April 2020 - tor-commits - lists.torproject.org

[translation/donatepages-messagespot] https://gitweb.torproject.org/translation.git/commit/?h=donatepages-messagespot
by translation＠torproject.org 09 Apr '20

09 Apr '20

commit dc7fd8c079668630e44755912ece71c37d28c5ea Author: Translation commit bot <translation(a)torproject.org> Date: Thu Apr 9 16:45:42 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=donatepages-message… --- locale/hr/LC_MESSAGES/messages.po | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/locale/hr/LC_MESSAGES/messages.po b/locale/hr/LC_MESSAGES/messages.po index e44fa89f26..30b171f857 100644 --- a/locale/hr/LC_MESSAGES/messages.po +++ b/locale/hr/LC_MESSAGES/messages.po @@ -1,8 +1,7 @@ # Translators: # Adam Lynn <adam(a)opentechfund.org>, 2018 -# Ljubo Šimić <aske777(a)gmail.com>, 2018 # Igor <lyricaltumor(a)gmail.com>, 2018 -# psiphon3 <psiphon3(a)gmail.com>, 2018 +# Ljubo Šimić <aske777(a)gmail.com>, 2018 # erinm, 2019 # Karlo Prikratki <karlo(a)karloprikratki.com>, 2019 # milotype <mail(a)milotype.de>, 2020 @@ -26,12 +25,12 @@ msgstr "" #: tmp/cache_locale/ff/ffee28cfc961a339d813aed75493753fcc9e985dfa212e1af03fc089d5c3fdb0.php:112 msgid "Give today, and Mozilla will match your donation." -msgstr "Donirajte danas i Mozilla će dati jednaku donaciju." +msgstr "Doniraj danas i Mozilla će dati jednaku donaciju." #: tmp/cache_locale/fa/fadd8d2107638a3de94449a9eddfca4e8f010bb26f3f6a71e2d875cb910cc5f1.php:34 #: tmp/cache_locale/c8/c806c3e41d2762077fdd1ce236b4b0b7dc838a7c1a428d6d6daeede2a01d35aa.php:53 msgid "Tor Privacy Policy" -msgstr "" +msgstr "Torova politika privatnosti" #: tmp/cache_locale/fa/fadd8d2107638a3de94449a9eddfca4e8f010bb26f3f6a71e2d875cb910cc5f1.php:44 #: tmp/cache_locale/c8/c806c3e41d2762077fdd1ce236b4b0b7dc838a7c1a428d6d6daeede2a01d35aa.php:64 @@ -283,22 +282,22 @@ msgstr "S" #: tmp/cache_locale/eb/eb66db0fc2349cdc00200df1ba86814695c5deb02dc0f5941de0ada2f44eb52b.php:96 #: tmp/cache_locale/ce/ce708c1cd991748e8c1c29f932e6ddbd1be5be1b4cc2c5b49b607cae1df80432.php:78 msgid "M" -msgstr "v" +msgstr "M" #: tmp/cache_locale/eb/eb66db0fc2349cdc00200df1ba86814695c5deb02dc0f5941de0ada2f44eb52b.php:100 #: tmp/cache_locale/ce/ce708c1cd991748e8c1c29f932e6ddbd1be5be1b4cc2c5b49b607cae1df80432.php:82 msgid "L" -msgstr "" +msgstr "L" #: tmp/cache_locale/eb/eb66db0fc2349cdc00200df1ba86814695c5deb02dc0f5941de0ada2f44eb52b.php:104 #: tmp/cache_locale/ce/ce708c1cd991748e8c1c29f932e6ddbd1be5be1b4cc2c5b49b607cae1df80432.php:86 msgid "XL" -msgstr "" +msgstr "XL" #: tmp/cache_locale/eb/eb66db0fc2349cdc00200df1ba86814695c5deb02dc0f5941de0ada2f44eb52b.php:108 #: tmp/cache_locale/ce/ce708c1cd991748e8c1c29f932e6ddbd1be5be1b4cc2c5b49b607cae1df80432.php:90 msgid "XXL" -msgstr "" +msgstr "XXL" #: tmp/cache_locale/dd/ddde851dcf0f4bcfdf69b2fb2bdd731c4f85ce373ca3ec850a7ca8bbc00dfb85.php:47 #: tmp/cache_locale/dd/ddde851dcf0f4bcfdf69b2fb2bdd731c4f85ce373ca3ec850a7ca8bbc00dfb85.php:70 @@ -418,7 +417,7 @@ msgstr "" #: tmp/cache_locale/60/60fb10a60dd92fe380a6d105fd68d9375e135c65251f204fa37158d9c2e655d9.php:64 #: tmp/cache_locale/12/12677df2d2a5991edb775c6909b7be7ca718fd00abd6950a809cda5ab878d2ce.php:64 msgid "Thank you!" -msgstr "Hvala Vam!" +msgstr "Hvala!" #: tmp/cache_locale/ca/ca1cd152d40544030a642d8d074e6afb769c3bf80a1b2b61c380f1466e3a03a4.php:51 #: tmp/cache_locale/af/afda2fbd22ed389453e63ca9acc074a25ce820b5bc97120edfd975cf8f46634a.php:51 @@ -560,7 +559,7 @@ msgstr "" #: tmp/cache_locale/af/af919ed4d7946ee7ed7d71a5580f4c75c5fb2b9374dd8d99d3a0671f71654f60.php:152 #: tmp/cache_locale/af/af919ed4d7946ee7ed7d71a5580f4c75c5fb2b9374dd8d99d3a0671f71654f60.php:158 msgid "donate" -msgstr "donirajte" +msgstr "doniraj" #: tmp/cache_locale/c7/c763c19bb6abb9330294c550c8241bb3874e3b4e17fb6e7b15db26c60df8d5fe.php:132 #: tmp/cache_locale/af/af919ed4d7946ee7ed7d71a5580f4c75c5fb2b9374dd8d99d3a0671f71654f60.php:154 @@ -704,7 +703,7 @@ msgstr "" #: tmp/cache_locale/c7/c763c19bb6abb9330294c550c8241bb3874e3b4e17fb6e7b15db26c60df8d5fe.php:348 #: tmp/cache_locale/af/af919ed4d7946ee7ed7d71a5580f4c75c5fb2b9374dd8d99d3a0671f71654f60.php:347 msgid "State" -msgstr "Stanje" +msgstr "Država" #: tmp/cache_locale/c7/c763c19bb6abb9330294c550c8241bb3874e3b4e17fb6e7b15db26c60df8d5fe.php:353 #: tmp/cache_locale/af/af919ed4d7946ee7ed7d71a5580f4c75c5fb2b9374dd8d99d3a0671f71654f60.php:352 @@ -772,7 +771,7 @@ msgstr "" #: tmp/cache_locale/c7/c763c19bb6abb9330294c550c8241bb3874e3b4e17fb6e7b15db26c60df8d5fe.php:443 #: tmp/cache_locale/af/af919ed4d7946ee7ed7d71a5580f4c75c5fb2b9374dd8d99d3a0671f71654f60.php:446 msgid "Donate" -msgstr "Donirajte" +msgstr "Doniraj" #: tmp/cache_locale/c7/c763c19bb6abb9330294c550c8241bb3874e3b4e17fb6e7b15db26c60df8d5fe.php:453 msgid "Gift Selected" @@ -1065,7 +1064,7 @@ msgstr "" #: tmp/cache_locale/92/92eb639bc328f3dd569fa22b60c4360b6fe38f1a4cd80a14fce862d91bd765cb.php:69 #: tmp/cache_locale/2d/2d5f07aeb16acd7bb0a8dd355b13f59678a1f0ba6ea2b3d9dec8d2b5dcfbfde5.php:51 msgid "Privacy Policy" -msgstr "Izjava o privatnosti" +msgstr "Politika privatnosti" #: tmp/cache_locale/92/92eb639bc328f3dd569fa22b60c4360b6fe38f1a4cd80a14fce862d91bd765cb.php:85 #: tmp/cache_locale/2d/2d5f07aeb16acd7bb0a8dd355b13f59678a1f0ba6ea2b3d9dec8d2b5dcfbfde5.php:67 @@ -2383,7 +2382,7 @@ msgstr "" #: tmp/cache_locale/6c/6cd01cfbd4684dcca4eada963c78b5d694a2f40cd309be9366b080c410b3c5a0.php:92 #: tmp/cache_locale/0d/0de73852fd4b6afe8a4f069f907a5e1e93a3159f5ffaddbf485db43dd4ce3a8a.php:71 msgid "Donate Now" -msgstr "Donirajte" +msgstr "Doniraj sada" #: tmp/cache_locale/66/666e9197f427d70c0743bcdae2c3e34f41f9d7acf2b2dddb2c21c21723e73d10.php:52 #: tmp/cache_locale/66/666e9197f427d70c0743bcdae2c3e34f41f9d7acf2b2dddb2c21c21723e73d10.php:75

1 0

[translation/bridgedb] https://gitweb.torproject.org/translation.git/commit/?h=bridgedb
by translation＠torproject.org 09 Apr '20

