- tor-commits - lists.torproject.org

[tor] branch release-0.4.6 updated (2dee45267b -> ee20d74672)
by gitolite role 27 Jul '22

27 Jul '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a change to branch release-0.4.6 in repository tor. from 2dee45267b Merge branch 'maint-0.4.6' into release-0.4.6 new dc13936f20 relay: Use remote reason when sending back a DESTROY new 8e7bd96362 Fix a check, make a netflow padding function more safe. new 691e542fd5 Merge branch 'tor-gitlab/mr/605' into maint-0.4.5 new e618a7e445 Merge branch 'maint-0.4.5' into maint-0.4.6 new ee20d74672 Merge branch 'maint-0.4.6' into release-0.4.6 The 5 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: changes/bug40645 | 5 +++++ src/core/or/channelpadding.c | 2 +- src/core/or/command.c | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 changes/bug40645 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 1

[tor] branch release-0.4.5 updated (611ee0d707 -> 6bd3d3fe70)
by gitolite role 27 Jul '22

27 Jul '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a change to branch release-0.4.5 in repository tor. from 611ee0d707 Merge branch 'maint-0.4.5' into release-0.4.5 new dc13936f20 relay: Use remote reason when sending back a DESTROY new 8e7bd96362 Fix a check, make a netflow padding function more safe. new 691e542fd5 Merge branch 'tor-gitlab/mr/605' into maint-0.4.5 new 6bd3d3fe70 Merge branch 'maint-0.4.5' into release-0.4.5 The 4 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: changes/bug40645 | 5 +++++ src/core/or/channelpadding.c | 2 +- src/core/or/command.c | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 changes/bug40645 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 1

[tor] branch maint-0.4.7 updated (e98995bb08 -> 7654e12be8)
by gitolite role 27 Jul '22

27 Jul '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a change to branch maint-0.4.7 in repository tor. from e98995bb08 Merge branch 'maint-0.4.6' into maint-0.4.7 new dc13936f20 relay: Use remote reason when sending back a DESTROY new 8e7bd96362 Fix a check, make a netflow padding function more safe. new 691e542fd5 Merge branch 'tor-gitlab/mr/605' into maint-0.4.5 new e618a7e445 Merge branch 'maint-0.4.5' into maint-0.4.6 new 7654e12be8 Merge branch 'maint-0.4.6' into maint-0.4.7 The 5 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: changes/bug40645 | 5 +++++ src/core/or/channelpadding.c | 2 +- src/core/or/command.c | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 changes/bug40645 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor] branch maint-0.4.6 updated (5260b4ef34 -> e618a7e445)
by gitolite role 27 Jul '22

27 Jul '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a change to branch maint-0.4.6 in repository tor. from 5260b4ef34 Merge branch 'maint-0.4.5' into maint-0.4.6 new dc13936f20 relay: Use remote reason when sending back a DESTROY new 8e7bd96362 Fix a check, make a netflow padding function more safe. new 691e542fd5 Merge branch 'tor-gitlab/mr/605' into maint-0.4.5 new e618a7e445 Merge branch 'maint-0.4.5' into maint-0.4.6 The 4 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: changes/bug40645 | 5 +++++ src/core/or/channelpadding.c | 2 +- src/core/or/command.c | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 changes/bug40645 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor] branch maint-0.4.5 updated (8d8afc4efa -> 691e542fd5)
by gitolite role 27 Jul '22

27 Jul '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a change to branch maint-0.4.5 in repository tor. from 8d8afc4efa relay: Send DESTROY cell instead of TRUNCATED cell new dc13936f20 relay: Use remote reason when sending back a DESTROY new 8e7bd96362 Fix a check, make a netflow padding function more safe. new 691e542fd5 Merge branch 'tor-gitlab/mr/605' into maint-0.4.5 The 3 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: changes/bug40645 | 5 +++++ src/core/or/channelpadding.c | 2 +- src/core/or/command.c | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 changes/bug40645 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor] branch main updated (ce1675ef65 -> 22cb4c23d0)
by gitolite role 27 Jul '22

