- tor-commits - lists.torproject.org

[tor/master] Rename tor_addr_get_ipv6_bytes to tor_addr_copy_ipv6_bytes
by nickm＠torproject.org 29 Apr '20

29 Apr '20

commit f62b051e873aa4be564e9f83745902d4541f79f4 Author: teor <teor(a)torproject.org> Date: Thu Apr 30 05:54:39 2020 +1000 Rename tor_addr_get_ipv6_bytes to tor_addr_copy_ipv6_bytes This is an automated commit, generated by this command: ./scripts/maint/rename_c_identifier.py \ tor_addr_get_ipv6_bytes tor_addr_copy_ipv6_bytes --- src/core/or/onion.c | 2 +- src/lib/net/address.c | 2 +- src/lib/net/address.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/core/or/onion.c b/src/core/or/onion.c index d73f981d2..923f850f2 100644 --- a/src/core/or/onion.c +++ b/src/core/or/onion.c @@ -674,7 +674,7 @@ extend_cell_format(uint8_t *command_out, uint16_t *len_out, extend2_cell_body_add_ls(cell, ls); ls->ls_type = LS_IPV6; ls->ls_len = 18; - tor_addr_get_ipv6_bytes((char *)ls->un_ipv6_addr, + tor_addr_copy_ipv6_bytes((char *)ls->un_ipv6_addr, &cell_in->orport_ipv6.addr); ls->un_ipv6_port = cell_in->orport_ipv6.port; } diff --git a/src/lib/net/address.c b/src/lib/net/address.c index 9a90093ae..af0e58fa4 100644 --- a/src/lib/net/address.c +++ b/src/lib/net/address.c @@ -907,7 +907,7 @@ tor_addr_from_in6(tor_addr_t *dest, const struct in6_addr *in6) * src must be an IPv6 address, if it is not, log a warning, and clear * dest. */ void -tor_addr_get_ipv6_bytes(char *dest, const tor_addr_t *src) +tor_addr_copy_ipv6_bytes(char *dest, const tor_addr_t *src) { tor_assert(dest); tor_assert(src); diff --git a/src/lib/net/address.h b/src/lib/net/address.h index 651d6bc71..89b1cae32 100644 --- a/src/lib/net/address.h +++ b/src/lib/net/address.h @@ -309,7 +309,7 @@ void tor_addr_from_ipv6_bytes(tor_addr_t *dest, const char *bytes); #define tor_addr_from_in(dest, in) \ tor_addr_from_ipv4n((dest), (in)->s_addr); void tor_addr_from_in6(tor_addr_t *dest, const struct in6_addr *in6); -void tor_addr_get_ipv6_bytes(char *dest, const tor_addr_t *src); +void tor_addr_copy_ipv6_bytes(char *dest, const tor_addr_t *src); int tor_addr_is_null(const tor_addr_t *addr); int tor_addr_is_loopback(const tor_addr_t *addr);

1 0

[tor/master] relay: Refactor circuit_open_connection_for_extend()
by nickm＠torproject.org 29 Apr '20

