- tor-commits - lists.torproject.org

[tor/master] Add an option to limit the number of non-open client circuits.
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit aef30547dc4aa77fc79517a6dcad7712b59af371 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jul 7 14:54:54 2011 -0400 Add an option to limit the number of non-open client circuits. This is mainly meant as a way to keep clients from accidentally DOSing themselves by (e.g.) enabling IsolateDestAddr or IsolateDestPort on a port that they use for HTTP. --- src/or/circuituse.c | 35 +++++++++++++++++++++++++++++++++++ src/or/config.c | 10 ++++++++++ src/or/or.h | 5 +++++ 3 files changed, 50 insertions(+), 0 deletions(-) diff --git a/src/or/circuituse.c b/src/or/circuituse.c index 93098e5..dcb6bfa 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -288,6 +288,27 @@ circuit_get_best(const edge_connection_t *conn, return best; } +/** Return the number of not-yet-open general-purpose origin circuits. */ +static int +count_pending_general_client_circuits(void) +{ + const circuit_t *circ; + + int count = 0; + + for (circ = global_circuitlist; circ; circ = circ->next) { + if (circ->marked_for_close || + circ->state == CIRCUIT_STATE_OPEN || + circ->purpose != CIRCUIT_PURPOSE_C_GENERAL || + !CIRCUIT_IS_ORIGIN(circ)) + continue; + + ++count; + } + + return count; +} + #if 0 /** Check whether, according to the policies in options, the * circuit circ makes sense. */ @@ -1347,6 +1368,20 @@ circuit_get_open_circ_or_launch(edge_connection_t *conn, if (!circ) { extend_info_t *extend_info=NULL; uint8_t new_circ_purpose; + const int n_pending = count_pending_general_client_circuits(); + + if (n_pending >= options->MaxClientCircuitsPending) { + static ratelim_t delay_limit = RATELIM_INIT(10*60); + char *m; + if ((m = rate_limit_log(&delay_limit, approx_time()))) { + log_notice(LD_APP, "We'd like to launch a circuit to handle a " + "connection, but we already have %d general-purpose client " + "circuits pending. Waiting until some finish.", + n_pending); + tor_free(m); + } + return 0; + } if (desired_circuit_purpose == CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT) { /* need to pick an intro point */ diff --git a/src/or/config.c b/src/or/config.c index 2ca9c66..14acf59 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -315,6 +315,7 @@ static config_var_t _option_vars[] = { VAR("MapAddress", LINELIST, AddressMap, NULL), V(MaxAdvertisedBandwidth, MEMUNIT, "1 GB"), V(MaxCircuitDirtiness, INTERVAL, "10 minutes"), + V(MaxClientCircuitsPending, UINT, "32"), V(MaxOnionsPending, UINT, "100"), OBSOLETE("MonthlyAccountingStart"), V(MyFamily, STRING, NULL), @@ -3215,6 +3216,15 @@ options_validate(or_options_t *old_options, or_options_t *options, return -1; } + if (options->MaxClientCircuitsPending <= 0 || + options->MaxClientCircuitsPending > MAX_MAX_CLIENT_CIRCUITS_PENDING) { + tor_asprintf(msg, + "MaxClientCircuitsPending must be between 1 and %d, but " + "was set to %d", MAX_MAX_CLIENT_CIRCUITS_PENDING, + options->MaxClientCircuitsPending); + return -1; + } + if (validate_ports_csv(options->FirewallPorts, "FirewallPorts", msg) < 0) return -1; diff --git a/src/or/or.h b/src/or/or.h index 97418f5..09907c3 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -3230,6 +3230,11 @@ typedef struct { /** Should that file be group-readable? */ int ControlPortFileGroupReadable; +#define MAX_MAX_CLIENT_CIRCUITS_PENDING 1024 + /** Maximum number of non-open general-purpose origin circuits to allow at + * once. */ + int MaxClientCircuitsPending; + } or_options_t; /** Persistent state for an onion router, as saved to disk. */

