tor-commits February 2021

tor-commits@lists.torproject.org

19 participants
1772 discussions

[tor/master] dos: Move config options within the subsystem
by nickm＠torproject.org 08 Feb '21

08 Feb '21

commit a634f6b64c485dc2e4ff326e46340dbff2ad49d5 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Jan 27 10:19:51 2021 -0500 dos: Move config options within the subsystem Closes #40261 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket40261 | 4 ++++ src/app/config/config.c | 13 ------------ src/app/config/or_options_st.h | 29 -------------------------- src/core/or/dos.c | 42 +++++++++++++++++++------------------ src/core/or/dos_config.c | 29 ++++++++++++++++++++++++++ src/core/or/dos_config.h | 16 ++++++++++++++ src/core/or/dos_options.inc | 47 ++++++++++++++++++++++++++++++++++++++++++ src/core/or/dos_options_st.h | 20 ++++++++++++++++++ src/core/or/dos_sys.c | 28 ++++++++++++++++++++++++- src/core/or/dos_sys.h | 3 +++ src/core/or/include.am | 4 ++++ 11 files changed, 172 insertions(+), 63 deletions(-) diff --git a/changes/ticket40261 b/changes/ticket40261 new file mode 100644 index 0000000000..f8d05a25be --- /dev/null +++ b/changes/ticket40261 @@ -0,0 +1,4 @@ + o Code simplification and refactoring (metrics, DoS): + - Move the DoS subsystem into the subsys manager including its configuration + options. Closes ticket 40261. + diff --git a/src/app/config/config.c b/src/app/config/config.c index 2d4155e9bc..9f366f9ee4 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -428,19 +428,6 @@ static const config_var_t option_vars_[] = { V(DormantTimeoutDisabledByIdleStreams, BOOL, "1"), V(DormantOnFirstStartup, BOOL, "0"), V(DormantCanceledByStartup, BOOL, "0"), - /* DoS circuit creation options. */ - V(DoSCircuitCreationEnabled, AUTOBOOL, "auto"), - V(DoSCircuitCreationMinConnections, POSINT, "0"), - V(DoSCircuitCreationRate, POSINT, "0"), - V(DoSCircuitCreationBurst, POSINT, "0"), - V(DoSCircuitCreationDefenseType, INT, "0"), - V(DoSCircuitCreationDefenseTimePeriod, INTERVAL, "0"), - /* DoS connection options. */ - V(DoSConnectionEnabled, AUTOBOOL, "auto"), - V(DoSConnectionMaxConcurrentCount, POSINT, "0"), - V(DoSConnectionDefenseType, INT, "0"), - /* DoS single hop client options. */ - V(DoSRefuseSingleHopClientRendezvous, AUTOBOOL, "auto"), V(DownloadExtraInfo, BOOL, "0"), V(TestingEnableConnBwEvent, BOOL, "0"), V(TestingEnableCellStatsEvent, BOOL, "0"), diff --git a/src/app/config/or_options_st.h b/src/app/config/or_options_st.h index 4364f145ed..714034b28d 100644 --- a/src/app/config/or_options_st.h +++ b/src/app/config/or_options_st.h @@ -1031,35 +1031,6 @@ struct or_options_t { */ int DisableSignalHandlers; - /** Autobool: Is the circuit creation DoS mitigation subsystem enabled? */ - int DoSCircuitCreationEnabled; - /** Minimum concurrent connection needed from one single address before any - * defense is used. */ - int DoSCircuitCreationMinConnections; - /** Circuit rate used to refill the token bucket. */ - int DoSCircuitCreationRate; - /** Maximum allowed burst of circuits. Reaching that value, the address is - * detected as malicious and a defense might be used. */ - int DoSCircuitCreationBurst; - /** When an address is marked as malicious, what defense should be used - * against it. See the dos_cc_defense_type_t enum. */ - int DoSCircuitCreationDefenseType; - /** For how much time (in seconds) the defense is applicable for a malicious - * address. A random time delta is added to the defense time of an address - * which will be between 1 second and half of this value. */ - int DoSCircuitCreationDefenseTimePeriod; - - /** Autobool: Is the DoS connection mitigation subsystem enabled? */ - int DoSConnectionEnabled; - /** Maximum concurrent connection allowed per address. */ - int DoSConnectionMaxConcurrentCount; - /** When an address is reaches the maximum count, what defense should be - * used against it. See the dos_conn_defense_type_t enum. */ - int DoSConnectionDefenseType; - - /** Autobool: Do we refuse single hop client rendezvous? */ - int DoSRefuseSingleHopClientRendezvous; - /** Interval: how long without activity does it take for a client * to become dormant? **/ diff --git a/src/core/or/dos.c b/src/core/or/dos.c index 41bf303ffe..a761082be0 100644 --- a/src/core/or/dos.c +++ b/src/core/or/dos.c @@ -23,7 +23,9 @@ #include "lib/crypt_ops/crypto_rand.h" #include "core/or/dos.h" +#include "core/or/dos_sys.h" +#include "core/or/dos_options_st.h" #include "core/or/or_connection_st.h" /* @@ -77,8 +79,8 @@ static uint64_t num_single_hop_client_refused; MOCK_IMPL(STATIC unsigned int, get_param_cc_enabled, (const networkstatus_t *ns)) { - if (get_options()->DoSCircuitCreationEnabled != -1) { - return get_options()->DoSCircuitCreationEnabled; + if (dos_get_options()->DoSCircuitCreationEnabled != -1) { + return dos_get_options()->DoSCircuitCreationEnabled; } return !!networkstatus_get_param(ns, "DoSCircuitCreationEnabled", @@ -90,8 +92,8 @@ get_param_cc_enabled, (const networkstatus_t *ns)) STATIC uint32_t get_param_cc_min_concurrent_connection(const networkstatus_t *ns) { - if (get_options()->DoSCircuitCreationMinConnections) { - return