09 Apr '20

commit 50566355910026617e37c21e2d71fe63f566ff6d Author: Translation commit bot <translation(a)torproject.org> Date: Thu Apr 9 16:45:14 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=bridgedb --- ar/LC_MESSAGES/bridgedb.po | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/ar/LC_MESSAGES/bridgedb.po b/ar/LC_MESSAGES/bridgedb.po index c1836793e7..c43888926a 100644 --- a/ar/LC_MESSAGES/bridgedb.po +++ b/ar/LC_MESSAGES/bridgedb.po @@ -35,7 +35,7 @@ msgstr "" "Project-Id-Version: Tor Project\n" "Report-Msgid-Bugs-To: 'https://trac.torproject.org/projects/tor/newticket?component=BridgeDB&keywo…'\n" "POT-Creation-Date: 2020-04-07 10:14-0700\n" -"PO-Revision-Date: 2020-04-09 15:23+0000\n" +"PO-Revision-Date: 2020-04-09 16:32+0000\n" "Last-Translator: hussin altiry <husss2011(a)gmail.com>\n" "Language-Team: Arabic (http://www.transifex.com/otf/torproject/language/ar/)\n" "MIME-Version: 1.0\n" @@ -211,7 +211,7 @@ msgstr "%sأ%sصل علي Bridges" #: bridgedb/strings.py:42 msgid "[This is an automated email.]" -msgstr "" +msgstr "[هذا بريد إلكتروني آلي.]" #: bridgedb/strings.py:44 msgid "Here are your bridges:" @@ -228,7 +228,7 @@ msgstr "لقد تخطيت الحد المسموح به. الرجاء الانت msgid "" "If these bridges are not what you need, reply to this email with one of\n" "the following commands in the message body:" -msgstr "" +msgstr "إذا لم تكن هذه الجسور هي ما تحتاج إليه ، فقم بالرد على هذه الرسالة الإلكترونية بأحد الرسائل\nالأوامر التالية في نص الرسالة:" #. TRANSLATORS: Please DO NOT translate "BridgeDB". #. TRANSLATORS: Please DO NOT translate "Pluggable Transports". @@ -312,7 +312,7 @@ msgstr "أحصل علي Bridges" #: bridgedb/strings.py:116 msgid "Bridge distribution mechanisms" -msgstr "" +msgstr "آليات توزيع الجسر" #. TRANSLATORS: Please DO NOT translate "BridgeDB", "HTTPS", and "Moat". #: bridgedb/strings.py:118 @@ -353,7 +353,7 @@ msgstr "" #: bridgedb/strings.py:138 msgid "Reserved" -msgstr "" +msgstr "محجوز" #: bridgedb/strings.py:139 #, python-format @@ -423,15 +423,15 @@ msgstr "" #: bridgedb/strings.py:182 msgid "(Request unobfuscated Tor bridges.)" -msgstr "" +msgstr "(طلب جسور Tor غير المشوشة.)" #: bridgedb/strings.py:183 msgid "(Request IPv6 bridges.)" -msgstr "" +msgstr "(طلب جسور IPv6.)" #: bridgedb/strings.py:184 msgid "(Request obfs4 obfuscated bridges.)" -msgstr "" +msgstr "(طلب جسور obfs4 المشوشة.)" #. TRANSLATORS: Please DO NOT translate "BridgeDB". #. TRANSLATORS: Please DO NOT translate "GnuPG".

1 0

[tor/master] relay: Protocol warn when a client gets an extend
by nickm＠torproject.org 09 Apr '20