27 Jul '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a change to branch main in repository tor. from ce1675ef65 Merge branch 'tor-gitlab/mr/601' new dc13936f20 relay: Use remote reason when sending back a DESTROY new 8e7bd96362 Fix a check, make a netflow padding function more safe. new 691e542fd5 Merge branch 'tor-gitlab/mr/605' into maint-0.4.5 new e618a7e445 Merge branch 'maint-0.4.5' into maint-0.4.6 new 7654e12be8 Merge branch 'maint-0.4.6' into maint-0.4.7 new 22cb4c23d0 Merge branch 'maint-0.4.7' The 6 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: changes/bug40645 | 5 +++++ src/core/or/channelpadding.c | 2 +- src/core/or/command.c | 2 +- 3 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 changes/bug40645 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 6

[tor-browser] branch tor-browser-91.11.0esr-12.0-1 updated (ef0f0ae9f0e56 -> c0426df7f7b37)
by gitolite role 27 Jul '22

27 Jul '22

This is an automated email from the git hooks/post-receive script. richard pushed a change to branch tor-browser-91.11.0esr-12.0-1 in repository tor-browser. from ef0f0ae9f0e56 fixup! Bug 31286: Implementation of bridge, proxy, and firewall settings in about:preferences#connection new 0b894b41ed680 fixup! Bug 25658: Replace security slider with security level UI new c0426df7f7b37 Bug 40926: Implemented the New Identity feature The 2 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: browser/base/content/appmenu-viewcache.inc.xhtml | 12 +- browser/base/content/browser-menubar.inc | 5 +- browser/base/content/browser-sets.inc | 2 +- browser/base/content/browser.js | 10 + browser/base/content/browser.xhtml | 1 - browser/base/content/navigator-toolbox.inc.xhtml | 5 +- browser/components/moz.build | 1 + .../components/newidentity/content/newidentity.js | 566 +++++++++++++++++++++ browser/components/newidentity/jar.mn | 13 + .../locale/en-US/newIdentity.properties | 8 + .../{torpreferences => newidentity}/moz.build | 0 browser/components/preferences/preferences.xhtml | 1 - .../securitylevel/content/securityLevel.js | 146 +++++- .../content/securityLevelPanel.inc.xhtml | 7 +- .../content/securityLevelPreferences.inc.xhtml | 42 +- browser/components/securitylevel/jar.mn | 5 + .../locale/en-US/securityLevel.properties | 30 ++ browser/installer/package-manifest.in | 9 +- .../en-US/browser/base-browser/securityLevel.ftl | 66 --- 19 files changed, 797 insertions(+), 132 deletions(-) create mode 100644 browser/components/newidentity/content/newidentity.js create mode 100644 browser/components/newidentity/jar.mn create mode 100644 browser/components/newidentity/locale/en-US/newIdentity.properties copy browser/components/{torpreferences => newidentity}/moz.build (100%) create mode 100644 browser/components/securitylevel/locale/en-US/securityLevel.properties delete mode 100644 browser/locales/en-US/browser/base-browser/securityLevel.ftl -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 2

[torspec] branch main updated: fix some easy typos in proposals
by gitolite role 27 Jul '22

