April 2020 - tor-commits - lists.torproject.org

[tor/release-0.4.1] Merge branch 'maint-0.3.5' into maint-0.4.1
by teor＠torproject.org 09 Apr '20

09 Apr '20

commit 987f2fa50ac26af61917c7a6e13dc62f3ddb23ee Merge: 26fd31fef d380acaec Author: teor <teor(a)torproject.org> Date: Thu Apr 9 11:03:20 2020 +1000 Merge branch 'maint-0.3.5' into maint-0.4.1 changes/ticket33491 | 6 ++++++ src/core/or/channel.c | 2 +- src/core/or/dos.c | 4 ++-- src/core/or/dos.h | 3 ++- src/test/test_dos.c | 24 ++++++++++++------------ 5 files changed, 23 insertions(+), 16 deletions(-)

1 0

[tor/release-0.4.2] Merge branch 'maint-0.4.1' into maint-0.4.2
by teor＠torproject.org 09 Apr '20

09 Apr '20

commit 2d7e08d57ef5d3b785cfaa6961d6d3c73fe59535 Merge: 048714d2c 987f2fa50 Author: teor <teor(a)torproject.org> Date: Thu Apr 9 11:03:27 2020 +1000 Merge branch 'maint-0.4.1' into maint-0.4.2 changes/ticket33491 | 6 ++++++ src/core/or/channel.c | 2 +- src/core/or/dos.c | 4 ++-- src/core/or/dos.h | 3 ++- src/test/test_dos.c | 24 ++++++++++++------------ 5 files changed, 23 insertions(+), 16 deletions(-)

1 0

[tor/release-0.4.3] dos: Pass transport name on new client connection
by teor＠torproject.org 09 Apr '20

