- tor-commits - lists.torproject.org

[tor/master] relay: Add IP version tests for circuit extends
by nickm＠torproject.org 30 Apr '20

30 Apr '20

commit cab05a84cd1504bc4929207a1f33b266744e5dca Author: teor <teor(a)torproject.org> Date: Wed Apr 29 20:10:14 2020 +1000 relay: Add IP version tests for circuit extends Add IPv4-only and IPv6-only tests for circuit_open_connection_for_extend(). Part of 33817. --- src/feature/relay/router.c | 4 ++-- src/feature/relay/router.h | 3 ++- src/test/test_circuitbuild.c | 48 +++++++++++++++++++++++++++++++++++++------- 3 files changed, 45 insertions(+), 10 deletions(-) diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c index 89e232ccc..b0a56012d 100644 --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@ -1491,8 +1491,8 @@ router_get_advertised_ipv6_or_ap(const or_options_t *options, } /** Returns true if this router has an advertised IPv6 ORPort. */ -bool -router_has_advertised_ipv6_orport(const or_options_t *options) +MOCK_IMPL(bool, +router_has_advertised_ipv6_orport,(const or_options_t *options)) { tor_addr_port_t ipv6_ap; router_get_advertised_ipv6_or_ap(options, &ipv6_ap); diff --git a/src/feature/relay/router.h b/src/feature/relay/router.h index c3a93cc0a..1a262a679 100644 --- a/src/feature/relay/router.h +++ b/src/feature/relay/router.h @@ -68,7 +68,8 @@ uint16_t router_get_active_listener_port_by_type_af(int listener_type, uint16_t router_get_advertised_or_port(const or_options_t *options); void router_get_advertised_ipv6_or_ap(const or_options_t *options, tor_addr_port_t *ipv6_ap_out); -bool router_has_advertised_ipv6_orport(const or_options_t *options); +MOCK_DECL(bool, router_has_advertised_ipv6_orport,( + const or_options_t *options)); uint16_t router_get_advertised_or_port_by_af(const or_options_t *options, sa_family_t family); uint16_t router_get_advertised_dir_port(const or_options_t *options, diff --git a/src/test/test_circuitbuild.c b/src/test/test_circuitbuild.c index a26109ed8..5ae7dbf97 100644 --- a/src/test/test_circuitbuild.c +++ b/src/test/test_circuitbuild.c @@ -30,6 +30,7 @@ #include "feature/client/entrynodes.h" #include "feature/nodelist/nodelist.h" #include "feature/relay/circuitbuild_relay.h" +#include "feature/relay/router.h" #include "feature/relay/routermode.h" #include "feature/nodelist/node_st.h" @@ -848,11 +849,27 @@ mock_channel_connect_for_circuit(const tor_addr_t *addr, return mock_channel_connect_nchan; } -/* Test the different cases in circuit_open_connection_for_extend(). */ +static bool +mock_router_has_advertised_ipv6_orport(const or_options_t *options) +{ + (void)options; + return 1; +} + +/* Test the different cases in circuit_open_connection_for_extend(). + * Chooses different IP addresses depending on the first character in arg: + * - 4: IPv4 + * - 6: IPv6 + * - d: IPv4 and IPv6 (dual-stack) + */ static void test_circuit_open_connection_for_extend(void *arg) { - (void)arg; + const char ip_version = ((const char *)arg)[0]; + const bool use_ipv4 = (ip_version == '4' || ip_version == 'd'); + const bool use_ipv6 = (ip_version == '6' || ip_version == 'd'); + tor_assert(use_ipv4 || use_ipv6); + extend_cell_t *ec = tor_malloc_zero(sizeof(extend_cell_t)); circuit_t *circ = tor_malloc_zero(sizeof(circuit_t)); channel_t *fake_n_chan = tor_malloc_zero(sizeof(channel_t)); @@ -867,6 +884,9 @@ test_circuit_open_connection_for_extend(void *arg) mock_channel_connect_calls = 0; mock_channel_connect_nchan = NULL; + MOCK(router_has_advertised_ipv6_orport, + mock_router_has_advertised_ipv6_orport); + setup_full_capture_of_logs(LOG_INFO); #ifndef ALL_BUGS_ARE_FATAL @@ -929,10 +949,14 @@ test_circuit_open_connection_for_extend(void *arg) #endif /* !defined(ALL_BUGS_ARE_FATAL) */ /* Set up valid addresses */ - tor_addr_parse(&ec->orport_ipv4.addr, PUBLIC_IPV4); - ec->orport_ipv4.port = VALID_PORT; - tor_addr_parse(&ec->orport_ipv6.addr, PUBLIC_IPV6); - ec->orport_ipv6.port = VALID_PORT; + if (use_ipv4) { + tor_addr_parse(&ec->orport_ipv4.addr, PUBLIC_IPV4); + ec->orport_ipv4.port = VALID_PORT; + } + if (use_ipv6) { + tor_addr_parse(&ec->orport_ipv6.addr, PUBLIC_IPV6); + ec->orport_ipv6.port = VALID_PORT; + } /* Succeed, but don't try to open a connection */ mock_circuit_close_calls = 0; @@ -1001,6 +1025,8 @@ test_circuit_open_connection_for_extend(void *arg) or_options_free(fake_options); mocked_options = NULL; + UNMOCK(router_has_advertised_ipv6_orport); + tor_free(ec); tor_free(circ->n_hop); tor_free(circ->n_chan_create_cell); @@ -1414,6 +1440,12 @@ test_onionskin_answer(void *arg) #define TEST_CIRCUIT(name, flags) \ { #name, test_circuit_ ## name, flags, NULL, NULL } +#ifndef COCCI +#define TEST_CIRCUIT_PASSTHROUGH(name, flags, arg) \ + { #name "/" arg, test_circuit_ ## name, flags, \ + &passthrough_setup, (void *)(arg) } +#endif + struct testcase_t circuitbuild_tests[] = { TEST_NEW_ROUTE_LEN(noexit, 0), TEST_NEW_ROUTE_LEN(safe_exit, 0), @@ -1425,7 +1457,9 @@ struct testcase_t circuitbuild_tests[] = { TEST_CIRCUIT(extend_state_valid, TT_FORK), TEST_CIRCUIT(extend_add_ed25519, TT_FORK), TEST_CIRCUIT(extend_lspec_valid, TT_FORK), - TEST_CIRCUIT(open_connection_for_extend, TT_FORK), + TEST_CIRCUIT_PASSTHROUGH(open_connection_for_extend, TT_FORK, "4"), + TEST_CIRCUIT_PASSTHROUGH(open_connection_for_extend, TT_FORK, "6"), + TEST_CIRCUIT_PASSTHROUGH(open_connection_for_extend, TT_FORK, "dual-stack"), TEST_CIRCUIT(extend, TT_FORK), TEST(onionskin_answer, TT_FORK, NULL, NULL),

