July 2020 - tor-commits - lists.torproject.org

[sbws/maint-1.1] fix: doc: Recommend using a CDN,
by juga＠torproject.org 22 Jul '20

22 Jul '20

commit 77c65cf55f5a55227bbd3506bdd7b65368faf866 Author: juga0 <juga(a)riseup.net> Date: Fri Jun 12 14:59:48 2020 +0000 fix: doc: Recommend using a CDN, add link to it and rephrase some sentences. --- DEPLOY.rst | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/DEPLOY.rst b/DEPLOY.rst index a1ab4dd..45e9d31 100644 --- a/DEPLOY.rst +++ b/DEPLOY.rst @@ -30,6 +30,9 @@ destination requirements - Bandwidth: at least 12.5MB/s (100 Mbit/s). - … [View More]

1 0

[sbws/maint-1.1] fix: CI: Add .gitlab-ci.yml to run tests in Gitlab
by juga＠torproject.org 22 Jul '20

22 Jul '20

commit 8f633943f07ed71982cc95279fe1410012bafbeb Author: juga0 <juga(a)riseup.net> Date: Wed Jul 15 09:25:33 2020 +0000 fix: CI: Add .gitlab-ci.yml to run tests in Gitlab Closes: #40007 --- .gitlab-ci.yml | 115 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ tox.ini | 8 ++-- 2 files changed, 120 insertions(+), 3 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml new file mode 100644 index 0000000..9b4fe40 --- /dev/null +++ b/.gitlab-ci.yml @@ -… [View More]0,0 +1,115 @@ +variables: + BASE_IMAGE: python:3.7 + RELEASE: tor-nightly-master-buster + # Without version, the default available in the Debian repository will be + # installed. + # Specifying which version starts with will install the highest that start + # with that version. + TOR: tor=* + PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip" + +cache: + paths: + - .cache/pip + +image: $BASE_IMAGE + +before_script: + - "wget https://deb.torproject.org/torproject.org/\ + A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc" + - cat A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | apt-key add - + - echo deb [signed-by=A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89] + http://deb.torproject.org/torproject.org $RELEASE + main >> /etc/apt/sources.list + - apt update -yqq + - apt install -yqq $TOR + - pip install tox + - python --version + - tor --version + +after_script: + - tox -e stats + +python36tor035: + variables: + BASE_IMAGE: python:3.6 + RELEASE: tor-nightly-0.3.5.x-buster + TOR: tor=0.3.5* + image: $BASE_IMAGE + script: + - tox -e py36 + - tox -e integration + +python36tor041: + variables: + BASE_IMAGE: python:3.6 + RELEASE: tor-nightly-0.4.1.x-buster + TOR: tor=0.4.1* + image: $BASE_IMAGE + script: + - tox -e py36 + - tox -e integration + +python36tor042: + variables: + BASE_IMAGE: python:3.6 + RELEASE: tor-nightly-0.4.2.x-buster + TOR: tor=0.4.2* + image: $BASE_IMAGE + script: + - tox -e py36 + - tox -e integration + +python36torstable: + variables: + BASE_IMAGE: python:3.6 + RELEASE: buster + TOR: tor + image: $BASE_IMAGE + script: + - tox -e py36 + - tox -e integration + +python37: + # This will overwrite the default before_script, so need to repeat the + # commands + before_script: + - "wget https://deb.torproject.org/torproject.org/\ + A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc" + - cat A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | apt-key add - + - echo deb [signed-by=A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89] + http://deb.torproject.org/torproject.org $RELEASE + main >> /etc/apt/sources.list + - apt update -yqq + - apt install -yqq $TOR + - pip install tox + - python --version + - tor --version + # To build the docs + - apt install -yqq texlive-latex-extra + - apt install -yqq dvipng + image: $BASE_IMAGE + script: + - tox -e inst + - tox -e setup + - tox -e py37 + - tox -e integration + - tox -e lint + - tox -e doc + +python38: + variables: + BASE_IMAGE: python:3.8 + image: $BASE_IMAGE + script: + - tox -e py38 + - tox -e integration + +python39: + variables: + BASE_IMAGE: python:3.9-rc-buster + image: $BASE_IMAGE + script: + - tox -e py39 + - tox -e integration + allow_failure: true diff --git a/tox.ini b/tox.ini index f9d712f..f0aadaf 100644 --- a/tox.ini +++ b/tox.ini @@ -1,6 +1,6 @@ [tox] skip_missing_interpreters = True -envlist = py{36, 37, 38, 39, nightly}, inst, setup, unit, integration, lint, stats, doc +envlist = py{36, 37, 38, 39}, inst, setup, integration, lint, stats, doc [travis] python = @@ -10,7 +10,7 @@ python = 3.9-dev: py39, inst, setup, unit, integration, lint, doc nightly: pynightly, inst, setup, unit, integration, lint, doc -[testenv] +; [testenv] # install_command can be removed when --process-dependency-links is not # needed anymore, and this section commented # install_command = pip install {opts} {packages} @@ -32,7 +32,7 @@ skip_install = True commands = python setup.py install recreate = True -[testenv:unit] +[testenv] deps = .[test] commands = coverage run -a --rcfile={toxinidir}/.coveragerc --source=sbws -m pytest \ @@ -49,6 +49,8 @@ whitelist_externals = mkdir rm commands = + # For some reason .[test] is not copying config.* files + pip install . cp -af {toxinidir}/tests/integration/net {envtmpdir} bash {envtmpdir}/net/start.sh bash -c "time python3 {envtmpdir}/net/wait.py {envtmpdir}/net/{auth,relay,exit}*" [View Less]