09 Apr '20

commit 894ff2dc8422cb86312c512698acd76476224f87 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Mar 10 14:45:13 2020 -0400 dos: Pass transport name on new client connection For a bridge configured with a pluggable transport, the transport name is used, with the IP address, for the GeoIP client cache entry. However, the DoS subsystem was not aware of it and always passing NULL when doing a lookup into the GeoIP cache. This resulted in bridges with a PT are never able to apply DoS defenses for newly created connections. Fixes #33491 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket33491 | 6 ++++++ src/core/or/channel.c | 2 +- src/core/or/dos.c | 4 ++-- src/core/or/dos.h | 3 ++- src/test/test_dos.c | 24 ++++++++++++------------ 5 files changed, 23 insertions(+), 16 deletions(-) diff --git a/changes/ticket33491 b/changes/ticket33491 new file mode 100644 index 000000000..595ea863e --- /dev/null +++ b/changes/ticket33491 @@ -0,0 +1,6 @@ + o Major bugfixes (DoS defenses, bridges, pluggable transport): + - DoS subsystem was not given the transport name of the client connection + when tor is a bridge and thus failing to find the GeoIP cache entry for + that client address. This resulted in failing to apply DoS defenses on + bridges with a pluggable transport. Fixes bug 33491; bugfix on + 0.3.3.2-alpha. diff --git a/src/core/or/channel.c b/src/core/or/channel.c index fd7bf6278..388690687 100644 --- a/src/core/or/channel.c +++ b/src/core/or/channel.c @@ -1871,7 +1871,7 @@ channel_do_open_actions(channel_t *chan) tor_free(transport_name); /* Notify the DoS subsystem of a new client. */ if (tlschan && tlschan->conn) { - dos_new_client_conn(tlschan->conn); + dos_new_client_conn(tlschan->conn, transport_name); } } /* Otherwise the underlying transport can't tell us this, so skip it */ diff --git a/src/core/or/dos.c b/src/core/or/dos.c index 5f9bbf90a..d06eaa6d0 100644 --- a/src/core/or/dos.c +++ b/src/core/or/dos.c @@ -671,7 +671,7 @@ dos_log_heartbeat(void) /* Called when a new client connection has been established on the given * address. */ void -dos_new_client_conn(or_connection_t *or_conn) +dos_new_client_conn(or_connection_t *or_conn, const char *transport_name) { clientmap_entry_t *entry; @@ -692,7 +692,7 @@ dos_new_client_conn(or_connection_t *or_conn) } /* We are only interested in client connection from the geoip cache. */ - entry = geoip_lookup_client(&or_conn->real_addr, NULL, + entry = geoip_lookup_client(&or_conn->real_addr, transport_name, GEOIP_CLIENT_CONNECT); if (BUG(entry == NULL)) { /* Should never happen because we note down the address in the geoip diff --git a/src/core/or/dos.h b/src/core/or/dos.h index 95448d053..058b7afce 100644 --- a/src/core/or/dos.h +++ b/src/core/or/dos.h @@ -53,7 +53,8 @@ int dos_enabled(void); void dos_log_heartbeat(void); void dos_geoip_entry_about_to_free(const struct clientmap_entry_t *geoip_ent); -void dos_new_client_conn(or_connection_t *or_conn); +void dos_new_client_conn(or_connection_t *or_conn, + const char *transport_name); void dos_close_client_conn(const or_connection_t *or_conn); int dos_should_refuse_single_hop_client(void); diff --git a/src/test/test_dos.c b/src/test/test_dos.c index 4756c5014..01d7cd006 100644 --- a/src/test/test_dos.c +++ b/src/test/test_dos.c @@ -79,7 +79,7 @@ test_dos_conn_creation(void *arg) { /* Register many conns from this client but not enough to get it blocked */ unsigned int i; for (i = 0; i < max_concurrent_conns; i++) { - dos_new_client_conn(&or_conn); + dos_new_client_conn(&or_conn, NULL); } } @@ -88,7 +88,7 @@ test_dos_conn_creation(void *arg) dos_conn_addr_get_defense_type(addr)); /* Register another conn and check that new conns are not allowed anymore */ - dos_new_client_conn(&or_conn); + dos_new_client_conn(&or_conn, NULL); tt_int_op(DOS_CONN_DEFENSE_CLOSE, OP_EQ, dos_conn_addr_get_defense_type(addr)); @@ -98,7 +98,7 @@ test_dos_conn_creation(void *arg) dos_conn_addr_get_defense_type(addr)); /* Register another conn and see that defense measures get reactivated */ - dos_new_client_conn(&or_conn); + dos_new_client_conn(&or_conn, NULL); tt_int_op(DOS_CONN_DEFENSE_CLOSE, OP_EQ, dos_conn_addr_get_defense_type(addr)); @@ -153,7 +153,7 @@ test_dos_circuit_creation(void *arg) * circuit counting subsystem */ geoip_note_client_seen(GEOIP_CLIENT_CONNECT, addr, NULL, now); for (i = 0; i < min_conc_conns_for_cc ; i++) { - dos_new_client_conn(&or_conn); + dos_new_client_conn(&or_conn, NULL); } /* Register new circuits for this client and conn, but not enough to get @@ -217,7 +217,7 @@ test_dos_bucket_refill(void *arg) /* Register this client */ geoip_note_client_seen(GEOIP_CLIENT_CONNECT, addr, NULL, now); - dos_new_client_conn(&or_conn); + dos_new_client_conn(&or_conn, NULL); /* Fetch this client from the geoip cache and get its DoS structs */ clientmap_entry_t *entry = geoip_lookup_client(addr, NULL, @@ -460,11 +460,11 @@ test_known_relay(void *arg) geoip_note_client_seen(GEOIP_CLIENT_CONNECT, &or_conn.real_addr, NULL, 0); /* Suppose we have 5 connections in rapid succession, the counter should * always be 0 because we should ignore this. */ - dos_new_client_conn(&or_conn); - dos_new_client_conn(&or_conn); - dos_new_client_conn(&or_conn); - dos_new_client_conn(&or_conn); - dos_new_client_conn(&or_conn); + dos_new_client_conn(&or_conn, NULL); + dos_new_client_conn(&or_conn, NULL); + dos_new_client_conn(&or_conn, NULL); + dos_new_client_conn(&or_conn, NULL); + dos_new_client_conn(&or_conn, NULL); entry = geoip_lookup_client(&or_conn.real_addr, NULL, GEOIP_CLIENT_CONNECT); tt_assert(entry); /* We should have a count of 0. */ @@ -474,8 +474,8 @@ test_known_relay(void *arg) * connection and see if we do get it. */ tor_addr_parse(&or_conn.real_addr, "42.42.42.43"); geoip_note_client_seen(GEOIP_CLIENT_CONNECT, &or_conn.real_addr, NULL, 0); - dos_new_client_conn(&or_conn); - dos_new_client_conn(&or_conn); + dos_new_client_conn(&or_conn, NULL); + dos_new_client_conn(&or_conn, NULL); entry = geoip_lookup_client(&or_conn.real_addr, NULL, GEOIP_CLIENT_CONNECT); tt_assert(entry); /* We should have a count of 2. */

1 0

[tor/release-0.4.3] Merge branch 'maint-0.3.5' into maint-0.4.1
by teor＠torproject.org 09 Apr '20

09 Apr '20

commit 987f2fa50ac26af61917c7a6e13dc62f3ddb23ee Merge: 26fd31fef d380acaec Author: teor <teor(a)torproject.org> Date: Thu Apr 9 11:03:20 2020 +1000 Merge branch 'maint-0.3.5' into maint-0.4.1 changes/ticket33491 | 6 ++++++ src/core/or/channel.c | 2 +- src/core/or/dos.c | 4 ++-- src/core/or/dos.h | 3 ++- src/test/test_dos.c | 24 ++++++++++++------------ 5 files changed, 23 insertions(+), 16 deletions(-)

