July 2020 - tor-commits - lists.torproject.org

[tor/master] git-install-tools: use -b, not --backup.
by nickm＠torproject.org 09 Jul '20

09 Jul '20

commit 18391f689ea11b064a9313be8824834df8be2a9e Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jul 9 17:12:37 2020 -0400 git-install-tools: use -b, not --backup. The osx version of this tool doesn't have --backup --- scripts/git/git-install-tools.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/git/git-install-tools.sh b/scripts/git/git-install-tools.sh index ef8623a01..3b9c3d79f 100755 --- a/scripts/git/git-install-tools.sh +++ b/scripts/git/git-install-tools.sh @@ -146,7 +146,7 @@ if [[ $INSTALL_HOOKS = 1 ]]; then note "Installing hooks" for fn in "$SCRIPTS_DIR"/*.git-hook; do name=$(basename "$fn") - $RUN install --backup "$fn" "${HOOKS_DIR}/${name%.git-hook}" + $RUN install -b "$fn" "${HOOKS_DIR}/${name%.git-hook}" done fi @@ -163,7 +163,7 @@ if [[ $INSTALL_TOOLS = 1 ]]; then note "Copying scripts" for tool in "${TOOL_NAMES[@]}"; do - $RUN install --backup "${SCRIPTS_DIR}/git-${tool}.sh" "${TOR_DEVTOOLS_DIR}/" + $RUN install -b "${SCRIPTS_DIR}/git-${tool}.sh" "${TOR_DEVTOOLS_DIR}/" done fi

1 0

[translation/donatepages-messagespot] https://gitweb.torproject.org/translation.git/commit/?h=donatepages-messagespot
by translation＠torproject.org 09 Jul '20