1 0

[tor/master] relay/circuitbuild: Refactor open connection for extend
by nickm＠torproject.org 30 Apr '20

30 Apr '20

commit a0b12f3cd40fc00c9bdbb1ff01b0d074673a7524 Author: teor <teor(a)torproject.org> Date: Thu Apr 16 08:13:02 2020 +1000 relay/circuitbuild: Refactor open connection for extend Re-use the newly created extend_info to launch the connection in circuit_open_connection_for_extend(). No behaviour change. Part of 33817. --- src/feature/relay/circuitbuild_relay.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index a926a1d81..d6ea22ca7 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -273,10 +273,11 @@ circuit_open_connection_for_extend(const struct extend_cell_t *ec, if (should_launch) { /* we should try to open a connection */ - channel_t *n_chan = channel_connect_for_circuit(&ec->orport_ipv4.addr, - ec->orport_ipv4.port, - (const char*)ec->node_id, - &ec->ed_pubkey); + channel_t *n_chan = channel_connect_for_circuit( + &circ->n_hop->addr, + circ->n_hop->port, + circ->n_hop->identity_digest, + &circ->n_hop->ed_identity); if (!n_chan) { log_info(LD_CIRC,"Launching n_chan failed. Closing circuit."); circuit_mark_for_close(circ, END_CIRC_REASON_CONNECTFAILED);

1 0

[tor/master] relay: Add tests for choosing extend IPs
by nickm＠torproject.org 30 Apr '20

30 Apr '20

commit df5ea297751d68dac7986f827494f2be87fe954f Author: teor <teor(a)torproject.org> Date: Wed Apr 29 21:25:10 2020 +1000 relay: Add tests for choosing extend IPs Part of 33817. --- src/test/test_circuitbuild.c | 100 ++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 93 insertions(+), 7 deletions(-) diff --git a/src/test/test_circuitbuild.c b/src/test/test_circuitbuild.c index 5ae7dbf97..ed75d102b 100644 --- a/src/test/test_circuitbuild.c +++ b/src/test/test_circuitbuild.c @@ -821,6 +821,97 @@ test_circuit_extend_lspec_valid(void *arg) tor_free(p_chan); } +static bool router_has_ipv6_orport_result = false; +static int mock_router_ipv6_orport_calls = 0; +static bool +mock_router_has_advertised_ipv6_orport(const or_options_t *options) +{ + (void)options; + mock_router_ipv6_orport_calls++; + return router_has_ipv6_orport_result; +} + +/* Test the different cases in circuit_choose_ip_ap_for_extend(). */ +static void +test_circuit_choose_ip_ap_for_extend(void *arg) +{ + (void)arg; + tor_addr_port_t ipv4_ap; + tor_addr_port_t ipv6_ap; + + /* Set up valid addresses */ + tor_addr_parse(&ipv4_ap.addr, PUBLIC_IPV4); + ipv4_ap.port = VALID_PORT; + tor_addr_parse(&ipv6_ap.addr, PUBLIC_IPV6); + ipv6_ap.port = VALID_PORT; + + or_options_t *fake_options = options_new(); + MOCK(get_options, mock_get_options); + mocked_options = fake_options; + + MOCK(router_has_advertised_ipv6_orport, + mock_router_has_advertised_ipv6_orport); + router_has_ipv6_orport_result = true; + mock_router_ipv6_orport_calls = 0; + + /* No valid addresses */ + router_has_ipv6_orport_result = true; + mock_router_ipv6_orport_calls = 0; + tt_ptr_op(circuit_choose_ip_ap_for_extend(NULL, NULL), OP_EQ, NULL); + tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + + router_has_ipv6_orport_result = false; + mock_router_ipv6_orport_calls = 0; + tt_ptr_op(circuit_choose_ip_ap_for_extend(NULL, NULL), OP_EQ, NULL); + tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + + /* One valid address: IPv4 */ + router_has_ipv6_orport_result = true; + mock_router_ipv6_orport_calls = 0; + tt_ptr_op(circuit_choose_ip_ap_for_extend(&ipv4_ap, NULL), OP_EQ, &ipv4_ap); + tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + + router_has_ipv6_orport_result = false; + mock_router_ipv6_orport_calls = 0; + tt_ptr_op(circuit_choose_ip_ap_for_extend(&ipv4_ap, NULL), OP_EQ, &ipv4_ap); + tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + + /* One valid address: IPv6 */ + router_has_ipv6_orport_result = true; + mock_router_ipv6_orport_calls = 0; + tt_ptr_op(circuit_choose_ip_ap_for_extend(NULL, &ipv6_ap), OP_EQ, &ipv6_ap); + tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + + router_has_ipv6_orport_result = false; + mock_router_ipv6_orport_calls = 0; + tt_ptr_op(circuit_choose_ip_ap_for_extend(NULL, &ipv6_ap), OP_EQ, NULL); + tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + + /* Two valid addresses */ + const tor_addr_port_t *chosen_addr = NULL; + + router_has_ipv6_orport_result = true; + mock_router_ipv6_orport_calls = 0; + chosen_addr = circuit_choose_ip_ap_for_extend(&ipv4_ap, &ipv6_ap); + tt_assert(chosen_addr == &ipv4_ap || chosen_addr == &ipv6_ap); + tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + + router_has_ipv6_orport_result = false; + mock_router_ipv6_orport_calls = 0; + tt_ptr_op(circuit_choose_ip_ap_for_extend(&ipv4_ap, &ipv6_ap), + OP_EQ, &ipv4_ap); + tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + + done: + UNMOCK(get_options); + or_options_free(fake_options); + mocked_options = NULL; + + UNMOCK(router_has_advertised_ipv6_orport); + + tor_free(fake_options); +} + static int mock_circuit_close_calls = 0; static void mock_circuit_mark_for_close_(circuit_t *circ, int reason, @@ -849,13 +940,6 @@ mock_channel_connect_for_circuit(const tor_addr_t *addr, return mock_channel_connect_nchan; } -static bool -mock_router_has_advertised_ipv6_orport(const or_options_t *options) -{ - (void)options; - return 1; -} - /* Test the different cases in circuit_open_connection_for_extend(). * Chooses different IP addresses depending on the first character in arg: * - 4: IPv4 @@ -886,6 +970,7 @@ test_circuit_open_connection_for_extend(void *arg) MOCK(router_has_advertised_ipv6_orport, mock_router_has_advertised_ipv6_orport); + router_has_ipv6_orport_result = true; setup_full_capture_of_logs(LOG_INFO); @@ -1457,6 +1542,7 @@ struct testcase_t circuitbuild_tests[] = { TEST_CIRCUIT(extend_state_valid, TT_FORK), TEST_CIRCUIT(extend_add_ed25519, TT_FORK), TEST_CIRCUIT(extend_lspec_valid, TT_FORK), + TEST_CIRCUIT(choose_ip_ap_for_extend, 0), TEST_CIRCUIT_PASSTHROUGH(open_connection_for_extend, TT_FORK, "4"), TEST_CIRCUIT_PASSTHROUGH(open_connection_for_extend, TT_FORK, "6"), TEST_CIRCUIT_PASSTHROUGH(open_connection_for_extend, TT_FORK, "dual-stack"),

