April 2021 - tor-commits - lists.torproject.org

[translation/tpo-web] https://gitweb.torproject.org/translation.git/commit/?h=tpo-web
by translation＠torproject.org 23 Apr '21

23 Apr '21

commit 9266e73ebca537b6a2de3e50ce4422b2639c0f21 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Apr 23 18:17:48 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tpo-web --- contents+ar.po | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/contents+ar.po b/contents+ar.po index 433c5bca43..b4d255f4d6 100644 --- a/contents+ar.po +++ b/contents+ar.po @@ -2042,27 +2042,27 @@ msgstr "شاهد" #: templates/privchat-1.html:43 msgid "Roger Dingledine" -msgstr "" +msgstr "روجر دينجليدين" #: templates/privchat-1.html:62 msgid "Carmela Troncoso" -msgstr "" +msgstr "كارميلا ترونكوسو" #: templates/privchat-1.html:74 msgid "Daniel Kahn Gillmor" -msgstr "" +msgstr "دانيال كان جيلمور" #: templates/privchat-1.html:86 msgid "Matt Mitchell " -msgstr "" +msgstr "مات ميتشل" #: templates/privchat.html:29 msgid "Save the Date" -msgstr "" +msgstr "احفظ التاريخ" #: templates/release.html:22 msgid "Do you need help?" -msgstr "" +msgstr "هل تحتاج مساعدة؟" #: templates/release.html:31 msgid "Get in Touch" @@ -2168,7 +2168,7 @@ msgstr "دليل استخدام متصفح Tor Browser" #: templates/macros/downloads.html:72 msgid "blog post" -msgstr "" +msgstr "مشاركة مدونة" #: templates/macros/jobs.html:11 msgid "Read more."

1 0

[translation/tbmanual-contentspot] https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot
by translation＠torproject.org 23 Apr '21

23 Apr '21

commit 9cb2ddf480db8aa412036e8290f7434781d5462f Author: Translation commit bot <translation(a)torproject.org> Date: Fri Apr 23 18:16:55 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tbmanual-contentspot --- contents+fr.po | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/contents+fr.po b/contents+fr.po index d028994e1b..4b51c9a032 100644 --- a/contents+fr.po +++ b/contents+fr.po @@ -2814,7 +2814,7 @@ msgstr "" #: https//tb-manual.torproject.org/known-issues/ #: (content/known-issues/contents+en.lrtopic.body) msgid "Flash is disabled for security reasons." -msgstr "" +msgstr "Flash est désactivé pour des raisons de sécurité." #: https//tb-manual.torproject.org/known-issues/ #: (content/known-issues/contents+en.lrtopic.body) @@ -2830,6 +2830,8 @@ msgstr "" #: (content/known-issues/contents+en.lrtopic.body) msgid "This is to ensure that each software build is exactly reproducible." msgstr "" +"Ceci permet de garantir que chaque version de logiciel est reproductible à " +"l'identique." #: https//tb-manual.torproject.org/known-issues/ #: (content/known-issues/contents+en.lrtopic.body)

1 0

[translation/tpo-web] https://gitweb.torproject.org/translation.git/commit/?h=tpo-web
by translation＠torproject.org 23 Apr '21

