February 2021 - tor-commits - lists.torproject.org

[tor/maint-0.4.5] relay: Follow consensus parameter for network reentry
by dgoulet＠torproject.org 01 Feb '21

01 Feb '21

commit 2c3c30e58fb0a4b291143a60c85b541de560ddd5 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Feb 1 08:56:27 2021 -0500 relay: Follow consensus parameter for network reentry Obey the "allow-network-reentry" consensus parameters in order to decide to allow it or not at the Exit. Closes #40268 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/core/or/connection_edge.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index 55e7841cc3..da5431c47e 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -4231,6 +4231,15 @@ my_exit_policy_rejects(const tor_addr_t *addr, return 0; } +/** Return true iff the consensus allows network reentry. The default value is + * false if the parameter is not found. */ +static bool +network_reentry_is_allowed(void) +{ + /* Default is false, re-entry is not allowed. */ + return !!networkstatus_get_param(NULL, "allow-network-reentry", 0, 0, 1); +} + /** Connect to conn's specified addr and port. If it worked, conn * has now been added to the connection_array. * @@ -4268,6 +4277,8 @@ connection_exit_connect(edge_connection_t *edge_conn) * infinite-length circuits (see "A Practical Congestion Attack on Tor Using * Long Paths", Usenix Security 2009). See also ticket 2667. * + * Skip this if the network reentry is allowed (known from the consensus). + * * The TORPROTOCOL reason is used instead of EXITPOLICY so client do NOT * attempt to retry connecting onto another circuit that will also fail * bringing considerable more load on the network if so. @@ -4278,6 +4289,7 @@ connection_exit_connect(edge_connection_t *edge_conn) * reason that makes the client retry results in much worst consequences in * case of an attack so this is a small price to pay. */ if (!connection_edge_is_rendezvous_stream(edge_conn) && + !network_reentry_is_allowed() && nodelist_reentry_probably_contains(&conn->addr, conn->port)) { log_info(LD_EXIT, "%s tried to connect back to a known relay address. " "Closing.", connection_describe(conn));

1 0

[tor/maint-0.4.5] relay: Double the size of the relay reentry set
by dgoulet＠torproject.org 01 Feb '21

01 Feb '21

commit 838e07be9dc88d41da39a1b4b6b445f67309b108 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Feb 1 09:04:50 2021 -0500 relay: Double the size of the relay reentry set This is to minimize false positive and thus deny reentry to Exit connections that were in reality not re-entering. Helps with overall UX. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/nodelist/nodelist.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/feature/nodelist/nodelist.c b/src/feature/nodelist/nodelist.c index 0c9bdb3c0e..6a6f277849 100644 --- a/src/feature/nodelist/nodelist.c +++ b/src/feature/nodelist/nodelist.c @@ -670,8 +670,12 @@ nodelist_set_consensus(const networkstatus_t *ns) address_set_free(the_nodelist->node_addrs); addr_port_set_free(the_nodelist->reentry_set); the_nodelist->node_addrs = address_set_new(estimated_addresses); - /* Times two here is for both the ORPort and DirPort. */ - the_nodelist->reentry_set = addr_port_set_new(estimated_addresses * 2); + /* Times two here is for both the ORPort and DirPort. We double it again in + * order to minimize as much as possible the false positive when looking up + * this set. Reason is that Exit streams that are legitimate but end up a + * false positive against this set will thus be considered reentry and be + * rejected which means a bad UX. */ + the_nodelist->reentry_set = addr_port_set_new(estimated_addresses * 2 * 2); SMARTLIST_FOREACH_BEGIN(ns->routerstatus_list, routerstatus_t *, rs) { node_t *node = node_get_or_create(rs->identity_digest);

1 0

[tor/master] relay: Double the size of the relay reentry set
by dgoulet＠torproject.org 01 Feb '21