1 0

[tor/master] relay: Choose between IPv4 and IPv6 extends at random
by nickm＠torproject.org 30 Apr '20

30 Apr '20

commit c3e058dfac1cbc7cb0dee5cdb1bdc61c1dc0f4fa Author: teor <teor(a)torproject.org> Date: Wed Apr 29 15:56:40 2020 +1000 relay: Choose between IPv4 and IPv6 extends at random When an EXTEND2 cell has an IPv4 and an IPv6 address, choose one of them uniformly at random. Part of 33817. --- src/feature/relay/circuitbuild_relay.c | 66 +++++++++++++++++++++++++++++++--- src/feature/relay/router.c | 11 +++++- src/feature/relay/router.h | 1 + src/test/test_circuitbuild.c | 32 ++++++++++++++++- 4 files changed, 103 insertions(+), 7 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index d6ea22ca7..261fbc7e4 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -18,6 +18,8 @@ #include "orconfig.h" #include "feature/relay/circuitbuild_relay.h" +#include "lib/crypt_ops/crypto_rand.h" + #include "core/or/or.h" #include "app/config/config.h" @@ -36,6 +38,7 @@ #include "feature/nodelist/nodelist.h" +#include "feature/relay/router.h" #include "feature/relay/routermode.h" #include "feature/relay/selftest.h" @@ -237,9 +240,14 @@ circuit_extend_lspec_valid_helper(const struct extend_cell_t *ec, } /* When there is no open channel for an extend cell ec, set up the - * circuit circ to wait for a new connection. If should_launch - * is true, open a new connection. (Otherwise, we are already waiting for a - * new connection to the same relay.) + * circuit circ to wait for a new connection. + * + * If should_launch is true, open a new connection. (Otherwise, we are + * already waiting for a new connection to the same relay.) + * + * Check if IPv6 extends are supported by our current configuration. If they + * are, new connections may be made over IPv4 or IPv6. (IPv4 connections are + * always supported.) */ STATIC void circuit_open_connection_for_extend(const struct extend_cell_t *ec, @@ -258,13 +266,61 @@ circuit_open_connection_for_extend(const struct extend_cell_t *ec, return; } + /* Check the addresses, without logging */ + const int ipv4_valid = + (circuit_extend_addr_port_helper(&ec->orport_ipv4, false, false, 0) == 0); + const int ipv6_valid = + (circuit_extend_addr_port_helper(&ec->orport_ipv6, false, false, 0) == 0); + + IF_BUG_ONCE(!ipv4_valid && !ipv6_valid) { + /* circuit_extend_lspec_valid_helper() should have caught this */ + circuit_mark_for_close(circ, END_CIRC_REASON_CONNECTFAILED); + return; + } + + /* If we could make an IPv4 or an IPv6 connection, make an IPv6 connection + * at random, with probability 1 in N. + * 1 means "always IPv6 (and no IPv4)" + * 2 means "equal probability of IPv4 or IPv6" + * ... (and so on) ... + * (UINT_MAX - 1) means "almost always IPv4 (and almost never IPv6)" + * To disable IPv6, set ipv6_supported to 0. + */ +#define IPV6_CONNECTION_ONE_IN_N 2 + + const bool ipv6_supported = router_has_advertised_ipv6_orport(get_options()); + const tor_addr_port_t *chosen_ap = NULL; + + /* IPv4 is always supported */ + if (ipv4_valid && ipv6_valid && ipv6_supported) { + /* Choose between IPv4 and IPv6 at random */ + bool choose_ipv6 = crypto_fast_rng_one_in_n(get_thread_fast_rng(), + IPV6_CONNECTION_ONE_IN_N); + if (choose_ipv6) { + chosen_ap = &ec->orport_ipv6; + } else { + chosen_ap = &ec->orport_ipv4; + } + } else if (ipv6_valid && ipv6_supported) { + /* There's only one valid address: try to use it */ + chosen_ap = &ec->orport_ipv6; + } else if (ipv4_valid) { + chosen_ap = &ec->orport_ipv4; + } else { + /* An IPv6-only extend, but IPv6 is not supported */ + log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, + "Received IPv6-only extend, but we don't have an IPv6 ORPort."); + circuit_mark_for_close(circ, END_CIRC_REASON_CONNECTFAILED); + return; + } + circ->n_hop = extend_info_new(NULL /*nickname*/, (const char*)ec->node_id, &ec->ed_pubkey, NULL, /*onion_key*/ NULL, /*curve25519_key*/ - &ec->orport_ipv4.addr, - ec->orport_ipv4.port); + &chosen_ap->addr, + chosen_ap->port); circ->n_chan_create_cell = tor_memdup(&ec->create_cell, sizeof(ec->create_cell)); diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c index a4a9c6a81..89e232ccc 100644 --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@ -1469,7 +1469,7 @@ router_get_advertised_ipv6_or_ap(const or_options_t *options, AF_INET6); if (!addr || port == 0) { - log_info(LD_CONFIG, "There is no advertised IPv6 ORPort."); + log_debug(LD_CONFIG, "There is no advertised IPv6 ORPort."); return; } @@ -1490,6 +1490,15 @@ router_get_advertised_ipv6_or_ap(const or_options_t *options, ipv6_ap_out->port = port; } +/** Returns true if this router has an advertised IPv6 ORPort. */ +bool +router_has_advertised_ipv6_orport(const or_options_t *options) +{ + tor_addr_port_t ipv6_ap; + router_get_advertised_ipv6_or_ap(options, &ipv6_ap); + return tor_addr_port_is_valid_ap(&ipv6_ap, 0); +} + /** Return the port that we should advertise as our DirPort; * this is one of three possibilities: * The one that is passed as dirport if the DirPort option is 0, or diff --git a/src/feature/relay/router.h b/src/feature/relay/router.h index d1b4ce5f8..c3a93cc0a 100644 --- a/src/feature/relay/router.h +++ b/src/feature/relay/router.h @@ -68,6 +68,7 @@ uint16_t router_get_active_listener_port_by_type_af(int listener_type, uint16_t router_get_advertised_or_port(const or_options_t *options); void router_get_advertised_ipv6_or_ap(const or_options_t *options, tor_addr_port_t *ipv6_ap_out); +bool router_has_advertised_ipv6_orport(const or_options_t *options); uint16_t router_get_advertised_or_port_by_af(const or_options_t *options, sa_family_t family); uint16_t router_get_advertised_dir_port(const or_options_t *options, diff --git a/src/test/test_circuitbuild.c b/src/test/test_circuitbuild.c index 5d09ba557..a26109ed8 100644 --- a/src/test/test_circuitbuild.c +++ b/src/test/test_circuitbuild.c @@ -857,6 +857,10 @@ test_circuit_open_connection_for_extend(void *arg) circuit_t *circ = tor_malloc_zero(sizeof(circuit_t)); channel_t *fake_n_chan = tor_malloc_zero(sizeof(channel_t)); + or_options_t *fake_options = options_new(); + MOCK(get_options, mock_get_options); + mocked_options = fake_options; + MOCK(circuit_mark_for_close_, mock_circuit_mark_for_close_); mock_circuit_close_calls = 0; MOCK(channel_connect_for_circuit, mock_channel_connect_for_circuit); @@ -906,8 +910,30 @@ test_circuit_open_connection_for_extend(void *arg) tt_int_op(smartlist_len(tor_get_captured_bug_log_()), OP_LE, 2); tor_end_capture_bugs_(); mock_clean_saved_logs(); + + /* Fail, because neither address is valid */ + mock_circuit_close_calls = 0; + mock_channel_connect_calls = 0; + tor_capture_bugs_(1); + circuit_open_connection_for_extend(ec, circ, 0); + /* Close the circuit, don't connect */ + tt_int_op(mock_circuit_close_calls, OP_EQ, 1); + tt_int_op(mock_channel_connect_calls, OP_EQ, 0); + /* Check state */ + tt_ptr_op(circ->n_hop, OP_EQ, NULL); + tt_ptr_op(circ->n_chan_create_cell, OP_EQ, NULL); + tt_int_op(circ->state, OP_EQ, 0); + /* Cleanup */ + tor_end_capture_bugs_(); + mock_clean_saved_logs(); #endif /* !defined(ALL_BUGS_ARE_FATAL) */ + /* Set up valid addresses */ + tor_addr_parse(&ec->orport_ipv4.addr, PUBLIC_IPV4); + ec->orport_ipv4.port = VALID_PORT; + tor_addr_parse(&ec->orport_ipv6.addr, PUBLIC_IPV6); + ec->orport_ipv6.port = VALID_PORT; + /* Succeed, but don't try to open a connection */ mock_circuit_close_calls = 0; mock_channel_connect_calls = 0; @@ -948,7 +974,7 @@ test_circuit_open_connection_for_extend(void *arg) mock_circuit_close_calls = 0; mock_channel_connect_calls = 0; circuit_open_connection_for_extend(ec, circ, 1); - /* Try to connect, and succeed, leaving the circuit open */ + /* Connection attempt succeeded, leaving the circuit open */ tt_int_op(mock_circuit_close_calls, OP_EQ, 0); tt_int_op(mock_channel_connect_calls, OP_EQ, 1); /* Check state */ @@ -971,6 +997,10 @@ test_circuit_open_connection_for_extend(void *arg) UNMOCK(channel_connect_for_circuit); mock_channel_connect_calls = 0; + UNMOCK(get_options); + or_options_free(fake_options); + mocked_options = NULL; + tor_free(ec); tor_free(circ->n_hop); tor_free(circ->n_chan_create_cell);

