- tor-commits - lists.torproject.org

[tor/master] Add documentation for the client-side DNS cache options
by nickm＠torproject.org 17 Dec '12

17 Dec '12

commit bde6f2daba59fc75ec32d91e2a29f8d21a08d487 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 25 15:30:11 2012 -0500 Add documentation for the client-side DNS cache options --- doc/tor.1.txt | 29 ++++++++++++++++++++++++----- 1 files changed, 24 insertions(+), 5 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 29d99b8..d6b51cb 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -929,11 +929,30 @@ The following options are useful only for clients (that is, if Tells exits that, if a host has both an IPv4 and an IPv6 address, we would prefer to connect to it via IPv6. (IPv4 is the default.) + + - NOTE: Although this option allows you to specify an IP address other than - localhost, you should do so only with extreme caution. The SOCKS - protocol is unencrypted and (as we use it) unauthenticated, so exposing - it in this way could leak your information to anybody watching your - network, and allow anybody to use your computer as an open proxy. + NOTE: Although this option allows you to specify an IP address + other than localhost, you should do so only with extreme caution. + The SOCKS protocol is unencrypted and (as we use it) + unauthenticated, so exposing it in this way could leak your + information to anybody watching your network, and allow anybody + to use your computer as an open proxy. + **CacheIPv4DNS**;; + Tells the client to remember IPv4 DNS answers we receive from exit + nodes via this connection. (On by default.) + **CacheIPv6DNS**;; + Tells the client to remember IPv6 DNS answers we receive from exit + nodes via this connection. + **CacheDNS**;; + Tells the client to remember all DNS answers we receive from exit + nodes via this connection. + **UseIPv4Cache**;; + Tells the client to use any cached IPv4 DNS answers we have when making + requests via this connection. (On by default.) + **UseIPv6Cache**;; + Tells the client to use any cached IPv6 DNS answers we have when making + requests via this connection. + **UseDNSCache**;; + Tells the client to use any cached DNS answers we have when making + requests via this connection. **SOCKSListenAddress** __IP__[:__PORT__]:: Bind to this address to listen for connections from Socks-speaking

1 0

[tor/master] Refactor port_cfg_t creation into a port_cfg_new() function
by nickm＠torproject.org 17 Dec '12

17 Dec '12

commit 7315a6764675ca2a148554488504f5abf98ff7e6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 25 14:57:10 2012 -0500 Refactor port_cfg_t creation into a port_cfg_new() function This function gives us a single place to set reasonable default flags for port_cfg_t entries, to avoid bugs like the one where we weren't setting ipv4_traffic_ok to 1 on SocksPorts initialized in an older way. --- src/or/config.c | 25 ++++++++++++++++--------- 1 files changed, 16 insertions(+), 9 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index d0d0049..9f54d3d 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -678,7 +678,7 @@ config_free_all(void) if (configured_ports) { SMARTLIST_FOREACH(configured_ports, - port_cfg_t *, p, tor_free(p)); + port_cfg_t *, p, port_cfg_free(p)); smartlist_free(configured_ports); configured_ports = NULL; } @@ -4589,6 +4589,17 @@ parse_dir_fallback_line(const char *line, return r; } +/** Allocate and return a new port_cfg_t with reasonable defaults. */ +static port_cfg_t * +port_cfg_new(void) +{ + port_cfg_t *cfg = tor_malloc_zero(sizeof(port_cfg_t)); + cfg->ipv4_traffic = 1; + cfg->cache_ipv4_answers = 1; + cfg->use_cached_ipv4_answers = 1; + return cfg; +} + /** Free all storage held in port */ static void port_cfg_free(port_cfg_t *port) @@ -4763,7 +4774,7 @@ parse_port_config(smartlist_t *out, if (use_server_options && out) { /* Add a no_listen port. */ - port_cfg_t *cfg = tor_malloc_zero(sizeof(port_cfg_t)); + port_cfg_t *cfg = port_cfg_new(); cfg->type = listener_type; cfg->port = mainport; tor_addr_make_unspec(&cfg->addr); /* Server ports default to 0.0.0.0 */ @@ -4782,15 +4793,13 @@ parse_port_config(smartlist_t *out, return -1; } if (out) { - port_cfg_t *cfg = tor_malloc_zero(sizeof(port_cfg_t)); + port_cfg_t *cfg = port_cfg_new(); cfg->type = listener_type; cfg->port = port ? port : mainport; tor_addr_copy(&cfg->addr, &addr); cfg->session_group = SESSION_GROUP_UNSET; cfg->isolation_flags = ISO_DEFAULT; cfg->no_advertise = 1; - cfg->ipv4_traffic = 1; - cfg->cache_ipv4_answers = cfg->use_cached_ipv4_answers = 1; smartlist_add(out, cfg); } } @@ -4808,14 +4817,12 @@ parse_port_config(smartlist_t *out, * one. */ if (! ports) { if (defaultport && out) { - port_cfg_t *cfg = tor_malloc_zero(sizeof(port_cfg_t)); + port_cfg_t *cfg = port_cfg_new(); cfg->type = listener_type; cfg->port = defaultport; tor_addr_parse(&cfg->addr, defaultaddr); cfg->session_group = SESSION_GROUP_UNSET; cfg->isolation_flags = ISO_DEFAULT; - cfg->ipv4_traffic = 1; - cfg->cache_ipv4_answers = cfg->use_cached_ipv4_answers = 1; smartlist_add(out, cfg); } return 0; @@ -5033,7 +5040,7 @@ parse_port_config(smartlist_t *out, } if (out && port) { - port_cfg_t *cfg = tor_malloc_zero(sizeof(port_cfg_t)); + port_cfg_t *cfg = port_cfg_new(); tor_addr_copy(&cfg->addr, &addr); cfg->port = port; cfg->type = listener_type;

