- tor-commits - lists.torproject.org

[tor/master] Changes from Nick's code review 'part 1'
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit b0fc18c37e0d30d9941109382df4b2b44f0f0ff8 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Dec 18 12:39:03 2012 -0800 Changes from Nick's code review 'part 1' I think this is actually his third code review of this branch so far. --- src/or/circuitbuild.c | 90 +++++++++++++++++++++++++--------------------- src/or/config.c | 4 +- src/or/connection_edge.c | 2 +- src/or/entrynodes.c | 2 +- src/or/relay.c | 12 +++--- 5 files changed, 59 insertions(+), 51 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index f93b04f..58020f2 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1015,7 +1015,7 @@ pathbias_get_notice_rate(const or_options_t *options) /* XXXX024 I'd like to have this be static again, but entrynodes.c needs it. */ /** The circuit success rate below which we issue a warn */ -double +static double pathbias_get_warn_rate(const or_options_t *options) { #define DFLT_PATH_BIAS_WARN_PCT 50 @@ -1055,7 +1055,7 @@ pathbias_get_dropguards(const or_options_t *options) return options->PathBiasDropGuards; else return networkstatus_get_param(NULL, "pb_dropguards", - DFLT_PATH_BIAS_DROP_GUARDS, 0, 100)/100.0; + DFLT_PATH_BIAS_DROP_GUARDS, 0, 1); } /** @@ -1078,9 +1078,10 @@ pathbias_get_scale_threshold(const or_options_t *options) /** * The scale factor is the denominator for our scaling - * of circuit counts for our path bias window. Note that - * we must be careful of the values we use here, as the - * code only scales in the event of no integer truncation. + * of circuit counts for our path bias window. + * + * Note that our use of doubles for the path bias state + * file means that powers of 2 work best here. */ static int pathbias_get_scale_factor(const or_options_t *options) @@ -1301,7 +1302,7 @@ pathbias_count_circ_attempt(origin_circuit_t *circ) } else { if ((rate_msg = rate_limit_log(&circ_attempt_notice_limit, approx_time()))) { - log_info(LD_BUG, + log_info(LD_CIRC, "Unopened circuit has no known guard. " "Circuit is a %s currently %s.%s", circuit_purpose_to_string(circ->base_.purpose), @@ -1378,7 +1379,7 @@ pathbias_count_build_success(origin_circuit_t *circ) } else if (circ->base_.purpose != CIRCUIT_PURPOSE_C_MEASURE_TIMEOUT) { if ((rate_msg = rate_limit_log(&success_notice_limit, approx_time()))) { - log_info(LD_BUG, + log_info(LD_CIRC, "Completed circuit has no known guard. " "Circuit is a %s currently %s.%s", circuit_purpose_to_string(circ->base_.purpose), @@ -1490,7 +1491,7 @@ pathbias_count_successful_close(origin_circuit_t *circ) /* In rare cases, CIRCUIT_PURPOSE_TESTING can get converted to * CIRCUIT_PURPOSE_C_MEASURE_TIMEOUT and have no guards here. * No need to log that case. */ - log_info(LD_BUG, + log_info(LD_CIRC, "Successfully closed circuit has no known guard. " "Circuit is a %s currently %s", circuit_purpose_to_string(circ->base_.purpose), @@ -1526,7 +1527,7 @@ pathbias_count_collapse(origin_circuit_t *circ) /* In rare cases, CIRCUIT_PURPOSE_TESTING can get converted to * CIRCUIT_PURPOSE_C_MEASURE_TIMEOUT and have no guards here. * No need to log that case. */ - log_info(LD_BUG, + log_info(LD_CIRC, "Destroyed circuit has no known guard. " "Circuit is a %s currently %s", circuit_purpose_to_string(circ->base_.purpose), @@ -1554,7 +1555,7 @@ pathbias_count_unusable(origin_circuit_t *circ) /* In rare cases, CIRCUIT_PURPOSE_TESTING can get converted to * CIRCUIT_PURPOSE_C_MEASURE_TIMEOUT and have no guards here. * No need to log that case. */ - log_info(LD_BUG, + log_info(LD_CIRC, "Stream-failing circuit has no known guard. " "Circuit is a %s currently %s", circuit_purpose_to_string(circ->base_.purpose), @@ -1620,10 +1621,9 @@ pathbias_get_closed_count(entry_guard_t *guard) continue; if (ocirc->path_state >= PATH_STATE_BUILD_SUCCEEDED && - (memcmp(guard->identity, + fast_memeq(guard->identity, ocirc->cpath->extend_info->identity_digest, - DIGEST_LEN) - == 0)) { + DIGEST_LEN)) { open_circuits++; } } @@ -1670,15 +1670,17 @@ entry_guard_inc_circ_attempt_count(entry_guard_t *guard) "Your Guard %s=%s is failing an extremely large amount of " "circuits. To avoid potential route manipluation attacks, " "Tor has disabled use of this guard. " - "Success counts are %d/%d. %d circuits completed, %d " - "were unusable, %d collapsed, and %d timed out. For " + "Success counts are %ld/%ld. %ld circuits completed, %ld " + "were unusable, %ld collapsed, and %ld timed out. For " "reference, your timeout cutoff is %ld seconds.", guard->nickname, hex_str(guard->identity, DIGEST_LEN), - (int)pathbias_get_closed_count(guard), - (int)guard->circ_attempts, (int)guard->circ_successes, - (int)guard->unusable_circuits, - (int)guard->collapsed_circuits, (int)guard->timeouts, - (long)circ_times.close_ms/1000); + tor_lround(pathbias_get_closed_count(guard)), + tor_lround(guard->circ_attempts), + tor_lround(guard->circ_successes), + tor_lround(guard->unusable_circuits), + tor_lround(guard->collapsed_circuits), + tor_lround(guard->timeouts), + tor_lround(circ_times.close_ms/1000)); guard->path_bias_disabled = 1; guard->bad_since = approx_time(); return -1; @@ -1689,15 +1691,17 @@ entry_guard_inc_circ_attempt_count(entry_guard_t *guard) "Your Guard %s=%s is failing an extremely large amount of " "circuits. This could indicate a route manipulation attack, " "extreme network overload, or a bug. " - "Success counts are %d/%d. %d circuits completed, %d " - "were unusable, %d collapsed, and %d timed out. For " + "Success counts are %ld/%ld. %ld circuits completed, %ld " + "were unusable, %ld collapsed, and %ld timed out. For " "reference, your timeout cutoff is %ld seconds.", guard->nickname, hex_str(guard->identity, DIGEST_LEN), - (int)pathbias_get_closed_count(guard), - (int)guard->circ_attempts, (int)guard->circ_successes, - (int)guard->unusable_circuits, - (int)guard->collapsed_circuits, (int)guard->timeouts, - (long)circ_times.close_ms/1000); + tor_lround(pathbias_get_closed_count(guard)), + tor_lround(guard->circ_attempts), + tor_lround(guard->circ_successes), + tor_lround(guard->unusable_circuits), + tor_lround(guard->collapsed_circuits), + tor_lround(guard->timeouts), + tor_lround(circ_times.close_ms/1000)); } } else if (pathbias_get_success_count(guard)/((double)guard->circ_attempts) < pathbias_get_warn_rate(options)) { @@ -1708,15 +1712,17 @@ entry_guard_inc_circ_attempt_count(entry_guard_t *guard) "circuits. Most likely this means the Tor network is " "overloaded, but it could also mean an attack against " "you or the potentially the guard itself. " - "Success counts are %d/%d. %d circuits completed, %d " - "were unusable, %d collapsed, and %d timed out. For " + "Success counts are %ld/%ld. %ld circuits completed, %ld " + "were unusable, %ld collapsed, and %ld timed out. For " "reference, your timeout cutoff is %ld seconds.", guard->nickname, hex_str(guard->identity, DIGEST_LEN), - (int)pathbias_get_closed_count(guard), - (int)guard->circ_attempts, (int)guard->circ_successes, - (int)guard->unusable_circuits, - (int)guard->collapsed_circuits, (int)guard->timeouts, - (long)circ_times.close_ms/1000); + tor_lround(pathbias_get_closed_count(guard)), + tor_lround(guard->circ_attempts), + tor_lround(guard->circ_successes), + tor_lround(guard->unusable_circuits), + tor_lround(guard->collapsed_circuits), + tor_lround(guard->timeouts), + tor_lround(circ_times.close_ms/1000)); } } else if (pathbias_get_success_count(guard)/((double)guard->circ_attempts) < pathbias_get_notice_rate(options)) { @@ -1725,15 +1731,17 @@ entry_guard_inc_circ_attempt_count(entry_guard_t *guard) log_notice(LD_CIRC, "Your Guard %s=%s is failing more circuits than usual. " "Most likely this means the Tor network is overloaded. " - "Success counts are %d/%d. %d circuits completed, %d " - "were unusable, %d collapsed, and %d timed out. For " + "Success counts are %ld/%ld. %ld circuits completed, %ld " + "were unusable, %ld collapsed, and %ld timed out. For " "reference, your timeout cutoff is %ld seconds.", guard->nickname, hex_str(guard->identity, DIGEST_LEN), - (int)pathbias_get_closed_count(guard), - (int)guard->circ_attempts, (int)guard->circ_successes, - (int)guard->unusable_circuits, - (int)guard->collapsed_circuits, (int)guard->timeouts, - (long)circ_times.close_ms/1000); + tor_lround(pathbias_get_closed_count(guard)), + tor_lround(guard->circ_attempts), + tor_lround(guard->circ_successes), + tor_lround(guard->unusable_circuits), + tor_lround(guard->collapsed_circuits), + tor_lround(guard->timeouts), + tor_lround(circ_times.close_ms/1000)); } } } diff --git a/src/or/config.c b/src/or/config.c index 79725cb..1d81c54 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -322,8 +322,8 @@ static config_var_t option_vars_[] = { V(PathBiasScaleThreshold, INT, "-1"), V(PathBiasScaleFactor, INT, "-1"), V(PathBiasMultFactor, INT, "-1"), - V(PathBiasDropGuards, BOOL, "0"), - V(PathBiasUseCloseCounts, BOOL, "1"), + V(PathBiasDropGuards, AUTOBOOL, "0"), + V(PathBiasUseCloseCounts, AUTOBOOL, "1"), OBSOLETE("PathlenCoinWeight"), V(PerConnBWBurst, MEMUNIT, "0"), diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 570ffe4..fa91c3a 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -2189,7 +2189,7 @@ connection_ap_handshake_socks_reply(entry_connection_t *conn, char *reply, // DNS remaps can trigger this. So can failed hidden service // lookups. log_info(LD_BUG, - "No origin circuit for successful SOCKS stream %ld. Reason: " + "No origin circuit for successful SOCKS stream %lu. Reason: " "%d", ENTRY_TO_CONN(conn)->global_identifier, endreason); } else { TO_ORIGIN_CIRCUIT(conn->edge_.on_circuit)->path_state diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 066dbec..fc7f6ed 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1194,7 +1194,7 @@ entry_guards_update_state(or_state_t *state) d, e->chosen_by_version, t); next = &(line->next); } - if (e->circ_attempts) { + if (e->circ_attempts > 0) { *next = line = tor_malloc_zero(sizeof(config_line_t)); line->key = tor_strdup("EntryGuardPathBias"); /* In the long run: circuit_success ~= successful_circuit_close + diff --git a/src/or/relay.c b/src/or/relay.c index b4b7700..8b3b27f 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -698,17 +698,17 @@ connection_ap_process_end_not_open( reason == END_STREAM_REASON_INTERNAL || reason == END_STREAM_REASON_DESTROY) { /* All three of these reasons could mean a failed tag - * hit the exit and it shat itself. Do not probe. + * hit the exit and it complained. Do not probe. * Fail the circuit. */ circ->path_state = PATH_STATE_USE_FAILED; return -END_CIRC_REASON_TORPROTOCOL; } else { /* Path bias: If we get a valid reason code from the exit, - * it wasn't due to tagging */ - // XXX: This relies on recognized+digest being strong enough not - // to be spoofable.. Is that a valid assumption? - // Or more accurately: is it better than nothing? Can the attack - // be done offline? + * it wasn't due to tagging. + * + * We rely on recognized+digest being strong enough to make + * tags unlikely to allow us to get tagged, yet 'recognized' + * reason codes here. */ circ->path_state = PATH_STATE_USE_SUCCEEDED; } }

