceptions.txt index 7d03bf27d..d51e3edb5 100644 --- a/scripts/maint/practracker/exceptions.txt +++ b/scripts/maint/practracker/exceptions.txt @@ -29,12 +29,12 @@ # # Remember: It is better to fix the problem than to add a new exception! -problem file-size /src/app/config/config.c 8491 +problem file-size /src/app/config/config.c 8501 problem include-count /src/app/config/config.c 86 problem function-size /src/app/config/config.c:options_act_reversible() 296 problem function-size /src/app/config/config.c:options_act() 588 problem function-size /src/app/config/config.c:resolve_my_address() 192 -problem function-size /src/app/config/config.c:options_validate() 1207 +problem function-size /src/app/config/config.c:options_validate() 1215 problem function-size /src/app/config/config.c:options_init_from_torrc() 202 problem function-size /src/app/config/config.c:options_init_from_string() 173 problem function-size /src/app/config/config.c:options_init_logs() 146 @@ -187,7 +187,7 @@ problem function-size /src/feature/dirclient/dirclient.c:handle_response_fetch_c problem function-size /src/feature/dircommon/consdiff.c:gen_ed_diff() 204 problem function-size /src/feature/dircommon/consdiff.c:apply_ed_diff() 159 problem function-size /src/feature/dirparse/authcert_parse.c:authority_cert_parse_from_string() 182 -problem function-size /src/feature/dirparse/microdesc_parse.c:microdescs_parse_from_string() 154 +problem function-size /src/feature/dirparse/microdesc_parse.c:microdescs_parse_from_string() 169 problem function-size /src/feature/dirparse/ns_parse.c:routerstatus_parse_entry_from_string() 286 problem function-size /src/feature/dirparse/ns_parse.c:networkstatus_verify_bw_weights() 389 problem function-size /src/feature/dirparse/ns_parse.c:networkstatus_parse_vote_from_string() 638

1 0

[tor/master] Changes file for bugs28693+30173+29203.
by nickm＠torproject.org 13 May '19

13 May '19

commit 0d275ec592761390c5ee05b2acdf5ae193c2a0ca Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed Apr 17 23:37:22 2019 +0000 Changes file for bugs28693+30173+29203. --- changes/bugs28693+30173+29203 | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/changes/bugs28693+30173+29203 b/changes/bugs28693+30173+29203 new file mode 100644 index 000000000..9faa6279b --- /dev/null +++ b/changes/bugs28693+30173+29203 @@ -0,0 +1,12 @@ + o Minor bugfixes (circuit padding): + - Add a torrc option to disable circuit padding. Fixes bug 28693; bugfix + on 0.4.0.1-alpha. + o Minor bugfixes (circuit padding): + - Provide consensus parameter to fully disable circuit padding, to be used + in emergency network overload situations. Fixes bug 30173; bugfix on + 0.4.0.1-alpha. + o Minor bugfixes (circuit padding): + - Allow circuit padding machines to specify that they do not contribute + much overhead, and provide consensus flags and torrc options to force + clients to only use low overhead machines. Fixes bug 29203; bugfix on + 0.4.0.1-alpha.

1 0

[tor/master] Merge branch 'bug28683_30173_29203_squashed'
by nickm＠torproject.org 13 May '19

13 May '19

commit 9ad2eb8f73b70292e36511424d676b223d4cdff0 Merge: c6523a639 507df74b3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 13 14:33:31 2019 -0400 Merge branch 'bug28683_30173_29203_squashed' changes/bugs28693+30173+29203 | 12 +++ doc/tor.1.txt | 14 +++ scripts/maint/practracker/exceptions.txt | 6 +- src/app/config/config.c | 10 ++ src/app/config/or_options_st.h | 11 +++ src/core/or/circuitpadding.c | 59 +++++++++++- src/core/or/circuitpadding.h | 11 +++ src/test/test_circuitpadding.c | 157 ++++++++++++++++++++++++++++++- src/test/test_options.c | 1 + 9 files changed, 274 insertions(+), 7 deletions(-) diff --cc scripts/maint/practracker/exceptions.txt index 7ed90482c,d51e3edb5..ee4f421bd --- a/scripts/maint/practracker/exceptions.txt +++ b/scripts/maint/practracker/exceptions.txt @@@ -29,12 -29,12 +29,12 @@@ # # Remember: It is better to fix the problem than to add a new exception! - problem file-size /src/app/config/config.c 8494 - problem include-count /src/app/config/config.c 87 -problem file-size /src/app/config/config.c 8501 -problem include-count /src/app/config/config.c 86 ++problem file-size /src/app/config/config.c 8510 ++problem include-count /src/app/config/config.c 88 problem function-size /src/app/config/config.c:options_act_reversible() 296 problem function-size /src/app/config/config.c:options_act() 588 problem function-size /src/app/config/config.c:resolve_my_address() 192 - problem function-size /src/app/config/config.c:options_validate() 1209 -problem function-size /src/app/config/config.c:options_validate() 1215 ++problem function-size /src/app/config/config.c:options_validate() 1220 problem function-size /src/app/config/config.c:options_init_from_torrc() 202 problem function-size /src/app/config/config.c:options_init_from_string() 173 problem function-size /src/app/config/config.c:options_init_logs() 146

