tor-commits January 2021

tor-commits@lists.torproject.org

16 participants
2244 discussions

[manual/master] Updating the 'Known Issues' page
by gus＠torproject.org 29 Jan '21

29 Jan '21

commit a0fec7e7590995676d4ab6599868f658c32c52f6 Author: championquizzer <championquizzer(a)gmail.com> Date: Fri Jan 29 14:47:59 2021 +0530 Updating the 'Known Issues' page --- content/known-issues/contents.lr | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/content/known-issues/contents.lr b/content/known-issues/contents.lr index b4243d8..4e86957 100644 --- a/content/known-issues/contents.lr +++ b/content/known-issues/contents.lr @@ -12,11 +12,14 @@ body: * Tor needs your system clock (and your time zone) set to the correct time. -* The following firewall software have been known to interfere with Tor and may need to be temporarily disabled: +* Antivirus or malware protection blocking users from accessing Tor Browser. Sometimes these also pop up with [false positives regarding malware and/or vulnerabilities](https://support.torproject.org/tbb/antivirus-false-positiv…. You can read more about this on our [Support Portal](https://support.torproject.org/tbb/tbb-10/). The following antivirus and firewall software have been known to interfere with Tor and may need to be temporarily disabled: * Webroot SecureAnywhere * Kaspersky Internet Security 2012 * Sophos Antivirus for Mac * Microsoft Security Essentials + * Avast Antivirus + +* VPNs also tend to interfere with Tor and need to be disabled. We also do not recommend using VPN and Tor together unless you're an advanced user who knows how to configure both in a way that doesn't compromise your privacy. You can find more detailed information about Tor + VPN at our [wiki](https://trac.torproject.org/projects/tor/wiki/doc/TorPlusVPN). * Videos that require Adobe Flash are unavailable. Flash is disabled for security reasons. @@ -24,10 +27,10 @@ body: * The Tor Browser package is dated January 1, 2000 00:00:00 UTC. This is to ensure that each software build is exactly reproducible. -* To run Tor Browser on Ubuntu, users need to execute a shell script. Open "Files" (Unity's explorer), open Preferences → Behavior Tab → Set "Run executable text files when they are opened" to "Ask every time", then click OK. +* Issues with making Tor Browser as your [default browser](https://support.torproject.org/tbb/tbb-32/). -* Tor Browser can also be started from the command line by running the following command from inside the Tor Browser directory: +* If Tor Browser was working before and is not working now (especially after a re-install or an update), your system may have been hibernating. A reboot of your system, in that case, will solve the issue. - `./start-tor-browser.desktop` +* Tor won't start on Windows when the [folder path contains non-ascii characters](https://gitlab.torproject.org/tpo/core/tor/-/issues/10416). * BitTorrent [is not anonymous over Tor](https://blog.torproject.org/bittorrent-over-tor-isnt-good-idea).

1 0

[newsletter/master] Update year of publication.
by gus＠torproject.org 29 Jan '21

29 Jan '21

commit d358b520009931916878a758edc22f506d6efcad Author: gus <gus(a)torproject.org> Date: Fri Jan 29 15:07:55 2021 -0500 Update year of publication. --- content/archive/2020-fundraising-results-thank-you/contents.lr | 2 +- content/archive/2020-fundraising-results-thank-you/text/contents.lr | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/archive/2020-fundraising-results-thank-you/contents.lr b/content/archive/2020-fundraising-results-thank-you/contents.lr index 8bbcd4c..272a627 100644 --- a/content/archive/2020-fundraising-results-thank-you/contents.lr +++ b/content/archive/2020-fundraising-results-thank-you/contents.lr @@ -4,7 +4,7 @@ _template: newsletter.html --- author: smith(a)torproject.org --- -pub_date: 2020-01-29 +pub_date: 2021-01-29 --- title: 2020 Fundraising Results: Thank You! --- diff --git a/content/archive/2020-fundraising-results-thank-you/text/contents.lr b/content/archive/2020-fundraising-results-thank-you/text/contents.lr index 698634f..92e0e6b 100644 --- a/content/archive/2020-fundraising-results-thank-you/text/contents.lr +++ b/content/archive/2020-fundraising-results-thank-you/text/contents.lr @@ -4,7 +4,7 @@ _template: post.html --- author: smith(a)torproject.org --- -pub_date: 2020-01-29 +pub_date: 2021-01-29 --- title: 2020 Fundraising Results: Thank You! ---