1 0

[tor/release-0.4.2] Merge branch 'maint-0.4.2' into release-0.4.2
by teor＠torproject.org 09 Apr '20

09 Apr '20

commit 958f6eb5c7b0f85197959970bd6bab5a54ecc30d Merge: c22601765 2d7e08d57 Author: teor <teor(a)torproject.org> Date: Thu Apr 9 11:03:30 2020 +1000 Merge branch 'maint-0.4.2' into release-0.4.2 changes/ticket33491 | 6 ++++++ src/core/or/channel.c | 2 +- src/core/or/dos.c | 4 ++-- src/core/or/dos.h | 3 ++- src/test/test_dos.c | 24 ++++++++++++------------ 5 files changed, 23 insertions(+), 16 deletions(-)

1 0

[tor/release-0.4.3] Merge remote-tracking branch 'tor-github/pr/1784' into maint-0.3.5
by teor＠torproject.org 09 Apr '20

09 Apr '20

commit d380acaecad5f554f7294cfcd7fbf100f9bbaca3 Merge: 38e07b88f 894ff2dc8 Author: teor <teor(a)torproject.org> Date: Thu Apr 9 11:02:49 2020 +1000 Merge remote-tracking branch 'tor-github/pr/1784' into maint-0.3.5 changes/ticket33491 | 6 ++++++ src/core/or/channel.c | 2 +- src/core/or/dos.c | 4 ++-- src/core/or/dos.h | 3 ++- src/test/test_dos.c | 24 ++++++++++++------------ 5 files changed, 23 insertions(+), 16 deletions(-)

1 0

[tor/release-0.4.3] client: Revert setting PreferIPv6 on by default
by teor＠torproject.org 09 Apr '20

09 Apr '20

commit cd2121a1262c2d51b8b9174933db5c985f0ccc55 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Apr 7 09:04:01 2020 -0400 client: Revert setting PreferIPv6 on by default This change broke torsocks that by default is expecting an IPv4 for hostname resolution because it can't ask tor for a specific IP version with the SOCKS5 extension. PreferIPv6 made it that sometimes the IPv6 could be returned to torsocks that was expecting an IPv4. Torsocks is probably a very unique case because the runtime flow is that it hijacks DNS resolution (ex: getaddrinfo()), gets an IP and then sends it back for the connect() to happen. The libc has DNS resolution functions that allows the caller to request a specific INET family but torsocks can't tell tor to resolve the hostname only to an IPv4 or IPv6 and thus by default fallsback to IPv4. Reverting this change into 0.4.3.x series but we'll keep it in the 0.4.4.x series in the hope that we add this SOCKS5 extension to tor for DNS resolution and then change torsocks to use that. Fixes #33804 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket33804 | 7 +++++++ doc/tor.1.txt | 7 +++---- src/app/config/config.c | 4 ++-- src/test/test_config.c | 2 +- 4 files changed, 13 insertions(+), 7 deletions(-) diff --git a/changes/ticket33804 b/changes/ticket33804 new file mode 100644 index 000000000..254246dac --- /dev/null +++ b/changes/ticket33804 @@ -0,0 +1,7 @@ + o Minor bugfixes (client, SocksPort, IPv6): + - Revert PreferIPv6 set by default on the SocksPort because it brokes the + torsocks use case. Tor doesn't have a way for an application to request + the hostname to be resolved for a specific IP version but torsocks + requires that. Up until now, IPv4 was used by default so it is expecting + that, and can't handle a possible IPv6 being returned. Fixes bug 33804; + bugfix on 0.4.3.1-alpha. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 79809832c..b2014842c 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1492,10 +1492,9 @@ The following options are useful only for clients (that is, if requests on this connection. This option is only relevant when SOCKS5 is in use, because SOCKS4 can't handle IPv6. (Allowing IPv6 is the default.) - **NoPreferIPv6**;; + **PreferIPv6**;; Tells exits that, if a host has both an IPv4 and an IPv6 address, - we would prefer to connect to it via IPv4. (IPv6 is the default in - recent versions of Tor.) + we would prefer to connect to it via IPv6. (IPv4 is the default.) **NoDNSRequest**;; Do not ask exits to resolve DNS addresses in SOCKS5 requests. Tor will connect to IPv4 addresses, IPv6 addresses (if IPv6Traffic is set) and @@ -1537,7 +1536,7 @@ The following options are useful only for clients (that is, if When serving a hostname lookup request on this port that should get automapped (according to AutomapHostsOnResolve), if we could return either an IPv4 or an IPv6 answer, prefer - an IPv4 answer. (Tor prefers IPv6 by default.) + an IPv4 answer. (Tor prefers IPv4 by default.) **PreferSOCKSNoAuth**;; Ordinarily, when an application offers both "username/password authentication" and "no authentication" to Tor via SOCKS5, Tor diff --git a/src/app/config/config.c b/src/app/config/config.c index bbf984ad0..c7ac9d631 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -5886,7 +5886,7 @@ port_cfg_new(size_t namelen) port_cfg_t *cfg = tor_malloc_zero(sizeof(port_cfg_t) + namelen + 1); cfg->entry_cfg.ipv4_traffic = 1; cfg->entry_cfg.ipv6_traffic = 1; - cfg->entry_cfg.prefer_ipv6 = 1; + cfg->entry_cfg.prefer_ipv6 = 0; cfg->entry_cfg.dns_request = 1; cfg->entry_cfg.onion_traffic = 1; cfg->entry_cfg.prefer_ipv6_virtaddr = 1; @@ -6134,7 +6134,7 @@ port_parse_config(smartlist_t *out, /* This must be kept in sync with port_cfg_new's defaults */ int no_listen = 0, no_advertise = 0, all_addrs = 0, bind_ipv4_only = 0, bind_ipv6_only = 0, - ipv4_traffic = 1, ipv6_traffic = 1, prefer_ipv6 = 1, dns_request = 1, + ipv4_traffic = 1, ipv6_traffic = 1, prefer_ipv6 = 0, dns_request = 1, onion_traffic = 1, cache_ipv4 = 0, use_cached_ipv4 = 0, cache_ipv6 = 0, use_cached_ipv6 = 0, diff --git a/src/test/test_config.c b/src/test/test_config.c index ee277104f..7b9812f55 100644 --- a/src/test/test_config.c +++ b/src/test/test_config.c @@ -4159,7 +4159,7 @@ test_config_parse_port_config__ports__ports_given(void *data) tt_int_op(port_cfg->entry_cfg.dns_request, OP_EQ, 1); tt_int_op(port_cfg->entry_cfg.ipv4_traffic, OP_EQ, 1); tt_int_op(port_cfg->entry_cfg.ipv6_traffic, OP_EQ, 1); - tt_int_op(port_cfg->entry_cfg.prefer_ipv6, OP_EQ, 1); + tt_int_op(port_cfg->entry_cfg.prefer_ipv6, OP_EQ, 0); tt_int_op(port_cfg->entry_cfg.onion_traffic, OP_EQ, 1); tt_int_op(port_cfg->entry_cfg.cache_ipv4_answers, OP_EQ, 0); tt_int_op(port_cfg->entry_cfg.prefer_ipv6_virtaddr, OP_EQ, 1);