get_options()->DoSCircuitCreationMinConnections; + if (dos_get_options()->DoSCircuitCreationMinConnections) { + return dos_get_options()->DoSCircuitCreationMinConnections; } return networkstatus_get_param(ns, "DoSCircuitCreationMinConnections", DOS_CC_MIN_CONCURRENT_CONN_DEFAULT, @@ -104,8 +106,8 @@ static uint32_t get_param_cc_circuit_rate(const networkstatus_t *ns) { /* This is in seconds. */ - if (get_options()->DoSCircuitCreationRate) { - return get_options()->DoSCircuitCreationRate; + if (dos_get_options()->DoSCircuitCreationRate) { + return dos_get_options()->DoSCircuitCreationRate; } return networkstatus_get_param(ns, "DoSCircuitCreationRate", DOS_CC_CIRCUIT_RATE_DEFAULT, @@ -117,8 +119,8 @@ get_param_cc_circuit_rate(const networkstatus_t *ns) STATIC uint32_t get_param_cc_circuit_burst(const networkstatus_t *ns) { - if (get_options()->DoSCircuitCreationBurst) { - return get_options()->DoSCircuitCreationBurst; + if (dos_get_options()->DoSCircuitCreationBurst) { + return dos_get_options()->DoSCircuitCreationBurst; } return networkstatus_get_param(ns, "DoSCircuitCreationBurst", DOS_CC_CIRCUIT_BURST_DEFAULT, @@ -129,8 +131,8 @@ get_param_cc_circuit_burst(const networkstatus_t *ns) static uint32_t get_param_cc_defense_type(const networkstatus_t *ns) { - if (get_options()->DoSCircuitCreationDefenseType) { - return get_options()->DoSCircuitCreationDefenseType; + if (dos_get_options()->DoSCircuitCreationDefenseType) { + return dos_get_options()->DoSCircuitCreationDefenseType; } return networkstatus_get_param(ns, "DoSCircuitCreationDefenseType", DOS_CC_DEFENSE_TYPE_DEFAULT, @@ -143,8 +145,8 @@ static int32_t get_param_cc_defense_time_period(const networkstatus_t *ns) { /* Time in seconds. */ - if (get_options()->DoSCircuitCreationDefenseTimePeriod) { - return get_options()->DoSCircuitCreationDefenseTimePeriod; + if (dos_get_options()->DoSCircuitCreationDefenseTimePeriod) { + return dos_get_options()->DoSCircuitCreationDefenseTimePeriod; } return networkstatus_get_param(ns, "DoSCircuitCreationDefenseTimePeriod", DOS_CC_DEFENSE_TIME_PERIOD_DEFAULT, @@ -156,8 +158,8 @@ get_param_cc_defense_time_period(const networkstatus_t *ns) MOCK_IMPL(STATIC unsigned int, get_param_conn_enabled, (const networkstatus_t *ns)) { - if (get_options()->DoSConnectionEnabled != -1) { - return get_options()->DoSConnectionEnabled; + if (dos_get_options()->DoSConnectionEnabled != -1) { + return dos_get_options()->DoSConnectionEnabled; } return !!networkstatus_get_param(ns, "DoSConnectionEnabled", DOS_CONN_ENABLED_DEFAULT, 0, 1); @@ -168,8 +170,8 @@ get_param_conn_enabled, (const networkstatus_t *ns)) STATIC uint32_t get_param_conn_max_concurrent_count(const networkstatus_t *ns) { - if (get_options()->DoSConnectionMaxConcurrentCount) { - return get_options()->DoSConnectionMaxConcurrentCount; + if (dos_get_options()->DoSConnectionMaxConcurrentCount) { + return dos_get_options()->DoSConnectionMaxConcurrentCount; } return networkstatus_get_param(ns, "DoSConnectionMaxConcurrentCount", DOS_CONN_MAX_CONCURRENT_COUNT_DEFAULT, @@ -180,8 +182,8 @@ get_param_conn_max_concurrent_count(const networkstatus_t *ns) static uint32_t get_param_conn_defense_type(const networkstatus_t *ns) { - if (get_options()->DoSConnectionDefenseType) { - return get_options()->DoSConnectionDefenseType; + if (dos_get_options()->DoSConnectionDefenseType) { + return dos_get_options()->DoSConnectionDefenseType; } return networkstatus_get_param(ns, "DoSConnectionDefenseType", DOS_CONN_DEFENSE_TYPE_DEFAULT, @@ -613,8 +615,8 @@ dos_should_refuse_single_hop_client(void) return 0; } - if (get_options()->DoSRefuseSingleHopClientRendezvous != -1) { - return get_options()->DoSRefuseSingleHopClientRendezvous; + if (dos_get_options()->DoSRefuseSingleHopClientRendezvous != -1) { + return dos_get_options()->DoSRefuseSingleHopClientRendezvous; } return (int) networkstatus_get_param(NULL, diff --git a/src/core/or/dos_config.c b/src/core/or/dos_config.c new file mode 100644 index 0000000000..e97c505ea3 --- /dev/null +++ b/src/core/or/dos_config.c @@ -0,0 +1,29 @@ +/* Copyright (c) 2021, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * @file dos_config.c + * @brief Code to interpret the user's configuration of DoS module. + **/ + +#include "core/or/dos_config.h" +#include "core/or/dos_options_st.h" + +/* Declare the options field table for dos_options */ +#define CONF_CONTEXT TABLE +#include "core/or/dos_options.inc" +#undef CONF_CONTEXT + +/** Magic number for dos_options_t. */ +#define DOS_OPTIONS_MAGIC 0x91716151 + +/** + * Declare the configuration options for the dos module. + **/ +const config_format_t dos_options_fmt = { + .size = sizeof(dos_options_t), + .magic = { "dos_options_t", + DOS_OPTIONS_MAGIC, + offsetof(dos_options_t, magic) }, + .vars = dos_options_t_vars, +}; diff --git a/src/core/or/dos_config.h b/src/core/or/dos_config.h new file mode 100644 index 0000000000..de8e135aaa --- /dev/null +++ b/src/core/or/dos_config.h @@ -0,0 +1,16 @@ +/* Copyright (c) 2021, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * @file dos_config.h + * @brief Header for