June 2020 - tor-commits - lists.torproject.org

[tor/master] circuit: Add flags for IPv6 extends
by nickm＠torproject.org 09 Jun '20

09 Jun '20

commit 9e7f51e469cd275ef519498945124fe5addc889f Author: teor <teor(a)riseup.net> Date: Mon May 11 16:54:01 2020 +1000 circuit: Add flags for IPv6 extends But don't implement the actual node selection yet. Part of 33226. --- src/core/or/circuitbuild.c | 12 ++++++++---- src/core/or/circuitlist.c | 4 ++-- src/core/or/circuituse.c | 17 ++++++++++++----- src/core/or/circuituse.h | 16 +++++++++++----- src/core/or/cpath_build_state_st.h | 2 ++ src/feature/relay/selftest.c | 8 ++++++-- 6 files changed, 41 insertions(+), 18 deletions(-) diff --git a/src/core/or/circuitbuild.c b/src/core/or/circuitbuild.c index 8d5988b63..ba70c4753 100644 --- a/src/core/or/circuitbuild.c +++ b/src/core/or/circuitbuild.c @@ -439,7 +439,8 @@ onion_populate_cpath(origin_circuit_t *circ) /** Create and return a new origin circuit. Initialize its purpose and * build-state based on our arguments. The flags argument is a - * bitfield of CIRCLAUNCH_* flags. */ + * bitfield of CIRCLAUNCH_* flags, see circuit_launch_by_extend_info() for + * more details. */ origin_circuit_t * origin_circuit_init(uint8_t purpose, int flags) { @@ -455,13 +456,16 @@ origin_circuit_init(uint8_t purpose, int flags) ((flags & CIRCLAUNCH_NEED_CAPACITY) ? 1 : 0); circ->build_state->is_internal = ((flags & CIRCLAUNCH_IS_INTERNAL) ? 1 : 0); + circ->build_state->is_ipv6_selftest = + ((flags & CIRCLAUNCH_IS_IPV6_SELFTEST) ? 1 : 0); circ->base_.purpose = purpose; return circ; } -/** Build a new circuit for purpose. If exit - * is defined, then use that as your exit router, else choose a suitable - * exit node. +/** Build a new circuit for purpose. If exit is defined, then use + * that as your exit router, else choose a suitable exit node. The flags + * argument is a bitfield of CIRCLAUNCH_* flags, see + * circuit_launch_by_extend_info() for more details. * * Also launch a connection to the first OR in the chosen path, if * it's not open already. diff --git a/src/core/or/circuitlist.c b/src/core/or/circuitlist.c index ca174c442..bfee4104e 100644 --- a/src/core/or/circuitlist.c +++ b/src/core/or/circuitlist.c @@ -1943,8 +1943,8 @@ circuit_find_to_cannibalize(uint8_t purpose_to_produce, extend_info_t *info, } /* Ignore any circuits for which we can't use the Guard. It is possible - * that the Guard was removed from the samepled set after the circuit - * was created so avoid using it. */ + * that the Guard was removed from the sampled set after the circuit + * was created, so avoid using it. */ if (!entry_guard_could_succeed(circ->guard_state)) { goto next; } diff --git a/src/core/or/circuituse.c b/src/core/or/circuituse.c index 46ebcc5dc..71063dc72 100644 --- a/src/core/or/circuituse.c +++ b/src/core/or/circuituse.c @@ -2092,11 +2092,18 @@ circuit_should_cannibalize_to_build(uint8_t purpose_to_build, } /** Launch a new circuit with purpose purpose and exit node - * extend_info (or NULL to select a random exit node). If flags - * contains CIRCLAUNCH_NEED_UPTIME, choose among routers with high uptime. If - * CIRCLAUNCH_NEED_CAPACITY is set, choose among routers with high bandwidth. - * If CIRCLAUNCH_IS_INTERNAL is true, the last hop need not be an exit node. - * If CIRCLAUNCH_ONEHOP_TUNNEL is set, the circuit will have only one hop. + * extend_info (or NULL to select a random exit node). + * + * If flags contains: + * - CIRCLAUNCH_ONEHOP_TUNNEL: the circuit will have only one hop; + * - CIRCLAUNCH_NEED_UPTIME: choose routers with high uptime; + * - CIRCLAUNCH_NEED_CAPACITY: choose routers with high bandwidth; + * - CIRCLAUNCH_IS_IPV6_SELFTEST: the second-last hop must support IPv6 + * extends; + * - CIRCLAUNCH_IS_INTERNAL: the last hop need not be an exit node; + * - CIRCLAUNCH_IS_V3_RP: the last hop must support v3 onion service + * rendezvous. + * * Return the newly allocated circuit on success, or NULL on failure. */ origin_circuit_t * circuit_launch_by_extend_info(uint8_t purpose, diff --git a/src/core/or/circuituse.h b/src/core/or/circuituse.h index 95d36d647..028fe4aa4 100644 --- a/src/core/or/circuituse.h +++ b/src/core/or/circuituse.h @@ -36,17 +36,23 @@ void circuit_try_attaching_streams(origin_circuit_t *circ); void circuit_build_failed(origin_circuit_t *circ); /** Flag to set when a circuit should have only a single hop. */ -#define CIRCLAUNCH_ONEHOP_TUNNEL (1<<0) +#define CIRCLAUNCH_ONEHOP_TUNNEL (1<<0) /** Flag to set when a circuit needs to be built of high-uptime nodes */ -#define CIRCLAUNCH_NEED_UPTIME (1<<1) +#define CIRCLAUNCH_NEED_UPTIME (1<<1) /** Flag to set when a circuit needs to be built of high-capacity nodes */ -#define CIRCLAUNCH_NEED_CAPACITY (1<<2) +#define CIRCLAUNCH_NEED_CAPACITY (1<<2) /** Flag to set when the last hop of a circuit doesn't need to be an * exit node. */ -#define CIRCLAUNCH_IS_INTERNAL (1<<3) +#define CIRCLAUNCH_IS_INTERNAL (1<<3) /** Flag to set when we are trying to launch a v3 rendezvous circuit. We need * to apply some additional filters on the node picked. */ -#define CIRCLAUNCH_IS_V3_RP (1<<4) +#define CIRCLAUNCH_IS_V3_RP (1<<4) +/** Flag to set when we are trying to launch a self-testing circuit to our + * IPv6 ORPort. We need to apply some additional filters on the second-last + * node in the circuit. (We are both the client and the last node in the + * circuit.) */ +#define CIRCLAUNCH_IS_IPV6_SELFTEST (1<<5) + origin_circuit_t *circuit_launch_by_extend_info(uint8_t purpose, extend_info_t *info, int flags); diff --git a/src/core/or/cpath_build_state_st.h b/src/core/or/cpath_build_state_st.h index ee9a0d972..eb8e97edc 100644 --- a/src/core/or/cpath_build_state_st.h +++ b/src/core/or/cpath_build_state_st.h @@ -24,6 +24,8 @@ struct cpath_build_state_t { unsigned int need_capacity : 1; /** Whether the last hop was picked with exiting in mind. */ unsigned int is_internal : 1; + /** Is this an IPv6 ORPort self-testing circuit? */ + unsigned int is_ipv6_selftest : 1; /** Did we pick this as a one-hop tunnel (not safe for other streams)? * These are for encrypted dir conns that exit to this router, not * for arbitrary exits from the circuit. */ diff --git a/src/feature/relay/selftest.c b/src/feature/relay/selftest.c index e311c08ec..ae5633bfb 100644 --- a/src/feature/relay/selftest.c +++ b/src/feature/relay/selftest.c @@ -190,15 +190,19 @@ router_do_orport_reachability_checks(const routerinfo_t *me, int orport_reachable) { extend_info_t *ei = extend_info_from_router(me, family); + int ipv6_flags = (family == AF_INET6 ? CIRCLAUNCH_IS_IPV6_SELFTEST : 0); - /* If we don't have an IPv6 ORPort, ei will be NULL. */ + /* If we're trying to test IPv6, but we don't have an IPv6 ORPort, ei will + * be NULL. */ if (ei) { const char *family_name = fmt_af_family(family); log_info(LD_CIRC, "Testing %s of my %s ORPort: %s.", !orport_reachable ? "reachability" : "bandwidth", family_name, fmt_addrport(&ei->addr, ei->port)); circuit_launch_by_extend_info(CIRCUIT_PURPOSE_TESTING, ei, - CIRCLAUNCH_NEED_CAPACITY|CIRCLAUNCH_IS_INTERNAL); + CIRCLAUNCH_NEED_CAPACITY| + CIRCLAUNCH_IS_INTERNAL| + ipv6_flags); extend_info_free(ei); } }