1 0

[tor/master] Changes file for new DNS caching options
by nickm＠torproject.org 17 Dec '12

17 Dec '12

commit 522e90d6610da3ca809c842b452c56ecab5d501b Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 25 16:38:29 2012 -0500 Changes file for new DNS caching options --- changes/prop205-simplified | 21 +++++++++++++++++++++ 1 files changed, 21 insertions(+), 0 deletions(-) diff --git a/changes/prop205-simplified b/changes/prop205-simplified new file mode 100644 index 0000000..c764fea --- /dev/null +++ b/changes/prop205-simplified @@ -0,0 +1,21 @@ + o Major features: + + - The updating and usage of DNS cache is now configurable on a + per- client-port level. SOCKSPort, DNSPort, etc lines may now + contain {No,}Cache{IPv4,IPv6,}DNS lines to indicate that we + shouldn't cache these types of DNS answers when we receive them + from an exit node in response to a request from this port, and + {No,}UseCached{IPv4,IPv6,DNS} lines to indicate that if we have + cached DNS answers of these types, we shouldn't use them. It's + potentially risky to use cached DNS answers at the client, + since doing so can indicate to one exit + what answers we've gotten for DNS lookups in the past. With + IPv6, this becomes especially problematic. Using cached DNS + answers for requests on the same circuit would present less + linkability risk, since all traffic on a circuits is already + linkable, but it would also provide little performance benefit: + the exit node caches DNS replies too. Implements a simplified + version of Proposal 205. + + +

1 0

[tor/master] changes entry for disabling cache usage by default
by nickm＠torproject.org 17 Dec '12

17 Dec '12

commit 593b235cc95f3b4a3b6c2abec852a59786cb768b Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 25 16:45:24 2012 -0500 changes entry for disabling cache usage by default --- changes/prop205-simplified | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) diff --git a/changes/prop205-simplified b/changes/prop205-simplified index c764fea..25d204d 100644 --- a/changes/prop205-simplified +++ b/changes/prop205-simplified @@ -1,4 +1,4 @@ - o Major features: + o Major features (client-side DNS): - The updating and usage of DNS cache is now configurable on a per- client-port level. SOCKSPort, DNSPort, etc lines may now @@ -15,7 +15,11 @@ linkability risk, since all traffic on a circuits is already linkable, but it would also provide little performance benefit: the exit node caches DNS replies too. Implements a simplified - version of Proposal 205. + version of Proposal 205. Implements ticket #7570. + o Disabled features: + - Client-side use of the DNS cache is now off by default. See "Major + features (client-side DNS)" for more information. Implements a + simplified version of Proposal 205. Implements ticket #7570.

1 0

[tor/master] Turn off by-default use of client-side DNS cacheing.
by nickm＠torproject.org 17 Dec '12

17 Dec '12

commit ac990aa44a2e3f2b03f2f91e93847230c744dc5c Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 25 15:36:35 2012 -0500 Turn off by-default use of client-side DNS cacheing. --- doc/tor.1.txt | 4 +++- src/or/config.c | 3 +-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index d6b51cb..5cf7ff7 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -946,7 +946,9 @@ The following options are useful only for clients (that is, if nodes via this connection. **UseIPv4Cache**;; Tells the client to use any cached IPv4 DNS answers we have when making - requests via this connection. (On by default.) + requests via this connection. (NOTE: This option, along UseIPv6Cache + and UseDNSCache, can harm your anonymity, and probably + won't help performance as much as you might expect. Use with care!) **UseIPv6Cache**;; Tells the client to use any cached IPv6 DNS answers we have when making requests via this connection. diff --git a/src/or/config.c b/src/or/config.c index 9f54d3d..04f512b 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -4596,7 +4596,6 @@ port_cfg_new(void) port_cfg_t *cfg = tor_malloc_zero(sizeof(port_cfg_t)); cfg->ipv4_traffic = 1; cfg->cache_ipv4_answers = 1; - cfg->use_cached_ipv4_answers = 1; return cfg; } @@ -4844,7 +4843,7 @@ parse_port_config(smartlist_t *out, int no_listen = 0, no_advertise = 0, all_addrs = 0, bind_ipv4_only = 0, bind_ipv6_only = 0, ipv4_traffic = 1, ipv6_traffic = 0, prefer_ipv6 = 0, - cache_ipv4 = 1, use_cached_ipv4 = 1, + cache_ipv4 = 1, use_cached_ipv4 = 0, cache_ipv6 = 0, use_cached_ipv6 = 0; smartlist_split_string(elts, ports->value, NULL,

1 0

[tor/master] Fix another uninitialized var warning from GCC
by nickm＠torproject.org 17 Dec '12