1 0

[sbws/maint-1.1] Merge remote-tracking branch 'gitlab/merge-requests/14' into maint-1.1
by juga＠torproject.org 22 Jul '20

22 Jul '20

commit 748cf1c1f347b89eaab625bdebd9314dadaccc8e Merge: c5fe10e a914215 Author: Georg Koppen <gk(a)torproject.org> Date: Fri Jul 10 23:10:23 2020 +0000 Merge remote-tracking branch 'gitlab/merge-requests/14' into maint-1.1 sbws/lib/v3bwfile.py | 30 ++++++++++++++++++------------ tests/unit/lib/data/results.txt | 2 +- 2 files changed, 19 insertions(+), 13 deletions(-)

1 0

[sbws/maint-1.1] Merge remote-tracking branch 'gitlab/merge-requests/18' into maint-1.1
by juga＠torproject.org 22 Jul '20

22 Jul '20

commit 40754a337887cd5c841fe07e6448e1e46f0dc1cc Merge: 16caca1 d958915 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jul 21 08:47:33 2020 +0000 Merge remote-tracking branch 'gitlab/merge-requests/18' into maint-1.1 sbws/lib/relaylist.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

[sbws/maint-1.1] Merge remote-tracking branch 'gitlab/merge-requests/19' into maint-1.1
by juga＠torproject.org 22 Jul '20

22 Jul '20

commit 16caca1040b2120ff0381a74763fc80516795e9e Merge: 748cf1c 09905b6 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jul 21 08:46:28 2020 +0000 Merge remote-tracking branch 'gitlab/merge-requests/19' into maint-1.1 sbws/globals.py | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)

1 0

[sbws/maint-1.1] Merge remote-tracking branch 'gitlab/merge-requests/20' into maint-1.1
by juga＠torproject.org 22 Jul '20

22 Jul '20

commit 3fcc5892cf33b7920507edd9cca4c76ca5d1a1a1 Merge: 40754a3 8f63394 Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jul 21 08:50:08 2020 +0000 Merge remote-tracking branch 'gitlab/merge-requests/20' into maint-1.1 .gitlab-ci.yml | 115 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ tox.ini | 8 ++-- 2 files changed, 120 insertions(+), 3 deletions(-)