core/or/dos_config.c + **/ + +#ifndef TOR_CORE_OR_DOS_CONFIG_H +#define TOR_CORE_OR_DOS_CONFIG_H + +#include "lib/conf/conftypes.h" + +extern const struct config_format_t dos_options_fmt; + +#endif /* !defined(TOR_CORE_OR_DOS_CONFIG_H) */ diff --git a/src/core/or/dos_options.inc b/src/core/or/dos_options.inc new file mode 100644 index 0000000000..063a739939 --- /dev/null +++ b/src/core/or/dos_options.inc @@ -0,0 +1,47 @@ +/* Copyright (c) 2021, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * @file dos_options.inc + * @brief Declare configuration options for the DoS module. + **/ + +BEGIN_CONF_STRUCT(dos_options_t) + +/** Autobool: Is the DoS connection mitigation subsystem enabled? */ +CONF_VAR(DoSConnectionEnabled, AUTOBOOL, 0, "auto") + +/** Autobool: Is the circuit creation DoS mitigation subsystem enabled? */ +CONF_VAR(DoSCircuitCreationEnabled, AUTOBOOL, 0, "auto") + +/** Minimum concurrent connection needed from one single address before any + * defense is used. */ +CONF_VAR(DoSCircuitCreationMinConnections, POSINT, 0, "0") + +/** Circuit rate used to refill the token bucket. */ +CONF_VAR(DoSCircuitCreationRate, POSINT, 0, "0") + +/** Maximum allowed burst of circuits. Reaching that value, the address is + * detected as malicious and a defense might be used. */ +CONF_VAR(DoSCircuitCreationBurst, POSINT, 0, "0") + +/** When an address is marked as malicious, what defense should be used + * against it. See the dos_cc_defense_type_t enum. */ +CONF_VAR(DoSCircuitCreationDefenseType, INT, 0, "0") + +/** For how much time (in seconds) the defense is applicable for a malicious + * address. A random time delta is added to the defense time of an address + * which will be between 1 second and half of this value. */ +CONF_VAR(DoSCircuitCreationDefenseTimePeriod, INTERVAL, 0, "0") + +/** Maximum concurrent connection allowed per address. */ +CONF_VAR(DoSConnectionMaxConcurrentCount, POSINT, 0, "0") + +/** When an address is reaches the maximum count, what defense should be + * used against it. See the dos_conn_defense_type_t enum. */ +CONF_VAR(DoSConnectionDefenseType, INT, 0, "0") + +/** Autobool: Do we refuse single hop client rendezvous? */ +CONF_VAR(DoSRefuseSingleHopClientRendezvous, AUTOBOOL, 0, "auto") + +END_CONF_STRUCT(dos_options_t) diff --git a/src/core/or/dos_options_st.h b/src/core/or/dos_options_st.h new file mode 100644 index 0000000000..b62bdecc82 --- /dev/null +++ b/src/core/or/dos_options_st.h @@ -0,0 +1,20 @@ +/* Copyright (c) 2021, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * @file dos_options_st.h + * @brief Structure dos_options_t to hold options for the DoS subsystem. + **/ + +#ifndef TOR_CORE_OR_DOS_OPTIONS_ST_H +#define TOR_CORE_OR_DOS_OPTIONS_ST_H + +#include "lib/conf/confdecl.h" + +#define CONF_CONTEXT STRUCT +#include "core/or/dos_options.inc" +#undef CONF_CONTEXT + +typedef struct dos_options_t dos_options_t; + +#endif /* !defined(TOR_CORE_OR_DOS_OPTIONS_ST_H) */ diff --git a/src/core/or/dos_sys.c b/src/core/or/dos_sys.c index b25d45bc14..cc3b5bf9c6 100644 --- a/src/core/or/dos_sys.c +++ b/src/core/or/dos_sys.c @@ -6,11 +6,17 @@ * @brief Subsystem definitions for DOS module. **/ +#include "core/or/or.h" + #include "lib/subsys/subsys.h" -#include "core/or/dos.h" +#include "core/or/dos_config.h" #include "core/or/dos_sys.h" +#include "core/or/dos_options_st.h" + +static const dos_options_t *global_dos_options; + static int subsys_dos_initialize(void) { @@ -20,6 +26,22 @@ subsys_dos_initialize(void) static void subsys_dos_shutdown(void) { + global_dos_options = NULL; +} + +const dos_options_t * +dos_get_options(void) +{ + tor_assert(global_dos_options); + return global_dos_options; +} + +static int +dos_set_options(void *arg) +{ + dos_options_t *opts = arg; + global_dos_options = opts; + return 0; } const struct subsys_fns_t sys_dos = { @@ -31,4 +53,8 @@ const struct subsys_fns_t sys_dos = { .initialize = subsys_dos_initialize, .shutdown = subsys_dos_shutdown, + + /* Configuration Options. */ + .options_format = &dos_options_fmt, + .set_options = dos_set_options, }; diff --git a/src/core/or/dos_sys.h b/src/core/or/dos_sys.h index 2c9824a32a..2212d3c707 100644 --- a/src/core/or/dos_sys.h +++ b/src/core/or/dos_sys.h @@ -9,6 +9,9 @@ #ifndef TOR_CORE_OR_DOS_SYS_H #define TOR_CORE_OR_DOS_SYS_H +struct dos_options_t; +const struct dos_options_t *dos_get_options(void); + extern const struct subsys_fns_t sys_dos; /** diff --git a/src/core/or/include.am b/src/core/or/include.am index 1308497092..b578b75673 100644 --- a/src/core/or/include.am +++ b/src/core/or/include.am @@ -18,6 +18,7 @@ LIBTOR_APP_A_SOURCES += \ src/core/or/connection_edge.c \ src/core/or/connection_or.c \ src/core/or/dos.c \ + src/core/or/dos_config.c \ src/core/or/dos_sys.c \ src/core/or/extendinfo.c \ src/core/or/onion.c \ @@ -65,6 +66,9 @@ noinst_HEADERS += \ src/core/or/crypt_path_st.h \ src/core/or/destroy_cell_queue_st.h \ src/core/or/dos.h \ + src/core/or/dos_config.h \ + src/core/or/dos_options.inc \ + src/core/or/dos_options_st.h \ src/core/or/dos_sys.h \ src/core/or/edge_connection_st.h \ src/core/or/extendinfo.h \

