- tor-commits - lists.torproject.org

[snowflake/main] Validate client and proxy supplied strings
by cohosh＠torproject.org 18 Jan '22

18 Jan '22

commit b35a79ac247e53ca0a2dd25625e083e9bba395fa Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Wed Jan 12 10:53:58 2022 -0500 Validate client and proxy supplied strings Malicious clients and proxies can provide potentially malicious strings in the polls. This validates the NAT type and proxy type strings to ensure that malformed strings are not displayed on a web page or passed to any of our monitoring infrastructure. If a client or proxy supplies an invalid NAT type, we return an error message. If a proxy supplies an unknown proxy type, we set the proxy type to unknown. --- common/messages/client.go | 12 ++++++++++-- common/messages/messages_test.go | 2 +- common/messages/proxy.go | 35 ++++++++++++++++++++++++++++++----- 3 files changed, 41 insertions(+), 8 deletions(-) diff --git a/common/messages/client.go b/common/messages/client.go index b40c582..edb7115 100644 --- a/common/messages/client.go +++ b/common/messages/client.go @@ -6,6 +6,8 @@ package messages import ( "encoding/json" "fmt" + + "git.torproject.org/pluggable-transports/snowflake.git/v2/common/nat" ) const ClientVersion = "1.0" @@ -73,8 +75,14 @@ func DecodeClientPollRequest(data []byte) (*ClientPollRequest, error) { return nil, fmt.Errorf("no supplied offer") } - if message.NAT == "" { - message.NAT = "unknown" + switch message.NAT { + case "": + message.NAT = nat.NATUnknown + case nat.NATUnknown: + case nat.NATRestricted: + case nat.NATUnrestricted: + default: + return nil, fmt.Errorf("invalid NAT type") } return &message, nil diff --git a/common/messages/messages_test.go b/common/messages/messages_test.go index abb978d..a38746b 100644 --- a/common/messages/messages_test.go +++ b/common/messages/messages_test.go @@ -22,7 +22,7 @@ func TestDecodeProxyPollRequest(t *testing.T) { { //Version 1.0 proxy message "ymbcCMto7KHNGYlp", - "", + "unknown", "unknown", 0, `{"Sid":"ymbcCMto7KHNGYlp","Version":"1.0"}`, diff --git a/common/messages/proxy.go b/common/messages/proxy.go index 3817c04..83606d3 100644 --- a/common/messages/proxy.go +++ b/common/messages/proxy.go @@ -7,9 +7,18 @@ import ( "encoding/json" "fmt" "strings" + + "git.torproject.org/pluggable-transports/snowflake.git/v2/common/nat" ) -const version = "1.2" +const ( + version = "1.2" + + ProxyStandalone = "standalone" + ProxyWebext = "webext" + ProxyBadge = "badge" + ProxyUnknown = "unknown" +) /* Version 1.2 specification: @@ -116,12 +125,28 @@ func DecodePollRequest(data []byte) (sid string, proxyType string, natType strin return } - natType = message.NAT - if natType == "" { - natType = "unknown" + switch message.NAT { + case "": + message.NAT = nat.NATUnknown + case nat.NATUnknown: + case nat.NATRestricted: + case nat.NATUnrestricted: + default: + err = fmt.Errorf("invalid NAT type") + return + } + + // we don't reject polls with an unknown proxy type because we encourage + // projects that embed proxy code to include their own type + switch message.Type { + case ProxyStandalone: + case ProxyWebext: + case ProxyBadge: + default: + message.Type = ProxyUnknown } - return message.Sid, message.Type, natType, message.Clients, nil + return message.Sid, message.Type, message.NAT, message.Clients, nil } type ProxyPollResponse struct {

1 0

[tor/release-0.4.5] main: Update a dead URL in a log notice
by dgoulet＠torproject.org 18 Jan '22