27 Jul '22

This is an automated email from the git hooks/post-receive script. arma pushed a commit to branch main in repository torspec. The following commit(s) were added to refs/heads/main by this push: new b5e2002 fix some easy typos in proposals b5e2002 is described below commit b5e2002983fc4682b88fedb73a9101cc8090b053 Author: Roger Dingledine <arma(a)torproject.org> AuthorDate: Wed Jul 27 01:25:09 2022 -0400 fix some easy typos in proposals --- proposals/326-tor-relay-well-known-uri-rfc8615.md | 2 +- proposals/327-pow-over-intro.txt | 4 ++-- proposals/341-better-oos.md | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/proposals/326-tor-relay-well-known-uri-rfc8615.md b/proposals/326-tor-relay-well-known-uri-rfc8615.md index 7648162..075aa6d 100644 --- a/proposals/326-tor-relay-well-known-uri-rfc8615.md +++ b/proposals/326-tor-relay-well-known-uri-rfc8615.md @@ -12,7 +12,7 @@ This is a specification for a well-known [registry](https://www.iana.org/assignm This resource identifier can be used for serving and finding proofs related to [Tor](https://www.torproject.org/) relay and bridge contact information. It can also be used for autodiscovery of Tor relays run by a given entity, if the entity's domain is known. -It solves the issue that Tor relay/bridge contact information is an unidirectional and unverified claim by nature. +It solves the issue that Tor relay/bridge contact information is a unidirectional and unverified claim by nature. This well-known URI aims to allow the verification of the unidirectional claim. It aims to reduce the risk of impersonation attacks, where a Tor relay/bridge claims to be operated by a certain entity, but actually isn't. The automated verification will also support the [visualization of relay/bridge groups](https://gitlab.torproject.org/tpo/metrics/relay-search/-/issues/400…. diff --git a/proposals/327-pow-over-intro.txt b/proposals/327-pow-over-intro.txt index 0fb528f..ca7f7cd 100644 --- a/proposals/327-pow-over-intro.txt +++ b/proposals/327-pow-over-intro.txt @@ -339,7 +339,7 @@ Status: Draft tuple. For this reason a replay protection mechanism must be employed. The simplest way is to use a simple hash table to check whether a (seed, - nonce) tuple has been used before for the actiev duration of a + nonce) tuple has been used before for the active duration of a seed. Depending on how long a seed stays active this might be a viable solution with reasonable memory/time overhead. @@ -439,7 +439,7 @@ Status: Draft Every HS_UPDATE_PERIOD seconds the service should upload a new descriptor with a new suggested-effort value. - The service should avoid uploading descriptors too often to avoid overwheming + The service should avoid uploading descriptors too often to avoid overwhelming the HSDirs. The service SHOULD NOT upload descriptors more often than HS_UPDATE_PERIOD. The service SHOULD NOT upload a new descriptor if the suggested-effort value changes by less than 15%. diff --git a/proposals/341-better-oos.md b/proposals/341-better-oos.md index 0715c14..8ddf7fd 100644 --- a/proposals/341-better-oos.md +++ b/proposals/341-better-oos.md @@ -56,7 +56,7 @@ other words, when you see "A - B" below, read it as "MAX(A-B, 0)". ## Phase 1: Deciding how many connections to close -When we are find that we are low on sockets, we pick a number of sockets +When we find that we are low on sockets, we pick a number of sockets that we want to close according to our existing algorithm. (That is, we try to close 1/4 of our maximum sockets if we have reached our upper limit, or 1/10 of our maximum sockets if we have encountered a failure @@ -133,8 +133,8 @@ until we have closed at least our target number of exit connections. > This approach probabilistically favors closing circuits with a large > number of sockets open, regardless of how long those sockets have been > open. This defeats the easiest way of opening a large number of exit -> streams ("open them all on once circuit") without making the -> counter-approach ("open each exit stream on a its own circuit") much +> streams ("open them all on one circuit") without making the +> counter-approach ("open each exit stream on its own circuit") much > more attractive. ## Phase 3: Closing OR connections. -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[pluggable-transports/snowflake] branch main updated: Fix broker race condition
by gitolite role 26 Jul '22

