tor-commits

tor-commits@lists.torproject.org

1 participants
213085 discussions

[tor/release-0.2.2] Fix log message when we have too few dirauths
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 2f8e96b5535481e157486944c8d7637f31e1a197 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Mon Mar 7 00:03:09 2011 +0100 Fix log message when we have too few dirauths The calculation of when to send the logmessage was correct, but we didn't give the correct number of relays required: We want more than half of all authorities we know about. Fixes bug 2663. --- src/or/dirvote.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/or/dirvote.c b/src/or/dirvote.c index 529b45c..9273dbc 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -3080,7 +3080,7 @@ dirvote_compute_consensuses(void) n_votes = smartlist_len(pending_vote_list); if (n_votes <= n_voters/2) { log_warn(LD_DIR, "We don't have enough votes to generate a consensus: " - "%d of %d", n_votes, n_voters/2); + "%d of %d", n_votes, n_voters/2+1); goto err; } tor_assert(pending_vote_list);

1 0

[tor/release-0.2.2] Use observed instead of declared uptime for HSDir
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit f7a3cdc8f27c2306cf06d742af63846c82ebdc56 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Wed Mar 9 11:34:04 2011 +0100 Use observed instead of declared uptime for HSDir It is important to verify the uptime claim of a relay instead of just trusting it, otherwise it becomes too easy to blackhole a specific hidden service. rephist already has data available that we can use here. Bugfix on 0.2.0.10-alpha. --- changes/hsdir_assignment | 7 +++++++ src/or/dirserv.c | 19 ++++++++++++++++++- src/or/rephist.c | 14 ++++++++++++++ src/or/rephist.h | 1 + 4 files changed, 40 insertions(+), 1 deletions(-) diff --git a/changes/hsdir_assignment b/changes/hsdir_assignment new file mode 100644 index 0000000..ba01990 --- /dev/null +++ b/changes/hsdir_assignment @@ -0,0 +1,7 @@ + o Security fixes: + - Directory authorities now use data collected from rephist when + choosing whether to assign the HSDir flag to relays, instead of + trusting the uptime value the relay reports in its descriptor. + This helps prevent an attack where relatively few malaicious + nodes can blackhole any given hidden service. Bugfix on + 0.2.0.10-alpha; fixes bug 2709. diff --git a/src/or/dirserv.c b/src/or/dirserv.c index aeeab45..40136a1 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -43,6 +43,8 @@ extern time_t time_of_process_start; /* from main.c */ +extern long stats_n_seconds_working; /* from main.c */ + /** Do we need to regenerate the v1 directory when someone asks for it? */ static time_t the_directory_is_dirty = 1; /** Do we need to regenerate the v1 runningrouters document when somebody @@ -1775,7 +1777,22 @@ dirserv_thinks_router_is_unreliable(time_t now, static int dirserv_thinks_router_is_hs_dir(routerinfo_t *router, time_t now) { - long uptime = real_uptime(router, now); + + long uptime; + + /* If we haven't been running for at least + * get_options()->MinUptimeHidServDirectoryV2 seconds, we can't + * have accurate data telling us a relay has been up for at least + * that long. We also want to allow a bit of slack: Reachability + * tests aren't instant. If we haven't been running long enough, + * trust the relay. */ + + if (stats_n_seconds_working > + get_options()->MinUptimeHidServDirectoryV2 * 1.1) + uptime = MIN(rep_hist_get_uptime(router->cache_info.identity_digest, now), + real_uptime(router, now)); + else + uptime = real_uptime(router, now); /* XXX We shouldn't need to check dir_port, but we do because of * bug 1693. In the future, once relays set wants_to_be_hs_dir diff --git a/src/or/rephist.c b/src/or/rephist.c index 53214d6..69001de 100644 --- a/src/or/rephist.c +++ b/src/or/rephist.c @@ -528,6 +528,20 @@ get_weighted_fractional_uptime(or_history_t *hist, time_t when) return ((double) up) / total; } +/** Return how long the router whose identity digest is id has + * been reachable. Return 0 if the router is unknown or currently deemed + * unreachable. */ +long +rep_hist_get_uptime(const char *id, time_t when) +{ + or_history_t *hist = get_or_history(id); + if (!hist) + return 0; + if (!hist->start_of_run) + return 0; + return when - hist->start_of_run; +} + /** Return an estimated MTBF for the router whose identity digest is * id. Return 0 if the router is unknown. */ double diff --git a/src/or/rephist.h b/src/or/rephist.h index 5f6b9f9..b06a39e 100644 --- a/src/or/rephist.h +++ b/src/or/rephist.h @@ -40,6 +40,7 @@ int rep_hist_record_mtbf_data(time_t now, int missing_means_down); int rep_hist_load_mtbf_data(time_t now); time_t rep_hist_downrate_old_runs(time_t now); +long rep_hist_get_uptime(const char *id, time_t when); double rep_hist_get_stability(const char *id, time_t when); double rep_hist_get_weighted_fractional_uptime(const char *id, time_t when); long rep_hist_get_weighted_time_known(const char *id, time_t when);