23 Apr '21

commit 30ed51476e0fcef6a852ce35bae99f726a5f9b65 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Apr 23 17:47:38 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tpo-web --- contents+ar.po | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/contents+ar.po b/contents+ar.po index 7223ef2f08..433c5bca43 100644 --- a/contents+ar.po +++ b/contents+ar.po @@ -720,6 +720,8 @@ msgid "" "We expect to release the new Tor Browser for Android based on Fenix in the " "following weeks." msgstr "" +"نتوقع إصدار متصفح Tor الجديد لنظام الاندرويد استنادًا إلى فينيكس في الأسابيع" +" التالية." #: https//www.torproject.org/releases/tor-browser-10-0/ #: (content/releases/tor-browser-10-0/contents+en.lrpage.body) @@ -727,6 +729,8 @@ msgid "" "Tor Browser 10 ships with Firefox 78.3.0esr, updates NoScript to 11.0.44, " "and Tor to 0.4.4.5." msgstr "" +"يأتي متصفح Tor 10 مع فايرفوكس 78.3.0esr ، ويحدث نوسكربت إلى 11.0.44 ، و Tor " +"إلى 0.4.4.5." #: https//www.torproject.org/releases/tor-browser-10-0/ #: (content/releases/tor-browser-10-0/contents+en.lrpage.body) @@ -734,6 +738,8 @@ msgid "" "This release includes important [security updates to " "Firefox](https://www.mozilla.org/en-US/security/advisories/mfsa2020-43/)." msgstr "" +"يتضمن هذا الإصدار مهمة [تحديثات الأمان لفايرفوكس](https://www.mozilla.org" +"/en-US/security/advisories/mfsa2020-43/)." #: https//www.torproject.org/releases/tor-browser-10-0/ #: (content/releases/tor-browser-10-0/contents+en.lrpage.body) @@ -742,6 +748,9 @@ msgid "" "[new extended support release](https://www.mozilla.org/en-" "US/firefox/enterprise/#overview) of Mozilla Firefox." msgstr "" +"يركز إصدار متصفح Tor الجديد هذا على تثبيت متصفح Tor استنادًا إلى [إصدار دعم" +" موسع جديد](https://www.mozilla.org/en-US/firefox/enterprise/#overview)من " +"موزيلا فايرفوكس." #: https//www.torproject.org/releases/tor-browser-10-0/ #: (content/releases/tor-browser-10-0/contents+en.lrpage.body) @@ -749,6 +758,7 @@ msgid "" "Tor Browser 10.0 is the first stable release of the 10.0 series based on " "Firefox 78esr." msgstr "" +"متصفح تور 10.0 هو أول إصدار مستقر من سلسلة 10.0 مبني على فايرفوكس 78 esr." #: https//www.torproject.org/releases/tor-browser-10-0/ #: (content/releases/tor-browser-10-0/contents+en.lrpage.body) @@ -757,11 +767,14 @@ msgid "" "series](https://gitlab.torproject.org/tpo/applications/tor-" "browser/-/issues/40089) supporting CentOS 6." msgstr "" +"** ملاحظة: ** متصفح تور 10.0 هو [سلسلة متصفح Tor " +"النهائية](https://gitlab.torproject.org/tpo/applications/tor-" +"browser/-/issues/40089) يدعم CentOS 6." #: https//www.torproject.org/releases/tor-browser-10-0/ #: (content/releases/tor-browser-10-0/contents+en.lrpage.body) msgid "Beginning with the 10.5 series, CentOS 6 is not supported." -msgstr "" +msgstr "بدءًا من سلسلة 10.5 ، لا يتم دعم CentOS 6." #: https//www.torproject.org/releases/tor-browser-10-0/ #: (content/releases/tor-browser-10-0/contents+en.lrpage.body) @@ -770,6 +783,8 @@ msgid "" "release, [please let us know](https://support.torproject.org/misc/bug-or-" "feedback/)." msgstr "" +"إذا وجدت خطأ أو كان لديك اقتراح حول كيفية تحسين هذا الإصدار, [من فضلك، " +"اسمحوا لنا أن نعرف](https://support.torproject.org/misc/bug-or-feedback/)." #: https//www.torproject.org/about/cy-pres/ #: (content/about/cy-pres/contents+en.lrpage.title) @@ -1208,7 +1223,7 @@ msgstr "" #: https//www.torproject.org/about/membership/ #: (content/about/membership/contents+en.lrpage.title) msgid "Membership" -msgstr "" +msgstr "عضوية" #: https//www.torproject.org/about/membership/ #: (content/about/membership/contents+en.lrpage.body) @@ -1218,6 +1233,9 @@ msgid "" "supportive relationship between our nonprofit and private sector " "organizations that use our technology or want to support our mission." msgstr "" +"لطالما كان المجتمع في قلب قوة Tor. بهذه الروح، أنشأنا برنامج عضوية مشروع " +"Tor. هدفنا هو بناء علاقة داعمة بين منظماتنا غير الربحية ومؤسسات القطاع الخاص" +" التي تستخدم تقنيتنا أو ترغب في دعم مهمتنا." #: https//www.torproject.org/press/-new-release-tails/ #: (content/press/new-release-tails/contents+en.lrpost.title) @@ -1934,7 +1952,7 @@ msgstr "ندعوك للانضمام إلينا في IRC لتعرف كيف يمك #: templates/membership.html:111 msgid "Green Onion Members" -msgstr "" +msgstr "أعضاء Onion الأخضر" #: templates/meta.html:11 msgid "The Tor Project | Privacy & Freedom Online" @@ -2020,7 +2038,7 @@ msgstr "الموضوع" #: templates/privchat-1.html:19 templates/privchat-2.html:19 msgid "Watch" -msgstr "" +msgstr "شاهد" #: templates/privchat-1.html:43 msgid "Roger Dingledine"

1 0

[translation/tpo-web] https://gitweb.torproject.org/translation.git/commit/?h=tpo-web
by translation＠torproject.org 23 Apr '21

23 Apr '21

commit f4bf61670bb44eb321fa4332606776fdb3ce94c6 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Apr 23 17:18:03 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tpo-web --- contents+ar.po | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/contents+ar.po b/contents+ar.po index c4769b7dff..7223ef2f08 100644 --- a/contents+ar.po +++ b/contents+ar.po @@ -16,8 +16,8 @@ # Ali <aboshanab_(a)hotmail.com>, 2021 # Amin Jobran, 2021 # Muhammad Elghdban <Mohamed.Elghdban(a)gmail.com>, 2021 -# NASI₿ <nomadweb(a)protonmail.ch>, 2021 # Emma Peel, 2021 +# NASI₿ <nomadweb(a)protonmail.ch>, 2021 # msgid "" msgstr "" @@ -25,7 +25,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2021-03-20 12:54+CET\n" "PO-Revision-Date: 2019-03-09 10:41+0000\n" -"Last-Translator: Emma Peel, 2021\n" +"Last-Translator: NASI₿ <nomadweb(a)protonmail.ch>, 2021\n" "Language-Team: Arabic (https://www.transifex.com/otf/teams/1519/ar/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -712,6 +712,7 @@ msgid "" "We are informed by Mozilla of any issues they learn about affecting this " "version." msgstr "" +"تم إبلاغنا من قبل موزيلا بأي مشكلات يتعلمونها حول التأثير على هذا الإصدار." #: https//www.torproject.org/releases/tor-browser-10-0/ #: (content/releases/tor-browser-10-0/contents+en.lrpage.body)

1 0

[tor/master] Add an extra prop330 test, and clarifying comments.
by dgoulet＠torproject.org 23 Apr '21