1 0

[tor/master] nodelist: Fix a comment and a log message
by nickm＠torproject.org 09 Jun '20

09 Jun '20

commit 8829d2d64428675e205889dc0af22cd2d98d53f0 Author: teor <teor(a)riseup.net> Date: Mon May 11 17:01:49 2020 +1000 nodelist: Fix a comment and a log message --- src/feature/nodelist/node_select.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/feature/nodelist/node_select.c b/src/feature/nodelist/node_select.c index 8e7da1ae2..fe88b7230 100644 --- a/src/feature/nodelist/node_select.c +++ b/src/feature/nodelist/node_select.c @@ -992,7 +992,7 @@ router_choose_random_node(smartlist_t *excludedsmartlist, smartlist_add(excludednodes, (node_t*)node); } else if (rendezvous_v3 && !node_supports_v3_rendezvous_point(node)) { - /* Exclude relays that do not support to rendezvous for a hidden service + /* Exclude relays that can not become a rendezvous for a hidden service * version 3. */ smartlist_add(excludednodes, (node_t*)node); } @@ -1030,11 +1030,12 @@ router_choose_random_node(smartlist_t *excludedsmartlist, if (!choice && (need_uptime || need_capacity || need_guard || pref_addr)) { /* try once more -- recurse but with fewer restrictions. */ log_info(LD_CIRC, - "We couldn't find any live%s%s%s routers; falling back " + "We couldn't find any live%s%s%s%s routers; falling back " "to list of all routers.", need_capacity?", fast":"", need_uptime?", stable":"", - need_guard?", guard":""); + need_guard?", guard":"", + pref_addr?", preferred address":""); flags &= ~ (CRN_NEED_UPTIME|CRN_NEED_CAPACITY|CRN_NEED_GUARD| CRN_PREF_ADDR); choice = router_choose_random_node(

