- tor-commits - lists.torproject.org

[tor/release-0.2.2] don't use old non-configured bridges (bug 2511)
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 9a1a96ba0947e1c9b0e43aef6600b0d083586cf5 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Feb 8 08:08:47 2011 -0500 don't use old non-configured bridges (bug 2511) --- changes/bug2511 | 6 ++++++ src/or/routerlist.c | 13 +++++++++++++ 2 files changed, 19 insertions(+), 0 deletions(-) diff --git a/changes/bug2511 b/changes/bug2511 new file mode 100644 index 0000000..a27696a --- /dev/null +++ b/changes/bug2511 @@ -0,0 +1,6 @@ + o Major bugfixes: + - If you configured Tor to use bridge A, and then quit and + configured Tor to use bridge B instead, it would happily continue + to use bridge A if it's still reachable. While this behavior is + a feature if your goal is connectivity, in some scenarios it's a + dangerous bug. Bugfix on Tor 0.2.0.1-alpha; fixes bug 2511. diff --git a/src/or/routerlist.c b/src/or/routerlist.c index 6d63862..bbd08f3 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -3314,6 +3314,19 @@ router_add_to_routerlist(routerinfo_t *router, const char **msg, return ROUTER_NOT_IN_CONSENSUS; } + /* If we're reading a bridge descriptor from our cache, and we don't + * recognize it as one of our currently configured bridges, drop the + * descriptor. Otherwise we could end up using it as one of our entry + * guards even if it isn't in our Bridge config lines. */ + if (router->purpose == ROUTER_PURPOSE_BRIDGE && from_cache && + !routerinfo_is_a_configured_bridge(router)) { + log_info(LD_DIR, "Dropping bridge descriptor for '%s' because we have " + "no bridge configured at that address.", router->nickname); + *msg = "Router descriptor was not a configured bridge."; + routerinfo_free(router); + return ROUTER_WAS_NOT_NEW; + } + /* If we have a router with the same identity key, choose the newer one. */ if (old_router) { if (!in_consensus && (router->cache_info.published_on <=

1 0

[tor/release-0.2.2] support multihomed bridges (bug 2510)
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 7d2a91f5e5aee77544115089ef79d14cb3e8093e Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Feb 8 03:11:18 2011 -0500 support multihomed bridges (bug 2510) --- changes/bug2510 | 8 ++++++++ src/or/circuitbuild.c | 25 +++++++++++++++++++++++++ 2 files changed, 33 insertions(+), 0 deletions(-) diff --git a/changes/bug2510 b/changes/bug2510 new file mode 100644 index 0000000..2c3f613 --- /dev/null +++ b/changes/bug2510 @@ -0,0 +1,8 @@ + o Major bugfixes: + - Fix a bug where bridge users who configure the non-canonical + address of a bridge automatically switch to its canonical + address. If a bridge listens at more than one address, it should be + able to advertise those addresses independently and any non-blocked + addresses should continue to work. Bugfix on Tor 0.2.0.x. Fixes + bug 2510. + diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 4f8f5fb..d1cb547 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -4670,6 +4670,29 @@ fetch_bridge_descriptors(or_options_t *options, time_t now) SMARTLIST_FOREACH_END(bridge); } +/** If our bridge is configured to be a different address than + * the bridge gives in its routerinfo ri, rewrite the routerinfo + * we received to use the address we meant to use. Now we handle + * multihomed bridges better. + */ +static void +rewrite_routerinfo_address_for_bridge(bridge_info_t *bridge, routerinfo_t *ri) +{ + tor_addr_t addr; + tor_addr_from_ipv4h(&addr, ri->addr); + + if (!tor_addr_compare(&bridge->addr, &addr, CMP_EXACT) && + bridge->port == ri->or_port) + return; /* they match, so no need to do anything */ + + ri->addr = tor_addr_to_ipv4h(&bridge->addr); + tor_free(ri->address); + ri->address = tor_dup_ip(ri->addr); + ri->or_port = bridge->port; + log_info(LD_DIR, "Adjusted bridge '%s' to match configured address %s:%d.", + ri->nickname, ri->address, ri->or_port); +} + /** We just learned a descriptor for a bridge. See if that * digest is in our entry guard list, and add it if not. */ void @@ -4688,6 +4711,8 @@ learned_bridge_descriptor(routerinfo_t *ri, int from_cache) if (!from_cache) download_status_reset(&bridge->fetch_status); + rewrite_routerinfo_address_for_bridge(bridge, ri); + add_an_entry_guard(ri, 1); log_notice(LD_DIR, "new bridge descriptor '%s' (%s)", ri->nickname, from_cache ? "cached" : "fresh");