1 0

[tor/release-0.2.2] Merge commit 'sebastian/bug2663' into maint-0.2.2
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 600ad7bf8d499d04259586bcf91afed7dfb88f99 Merge: 879f171 2f8e96b Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Mar 11 20:37:21 2011 -0500 Merge commit 'sebastian/bug2663' into maint-0.2.2 src/or/dirvote.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

1 0

[tor/release-0.2.2] improve accuracy for when a relay went unreachable
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 977e396e866052a20de73f4e8121e514d4eff774 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Mar 11 22:12:15 2011 -0500 improve accuracy for when a relay went unreachable --- changes/bug2716 | 5 +++++ src/or/dirserv.c | 13 +++++++++---- src/or/dirserv.h | 8 ++++++++ src/or/main.c | 5 +++-- 4 files changed, 25 insertions(+), 6 deletions(-) diff --git a/changes/bug2716 b/changes/bug2716 new file mode 100644 index 0000000..4663ed3 --- /dev/null +++ b/changes/bug2716 @@ -0,0 +1,5 @@ + o Minor features: + - When a relay has failed several reachability tests, be more accurate + at recording when it became unreachable, so we can in turn provide + more accuracy at assigning Stable, Guard, HSDir, etc flags. Bugfix + on 0.2.0.6-alpha. Resolves bug 2716. diff --git a/src/or/dirserv.c b/src/or/dirserv.c index aeeab45..7386927 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -970,7 +970,11 @@ dirserv_set_router_is_running(routerinfo_t *router, time_t now) if (!answer && running_long_enough_to_decide_unreachable()) { /* not considered reachable. tell rephist. */ - rep_hist_note_router_unreachable(router->cache_info.identity_digest, now); + time_t when = now; + if (router->last_reachable && + router->last_reachable + REACHABILITY_TEST_PERIOD < now) + when = router->last_reachable + REACHABILITY_TEST_PERIOD; + rep_hist_note_router_unreachable(router->cache_info.identity_digest, when); } router->is_running = answer; @@ -3187,7 +3191,8 @@ dirserv_single_reachability_test(time_t now, routerinfo_t *router) * try a few connections per call. * * The load balancing is such that if we get called once every ten - * seconds, we will cycle through all the tests in 1280 seconds (a + * seconds, we will cycle through all the tests in + * 10*REACHABILITY_MASK_PER_TEST seconds (a * bit over 20 minutes). */ void @@ -3214,11 +3219,11 @@ dirserv_test_reachability(time_t now) continue; /* bridge authorities only test reachability on bridges */ // if (router->cache_info.published_on > cutoff) // continue; - if ((((uint8_t)id_digest[0]) % 128) == ctr) { + if ((((uint8_t)id_digest[0]) % REACHABILITY_MODULO_PER_TEST) == ctr) { dirserv_single_reachability_test(now, router); } } SMARTLIST_FOREACH_END(router); - ctr = (ctr + 1) % 128; /* increment ctr */ + ctr = (ctr + 1) % REACHABILITY_MODULO_PER_TEST; /* increment ctr */ } /** Given a fingerprint fp which is either set if we're looking for a diff --git a/src/or/dirserv.h b/src/or/dirserv.h index 56ad7a6..949482b 100644 --- a/src/or/dirserv.h +++ b/src/or/dirserv.h @@ -12,6 +12,14 @@ #ifndef _TOR_DIRSERV_H #define _TOR_DIRSERV_H +/** What fraction (1 over this number) of the relay ID space do we + * (as a directory authority) launch connections to at each reachability + * test? */ +#define REACHABILITY_MODULO_PER_TEST 128 + +/** How many seconds apart are the reachability tests for a given relay? */ +#define REACHABILITY_TEST_PERIOD (10*REACHABILITY_MODULO_PER_TEST) + /** Maximum length of an exit policy summary. */ #define MAX_EXITPOLICY_SUMMARY_LEN 1000 diff --git a/src/or/main.c b/src/or/main.c index 979a2be..558608e 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -962,8 +962,9 @@ run_scheduled_events(time_t now) if (accounting_is_enabled(options)) accounting_run_housekeeping(now); - if (now % 10 == 0 && (authdir_mode_tests_reachability(options)) && - !we_are_hibernating()) { + if (now % REACHABILITY_TEST_PERIOD/REACHABILITY_MODULO_PER_TEST == 0 && + (authdir_mode_tests_reachability(options)) && + !we_are_hibernating()) { /* try to determine reachability of the other Tor relays */ dirserv_test_reachability(now); }

