October 2021 - tor-commits - lists.torproject.org

[tor/release-0.4.6] test: Don't run HSv2 Chutney test networks
by dgoulet＠torproject.org 19 Oct '21

19 Oct '21

commit f9750249ac5e851792c170af0869a8c3cf4c9def Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Sep 30 11:12:46 2021 -0400 test: Don't run HSv2 Chutney test networks Part of #40476 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/test/include.am | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/src/test/include.am b/src/test/include.am index 75861fb9ef..c13c5f2c2d 100644 --- a/src/test/include.am +++ b/src/test/include.am @@ -51,15 +51,12 @@ TESTS += src/test/test-slow src/test/test-memwipe \ $(TESTSCRIPTS) # These flavors are run using automake's test-driver and test-network.sh -TEST_CHUTNEY_FLAVORS = basic-min bridges-min hs-v2-min hs-v3-min \ - single-onion-v23 +TEST_CHUTNEY_FLAVORS = basic-min bridges-min hs-v3-min single-onion-v3 # only run if we can ping6 ::1 (localhost) -# IPv6-only v3 single onion services don't work yet, so we don't test the -# single-onion-v23-ipv6-md flavor -TEST_CHUTNEY_FLAVORS_IPV6 = bridges+ipv6-min ipv6-exit-min hs-v23-ipv6-md \ - single-onion-ipv6-md +# IPv6-only v3 single onion services don't work yet. +TEST_CHUTNEY_FLAVORS_IPV6 = bridges+ipv6-min ipv6-exit-min hs-v3-ipv6 # only run if we can find a stable (or simply another) version of tor -TEST_CHUTNEY_FLAVORS_MIXED = mixed+hs-v2 +TEST_CHUTNEY_FLAVORS_MIXED = mixed+hs-v3 ### This is a lovely feature, but it requires automake >= 1.12, and Tor ### doesn't require that yet.

1 0

[tor/release-0.4.6] Merge branch 'maint-0.4.5' into maint-0.4.6
by dgoulet＠torproject.org 19 Oct '21

19 Oct '21

commit 326f954f10dc99fbebb10bb6962a44a3eeff424c Merge: f748a497c7 d949a2f924 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Oct 19 10:35:35 2021 -0400 Merge branch 'maint-0.4.5' into maint-0.4.6

1 0

[tor/maint-0.4.5] changes: Add file for ticket 40476
by dgoulet＠torproject.org 19 Oct '21

19 Oct '21

commit 18b5630a7c263711ff1f568e0347f1c66b31cda3 Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Sep 30 11:21:13 2021 -0400 changes: Add file for ticket 40476 Closes #40476 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket40476 | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/changes/ticket40476 b/changes/ticket40476 new file mode 100644 index 0000000000..062e36f9bc --- /dev/null +++ b/changes/ticket40476 @@ -0,0 +1,8 @@ + o Major feature (onion service v2): + - Tor does NOT allow anymore to create v2 services, to connect as a client + to a v2 service and for a relay to be a v2 HSDir or introduction point. + This effectively disable onion service version 2 tor wide. Closes 40476. + - The control port command HSFETCH and HSPOST don't allow version 2 as well. + It is also not possible to create a v2 service with ADD_ONION. + - See https://blog.torproject.org/v2-deprecation-timeline for details on + how to transition from v2 to v3.

1 0

[tor/maint-0.4.5] Merge branch 'maint-0.3.5' into maint-0.4.5
by dgoulet＠torproject.org 19 Oct '21

19 Oct '21

commit d949a2f924bfabd4aacf48e884d99cd6a8db61ef Merge: d0053fdfb5 44e105c27f Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Oct 19 10:29:15 2021 -0400 Merge branch 'maint-0.3.5' into maint-0.4.5

1 0

[tor/maint-0.4.5] hs: Improve warning for bad service version
by dgoulet＠torproject.org 19 Oct '21

19 Oct '21

commit 44e105c27f9ff7ce1fb62b09bac30679382c8d67 Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Oct 14 09:56:10 2021 -0400 hs: Improve warning for bad service version Now that we don't have version 2, it gives us: [warn] HiddenServiceVersion must be between 3 and 3, not 2. This commit changes it to: [warn] HiddenServiceVersion must be 3, not 2. Part of #40476 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/hs/hs_config.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/feature/hs/hs_config.c b/src/feature/hs/hs_config.c index ee4499ef5b..79fadf4c0d 100644 --- a/src/feature/hs/hs_config.c +++ b/src/feature/hs/hs_config.c @@ -135,9 +135,13 @@ helper_parse_uint64(const char *opt, const char *value, uint64_t min, *ok = 0; ret = tor_parse_uint64(value, 10, min, max, ok, NULL); if (!*ok) { - log_warn(LD_CONFIG, "%s must be between %" PRIu64 " and %"PRIu64 - ", not %s.", - opt, min, max, value); + if (min == max) { + log_warn(LD_CONFIG, "%s must be %" PRIu64 ", not %s.", opt, max, value); + } else { + log_warn(LD_CONFIG, "%s must be between %" PRIu64 " and %"PRIu64 + ", not %s.", + opt, min, max, value); + } goto err; } log_info(LD_CONFIG, "%s was parsed to %" PRIu64, opt, ret);

