- tor-commits - lists.torproject.org

[flashproxy/master] Be consistent about prefixing prompt indicators in README.
by dcf＠torproject.org 17 Jun '11

17 Jun '11

commit 4d2318d5b93d445d0d6e27bb4464ffe14336f0ce Author: David Fifield <david(a)bamsoftware.com> Date: Fri Jun 17 12:45:54 2011 -0700 Be consistent about prefixing prompt indicators in README. --- README | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/README b/README index ef7e826..ef2cc65 100644 --- a/README +++ b/README @@ -39,12 +39,12 @@ Copy the resulting swfcat.swf file to a web server. === Connecting On the Tor relay, run - sudo ./crossdomaind.py + # ./crossdomaind.py In general, any computer that a proxy connects to needs to serve a crossdomain policy, but the connector and facilitator have it built in. On the facilitator, run - ./facilitator.py -r <relay-ip> + $ ./facilitator.py -r <relay-ip> The facilitator runs on port 9002 by default. In a browser somewhere, open swfcat.swf and pass it a parameters telling it @@ -58,7 +58,7 @@ coordinates connections using another server (which may be the same as the facilitator) and works when the client is behind a NAT. To connect with TCP, run - ./connector.py -f <facilitator-ip> + $ ./connector.py -f <facilitator-ip> (If you are running the facilitator locally, be sure to use an external IP address, not 127.0.0.1.) The connector informs the facilitator that it wants a connection, then listens on 0.0.0.0:9000 and 127.0.0.1:9001. @@ -66,7 +66,7 @@ The proxy will connect on port 9000 and the local Tor will connect on 9001. To connect with RTMFP, run - ./connector.py 127.0.0.1:9001 127.0.0.1:9002 + $ ./connector.py 127.0.0.1:9001 127.0.0.1:9002 and open in a browser http://www.example.com/swfcat.swf?client=1&facilitator=<facilitator-ip>:9002 In this case, it is swfcat running in client mode that registers with

1 0

[tor/master] Abandon rendezvous circuits on SIGNAL NEWNYM
by nickm＠torproject.org 17 Jun '11

17 Jun '11

commit 010b8dd4f6e8e3c3d2e44ff589ff61cbf64b952a Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Thu Jun 9 19:56:40 2011 -0700 Abandon rendezvous circuits on SIGNAL NEWNYM --- changes/abandon-rend-circs-on-newnym | 8 ++++++++ src/or/circuituse.c | 3 ++- 2 files changed, 10 insertions(+), 1 deletions(-) diff --git a/changes/abandon-rend-circs-on-newnym b/changes/abandon-rend-circs-on-newnym new file mode 100644 index 0000000..67cb2dc --- /dev/null +++ b/changes/abandon-rend-circs-on-newnym @@ -0,0 +1,8 @@ + o Security fixes: + - Don't attach new streams to old rendezvous circuits after SIGNAL + NEWNYM. Previously, we would keep using an existing rendezvous + circuit if it remained open (i.e. if it were kept open by a + long-lived stream or if a new stream were attached to it before + Tor could notice that it was old and no longer in use and close + it). Bugfix on 0.1.1.15-rc; fixes bug 3375. + diff --git a/src/or/circuituse.c b/src/or/circuituse.c index 41c1899..48fc198 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -59,7 +59,8 @@ circuit_is_acceptable(circuit_t *circ, edge_connection_t *conn, return 0; } - if (purpose == CIRCUIT_PURPOSE_C_GENERAL) + if (purpose == CIRCUIT_PURPOSE_C_GENERAL || + purpose == CIRCUIT_PURPOSE_C_REND_JOINED) if (circ->timestamp_dirty && circ->timestamp_dirty+get_options()->MaxCircuitDirtiness <= now) return 0;

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2
by nickm＠torproject.org 17 Jun '11

17 Jun '11

commit 85d4c290d79264d334baa9e5c8fdf3b06d0b3d79 Merge: 209229f 010b8dd Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 17 15:24:23 2011 -0400 Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2 changes/abandon-rend-circs-on-newnym | 8 ++++++++ src/or/circuituse.c | 3 ++- 2 files changed, 10 insertions(+), 1 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2'
by nickm＠torproject.org 17 Jun '11

17 Jun '11

commit 42d6f3459053aaafbed2ab215e9e85ae5d594b5a Merge: 31b9b1a 85d4c29 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 17 15:25:18 2011 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' changes/abandon-rend-circs-on-newnym | 8 ++++++++ src/or/circuituse.c | 3 ++- 2 files changed, 10 insertions(+), 1 deletions(-)

1 0

[tor/maint-0.2.2] Abandon rendezvous circuits on SIGNAL NEWNYM
by nickm＠torproject.org 17 Jun '11

