February 2020 - tor-commits - lists.torproject.org

[translation/tbmanual-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot
by translation＠torproject.org 19 Feb '20

19 Feb '20

commit 6d2ec168c3d644032d3af88c82f3e2f3173ec368 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Feb 19 20:20:23 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot --- contents+pt-PT.po | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/contents+pt-PT.po b/contents+pt-PT.po index 9f8e53e210..1d2240c1f4 100644 --- a/contents+pt-PT.po +++ b/contents+pt-PT.po @@ -385,7 +385,7 @@ msgstr "" #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.body) msgid "### TO USE GETTOR VIA JABBER/XMPP (JITSI, COYIM, ETC.):" -msgstr "" +msgstr "### UTILIZAR GETTOR VIA JABBER/XMPP (JITSI, COYIM, ETC.):" #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.body) @@ -400,19 +400,19 @@ msgstr "" #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.title) msgid "INSTALLATION" -msgstr "" +msgstr "INSTALAÇÃO" #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.description) msgid "Installing Tor Browser" -msgstr "" +msgstr "Instalar o Tor Browser" #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) #: https//tb-manual.torproject.org/make-tor-portable/ #: (content/make-tor-portable/contents+en.lrtopic.body) msgid "For Windows:" -msgstr "" +msgstr "Para Windows:" #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) @@ -420,11 +420,13 @@ msgid "" "1. Navigate to the Tor Browser [download " "page](https://www.torproject.org/download)." msgstr "" +"1. Navegar até à [página de " +"transferência](https://www.torproject.org/download) do Tor Browser." #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) msgid "2. Download the Windows `.exe` file" -msgstr "" +msgstr "2. Transferir o ficheiro Windows `.exe`" #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) @@ -441,18 +443,20 @@ msgid "" "4. When the download is complete, double click the `.exe` file. Complete the" " installation wizard process." msgstr "" +"4. Quando a transferência estiver completa, fazer o bitoque no ficheiro " +"`.exe`. Complete o processo de instalação." #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) #: https//tb-manual.torproject.org/make-tor-portable/ #: (content/make-tor-portable/contents+en.lrtopic.body) msgid "For macOS:" -msgstr "" +msgstr "Para macOS:" #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) msgid "2. Download the macOS `.dmg` file" -msgstr "" +msgstr "2. Transferir o ficheiro macOS `.dmg`" #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) @@ -460,18 +464,20 @@ msgid "" "4. When the download is complete, double click the `.dmg` file. Complete the" " installation wizard process." msgstr "" +"4. Quando a transferência estiver completa, fazer o bitoque no ficheiro " +"`.dmg`. Complete o processo de instalação." #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) #: https//tb-manual.torproject.org/make-tor-portable/ #: (content/make-tor-portable/contents+en.lrtopic.body) msgid "For GNU/Linux:" -msgstr "" +msgstr "Para GNU/Linux:" #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) msgid "2. Download the GNU/Linux `.tar.xz` file" -msgstr "" +msgstr "2. Transferir o ficheiro GNU/Linux `.tar.xz`" #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) @@ -479,6 +485,8 @@ msgid "" "4. When the download is complete, extract the archive with the command `tar " "-xf [TB archive]` or by using an archive manager." msgstr "" +"4. Quando a transferência estiver completa, extrair o arquivo com o comando " +"`tar -xf [TB archive]` ou através de um gestor de ficheiros." #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) @@ -486,11 +494,13 @@ msgid "" "5. You'll need to tell your GNU/Linux that you want the ability to execute " "shell scripts from the graphical interface." msgstr "" +"5. Terá de dizer ao seu GNU/Linux que quer a abilidade de executar scripts " +"de shell através da interface gráfica." #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body) msgid "Navigate to the newly extracted Tor Browser directory." -msgstr "" +msgstr "Navegar até à recentemente extraída pasta do Tor Browser." #: https//tb-manual.torproject.org/installation/ #: (content/installation/contents+en.lrtopic.body)

