- tor-commits - lists.torproject.org

[tor/master] Remember optimistically sent data until we have gotten a CONNECTED
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit 218e84b634d10c25a6d5d002a983ddb051278bdf Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jul 18 15:38:05 2011 -0400 Remember optimistically sent data until we have gotten a CONNECTED Since we can retry failed streams under some circumstances, we need to be ready to send data queued on them. --- src/or/connection.c | 7 ++++++- src/or/connection_edge.c | 9 ++++++++- src/or/or.h | 15 ++++++++++++--- src/or/relay.c | 44 ++++++++++++++++++++++++++++++++++++++++++-- 4 files changed, 68 insertions(+), 7 deletions(-) diff --git a/src/or/connection.c b/src/or/connection.c index 8b9fb12..1ccd2b6 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -444,7 +444,12 @@ _connection_free(connection_t *conn) tor_free(edge_conn->chosen_exit_name); if (edge_conn->socks_request) socks_request_free(edge_conn->socks_request); - + if (edge_conn->pending_optimistic_data) { + generic_buffer_free(edge_conn->pending_optimistic_data); + } + if (edge_conn->sending_optimistic_data) { + generic_buffer_free(edge_conn->sending_optimistic_data); + } rend_data_free(edge_conn->rend_data); } if (conn->type == CONN_TYPE_CONTROL) { diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 20f8bc9..79f0db0 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -738,6 +738,12 @@ connection_ap_detach_retriable(edge_connection_t *conn, origin_circuit_t *circ, { control_event_stream_status(conn, STREAM_EVENT_FAILED_RETRIABLE, reason); conn->_base.timestamp_lastread = time(NULL); + + if (conn->pending_optimistic_data) { + generic_buffer_set_to_copy(&conn->sending_optimistic_data, + conn->pending_optimistic_data); + } + if (!get_options()->LeaveStreamsUnattached || conn->use_begindir) { /* If we're attaching streams ourself, or if this connection is * a tunneled directory connection, then just attach it. */ @@ -2429,7 +2435,8 @@ connection_ap_handshake_send_begin(edge_connection_t *ap_conn) control_event_stream_status(ap_conn, STREAM_EVENT_SENT_CONNECT, 0); /* If there's queued-up data, send it now */ - if (connection_get_inbuf_len(TO_CONN(ap_conn)) && + if ((connection_get_inbuf_len(TO_CONN(ap_conn)) || + ap_conn->sending_optimistic_data) && connection_ap_supports_optimistic_data(ap_conn)) { log_info(LD_APP, "Sending up to %ld bytes of queued-up data", connection_get_inbuf_len(TO_CONN(ap_conn))); diff --git a/src/or/or.h b/src/or/or.h index c784267..7097b5f 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1237,11 +1237,20 @@ typedef struct edge_connection_t { * NATd connection */ unsigned int is_transparent_ap:1; - /** Set if this connection's target exit node allows optimistic data. - * (That is, data sent on this stream before the exit has sent a - * CONNECTED cell.)*/ + /** For AP connections only: Set if this connection's target exit node + * allows optimistic data. (That is, data sent on this stream before + * the exit has sent a CONNECTED cell.)*/ unsigned int exit_allows_optimistic_data : 1; + /** For AP connections only: buffer for data that we have sent + * optimistically, which we might need to re-send if we have to + * retry this connection. */ + generic_buffer_t *pending_optimistic_data; + /* For AP connections only: buffer for data that we previously sent + * optimistically which we are currently re-sending as we retry this + * connection. */ + generic_buffer_t *sending_optimistic_data; + /** If this is a DNSPort connection, this field holds the pending DNS * request that we're going to try to answer. */ struct evdns_server_request *dns_server_request; diff --git a/src/or/relay.c b/src/or/relay.c index df6d0a8..3fa31a3 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -944,6 +944,12 @@ connection_edge_process_relay_cell_not_open( break; } } + /* This is definitely a success, so forget about any pending data we + * had sent. */ + if (conn->pending_optimistic_data) { + generic_buffer_free(conn->pending_optimistic_data); + conn->pending_optimistic_data = NULL; + } /* handle anything that might have queued */ if (connection_edge_package_raw_inbuf(conn, 1, NULL) < 0) { @@ -1343,6 +1349,10 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial, char payload[CELL_PAYLOAD_SIZE]; circuit_t *circ; unsigned domain = conn->cpath_layer ? LD_APP : LD_EXIT; + int sending_from_optimistic = 0; + const int sending_optimistically = + conn->_base.type == CONN_TYPE_AP && + conn->_base.state != AP_CONN_STATE_OPEN; tor_assert(conn); @@ -1375,7 +1385,18 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial, return 0; } - amount_to_process = connection_get_inbuf_len(TO_CONN(conn)); + sending_from_optimistic = conn->sending_optimistic_data != NULL; + + if (PREDICT_UNLIKELY(sending_from_optimistic)) { + amount_to_process = generic_buffer_len(conn->sending_optimistic_data); + if (PREDICT_UNLIKELY(!amount_to_process)) { + log_warn(LD_BUG, "sending_optimistic_data was non-NULL but empty"); + amount_to_process = connection_get_inbuf_len(TO_CONN(conn)); + sending_from_optimistic = 0; + } + } else { + amount_to_process = connection_get_inbuf_len(TO_CONN(conn)); + } if (!amount_to_process) return 0; @@ -1391,11 +1412,30 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial, stats_n_data_bytes_packaged += length; stats_n_data_cells_packaged += 1; - connection_fetch_from_buf(payload, length, TO_CONN(conn)); + if (PREDICT_UNLIKELY(sending_from_optimistic)) { + /* XXX023 We could be more efficient here by sometimes packing + * previously-sent optimistic data in the same cell with data + * from the inbuf. */ + generic_buffer_get(conn->sending_optimistic_data, payload, length); + if (!generic_buffer_len(conn->sending_optimistic_data)) { + generic_buffer_free(conn->sending_optimistic_data); + conn->sending_optimistic_data = NULL; + } + } else { + connection_fetch_from_buf(payload, length, TO_CONN(conn)); + } log_debug(domain,"(%d) Packaging %d bytes (%d waiting).", conn->_base.s, (int)length, (int)connection_get_inbuf_len(TO_CONN(conn))); + if (sending_optimistically && !sending_from_optimistic) { + /* This is new optimistic data; remember it in case we need to detach and + retry */ + if (!conn->pending_optimistic_data) + conn->pending_optimistic_data = generic_buffer_new(); + generic_buffer_add(conn->pending_optimistic_data, payload, length); + } + if (connection_edge_send_command(conn, RELAY_COMMAND_DATA, payload, length) < 0 ) /* circuit got marked for close, don't continue, don't need to mark conn */