1 0

[tor/maint-0.4.5] exit: Deny re-entry into the network
by dgoulet＠torproject.org 29 Jan '21

29 Jan '21

commit 632688c797bb3968946343cafaaf51c882c59aed Author: Roger Dingledine <arma(a)torproject.org> Date: Wed Jan 27 23:48:57 2021 -0500 exit: Deny re-entry into the network Exit relays now reject exit attempts to known relay addresses + ORPort and also to authorities on the ORPort and DirPort. Closes #2667 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket2667 | 4 ++++ src/core/or/connection_edge.c | 24 ++++++++++++++++++++++++ 2 files changed, 28 insertions(+) diff --git a/changes/ticket2667 b/changes/ticket2667 new file mode 100644 index 0000000000..cc42286ef9 --- /dev/null +++ b/changes/ticket2667 @@ -0,0 +1,4 @@ + o Major feature (exit): + - Re-entry into the network is now denied at the Exit level to all relays' + ORPort and authorities' ORPort+DirPort. This is to help mitigate a series + of attacks. See ticket for more information. Closes ticket 2667. diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index 859ad1c6fc..55e7841cc3 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -4263,6 +4263,30 @@ connection_exit_connect(edge_connection_t *edge_conn) return; } + /* Next, check for attempts to connect back into the Tor network. We don't + * want to allow these for the same reason we don't want to allow + * infinite-length circuits (see "A Practical Congestion Attack on Tor Using + * Long Paths", Usenix Security 2009). See also ticket 2667. + * + * The TORPROTOCOL reason is used instead of EXITPOLICY so client do NOT + * attempt to retry connecting onto another circuit that will also fail + * bringing considerable more load on the network if so. + * + * Since the address+port set here is a bloomfilter, in very rare cases, the + * check will create a false positive meaning that the destination could + * actually be legit and thus being denied exit. However, sending back a + * reason that makes the client retry results in much worst consequences in + * case of an attack so this is a small price to pay. */ + if (!connection_edge_is_rendezvous_stream(edge_conn) && + nodelist_reentry_probably_contains(&conn->addr, conn->port)) { + log_info(LD_EXIT, "%s tried to connect back to a known relay address. " + "Closing.", connection_describe(conn)); + connection_edge_end(edge_conn, END_STREAM_REASON_TORPROTOCOL); + circuit_detach_stream(circuit_get_by_edge_conn(edge_conn), edge_conn); + connection_free(conn); + return; + } + #ifdef HAVE_SYS_UN_H if (conn->socket_family != AF_UNIX) { #else

1 0

[tor/maint-0.4.5] relay: Add bloomfiter of relay address + {OR|Dir}Port
by dgoulet＠torproject.org 29 Jan '21