1 0

[tor/master] Woops, this log message triggers with the 2-hop bias commit.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit af9011f82430a5fac0a6db368f1afb1aa4bbc9f6 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Dec 11 17:19:39 2012 -0800 Woops, this log message triggers with the 2-hop bias commit. --- src/or/circuitbuild.c | 16 ---------------- 1 files changed, 0 insertions(+), 16 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index cc43797..3e2568c 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1309,22 +1309,6 @@ pathbias_count_circ_attempt(origin_circuit_t *circ) } } } - } else { - /* Help track down the real cause of bug #6475: */ - if (circ->path_state == PATH_STATE_NEW_CIRC) { - if ((rate_msg = rate_limit_log(&circ_attempt_notice_limit, - approx_time()))) { - log_info(LD_BUG, - "A %s circuit is in cpath state %d (opened: %d). " - "Circuit is a %s currently %s.%s", - pathbias_state_to_string(circ->path_state), - circ->cpath->state, circ->has_opened, - circuit_purpose_to_string(circ->base_.purpose), - circuit_state_to_string(circ->base_.state), - rate_msg); - tor_free(rate_msg); - } - } } return 0;

1 0

[tor/master] Merge remote-tracking branch 'mikeperry/209-path-bias-changes'
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit 885e8d35c7af65b3e1e598d6f2e951ba84e65928 Merge: 265aab2 406d59a Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 25 23:30:28 2012 -0500 Merge remote-tracking branch 'mikeperry/209-path-bias-changes' changes/bug7157 | 26 ++ doc/tor.1.txt | 41 ++- src/or/circuitbuild.c | 720 +++++++++++++++++++++++++++++++++++++--------- src/or/circuitbuild.h | 5 +- src/or/circuitlist.c | 12 +- src/or/circuituse.c | 33 +++ src/or/config.c | 7 +- src/or/connection_edge.c | 25 ++ src/or/entrynodes.c | 61 +++- src/or/entrynodes.h | 22 ++- src/or/or.h | 32 ++- src/or/relay.c | 20 ++ src/or/rendclient.c | 11 + src/or/rendservice.c | 8 + 14 files changed, 838 insertions(+), 185 deletions(-) diff --cc src/or/entrynodes.h index ae5d230,2686a4f..2a9a99c --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@@ -31,11 -31,14 +31,15 @@@ typedef struct entry_guard_t * router, 1 if we have. */ unsigned int can_retry : 1; /**< Should we retry connecting to this entry, * in spite of having it marked as unreachable?*/ - unsigned int path_bias_notice : 1; /**< Did we alert the user about path bias + unsigned int path_bias_noticed : 1; /**< Did we alert the user about path + * bias for this node already? */ + unsigned int path_bias_warned : 1; /**< Did we alert the user about path bias * for this node already? */ + unsigned int path_bias_extreme : 1; /**< Did we alert the user about path + * bias for this node already? */ unsigned int path_bias_disabled : 1; /**< Have we disabled this node because * of path bias issues? */ + unsigned int is_dir_cache : 1; /**< Is this node a directory cache? */ time_t bad_since; /**< 0 if this guard is currently usable, or the time at * which it was observed to become (according to the * directory or the user configuration) unusable. */

1 0

[tor/master] Fix compilation warning: must not format u64 as long.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit 01a09e8f8601ce61be500c92ea200c29e4389c7a Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Dec 25 23:34:38 2012 -0500 Fix compilation warning: must not format u64 as long. --- src/or/connection_edge.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index a7c201f..defe944 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -2199,8 +2199,10 @@ connection_ap_handshake_socks_reply(entry_connection_t *conn, char *reply, // DNS remaps can trigger this. So can failed hidden service // lookups. log_info(LD_BUG, - "No origin circuit for successful SOCKS stream %lu. Reason: " - "%d", ENTRY_TO_CONN(conn)->global_identifier, endreason); + "No origin circuit for successful SOCKS stream "U64_FORMAT + ". Reason: %d", + U64_PRINTF_ARG(ENTRY_TO_CONN(conn)->global_identifier), + endreason); } else { TO_ORIGIN_CIRCUIT(conn->edge_.on_circuit)->path_state = PATH_STATE_USE_SUCCEEDED;