1 0

[tor/master] Fix a compilation warning: function does not have to be STATIC.
by nickm＠torproject.org 13 May '19

13 May '19

commit 5d950f3edd7f9c46f0149327c20c01a5f1cc40e2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 13 14:34:16 2019 -0400 Fix a compilation warning: function does not have to be STATIC. --- src/core/or/circuitpadding.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/or/circuitpadding.c b/src/core/or/circuitpadding.c index f21cf113c..58e8e053c 100644 --- a/src/core/or/circuitpadding.c +++ b/src/core/or/circuitpadding.c @@ -1107,7 +1107,7 @@ circpad_new_consensus_params(const networkstatus_t *ns) /** * Return true if padding is allowed by torrc and consensus. */ -STATIC bool +static bool circpad_is_padding_allowed(void) { /* If padding has been disabled in the consensus, don't send any more

1 0

[tor/master] Bug 29231: Report correct padding write totals and enabled totals.
by nickm＠torproject.org 13 May '19

13 May '19

commit d0fb74c902e19bdec6e3a84a9ec5c70dccbf88d0 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Wed May 1 21:00:26 2019 +0000 Bug 29231: Report correct padding write totals and enabled totals. --- src/core/or/channel.c | 11 +++++++++++ src/core/or/channeltls.c | 4 ++-- src/core/or/circuitpadding.c | 2 +- src/core/or/connection_or.c | 5 ++++- src/core/or/relay.c | 2 +- src/core/or/relay.h | 1 + 6 files changed, 20 insertions(+), 5 deletions(-) diff --git a/src/core/or/channel.c b/src/core/or/channel.c index fd7bf6278..0e190809b 100644 --- a/src/core/or/channel.c +++ b/src/core/or/channel.c @@ -1418,6 +1418,7 @@ write_packed_cell(channel_t *chan, packed_cell_t *cell) { int ret = -1; size_t cell_bytes; + uint8_t command = packed_cell_get_command(cell, chan->wide_circ_ids); tor_assert(chan); tor_assert(cell); @@ -1452,6 +1453,16 @@ write_packed_cell(channel_t *chan, packed_cell_t *cell) /* Successfully sent the cell. */ ret = 0; + /* Update padding statistics for the packed codepath.. */ + rep_hist_padding_count_write(PADDING_TYPE_TOTAL); + if (command == CELL_PADDING) + rep_hist_padding_count_write(PADDING_TYPE_CELL); + if (chan->padding_enabled) { + rep_hist_padding_count_write(PADDING_TYPE_ENABLED_TOTAL); + if (command == CELL_PADDING) + rep_hist_padding_count_write(PADDING_TYPE_ENABLED_CELL); + } + done: return ret; } diff --git a/src/core/or/channeltls.c b/src/core/or/channeltls.c index f552b2077..96d50f8a5 100644 --- a/src/core/or/channeltls.c +++ b/src/core/or/channeltls.c @@ -1094,13 +1094,13 @@ channel_tls_handle_cell(cell_t *cell, or_connection_t *conn) entry_guards_note_internet_connectivity(get_guard_selection_info()); rep_hist_padding_count_read(PADDING_TYPE_TOTAL); - if (TLS_CHAN_TO_BASE(chan)->currently_padding) + if (TLS_CHAN_TO_BASE(chan)->padding_enabled) rep_hist_padding_count_read(PADDING_TYPE_ENABLED_TOTAL); switch (cell->command) { case CELL_PADDING: rep_hist_padding_count_read(PADDING_TYPE_CELL); - if (TLS_CHAN_TO_BASE(chan)->currently_padding) + if (TLS_CHAN_TO_BASE(chan)->padding_enabled) rep_hist_padding_count_read(PADDING_TYPE_ENABLED_CELL); ++stats_n_padding_cells_processed; /* do nothing */ diff --git a/src/core/or/circuitpadding.c