29 Jan '21

commit 8dda7bfdb84a5e4b3b422592f811a465e37bb155 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Jan 27 21:49:56 2021 -0500 relay: Add bloomfiter of relay address + {OR|Dir}Port In order to deny re-entry in the network, we now keep a bloomfilter of relay ORPort + address and authorities ORPort + address and DirPort + address combinations. So when an Exit stream is handled, we deny anything connecting back into the network on the ORPorts for relays and on the ORPort+DirPort for the authorities. Related to #2667 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/core/or/address_set.c | 74 +++++++++++++++++++++++++++++++++++++++++ src/core/or/address_set.h | 18 +++++++++- src/feature/nodelist/dirlist.c | 9 +++-- src/feature/nodelist/nodelist.c | 64 +++++++++++++++++++++++++++++------ src/feature/nodelist/nodelist.h | 5 ++- 5 files changed, 154 insertions(+), 16 deletions(-) diff --git a/src/core/or/address_set.c b/src/core/or/address_set.c index d618ffc3d6..fcddc55e9f 100644 --- a/src/core/or/address_set.c +++ b/src/core/or/address_set.c @@ -69,3 +69,77 @@ address_set_probably_contains(const address_set_t *set, { return bloomfilt_probably_contains(set, addr); } + +/* Length of the item is an address (IPv4 or IPv6) and a 2 byte port. We use + * 16 bytes for the address here (IPv6) since we do not know which family + * the given address in the item thus in the case of IPv4, the extra bytes + * are simply zeroes to accomodate. */ +#define BLOOMFILT_ADDR_PORT_ITEM_LEN (16 + sizeof(uint16_t)) + +/** Build an item for the bloomfilter consisting of an address and port pair. + * + * If the given address is _not_ AF_INET or AF_INET6, then the item is an + * array of 0s. + * + * Return a pointer to a static buffer containing the item. Next call to this + * function invalidates its previous content. */ +static const uint8_t * +build_addr_port_item(const tor_addr_t *addr, const uint16_t port) +{ + static uint8_t data[BLOOMFILT_ADDR_PORT_ITEM_LEN]; + + memset(data, 0, sizeof(data)); + switch (tor_addr_family(addr)) { + case AF_INET: + memcpy(data, &addr->addr.in_addr.s_addr, 4); + break; + case AF_INET6: + memcpy(data, &addr->addr.in6_addr.s6_addr, 16); + break; + case AF_UNSPEC: + /* Leave the 0. */ + break; + default: + /* LCOV_EXCL_START */ + tor_fragile_assert(); + /* LCOV_EXCL_STOP */ + } + + memcpy(data + 16, &port, sizeof(port)); + return data; +} + +/** Return a hash value for the given item that the bloomfilter will use. */ +static uint64_t +bloomfilt_addr_port_hash(const struct sipkey *key, + const void *item) +{ + return siphash24(item, BLOOMFILT_ADDR_PORT_ITEM_LEN, key); +} + +/** Allocate and return an addr_port_set_t, suitable for holding up to + * max_address_guess distinct values. */ +addr_port_set_t * +addr_port_set_new(int max_addresses_guess) +{ + uint8_t k[BLOOMFILT_KEY_LEN]; + crypto_rand((void*)k, sizeof(k)); + return bloomfilt_new(max_addresses_guess, bloomfilt_addr_port_hash, k); +} + +/** Add an address and port pair to the given set. */ +void +addr_port_set_add(addr_port_set_t *set, const tor_addr_t *addr, uint16_t port) +{ + bloomfilt_add(set, build_addr_port_item(addr, port)); +} + +/** Return true if the given address and port pair are in the set. Of course, + * this is a bloomfilter and thus in rare occasion, a false positive happens + * thus the "probably". */ +bool +addr_port_set_probably_contains(const addr_port_set_t *set, + const tor_addr_t *addr, uint16_t port) +{ + return !!bloomfilt_probably_contains(set, build_addr_port_item(addr, port)); +} diff --git a/src/core/or/address_set.h b/src/core/or/address_set.h index 33887a7c9e..2c78ab0576 100644 --- a/src/core/or/address_set.h +++ b/src/core/or/address_set.h @@ -13,13 +13,14 @@ #include "lib/cc/torint.h" #include "lib/container/bloomfilt.h" +struct tor_addr_t; + /** * An address_set_t represents a set of tor_addr_t values. The