17 Dec '12

commit 88d7312ff29cda982f928caf3ddab4df189b245c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 6 12:26:10 2012 -0500 Fix another uninitialized var warning from GCC --- src/or/routerlist.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 6fff70b..65d1be5 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -1285,7 +1285,7 @@ router_pick_trusteddirserver_impl(const smartlist_t *sourcelist, smartlist_t *direct, *tunnel; smartlist_t *overloaded_direct, *overloaded_tunnel; const routerinfo_t *me = router_get_my_routerinfo(); - const routerstatus_t *result; + const routerstatus_t *result=NULL; time_t now = time(NULL); const int requireother = ! (flags & PDS_ALLOW_SELF); const int fascistfirewall = ! (flags & PDS_IGNORE_FASCISTFIREWALL);

1 0

[tor/master] Fixed an unused-variable warning
by nickm＠torproject.org 17 Dec '12

17 Dec '12

commit 8969d9e0b6b95e29713ffabc7cb4492a4dba2e28 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Dec 6 11:45:06 2012 -0500 Fixed an unused-variable warning --- src/or/connection_edge.c | 4 ---- 1 files changed, 0 insertions(+), 4 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 61e57bf..3207f58 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -2064,10 +2064,6 @@ connection_ap_handshake_socks_resolved(entry_connection_t *conn, size_t replylen; if (ttl >= 0) { - origin_circuit_t *origin_circ = NULL; - circuit_t *circ = ENTRY_TO_EDGE_CONN(conn)->on_circuit; - if (CIRCUIT_IS_ORIGIN(circ)) /* should always be true */ - origin_circ = TO_ORIGIN_CIRCUIT(circ); if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4) { tor_addr_t a; tor_addr_from_ipv4n(&a, get_uint32(answer));

1 0

[tor/master] Refactor the code to check if an address is matched by automapsuffixes
by nickm＠torproject.org 17 Dec '12

17 Dec '12

commit 963b3d15492c6cda3feac6efcff768913352ac2c Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 25 14:31:35 2012 -0500 Refactor the code to check if an address is matched by automapsuffixes --- src/or/addressmap.c | 28 +++++++++++++++++++--------- src/or/addressmap.h | 2 ++ src/or/connection_edge.c | 8 ++------ 3 files changed, 23 insertions(+), 15 deletions(-) diff --git a/src/or/addressmap.c b/src/or/addressmap.c index 5815bfb..8502178 100644 --- a/src/or/addressmap.c +++ b/src/or/addressmap.c @@ -210,6 +210,24 @@ addressmap_clear_excluded_trackexithosts(const or_options_t *options) } STRMAP_FOREACH_END; } +/** Return true iff address is one that we are configured to + * automap on resolve according to options. */ +int +addressmap_address_should_automap(const char *address, + const or_options_t *options) +{ + const smartlist_t *suffix_list = options->AutomapHostsSuffixes; + + if (!suffix_list) + return 0; + + SMARTLIST_FOREACH_BEGIN(suffix_list, const char *, suffix) { + if (!strcasecmpend(address, suffix)) + return 1; + } SMARTLIST_FOREACH_END(suffix); + return 0; +} + /** Remove all AUTOMAP mappings from the addressmap for which the * source address no longer matches AutomapHostsSuffixes, which is * no longer allowed by AutomapHostsOnResolve, or for which the @@ -232,15 +250,7 @@ addressmap_clear_invalid_automaps(const or_options_t *options) continue; /* not an automap mapping. */ if (!remove) { - int suffix_found = 0; - SMARTLIST_FOREACH(suffixes, const char *, suffix, { - if (!strcasecmpend(src_address, suffix)) { - suffix_found = 1; - break; - } - }); - if (!suffix_found) - remove = 1; + remove = ! addressmap_address_should_automap(src_address, options); } if (!remove && ! address_is_in_virtual_range(ent->new_address)) diff --git a/src/or/addressmap.h b/src/or/addressmap.h index 0c73201..4534fff 100644 --- a/src/or/addressmap.h +++ b/src/or/addressmap.h @@ -42,6 +42,8 @@ void clear_trackexithost_mappings(const char *exitname); void client_dns_set_reverse_addressmap(entry_connection_t *for_conn, const char *address, const char *v, const char *exitname, int ttl); +int addressmap_address_should_automap(const char *address, + const or_options_t *options); #endif diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 3207f58..9ccf58e 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -928,12 +928,8 @@ connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn, if (socks->command == SOCKS_COMMAND_RESOLVE && !tor_inet_aton(socks->address, &addr_tmp) && - options->AutomapHostsOnResolve && options->AutomapHostsSuffixes) { - SMARTLIST_FOREACH(options->AutomapHostsSuffixes, const char *, cp, - if (!strcasecmpend(socks->address, cp)) { - automap = 1; - break; - }); + options->AutomapHostsOnResolve) { + automap = addressmap_address_should_automap(socks->address, options); if (automap) { const char *new_addr; new_addr = addressmap_register_virtual_address(

1 0

[tor/master] Don't use the cache when changing an IP address because of an exit policy
by nickm＠torproject.org 17 Dec '12