1 0

[tor/master] Nick's Code review #3 part 2.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit 406d59a9c93e46bcb5be0e0a5c087f4860522d56 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Dec 18 14:16:01 2012 -0800 Nick's Code review #3 part 2. --- src/or/circuitbuild.c | 15 +++++++++++---- src/or/entrynodes.c | 6 +++--- 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 58020f2..804782d 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1350,7 +1350,7 @@ pathbias_count_build_success(origin_circuit_t *circ) circ->path_state = PATH_STATE_BUILD_SUCCEEDED; guard->circ_successes++; - log_info(LD_CIRC, "Got success count %lf/%lf for guard %s=%s", + log_info(LD_CIRC, "Got success count %f/%f for guard %s=%s", guard->circ_successes, guard->circ_attempts, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); } else { @@ -1368,7 +1368,7 @@ pathbias_count_build_success(origin_circuit_t *circ) } if (guard->circ_attempts < guard->circ_successes) { - log_notice(LD_BUG, "Unexpectedly high successes counts (%lf/%lf) " + log_notice(LD_BUG, "Unexpectedly high successes counts (%f/%f) " "for guard %s=%s", guard->circ_successes, guard->circ_attempts, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); @@ -1407,6 +1407,13 @@ pathbias_count_build_success(origin_circuit_t *circ) /** * Check if a circuit was used and/or closed successfully. + * + * If we attempted to use the circuit to carry a stream but failed + * for whatever reason, or if the circuit mysteriously died before + * we could attach any streams, record these two cases. + * + * If we *have* successfully used the circuit, or it appears to + * have been closed by us locally, count it as a success. */ void pathbias_check_close(origin_circuit_t *ocirc, int reason) @@ -1751,7 +1758,7 @@ entry_guard_inc_circ_attempt_count(entry_guard_t *guard) const int scale_factor = pathbias_get_scale_factor(options); const int mult_factor = pathbias_get_mult_factor(options); log_info(LD_CIRC, - "Scaling pathbias counts to (%lf/%lf)*(%d/%d) for guard %s=%s", + "Scaling pathbias counts to (%f/%f)*(%d/%d) for guard %s=%s", guard->circ_successes, guard->circ_attempts, mult_factor, scale_factor, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); @@ -1771,7 +1778,7 @@ entry_guard_inc_circ_attempt_count(entry_guard_t *guard) guard->unusable_circuits /= scale_factor; } guard->circ_attempts++; - log_info(LD_CIRC, "Got success count %lf/%lf for guard %s=%s", + log_info(LD_CIRC, "Got success count %f/%f for guard %s=%s", guard->circ_successes, guard->circ_attempts, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); return 0; diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index fc7f6ed..7aa4d7a 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1060,7 +1060,7 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) node->collapsed_circuits = collapsed; node->unusable_circuits = unusable; - log_info(LD_GENERAL, "Read %lf/%lf path bias for node %s", + log_info(LD_GENERAL, "Read %f/%f path bias for node %s", node->circ_successes, node->circ_attempts, node->nickname); /* Note: We rely on the < comparison here to allow us to set a 0 * rate and disable the feature entirely. If refactoring, don't @@ -1070,7 +1070,7 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) pathbias_get_dropguards(options)) { node->path_bias_disabled = 1; log_info(LD_GENERAL, - "Path bias is too high (%lf/%lf); disabling node %s", + "Path bias is too high (%f/%f); disabling node %s", node->circ_successes, node->circ_attempts, node->nickname); } @@ -1200,7 +1200,7 @@ entry_guards_update_state(or_state_t *state) /* In the long run: circuit_success ~= successful_circuit_close + * collapsed_circuits + * unusable_circuits */ - tor_asprintf(&line->value, "%lf %lf %lf %lf %lf %lf", + tor_asprintf(&line->value, "%f %f %f %f %f %f", e->circ_attempts, e->circ_successes, pathbias_get_closed_count(e), e->collapsed_circuits, e->unusable_circuits, e->timeouts);