implementation * is probabilistic: false negatives cannot occur but false positives are * possible. */ typedef struct bloomfilt_t address_set_t; -struct tor_addr_t; address_set_t *address_set_new(int max_addresses_guess); #define address_set_free(set) bloomfilt_free(set) @@ -28,4 +29,19 @@ void address_set_add_ipv4h(address_set_t *set, uint32_t addr); int address_set_probably_contains(const address_set_t *set, const struct tor_addr_t *addr); +/** + * An addr_port_set_t represents a set of tor_addr_t values with a uint16_t + * port value. The implementation is probabilistic: false negatives cannot + * occur but false positives are possible. + */ +typedef struct bloomfilt_t addr_port_set_t; + +addr_port_set_t *addr_port_set_new(int max_addresses_guess); +#define addr_port_set_free(s) bloomfilt_free(s) +void addr_port_set_add(addr_port_set_t *set, + const struct tor_addr_t *addr, uint16_t port); +bool addr_port_set_probably_contains(const addr_port_set_t *set, + const struct tor_addr_t *addr, + uint16_t port); + #endif /* !defined(TOR_ADDRESS_SET_H) */ diff --git a/src/feature/nodelist/dirlist.c b/src/feature/nodelist/dirlist.c index 576a6a2e49..423c4106e2 100644 --- a/src/feature/nodelist/dirlist.c +++ b/src/feature/nodelist/dirlist.c @@ -58,10 +58,13 @@ add_trusted_dir_to_nodelist_addr_set(const dir_server_t *dir) tor_assert(dir); tor_assert(dir->is_authority); - /* Add IPv4 and then IPv6 if applicable. */ - nodelist_add_addr_to_address_set(&dir->ipv4_addr); + /* Add IPv4 and then IPv6 if applicable. For authorities, we add the ORPort + * and DirPort so re-entry into the network back to them is not possible. */ + nodelist_add_addr_to_address_set(&dir->ipv4_addr, dir->ipv4_orport, + dir->ipv4_dirport); if (!tor_addr_is_null(&dir->ipv6_addr)) { - nodelist_add_addr_to_address_set(&dir->ipv6_addr); + /* IPv6 DirPort is not a thing yet for authorities. */ + nodelist_add_addr_to_address_set(&dir->ipv6_addr, dir->ipv6_orport, 0); } } diff --git a/src/feature/nodelist/nodelist.c b/src/feature/nodelist/nodelist.c index cfa8b69f81..0c9bdb3c0e 100644 --- a/src/feature/nodelist/nodelist.c +++ b/src/feature/nodelist/nodelist.c @@ -135,6 +135,10 @@ typedef struct nodelist_t { /* Set of addresses that belong to nodes we believe in. */ address_set_t *node_addrs; + /* Set of addresses + port that belong to nodes we know and that we don't + * allow network re-entry towards them. */ + addr_port_set_t *reentry_set; + /* The valid-after time of the last live consensus that initialized the * nodelist. We use this to detect outdated nodelists that need to be * rebuilt using a newer consensus. */ @@ -447,40 +451,58 @@ node_addrs_changed(node_t *node) static void node_add_to_address_set(const node_t *node) { - if (!the_nodelist || !the_nodelist->node_addrs) + if (!the_nodelist || + !the_nodelist->node_addrs || !the_nodelist->reentry_set) return; - /* These various address sources can be redundant, but it's likely faster - * to add them all than to compare them all for equality. */ + /* These various address sources can be redundant, but it's likely faster to + * add them all than to compare them all for equality. + * + * For relays, we only add the ORPort in the addr+port set since we want to + * allow re-entry into the network to the DirPort so the self reachability + * test succeeds and thus the 0 value for the DirPort. */ if (node->rs) { if (!tor_addr_is_null(&node->rs->ipv4_addr)) - nodelist_add_addr_to_address_set(&node->rs->ipv4_addr); + nodelist_add_addr_to_address_set(&node->rs->ipv4_addr, + node->rs->ipv4_orport, 0); if (!tor_addr_is_null(&node->rs->ipv6_addr)) - nodelist_add_addr_to_address_set(&node->rs->ipv6_addr); + nodelist_add_addr_to_address_set(&node->rs->ipv6_addr, + node->rs->ipv6_orport, 0); } if (node->ri) { if (!tor_addr_is_null(&node->ri->ipv4_addr)) - nodelist_add_addr_to_address_set(&node->ri->ipv4_addr); + nodelist_add_addr_to_address_set(&node->ri->ipv4_addr, + node->ri->ipv4_orport, 