February 2021 - tor-commits - lists.torproject.org

[tor/release-0.4.4] Merge branch 'maint-0.4.4' into release-0.4.4
by dgoulet＠torproject.org 03 Feb '21

03 Feb '21

commit 3e618aae1a81bd1e5e6a49bc508c48dd38d9ef18 Merge: 509a14178a b2434d30d2 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Feb 3 08:44:19 2021 -0500 Merge branch 'maint-0.4.4' into release-0.4.4 changes/ticket2667 | 4 ++ src/core/or/address_set.c | 74 +++++++++++++++++++++++++++++++++++ src/core/or/address_set.h | 18 ++++++++- src/core/or/connection_edge.c | 25 ++++++++++++ src/feature/nodelist/dirlist.c | 11 ++++-- src/feature/nodelist/nodelist.c | 87 +++++++++++++++++++++++++++++------------ src/feature/nodelist/nodelist.h | 6 ++- src/test/test_address_set.c | 80 +++++++++++++++++++++++++++++++++++++ 8 files changed, 274 insertions(+), 31 deletions(-)

1 0

[tor/release-0.4.4] relay: Double the size of the relay reentry set
by dgoulet＠torproject.org 03 Feb '21

03 Feb '21

commit 98590621bb49cbecd601085f7e03697f8783ff7b Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Feb 1 09:04:50 2021 -0500 relay: Double the size of the relay reentry set This is to minimize false positive and thus deny reentry to Exit connections that were in reality not re-entering. Helps with overall UX. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/nodelist/nodelist.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/feature/nodelist/nodelist.c b/src/feature/nodelist/nodelist.c index 9d553ce1f5..22b93762e7 100644 --- a/src/feature/nodelist/nodelist.c +++ b/src/feature/nodelist/nodelist.c @@ -672,8 +672,12 @@ nodelist_set_consensus(networkstatus_t *ns) address_set_free(the_nodelist->node_addrs); addr_port_set_free(the_nodelist->reentry_set); the_nodelist->node_addrs = address_set_new(estimated_addresses); - /* Times two here is for both the ORPort and DirPort. */ - the_nodelist->reentry_set = addr_port_set_new(estimated_addresses * 2); + /* Times two here is for both the ORPort and DirPort. We double it again in + * order to minimize as much as possible the false positive when looking up + * this set. Reason is that Exit streams that are legitimate but end up a + * false positive against this set will thus be considered reentry and be + * rejected which means a bad UX. */ + the_nodelist->reentry_set = addr_port_set_new(estimated_addresses * 2 * 2); SMARTLIST_FOREACH_BEGIN(ns->routerstatus_list, routerstatus_t *, rs) { node_t *node = node_get_or_create(rs->identity_digest);

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.3' into maint-0.4.4
by dgoulet＠torproject.org 03 Feb '21

03 Feb '21

commit 36b51a1c716200c65f5bb9f233c461208a8d924c Merge: b2434d30d2 0f8195406e Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Feb 3 08:51:37 2021 -0500 Merge branch 'maint-0.4.3' into maint-0.4.4 src/core/or/connection_edge.c | 12 ++++++++++++ src/feature/nodelist/nodelist.c | 8 ++++++-- 2 files changed, 18 insertions(+), 2 deletions(-)

1 0

[tor/release-0.4.5] Merge branch 'ticket40270_035_01' into maint-0.3.5
by dgoulet＠torproject.org 03 Feb '21

03 Feb '21

commit a3cef41fc375b3a004eca3d090be0ebe9801cdb0 Merge: c2cee6c780 59f1a41a7f Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Feb 3 08:56:30 2021 -0500 Merge branch 'ticket40270_035_01' into maint-0.3.5 src/core/or/connection_edge.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[tor/release-0.4.5] relay: Send back CONNECTION_REFUSED on reentry
by dgoulet＠torproject.org 03 Feb '21