01 Feb '21

commit 838e07be9dc88d41da39a1b4b6b445f67309b108 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Feb 1 09:04:50 2021 -0500 relay: Double the size of the relay reentry set This is to minimize false positive and thus deny reentry to Exit connections that were in reality not re-entering. Helps with overall UX. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/nodelist/nodelist.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/feature/nodelist/nodelist.c b/src/feature/nodelist/nodelist.c index 0c9bdb3c0e..6a6f277849 100644 --- a/src/feature/nodelist/nodelist.c +++ b/src/feature/nodelist/nodelist.c @@ -670,8 +670,12 @@ nodelist_set_consensus(const networkstatus_t *ns) address_set_free(the_nodelist->node_addrs); addr_port_set_free(the_nodelist->reentry_set); the_nodelist->node_addrs = address_set_new(estimated_addresses); - /* Times two here is for both the ORPort and DirPort. */ - the_nodelist->reentry_set = addr_port_set_new(estimated_addresses * 2); + /* Times two here is for both the ORPort and DirPort. We double it again in + * order to minimize as much as possible the false positive when looking up + * this set. Reason is that Exit streams that are legitimate but end up a + * false positive against this set will thus be considered reentry and be + * rejected which means a bad UX. */ + the_nodelist->reentry_set = addr_port_set_new(estimated_addresses * 2 * 2); SMARTLIST_FOREACH_BEGIN(ns->routerstatus_list, routerstatus_t *, rs) { node_t *node = node_get_or_create(rs->identity_digest);

1 0

[tor/master] relay: Follow consensus parameter for network reentry
by dgoulet＠torproject.org 01 Feb '21

01 Feb '21

commit 2c3c30e58fb0a4b291143a60c85b541de560ddd5 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Feb 1 08:56:27 2021 -0500 relay: Follow consensus parameter for network reentry Obey the "allow-network-reentry" consensus parameters in order to decide to allow it or not at the Exit. Closes #40268 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/core/or/connection_edge.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index 55e7841cc3..da5431c47e 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -4231,6 +4231,15 @@ my_exit_policy_rejects(const tor_addr_t *addr, return 0; } +/** Return true iff the consensus allows network reentry. The default value is + * false if the parameter is not found. */ +static bool +network_reentry_is_allowed(void) +{ + /* Default is false, re-entry is not allowed. */ + return !!networkstatus_get_param(NULL, "allow-network-reentry", 0, 0, 1); +} + /** Connect to conn's specified addr and port. If it worked, conn * has now been added to the connection_array. * @@ -4268,6 +4277,8 @@ connection_exit_connect(edge_connection_t *edge_conn) * infinite-length circuits (see "A Practical Congestion Attack on Tor Using * Long Paths", Usenix Security 2009). See also ticket 2667. * + * Skip this if the network reentry is allowed (known from the consensus). + * * The TORPROTOCOL reason is used instead of EXITPOLICY so client do NOT * attempt to retry connecting onto another circuit that will also fail * bringing considerable more load on the network if so. @@ -4278,6 +4289,7 @@ connection_exit_connect(edge_connection_t *edge_conn) * reason that makes the client retry results in much worst consequences in * case of an attack so this is a small price to pay. */ if (!connection_edge_is_rendezvous_stream(edge_conn) && + !network_reentry_is_allowed() && nodelist_reentry_probably_contains(&conn->addr, conn->port)) { log_info(LD_EXIT, "%s tried to connect back to a known relay address. " "Closing.", connection_describe(conn));

1 0

[tor/master] Merge branch 'maint-0.4.5'
by dgoulet＠torproject.org 01 Feb '21

01 Feb '21

commit 385fda038fdf53694926729d4b6f078a4b259410 Merge: 1eec42dee4 838e07be9d Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Feb 1 09:24:38 2021 -0500 Merge branch 'maint-0.4.5' src/core/or/connection_edge.c | 12 ++++++++++++ src/feature/nodelist/nodelist.c | 8 ++++++-- 2 files changed, 18 insertions(+), 2 deletions(-)

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 01 Feb '21

01 Feb '21

commit 0e7c82f7ba3cde730abaf7b451a0946f95d0a6f8 Merge: 9cfbb45487 838e07be9d Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Feb 1 09:24:38 2021 -0500 Merge branch 'maint-0.4.5' into release-0.4.5 src/core/or/connection_edge.c | 12 ++++++++++++ src/feature/nodelist/nodelist.c | 8 ++++++-- 2 files changed, 18 insertions(+), 2 deletions(-)