1 0

[tor/master] relay: Remove possible ORPorts duplicate from parsed list
by nickm＠torproject.org 22 Jul '20

22 Jul '20

commit 803e769fb255f39dba07b5dbc2ca62a43b43004c Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jul 21 11:34:13 2020 -0400 relay: Remove possible ORPorts duplicate from parsed list Now that tor automatically binds to IPv4 _and_ IPv6, in order to avoid breaking configurations, we sanitize the parsed lists for duplicate ORPorts. It is possible to happen because we still allow this configuration; ORPort 9888 ORPort [4242::1]:9888 … [View More]Meaning that the first ORPort value will bind to 0.0.0.0:9888 _and_ [::]:9888 which would lead to an error when attempting to bind on [4242::1]:9888. However, that configuration is accepted today and thus we must not break it. To remedy, we now sanitize the parsed list and prioritize an ORPort that has an explicit address over the global one. A warning is emitted if such configuration pattern is found. This is only for the ORPort. Related to #33246 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/relay/relay_config.c | 89 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 88 insertions(+), 1 deletion(-) diff --git a/src/feature/relay/relay_config.c b/src/feature/relay/relay_config.c index cddb031f8f..c8a30d63d1 100644 --- a/src/feature/relay/relay_config.c +++ b/src/feature/relay/relay_config.c @@ -133,12 +133,96 @@ port_warn_nonlocal_ext_orports(const smartlist_t *ports, const char *portname) } SMARTLIST_FOREACH_END(port); } +/** Return a static buffer containing the human readable logging string that + * describes the given port object. */ +static const char * +describe_relay_port(const port_cfg_t *port) +{ + IF_BUG_ONCE(!port) { + return "<null port>"; + } + + static char buf[256]; + const char *type, *addr; + + switch (port->type) { + case CONN_TYPE_OR_LISTENER: + type = "OR"; + break; + case CONN_TYPE_DIR_LISTENER: + type = "Dir"; + break; + case CONN_TYPE_EXT_OR_LISTENER: + type = "ExtOR"; + break; + default: + type = ""; + break; + } + + if (port->explicit_addr) { + addr = fmt_and_decorate_addr(&port->addr); + } else { + addr = ""; + } + + tor_snprintf(buf, sizeof(buf), "%sPort %s%s%d", + type, addr, (strlen(addr) > 0) ? ":" : "", port->port); + return buf; +} + +/** Attempt to find duplicate ORPort that would be superseded by another and + * remove them from the given ports list. This is possible if we have for + * instance: + * + * ORPort 9050 + * ORPort [4242::1]:9050 + * + * First one binds to both v4 and v6 address but second one is specific to an + * address superseding the global bind one. + * + * The following is O(n^2) but it is done at bootstrap or config reload and + * the list is not very long usually. */ +static void +remove_duplicate_orports(smartlist_t *ports) +{ + for (int i = 0; i < smartlist_len(ports); ++i) { + port_cfg_t *current = smartlist_get(ports, i); + + /* Skip non ORPorts. */ + if (current->type != CONN_TYPE_OR_LISTENER) { + continue; + } + + for (int j = 0; j < smartlist_len(ports); ++j) { + port_cfg_t *next = smartlist_get(ports, j); + + /* Avoid comparing the same object. */ + if (current == next) { + continue; + } + /* Same address family and same port number, we have a match. */ + if (!current->explicit_addr && next->explicit_addr && + tor_addr_family(&current->addr) == tor_addr_family(&next->addr) && + current->port == next->port) { + /* Remove current because next is explicitly set. */ + smartlist_del_keeporder(ports, i--); + char *next_str = tor_strdup(describe_relay_port(next)); + log_warn(LD_CONFIG, "Configuration port %s superseded by %s", + describe_relay_port(current), next_str); + tor_free(next_str); + port_cfg_free(current); + } + } + } +} + /** Given a list of port_cfg_t in ports, check them for internal * consistency and warn as appropriate. On Unix-based OSes, set * *n_low_ports_out to the number of sub-1024 ports we will be * binding, and warn if we may be unable to re-bind after hibernation. */ static int -check_server_ports(const smartlist_t *ports, +check_server_ports(smartlist_t *ports, const or_options_t *options, int *n_low_ports_out) { @@ -159,6 +243,9 @@ check_server_ports(const smartlist_t *ports, int n_low_port = 0; int r = 0; + /* Remove possible duplicate ORPorts before inspecting the list. */ + remove_duplicate_orports(ports); + SMARTLIST_FOREACH_BEGIN(ports, const port_cfg_t *, port) { if (port->type == CONN_TYPE_DIR_LISTENER) { if (! port->server_cfg.no_advertise) [View Less]