1 0

[tor/master] Add the ability to count circuit timeouts for guards.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit 954f263ed5eb451a0742f8888681e10e64dd193a Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed Oct 24 17:34:18 2012 -0700 Add the ability to count circuit timeouts for guards. This is purely for informational reasons for debugging. --- src/or/circuitbuild.c | 67 +++++++++++++++++++++++++++++++++++++++++++++++++ src/or/circuituse.c | 2 + src/or/entrynodes.c | 18 +++++++++---- src/or/entrynodes.h | 2 + src/or/or.h | 2 + 5 files changed, 85 insertions(+), 6 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 7301874..c8c8db3 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1057,6 +1057,53 @@ pathbias_state_to_string(path_state_t state) } /** + * Decide if the path bias code should count a circuit. + * + * @returns 1 if we should count it, 0 otherwise. + */ +static int +pathbias_should_count(origin_circuit_t *circ) +{ +#define PATHBIAS_COUNT_INTERVAL (600) + static ratelim_t count_limit = + RATELIM_INIT(PATHBIAS_COUNT_INTERVAL); + char *rate_msg = NULL; + + /* We can't do path bias accounting without entry guards. + * Testing and controller circuits also have no guards. */ + if (get_options()->UseEntryGuards == 0 || + circ->base_.purpose == CIRCUIT_PURPOSE_TESTING || + circ->base_.purpose == CIRCUIT_PURPOSE_CONTROLLER) { + return 0; + } + + /* Completely ignore one hop circuits */ + if (circ->build_state->onehop_tunnel || + circ->build_state->desired_path_len == 1) { + /* Check for inconsistency */ + if (circ->build_state->desired_path_len != 1 || + !circ->build_state->onehop_tunnel) { + if ((rate_msg = rate_limit_log(&count_limit, approx_time()))) { + log_notice(LD_BUG, + "One-hop circuit has length %d. Path state is %s. " + "Circuit is a %s currently %s.%s", + circ->build_state->desired_path_len, + pathbias_state_to_string(circ->path_state), + circuit_purpose_to_string(circ->base_.purpose), + circuit_state_to_string(circ->base_.state), + rate_msg); + tor_free(rate_msg); + } + tor_fragile_assert(); + } + return 0; + } + + return 1; +} + + +/** * Check our circuit state to see if this is a successful first hop. * If so, record it in the current guard's path bias first_hop count. * @@ -1290,6 +1337,26 @@ pathbias_count_success(origin_circuit_t *circ) } } +/** + * Count timeouts for path bias log messages. + * + * These counts are purely informational. + */ +void +pathbias_count_timeout(origin_circuit_t *circ) +{ + if(!pathbias_should_count(circ)) { + return; + } + entry_guard_t *guard = + entry_guard_get_by_id_digest(circ->base_.n_chan->identity_digest); + + if (guard) { + guard->timeouts++; + entry_guards_changed(); + } +} + /** Increment the number of times we successfully extended a circuit to * 'guard', first checking if the failure rate is high enough that we should * eliminate the guard. Return -1 if the guard looks no good; return 0 if the diff --git a/src/or/circuituse.c b/src/or/circuituse.c index e14f9d0..77822a3 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -663,6 +663,8 @@ circuit_expire_building(void) circuit_mark_for_close(victim, END_CIRC_REASON_MEASUREMENT_EXPIRED); else circuit_mark_for_close(victim, END_CIRC_REASON_TIMEOUT); + + pathbias_count_timeout(TO_ORIGIN_CIRCUIT(victim)); } } diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 8712241..d9a06a6 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1021,7 +1021,7 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) digestmap_set(added_by, d, tor_strdup(line->value+HEX_DIGEST_LEN+1)); } else if (!strcasecmp(line->key, "EntryGuardPathBias")) { const or_options_t *options = get_options(); - unsigned hop_cnt, success_cnt; + unsigned hop_cnt, success_cnt, timeouts; if (!node) { *msg = tor_strdup("Unable to parse entry nodes: " @@ -1029,14 +1029,20 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) break; } - if (tor_sscanf(line->value, "%u %u", &success_cnt, &hop_cnt) != 2) { - log_warn(LD_GENERAL, "Unable to parse guard path bias info: " + /* First try 3 params, then 2. */ + if (tor_sscanf(line->value, "%u %u %u", &success_cnt, &hop_cnt, + &timeouts) != 3) { + timeouts = 0; + if (tor_sscanf(line->value, "%u %u", &success_cnt, &hop_cnt) != 2) { + log_warn(LD_GENERAL, "Unable to parse guard path bias info: " "Misformated EntryGuardPathBias %s", escaped(line->value)); - continue; + continue; + } } node->first_hops = hop_cnt; node->circuit_successes = success_cnt; + node->timeouts = timeouts; log_info(LD_GENERAL, "Read %u/%u path bias for node %s", node->circuit_successes, node->first_hops, node->nickname); /* Note: We rely on the < comparison here to allow us to set a 0 @@ -1173,8 +1179,8 @@ entry_guards_update_state(or_state_t *state) if (e->first_hops) { *next = line = tor_malloc_zero(sizeof(config_line_t)); line->key = tor_strdup("EntryGuardPathBias"); - tor_asprintf(&line->value, "%u %u", - e->circuit_successes, e->first_hops); + tor_asprintf(&line->value, "%u %u %u", + e->circuit_successes, e->first_hops, e->timeouts); next = &(line->next); } diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index 4d031c3..b347441 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -47,6 +47,8 @@ typedef struct entry_guard_t { unsigned first_hops; /**< Number of first hops this guard has completed */ unsigned circuit_successes; /**< Number of successfully built circuits using * this guard as first hop. */ + unsigned timeouts; /**< Number of 'right-censored' timeouts + for this guard. */ } entry_guard_t; entry_guard_t *entry_guard_get_by_id_digest(const char *digest); diff --git a/src/or/or.h b/src/or/or.h index 195cb2b..5920210 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4067,6 +4067,8 @@ typedef struct { double close_ms; } circuit_build_times_t; +void pathbias_count_timeout(origin_circuit_t *circ); + /********************************* config.c ***************************/ /** An error from options_trial_assign() or options_init_from_string(). */