1 0

[tor/master] relay: Refactor choosing extend IPs
by nickm＠torproject.org 30 Apr '20

30 Apr '20

commit bcec1ec071400464f7cefa4f0d493964984905ce Author: teor <teor(a)torproject.org> Date: Wed Apr 29 21:37:31 2020 +1000 relay: Refactor choosing extend IPs Flatten the logic in circuit_choose_ip_ap_for_extend(). Part of 33817. --- src/feature/relay/circuitbuild_relay.c | 45 +++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 20 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index 2bf08547d..9420ea11a 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -250,8 +250,27 @@ STATIC const tor_addr_port_t * circuit_choose_ip_ap_for_extend(const tor_addr_port_t *ipv4_ap, const tor_addr_port_t *ipv6_ap) { - /* If we could make an IPv4 or an IPv6 connection, make an IPv6 connection - * at random, with probability 1 in N. + const bool ipv6_supported = router_has_advertised_ipv6_orport(get_options()); + + /* If IPv6 is not supported, we can't use the IPv6 address. */ + if (!ipv6_supported) { + ipv6_ap = NULL; + } + + /* If there is no IPv6 address, IPv4 is always supported. + * Until clients include IPv6 ORPorts, and most relays support IPv6, + * this is the most common case. */ + if (!ipv6_ap) { + return ipv4_ap; + } + + /* If there is no IPv4 address, return the (possibly NULL) IPv6 address. */ + if (!ipv4_ap) { + return ipv6_ap; + } + + /* Now we have an IPv4 and an IPv6 address, and IPv6 is supported. + * So make an IPv6 connection at random, with probability 1 in N. * 1 means "always IPv6 (and no IPv4)" * 2 means "equal probability of IPv4 or IPv6" * ... (and so on) ... @@ -260,26 +279,12 @@ circuit_choose_ip_ap_for_extend(const tor_addr_port_t *ipv4_ap, */ #define IPV6_CONNECTION_ONE_IN_N 2 - /* IPv4 is always supported */ - const bool ipv6_supported = router_has_advertised_ipv6_orport(get_options()); - - if (ipv4_ap && ipv6_ap && ipv6_supported) { - /* Choose between IPv4 and IPv6 at random */ - bool choose_ipv6 = crypto_fast_rng_one_in_n(get_thread_fast_rng(), - IPV6_CONNECTION_ONE_IN_N); - if (choose_ipv6) { - return ipv6_ap; - } else { - return ipv4_ap; - } - } else if (ipv6_ap && ipv6_supported) { - /* There's only one valid address: try to use it */ + bool choose_ipv6 = crypto_fast_rng_one_in_n(get_thread_fast_rng(), + IPV6_CONNECTION_ONE_IN_N); + if (choose_ipv6) { return ipv6_ap; - } else if (ipv4_ap) { - return ipv4_ap; } else { - /* IPv6-only extend, but IPv6 is not supported. */ - return NULL; + return ipv4_ap; } }