1 0

[tor/release-0.4.3] Merge branch 'maint-0.4.3' into release-0.4.3
by teor＠torproject.org 09 Apr '20

09 Apr '20

commit 456337a8dd52085c4a8647ceb2b74f40fde20934 Merge: 72e4ed863 f6efb3a18 Author: teor <teor(a)torproject.org> Date: Thu Apr 9 11:07:47 2020 +1000 Merge branch 'maint-0.4.3' into release-0.4.3 changes/ticket33804 | 7 +++++++ doc/tor.1.txt | 7 +++---- src/app/config/config.c | 4 ++-- src/test/test_config.c | 2 +- 4 files changed, 13 insertions(+), 7 deletions(-)

1 0

[tor/release-0.4.3] Merge branch 'maint-0.4.2' into maint-0.4.3
by teor＠torproject.org 09 Apr '20

09 Apr '20

commit 2d6f00e45b3003337242704e0fde2d2adbaa6cf5 Merge: 34faee060 2d7e08d57 Author: teor <teor(a)torproject.org> Date: Thu Apr 9 11:03:34 2020 +1000 Merge branch 'maint-0.4.2' into maint-0.4.3 changes/ticket33491 | 6 ++++++ src/core/or/channel.c | 2 +- src/core/or/dos.c | 4 ++-- src/core/or/dos.h | 3 ++- src/test/test_dos.c | 24 ++++++++++++------------ 5 files changed, 23 insertions(+), 16 deletions(-)

1 0

[tor/release-0.4.3] Merge branch 'maint-0.4.3' into release-0.4.3
by teor＠torproject.org 09 Apr '20

09 Apr '20

commit 72e4ed86347a9426788265379befe8dd7be6b0d6 Merge: a985f554c 2d6f00e45 Author: teor <teor(a)torproject.org> Date: Thu Apr 9 11:03:37 2020 +1000 Merge branch 'maint-0.4.3' into release-0.4.3 changes/ticket33491 | 6 ++++++ src/core/or/channel.c | 2 +- src/core/or/dos.c | 4 ++-- src/core/or/dos.h | 3 ++- src/test/test_dos.c | 24 ++++++++++++------------ 5 files changed, 23 insertions(+), 16 deletions(-)

1 0