09 Jul '20

commit 4905bbfd61f45c81b6a58a4265d62fc412947aaa Author: Translation commit bot <translation(a)torproject.org> Date: Thu Jul 9 21:15:14 2020 +0000 https://gitweb.torproject.org/translation.git/commit/?h=donatepages-message… --- locale/fr/LC_MESSAGES/messages.po | 37 +++++++++++++++++++------------------ 1 file changed, 19 insertions(+), 18 deletions(-) diff --git a/locale/fr/LC_MESSAGES/messages.po b/locale/fr/LC_MESSAGES/messages.po index eac553ec1d..f380824df0 100644 --- a/locale/fr/LC_MESSAGES/messages.po +++ b/locale/fr/LC_MESSAGES/messages.po @@ -1423,7 +1423,7 @@ msgstr "" #: tmp/cache_locale/7d/7d56367a61f987367eeb2a89d0c6db83fd0801cce86278bf7e99ed39b5b46254.php:349 msgid "The account information is as follows:" -msgstr "L’information du compte est comme suit :" +msgstr "Les renseignements sur le compte sont :" #: tmp/cache_locale/7d/7d56367a61f987367eeb2a89d0c6db83fd0801cce86278bf7e99ed39b5b46254.php:353 msgid "" @@ -1435,11 +1435,12 @@ msgid "" " 85049 Ingolstadt" msgstr "" "Renewable Freedom Foundation \n" -" IBAN : DE17721500000053693701 \n" -" BIC : BYLADEM1ING \n" +" IBAN : DE17721500000053693701 \n" +" BIC : BYLADEM1ING \n" " Sparkasse Ingolstadt \n" " Rathausplatz 6 \n" -" 85049 Ingolstadt" +" 85049 Ingolstadt\n" +" Allemagne" #: tmp/cache_locale/7d/7d56367a61f987367eeb2a89d0c6db83fd0801cce86278bf7e99ed39b5b46254.php:365 msgid "If I am not in the United States, can I still donate?" @@ -1502,13 +1503,13 @@ msgid "" msgstr "" "<a href=\"https://www.torservers.net/\" target=\"_blank\" class=\"hyperlinks" " links\">torservers.net</a> est un organisme sans but lucratif allemand qui " -"administre une large variété de relais de sortie à travers le monde." +"administre une vaste gamme de relais de sortie dans le monde entier." #: tmp/cache_locale/7d/7d56367a61f987367eeb2a89d0c6db83fd0801cce86278bf7e99ed39b5b46254.php:391 msgid "They also like donations of bandwidth from ISPs." msgstr "" -"Ils apprécient également les dons de bande passante de fournisseurs d’accès " -"à Internet." +"Ils acceptent aussi volontiers les dons de bande passante de fournisseurs " +"d’accès à Internet." #: tmp/cache_locale/7d/7d56367a61f987367eeb2a89d0c6db83fd0801cce86278bf7e99ed39b5b46254.php:395 msgid "" @@ -1519,8 +1520,9 @@ msgid "" msgstr "" "<a href=\"https://www.noisebridge.net/wiki/Noisebridge_Tor\" " "target=\"_blank\" class=\"hyperlinks links\">Noisebridge</a> est un " -"organisme sans but lucratif 501(c)(3) basé aux États-Unis qui collecte des " -"dons et les transforment en une capacité de relais de sortie supplémentaire." +"organisme sans but lucratif 501(c)(3) basé aux États-Unis, qui collecte des " +"dons et les transforme en une capacité supérieure de relais de sortie à " +"partir des États-Unis." #: tmp/cache_locale/7d/7d56367a61f987367eeb2a89d0c6db83fd0801cce86278bf7e99ed39b5b46254.php:399 msgid "" @@ -1555,8 +1557,8 @@ msgstr "" #: tmp/cache_locale/7d/7d56367a61f987367eeb2a89d0c6db83fd0801cce86278bf7e99ed39b5b46254.php:409 msgid "They're run by nice people who are part of the Tor community." msgstr "" -"Ils sont administrés par des gens sympatiques qui font partie de la " -"communauté Tor." +"Ils sont administrés par des gens sympathiques qui font partie de la " +"communauté Tor." #: tmp/cache_locale/7d/7d56367a61f987367eeb2a89d0c6db83fd0801cce86278bf7e99ed39b5b46254.php:415 msgid "" @@ -1637,25 +1639,24 @@ msgid "" "Some users experience issues because PayPal limits the number of times an IP" " address can be used in a certain period of time." msgstr "" -"Certains utilisateurs rencontrent des problèmes parce que PayPal limite le " -"nombre de fois où il est possible d’utiliser une même adresse IP pendant un " -"certain intervalle de temps." +"Certains utilisateurs rencontrent des problèmes, car PayPal limite le nombre" +" de fois qu’une adresse IP peut être utilisée pendant une période donnée." #: tmp/cache_locale/7d/7d56367a61f987367eeb2a89d0c6db83fd0801cce86278bf7e99ed39b5b46254.php:447 msgid "This is to prevent fraud from card testers." -msgstr "Ceci permet de prévenir la fraude provenant de testeurs de cartes." +msgstr "Cela permet de prévenir la fraude par des testeurs de cartes." #: tmp/cache_locale/7d/7d56367a61f987367eeb2a89d0c6db83fd0801cce86278bf7e99ed39b5b46254.php:449 msgid "If you run into an issue, please try again." -msgstr "Si vous rencontrez un problème, veuillez réessayer." +msgstr "Si vous rencontrez un problème, veuillez ressayer." #: tmp/cache_locale/7d/7d56367a61f987367eeb2a89d0c6db83fd0801cce86278bf7e99ed39b5b46254.php:451 msgid "" "Unfortunately, when we are receiving a high volume of donations, you might " "need to use a different browser." msgstr "" -"Malheureusement, lorsque nous recevons un volume important de dons, vous " -"pourriez avoir à utiliser un navigateur différent." +"Malheureusement, si nous recevons un grand volume de dons, vous devrez peut-" +"être utiliser un navigateur différent." #: tmp/cache_locale/7d/7d56367a61f987367eeb2a89d0c6db83fd0801cce86278bf7e99ed39b5b46254.php:457 msgid "How can I donate via debit or credit card?"

