August 2019 - tor-commits - lists.torproject.org

[tor/master] Merge branch 'doc31089_035' into doc31089_040
by asn＠torproject.org 19 Aug '19

19 Aug '19

commit c3d6c75945cd3955a7c9960d5a726dd9579e425d Merge: 0a661cde1 25f39bdfc Author: teor <teor(a)torproject.org> Date: Thu Aug 8 23:07:17 2019 +1000 Merge branch 'doc31089_035' into doc31089_040 changes/doc31089 | 4 + contrib/operator-tools/tor-exit-notice.html | 177 +++++++++++++++++++++++++++- 2 files changed, 176 insertions(+), 5 deletions(-)

1 0

[tor/master] Merge branch 'doc31089_041' into doc31089_master
by asn＠torproject.org 19 Aug '19

19 Aug '19

commit 320f5068a07ed3dfe204d247245a62549fe976c9 Merge: 0acfd7dce fcb4d273f Author: teor <teor(a)torproject.org> Date: Thu Aug 8 23:08:19 2019 +1000 Merge branch 'doc31089_041' into doc31089_master Delete outdated comment about serving the image, which had been modified earlier in the master branch. changes/doc31089 | 4 + contrib/operator-tools/tor-exit-notice.html | 179 ++++++++++++++++++++++++++-- 2 files changed, 176 insertions(+), 7 deletions(-)

1 0

[tor/master] Merge branch 'tor-github/pr/1217'
by asn＠torproject.org 19 Aug '19

19 Aug '19

commit 60adebc4996797de4c179f489d840af9feff60e2 Merge: 4185ef29f 320f5068a Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Aug 19 18:07:48 2019 +0300 Merge branch 'tor-github/pr/1217' changes/doc31089 | 4 + contrib/operator-tools/tor-exit-notice.html | 179 ++++++++++++++++++++++++++-- 2 files changed, 176 insertions(+), 7 deletions(-)

1 0

[tor/master] hs-v3: Disallow single hop client to post/get a descriptor
by asn＠torproject.org 19 Aug '19