1 0

[tor/release-0.2.2] Fix log message when we have too few dirauths
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 2f8e96b5535481e157486944c8d7637f31e1a197 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Mon Mar 7 00:03:09 2011 +0100 Fix log message when we have too few dirauths The calculation of when to send the logmessage was correct, but we didn't give the correct number of relays required: We want more than half of all authorities we know about. Fixes bug 2663. --- src/or/dirvote.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/or/dirvote.c b/src/or/dirvote.c index 529b45c..9273dbc 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -3080,7 +3080,7 @@ dirvote_compute_consensuses(void) n_votes = smartlist_len(pending_vote_list); if (n_votes <= n_voters/2) { log_warn(LD_DIR, "We don't have enough votes to generate a consensus: " - "%d of %d", n_votes, n_voters/2); + "%d of %d", n_votes, n_voters/2+1); goto err; } tor_assert(pending_vote_list);

1 0

[tor/release-0.2.2] Use observed instead of declared uptime for HSDir
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit f7a3cdc8f27c2306cf06d742af63846c82ebdc56 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Wed Mar 9 11:34:04 2011 +0100 Use observed instead of declared uptime for HSDir It is important to verify the uptime claim of a relay instead of just trusting it, otherwise it becomes too easy to blackhole a specific hidden service. rephist already has data available that we can use here. Bugfix on 0.2.0.10-alpha. --- changes/hsdir_assignment | 7 +++++++ src/or/dirserv.c | 19 ++++++++++++++++++- src/or/rephist.c | 14 ++++++++++++++ src/or/rephist.h | 1 + 4 files changed, 40 insertions(+), 1 deletions(-) diff --git a/changes/hsdir_assignment b/changes/hsdir_assignment new file mode 100644 index 0000000..ba01990 --- /dev/null +++ b/changes/hsdir_assignment @@ -0,0 +1,7 @@ + o Security fixes: + - Directory authorities now use data collected from rephist when + choosing whether to assign the HSDir flag to relays, instead of + trusting the uptime value the relay reports in its descriptor. + This helps prevent an attack where relatively few malaicious + nodes can blackhole any given hidden service. Bugfix on + 0.2.0.10-alpha; fixes bug 2709. diff --git a/src/or/dirserv.c b/src/or/dirserv.c index aeeab45..40136a1 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -43,6 +43,8 @@ extern time_t time_of_process_start; /* from main.c */ +extern long stats_n_seconds_working; /* from main.c */ + /** Do we need to regenerate the v1 directory when someone asks for it? */ static time_t the_directory_is_dirty = 1; /** Do we need to regenerate the v1 runningrouters document when somebody @@ -1775,7 +1777,22 @@ dirserv_thinks_router_is_unreliable(time_t now, static int dirserv_thinks_router_is_hs_dir(routerinfo_t *router, time_t now) { - long uptime = real_uptime(router, now); + + long uptime; + + /* If we haven't been running for at least + * get_options()->MinUptimeHidServDirectoryV2 seconds, we can't + * have accurate data telling us a relay has been up for at least + * that long. We also want to allow a bit of slack: Reachability + * tests aren't instant. If we haven't been running long enough, + * trust the relay. */ + + if (stats_n_seconds_working > + get_options()->MinUptimeHidServDirectoryV2 * 1.1) + uptime = MIN(rep_hist_get_uptime(router->cache_info.identity_digest, now), + real_uptime(router, now)); + else + uptime = real_uptime(router, now); /* XXX We shouldn't need to check dir_port, but we do because of * bug 1693. In the future, once relays set wants_to_be_hs_dir diff --git a/src/or/rephist.c b/src/or/rephist.c index 53214d6..69001de 100644 --- a/src/or/rephist.c +++ b/src/or/rephist.c @@ -528,6 +528,20 @@ get_weighted_fractional_uptime(or_history_t *hist, time_t when) return ((double) up) / total; } +/** Return how long the router whose identity digest is id has + * been reachable. Return 0 if the router is unknown or currently deemed + * unreachable. */ +long +rep_hist_get_uptime(const char *id, time_t when) +{ + or_history_t *hist = get_or_history(id); + if (!hist) + return 0; + if (!hist->start_of_run) + return 0; + return when - hist->start_of_run; +} + /** Return an estimated MTBF for the router whose identity digest is * id. Return 0 if the router is unknown. */ double diff --git a/src/or/rephist.h b/src/or/rephist.h index 5f6b9f9..b06a39e 100644 --- a/src/or/rephist.h +++ b/src/or/rephist.h @@ -40,6 +40,7 @@ int rep_hist_record_mtbf_data(time_t now, int missing_means_down); int rep_hist_load_mtbf_data(time_t now); time_t rep_hist_downrate_old_runs(time_t now); +long rep_hist_get_uptime(const char *id, time_t when); double rep_hist_get_stability(const char *id, time_t when); double rep_hist_get_weighted_fractional_uptime(const char *id, time_t when); long rep_hist_get_weighted_time_known(const char *id, time_t when);