09 Apr '20

commit c9b674d5110278f98c48f7e36653141bd39416dd Author: teor <teor(a)torproject.org> Date: Wed Mar 18 18:07:14 2020 +1000 relay: Protocol warn when a client gets an extend circuit_extend() may be called when a client receives an extend cell, even if the relay module is disabled. Log a protocol warning when the relay module is disabled. Part of 33633. --- src/feature/relay/circuitbuild_relay.c | 18 +++++++----------- src/feature/relay/circuitbuild_relay.h | 13 ++++++++++++- 2 files changed, 19 insertions(+), 12 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index f167d0a8e..9da89953f 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -39,11 +39,8 @@ #include "feature/relay/routermode.h" #include "feature/relay/selftest.h" -/** Take the 'extend' cell, pull out addr/port plus the onion - * skin and identity digest for the next hop. If we're already connected, - * pass the onion skin to the next hop using a create cell; otherwise - * launch a new OR connection, and circ will notice when the - * connection succeeds or fails. +/* Before replying to an extend cell, check the state of the circuit + * circ, and the configured tor mode. * * Return -1 if we want to warn and tear down the circuit, else return 0. */ @@ -56,6 +53,11 @@ circuit_extend(struct cell_t *cell, struct circuit_t *circ) const char *msg = NULL; int should_launch = 0; + if (!server_mode(get_options())) { + circuitbuild_warn_client_extend(); + return -1; + } + if (circ->n_chan) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "n_chan already set. Bug/attack. Closing."); @@ -67,12 +69,6 @@ circuit_extend(struct cell_t *cell, struct circuit_t *circ) return -1; } - if (!server_mode(get_options())) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Got an extend cell, but running as a client. Closing."); - return -1; - } - relay_header_unpack(&rh, cell->payload); if (extend_cell_parse(&ec, rh.command, diff --git a/src/feature/relay/circuitbuild_relay.h b/src/feature/relay/circuitbuild_relay.h index decc28d3a..890b40dc2 100644 --- a/src/feature/relay/circuitbuild_relay.h +++ b/src/feature/relay/circuitbuild_relay.h @@ -13,6 +13,9 @@ #define TOR_FEATURE_RELAY_CIRCUITBUILD_RELAY_H #include "lib/cc/torint.h" +#include "lib/log/log.h" + +#include "app/config/config.h" struct cell_t; struct created_cell_t; @@ -20,6 +23,14 @@ struct created_cell_t; struct circuit_t; struct or_circuit_t; +/* Log a protocol warning about getting an extend cell on a client. */ +static inline void +circuitbuild_warn_client_extend(void) +{ + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Got an extend cell, but running as a client. Closing."); +} + #ifdef HAVE_MODULE_RELAY int circuit_extend(struct cell_t *cell, struct circuit_t *circ); @@ -36,7 +47,7 @@ circuit_extend(struct cell_t *cell, struct circuit_t *circ) { (void)cell; (void)circ; - tor_assert_nonfatal_unreached(); + circuitbuild_warn_client_extend(); return -1; }

1 0

[tor/master] relay: Improve the comments on onionskin_answer()
by nickm＠torproject.org 09 Apr '20

09 Apr '20

commit beee9ca608e860ee71446e4923bf4f673eb012e3 Author: teor <teor(a)torproject.org> Date: Tue Mar 17 17:41:26 2020 +1000 relay: Improve the comments on onionskin_answer() Part of 33633. --- src/feature/relay/circuitbuild_relay.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index 9da89953f..85a05a865 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -193,8 +193,24 @@ circuit_extend(struct cell_t *cell, struct circuit_t *circ) return 0; } -/** Given a response payload and keys, initialize, then send a created - * cell back. +/** On a relay, accept a create cell, initialise a circuit, and send a + * created cell back. + * + * Given: + * - a response payload consisting of: + * - the created_cell and + * - an optional rend_circ_nonce, and + * - keys of length keys_len, which must be + * CPATH_KEY_MATERIAL_LEN; + * then: + * - initialize the circuit circ's cryptographic material, + * - set the circuit's state to open, and + * - send a created cell back on that circuit. + * + * If we haven't found our ORPorts reachable yet, and the channel meets the + * necessary conditions, mark the relevant ORPorts as reachable. + * + * Returns -1 if cell or circuit initialisation fails. */ int onionskin_answer(struct or_circuit_t *circ,

1 0

[tor/master] relay: Split state checks out of circuit_extend()
by nickm＠torproject.org 09 Apr '20

09 Apr '20

commit 2563d74a5cb321887324c010d6509c3af3f1e238 Author: teor <teor(a)torproject.org> Date: Wed Apr 1 09:20:58 2020 +1000 relay: Split state checks out of circuit_extend() Part of 33633. --- src/feature/relay/circuitbuild_relay.c | 36 +++++++++++++++++++++++++--------- 1 file changed, 27 insertions(+), 9 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index 85a05a865..469fd44b8 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -42,17 +42,12 @@ /* Before replying to an extend cell, check the state of the circuit * circ, and the configured tor mode. * - * Return -1 if we want to warn and tear down the circuit, else return 0. + * If the state and mode are valid, return 0. + * Otherwise, if they are invalid, log a protocol warning, and return -1. */ -int -circuit_extend(struct cell_t *cell, struct circuit_t *circ) +static int +circuit_extend_state_valid_helper(const struct circuit_t *circ) { - channel_t *n_chan; - relay_header_t rh; - extend_cell_t ec; - const char *msg = NULL; - int should_launch = 0; - if (!server_mode(get_options())) { circuitbuild_warn_client_extend(); return -1; @@ -69,6 +64,29 @@ circuit_extend(struct cell_t *cell, struct circuit_t *circ) return -1; } + return 0; +} + +/** Take the 'extend' cell, pull out addr/port plus the onion + * skin and identity digest for the next hop. If we're already connected, + * pass the onion skin to the next hop using a create cell; otherwise + * launch a new OR connection, and circ will notice when the + * connection succeeds or fails. + * + * Return -1 if we want to warn and tear down the circuit, else return 0. + */ +int +circuit_extend(struct cell_t *cell, struct circuit_t *circ) +{ + channel_t *n_chan; + relay_header_t rh; + extend_cell_t ec; + const char *msg = NULL; + int should_launch = 0; + + if (circuit_extend_state_valid_helper(circ) < 0) + return -1; + relay_header_unpack(&rh, cell->payload); if (extend_cell_parse(&ec, rh.command,