1 0

[tor/master] Wrap long lines
by nickm＠torproject.org 09 Jun '20

09 Jun '20

commit 74902c8aca96dda3178fac768223bcdb9a11f50c Author: teor <teor(a)riseup.net> Date: Thu May 7 20:16:56 2020 +1000 Wrap long lines --- src/core/or/circuituse.c | 3 ++- src/feature/control/control_getinfo.c | 17 ++++++++++------- src/feature/nodelist/node_select.c | 16 ++++++++++------ src/feature/nodelist/routerlist.c | 9 ++++++--- src/feature/nodelist/routerlist.h | 8 +++++--- src/feature/relay/selftest.c | 3 ++- src/feature/relay/selftest.h | 6 ++++-- 7 files changed, 39 insertions(+), 23 deletions(-) diff --git a/src/core/or/circuituse.c b/src/core/or/circuituse.c index 3ab527f42..46ebcc5dc 100644 --- a/src/core/or/circuituse.c +++ b/src/core/or/circuituse.c @@ -1659,7 +1659,8 @@ static void circuit_testing_failed(origin_circuit_t *circ, int at_last_hop) { const or_options_t *options = get_options(); - if (server_mode(options) && router_should_skip_orport_reachability_check(options)) + if (server_mode(options) && + router_should_skip_orport_reachability_check(options)) return; log_info(LD_GENERAL, diff --git a/src/feature/control/control_getinfo.c b/src/feature/control/control_getinfo.c index 52cf54b1c..39113b571 100644 --- a/src/feature/control/control_getinfo.c +++ b/src/feature/control/control_getinfo.c @@ -1276,15 +1276,18 @@ getinfo_helper_events(control_connection_t *control_conn, *answer = tor_strdup(directories_have_accepted_server_descriptor() ? "1" : "0"); } else if (!strcmp(question, "status/reachability-succeeded/or")) { - *answer = tor_strdup(router_should_skip_orport_reachability_check(options) ? - "1" : "0"); + *answer = tor_strdup( + router_should_skip_orport_reachability_check(options) ? + "1" : "0"); } else if (!strcmp(question, "status/reachability-succeeded/dir")) { - *answer = tor_strdup(router_should_skip_dirport_reachability_check(options) ? - "1" : "0"); + *answer = tor_strdup( + router_should_skip_dirport_reachability_check(options) ? + "1" : "0"); } else if (!strcmp(question, "status/reachability-succeeded")) { - tor_asprintf(answer, "OR=%d DIR=%d", - router_should_skip_orport_reachability_check(options) ? 1 : 0, - router_should_skip_dirport_reachability_check(options) ? 1 : 0); + tor_asprintf( + answer, "OR=%d DIR=%d", + router_should_skip_orport_reachability_check(options) ? 1 : 0, + router_should_skip_dirport_reachability_check(options) ? 1 : 0); } else if (!strcmp(question, "status/bootstrap-phase")) { *answer = control_event_boot_last_msg(); } else if (!strcmpstart(question, "status/version/")) { diff --git a/src/feature/nodelist/node_select.c b/src/feature/nodelist/node_select.c index d2118c524..bd63cd3b6 100644 --- a/src/feature/nodelist/node_select.c +++ b/src/feature/nodelist/node_select.c @@ -321,10 +321,12 @@ router_pick_directory_server_impl(dirinfo_type_t type, int flags, overloaded_direct = smartlist_new(); overloaded_tunnel = smartlist_new(); - const int skip_or_fw = client_or_conn_should_skip_reachable_address_check(options, + const int skip_or_fw = client_or_conn_should_skip_reachable_address_check( + options, + try_ip_pref); + const int skip_dir_fw = client_dir_conn_should_skip_reachable_address_check( + options, try_ip_pref); - const int skip_dir_fw = client_dir_conn_should_skip_reachable_address_check(options, - try_ip_pref); const int must_have_or = dirclient_must_use_begindir(options); /* Find all the running dirservers we know about. */ @@ -1122,10 +1124,12 @@ router_pick_trusteddirserver_impl(const smartlist_t *sourcelist, overloaded_direct = smartlist_new(); overloaded_tunnel = smartlist_new(); - const int skip_or_fw = client_or_conn_should_skip_reachable_address_check(options, + const int skip_or_fw = client_or_conn_should_skip_reachable_address_check( + options, + try_ip_pref); + const int skip_dir_fw = client_dir_conn_should_skip_reachable_address_check( + options, try_ip_pref); - const int skip_dir_fw = client_dir_conn_should_skip_reachable_address_check(options, - try_ip_pref); const int must_have_or = dirclient_must_use_begindir(options); SMARTLIST_FOREACH_BEGIN(sourcelist, const dir_server_t *, d) diff --git a/src/feature/nodelist/routerlist.c b/src/feature/nodelist/routerlist.c index 0e8fff7c3..2a5353c56 100644 --- a/src/feature/nodelist/routerlist.c +++ b/src/feature/nodelist/routerlist.c @@ -476,7 +476,8 @@ router_reload_router_list(void) * Finally, return true if ReachableAddresses is set. */ int -client_or_conn_should_skip_reachable_address_check(const or_options_t *options, +client_or_conn_should_skip_reachable_address_check( + const or_options_t *options, int try_ip_pref) { /* Servers always have and prefer IPv4. @@ -491,7 +492,8 @@ client_or_conn_should_skip_reachable_address_check(const or_options_t *options, * This function is obsolete, because clients only use ORPorts. */ int -client_dir_conn_should_skip_reachable_address_check(const or_options_t *options, +client_dir_conn_should_skip_reachable_address_check( + const or_options_t *options, int try_ip_pref) { /* Servers always have and prefer IPv4. @@ -518,7 +520,8 @@ router_add_running_nodes_to_smartlist(smartlist_t *sl, int need_uptime, int need_desc, int pref_addr, int direct_conn) { - const int check_reach = !client_or_conn_should_skip_reachable_address_check(get_options(), + const int check_reach = !client_or_conn_should_skip_reachable_address_check( + get_options(), pref_addr); /* XXXX MOVE */ SMARTLIST_FOREACH_BEGIN(nodelist_get_list(), const node_t *, node) { diff --git a/src/feature/nodelist/routerlist.h b/src/feature/nodelist/routerlist.h index 55eec6c3f..5256298d8 100644 --- a/src/feature/nodelist/routerlist.h +++ b/src/feature/nodelist/routerlist.h @@ -50,10 +50,12 @@ typedef enum was_router_added_t { int router_reload_router_list(void); -int client_or_conn_should_skip_reachable_address_check(const or_options_t *options, +int client_or_conn_should_skip_reachable_address_check( + const or_options_t *options, + int try_ip_pref); +int client_dir_conn_should_skip_reachable_address_check( + const or_options_t *options, int try_ip_pref); -int client_dir_conn_should_skip_reachable_address_check(const or_options_t *options, - int try_ip_pref); void router_reset_status_download_failures(void); int routers_have_same_or_addrs(const routerinfo_t *r1, const routerinfo_t *r2); void router_add_running_nodes_to_smartlist(smartlist_t *sl, int need_uptime, diff --git a/src/feature/relay/selftest.c b/src/feature/relay/selftest.c index a498e3dff..23e4a7dec 100644 --- a/src/feature/relay/selftest.c +++ b/src/feature/relay/selftest.c @@ -154,7 +154,8 @@ extend_info_from_router(const routerinfo_t *r, int family) /* Relays always assume that the first hop is reachable. They ignore * ReachableAddresses. */ - tor_assert_nonfatal(client_or_conn_should_skip_reachable_address_check(get_options(), 0)); + tor_assert_nonfatal(client_or_conn_should_skip_reachable_address_check( + get_options(), 0)); const ed25519_public_key_t *ed_id_key; if (r->cache_info.signing_key_cert) diff --git a/src/feature/relay/selftest.h b/src/feature/relay/selftest.h index f2350cf8f..5799a6ca3 100644 --- a/src/feature/relay/selftest.h +++ b/src/feature/relay/selftest.h @@ -15,8 +15,10 @@ #ifdef HAVE_MODULE_RELAY struct or_options_t; -int router_should_skip_orport_reachability_check(const struct or_options_t *options); -int router_should_skip_dirport_reachability_check(const struct or_options_t *options); +int router_should_skip_orport_reachability_check( + const struct or_options_t *options); +int router_should_skip_dirport_reachability_check( + const struct or_options_t *options); void router_do_reachability_checks(int test_or, int test_dir); void router_perform_bandwidth_test(int num_circs, time_t now);