1 0

[tor/master] Update pathbias parameters to match Proposal 209.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit 248fbc3619664e1d9f4b16732ccbdb484939624d Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed Oct 24 18:03:09 2012 -0700 Update pathbias parameters to match Proposal 209. Needs manpage update and testing still.. --- src/or/circuitbuild.c | 77 +++++++++++++++++++++++++++++++++++++----------- src/or/circuitbuild.h | 3 +- src/or/config.c | 5 ++- src/or/entrynodes.c | 5 ++- src/or/or.h | 5 ++- 5 files changed, 72 insertions(+), 23 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index c8c8db3..65c6492 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -985,7 +985,7 @@ circuit_init_cpath_crypto(crypt_path_t *cpath, const char *key_data, static int pathbias_get_min_circs(const or_options_t *options) { -#define DFLT_PATH_BIAS_MIN_CIRC 20 +#define DFLT_PATH_BIAS_MIN_CIRC 150 if (options->PathBiasCircThreshold >= 5) return options->PathBiasCircThreshold; else @@ -997,7 +997,7 @@ pathbias_get_min_circs(const or_options_t *options) static double pathbias_get_notice_rate(const or_options_t *options) { -#define DFLT_PATH_BIAS_NOTICE_PCT 40 +#define DFLT_PATH_BIAS_NOTICE_PCT 70 if (options->PathBiasNoticeRate >= 0.0) return options->PathBiasNoticeRate; else @@ -1007,22 +1007,45 @@ pathbias_get_notice_rate(const or_options_t *options) /* XXXX024 I'd like to have this be static again, but entrynodes.c needs it. */ double -pathbias_get_disable_rate(const or_options_t *options) +pathbias_get_warn_rate(const or_options_t *options) { -// XXX: This needs tuning based on use + experimentation before we set it -#define DFLT_PATH_BIAS_DISABLE_PCT 0 - if (options->PathBiasDisableRate >= 0.0) - return options->PathBiasDisableRate; +#define DFLT_PATH_BIAS_WARN_PCT 50 + if (options->PathBiasWarnRate >= 0.0) + return options->PathBiasWarnRate; else - return networkstatus_get_param(NULL, "pb_disablepct", - DFLT_PATH_BIAS_DISABLE_PCT, 0, 100)/100.0; + return networkstatus_get_param(NULL, "pb_warnpct", + DFLT_PATH_BIAS_WARN_PCT, 0, 100)/100.0; +} + +/* XXXX024 I'd like to have this be static again, but entrynodes.c needs it. */ +double +pathbias_get_crit_rate(const or_options_t *options) +{ +#define DFLT_PATH_BIAS_CRIT_PCT 30 + if (options->PathBiasCritRate >= 0.0) + return options->PathBiasCritRate; + else + return networkstatus_get_param(NULL, "pb_critpct", + DFLT_PATH_BIAS_CRIT_PCT, 0, 100)/100.0; +} + +/* XXXX024 I'd like to have this be static again, but entrynodes.c needs it. */ +int +pathbias_get_dropguards(const or_options_t *options) +{ +#define DFLT_PATH_BIAS_DROP_GUARDS 0 + if (options->PathBiasDropGuards >= 0) + return options->PathBiasDropGuards; + else + return networkstatus_get_param(NULL, "pb_dropguards", + DFLT_PATH_BIAS_DROP_GUARDS, 0, 100)/100.0; } static int pathbias_get_scale_threshold(const or_options_t *options) { -#define DFLT_PATH_BIAS_SCALE_THRESHOLD 200 - if (options->PathBiasScaleThreshold >= 2) +#define DFLT_PATH_BIAS_SCALE_THRESHOLD 300 + if (options->PathBiasScaleThreshold >= 10) return options->PathBiasScaleThreshold; else return networkstatus_get_param(NULL, "pb_scalecircs", @@ -1041,6 +1064,18 @@ pathbias_get_scale_factor(const or_options_t *options) DFLT_PATH_BIAS_SCALE_FACTOR, 1, INT32_MAX); } +static int +pathbias_get_mult_factor(const or_options_t *options) +{ +#define DFLT_PATH_BIAS_MULT_FACTOR 1 + if (options->PathBiasMultFactor >= 1) + return options->PathBiasMultFactor; + else + return networkstatus_get_param(NULL, "pb_multfactor", + DFLT_PATH_BIAS_MULT_FACTOR, 1, + pathbias_get_scale_factor(options)-1); +} + static const char * pathbias_state_to_string(path_state_t state) { @@ -1373,7 +1408,7 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) * rate and disable the feature entirely. If refactoring, don't * change to <= */ if (guard->circuit_successes/((double)guard->first_hops) - < pathbias_get_disable_rate(options)) { + < pathbias_get_crit_rate(options)) { /* This message is currently disabled by default. */ log_warn(LD_PROTOCOL, @@ -1383,8 +1418,10 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); - guard->path_bias_disabled = 1; - guard->bad_since = approx_time(); + if (pathbias_get_dropguards(options)) { + guard->path_bias_disabled = 1; + guard->bad_since = approx_time(); + } return -1; } else if (guard->circuit_successes/((double)guard->first_hops) < pathbias_get_notice_rate(options) @@ -1400,15 +1437,19 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) /* If we get a ton of circuits, just scale everything down */ if (guard->first_hops > (unsigned)pathbias_get_scale_threshold(options)) { const int scale_factor = pathbias_get_scale_factor(options); + const int mult_factor = pathbias_get_mult_factor(options); /* For now, only scale if there will be no rounding error... * XXX024: We want to switch to a real moving average for 0.2.4. */ - if ((guard->first_hops % scale_factor) == 0 && - (guard->circuit_successes % scale_factor) == 0) { + if (((mult_factor*guard->first_hops) % scale_factor) == 0 && + ((mult_factor*guard->circuit_successes) % scale_factor) == 0) { log_info(LD_PROTOCOL, - "Scaling pathbias counts to (%u/%u)/%d for guard %s=%s", - guard->circuit_successes, guard->first_hops, + "Scaling pathbias counts to (%u/%u)*(%d/%d) for guard %s=%s", + guard->circuit_successes, guard->first_hops, mult_factor, scale_factor, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); + guard->first_hops *= mult_factor; + guard->circuit_successes *= mult_factor; + guard->first_hops /= scale_factor; guard->circuit_successes /= scale_factor; } diff --git a/src/or/circuitbuild.h b/src/or/circuitbuild.h index 78575af..52f9f79 100644 --- a/src/or/circuitbuild.h +++ b/src/or/circuitbuild.h @@ -53,7 +53,8 @@ const char *build_state_get_exit_nickname(cpath_build_state_t *state); const node_t *choose_good_entry_server(uint8_t purpose, cpath_build_state_t *state); -double pathbias_get_disable_rate(const or_options_t *options); +double pathbias_get_crit_rate(const or_options_t *options); +int pathbias_get_dropguards(const or_options_t *options); #endif diff --git a/src/or/config.c b/src/or/config.c index 75f6193..fffe14c 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -316,9 +316,12 @@ static config_var_t option_vars_[] = { V(PathBiasCircThreshold, INT, "-1"), V(PathBiasNoticeRate, DOUBLE, "-1"), - V(PathBiasDisableRate, DOUBLE, "-1"), + V(PathBiasWarnRate, DOUBLE, "-1"), + V(PathBiasCritRate, DOUBLE, "-1"), V(PathBiasScaleThreshold, INT, "-1"), V(PathBiasScaleFactor, INT, "-1"), + V(PathBiasMultFactor, INT, "-1"), + V(PathBiasDropGuards, BOOL, "0"), OBSOLETE("PathlenCoinWeight"), V(PerConnBWBurst, MEMUNIT, "0"), diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index d9a06a6..faf5269 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1048,8 +1048,9 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg) /* Note: We rely on the < comparison here to allow us to set a 0 * rate and disable the feature entirely. If refactoring, don't * change to <= */ - if (node->circuit_successes/((double)node->first_hops) - < pathbias_get_disable_rate(options)) { + if ((node->circuit_successes/((double)node->first_hops) + < pathbias_get_crit_rate(options)) && + pathbias_get_dropguards(options)) { node->path_bias_disabled = 1; log_info(LD_GENERAL, "Path bias is too high (%u/%u); disabling node %s", diff --git a/src/or/or.h b/src/or/or.h index 5920210..cef5201 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3784,9 +3784,12 @@ typedef struct { */ int PathBiasCircThreshold; double PathBiasNoticeRate; - double PathBiasDisableRate; + double PathBiasWarnRate; + double PathBiasCritRate; + int PathBiasDropGuards; int PathBiasScaleThreshold; int PathBiasScaleFactor; + int PathBiasMultFactor; /** @} */ int IPv6Exit; /**< Do we support exiting to IPv6 addresses? */