1 0

[tpo/master] Remove 9.5a4 from RecommendedTBBVersions
by boklm＠torproject.org 19 Feb '20

19 Feb '20

commit 90264dd53e6b48a30865f7f6ba02ddaf49ae75f1 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Feb 17 19:47:49 2020 +0100 Remove 9.5a4 from RecommendedTBBVersions --- content/projects/torbrowser/RecommendedTBBVersions/contents.lr | 4 ---- 1 file changed, 4 deletions(-) diff --git a/content/projects/torbrowser/RecommendedTBBVersions/contents.lr b/content/projects/torbrowser/RecommendedTBBVersions/contents.lr index 8ef833c..f4c3aa9 100644 --- a/content/projects/torbrowser/RecommendedTBBVersions/contents.lr +++ b/content/projects/torbrowser/RecommendedTBBVersions/contents.lr @@ -9,10 +9,6 @@ body: "9.0.5-MacOS", "9.0.5-Linux", "9.0.5-Windows", -"9.5a4", -"9.5a4-MacOS", -"9.5a4-Linux", -"9.5a4-Windows", "9.5a5", "9.5a5-MacOS", "9.5a5-Linux",

1 0

[tor-browser/tor-browser-68.5.0esr-9.5-1] Bug 32493: Disable MOZ_SERVICES_HEALTHREPORT
by sysrqb＠torproject.org 19 Feb '20

19 Feb '20

commit 6046d1d582804594a57d132280376b8027d1ed83 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Jan 30 14:32:13 2020 +0100 Bug 32493: Disable MOZ_SERVICES_HEALTHREPORT --- browser/moz.configure | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browser/moz.configure b/browser/moz.configure index f0f0f07e23f3..f03184d48651 100644 --- a/browser/moz.configure +++ b/browser/moz.configure @@ -5,7 +5,7 @@ # file, You can obtain one at http://mozilla.org/MPL/2.0/. imply_option('MOZ_PLACES', True) -imply_option('MOZ_SERVICES_HEALTHREPORT', True) +imply_option('MOZ_SERVICES_HEALTHREPORT', False) imply_option('MOZ_SERVICES_SYNC', True) imply_option('MOZ_DEDICATED_PROFILES', False) imply_option('MOZ_BLOCK_PROFILE_DOWNGRADE', False)

1 0

[tor-browser/tor-browser-68.5.0esr-9.5-1] Bug 32658: Create a new MAR signing key
by sysrqb＠torproject.org 19 Feb '20

19 Feb '20

commit 0f42a8ed2229c1ad5da15803eeebd2f849ffdb21 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jan 17 12:54:31 2020 +0000 Bug 32658: Create a new MAR signing key It's time for our rotation again: Move the backup key in the front position and add a new backup key. --- toolkit/mozapps/update/updater/release_primary.der | Bin 1229 -> 1229 bytes toolkit/mozapps/update/updater/release_secondary.der | Bin 1229 -> 1229 bytes 2 files changed, 0 insertions(+), 0 deletions(-) diff --git a/toolkit/mozapps/update/updater/release_primary.der b/toolkit/mozapps/update/updater/release_primary.der index ec74f89dc807..0103a171de88 100644 Binary files a/toolkit/mozapps/update/updater/release_primary.der and b/toolkit/mozapps/update/updater/release_primary.der differ diff --git a/toolkit/mozapps/update/updater/release_secondary.der b/toolkit/mozapps/update/updater/release_secondary.der index 0103a171de88..fcee3944e9b7 100644 Binary files a/toolkit/mozapps/update/updater/release_secondary.der and b/toolkit/mozapps/update/updater/release_secondary.der differ