1 0

[tor/release-0.2.2] Merge commit 'sebastian/bug2663' into maint-0.2.2
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 600ad7bf8d499d04259586bcf91afed7dfb88f99 Merge: 879f171 2f8e96b Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Mar 11 20:37:21 2011 -0500 Merge commit 'sebastian/bug2663' into maint-0.2.2 src/or/dirvote.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)

1 0

[tor/release-0.2.2] improve accuracy for when a relay went unreachable
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 977e396e866052a20de73f4e8121e514d4eff774 Author: Roger Dingledine <arma(a)torproject.org> Date: Fri Mar 11 22:12:15 2011 -0500 improve accuracy for when a relay went unreachable --- changes/bug2716 | 5 +++++ src/or/dirserv.c | 13 +++++++++---- src/or/dirserv.h | 8 ++++++++ src/or/main.c | 5 +++-- 4 files changed, 25 insertions(+), 6 deletions(-) diff --git a/changes/bug2716 b/changes/bug2716 new file mode 100644 index 0000000..4663ed3 --- /dev/null +++ b/changes/bug2716 @@ -0,0 +1,5 @@ + o Minor features: + - When a relay has failed several reachability tests, be more accurate + at recording when it became unreachable, so we can in turn provide + more accuracy at assigning Stable, Guard, HSDir, etc flags. Bugfix + on 0.2.0.6-alpha. Resolves bug 2716. diff --git a/src/or/dirserv.c b/src/or/dirserv.c index aeeab45..7386927 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -970,7 +970,11 @@ dirserv_set_router_is_running(routerinfo_t *router, time_t now) if (!answer && running_long_enough_to_decide_unreachable()) { /* not considered reachable. tell rephist. */ - rep_hist_note_router_unreachable(router->cache_info.identity_digest, now); + time_t when = now; + if (router->last_reachable && + router->last_reachable + REACHABILITY_TEST_PERIOD < now) + when = router->last_reachable + REACHABILITY_TEST_PERIOD; + rep_hist_note_router_unreachable(router->cache_info.identity_digest, when); } router->is_running = answer; @@ -3187,7 +3191,8 @@ dirserv_single_reachability_test(time_t now, routerinfo_t *router) * try a few connections per call. * * The load balancing is such that if we get called once every ten - * seconds, we will cycle through all the tests in 1280 seconds (a + * seconds, we will cycle through all the tests in + * 10*REACHABILITY_MASK_PER_TEST seconds (a * bit over 20 minutes). */ void @@ -3214,11 +3219,11 @@ dirserv_test_reachability(time_t now) continue; /* bridge authorities only test reachability on bridges */ // if (router->cache_info.published_on > cutoff) // continue; - if ((((uint8_t)id_digest[0]) % 128) == ctr) { + if ((((uint8_t)id_digest[0]) % REACHABILITY_MODULO_PER_TEST) == ctr) { dirserv_single_reachability_test(now, router); } } SMARTLIST_FOREACH_END(router); - ctr = (ctr + 1) % 128; /* increment ctr */ + ctr = (ctr + 1) % REACHABILITY_MODULO_PER_TEST; /* increment