1 0

[tor/master] practracker: Accept extra or.h lines
by nickm＠torproject.org 09 Jun '20

09 Jun '20

commit b64972edcd7e3707ff25ed8bfca421d61101efed Author: teor <teor(a)riseup.net> Date: Mon May 11 12:28:00 2020 +1000 practracker: Accept extra or.h lines --- scripts/maint/practracker/exceptions.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/maint/practracker/exceptions.txt b/scripts/maint/practracker/exceptions.txt index 96d72362b..cd4b5577b 100644 --- a/scripts/maint/practracker/exceptions.txt +++ b/scripts/maint/practracker/exceptions.txt @@ -146,7 +146,7 @@ problem function-size /src/core/or/connection_or.c:connection_or_client_learned_ problem dependency-violation /src/core/or/connection_or.c 21 problem dependency-violation /src/core/or/dos.c 6 problem dependency-violation /src/core/or/onion.c 2 -problem file-size /src/core/or/or.h 1105 +problem file-size /src/core/or/or.h 1150 problem include-count /src/core/or/or.h 48 problem dependency-violation /src/core/or/or.h 1 problem dependency-violation /src/core/or/or_periodic.c 1

1 0

[tor/master] protover: Sort version flags by their underlying protocols
by nickm＠torproject.org 09 Jun '20

09 Jun '20

commit 51f32140b41551bf8f34c9e30a067ddf027401b6 Author: teor <teor(a)riseup.net> Date: Mon May 11 12:21:18 2020 +1000 protover: Sort version flags by their underlying protocols Also fix some comment typos, mainly ">=" when the code says "=". Part of 33226. --- src/core/or/or.h | 9 +++++---- src/core/or/versions.c | 10 ++++++++-- src/feature/nodelist/nodelist.c | 24 ++++++++++++------------ 3 files changed, 25 insertions(+), 18 deletions(-) diff --git a/src/core/or/or.h b/src/core/or/or.h index 5b35cbe7f..28211b48c 100644 --- a/src/core/or/or.h +++ b/src/core/or/or.h @@ -830,6 +830,10 @@ typedef struct protover_summary_flags_t { * the v3 protocol detailed in proposal 224. This requires HSIntro=4. */ unsigned int supports_ed25519_hs_intro : 1; + /** True iff this router has a protocol list that allows it to support the + * ESTABLISH_INTRO DoS cell extension. Requires HSIntro=5. */ + unsigned int supports_establish_intro_dos_extension : 1; + /** True iff this router has a protocol list that allows it to be an hidden * service directory supporting version 3 as seen in proposal 224. This * requires HSDir=2. */ @@ -841,12 +845,9 @@ typedef struct protover_summary_flags_t { unsigned int supports_v3_rendezvous_point: 1; /** True iff this router has a protocol list that allows clients to - * negotiate hs circuit setup padding. Requires Padding>=2. */ + * negotiate hs circuit setup padding. Requires Padding=2. */ unsigned int supports_hs_setup_padding : 1; - /** True iff this router has a protocol list that allows it to support the - * ESTABLISH_INTRO DoS cell extension. Requires HSIntro>=5. */ - unsigned int supports_establish_intro_dos_extension : 1; } protover_summary_flags_t; typedef struct routerinfo_t routerinfo_t; diff --git a/src/core/or/versions.c b/src/core/or/versions.c index a9a960d66..2a33bf68f 100644 --- a/src/core/or/versions.c +++ b/src/core/or/versions.c @@ -434,25 +434,31 @@ memoize_protover_summary(protover_summary_flags_t *out, memset(out, 0, sizeof(*out)); out->protocols_known = 1; + out->supports_extend2_cells = protocol_list_supports_protocol(protocols, PRT_RELAY, 2); + out->supports_ed25519_link_handshake_compat = protocol_list_supports_protocol(protocols, PRT_LINKAUTH, 3); out->supports_ed25519_link_handshake_any = protocol_list_supports_protocol_or_later(protocols, PRT_LINKAUTH, 3); + out->supports_ed25519_hs_intro = protocol_list_supports_protocol(protocols, PRT_HSINTRO, 4); + out->supports_establish_intro_dos_extension = + protocol_list_supports_protocol(protocols, PRT_HSINTRO, 5); + out->supports_v3_hsdir = protocol_list_supports_protocol(protocols, PRT_HSDIR, PROTOVER_HSDIR_V3); + out->supports_v3_rendezvous_point = protocol_list_supports_protocol(protocols, PRT_HSREND, PROTOVER_HS_RENDEZVOUS_POINT_V3); + out->supports_hs_setup_padding = protocol_list_supports_protocol(protocols, PRT_PADDING, PROTOVER_HS_SETUP_PADDING); - out->supports_establish_intro_dos_extension = - protocol_list_supports_protocol(protocols, PRT_HSINTRO, 5); protover_summary_flags_t *new_cached = tor_memdup(out, sizeof(*out)); cached = strmap_set(protover_summary_map, protocols, new_cached); diff --git a/src/feature/nodelist/nodelist.c b/src/feature/nodelist/nodelist.c index 7454f342f..6a8e1723d 100644 --- a/src/feature/nodelist/nodelist.c +++ b/src/feature/nodelist/nodelist.c @@ -1193,18 +1193,7 @@ node_supports_ed25519_hs_intro(const node_t *node) return node_get_protover_summary_flags(node)->supports_ed25519_hs_intro; } -/** Return true iff node supports the DoS ESTABLISH_INTRO cell - * extenstion. */ -int -node_supports_establish_intro_dos_extension(const node_t *node) -{ - tor_assert(node); - - return node_get_protover_summary_flags(node)-> - supports_establish_intro_dos_extension; -} - -/** Return true iff node supports to be a rendezvous point for hidden +/** Return true iff node can be a rendezvous point for hidden * service version 3 (HSRend=2). */ int node_supports_v3_rendezvous_point(const node_t *node) @@ -1219,6 +1208,17 @@ node_supports_v3_rendezvous_point(const node_t *node) return node_get_protover_summary_flags(node)->supports_v3_rendezvous_point; } +/** Return true iff node supports the DoS ESTABLISH_INTRO cell + * extenstion. */ +int +node_supports_establish_intro_dos_extension(const node_t *node) +{ + tor_assert(node); + + return node_get_protover_summary_flags(node)-> + supports_establish_intro_dos_extension; +} + /** Return the RSA ID key's SHA1 digest for the provided node. */ const uint8_t * node_get_rsa_id_digest(const node_t *node)