1 0

[tor/master] fix typo from 7920fc35
by arma＠torproject.org 19 Feb '20

19 Feb '20

commit 98bf7604a3b07facdc5f0d41b0279851440d1380 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed Feb 19 14:53:36 2020 -0500 fix typo from 7920fc35 --- doc/tor.1.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index a983b555c..3d00e62a4 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2764,7 +2764,7 @@ your log at NOTICE level which looks like: The following options are useful only for a public relay. They control the Denial of Service mitigation subsystem described above. -//Out of order because it logically belongs before the other DocCircuitCreation options. +//Out of order because it logically belongs before the other DoSCircuitCreation options. [[DoSCircuitCreationEnabled]] **DoSCircuitCreationEnabled** **0**|**1**|**auto**:: Enable circuit creation DoS mitigation. If set to 1 (enabled), tor will

1 0

[translation/support-portal] https://gitweb.torproject.org/translation.git/commit/?h=support-portal
by translation＠torproject.org 19 Feb '20

19 Feb '20

commit a8a84b664070e1b4361fe73bc559115bbb80edd1 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Feb 19 19:53:55 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=support-portal --- contents+es.po | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/contents+es.po b/contents+es.po index 3ffa230892..9c77a6d9eb 100644 --- a/contents+es.po +++ b/contents+es.po @@ -5494,6 +5494,9 @@ msgid "" "signed by the master identity secret key and confirms that the medium term " "signing key is valid for a certain period of time." msgstr "" +"Aparte, se genera un certifiado llamado \"ed25519_signing_cert\" el cual es " +"firmado digitalmente por la clave privada maestra, que sirve para confirmar " +"que la clave intermedia es válida durante un tiempo determinado." #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description) @@ -5501,6 +5504,8 @@ msgid "" "The default validity is 30 days, but this can be customized by setting " "\"SigningKeyLifetime N days|weeks|months\" in torrc." msgstr "" +"La validez por defecto es de 30 días, pero puedes cambiar este valor " +"ajustando \"SigningKeyLifetime N days|weeks|months\" en el archivo torrc." #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description) @@ -5508,6 +5513,9 @@ msgid "" "* There is also a master public key named \"ed25519_master_id_public_key, " "which is the actual identity of the relay advertised in the network." msgstr "" +"* También está la clave pública maestra llamada " +"\"ed25519_master_id_public_key\", que es la que se publica en la red como " +"identidad de tu repetidor." #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description) @@ -5515,6 +5523,8 @@ msgid "" "This one is not sensitive and can be easily computed from " "\"ed5519_master_id_secret_key\"." msgstr "" +"Esta no es delicada (secreta) ya que se puede calcular a partir de la " +"\"ed5519_master_id_secret_key\"." #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description) @@ -5523,6 +5533,10 @@ msgid "" "long as they are valid, so the master identity secret key can be kept " "outside DataDirectory/keys, on a storage media or a different computer." msgstr "" +"Tor solamente necesita acceso a la clave intermedia de firma digital y al " +"certificado siempre y cuando sigan siendo válidos, así que la clave privada " +"maestra puede ser guardada fuera del directorio DataDirectory/keys, en un " +"medio de almacenamiento externo o en otro equipo." #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description) @@ -5531,11 +5545,16 @@ msgid "" "before they expire otherwise the Tor process on the relay will exit upon " "expiration." msgstr "" +"Deberás renovar de forma manual la clave intermedia de firma digital y el " +"certificado antes de que caduquen, de lo contrario el proceso tor del " +"repetidor se detendrá cuando pase el tiempo estipulado." #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description) msgid "This feature is optional, you don't need to use it unless you want to." msgstr "" +"Esta característica es opcional, no necesitas usarla a menos que quieras " +"hacerlo." #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description) @@ -5545,6 +5564,11 @@ msgid "" "leave the master identity secret key in DataDirectory/keys, just make a " "backup in case you'll need to reinstall it." msgstr "" +"Si quieres que tu repetidor funcione sin supervisión por más tiempo sin que " +"tengas que renovar periódicamente la clave intermedia, lo mejor es que dejes" +" la clave privada maestra en el directorio DataDirectory/keys y que " +"simplemente hagas una copia de seguridad en caso de que haya que reinstalar " +"el repetidor." #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description) @@ -5553,6 +5577,10 @@ msgid "" "guide](https://trac.torproject.org/projects/tor/wiki/doc/TorRelaySecurity/O…" " on the topic." msgstr "" +"Si estás interesado en utilizar esta característica, puedes consultar " +"nuestra [guía en " +"profundidad](https://trac.torproject.org/projects/tor/wiki/doc/TorRelaySecu…" +" al respecto." #: https//support.torproject.org/operators/operators-1/ #: (content/operators/operators-1/contents+en.lrquestion.title)