19 Aug '19

commit ef2123c7c7bbf0cb6ec2a5528bae082d51ea8962 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Jun 19 12:02:41 2019 -0400 hs-v3: Disallow single hop client to post/get a descriptor Closes #24964 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket24964 | 4 +++ src/feature/dircache/dircache.c | 13 ++++---- src/feature/dircommon/directory.c | 69 +++++++++++++++++++++++++++++++++++++++ src/feature/dircommon/directory.h | 1 + src/test/test_hs_cache.c | 23 +++++++++++-- 5 files changed, 102 insertions(+), 8 deletions(-) diff --git a/changes/ticket24964 b/changes/ticket24964 new file mode 100644 index 000000000..171c86eb1 --- /dev/null +++ b/changes/ticket24964 @@ -0,0 +1,4 @@ + o Minor feature (onion service v3): + - Do not allow single hop client to fetch or post an HS descriptor from an + HSDir. Closes ticket 24964; + diff --git a/src/feature/dircache/dircache.c b/src/feature/dircache/dircache.c index 1b36f716f..7c6af3582 100644 --- a/src/feature/dircache/dircache.c +++ b/src/feature/dircache/dircache.c @@ -1390,8 +1390,9 @@ handle_get_hs_descriptor_v3(dir_connection_t *conn, const char *pubkey_str = NULL; const char *url = args->url; - /* Reject unencrypted dir connections */ - if (!connection_dir_is_encrypted(conn)) { + /* Reject non anonymous dir connections (which also tests if encrypted). We + * do not allow single hop clients to query an HSDir. */ + if (!connection_dir_is_anonymous(conn)) { write_short_http_response(conn, 404, "Not found"); goto done; } @@ -1632,10 +1633,10 @@ directory_handle_command_post,(dir_connection_t *conn, const char *headers, goto done; } - /* Handle HS descriptor publish request. */ - /* XXX: This should be disabled with a consensus param until we want to - * the prop224 be deployed and thus use. */ - if (connection_dir_is_encrypted(conn) && !strcmpstart(url, "/tor/hs/")) { + /* Handle HS descriptor publish request. We force an anonymous connection + * (which also tests for encrypted). We do not allow single-hop client to + * post a descriptor onto an HSDir. */ + if (connection_dir_is_anonymous(conn) && !strcmpstart(url, "/tor/hs/")) { const char *msg = "HS descriptor stored successfully."; /* We most probably have a publish request for an HS descriptor. */ diff --git a/src/feature/dircommon/directory.c b/src/feature/dircommon/directory.c index 9e6f72e9a..b3db0aa10 100644 --- a/src/feature/dircommon/directory.c +++ b/src/feature/dircommon/directory.c @@ -7,6 +7,10 @@ #include "app/config/config.h" #include "core/mainloop/connection.h" +#include "core/or/circuitlist.h" +#include "core/or/connection_edge.h" +#include "core/or/connection_or.h" +#include "core/or/channeltls.h" #include "feature/dircache/dircache.h" #include "feature/dircache/dirserv.h" #include "feature/dirclient/dirclient.h" @@ -15,6 +19,10 @@ #include "feature/stats/geoip_stats.h" #include "lib/compress/compress.h" +#include "core/or/circuit_st.h" +#include "core/or/or_circuit_st.h" +#include "core/or/edge_connection_st.h" +#include "core/or/or_connection_st.h" #include "feature/dircommon/dir_connection_st.h" #include "feature/nodelist/routerinfo_st.h" @@ -167,6 +175,67 @@ connection_dir_is_encrypted(const dir_connection_t *conn) return TO_CONN(conn)->linked; } +/** Return true iff the given directory connection dir_conn is + * anonymous, that is, it is on a circuit via a public relay and not directly + * from a client or bridge. + * + * For client circuits via relays: true for 2-hop+ paths. + * For client circuits via bridges: true for 3-hop+ paths. + * + * This first test if the connection is encrypted since it is a strong + * requirement for anonymity. */ +bool +connection_dir_is_anonymous(const dir_connection_t *dir_conn) +{ + const connection_t *conn, *linked_conn; + const edge_connection_t *edge_conn; + const circuit_t *circ; + + tor_assert(dir_conn); + + if (!connection_dir_is_encrypted(dir_conn)) { + return false; + } + + /* + * Buckle up, we'll do a deep dive into the connection in order to get the + * final connection channel of that connection in order to figure out if + * this is a client or relay link. + * + * We go: dir_conn -> linked_conn -> edge_conn -> on_circuit -> p_chan. + */ + + conn = TO_CONN(dir_conn); + linked_conn = conn->linked_conn; + + /* The dir connection should be connected to an edge connection. It can not + * be closed or marked for close. */ + if (linked_conn == NULL || linked_conn->magic != EDGE_CONNECTION_MAGIC || + conn->linked_conn_is_closed || conn->linked_conn->marked_for_close) { + log_info(LD_DIR, "Rejected HSDir request: not linked to edge"); + return false; + } + + edge_conn = TO_EDGE_CONN((connection_t *) linked_conn); + circ = edge_conn->on_circuit; + + /* Can't be a circuit we initiated and without a circuit, no channel. */ + if (circ == NULL || CIRCUIT_IS_ORIGIN(circ)) { + log_info(LD_DIR, "Rejected HSDir request: not on OR circuit"); + return false; + } + + /* Get the previous channel to learn if it is a client or relay link. */ + if (BUG(CONST_TO_OR_CIRCUIT(circ)->p_chan == NULL)) { + log_info(LD_DIR, "Rejected HSDir request: no p_chan"); + return false; + } + + /* Will be true if the channel is an unauthenticated peer which is only true + * for clients and bridges. */ + return !channel_is_client(CONST_TO_OR_CIRCUIT(circ)->p_chan); +} + /** Parse an HTTP request line at the start of a headers string. On failure, * return -1. On success, set *command_out to a copy of the HTTP * command ("get", "post", etc), set *url_out to a copy of the URL, and diff --git a/src/feature/dircommon/directory.h b/src/feature/dircommon/directory.h index ba3f8c1b0..4fc743ad3 100644 --- a/src/feature/dircommon/directory.h +++ b/src/feature/dircommon/directory.h @@ -94,6 +94,7 @@ int parse_http_command(const char *headers, char *http_get_header(const char *headers, const char *which); int connection_dir_is_encrypted(const dir_connection_t *conn); +bool connection_dir_is_anonymous(const dir_connection_t *conn); int connection_dir_reached_eof(dir_connection_t *conn); int connection_dir_process_inbuf(dir_connection_t *conn); int connection_dir_finished_flushing(dir_connection_t *conn); diff --git a/src/test/test_hs_cache.c b/src/test/test_hs_cache.c index d71f8b6b1..86ac7e7fb 100644 --- a/src/test/test_hs_cache.c +++ b/src/test/test_hs_cache.c @@ -10,6 +10,7 @@ #define DIRCACHE_PRIVATE #define DIRCLIENT_PRIVATE #define HS_CACHE_PRIVATE +#define TOR_CHANNEL_INTERNAL_ #include "trunnel/ed25519_cert.h" #include "feature/hs/hs_cache.h" @@ -20,7 +21,12 @@ #include "core/mainloop/connection.h" #include "core/proto/proto_http.h" #include "lib/crypt_ops/crypto_format.h" +#include "core/or/circuitlist.h" +#include "core/or/channel.h" +#include "core/or/edge_connection_st.h" +#include "core/or/or_circuit_st.h" +#include "core/or/or_connection_st.h" #include "feature/dircommon/dir_connection_st.h" #include "feature/nodelist/networkstatus_st.h" @@ -232,6 +238,8 @@ helper_fetch_desc_from_hsdir(const ed25519_public_key_t *blinded_key) /* The dir conn we are going to simulate */ dir_connection_t *conn = NULL; + edge_connection_t *edge_conn = NULL; + or_circuit_t *or_circ = NULL; /* First extract the blinded public key that we are going to use in our query, and then build the actual query string. */ @@ -245,8 +253,16 @@ helper_fetch_desc_from_hsdir(const ed25519_public_key_t *blinded_key) /* Simulate an HTTP GET request to the HSDir */ conn = dir_connection_new(AF_INET); tt_assert(conn); + TO_CONN(conn)->linked = 1; /* Signal that it is encrypted. */ tor_addr_from_ipv4h(&conn->base_.addr, 0x7f000001); - TO_CONN(conn)->linked = 1;/* Pretend the conn is encrypted :) */ + + /* Pretend this conn is anonymous. */ + edge_conn = edge_connection_new(CONN_TYPE_EXIT, AF_INET); + TO_CONN(conn)->linked_conn = TO_CONN(edge_conn); + or_circ = or_circuit_new(0, NULL); + or_circ->p_chan = tor_malloc_zero(sizeof(channel_t)); + edge_conn->on_circuit = TO_CIRCUIT(or_circ); + retval = directory_handle_command_get(conn, hsdir_query_str, NULL, 0); tt_int_op(retval, OP_EQ, 0); @@ -263,8 +279,11 @@ helper_fetch_desc_from_hsdir(const ed25519_public_key_t *blinded_key) done: tor_free(hsdir_query_str); - if (conn) + if (conn) { + tor_free(or_circ->p_chan); + connection_free_minimal(TO_CONN(conn)->linked_conn); connection_free_minimal(TO_CONN(conn)); + } return received_desc; }