1 0

[tor/master] dos: Add DoS subsystem to manager list
by nickm＠torproject.org 08 Feb '21

08 Feb '21

commit fd5a72078cf405ae60ebe4ca608cbe2b203d0258 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jan 26 15:31:21 2021 -0500 dos: Add DoS subsystem to manager list Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/app/main/subsystem_list.c | 2 ++ src/core/or/dos.h | 2 ++ src/core/or/dos_sys.c | 34 ++++++++++++++++++++++++++++++++++ src/core/or/dos_sys.h | 22 ++++++++++++++++++++++ src/core/or/include.am | 2 ++ 5 files changed, 62 insertions(+) diff --git a/src/app/main/subsystem_list.c b/src/app/main/subsystem_list.c index cb79909e69..4b417f57e2 100644 --- a/src/app/main/subsystem_list.c +++ b/src/app/main/subsystem_list.c @@ -14,6 +14,7 @@ #include "lib/cc/torint.h" #include "core/mainloop/mainloop_sys.h" +#include "core/or/dos_sys.h" #include "core/or/or_sys.h" #include "feature/control/btrack_sys.h" #include "lib/compress/compress_sys.h" @@ -64,6 +65,7 @@ const subsys_fns_t *tor_subsystems[] = { &sys_mainloop, &sys_or, + &sys_dos, &sys_relay, &sys_hs, diff --git a/src/core/or/dos.h b/src/core/or/dos.h index b3eca058b8..62c3857409 100644 --- a/src/core/or/dos.h +++ b/src/core/or/dos.h @@ -9,6 +9,8 @@ #ifndef TOR_DOS_H #define TOR_DOS_H +#include "core/or/or.h" + /* Structure that keeps stats of client connection per-IP. */ typedef struct cc_client_stats_t { /* Number of allocated circuits remaining for this address. It is diff --git a/src/core/or/dos_sys.c b/src/core/or/dos_sys.c new file mode 100644 index 0000000000..b25d45bc14 --- /dev/null +++ b/src/core/or/dos_sys.c @@ -0,0 +1,34 @@ +/* Copyright (c) 2021, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * @file dos_sys.c + * @brief Subsystem definitions for DOS module. + **/ + +#include "lib/subsys/subsys.h" + +#include "core/or/dos.h" +#include "core/or/dos_sys.h" + +static int +subsys_dos_initialize(void) +{ + return 0; +} + +static void +subsys_dos_shutdown(void) +{ +} + +const struct subsys_fns_t sys_dos = { + SUBSYS_DECLARE_LOCATION(), + + .name = "dos", + .supported = true, + .level = DOS_SUBSYS_LEVEL, + + .initialize = subsys_dos_initialize, + .shutdown = subsys_dos_shutdown, +}; diff --git a/src/core/or/dos_sys.h b/src/core/or/dos_sys.h new file mode 100644 index 0000000000..2c9824a32a --- /dev/null +++ b/src/core/or/dos_sys.h @@ -0,0 +1,22 @@ +/* Copyright (c) 2021, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +/** + * @file dos_sys.h + * @brief Header for core/or/dos_sys.c + **/ + +#ifndef TOR_CORE_OR_DOS_SYS_H +#define TOR_CORE_OR_DOS_SYS_H + +extern const struct subsys_fns_t sys_dos; + +/** + * Subsystem level for the metrics system. + * + * Defined here so that it can be shared between the real and stub + * definitions. + **/ +#define DOS_SUBSYS_LEVEL (21) + +#endif /* !defined(TOR_CORE_OR_DOS_SYS_H) */ diff --git a/src/core/or/include.am b/src/core/or/include.am index 7c42268c46..1308497092 100644 --- a/src/core/or/include.am +++ b/src/core/or/include.am @@ -18,6 +18,7 @@ LIBTOR_APP_A_SOURCES += \ src/core/or/connection_edge.c \ src/core/or/connection_or.c \ src/core/or/dos.c \ + src/core/or/dos_sys.c \ src/core/or/extendinfo.c \ src/core/or/onion.c \ src/core/or/ocirc_event.c \ @@ -64,6 +65,7 @@ noinst_HEADERS += \ src/core/or/crypt_path_st.h \ src/core/or/destroy_cell_queue_st.h \ src/core/or/dos.h \ + src/core/or/dos_sys.h \ src/core/or/edge_connection_st.h \ src/core/or/extendinfo.h \ src/core/or/half_edge_st.h \