0); if (!tor_addr_is_null(&node->ri->ipv6_addr)) - nodelist_add_addr_to_address_set(&node->ri->ipv6_addr); + nodelist_add_addr_to_address_set(&node->ri->ipv6_addr, + node->ri->ipv6_orport, 0); } if (node->md) { if (!tor_addr_is_null(&node->md->ipv6_addr)) - nodelist_add_addr_to_address_set(&node->md->ipv6_addr); + nodelist_add_addr_to_address_set(&node->md->ipv6_addr, + node->md->ipv6_orport, 0); } } /** Add the given address into the nodelist address set. */ void -nodelist_add_addr_to_address_set(const tor_addr_t *addr) +nodelist_add_addr_to_address_set(const tor_addr_t *addr, + uint16_t or_port, uint16_t dir_port) { if (BUG(!addr) || tor_addr_is_null(addr) || (!tor_addr_is_v4(addr) && !tor_addr_is_v6(addr)) || - !the_nodelist || !the_nodelist->node_addrs) { + !the_nodelist || !the_nodelist->node_addrs || + !the_nodelist->reentry_set) { return; } address_set_add(the_nodelist->node_addrs, addr); + if (or_port != 0) { + addr_port_set_add(the_nodelist->reentry_set, addr, or_port); + } + if (dir_port != 0) { + addr_port_set_add(the_nodelist->reentry_set, addr, dir_port); + } } /** Return true if addr is the address of some node in the nodelist. @@ -497,6 +519,21 @@ nodelist_probably_contains_address(const tor_addr_t *addr) return address_set_probably_contains(the_nodelist->node_addrs, addr); } +/** Return true if addr is the address of some node in the nodelist and + * corresponds also to the given port. If not, probably return false. */ +bool +nodelist_reentry_probably_contains(const tor_addr_t *addr, uint16_t port) +{ + if (BUG(!addr) || BUG(!port)) + return false; + + if (!the_nodelist || !the_nodelist->reentry_set) + return false; + + return addr_port_set_probably_contains(the_nodelist->reentry_set, + addr, port); +} + /** Add ri to an appropriate node in the nodelist. If we replace an * old routerinfo, and ri_old_out is not NULL, set *ri_old_out * to the previous routerinfo. @@ -628,10 +665,13 @@ nodelist_set_consensus(const networkstatus_t *ns) * v6). Then we add the number of configured trusted authorities we have. */ int estimated_addresses = smartlist_len(ns->routerstatus_list) * get_estimated_address_per_node(); - estimated_addresses += (get_n_authorities(V3_DIRINFO & BRIDGE_DIRINFO) * + estimated_addresses += (get_n_authorities(V3_DIRINFO | BRIDGE_DIRINFO) * get_estimated_address_per_node()); address_set_free(the_nodelist->node_addrs); + addr_port_set_free(the_nodelist->reentry_set); the_nodelist->node_addrs = address_set_new(estimated_addresses); + /* Times two here is for both the ORPort and DirPort. */ + the_nodelist->reentry_set = addr_port_set_new(estimated_addresses * 2); SMARTLIST_FOREACH_BEGIN(ns->routerstatus_list, routerstatus_t *, rs) { node_t *node = node_get_or_create(rs->identity_digest); @@ -858,6 +898,8 @@ nodelist_free_all(void) address_set_free(the_nodelist->node_addrs); the_nodelist->node_addrs = NULL; + addr_port_set_free(the_nodelist->reentry_set); + the_nodelist->reentry_set = NULL; tor_free(the_nodelist); } diff --git a/src/feature/nodelist/nodelist.h b/src/feature/nodelist/nodelist.h index b762fb339c..ada0a640a1 100644 --- a/src/feature/nodelist/nodelist.h +++ b/src/feature/nodelist/nodelist.h @@ -35,7 +35,10 @@ node_t *nodelist_add_microdesc(microdesc_t *md); void nodelist_set_consensus(const networkstatus_t *ns); void nodelist_ensure_freshness(const networkstatus_t *ns); int nodelist_probably_contains_address(const tor_addr_t *addr); -void nodelist_add_addr_to_address_set(const tor_addr_t *addr); +bool nodelist_reentry_probably_contains(const tor_addr_t *addr, + uint16_t port); +void nodelist_add_addr_to_address_set(const tor_addr_t *addr, + uint16_t or_port, uint16_t dir_port); void nodelist_remove_microdesc(const char *identity_digest, microdesc_t *md); void nodelist_remove_routerinfo(routerinfo_t *ri);