1 0

[tor/maint-0.4.6] hs-v2: Disable SOCKS connection for v2 addresses
by dgoulet＠torproject.org 19 Oct '21

19 Oct '21

commit 13b2b1108f2640e68dc7af95f5c7278984de743c Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Sep 30 10:26:37 2021 -0400 hs-v2: Disable SOCKS connection for v2 addresses This effectively turns off the ability of tor to use HSv2 as a client by invalidating the v2 onion hostname passed through a SOCKS request. Part of #40476 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/core/or/connection_edge.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index 84b80313ce..ae9177a2d0 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -4348,9 +4348,6 @@ parse_extended_hostname(char *address) if (q != address) { memmove(address, q, strlen(q) + 1 /* also get \0 */); } - if (rend_valid_v2_service_id(query)) { - return ONION_V2_HOSTNAME; /* success */ - } if (hs_address_is_valid(query)) { return ONION_V3_HOSTNAME; }

1 0

[tor/maint-0.4.6] hs-v2: Disable version 2 service
by dgoulet＠torproject.org 19 Oct '21

19 Oct '21

commit 765bdb9c3331a0fdbf15406db82fa4a29d6651b4 Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Sep 30 10:32:05 2021 -0400 hs-v2: Disable version 2 service The minimum service version is raised from 2 to 3 which effectively disable loading or creating an onion service v2. As for ADD_ONION, for version 2, a 551 error is returned: "551 Failed to add Onion Service" Part of #40476 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/control/control.c | 8 +++++--- src/feature/hs/hs_common.h | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/src/feature/control/control.c b/src/feature/control/control.c index 26ac12d307..8185218a9f 100644 --- a/src/feature/control/control.c +++ b/src/feature/control/control.c @@ -4653,11 +4653,13 @@ add_onion_helper_add_service(int hs_version, tor_assert(port_cfgs); tor_assert(address_out); + /* Version 2 is disabled. */ + (void) auth_type; + (void) auth_clients; + switch (hs_version) { case HS_VERSION_TWO: - ret = rend_service_add_ephemeral(pk->v2, port_cfgs, max_streams, - max_streams_close_circuit, auth_type, - auth_clients, address_out); + ret = RSAE_INTERNAL; break; case HS_VERSION_THREE: ret = hs_service_add_ephemeral(pk->v3, port_cfgs, max_streams, diff --git a/src/feature/hs/hs_common.h b/src/feature/hs/hs_common.h index a44505930a..94cdf5abc4 100644 --- a/src/feature/hs/hs_common.h +++ b/src/feature/hs/hs_common.h @@ -25,7 +25,7 @@ struct ed25519_keypair_t; /* Version 3 of the protocol (prop224). */ #define HS_VERSION_THREE 3 /* Earliest and latest version we support. */ -#define HS_VERSION_MIN HS_VERSION_TWO +#define HS_VERSION_MIN HS_VERSION_THREE #define HS_VERSION_MAX HS_VERSION_THREE /** Try to maintain this many intro points per service by default. */

1 0

[tor/maint-0.4.6] hs-v2: Disable version 2 introduction point
by dgoulet＠torproject.org 19 Oct '21

19 Oct '21

commit ff3ac02702df8b32ef4c1ddb60816ac30400a617 Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Sep 30 10:40:19 2021 -0400 hs-v2: Disable version 2 introduction point Upon receiving a v2 introduction request, the relay will close the circuit and send back a tor protocol error. Part of #40476 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/hs/hs_intropoint.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/feature/hs/hs_intropoint.c b/src/feature/hs/hs_intropoint.c index 7717ed53d4..9c886228c5 100644 --- a/src/feature/hs/hs_intropoint.c +++ b/src/feature/hs/hs_intropoint.c @@ -320,7 +320,8 @@ hs_intro_received_establish_intro(or_circuit_t *circ, const uint8_t *request, switch (first_byte) { case TRUNNEL_HS_INTRO_AUTH_KEY_TYPE_LEGACY0: case TRUNNEL_HS_INTRO_AUTH_KEY_TYPE_LEGACY1: - return rend_mid_establish_intro_legacy(circ, request, request_len); + /* Don't accept version 2 introduction anymore. */ + goto err; case TRUNNEL_HS_INTRO_AUTH_KEY_TYPE_ED25519: return handle_establish_intro(circ, request, request_len); default:

