July 2021 - tor-commits - lists.torproject.org

[translation/bridgedb] https://gitweb.torproject.org/translation.git/commit/?h=bridgedb
by translation＠torproject.org 28 Jul '21

28 Jul '21

commit 30000782e5975eb3c35eb3c3a1af4290e9e34d5b Author: Translation commit bot <translation(a)torproject.org> Date: Wed Jul 28 09:15:05 2021 +0000 https://gitweb.torproject.org/translation.git/commit/?h=bridgedb --- hu/LC_MESSAGES/bridgedb.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hu/LC_MESSAGES/bridgedb.po b/hu/LC_MESSAGES/bridgedb.po index 946e387451..1d0d218793 100644 --- a/hu/LC_MESSAGES/bridgedb.po +++ b/hu/LC_MESSAGES/bridgedb.po @@ -15,7 +15,7 @@ msgstr "" "Project-Id-Version: Tor Project\n" "Report-Msgid-Bugs-To: 'https://trac.torproject.org/projects/tor/newticket?component=BridgeDB&keywo…'\n" "POT-Creation-Date: 2020-05-14 14:21-0700\n" -"PO-Revision-Date: 2021-07-26 21:10+0000\n" +"PO-Revision-Date: 2021-07-28 09:03+0000\n" "Last-Translator: vargaviktor <viktor.varga(a)gmail.com>\n" "Language-Team: Hungarian (http://www.transifex.com/otf/torproject/language/hu/)\n" "MIME-Version: 1.0\n" @@ -235,7 +235,7 @@ msgid "" "Pluggable Transports %s which maybe doesn't sound as cool, but they can still\n" "help to circumvent internet censorship in many cases.\n" "\n" -msgstr "Ezen felül, BridgeDB -nek van sok régi módi \"vanília\" hídjai %s melyek Csatlakoztatható Szállítók %s nélkül vannak\nmely talán nem hallatszik szuperül, de ők még mindig\ntudnak segíteni kikerülni az internet cenzúráját.\n\n" +msgstr "Ezen felül, BridgeDB -nek van sok régi módi \"vanília\" hídjai %s melyek cserélhető átvitel %s nélküliek\nmely talán nem hallatszanak szuperül, de ők még mindig\ntudnak segíteni kikerülni az internet cenzúráját.\n\n" #: bridgedb/strings.py:78 bridgedb/test/test_https.py:356 msgid "What are bridges?"

1 0

[tor/main] Preemptive circuits for HSes should now be vanguard circuits
by asn＠torproject.org 28 Jul '21

28 Jul '21

commit 0240c00929dff8451b42ef313f5345e15ce4da06 Author: George Kadianakis <desnacked(a)riseup.net> Date: Thu Jul 1 17:50:41 2021 +0300 Preemptive circuits for HSes should now be vanguard circuits Co-authored-by: Mike Perry <mikeperry-git(a)torproject.org> --- src/core/or/circuituse.c | 26 +++++--------------------- 1 file changed, 5 insertions(+), 21 deletions(-) diff --git a/src/core/or/circuituse.c b/src/core/or/circuituse.c index 98ff4c252f..adf9e12ed5 100644 --- a/src/core/or/circuituse.c +++ b/src/core/or/circuituse.c @@ -1204,25 +1204,6 @@ needs_circuits_for_build(int num) return 0; } -/** - * Launch the appropriate type of predicted circuit for hidden - * services, depending on our options. - */ -static void -circuit_launch_predicted_hs_circ(int flags) -{ - /* K.I.S.S. implementation of bug #23101: If we are using - * vanguards or pinned middles, pre-build a specific purpose - * for HS circs. */ - if (circuit_should_use_vanguards(CIRCUIT_PURPOSE_HS_VANGUARDS)) { - circuit_launch(CIRCUIT_PURPOSE_HS_VANGUARDS, flags); - } else { - /* If no vanguards, then no HS-specific prebuilt circuits are needed. - * Normal GENERAL circs are fine */ - circuit_launch(CIRCUIT_PURPOSE_C_GENERAL, flags); - } -} - /** Determine how many circuits we have open that are clean, * Make sure it's enough for all the upcoming behaviors we predict we'll have. * But put an upper bound on the total number of circuits. @@ -1276,7 +1257,7 @@ circuit_predict_and_launch_new(void) "Have %d clean circs (%d internal), need another internal " "circ for my hidden service.", num, num_internal); - circuit_launch_predicted_hs_circ(flags); + circuit_launch(CIRCUIT_PURPOSE_HS_VANGUARDS, flags); return; } @@ -1295,7 +1276,10 @@ circuit_predict_and_launch_new(void) " another hidden service circ.", num, num_uptime_internal, num_internal); - circuit_launch_predicted_hs_circ(flags); + /* Always launch vanguards purpose circuits for HS clients, + * for vanguards-lite. This prevents us from cannibalizing + * to build these circuits (and thus not use vanguards). */ + circuit_launch(CIRCUIT_PURPOSE_HS_VANGUARDS, flags); return; }