1 0

[tor/release-0.2.2] Clarify threat description and avoid negative uptimes.
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 3a0c6021556abc96f4c610d5e097e3890216595f Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 11 13:03:25 2011 -0500 Clarify threat description and avoid negative uptimes. --- changes/hsdir_assignment | 7 ++++--- src/or/rephist.c | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/changes/hsdir_assignment b/changes/hsdir_assignment index ba01990..5c04b9b 100644 --- a/changes/hsdir_assignment +++ b/changes/hsdir_assignment @@ -2,6 +2,7 @@ - Directory authorities now use data collected from rephist when choosing whether to assign the HSDir flag to relays, instead of trusting the uptime value the relay reports in its descriptor. - This helps prevent an attack where relatively few malaicious - nodes can blackhole any given hidden service. Bugfix on - 0.2.0.10-alpha; fixes bug 2709. + This helps prevent an attack where a small set of nodes with + frequently-changing identity keys can blackhole a hidden service. + (Only authorities need upgrade; others will be fine once they do.) + Bugfix on 0.2.0.10-alpha; fixes bug 2709. diff --git a/src/or/rephist.c b/src/or/rephist.c index 69001de..e4afe62 100644 --- a/src/or/rephist.c +++ b/src/or/rephist.c @@ -537,7 +537,7 @@ rep_hist_get_uptime(const char *id, time_t when) or_history_t *hist = get_or_history(id); if (!hist) return 0; - if (!hist->start_of_run) + if (!hist->start_of_run || when < hist->start_of_run) return 0; return when - hist->start_of_run; }