1 0

[tor/master] Implement destaddr-based isolation
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit 424063e3b2b882d72943bda41279bd29a711ec55 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jul 8 15:15:59 2011 -0400 Implement destaddr-based isolation The new candidate rule, which arma suggested and I like, is that the original address as received from the client connection or as rewritten by the controller is the address that counts. --- src/or/connection.c | 2 +- src/or/connection_edge.c | 45 +++++++++++++++++++++++++++++++++++---------- src/or/dnsserv.c | 1 + src/or/or.h | 4 +++- 4 files changed, 40 insertions(+), 12 deletions(-) diff --git a/src/or/connection.c b/src/or/connection.c index 09b45e0..5e5abca 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -467,9 +467,9 @@ _connection_free(connection_t *conn) if (CONN_IS_EDGE(conn)) { edge_connection_t *edge_conn = TO_EDGE_CONN(conn); tor_free(edge_conn->chosen_exit_name); + tor_free(edge_conn->original_dest_address); if (edge_conn->socks_request) socks_request_free(edge_conn->socks_request); - rend_data_free(edge_conn->rend_data); } if (conn->type == CONN_TYPE_CONTROL) { diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 20f01b1..cfa6a3d 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -1671,6 +1671,9 @@ connection_ap_handshake_rewrite_and_attach(edge_connection_t *conn, safe_str_client(socks->address), socks->port); + if (! conn->original_dest_address) + conn->original_dest_address = tor_strdup(conn->socks_request->address); + if (socks->command == SOCKS_COMMAND_RESOLVE && !tor_inet_aton(socks->address, &addr_tmp) && options->AutomapHostsOnResolve && options->AutomapHostsSuffixes) { @@ -2512,6 +2515,7 @@ connection_ap_make_link(connection_t *partner, conn->socks_request->has_finished = 0; /* waiting for 'connected' */ strlcpy(conn->socks_request->address, address, sizeof(conn->socks_request->address)); + conn->original_dest_address = tor_strdup(address); conn->socks_request->port = port; conn->socks_request->command = SOCKS_COMMAND_CONNECT; conn->want_onehop = want_onehop; @@ -3274,12 +3278,23 @@ connection_edge_streams_are_compatible(const edge_connection_t *a, { const uint8_t iso = a->isolation_flags | b->isolation_flags; + if (! a->original_dest_address) { + log_warn(LD_BUG, "Reached connection_edge_streams_are_compatible without " + "having set a->original_dest_address"); + ((edge_connection_t*)a)->original_dest_address = + tor_strdup(a->socks_request->address); + } + if (! b->original_dest_address) { + log_warn(LD_BUG, "Reached connection_edge_streams_are_compatible without " + "having set b->original_dest_address"); + ((edge_connection_t*)b)->original_dest_address = + tor_strdup(a->socks_request->address); + } + if ((iso & ISO_DESTPORT) && a->socks_request->port != b->socks_request->port) return 0; - /* XXXX023 Not quite right: we care about addresses that resolve to the same - place */ if ((iso & ISO_DESTADDR) && - strcasecmp(a->socks_request->address, b->socks_request->address)) + strcasecmp(a->original_dest_address, b->original_dest_address)) return 0; /* XXXX023 Waititing for ticket #1666 */ /* @@ -3328,12 +3343,17 @@ connection_edge_compatible_with_circuit(const edge_connection_t *conn, return 0; } + if (! conn->original_dest_address) { + log_warn(LD_BUG, "Reached connection_edge_compatible_with_circuit without " + "having set conn->original_dest_address"); + ((edge_connection_t*)conn)->original_dest_address = + tor_strdup(conn->socks_request->address); + } + if ((iso & ISO_DESTPORT) && conn->socks_request->port != circ->dest_port) return 0; - /* XXXX023 Not quite right: we care about addresses that resolve to the same - place */ if ((iso & ISO_DESTADDR) && - strcasecmp(conn->socks_request->address, circ->dest_address)) + strcasecmp(conn->original_dest_address, circ->dest_address)) return 0; /* XXXX023 Waititing for ticket #1666 */ /* @@ -3369,11 +3389,18 @@ connection_edge_update_circuit_isolation(const edge_connection_t *conn, origin_circuit_t *circ, int dry_run) { + if (! conn->original_dest_address) { + log_warn(LD_BUG, "Reached connection_update_circuit_isolation without " + "having set conn->original_dest_address"); + ((edge_connection_t*)conn)->original_dest_address = + tor_strdup(conn->socks_request->address); + } + if (!circ->isolation_values_set) { if (dry_run) return -1; circ->dest_port = conn->socks_request->port; - circ->dest_address = tor_strdup(conn->socks_request->address); + circ->dest_address = tor_strdup(conn->original_dest_address); circ->client_proto_type = TO_CONN(conn)->type; circ->client_proto_socksver = conn->socks_request->socks_version; tor_addr_copy(&circ->client_addr, &TO_CONN(conn)->addr); @@ -3387,9 +3414,7 @@ connection_edge_update_circuit_isolation(const edge_connection_t *conn, uint8_t mixed = 0; if (conn->socks_request->port != circ->dest_port) mixed |= ISO_DESTPORT; - /* XXXX023 Not quite right: we care about addresses that resolve to the - same place */ - if (strcasecmp(conn->socks_request->address, circ->dest_address)) + if (strcasecmp(conn->original_dest_address, circ->dest_address)) mixed |= ISO_DESTADDR; /* XXXX023 auth too, once #1666 is in. */ if ((TO_CONN(conn)->type != circ->client_proto_type || diff --git a/src/or/dnsserv.c b/src/or/dnsserv.c index 8612b48..c81d72f 100644 --- a/src/or/dnsserv.c +++ b/src/or/dnsserv.c @@ -184,6 +184,7 @@ dnsserv_launch_request(const char *name, int reverse) strlcpy(conn->socks_request->address, name, sizeof(conn->socks_request->address)); + conn->original_dest_address = tor_strdup(name); if (connection_add(TO_CONN(conn))<0) { log_warn(LD_APP, "Couldn't register dummy connection for RESOLVE request"); diff --git a/src/or/or.h b/src/or/or.h index 09907c3..ace92ce 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1214,10 +1214,12 @@ typedef struct edge_connection_t { int session_group; /** AP only: The newnym epoch in which we created this connection. */ unsigned nym_epoch; + /** AP only: The original requested address before we rewrote it. */ + char *original_dest_address; /* Other fields to isolate on already exist. The ClientAddr is addr. The ClientProtocol is a combination of type and socks_request-> socks_version. SocksAuth will be added to socks_request by ticket - #1666. DestAddr and DestPort are in socks_request->address. */ + #1666. DestAddr is in socks_request->address. */ /** Number of times we've reassigned this application connection to * a new circuit. We keep track because the timeout is longer if we've