1 0

[tor/main] Use L2 vanguards during path selection
by asn＠torproject.org 28 Jul '21

28 Jul '21

commit e23947716e227a9888690b9fca7a5069038d4c0f Author: George Kadianakis <desnacked(a)riseup.net> Date: Thu Jul 1 17:49:27 2021 +0300 Use L2 vanguards during path selection Co-authored-by: Mike Perry <mikeperry-git(a)torproject.org> --- src/core/or/circuitbuild.c | 12 +++++++++--- src/core/or/circuituse.c | 12 ++++-------- src/feature/nodelist/networkstatus.c | 3 +++ 3 files changed, 16 insertions(+), 11 deletions(-) diff --git a/src/core/or/circuitbuild.c b/src/core/or/circuitbuild.c index f2f3bb5b34..c1667d7260 100644 --- a/src/core/or/circuitbuild.c +++ b/src/core/or/circuitbuild.c @@ -2259,8 +2259,9 @@ middle_node_must_be_vanguard(const or_options_t *options, return 0; } - /* If we have sticky L2 nodes, and this is an L2 pick, use vanguards */ - if (options->HSLayer2Nodes && cur_len == 1) { + /* If we are a hidden service circuit, always use either vanguards-lite + * or HSLayer2Nodes for 2nd hop. */ + if (cur_len == 1) { return 1; } @@ -2284,7 +2285,8 @@ pick_vanguard_middle_node(const or_options_t *options, /* Pick the right routerset based on the current hop */ if (cur_len == 1) { - vanguard_routerset = options->HSLayer2Nodes; + vanguard_routerset = options->HSLayer2Nodes ? + options->HSLayer2Nodes : get_layer2_guards(); } else if (cur_len == 2) { vanguard_routerset = options->HSLayer3Nodes; } else { @@ -2293,6 +2295,10 @@ pick_vanguard_middle_node(const or_options_t *options, return NULL; } + if (BUG(!vanguard_routerset)) { + return NULL; + } + node = pick_restricted_middle_node(flags, vanguard_routerset, options->ExcludeNodes, excluded, cur_len+1); diff --git a/src/core/or/circuituse.c b/src/core/or/circuituse.c index 044b30b8b3..98ff4c252f 100644 --- a/src/core/or/circuituse.c +++ b/src/core/or/circuituse.c @@ -2022,16 +2022,12 @@ circuit_is_hs_v3(const circuit_t *circ) int circuit_should_use_vanguards(uint8_t purpose) { - const or_options_t *options = get_options(); - - /* Only hidden service circuits use vanguards */ - if (!circuit_purpose_is_hidden_service(purpose)) - return 0; - - /* Pinned middles are effectively vanguards */ - if (options->HSLayer2Nodes || options->HSLayer3Nodes) + /* All hidden service circuits use either vanguards or + * vanguards-lite. */ + if (circuit_purpose_is_hidden_service(purpose)) return 1; + /* Everything else is a normal circuit */ return 0; } diff --git a/src/feature/nodelist/networkstatus.c b/src/feature/nodelist/networkstatus.c index 2ffa6da1a3..7a1e73ef60 100644 --- a/src/feature/nodelist/networkstatus.c +++ b/src/feature/nodelist/networkstatus.c @@ -1699,6 +1699,9 @@ notify_after_networkstatus_changes(void) channelpadding_new_consensus_params(c); circpad_new_consensus_params(c); router_new_consensus_params(c); + + /* Maintenance of our L2 guard list */ + maintain_layer2_guards(); } /** Copy all the ancillary information (like router download status and so on)

1 0

[tor/main] Special vanguard L3 increased path length does not apply for vanguards-lite
by asn＠torproject.org 28 Jul '21

28 Jul '21

commit 9afd9d09404200ed149abeeaad9efd3a1542f7e0 Author: George Kadianakis <desnacked(a)riseup.net> Date: Thu Jul 1 17:52:58 2021 +0300 Special vanguard L3 increased path length does not apply for vanguards-lite Co-authored-by: Mike Perry <mikeperry-git(a)torproject.org> --- src/core/or/circuitbuild.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/src/core/or/circuitbuild.c b/src/core/or/circuitbuild.c index c1667d7260..5cb647bd02 100644 --- a/src/core/or/circuitbuild.c +++ b/src/core/or/circuitbuild.c @@ -1359,7 +1359,9 @@ route_len_for_purpose(uint8_t purpose, extend_info_t *exit_ei) int routelen = DEFAULT_ROUTE_LEN; int known_purpose = 0; - if (circuit_should_use_vanguards(purpose)) { + /* If we're using L3 vanguards, we need longer paths for onion services */ + if (circuit_purpose_is_hidden_service(purpose) && + get_options()->HSLayer3Nodes) { /* Clients want an extra hop for rends to avoid linkability. * Services want it for intro points to avoid publishing their * layer3 guards. They want it for hsdir posts to use @@ -1374,14 +1376,6 @@ route_len_for_purpose(uint8_t purpose, extend_info_t *exit_ei) purpose == CIRCUIT_PURPOSE_S_ESTABLISH_INTRO) return routelen+1; - /* If we only have Layer2 vanguards, then we do not need - * the extra hop for linkabilty reasons (see below). - * This means all hops can be of the form: - * S/C - G - L2 - M - R/HSDir/I - */ - if (get_options()->HSLayer2Nodes && !get_options()->HSLayer3Nodes) - return routelen+1; - /* For connections to hsdirs, clients want two extra hops * when using layer3 guards, to avoid linkability. * Same goes for intro points. Note that the route len

1 0

[tor/main] Introduce vanguards-lite subsystem and some of its entry points
by asn＠torproject.org 28 Jul '21

28 Jul '21

commit 314a6b42c59c7d9ea240b758ccffd796963efd0f Author: George Kadianakis <desnacked(a)riseup.net> Date: Thu Jul 1 17:42:34 2021 +0300 Introduce vanguards-lite subsystem and some of its entry points Co-authored-by: Mike Perry <mikeperry-git(a)torproject.org> --- changes/ticket40363 | 9 ++ src/core/mainloop/mainloop.c | 20 ++++ src/feature/client/entrynodes.c | 202 ++++++++++++++++++++++++++++++++++++++++ src/feature/client/entrynodes.h | 4 + src/test/test_entrynodes.c | 25 +++++ 5 files changed, 260 insertions(+) diff --git a/changes/ticket40363 b/changes/ticket40363 new file mode 100644 index 0000000000..240cbf8680 --- /dev/null +++ b/changes/ticket40363 @@ -0,0 +1,9 @@ + o Major features (Proposal 332, onion services, guard selection algorithm): + - Clients and onion services now choose four long-lived "layer 2" guard + relays for use as the middle hop in all onion circuits. These relays are + kept in place for a randomized duration averaging 1 week each. This + mitigates guard discovery attacks against clients and short-lived onion + services such as OnionShare. Long-lived onion services that need high + security should still use the Vanguards addon + (https://github.com/mikeperry-tor/vanguards) Closes ticket 40363; + implements proposal 332. diff --git a/src/core/mainloop/mainloop.c b/src/core/mainloop/mainloop.c index 69606c0d53..68e8ee8f20 100644 --- a/src/core/mainloop/mainloop.c +++ b/src/core/mainloop/mainloop.c @@ -1293,6 +1293,7 @@ signewnym_impl(time_t now) circuit_mark_all_dirty_circs_as_unusable(); addressmap_clear_transient(); hs_client_purge_state(); + purge_vanguards_lite(); time_of_last_signewnym = now; signewnym_is_pending = 0; @@ -1370,6 +1371,7 @@ CALLBACK(save_state); CALLBACK(write_stats_file); CALLBACK(control_per_second_events); CALLBACK(second_elapsed); +CALLBACK(manage_vglite); #undef CALLBACK @@ -1392,6 +1394,9 @@ STATIC periodic_event_item_t mainloop_periodic_events[] = { CALLBACK(second_elapsed, NET_PARTICIPANT, FL(RUN_ON_DISABLE)), + /* Update vanguards-lite once per hour, if we have networking */ + CALLBACK(manage_vglite, NET_PARTICIPANT, FL(NEED_NET)), + /* XXXX Do we have a reason to do this on a callback? Does it do any good at * all? For now, if we're dormant, we can let our listeners decay. */ CALLBACK(retry_listeners, NET_PARTICIPANT, FL(NEED_NET)), @@ -1662,6 +1667,21 @@ mainloop_schedule_shutdown(int delay_sec) mainloop_event_schedule(scheduled_shutdown_ev, &delay_tv); } +/** + * Update vanguards-lite layer2 nodes, once per hour + */ +static int +manage_vglite_callback(time_t now, const or_options_t *options) +{ + (void)now; + (void)options; +#define VANGUARDS_LITE_INTERVAL (60*60) + + maintain_layer2_guards(); + + return VANGUARDS_LITE_INTERVAL; +} + /** Perform regular maintenance tasks. This function gets run once per * second. */ diff --git a/src/feature/client/entrynodes.c b/src/feature/client/entrynodes.c index 502cb99690..58faa8033c 100644 --- a/src/feature/client/entrynodes.c +++ b/src/feature/client/entrynodes.c @@ -3930,6 +3930,197 @@ guard_selection_free_(guard_selection_t *gs) tor_free(gs); } +/**********************************************************************/ + +/** Layer2 guard subsystem used for client-side onion service circuits. */ + +/** A simple representation of a layer2 guard. We just need its identity so + * that we feed it into a routerset, and a sampled timestamp to do expiration + * checks. */ +typedef struct layer2_guard_t { + /** Identity of the guard */ + char identity[DIGEST_LEN]; + /** When does this guard expire? (randomized timestamp) */ + time_t expire_on_date; +} layer2_guard_t; + +/** Global list and routerset of L2 guards. They are both synced and they get + * updated periodically. We need both the list and the routerset: we use the + * smartlist to keep track of expiration times and the routerset is what we + * return to the users of this subsystem. */ +static smartlist_t *layer2_guards = NULL; +static routerset_t *layer2_routerset = NULL; + +/** Number of L2 guards */ +#define NUMBER_SECOND_GUARDS 4 +/** Lifetime of L2 guards: + * 1 to 12 days, for an average of a week using the max(x,x) distribution */ +#define MIN_SECOND_GUARD_LIFETIME (3600*24) +#define MAX_SECOND_GUARD_LIFETIME (3600*24*12) + +/** Return the number of guards our L2 guardset should have */ +static int +get_number_of_layer2_hs_guards(void) +{ + return (int) networkstatus_get_param(NULL, + "guard-hs-l2-number", + NUMBER_SECOND_GUARDS, + 1, INT32_MAX); +} + +/** Return the minimum lifetime of L2 guards */ +static int +get_min_lifetime_of_layer2_hs_guards(void) +{ + return (int) networkstatus_get_param(NULL, + "guard-hs-l2-lifetime-min", + MIN_SECOND_GUARD_LIFETIME, + 1, INT32_MAX); +} + +/** Return the maximum lifetime of L2 guards */ +static int +get_max_lifetime_of_layer2_hs_guards(void) +{ + return (int) networkstatus_get_param(NULL, + "guard-hs-l2-lifetime-max", + MAX_SECOND_GUARD_LIFETIME, + 1, INT32_MAX); +} + +/** + * Sample and return a lifetime for an L2 guard. + * + * Lifetime randomized uniformly between min and max consensus params. + */ +static int +get_layer2_hs_guard_lifetime(void) +{ + return crypto_rand_int_range(get_min_lifetime_of_layer2_hs_guards(), + get_max_lifetime_of_layer2_hs_guards()); +} + +/** Maintain the L2 guard list. Make sure the list contains enough guards, do + * expirations as necessary, and keep all the data structures of this + * subsystem synchronized */ +void +maintain_layer2_guards(void) +{ + if (!router_have_minimum_dir_info()) { + return; + } + + /* Create the list if it doesn't exist */ + if (!layer2_guards) { + layer2_guards = smartlist_new(); + } + + /* Go through the list and perform any needed expirations */ + SMARTLIST_FOREACH_BEGIN(layer2_guards, layer2_guard_t *, g) { + /* Expire based on expiration date */ + if (g->expire_on_date <= approx_time()) { + log_info(LD_GENERAL, "Removing expired Layer2 guard %s", + safe_str_client(hex_str(g->identity, DIGEST_LEN))); + // Nickname may be gone from consensus and doesn't matter anyway + control_event_guard("None", g->identity, "BAD_L2"); + tor_free(g); + SMARTLIST_DEL_CURRENT_KEEPORDER(layer2_guards, g); + continue; + } + + /* Expire if relay has left consensus */ + if (router_get_consensus_status_by_id(g->identity) == NULL) { + log_info(LD_GENERAL, "Removing missing Layer2 guard %s", + safe_str_client(hex_str(g->identity, DIGEST_LEN))); + // Nickname may be gone from consensus and doesn't matter anyway + control_event_guard("None", g->identity, "BAD_L2"); + tor_free(g); + SMARTLIST_DEL_CURRENT_KEEPORDER(layer2_guards, g); + continue; + } + } SMARTLIST_FOREACH_END(g); + + /* Find out how many guards we need to add */ + int new_guards_needed_n = + get_number_of_layer2_hs_guards() - smartlist_len(layer2_guards); + if (new_guards_needed_n <= 0) { + return; + } + + log_info(LD_GENERAL, "Adding %d guards to Layer2 routerset", + new_guards_needed_n); + + /* Add required guards to the list */ + for (int i = 0; i < new_guards_needed_n; i++) { + const node_t *choice = NULL; + const or_options_t *options = get_options(); + /* Pick Stable nodes */ + router_crn_flags_t flags = CRN_NEED_DESC|CRN_NEED_UPTIME; + choice = router_choose_random_node(NULL, options->ExcludeNodes, flags); + if (choice) { + /* We found our node: create an L2 guard out of it */ + layer2_guard_t *layer2_guard = tor_malloc_zero(sizeof(layer2_guard_t)); + memcpy(layer2_guard->identity, choice->identity, DIGEST_LEN); + layer2_guard->expire_on_date = approx_time() + + get_layer2_hs_guard_lifetime(); + smartlist_add(layer2_guards, layer2_guard); + log_info(LD_GENERAL, "Adding Layer2 guard %s", + safe_str_client(hex_str(layer2_guard->identity, DIGEST_LEN))); + // Nickname can also be None here because it is looked up later + control_event_guard("None", layer2_guard->identity, + "GOOD_L2"); + } + } + + /* Now that the list is up to date, synchronize the routerset */ + routerset_free(layer2_routerset); + layer2_routerset = routerset_new(); + + SMARTLIST_FOREACH_BEGIN (layer2_guards, layer2_guard_t *, g) { + routerset_parse(layer2_routerset, + hex_str(g->identity, DIGEST_LEN), + "l2 guards"); + } SMARTLIST_FOREACH_END(g); +} + +/** + * Reset vanguards-lite list(s). + * + * Used for SIGNAL NEWNYM. + */ +void +purge_vanguards_lite(void) +{ + if (!layer2_guards) + return; + + /* Go through the list and perform any needed expirations */ + SMARTLIST_FOREACH_BEGIN(layer2_guards, layer2_guard_t *, g) { + tor_free(g); + } SMARTLIST_FOREACH_END(g); + + smartlist_clear(layer2_guards); + + /* Pick new l2 guards */ + maintain_layer2_guards(); +} + +/** Return a routerset containing the L2 guards or NULL if it's not yet + * initialized. Callers must not free the routerset. Designed for use in + * pick_vanguard_middle_node() and should not be used anywhere else (because + * the routerset pointer can dangle under your feet) */ +routerset_t * +get_layer2_guards(void) +{ + if (!layer2_guards) { + maintain_layer2_guards(); + } + + return layer2_routerset; +} + +/*****************************************************************************/ + /** Release all storage held by the list of entry guards and related * memory structs. */ void @@ -3946,4 +4137,15 @@ entry_guards_free_all(void) guard_contexts = NULL; } circuit_build_times_free_timeouts(get_circuit_build_times_mutable()); + + if (!layer2_guards) { + return; + } + + SMARTLIST_FOREACH_BEGIN(layer2_guards, layer2_guard_t *, g) { + tor_free(g); + } SMARTLIST_FOREACH_END(g); + + smartlist_free(layer2_guards); + routerset_free(layer2_routerset); } diff --git a/src/feature/client/entrynodes.h b/src/feature/client/entrynodes.h index 88ed8f649e..c1bc5b41c1 100644 --- a/src/feature/client/entrynodes.h +++ b/src/feature/client/entrynodes.h @@ -651,4 +651,8 @@ guard_get_guardfraction_bandwidth(guardfraction_bandwidth_t *guardfraction_bw, int orig_bandwidth, uint32_t guardfraction_percentage); +routerset_t *get_layer2_guards(void); +void maintain_layer2_guards(void); +void purge_vanguards_lite(void); + #endif /* !defined(TOR_ENTRYNODES_H) */ diff --git a/src/test/test_entrynodes.c b/src/test/test_entrynodes.c index c94b5d6a23..785ce296d3 100644 --- a/src/test/test_entrynodes.c +++ b/src/test/test_entrynodes.c @@ -92,6 +92,12 @@ bfn_mock_node_get_by_id(const char *id) return NULL; } +static int +mock_router_have_minimum_dir_info(void) +{ + return 1; +} + /* Helper function to free a test node. */ static void test_node_free(node_t *n) @@ -3087,6 +3093,23 @@ test_entry_guard_vanguard_path_selection(void *arg) circuit_free_(circ); } +static void +test_entry_guard_layer2_guards(void *arg) +{ + (void) arg; + MOCK(router_have_minimum_dir_info, mock_router_have_minimum_dir_info); + + /* Create the guardset */ + maintain_layer2_guards(); + + routerset_t *l2_guards = get_layer2_guards(); + tt_assert(l2_guards); + tt_int_op(routerset_len(l2_guards), OP_EQ, 4); + + done: + UNMOCK(router_have_minimum_dir_info); +} + static const struct testcase_setup_t big_fake_network = { big_fake_network_setup, big_fake_network_cleanup }; @@ -3152,6 +3175,8 @@ struct testcase_t entrynodes_tests[] = { BFN_TEST(manage_primary), BFN_TEST(correct_cascading_order), + BFN_TEST(layer2_guards), + EN_TEST_FORK(guard_preferred), BFN_TEST(select_for_circuit_no_confirmed),

1 0

[tor/main] Simplify cannibalization logic now that all HS is vanguards
by asn＠torproject.org 28 Jul '21

28 Jul '21

commit 52c5b8aa12cc613e145600826965917ae10b7cbb Author: George Kadianakis <desnacked(a)riseup.net> Date: Thu Jul 1 17:56:56 2021 +0300 Simplify cannibalization logic now that all HS is vanguards Co-authored-by: Mike Perry <mikeperry-git(a)torproject.org> --- src/core/or/circuituse.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/src/core/or/circuituse.c b/src/core/or/circuituse.c index adf9e12ed5..2ec391eca0 100644 --- a/src/core/or/circuituse.c +++ b/src/core/or/circuituse.c @@ -2049,13 +2049,11 @@ circuit_should_cannibalize_to_build(uint8_t purpose_to_build, return 0; } - /* For vanguards, the server-side intro circ is not cannibalized - * because we pre-build 4 hop HS circuits, and it only needs a 3 hop - * circuit. It is also long-lived, so it is more important that - * it have lower latency than get built fast. + /* The server-side intro circ is not cannibalized because it only + * needs a 3 hop circuit. It is also long-lived, so it is more + * important that it have lower latency than get built fast. */ - if (circuit_should_use_vanguards(purpose_to_build) && - purpose_to_build == CIRCUIT_PURPOSE_S_ESTABLISH_INTRO) { + if (purpose_to_build == CIRCUIT_PURPOSE_S_ESTABLISH_INTRO) { return 0; }

1 0

[tor/main] Code improvements
by asn＠torproject.org 28 Jul '21

28 Jul '21

commit 1f87269cf47e2c01ef500405a971b17130c8bb72 Author: George Kadianakis <desnacked(a)riseup.net> Date: Tue Jul 6 13:22:59 2021 +0300 Code improvements --- src/feature/client/entrynodes.c | 17 ++++++++++++----- src/feature/client/entrynodes.h | 2 +- src/test/test_entrynodes.c | 2 +- 3 files changed, 14 insertions(+), 7 deletions(-) diff --git a/src/feature/client/entrynodes.c b/src/feature/client/entrynodes.c index 58faa8033c..5c6152449a 100644 --- a/src/feature/client/entrynodes.c +++ b/src/feature/client/entrynodes.c @@ -3996,8 +3996,14 @@ get_max_lifetime_of_layer2_hs_guards(void) static int get_layer2_hs_guard_lifetime(void) { - return crypto_rand_int_range(get_min_lifetime_of_layer2_hs_guards(), - get_max_lifetime_of_layer2_hs_guards()); + int min = get_min_lifetime_of_layer2_hs_guards(); + int max = get_max_lifetime_of_layer2_hs_guards(); + + if (BUG(min >= max)) { + return min; + } + + return crypto_rand_int_range(min, max); } /** Maintain the L2 guard list. Make sure the list contains enough guards, do @@ -4107,9 +4113,10 @@ purge_vanguards_lite(void) /** Return a routerset containing the L2 guards or NULL if it's not yet * initialized. Callers must not free the routerset. Designed for use in - * pick_vanguard_middle_node() and should not be used anywhere else (because - * the routerset pointer can dangle under your feet) */ -routerset_t * + * pick_vanguard_middle_node() and should not be used anywhere else. Do not + * store this pointer -- any future calls to maintain_layer2_guards() and + * purge_vanguards_lite() can invalidate it. */ +const routerset_t * get_layer2_guards(void) { if (!layer2_guards) { diff --git a/src/feature/client/entrynodes.h b/src/feature/client/entrynodes.h index c1bc5b41c1..9c38c2b5f8 100644 --- a/src/feature/client/entrynodes.h +++ b/src/feature/client/entrynodes.h @@ -651,7 +651,7 @@ guard_get_guardfraction_bandwidth(guardfraction_bandwidth_t *guardfraction_bw, int orig_bandwidth, uint32_t guardfraction_percentage); -routerset_t *get_layer2_guards(void); +const routerset_t *get_layer2_guards(void); void maintain_layer2_guards(void); void purge_vanguards_lite(void); diff --git a/src/test/test_entrynodes.c b/src/test/test_entrynodes.c index 785ce296d3..4d353e8480 100644 --- a/src/test/test_entrynodes.c +++ b/src/test/test_entrynodes.c @@ -3102,7 +3102,7 @@ test_entry_guard_layer2_guards(void *arg) /* Create the guardset */ maintain_layer2_guards(); - routerset_t *l2_guards = get_layer2_guards(); + const routerset_t *l2_guards = get_layer2_guards(); tt_assert(l2_guards); tt_int_op(routerset_len(l2_guards), OP_EQ, 4);

1 0

[tor/main] Service intro circuits are now 4-hop to avoid linkability by intro
by asn＠torproject.org 28 Jul '21

28 Jul '21

commit 7ec9a68477d3c5b6937fa39445dc6b95415abb39 Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon Jul 12 11:23:00 2021 +0300 Service intro circuits are now 4-hop to avoid linkability by intro Now the circuits look like this: client rend: C -> G -> L2 -> Rend client intro: C -> G -> L2 -> M -> Intro client hsdir: C -> G -> L2 -> M -> HSDir service rend: C -> G -> L2 -> M -> Rend service intro: C -> G -> L2 -> M -> Intro service hsdir: C -> G -> L2 -> M -> HSDir --- src/core/or/circuitbuild.c | 11 ++++++----- src/test/test_circuitbuild.c | 2 +- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/src/core/or/circuitbuild.c b/src/core/or/circuitbuild.c index 5cb647bd02..84a8bec421 100644 --- a/src/core/or/circuitbuild.c +++ b/src/core/or/circuitbuild.c @@ -1394,16 +1394,14 @@ route_len_for_purpose(uint8_t purpose, extend_info_t *exit_ei) return routelen; switch (purpose) { - /* These two purposes connect to a router that we chose, so - * DEFAULT_ROUTE_LEN is safe. */ - case CIRCUIT_PURPOSE_S_ESTABLISH_INTRO: - /* hidden service connecting to introduction point */ + /* These purposes connect to a router that we chose, so DEFAULT_ROUTE_LEN + * is safe: */ case CIRCUIT_PURPOSE_TESTING: /* router reachability testing */ known_purpose = 1; break; - /* These three purposes connect to a router that someone else + /* These purposes connect to a router that someone else * might have chosen, so add an extra hop to protect anonymity. */ case CIRCUIT_PURPOSE_C_GENERAL: case CIRCUIT_PURPOSE_C_HSDIR_GET: @@ -1413,6 +1411,9 @@ route_len_for_purpose(uint8_t purpose, extend_info_t *exit_ei) /* client connecting to introduction point */ case CIRCUIT_PURPOSE_S_CONNECT_REND: /* hidden service connecting to rendezvous point */ + case CIRCUIT_PURPOSE_S_ESTABLISH_INTRO: + /* hidden service connecting to intro point. In this case we want an extra + hop to avoid linkability attacks by the introduction point. */ known_purpose = 1; routelen++; break; diff --git a/src/test/test_circuitbuild.c b/src/test/test_circuitbuild.c index 873391a84f..0a5c3530bd 100644 --- a/src/test/test_circuitbuild.c +++ b/src/test/test_circuitbuild.c @@ -113,7 +113,7 @@ test_new_route_len_safe_exit(void *arg) /* hidden service connecting to introduction point */ r = new_route_len(CIRCUIT_PURPOSE_S_ESTABLISH_INTRO, &dummy_ei, &dummy_nodes); - tt_int_op(DEFAULT_ROUTE_LEN, OP_EQ, r); + tt_int_op(DEFAULT_ROUTE_LEN+1, OP_EQ, r); /* router testing its own reachability */ r = new_route_len(CIRCUIT_PURPOSE_TESTING, &dummy_ei, &dummy_nodes);

1 0

[tor/main] Don't double-pick L2 nodes
by asn＠torproject.org 28 Jul '21

28 Jul '21

commit a77727cdca35bb272794ee863790d36c8db45caf Author: George Kadianakis <desnacked(a)riseup.net> Date: Fri Jul 9 16:48:26 2021 +0300 Don't double-pick L2 nodes --- src/feature/client/entrynodes.c | 36 ++++++++++++++++++++++-------------- 1 file changed, 22 insertions(+), 14 deletions(-) diff --git a/src/feature/client/entrynodes.c b/src/feature/client/entrynodes.c index 5c6152449a..fddb7b8f0f 100644 --- a/src/feature/client/entrynodes.c +++ b/src/feature/client/entrynodes.c @@ -3932,7 +3932,7 @@ guard_selection_free_(guard_selection_t *gs) /**********************************************************************/ -/** Layer2 guard subsystem used for client-side onion service circuits. */ +/** Layer2 guard subsystem used for onion service circuits. */ /** A simple representation of a layer2 guard. We just need its identity so * that we feed it into a routerset, and a sampled timestamp to do expiration @@ -4057,27 +4057,35 @@ maintain_layer2_guards(void) new_guards_needed_n); /* Add required guards to the list */ + smartlist_t *excluded = smartlist_new(); for (int i = 0; i < new_guards_needed_n; i++) { const node_t *choice = NULL; const or_options_t *options = get_options(); /* Pick Stable nodes */ router_crn_flags_t flags = CRN_NEED_DESC|CRN_NEED_UPTIME; - choice = router_choose_random_node(NULL, options->ExcludeNodes, flags); - if (choice) { - /* We found our node: create an L2 guard out of it */ - layer2_guard_t *layer2_guard = tor_malloc_zero(sizeof(layer2_guard_t)); - memcpy(layer2_guard->identity, choice->identity, DIGEST_LEN); - layer2_guard->expire_on_date = approx_time() + - get_layer2_hs_guard_lifetime(); - smartlist_add(layer2_guards, layer2_guard); - log_info(LD_GENERAL, "Adding Layer2 guard %s", - safe_str_client(hex_str(layer2_guard->identity, DIGEST_LEN))); - // Nickname can also be None here because it is looked up later - control_event_guard("None", layer2_guard->identity, - "GOOD_L2"); + choice = router_choose_random_node(excluded, options->ExcludeNodes, flags); + if (!choice) { + break; } + + /* We found our node: create an L2 guard out of it */ + layer2_guard_t *layer2_guard = tor_malloc_zero(sizeof(layer2_guard_t)); + memcpy(layer2_guard->identity, choice->identity, DIGEST_LEN); + layer2_guard->expire_on_date = approx_time() + + get_layer2_hs_guard_lifetime(); + smartlist_add(layer2_guards, layer2_guard); + log_info(LD_GENERAL, "Adding Layer2 guard %s", + safe_str_client(hex_str(layer2_guard->identity, DIGEST_LEN))); + // Nickname can also be None here because it is looked up later + control_event_guard("None", layer2_guard->identity, + "GOOD_L2"); + /* Exclude this node and its family so that we don't double-pick. */ + nodelist_add_node_and_family(excluded, choice); } + /* Some cleanup */ + smartlist_free(excluded); + /* Now that the list is up to date, synchronize the routerset */ routerset_free(layer2_routerset); layer2_routerset = routerset_new();

1 0

[tor/main] Add layer2_guard_free()
by asn＠torproject.org 28 Jul '21

28 Jul '21

commit 9b464cdc364755fb00b544c31a1e75500a3b84d3 Author: George Kadianakis <desnacked(a)riseup.net> Date: Fri Jul 9 16:54:24 2021 +0300 Add layer2_guard_free() --- src/feature/client/entrynodes.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/src/feature/client/entrynodes.c b/src/feature/client/entrynodes.c index fddb7b8f0f..1e9416c9cf 100644 --- a/src/feature/client/entrynodes.c +++ b/src/feature/client/entrynodes.c @@ -3944,6 +3944,19 @@ typedef struct layer2_guard_t { time_t expire_on_date; } layer2_guard_t; +#define layer2_guard_free(val) \ + FREE_AND_NULL(layer2_guard_t, layer2_guard_free_, (val)) + +static void +layer2_guard_free_(layer2_guard_t *l2) +{ + if (!l2) { + return; + } + + tor_free(l2); +} + /** Global list and routerset of L2 guards. They are both synced and they get * updated periodically. We need both the list and the routerset: we use the * smartlist to keep track of expiration times and the routerset is what we @@ -4029,7 +4042,7 @@ maintain_layer2_guards(void) safe_str_client(hex_str(g->identity, DIGEST_LEN))); // Nickname may be gone from consensus and doesn't matter anyway control_event_guard("None", g->identity, "BAD_L2"); - tor_free(g); + layer2_guard_free(g); SMARTLIST_DEL_CURRENT_KEEPORDER(layer2_guards, g); continue; } @@ -4040,7 +4053,7 @@ maintain_layer2_guards(void) safe_str_client(hex_str(g->identity, DIGEST_LEN))); // Nickname may be gone from consensus and doesn't matter anyway control_event_guard("None", g->identity, "BAD_L2"); - tor_free(g); + layer2_guard_free(g); SMARTLIST_DEL_CURRENT_KEEPORDER(layer2_guards, g); continue; } @@ -4110,7 +4123,7 @@ purge_vanguards_lite(void) /* Go through the list and perform any needed expirations */ SMARTLIST_FOREACH_BEGIN(layer2_guards, layer2_guard_t *, g) { - tor_free(g); + layer2_guard_free(g); } SMARTLIST_FOREACH_END(g); smartlist_clear(layer2_guards); @@ -4158,7 +4171,7 @@ entry_guards_free_all(void) } SMARTLIST_FOREACH_BEGIN(layer2_guards, layer2_guard_t *, g) { - tor_free(g); + layer2_guard_free(g); } SMARTLIST_FOREACH_END(g); smartlist_free(layer2_guards);

1 0