1 0

[tor/master] net: Make all address bytes functions take uint8_t *
by nickm＠torproject.org 30 Apr '20

30 Apr '20

commit cd7e2fc210349615c8e9cdb879f98cb0c9cac57b Author: teor <teor(a)torproject.org> Date: Thu Apr 30 06:17:18 2020 +1000 net: Make all address bytes functions take uint8_t * Part of 33817. --- src/core/or/channeltls.c | 2 +- src/core/or/connection_edge.c | 2 +- src/core/or/onion.c | 6 +++--- src/core/or/policies.c | 4 ++-- src/core/or/relay.c | 8 ++++---- src/core/proto/proto_socks.c | 5 ++--- src/feature/client/addressmap.c | 2 +- src/lib/net/address.c | 17 +++++++++-------- src/lib/net/address.h | 8 ++++---- src/test/test_address.c | 4 ++-- src/tools/tor-resolve.c | 2 +- 11 files changed, 30 insertions(+), 30 deletions(-) diff --git a/src/core/or/channeltls.c b/src/core/or/channeltls.c index b424d02a5..be941c176 100644 --- a/src/core/or/channeltls.c +++ b/src/core/or/channeltls.c @@ -1669,7 +1669,7 @@ tor_addr_from_netinfo_addr(tor_addr_t *tor_addr, } else if (type == NETINFO_ADDR_TYPE_IPV6 && len == 16) { const uint8_t *ipv6_bytes = netinfo_addr_getconstarray_addr_ipv6( netinfo_addr); - tor_addr_from_ipv6_bytes(tor_addr, (const char *)ipv6_bytes); + tor_addr_from_ipv6_bytes(tor_addr, ipv6_bytes); } else { log_fn(LOG_PROTOCOL_WARN, LD_OR, "Cannot read address from NETINFO " "- wrong type/length."); diff --git a/src/core/or/connection_edge.c b/src/core/or/connection_edge.c index 23c6e230c..803bd82fc 100644 --- a/src/core/or/connection_edge.c +++ b/src/core/or/connection_edge.c @@ -3531,7 +3531,7 @@ connection_ap_handshake_socks_resolved,(entry_connection_t *conn, } } else if (answer_type == RESOLVED_TYPE_IPV6 && answer_len == 16) { tor_addr_t a; - tor_addr_from_ipv6_bytes(&a, (char*)answer); + tor_addr_from_ipv6_bytes(&a, answer); if (! tor_addr_is_null(&a)) { client_dns_set_addressmap(conn, conn->socks_request->address, &a, diff --git a/src/core/or/onion.c b/src/core/or/onion.c index 923f850f2..7b8f3c61f 100644 --- a/src/core/or/onion.c +++ b/src/core/or/onion.c @@ -353,7 +353,7 @@ extend_cell_from_extend2_cell_body(extend_cell_t *cell_out, continue; found_ipv6 = 1; tor_addr_from_ipv6_bytes(&cell_out->orport_ipv6.addr, - (const char *)ls->un_ipv6_addr); + ls->un_ipv6_addr); cell_out->orport_ipv6.port = ls->un_ipv6_port; break; case LS_LEGACY_ID: @@ -674,8 +674,8 @@ extend_cell_format(uint8_t *command_out, uint16_t *len_out, extend2_cell_body_add_ls(cell, ls); ls->ls_type = LS_IPV6; ls->ls_len = 18; - tor_addr_copy_ipv6_bytes((char *)ls->un_ipv6_addr, - &cell_in->orport_ipv6.addr); + tor_addr_copy_ipv6_bytes(ls->un_ipv6_addr, + &cell_in->orport_ipv6.addr); ls->un_ipv6_port = cell_in->orport_ipv6.port; } cell->n_spec = n_specifiers; diff --git a/src/core/or/policies.c b/src/core/or/policies.c index dd4feaadf..ea803f393 100644 --- a/src/core/or/policies.c +++ b/src/core/or/policies.c @@ -167,7 +167,7 @@ policy_expand_unspec(smartlist_t **policy) } tor_addr_from_ipv4h(&newpolicy_ipv4.addr, 0); tor_addr_from_ipv6_bytes(&newpolicy_ipv6.addr, - "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"); + (const uint8_t *)"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"); smartlist_add(tmp, addr_policy_get_canonical_entry(&newpolicy_ipv4)); smartlist_add(tmp, addr_policy_get_canonical_entry(&newpolicy_ipv6)); addr_policy_free(p); @@ -1005,7 +1005,7 @@ fascist_firewall_choose_address_ls(const smartlist_t *lspecs, * direct connection. */ if (have_v6) continue; tor_addr_from_ipv6_bytes(&addr_v6, - (const char *) link_specifier_getconstarray_un_ipv6_addr(ls)); + link_specifier_getconstarray_un_ipv6_addr(ls)); port_v6 = link_specifier_get_un_ipv6_port(ls); have_v6 = 1; break; diff --git a/src/core/or/relay.c b/src/core/or/relay.c index 00bbf77b9..b831af0ac 100644 --- a/src/core/or/relay.c +++ b/src/core/or/relay.c @@ -867,7 +867,7 @@ connection_ap_process_end_not_open( ttl = (int)ntohl(get_uint32(cell->payload+RELAY_HEADER_SIZE+5)); } else if (rh->length == 17 || rh->length == 21) { tor_addr_from_ipv6_bytes(&addr, - (char*)(cell->payload+RELAY_HEADER_SIZE+1)); + (cell->payload+RELAY_HEADER_SIZE+1)); if (rh->length == 21) ttl = (int)ntohl(get_uint32(cell->payload+RELAY_HEADER_SIZE+17)); } @@ -1092,7 +1092,7 @@ connected_cell_parse(const relay_header_t *rh, const cell_t *cell, return -1; if (get_uint8(payload + 4) != 6) return -1; - tor_addr_from_ipv6_bytes(addr_out, (char*)(payload + 5)); + tor_addr_from_ipv6_bytes(addr_out, (payload + 5)); bytes = ntohl(get_uint32(payload + 21)); if (bytes <= INT32_MAX) *ttl_out = (int) bytes; @@ -1165,7 +1165,7 @@ resolved_cell_parse(const cell_t *cell, const relay_header_t *rh, if (answer_len != 16) goto err; addr = tor_malloc_zero(sizeof(*addr)); - tor_addr_from_ipv6_bytes(&addr->addr, (const char*) cp); + tor_addr_from_ipv6_bytes(&addr->addr, cp); cp += 16; addr->ttl = ntohl(get_uint32(cp)); cp += 4; @@ -3217,7 +3217,7 @@ decode_address_from_payload(tor_addr_t *addr_out, const uint8_t *payload, case RESOLVED_TYPE_IPV6: if (payload[1] != 16) return NULL; - tor_addr_from_ipv6_bytes(addr_out, (char*)(payload+2)); + tor_addr_from_ipv6_bytes(addr_out, (payload+2)); break; default: tor_addr_make_unspec(addr_out); diff --git a/src/core/proto/proto_socks.c b/src/core/proto/proto_socks.c index 6fd08b227..c7d2af3d9 100644 --- a/src/core/proto/proto_socks.c +++ b/src/core/proto/proto_socks.c @@ -587,9 +587,8 @@ parse_socks5_client_request(const uint8_t *raw_data, socks_request_t *req, strlcpy(req->address, hostname, sizeof(req->address)); } break; case 4: { - const char *ipv6 = - (const char *)socks5_client_request_getarray_dest_addr_ipv6( - trunnel_req); + const uint8_t *ipv6 = + socks5_client_request_getarray_dest_addr_ipv6(trunnel_req); tor_addr_from_ipv6_bytes(&destaddr, ipv6); tor_addr_to_str(req->address, &destaddr, sizeof(req->address), 1); diff --git a/src/feature/client/addressmap.c b/src/feature/client/addressmap.c index cc97166f3..9ad2d7f93 