18 Jan '22

commit b9c06718a871cc9bfe57c7b59e5228183d71d992 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jan 18 12:51:52 2022 -0500 main: Update a dead URL in a log notice Change https://www.torproject.org/download/download#warning to https://support.torproject.org/faq/staying-anonymous/ Closes #40544 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket40544 | 3 +++ src/app/main/main.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/changes/ticket40544 b/changes/ticket40544 new file mode 100644 index 0000000000..b0754f0fd4 --- /dev/null +++ b/changes/ticket40544 @@ -0,0 +1,3 @@ + o Minor bugfix (logging): + - Update a log notice dead URL to a working one. Fixes bug 40544; bugfix on + 0.3.5.1-alpha. diff --git a/src/app/main/main.c b/src/app/main/main.c index 8a5d4cfd15..ca3148e7fc 100644 --- a/src/app/main/main.c +++ b/src/app/main/main.c @@ -618,7 +618,7 @@ tor_init(int argc, char *argv[]) log_notice(LD_GENERAL, "Tor can't help you if you use it wrong! " "Learn how to be safe at " - "https://www.torproject.org/download/download#warning"); + "https://support.torproject.org/faq/staying-anonymous/"); if (strstr(version, "alpha") || strstr(version, "beta")) log_notice(LD_GENERAL, "This version is not a stable Tor release. "

1 0

[tor/release-0.4.5] Update new relay blogpost URL
by dgoulet＠torproject.org 18 Jan '22

18 Jan '22

commit d6c2da663029f4da94a9b7ff68f830e6e7f80e7d Author: Jérôme Charaoui <jerome(a)riseup.net> Date: Mon Jan 10 15:16:24 2022 +0000 Update new relay blogpost URL This removes the '/blog/' URL component which relies on a redirection since the blog has been migrated to Lektor --- src/feature/relay/router.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c index 7ea2a4e719..c4170cd720 100644 --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@ -525,8 +525,8 @@ log_new_relay_greeting(void) tor_log(LOG_NOTICE, LD_GENERAL, "You are running a new relay. " "Thanks for helping the Tor network! If you wish to know " "what will happen in the upcoming weeks regarding its usage, " - "have a look at https://blog.torproject.org/blog/lifecycle-of" - "-a-new-relay"); + "have a look at https://blog.torproject.org/lifecycle-of-a" + "-new-relay"); already_logged = 1; }

1 0

[tor/release-0.4.5] relay: Don't advertise HSv2 protocol version
by dgoulet＠torproject.org 18 Jan '22