17 Dec '12

commit 8eb422e7bda1d9ffbd0032f343c7a00af6d81ef2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Nov 27 20:53:09 2012 -0500 Don't use the cache when changing an IP address because of an exit policy --- src/or/relay.c | 25 ++++++++++++------------- 1 files changed, 12 insertions(+), 13 deletions(-) diff --git a/src/or/relay.c b/src/or/relay.c index 8955d31..2103087 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -706,6 +706,7 @@ connection_ap_process_end_not_open( case END_STREAM_REASON_EXITPOLICY: if (rh->length >= 5) { tor_addr_t addr; + int ttl = -1; tor_addr_make_unspec(&addr); if (rh->length == 5 || rh->length == 9) { @@ -745,6 +746,16 @@ connection_ap_process_end_not_open( client_dns_set_addressmap(conn, conn->socks_request->address, &addr, conn->chosen_exit_name, ttl); + + { + char new_addr[TOR_ADDR_BUF_LEN]; + tor_addr_to_str(new_addr, &addr, sizeof(new_addr), 1); + if (strcmp(conn->socks_request->address, new_addr)) { + strlcpy(conn->socks_request->address, new_addr, + sizeof(conn->socks_request->address)); + control_event_stream_status(conn, STREAM_EVENT_REMAP, 0); + } + } } /* check if he *ought* to have allowed it */ if (exitrouter && @@ -757,19 +768,7 @@ connection_ap_process_end_not_open( node_describe(exitrouter)); policies_set_node_exitpolicy_to_reject_all(exitrouter); } - /* rewrite it to an IP if we learned one. */ - { - unsigned rewrite_flags = 0; - if (conn->use_cached_ipv4_answers) - rewrite_flags |= AMR_FLAG_USE_IPV4_DNS; - if (conn->use_cached_ipv6_answers) - rewrite_flags |= AMR_FLAG_USE_IPV6_DNS; - if (addressmap_rewrite(conn->socks_request->address, - sizeof(conn->socks_request->address), - rewrite_flags, NULL, NULL)) { - control_event_stream_status(conn, STREAM_EVENT_REMAP, 0); - } - } + if (conn->chosen_exit_optional || conn->chosen_exit_retries) { /* stop wanting a specific exit */

1 0

[tor/master] Build and test most of the machinery needed for IPv6 virtualaddrmaps
by nickm＠torproject.org 17 Dec '12