17 Jun '11

commit 010b8dd4f6e8e3c3d2e44ff589ff61cbf64b952a Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Thu Jun 9 19:56:40 2011 -0700 Abandon rendezvous circuits on SIGNAL NEWNYM --- changes/abandon-rend-circs-on-newnym | 8 ++++++++ src/or/circuituse.c | 3 ++- 2 files changed, 10 insertions(+), 1 deletions(-) diff --git a/changes/abandon-rend-circs-on-newnym b/changes/abandon-rend-circs-on-newnym new file mode 100644 index 0000000..67cb2dc --- /dev/null +++ b/changes/abandon-rend-circs-on-newnym @@ -0,0 +1,8 @@ + o Security fixes: + - Don't attach new streams to old rendezvous circuits after SIGNAL + NEWNYM. Previously, we would keep using an existing rendezvous + circuit if it remained open (i.e. if it were kept open by a + long-lived stream or if a new stream were attached to it before + Tor could notice that it was old and no longer in use and close + it). Bugfix on 0.1.1.15-rc; fixes bug 3375. + diff --git a/src/or/circuituse.c b/src/or/circuituse.c index 41c1899..48fc198 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -59,7 +59,8 @@ circuit_is_acceptable(circuit_t *circ, edge_connection_t *conn, return 0; } - if (purpose == CIRCUIT_PURPOSE_C_GENERAL) + if (purpose == CIRCUIT_PURPOSE_C_GENERAL || + purpose == CIRCUIT_PURPOSE_C_REND_JOINED) if (circ->timestamp_dirty && circ->timestamp_dirty+get_options()->MaxCircuitDirtiness <= now) return 0;

1 0

[tor/maint-0.2.2] Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2
by nickm＠torproject.org 17 Jun '11

17 Jun '11

commit 85d4c290d79264d334baa9e5c8fdf3b06d0b3d79 Merge: 209229f 010b8dd Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Jun 17 15:24:23 2011 -0400 Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2 changes/abandon-rend-circs-on-newnym | 8 ++++++++ src/or/circuituse.c | 3 ++- 2 files changed, 10 insertions(+), 1 deletions(-)

1 0

[tor/maint-0.2.1] Abandon rendezvous circuits on SIGNAL NEWNYM
by nickm＠torproject.org 17 Jun '11

17 Jun '11

commit 010b8dd4f6e8e3c3d2e44ff589ff61cbf64b952a Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Thu Jun 9 19:56:40 2011 -0700 Abandon rendezvous circuits on SIGNAL NEWNYM --- changes/abandon-rend-circs-on-newnym | 8 ++++++++ src/or/circuituse.c | 3 ++- 2 files changed, 10 insertions(+), 1 deletions(-) diff --git a/changes/abandon-rend-circs-on-newnym b/changes/abandon-rend-circs-on-newnym new file mode 100644 index 0000000..67cb2dc --- /dev/null +++ b/changes/abandon-rend-circs-on-newnym @@ -0,0 +1,8 @@ + o Security fixes: + - Don't attach new streams to old rendezvous circuits after SIGNAL + NEWNYM. Previously, we would keep using an existing rendezvous + circuit if it remained open (i.e. if it were kept open by a + long-lived stream or if a new stream were attached to it before + Tor could notice that it was old and no longer in use and close + it). Bugfix on 0.1.1.15-rc; fixes bug 3375. + diff --git a/src/or/circuituse.c b/src/or/circuituse.c index 41c1899..48fc198 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -59,7 +59,8 @@ circuit_is_acceptable(circuit_t *circ, edge_connection_t *conn, return 0; } - if (purpose == CIRCUIT_PURPOSE_C_GENERAL) + if (purpose == CIRCUIT_PURPOSE_C_GENERAL || + purpose == CIRCUIT_PURPOSE_C_REND_JOINED) if (circ->timestamp_dirty && circ->timestamp_dirty+get_options()->MaxCircuitDirtiness <= now) return 0;

1 0

[tor/master] Correct some outdated comments
by nickm＠torproject.org 17 Jun '11

17 Jun '11

commit 39480c797851c8c70914153b403a282a02e7aebb Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Tue May 24 22:20:12 2011 -0700 Correct some outdated comments --- src/or/control.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/or/control.c b/src/or/control.c index 0dad1b9..5d2d135 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -606,12 +606,12 @@ send_control_event_string(uint16_t event, event_format_t which, } SMARTLIST_FOREACH_END(conn); } -/** Helper for send_control1_event and send_control1_event_extended: +/** Helper for send_control_event and control_event_status: * Send an event to all v1 controllers that are listening for code * event. The event's body is created by the printf-style format in * format, and other arguments as provided. * - * Currently the length of the message is limited to 1024 (including the + * Currently the length of the message is limited to 10064 (including the * ending \\r\\n\\0). */ static void send_control_event_impl(uint16_t event, event_format_t which, @@ -644,7 +644,7 @@ send_control_event_impl(uint16_t event, event_format_t which, * event. The event's body is created by the printf-style format in * format, and other arguments as provided. * - * Currently the length of the message is limited to 1024 (including the + * Currently the length of the message is limited to 10064 (including the * ending \\n\\r\\0. */ static void send_control_event(uint16_t event, event_format_t which,