1 0

[tor/master] relay: Split link specifier checks from circuit_extend()
by nickm＠torproject.org 09 Apr '20

09 Apr '20

commit 5cb2bbea7d7e6bebe797a9d59cd8b98d41b201ba Author: teor <teor(a)torproject.org> Date: Wed Mar 18 18:44:42 2020 +1000 relay: Split link specifier checks from circuit_extend() Part of 33633. --- src/feature/relay/circuitbuild_relay.c | 136 +++++++++++++++++++++------------ 1 file changed, 87 insertions(+), 49 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index 469fd44b8..2781d1400 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -67,56 +67,27 @@ circuit_extend_state_valid_helper(const struct circuit_t *circ) return 0; } -/** Take the 'extend' cell, pull out addr/port plus the onion - * skin and identity digest for the next hop. If we're already connected, - * pass the onion skin to the next hop using a create cell; otherwise - * launch a new OR connection, and circ will notice when the - * connection succeeds or fails. +/* Make sure the extend cell ec has an ed25519 link specifier. * - * Return -1 if we want to warn and tear down the circuit, else return 0. + * First, check that the RSA node id is valid. + * If the node id is valid, add the ed25519 link specifier (if required), + * and return 0. + * + * Otherwise, if the node id is invalid, log a protocol warning, + * and return -1.(And do not modify the extend cell.) + * + * Must be called before circuit_extend_lspec_valid_helper(). */ -int -circuit_extend(struct cell_t *cell, struct circuit_t *circ) +static int +circuit_extend_add_ed25519_helper(extend_cell_t *ec) { - channel_t *n_chan; - relay_header_t rh; - extend_cell_t ec; - const char *msg = NULL; - int should_launch = 0; - - if (circuit_extend_state_valid_helper(circ) < 0) - return -1; - - relay_header_unpack(&rh, cell->payload); - - if (extend_cell_parse(&ec, rh.command, - cell->payload+RELAY_HEADER_SIZE, - rh.length) < 0) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Can't parse extend cell. Closing circuit."); - return -1; - } - - if (!ec.orport_ipv4.port || tor_addr_is_null(&ec.orport_ipv4.addr)) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Client asked me to extend to zero destination port or addr."); - return -1; - } - - if (tor_addr_is_internal(&ec.orport_ipv4.addr, 0) && - !get_options()->ExtendAllowPrivateAddresses) { - log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, - "Client asked me to extend to a private address"); - return -1; - } - /* Check if they asked us for 0000..0000. We support using * an empty fingerprint for the first hop (e.g. for a bridge relay), * but we don't want to let clients send us extend cells for empty * fingerprints -- a) because it opens the user up to a mitm attack, * and b) because it lets an attacker force the relay to hold open a * new TLS connection for each extend request. */ - if (tor_digest_is_zero((const char*)ec.node_id)) { + if (tor_digest_is_zero((const char*)ec->node_id)) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Client asked me to extend without specifying an id_digest."); return -1; @@ -124,21 +95,49 @@ circuit_extend(struct cell_t *cell, struct circuit_t *circ) /* Fill in ed_pubkey if it was not provided and we can infer it from * our networkstatus */ - if (ed25519_public_key_is_zero(&ec.ed_pubkey)) { - const node_t *node = node_get_by_id((const char*)ec.node_id); + if (ed25519_public_key_is_zero(&ec->ed_pubkey)) { + const node_t *node = node_get_by_id((const char*)ec->node_id); const ed25519_public_key_t *node_ed_id = NULL; if (node && node_supports_ed25519_link_authentication(node, 1) && (node_ed_id = node_get_ed25519_id(node))) { - ed25519_pubkey_copy(&ec.ed_pubkey, node_ed_id); + ed25519_pubkey_copy(&ec->ed_pubkey, node_ed_id); } } + return 0; +} + +/* Before replying to an extend cell, check the link specifiers in the extend + * cell ec, which was received on the circuit circ. + * + * If they are valid, return 0. + * Otherwise, if they are invalid, log a protocol warning, and return -1. + * + * Must be called after circuit_extend_add_ed25519_helper(). + */ +static int +circuit_extend_lspec_valid_helper(const extend_cell_t *ec, + const struct circuit_t *circ) +{ + if (!ec->orport_ipv4.port || tor_addr_is_null(&ec->orport_ipv4.addr)) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Client asked me to extend to zero destination port or addr."); + return -1; + } + + if (tor_addr_is_internal(&ec->orport_ipv4.addr, 0) && + !get_options()->ExtendAllowPrivateAddresses) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Client asked me to extend to a private address"); + return -1; + } + /* Next, check if we're being asked to connect to the hop that the * extend cell came from. There isn't any reason for that, and it can * assist circular-path attacks. */ - if (tor_memeq(ec.node_id, - TO_OR_CIRCUIT(circ)->p_chan->identity_digest, + if (tor_memeq(ec->node_id, + CONST_TO_OR_CIRCUIT(circ)->p_chan->identity_digest, DIGEST_LEN)) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Client asked me to extend back to the previous hop."); @@ -146,15 +145,54 @@ circuit_extend(struct cell_t *cell, struct circuit_t *circ) } /* Check the previous hop Ed25519 ID too */ - if (! ed25519_public_key_is_zero(&ec.ed_pubkey) && - ed25519_pubkey_eq(&ec.ed_pubkey, - &TO_OR_CIRCUIT(circ)->p_chan->ed25519_identity)) { + if (! ed25519_public_key_is_zero(&ec->ed_pubkey) && + ed25519_pubkey_eq(&ec->ed_pubkey, + &CONST_TO_OR_CIRCUIT(circ)->p_chan->ed25519_identity)) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Client asked me to extend back to the previous hop " "(by Ed25519 ID)."); return -1; } + return 0; +} + +/** Take the 'extend' cell, pull out addr/port plus the onion + * skin and identity digest for the next hop. If we're already connected, + * pass the onion skin to the next hop using a create cell; otherwise + * launch a new OR connection, and circ will notice when the + * connection succeeds or fails. + * + * Return -1 if we want to warn and tear down the circuit, else return 0. + */ +int +circuit_extend(struct cell_t *cell, struct circuit_t *circ) +{ + channel_t *n_chan; + relay_header_t rh; + extend_cell_t ec; + const char *msg = NULL; + int should_launch = 0; + + if (circuit_extend_state_valid_helper(circ) < 0) + return -1; + + relay_header_unpack(&rh, cell->payload); + + if (extend_cell_parse(&ec, rh.command, + cell->payload+RELAY_HEADER_SIZE, + rh.length) < 0) { + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Can't parse extend cell. Closing circuit."); + return -1; + } + + if (circuit_extend_add_ed25519_helper(&ec) < 0) + return -1; + + if (circuit_extend_lspec_valid_helper(&ec, circ) < 0) + return -1; + n_chan = channel_get_for_extend((const char*)ec.node_id, &ec.ed_pubkey, &ec.orport_ipv4.addr,