23 Apr '21

commit ebb826f4a15c90d480bb5384facc9d05e13505ab Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 24 10:19:21 2021 -0400 Add an extra prop330 test, and clarifying comments. This test makes sure that we reject "upload=" URLs with bad IP addresses. Also, add a warning when we can't parse the address. --- src/app/config/config.c | 2 ++ src/test/test_dirauth_ports.c | 23 +++++++++++++++++++++-- 2 files changed, 23 insertions(+), 2 deletions(-) diff --git a/src/app/config/config.c b/src/app/config/config.c index 395da5e66a..547662300d 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -5500,6 +5500,8 @@ parse_dirauth_dirport(dir_server_t *ds, const char *flag) &dirport.addr, &dirport.port, -1); if (ds != NULL && rv == 0) { trusted_dir_server_add_dirport(ds, usage, &dirport); + } else if (rv == -1) { + log_warn(LD_CONFIG, "Unable to parse address in authority flag %s",flag); } tor_free(addr_string); diff --git a/src/test/test_dirauth_ports.c b/src/test/test_dirauth_ports.c index de10c7006e..5dc0b0b631 100644 --- a/src/test/test_dirauth_ports.c +++ b/src/test/test_dirauth_ports.c @@ -44,7 +44,7 @@ test_dirauth_port_parsing(void *arg) rv = parse_dir_authority_line( "moria1 orport=9101 " "v3ident=D586D18309DED4CD6D57C18FDB97EFA96D330566 " - "upload=https://128.31.0.39:9131/ " // not recognized + "upload=https://128.31.0.39:9131/ " // https is not recognized "128.31.0.39:9131 9695 DFC3 5FFE B861 329B 9F1A B04C 4639 7020 CE31", NO_DIRINFO, 1); tt_int_op(rv,OP_EQ,-1); @@ -54,11 +54,30 @@ test_dirauth_port_parsing(void *arg) rv = parse_dir_authority_line( "moria1 orport=9101 " "v3ident=D586D18309DED4CD6D57C18FDB97EFA96D330566 " - "upload=http://128.31.0.39:9131/tor " // not supported + "upload=http://128.31.0.39:9131/tor " // suffix is not supported "128.31.0.39:9131 9695 DFC3 5FFE B861 329B 9F1A B04C 4639 7020 CE31", NO_DIRINFO, 1); tt_int_op(rv,OP_EQ,-1); expect_log_msg_containing("Unsupported URL prefix"); + mock_clean_saved_logs(); + + rv = parse_dir_authority_line( + "moria1 orport=9101 " + "v3ident=D586D18309DED4CD6D57C18FDB97EFA96D330566 " + "upload=http://128.31.0.256:9131/ " // "256" is not ipv4. + "128.31.0.39:9131 9695 DFC3 5FFE B861 329B 9F1A B04C 4639 7020 CE31", + NO_DIRINFO, 1); + tt_int_op(rv,OP_EQ,-1); + expect_log_msg_containing("Unable to parse address"); + + rv = parse_dir_authority_line( + "moria1 orport=9101 " + "v3ident=D586D18309DED4CD6D57C18FDB97EFA96D330566 " + "upload=http://xyz.example.com/ " // hostnames not supported. + "128.31.0.39:9131 9695 DFC3 5FFE B861 329B 9F1A B04C 4639 7020 CE31", + NO_DIRINFO, 1); + tt_int_op(rv,OP_EQ,-1); + expect_log_msg_containing("Unable to parse address"); done: teardown_capture_of_logs();

1 0

[tor/master] Allow extra dirport URLs to be configured for authorities.
by dgoulet＠torproject.org 23 Apr '21

23 Apr '21

commit 6e4b10cf67d1ef39f8401b0bef3bc009584427c6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 24 11:31:46 2021 -0500 Allow extra dirport URLs to be configured for authorities. --- src/app/config/config.c | 94 +++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 92 insertions(+), 2 deletions(-) diff --git a/src/app/config/config.c b/src/app/config/config.c index fa74907b3d..395da5e66a 100644 --- a/src/app/config/config.c +++ b/src/app/config/config.c @@ -5437,6 +5437,75 @@ pt_parse_transport_line(const or_options_t *options, return r; } +/** + * Parse a flag describing an extra dirport for a directory authority. + * + * Right now, the supported format is exactly: + * `{upload,download,voting}=http://[IP:PORT]/`. + * Other URL schemes, and other suffixes, might be supported in the future. + * + * Only call this function if `flag` starts with one of the above strings. + * + * Return 0 on success, and -1 on failure. + * + * If `ds` is provided, then add any parsed dirport to `ds`. If `ds` is NULL, + * take no action other than parsing. + **/ +static int +parse_dirauth_dirport(dir_server_t *ds, const char *flag) +{ + tor_assert(flag); + + auth_dirport_usage_t usage; + + if (!strcasecmpstart(flag, "upload=")) { + usage = AUTH_USAGE_UPLOAD; + } else if (!strcasecmpstart(flag, "download=")) { + usage = AUTH_USAGE_DOWNLOAD; + } else if (!strcasecmpstart(flag, "vote=")) { + usage = AUTH_USAGE_VOTING; + } else { + // We shouldn't get called with a flag that we don't recognize. + tor_assert_nonfatal_unreached(); + return -1; + } + + const char *eq = strchr(flag, '='); + tor_assert(eq); + const char *target = eq + 1; + + // Find the part inside the http://{....}/ + if (strcmpstart(target, "http://")) { + log_warn(LD_CONFIG, "Unsupported URL scheme in authority flag %s", flag); + return -1; + } + const char *addr = target + strlen("http://"); + + const char *eos = strchr(addr, '/'); + size_t addr_len; + if (eos && strcmp(eos, "/")) { + log_warn(LD_CONFIG, "Unsupported URL prefix in authority flag %s", flag); + return -1; + } else if (eos) { + addr_len = eos - addr; + } else { + addr_len = strlen(addr); + } + + // Finally, parse the addr:port part. + char *addr_string = tor_strndup(addr, addr_len); + tor_addr_port_t dirport; + memset(&dirport, 0, sizeof(dirport)); + int rv = tor_addr_port_parse(LOG_WARN, addr_string, + &dirport.addr, &dirport.port, -1); + if (ds != NULL && rv == 0) { + trusted_dir_server_add_dirport(ds, usage, &dirport); + } + + tor_free(addr_string); + return rv; +} + /** Read the contents of a DirAuthority line from line. If * validate_only is 0, and the line is well-formed, and it * shares any bits with required_type or required_type @@ -5457,6 +5526,7 @@ parse_dir_authority_line(const char *line, dirinfo_type_t required_type, char v3_digest[DIGEST_LEN]; dirinfo_type_t type = 0; double weight = 1.0; + smartlist_t *extra_dirports = smartlist_new(); memset(v3_digest, 0, sizeof(v3_digest)); @@ -5525,6 +5595,12 @@ parse_dir_authority_line(const char *line, dirinfo_type_t required_type, } ipv6_addrport_ptr = &ipv6_addrport; } + } else if (!strcasecmpstart(flag, "upload=") || + !strcasecmpstart(flag, "download=") || + !strcasecmpstart(flag, "vote=")) { + // We'll handle these after creating the authority object. + smartlist_add(extra_dirports, flag); + flag = NULL; // prevent double-free. } else { log_warn(LD_CONFIG, "Unrecognized flag '%s' on DirAuthority line", flag); @@ -5568,6 +5644,13 @@ parse_dir_authority_line(const char *line, dirinfo_type_t required_type, goto err; } + if (validate_only) { + SMARTLIST_FOREACH_BEGIN(extra_dirports, const char *, cp) { + if (parse_dirauth_dirport(NULL, cp) < 0) + goto err; + } SMARTLIST_FOREACH_END(cp); + } + if (!validate_only && (!required_type || required_type & type)) { dir_server_t *ds; if (required_type) @@ -5579,16 +5662,23 @@ parse_dir_authority_line(const char *line, dirinfo_type_t required_type, ipv6_addrport_ptr, digest, v3_digest, type, weight))) goto err; + + SMARTLIST_FOREACH_BEGIN(extra_dirports, const char *, cp) { + if (parse_dirauth_dirport(ds, cp) < 0) + goto err; + } SMARTLIST_FOREACH_END(cp); dir_server_add(ds); } r = 0; goto done; - err: + err: r = -1; - done: + done: + SMARTLIST_FOREACH(extra_dirports, char*, s, tor_free(s)); + smartlist_free(extra_dirports); SMARTLIST_FOREACH(items, char*, s, tor_free(s)); smartlist_free(items); tor_free(addrport);