1 0

[tor/master] test: Add IPv6 inet_pton double "::" test
by nickm＠torproject.org 09 Jul '20

09 Jul '20

commit edb5ef2540d2bcdc73e3601937c057ca8385a3ca Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Jul 9 09:05:53 2020 -0400 test: Add IPv6 inet_pton double "::" test Unclear but that somehow failed on Windows once (?) according to ticket #33768 but we are not seeing that failure. Nevertheless, add a simple unit test. Closes #33768 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/test/test_addr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/test/test_addr.c b/src/test/test_addr.c index cf5aad7e7..dbc581288 100644 --- a/src/test/test_addr.c +++ b/src/test/test_addr.c @@ -341,6 +341,7 @@ test_addr_ip6_helpers(void *arg) test_pton6_bad("0XYXXY"); test_pton6_bad("0x"); test_pton6_bad("0X"); + test_pton6_bad("2000::1a00::1000:fc098"); /* test internal checking */ test_external_ip("fbff:ffff::2:7", 0);

1 0

[tor/master] Merge remote-tracking branch 'tor-gitlab/mr/36'
by nickm＠torproject.org 09 Jul '20

09 Jul '20

commit 7b24d56accfac9532bc760bca51a64c8462e2ab7 Merge: 7207b4f2e edb5ef254 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jul 9 14:39:02 2020 -0400 Merge remote-tracking branch 'tor-gitlab/mr/36' src/test/test_addr.c | 1 + 1 file changed, 1 insertion(+)

1 0

[tor/master] channel: Refactor NETINFO process function
by nickm＠torproject.org 09 Jul '20

09 Jul '20

commit 789beca7831253737ea91bd3ab516a581051fa4d Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Jul 6 08:45:12 2020 -0400 channel: Refactor NETINFO process function In order to process a NETINFO cell, the OR connection needs to go through a series of validation else we don't process the cell. Move those into its own function in and improve documentation. This is an attempt at reducing technical debt of the rather large and complicated channel_tls_process_netinfo_cell() function. Related to #40022 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/core/or/channeltls.c | 51 ++++++++++++++++++++++++++++++++++++------------ 1 file changed, 39 insertions(+), 12 deletions(-) diff --git a/src/core/or/channeltls.c b/src/core/or/channeltls.c index a51fbf1dd..9b2ac7d16 100644 --- a/src/core/or/channeltls.c +++ b/src/core/or/channeltls.c @@ -1688,6 +1688,41 @@ time_abs(time_t val) return (val < 0) ? -val : val; } +/** Return true iff the channel can process a NETINFO cell. For this to return + * true, these channel conditions apply: + * + * 1. Link protocol is version 2 or higher (tor-spec.txt, NETINFO cells + * section). + * + * 2. Underlying OR connection of the channel is either in v2 or v3 + * handshaking state. + */ +static bool +can_process_netinfo_cell(const channel_tls_t *chan) +{ + /* NETINFO cells can only be negotiated on link protocol 2 or higher. */ + if (chan->conn->link_proto < 2) { + log_fn(LOG_PROTOCOL_WARN, LD_OR, + "Received a NETINFO cell on %s connection; dropping.", + chan->conn->link_proto == 0 ? "non-versioned" : "a v1"); + return false; + } + + /* Can't process a NETINFO cell if the connection is not handshaking. */ + if (chan->conn->base_.state != OR_CONN_STATE_OR_HANDSHAKING_V2 && + chan->conn->base_.state != OR_CONN_STATE_OR_HANDSHAKING_V3) { + log_fn(LOG_PROTOCOL_WARN, LD_OR, + "Received a NETINFO cell on non-handshaking connection; dropping."); + return false; + } + + /* Make sure we do have handshake state. */ + tor_assert(chan->conn->handshake_state); + tor_assert(chan->conn->handshake_state->received_versions); + + return true; +} + /** * Process a 'netinfo' cell * @@ -1713,20 +1748,12 @@ channel_tls_process_netinfo_cell(cell_t *cell, channel_tls_t *chan) tor_assert(chan); tor_assert(chan->conn); - if (chan->conn->link_proto < 2) { - log_fn(LOG_PROTOCOL_WARN, LD_OR, - "Received a NETINFO cell on %s connection; dropping.", - chan->conn->link_proto == 0 ? "non-versioned" : "a v1"); + /* Make sure we can process a NETINFO cell. Link protocol and state + * validation is done to make sure of it. */ + if (!can_process_netinfo_cell(chan)) { return; } - if (chan->conn->base_.state != OR_CONN_STATE_OR_HANDSHAKING_V2 && - chan->conn->base_.state != OR_CONN_STATE_OR_HANDSHAKING_V3) { - log_fn(LOG_PROTOCOL_WARN, LD_OR, - "Received a NETINFO cell on non-handshaking connection; dropping."); - return; - } - tor_assert(chan->conn->handshake_state && - chan->conn->handshake_state->received_versions); + started_here = connection_or_nonopen_was_started_here(chan->conn); identity_digest = chan->conn->identity_digest;

1 0

[tor/master] addr: New function relay_address_new_suggestion()
by nickm＠torproject.org 09 Jul '20

09 Jul '20

commit 192d367b411019760f92f58adde7592476341d6b Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Jul 6 09:42:10 2020 -0400 addr: New function relay_address_new_suggestion() This behaves like router_new_address_suggestion() but differs in couple of ways: 1. It takes a tor_addr_t instead of an address string and supports both AF_INET and AF_INET6. 2. It does _not_ use the last_guessed_ip local cache and instead only relies on the last resolved address cache in resolve_addr.c It is not used at this commit. This function is made to process a suggested address found in a NETINFO cell exactly like router_new_address_suggestion() does with the address a directory suggests us. Related to #40022 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/app/config/resolve_addr.c | 29 ++++++++++++++++++++ src/app/config/resolve_addr.h | 3 +++ src/feature/nodelist/dirlist.c | 28 +++++++++++++++++++ src/feature/nodelist/dirlist.h | 5 ++++ src/feature/relay/relay_find_addr.c | 54 +++++++++++++++++++++++++++++++++++++ src/feature/relay/relay_find_addr.h | 3 +++ 6 files changed, 122 insertions(+) diff --git a/src/app/config/resolve_addr.c b/src/app/config/resolve_addr.c index 2a11ba3c0..75b5eb75b 100644 --- a/src/app/config/resolve_addr.c +++ b/src/app/config/resolve_addr.c @@ -44,6 +44,12 @@ typedef enum { /** Last resolved addresses. */ static tor_addr_t last_resolved_addrs[IDX_SIZE]; +/** Last suggested addresses. + * + * These addresses come from a NETINFO cell from a trusted relay (currently + * only authorities). We only use those in last resort. */ +static tor_addr_t last_suggested_addrs[IDX_SIZE]; + static inline int af_to_idx(const int family) { @@ -60,6 +66,29 @@ af_to_idx(const int family) } } +/** Copy the last suggested address of family into addr_out. + * + * If no last suggested address exists, the addr_out is a null address (use + * tor_addr_is_null() to confirm). */ +void +resolved_addr_get_suggested(int family, tor_addr_t *addr_out) +{ + tor_addr_copy(addr_out, &last_suggested_addrs[af_to_idx(family)]); +} + +/** Set the last suggested address into our cache. This is called when we get + * a new NETINFO cell from a trusted source. */ +void +resolved_addr_set_suggested(const tor_addr_t *addr) +{ + if (BUG(tor_addr_family(addr) != AF_INET || + tor_addr_family(addr) != AF_INET6)) { + return; + } + tor_addr_copy(&last_suggested_addrs[af_to_idx(tor_addr_family(addr))], + addr); +} + /** Copy the last resolved address of family into addr_out. * * If not last resolved address existed, the addr_out is a null address (use diff --git a/src/app/config/resolve_addr.h b/src/app/config/resolve_addr.h index 055d59a8f..7ba70541a 100644 --- a/src/app/config/resolve_addr.h +++ b/src/app/config/resolve_addr.h @@ -20,6 +20,9 @@ void resolved_addr_reset_last(int family); void resolved_addr_set_last(const tor_addr_t *addr, const char *method_used, const char *hostname_used); +void resolved_addr_get_suggested(int family, tor_addr_t *addr_out); +void resolved_addr_set_suggested(const tor_addr_t *addr); + MOCK_DECL(bool, is_local_to_resolve_addr, (const tor_addr_t *addr)); #ifdef RESOLVE_ADDR_PRIVATE diff --git a/src/feature/nodelist/dirlist.c b/src/feature/nodelist/dirlist.c index bd647ab53..c1864faed 100644 --- a/src/feature/nodelist/dirlist.c +++ b/src/feature/nodelist/dirlist.c @@ -250,6 +250,34 @@ router_digest_is_trusted_dir_type(const char *digest, dirinfo_type_t type) return 0; } +/** Return true iff the given address matches a trusted directory that matches + * at least one bit of type. + * + * If type is NO_DIRINFO or ALL_DIRINFO, any authority is matched. */ +bool +router_addr_is_trusted_dir_type(const tor_addr_t *addr, dirinfo_type_t type) +{ + int family = tor_addr_family(addr); + + if (!trusted_dir_servers) { + return false; + } + + SMARTLIST_FOREACH_BEGIN(trusted_dir_servers, dir_server_t *, ent) { + /* Ignore entries that don't match the given type. */ + if (type != NO_DIRINFO && (type & ent->type) == 0) { + continue; + } + /* Match IPv4 or IPv6 address. */ + if ((family == AF_INET && tor_addr_eq_ipv4h(addr, ent->addr)) || + (family == AF_INET6 && tor_addr_eq(addr, &ent->ipv6_addr))) { + return true; + } + } SMARTLIST_FOREACH_END(ent); + + return false; +} + /** Create a directory server at address:port, with OR identity * key digest which has DIGEST_LEN bytes. If address is NULL, * add ourself. If is_authority, this is a directory authority. Return diff --git a/src/feature/nodelist/dirlist.h b/src/feature/nodelist/dirlist.h index 9201e76a9..c9310ff35 100644 --- a/src/feature/nodelist/dirlist.h +++ b/src/feature/nodelist/dirlist.h @@ -25,6 +25,11 @@ int router_digest_is_fallback_dir(const char *digest); MOCK_DECL(dir_server_t *, trusteddirserver_get_by_v3_auth_digest, (const char *d)); +bool router_addr_is_trusted_dir_type(const tor_addr_t *addr, + dirinfo_type_t type); +#define router_addr_is_trusted_dir(d) \ + router_addr_is_trusted_dir_type((d), NO_DIRINFO) + int router_digest_is_trusted_dir_type(const char *digest, dirinfo_type_t type); #define router_digest_is_trusted_dir(d) \ diff --git a/src/feature/relay/relay_find_addr.c b/src/feature/relay/relay_find_addr.c index a51457ddb..699eb7e38 100644 --- a/src/feature/relay/relay_find_addr.c +++ b/src/feature/relay/relay_find_addr.c @@ -15,6 +15,7 @@ #include "feature/control/control_events.h" #include "feature/dircommon/dir_connection_st.h" +#include "feature/nodelist/dirlist.h" #include "feature/relay/relay_find_addr.h" #include "feature/relay/router.h" #include "feature/relay/routermode.h" @@ -37,6 +38,59 @@ router_guess_address_from_dir_headers(uint32_t *guess) return -1; } +/** Consider the address suggestion suggested_addr as a possible one to use as + * our address. + * + * This is called when a valid NETINFO cell is recevied containing a candidate + * for our address. + * + * The suggested address is ignored if it does NOT come from a trusted source. + * At the moment, we only look a trusted directory authorities. + * + * The suggested address is ignored if it is internal or it is the same as the + * given peer_addr which is the address from the endpoint that sent the + * NETINFO cell. + * + * The suggested address is set in our suggested address cache if everything + * passes. */ +void +relay_address_new_suggestion(const tor_addr_t *suggested_addr, + const tor_addr_t *peer_addr) +{ + const or_options_t *options = get_options(); + + tor_assert(suggested_addr); + tor_assert(peer_addr); + + /* This should never be called on a non Tor relay. */ + if (BUG(!server_mode(options))) { + return; + } + + /* Is the peer a trusted source? Ignore anything coming from non trusted + * source. In this case, we only look at trusted authorities. */ + if (!router_addr_is_trusted_dir(peer_addr)) { + return; + } + + /* Ignore a suggestion that is an internal address or the same as the one + * the peer address. */ + if (tor_addr_is_internal(suggested_addr, 0)) { + /* Do not believe anyone who says our address is internal. */ + return; + } + if (tor_addr_eq(suggested_addr, peer_addr)) { + /* Do not believe anyone who says our address is their address. */ + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "A relay endpoint %s is telling us that their address is ours.", + fmt_addr(peer_addr)); + return; + } + + /* Save the suggestion in our cache. */ + resolved_addr_set_suggested(suggested_addr); +} + /** A directory server d_conn told us our IP address is * suggestion. * If this address is different from the one we think we are now, and diff --git a/src/feature/relay/relay_find_addr.h b/src/feature/relay/relay_find_addr.h index ac51a977e..d856e706e 100644 --- a/src/feature/relay/relay_find_addr.h +++ b/src/feature/relay/relay_find_addr.h @@ -15,6 +15,9 @@ MOCK_DECL(int, router_pick_published_address, void router_new_address_suggestion(const char *suggestion, const dir_connection_t *d_conn); +void relay_address_new_suggestion(const tor_addr_t *suggested_addr, + const tor_addr_t *peer_addr); + #ifdef RELAY_FIND_ADDR_PRIVATE #endif /* RELAY_FIND_ADDR_PRIVATE */

1 0

[tor/master] addr: Rename and make resolved_addr_set_last() function public
by nickm＠torproject.org 09 Jul '20

09 Jul '20

commit f57ce632fe3d391e62d288c0b8acd0001bf670df Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Jul 6 09:40:03 2020 -0400 addr: Rename and make resolved_addr_set_last() function public Rename the static function update_resolved_cache() to resolved_addr_set_last() and make it public. We are about to use it in order to record any suggested address from a NETINFO cell. Related to #40022 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/app/config/resolve_addr.c | 10 +++++----- src/app/config/resolve_addr.h | 2 ++ 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/src/app/config/resolve_addr.c b/src/app/config/resolve_addr.c index 808c5ddf0..2a11ba3c0 100644 --- a/src/app/config/resolve_addr.c +++ b/src/app/config/resolve_addr.c @@ -370,7 +370,7 @@ get_address_from_interface(const or_options_t *options, int warn_severity, return FN_RET_OK; } -/** @brief Update the last resolved address cache using the given address. +/** @brief Set the last resolved address cache using the given address. * * A log notice is emitted if the given address has changed from before. Not * emitted on first resolve. @@ -386,9 +386,9 @@ get_address_from_interface(const or_options_t *options, int warn_severity, * @param hostname_used Which hostname was used. If none were used, it is * NULL. (for logging and control port). */ -static void -update_resolved_cache(const tor_addr_t *addr, const char *method_used, - const char *hostname_used) +void +resolved_addr_set_last(const tor_addr_t *addr, const char *method_used, + const char *hostname_used) { /** Have we done a first resolve. This is used to control logging. */ static bool have_resolved_once[IDX_SIZE] = { false, false, false }; @@ -561,7 +561,7 @@ find_my_address(const or_options_t *options, int family, int warn_severity, /* * Step 2: Update last resolved address cache and inform the control port. */ - update_resolved_cache(&my_addr, method_used, hostname_used); + resolved_addr_set_last(&my_addr, method_used, hostname_used); if (method_out) { *method_out = method_used; diff --git a/src/app/config/resolve_addr.h b/src/app/config/resolve_addr.h index 54f55ba36..055d59a8f 100644 --- a/src/app/config/resolve_addr.h +++ b/src/app/config/resolve_addr.h @@ -17,6 +17,8 @@ bool find_my_address(const or_options_t *options, int family, void resolved_addr_get_last(int family, tor_addr_t *addr_out); void resolved_addr_reset_last(int family); +void resolved_addr_set_last(const tor_addr_t *addr, const char *method_used, + const char *hostname_used); MOCK_DECL(bool, is_local_to_resolve_addr, (const tor_addr_t *addr));

1 0

[tor/master] channel: Continue refactor NETINFO process function
by nickm＠torproject.org 09 Jul '20

09 Jul '20

commit 78bc52c47c8d7c3747ea3335b571fd98a15a47b1 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Jul 6 09:06:22 2020 -0400 channel: Continue refactor NETINFO process function In the spirit of reducing technical debt. Move code that marks a channel as a client into its own function and document it properly. No behavior change, only code movement. Related to #40022 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/core/or/channeltls.c | 73 +++++++++++++++++++++++++++++++++--------------- 1 file changed, 50 insertions(+), 23 deletions(-) diff --git a/src/core/or/channeltls.c b/src/core/or/channeltls.c index 9b2ac7d16..fc93ea8d5 100644 --- a/src/core/or/channeltls.c +++ b/src/core/or/channeltls.c @@ -1723,6 +1723,50 @@ can_process_netinfo_cell(const channel_tls_t *chan) return true; } +/** Mark the given channel endpoint as a client (which means either a tor + * client or a tor bridge). + * + * This MUST be done on an _unauthenticated_ channel. It is a mistake to mark + * an authenticated channel as a client. + * + * The following is done on the channel: + * + * 1. Marked as a client. + * 2. Type of circuit ID type is set. + * 3. The underlying OR connection is initialized with the address of the + * endpoint. + */ +static void +mark_channel_tls_endpoint_as_client(channel_tls_t *chan) +{ + /* Ending up here for an authenticated link is a mistake. */ + if (BUG(chan->conn->handshake_state->authenticated)) { + return; + } + + tor_assert(tor_digest_is_zero( + (const char*)(chan->conn->handshake_state-> + authenticated_rsa_peer_id))); + tor_assert(fast_mem_is_zero( + (const char*)(chan->conn->handshake_state-> + authenticated_ed25519_peer_id.pubkey), 32)); + /* If the client never authenticated, it's a tor client or bridge + * relay, and we must not use it for EXTEND requests (nor could we, as + * there are no authenticated peer IDs) */ + channel_mark_client(TLS_CHAN_TO_BASE(chan)); + channel_set_circid_type(TLS_CHAN_TO_BASE(chan), NULL, + chan->conn->link_proto < MIN_LINK_PROTO_FOR_WIDE_CIRC_IDS); + + connection_or_init_conn_from_address(chan->conn, + &(chan->conn->base_.addr), + chan->conn->base_.port, + /* zero, checked above */ + (const char*)(chan->conn->handshake_state-> + authenticated_rsa_peer_id), + NULL, /* Ed25519 ID: Also checked as zero */ + 0); +} + /** * Process a 'netinfo' cell * @@ -1768,30 +1812,13 @@ channel_tls_process_netinfo_cell(cell_t *cell, channel_tls_t *chan) return; } } else { - /* we're the server. If the client never authenticated, we have - some housekeeping to do.*/ + /* We're the server. If the client never authenticated, we have some + * housekeeping to do. + * + * It's a tor client or bridge relay, and we must not use it for EXTEND + * requests (nor could we, as there are no authenticated peer IDs) */ if (!(chan->conn->handshake_state->authenticated)) { - tor_assert(tor_digest_is_zero( - (const char*)(chan->conn->handshake_state-> - authenticated_rsa_peer_id))); - tor_assert(fast_mem_is_zero( - (const char*)(chan->conn->handshake_state-> - authenticated_ed25519_peer_id.pubkey), 32)); - /* If the client never authenticated, it's a tor client or bridge - * relay, and we must not use it for EXTEND requests (nor could we, as - * there are no authenticated peer IDs) */ - channel_mark_client(TLS_CHAN_TO_BASE(chan)); - channel_set_circid_type(TLS_CHAN_TO_BASE(chan), NULL, - chan->conn->link_proto < MIN_LINK_PROTO_FOR_WIDE_CIRC_IDS); - - connection_or_init_conn_from_address(chan->conn, - &(chan->conn->base_.addr), - chan->conn->base_.port, - /* zero, checked above */ - (const char*)(chan->conn->handshake_state-> - authenticated_rsa_peer_id), - NULL, /* Ed25519 ID: Also checked as zero */ - 0); + mark_channel_tls_endpoint_as_client(chan); } } }

1 0

[tor/master] channel: Consider NETINFO other address as ours
by nickm＠torproject.org 09 Jul '20

09 Jul '20

commit f5ce8a2bed833befcee895d4966d5731ad2fdf75 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Jul 6 09:50:48 2020 -0400 channel: Consider NETINFO other address as ours Attempt to learn our address from the NETINFO cell. At this commit, the address won't be used in the descriptor if selected. Next commit will make it happen. Related to #40022 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/core/or/channeltls.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/core/or/channeltls.c b/src/core/or/channeltls.c index fc93ea8d5..9198a8bfb 100644 --- a/src/core/or/channeltls.c +++ b/src/core/or/channeltls.c @@ -72,6 +72,7 @@ #include "core/or/or_handshake_state_st.h" #include "feature/nodelist/routerinfo_st.h" #include "core/or/var_cell_st.h" +#include "src/feature/relay/relay_find_addr.h" #include "lib/tls/tortls.h" #include "lib/tls/x509.h" @@ -1929,8 +1930,11 @@ channel_tls_process_netinfo_cell(cell_t *cell, channel_tls_t *chan) "NETINFO cell", "OR"); } - /* XXX maybe act on my_apparent_addr, if the source is sufficiently - * trustworthy. */ + /* Consider our apparent address as a possible suggestion for our address if + * we were unable to resolve it previously. The endpoint address is passed + * in order to make sure to never consider an address that is the same as + * our endpoint. */ + relay_address_new_suggestion(&my_apparent_addr, &chan->conn->real_addr); if (! chan->conn->handshake_state->sent_netinfo) { /* If we were prepared to authenticate, but we never got an AUTH_CHALLENGE

1 0

[tor/master] changes: Add a changes file for #40022
by nickm＠torproject.org 09 Jul '20

09 Jul '20

commit 15be1ff8ad568629f809b4feac79a8dcbfac9444 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Jul 6 10:02:45 2020 -0400 changes: Add a changes file for #40022 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket40022 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changes/ticket40022 b/changes/ticket40022 new file mode 100644 index 000000000..aa7bb256e --- /dev/null +++ b/changes/ticket40022 @@ -0,0 +1,4 @@ + o Minor feature (relay): + - If a relay is unable to discover its address, attempt to learn it from the + NETINFO cell. Closes ticket 40022. +

1 0