29 Apr '20

commit 9a6186c267c613ab1cbcb7544e988fe62aab8548 Author: teor <teor(a)torproject.org> Date: Wed Apr 29 20:29:15 2020 +1000 relay: Refactor circuit_open_connection_for_extend() Refactor circuit_open_connection_for_extend(), splitting out the IP address choice code into a new function. Adds unit tests. No behaviour changes in tor. Part of 33817. --- src/feature/relay/circuitbuild_relay.c | 77 +++++++++++++++++++++------------- src/feature/relay/circuitbuild_relay.h | 3 ++ 2 files changed, 51 insertions(+), 29 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index 261fbc7e4..2bf08547d 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -239,6 +239,50 @@ circuit_extend_lspec_valid_helper(const struct extend_cell_t *ec, return 0; } +/* If possible, return a supported, non-NULL IP address. + * + * If both addresses are supported and non-NULL, choose one uniformly at + * random. + * + * If we have an IPv6-only extend, but IPv6 is not supported, returns NULL. + * If both addresses are NULL, also returns NULL. */ +STATIC const tor_addr_port_t * +circuit_choose_ip_ap_for_extend(const tor_addr_port_t *ipv4_ap, + const tor_addr_port_t *ipv6_ap) +{ + /* If we could make an IPv4 or an IPv6 connection, make an IPv6 connection + * at random, with probability 1 in N. + * 1 means "always IPv6 (and no IPv4)" + * 2 means "equal probability of IPv4 or IPv6" + * ... (and so on) ... + * (UINT_MAX - 1) means "almost always IPv4 (and almost never IPv6)" + * To disable IPv6, set ipv6_supported to 0. + */ +#define IPV6_CONNECTION_ONE_IN_N 2 + + /* IPv4 is always supported */ + const bool ipv6_supported = router_has_advertised_ipv6_orport(get_options()); + + if (ipv4_ap && ipv6_ap && ipv6_supported) { + /* Choose between IPv4 and IPv6 at random */ + bool choose_ipv6 = crypto_fast_rng_one_in_n(get_thread_fast_rng(), + IPV6_CONNECTION_ONE_IN_N); + if (choose_ipv6) { + return ipv6_ap; + } else { + return ipv4_ap; + } + } else if (ipv6_ap && ipv6_supported) { + /* There's only one valid address: try to use it */ + return ipv6_ap; + } else if (ipv4_ap) { + return ipv4_ap; + } else { + /* IPv6-only extend, but IPv6 is not supported. */ + return NULL; + } +} + /* When there is no open channel for an extend cell ec, set up the * circuit circ to wait for a new connection. * @@ -278,35 +322,10 @@ circuit_open_connection_for_extend(const struct extend_cell_t *ec, return; } - /* If we could make an IPv4 or an IPv6 connection, make an IPv6 connection - * at random, with probability 1 in N. - * 1 means "always IPv6 (and no IPv4)" - * 2 means "equal probability of IPv4 or IPv6" - * ... (and so on) ... - * (UINT_MAX - 1) means "almost always IPv4 (and almost never IPv6)" - * To disable IPv6, set ipv6_supported to 0. - */ -#define IPV6_CONNECTION_ONE_IN_N 2 - - const bool ipv6_supported = router_has_advertised_ipv6_orport(get_options()); - const tor_addr_port_t *chosen_ap = NULL; - - /* IPv4 is always supported */ - if (ipv4_valid && ipv6_valid && ipv6_supported) { - /* Choose between IPv4 and IPv6 at random */ - bool choose_ipv6 = crypto_fast_rng_one_in_n(get_thread_fast_rng(), - IPV6_CONNECTION_ONE_IN_N); - if (choose_ipv6) { - chosen_ap = &ec->orport_ipv6; - } else { - chosen_ap = &ec->orport_ipv4; - } - } else if (ipv6_valid && ipv6_supported) { - /* There's only one valid address: try to use it */ - chosen_ap = &ec->orport_ipv6; - } else if (ipv4_valid) { - chosen_ap = &ec->orport_ipv4; - } else { + const tor_addr_port_t *chosen_ap = circuit_choose_ip_ap_for_extend( + ipv4_valid ? &ec->orport_ipv4 : NULL, + ipv6_valid ? &ec->orport_ipv6 : NULL); + if (!chosen_ap) { /* An IPv6-only extend, but IPv6 is not supported */ log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL, "Received IPv6-only extend, but we don't have an IPv6 ORPort."); diff --git a/src/feature/relay/circuitbuild_relay.h b/src/feature/relay/circuitbuild_relay.h index d14f304f1..078316153 100644 --- a/src/feature/relay/circuitbuild_relay.h +++ b/src/feature/relay/circuitbuild_relay.h @@ -75,6 +75,9 @@ STATIC int circuit_extend_state_valid_helper(const struct circuit_t *circ); STATIC int circuit_extend_add_ed25519_helper(struct extend_cell_t *ec); STATIC int circuit_extend_lspec_valid_helper(const struct extend_cell_t *ec, const struct circuit_t *circ); +STATIC const tor_addr_port_t * circuit_choose_ip_ap_for_extend( + const tor_addr_port_t *ipv4_ap, + const tor_addr_port_t *ipv6_ap); STATIC void circuit_open_connection_for_extend(const struct extend_cell_t *ec, struct circuit_t *circ, int should_launch);