03 Feb '21

commit 59f1a41a7fdc03f5008e859e7e56e9c159b8a8d9 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Feb 1 12:45:32 2021 -0500 relay: Send back CONNECTION_REFUSED on reentry The TORPROTOCOL reason causes the client to close the circuit which is not what we want because other valid streams might be on it. Instead, CONNECTION_REFUSED will leave it open but will not allow more streams to be attached to it. The client then open a new circuit to the destination. Closes #40270 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/core/or/connection_edge.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index b40fa3e567..895e73ac1b 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -4066,7 +4066,7 @@ connection_exit_connect(edge_connection_t *edge_conn) log_info(LD_EXIT, "%s:%d tried to connect back to a known relay address. " "Closing.", escaped_safe_str_client(conn->address), conn->port); - connection_edge_end(edge_conn, END_STREAM_REASON_TORPROTOCOL); + connection_edge_end(edge_conn, END_STREAM_REASON_CONNECTREFUSED); circuit_detach_stream(circuit_get_by_edge_conn(edge_conn), edge_conn); connection_free(conn); return;

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 03 Feb '21

03 Feb '21

commit f503f06779e47a0b51a631d8195632e6c2d42986 Merge: 016044b95e a0b3e9116d Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Feb 3 08:58:17 2021 -0500 Merge branch 'maint-0.4.5' into release-0.4.5 src/core/or/address_set.c | 74 ++++++++++++++++++++++++++++++++++++++++++ src/core/or/address_set.h | 15 +++++++++ src/feature/nodelist/dirlist.c | 2 ++ 3 files changed, 91 insertions(+)

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 03 Feb '21

03 Feb '21

commit 39ca32957361fe38399dbf8a71c1ccc1ecf070bf Merge: 6409902e35 44b4aa82aa Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Feb 3 09:35:50 2021 -0500 Merge branch 'maint-0.4.5' into release-0.4.5 src/feature/nodelist/dirlist.c | 2 -- 1 file changed, 2 deletions(-)

1 0

[tor/release-0.4.5] Remove unused addr_port_set code
by dgoulet＠torproject.org 03 Feb '21