1 0

[tor/release-0.2.2] we're not reachable if we don't have a routerinfo yet
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 1a9d19e9728c21ffa37f2b751df8e8e97c1835d3 Author: Roger Dingledine <arma(a)torproject.org> Date: Sun Mar 13 15:47:59 2011 -0400 we're not reachable if we don't have a routerinfo yet --- changes/bug1172 | 9 +++++++++ src/or/router.c | 20 +++++--------------- 2 files changed, 14 insertions(+), 15 deletions(-) diff --git a/changes/bug1172 b/changes/bug1172 new file mode 100644 index 0000000..3abd743 --- /dev/null +++ b/changes/bug1172 @@ -0,0 +1,9 @@ + o Minor bugfixes: + - When we restart our relay, we might get a successful connection + from the outside before we've started our reachability tests, + triggering a warning: "ORPort found reachable, but I have no + routerinfo yet. Failing to inform controller of success." This + bug was harmless unless Tor is running under a controller + like Vidalia, in which case the controller would never get a + REACHABILITY_SUCCEEDED status event. Bugfix on 0.1.2.6-alpha; + fixes bug 1172. diff --git a/src/or/router.c b/src/or/router.c index 75f592d..ba7be3d 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -793,19 +793,14 @@ consider_testing_reachability(int test_or, int test_dir) void router_orport_found_reachable(void) { - if (!can_reach_or_port) { - routerinfo_t *me = router_get_my_routerinfo(); + routerinfo_t *me = router_get_my_routerinfo(); + if (!can_reach_or_port && me) { log_notice(LD_OR,"Self-testing indicates your ORPort is reachable from " "the outside. Excellent.%s", get_options()->_PublishServerDescriptor != NO_AUTHORITY ? " Publishing server descriptor." : ""); can_reach_or_port = 1; mark_my_descriptor_dirty(); - if (!me) { /* should never happen */ - log_warn(LD_BUG, "ORPort found reachable, but I have no routerinfo " - "yet. Failing to inform controller of success."); - return; - } control_event_server_status(LOG_NOTICE, "REACHABILITY_SUCCEEDED ORADDRESS=%s:%d", me->address, me->or_port); @@ -816,18 +811,13 @@ router_orport_found_reachable(void) void router_dirport_found_reachable(void) { - if (!can_reach_dir_port) { - routerinfo_t *me = router_get_my_routerinfo(); + routerinfo_t *me = router_get_my_routerinfo(); + if (!can_reach_dir_port && me) { log_notice(LD_DIRSERV,"Self-testing indicates your DirPort is reachable " "from the outside. Excellent."); can_reach_dir_port = 1; - if (!me || decide_to_advertise_dirport(get_options(), me->dir_port)) + if (decide_to_advertise_dirport(get_options(), me->dir_port)) mark_my_descriptor_dirty(); - if (!me) { /* should never happen */ - log_warn(LD_BUG, "DirPort found reachable, but I have no routerinfo " - "yet. Failing to inform controller of success."); - return; - } control_event_server_status(LOG_NOTICE, "REACHABILITY_SUCCEEDED DIRADDRESS=%s:%d", me->address, me->dir_port);