1 0

[tor/master] protover: Add node functions for IPv6 extend support
by nickm＠torproject.org 09 Jun '20

09 Jun '20

commit c7f085d9bdf4196b04054f5812e29137d1789ad7 Author: teor <teor(a)riseup.net> Date: Mon May 11 12:25:41 2020 +1000 protover: Add node functions for IPv6 extend support Part of 33226. --- src/core/or/or.h | 12 ++++++++++ src/core/or/versions.c | 7 ++++++ src/feature/nodelist/nodelist.c | 52 ++++++++++++++++++++++++++++++++++++++++- src/feature/nodelist/nodelist.h | 5 ++++ src/feature/relay/router.c | 17 +++++++++++++- 5 files changed, 91 insertions(+), 2 deletions(-) diff --git a/src/core/or/or.h b/src/core/or/or.h index 28211b48c..7e02da664 100644 --- a/src/core/or/or.h +++ b/src/core/or/or.h @@ -815,6 +815,18 @@ typedef struct protover_summary_flags_t { * accept EXTEND2 cells. This requires Relay=2. */ unsigned int supports_extend2_cells:1; + /** True iff this router has a version or protocol list that allows it to + * accept IPv6 connections. This requires Relay=2 or Relay=3. */ + unsigned int supports_accepting_ipv6_extends:1; + + /** True iff this router has a version or protocol list that allows it to + * initiate IPv6 connections. This requires Relay=3. */ + unsigned int supports_initiating_ipv6_extends:1; + + /** True iff this router has a version or protocol list that allows it to + * consider IPv6 connections canonical. This requires Relay=3. */ + unsigned int supports_canonical_ipv6_conns:1; + /** True iff this router has a protocol list that allows it to negotiate * ed25519 identity keys on a link handshake with us. This * requires LinkAuth=3. */ diff --git a/src/core/or/versions.c b/src/core/or/versions.c index 2a33bf68f..a8dfe7e61 100644 --- a/src/core/or/versions.c +++ b/src/core/or/versions.c @@ -437,6 +437,13 @@ memoize_protover_summary(protover_summary_flags_t *out, out->supports_extend2_cells = protocol_list_supports_protocol(protocols, PRT_RELAY, 2); + out->supports_accepting_ipv6_extends = ( + protocol_list_supports_protocol(protocols, PRT_RELAY, 2) || + protocol_list_supports_protocol(protocols, PRT_RELAY, 3)); + out->supports_initiating_ipv6_extends = + protocol_list_supports_protocol(protocols, PRT_RELAY, 3); + out->supports_canonical_ipv6_conns = + protocol_list_supports_protocol(protocols, PRT_RELAY, 3); out->supports_ed25519_link_handshake_compat = protocol_list_supports_protocol(protocols, PRT_LINKAUTH, 3); diff --git a/src/feature/nodelist/nodelist.c b/src/feature/nodelist/nodelist.c index 6a8e1723d..a55339062 100644 --- a/src/feature/nodelist/nodelist.c +++ b/src/feature/nodelist/nodelist.c @@ -1133,7 +1133,7 @@ node_ed25519_id_matches(const node_t *node, const ed25519_public_key_t *id) /** Dummy object that should be unreturnable. Used to ensure that * node_get_protover_summary_flags() always returns non-NULL. */ static const protover_summary_flags_t zero_protover_flags = { - 0,0,0,0,0,0,0,0,0 + 0,0,0,0,0,0,0,0,0,0,0,0 }; /** Return the protover_summary_flags for a given node. */ @@ -1219,6 +1219,56 @@ node_supports_establish_intro_dos_extension(const node_t *node) supports_establish_intro_dos_extension; } +/** Return true iff node can initiate IPv6 extends (Relay=3). + * + * This check should only be performed by client path selection code. + * + * Extending relays should check their own IPv6 support using + * router_can_extend_over_ipv6(). Like other extends, they should not verify + * the link specifiers in the extend cell against the consensus, because it + * may be out of date. */ +bool +node_supports_initiating_ipv6_extends(const node_t *node) +{ + tor_assert(node); + + /* Relays can't initiate an IPv6 extend, unless they have an IPv6 ORPort. */ + if (!node_has_ipv6_orport(node)) { + return 0; + } + + /* Initiating relays also need to support the relevant protocol version. */ + return + node_get_protover_summary_flags(node)->supports_initiating_ipv6_extends; +} + +/** Return true iff node can accept IPv6 extends (Relay=2 or Relay=3) + * from other relays. If need_canonical_ipv6_conn is true, also check + * if the relay supports canonical IPv6 connections (Relay=3 only). + * + * This check should only be performed by client path selection code. + */ +bool +node_supports_accepting_ipv6_extends(const node_t *node, + bool need_canonical_ipv6_conn) +{ + tor_assert(node); + + /* Relays can't accept an IPv6 extend, unless they have an IPv6 ORPort. */ + if (!node_has_ipv6_orport(node)) { + return 0; + } + + /* Accepting relays also need to support the relevant protocol version. */ + if (need_canonical_ipv6_conn) { + return + node_get_protover_summary_flags(node)->supports_canonical_ipv6_conns; + } else { + return + node_get_protover_summary_flags(node)->supports_accepting_ipv6_extends; + } +} + /** Return the RSA ID key's SHA1 digest for the provided node. */ const uint8_t * node_get_rsa_id_digest(const node_t *node) diff --git a/src/feature/nodelist/nodelist.h b/src/feature/nodelist/nodelist.h index 57ab2d591..991cec319 100644 --- a/src/feature/nodelist/nodelist.h +++ b/src/feature/nodelist/nodelist.h @@ -81,6 +81,11 @@ int node_supports_v3_hsdir(const node_t *node); int node_supports_ed25519_hs_intro(const node_t *node); int node_supports_v3_rendezvous_point(const node_t *node); int node_supports_establish_intro_dos_extension(const node_t *node); +bool node_supports_initiating_ipv6_extends(const node_t *node); +bool node_supports_accepting_ipv6_extends( + const node_t *node, + bool need_canonical_ipv6_conn); + const uint8_t *node_get_rsa_id_digest(const node_t *node); MOCK_DECL(smartlist_t *,node_get_link_specifier_smartlist,(const node_t *node, bool direct_conn)); diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c index 1a35e27e1..85788c07e 100644 --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@ -1499,7 +1499,22 @@ router_has_advertised_ipv6_orport(const or_options_t *options) return tor_addr_port_is_valid_ap(&ipv6_ap, 0); } -/** Returns true if this router has an advertised IPv6 ORPort. */ +/** Returns true if this router can extend over IPv6. + * + * This check should only be performed by relay extend code. + * + * Clients should check if relays can initiate and accept IPv6 extends using + * node_supports_initiating_ipv6_extends() and + * node_supports_accepting_ipv6_extends(). + * + * As with other extends, relays should assume the client has already + * performed the relevant checks for the next hop. (Otherwise, relays that + * have just added IPv6 ORPorts won't be able to self-test those ORPorts.) + * + * Accepting relays don't need to perform any IPv6-specific checks before + * accepting a connection, because having an IPv6 ORPort implies support for + * the relevant protocol version. + */ MOCK_IMPL(bool, router_can_extend_over_ipv6,(const or_options_t *options)) {