1 0

[tor/master] Choose the correct dirport when contacting an authority.
by dgoulet＠torproject.org 23 Apr '21

23 Apr '21

commit ae0aff87ce321b2765a30472af9a2a310441408f Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 23 15:25:51 2021 -0500 Choose the correct dirport when contacting an authority. This is part of an implementation for proposal 330. This implementation doesn't handle authdirs' IPv6 dirports (yet). --- src/feature/dirclient/dirclient.c | 38 ++++++++++++++++++++++++++++++++++++-- src/feature/nodelist/dirlist.c | 39 ++++++++++++++++++++++++++++++++++++++- src/feature/nodelist/dirlist.h | 6 ++++++ 3 files changed, 80 insertions(+), 3 deletions(-) diff --git a/src/feature/dirclient/dirclient.c b/src/feature/dirclient/dirclient.c index a5dd856729..257cf2c72d 100644 --- a/src/feature/dirclient/dirclient.c +++ b/src/feature/dirclient/dirclient.c @@ -1164,6 +1164,7 @@ directory_request_set_routerstatus(directory_request_t *req, { req->routerstatus = status; } + /** * Helper: update the addresses, ports, and identities in req * from the routerstatus object in req. Return 0 on success. @@ -1206,7 +1207,7 @@ directory_request_set_dir_from_routerstatus(directory_request_t *req) return -1; } - /* At this point, if we are a client making a direct connection to a + /* At this point, if we are a client making a direct connection to a * directory server, we have selected a server that has at least one address * allowed by ClientUseIPv4/6 and Reachable{"",OR,Dir}Addresses. This * selection uses the preference in ClientPreferIPv6{OR,Dir}Port, if @@ -1221,6 +1222,37 @@ directory_request_set_dir_from_routerstatus(directory_request_t *req) return -1; } + /* One last thing: If we're talking to an authority, we might want to use + * a special HTTP port for it based on our purpose. + */ + if (req->indirection == DIRIND_DIRECT_CONN && status->is_authority) { + const dir_server_t *ds = router_get_trusteddirserver_by_digest( + status->identity_digest); + if (ds) { + const tor_addr_port_t *v4 = NULL; + if (authdir_mode_v3(get_options())) { + // An authority connecting to another authority should always + // prefer the VOTING usage, if one is specifically configured. + v4 = trusted_dir_server_get_dirport_exact( + ds, AUTH_USAGE_VOTING, AF_INET); + } + if (! v4) { + // Everybody else should prefer a usage dependent on their + // the dir_purpose. + auth_dirport_usage_t usage = + auth_dirport_usage_for_purpose(req->dir_purpose); + v4 = trusted_dir_server_get_dirport(ds, usage, AF_INET); + } + tor_assert_nonfatal(v4); + if (v4) { + // XXXX We could, if we wanted, also select a v6 address. But a v4 + // address must exist here, and we as a relay are required to support + // ipv4. So we just that. + tor_addr_port_copy(&use_dir_ap, v4); + } + } + } + directory_request_set_or_addr_port(req, &use_or_ap); directory_request_set_dir_addr_port(req, &use_dir_ap); directory_request_set_directory_id_digest(req, status->identity_digest); @@ -1239,7 +1271,7 @@ directory_initiate_request,(directory_request_t *request)) tor_assert_nonfatal( ! directory_request_dir_contact_info_specified(request)); if (directory_request_set_dir_from_routerstatus(request) < 0) { - return; + return; // or here XXXX } } @@ -1363,6 +1395,8 @@ directory_initiate_request,(directory_request_t *request)) entry_guard_cancel(&guard_state); } + // XXXX This is the case where we replace. + switch (connection_connect(TO_CONN(conn), conn->base_.address, &addr, port, &socket_error)) { case -1: diff --git a/src/feature/nodelist/dirlist.c b/src/feature/nodelist/dirlist.c index c9d0a991e5..cc2795a5f5 100644 --- a/src/feature/nodelist/dirlist.c +++ b/src/feature/nodelist/dirlist.c @@ -297,6 +297,42 @@ router_addr_is_trusted_dir_type(const tor_addr_t *addr, dirinfo_type_t type) return false; } +/** Return an appropriate usage value describing which authdir port to use + * for a given directory connection purpose. + */ +auth_dirport_usage_t +auth_dirport_usage_for_purpose(int purpose) +{ + switch (purpose) { + case DIR_PURPOSE_FETCH_SERVERDESC: + case DIR_PURPOSE_FETCH_EXTRAINFO: + case DIR_PURPOSE_FETCH_CONSENSUS: + case DIR_PURPOSE_FETCH_CERTIFICATE: + case DIR_PURPOSE_FETCH_MICRODESC: + return AUTH_USAGE_DOWNLOAD; + + case DIR_PURPOSE_UPLOAD_DIR: + return AUTH_USAGE_UPLOAD; + + case DIR_PURPOSE_UPLOAD_VOTE: + case DIR_PURPOSE_UPLOAD_SIGNATURES: + case DIR_PURPOSE_FETCH_DETACHED_SIGNATURES: + case DIR_PURPOSE_FETCH_STATUS_VOTE: + return AUTH_USAGE_VOTING; + + case DIR_PURPOSE_HAS_FETCHED_RENDDESC_V2: + case DIR_PURPOSE_SERVER: + case DIR_PURPOSE_UPLOAD_RENDDESC_V2: + case DIR_PURPOSE_FETCH_RENDDESC_V2: + case DIR_PURPOSE_UPLOAD_HSDESC: + case DIR_PURPOSE_FETCH_HSDESC: + case DIR_PURPOSE_HAS_FETCHED_HSDESC: + default: + tor_assert_nonfatal_unreached(); + return AUTH_USAGE_LEGACY; + } +} + /** Create a directory server at address:port, with OR identity * key digest which has DIGEST_LEN bytes. If address is NULL, * add ourself. If is_authority, this is a directory authority. Return @@ -373,6 +409,7 @@ dir_server_new(int is_authority, ent->fake_status.ipv4_dirport = ent->ipv4_dirport; ent->fake_status.ipv4_orport = ent->ipv4_orport; ent->fake_status.ipv6_orport = ent->ipv6_orport; + ent->fake_status.is_authority = !! is_authority; return ent; } @@ -465,7 +502,7 @@ trusted_dir_server_add_dirport(dir_server_t *ds, * Helper for trusted_dir_server_get_dirport: only return the exact requested * usage type. */ -static const tor_addr_port_t * +const tor_addr_port_t * trusted_dir_server_get_dirport_exact(const dir_server_t *ds, auth_dirport_usage_t usage, int addr_family) diff --git a/src/feature/nodelist/dirlist.h b/src/feature/nodelist/dirlist.h index 70bbb780d1..c17589c12e 100644 --- a/src/feature/nodelist/dirlist.h +++ b/src/feature/nodelist/dirlist.h @@ -40,6 +40,8 @@ smartlist_t *router_get_trusted_dir_servers_mutable(void); smartlist_t *router_get_fallback_dir_servers_mutable(void); void mark_all_dirservers_up(smartlist_t *server_list); +auth_dirport_usage_t auth_dirport_usage_for_purpose(int purpose); + dir_server_t *router_get_trusteddirserver_by_digest(const char *d); dir_server_t *router_get_fallback_dirserver_by_digest( const char *digest); @@ -53,6 +55,10 @@ MOCK_DECL(int, router_digest_is_trusted_dir_type, const tor_addr_port_t *trusted_dir_server_get_dirport(const dir_server_t *ds, auth_dirport_usage_t usage, int addr_family); +const tor_addr_port_t *trusted_dir_server_get_dirport_exact( + const dir_server_t *ds, + auth_dirport_usage_t usage, + int addr_family); bool router_addr_is_trusted_dir_type(const tor_addr_t *addr, dirinfo_type_t type);

1 0

[tor/master] Add support for knowing multiple HTTP DirPorts for an authority.
by dgoulet＠torproject.org 23 Apr '21

23 Apr '21

commit 4e977cce40ed95f4f25f8511eb8791072d691c93 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 23 14:09:03 2021 -0500 Add support for knowing multiple HTTP DirPorts for an authority. (These aren't yet set or used.) --- src/feature/dirclient/dir_server_st.h | 6 ++ src/feature/nodelist/dirlist.c | 110 +++++++++++++++++++++++++++++++++- src/feature/nodelist/dirlist.h | 29 +++++++++ 3 files changed, 144 insertions(+), 1 deletion(-) diff --git a/src/feature/dirclient/dir_server_st.h b/src/feature/dirclient/dir_server_st.h index 57530a571b..d1ecbcf515 100644 --- a/src/feature/dirclient/dir_server_st.h +++ b/src/feature/dirclient/dir_server_st.h @@ -16,6 +16,8 @@ #include "core/or/or.h" #include "feature/nodelist/routerstatus_st.h" +struct smartlist_t; + /** Represents information about a single trusted or fallback directory * server. */ struct dir_server_t { @@ -48,6 +50,10 @@ struct dir_server_t { time_t addr_current_at; /**< When was the document that we derived the * address information from published? */ + /** Authority only. Can be null. If present, a list of auth_dirport_t + * representing HTTP dirports for this authority. */ + struct smartlist_t *auth_dirports; + routerstatus_t fake_status; /**< Used when we need to pass this trusted * dir_server_t to * directory_request_set_routerstatus. diff --git a/src/feature/nodelist/dirlist.c b/src/feature/nodelist/dirlist.c index 423c4106e2..c9d0a991e5 100644 --- a/src/feature/nodelist/dirlist.c +++ b/src/feature/nodelist/dirlist.c @@ -43,6 +43,14 @@ #include "feature/dirclient/dir_server_st.h" #include "feature/nodelist/node_st.h" +/** Information about an (HTTP) dirport for a directory authority. */ +struct auth_dirport_t { + /** What is the intended usage for this dirport? One of AUTH_USAGE_* */ + auth_dirport_usage_t usage; + /** What is the correct address/port ? */ + tor_addr_port_t dirport; +}; + /** Global list of a dir_server_t object for each directory * authority. */ static smartlist_t *trusted_dir_servers = NULL; @@ -66,6 +74,11 @@ add_trusted_dir_to_nodelist_addr_set(const dir_server_t *dir) /* IPv6 DirPort is not a thing yet for authorities. */ nodelist_add_addr_to_address_set(&dir->ipv6_addr, dir->ipv6_orport, 0); } + if (dir->auth_dirports) { + SMARTLIST_FOREACH_BEGIN(dir->auth_dirports, const auth_dirport_t *, p) { + nodelist_add_addr_to_address_set(&p->dirport.addr, 0, p->dirport.port); + } SMARTLIST_FOREACH_END(p); + } } /** Go over the trusted directory server list and add their address(es) to the @@ -256,7 +269,10 @@ MOCK_IMPL(int, router_digest_is_trusted_dir_type, /** Return true iff the given address matches a trusted directory that matches * at least one bit of type. * - * If type is NO_DIRINFO or ALL_DIRINFO, any authority is matched. */ + * If type is NO_DIRINFO or ALL_DIRINFO, any authority is matched. + * + * Only ORPorts' addresses are considered. + */ bool router_addr_is_trusted_dir_type(const tor_addr_t *addr, dirinfo_type_t type) { @@ -404,10 +420,98 @@ trusted_dir_server_new(const char *nickname, const char *address, ipv6_addrport, digest, v3_auth_digest, type, weight); + + if (ipv4_dirport) { + tor_addr_port_t p; + memset(&p, 0, sizeof(p)); + tor_addr_copy(&p.addr, &ipv4_addr); + p.port = ipv4_dirport; + trusted_dir_server_add_dirport(result, AUTH_USAGE_LEGACY, &p); + } tor_free(hostname); return result; } +/** + * Add @a dirport as an HTTP DirPort contact point for the directory authority + * @a ds, for use when contacting that authority for the given @a usage. + * + * Multiple ports of the same usage are allowed; if present, then only + * the first one of each address family is currently used. + */ +void +trusted_dir_server_add_dirport(dir_server_t *ds, + auth_dirport_usage_t usage, + const tor_addr_port_t *dirport) +{ + tor_assert(ds); + tor_assert(dirport); + + if (BUG(! ds->is_authority)) { + return; + } + + if (ds->auth_dirports == NULL) { + ds->auth_dirports = smartlist_new(); + } + + auth_dirport_t *port = tor_malloc_zero(sizeof(auth_dirport_t)); + port->usage = usage; + tor_addr_port_copy(&port->dirport, dirport); + smartlist_add(ds->auth_dirports, port); +} + +/** + * Helper for trusted_dir_server_get_dirport: only return the exact requested + * usage type. + */ +static const tor_addr_port_t * +trusted_dir_server_get_dirport_exact(const dir_server_t *ds, + auth_dirport_usage_t usage, + int addr_family) +{ + tor_assert(ds); + tor_assert_nonfatal(addr_family == AF_INET || addr_family == AF_INET6); + if (ds->auth_dirports == NULL) + return NULL; + + SMARTLIST_FOREACH_BEGIN(ds->auth_dirports, const auth_dirport_t *, port) { + if (port->usage == usage && + tor_addr_family(&port->dirport.addr) == addr_family) { + return &port->dirport; + } + } SMARTLIST_FOREACH_END(port); + + return NULL; +} + +/** + * Return the DirPort of the authority @a ds for with the usage type + * @a usage and address family @a addr_family. If none is found, try + * again with an AUTH_USAGE_LEGACY dirport, if there is one. Return NULL + * if no port can be found. + */ +const tor_addr_port_t * +trusted_dir_server_get_dirport(const dir_server_t *ds, + auth_dirport_usage_t usage, + int addr_family) +{ + const tor_addr_port_t *port; + + while (1) { + port = trusted_dir_server_get_dirport_exact(ds, usage, addr_family); + if (port) + return port; + + // If we tried LEGACY, there is no fallback from this point. + if (usage == AUTH_USAGE_LEGACY) + return NULL; + + // Try again with LEGACY. + usage = AUTH_USAGE_LEGACY; + } +} + /** Return a new dir_server_t for a fallback directory server at * addr:or_port/dir_port, with identity key digest * id_digest */ @@ -447,6 +551,10 @@ dir_server_free_(dir_server_t *ds) if (!ds) return; + if (ds->auth_dirports) { + SMARTLIST_FOREACH(ds->auth_dirports, auth_dirport_t *, p, tor_free(p)); + smartlist_free(ds->auth_dirports); + } tor_free(ds->nickname); tor_free(ds->description); tor_free(ds->address); diff --git a/src/feature/nodelist/dirlist.h b/src/feature/nodelist/dirlist.h index ae3debf4e5..70bbb780d1 100644 --- a/src/feature/nodelist/dirlist.h +++ b/src/feature/nodelist/dirlist.h @@ -11,6 +11,28 @@ #ifndef TOR_DIRLIST_H #define TOR_DIRLIST_H +typedef struct auth_dirport_t auth_dirport_t; +/** + * Different usages for an authority's HTTP directory port. + * + * Historically, only legacy ports existed; proposal 330 added multiple types + * of dirport to better enable authorities to offload work and resist DoS + * attacks. + **/ +typedef enum auth_dirport_usage_t { + /** Flag for an authority's dirport that is intended for misc/legacy + * usage. May be used when no other dirport is available. */ + AUTH_USAGE_LEGACY, + /** Flag for an authority's dirport that is intended for descriptor uploads + * only. */ + AUTH_USAGE_UPLOAD, + /** Flag for an authority's dirport that is intended for voting only */ + AUTH_USAGE_VOTING, + /** Flag for an authority's dirport that is intended for relay downloads + * only. */ + AUTH_USAGE_DOWNLOAD, +} auth_dirport_usage_t; + int get_n_authorities(dirinfo_type_t type); const smartlist_t *router_get_trusted_dir_servers(void); const smartlist_t *router_get_fallback_dir_servers(void); @@ -28,6 +50,10 @@ MOCK_DECL(dir_server_t *, trusteddirserver_get_by_v3_auth_digest, MOCK_DECL(int, router_digest_is_trusted_dir_type, (const char *digest, dirinfo_type_t type)); +const tor_addr_port_t *trusted_dir_server_get_dirport(const dir_server_t *ds, + auth_dirport_usage_t usage, + int addr_family); + bool router_addr_is_trusted_dir_type(const tor_addr_t *addr, dirinfo_type_t type); #define router_addr_is_trusted_dir(d) \ @@ -41,6 +67,9 @@ dir_server_t *trusted_dir_server_new(const char *nickname, const char *address, const tor_addr_port_t *addrport_ipv6, const char *digest, const char *v3_auth_digest, dirinfo_type_t type, double weight); +void trusted_dir_server_add_dirport(dir_server_t *ds, + auth_dirport_usage_t usage, + const tor_addr_port_t *dirport); dir_server_t *fallback_dir_server_new(const tor_addr_t *addr, uint16_t dir_port, uint16_t or_port, const tor_addr_port_t *addrport_ipv6,

1 0

[tor/master] Add tests for parsing and selecting directory ports.
by dgoulet＠torproject.org 23 Apr '21

23 Apr '21

commit db14801b04dc27760c71ff6567c59c222459bfe6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Feb 24 13:16:07 2021 -0500 Add tests for parsing and selecting directory ports. --- src/test/include.am | 1 + src/test/test.c | 3 +- src/test/test.h | 1 + src/test/test_dirauth_ports.c | 133 ++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 137 insertions(+), 1 deletion(-) diff --git a/src/test/include.am b/src/test/include.am index cdf3b20c48..05c231b363 100644 --- a/src/test/include.am +++ b/src/test/include.am @@ -171,6 +171,7 @@ src_test_test_SOURCES += \ src/test/test_crypto_rng.c \ src/test/test_data.c \ src/test/test_dir.c \ + src/test/test_dirauth_ports.c \ src/test/test_dirvote.c \ src/test/test_dir_common.c \ src/test/test_dir_handle_get.c \ diff --git a/src/test/test.c b/src/test/test.c index ffea158141..69086d0d46 100644 --- a/src/test/test.c +++ b/src/test/test.c @@ -1,5 +1,5 @@ /* Copyright (c) 2001-2004, Roger Dingledine. -->a * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. + * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. * Copyright (c) 2007-2020, The Tor Project, Inc. */ /* See LICENSE for licensing information */ @@ -707,6 +707,7 @@ struct testgroup_t testgroups[] = { { "crypto/pem/", pem_tests }, { "crypto/rng/", crypto_rng_tests }, { "dir/", dir_tests }, + { "dir/auth/ports/", dirauth_port_tests }, { "dir/auth/process_descs/", process_descs_tests }, { "dir/md/", microdesc_tests }, { "dirauth/dirvote/", dirvote_tests}, diff --git a/src/test/test.h b/src/test/test.h index 56037648d3..0c49861eaa 100644 --- a/src/test/test.h +++ b/src/test/test.h @@ -120,6 +120,7 @@ extern struct testcase_t crypto_ope_tests[]; extern struct testcase_t crypto_openssl_tests[]; extern struct testcase_t crypto_rng_tests[]; extern struct testcase_t crypto_tests[]; +extern struct testcase_t dirauth_port_tests[]; extern struct testcase_t dir_handle_get_tests[]; extern struct testcase_t dir_tests[]; extern struct testcase_t dirvote_tests[]; diff --git a/src/test/test_dirauth_ports.c b/src/test/test_dirauth_ports.c new file mode 100644 index 0000000000..de10c7006e --- /dev/null +++ b/src/test/test_dirauth_ports.c @@ -0,0 +1,133 @@ +/* Copyright (c) 2001-2004, Roger Dingledine. + * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. + * Copyright (c) 2007-2021, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +#include "orconfig.h" +#define CONFIG_PRIVATE + +#include "core/or/or.h" +#include "feature/dirclient/dir_server_st.h" +#include "feature/nodelist/dirlist.h" +#include "app/config/config.h" +#include "test/test.h" +#include "test/log_test_helpers.h" + +static void +test_dirauth_port_parsing(void *arg) +{ + (void)arg; + + // This one is okay. + int rv = parse_dir_authority_line( + "moria1 orport=9101 " + "v3ident=D586D18309DED4CD6D57C18FDB97EFA96D330566 " + "upload=http://128.31.0.39:9131/ " + "download=http://128.31.0.39:9131 " + "vote=http://128.31.0.39:9131/ " + "128.31.0.39:9131 9695 DFC3 5FFE B861 329B 9F1A B04C 4639 7020 CE31", + NO_DIRINFO, 1); + tt_int_op(rv,OP_EQ,0); + + // These have bad syntax. + setup_capture_of_logs(LOG_WARN); + rv = parse_dir_authority_line( + "moria1 orport=9101 " + "v3ident=D586D18309DED4CD6D57C18FDB97EFA96D330566 " + "uploadx=http://128.31.0.39:9131/ " + "128.31.0.39:9131 9695 DFC3 5FFE B861 329B 9F1A B04C 4639 7020 CE31", + NO_DIRINFO, 1); + tt_int_op(rv,OP_EQ,0); + expect_log_msg_containing("Unrecognized flag"); + mock_clean_saved_logs(); + + rv = parse_dir_authority_line( + "moria1 orport=9101 " + "v3ident=D586D18309DED4CD6D57C18FDB97EFA96D330566 " + "upload=https://128.31.0.39:9131/ " // not recognized + "128.31.0.39:9131 9695 DFC3 5FFE B861 