1 0

[tor/maint-0.4.5] test: Add test for exits blocking reentry to the network
by dgoulet＠torproject.org 29 Jan '21

29 Jan '21

commit 46efbcb116b70f417c9e4241e4480688169b1813 Author: George Kadianakis <desnacked(a)riseup.net> Date: Fri Jan 29 18:21:30 2021 +0200 test: Add test for exits blocking reentry to the network Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/test/test_address_set.c | 80 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) diff --git a/src/test/test_address_set.c b/src/test/test_address_set.c index 3fee322c47..55a0b106d2 100644 --- a/src/test/test_address_set.c +++ b/src/test/test_address_set.c @@ -181,11 +181,91 @@ test_nodelist(void *arg) UNMOCK(dirlist_add_trusted_dir_addresses); } +/** Test that the no-reentry exit filter works as intended */ +static void +test_exit_no_reentry(void *arg) +{ + routerstatus_t *rs = NULL; microdesc_t *md = NULL; routerinfo_t *ri = NULL; + (void) arg; + + MOCK(networkstatus_get_latest_consensus, + mock_networkstatus_get_latest_consensus); + MOCK(networkstatus_get_latest_consensus_by_flavor, + mock_networkstatus_get_latest_consensus_by_flavor); + MOCK(get_estimated_address_per_node, + mock_get_estimated_address_per_node); + MOCK(dirlist_add_trusted_dir_addresses, + mock_dirlist_add_trusted_dir_addresses); + + dummy_ns = tor_malloc_zero(sizeof(*dummy_ns)); + dummy_ns->flavor = FLAV_MICRODESC; + dummy_ns->routerstatus_list = smartlist_new(); + + tor_addr_t addr_v4, addr_v6, dummy_addr; + tor_addr_parse(&addr_v4, "42.42.42.42"); + tor_addr_parse(&addr_v6, "1:2:3:4::"); + memset(&dummy_addr, 'A', sizeof(dummy_addr)); + + /* This will make the nodelist bloom filter very large + * (the_nodelist->node_addrs) so we will fail the contain test rarely. */ + addr_per_node = 1024; + + /* After this point the nodelist is populated with the directory authorities + * address and ports */ + nodelist_set_consensus(dummy_ns); + + /* The address set is empty. Try it anyway */ + tt_assert(!nodelist_reentry_probably_contains(&addr_v4, 244)); + tt_assert(!nodelist_reentry_probably_contains(&addr_v6, 244)); + + /* Now let's populate the network */ + md = tor_malloc_zero(sizeof(*md)); + ri = tor_malloc_zero(sizeof(*ri)); + rs = tor_malloc_zero(sizeof(*rs)); + crypto_rand(rs->identity_digest, sizeof(rs->identity_digest)); + crypto_rand(md->digest, sizeof(md->digest)); + memcpy(rs->descriptor_digest, md->digest, DIGEST256_LEN); + + /* Setup the rs, ri and md addresses. */ + tor_addr_copy(&rs->ipv4_addr, &addr_v4); + rs->ipv4_orport = 444; + tor_addr_parse(&rs->ipv6_addr, "1:2:3:4::"); + rs->ipv6_orport = 666; + tor_addr_copy(&ri->ipv4_addr, &addr_v4); + tor_addr_parse(&ri->ipv6_addr, "1:2:3:4::"); + tor_addr_parse(&md->ipv6_addr, "1:2:3:4::"); + + /* Add the rs to the consensus becoming a node_t. */ + smartlist_add(dummy_ns->routerstatus_list, rs); + nodelist_set_consensus(dummy_ns); + + /* Now that the nodelist is populated let's do some retry attempts */ + + /* First let's try an address that is on the no-reentry list, but with a + different port */ + tt_assert(!nodelist_reentry_probably_contains(&addr_v4, 666)); + tt_assert(!nodelist_reentry_probably_contains(&addr_v6, 444)); + + /* OK now let's try with the right address and right port */ + tt_assert(nodelist_reentry_probably_contains(&addr_v4, 444)); + tt_assert(nodelist_reentry_probably_contains(&addr_v6, 666)); + + done: + routerstatus_free(rs); routerinfo_free(ri); microdesc_free(md); + smartlist_clear(dummy_ns->routerstatus_list); + networkstatus_vote_free(dummy_ns); + UNMOCK(networkstatus_get_latest_consensus); + UNMOCK(networkstatus_get_latest_consensus_by_flavor); + UNMOCK(get_estimated_address_per_node); + UNMOCK(dirlist_add_trusted_dir_addresses); +} + struct testcase_t address_set_tests[] = { { "contains", test_contains, TT_FORK, NULL, NULL }, { "nodelist", test_nodelist, TT_FORK, NULL, NULL }, + { "exit_no_reentry", test_exit_no_reentry, TT_FORK, NULL, NULL }, END_OF_TESTCASES };