1 0

[tor/master] test/circuitbuild: Add a test for origin_circuit_init()
by nickm＠torproject.org 09 Jun '20

09 Jun '20

commit 115a453f04d27b7abeedee9e34a6d70068fd0bdd Author: teor <teor(a)riseup.net> Date: Wed May 13 20:06:27 2020 +1000 test/circuitbuild: Add a test for origin_circuit_init() Part of 33222. --- src/test/test_circuitbuild.c | 72 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) diff --git a/src/test/test_circuitbuild.c b/src/test/test_circuitbuild.c index 03fd176ea..1a3ba16c1 100644 --- a/src/test/test_circuitbuild.c +++ b/src/test/test_circuitbuild.c @@ -19,6 +19,7 @@ #include "core/or/channel.h" #include "core/or/circuitbuild.h" #include "core/or/circuitlist.h" +#include "core/or/circuituse.h" #include "core/or/onion.h" #include "core/or/cell_st.h" @@ -1516,6 +1517,75 @@ test_onionskin_answer(void *arg) tor_free(or_circ); } +/* Test the different cases in origin_circuit_init(). */ +static void +test_origin_circuit_init(void *arg) +{ + (void)arg; + origin_circuit_t *origin_circ = NULL; + + /* Init with 0 purpose and 0 flags */ + origin_circ = origin_circuit_init(0, 0); + tt_int_op(origin_circ->base_.purpose, OP_EQ, 0); + tt_int_op(origin_circ->base_.state, OP_EQ, CIRCUIT_STATE_CHAN_WAIT); + tt_ptr_op(origin_circ->build_state, OP_NE, NULL); + tt_int_op(origin_circ->build_state->is_internal, OP_EQ, 0); + tt_int_op(origin_circ->build_state->is_ipv6_selftest, OP_EQ, 0); + tt_int_op(origin_circ->build_state->need_capacity, OP_EQ, 0); + tt_int_op(origin_circ->build_state->need_uptime, OP_EQ, 0); + tt_int_op(origin_circ->build_state->onehop_tunnel, OP_EQ, 0); + /* The circuits are automatically freed by the circuitlist. */ + + /* Init with a purpose */ + origin_circ = origin_circuit_init(CIRCUIT_PURPOSE_C_GENERAL, 0); + tt_int_op(origin_circ->base_.purpose, OP_EQ, CIRCUIT_PURPOSE_C_GENERAL); + + /* Init with each flag */ + origin_circ = origin_circuit_init(0, CIRCLAUNCH_IS_INTERNAL); + tt_ptr_op(origin_circ->build_state, OP_NE, NULL); + tt_int_op(origin_circ->build_state->is_internal, OP_EQ, 1); + tt_int_op(origin_circ->build_state->is_ipv6_selftest, OP_EQ, 0); + tt_int_op(origin_circ->build_state->need_capacity, OP_EQ, 0); + tt_int_op(origin_circ->build_state->need_uptime, OP_EQ, 0); + tt_int_op(origin_circ->build_state->onehop_tunnel, OP_EQ, 0); + + origin_circ = origin_circuit_init(0, CIRCLAUNCH_IS_IPV6_SELFTEST); + tt_ptr_op(origin_circ->build_state, OP_NE, NULL); + tt_int_op(origin_circ->build_state->is_internal, OP_EQ, 0); + tt_int_op(origin_circ->build_state->is_ipv6_selftest, OP_EQ, 1); + tt_int_op(origin_circ->build_state->need_capacity, OP_EQ, 0); + tt_int_op(origin_circ->build_state->need_uptime, OP_EQ, 0); + tt_int_op(origin_circ->build_state->onehop_tunnel, OP_EQ, 0); + + origin_circ = origin_circuit_init(0, CIRCLAUNCH_NEED_CAPACITY); + tt_ptr_op(origin_circ->build_state, OP_NE, NULL); + tt_int_op(origin_circ->build_state->is_internal, OP_EQ, 0); + tt_int_op(origin_circ->build_state->is_ipv6_selftest, OP_EQ, 0); + tt_int_op(origin_circ->build_state->need_capacity, OP_EQ, 1); + tt_int_op(origin_circ->build_state->need_uptime, OP_EQ, 0); + tt_int_op(origin_circ->build_state->onehop_tunnel, OP_EQ, 0); + + origin_circ = origin_circuit_init(0, CIRCLAUNCH_NEED_UPTIME); + tt_ptr_op(origin_circ->build_state, OP_NE, NULL); + tt_int_op(origin_circ->build_state->is_internal, OP_EQ, 0); + tt_int_op(origin_circ->build_state->is_ipv6_selftest, OP_EQ, 0); + tt_int_op(origin_circ->build_state->need_capacity, OP_EQ, 0); + tt_int_op(origin_circ->build_state->need_uptime, OP_EQ, 1); + tt_int_op(origin_circ->build_state->onehop_tunnel, OP_EQ, 0); + + origin_circ = origin_circuit_init(0, CIRCLAUNCH_ONEHOP_TUNNEL); + tt_ptr_op(origin_circ->build_state, OP_NE, NULL); + tt_int_op(origin_circ->build_state->is_internal, OP_EQ, 0); + tt_int_op(origin_circ->build_state->is_ipv6_selftest, OP_EQ, 0); + tt_int_op(origin_circ->build_state->need_capacity, OP_EQ, 0); + tt_int_op(origin_circ->build_state->need_uptime, OP_EQ, 0); + tt_int_op(origin_circ->build_state->onehop_tunnel, OP_EQ, 1); + + done: + /* The circuits are automatically freed by the circuitlist. */ + ; +} + #define TEST(name, flags, setup, cleanup) \ { #name, test_ ## name, flags, setup, cleanup } @@ -1550,5 +1620,7 @@ struct testcase_t circuitbuild_tests[] = { TEST(onionskin_answer, TT_FORK, NULL, NULL), + TEST(origin_circuit_init, TT_FORK, NULL, NULL), + END_OF_TESTCASES };