1 0

[tor/master] Unit test for generic_buffer_set_to_copy
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit 9a7c16fb00c6ffc32ef7d6cc7fbede5258fe4390 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 20 09:34:19 2011 -0400 Unit test for generic_buffer_set_to_copy --- src/test/test.c | 66 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 files changed, 66 insertions(+), 0 deletions(-) diff --git a/src/test/test.c b/src/test/test.c index 05f5922..e7d4ccb 100644 --- a/src/test/test.c +++ b/src/test/test.c @@ -569,6 +569,71 @@ test_socks_5_auth_before_negotiation(void *ptr) ; } +static void +test_buffer_copy(void *arg) +{ + generic_buffer_t *buf=NULL, *buf2=NULL; + const char *s; + size_t len; + char b[256]; + int i; + (void)arg; + + buf = generic_buffer_new(); + tt_assert(buf); + + /* Copy an empty buffer. */ + tt_int_op(0, ==, generic_buffer_set_to_copy(&buf2, buf)); + tt_assert(buf2); + tt_int_op(0, ==, generic_buffer_len(buf2)); + + /* Now try with a short buffer. */ + s = "And now comes an act of enormous enormance!"; + len = strlen(s); + generic_buffer_add(buf, s, len); + tt_int_op(len, ==, generic_buffer_len(buf)); + /* Add junk to buf2 so we can test replacing.*/ + generic_buffer_add(buf2, "BLARG", 5); + tt_int_op(0, ==, generic_buffer_set_to_copy(&buf2, buf)); + tt_int_op(len, ==, generic_buffer_len(buf2)); + generic_buffer_get(buf2, b, len); + test_mem_op(b, ==, s, len); + /* Now free buf2 and retry so we can test allocating */ + generic_buffer_free(buf2); + buf2 = NULL; + tt_int_op(0, ==, generic_buffer_set_to_copy(&buf2, buf)); + tt_int_op(len, ==, generic_buffer_len(buf2)); + generic_buffer_get(buf2, b, len); + test_mem_op(b, ==, s, len); + /* Clear buf for next test */ + generic_buffer_get(buf, b, len); + tt_int_op(generic_buffer_len(buf),==,0); + + /* Okay, now let's try a bigger buffer. */ + s = "Quis autem vel eum iure reprehenderit qui in ea voluptate velit " + "esse quam nihil molestiae consequatur, vel illum qui dolorem eum " + "fugiat quo voluptas nulla pariatur?"; + len = strlen(s); + for (i = 0; i < 256; ++i) { + b[0]=i; + generic_buffer_add(buf, b, 1); + generic_buffer_add(buf, s, len); + } + tt_int_op(0, ==, generic_buffer_set_to_copy(&buf2, buf)); + tt_int_op(generic_buffer_len(buf2), ==, generic_buffer_len(buf)); + for (i = 0; i < 256; ++i) { + generic_buffer_get(buf2, b, len+1); + tt_int_op((unsigned char)b[0],==,i); + test_mem_op(b+1, ==, s, len); + } + + done: + if (buf) + generic_buffer_free(buf); + if (buf2) + generic_buffer_free(buf2); +} + /** Run unit tests for buffers.c */ static void test_buffers(void) @@ -1612,6 +1677,7 @@ const struct testcase_setup_t legacy_setup = { static struct testcase_t test_array[] = { ENT(buffers), + { "buffer_copy", test_buffer_copy, 0, NULL, NULL }, ENT(onion_handshake), ENT(circuit_timeout), ENT(policies),