1 0

[tor/master] relay: Split out opening a connection for an extend
by nickm＠torproject.org 09 Apr '20

09 Apr '20

commit ca9565b9f74a3594834d97b41ced335d0638991f Author: teor <teor(a)torproject.org> Date: Wed Mar 18 19:06:41 2020 +1000 relay: Split out opening a connection for an extend Part of 33633. --- src/feature/relay/circuitbuild_relay.c | 69 +++++++++++++++++++++------------- 1 file changed, 43 insertions(+), 26 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index c57f0e5e8..fa0083bdf 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -156,6 +156,47 @@ circuit_extend_lspec_valid_helper(const extend_cell_t *ec, return 0; } +/* When there is no open channel for an extend cell ec, set up the + * circuit circ to wait for a new connection. If should_launch + * is true, open a new connection. (Otherwise, we are already waiting for a + * new connection to the same relay.) + * + * Always returns 0. + */ +static int +circuit_open_connection_for_extend(const extend_cell_t *ec, + struct circuit_t *circ, + int should_launch) +{ + circ->n_hop = extend_info_new(NULL /*nickname*/, + (const char*)ec->node_id, + &ec->ed_pubkey, + NULL, /*onion_key*/ + NULL, /*curve25519_key*/ + &ec->orport_ipv4.addr, + ec->orport_ipv4.port); + + circ->n_chan_create_cell = tor_memdup(&ec->create_cell, + sizeof(ec->create_cell)); + + circuit_set_state(circ, CIRCUIT_STATE_CHAN_WAIT); + + if (should_launch) { + /* we should try to open a connection */ + channel_t *n_chan = channel_connect_for_circuit(&ec->orport_ipv4.addr, + ec->orport_ipv4.port, + (const char*)ec->node_id, + &ec->ed_pubkey); + if (!n_chan) { + log_info(LD_CIRC,"Launching n_chan failed. Closing circuit."); + circuit_mark_for_close(circ, END_CIRC_REASON_CONNECTFAILED); + return 0; + } + log_debug(LD_CIRC,"connecting in progress (or finished). Good."); + } + return 0; +} + /** Take the 'extend' cell, pull out addr/port plus the onion * skin and identity digest for the next hop. If we're already connected, * pass the onion skin to the next hop using a create cell; otherwise @@ -203,32 +244,8 @@ circuit_extend(struct cell_t *cell, struct circuit_t *circ) fmt_addrport(&ec.orport_ipv4.addr,ec.orport_ipv4.port), msg?msg:"????"); - circ->n_hop = extend_info_new(NULL /*nickname*/, - (const char*)ec.node_id, - &ec.ed_pubkey, - NULL, /*onion_key*/ - NULL, /*curve25519_key*/ - &ec.orport_ipv4.addr, - ec.orport_ipv4.port); - - circ->n_chan_create_cell = tor_memdup(&ec.create_cell, - sizeof(ec.create_cell)); - - circuit_set_state(circ, CIRCUIT_STATE_CHAN_WAIT); - - if (should_launch) { - /* we should try to open a connection */ - n_chan = channel_connect_for_circuit(&ec.orport_ipv4.addr, - ec.orport_ipv4.port, - (const char*)ec.node_id, - &ec.ed_pubkey); - if (!n_chan) { - log_info(LD_CIRC,"Launching n_chan failed. Closing circuit."); - circuit_mark_for_close(circ, END_CIRC_REASON_CONNECTFAILED); - return 0; - } - log_debug(LD_CIRC,"connecting in progress (or finished). Good."); - } + circuit_open_connection_for_extend(&ec, circ, should_launch); + /* return success. The onion/circuit/etc will be taken care of * automatically (may already have been) whenever n_chan reaches * OR_CONN_STATE_OPEN.

1 0

[tor/master] relay: Refactor some long lines from circuit_extend()
by nickm＠torproject.org 09 Apr '20

09 Apr '20

commit 2640030b10038ed0e6fc4a4a9628745708be9d83 Author: teor <teor(a)torproject.org> Date: Wed Mar 18 18:48:01 2020 +1000 relay: Refactor some long lines from circuit_extend() Part of 33633. --- src/feature/relay/circuitbuild_relay.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index 2781d1400..c57f0e5e8 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -133,12 +133,12 @@ circuit_extend_lspec_valid_helper(const extend_cell_t *ec, return -1; } + const channel_t *p_chan = CONST_TO_OR_CIRCUIT(circ)->p_chan; + /* Next, check if we're being asked to connect to the hop that the * extend cell came from. There isn't any reason for that, and it can * assist circular-path attacks. */ - if (tor_memeq(ec->node_id, - CONST_TO_OR_CIRCUIT(circ)->p_chan->identity_digest, - DIGEST_LEN)) { + if (tor_memeq(ec->node_id, p_chan->identity_digest, DIGEST_LEN)) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Client asked me to extend back to the previous hop."); return -1; @@ -146,8 +146,7 @@ circuit_extend_lspec_valid_helper(const extend_cell_t *ec, /* Check the previous hop Ed25519 ID too */ if (! ed25519_public_key_is_zero(&ec->ed_pubkey) && - ed25519_pubkey_eq(&ec->ed_pubkey, - &CONST_TO_OR_CIRCUIT(circ)->p_chan->ed25519_identity)) { + ed25519_pubkey_eq(&ec->ed_pubkey, &p_chan->ed25519_identity)) { log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Client asked me to extend back to the previous hop " "(by Ed25519 ID).");

1 0

[tor/master] relay: Make circuitbuild functions STATIC
by nickm＠torproject.org 09 Apr '20

