- tor-commits - lists.torproject.org

[tor/master] Describe rend_service_descriptor_t more completely
by nickm＠torproject.org 11 Sep '11

11 Sep '11

commit 07a5cf285a3b87f9ec73f69b8821a33744853606 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sat Sep 10 19:09:01 2011 -0400 Describe rend_service_descriptor_t more completely --- src/or/or.h | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/or/or.h b/src/or/or.h index 10af3d5..a2f4083 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3463,7 +3463,8 @@ typedef struct rend_intro_point_t { * key, if this descriptor is V2. */ } rend_intro_point_t; -/** Information used to connect to a hidden service. */ +/** Information used to connect to a hidden service. Used on both the + * service side and the client side. */ typedef struct rend_service_descriptor_t { crypto_pk_env_t *pk; /**< This service's public key. */ int version; /**< Version of the descriptor format: 0 or 2. */

1 0

[tor/master] Demote 'INTRODUCE2 cell is too {old, new}' message to info level
by nickm＠torproject.org 11 Sep '11

11 Sep '11

commit 8ea6d29fe468dc91d1c7dfc45ad5b4196e89ebdd Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sat Sep 10 21:40:09 2011 -0400 Demote 'INTRODUCE2 cell is too {old,new}' message to info level --- changes/bug2442b | 8 ++++++++ src/or/rendservice.c | 4 +++- 2 files changed, 11 insertions(+), 1 deletions(-) diff --git a/changes/bug2442b b/changes/bug2442b new file mode 100644 index 0000000..02e1636 --- /dev/null +++ b/changes/bug2442b @@ -0,0 +1,8 @@ + * Minor bugfixes: + + - Demote the 'INTRODUCE2 cell is too {old,new}' log message to + info level. There is nothing that a hidden service's operator + can do to fix its clients' clocks. Bugfix on 0.2.1.6-alpha; + fixes part of bug 2442. + + diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 5f55537..6ed9650 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -1019,7 +1019,9 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request, v3_shift += 4; if ((now - ts) < -1 * REND_REPLAY_TIME_INTERVAL / 2 || (now - ts) > REND_REPLAY_TIME_INTERVAL / 2) { - log_warn(LD_REND, "INTRODUCE2 cell is too %s. Discarding.", + /* This is far more likely to mean that a client's clock is + * skewed than that a replay attack is in progress. */ + log_info(LD_REND, "INTRODUCE2 cell is too %s. Discarding.", (now - ts) < 0 ? "old" : "new"); return -1; }

1 0

[tor/master] Demote HS 'replay detected' log message for DH public keys to info level
by nickm＠torproject.org 11 Sep '11

11 Sep '11

commit b10735903b8135c9295e356ad7ea2222a339ab14 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sat Sep 10 20:54:26 2011 -0400 Demote HS 'replay detected' log message for DH public keys to info level --- changes/bug2442 | 8 ++++++++ src/or/rendservice.c | 9 ++++++++- 2 files changed, 16 insertions(+), 1 deletions(-) diff --git a/changes/bug2442 b/changes/bug2442 new file mode 100644 index 0000000..cbcc22b --- /dev/null +++ b/changes/bug2442 @@ -0,0 +1,8 @@ + * Minor bugfixes: + + - Demote the 'replay detected' log message emitted when a hidden + service receives the same Diffie-Hellman public key in two + different INTRODUCE2 cells to info level. A normal Tor client + can cause that log message during its normal operation. Bugfix + on 0.2.1.6-alpha; fixes part of bug 2442. + diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 926f380..5f55537 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -1123,7 +1123,14 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request, * part 1. */ access_time = digestmap_get(service->accepted_intros, diffie_hellman_hash); if (access_time != NULL) { - log_warn(LD_REND, "Possible replay detected! We received an " + /* A Tor client will send a new INTRODUCE1 cell with the same rend + * cookie and DH public key as its previous one if its intro circ + * times out while in state CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT . + * If we received the first INTRODUCE1 cell (the intro-point relay + * converts it into an INTRODUCE2 cell), we are already trying to + * connect to that rend point (and may have already succeeded); + * drop this cell. */ + log_info(LD_REND, "We received an " "INTRODUCE2 cell with same first part of " "Diffie-Hellman handshake %d seconds ago. Dropping " "cell.",