18 Jan '22

commit 72041c63064b461e2eb9102f12c4fe217e9066dd Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Nov 4 14:44:58 2021 -0400 relay: Don't advertise HSv2 protocol version We removed HSIntro=3 and HSDir=1 that are v2 specific. Since 0.3.5.17, we do not support introducing or being a directory for onion service v2. Closes #40509 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket40509 | 4 ++++ src/core/or/protover.c | 12 ++++++------ src/test/test_protover.c | 4 ++-- 3 files changed, 12 insertions(+), 8 deletions(-) diff --git a/changes/ticket40509 b/changes/ticket40509 new file mode 100644 index 0000000000..ba4502ff3b --- /dev/null +++ b/changes/ticket40509 @@ -0,0 +1,4 @@ + o Minor bugfix (relay): + - Remove the HSDir and HSIntro onion service v2 protocol versions so relay + stop advertising that they support them. Fixes bug 40509; bugfix on + 0.3.5.17. diff --git a/src/core/or/protover.c b/src/core/or/protover.c index 82e4f64c94..e047bfe200 100644 --- a/src/core/or/protover.c +++ b/src/core/or/protover.c @@ -423,8 +423,8 @@ protover_get_supported_protocols(void) "Cons=1-2 " "Desc=1-2 " "DirCache=1-2 " - "HSDir=1-2 " - "HSIntro=3-4 " + "HSDir=2 " + "HSIntro=4 " "HSRend=1-2 " "Link=1-5 " #ifdef HAVE_WORKING_TOR_TLS_GET_TLSSECRETS @@ -475,7 +475,7 @@ protover_get_supported_protocols(void) const char * protover_get_recommended_client_protocols(void) { - return "Cons=1-2 Desc=1-2 DirCache=1 HSDir=1 HSIntro=3 HSRend=1 " + return "Cons=1-2 Desc=1-2 DirCache=1 HSDir=2 HSIntro=4 HSRend=1 " "Link=4 Microdesc=1-2 Relay=2"; } @@ -484,7 +484,7 @@ protover_get_recommended_client_protocols(void) const char * protover_get_recommended_relay_protocols(void) { - return "Cons=1-2 Desc=1-2 DirCache=1 HSDir=1 HSIntro=3 HSRend=1 " + return "Cons=1-2 Desc=1-2 DirCache=1 HSDir=2 HSIntro=4 HSRend=1 " "Link=4 Microdesc=1-2 Relay=2"; } @@ -493,7 +493,7 @@ protover_get_recommended_relay_protocols(void) const char * protover_get_required_client_protocols(void) { - return "Cons=1-2 Desc=1-2 DirCache=1 HSDir=1 HSIntro=3 HSRend=1 " + return "Cons=1-2 Desc=1-2 DirCache=1 HSDir=2 HSIntro=4 HSRend=1 " "Link=4 Microdesc=1-2 Relay=2"; } @@ -502,7 +502,7 @@ protover_get_required_client_protocols(void) const char * protover_get_required_relay_protocols(void) { - return "Cons=1 Desc=1 DirCache=1 HSDir=1 HSIntro=3 HSRend=1 " + return "Cons=1 Desc=1 DirCache=1 HSDir=2 HSIntro=4 HSRend=1 " "Link=3-4 Microdesc=1 Relay=1-2"; } diff --git a/src/test/test_protover.c b/src/test/test_protover.c index b4689045cf..3fbfe3a682 100644 --- a/src/test/test_protover.c +++ b/src/test/test_protover.c @@ -369,12 +369,12 @@ test_protover_supports_version(void *arg) /* Highest supported HSv2 introduce protocol version. * Hard-coded here, because it does not appear anywhere in the code. * It's not clear if we actually support version 2, see #25068. */ -#define PROTOVER_HSINTRO_V2 3 +#define PROTOVER_HSINTRO_V2 4 /* HSv2 Rend and HSDir protocol versions. * Hard-coded here, because they do not appear anywhere in the code. */ #define PROTOVER_HS_RENDEZVOUS_POINT_V2 1 -#define PROTOVER_HSDIR_V2 1 +#define PROTOVER_HSDIR_V2 2 /* DirCache, Desc, Microdesc, and Cons protocol versions. * Hard-coded here, because they do not appear anywhere in the code. */

1 0

[tor/release-0.4.5] Merge branch 'maint-0.3.5' into maint-0.4.5
by dgoulet＠torproject.org 18 Jan '22