1 0

[tor/master] relay: Change router_can_extend_over_ipv6() to look at configured port
by nickm＠torproject.org 22 Jul '20

22 Jul '20

commit 28c1b6047649dad62d269e6c2fde40f41cb9834a Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jul 21 13:11:28 2020 -0400 relay: Change router_can_extend_over_ipv6() to look at configured port In routerconf_find_ipv6_or_ap(), we check if the returned ORPort is internal but not for listening. This means that IPv6 [::] is considered internal. Thus, we can't use it, we have to look directly at the configured address and port and if they are valid, … [View More]

1 0

[tor/master] Rename check_server_ports to check_and_prune_server_ports
by nickm＠torproject.org 22 Jul '20

22 Jul '20

commit a4c5b7d7421b9f02d479e4471b527ee3b9285d8c Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jul 21 15:15:06 2020 -0400 Rename check_server_ports to check_and_prune_server_ports This is an automated commit, generated by this command: ./scripts/maint/rename_c_identifier.py \ check_server_ports check_and_prune_server_ports --- src/feature/relay/relay_config.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/… [View More]

1 0

[tor/master] relay: Automatically Enable an IPv6 ORPort
by nickm＠torproject.org 22 Jul '20

22 Jul '20

commit c3a0f757964de0e8a24911d72abff5df20bb323c Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jul 21 09:28:52 2020 -0400 relay: Automatically Enable an IPv6 ORPort This commit makes it that if the ORPort is set with a single port, it will bind to both global listen IPv4 and IPv6 addresses. To pin an "ORPort <PORT>" to be IPv4 or IPv6, the IPv4Only/IPv6Only flags are honored thus this will _only_ bind on IPv6 for that port value: … [View More] ORPort 9050 IPv6Only Results in: [::]:9050 ORPort 9051 IPv4Only Results in: [0.0.0.0]:9051 Attempting to configure an explicit IPv4 address with IPv6Only flag is an error and vice versa. Closes #33246 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket33246 | 3 +++ src/app/config/config.c | 51 ++++++++++++++++++++++++++++++---------- src/core/or/port_cfg_st.h | 2 ++ src/feature/relay/relay_config.c | 8 +++++++ src/test/test_config.c | 38 ++++++++++++++++++++++++++++++ 5 files changed, 90 insertions(+), 12 deletions(-) diff --git a/changes/ticket33246 b/changes/ticket33246 new file mode 100644 index 0000000000..c44c2992b0 --- /dev/null +++ b/changes/ticket33246 @@ -0,0 +1,3 @@ + o Major feature (relay, IPv6): + - Relays now automatically bind on IPv6 for their ORPort unless specified + otherwise with the IPv4Only flag. Closes ticket 33246. diff --git a/src/app/config/config.c b/src/app/config/config.c index 1671f295e3..a70c1d651e 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -5831,6 +5831,15 @@ port_parse_config(smartlist_t *out, int got_zero_port=0, got_nonzero_port=0; char *unix_socket_path = NULL; port_cfg_t *cfg = NULL; + bool addr_is_explicit = false; + int family = -1; + + /* Parse default address. This can fail for Unix socket for instance so + * family can be -1 and the default_addr will be made UNSPEC. */ + tor_addr_t default_addr = TOR_ADDR_NULL; + if (defaultaddr) { + family = tor_addr_parse(&default_addr, defaultaddr); + } /* If there's no FooPort, then maybe make a default one. */ if (! ports) { @@ -5907,8 +5916,8 @@ port_parse_config(smartlist_t *out, port = 1; } else if (!strcasecmp(addrport, "auto")) { port = CFG_AUTO_PORT; - int af = tor_addr_parse(&addr, defaultaddr); - tor_assert(af >= 0); + tor_assert(family >= 0); + tor_addr_copy(&addr, &default_addr); } else if (!strcasecmpend(addrport, ":auto")) { char *addrtmp = tor_strndup(addrport, strlen(addrport)-5); port = CFG_AUTO_PORT; @@ -5924,14 +5933,20 @@ port_parse_config(smartlist_t *out, "9050" might be a valid address. */ port = (int) tor_parse_long(addrport, 10, 0, 65535, &ok, NULL); if (ok) { - int af = tor_addr_parse(&addr, defaultaddr); - tor_assert(af >= 0); + tor_assert(family >= 0); + tor_addr_copy(&addr, &default_addr); } else if (tor_addr_port_lookup(addrport, &addr, &ptmp) == 0) { if (ptmp == 0) { log_warn(LD_CONFIG, "%sPort line has address but no port", portname); goto err; } + if (family != -1 && tor_addr_family(&addr) != family) { + /* This means we are parsing another ORPort family but we are + * attempting to find the default address' family ORPort. */ + goto ignore; + } port = ptmp; + addr_is_explicit = true; } else { log_warn(LD_CONFIG, "Couldn't parse address %s for %sPort", escaped(addrport), portname); @@ -5942,6 +5957,7 @@ port_parse_config(smartlist_t *out, /* Default port_cfg_t object initialization */ cfg = port_cfg_new(unix_socket_path ? strlen(unix_socket_path) : 0); + cfg->explicit_addr = addr_is_explicit; if (unix_socket_path && default_to_group_writable) cfg->is_group_writable = 1; @@ -5984,15 +6000,25 @@ port_parse_config(smartlist_t *out, } if (cfg->server_cfg.bind_ipv4_only && tor_addr_family(&addr) != AF_INET) { - log_warn(LD_CONFIG, "Could not interpret %sPort address as IPv4", - portname); - goto err; + if (cfg->explicit_addr) { + log_warn(LD_CONFIG, "Could not interpret %sPort address as IPv4", + portname); + goto err; + } + /* This ORPort is IPv4Only but the default address is IPv6, ignore it + * since this will be configured with an IPv4 default address. */ + goto ignore; } if (cfg->server_cfg.bind_ipv6_only && tor_addr_family(&addr) != AF_INET6) { - log_warn(LD_CONFIG, "Could not interpret %sPort address as IPv6", - portname); - goto err; + if (cfg->explicit_addr) { + log_warn(LD_CONFIG, "Could not interpret %sPort address as IPv6", + portname); + goto err; + } + /* This ORPort is IPv6Only but the default address is IPv4, ignore it + * since this will be configured with an IPv6 default address. */ + goto ignore; } } else { /* This is a client port; parse isolation options */ @@ -6205,9 +6231,10 @@ port_parse_config(smartlist_t *out, smartlist_add(out, cfg); /* out owns cfg now, don't re-use or free it */ cfg = NULL; - } else { - tor_free(cfg); } + + ignore: + tor_free(cfg); SMARTLIST_FOREACH(elts, char *, cp, tor_free(cp)); smartlist_clear(elts); tor_free(addrport); diff --git a/src/core/or/port_cfg_st.h b/src/core/or/port_cfg_st.h index 064e679d78..f8ff6f8cc8 100644 --- a/src/core/or/port_cfg_st.h +++ b/src/core/or/port_cfg_st.h @@ -26,6 +26,8 @@ struct port_cfg_t { unsigned is_group_writable : 1; unsigned is_world_writable : 1; unsigned relax_dirmode_check : 1; + unsigned explicit_addr : 1; /** Indicate if address was explicitly set or + * we are using the default address. */ entry_port_cfg_t entry_cfg; diff --git a/src/feature/relay/relay_config.c b/src/feature/relay/relay_config.c index 7cb7f2ccfd..cddb031f8f 100644 --- a/src/feature/relay/relay_config.c +++ b/src/feature/relay/relay_config.c @@ -270,6 +270,14 @@ port_parse_ports_relay(or_options_t *options, *msg = tor_strdup("Invalid ORPort configuration"); goto err; } + if (port_parse_config(ports, + options->ORPort_lines, + "OR", CONN_TYPE_OR_LISTENER, + "[::]", 0, + CL_PORT_SERVER_OPTIONS) < 0) { + *msg = tor_strdup("Invalid ORPort configuration"); + goto err; + } if (port_parse_config(ports, options->ExtORPort_lines, "ExtOR", CONN_TYPE_EXT_OR_LISTENER, diff --git a/src/test/test_config.c b/src/test/test_config.c index e61a62818d..121b51e925 100644 --- a/src/test/test_config.c +++ b/src/test/test_config.c @@ -5162,6 +5162,44 @@ test_config_parse_port_config__ports__server_options(void *data) 0, CL_PORT_SERVER_OPTIONS); tt_int_op(ret, OP_EQ, -1); + /* Default address is IPv4 but pass IPv6Only flag. Should be ignored. */ + config_free_lines(config_port_invalid); config_port_invalid = NULL; + SMARTLIST_FOREACH(slout,port_cfg_t *,pf,port_cfg_free(pf)); + smartlist_clear(slout); + config_port_invalid = mock_config_line("ORPort", "9050 IPv6Only"); + ret = port_parse_config(slout, config_port_invalid, "ORPort", 0, + "127.0.0.1", 0, CL_PORT_SERVER_OPTIONS); + tt_int_op(ret, OP_EQ, 0); + + /* Default address is IPv6 but pass IPv4Only flag. Should be ignored. */ + config_free_lines(config_port_invalid); config_port_invalid = NULL; + SMARTLIST_FOREACH(slout,port_cfg_t *,pf,port_cfg_free(pf)); + smartlist_clear(slout); + config_port_invalid = mock_config_line("ORPort", "9050 IPv4Only"); + ret = port_parse_config(slout, config_port_invalid, "ORPort", 0, + "[::]", 0, CL_PORT_SERVER_OPTIONS); + tt_int_op(ret, OP_EQ, 0); + + /* Explicit address is IPv6 but pass IPv4Only flag. Should error. */ + config_free_lines(config_port_invalid); config_port_invalid = NULL; + SMARTLIST_FOREACH(slout,port_cfg_t *,pf,port_cfg_free(pf)); + smartlist_clear(slout); + config_port_invalid = mock_config_line("ORPort", + "[4242::4242]:9050 IPv4Only"); + ret = port_parse_config(slout, config_port_invalid, "ORPort", 0, + "[::]", 0, CL_PORT_SERVER_OPTIONS); + tt_int_op(ret, OP_EQ, -1); + + /* Explicit address is IPv4 but pass IPv6Only flag. Should error. */ + config_free_lines(config_port_invalid); config_port_invalid = NULL; + SMARTLIST_FOREACH(slout,port_cfg_t *,pf,port_cfg_free(pf)); + smartlist_clear(slout); + config_port_invalid = mock_config_line("ORPort", + "1.2.3.4:9050 IPv6Only"); + ret = port_parse_config(slout, config_port_invalid, "ORPort", 0, + "127.0.0.1", 0, CL_PORT_SERVER_OPTIONS); + tt_int_op(ret, OP_EQ, -1); + done: if (slout) SMARTLIST_FOREACH(slout,port_cfg_t *,pf,port_cfg_free(pf)); [View Less]

1 0