1 0

[tor/master] doc: Some tor features may not work with MiddleNodes
by nickm＠torproject.org 09 Jun '20

09 Jun '20

commit e2bd15b6f38f9fdf6c78b045fe4152aa34a92281 Author: teor <teor(a)riseup.net> Date: Mon May 11 17:05:53 2020 +1000 doc: Some tor features may not work with MiddleNodes And fix a formatting issue in the MiddleNodes man page entry. Part of 33226. --- doc/tor.1.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index fbe2915cf..e83178a4d 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2032,12 +2032,12 @@ different from other Tor clients: A list of identity fingerprints and country codes of nodes to use for "middle" hops in your normal circuits. Normal circuits include all circuits except for direct connections - to directory servers. Middle hops are all hops other than exit and entry. + + to directory servers. Middle hops are all hops other than exit and entry. + This is an **experimental** feature that is meant to be used by researchers and developers to test new features in the Tor network safely. Using it - without care will strongly influence your anonymity. This feature might get - removed in the future. + without care will strongly influence your anonymity. Other tor features may + not work with MiddleNodes. This feature might get removed in the future. + The HSLayer2Node and HSLayer3Node options override this option for onion service circuits, if they are set. The vanguards addon will read this

1 0

[tor/master] test/circuitstats: Fix a bunch of coding style issues
by nickm＠torproject.org 09 Jun '20