ctr */ } /** Given a fingerprint fp which is either set if we're looking for a diff --git a/src/or/dirserv.h b/src/or/dirserv.h index 56ad7a6..949482b 100644 --- a/src/or/dirserv.h +++ b/src/or/dirserv.h @@ -12,6 +12,14 @@ #ifndef _TOR_DIRSERV_H #define _TOR_DIRSERV_H +/** What fraction (1 over this number) of the relay ID space do we + * (as a directory authority) launch connections to at each reachability + * test? */ +#define REACHABILITY_MODULO_PER_TEST 128 + +/** How many seconds apart are the reachability tests for a given relay? */ +#define REACHABILITY_TEST_PERIOD (10*REACHABILITY_MODULO_PER_TEST) + /** Maximum length of an exit policy summary. */ #define MAX_EXITPOLICY_SUMMARY_LEN 1000 diff --git a/src/or/main.c b/src/or/main.c index 979a2be..558608e 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -962,8 +962,9 @@ run_scheduled_events(time_t now) if (accounting_is_enabled(options)) accounting_run_housekeeping(now); - if (now % 10 == 0 && (authdir_mode_tests_reachability(options)) && - !we_are_hibernating()) { + if (now % REACHABILITY_TEST_PERIOD/REACHABILITY_MODULO_PER_TEST == 0 && + (authdir_mode_tests_reachability(options)) && + !we_are_hibernating()) { /* try to determine reachability of the other Tor relays */ dirserv_test_reachability(now); }

1 0

[tor/release-0.2.2] Clarify threat description and avoid negative uptimes.
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 3a0c6021556abc96f4c610d5e097e3890216595f Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Mar 11 13:03:25 2011 -0500 Clarify threat description and avoid negative uptimes. --- changes/hsdir_assignment | 7 ++++--- src/or/rephist.c | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/changes/hsdir_assignment b/changes/hsdir_assignment index ba01990..5c04b9b 100644 --- a/changes/hsdir_assignment +++ b/changes/hsdir_assignment @@ -2,6 +2,7 @@ - Directory authorities now use data collected from rephist when choosing whether to assign the HSDir flag to relays, instead of trusting the uptime value the relay reports in its descriptor. - This helps prevent an attack where relatively few malaicious - nodes can blackhole any given hidden service. Bugfix on - 0.2.0.10-alpha; fixes bug 2709. + This helps prevent an attack where a small set of nodes with + frequently-changing identity keys can blackhole a hidden service. + (Only authorities need upgrade; others will be fine once they do.) + Bugfix on 0.2.0.10-alpha; fixes bug 2709. diff --git a/src/or/rephist.c b/src/or/rephist.c index 69001de..e4afe62 100644 --- a/src/or/rephist.c +++ b/src/or/rephist.c @@ -537,7 +537,7 @@ rep_hist_get_uptime(const char *id, time_t when) or_history_t *hist = get_or_history(id); if (!hist) return 0; - if (!hist->start_of_run) + if (!hist->start_of_run || when < hist->start_of_run) return 0; return when - hist->start_of_run; }