1 0

[tor/master] exit: Deny re-entry into the network
by dgoulet＠torproject.org 29 Jan '21

29 Jan '21

1 0

[tor/master] relay: Add bloomfiter of relay address + {OR|Dir}Port
by dgoulet＠torproject.org 29 Jan '21

29 Jan '21

1 0

[tor/master] Merge branch 'maint-0.4.5'
by dgoulet＠torproject.org 29 Jan '21

29 Jan '21

commit ec9575944ac780d67bd36c0e6e64ddcebcdadeb3 Merge: e50469299b 46efbcb116 Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Jan 29 14:40:56 2021 -0500 Merge branch 'maint-0.4.5' changes/ticket2667 | 4 +++ src/core/or/address_set.c | 74 ++++++++++++++++++++++++++++++++++++++ src/core/or/address_set.h | 18 +++++++++- src/core/or/connection_edge.c | 24 +++++++++++++ src/feature/nodelist/dirlist.c | 9 +++-- src/feature/nodelist/nodelist.c | 64 +++++++++++++++++++++++++++------ src/feature/nodelist/nodelist.h | 5 ++- src/test/test_address_set.c | 80 +++++++++++++++++++++++++++++++++++++++++ 8 files changed, 262 insertions(+), 16 deletions(-)

1 0

[tor/release-0.4.5] exit: Deny re-entry into the network
by dgoulet＠torproject.org 29 Jan '21

29 Jan '21

1 0

[tor/master] test: Add test for exits blocking reentry to the network
by dgoulet＠torproject.org 29 Jan '21

29 Jan '21

1 0

← Newer
1
...
6
7
8
9
10
11
12
...
225
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits January 2021