1 0

[translation/tbmanual-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot
by translation＠torproject.org 19 Feb '20

19 Feb '20

commit 99b51bc6a9e9ebac38e0079cebfc459c5c2c9a52 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Feb 19 19:50:18 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot --- contents+pt-PT.po | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/contents+pt-PT.po b/contents+pt-PT.po index 49fc7db4a3..9f8e53e210 100644 --- a/contents+pt-PT.po +++ b/contents+pt-PT.po @@ -153,7 +153,7 @@ msgstr "Traduzir o Projeto Tor (Ser um Tradutor)" #: https//tb-manual.torproject.org/menu/ #: (content/menu/contents+en.lrtopic.body) msgid "Making Tor Browser portable" -msgstr "" +msgstr "Tornar o Tor Browser portátil" #: https//tb-manual.torproject.org/menu/ #: (content/menu/contents+en.lrtopic.body) @@ -222,11 +222,15 @@ msgid "" " valid for a single session (until Tor Browser is exited or a [New Identity" "](/managing-identities/#new-identity) is requested)." msgstr "" +"Por predefinição, o Tor Browser não mantém qualquer histórico de navegação. " +"As cookies são válidas para apenas uma sessão (até que Tor Browser seja " +"fechado ou uma [nova identidade](/managing-identities/#new-identity) seja " +"pedida)." #: https//tb-manual.torproject.org/about/ #: (content/about/contents+en.lrtopic.body) msgid "### HOW TOR WORKS" -msgstr "" +msgstr "### COMO É QUE O TOR FUNCIONA" #: https//tb-manual.torproject.org/about/ #: (content/about/contents+en.lrtopic.body) @@ -314,7 +318,7 @@ msgstr "" #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.body) msgid "### MIRRORS" -msgstr "" +msgstr "### MIRRORS" #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.body) @@ -324,11 +328,15 @@ msgid "" "mirrors, either through [EFF](https://tor.eff.org), [Calyx " "Institute](https://tor.calyxinstitute.org) or [CCC](https://tor.ccc.de)." msgstr "" +"Se não conseguir transferir o Tor Browser do site da Web oficial do Projeto " +"Tor, pode, em vez disso, tentar transferi-lo de um dos nossos mirrors " +"oficiais, [EFF](https://tor.eff.org), [Calyx " +"Institute](https://tor.calyxinstitute.org) ou [CCC](https://tor.ccc.de)." #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.body) msgid "### GETTOR" -msgstr "" +msgstr "### GETTOR" #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.body) @@ -344,7 +352,7 @@ msgstr "" #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.body) msgid "### TO USE GETTOR VIA EMAIL:" -msgstr "" +msgstr "### UTILIZAR GETTOR VIA E-MAIL:" #: https//tb-manual.torproject.org/downloading/ #: (content/downloading/contents+en.lrtopic.body)

1 0

[translation/support-portal] https://gitweb.torproject.org/translation.git/commit/?h=support-portal
by translation＠torproject.org 19 Feb '20