1 0

[tor/master] log when we finish ssl handshake and move to renegotiation
by nickm＠torproject.org 17 Jun '11

17 Jun '11

commit 64bfbcb918a59edf8e7167954171f311d032fc4b Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Jun 17 03:31:59 2011 -0400 log when we finish ssl handshake and move to renegotiation debug-level since it will be quite common. logged at both client and server side. this step should help us track what's going on with people filtering tor connections by our ssl habits. --- src/or/connection_or.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/src/or/connection_or.c b/src/or/connection_or.c index ed174c9..c019f65 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -929,13 +929,16 @@ connection_tls_continue_handshake(or_connection_t *conn) if (! tor_tls_used_v1_handshake(conn->tls)) { if (!tor_tls_is_server(conn->tls)) { if (conn->_base.state == OR_CONN_STATE_TLS_HANDSHAKING) { - // log_notice(LD_OR,"Done. state was TLS_HANDSHAKING."); + log_debug(LD_OR, "Done with initial SSL handshake (client-side). " + "Requesting renegotiation."); conn->_base.state = OR_CONN_STATE_TLS_CLIENT_RENEGOTIATING; goto again; } // log_notice(LD_OR,"Done. state was %d.", conn->_base.state); } else { /* improved handshake, but not a client. */ + log_debug(LD_OR, "Done with initial SSL handshake (server-side). " + "Expecting renegotiation."); tor_tls_set_renegotiate_callback(conn->tls, connection_or_tls_renegotiated_cb, conn);

1 0

[tor/master] Make connection_printf_to_buf's behaviour sane
by nickm＠torproject.org 17 Jun '11

17 Jun '11

commit 68cd0a9abeab126b3d954f060d922fd71cb945f7 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Wed Jun 15 21:16:44 2011 -0700 Make connection_printf_to_buf's behaviour sane --- changes/fix-connection_printf_to_buf | 10 ++++++++++ src/or/control.c | 29 +++++++++++------------------ 2 files changed, 21 insertions(+), 18 deletions(-) diff --git a/changes/fix-connection_printf_to_buf b/changes/fix-connection_printf_to_buf new file mode 100644 index 0000000..b6fa092 --- /dev/null +++ b/changes/fix-connection_printf_to_buf @@ -0,0 +1,10 @@ + * Code simplifications and refactoring: + + - Make connection_printf_to_buf's behaviour sane. Its callers + expect it to emit a CRLF iff the format string ends with CRLF; + it actually emits a CRLF iff (a) the format string ends with + CRLF or (b) the resulting string is over 1023 characters long or + (c) the format string does not end with CRLF ''and'' the + resulting string is 1021 characters long or longer. Bugfix on + 0.1.1.9-alpha; fixes bug 3407. + diff --git a/src/or/control.c b/src/or/control.c index 5d2d135..2308cd6 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -481,33 +481,26 @@ decode_escaped_string(const char *start, size_t in_len_max, } /** Acts like sprintf, but writes its formatted string to the end of - * conn-\>outbuf. The message may be truncated if it is too long, - * but it will always end with a CRLF sequence. - * - * Currently the length of the message is limited to 1024 (including the - * ending CR LF NUL ("\\r\\n\\0"). */ + * conn-\>outbuf. */ static void connection_printf_to_buf(control_connection_t *conn, const char *format, ...) { -#define CONNECTION_PRINTF_TO_BUF_BUFFERSIZE 1024 va_list ap; - char buf[CONNECTION_PRINTF_TO_BUF_BUFFERSIZE]; - int r; - size_t len; + char *buf = NULL; + int len; + va_start(ap,format); - r = tor_vsnprintf(buf, sizeof(buf), format, ap); + len = tor_vasprintf(&buf, format, ap); va_end(ap); - if (r<0) { + + if (len < 0) { log_warn(LD_BUG, "Unable to format string for controller."); return; } - len = strlen(buf); - if (fast_memcmp("\r\n\0", buf+len-2, 3)) { - buf[CONNECTION_PRINTF_TO_BUF_BUFFERSIZE-1] = '\0'; - buf[CONNECTION_PRINTF_TO_BUF_BUFFERSIZE-2] = '\n'; - buf[CONNECTION_PRINTF_TO_BUF_BUFFERSIZE-3] = '\r'; - } - connection_write_to_buf(buf, len, TO_CONN(conn)); + + connection_write_to_buf(buf, (size_t)len, TO_CONN(conn)); + + tor_free(buf); } /** Write all of the open control ports to ControlPortWriteToFile */

1 0