1 0

[tor/release-0.2.2] we're not reachable if we don't have a routerinfo yet
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 1a9d19e9728c21ffa37f2b751df8e8e97c1835d3 Author: Roger Dingledine <arma(a)torproject.org> Date: Sun Mar 13 15:47:59 2011 -0400 we're not reachable if we don't have a routerinfo yet --- changes/bug1172 | 9 +++++++++ src/or/router.c | 20 +++++--------------- 2 files changed, 14 insertions(+), 15 deletions(-) diff --git a/changes/bug1172 b/changes/bug1172 new file mode 100644 index 0000000..3abd743 --- /dev/null +++ b/changes/bug1172 @@ -0,0 +1,9 @@ + o Minor bugfixes: + - When we restart our relay, we might get a successful connection + from the outside before we've started our reachability tests, + triggering a warning: "ORPort found reachable, but I have no + routerinfo yet. Failing to inform controller of success." This + bug was harmless unless Tor is running under a controller + like Vidalia, in which case the controller would never get a + REACHABILITY_SUCCEEDED status event. Bugfix on 0.1.2.6-alpha; + fixes bug 1172. diff --git a/src/or/router.c b/src/or/router.c index 75f592d..ba7be3d 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -793,19 +793,14 @@ consider_testing_reachability(int test_or, int test_dir) void router_orport_found_reachable(void) { - if (!can_reach_or_port) { - routerinfo_t *me = router_get_my_routerinfo(); + routerinfo_t *me = router_get_my_routerinfo(); + if (!can_reach_or_port && me) { log_notice(LD_OR,"Self-testing indicates your ORPort is reachable from " "the outside. Excellent.%s", get_options()->_PublishServerDescriptor != NO_AUTHORITY ? " Publishing server descriptor." : ""); can_reach_or_port = 1; mark_my_descriptor_dirty(); - if (!me) { /* should never happen */ - log_warn(LD_BUG, "ORPort found reachable, but I have no routerinfo " - "yet. Failing to inform controller of success."); - return; - } control_event_server_status(LOG_NOTICE, "REACHABILITY_SUCCEEDED ORADDRESS=%s:%d", me->address, me->or_port); @@ -816,18 +811,13 @@ router_orport_found_reachable(void) void router_dirport_found_reachable(void) { - if (!can_reach_dir_port) { - routerinfo_t *me = router_get_my_routerinfo(); + routerinfo_t *me = router_get_my_routerinfo(); + if (!can_reach_dir_port && me) { log_notice(LD_DIRSERV,"Self-testing indicates your DirPort is reachable " "from the outside. Excellent."); can_reach_dir_port = 1; - if (!me || decide_to_advertise_dirport(get_options(), me->dir_port)) + if (decide_to_advertise_dirport(get_options(), me->dir_port)) mark_my_descriptor_dirty(); - if (!me) { /* should never happen */ - log_warn(LD_BUG, "DirPort found reachable, but I have no routerinfo " - "yet. Failing to inform controller of success."); - return; - } control_event_server_status(LOG_NOTICE, "REACHABILITY_SUCCEEDED DIRADDRESS=%s:%d", me->address, me->dir_port);