1 0

[tor/release-0.2.2] Tweak bug2716 patch a little
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 176fde505fde38afa56ddce04606118b9080546e Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Mar 12 00:19:52 2011 -0500 Tweak bug2716 patch a little Name the magic value "10" rather than re-deriving it. Comment more. Use the pattern that works for periodic timers, not the pattern that doesn't work. ;) --- src/or/dirserv.c | 12 +++++++++--- src/or/dirserv.h | 6 +++++- src/or/main.c | 4 +++- 3 files changed, 17 insertions(+), 5 deletions(-) diff --git a/src/or/dirserv.c b/src/or/dirserv.c index 7386927..b68e005 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -969,11 +969,17 @@ dirserv_set_router_is_running(routerinfo_t *router, time_t now) } if (!answer && running_long_enough_to_decide_unreachable()) { - /* not considered reachable. tell rephist. */ + /* Not considered reachable. tell rephist about that. + + Because we launch a reachability test for each router every + REACHABILITY_TEST_CYCLE_PERIOD seconds, then the router has probably + been down since at least that time after we last successfully reached + it. + */ time_t when = now; if (router->last_reachable && - router->last_reachable + REACHABILITY_TEST_PERIOD < now) - when = router->last_reachable + REACHABILITY_TEST_PERIOD; + router->last_reachable + REACHABILITY_TEST_CYCLE_PERIOD < now) + when = router->last_reachable + REACHABILITY_TEST_CYCLE_PERIOD; rep_hist_note_router_unreachable(router->cache_info.identity_digest, when); } diff --git a/src/or/dirserv.h b/src/or/dirserv.h index 949482b..569abfc 100644 --- a/src/or/dirserv.h +++ b/src/or/dirserv.h @@ -17,8 +17,12 @@ * test? */ #define REACHABILITY_MODULO_PER_TEST 128 +/** How often (in seconds) do we launch reachability tests? */ +#define REACHABILITY_TEST_INTERVAL 10 + /** How many seconds apart are the reachability tests for a given relay? */ -#define REACHABILITY_TEST_PERIOD (10*REACHABILITY_MODULO_PER_TEST) +#define REACHABILITY_TEST_CYCLE_PERIOD \ + (REACHABILITY_TEST_INTERVAL*REACHABILITY_MODULO_PER_TEST) /** Maximum length of an exit policy summary. */ #define MAX_EXITPOLICY_SUMMARY_LEN 1000 diff --git a/src/or/main.c b/src/or/main.c index 558608e..214a4fa 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -872,6 +872,7 @@ run_scheduled_events(time_t now) static time_t time_to_check_for_expired_networkstatus = 0; static time_t time_to_write_stats_files = 0; static time_t time_to_write_bridge_stats = 0; + static time_t time_to_launch_reachability_tests = 0; static int should_init_bridge_stats = 1; static time_t time_to_retry_dns_init = 0; or_options_t *options = get_options(); @@ -962,9 +963,10 @@ run_scheduled_events(time_t now) if (accounting_is_enabled(options)) accounting_run_housekeeping(now); - if (now % REACHABILITY_TEST_PERIOD/REACHABILITY_MODULO_PER_TEST == 0 && + if (time_to_launch_reachability_tests < now && (authdir_mode_tests_reachability(options)) && !we_are_hibernating()) { + time_to_launch_reachability_tests = now + REACHABILITY_TEST_INTERVAL; /* try to determine reachability of the other Tor relays */ dirserv_test_reachability(now); }

1 0

[tor/release-0.2.2] fix one more typo
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 61f648ae3764daacb3865c8344f0381fd09a8e45 Author: Roger Dingledine <arma(a)torproject.org> Date: Sun Mar 13 15:22:45 2011 -0400 fix one more typo --- src/or/dirserv.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/src/or/dirserv.c b/src/or/dirserv.c index b68e005..09da66d 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -3198,8 +3198,7 @@ dirserv_single_reachability_test(time_t now, routerinfo_t *router) * * The load balancing is such that if we get called once every ten * seconds, we will cycle through all the tests in - * 10*REACHABILITY_MASK_PER_TEST seconds (a - * bit over 20 minutes). + * REACHABILITY_TEST_CYCLE_PERIOD seconds (a bit over 20 minutes). */ void dirserv_test_reachability(time_t now)

1 0

[tor/release-0.2.2] Merge branch 'hsdir_assignment' into maint-0.2.2
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit d34a5cdc597824e72453009ed209e5644f158e90 Merge: 600ad7b 3a0c602 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 11 23:30:25 2011 -0500 Merge branch 'hsdir_assignment' into maint-0.2.2 changes/hsdir_assignment | 8 ++++++++ src/or/dirserv.c | 19 ++++++++++++++++++- src/or/rephist.c | 14 ++++++++++++++ src/or/rephist.h | 1 + 4 files changed, 41 insertions(+), 1 deletions(-)

1 0

[tor/maint-0.2.2] we're not reachable if we don't have a routerinfo yet
by nickm＠torproject.org 14 Mar '11

14 Mar '11

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits