tor-commits July 2020

tor-commits@lists.torproject.org

17 participants
2100 discussions

[tor/master] Merge branch 'maint-0.4.4'
by dgoulet＠torproject.org 22 Jul '20

22 Jul '20

commit 884ccd6996dcd713600e50ec11de0e9a6655607f Merge: 492625badf 1ee164afc2 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Jul 22 16:14:19 2020 -0400 Merge branch 'maint-0.4.4' changes/ticket33880 | 6 ++++++ src/core/or/channel.c | 32 +++++++++++++++++++++++++++++--- 2 files changed, 35 insertions(+), 3 deletions(-)

1 0

[tor/master] Adjust the rules for warning about too many connections.
by dgoulet＠torproject.org 22 Jul '20

22 Jul '20

commit faa752f3c9bd3faa2d23e6273f657771a3cad078 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 22 14:45:03 2020 -0400 Adjust the rules for warning about too many connections. Previously we tolerated up to 1.5 connections for every relay we were connected to, and didn't warn if we had fewer than 5 connections total. Now we tolerate up to 1.5 connections per relay, and up to 4 connections per authority, and we don't warn at all when we have fewer than 25 connections total. Fixes bug 33880, which seems to have been provoked by our #17592 change in 0.3.5. --- changes/ticket33880 | 6 ++++++ src/core/or/channel.c | 32 +++++++++++++++++++++++++++++--- 2 files changed, 35 insertions(+), 3 deletions(-) diff --git a/changes/ticket33880 b/changes/ticket33880 new file mode 100644 index 0000000000..c1889bb134 --- /dev/null +++ b/changes/ticket33880 @@ -0,0 +1,6 @@ + o Minor bugfixes (relay, usability): + - Adjust the rules for when to warn about having too many connections + to other relays. Previously we'd tolerate up to 1.5 connections + per relay on average. Now we tolerate more connections for directory + authorities, and raise the number of total connections we need + to see before we warn. Fixes bug 33880; bugfix on 0.3.1.1-alpha. diff --git a/src/core/or/channel.c b/src/core/or/channel.c index 3886906875..71cb6bccbb 100644 --- a/src/core/or/channel.c +++ b/src/core/or/channel.c @@ -72,6 +72,7 @@ #include "core/or/relay.h" #include "core/or/scheduler.h" #include "feature/client/entrynodes.h" +#include "feature/nodelist/dirlist.h" #include "feature/nodelist/networkstatus.h" #include "feature/nodelist/nodelist.h" #include "feature/nodelist/routerlist.h" @@ -749,6 +750,7 @@ channel_check_for_duplicates(void) { channel_idmap_entry_t **iter; channel_t *chan; + int total_dirauth_connections = 0, total_dirauths = 0; int total_relay_connections = 0, total_relays = 0, total_canonical = 0; int total_half_canonical = 0; int total_gt_one_connection = 0, total_gt_two_connections = 0; @@ -756,13 +758,18 @@ channel_check_for_duplicates(void) HT_FOREACH(iter, channel_idmap, &channel_identity_map) { int connections_to_relay = 0; + const char *id_digest = (char *) (*iter)->digest; /* Only consider relay connections */ - if (!connection_or_digest_is_known_relay((char*)(*iter)->digest)) + if (!connection_or_digest_is_known_relay(id_digest)) continue; total_relays++; + const bool is_dirauth = router_digest_is_trusted_dir(id_digest); + if (is_dirauth) + total_dirauths++; + for (chan = TOR_LIST_FIRST(&(*iter)->channel_list); chan; chan = channel_next_with_rsa_identity(chan)) { @@ -771,6 +778,8 @@ channel_check_for_duplicates(void) connections_to_relay++; total_relay_connections++; + if (is_dirauth) + total_dirauth_connections++; if (chan->is_canonical(chan, 0)) total_canonical++; @@ -785,11 +794,28 @@ channel_check_for_duplicates(void) if (connections_to_relay > 4) total_gt_four_connections++; } -#define MIN_RELAY_CONNECTIONS_TO_WARN 5 + /* Don't bother warning about excessive connections unless we have + * at least this many connections, total. + */ +#define MIN_RELAY_CONNECTIONS_TO_WARN 25 + /* If the average number of connections for a regular relay is more than + * this, that's too high. + */ +#define MAX_AVG_RELAY_CONNECTIONS 1.5 + /* If the average number of connections for a dirauth is more than + * this, that's too high. + */ +#define MAX_AVG_DIRAUTH_CONNECTIONS 4 + + /* How many connections total would be okay, given the number of + * relays and dirauths that we have connections to? */ + const int max_tolerable_connections = (int)( + (total_relays-total_dirauths) * MAX_AVG_RELAY_CONNECTIONS + + total_dirauths * MAX_AVG_DIRAUTH_CONNECTIONS); /* If we average 1.5 or more connections per relay, something is wrong */ if (total_relays > MIN_RELAY_CONNECTIONS_TO_WARN && - total_relay_connections >= 1.5*total_relays) { + total_relay_connections > max_tolerable_connections) { log_notice(LD_OR, "Your relay has a very large number of connections to other relays. " "Is your outbound address the same as your relay address? "

1 0

[tor/maint-0.4.4] Adjust the rules for warning about too many connections.
by dgoulet＠torproject.org 22 Jul '20

22 Jul '20

1 0

[tor/maint-0.4.4] Merge branch 'tor-gitlab/mr/77' into maint-0.4.4
by dgoulet＠torproject.org 22 Jul '20

22 Jul '20

commit 1ee164afc2fcc449b562ab8899c458bcc877a4ba Merge: 5cd85feaa7 faa752f3c9 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Jul 22 16:14:11 2020 -0400 Merge branch 'tor-gitlab/mr/77' into maint-0.4.4 changes/ticket33880 | 6 ++++++ src/core/or/channel.c | 32 +++++++++++++++++++++++++++++--- 2 files changed, 35 insertions(+), 3 deletions(-)

1 0

[tor/master] addr: Always set addr_out to UNSPEC in find_my_address
by dgoulet＠torproject.org 22 Jul '20

22 Jul '20

commit 053e02a487c7b960dc72717b230a85cd26a28e0b Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Jul 22 14:21:45 2020 -0400 addr: Always set addr_out to UNSPEC in find_my_address Related #40058 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/app/config/resolve_addr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/app/config/resolve_addr.c b/src/app/config/resolve_addr.c index d23e39b62d..a184c14887 100644 --- a/src/app/config/resolve_addr.c +++ b/src/app/config/resolve_addr.c @@ -629,6 +629,7 @@ find_my_address(const or_options_t *options, int family, int warn_severity, tor_assert(addr_out); /* Set them to NULL for safety reasons. */ + tor_addr_make_unspec(addr_out); if (method_out) *method_out = NULL; if (hostname_out) *hostname_out = NULL;

1 0

[tor/master] Merge branch 'tor-gitlab/mr/74'
by dgoulet＠torproject.org 22 Jul '20

22 Jul '20

commit 492625badff5fda089b33debd98b88c1fd092d1b Merge: f0da04bb7b 053e02a487 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Jul 22 16:09:11 2020 -0400 Merge branch 'tor-gitlab/mr/74' src/app/config/resolve_addr.c | 1 + src/feature/relay/router.c | 66 ++++++++++++++++++++++++------------------- 2 files changed, 38 insertions(+), 29 deletions(-)

1 0

[tor/master] relay: Support IPv6 when checking if our address changed
by dgoulet＠torproject.org 22 Jul '20