100644 --- a/src/feature/client/addressmap.c +++ b/src/feature/client/addressmap.c @@ -902,7 +902,7 @@ get_random_virtual_addr(const virtual_addr_conf_t *conf, tor_addr_t *addr_out) } if (ipv6) - tor_addr_from_ipv6_bytes(addr_out, (char*) bytes); + tor_addr_from_ipv6_bytes(addr_out, bytes); else tor_addr_from_ipv4n(addr_out, get_uint32(bytes)); diff --git a/src/lib/net/address.c b/src/lib/net/address.c index af0e58fa4..4193053ee 100644 --- a/src/lib/net/address.c +++ b/src/lib/net/address.c @@ -608,7 +608,8 @@ tor_addr_parse_mask_ports(const char *s, family = AF_INET; tor_addr_from_ipv4h(addr_out, 0); } else if (flags & TAPMP_STAR_IPV6_ONLY) { - static char nil_bytes[16] = { [0]=0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0 }; + static uint8_t nil_bytes[16] = + { [0]=0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0 }; family = AF_INET6; tor_addr_from_ipv6_bytes(addr_out, nil_bytes); } else { @@ -629,7 +630,7 @@ tor_addr_parse_mask_ports(const char *s, tor_addr_from_ipv4h(addr_out, 0); any_flag = 1; } else if (!strcmp(address, "*6") && (flags & TAPMP_EXTENDED_STAR)) { - static char nil_bytes[16] = { [0]=0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0 }; + static uint8_t nil_bytes[16] = { [0]=0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0 }; family = AF_INET6; tor_addr_from_ipv6_bytes(addr_out, nil_bytes); any_flag = 1; @@ -887,7 +888,7 @@ tor_addr_from_ipv4n(tor_addr_t *dest, uint32_t v4addr) /** Set dest to equal the IPv6 address in the 16 bytes at * ipv6_bytes. */ void -tor_addr_from_ipv6_bytes(tor_addr_t *dest, const char *ipv6_bytes) +tor_addr_from_ipv6_bytes(tor_addr_t *dest, const uint8_t *ipv6_bytes) { tor_assert(dest); tor_assert(ipv6_bytes); @@ -900,14 +901,14 @@ tor_addr_from_ipv6_bytes(tor_addr_t *dest, const char *ipv6_bytes) void tor_addr_from_in6(tor_addr_t *dest, const struct in6_addr *in6) { - tor_addr_from_ipv6_bytes(dest, (const char*)in6->s6_addr); + tor_addr_from_ipv6_bytes(dest, in6->s6_addr); } /** Set the 16 bytes at dest to equal the IPv6 address src. * src must be an IPv6 address, if it is not, log a warning, and clear * dest. */ void -tor_addr_copy_ipv6_bytes(char *dest, const tor_addr_t *src) +tor_addr_copy_ipv6_bytes(uint8_t *dest, const tor_addr_t *src) { tor_assert(dest); tor_assert(src); @@ -1463,10 +1464,10 @@ ifconf_free_ifc_buf(struct ifconf *ifc) * into smartlist of tor_addr_t structures. */ STATIC smartlist_t * -ifreq_to_smartlist(char *buf, size_t buflen) +ifreq_to_smartlist(const uint8_t *buf, size_t buflen) { smartlist_t *result = smartlist_new(); - char *end = buf + buflen; + const uint8_t *end = buf + buflen; /* These acrobatics are due to alignment issues which trigger * undefined behaviour traps on OSX. */ @@ -1540,7 +1541,7 @@ get_interface_addresses_ioctl(int severity, sa_family_t family) /* Ensure we have least IFREQ_SIZE bytes unused at the end. Otherwise, we * don't know if we got everything during ioctl. */ } while (mult * IFREQ_SIZE - ifc.ifc_len <= IFREQ_SIZE); - result = ifreq_to_smartlist(ifc.ifc_buf, ifc.ifc_len); + result = ifreq_to_smartlist((const uint8_t *)ifc.ifc_buf, ifc.ifc_len); done: if (fd >= 0) diff --git a/src/lib/net/address.h b/src/lib/net/address.h index 89b1cae32..b5754087c 100644 --- a/src/lib/net/address.h +++ b/src/lib/net/address.h @@ -304,12 +304,12 @@ void tor_addr_from_ipv4n(tor_addr_t *dest, uint32_t v4addr); * order. */ #define tor_addr_from_ipv4h(dest, v4addr) \ tor_addr_from_ipv4n((dest), htonl(v4addr)) -void tor_addr_from_ipv6_bytes(tor_addr_t *dest, const char *bytes); +void tor_addr_from_ipv6_bytes(tor_addr_t *dest, const uint8_t *bytes); /** Set dest to the IPv4 address incoded in in. */ #define tor_addr_from_in(dest, in) \ tor_addr_from_ipv4n((dest), (in)->s_addr); void tor_addr_from_in6(tor_addr_t *dest, const struct in6_addr *in6); -void tor_addr_copy_ipv6_bytes(char *dest, const tor_addr_t *src); +void tor_addr_copy_ipv6_bytes(uint8_t *dest, const tor_addr_t *src); int tor_addr_is_null(const tor_addr_t *addr); int tor_addr_is_loopback(const tor_addr_t *addr); @@ -400,8 +400,8 @@ STATIC struct smartlist_t *get_interface_addresses_win32(int severity, #endif /* defined(HAVE_IP_ADAPTER_TO_SMARTLIST) */ #ifdef HAVE_IFCONF_TO_SMARTLIST -STATIC struct smartlist_t *ifreq_to_smartlist(char *ifr, - size_t buflen); +STATIC struct smartlist_t *ifreq_to_smartlist(const uint8_t *ifr, + size_t buflen); STATIC struct smartlist_t *get_interface_addresses_ioctl(int severity, sa_family_t family); #endif /* defined(HAVE_IFCONF_TO_SMARTLIST) */ diff --git a/src/test/test_address.c b/src/test/test_address.c index e068c99d9..4cedbda34 100644 --- a/src/test/test_address.c +++ b/src/test/test_address.c @@ -460,7 +460,7 @@ test_address_ifreq_to_smartlist(void *arg) ifc->ifc_len = sizeof(struct ifreq); ifc->ifc_ifcu.ifcu_req = ifr; - results = ifreq_to_smartlist(ifc->ifc_buf,ifc->ifc_len); + results = ifreq_to_smartlist((const uint8_t *)ifc->ifc_buf,ifc->ifc_len); tt_int_op(smartlist_len(results),OP_EQ,1); tor_addr = smartlist_get(results, 0); @@ -483,7 +483,7 @@ test_address_ifreq_to_smartlist(void *arg) SMARTLIST_FOREACH(results, tor_addr_t *, t, tor_free(t)); smartlist_free(results); - results = ifreq_to_smartlist(ifc->ifc_buf,ifc->ifc_len); + results = ifreq_to_smartlist((const uint8_t *)ifc->ifc_buf,ifc->ifc_len); tt_int_op(smartlist_len(results),OP_EQ,2); tor_addr = smartlist_get(results, 0); diff --git a/src/tools/tor-resolve.c b/src/tools/tor-resolve.c index d369445df..e6d6bddcd 100644 --- a/src/tools/tor-resolve.c +++ b/src/tools/tor-resolve.c @@ -509,7 +509,7 @@ do_resolve(const char *hostname, } else if (atype == SOCKS5_ATYPE_IPV6) { /* IPv6 address */ tor_addr_from_ipv6_bytes(result_addr, - (const char *)socks5_server_reply_getarray_bind_addr_ipv6(reply)); + socks5_server_reply_getarray_bind_addr_ipv6(reply)); } else if (atype == SOCKS5_ATYPE_HOSTNAME) { /* Domain name */ domainname_t *dn =