b/src/core/or/circuitpadding.c index d30edf9db..9253c9e28 100644 --- a/src/core/or/circuitpadding.c +++ b/src/core/or/circuitpadding.c @@ -1020,6 +1020,7 @@ circpad_send_padding_cell_for_callback(circpad_machine_runtime_t *mi) "Callback: Sending padding to non-origin circuit."); relay_send_command_from_edge(0, mi->on_circ, RELAY_COMMAND_DROP, NULL, 0, NULL); + rep_hist_padding_count_write(PADDING_TYPE_DROP); } else { static ratelim_t cell_lim = RATELIM_INIT(600); log_fn_ratelim(&cell_lim,LOG_NOTICE,LD_CIRC, @@ -1028,7 +1029,6 @@ circpad_send_padding_cell_for_callback(circpad_machine_runtime_t *mi) } } - rep_hist_padding_count_write(PADDING_TYPE_DROP); /* This is a padding cell sent from the client or from the middle node, * (because it's invoked from circuitpadding.c) */ circpad_cell_event_padding_sent(circ); diff --git a/src/core/or/connection_or.c b/src/core/or/connection_or.c index e9b4b2195..830e09fd5 100644 --- a/src/core/or/connection_or.c +++ b/src/core/or/connection_or.c @@ -2308,6 +2308,8 @@ connection_or_write_cell_to_buf(const cell_t *cell, or_connection_t *conn) cell_pack(&networkcell, cell, conn->wide_circ_ids); + /* We need to count padding cells from this non-packed code path + * since they are sent via chan->write_cell() (which is not packed) */ rep_hist_padding_count_write(PADDING_TYPE_TOTAL); if (cell->command == CELL_PADDING) rep_hist_padding_count_write(PADDING_TYPE_CELL); @@ -2318,7 +2320,7 @@ connection_or_write_cell_to_buf(const cell_t *cell, or_connection_t *conn) if (conn->chan) { channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan)); - if (TLS_CHAN_TO_BASE(conn->chan)->currently_padding) { + if (TLS_CHAN_TO_BASE(conn->chan)->padding_enabled) { rep_hist_padding_count_write(PADDING_TYPE_ENABLED_TOTAL); if (cell->command == CELL_PADDING) rep_hist_padding_count_write(PADDING_TYPE_ENABLED_CELL); @@ -2348,6 +2350,7 @@ connection_or_write_var_cell_to_buf,(const var_cell_t *cell, if (conn->base_.state == OR_CONN_STATE_OR_HANDSHAKING_V3) or_handshake_state_record_var_cell(conn, conn->handshake_state, cell, 0); + rep_hist_padding_count_write(PADDING_TYPE_TOTAL); /* Touch the channel's active timestamp if there is one */ if (conn->chan) channel_timestamp_active(TLS_CHAN_TO_BASE(conn->chan)); diff --git a/src/core/or/relay.c b/src/core/or/relay.c index a166904a5..59b580c14 100644 --- a/src/core/or/relay.c +++ b/src/core/or/relay.c @@ -2770,7 +2770,7 @@ set_streams_blocked_on_circ(circuit_t *circ, channel_t *chan, } /** Extract the command from a packed cell. */ -static uint8_t +uint8_t packed_cell_get_command(const packed_cell_t *cell, int wide_circ_ids) { if (wide_circ_ids) { diff --git a/src/core/or/relay.h b/src/core/or/relay.h index ea1b358ff..126f3f868 100644 --- a/src/core/or/relay.h +++ b/src/core/or/relay.h @@ -95,6 +95,7 @@ const uint8_t *decode_address_from_payload(tor_addr_t *addr_out, void circuit_clear_cell_queue(circuit_t *circ, channel_t *chan); circid_t packed_cell_get_circid(const packed_cell_t *cell, int wide_circ_ids); +uint8_t packed_cell_get_command(const packed_cell_t *cell, int wide_circ_ids); #ifdef RELAY_PRIVATE STATIC int connected_cell_parse(const relay_header_t *rh, const cell_t *cell,

1 0