17 Dec '12

commit de4cc126cbb5e663bdd048fd782fde869be7b80a Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 23 17:31:53 2012 -0500 Build and test most of the machinery needed for IPv6 virtualaddrmaps With an IPv6 virtual address map, we can basically hand out a new IPv6 address for _every_ address we connect to. That'll be cool, and will let us maybe get around prop205 issues. This uses some fancy logic to try to make the code paths in the ipv4 and the ipv6 case as close as possible, and moves to randomly generated addresses so we don't need to maintain those stupid counters that will collide if Tor restarts but apps don't. Also has some XXXX items to fix to make this useful. More design needed. --- doc/tor.1.txt | 16 +++-- src/or/addressmap.c | 182 ++++++++++++++++++++++++++++++---------------- src/or/addressmap.h | 13 +++- src/or/config.c | 19 ++++- src/or/connection_edge.c | 5 +- src/or/control.c | 9 ++- src/or/or.h | 6 +- src/test/test_addr.c | 71 ++++++++++++++++++ 8 files changed, 239 insertions(+), 82 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 5cf7ff7..ec350ba 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1040,16 +1040,20 @@ The following options are useful only for clients (that is, if applications to do DNS resolves themselves is usually a bad idea and can leak your location to attackers. (Default: 1) -**VirtualAddrNetwork** __Address__/__bits__:: +**VirtualAddrNetworkIPv4** __Address__/__bits__ + + +**VirtualAddrNetworkIPv6** [__Address__]/__bits__:: When Tor needs to assign a virtual (unused) address because of a MAPADDRESS command from the controller or the AutomapHostsOnResolve feature, Tor - picks an unassigned address from this range. (Default: - 127.192.0.0/10) + + picks an unassigned address from this range. (Defaults: + 127.192.0.0/10 and [FE80::]/10 respectively.) + + When providing proxy server service to a network of computers using a tool - like dns-proxy-tor, change this address to "10.192.0.0/10" or - "172.16.0.0/12". The default **VirtualAddrNetwork** address range on a - properly configured machine will route to the loopback interface. For + like dns-proxy-tor, change the IPv4 network to "10.192.0.0/10" or + "172.16.0.0/12" and change the IPv6 network to "[FC00]/7". + The default **VirtualAddrNetwork** address ranges on a + properly configured machine will route to the loopback or link-local + interface. For local use, no change to the default VirtualAddrNetwork setting is needed. **AllowNonRFC953Hostnames** **0**|**1**:: diff --git a/src/or/addressmap.c b/src/or/addressmap.c index 8502178..e1efbf4 100644 --- a/src/or/addressmap.c +++ b/src/or/addressmap.c @@ -4,6 +4,8 @@ * Copyright (c) 2007-2012, The Tor Project, Inc. */ /* See LICENSE for licensing information */ +#define ADDRESSMAP_PRIVATE + #include "or.h" #include "addressmap.h" #include "circuituse.h" @@ -52,11 +54,13 @@ typedef struct { /** Entry for mapping addresses to which virtual address we mapped them to. */ typedef struct { char *ipv4_address; + char *ipv6_address; char *hostname_address; } virtaddress_entry_t; /** A hash table to store client-side address rewrite instructions. */ static strmap_t *addressmap=NULL; + /** * Table mapping addresses to which virtual address, if any, we * assigned them to. @@ -714,13 +718,9 @@ client_dns_set_reverse_addressmap(entry_connection_t *for_conn, * * These options are configured by parse_virtual_addr_network(). */ -/** Which network should we use for virtual IPv4 addresses? Only the first - * bits of this value are fixed. */ -static uint32_t virtual_addr_network = 0x7fc00000u; -/** How many bits of virtual_addr_network are fixed? */ -static maskbits_t virtual_addr_netmask_bits = 10; -/** What's the next virtual address we will hand out? */ -static uint32_t next_virtual_addr = 0x7fc00000u; + +static virtual_addr_conf_t virtaddr_conf_ipv4; +static virtual_addr_conf_t virtaddr_conf_ipv6; /** Read a netmask of the form 127.192.0.0/10 from "val", and check whether * it's a valid set of virtual addresses to hand out in response to MAPADDRESS @@ -728,37 +728,49 @@ static uint32_t next_virtual_addr = 0x7fc00000u; * string and return -1 on failure. If validate_only is false, sets the * actual virtual address range to the parsed value. */ int -parse_virtual_addr_network(const char *val, int validate_only, +parse_virtual_addr_network(const char *val, sa_family_t family, + int validate_only, char **msg) { - uint32_t addr; - uint16_t port_min, port_max; + const int ipv6 = (family == AF_INET6); + tor_addr_t addr; maskbits_t bits; + const int max_bits = ipv6 ? 