22 Jul '20

commit 65c7d33d33aaee8f3f9e4ac2c8ab08c9cdf54927 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Jul 22 10:52:48 2020 -0400 relay: Support IPv6 when checking if our address changed Now support IPv4 _and_ IPv6. This also cleans up nicely the function that was moving IPv4 addresses from uint32_t to tor_addr_t. Fixes #40058 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/relay/router.c | 66 ++++++++++++++++++++++++++-------------------- 1 file changed, 37 insertions(+), 29 deletions(-) diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c index 97a77f9578..4a0a4203aa 100644 --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@ -2589,51 +2589,59 @@ log_addr_has_changed(int severity, addrbuf_cur, source); } -/** Check whether our own address as defined by the Address configuration - * has changed. This is for routers that get their address from a service - * like dyndns. If our address has changed, mark our descriptor dirty. */ +/** Check whether our own address has changed versus the one we have in our + * current descriptor. + * + * If our address has changed, call ip_address_changed() which takes + * appropriate actions. */ void check_descriptor_ipaddress_changed(time_t now) { - uint32_t prev, cur; - tor_addr_t addr; - const or_options_t *options = get_options(); + const routerinfo_t *my_ri = router_get_my_routerinfo(); const char *method = NULL; char *hostname = NULL; - const routerinfo_t *my_ri = router_get_my_routerinfo(); + int families[2] = { AF_INET, AF_INET6 }; + bool has_changed = false; (void) now; - if (my_ri == NULL) /* make sure routerinfo exists */ - return; - - /* XXXX ipv6 */ - prev = tor_addr_to_ipv4h(&my_ri->ipv4_addr); - if (!find_my_address(options, AF_INET, LOG_INFO, &addr, &method, - &hostname)) { - log_info(LD_CONFIG,"options->Address didn't resolve into an IP."); + /* We can't learn our descriptor address without one. */ + if (my_ri == NULL) { return; } - cur = tor_addr_to_ipv4h(&addr); - if (prev != cur) { - char *source; - tor_addr_t tmp_prev, tmp_cur; + for (size_t i = 0; i < ARRAY_LENGTH(families); i++) { + tor_addr_t current; + const tor_addr_t *previous; + int family = families[i]; - tor_addr_from_ipv4h(&tmp_prev, prev); - tor_addr_from_ipv4h(&tmp_cur, cur); - - tor_asprintf(&source, "METHOD=%s%s%s", method, - hostname ? " HOSTNAME=" : "", - hostname ? hostname : ""); + /* Get the descriptor address from the family we are looking up. */ + previous = &my_ri->ipv4_addr; + if (family == AF_INET6) { + previous = &my_ri->ipv6_addr; + } - log_addr_has_changed(LOG_NOTICE, &tmp_prev, &tmp_cur, source); - tor_free(source); + /* Ignore returned value because we want to notice not only an address + * change but also if an address is lost (current == UNSPEC). */ + find_my_address(get_options(), family, LOG_INFO, &current, &method, + &hostname); + + if (!tor_addr_eq(previous, &current)) { + char *source; + tor_asprintf(&source, "METHOD=%s%s%s", + method ? method : "UNKNOWN", + hostname ? " HOSTNAME=" : "", + hostname ? hostname : ""); + log_addr_has_changed(LOG_NOTICE, previous, &current, source); + tor_free(source); + has_changed = true; + } + tor_free(hostname); + } + if (has_changed) { ip_address_changed(0); } - - tor_free(hostname); } /** Set <b>platform</b> (max length <b>len</b>) to a NUL-terminated short

1 0

[tor/master] relay: Limit Directory Authority Addresses to Address and ORPort
by dgoulet＠torproject.org 22 Jul '20