1 0

[tor/master] channel: Refactor matches target address function
by nickm＠torproject.org 30 Apr '20

30 Apr '20

commit 066d2deb3d322e960600d80739739199d8c4cfa6 Author: teor <teor(a)torproject.org> Date: Thu Apr 30 06:31:05 2020 +1000 channel: Refactor matches target address function Refactor channel_matches_target_addr_for_extend() to return a boolean result. Part of 33817. --- src/core/or/channel.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/core/or/channel.c b/src/core/or/channel.c index 93245ce81..a05554472 100644 --- a/src/core/or/channel.c +++ b/src/core/or/channel.c @@ -85,7 +85,7 @@ /* Static function prototypes */ -static int channel_matches_target_addr_for_extend( +static bool channel_matches_target_addr_for_extend( channel_t *chan, const tor_addr_t *target_ipv4_addr, const tor_addr_t *target_ipv6_addr); @@ -2412,7 +2412,7 @@ channel_get_for_extend,(const char *rsa_id_digest, continue; } - const int matches_target = + const bool matches_target = channel_matches_target_addr_for_extend(chan, target_ipv4_addr, target_ipv6_addr); @@ -3317,7 +3317,7 @@ channel_matches_extend_info(channel_t *chan, extend_info_t *extend_info) * This function calls into the lower layer and asks if this channel thinks * it matches the target addresses for circuit extension purposes. */ -int +static bool channel_matches_target_addr_for_extend(channel_t *chan, const tor_addr_t *target_ipv4_addr, const tor_addr_t *target_ipv6_addr) @@ -3326,15 +3326,15 @@ channel_matches_target_addr_for_extend(channel_t *chan, tor_assert(chan->matches_target); IF_BUG_ONCE(!target_ipv4_addr && !target_ipv6_addr) - return 0; + return false; if (target_ipv4_addr && chan->matches_target(chan, target_ipv4_addr)) - return 1; + return true; if (target_ipv6_addr && chan->matches_target(chan, target_ipv6_addr)) - return 1; + return true; - return 0; + return false; } /**

1 0

[tor/master] Merge remote-tracking branch 'tor-github/pr/1864/head'
by nickm＠torproject.org 30 Apr '20

30 Apr '20

1 0

[tor/master] Rename tor_addr_get_ipv6_bytes to tor_addr_copy_ipv6_bytes
by nickm＠torproject.org 30 Apr '20

30 Apr '20

commit f62b051e873aa4be564e9f83745902d4541f79f4 Author: teor <teor(a)torproject.org> Date: Thu Apr 30 05:54:39 2020 +1000 Rename tor_addr_get_ipv6_bytes to tor_addr_copy_ipv6_bytes This is an automated commit, generated by this command: ./scripts/maint/rename_c_identifier.py \ tor_addr_get_ipv6_bytes tor_addr_copy_ipv6_bytes --- src/core/or/onion.c | 2 +- src/lib/net/address.c | 2 +- src/lib/net/address.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/core/or/onion.c b/src/core/or/onion.c index d73f981d2..923f850f2 100644 --- a/src/core/or/onion.c +++ b/src/core/or/onion.c @@ -674,7 +674,7 @@ extend_cell_format(uint8_t *command_out, uint16_t *len_out, extend2_cell_body_add_ls(cell, ls); ls->ls_type = LS_IPV6; ls->ls_len = 18; - tor_addr_get_ipv6_bytes((char *)ls->un_ipv6_addr, + tor_addr_copy_ipv6_bytes((char *)ls->un_ipv6_addr, &cell_in->orport_ipv6.addr); ls->un_ipv6_port = cell_in->orport_ipv6.port; } diff --git a/src/lib/net/address.c b/src/lib/net/address.c index 9a90093ae..af0e58fa4 100644 --- a/src/lib/net/address.c +++ b/src/lib/net/address.c @@ -907,7 +907,7 @@ tor_addr_from_in6(tor_addr_t *dest, const struct in6_addr *in6) * src must be an IPv6 address, if it is not, log a warning, and clear * dest. */ void -tor_addr_get_ipv6_bytes(char *dest, const tor_addr_t *src) +tor_addr_copy_ipv6_bytes(char *dest, const tor_addr_t *src) { tor_assert(dest); tor_assert(src); diff --git a/src/lib/net/address.h b/src/lib/net/address.h index 651d6bc71..89b1cae32 100644 --- a/src/lib/net/address.h +++ b/src/lib/net/address.h @@ -309,7 +309,7 @@ void tor_addr_from_ipv6_bytes(tor_addr_t *dest, const char *bytes); #define tor_addr_from_in(dest, in) \ tor_addr_from_ipv4n((dest), (in)->s_addr); void tor_addr_from_in6(tor_addr_t *dest, const struct in6_addr *in6); -void tor_addr_get_ipv6_bytes(char *dest, const tor_addr_t *src); +void tor_addr_copy_ipv6_bytes(char *dest, const tor_addr_t *src); int tor_addr_is_null(const tor_addr_t *addr); int tor_addr_is_loopback(const tor_addr_t *addr);