1 0

[tor/master] Add log message checks for different rates.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit 9bf5582e7368bf91e2b9bf9e88ee71d2ba51a335 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Wed Oct 24 18:15:41 2012 -0700 Add log message checks for different rates. May want to squash this forward or back.. --- src/or/circuitbuild.c | 17 ++++++++++++++--- src/or/entrynodes.h | 6 +++++- 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 65c6492..3423432 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1408,7 +1408,8 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) * rate and disable the feature entirely. If refactoring, don't * change to <= */ if (guard->circuit_successes/((double)guard->first_hops) - < pathbias_get_crit_rate(options)) { + < pathbias_get_crit_rate(options) + && !guard->path_bias_crited) { /* This message is currently disabled by default. */ log_warn(LD_PROTOCOL, @@ -1417,6 +1418,7 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) "a bug.", guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); + guard->path_bias_crited = 1; if (pathbias_get_dropguards(options)) { guard->path_bias_disabled = 1; @@ -1424,14 +1426,23 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) } return -1; } else if (guard->circuit_successes/((double)guard->first_hops) + < pathbias_get_warn_rate(options) + && !guard->path_bias_warned) { + guard->path_bias_warned = 1; + log_notice(LD_PROTOCOL, + "Low circuit success rate %u/%u for guard %s=%s.", + guard->circuit_successes, guard->first_hops, guard->nickname, + hex_str(guard->identity, DIGEST_LEN)); + } else if (guard->circuit_successes/((double)guard->first_hops) < pathbias_get_notice_rate(options) - && !guard->path_bias_notice) { - guard->path_bias_notice = 1; + && !guard->path_bias_noticed) { + guard->path_bias_noticed = 1; log_notice(LD_PROTOCOL, "Low circuit success rate %u/%u for guard %s=%s.", guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); } + } /* If we get a ton of circuits, just scale everything down */ diff --git a/src/or/entrynodes.h b/src/or/entrynodes.h index b347441..6fdb3f7 100644 --- a/src/or/entrynodes.h +++ b/src/or/entrynodes.h @@ -31,7 +31,11 @@ typedef struct entry_guard_t { * router, 1 if we have. */ unsigned int can_retry : 1; /**< Should we retry connecting to this entry, * in spite of having it marked as unreachable?*/ - unsigned int path_bias_notice : 1; /**< Did we alert the user about path bias + unsigned int path_bias_noticed : 1; /**< Did we alert the user about path bias + * for this node already? */ + unsigned int path_bias_warned : 1; /**< Did we alert the user about path bias + * for this node already? */ + unsigned int path_bias_crited : 1; /**< Did we alert the user about path bias * for this node already? */ unsigned int path_bias_disabled : 1; /**< Have we disabled this node because * of path bias issues? */

1 0

[tor/master] Update Path Bias log messages to match Proposal 209.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit ab9c83c949bd415271281f96c04ff598a9a3b7b5 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu Oct 25 13:42:37 2012 -0700 Update Path Bias log messages to match Proposal 209. --- src/or/circuitbuild.c | 51 +++++++++++++++++++++++++++++++++--------------- 1 files changed, 35 insertions(+), 16 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 3423432..6f91fc3 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1410,37 +1410,56 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) if (guard->circuit_successes/((double)guard->first_hops) < pathbias_get_crit_rate(options) && !guard->path_bias_crited) { - - /* This message is currently disabled by default. */ - log_warn(LD_PROTOCOL, - "Extremely low circuit success rate %u/%u for guard %s=%s. " - "This indicates either an overloaded guard, an attack, or " - "a bug.", - guard->circuit_successes, guard->first_hops, guard->nickname, - hex_str(guard->identity, DIGEST_LEN)); guard->path_bias_crited = 1; - + if (pathbias_get_dropguards(options)) { + /* This message is currently disabled by default. */ + log_warn(LD_PROTOCOL, + "Your Guard %s=%s is failing an extremely large amount of " + "circuits. Tor has disabled use of this guard. Success " + "counts are %d/%d, with %d timeouts. For reference, your " + "timeout cutoff is %ld.", + guard->nickname, hex_str(guard->identity, DIGEST_LEN), + guard->circuit_successes, guard->first_hops, guard->timeouts, + (long)circ_times.close_ms/1000); guard->path_bias_disabled = 1; guard->bad_since = approx_time(); + } else { + log_warn(LD_PROTOCOL, + "Your Guard %s=%s is failing an extremely large amount of " + "circuits. Success counts are %d/%d, with %d timeouts. " + "For reference, your timeout cutoff is %ld.", + guard->nickname, hex_str(guard->identity, DIGEST_LEN), + guard->circuit_successes, guard->first_hops, guard->timeouts, + (long)circ_times.close_ms/1000); } return -1; } else if (guard->circuit_successes/((double)guard->first_hops) < pathbias_get_warn_rate(options) && !guard->path_bias_warned) { guard->path_bias_warned = 1; - log_notice(LD_PROTOCOL, - "Low circuit success rate %u/%u for guard %s=%s.", - guard->circuit_successes, guard->first_hops, guard->nickname, - hex_str(guard->identity, DIGEST_LEN)); + log_warn(LD_PROTOCOL, + "Your Guard %s=%s is failing a very large amount of " + "circuits. Most likely this means the Tor network is " + "overloaded, but it could also mean an attack against " + "you or the potentially the guard itself. Success counts " + "are %d/%d, with %d timeouts. For reference, your timeout " + "cutoff is %ld.", + guard->nickname, hex_str(guard->identity, DIGEST_LEN), + guard->circuit_successes, guard->first_hops, guard->timeouts, + (long)circ_times.close_ms/1000); } else if (guard->circuit_successes/((double)guard->first_hops) < pathbias_get_notice_rate(options) && !guard->path_bias_noticed) { guard->path_bias_noticed = 1; log_notice(LD_PROTOCOL, - "Low circuit success rate %u/%u for guard %s=%s.", - guard->circuit_successes, guard->first_hops, guard->nickname, - hex_str(guard->identity, DIGEST_LEN)); + "Your Guard %s=%s is failing more circuits than usual. Most " + "likely this means the Tor network is overloaded. Success " + "counts are %d/%d, with %d timeouts. For reference, your " + "timeout cutoff is %ld.", + guard->nickname, hex_str(guard->identity, DIGEST_LEN), + guard->circuit_successes, guard->first_hops, guard->timeouts, + (long)circ_times.close_ms/1000); } }

1 0

[tor/master] Refactor pathbias functions to use pathbias_should_count.
by nickm＠torproject.org 26 Dec '12

26 Dec '12

commit a54873648f226fc9b16a3c1c192b0bae6559dbbc Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu Oct 25 14:05:44 2012 -0700 Refactor pathbias functions to use pathbias_should_count. --- src/or/circuitbuild.c | 58 +----------------------------------------------- 1 files changed, 2 insertions(+), 56 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 6f91fc3..299ca29 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1152,34 +1152,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) RATELIM_INIT(FIRST_HOP_NOTICE_INTERVAL); char *rate_msg = NULL; - /* We can't do path bias accounting without entry guards. - * Testing and controller circuits also have no guards. */ - if (get_options()->UseEntryGuards == 0 || - circ->base_.purpose == CIRCUIT_PURPOSE_TESTING || - circ->base_.purpose == CIRCUIT_PURPOSE_CONTROLLER) { - return 0; - } - - /* Completely ignore one hop circuits */ - if (circ->build_state->onehop_tunnel || - circ->build_state->desired_path_len == 1) { - /* Check for inconsistency */ - if (circ->build_state->desired_path_len != 1 || - !circ->build_state->onehop_tunnel) { - if ((rate_msg = rate_limit_log(&first_hop_notice_limit, - approx_time()))) { - log_notice(LD_BUG, - "One-hop circuit has length %d. Path state is %s. " - "Circuit is a %s currently %s.%s", - circ->build_state->desired_path_len, - pathbias_state_to_string(circ->path_state), - circuit_purpose_to_string(circ->base_.purpose), - circuit_state_to_string(circ->base_.state), - rate_msg); - tor_free(rate_msg); - } - tor_fragile_assert(); - } + if (!pathbias_should_count(circ)) { return 0; } @@ -1276,34 +1249,7 @@ pathbias_count_success(origin_circuit_t *circ) char *rate_msg = NULL; entry_guard_t *guard = NULL; - /* We can't do path bias accounting without entry guards. - * Testing and controller circuits also have no guards. */ - if (get_options()->UseEntryGuards == 0 || - circ->base_.purpose == CIRCUIT_PURPOSE_TESTING || - circ->base_.purpose == CIRCUIT_PURPOSE_CONTROLLER) { - return; - } - - /* Ignore one hop circuits */ - if (circ->build_state->onehop_tunnel || - circ->build_state->desired_path_len == 1) { - /* Check for consistency */ - if (circ->build_state->desired_path_len != 1 || - !circ->build_state->onehop_tunnel) { - if ((rate_msg = rate_limit_log(&success_notice_limit, - approx_time()))) { - log_notice(LD_BUG, - "One-hop circuit has length %d. Path state is %s. " - "Circuit is a %s currently %s.%s", - circ->build_state->desired_path_len, - pathbias_state_to_string(circ->path_state), - circuit_purpose_to_string(circ->base_.purpose), - circuit_state_to_string(circ->base_.state), - rate_msg); - tor_free(rate_msg); - } - tor_fragile_assert(); - } + if (!pathbias_should_count(circ)) { return; }

1 0