40 : 16; + virtual_addr_conf_t *conf = ipv6 ? &virtaddr_conf_ipv6 : &virtaddr_conf_ipv4; - if (parse_addr_and_port_range(val, &addr, &bits, &port_min, &port_max)) { - if (msg) *msg = tor_strdup("Error parsing VirtualAddressNetwork"); + if (tor_addr_parse_mask_ports(val, 0, &addr, &bits, NULL, NULL) < 0) { + if (msg) + tor_asprintf(msg, "Error parsing VirtualAddressNetwork%s %s", + ipv6?"IPv6":"", val); return -1; } - + if (tor_addr_family(&addr) != family) { + if (msg) + tor_asprintf(msg, "Incorrect address type for VirtualAddressNetwork%s", + ipv6?"IPv6":""); + return -1; + } +#if 0 if (port_min != 1 || port_max != 65535) { - if (msg) *msg = tor_strdup("Can't specify ports on VirtualAddressNetwork"); + if (msg) + tor_asprintf(msg, "Can't specify ports on VirtualAddressNetwork%s", + ipv6?"IPv6":""); return -1; } +#endif - if (bits > 16) { - if (msg) *msg = tor_strdup("VirtualAddressNetwork expects a /16 " - "network or larger"); + if (bits > max_bits) { + if (msg) + tor_asprintf(msg, "VirtualAddressNetwork%s expects a /%d " + "network or larger",ipv6?"IPv6":"", max_bits); return -1; } if (validate_only) return 0; - virtual_addr_network = (uint32_t)( addr & (0xfffffffful << (32-bits)) ); - virtual_addr_netmask_bits = bits; - - if (addr_mask_cmp_bits(next_virtual_addr, addr, bits)) - next_virtual_addr = addr; + tor_addr_copy(&conf->addr, &addr); + conf->bits = bits; return 0; } @@ -770,29 +782,60 @@ parse_virtual_addr_network(const char *val, int validate_only, int address_is_in_virtual_range(const char *address) { - struct in_addr in; + tor_addr_t addr; tor_assert(address); if (!strcasecmpend(address, ".virtual")) { return 1; - } else if (tor_inet_aton(address, &in)) { - uint32_t addr = ntohl(in.s_addr); - if (!addr_mask_cmp_bits(addr, virtual_addr_network, - virtual_addr_netmask_bits)) + } else if (tor_addr_parse(&addr, address) >= 0) { + const virtual_addr_conf_t *conf = (tor_addr_family(&addr) == AF_INET6) ? + &virtaddr_conf_ipv6 : &virtaddr_conf_ipv4; + if (tor_addr_compare_masked(&addr, &conf->addr, conf->bits, CMP_EXACT)==0) return 1; } return 0; } -/** Increment the value of next_virtual_addr; reset it to the start of the - * virtual address range if it wraps around. +/** Return a random address conforming to the virtual address configuration + * in conf. */ -static INLINE void -increment_virtual_addr(void) +/* private */ void +get_random_virtual_addr(const virtual_addr_conf_t *conf, tor_addr_t *addr_out) { - ++next_virtual_addr; - if (addr_mask_cmp_bits(next_virtual_addr, virtual_addr_network, - virtual_addr_netmask_bits)) - next_virtual_addr = virtual_addr_network; + uint8_t tmp[4]; + const uint8_t *addr_bytes; + uint8_t bytes[16]; + const int ipv6 = tor_addr_family(&conf->addr) == AF_INET6; + const int total_bytes = ipv6 ? 16 : 4; + + tor_assert(conf->bits <= total_bytes * 8); + + /* Set addr_bytes to the bytes of the virtual network, in host order */ + if (ipv6) { + addr_bytes = tor_addr_to_in6_addr8(&conf->addr); + } else { + set_uint32(tmp, tor_addr_to_ipv4n(&conf->addr)); + addr_bytes = tmp; + } + + /* Get an appropriate number of random bytes. */ + crypto_rand((char*)bytes, total_bytes); + + /* Now replace the first "conf->bits" bits of 'bytes' with addr_bytes*/ + if (conf->bits >= 8) + memcpy(bytes, addr_bytes, conf->bits / 8); + if (conf->bits & 7) { + uint8_t mask = 0xff >> (conf->bits & 7); + bytes[conf->bits/8] &= mask; + bytes[conf->bits/8] |= addr_bytes[conf->bits/8] & ~mask; + } + + if (ipv6) + tor_addr_from_ipv6_bytes(addr_out, (char*) bytes); + else + tor_addr_from_ipv4n(addr_out, get_uint32(bytes)); + + tor_assert(tor_addr_compare_masked(addr_out, &conf->addr, + conf->bits, CMP_EXACT)==0); } /** Return a newly allocated string holding an address of type @@ -815,37 +858,44 @@ addressmap_get_virtual_address(int type) strlcat(buf, ".virtual", sizeof(buf)); } while (strmap_get(addressmap, buf)); return tor_strdup(buf); - } else if (type == RESOLVED_TYPE_IPV4) { + } else if (type == RESOLVED_TYPE_IPV4 || type == RESOLVED_TYPE_IPV6) { + const int ipv6 = (type == RESOLVED_TYPE_IPV6); + const virtual_addr_conf_t *conf = ipv6 ? + &virtaddr_conf_ipv6 : &virtaddr_conf_ipv4; + // This is an imperfect estimate of how many addresses are available, but - // that's ok. - struct in_addr in; - uint32_t available = 1u << (32-virtual_addr_netmask_bits); - while (available) { - /* Don't hand out any .0 or .255 address. */ - while ((next_virtual_addr & 0xff) == 0 || - (next_virtual_addr & 0xff) == 0xff) { - increment_virtual_addr(); - if (! --available) { - log_warn(LD_CONFIG, "Ran out of virtual addresses!"); - return NULL; - } + // that's ok. We also don't try every one. + uint32_t attempts = ipv6 ? UINT32_MAX : (1u << (32- conf->bits)); + + tor_addr_t addr; + + while (attempts--) { + get_random_virtual_addr(conf, &addr); + + if (!ipv6) { + /* Don't hand out any .0 or .255 address. */ + const uint32_t a = tor_addr_to_ipv4h(&addr); + if ((a & 0xff) == 0 || (a & 0xff) == 0xff) + continue; } - in.s_addr = htonl(next_virtual_addr); - tor_inet_ntoa(&in, buf, sizeof(buf)); + + tor_addr_to_str(buf, &addr, sizeof(buf), 1); if (!strmap_get(addressmap, buf)) { - increment_virtual_addr(); - break; - } + /* XXXX This code is to make sure I didn't add an undecorated version + * by mistake. I hope it's needless. */ + char tmp[TOR_ADDR_BUF_LEN]; + tor_addr_to_str(buf, &addr, sizeof(tmp), 0); + if (strmap_get(addressmap, tmp)) { + log_warn(LD_BUG, "%s wasn't in the addressmap, but %s was.", + buf, tmp); + continue; + } - increment_virtual_addr(); - --available; - // log_info(LD_CONFIG, "%d addrs available", (int)available); - if (! available) { - log_warn(LD_CONFIG, "Ran out of virtual addresses!"); - return NULL; + return tor_strdup(buf); } } - return tor_strdup(buf); + log_warn(LD_CONFIG, "Ran out of virtual addresses!"); + return NULL; } else { log_warn(LD_BUG, "Called with unsupported address type (%d)", type); return NULL; @@ -878,8 +928,13 @@ addressmap_register_virtual_address(int type, char *new_address) vent_needs_to_be_added = 1; } - addrp = (type == RESOLVED_TYPE_IPV4) ? - &vent->ipv4_address : &vent->hostname_address; + if (type == RESOLVED_TYPE_IPV4) + addrp = &vent->ipv4_address; + else if (type == RESOLVED_TYPE_IPV6) + addrp = &vent->ipv6_address; + else + addrp = &vent->hostname_address; + if (*addrp) { addressmap_entry_t *ent = strmap_get(addressmap, *addrp); if (ent && ent->new_address && @@ -887,7 +942,7 @@ addressmap_register_virtual_address(int type, char *new_address) tor_free(new_address); tor_assert(!vent_needs_to_be_added); return tor_strdup(*addrp); - } else + } else { log_warn(LD_BUG, "Internal confusion: I thought that '%s' was mapped to by " "'%s', but '%s' really maps to '%s'. This is a harmless bug.", @@ -895,6 +950,7 @@ addressmap_register_virtual_address(int type, char *new_address) safe_str_client(*addrp), safe_str_client(*addrp), ent?safe_str_client(ent->new_address):"(nothing)"); + } } tor_free(*addrp); diff --git a/src/or/addressmap.h b/src/or/addressmap.h index 4534fff..3f1c445 100644 --- a/src/or/addressmap.h +++ b/src/or/addressmap.h @@ -27,7 +27,8 @@ void addressmap_register(const char *address, char *new_address, time_t expires, addressmap_entry_source_t source, const int address_wildcard, const int new_address_wildcard); -int parse_virtual_addr_network(const char *val, int validate_only, +int parse_virtual_addr_network(const char *val, + sa_family_t family, int validate_only, char **msg); int client_dns_incr_failures(const char *address); void client_dns_clear_failures(const char *address); @@ -45,5 +46,15 @@ void client_dns_set_reverse_addressmap(entry_connection_t *for_conn, int addressmap_address_should_automap(const char *address, const or_options_t *options); +#ifdef ADDRESSMAP_PRIVATE +typedef struct virtual_addr_conf_t { + tor_addr_t addr; + maskbits_t bits; +} virtual_addr_conf_t; + +void get_random_virtual_addr(const virtual_addr_conf_t *conf, + tor_addr_t *addr_out); +#endif + #endif diff --git a/src/or/config.c b/src/or/config.c index 04f512b..60028f2 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -98,6 +98,7 @@ static config_abbrev_t option_abbrevs_[] = { { "HashedControlPassword", "__HashedControlSessionPassword", 1, 0}, { "StrictEntryNodes", "StrictNodes", 0, 1}, { "StrictExitNodes", "StrictNodes", 0, 1}, + { "VirtualAddrNetwork", "VirtualAddrNetworkIPv4", 0, 0}, { "_UseFilteringSSLBufferevents", "UseFilteringSSLBufferevents", 0, 1}, { NULL, NULL, 0, 0}, }; @@ -396,7 +397,8 @@ static config_var_t option_vars_[] = { V(V3AuthUseLegacyKey, BOOL, "0"), V(V3BandwidthsFile, FILENAME, NULL), VAR("VersioningAuthoritativeDirectory",BOOL,VersioningAuthoritativeDir, "0"), - V(VirtualAddrNetwork, STRING, "127.192.0.0/10"), + V(VirtualAddrNetworkIPv4, STRING, "127.192.0.0/10"), + V(VirtualAddrNetworkIPv6, STRING, "[FE80::]/10"), V(WarnPlaintextPorts, CSV, "23,109,110,143"), V(UseFilteringSSLBufferevents, BOOL, "0"), VAR("__ReloadTorrcOnSIGHUP", BOOL, ReloadTorrcOnSIGHUP, "1"), @@ -1379,7 +1381,8 @@ options_act(const or_options_t *old_options) /* Register addressmap directives */ config_register_addressmaps(options); - parse_virtual_addr_network(options->VirtualAddrNetwork, 0, NULL); + parse_virtual_addr_network(options->VirtualAddrNetworkIPv4, AF_INET,0,NULL); + parse_virtual_addr_network(options->VirtualAddrNetworkIPv6, AF_INET6,0,NULL); /* Update address policies. */ if (policies_parse_from_options(options) < 0) { @@ -1492,8 +1495,10 @@ options_act(const or_options_t *old_options) if (!smartlist_strings_eq(old_options->AutomapHostsSuffixes, options->AutomapHostsSuffixes)) revise_automap_entries = 1; - else if (!opt_streq(old_options->VirtualAddrNetwork, - options->VirtualAddrNetwork)) + else if (!opt_streq(old_options->VirtualAddrNetworkIPv4, + options->VirtualAddrNetworkIPv4) || + !opt_streq(old_options->VirtualAddrNetworkIPv6, + options->VirtualAddrNetworkIPv6)) revise_automap_entries = 1; } @@ -2968,7 +2973,11 @@ options_validate(or_options_t *old_options, or_options_t *options, REJECT("Failed to configure client authorization for hidden services. " "See logs for details."); - if (parse_virtual_addr_network(options->VirtualAddrNetwork, 1, NULL)<0) + if (parse_virtual_addr_network(options->VirtualAddrNetworkIPv4, + AF_INET, 1, msg)<0) + return -1; + if (parse_virtual_addr_network(options->VirtualAddrNetworkIPv6, + AF_INET6, 1, msg)<0) return -1; if (options->PreferTunneledDirConns && !options->TunnelDirConns) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 9ccf58e..9608026 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -897,7 +897,7 @@ connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn, socks_request_t *socks = conn->socks_request; hostname_type_t addresstype; const or_options_t *options = get_options(); - struct in_addr addr_tmp; + tor_addr_t addr_tmp; /* We set this to true if this is an address we should automatically * remap to a local address in VirtualAddrNetwork */ int automap = 0; @@ -927,11 +927,12 @@ connection_ap_handshake_rewrite_and_attach(entry_connection_t *conn, conn->original_dest_address = tor_strdup(conn->socks_request->address); if (socks->command == SOCKS_COMMAND_RESOLVE && - !tor_inet_aton(socks->address, &addr_tmp) && + tor_addr_parse(&addr_tmp, socks->address)<0 && options->AutomapHostsOnResolve) { automap = addressmap_address_should_automap(socks->address, options); if (automap) { const char *new_addr; + /*XXXX IPv6 Sometimes this should be RESOLVED_TYPE_IPV6 */ new_addr = addressmap_register_virtual_address( RESOLVED_TYPE_IPV4, tor_strdup(socks->address)); if (! new_addr) { diff --git a/src/or/control.c b/src/or/control.c index 75c9af6..65689c4 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -1373,10 +1373,13 @@ handle_control_mapaddress(control_connection_t *conn, uint32_t len, "512-syntax error: invalid address '%s'", to); log_warn(LD_CONTROL, "Skipping invalid argument '%s' in MapAddress msg", to); - } else if (!strcmp(from, ".") || !strcmp(from, "0.0.0.0")) { + } else if (!strcmp(from, ".") || !strcmp(from, "0.0.0.0") || + !strcmp(from, "::")) { + const char type = + !strcmp(from,".") ? RESOLVED_TYPE_HOSTNAME : + (!strcmp(from, "0.0.0.0") ? RESOLVED_TYPE_IPV4 : RESOLVED_TYPE_IPV6); const char *address = addressmap_register_virtual_address( - !strcmp(from,".") ? RESOLVED_TYPE_HOSTNAME : RESOLVED_TYPE_IPV4, - tor_strdup(to)); + type, tor_strdup(to)); if (!address) { smartlist_add_asprintf(reply, "451-resource exhausted: skipping '%s'", line); diff --git a/src/or/or.h b/src/or/or.h index a2c4122..5b60193 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3588,8 +3588,10 @@ typedef struct { /** Should we fetch our dir info at the start of the consensus period? */ int FetchDirInfoExtraEarly; - char *VirtualAddrNetwork; /**< Address and mask to hand out for virtual - * MAPADDRESS requests. */ + char *VirtualAddrNetworkIPv4; /**< Address and mask to hand out for virtual + * MAPADDRESS requests for IPv4 addresses */ + char *VirtualAddrNetworkIPv6; /**< Address and mask to hand out for virtual + * MAPADDRESS requests for IPv6 addresses */ int ServerDNSSearchDomains; /**< Boolean: If set, we don't force exit * addresses to be FQDNs, but rather search for them in * the local domains. */ diff --git a/src/test/test_addr.c b/src/test/test_addr.c index d2b25e5..eea0fcd 100644 --- a/src/test/test_addr.c +++ b/src/test/test_addr.c @@ -3,9 +3,11 @@ * Copyright (c) 2007-2012, The Tor Project, Inc. */ /* See LICENSE for licensing information */ +#define ADDRESSMAP_PRIVATE #include "orconfig.h" #include "or.h" #include "test.h" +#include "addressmap.h" static void test_addr_basic(void) @@ -773,6 +775,74 @@ test_addr_parse(void) ; } +static void +update_difference(int ipv6, uint8_t *d, + const tor_addr_t *a, const tor_addr_t *b) +{ + const int n_bytes = ipv6 ? 16 : 4; + uint8_t a_tmp[4], b_tmp[4]; + const uint8_t *ba, *bb; + int i; + + if (ipv6) { + ba = tor_addr_to_in6_addr8(a); + bb = tor_addr_to_in6_addr8(b); + } else { + set_uint32(a_tmp, tor_addr_to_ipv4n(a)); + set_uint32(b_tmp, tor_addr_to_ipv4n(b)); + ba = a_tmp; bb = b_tmp; + } + + for (i = 0; i < n_bytes; ++i) { + d[i] |= ba[i] ^ bb[i]; + } +} + +static void +test_virtaddrmap(void *data) +{ + /* Let's start with a bunch of random addresses. */ + int ipv6, bits, iter, b; + virtual_addr_conf_t cfg[2]; + uint8_t bytes[16]; + + (void)data; + + tor_addr_parse(&cfg[0].addr, "64.65.0.0"); + tor_addr_parse(&cfg[1].addr, "3491:c0c0::"); + + for (ipv6 = 0; ipv6 <= 1; ++ipv6) { + for (bits = 0; bits < 18; ++bits) { + tor_addr_t last_a; + cfg[ipv6].bits = bits; + memset(bytes, 0, sizeof(bytes)); + tor_addr_copy(&last_a, &cfg[ipv6].addr); + /* Generate 128 addresses with each addr/bits combination. */ + for (iter = 0; iter < 128; ++iter) { + tor_addr_t a; + + get_random_virtual_addr(&cfg[ipv6], &a); + //printf("%s\n", fmt_addr(&a)); + /* Make sure that the first b bits match the configured network */ + tt_int_op(0, ==, tor_addr_compare_masked(&a, &cfg[ipv6].addr, + bits, CMP_EXACT)); + + /* And track which bits have been different between pairs of + * addresses */ + update_difference(ipv6, bytes, &last_a, &a); + } + + /* Now make sure all but the first 'bits' bits of bytes are true */ + for (b = bits+1; b < (ipv6?128:32); ++b) { + tt_assert(1 & (bytes[b/8] >> (7-(b&7)))); + } + } + } + + done: + ; +} + #define ADDR_LEGACY(name) \ { #name, legacy_test_helper, 0, &legacy_setup, test_addr_ ## name } @@ -780,6 +850,7 @@ struct testcase_t addr_tests[] = { ADDR_LEGACY(basic), ADDR_LEGACY(ip6_helpers), ADDR_LEGACY(parse), + { "virtaddr", test_virtaddrmap, 0, NULL, NULL }, END_OF_TESTCASES };

1 0