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2'
by nickm＠torproject.org 11 Sep '11

11 Sep '11

commit 386966142ecebc23e78e57ae26323aee33d410f9 Merge: cca806c 8ea6d29 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Sep 11 16:25:14 2011 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' changes/bug2442 | 8 ++++++++ changes/bug2442b | 8 ++++++++ src/or/or.h | 7 +++++-- src/or/rendservice.c | 13 +++++++++++-- 4 files changed, 32 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.2.2] Demote HS 'replay detected' log message for DH public keys to info level
by nickm＠torproject.org 11 Sep '11

11 Sep '11

commit b10735903b8135c9295e356ad7ea2222a339ab14 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sat Sep 10 20:54:26 2011 -0400 Demote HS 'replay detected' log message for DH public keys to info level --- changes/bug2442 | 8 ++++++++ src/or/rendservice.c | 9 ++++++++- 2 files changed, 16 insertions(+), 1 deletions(-) diff --git a/changes/bug2442 b/changes/bug2442 new file mode 100644 index 0000000..cbcc22b --- /dev/null +++ b/changes/bug2442 @@ -0,0 +1,8 @@ + * Minor bugfixes: + + - Demote the 'replay detected' log message emitted when a hidden + service receives the same Diffie-Hellman public key in two + different INTRODUCE2 cells to info level. A normal Tor client + can cause that log message during its normal operation. Bugfix + on 0.2.1.6-alpha; fixes part of bug 2442. + diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 926f380..5f55537 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -1123,7 +1123,14 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request, * part 1. */ access_time = digestmap_get(service->accepted_intros, diffie_hellman_hash); if (access_time != NULL) { - log_warn(LD_REND, "Possible replay detected! We received an " + /* A Tor client will send a new INTRODUCE1 cell with the same rend + * cookie and DH public key as its previous one if its intro circ + * times out while in state CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT . + * If we received the first INTRODUCE1 cell (the intro-point relay + * converts it into an INTRODUCE2 cell), we are already trying to + * connect to that rend point (and may have already succeeded); + * drop this cell. */ + log_info(LD_REND, "We received an " "INTRODUCE2 cell with same first part of " "Diffie-Hellman handshake %d seconds ago. Dropping " "cell.",

1 0

[tor/maint-0.2.2] Demote 'INTRODUCE2 cell is too {old, new}' message to info level
by nickm＠torproject.org 11 Sep '11

11 Sep '11

commit 8ea6d29fe468dc91d1c7dfc45ad5b4196e89ebdd Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sat Sep 10 21:40:09 2011 -0400 Demote 'INTRODUCE2 cell is too {old,new}' message to info level --- changes/bug2442b | 8 ++++++++ src/or/rendservice.c | 4 +++- 2 files changed, 11 insertions(+), 1 deletions(-) diff --git a/changes/bug2442b b/changes/bug2442b new file mode 100644 index 0000000..02e1636 --- /dev/null +++ b/changes/bug2442b @@ -0,0 +1,8 @@ + * Minor bugfixes: + + - Demote the 'INTRODUCE2 cell is too {old,new}' log message to + info level. There is nothing that a hidden service's operator + can do to fix its clients' clocks. Bugfix on 0.2.1.6-alpha; + fixes part of bug 2442. + + diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 5f55537..6ed9650 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -1019,7 +1019,9 @@ rend_service_introduce(origin_circuit_t *circuit, const uint8_t *request, v3_shift += 4; if ((now - ts) < -1 * REND_REPLAY_TIME_INTERVAL / 2 || (now - ts) > REND_REPLAY_TIME_INTERVAL / 2) { - log_warn(LD_REND, "INTRODUCE2 cell is too %s. Discarding.", + /* This is far more likely to mean that a client's clock is + * skewed than that a replay attack is in progress. */ + log_info(LD_REND, "INTRODUCE2 cell is too %s. Discarding.", (now - ts) < 0 ? "old" : "new"); return -1; }