19 Feb '20

commit a18326469e5f13a82802df9f20484d51d1c9d748 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Feb 19 19:24:22 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=support-portal --- contents+es.po | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/contents+es.po b/contents+es.po index 114207d12c..3ffa230892 100644 --- a/contents+es.po +++ b/contents+es.po @@ -5434,16 +5434,22 @@ msgid "" "Understanding and Improving Entry Guard Selection in " "Tor](https://www.freehaven.net/anonbib/cache/wpes12-cogs.pdf)." msgstr "" +"Puedes consultar más detalles en este " +"[blog](https://blog.torproject.org/blog/lifecycle-of-a-new-relay) o en " +"[Cambio de guardián: Un esbozo para entender y mejorar la selección de " +"guardianes de entrada en " +"Tor](https://www.freehaven.net/anonbib/cache/wpes12-cogs.pdf)." #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.title) msgid "How do offline ed25519 identity keys work? What do I need to know?" msgstr "" +"¿Cómo funcionan las claves desconectadas ed25519? ¿Qué necesito saber?" #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description) msgid "In simple words, it works like this:" -msgstr "" +msgstr "Simplificando, funcionan tal que así:" #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description) @@ -5451,6 +5457,8 @@ msgid "" "* There is a master ed25519 identity secret key file named " "\"ed25519_master_id_secret_key\"." msgstr "" +"* Hay una clave privada maestra ed25519 en un archivo llamado " +"\"ed25519_master_id_secret_key\"." #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description) @@ -5458,6 +5466,8 @@ msgid "" "This is the most important one, so make sure you keep a backup in a secure " "place - the file is sensitive and should be protected." msgstr "" +"Esta es la más importante, así que asegúrate de que mantienes una copia de " +"seguridad en lugar seguro - el archivo es delicado y debe estar protegido." #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description) @@ -5465,6 +5475,8 @@ msgid "" "Tor could encrypt it for you if you generate it manually and enter a " "password when asked." msgstr "" +"Tor puede cifrarlo por ti si lo generas de forma manual y le asignas una " +"contraseña cuando se te pida." #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description) @@ -5472,6 +5484,8 @@ msgid "" "* A medium term signing key named \"ed25519_signing_secret_key\" is " "generated for Tor to use." msgstr "" +"* Una clave intermedia de firma digital llamada " +"\"ed25519_signing_secret_key\" es generada para ser usada por Tor." #: https//support.torproject.org/operators/offline-ed25519/ #: (content/operators/offline-ed25519/contents+en.lrquestion.description)

1 0

[tor/master] Replace identifiers related to clipping DNS ttls.
by nickm＠torproject.org 19 Feb '20