26 Jul '22

This is an automated email from the git hooks/post-receive script. itchyonion pushed a commit to branch main in repository pluggable-transports/snowflake. The following commit(s) were added to refs/heads/main by this push: new 03b2b56 Fix broker race condition 03b2b56 is described below commit 03b2b56f879879bb379cff8d7352ace1102d8811 Author: itchyonion <itchyonion(a)torproject.com> AuthorDate: Thu May 26 23:26:38 2022 -0700 Fix broker race condition --- broker/broker.go | 2 +- broker/ipc.go | 41 ++++++++++++++++++++++------------------- 2 files changed, 23 insertions(+), 20 deletions(-) diff --git a/broker/broker.go b/broker/broker.go index 2bf4614..c356de9 100644 --- a/broker/broker.go +++ b/broker/broker.go @@ -154,8 +154,8 @@ func (ctx *BrokerContext) AddSnowflake(id string, proxyType string, natType stri heap.Push(ctx.restrictedSnowflakes, snowflake) } ctx.metrics.promMetrics.AvailableProxies.With(prometheus.Labels{"nat": natType, "type": proxyType}).Inc() - ctx.snowflakeLock.Unlock() ctx.idToSnowflake[id] = snowflake + ctx.snowflakeLock.Unlock() return snowflake } diff --git a/broker/ipc.go b/broker/ipc.go index 30de180..6b8971f 100644 --- a/broker/ipc.go +++ b/broker/ipc.go @@ -190,19 +190,10 @@ func (i *IPC) ClientOffers(arg messages.Arg, response *[]byte) error { offer.fingerprint = BridgeFingerprint.ToBytes() - // Only hand out known restricted snowflakes to unrestricted clients - var snowflakeHeap *SnowflakeHeap - if offer.natType == NATUnrestricted { - snowflakeHeap = i.ctx.restrictedSnowflakes + snowflake := i.matchSnowflake(offer.natType) + if snowflake != nil { + snowflake.offerChannel <- offer } else { - snowflakeHeap = i.ctx.snowflakes - } - - // Immediately fail if there are no snowflakes available. - i.ctx.snowflakeLock.Lock() - numSnowflakes := snowflakeHeap.Len() - i.ctx.snowflakeLock.Unlock() - if numSnowflakes <= 0 { i.ctx.metrics.lock.Lock() i.ctx.metrics.clientDeniedCount++ i.ctx.metrics.promMetrics.ClientPollTotal.With(prometheus.Labels{"nat": offer.natType, "status": "denied"}).Inc() @@ -216,13 +207,6 @@ func (i *IPC) ClientOffers(arg messages.Arg, response *[]byte) error { return sendClientResponse(resp, response) } - // Otherwise, find the most available snowflake proxy, and pass the offer to it. - // Delete must be deferred in order to correctly process answer request later. - i.ctx.snowflakeLock.Lock() - snowflake := heap.Pop(snowflakeHeap).(*Snowflake) - i.ctx.snowflakeLock.Unlock() - snowflake.offerChannel <- offer - // Wait for the answer to be returned on the channel or timeout. select { case answer := <-snowflake.answerChannel: @@ -248,6 +232,25 @@ func (i *IPC) ClientOffers(arg messages.Arg, response *[]byte) error { return err } +func (i *IPC) matchSnowflake(natType string) *Snowflake { + // Only hand out known restricted snowflakes to unrestricted clients + var snowflakeHeap *SnowflakeHeap + if natType == NATUnrestricted { + snowflakeHeap = i.ctx.restrictedSnowflakes + } else { + snowflakeHeap = i.ctx.snowflakes + } + + i.ctx.snowflakeLock.Lock() + defer i.ctx.snowflakeLock.Unlock() + + if snowflakeHeap.Len() > 0 { + return heap.Pop(snowflakeHeap).(*Snowflake) + } else { + return nil + } +} + func (i *IPC) ProxyAnswers(arg messages.Arg, response *[]byte) error { answer, id, err := messages.DecodeAnswerRequest(arg.Body) if err != nil || answer == "" { -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor] branch main updated: relay: Remove unused conn->ext_or_conn_id
by gitolite role 26 Jul '22