329B 9F1A B04C 4639 7020 CE31", + NO_DIRINFO, 1); + tt_int_op(rv,OP_EQ,-1); + expect_log_msg_containing("Unsupported URL scheme"); + mock_clean_saved_logs(); + + rv = parse_dir_authority_line( + "moria1 orport=9101 " + "v3ident=D586D18309DED4CD6D57C18FDB97EFA96D330566 " + "upload=http://128.31.0.39:9131/tor " // not supported + "128.31.0.39:9131 9695 DFC3 5FFE B861 329B 9F1A B04C 4639 7020 CE31", + NO_DIRINFO, 1); + tt_int_op(rv,OP_EQ,-1); + expect_log_msg_containing("Unsupported URL prefix"); + + done: + teardown_capture_of_logs(); +} + +static void +test_dirauth_port_lookup(void *arg) +{ + (void)arg; + + clear_dir_servers(); + + int rv = parse_dir_authority_line( + "moria1 orport=9101 " + "v3ident=D586D18309DED4CD6D57C18FDB97EFA96D330566 " + "upload=http://128.31.0.40:9132/ " + "download=http://128.31.0.41:9133 " + "vote=http://128.31.0.42:9134/ " + "128.31.0.39:9131 9695 DFC3 5FFE B861 329B 9F1A B04C 4639 7020 CE31", + NO_DIRINFO, 0); + tt_int_op(rv,OP_EQ,0); + + rv = parse_dir_authority_line( + "morgoth orport=9101 " + "v3ident=D586D18309DED4CDFFFFFFFFDB97EFA96D330566 " + "upload=http://128.31.0.43:9140/ " + "128.31.0.44:9131 9695 DFC3 5FFE B861 329B 9F1A B04C 4639 7020 CE31", + NO_DIRINFO, 0); + tt_int_op(rv,OP_EQ,0); + + const smartlist_t *servers = router_get_trusted_dir_servers(); + tt_assert(servers); + tt_int_op(smartlist_len(servers), OP_EQ, 2); + const dir_server_t *moria = smartlist_get(servers, 0); + const dir_server_t *morgoth = smartlist_get(servers, 1); + tt_str_op(moria->nickname, OP_EQ, "moria1"); + tt_str_op(morgoth->nickname, OP_EQ, "morgoth"); + + const tor_addr_port_t *dirport; + + dirport = trusted_dir_server_get_dirport(moria, + AUTH_USAGE_UPLOAD, AF_INET); + tt_int_op(dirport->port, OP_EQ, 9132); + dirport = trusted_dir_server_get_dirport(moria, + AUTH_USAGE_DOWNLOAD, AF_INET); + tt_int_op(dirport->port, OP_EQ, 9133); + dirport = trusted_dir_server_get_dirport(moria, + AUTH_USAGE_VOTING, AF_INET); + tt_int_op(dirport->port, OP_EQ, 9134); + + dirport = trusted_dir_server_get_dirport(morgoth, + AUTH_USAGE_UPLOAD, AF_INET); + tt_int_op(dirport->port, OP_EQ, 9140); + dirport = trusted_dir_server_get_dirport(morgoth, + AUTH_USAGE_DOWNLOAD, AF_INET); + tt_int_op(dirport->port, OP_EQ, 9131); // fallback + dirport = trusted_dir_server_get_dirport(morgoth, + AUTH_USAGE_VOTING, AF_INET); + tt_int_op(dirport->port, OP_EQ, 9131); // fallback + + done: + ; +} + +#define T(name) \ + { #name, test_dirauth_port_ ## name, TT_FORK, NULL, NULL } + +struct testcase_t dirauth_port_tests[] = { + T(parsing), + T(lookup), + END_OF_TESTCASES +};

1 0

[tor/master] Merge branch 'tor-gitlab/mr/327'
by dgoulet＠torproject.org 23 Apr '21

23 Apr '21

commit 3bd7367274576ca1b2229561e34044f86e26d337 Merge: 973fcf056a ebb826f4a1 Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Apr 23 12:48:55 2021 -0400 Merge branch 'tor-gitlab/mr/327' Conflicts: src/test/test.c Minor comment issue. src/app/config/config.c | 96 ++++++++++++++++++++- src/feature/dirclient/dir_server_st.h | 6 ++ src/feature/dirclient/dirclient.c | 38 ++++++++- src/feature/nodelist/dirlist.c | 147 +++++++++++++++++++++++++++++++- src/feature/nodelist/dirlist.h | 35 ++++++++ src/test/include.am | 1 + src/test/test.c | 2 +- src/test/test.h | 1 + src/test/test_dirauth_ports.c | 152 ++++++++++++++++++++++++++++++++++ 9 files changed, 472 insertions(+), 6 deletions(-) diff --cc src/test/test.c index 40c053a660,69086d0d46..9543a24376 --- a/src/test/test.c +++ b/src/test/test.c @@@ -1,6 -1,6 +1,5 @@@ /* Copyright (c) 2001-2004, Roger Dingledine. - ->a * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson. - * Copyright (c) 2007-2020, The Tor Project, Inc. */ + * Copyright (c) 2007-2021, The Tor Project, Inc. */ /* See LICENSE for licensing information */ /**

1 0