1 0

[tor/master] Launch sufficient circuits to satisfy pending isolated streams
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit 20c0581a7935369fecb6c62b7cf5c7c244cdb533 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jul 7 10:40:23 2011 -0400 Launch sufficient circuits to satisfy pending isolated streams Our old "do we need to launch a circuit for stream S" logic was, more or less, that if we had a pending circuit that could handle S, we didn't need to launch a new one. But now that we have streams isolated from one another, we need something stronger here: It's possible that some pending C can handle either S1 or S2, but not both. This patch reuses the existing isolation logic for a simple solution: when we decide during circuit launching that some pending C would satisfy stream S1, we "hypothetically" mark C as though S1 had been connected to it. Now if S2 is incompatible with S1, it won't be something that can attach to C, and so we'll launch a new stream. When the circuit becomes OPEN for the first time (with no streams attached to it), we reset the circuit's isolation status. I'm not too sure about this part: I wanted some way to be sure that, if all streams that would have used a circuit die before the circuit is done, the circuit can still get used. But I worry that this approach could also lead to us launching too many circuits. Careful thought needed here. --- src/or/circuitlist.c | 18 ++++++++++++++++-- src/or/circuituse.c | 13 +++++++++++-- src/or/connection_edge.c | 35 +++++++++++++++++++++++++++++++++++ src/or/connection_edge.h | 1 + src/or/or.h | 24 +++++++++++++++++++----- 5 files changed, 82 insertions(+), 9 deletions(-) diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c index 9f68880..6f17697 100644 --- a/src/or/circuitlist.c +++ b/src/or/circuitlist.c @@ -210,9 +210,23 @@ circuit_set_state(circuit_t *circ, uint8_t state) /* add to waiting-circuit list. */ smartlist_add(circuits_pending_or_conns, circ); } - if (state == CIRCUIT_STATE_OPEN) - tor_assert(!circ->n_conn_onionskin); + circ->state = state; + + if (state == CIRCUIT_STATE_OPEN) { + tor_assert(!circ->n_conn_onionskin); + if (CIRCUIT_IS_ORIGIN(circ)) { + origin_circuit_t *origin_circ = TO_ORIGIN_CIRCUIT(circ); + if (origin_circ->isolation_values_set && + !origin_circ->isolation_any_streams_attached) { + /* If we have any isolation information set on this circuit, + * but we never attached any streams to it, then all of the + * isolation information was hypothetical. Clear it. + */ + circuit_clear_isolation(origin_circ); + } + } + } } /** Add circ to the global list of circuits. This is called only from diff --git a/src/or/circuituse.c b/src/or/circuituse.c index 19a6234..93098e5 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -1457,12 +1457,20 @@ circuit_get_open_circ_or_launch(edge_connection_t *conn, rend_client_rendcirc_has_opened(circ); } } - } - if (!circ) + } /* endif (!circ) */ + if (circ) { + /* Mark the circuit with the isolation fields for this connection. + * When the circuit arrives, we'll clear these flags: this is + * just some internal bookkeeping to make sure that we have + * launched enough circuits. + */ + connection_edge_update_circuit_isolation(conn, circ, 0); + } else { log_info(LD_APP, "No safe circuit (purpose %d) ready for edge " "connection; delaying.", desired_circuit_purpose); + } *circp = circ; return 0; } @@ -1509,6 +1517,7 @@ link_apconn_to_circ(edge_connection_t *apconn, origin_circuit_t *circ, apconn->cpath_layer = circ->cpath->prev; } + circ->isolation_any_streams_attached = 1; connection_edge_update_circuit_isolation(apconn, circ, 0); } diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index ce555ed..20f01b1 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -3414,3 +3414,38 @@ connection_edge_update_circuit_isolation(const edge_connection_t *conn, } } +/** + * Clear the isolation settings on circ. + * + * This only works on an open circuit that has never had a stream attached to + * it, and whose isolation settings are hypothetical. (We set hypothetical + * isolation settings on circuits as we're launching them, so that we + * know whether they can handle more streams or whether we need to launch + * even more circuits. We clear the flags once the circuits are open, + * in case the streams that made us launch the circuits have closed + * since we began launching the circuits.) + */ +void +circuit_clear_isolation(origin_circuit_t *circ) +{ + if (circ->isolation_any_streams_attached) { + log_warn(LD_BUG, "Tried to clear the isolation status of a dirty circuit"); + return; + } + if (TO_CIRCUIT(circ)->state != CIRCUIT_STATE_OPEN) { + log_warn(LD_BUG, "Tried to clear the isolation status of a non-open " + "circuit"); + return; + } + + circ->isolation_values_set = 0; + circ->isolation_flags_mixed = 0; + circ->client_proto_type = 0; + circ->client_proto_socksver = 0; + circ->dest_port = 0; + tor_addr_make_unspec(&circ->client_addr); + tor_free(circ->dest_address); + circ->session_group = -1; + circ->nym_epoch = 0; +} + diff --git a/src/or/connection_edge.h b/src/or/connection_edge.h index ddcf8cc..8bd308d 100644 --- a/src/or/connection_edge.h +++ b/src/or/connection_edge.h @@ -110,6 +110,7 @@ int connection_edge_compatible_with_circuit(const edge_connection_t *conn, int connection_edge_update_circuit_isolation(const edge_connection_t *conn, origin_circuit_t *circ, int dry_run); +void circuit_clear_isolation(origin_circuit_t *circ); #endif diff --git a/src/or/or.h b/src/or/or.h index 9cf508c..97418f5 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2461,9 +2461,19 @@ typedef struct origin_circuit_t { /* XXXX NM This can get re-used after 2**32 circuits. */ uint32_t global_identifier; - /** True if we have attached at least one stream to this circuit, thereby - * setting the isolation paramaters for this circuit. */ + /** True if we have associated one stream to this circuit, thereby setting + * the isolation paramaters for this circuit. Note that this doesn't + * necessarily mean that we've attached any streams to the circuit: + * we may only have marked up this circuit during the launch process. + */ unsigned int isolation_values_set : 1; + /** True iff any stream has ever been attached to this circuit. + * + * In a better world we could use timestamp_dirty for this, but + * timestamp_dirty is far too overloaded at the moment. + */ + unsigned int isolation_any_streams_attached : 1; + /** A bitfield of ISO_* flags for every isolation field such that this * circuit has had streams with more than one value for that field * attached to it. */ @@ -2471,11 +2481,15 @@ typedef struct origin_circuit_t { /** @name Isolation parameters * - * If any streams have been attached to this circuit (isolation_values_set - * == 1), and all streams attached to the circuit have had the same value - * for some field ((isolation_flags_mixed & ISO_FOO) == 0), then these + * If any streams have been associated with this circ (isolation_values_set + * == 1), and all streams associated with the circuit have had the same + * value for some field ((isolation_flags_mixed & ISO_FOO) == 0), then these * elements hold the value for that field. * + * Note again that "associated" is not the same as "attached": we + * preliminarily associate streams with a circuit while the circuit is being + * launched, so that we can tell whether we need to launch more circuits. + * * @{ */ uint8_t client_proto_type;

1 0

[tor/master] Stick controller-originated resolves in their own session group
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit 172f8acbe7fcdf6b025ad87c81760ef45bbe1d53 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jul 8 16:00:19 2011 -0400 Stick controller-originated resolves in their own session group --- src/or/dnsserv.c | 4 ++++ src/or/or.h | 4 +++- 2 files changed, 7 insertions(+), 1 deletions(-) diff --git a/src/or/dnsserv.c b/src/or/dnsserv.c index c81d72f..35279c4 100644 --- a/src/or/dnsserv.c +++ b/src/or/dnsserv.c @@ -184,7 +184,11 @@ dnsserv_launch_request(const char *name, int reverse) strlcpy(conn->socks_request->address, name, sizeof(conn->socks_request->address)); + conn->original_dest_address = tor_strdup(name); + conn->session_group = SESSION_GROUP_CONTROL_RESOLVE; + conn->nym_epoch = get_signewnym_epoch(); + conn->isolation_flags = ISO_DEFAULT; if (connection_add(TO_CONN(conn))<0) { log_warn(LD_APP, "Couldn't register dummy connection for RESOLVE request"); diff --git a/src/or/or.h b/src/or/or.h index 26e9970..835f279 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2653,8 +2653,10 @@ typedef enum invalid_router_usage_t { #define SESSION_GROUP_UNSET -1 /** Session group reserved for directory connections */ #define SESSION_GROUP_DIRCONN -2 +/** Session group reserved for resolve requests launched by a controller */ +#define SESSION_GROUP_CONTROL_RESOLVE -3 /** First automatically allocated session group number */ -#define SESSION_GROUP_FIRST_AUTO -3 +#define SESSION_GROUP_FIRST_AUTO -4 /** Configuration for a single port that we're listening on. */ typedef struct port_cfg_t {

1 0

[tor/master] Implement sensible isolation for tunneled directory conns
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit 8314fa5e5c8d300323589ff97599f8f93b847b78 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jul 8 15:54:30 2011 -0400 Implement sensible isolation for tunneled directory conns One-hop dirconn streams all share a session group, and get the ISO_SESSIONGRP flag: they may share circuits with each other and nothing else. Anonymized dirconn streams get a new internal-use-only ISO_STREAM flag: they may not share circuits with anything, including each other. --- src/or/config.c | 6 +++--- src/or/connection.c | 2 +- src/or/connection_edge.c | 18 ++++++++++++++++-- src/or/connection_edge.h | 2 ++ src/or/directory.c | 8 +++++++- src/or/or.h | 9 +++++++++ 6 files changed, 38 insertions(+), 7 deletions(-) diff --git a/src/or/config.c b/src/or/config.c index 14acf59..86ccb92 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -4973,7 +4973,7 @@ parse_client_port_config(smartlist_t *out, cfg->type = listener_type; cfg->port = port ? port : defaultport; tor_addr_copy(&cfg->addr, &addr); - cfg->session_group = -1; + cfg->session_group = SESSION_GROUP_UNSET; cfg->isolation_flags = ISO_DEFAULT; smartlist_add(out, cfg); } @@ -4992,7 +4992,7 @@ parse_client_port_config(smartlist_t *out, cfg->type = listener_type; cfg->port = defaultport; tor_addr_from_str(&cfg->addr, defaultaddr); - cfg->session_group = -1; + cfg->session_group = SESSION_GROUP_UNSET; cfg->isolation_flags = ISO_DEFAULT; smartlist_add(out, cfg); } @@ -5006,7 +5006,7 @@ parse_client_port_config(smartlist_t *out, for (; ports; ports = ports->next) { tor_addr_t addr; int port; - int sessiongroup = -1; + int sessiongroup = SESSION_GROUP_UNSET; unsigned isolation = ISO_DEFAULT; char *addrport; diff --git a/src/or/connection.c b/src/or/connection.c index 5e5abca..0fae11e 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -868,7 +868,7 @@ connection_create_listener(const struct sockaddr *listensockaddr, tor_socket_t s; /* the socket we're going to make */ uint16_t usePort = 0, gotPort = 0; int start_reading = 0; - static int global_next_session_group = -2; + static int global_next_session_group = SESSION_GROUP_FIRST_AUTO; if (get_n_open_sockets() >= get_options()->_ConnLimit-1) { warn_too_many_conns(); diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index cfa6a3d..42f74b7 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -2497,7 +2497,9 @@ connection_ap_handshake_send_resolve(edge_connection_t *ap_conn) edge_connection_t * connection_ap_make_link(connection_t *partner, char *address, uint16_t port, - const char *digest, int use_begindir, int want_onehop) + const char *digest, + int session_group, int isolation_flags, + int use_begindir, int want_onehop) { edge_connection_t *conn; @@ -2515,7 +2517,6 @@ connection_ap_make_link(connection_t *partner, conn->socks_request->has_finished = 0; /* waiting for 'connected' */ strlcpy(conn->socks_request->address, address, sizeof(conn->socks_request->address)); - conn->original_dest_address = tor_strdup(address); conn->socks_request->port = port; conn->socks_request->command = SOCKS_COMMAND_CONNECT; conn->want_onehop = want_onehop; @@ -2528,6 +2529,11 @@ connection_ap_make_link(connection_t *partner, digest, DIGEST_LEN); } + /* Populate isolation fields. */ + conn->original_dest_address = tor_strdup(address); + conn->session_group = session_group; + conn->isolation_flags = isolation_flags; + conn->_base.address = tor_strdup("(Tor_internal)"); tor_addr_make_unspec(&conn->_base.addr); conn->_base.port = 0; @@ -3291,6 +3297,9 @@ connection_edge_streams_are_compatible(const edge_connection_t *a, tor_strdup(a->socks_request->address); } + if (iso & ISO_STREAM) + return 0; + if ((iso & ISO_DESTPORT) && a->socks_request->port != b->socks_request->port) return 0; if ((iso & ISO_DESTADDR) && @@ -3350,6 +3359,11 @@ connection_edge_compatible_with_circuit(const edge_connection_t *conn, tor_strdup(conn->socks_request->address); } + /* If isolation_values_set, then the circuit is not compatible with + * any new ISO_STREAM stream. */ + if (iso & ISO_STREAM) + return 0; + if ((iso & ISO_DESTPORT) && conn->socks_request->port != circ->dest_port) return 0; if ((iso & ISO_DESTADDR) && diff --git a/src/or/connection_edge.h b/src/or/connection_edge.h index 8bd308d..85293a0 100644 --- a/src/or/connection_edge.h +++ b/src/or/connection_edge.h @@ -36,6 +36,8 @@ int connection_ap_handshake_send_resolve(edge_connection_t *ap_conn); edge_connection_t *connection_ap_make_link(connection_t *partner, char *address, uint16_t port, const char *digest, + int session_group, + int isolation_flags, int use_begindir, int want_onehop); void connection_ap_handshake_socks_reply(edge_connection_t *conn, char *reply, size_t replylen, diff --git a/src/or/directory.c b/src/or/directory.c index 2667f12..744bc12 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -973,6 +973,10 @@ directory_initiate_command_rend(const char *address, const tor_addr_t *_addr, } } else { /* we want to connect via a tor connection */ edge_connection_t *linked_conn; + /* Anonymized tunneled connections can never share a circuit. + * One-hop directory connections can share circuits with each other + * but nothing else. */ + int iso_flags = anonymized_connection ? ISO_STREAM : ISO_SESSIONGRP; /* If it's an anonymized connection, remember the fact that we * wanted it for later: maybe we'll want it again soon. */ @@ -988,7 +992,9 @@ directory_initiate_command_rend(const char *address, const tor_addr_t *_addr, linked_conn = connection_ap_make_link(TO_CONN(conn), conn->_base.address, conn->_base.port, - digest, use_begindir, conn->dirconn_direct); + digest, + SESSION_GROUP_DIRCONN, iso_flags, + use_begindir, conn->dirconn_direct); if (!linked_conn) { log_warn(LD_NET,"Making tunnel to dirserver failed."); connection_mark_for_close(TO_CONN(conn)); diff --git a/src/or/or.h b/src/or/or.h index ace92ce..26e9970 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2642,11 +2642,20 @@ typedef enum invalid_router_usage_t { #define ISO_SESSIONGRP (1u<<5) /** Isolate based on newnym epoch (always on). */ #define ISO_NYM_EPOCH (1u<<6) +/** Isolate all streams (Internal only). */ +#define ISO_STREAM (1u<<7) /**@}*/ /** Default isolation level for ports. */ #define ISO_DEFAULT (ISO_CLIENTADDR|ISO_SOCKSAUTH|ISO_SESSIONGRP|ISO_NYM_EPOCH) +/** Indicates that we haven't yet set a session group on a port_cfg_t. */ +#define SESSION_GROUP_UNSET -1 +/** Session group reserved for directory connections */ +#define SESSION_GROUP_DIRCONN -2 +/** First automatically allocated session group number */ +#define SESSION_GROUP_FIRST_AUTO -3 + /** Configuration for a single port that we're listening on. */ typedef struct port_cfg_t { tor_addr_t addr; /**< The actual IP to listen on, if !is_unix_addr. */

1 0

[tor/master] Fix spurious warning in bufferevent socks parsing
by nickm＠torproject.org 20 Jul '11

20 Jul '11

commit 553ae5dfb5f6bb49889b2b1735217dae803f92d7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 19 20:40:15 2011 -0400 Fix spurious warning in bufferevent socks parsing The problem was that we weren't initializing want_length to 0 before calling parse_socks() the first time, so it looked like we were risking an infinite loop when in fact we were safe. Fixes 3615; bugfix on 0.2.3.2-alpha. --- changes/bug3615 | 3 +++ src/or/buffers.c | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/changes/bug3615 b/changes/bug3615 new file mode 100644 index 0000000..704b3fa --- /dev/null +++ b/changes/bug3615 @@ -0,0 +1,3 @@ + o Minor bugfixes: + - Fix a spurious warning when parsing SOCKS requests with + bufferevents enabled. Fixes bug 3615; bugfix on 0.2.3.2-alpha. diff --git a/src/or/buffers.c b/src/or/buffers.c index 256b507..e2b0bd0 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -1581,12 +1581,12 @@ fetch_from_evbuffer_socks(struct evbuffer *buf, socks_request_t *req, */ struct evbuffer_iovec v; int i; - want_length = evbuffer_get_contiguous_space(buf); n_drain = 0; - i = evbuffer_peek(buf, want_length, NULL, &v, 1); + i = evbuffer_peek(buf, -1, NULL, &v, 1); tor_assert(i == 1); data = v.iov_base; datalen = v.iov_len; + want_length = 0; res = parse_socks(data, datalen, req, log_sockstype, safe_socks, &n_drain, &want_length);

1 0

[tor/master] Specify text or binary mode in every start_writing_to_stdio_file call
by nickm＠torproject.org 19 Jul '11

19 Jul '11

commit f021df58246b5cb9b1312e5339f484462ba94b02 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Mon Jul 18 18:12:31 2011 -0700 Specify text or binary mode in every start_writing_to_stdio_file call --- changes/bug3607 | 15 +++++++++++++++ src/or/geoip.c | 4 ++-- src/or/rendservice.c | 6 ++++-- src/or/rephist.c | 2 +- src/tools/tor-gencert.c | 4 ++-- 5 files changed, 24 insertions(+), 7 deletions(-) diff --git a/changes/bug3607 b/changes/bug3607 new file mode 100644 index 0000000..2e86253 --- /dev/null +++ b/changes/bug3607 @@ -0,0 +1,15 @@ + o Minor bugfixes: + + - Write several files (currently, buffer-stats, dirreq-stats, and + entry-stats on relays that collect those statistics, client_keys + and hostname files for hidden services that use authentication, + and (in the tor-gencert utility) newly generated identity and + signing keys) in text mode, on OSes that distinguish text mode + from binary mode (i.e. on Windows). Previously, we wouldn't + specify text mode or binary mode, leading to an assertion + failure. Fixes bug 3607. Bugfix on 0.2.1.1-alpha (when the + DirRecordUsageByCountry option which would have triggered the + assertion failure was added), although this assertion failure + would have occurred in tor-gencert on Windows in 0.2.0.1-alpha. + + diff --git a/src/or/geoip.c b/src/or/geoip.c index c621ea8..c51142c 100644 --- a/src/or/geoip.c +++ b/src/or/geoip.c @@ -976,7 +976,7 @@ geoip_dirreq_stats_write(time_t now) data_v2 = geoip_get_client_history(GEOIP_CLIENT_NETWORKSTATUS_V2); data_v3 = geoip_get_client_history(GEOIP_CLIENT_NETWORKSTATUS); format_iso_time(written, now); - out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND, + out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND | O_TEXT, 0600, &open_file); if (!out) goto done; @@ -1309,7 +1309,7 @@ geoip_entry_stats_write(time_t now) filename = get_datadir_fname2("stats", "entry-stats"); data = geoip_get_client_history(GEOIP_CLIENT_CONNECT); format_iso_time(written, now); - out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND, + out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND | O_TEXT, 0600, &open_file); if (!out) goto done; diff --git a/src/or/rendservice.c b/src/or/rendservice.c index d9a9364..8a01711 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -635,13 +635,15 @@ rend_service_load_keys(void) } /* Prepare client_keys and hostname files. */ - if (!(cfile = start_writing_to_stdio_file(cfname, OPEN_FLAGS_REPLACE, + if (!(cfile = start_writing_to_stdio_file(cfname, + OPEN_FLAGS_REPLACE | O_TEXT, 0600, &open_cfile))) { log_warn(LD_CONFIG, "Could not open client_keys file %s", escaped(cfname)); goto err; } - if (!(hfile = start_writing_to_stdio_file(fname, OPEN_FLAGS_REPLACE, + if (!(hfile = start_writing_to_stdio_file(fname, + OPEN_FLAGS_REPLACE | O_TEXT, 0600, &open_hfile))) { log_warn(LD_CONFIG, "Could not open hostname file %s", escaped(fname)); goto err; diff --git a/src/or/rephist.c b/src/or/rephist.c index b7341f3..2444700 100644 --- a/src/or/rephist.c +++ b/src/or/rephist.c @@ -2500,7 +2500,7 @@ rep_hist_buffer_stats_write(time_t now) if (check_private_dir(statsdir, CPD_CREATE, get_options()->User) < 0) goto done; filename = get_datadir_fname2("stats", "buffer-stats"); - out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND, + out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND | O_TEXT, 0600, &open_file); if (!out) goto done; diff --git a/src/tools/tor-gencert.c b/src/tools/tor-gencert.c index a04edda..7a516b4 100644 --- a/src/tools/tor-gencert.c +++ b/src/tools/tor-gencert.c @@ -264,7 +264,7 @@ load_identity_key(void) } if (!(f = start_writing_to_stdio_file(identity_key_file, - OPEN_FLAGS_REPLACE, 0400, + OPEN_FLAGS_REPLACE | O_TEXT, 0400, &open_file))) return 1; @@ -349,7 +349,7 @@ generate_signing_key(void) } if (!(f = start_writing_to_stdio_file(signing_key_file, - OPEN_FLAGS_REPLACE, 0600, + OPEN_FLAGS_REPLACE | O_TEXT, 0600, &open_file))) return 1;

1 0

[tor/master] Untangle first sentence of changes/bug3607
by nickm＠torproject.org 19 Jul '11

19 Jul '11

commit 3e3aac5fd552b7b1949b0d2e12368cea26449b83 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 19 11:14:01 2011 -0400 Untangle first sentence of changes/bug3607 --- changes/bug3607 | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/changes/bug3607 b/changes/bug3607 index 2e86253..5ece219 100644 --- a/changes/bug3607 +++ b/changes/bug3607 @@ -1,12 +1,12 @@ o Minor bugfixes: - - Write several files (currently, buffer-stats, dirreq-stats, and - entry-stats on relays that collect those statistics, client_keys - and hostname files for hidden services that use authentication, - and (in the tor-gencert utility) newly generated identity and - signing keys) in text mode, on OSes that distinguish text mode - from binary mode (i.e. on Windows). Previously, we wouldn't - specify text mode or binary mode, leading to an assertion + - Write several files in text mode, on OSes that distinguish text + mode from binary mode (namely, Windows). These files are: + buffer-stats, dirreq-stats, and entry-stats on relays that collect + those statistics; client_keys and hostname files for hidden + services that use authentication; and (in the tor-gencert utility) + newly generated identity and signing keys. Previously, we + wouldn't specify text mode or binary mode, leading to an assertion failure. Fixes bug 3607. Bugfix on 0.2.1.1-alpha (when the DirRecordUsageByCountry option which would have triggered the assertion failure was added), although this assertion failure

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2'
by nickm＠torproject.org 19 Jul '11

19 Jul '11

commit c2d3da6303a6a5e41eabcb18b56ee5d8434a9817 Merge: 2163e42 3e3aac5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jul 19 12:59:10 2011 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' changes/bug3607 | 15 +++++++++++++++ src/or/geoip.c | 4 ++-- src/or/rendservice.c | 6 ++++-- src/or/rephist.c | 2 +- src/tools/tor-gencert.c | 4 ++-- 5 files changed, 24 insertions(+), 7 deletions(-)

1 0

[tor/maint-0.2.2] Specify text or binary mode in every start_writing_to_stdio_file call
by nickm＠torproject.org 19 Jul '11

19 Jul '11

commit f021df58246b5cb9b1312e5339f484462ba94b02 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Mon Jul 18 18:12:31 2011 -0700 Specify text or binary mode in every start_writing_to_stdio_file call --- changes/bug3607 | 15 +++++++++++++++ src/or/geoip.c | 4 ++-- src/or/rendservice.c | 6 ++++-- src/or/rephist.c | 2 +- src/tools/tor-gencert.c | 4 ++-- 5 files changed, 24 insertions(+), 7 deletions(-) diff --git a/changes/bug3607 b/changes/bug3607 new file mode 100644 index 0000000..2e86253 --- /dev/null +++ b/changes/bug3607 @@ -0,0 +1,15 @@ + o Minor bugfixes: + + - Write several files (currently, buffer-stats, dirreq-stats, and + entry-stats on relays that collect those statistics, client_keys + and hostname files for hidden services that use authentication, + and (in the tor-gencert utility) newly generated identity and + signing keys) in text mode, on OSes that distinguish text mode + from binary mode (i.e. on Windows). Previously, we wouldn't + specify text mode or binary mode, leading to an assertion + failure. Fixes bug 3607. Bugfix on 0.2.1.1-alpha (when the + DirRecordUsageByCountry option which would have triggered the + assertion failure was added), although this assertion failure + would have occurred in tor-gencert on Windows in 0.2.0.1-alpha. + + diff --git a/src/or/geoip.c b/src/or/geoip.c index c621ea8..c51142c 100644 --- a/src/or/geoip.c +++ b/src/or/geoip.c @@ -976,7 +976,7 @@ geoip_dirreq_stats_write(time_t now) data_v2 = geoip_get_client_history(GEOIP_CLIENT_NETWORKSTATUS_V2); data_v3 = geoip_get_client_history(GEOIP_CLIENT_NETWORKSTATUS); format_iso_time(written, now); - out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND, + out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND | O_TEXT, 0600, &open_file); if (!out) goto done; @@ -1309,7 +1309,7 @@ geoip_entry_stats_write(time_t now) filename = get_datadir_fname2("stats", "entry-stats"); data = geoip_get_client_history(GEOIP_CLIENT_CONNECT); format_iso_time(written, now); - out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND, + out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND | O_TEXT, 0600, &open_file); if (!out) goto done; diff --git a/src/or/rendservice.c b/src/or/rendservice.c index d9a9364..8a01711 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -635,13 +635,15 @@ rend_service_load_keys(void) } /* Prepare client_keys and hostname files. */ - if (!(cfile = start_writing_to_stdio_file(cfname, OPEN_FLAGS_REPLACE, + if (!(cfile = start_writing_to_stdio_file(cfname, + OPEN_FLAGS_REPLACE | O_TEXT, 0600, &open_cfile))) { log_warn(LD_CONFIG, "Could not open client_keys file %s", escaped(cfname)); goto err; } - if (!(hfile = start_writing_to_stdio_file(fname, OPEN_FLAGS_REPLACE, + if (!(hfile = start_writing_to_stdio_file(fname, + OPEN_FLAGS_REPLACE | O_TEXT, 0600, &open_hfile))) { log_warn(LD_CONFIG, "Could not open hostname file %s", escaped(fname)); goto err; diff --git a/src/or/rephist.c b/src/or/rephist.c index b7341f3..2444700 100644 --- a/src/or/rephist.c +++ b/src/or/rephist.c @@ -2500,7 +2500,7 @@ rep_hist_buffer_stats_write(time_t now) if (check_private_dir(statsdir, CPD_CREATE, get_options()->User) < 0) goto done; filename = get_datadir_fname2("stats", "buffer-stats"); - out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND, + out = start_writing_to_stdio_file(filename, OPEN_FLAGS_APPEND | O_TEXT, 0600, &open_file); if (!out) goto done; diff --git a/src/tools/tor-gencert.c b/src/tools/tor-gencert.c index a04edda..7a516b4 100644 --- a/src/tools/tor-gencert.c +++ b/src/tools/tor-gencert.c @@ -264,7 +264,7 @@ load_identity_key(void) } if (!(f = start_writing_to_stdio_file(identity_key_file, - OPEN_FLAGS_REPLACE, 0400, + OPEN_FLAGS_REPLACE | O_TEXT, 0400, &open_file))) return 1; @@ -349,7 +349,7 @@ generate_signing_key(void) } if (!(f = start_writing_to_stdio_file(signing_key_file, - OPEN_FLAGS_REPLACE, 0600, + OPEN_FLAGS_REPLACE | O_TEXT, 0600, &open_file))) return 1;

1 0