1 0

[tor/master] Merge branch 'optimistic-client'
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit eaa1c05397c1a6cf2f58b7c41e388311d5aa8ffb Merge: 195bcb6 9a7c16f Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jul 20 09:50:53 2011 -0400 Merge branch 'optimistic-client' The conflicts are with the proposal 171 circuit isolation code, and they're all trivial: they're just a matter of both branches adding some unrelated code in the same places. Conflicts: src/or/circuituse.c src/or/connection.c src/or/buffers.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++ src/or/buffers.h | 19 ++++++++++++ src/or/circuituse.c | 21 ++++++++++++++ src/or/connection.c | 6 ++++ src/or/connection_edge.c | 52 +++++++++++++++++++++++++++++++++- src/or/or.h | 22 ++++++++++++++ src/or/relay.c | 44 +++++++++++++++++++++++++++- src/or/routerparse.c | 3 ++ src/test/test.c | 66 +++++++++++++++++++++++++++++++++++++++++++ 9 files changed, 300 insertions(+), 3 deletions(-) diff --cc src/or/circuituse.c index b486044,3c8cacb..1bc518b --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@@ -1568,8 -1472,23 +1571,26 @@@ link_apconn_to_circ(edge_connection_t * apconn->cpath_layer = circ->cpath->prev; } + circ->isolation_any_streams_attached = 1; + connection_edge_update_circuit_isolation(apconn, circ, 0); ++ + /* See if we can use optimistic data on this circuit */ + if (apconn->cpath_layer->extend_info && + (exitnode = node_get_by_id( + apconn->cpath_layer->extend_info->identity_digest)) && + exitnode->rs) { + /* Okay; we know what exit node this is. */ + if (circ->_base.purpose == CIRCUIT_PURPOSE_C_GENERAL && + exitnode->rs->version_supports_optimistic_data) + apconn->exit_allows_optimistic_data = 1; + else + apconn->exit_allows_optimistic_data = 0; + log_info(LD_APP, "Looks like completed circuit to %s %s allow " + "optimistic data for connection to %s", + safe_str_client(node_describe(exitnode)), + apconn->exit_allows_optimistic_data ? "does" : "doesn't", + safe_str_client(apconn->socks_request->address)); + } } /** Return true iff address is matched by one of the entries in diff --cc src/or/connection.c index 59a7b80,1ccd2b6..3950f90 --- a/src/or/connection.c +++ b/src/or/connection.c @@@ -467,9 -442,14 +467,15 @@@ _connection_free(connection_t *conn if (CONN_IS_EDGE(conn)) { edge_connection_t *edge_conn = TO_EDGE_CONN(conn); tor_free(edge_conn->chosen_exit_name); + tor_free(edge_conn->original_dest_address); if (edge_conn->socks_request) socks_request_free(edge_conn->socks_request); + if (edge_conn->pending_optimistic_data) { + generic_buffer_free(edge_conn->pending_optimistic_data); + } + if (edge_conn->sending_optimistic_data) { + generic_buffer_free(edge_conn->sending_optimistic_data); + } rend_data_free(edge_conn->rend_data); } if (conn->type == CONN_TYPE_CONTROL) {

1 0

[tor/master] Initial optimistic_client fixes
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit ba5d75810493f237edbb7f4f149d61f1ca08e605 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jul 18 13:00:48 2011 -0400 Initial optimistic_client fixes - Conform to make check-spaces - Build without warnings from passing size_t to %d - Use connection_get_inbuf_len(), not buf_datalen (otherwise bufferevents won't work). - Don't log that we're using this feature at warn. --- src/or/connection_edge.c | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 7551c39..6f91d1a 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -165,8 +165,10 @@ connection_edge_process_inbuf(edge_connection_t *conn, int package_partial) return 0; case AP_CONN_STATE_CONNECT_WAIT: log_info(LD_EDGE, - "data from edge while in '%s' state. Sending it anyway. package_partial=%d, buflen=%d", - conn_state_to_string(conn->_base.type, conn->_base.state), package_partial, buf_datalen(TO_CONN(conn)->inbuf)); + "data from edge while in '%s' state. Sending it anyway. " + "package_partial=%d, buflen=%ld", + conn_state_to_string(conn->_base.type, conn->_base.state), + package_partial, connection_get_inbuf_len(TO_CONN(conn))); if (connection_edge_package_raw_inbuf(conn, package_partial, NULL) < 0) { /* (We already sent an end cell if possible) */ connection_mark_for_close(TO_CONN(conn)); @@ -2406,7 +2408,8 @@ connection_ap_handshake_send_begin(edge_connection_t *ap_conn) control_event_stream_status(ap_conn, STREAM_EVENT_SENT_CONNECT, 0); /* If there's queued-up data, send it now */ - log_warn(LD_APP, "Possibly sending queued-up data: %d", buf_datalen(TO_CONN(ap_conn)->inbuf)); + log_info(LD_APP, "Possibly sending queued-up data: %ld", + connection_get_inbuf_len(TO_CONN(ap_conn))); if (connection_edge_package_raw_inbuf(ap_conn, 1, NULL) < 0) { connection_mark_for_close(TO_CONN(ap_conn)); }

1 0

[tor/master] Implement the client side of optimistic data (proposal 174)
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit 326d5c156dce64c115a76427a4dabb0e93a90033 Author: Ian Goldberg <iang(a)cs.uwaterloo.ca> Date: Mon Jul 18 12:56:45 2011 -0400 Implement the client side of optimistic data (proposal 174) --- src/or/connection_edge.c | 18 +++++++++++++++++- 1 files changed, 17 insertions(+), 1 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index f2ddfc7..7551c39 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -157,13 +157,22 @@ connection_edge_process_inbuf(edge_connection_t *conn, int package_partial) case EXIT_CONN_STATE_CONNECTING: case AP_CONN_STATE_RENDDESC_WAIT: case AP_CONN_STATE_CIRCUIT_WAIT: - case AP_CONN_STATE_CONNECT_WAIT: case AP_CONN_STATE_RESOLVE_WAIT: case AP_CONN_STATE_CONTROLLER_WAIT: log_info(LD_EDGE, "data from edge while in '%s' state. Leaving it on buffer.", conn_state_to_string(conn->_base.type, conn->_base.state)); return 0; + case AP_CONN_STATE_CONNECT_WAIT: + log_info(LD_EDGE, + "data from edge while in '%s' state. Sending it anyway. package_partial=%d, buflen=%d", + conn_state_to_string(conn->_base.type, conn->_base.state), package_partial, buf_datalen(TO_CONN(conn)->inbuf)); + if (connection_edge_package_raw_inbuf(conn, package_partial, NULL) < 0) { + /* (We already sent an end cell if possible) */ + connection_mark_for_close(TO_CONN(conn)); + return -1; + } + return 0; } log_warn(LD_BUG,"Got unexpected state %d. Closing.",conn->_base.state); tor_fragile_assert(); @@ -2395,6 +2404,13 @@ connection_ap_handshake_send_begin(edge_connection_t *ap_conn) log_info(LD_APP,"Address/port sent, ap socket %d, n_circ_id %d", ap_conn->_base.s, circ->_base.n_circ_id); control_event_stream_status(ap_conn, STREAM_EVENT_SENT_CONNECT, 0); + + /* If there's queued-up data, send it now */ + log_warn(LD_APP, "Possibly sending queued-up data: %d", buf_datalen(TO_CONN(ap_conn)->inbuf)); + if (connection_edge_package_raw_inbuf(ap_conn, 1, NULL) < 0) { + connection_mark_for_close(TO_CONN(ap_conn)); + } + return 0; }

1 0

[tor/master] Only use optimistic data with exits that support it
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit 1e441df2d0d06aa66eaf2c0e00a42d7fe9c39c87 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jul 18 13:56:22 2011 -0400 Only use optimistic data with exits that support it This adds a little code complexity: we need to remember for each node whether it supports the right feature, and then check for each connection whether it's exiting at such a node. We store this in a flag in the edge_connection_t, and set that flag at link time. --- src/or/circuituse.c | 21 +++++++++++++++++ src/or/connection_edge.c | 56 ++++++++++++++++++++++++++++++++------------- src/or/or.h | 8 ++++++ src/or/routerparse.c | 3 ++ 4 files changed, 72 insertions(+), 16 deletions(-) diff --git a/src/or/circuituse.c b/src/or/circuituse.c index 460c41f..3c8cacb 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -677,6 +677,7 @@ circuit_detach_stream(circuit_t *circ, edge_connection_t *conn) tor_assert(conn); conn->cpath_layer = NULL; /* make sure we don't keep a stale pointer */ + conn->exit_allows_optimistic_data = 0; conn->on_circuit = NULL; if (CIRCUIT_IS_ORIGIN(circ)) { @@ -1449,6 +1450,8 @@ static void link_apconn_to_circ(edge_connection_t *apconn, origin_circuit_t *circ, crypt_path_t *cpath) { + const node_t *exitnode; + /* add it into the linked list of streams on this circuit */ log_debug(LD_APP|LD_CIRC, "attaching new conn to circ. n_circ_id %d.", circ->_base.n_circ_id); @@ -1468,6 +1471,24 @@ link_apconn_to_circ(edge_connection_t *apconn, origin_circuit_t *circ, tor_assert(circ->cpath->prev->state == CPATH_STATE_OPEN); apconn->cpath_layer = circ->cpath->prev; } + + /* See if we can use optimistic data on this circuit */ + if (apconn->cpath_layer->extend_info && + (exitnode = node_get_by_id( + apconn->cpath_layer->extend_info->identity_digest)) && + exitnode->rs) { + /* Okay; we know what exit node this is. */ + if (circ->_base.purpose == CIRCUIT_PURPOSE_C_GENERAL && + exitnode->rs->version_supports_optimistic_data) + apconn->exit_allows_optimistic_data = 1; + else + apconn->exit_allows_optimistic_data = 0; + log_info(LD_APP, "Looks like completed circuit to %s %s allow " + "optimistic data for connection to %s", + safe_str_client(node_describe(exitnode)), + apconn->exit_allows_optimistic_data ? "does" : "doesn't", + safe_str_client(apconn->socks_request->address)); + } } /** Return true iff address is matched by one of the entries in diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 6f91d1a..20f8bc9 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -57,6 +57,7 @@ static int connection_exit_connect_dir(edge_connection_t *exitconn); static int address_is_in_virtual_range(const char *addr); static int consider_plaintext_ports(edge_connection_t *conn, uint16_t port); static void clear_trackexithost_mappings(const char *exitname); +static int connection_ap_supports_optimistic_data(const edge_connection_t *); /** An AP stream has failed/finished. If it hasn't already sent back * a socks reply, send one now (based on endreason). Also set @@ -154,6 +155,22 @@ connection_edge_process_inbuf(edge_connection_t *conn, int package_partial) return -1; } return 0; + case AP_CONN_STATE_CONNECT_WAIT: + if (connection_ap_supports_optimistic_data(conn)) { + log_info(LD_EDGE, + "data from edge while in '%s' state. Sending it anyway. " + "package_partial=%d, buflen=%ld", + conn_state_to_string(conn->_base.type, conn->_base.state), + package_partial, connection_get_inbuf_len(TO_CONN(conn))); + if (connection_edge_package_raw_inbuf(conn, package_partial, NULL)<0) { + /* (We already sent an end cell if possible) */ + connection_mark_for_close(TO_CONN(conn)); + return -1; + } + return 0; + } + /* Fall through if the connection is on a circuit without optimistic + * data support. */ case EXIT_CONN_STATE_CONNECTING: case AP_CONN_STATE_RENDDESC_WAIT: case AP_CONN_STATE_CIRCUIT_WAIT: @@ -163,18 +180,6 @@ connection_edge_process_inbuf(edge_connection_t *conn, int package_partial) "data from edge while in '%s' state. Leaving it on buffer.", conn_state_to_string(conn->_base.type, conn->_base.state)); return 0; - case AP_CONN_STATE_CONNECT_WAIT: - log_info(LD_EDGE, - "data from edge while in '%s' state. Sending it anyway. " - "package_partial=%d, buflen=%ld", - conn_state_to_string(conn->_base.type, conn->_base.state), - package_partial, connection_get_inbuf_len(TO_CONN(conn))); - if (connection_edge_package_raw_inbuf(conn, package_partial, NULL) < 0) { - /* (We already sent an end cell if possible) */ - connection_mark_for_close(TO_CONN(conn)); - return -1; - } - return 0; } log_warn(LD_BUG,"Got unexpected state %d. Closing.",conn->_base.state); tor_fragile_assert(); @@ -2345,6 +2350,22 @@ get_unique_stream_id_by_circ(origin_circuit_t *circ) return test_stream_id; } +/** Return true iff conn is linked to a circuit and configured to use + * an exit that supports optimistic data. */ +static int +connection_ap_supports_optimistic_data(const edge_connection_t *conn) +{ + tor_assert(conn->_base.type == CONN_TYPE_AP); + /* We can only send optimistic data if we're connected to an open + general circuit. */ + if (conn->on_circuit == NULL || + conn->on_circuit->state != CIRCUIT_STATE_OPEN || + conn->on_circuit->purpose != CIRCUIT_PURPOSE_C_GENERAL) + return 0; + + return conn->exit_allows_optimistic_data; +} + /** Write a relay begin cell, using destaddr and destport from ap_conn's * socks_request field, and send it down circ. * @@ -2408,10 +2429,13 @@ connection_ap_handshake_send_begin(edge_connection_t *ap_conn) control_event_stream_status(ap_conn, STREAM_EVENT_SENT_CONNECT, 0); /* If there's queued-up data, send it now */ - log_info(LD_APP, "Possibly sending queued-up data: %ld", - connection_get_inbuf_len(TO_CONN(ap_conn))); - if (connection_edge_package_raw_inbuf(ap_conn, 1, NULL) < 0) { - connection_mark_for_close(TO_CONN(ap_conn)); + if (connection_get_inbuf_len(TO_CONN(ap_conn)) && + connection_ap_supports_optimistic_data(ap_conn)) { + log_info(LD_APP, "Sending up to %ld bytes of queued-up data", + connection_get_inbuf_len(TO_CONN(ap_conn))); + if (connection_edge_package_raw_inbuf(ap_conn, 1, NULL) < 0) { + connection_mark_for_close(TO_CONN(ap_conn)); + } } return 0; diff --git a/src/or/or.h b/src/or/or.h index 7a2bde5..f805215 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1232,6 +1232,11 @@ typedef struct edge_connection_t { * NATd connection */ unsigned int is_transparent_ap:1; + /** Set if this connection's target exit node allows optimistic data. + * (That is, data sent on this stream before the exit has sent a + * CONNECTED cell.)*/ + unsigned int exit_allows_optimistic_data : 1; + /** If this is a DNSPort connection, this field holds the pending DNS * request that we're going to try to answer. */ struct evdns_server_request *dns_server_request; @@ -1667,6 +1672,9 @@ typedef struct routerstatus_t { /** True iff this router is a version that, if it caches directory info, * we can get microdescriptors from. */ unsigned int version_supports_microdesc_cache:1; + /** True iff this router is a version that allows DATA cells to arrive on + * a stream before it has sent a CONNECTED cell. */ + unsigned int version_supports_optimistic_data:1; unsigned int has_bandwidth:1; /**< The vote/consensus had bw info */ unsigned int has_exitsummary:1; /**< The vote/consensus had exit summaries */ diff --git a/src/or/routerparse.c b/src/or/routerparse.c index d1b2cd0..5f160d0 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -2092,6 +2092,7 @@ routerstatus_parse_entry_from_string(memarea_t *area, rs->version_supports_extrainfo_upload = 1; rs->version_supports_conditional_consensus = 1; rs->version_supports_microdesc_cache = 1; + rs->version_supports_optimistic_data = 1; } else { rs->version_supports_begindir = tor_version_as_new_as(tok->args[0], "0.2.0.1-alpha"); @@ -2109,6 +2110,8 @@ routerstatus_parse_entry_from_string(memarea_t *area, */ rs->version_supports_microdesc_cache = tor_version_as_new_as(tok->args[0], "0.2.3.0-alpha"); + rs->version_supports_optimistic_data = + tor_version_as_new_as(tok->args[0], "0.2.3.1-alpha"); } if (vote_rs) { vote_rs->version = tor_strdup(tok->args[0]);

1 0

[metrics-web/master] Handle files with multiple descriptors correctly.
by karsten＠torproject.org 20 Jul '11

20 Jul '11

commit 9134082c3ab911c1b283aaf0f1f074d37660060d Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed Jul 20 12:23:39 2011 +0200 Handle files with multiple descriptors correctly. --- .../ernie/cron/RelayDescriptorParser.java | 56 ++++++++++++++++++-- 1 files changed, 51 insertions(+), 5 deletions(-) diff --git a/src/org/torproject/ernie/cron/RelayDescriptorParser.java b/src/org/torproject/ernie/cron/RelayDescriptorParser.java index a9a0d3d..4b8a16c 100644 --- a/src/org/torproject/ernie/cron/RelayDescriptorParser.java +++ b/src/org/torproject/ernie/cron/RelayDescriptorParser.java @@ -55,17 +55,63 @@ public class RelayDescriptorParser { public void parse(byte[] data) { try { - /* Convert descriptor to ASCII for parsing. This means we'll lose - * the non-ASCII chars, but we don't care about them for parsing - * anyway. */ + /* Remove any @ lines at the beginning of the file and parse the + * first non-@ line to find out the descriptor type. */ BufferedReader br = new BufferedReader(new StringReader(new String( data, "US-ASCII"))); String line = br.readLine(); + while (line != null && line.startsWith("@")) { + line = br.readLine(); + } if (line == null) { - this.logger.fine("We were given an empty descriptor for " - + "parsing. Ignoring."); + this.logger.fine("We were given a file that doesn't contain a " + + "single descriptor for parsing. Ignoring."); return; } + br.close(); + + /* Split the byte[] possibly containing multiple descriptors into + * byte[]'s with one descriptor each and parse them. */ + String startToken = null; + if (line.equals("network-status-version 3")) { + startToken = "network-status-version 3"; + } else if (line.startsWith("router ")) { + startToken = "router "; + } else if (line.startsWith("extra-info ")) { + startToken = "extra-info "; + } else { + this.logger.warning("Unknown descriptor type. Ignoring."); + return; + } + String splitToken = "\n" + startToken; + String ascii = new String(data, "US-ASCII"); + int length = data.length, start = ascii.indexOf(startToken); + while (start < length) { + int end = ascii.indexOf(splitToken, start); + if (end < 0) { + end = length; + } else { + end += 1; + } + byte[] descBytes = new byte[end - start]; + System.arraycopy(data, start, descBytes, 0, end - start); + parseSingleDescriptor(descBytes); + start = end; + } + } catch (IOException e) { + this.logger.log(Level.WARNING, "Could not parse descriptor. " + + "Skipping.", e); + } + } + + private void parseSingleDescriptor(byte[] data) { + try { + /* Convert descriptor to ASCII for parsing. This means we'll lose + * the non-ASCII chars, but we don't care about them for parsing + * anyway. */ + BufferedReader br = new BufferedReader(new StringReader(new String( + data, "US-ASCII"))); + String line = br.readLine(); SimpleDateFormat parseFormat = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); parseFormat.setTimeZone(TimeZone.getTimeZone("UTC"));

1 0

[torspec/master] Mark proposal 171 as implemented
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit 6a2136dac7cbe9c8cff7965fb6050207c971a9fc Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 19 20:55:01 2011 -0400 Mark proposal 171 as implemented --- proposals/000-index.txt | 4 ++-- proposals/171-separate-streams.txt | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/proposals/000-index.txt b/proposals/000-index.txt index 43502ec..bd952ad 100644 --- a/proposals/000-index.txt +++ b/proposals/000-index.txt @@ -91,7 +91,7 @@ Proposals by number: 168 Reduce default circuit window [OPEN] 169 Eliminate TLS renegotiation for the Tor connection handshake [SUPERSEDED] 170 Configuration options regarding circuit building [SUPERSEDED] -171 Separate streams across circuits by connection metadata [ACCEPTED] +171 Separate streams across circuits by connection metadata [CLOSED] 172 GETINFO controller option for circuit information [ACCEPTED] 173 GETINFO Option Expansion [ACCEPTED] 174 Optimistic Data for Tor: Server Side [CLOSED] @@ -140,7 +140,6 @@ Proposals by status: 140 Provide diffs between consensuses 147 Eliminate the need for v2 directories in generating v3 directories [for 0.2.3.x] 157 Make certificate downloads specific [for 0.2.3.x] - 171 Separate streams across circuits by connection metadata [for 0.2.3.x] 172 GETINFO controller option for circuit information [for 0.2.3.x] 173 GETINFO Option Expansion [for 0.2.3.x] META: @@ -185,6 +184,7 @@ Proposals by status: 152 Optionally allow exit from single-hop circuits [in 0.2.1.6-alpha] 166 Including Network Statistics in Extra-Info Documents [for 0.2.2] 167 Vote on network parameters in consensus [in 0.2.2] + 171 Separate streams across circuits by connection metadata [in 0.2.3.3-alpha] 174 Optimistic Data for Tor: Server Side [in 0.2.3.1-alpha] SUPERSEDED: 112 Bring Back Pathlen Coin Weight diff --git a/proposals/171-separate-streams.txt b/proposals/171-separate-streams.txt index 3b8b826..01668a4 100644 --- a/proposals/171-separate-streams.txt +++ b/proposals/171-separate-streams.txt @@ -3,8 +3,8 @@ Title: Separate streams across circuits by connection metadata Author: Robert Hogan, Jacob Appelbaum, Damon McCoy, Nick Mathewson Created: 21-Oct-2008 Modified: 7-Dec-2010 -Status: Accepted -Target: 0.2.3.x +Status: Closed +Implemented-In: 0.2.3.3-alpha Summary:

1 0

[tor/master] Turn streq_opt into a generic strcmp_opt.
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit 94f85f216ae4b6196d2a3438bfaf328375ebaad6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 19 02:36:11 2011 -0400 Turn streq_opt into a generic strcmp_opt. --- src/common/util.c | 17 +++++++++++++++++ src/common/util.h | 1 + src/or/config.c | 7 +------ 3 files changed, 19 insertions(+), 6 deletions(-) diff --git a/src/common/util.c b/src/common/util.c index bf0bbe0..15b6e71 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -521,6 +521,23 @@ tor_strisnonupper(const char *s) return 1; } +/** As strcmp, except that either string may be NULL. The NULL string is + * considered to be before any non-NULL string. */ +int +strcmp_opt(const char *s1, const char *s2) +{ + if (!s1) { + if (!s2) + return 0; + else + return -1; + } else if (!s2) { + return 1; + } else { + return strcmp(s1, s2); + } +} + /** Compares the first strlen(s2) characters of s1 with s2. Returns as for * strcmp. */ diff --git a/src/common/util.h b/src/common/util.h index de06c3c..9935587 100644 --- a/src/common/util.h +++ b/src/common/util.h @@ -175,6 +175,7 @@ void tor_strlower(char *s) ATTR_NONNULL((1)); void tor_strupper(char *s) ATTR_NONNULL((1)); int tor_strisprint(const char *s) ATTR_PURE ATTR_NONNULL((1)); int tor_strisnonupper(const char *s) ATTR_PURE ATTR_NONNULL((1)); +int strcmp_opt(const char *s1, const char *s2) ATTR_PURE; int strcmpstart(const char *s1, const char *s2) ATTR_PURE ATTR_NONNULL((1,2)); int strcmp_len(const char *s1, const char *s2, size_t len) ATTR_PURE ATTR_NONNULL((1,2)); diff --git a/src/or/config.c b/src/or/config.c index 86ccb92..cc1561b 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -3864,12 +3864,7 @@ options_validate(or_options_t *old_options, or_options_t *options, static int opt_streq(const char *s1, const char *s2) { - if (!s1 && !s2) - return 1; - else if (s1 && s2 && !strcmp(s1,s2)) - return 1; - else - return 0; + return 0 == strcmp_opt(s1, s2); } /** Check if any of the previous options have changed but aren't allowed to. */

1 0

[tor/master] Manpage updates for proposal 171 (isolated streams)
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit 891ccd3cd0690e83f1dc4dde7698c3bd9d7fe98d Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jul 8 16:37:29 2011 -0400 Manpage updates for proposal 171 (isolated streams) --- doc/tor.1.txt | 105 +++++++++++++++++++++++++++++++++++++++++++------------- 1 files changed, 80 insertions(+), 25 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 9607632..8241eeb 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -464,7 +464,7 @@ CLIENT OPTIONS -------------- The following options are useful only for clients (that is, if -**SocksPort** is non-zero): +**SocksPort**, **TransPort**, **DNSPort**, or **NATDPort** is non-zero): **AllowInvalidNodes** **entry**|**exit**|**middle**|**introduction**|**rendezvous**|**...**:: If some Tor servers are obviously not working right, the directory @@ -682,17 +682,50 @@ The following options are useful only for clients (that is, if the same circuit. Currently, two addresses are "too close" if they lie in the same /16 range. (Default: 1) -**SocksPort** __PORT__|**auto**:: - Advertise this port to listen for connections from Socks-speaking +**SOCKSPort** \['address':]__port__|**auto** [_isolation flags_]:: + Open this port to listen for connections from SOCKS-speaking applications. Set this to 0 if you don't want to allow application connections via SOCKS. Set it to "auto" to have Tor pick a port for - you. (Default: 9050) - -**SocksListenAddress** __IP__[:__PORT__]:: + you. This directive can be specified multiple times to bind + to multiple addresses/ports. (Default: 9050) + + + + The _isolation flags_ arguments give Tor rules for which streams + received on this SOCKSPort are allowed to share circuits with one + another. Recognized isolation flags are: + **IsolateClientAddr**;; + Don't share a circuits with streams from a different + client address. (On by default and strongly recommended; + you can disable it with **NoIsolateClientAddr**.) + **IsolateSOCKSAuth**;; + Don't share a circuits with streams for which different + SOCKS authentication was provided. (On by default; + you can disable it with **NoIsolateSOCKSAuth**.) + [NOT YET IMPLEMENTED.] + **IsolateClientProtocol**;; + Don't share circuits with streams using a different protocol. + (SOCKS 4, SOCKS 5, TransPort connections, NATDPort connections, + and DNSPort requests are all considered to be different protocols.) + **IsolateDestPort**;; + Don't share a circuits with streams targetting a different + destination port. + **IsolateDestAddr**;; + Don't share a circuits with streams targetting a different + destination address. + **SessionGroup=**__INT__;; + If no other isolation rules would prevent it, allow streams + on this port to share circuits with streams from every other + port with the same session group. (By default, streams received + on different ports are always isolated from one another.) + +**SOCKSListenAddress** __IP__[:__PORT__]:: Bind to this address to listen for connections from Socks-speaking applications. (Default: 127.0.0.1) You can also specify a port (e.g. 192.168.0.1:9100). This directive can be specified multiple times to bind - to multiple addresses/ports. + to multiple addresses/ports. (DEPRECATED: As of 0.2.3.x-alpha, you can + now use multiple SOCKSPort entries, and provide addresses for SOCKSPort + entries, so SOCKSListenAddress no longer has a purpose. For backward + compatibility, SOCKSListenAddress is only allowed when SOCKSPort is just + a port number.) **SocksPolicy** __policy__,__policy__,__...__:: Set an entrance policy for this server, to limit who can connect to the @@ -795,28 +828,44 @@ The following options are useful only for clients (that is, if operating as a relay, and it will never use the public key step if it doesn't yet know the onion key of the first hop. (Default: 1) -**TransPort** __PORT__|**auto**:: - If non-zero, enables transparent proxy support on __PORT__ (by convention, - 9040). Requires OS support for transparent proxies, such as BSDs' pf or +**TransPort** \['address':]__port__|**auto** [_isolation flags_]:: + Open this port to listen for transparent proxy connections. Set this to + 0 if you don't want to allow transparent proxy connections. Set the port + to "auto" to have Tor pick a port for you. This directive can be + specified multiple times to bind to multiple addresses/ports. See + SOCKSPort for an explanation of isolation flags. + + + + TransPort requires OS support for transparent proxies, such as BSDs' pf or Linux's IPTables. If you're planning to use Tor as a transparent proxy for a network, you'll want to examine and change VirtualAddrNetwork from the default setting. You'll also want to set the TransListenAddress option for - the network you'd like to proxy. Set it to "auto" to have Tor pick a - port for you. (Default: 0). + the network you'd like to proxy. (Default: 0). **TransListenAddress** __IP__[:__PORT__]:: Bind to this address to listen for transparent proxy connections. (Default: 127.0.0.1). This is useful for exporting a transparent proxy server to an - entire network. - -**NATDPort** __PORT__|**auto**:: - Allow old versions of ipfw (as included in old versions of FreeBSD, etc.) - to send connections through Tor using the NATD protocol. This option is - only for people who cannot use TransPort. Set it to "auto" to have Tor - pick a port for you. (Default: 0) + entire network. (DEPRECATED: As of 0.2.3.x-alpha, you can + now use multiple TransPort entries, and provide addresses for TransPort + entries, so TransListenAddress no longer has a purpose. For backward + compatibility, TransListenAddress is only allowed when TransPort is just + a port number.) + +**NATDPort** \['address':]__port__|**auto** [_isolation flags_]:: + Open this port to listen for connections from old versions of ipfw (as + included in old versions of FreeBSD, etc) using the NATD protocol. + Use 0 if you don't want to allow NATD connections. Set the port + to "auto" to have Tor pick a port for you. This directive can be + specified multiple times to bind to multiple addresses/ports. See + SOCKSPort for an explanation of isolation flags. + + + + This option is only for people who cannot use TransPort. (Default: 0) **NATDListenAddress** __IP__[:__PORT__]:: - Bind to this address to listen for NATD connections. (Default: 127.0.0.1). + Bind to this address to listen for NATD connections. (DEPRECATED: As of + 0.2.3.x-alpha, you can now use multiple NATDPort entries, and provide + addresses for NATDPort entries, so NATDListenAddress no longer has a + purpose. For backward compatibility, NATDListenAddress is only allowed + when NATDPort is just a port number.) **AutomapHostsOnResolve** **0**|**1**:: When this option is enabled, and we get a request to resolve an address @@ -829,13 +878,19 @@ The following options are useful only for clients (that is, if A comma-separated list of suffixes to use with **AutomapHostsOnResolve**. The "." suffix is equivalent to "all addresses." (Default: .exit,.onion). -**DNSPort** __PORT__|**auto**:: - If non-zero, Tor listens for UDP DNS requests on this port and resolves - them anonymously. Set it to "auto" to have Tor pick a port for - you. (Default: 0). +**DNSPort** \['address':]__port__|**auto** [_isolation flags_]:: + If non-zero, open this port to listen for UDP DNS requests, and resolve + them anonymously. Set the port to "auto" to have Tor pick a port for + you. This directive can be specified multiple times to bind to multiple + addresses/ports. See SOCKSPort for an explanation of isolation + flags. (Default: 0). **DNSListenAddress** __IP__[:__PORT__]:: - Bind to this address to listen for DNS connections. (Default: 127.0.0.1). + Bind to this address to listen for DNS connections. (DEPRECATED: As of + 0.2.3.x-alpha, you can now use multiple DNSPort entries, and provide + addresses for DNSPort entries, so DNSListenAddress no longer has a + purpose. For backward compatibility, DNSListenAddress is only allowed + when DNSPort is just a port number.) **ClientDNSRejectInternalAddresses** **0**|**1**:: If true, Tor does not believe any anonymously retrieved DNS answer that

1 0