1 0

[torspec/master] Add StreamId to ADDRMAP entry in control-spec
by nickm＠torproject.org 08 Feb '21

08 Feb '21

commit c91d596262c5e5b0c285f611aa437d99a400ff33 Author: Neel Chauhan <neel(a)neelc.org> Date: Tue Jan 26 14:26:51 2021 -0800 Add StreamId to ADDRMAP entry in control-spec --- control-spec.txt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/control-spec.txt b/control-spec.txt index 72d3195..e160da0 100644 --- a/control-spec.txt +++ b/control-spec.txt @@ -2567,7 +2567,7 @@ "650" SP "ADDRMAP" SP Address SP NewAddress SP Expiry [SP "error=" ErrorCode] [SP "EXPIRES=" UTCExpiry] [SP "CACHED=" Cached] - CRLF + [SP "STREAMID=" StreamId] CRLF NewAddress = Address / "<error>" Expiry = DQUOTE ISOTime DQUOTE / "NEVER" @@ -2576,6 +2576,7 @@ UTCExpiry = DQUOTE IsoTime DQUOTE Cached = DQUOTE "YES" DQUOTE / DQUOTE "NO" DQUOTE + StreamId = DQUOTE StreamId DQUOTE Error and UTCExpiry are only provided if extended events are enabled. The values for Error are mostly useless. Future values will be @@ -2589,6 +2590,9 @@ Cached indicates whether the mapping will be stored until it expires, or if it is just a notification in response to a RESOLVE command. + StreamId is the global stream identifier of the stream or circuit from which + the address was resolved. + 4.1.8. Descriptors uploaded to us in our role as authoritative dirserver [NOTE: This feature was removed in Tor 0.3.2.1-alpha.]

1 0

[torspec/master] Merge remote-tracking branch 'tor-gitlab/mr/26'
by nickm＠torproject.org 08 Feb '21

08 Feb '21

commit d3a4dadac149c2be162344a6c2286653b8ac3753 Merge: 6eb726c c91d596 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 8 10:39:01 2021 -0500 Merge remote-tracking branch 'tor-gitlab/mr/26' control-spec.txt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)

1 0

[tor/master] Add a colon to ticket40249 changes entry
by nickm＠torproject.org 08 Feb '21

08 Feb '21

commit d159bdb0f498167c2f9ea0004a56bf6f64f2c9ff Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 8 10:31:18 2021 -0500 Add a colon to ticket40249 changes entry --- changes/ticket40249 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changes/ticket40249 b/changes/ticket40249 index 11c40bc5a3..f9a1528a26 100644 --- a/changes/ticket40249 +++ b/changes/ticket40249 @@ -1,3 +1,3 @@ - o Minor features (control port, stream handling) + o Minor features (control port, stream handling): - Add the stream ID argument to the event line in the ADDRMAP control event. Closes ticket 40249. Patch by Neel Chauhan.

1 0

[tor/master] Merge branch 'bug40249_squashed'
by nickm＠torproject.org 08 Feb '21

08 Feb '21

commit 90add50550f2e101de5383e926d1f2729d8987ce Merge: 177b535e72 d159bdb0f4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 8 10:31:30 2021 -0500 Merge branch 'bug40249_squashed' changes/ticket40249 | 3 +++ src/app/config/config.c | 2 +- src/core/or/circuituse.c | 7 ++++++- src/core/or/connection_edge.c | 12 +++++++++--- src/feature/client/addressmap.c | 15 ++++++++++----- src/feature/client/addressmap.h | 2 +- src/feature/control/control_cmd.c | 2 +- src/feature/control/control_events.c | 29 +++++++++++++++++++---------- src/feature/control/control_events.h | 2 +- src/test/test_entryconn.c | 4 ++-- 10 files changed, 53 insertions(+), 25 deletions(-)

1 0

[tor/master] Add stream ID to ADDRMAP control event
by nickm＠torproject.org 08 Feb '21

08 Feb '21

commit 2391c60c5c89b104572323a439e3560a09c1a6e2 Author: Neel Chauhan <neel(a)neelc.org> Date: Tue Jan 19 14:51:00 2021 -0800 Add stream ID to ADDRMAP control event --- changes/ticket40249 | 3 +++ src/app/config/config.c | 2 +- src/core/or/circuituse.c | 7 ++++++- src/core/or/connection_edge.c | 12 +++++++++--- src/feature/client/addressmap.c | 15 ++++++++++----- src/feature/client/addressmap.h | 2 +- src/feature/control/control_cmd.c | 2 +- src/feature/control/control_events.c | 29 +++++++++++++++++++---------- src/feature/control/control_events.h | 2 +- src/test/test_entryconn.c | 4 ++-- 10 files changed, 53 insertions(+), 25 deletions(-) diff --git a/changes/ticket40249 b/changes/ticket40249 new file mode 100644 index 0000000000..11c40bc5a3 --- /dev/null +++ b/changes/ticket40249 @@ -0,0 +1,3 @@ + o Minor features (control port, stream handling) + - Add the stream ID argument to the event line in the ADDRMAP control + event. Closes ticket 40249. Patch by Neel Chauhan. diff --git a/src/app/config/config.c b/src/app/config/config.c index bf2f49ead4..40071cb093 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -4841,7 +4841,7 @@ addressmap_register_auto(const char *from, const char *to, } addressmap_register(from, tor_strdup(to), expires, addrmap_source, - from_wildcard, to_wildcard); + from_wildcard, to_wildcard, 0); return 0; } diff --git a/src/core/or/circuituse.c b/src/core/or/circuituse.c index 0f3fc29361..018654769d 100644 --- a/src/core/or/circuituse.c +++ b/src/core/or/circuituse.c @@ -2733,6 +2733,11 @@ consider_recording_trackhost(const entry_connection_t *conn, const or_options_t *options = get_options(); char *new_address = NULL; char fp[HEX_DIGEST_LEN+1]; + uint64_t stream_id = 0; + + if (conn) { + stream_id = ENTRY_TO_CONN(conn)->global_identifier; + } /* Search the addressmap for this conn's destination. */ /* If they're not in the address map.. */ @@ -2756,7 +2761,7 @@ consider_recording_trackhost(const entry_connection_t *conn, addressmap_register(conn->socks_request->address, new_address, time(NULL) + options->TrackHostExitsExpire, - ADDRMAPSRC_TRACKEXIT, 0, 0); + ADDRMAPSRC_TRACKEXIT, 0, 0, stream_id); } /** Attempt to attach the connection conn to circ, and send a diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index b2390e4f04..e605b5f4e1 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -3519,22 +3519,28 @@ tell_controller_about_resolved_result(entry_connection_t *conn, int ttl, time_t expires) { + uint64_t stream_id = 0; + + if (conn) { + stream_id = ENTRY_TO_CONN(conn)->global_identifier; + } + expires = time(NULL) + ttl; if (answer_type == RESOLVED_TYPE_IPV4 && answer_len >= 4) { char *cp = tor_dup_ip(ntohl(get_uint32(answer))); if (cp) control_event_address_mapped(conn->socks_request->address, - cp, expires, NULL, 0); + cp, expires, NULL, 0, stream_id); tor_free(cp); } else if (answer_type == RESOLVED_TYPE_HOSTNAME && answer_len < 256) { char *cp = tor_strndup(answer, answer_len); control_event_address_mapped(conn->socks_request->address, - cp, expires, NULL, 0); + cp, expires, NULL, 0, stream_id); tor_free(cp); } else { control_event_address_mapped(conn->socks_request->address, "<error>", time(NULL)+ttl, - "error=yes", 0); + "error=yes", 0, stream_id); } } diff --git a/src/feature/client/addressmap.c b/src/feature/client/addressmap.c index e5bf2cc49c..316fb7ceaa 100644 --- a/src/feature/client/addressmap.c +++ b/src/feature/client/addressmap.c @@ -576,7 +576,7 @@ void addressmap_register(const char *address, char *new_address, time_t expires, addressmap_entry_source_t source, const int wildcard_addr, - const int wildcard_new_addr) + const int wildcard_new_addr, uint64_t stream_id) { addressmap_entry_t *ent; @@ -626,7 +626,8 @@ addressmap_register(const char *address, char *new_address, time_t expires, log_info(LD_CONFIG, "Addressmap: (re)mapped '%s' to '%s'", safe_str_client(address), safe_str_client(ent->new_address)); - control_event_address_mapped(address, ent->new_address, expires, NULL, 1); + control_event_address_mapped(address, ent->new_address, + expires, NULL, 1, stream_id); } /** An attempt to resolve address failed at some OR. @@ -680,11 +681,15 @@ client_dns_set_addressmap_impl(entry_connection_t *for_conn, int ttl) { char *extendedaddress=NULL, *extendedval=NULL; - (void)for_conn; + uint64_t stream_id = 0; tor_assert(address); tor_assert(name); + if (for_conn) { + stream_id = ENTRY_TO_CONN(for_conn)->global_identifier; + } + if (ttl<0) ttl = DEFAULT_DNS_TTL; else @@ -705,7 +710,7 @@ client_dns_set_addressmap_impl(entry_connection_t *for_conn, "%s", name); } addressmap_register(extendedaddress, extendedval, - time(NULL) + ttl, ADDRMAPSRC_DNS, 0, 0); + time(NULL) + ttl, ADDRMAPSRC_DNS, 0, 0, stream_id); tor_free(extendedaddress); } @@ -1043,7 +1048,7 @@ addressmap_register_virtual_address(int type, char *new_address) log_info(LD_APP, "Registering map from %s to %s", *addrp, new_address); if (vent_needs_to_be_added) strmap_set(virtaddress_reversemap, new_address, vent); - addressmap_register(*addrp, new_address, 2, ADDRMAPSRC_AUTOMAP, 0, 0); + addressmap_register(*addrp, new_address, 2, ADDRMAPSRC_AUTOMAP, 0, 0, 0); /* FFFF register corresponding reverse mapping. */ diff --git a/src/feature/client/addressmap.h b/src/feature/client/addressmap.h index 7f1024e09a..681abb714a 100644 --- a/src/feature/client/addressmap.h +++ b/src/feature/client/addressmap.h @@ -36,7 +36,7 @@ int addressmap_have_mapping(const char *address, int update_timeout); void addressmap_register(const char *address, char *new_address, time_t expires, addressmap_entry_source_t source, const int address_wildcard, - const int new_address_wildcard); + const int new_address_wildcard, uint64_t stream_id); int parse_virtual_addr_network(const char *val, sa_family_t family, int validate_only, char **msg); diff --git a/src/feature/control/control_cmd.c b/src/feature/control/control_cmd.c index 5b75c24692..17d9280200 100644 --- a/src/feature/control/control_cmd.c +++ b/src/feature/control/control_cmd.c @@ -1232,7 +1232,7 @@ handle_control_resolve(control_connection_t *conn, send_control_done(conn); SMARTLIST_FOREACH(failed, const char *, arg, { control_event_address_mapped(arg, arg, time(NULL), - "internal", 0); + "internal", 0, 0); }); smartlist_free(failed); diff --git a/src/feature/control/control_events.c b/src/feature/control/control_events.c index 0dd52659ec..6648ffeecd 100644 --- a/src/feature/control/control_events.c +++ b/src/feature/control/control_events.c @@ -1477,31 +1477,40 @@ control_event_descriptors_changed(smartlist_t *routers) * mode of the mapping. */ int -control_event_address_mapped(const char *from, const char *to, time_t expires, - const char *error, const int cached) +control_event_address_mapped(const char *from, const char *to, + time_t expires, const char *error, + const int cached, uint64_t stream_id) { + char *stream_id_str = NULL; if (!EVENT_IS_INTERESTING(EVENT_ADDRMAP)) return 0; + if (stream_id) { + tor_asprintf(&stream_id_str, " STREAMID=%"PRIu64"", stream_id); + } + if (expires < 3 || expires == TIME_MAX) send_control_event(EVENT_ADDRMAP, "650 ADDRMAP %s %s NEVER %s%s" - "CACHED=\"%s\"\r\n", - from, to, error?error:"", error?" ":"", - cached?"YES":"NO"); + "CACHED=\"%s\"%s\r\n", + from, to, error ? error : "", error ? " " : "", + cached ? "YES" : "NO", + stream_id ? stream_id_str : ""); else { char buf[ISO_TIME_LEN+1]; char buf2[ISO_TIME_LEN+1]; format_local_iso_time(buf,expires); format_iso_time(buf2,expires); send_control_event(EVENT_ADDRMAP, - "650 ADDRMAP %s %s \"%s\"" - " %s%sEXPIRES=\"%s\" CACHED=\"%s\"\r\n", - from, to, buf, - error?error:"", error?" ":"", - buf2, cached?"YES":"NO"); + "650 ADDRMAP %s %s \"%s\" %s%sEXPIRES=\"%s\" " + "CACHED=\"%s\"%s\r\n", + from, to, buf, error ? error : "", + error ? " " : "", buf2, cached ? "YES" : "NO", + stream_id ? stream_id_str: ""); } + tor_free(stream_id_str); + return 0; } /** The network liveness has changed; this is called from circuitstats.c diff --git a/src/feature/control/control_events.h b/src/feature/control/control_events.h index 0ac233cc6e..e499c037ba 100644 --- a/src/feature/control/control_events.h +++ b/src/feature/control/control_events.h @@ -137,7 +137,7 @@ void control_event_logmsg_pending(void); int control_event_descriptors_changed(smartlist_t *routers); int control_event_address_mapped(const char *from, const char *to, time_t expires, const char *error, - const int cached); + const int cached, uint64_t stream_id); int control_event_my_descriptor_changed(void); int control_event_network_liveness_update(int liveness); int control_event_networkstatus_changed(smartlist_t *statuses); diff --git a/src/test/test_entryconn.c b/src/test/test_entryconn.c index 9cdd7f6d0e..6a8603cbf8 100644 --- a/src/test/test_entryconn.c +++ b/src/test/test_entryconn.c @@ -307,7 +307,7 @@ test_entryconn_rewrite_cached_dns_ipv4(void *arg) tor_strdup("240.240.241.241"), expires, ADDRMAPSRC_DNS, - 0, 0); + 0, 0, 0); strlcpy(ec->socks_request->address, "www.friendly.example.com", sizeof(ec->socks_request->address)); @@ -359,7 +359,7 @@ test_entryconn_rewrite_cached_dns_ipv6(void *arg) tor_strdup("[::f00f]"), expires, ADDRMAPSRC_DNS, - 0, 0); + 0, 0, 0); strlcpy(ec->socks_request->address, "www.friendly.example.com", sizeof(ec->socks_request->address));