1 0

[tor/release-0.2.2] Tweak bug2716 patch a little
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 176fde505fde38afa56ddce04606118b9080546e Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Mar 12 00:19:52 2011 -0500 Tweak bug2716 patch a little Name the magic value "10" rather than re-deriving it. Comment more. Use the pattern that works for periodic timers, not the pattern that doesn't work. ;) --- src/or/dirserv.c | 12 +++++++++--- src/or/dirserv.h | 6 +++++- src/or/main.c | 4 +++- 3 files changed, 17 insertions(+), 5 deletions(-) diff --git a/src/or/dirserv.c b/src/or/dirserv.c index 7386927..b68e005 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -969,11 +969,17 @@ dirserv_set_router_is_running(routerinfo_t *router, time_t now) } if (!answer && running_long_enough_to_decide_unreachable()) { - /* not considered reachable. tell rephist. */ + /* Not considered reachable. tell rephist about that. + + Because we launch a reachability test for each router every + REACHABILITY_TEST_CYCLE_PERIOD seconds, then the router has probably + been down since at least that time after we last successfully reached + it. + */ time_t when = now; if (router->last_reachable && - router->last_reachable + REACHABILITY_TEST_PERIOD < now) - when = router->last_reachable + REACHABILITY_TEST_PERIOD; + router->last_reachable + REACHABILITY_TEST_CYCLE_PERIOD < now) + when = router->last_reachable + REACHABILITY_TEST_CYCLE_PERIOD; rep_hist_note_router_unreachable(router->cache_info.identity_digest, when); } diff --git a/src/or/dirserv.h b/src/or/dirserv.h index 949482b..569abfc 100644 --- a/src/or/dirserv.h +++ b/src/or/dirserv.h @@ -17,8 +17,12 @@ * test? */ #define REACHABILITY_MODULO_PER_TEST 128 +/** How often (in seconds) do we launch reachability tests? */ +#define REACHABILITY_TEST_INTERVAL 10 + /** How many seconds apart are the reachability tests for a given relay? */ -#define REACHABILITY_TEST_PERIOD (10*REACHABILITY_MODULO_PER_TEST) +#define REACHABILITY_TEST_CYCLE_PERIOD \ + (REACHABILITY_TEST_INTERVAL*REACHABILITY_MODULO_PER_TEST) /** Maximum length of an exit policy summary. */ #define MAX_EXITPOLICY_SUMMARY_LEN 1000 diff --git a/src/or/main.c b/src/or/main.c index 558608e..214a4fa 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -872,6 +872,7 @@ run_scheduled_events(time_t now) static time_t time_to_check_for_expired_networkstatus = 0; static time_t time_to_write_stats_files = 0; static time_t time_to_write_bridge_stats = 0; + static time_t time_to_launch_reachability_tests = 0; static int should_init_bridge_stats = 1; static time_t time_to_retry_dns_init = 0; or_options_t *options = get_options(); @@ -962,9 +963,10 @@ run_scheduled_events(time_t now) if (accounting_is_enabled(options)) accounting_run_housekeeping(now); - if (now % REACHABILITY_TEST_PERIOD/REACHABILITY_MODULO_PER_TEST == 0 && + if (time_to_launch_reachability_tests < now && (authdir_mode_tests_reachability(options)) && !we_are_hibernating()) { + time_to_launch_reachability_tests = now + REACHABILITY_TEST_INTERVAL; /* try to determine reachability of the other Tor relays */ dirserv_test_reachability(now); }

1 0

[tor/release-0.2.2] fix one more typo
by arma＠torproject.org 14 Mar '11

14 Mar '11

commit 61f648ae3764daacb3865c8344f0381fd09a8e45 Author: Roger Dingledine <arma(a)torproject.org> Date: Sun Mar 13 15:22:45 2011 -0400 fix one more typo --- src/or/dirserv.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/src/or/dirserv.c b/src/or/dirserv.c index b68e005..09da66d 100644 --- a/src/or/dirserv.c +++ b/src/or/dirserv.c @@ -3198,8 +3198,7 @@ dirserv_single_reachability_test(time_t now, routerinfo_t *router) * * The load balancing is such that if we get called once every ten * seconds, we will cycle through all the tests in - * 10*REACHABILITY_MASK_PER_TEST seconds (a - * bit over 20 minutes). + * REACHABILITY_TEST_CYCLE_PERIOD seconds (a bit over 20 minutes). */ void dirserv_test_reachability(time_t now)

1 0