26 Jul '22

This is an automated email from the git hooks/post-receive script. dgoulet pushed a commit to branch main in repository tor. The following commit(s) were added to refs/heads/main by this push: new b7f9a24c08 relay: Remove unused conn->ext_or_conn_id new ce1675ef65 Merge branch 'tor-gitlab/mr/601' b7f9a24c08 is described below commit b7f9a24c08de435a54424caeb8dbc3916faca96c Author: David Goulet <dgoulet(a)torproject.org> AuthorDate: Tue Jul 26 11:18:15 2022 -0400 relay: Remove unused conn->ext_or_conn_id This also incidently removes a use of uninitialized stack data from the connection_or_set_ext_or_identifier() function. Fixes #40648 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket40648 | 3 +++ src/core/mainloop/connection.c | 2 -- src/core/or/or_connection_st.h | 2 -- src/feature/relay/ext_orport.c | 13 ------------- src/feature/relay/ext_orport.h | 4 ---- 5 files changed, 3 insertions(+), 21 deletions(-) diff --git a/changes/ticket40648 b/changes/ticket40648 new file mode 100644 index 0000000000..a891e30204 --- /dev/null +++ b/changes/ticket40648 @@ -0,0 +1,3 @@ + o Code simplification and refactoring (bridges): + - Remove unused code related to ExtPort connection ID. Fixes bug 40648; + bugfix on 0.3.5.1-alpha. diff --git a/src/core/mainloop/connection.c b/src/core/mainloop/connection.c index 75fc3c8918..883610d7e1 100644 --- a/src/core/mainloop/connection.c +++ b/src/core/mainloop/connection.c @@ -590,7 +590,6 @@ or_connection_new(int type, int socket_family) /* If we aren't told an address for this connection, we should * presume it isn't local, and should be rate-limited. */ TO_CONN(or_conn)->always_rate_limit_as_remote = 1; - connection_or_set_ext_or_identifier(or_conn); } return or_conn; @@ -957,7 +956,6 @@ connection_free_minimal(connection_t *conn) connection_or_clear_identity(TO_OR_CONN(conn)); } if (conn->type == CONN_TYPE_OR || conn->type == CONN_TYPE_EXT_OR) { - tor_free(TO_OR_CONN(conn)->ext_or_conn_id); tor_free(TO_OR_CONN(conn)->ext_or_auth_correct_client_hash); tor_free(TO_OR_CONN(conn)->ext_or_transport); } diff --git a/src/core/or/or_connection_st.h b/src/core/or/or_connection_st.h index 81ba2091ec..aceed4d2c4 100644 --- a/src/core/or/or_connection_st.h +++ b/src/core/or/or_connection_st.h @@ -26,8 +26,6 @@ struct or_connection_t { * if the other side hasn't shown us a valid identity key. */ char identity_digest[DIGEST_LEN]; - /** Extended ORPort connection identifier. */ - char *ext_or_conn_id; /** This is the ClientHash value we expect to receive from the * client during the Extended ORPort authentication protocol. We * compute it upon receiving the ClientNoce from the client, and we diff --git a/src/feature/relay/ext_orport.c b/src/feature/relay/ext_orport.c index 3dd884932e..89b287b0b4 100644 --- a/src/feature/relay/ext_orport.c +++ b/src/feature/relay/ext_orport.c @@ -656,19 +656,6 @@ connection_ext_or_start_auth(or_connection_t *or_conn) return 0; } -/** Creates an Extended ORPort identifier for <b>conn</b> and deposits - * it into the global list of identifiers. */ -void -connection_or_set_ext_or_identifier(or_connection_t *conn) -{ - char random_id[EXT_OR_CONN_ID_LEN]; - - if (!conn->ext_or_conn_id) - conn->ext_or_conn_id = tor_malloc_zero(EXT_OR_CONN_ID_LEN); - - memcpy(conn->ext_or_conn_id, random_id, EXT_OR_CONN_ID_LEN); -} - /** Free any leftover allocated memory of the ext_orport.c subsystem. */ void ext_orport_free_all(void) diff --git a/src/feature/relay/ext_orport.h b/src/feature/relay/ext_orport.h index 722dc3787c..5a9063d005 100644 --- a/src/feature/relay/ext_orport.h +++ b/src/feature/relay/ext_orport.h @@ -35,7 +35,6 @@ int connection_ext_or_start_auth(or_connection_t *or_conn); -void connection_or_set_ext_or_identifier(or_connection_t *conn); int connection_ext_or_finished_flushing(or_connection_t *conn); int connection_ext_or_process_inbuf(or_connection_t *or_conn); char *get_ext_or_auth_cookie_file_name(void); @@ -67,9 +66,6 @@ connection_ext_or_process_inbuf(or_connection_t *conn) tor_assert_nonfatal_unreached(); return -1; } -#define connection_or_set_ext_or_identifier(conn) \ - ((void)(conn)) - #define get_ext_or_auth_cookie_file_name() \ (NULL) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0