1 0

[tor/master] Another round of unittest massaging for tor!212.
by asn＠torproject.org 08 Feb '21

08 Feb '21

commit 177b535e7295161db3ac62641173331310ab2ea5 Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Feb 8 15:54:48 2021 +0200 Another round of unittest massaging for tor!212. --- src/test/test_hs_control.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/test/test_hs_control.c b/src/test/test_hs_control.c index 99c865c8ee..dfc1e5445e 100644 --- a/src/test/test_hs_control.c +++ b/src/test/test_hs_control.c @@ -800,6 +800,8 @@ test_hs_control_add_onion_helper_add_service(void *arg) rend_service_port_config_t *portcfg; smartlist_t *portcfgs; char *address_out_good, *address_out_bad; + hs_service_t *service_good = NULL; + hs_service_t *service_bad = NULL; (void) arg; @@ -831,7 +833,7 @@ test_hs_control_add_onion_helper_add_service(void *arg) add_onion_helper_add_service(HS_VERSION_THREE, &sk_good, portcfgs, 1, 1, REND_V3_AUTH, NULL, list_good, &address_out_good); - hs_service_t *service_good = find_service(global_map, &pk_good); + service_good = find_service(global_map, &pk_good); tt_int_op(smartlist_len(service_good->config.clients), OP_EQ, 1); hs_service_free(service_good); @@ -846,7 +848,7 @@ test_hs_control_add_onion_helper_add_service(void *arg) add_onion_helper_add_service(HS_VERSION_THREE, &sk_bad, portcfgs, 1, 1, REND_V3_AUTH, NULL, list_bad, &address_out_bad); - hs_service_t *service_bad = find_service(global_map, &pk_bad); + service_bad = find_service(global_map, &pk_bad); tt_int_op(smartlist_len(service_bad->config.clients), OP_EQ, 0);

1 0

[tor/master] Fix broken unittest from tor!212 .
by asn＠torproject.org 08 Feb '21

08 Feb '21

commit 16915ec5158e1dda97f8ece3edb24370c9cddf46 Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Feb 8 15:30:50 2021 +0200 Fix broken unittest from tor!212 . Be more careful with memory management in the test. --- src/test/test_hs_control.c | 33 +++++++++++++++++++-------------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/src/test/test_hs_control.c b/src/test/test_hs_control.c index 5788fa2a95..99c865c8ee 100644 --- a/src/test/test_hs_control.c +++ b/src/test/test_hs_control.c @@ -795,7 +795,7 @@ test_hs_control_add_onion_helper_add_service(void *arg) char *key_new_blob_good = NULL, *key_new_blob_bad = NULL; const char *key_new_alg_good = NULL, *key_new_alg_bad = NULL; hs_service_authorized_client_t *client_good, *client_bad; - smartlist_t *list_v2, *list_good, *list_bad; + smartlist_t *list_good, *list_bad; hs_service_ht *global_map; rend_service_port_config_t *portcfg; smartlist_t *portcfgs; @@ -825,22 +825,30 @@ test_hs_control_add_onion_helper_add_service(void *arg) "N2NU7BSRL6YODZCYPN4CREB54TYLKGIE2KYOQWLFYC23ZJVCE5DQ", LOG_INFO); client_bad = parse_authorized_client_key("dummy", LOG_INFO); - list_v2 = smartlist_new(); list_good = smartlist_new(); smartlist_add(list_good, client_good); + + add_onion_helper_add_service(HS_VERSION_THREE, &sk_good, portcfgs, 1, 1, + REND_V3_AUTH, NULL, list_good, &address_out_good); + + hs_service_t *service_good = find_service(global_map, &pk_good); + tt_int_op(smartlist_len(service_good->config.clients), OP_EQ, 1); + + hs_service_free(service_good); + list_bad = smartlist_new(); smartlist_add(list_bad, client_bad); - add_onion_helper_add_service(HS_VERSION_THREE, &sk_good, portcfgs, 1, 1, - REND_V3_AUTH, list_v2, list_good, &address_out_good); + portcfg = rend_service_parse_port_config("8080", ",", NULL); + portcfgs = smartlist_new(); + smartlist_add(portcfgs, portcfg); + add_onion_helper_add_service(HS_VERSION_THREE, &sk_bad, portcfgs, 1, 1, - REND_V3_AUTH, list_v2, list_bad, &address_out_bad); + REND_V3_AUTH, NULL, list_bad, &address_out_bad); - hs_service_t *srv_good = find_service(global_map, &pk_good); - hs_service_t *srv_bad = find_service(global_map, &pk_bad); + hs_service_t *service_bad = find_service(global_map, &pk_bad); - tt_int_op(smartlist_len(srv_good->config.clients), OP_EQ, 1); - tt_int_op(smartlist_len(srv_bad->config.clients), OP_EQ, 0); + tt_int_op(smartlist_len(service_bad->config.clients), OP_EQ, 0); done: tor_free(key_new_blob_good); @@ -848,11 +856,8 @@ test_hs_control_add_onion_helper_add_service(void *arg) tor_free(address_out_good); tor_free(address_out_bad); - service_authorized_client_free(client_good); - - smartlist_free(list_v2); - smartlist_free(list_good); - smartlist_free(list_bad); + hs_service_free(service_good); + hs_service_free(service_bad); } struct testcase_t hs_control_tests[] = {

1 0

[tor/master] Add changes file for ticket 40084
by asn＠torproject.org 08 Feb '21

08 Feb '21

commit 3057671a380773167f5e8efe7b3860b88015eeab Author: Neel Chauhan <neel(a)neelc.org> Date: Sun Nov 15 14:33:43 2020 -0800 Add changes file for ticket 40084 --- changes/ticket40084 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changes/ticket40084 b/changes/ticket40084 new file mode 100644 index 0000000000..072af813f1 --- /dev/null +++ b/changes/ticket40084 @@ -0,0 +1,4 @@ + o Major features (control port, onion services): + - Add support for creating version 3 onion services with authorization + from the control port. Previously, we could only create version 2 + services here. Closes ticket 40084. Patch by Neel Chauhan.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits February 2021