1 0

[tor/release-0.4.5] relay: Follow consensus parameter for network reentry
by dgoulet＠torproject.org 01 Feb '21

01 Feb '21

commit 2c3c30e58fb0a4b291143a60c85b541de560ddd5 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Feb 1 08:56:27 2021 -0500 relay: Follow consensus parameter for network reentry Obey the "allow-network-reentry" consensus parameters in order to decide to allow it or not at the Exit. Closes #40268 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/core/or/connection_edge.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index 55e7841cc3..da5431c47e 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -4231,6 +4231,15 @@ my_exit_policy_rejects(const tor_addr_t *addr, return 0; } +/** Return true iff the consensus allows network reentry. The default value is + * false if the parameter is not found. */ +static bool +network_reentry_is_allowed(void) +{ + /* Default is false, re-entry is not allowed. */ + return !!networkstatus_get_param(NULL, "allow-network-reentry", 0, 0, 1); +} + /** Connect to conn's specified addr and port. If it worked, conn * has now been added to the connection_array. * @@ -4268,6 +4277,8 @@ connection_exit_connect(edge_connection_t *edge_conn) * infinite-length circuits (see "A Practical Congestion Attack on Tor Using * Long Paths", Usenix Security 2009). See also ticket 2667. * + * Skip this if the network reentry is allowed (known from the consensus). + * * The TORPROTOCOL reason is used instead of EXITPOLICY so client do NOT * attempt to retry connecting onto another circuit that will also fail * bringing considerable more load on the network if so. @@ -4278,6 +4289,7 @@ connection_exit_connect(edge_connection_t *edge_conn) * reason that makes the client retry results in much worst consequences in * case of an attack so this is a small price to pay. */ if (!connection_edge_is_rendezvous_stream(edge_conn) && + !network_reentry_is_allowed() && nodelist_reentry_probably_contains(&conn->addr, conn->port)) { log_info(LD_EXIT, "%s tried to connect back to a known relay address. " "Closing.", connection_describe(conn));

1 0

[tor/release-0.4.5] relay: Double the size of the relay reentry set
by dgoulet＠torproject.org 01 Feb '21

01 Feb '21

commit 838e07be9dc88d41da39a1b4b6b445f67309b108 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Feb 1 09:04:50 2021 -0500 relay: Double the size of the relay reentry set This is to minimize false positive and thus deny reentry to Exit connections that were in reality not re-entering. Helps with overall UX. Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/nodelist/nodelist.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/feature/nodelist/nodelist.c b/src/feature/nodelist/nodelist.c index 0c9bdb3c0e..6a6f277849 100644 --- a/src/feature/nodelist/nodelist.c +++ b/src/feature/nodelist/nodelist.c @@ -670,8 +670,12 @@ nodelist_set_consensus(const networkstatus_t *ns) address_set_free(the_nodelist->node_addrs); addr_port_set_free(the_nodelist->reentry_set); the_nodelist->node_addrs = address_set_new(estimated_addresses); - /* Times two here is for both the ORPort and DirPort. */ - the_nodelist->reentry_set = addr_port_set_new(estimated_addresses * 2); + /* Times two here is for both the ORPort and DirPort. We double it again in + * order to minimize as much as possible the false positive when looking up + * this set. Reason is that Exit streams that are legitimate but end up a + * false positive against this set will thus be considered reentry and be + * rejected which means a bad UX. */ + the_nodelist->reentry_set = addr_port_set_new(estimated_addresses * 2 * 2); SMARTLIST_FOREACH_BEGIN(ns->routerstatus_list, routerstatus_t *, rs) { node_t *node = node_get_or_create(rs->identity_digest);

1 0

[torspec/master] Add network reentry consensus parameter
by dgoulet＠torproject.org 01 Feb '21

01 Feb '21

commit d7e6d92c230b77d3bd4f2ec64186dc2e7cd77d9a Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Feb 1 08:54:18 2021 -0500 Add network reentry consensus parameter Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- param-spec.txt | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/param-spec.txt b/param-spec.txt index 7643a9b..4da8ee1 100644 --- a/param-spec.txt +++ b/param-spec.txt @@ -48,6 +48,13 @@ line of a directory consensus. Min: 0. Max: 255. Default 0. First appeared: 0.4.1.1-alpha. + "allow-network-reentry" -- If true, the Exit relays allow connections that + are exiting the network to re-enter. If false, any exit connections going + to a relay ORPort or an authority ORPort and DirPort is denied and the + stream is terminated. + Min: 0. Max: 1. Default: 0 + First appeared: 0.4.5.1-alpha. + 2. Performance-tuning parameters "CircuitPriorityHalflifeMsec" -- the halflife parameter used when

1 0

[translation/tpo-web] https://gitweb.torproject.org/translation.git/commit/?h=tpo-web
by translation＠torproject.org 01 Feb '21

01 Feb '21

commit 9b85683276aec49a29b2c887d799e1a9869b601c Author: Translation commit bot <translation(a)torproject.org> Date: Mon Feb 1 14:19:39 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tpo-web --- contents+hy.po | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/contents+hy.po b/contents+hy.po index a480915558..afb605a540 100644 --- a/contents+hy.po +++ b/contents+hy.po @@ -29,7 +29,7 @@ msgstr "" #: https//www.torproject.org/ (content/contents+en.lrpage.body) msgid "###### ABOUT US ######" -msgstr "" +msgstr "###### ՄԵՐ ՄԱՍԻՆ ######" #: https//www.torproject.org/ (content/contents+en.lrpage.body) msgid "" @@ -56,7 +56,7 @@ msgstr "Կապ" #: https//www.torproject.org/thank-you/ #: (content/thank-you/contents+en.lrpage.section) msgid "The Tor Project" -msgstr "" +msgstr "Tor Project-ը" #: https//www.torproject.org/contact/ #: (content/contact/contents+en.lrpage.body) @@ -81,7 +81,7 @@ msgstr "" #: https//www.torproject.org/download/tor/ #: (content/download/tor/contents+en.lrpage.section) msgid "Download" -msgstr "" +msgstr "Ներբեռնել" #: https//www.torproject.org/menu/ (content/menu/contents+en.lrpage.title) msgid "Sponsors" @@ -104,7 +104,7 @@ msgstr "" #: https//www.torproject.org/about/jobs/ #: (content/about/jobs/contents+en.lrjobs.section) msgid "About" -msgstr "" +msgstr "Մեր մասին" #: https//www.torproject.org/menu/ (content/menu/contents+en.lrpage.body) msgid "Documentation" @@ -116,11 +116,11 @@ msgstr "" #: https//www.torproject.org/menu/ (content/menu/contents+en.lrpage.body) msgid "Support" -msgstr "" +msgstr "Աջակցություն" #: https//www.torproject.org/menu/ (content/menu/contents+en.lrpage.body) msgid "Jobs" -msgstr "" +msgstr "Աշխատանք" #: https//www.torproject.org/menu/ (content/menu/contents+en.lrpage.body) msgid "Blog" @@ -140,7 +140,7 @@ msgstr "" #: https//www.torproject.org/menu/ (content/menu/contents+en.lrpage.body) msgid "Community" -msgstr "" +msgstr "Համայնք" #: https//www.torproject.org/thank-you/ #: (content/thank-you/contents+en.lrpage.title) @@ -201,7 +201,7 @@ msgstr "" #: https//www.torproject.org/download/languages/ #: (content/download/languages/contents+en.lrpage.title) msgid "Download Tor Browser in your language" -msgstr "" +msgstr "Ներբեռնեք Tor դիտարկիչը Ձեր լեզվով" #: https//www.torproject.org/download/languages/ #: (content/download/languages/contents+en.lrpage.body) @@ -743,7 +743,7 @@ msgstr "" #: lego/templates/secure-connections.html:51 msgid "data" -msgstr "" +msgstr "տվյալներ" #: lego/templates/secure-connections.html:54 msgid "Data being transmitted." @@ -751,7 +751,7 @@ msgstr "" #: lego/templates/secure-connections.html:58 msgid "location" -msgstr "" +msgstr "տեղագրություն" #: lego/templates/secure-connections.html:61 msgid ""

1 0