1 0

[tor/master] relay: Refactor circuit_open_connection_for_extend()
by nickm＠torproject.org 30 Apr '20

30 Apr '20

commit 9a6186c267c613ab1cbcb7544e988fe62aab8548 Author: teor <teor(a)torproject.org> Date: Wed Apr 29 20:29:15 2020 +1000 relay: Refactor circuit_open_connection_for_extend() Refactor circuit_open_connection_for_extend(), splitting out the IP address choice code into a new function. Adds unit tests. No behaviour changes in tor. Part of 33817. --- src/feature/relay/circuitbuild_relay.c | 77 +++++++++++++++++++++------------- src/feature/relay/circuitbuild_relay.h | 3 ++ 2 files changed, 51 insertions(+), 29 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index 261fbc7e4..2bf08547d 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -239,6 +239,50 @@ circuit_extend_lspec_valid_helper(const struct extend_cell_t *ec, return 0; } +/* If possible, return a supported, non-NULL IP address. + * + * If both addresses are supported and non-NULL, choose one uniformly at + * random. + * + * If we have an IPv6-only extend, but IPv6 is not supported, returns NULL. + * If both addresses are NULL, also returns NULL. */ +STATIC const tor_addr_port_t * +circuit_choose_ip_ap_for_extend(const tor_addr_port_t *ipv4_ap, + const tor_addr_port_t *ipv6_ap) +{ + /* If we could make an IPv4 or an IPv6 connection, make an IPv6 connection + * at random, with probability 1 in N. + * 1 means "always IPv6 (and no IPv4)" + * 2 means "equal probability of IPv4 or IPv6" + * ... (and so on) ... + * (UINT_MAX - 1) means "almost always IPv4 (and almost never IPv6)" + * To disable IPv6, set ipv6_supported to 0. + */ +#define IPV6_CONNECTION_ONE_IN_N 2 + + /* IPv4 is always supported */ + const bool ipv6_supported = router_has_advertised_ipv6_orport(get_options()); + + if (ipv4_ap && ipv6_ap && ipv6_supported) { + /* Choose between IPv4 and IPv6 at random */ + bool choose_ipv6 = crypto_fast_rng_one_in_n(get_thread_fast_rng(), + IPV6_CONNECTION_ONE_IN_N); + if (choose_ipv6) { + return ipv6_ap; + } else { + return ipv4_ap; + } + } else if (ipv6_ap && ipv6_supported) { + /* There's only one valid address: try to use it */ + return ipv6_ap; + } else if (ipv4_ap) { + return ipv4_ap; + } else { + /* IPv6-only extend, but IPv6 is not supported. */ + return NULL; + } +} + /* When there is no open channel for an extend cell ec, set up the * circuit circ to wait for a new connection. * @@ -278,35 +322,10 @@ circuit_open_connection_for_extend(const struct extend_cell_t *ec, return; } - /* If we could make an IPv4 or an IPv6 connection, make an IPv6 connection - * at random, with probability 1 in N. - * 1 means "always IPv6 (and no IPv4)" - * 2 means "equal probability of IPv4 or IPv6" - * ... (and so on) ... - * (UINT_MAX - 1) means "almost always IPv4 (and almost never IPv6)" - * To disable IPv6, set ipv6_supported to 0. - */ -#define IPV6_CONNECTION_ONE_IN_N 2 - - const bool ipv6_supported = router_has_advertised_ipv6_orport(get_options()); - const tor_addr_port_t *chosen_ap = NULL; - - /* IPv4 is always supported */ - if (ipv4_valid && ipv6_valid && ipv6_supported) { - /* Choose between IPv4 and IPv6 at random */ - bool choose_ipv6 = crypto_fast_rng_one_in_n(get_thread_fast_rng(), - IPV6_CONNECTION_ONE_IN_N); - if (choose_ipv6) { - chosen_ap = &ec->orport_ipv6; - } else { - chosen_ap = &ec->orport_ipv4; - } - } else if (ipv6_valid && ipv6_supported) { - /* There's only one valid address: try to use it */ - chosen_ap = &ec->orport_ipv6; - } else if (ipv4_valid) { - chosen_ap = &ec->orport_ipv4; - } else { + const tor_addr_port_t *chosen_ap = circuit_choose_ip_ap_for_extend( + ipv4_valid ? &ec->orport_ipv4 : NULL, + ipv6_valid ? &ec->orport_ipv6 : NULL); + if (!chosen_ap) { /* An IPv6-only extend, but IPv6 is not supported */ log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Received IPv6-only extend, but we don't have an IPv6 ORPort."); diff --git a/src/feature/relay/circuitbuild_relay.h b/src/feature/relay/circuitbuild_relay.h index d14f304f1..078316153 100644 --- a/src/feature/relay/circuitbuild_relay.h +++ b/src/feature/relay/circuitbuild_relay.h @@ -75,6 +75,9 @@ STATIC int circuit_extend_state_valid_helper(const struct circuit_t *circ); STATIC int circuit_extend_add_ed25519_helper(struct extend_cell_t *ec); STATIC int circuit_extend_lspec_valid_helper(const struct extend_cell_t *ec, const struct circuit_t *circ); +STATIC const tor_addr_port_t * circuit_choose_ip_ap_for_extend( + const tor_addr_port_t *ipv4_ap, + const tor_addr_port_t *ipv6_ap); STATIC void circuit_open_connection_for_extend(const struct extend_cell_t *ec, struct circuit_t *circ, int should_launch);

1 0