1 0

[tor/master] Merge branch 'tor-github/pr/1122'
by asn＠torproject.org 19 Aug '19

19 Aug '19

commit 4185ef29fd637b4ca4aefffb4d50146acab395c3 Merge: af7cf7d5c ef2123c7c Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Aug 19 18:06:05 2019 +0300 Merge branch 'tor-github/pr/1122' changes/ticket24964 | 4 +++ src/feature/dircache/dircache.c | 13 ++++---- src/feature/dircommon/directory.c | 69 +++++++++++++++++++++++++++++++++++++++ src/feature/dircommon/directory.h | 1 + src/test/test_hs_cache.c | 23 +++++++++++-- 5 files changed, 102 insertions(+), 8 deletions(-)

1 0

[tor/master] Merge branch 'tor-github/pr/1233'
by asn＠torproject.org 19 Aug '19

19 Aug '19

commit af7cf7d5c103e649bdd0b58a34ee83cddcbb1b99 Merge: dfc8c0b53 e87e34099 Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Aug 19 18:05:22 2019 +0300 Merge branch 'tor-github/pr/1233' doc/tor.1.txt | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)

1 0

[tor/master] Fix typos in HiddenServiceExportCircuitID
by asn＠torproject.org 19 Aug '19

19 Aug '19

commit e87e34099c00b97740557058bab907a12e3cc7af Author: teor <teor(a)torproject.org> Date: Thu Aug 15 18:58:10 2019 +1000 Fix typos in HiddenServiceExportCircuitID Closes bug 31418. --- doc/tor.1.txt | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index f357fa333..362c40990 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2973,7 +2973,7 @@ The following options are used to configure a hidden service. [[HiddenServiceExportCircuitID]] **HiddenServiceExportCircuitID** __protocol__:: The onion service will use the given protocol to expose the global circuit - identifier of each inbound client circuit via the selected protocol. The only + identifier of each inbound client circuit. The only protocol supported right now \'haproxy'. This option is only for v3 services. (Default: none) + + @@ -2990,12 +2990,12 @@ The following options are used to configure a hidden service. + global_circuit_id = (0xAA << 24) + (0xBB << 16) + (0xCC << 8) + 0xDD; + + - In the case above, where the last 32-bit is 0xffffffff, the global circuit + In the case above, where the last 32-bits are 0xffffffff, the global circuit identifier would be 4294967295. You can use this value together with Tor's - control port where it is possible to terminate a circuit given the global - circuit identifier. For more information about this see controls-spec.txt. + + control port to terminate particular circuits using their global + circuit identifiers. For more information about this see control-spec.txt. + + - The HAProxy version 1 proxy protocol is described in detail at + The HAProxy version 1 protocol is described in detail at https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt [[HiddenServiceMaxStreams]] **HiddenServiceMaxStreams** __N__::

1 0

[tor/master] test_token_bucket: negate after casting to signed type.
by asn＠torproject.org 19 Aug '19

19 Aug '19

commit 484b6540480ee4fdbc7a105242c897cca6d9d8eb Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Aug 6 11:42:04 2019 -0400 test_token_bucket: negate after casting to signed type. Previously we tried multiplying by -1 before casting to int32_t, which would cause us to cast the -1 to an unsigned before we multiplied. This gave us compiler warnings on windows. Fixes bug 31353; bug not in any released Tor. --- src/test/test_token_bucket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/test_token_bucket.c b/src/test/test_token_bucket.c index d3ce59138..31670718d 100644 --- a/src/test/test_token_bucket.c +++ b/src/test/test_token_bucket.c @@ -93,7 +93,7 @@ test_token_bucket_ctr_dec(void *arg) /* Keep underflowing shouldn't flag the bucket as empty. */ tt_uint_op(false, OP_EQ, token_bucket_ctr_dec(&tb, BURST)); - tt_int_op(tb.counter.bucket, OP_EQ, (int32_t) ((BURST + 1) * -1)); + tt_int_op(tb.counter.bucket, OP_EQ, - (int32_t) (BURST + 1)); done: ;

1 0

[tor/master] Merge branch 'tor-github/pr/1214'
by asn＠torproject.org 19 Aug '19

19 Aug '19

commit dfc8c0b536aedc47f965efd47f180aaf6f5023e1 Merge: 19e19c1fa 484b65404 Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Aug 19 18:04:35 2019 +0300 Merge branch 'tor-github/pr/1214' src/test/test_token_bucket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[tor/master] Coverity: fix test issues with always-present 'service' var.
by asn＠torproject.org 19 Aug '19

19 Aug '19

commit 5fa2b322005d1860d39e420cb6d3ed25f5073389 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 28 12:24:26 2019 -0400 Coverity: fix test issues with always-present 'service' var. Coverity is worried that we check "service" at the end of these test functions, since it doesn't see any way to reach the cleanup code without having first dereferenced the variable. Removing the check would be unwise in this case: instead we add a tt_assert check before using "service" so that coverity thinks that the check is doing something useful. Bugfix on 0.3.2.1-alpha. --- src/test/test_hs_common.c | 1 + src/test/test_hs_service.c | 1 + 2 files changed, 2 insertions(+) diff --git a/src/test/test_hs_common.c b/src/test/test_hs_common.c index abded6021..de3f7e04f 100644 --- a/src/test/test_hs_common.c +++ b/src/test/test_hs_common.c @@ -502,6 +502,7 @@ test_desc_reupload_logic(void *arg) pubkey_hex, strlen(pubkey_hex)); hs_build_address(&pubkey, HS_VERSION_THREE, onion_addr); service = tor_malloc_zero(sizeof(hs_service_t)); + tt_assert(service); memcpy(service->onion_address, onion_addr, sizeof(service->onion_address)); ed25519_secret_key_generate(&service->keys.identity_sk, 0); ed25519_public_key_generate(&service->keys.identity_pk, diff --git a/src/test/test_hs_service.c b/src/test/test_hs_service.c index a303f1041..2e4be4e29 100644 --- a/src/test/test_hs_service.c +++ b/src/test/test_hs_service.c @@ -1265,6 +1265,7 @@ test_service_event(void *arg) /* Set a service for this circuit. */ service = helper_create_service(); + tt_assert(service); ed25519_pubkey_copy(&circ->hs_ident->identity_pk, &service->keys.identity_pk);

1 0