1 0

[tor/maint-0.4.6] hs-v2: Disable version 2 service
by dgoulet＠torproject.org 19 Oct '21

19 Oct '21

commit 471149b651cd3ef953cd0961b871c7a519313f37 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Oct 19 09:11:12 2021 -0400 hs-v2: Disable version 2 service The minimum service version is raised from 2 to 3 which effectively disable loading or creating an onion service v2. As for ADD_ONION, for version 2, a 551 error is returned: "551 Failed to add Onion Service" Part of #40476 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/control/control_cmd.c | 8 +++++--- src/feature/hs/hs_common.h | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/src/feature/control/control_cmd.c b/src/feature/control/control_cmd.c index 0456d709f5..3b23018c9c 100644 --- a/src/feature/control/control_cmd.c +++ b/src/feature/control/control_cmd.c @@ -1662,11 +1662,13 @@ add_onion_helper_add_service(int hs_version, tor_assert(port_cfgs); tor_assert(address_out); + /* Version 2 is disabled. */ + (void) auth_type; + (void) auth_clients; + switch (hs_version) { case HS_VERSION_TWO: - ret = rend_service_add_ephemeral(pk->v2, port_cfgs, max_streams, - max_streams_close_circuit, auth_type, - auth_clients, address_out); + ret = RSAE_INTERNAL; break; case HS_VERSION_THREE: ret = hs_service_add_ephemeral(pk->v3, port_cfgs, max_streams, diff --git a/src/feature/hs/hs_common.h b/src/feature/hs/hs_common.h index 4a9c7a9918..274017180a 100644 --- a/src/feature/hs/hs_common.h +++ b/src/feature/hs/hs_common.h @@ -25,7 +25,7 @@ struct ed25519_keypair_t; /** Version 3 of the protocol (prop224). */ #define HS_VERSION_THREE 3 /** Earliest version we support. */ -#define HS_VERSION_MIN HS_VERSION_TWO +#define HS_VERSION_MIN HS_VERSION_THREE /** Latest version we support. */ #define HS_VERSION_MAX HS_VERSION_THREE

1 0

[tor/maint-0.4.6] hs-v2: Disable SOCKS connection for v2 addresses
by dgoulet＠torproject.org 19 Oct '21

19 Oct '21

commit ed4d6a00300dec1dcac7cf294bebfe736e1d97a4 Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Sep 30 10:26:37 2021 -0400 hs-v2: Disable SOCKS connection for v2 addresses This effectively turns off the ability of tor to use HSv2 as a client by invalidating the v2 onion hostname passed through a SOCKS request. Part of #40476 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/core/or/connection_edge.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index 82e8ead5e0..d9067d5c29 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -1636,12 +1636,12 @@ consider_plaintext_ports(entry_connection_t *conn, uint16_t port) * The possible recognized forms are (where true is returned): * * If address is of the form "y.onion" with a well-formed handle y: - * Put a NUL after y, lower-case it, and return ONION_V2_HOSTNAME or - * ONION_V3_HOSTNAME depending on the HS version. + * Put a NUL after y, lower-case it, and return ONION_V3_HOSTNAME + * depending on the HS version. * * If address is of the form "x.y.onion" with a well-formed handle x: * Drop "x.", put a NUL after y, lower-case it, and return - * ONION_V2_HOSTNAME or ONION_V3_HOSTNAME depending on the HS version. + * ONION_V3_HOSTNAME depending on the HS version. * * If address is of the form "y.onion" with a badly-formed handle y: * Return BAD_HOSTNAME and log a message. @@ -1691,14 +1691,6 @@ parse_extended_hostname(char *address, hostname_type_t *type_out) if (q != address) { memmove(address, q, strlen(q) + 1 /* also get \0 */); } - /* v2 onion address check. */ - if (strlen(query) == REND_SERVICE_ID_LEN_BASE32) { - *type_out = ONION_V2_HOSTNAME; - if (rend_valid_v2_service_id(query)) { - goto success; - } - goto failed; - } /* v3 onion address check. */ if (strlen(query) == HS_SERVICE_ADDR_LEN_BASE32) { @@ -1718,8 +1710,7 @@ parse_extended_hostname(char *address, hostname_type_t *type_out) failed: /* otherwise, return to previous state and return 0 */ *s = '.'; - const bool is_onion = (*type_out == ONION_V2_HOSTNAME) || - (*type_out == ONION_V3_HOSTNAME); + const bool is_onion = (*type_out == ONION_V3_HOSTNAME); log_warn(LD_APP, "Invalid %shostname %s; rejecting", is_onion ? "onion " : "", safe_str_client(address));

1 0