19 Feb '20

commit dcbc45e6b2f80e8bd3664972d6317331d6b3bc85 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 18 12:00:24 2020 -0500 Replace identifiers related to clipping DNS ttls. This is an automated commit, generated by this command: ./scripts/maint/rename_c_identifier.py \ MIN_DNS_TTL_AT_EXIT MIN_DNS_TTL \ MAX_DNS_TTL_AT_EXIT MAX_DNS_TTL \ dns_clip_ttl clip_dns_ttl --- src/core/or/connection_edge.c | 4 ++-- src/feature/client/addressmap.c | 2 +- src/feature/relay/dns.c | 16 ++++++++-------- src/feature/relay/dns.h | 6 +++--- src/test/test_dns.c | 8 ++++---- 5 files changed, 18 insertions(+), 18 deletions(-) diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index aeb9ec646..eae07141c 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -480,7 +480,7 @@ connection_edge_end(edge_connection_t *conn, uint8_t reason) memcpy(payload+1, tor_addr_to_in6_addr8(&conn->base_.addr), 16); addrlen = 16; } - set_uint32(payload+1+addrlen, htonl(dns_clip_ttl(conn->address_ttl))); + set_uint32(payload+1+addrlen, htonl(clip_dns_ttl(conn->address_ttl))); payload_len += 4+addrlen; } @@ -845,7 +845,7 @@ connected_cell_format_payload(uint8_t *payload_out, return -1; } - set_uint32(payload_out + connected_payload_len, htonl(dns_clip_ttl(ttl))); + set_uint32(payload_out + connected_payload_len, htonl(clip_dns_ttl(ttl))); connected_payload_len += 4; tor_assert(connected_payload_len <= MAX_CONNECTED_CELL_PAYLOAD_LEN); diff --git a/src/feature/client/addressmap.c b/src/feature/client/addressmap.c index 1a6958d38..af76253e4 100644 --- a/src/feature/client/addressmap.c +++ b/src/feature/client/addressmap.c @@ -689,7 +689,7 @@ client_dns_set_addressmap_impl(entry_connection_t *for_conn, if (ttl<0) ttl = DEFAULT_DNS_TTL; else - ttl = dns_clip_ttl(ttl); + ttl = clip_dns_ttl(ttl); if (exitname) { /* XXXX fails to ever get attempts to get an exit address of diff --git a/src/feature/relay/dns.c b/src/feature/relay/dns.c index da0cbb1df..08fe4d39c 100644 --- a/src/feature/relay/dns.c +++ b/src/feature/relay/dns.c @@ -272,16 +272,16 @@ has_dns_init_failed(void) * OP that asked us to resolve it, and how long to cache that record * ourselves. */ uint32_t -dns_clip_ttl(uint32_t ttl) +clip_dns_ttl(uint32_t ttl) { /* This logic is a defense against "DefectTor" DNS-based traffic * confirmation attacks, as in https://nymity.ch/tor-dns/tor-dns.pdf . * We only give two values: a "low" value and a "high" value. */ - if (ttl < MIN_DNS_TTL_AT_EXIT) - return MIN_DNS_TTL_AT_EXIT; + if (ttl < MIN_DNS_TTL) + return MIN_DNS_TTL; else - return MAX_DNS_TTL_AT_EXIT; + return MAX_DNS_TTL; } /** Helper: free storage held by an entry in the DNS cache. */ @@ -521,7 +521,7 @@ send_resolved_cell,(edge_connection_t *conn, uint8_t answer_type, uint32_t ttl; buf[0] = answer_type; - ttl = dns_clip_ttl(conn->address_ttl); + ttl = clip_dns_ttl(conn->address_ttl); switch (answer_type) { @@ -593,7 +593,7 @@ send_resolved_hostname_cell,(edge_connection_t *conn, size_t namelen = strlen(hostname); tor_assert(namelen < 256); - ttl = dns_clip_ttl(conn->address_ttl); + ttl = clip_dns_ttl(conn->address_ttl); buf[0] = RESOLVED_TYPE_HOSTNAME; buf[1] = (uint8_t)namelen; @@ -1338,7 +1338,7 @@ make_pending_resolve_cached(cached_resolve_t *resolve) resolve->ttl_hostname < ttl) ttl = resolve->ttl_hostname; - set_expiry(new_resolve, time(NULL) + dns_clip_ttl(ttl)); + set_expiry(new_resolve, time(NULL) + clip_dns_ttl(ttl)); } assert_cache_ok(); @@ -2188,7 +2188,7 @@ dns_cache_handle_oom(time_t now, size_t min_remove_bytes) total_bytes_removed += bytes_removed; /* Increase time_inc by a reasonable fraction. */ - time_inc += (MAX_DNS_TTL_AT_EXIT / 4); + time_inc += (MAX_DNS_TTL / 4); } while (total_bytes_removed < min_remove_bytes); return total_bytes_removed; diff --git a/src/feature/relay/dns.h b/src/feature/relay/dns.h index 2b1da8d12..e445b2333 100644 --- a/src/feature/relay/dns.h +++ b/src/feature/relay/dns.h @@ -13,9 +13,9 @@ #define TOR_DNS_H /** Lowest value for DNS ttl that a server will give. */ -#define MIN_DNS_TTL_AT_EXIT (5*60) +#define MIN_DNS_TTL (5*60) /** Highest value for DNS ttl that a server will give. */ -#define MAX_DNS_TTL_AT_EXIT (60*60) +#define MAX_DNS_TTL (60*60) /** How long do we keep DNS cache entries before purging them (regardless of * their TTL)? */ @@ -27,7 +27,7 @@ int dns_init(void); int has_dns_init_failed(void); void dns_free_all(void); -uint32_t dns_clip_ttl(uint32_t ttl); +uint32_t clip_dns_ttl(uint32_t ttl); int dns_reset(void); void connection_dns_remove(edge_connection_t *conn); void assert_connection_edge_not_dns_pending(edge_connection_t *conn); diff --git a/src/test/test_dns.c b/src/test/test_dns.c index ec17e9e91..299321ab6 100644 --- a/src/test/test_dns.c +++ b/src/test/test_dns.c @@ -80,11 +80,11 @@ test_dns_clip_ttl(void *arg) { (void)arg; - uint32_t ttl_mid = MIN_DNS_TTL_AT_EXIT / 2 + MAX_DNS_TTL_AT_EXIT / 2; + uint32_t ttl_mid = MIN_DNS_TTL / 2 + MAX_DNS_TTL / 2; - tt_int_op(dns_clip_ttl(MIN_DNS_TTL_AT_EXIT - 1),OP_EQ,MIN_DNS_TTL_AT_EXIT); - tt_int_op(dns_clip_ttl(ttl_mid),OP_EQ,MAX_DNS_TTL_AT_EXIT); - tt_int_op(dns_clip_ttl(MAX_DNS_TTL_AT_EXIT + 1),OP_EQ,MAX_DNS_TTL_AT_EXIT); + tt_int_op(clip_dns_ttl(MIN_DNS_TTL - 1),OP_EQ,MIN_DNS_TTL); + tt_int_op(clip_dns_ttl(ttl_mid),OP_EQ,MAX_DNS_TTL); + tt_int_op(clip_dns_ttl(MAX_DNS_TTL + 1),OP_EQ,MAX_DNS_TTL); done: return;

1 0

[tor/master] Move DNS TTL manipulation code to src/core/or
by nickm＠torproject.org 19 Feb '20

19 Feb '20

commit 1f06f494c8ce45946e565237a8a52785a8ece447 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 18 12:08:29 2020 -0500 Move DNS TTL manipulation code to src/core/or This removes a dependency from the client code on feature/relay. --- src/core/or/connection_edge.c | 15 +++++++++++++++ src/core/or/connection_edge.h | 15 +++++++++++++++ src/feature/client/addressmap.c | 1 - src/feature/relay/dns.c | 16 ---------------- src/feature/relay/dns.h | 14 -------------- 5 files changed, 30 insertions(+), 31 deletions(-) diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index eae07141c..23c6e230c 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -432,6 +432,21 @@ warn_if_hs_unreachable(const edge_connection_t *conn, uint8_t reason) } } +/** Given a TTL (in seconds) from a DNS response or from a relay, determine + * what TTL clients and relays should actually use for caching it. */ +uint32_t +clip_dns_ttl(uint32_t ttl) +{ + /* This logic is a defense against "DefectTor" DNS-based traffic + * confirmation attacks, as in https://nymity.ch/tor-dns/tor-dns.pdf . + * We only give two values: a "low" value and a "high" value. + */ + if (ttl < MIN_DNS_TTL) + return MIN_DNS_TTL; + else + return MAX_DNS_TTL; +} + /** Send a relay end cell from stream <b>conn</b> down conn's circuit, and * remember that we've done so. If this is not a client connection, set the * relay end cell's reason for closing as <b>reason</b>. diff --git a/src/core/or/connection_edge.h b/src/core/or/connection_edge.h index 11cb25293..8c06af566 100644 --- a/src/core/or/connection_edge.h +++ b/src/core/or/connection_edge.h @@ -182,6 +182,21 @@ void connection_ap_warn_and_unmark_if_pending_circ( entry_connection_t *entry_conn, const char *where); +/** Lowest value for DNS ttl that a server should give or a client should + * believe. */ +#define MIN_DNS_TTL (5*60) +/** Highest value for DNS ttl that a server should give or a client should + * believe. */ +#define MAX_DNS_TTL (60*60) +/** How long do we keep DNS cache entries before purging them (regardless of + * their TTL)? */ +#define MAX_DNS_ENTRY_AGE (3*60*60) +/** How long do we cache/tell clients to cache DNS records when no TTL is + * known? */ +#define DEFAULT_DNS_TTL (30*60) + +uint32_t clip_dns_ttl(uint32_t ttl); + int connection_half_edge_is_valid_data(const smartlist_t *half_conns, streamid_t stream_id); int connection_half_edge_is_valid_sendme(const smartlist_t *half_conns, diff --git a/src/feature/client/addressmap.c b/src/feature/client/addressmap.c index af76253e4..cc97166f3 100644 --- a/src/feature/client/addressmap.c +++ b/src/feature/client/addressmap.c @@ -23,7 +23,6 @@ #include "app/config/config.h" #include "core/or/connection_edge.h" #include "feature/control/control_events.h" -#include "feature/relay/dns.h" #include "feature/nodelist/nodelist.h" #include "feature/nodelist/routerset.h" diff --git a/src/feature/relay/dns.c b/src/feature/relay/dns.c index 08fe4d39c..5f4bddab9 100644 --- a/src/feature/relay/dns.c +++ b/src/feature/relay/dns.c @@ -268,22 +268,6 @@ has_dns_init_failed(void) return nameserver_config_failed; } -/** Helper: Given a TTL from a DNS response, determine what TTL to give the - * OP that asked us to resolve it, and how long to cache that record - * ourselves. */ -uint32_t -clip_dns_ttl(uint32_t ttl) -{ - /* This logic is a defense against "DefectTor" DNS-based traffic - * confirmation attacks, as in https://nymity.ch/tor-dns/tor-dns.pdf . - * We only give two values: a "low" value and a "high" value. - */ - if (ttl < MIN_DNS_TTL) - return MIN_DNS_TTL; - else - return MAX_DNS_TTL; -} - /** Helper: free storage held by an entry in the DNS cache. */ static void free_cached_resolve_(cached_resolve_t *r) diff --git a/src/feature/relay/dns.h b/src/feature/relay/dns.h index e445b2333..a2275c724 100644 --- a/src/feature/relay/dns.h +++ b/src/feature/relay/dns.h @@ -12,22 +12,9 @@ #ifndef TOR_DNS_H #define TOR_DNS_H -/** Lowest value for DNS ttl that a server will give. */ -#define MIN_DNS_TTL (5*60) -/** Highest value for DNS ttl that a server will give. */ -#define MAX_DNS_TTL (60*60) - -/** How long do we keep DNS cache entries before purging them (regardless of - * their TTL)? */ -#define MAX_DNS_ENTRY_AGE (3*60*60) -/** How long do we cache/tell clients to cache DNS records when no TTL is - * known? */ -#define DEFAULT_DNS_TTL (30*60) - int dns_init(void); int has_dns_init_failed(void); void dns_free_all(void); -uint32_t clip_dns_ttl(uint32_t ttl); int dns_reset(void); void connection_dns_remove(edge_connection_t *conn); void assert_connection_edge_not_dns_pending(edge_connection_t *conn); @@ -74,4 +61,3 @@ launch_resolve,(cached_resolve_t *resolve)); #endif /* defined(DNS_PRIVATE) */ #endif /* !defined(TOR_DNS_H) */ -

1 0