18 Jan '22

commit aac5731f86399a3ac37720f9d0c4cffacd8eb38a Merge: 882fd1f0d4 72041c6306 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jan 18 13:12:13 2022 -0500 Merge branch 'maint-0.3.5' into maint-0.4.5 changes/ticket40509 | 4 ++++ src/core/or/protover.c | 4 ++-- src/test/test_protover.c | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --cc src/core/or/protover.c index cb9a03d6ec,e047bfe200..d45246cb83 --- a/src/core/or/protover.c +++ b/src/core/or/protover.c @@@ -435,10 -422,9 +435,10 @@@ protover_get_supported_protocols(void return "Cons=1-2 " "Desc=1-2 " - "DirCache=1-2 " + "DirCache=2 " + "FlowCtrl=1 " - "HSDir=1-2 " - "HSIntro=3-5 " + "HSDir=2 " - "HSIntro=4 " ++ "HSIntro=4-5 " "HSRend=1-2 " "Link=1-5 " #ifdef HAVE_WORKING_TOR_TLS_GET_TLSSECRETS diff --cc src/test/test_protover.c index 016cee7f15,3fbfe3a682..44febe0fa6 --- a/src/test/test_protover.c +++ b/src/test/test_protover.c @@@ -342,21 -361,23 +342,21 @@@ test_protover_supports_version(void *ar * Hard-coded here, because they are not in the code, or not exposed in the * headers. */ #define PROTOVER_LINKAUTH_V1 1 -#define PROTOVER_LINKAUTH_V3 3 - +#define PROTOVER_LINKAUTH_V2 2 #define PROTOVER_RELAY_V1 1 -#define PROTOVER_RELAY_V2 2 +/* Deprecated HSIntro versions */ +#define PROTOVER_HS_INTRO_DEPRECATED_1 1 +#define PROTOVER_HS_INTRO_DEPRECATED_2 2 /* Highest supported HSv2 introduce protocol version. - * Hard-coded here, because it does not appear anywhere in the code. * It's not clear if we actually support version 2, see #25068. */ -#define PROTOVER_HSINTRO_V2 4 +#define PROTOVER_HS_INTRO_V2 3 -/* HSv2 Rend and HSDir protocol versions. - * Hard-coded here, because they do not appear anywhere in the code. */ +/* HSv2 Rend and HSDir protocol versions. */ #define PROTOVER_HS_RENDEZVOUS_POINT_V2 1 - #define PROTOVER_HSDIR_V2 1 + #define PROTOVER_HSDIR_V2 2 -/* DirCache, Desc, Microdesc, and Cons protocol versions. - * Hard-coded here, because they do not appear anywhere in the code. */ +/* DirCache, Desc, Microdesc, and Cons protocol versions. */ #define PROTOVER_DIRCACHE_V1 1 #define PROTOVER_DIRCACHE_V2 2

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 18 Jan '22

18 Jan '22

commit c2029e1da999fef10452f28a55fd6a44da670da3 Merge: 6470aed5ae aac5731f86 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jan 18 13:12:35 2022 -0500 Merge branch 'maint-0.4.5' into release-0.4.5 changes/ticket40509 | 4 ++++ src/core/or/protover.c | 4 ++-- src/test/test_protover.c | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-)

1 0

[tor/release-0.4.5] Merge branch 'tor-gitlab/mr/510' into maint-0.3.5
by dgoulet＠torproject.org 18 Jan '22

18 Jan '22

commit e52348069133cd14b119e3c74d945cfb36771814 Merge: 72041c6306 b9c06718a8 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jan 18 13:15:23 2022 -0500 Merge branch 'tor-gitlab/mr/510' into maint-0.3.5 changes/ticket40544 | 3 +++ src/app/main/main.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-)

1 0

[tor/release-0.4.5] Merge branch 'tor-gitlab/mr/511' into maint-0.3.5
by dgoulet＠torproject.org 18 Jan '22

18 Jan '22

commit 501d8bbd4cb50739182a54f1e3482ce8e3c8d53b Merge: e523480691 d6c2da6630 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jan 18 13:15:33 2022 -0500 Merge branch 'tor-gitlab/mr/511' into maint-0.3.5 src/feature/relay/router.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

[tor/release-0.4.5] Merge branch 'maint-0.3.5' into maint-0.4.5
by dgoulet＠torproject.org 18 Jan '22

18 Jan '22

commit 49c758af47ce5e45154dbf445519b422d79f30ad Merge: aac5731f86 e523480691 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jan 18 13:15:29 2022 -0500 Merge branch 'maint-0.3.5' into maint-0.4.5 changes/ticket40544 | 3 +++ src/app/main/main.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-)

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.5' into release-0.4.5
by dgoulet＠torproject.org 18 Jan '22

18 Jan '22

commit ae149b2b6343e6de5436ca207cdfc26425cda08f Merge: c2029e1da9 49c758af47 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jan 18 13:15:29 2022 -0500 Merge branch 'maint-0.4.5' into release-0.4.5 changes/ticket40544 | 3 +++ src/app/main/main.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-)

1 0