22 Jul '20

commit f0da04bb7b89d6bc4c2da9a3dc954fe60c3b5c0e Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Jul 22 14:17:21 2020 -0400 relay: Limit Directory Authority Addresses to Address and ORPort Closes #33239 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/app/config/resolve_addr.c | 47 ++++++++++++++++++++++++++++++++++--------- 1 file changed, 37 insertions(+), 10 deletions(-) diff --git a/src/app/config/resolve_addr.c b/src/app/config/resolve_addr.c index d23e39b62d..34b33e2887 100644 --- a/src/app/config/resolve_addr.c +++ b/src/app/config/resolve_addr.c @@ -14,6 +14,7 @@ #include "core/mainloop/mainloop.h" #include "feature/control/control_events.h" +#include "feature/dirauth/authmode.h" #include "lib/encoding/confline.h" #include "lib/net/gethostname.h" @@ -536,12 +537,15 @@ resolved_addr_set_last(const tor_addr_t *addr, const char *method_used, *done_one_resolve = true; } +/** Ease our lives. Typedef to the address discovery function signature. */ +typedef fn_address_ret_t + (*fn_address_t)( + const or_options_t *options, int warn_severity, int family, + const char **method_out, char **hostname_out, tor_addr_t *addr_out); + /** Address discovery function table. The order matters as in the first one is * executed first and so on. */ -static fn_address_ret_t - (*fn_address_table[])( - const or_options_t *options, int warn_severity, int family, - const char **method_out, char **hostname_out, tor_addr_t *addr_out) = +static const fn_address_t fn_address_table[] = { /* These functions are in order for our find address algorithm. */ get_address_from_config, @@ -550,7 +554,23 @@ static fn_address_ret_t get_address_from_hostname, }; /** Length of address table as in how many functions. */ -static const size_t fn_address_table_len = ARRAY_LENGTH(fn_address_table); +static const size_t fn_address_table_len = + ARRAY_LENGTH(fn_address_table); + +/* Address discover function table for authorities (bridge or directory). + * + * They only discover their address from either the configuration file or the + * ORPort. They do not query the interface nor do any DNS resolution for + * security reasons. */ +static const fn_address_t fn_address_table_auth[] = +{ + /* These functions are in order for our find address algorithm. */ + get_address_from_config, + get_address_from_orport, +}; +/** Length of address table as in how many functions. */ +static const size_t fn_address_table_auth_len = + ARRAY_LENGTH(fn_address_table_auth); /** @brief Attempt to find our IP address that can be used as our external * reachable address. @@ -624,6 +644,8 @@ find_my_address(const or_options_t *options, int family, int warn_severity, const char *method_used = NULL; char *hostname_used = NULL; tor_addr_t my_addr; + const fn_address_t *table = fn_address_table; + size_t table_len = fn_address_table_len; tor_assert(options); tor_assert(addr_out); @@ -639,15 +661,20 @@ find_my_address(const or_options_t *options, int family, int warn_severity, return false; } + /* For authorities (bridge and directory), we use a different table. */ + if (authdir_mode(options)) { + table = fn_address_table_auth; + table_len = fn_address_table_auth_len; + } + /* - * Step 1: Discover address by attempting 3 different methods consecutively. + * Step 1: Discover address by calling methods from the function table. */ /* Go over the function table. They are in order. */ - for (size_t idx = 0; idx < fn_address_table_len; idx++) { - fn_address_ret_t ret = fn_address_table[idx](options, warn_severity, - family, &method_used, - &hostname_used, &my_addr); + for (size_t idx = 0; idx < table_len; idx++) { + fn_address_ret_t ret = table[idx](options, warn_severity, family, + &method_used, &hostname_used, &my_addr); if (ret == FN_RET_BAIL) { return false; } else if (ret == FN_RET_OK) {

1 0

[tor-browser-build/master] Fold in 9.5.2 Changelog
by sysrqb＠torproject.org 22 Jul '20

22 Jul '20

commit dcddad0e162442c8629f00c351f37ab5b9fe4aa7 Author: Matthew Finkel <sysrqb(a)torproject.org> Date: Wed Jul 22 17:29:36 2020 +0000 Fold in 9.5.2 Changelog --- projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt index a6b6408..719a603 100644 --- a/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt +++ b/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt @@ -2,6 +2,10 @@ Tor Browser 10.0a3 -- July 7 2020 * Android * Update Firefox to 68.10.1esr +Tor Browser 9.5.2 -- July 7 2020 + * Android + * Update Firefox to 68.10.1esr + Tor Browser 10.0a2 -- June 30 2020 * All Platforms * Update Firefox to 68.10.0esr

1 0

[sbws/master] fix: CI: Add .gitlab-ci.yml to run tests in Gitlab
by juga＠torproject.org 22 Jul '20