03 Feb '21

commit 6f95cdf87ead5c9d47d384be41a2cffed07fc867 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Feb 1 12:28:29 2021 -0500 Remove unused addr_port_set code Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/core/or/address_set.c | 75 ----------------------------------------------- src/core/or/address_set.h | 15 ---------- 2 files changed, 90 deletions(-) diff --git a/src/core/or/address_set.c b/src/core/or/address_set.c index c2daf89dde..7ada4446c4 100644 --- a/src/core/or/address_set.c +++ b/src/core/or/address_set.c @@ -15,7 +15,6 @@ #include "lib/net/address.h" #include "lib/container/bloomfilt.h" #include "lib/crypt_ops/crypto_rand.h" -#include "siphash.h" /* Wrap our hash function to have the signature that the bloom filter * needs. */ @@ -69,77 +68,3 @@ address_set_probably_contains(const address_set_t *set, { return bloomfilt_probably_contains(set, addr); } - -/* Length of the item is an address (IPv4 or IPv6) and a 2 byte port. We use - * 16 bytes for the address here (IPv6) since we do not know which family - * the given address in the item thus in the case of IPv4, the extra bytes - * are simply zeroes to accomodate. */ -#define BLOOMFILT_ADDR_PORT_ITEM_LEN (16 + sizeof(uint16_t)) - -/** Build an item for the bloomfilter consisting of an address and port pair. - * - * If the given address is _not_ AF_INET or AF_INET6, then the item is an - * array of 0s. - * - * Return a pointer to a static buffer containing the item. Next call to this - * function invalidates its previous content. */ -static const uint8_t * -build_addr_port_item(const tor_addr_t *addr, const uint16_t port) -{ - static uint8_t data[BLOOMFILT_ADDR_PORT_ITEM_LEN]; - - memset(data, 0, sizeof(data)); - switch (tor_addr_family(addr)) { - case AF_INET: - memcpy(data, &addr->addr.in_addr.s_addr, 4); - break; - case AF_INET6: - memcpy(data, &addr->addr.in6_addr.s6_addr, 16); - break; - case AF_UNSPEC: - /* Leave the 0. */ - break; - default: - /* LCOV_EXCL_START */ - tor_fragile_assert(); - /* LCOV_EXCL_STOP */ - } - - memcpy(data + 16, &port, sizeof(port)); - return data; -} - -/** Return a hash value for the given item that the bloomfilter will use. */ -static uint64_t -bloomfilt_addr_port_hash(const struct sipkey *key, - const void *item) -{ - return siphash24(item, BLOOMFILT_ADDR_PORT_ITEM_LEN, key); -} - -/** Allocate and return an addr_port_set_t, suitable for holding up to - * max_address_guess distinct values. */ -addr_port_set_t * -addr_port_set_new(int max_addresses_guess) -{ - uint8_t k[BLOOMFILT_KEY_LEN]; - crypto_rand((void*)k, sizeof(k)); - return bloomfilt_new(max_addresses_guess, bloomfilt_addr_port_hash, k); -} - -/** Add an address and port pair to the given set. */ -void -addr_port_set_add(addr_port_set_t *set, const tor_addr_t *addr, uint16_t port) -{ - bloomfilt_add(set, build_addr_port_item(addr, port)); -} - -/** Return true if the given address and port pair are in the set. Of course, - * this is a bloomfilter and thus in rare occasion, a false positive happens - * thus the "probably". */ -bool -addr_port_set_probably_contains(const addr_port_set_t *set, - const tor_addr_t *addr, uint16_t port) -{ - return !!bloomfilt_probably_contains(set, build_addr_port_item(addr, port)); -} diff --git a/src/core/or/address_set.h b/src/core/or/address_set.h index a7b7cb3f78..a505d31628 100644 --- a/src/core/or/address_set.h +++ b/src/core/or/address_set.h @@ -29,19 +29,4 @@ void address_set_add_ipv4h(address_set_t *set, uint32_t addr); int address_set_probably_contains(const address_set_t *set, const struct tor_addr_t *addr); -/** - * An addr_port_set_t represents a set of tor_addr_t values with a uint16_t - * port value. The implementation is probabilistic: false negatives cannot - * occur but false positives are possible. - */ -typedef struct bloomfilt_t addr_port_set_t; - -addr_port_set_t *addr_port_set_new(int max_addresses_guess); -#define addr_port_set_free(s) bloomfilt_free(s) -void addr_port_set_add(addr_port_set_t *set, - const struct tor_addr_t *addr, uint16_t port); -bool addr_port_set_probably_contains(const addr_port_set_t *set, - const struct tor_addr_t *addr, - uint16_t port); - #endif /* !defined(TOR_ADDRESS_SET_H) */

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 03 Feb '21

03 Feb '21

commit 6409902e3523dd9bb78b8dc7dc6540ec6309935d Merge: f503f06779 9e91bb31cc Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Feb 3 09:11:15 2021 -0500 Merge branch 'maint-0.4.5' into release-0.4.5 src/core/or/address_set.c | 74 ----------------------------------------------- src/core/or/address_set.h | 15 ---------- 2 files changed, 89 deletions(-)

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.4' into maint-0.4.5
by dgoulet＠torproject.org 03 Feb '21

03 Feb '21

commit 9e91bb31ccf7ed8c221eab47332cca6c88cea162 Merge: a0b3e9116d 61e38deb56 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Feb 3 09:11:15 2021 -0500 Merge branch 'maint-0.4.4' into maint-0.4.5 src/core/or/address_set.c | 74 ----------------------------------------------- src/core/or/address_set.h | 15 ---------- 2 files changed, 89 deletions(-)

1 0