09 Apr '20

commit b10b2875898887f74e1018343c2c25ac376ff335 Author: teor <teor(a)torproject.org> Date: Wed Apr 1 21:37:47 2020 +1000 relay: Make circuitbuild functions STATIC Allow the circuitbuild_relay functions to be accessed by the unit tests. Part of 33633. --- src/feature/relay/circuitbuild_relay.c | 14 +++++++------- src/feature/relay/circuitbuild_relay.h | 13 +++++++++++++ 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index a9c7378fe..5c3f0d7d2 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -45,7 +45,7 @@ * If the state and mode are valid, return 0. * Otherwise, if they are invalid, log a protocol warning, and return -1. */ -static int +STATIC int circuit_extend_state_valid_helper(const struct circuit_t *circ) { if (!server_mode(get_options())) { @@ -78,8 +78,8 @@ circuit_extend_state_valid_helper(const struct circuit_t *circ) * * Must be called before circuit_extend_lspec_valid_helper(). */ -static int -circuit_extend_add_ed25519_helper(extend_cell_t *ec) +STATIC int +circuit_extend_add_ed25519_helper(struct extend_cell_t *ec) { /* Check if they asked us for 0000..0000. We support using * an empty fingerprint for the first hop (e.g. for a bridge relay), @@ -116,8 +116,8 @@ circuit_extend_add_ed25519_helper(extend_cell_t *ec) * * Must be called after circuit_extend_add_ed25519_helper(). */ -static int -circuit_extend_lspec_valid_helper(const extend_cell_t *ec, +STATIC int +circuit_extend_lspec_valid_helper(const struct extend_cell_t *ec, const struct circuit_t *circ) { if (!ec->orport_ipv4.port || tor_addr_is_null(&ec->orport_ipv4.addr)) { @@ -161,8 +161,8 @@ circuit_extend_lspec_valid_helper(const extend_cell_t *ec, * is true, open a new connection. (Otherwise, we are already waiting for a * new connection to the same relay.) */ -static void -circuit_open_connection_for_extend(const extend_cell_t *ec, +STATIC void +circuit_open_connection_for_extend(const struct extend_cell_t *ec, struct circuit_t *circ, int should_launch) { diff --git a/src/feature/relay/circuitbuild_relay.h b/src/feature/relay/circuitbuild_relay.h index 890b40dc2..19dbc4b94 100644 --- a/src/feature/relay/circuitbuild_relay.h +++ b/src/feature/relay/circuitbuild_relay.h @@ -22,6 +22,7 @@ struct created_cell_t; struct circuit_t; struct or_circuit_t; +struct extend_cell_t; /* Log a protocol warning about getting an extend cell on a client. */ static inline void @@ -68,4 +69,16 @@ onionskin_answer(struct or_circuit_t *circ, #endif +#ifdef TOR_UNIT_TESTS + +STATIC int circuit_extend_state_valid_helper(const struct circuit_t *circ); +STATIC int circuit_extend_add_ed25519_helper(struct extend_cell_t *ec); +STATIC int circuit_extend_lspec_valid_helper(const struct extend_cell_t *ec, + const struct circuit_t *circ); +STATIC void circuit_open_connection_for_extend(const struct extend_cell_t *ec, + struct circuit_t *circ, + int should_launch); + +#endif + #endif /* !defined(TOR_FEATURE_RELAY_CIRCUITBUILD_RELAY_H) */

1 0

[tor/master] relay: Remove a redundant function return value
by nickm＠torproject.org 09 Apr '20

09 Apr '20

commit 44f634d0be41200fcaa99eb48599b4a0bb52f43a Author: teor <teor(a)torproject.org> Date: Wed Mar 18 19:07:57 2020 +1000 relay: Remove a redundant function return value Part of 33633. --- src/feature/relay/circuitbuild_relay.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index fa0083bdf..a9c7378fe 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -160,10 +160,8 @@ circuit_extend_lspec_valid_helper(const extend_cell_t *ec, * circuit circ to wait for a new connection. If should_launch * is true, open a new connection. (Otherwise, we are already waiting for a * new connection to the same relay.) - * - * Always returns 0. */ -static int +static void circuit_open_connection_for_extend(const extend_cell_t *ec, struct circuit_t *circ, int should_launch) @@ -190,11 +188,10 @@ circuit_open_connection_for_extend(const extend_cell_t *ec, if (!n_chan) { log_info(LD_CIRC,"Launching n_chan failed. Closing circuit."); circuit_mark_for_close(circ, END_CIRC_REASON_CONNECTFAILED); - return 0; + return; } log_debug(LD_CIRC,"connecting in progress (or finished). Good."); } - return 0; } /** Take the 'extend' cell, pull out addr/port plus the onion

1 0