22 Jul '20

commit 8f633943f07ed71982cc95279fe1410012bafbeb Author: juga0 <juga(a)riseup.net> Date: Wed Jul 15 09:25:33 2020 +0000 fix: CI: Add .gitlab-ci.yml to run tests in Gitlab Closes: #40007 --- .gitlab-ci.yml | 115 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ tox.ini | 8 ++-- 2 files changed, 120 insertions(+), 3 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml new file mode 100644 index 0000000..9b4fe40 --- /dev/null +++ b/.gitlab-ci.yml @@ -0,0 +1,115 @@ +variables: + BASE_IMAGE: python:3.7 + RELEASE: tor-nightly-master-buster + # Without version, the default available in the Debian repository will be + # installed. + # Specifying which version starts with will install the highest that start + # with that version. + TOR: tor=* + PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip" + +cache: + paths: + - .cache/pip + +image: $BASE_IMAGE + +before_script: + - "wget https://deb.torproject.org/torproject.org/\ + A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc" + - cat A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | apt-key add - + - echo deb [signed-by=A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89] + http://deb.torproject.org/torproject.org $RELEASE + main >> /etc/apt/sources.list + - apt update -yqq + - apt install -yqq $TOR + - pip install tox + - python --version + - tor --version + +after_script: + - tox -e stats + +python36tor035: + variables: + BASE_IMAGE: python:3.6 + RELEASE: tor-nightly-0.3.5.x-buster + TOR: tor=0.3.5* + image: $BASE_IMAGE + script: + - tox -e py36 + - tox -e integration + +python36tor041: + variables: + BASE_IMAGE: python:3.6 + RELEASE: tor-nightly-0.4.1.x-buster + TOR: tor=0.4.1* + image: $BASE_IMAGE + script: + - tox -e py36 + - tox -e integration + +python36tor042: + variables: + BASE_IMAGE: python:3.6 + RELEASE: tor-nightly-0.4.2.x-buster + TOR: tor=0.4.2* + image: $BASE_IMAGE + script: + - tox -e py36 + - tox -e integration + +python36torstable: + variables: + BASE_IMAGE: python:3.6 + RELEASE: buster + TOR: tor + image: $BASE_IMAGE + script: + - tox -e py36 + - tox -e integration + +python37: + # This will overwrite the default before_script, so need to repeat the + # commands + before_script: + - "wget https://deb.torproject.org/torproject.org/\ + A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc" + - cat A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | apt-key add - + - echo deb [signed-by=A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89] + http://deb.torproject.org/torproject.org $RELEASE + main >> /etc/apt/sources.list + - apt update -yqq + - apt install -yqq $TOR + - pip install tox + - python --version + - tor --version + # To build the docs + - apt install -yqq texlive-latex-extra + - apt install -yqq dvipng + image: $BASE_IMAGE + script: + - tox -e inst + - tox -e setup + - tox -e py37 + - tox -e integration + - tox -e lint + - tox -e doc + +python38: + variables: + BASE_IMAGE: python:3.8 + image: $BASE_IMAGE + script: + - tox -e py38 + - tox -e integration + +python39: + variables: + BASE_IMAGE: python:3.9-rc-buster + image: $BASE_IMAGE + script: + - tox -e py39 + - tox -e integration + allow_failure: true diff --git a/tox.ini b/tox.ini index f9d712f..f0aadaf 100644 --- a/tox.ini +++ b/tox.ini @@ -1,6 +1,6 @@ [tox] skip_missing_interpreters = True -envlist = py{36, 37, 38, 39, nightly}, inst, setup, unit, integration, lint, stats, doc +envlist = py{36, 37, 38, 39}, inst, setup, integration, lint, stats, doc [travis] python = @@ -10,7 +10,7 @@ python = 3.9-dev: py39, inst, setup, unit, integration, lint, doc nightly: pynightly, inst, setup, unit, integration, lint, doc -[testenv] +; [testenv] # install_command can be removed when --process-dependency-links is not # needed anymore, and this section commented # install_command = pip install {opts} {packages} @@ -32,7 +32,7 @@ skip_install = True commands = python setup.py install recreate = True -[testenv:unit] +[testenv] deps = .[test] commands = coverage run -a --rcfile={toxinidir}/.coveragerc --source=sbws -m pytest \ @@ -49,6 +49,8 @@ whitelist_externals = mkdir rm commands = + # For some reason .[test] is not copying config.* files + pip install . cp -af {toxinidir}/tests/integration/net {envtmpdir} bash {envtmpdir}/net/start.sh bash -c "time python3 {envtmpdir}/net/wait.py {envtmpdir}/net/{auth,relay,exit}*"

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits July 2020