1 0

[tor/maint-0.2.2] Fix log message typo.
by nickm＠torproject.org 11 Sep '11

11 Sep '11

commit c621e528833aaf871b81d21afa7495f84cbdd66b Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sat Sep 10 16:15:52 2011 -0400 Fix log message typo. --- changes/typo-fix-ohkah8Ah | 9 +++++++++ src/or/rendservice.c | 2 +- 2 files changed, 10 insertions(+), 1 deletions(-) diff --git a/changes/typo-fix-ohkah8Ah b/changes/typo-fix-ohkah8Ah new file mode 100644 index 0000000..9b4e5c0 --- /dev/null +++ b/changes/typo-fix-ohkah8Ah @@ -0,0 +1,9 @@ + * Minor bugfixes: + + - Clarify a log message specifying the characters permitted in + HiddenServiceAuthorizeClient client names. Previously, the log + message said that "[A-Za-z0-9+-_]" were permitted; that could + have given the impression that every ASCII character between "+" + and "_" was permitted. Now we say "[A-Za-z0-9+_-]". Bugfix on + 0.2.1.5-alpha. + diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 681c4b8..926f380 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -409,7 +409,7 @@ rend_config_services(or_options_t *options, int validate_only) if (strspn(client_name, REND_LEGAL_CLIENTNAME_CHARACTERS) != len) { log_warn(LD_CONFIG, "HiddenServiceAuthorizeClient contains an " "illegal client name: '%s'. Valid " - "characters are [A-Za-z0-9+-_].", + "characters are [A-Za-z0-9+_-].", client_name); SMARTLIST_FOREACH(clients, char *, cp, tor_free(cp)); smartlist_free(clients);

1 0

[tor/maint-0.2.2] Describe rend_intro_point_t more completely
by nickm＠torproject.org 11 Sep '11

11 Sep '11

commit aa900b17ca0f25b490ed5fc6d9559b5a30fd4ea8 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sat Sep 10 19:05:53 2011 -0400 Describe rend_intro_point_t more completely --- src/or/or.h | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/src/or/or.h b/src/or/or.h index 2e5edff..10af3d5 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3454,7 +3454,9 @@ typedef struct rend_encoded_v2_service_descriptor_t { char *desc_str; /**< Descriptor string. */ } rend_encoded_v2_service_descriptor_t; -/** Introduction point information. */ +/** Introduction point information. Used both in rend_service_t (on + * the service side) and in rend_service_descriptor_t (on both the + * client and service side). */ typedef struct rend_intro_point_t { extend_info_t *extend_info; /**< Extend info of this introduction point. */ crypto_pk_env_t *intro_key; /**< Introduction key that replaces the service

1 0

[tor/maint-0.2.2] Describe rend_service_descriptor_t more completely
by nickm＠torproject.org 11 Sep '11

11 Sep '11

commit 07a5cf285a3b87f9ec73f69b8821a33744853606 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sat Sep 10 19:09:01 2011 -0400 Describe rend_service_descriptor_t more completely --- src/or/or.h | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/or/or.h b/src/or/or.h index 10af3d5..a2f4083 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3463,7 +3463,8 @@ typedef struct rend_intro_point_t { * key, if this descriptor is V2. */ } rend_intro_point_t; -/** Information used to connect to a hidden service. */ +/** Information used to connect to a hidden service. Used on both the + * service side and the client side. */ typedef struct rend_service_descriptor_t { crypto_pk_env_t *pk; /**< This service's public key. */ int version; /**< Version of the descriptor format: 0 or 2. */

1 0

[tor/master] fix whitespace (two-space indent)
by arma＠torproject.org 11 Sep '11

11 Sep '11

commit cca806c56c4b14462a610eaa835db8d081d27c14 Author: Roger Dingledine <arma(a)torproject.org> Date: Sun Sep 11 01:33:04 2011 -0400 fix whitespace (two-space indent) --- src/or/config.c | 93 ++++++++++++++++++++++++++++--------------------------- 1 files changed, 47 insertions(+), 46 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index ac7c6ff..bc77b3a 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -4980,56 +4980,57 @@ parse_client_port_config(smartlist_t *out, /* FooListenAddress is deprecated; let's make it work like it used to work, * though. */ if (listenaddrs) { - int mainport = defaultport; + int mainport = defaultport; - if (ports && ports->next) { + if (ports && ports->next) { log_warn(LD_CONFIG, "%sListenAddress can't be used when there are " "multiple %sPort lines", portname, portname); return -1; - } else if (ports) { - if (!strcmp(ports->value, "auto")) { - mainport = CFG_AUTO_PORT; - } else { - int ok; - mainport = (int)tor_parse_long(ports->value, 10, 0, 65535, &ok, NULL); - if (!ok) { - log_warn(LD_CONFIG, "%sListenAddress can only be used with a single " - "%sPort with value \"auto\" or 1-65535.", portname, portname); - return -1; - } - } - } + } else if (ports) { + if (!strcmp(ports->value, "auto")) { + mainport = CFG_AUTO_PORT; + } else { + int ok; + mainport = (int)tor_parse_long(ports->value, 10, 0, 65535, &ok, NULL); + if (!ok) { + log_warn(LD_CONFIG, "%sListenAddress can only be used with a single " + "%sPort with value \"auto\" or 1-65535.", + portname, portname); + return -1; + } + } + } - if (mainport == 0) { - if (allow_spurious_listenaddr) - return 1; - log_warn(LD_CONFIG, "%sPort must be defined if %sListenAddress is used", - portname, portname); - return -1; - } + if (mainport == 0) { + if (allow_spurious_listenaddr) + return 1; + log_warn(LD_CONFIG, "%sPort must be defined if %sListenAddress is used", + portname, portname); + return -1; + } - for (; listenaddrs; listenaddrs = listenaddrs->next) { - tor_addr_t addr; - uint16_t port = 0; - if (tor_addr_port_parse(listenaddrs->value, &addr, &port) < 0) { - log_warn(LD_CONFIG, "Unable to parse %sListenAddress '%s'", - portname, listenaddrs->value); - return -1; - } - if (out) { - port_cfg_t *cfg = tor_malloc_zero(sizeof(port_cfg_t)); - cfg->type = listener_type; - cfg->port = port ? port : mainport; - tor_addr_copy(&cfg->addr, &addr); - cfg->session_group = SESSION_GROUP_UNSET; - cfg->isolation_flags = ISO_DEFAULT; - smartlist_add(out, cfg); - } - } + for (; listenaddrs; listenaddrs = listenaddrs->next) { + tor_addr_t addr; + uint16_t port = 0; + if (tor_addr_port_parse(listenaddrs->value, &addr, &port) < 0) { + log_warn(LD_CONFIG, "Unable to parse %sListenAddress '%s'", + portname, listenaddrs->value); + return -1; + } + if (out) { + port_cfg_t *cfg = tor_malloc_zero(sizeof(port_cfg_t)); + cfg->type = listener_type; + cfg->port = port ? port : mainport; + tor_addr_copy(&cfg->addr, &addr); + cfg->session_group = SESSION_GROUP_UNSET; + cfg->isolation_flags = ISO_DEFAULT; + smartlist_add(out, cfg); + } + } - if (warn_nonlocal && out) - warn_nonlocal_client_ports(out, portname); - return 0; + if (warn_nonlocal && out) + warn_nonlocal_client_ports(out, portname); + return 0; } /* end if (listenaddrs) */ /* No ListenAddress lines. If there's no FooPort, then maybe make a default

1 0