09 Jun '20

commit e9c9e171ae0bdb19b3649a0d5d92ab0f8ce1dfce Author: teor <teor(a)riseup.net> Date: Thu May 14 10:05:26 2020 +1000 test/circuitstats: Fix a bunch of coding style issues Part of 33222. --- src/test/test_circuitstats.c | 83 +++++++++++++++++++++----------------------- 1 file changed, 40 insertions(+), 43 deletions(-) diff --git a/src/test/test_circuitstats.c b/src/test/test_circuitstats.c index e15dec5a0..3660e4295 100644 --- a/src/test/test_circuitstats.c +++ b/src/test/test_circuitstats.c @@ -16,19 +16,16 @@ #include "core/or/circuitstats.h" #include "core/or/circuituse.h" #include "core/or/channel.h" +#include "core/or/crypt_path.h" #include "core/or/cpath_build_state_st.h" #include "core/or/crypt_path_st.h" #include "core/or/extend_info_st.h" #include "core/or/origin_circuit_st.h" -void test_circuitstats_timeout(void *arg); -void test_circuitstats_hoplen(void *arg); -origin_circuit_t *subtest_fourhop_circuit(struct timeval, int); -origin_circuit_t *add_opened_threehop(void); -origin_circuit_t *build_unopened_fourhop(struct timeval); - -int cpath_append_hop(crypt_path_t **head_ptr, extend_info_t *choice); +static origin_circuit_t *add_opened_threehop(void); +static origin_circuit_t *build_unopened_fourhop(struct timeval); +static origin_circuit_t *subtest_fourhop_circuit(struct timeval, int); static int marked_for_close; /* Mock function because we are not trying to test the close circuit that does @@ -45,85 +42,85 @@ mock_circuit_mark_for_close(circuit_t *circ, int reason, int line, return; } -origin_circuit_t * +static origin_circuit_t * add_opened_threehop(void) { - origin_circuit_t *or_circ = origin_circuit_new(); + origin_circuit_t *origin_circ = origin_circuit_new(); extend_info_t fakehop; memset(&fakehop, 0, sizeof(fakehop)); - TO_CIRCUIT(or_circ)->purpose = CIRCUIT_PURPOSE_C_GENERAL; + TO_CIRCUIT(origin_circ)->purpose = CIRCUIT_PURPOSE_C_GENERAL; - or_circ->build_state = tor_malloc_zero(sizeof(cpath_build_state_t)); - or_circ->build_state->desired_path_len = DEFAULT_ROUTE_LEN; + origin_circ->build_state = tor_malloc_zero(sizeof(cpath_build_state_t)); + origin_circ->build_state->desired_path_len = DEFAULT_ROUTE_LEN; - cpath_append_hop(&or_circ->cpath, &fakehop); - cpath_append_hop(&or_circ->cpath, &fakehop); - cpath_append_hop(&or_circ->cpath, &fakehop); + cpath_append_hop(&origin_circ->cpath, &fakehop); + cpath_append_hop(&origin_circ->cpath, &fakehop); + cpath_append_hop(&origin_circ->cpath, &fakehop); - or_circ->has_opened = 1; - TO_CIRCUIT(or_circ)->state = CIRCUIT_STATE_OPEN; - TO_CIRCUIT(or_circ)->purpose = CIRCUIT_PURPOSE_C_GENERAL; + origin_circ->has_opened = 1; + TO_CIRCUIT(origin_circ)->state = CIRCUIT_STATE_OPEN; + TO_CIRCUIT(origin_circ)->purpose = CIRCUIT_PURPOSE_C_GENERAL; - return or_circ; + return origin_circ; } -origin_circuit_t * +static origin_circuit_t * build_unopened_fourhop(struct timeval circ_start_time) { - origin_circuit_t *or_circ = origin_circuit_new(); + origin_circuit_t *origin_circ = origin_circuit_new(); extend_info_t *fakehop = tor_malloc_zero(sizeof(extend_info_t)); memset(fakehop, 0, sizeof(extend_info_t)); - TO_CIRCUIT(or_circ)->purpose = CIRCUIT_PURPOSE_C_GENERAL; - TO_CIRCUIT(or_circ)->timestamp_began = circ_start_time; - TO_CIRCUIT(or_circ)->timestamp_created = circ_start_time; + TO_CIRCUIT(origin_circ)->purpose = CIRCUIT_PURPOSE_C_GENERAL; + TO_CIRCUIT(origin_circ)->timestamp_began = circ_start_time; + TO_CIRCUIT(origin_circ)->timestamp_created = circ_start_time; - or_circ->build_state = tor_malloc_zero(sizeof(cpath_build_state_t)); - or_circ->build_state->desired_path_len = 4; + origin_circ->build_state = tor_malloc_zero(sizeof(cpath_build_state_t)); + origin_circ->build_state->desired_path_len = 4; - cpath_append_hop(&or_circ->cpath, fakehop); - cpath_append_hop(&or_circ->cpath, fakehop); - cpath_append_hop(&or_circ->cpath, fakehop); - cpath_append_hop(&or_circ->cpath, fakehop); + cpath_append_hop(&origin_circ->cpath, fakehop); + cpath_append_hop(&origin_circ->cpath, fakehop); + cpath_append_hop(&origin_circ->cpath, fakehop); + cpath_append_hop(&origin_circ->cpath, fakehop); tor_free(fakehop); - return or_circ; + return origin_circ; } -origin_circuit_t * +static origin_circuit_t * subtest_fourhop_circuit(struct timeval circ_start_time, int should_timeout) { - origin_circuit_t *or_circ = build_unopened_fourhop(circ_start_time); + origin_circuit_t *origin_circ = build_unopened_fourhop(circ_start_time); // Now make them open one at a time and call // circuit_build_times_handle_completed_hop(); - or_circ->cpath->state = CPATH_STATE_OPEN; - circuit_build_times_handle_completed_hop(or_circ); + origin_circ->cpath->state = CPATH_STATE_OPEN; + circuit_build_times_handle_completed_hop(origin_circ); tt_int_op(get_circuit_build_times()->total_build_times, OP_EQ, 0); - or_circ->cpath->next->state = CPATH_STATE_OPEN; - circuit_build_times_handle_completed_hop(or_circ); + origin_circ->cpath->next->state = CPATH_STATE_OPEN; + circuit_build_times_handle_completed_hop(origin_circ); tt_int_op(get_circuit_build_times()->total_build_times, OP_EQ, 0); // Third hop: We should count it now. - or_circ->cpath->next->next->state = CPATH_STATE_OPEN; - circuit_build_times_handle_completed_hop(or_circ); + origin_circ->cpath->next->next->state = CPATH_STATE_OPEN; + circuit_build_times_handle_completed_hop(origin_circ); tt_int_op(get_circuit_build_times()->total_build_times, OP_EQ, !should_timeout); // 1 if counted, 0 otherwise // Fourth hop: Don't double count - or_circ->cpath->next->next->next->state = CPATH_STATE_OPEN; - circuit_build_times_handle_completed_hop(or_circ); + origin_circ->cpath->next->next->next->state = CPATH_STATE_OPEN; + circuit_build_times_handle_completed_hop(origin_circ); tt_int_op(get_circuit_build_times()->total_build_times, OP_EQ, !should_timeout); done: - return or_circ; + return origin_circ; } -void +static void test_circuitstats_hoplen(void *arg) { /* Plan:

1 0

[tor/master] practracker: Allow a few extra lines in circuituse
by nickm＠torproject.org 09 Jun '20

09 Jun '20

commit de979dd7bd55647c17c9853b2e3c9e51efbd7c05 Author: teor <teor(a)riseup.net> Date: Wed May 13 20:08:29 2020 +1000 practracker: Allow a few extra lines in circuituse Part of 33222. --- scripts/maint/practracker/exceptions.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/maint/practracker/exceptions.txt b/scripts/maint/practracker/exceptions.txt index cd4b5577b..ca06d94fb 100644 --- a/scripts/maint/practracker/exceptions.txt +++ b/scripts/maint/practracker/exceptions.txt @@ -117,7 +117,7 @@ problem function-size /src/core/or/circuitpadding_machines.c:circpad_machine_cli problem dependency-violation /src/core/or/circuitpadding_machines.c 1 problem function-size /src/core/or/circuitstats.c:circuit_build_times_parse_state() 123 problem dependency-violation /src/core/or/circuitstats.c 11 -problem file-size /src/core/or/circuituse.c 3200 +problem file-size /src/core/or/circuituse.c 3250 problem function-size /src/core/or/circuituse.c:circuit_is_acceptable() 128 problem function-size /src/core/or/circuituse.c:circuit_expire_building() 389 problem function-size /src/core/or/circuituse.c:circuit_log_ancient_one_hop_circuits() 126

1 0