1 0

[tor/master] changes: file for 33817
by nickm＠torproject.org 29 Apr '20

29 Apr '20

commit 528a1fe985fbcbd348825c5ab98d0e9018453c5b Author: teor <teor(a)torproject.org> Date: Wed Apr 15 20:03:22 2020 +1000 changes: file for 33817 --- changes/ticket33817 | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/changes/ticket33817 b/changes/ticket33817 new file mode 100644 index 000000000..9c22d084e --- /dev/null +++ b/changes/ticket33817 @@ -0,0 +1,12 @@ + o Major features (IPv6, relay): + - Relays may extend circuits over IPv6, if the relay has an IPv6 ORPort, + and the client supplies the other relay's IPv6 ORPort in the EXTEND2 + cell. IPv6 extends will be used by the relay IPv6 ORPort self-tests in + 33222. Closes ticket 33817. + - Consider IPv6-only EXTEND2 cells valid on relays. Log a protocol warning + if the IPv4 or IPv6 address is an internal address, and internal + addresses are not allowed. But continue to use the other address, if it + is valid. Closes ticket 33817. + - If a relay can extend over IPv4 and IPv6, it chooses between them + uniformly at random. Closes ticket 33817. + - Re-use existing IPv6 connections for circuit extends. Closes ticket 33817.

1 0

[tor/master] relay: Refactor extend address validity function
by nickm＠torproject.org 29 Apr '20

29 Apr '20

commit 496ddd2877051a43aaa7bbeb68bd5b255c71adc7 Author: teor <teor(a)torproject.org> Date: Thu Apr 30 06:26:40 2020 +1000 relay: Refactor extend address validity function Rename the function, and give it a boolean return value. No behaviour change. Part of 33817. --- src/feature/relay/circuitbuild_relay.c | 59 +++++++++++++++++----------------- 1 file changed, 30 insertions(+), 29 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index 9420ea11a..75b2767b8 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -125,16 +125,17 @@ circuit_extend_add_ed25519_helper(struct extend_cell_t *ec) /* Check if the address and port in the tor_addr_port_t ap are valid, * and are allowed by the current ExtendAllowPrivateAddresses config. * - * If they are valid, return 0. - * Otherwise, if they are invalid, return -1. + * If they are valid, return true. + * Otherwise, if they are invalid, return false. + * * If log_zero_addrs is true, log warnings about zero addresses at * log_level. If log_internal_addrs is true, log warnings about * internal addresses at log_level. */ -static int -circuit_extend_addr_port_helper(const struct tor_addr_port_t *ap, - bool log_zero_addrs, bool log_internal_addrs, - int log_level) +static bool +circuit_extend_addr_port_is_valid(const struct tor_addr_port_t *ap, + bool log_zero_addrs, bool log_internal_addrs, + int log_level) { /* It's safe to print the family. But we don't want to print the address, * unless specifically configured to do so. (Zero addresses aren't sensitive, @@ -147,7 +148,7 @@ circuit_extend_addr_port_helper(const struct tor_addr_port_t *ap, "%s address '%s'.", fmt_addr_family(&ap->addr), safe_str(fmt_addrport_ap(ap))); } - return -1; + return false; } if (tor_addr_is_internal(&ap->addr, 0) && @@ -158,10 +159,10 @@ circuit_extend_addr_port_helper(const struct tor_addr_port_t *ap, fmt_addr_family(&ap->addr), safe_str(fmt_and_decorate_addr(&ap->addr))); } - return -1; + return false; } - return 0; + return true; } /* Before replying to an extend cell, check the link specifiers in the extend @@ -185,27 +186,27 @@ circuit_extend_lspec_valid_helper(const struct extend_cell_t *ec, } /* Check the addresses, without logging */ - const int ipv4_valid = - (circuit_extend_addr_port_helper(&ec->orport_ipv4, false, false, 0) == 0); - const int ipv6_valid = - (circuit_extend_addr_port_helper(&ec->orport_ipv6, false, false, 0) == 0); + const int ipv4_valid = circuit_extend_addr_port_is_valid(&ec->orport_ipv4, + false, false, 0); + const int ipv6_valid = circuit_extend_addr_port_is_valid(&ec->orport_ipv6, + false, false, 0); /* We need at least one valid address */ if (!ipv4_valid && !ipv6_valid) { /* Now, log the invalid addresses at protocol warning level */ - circuit_extend_addr_port_helper(&ec->orport_ipv4, true, true, - LOG_PROTOCOL_WARN); - circuit_extend_addr_port_helper(&ec->orport_ipv6, true, true, - LOG_PROTOCOL_WARN); + circuit_extend_addr_port_is_valid(&ec->orport_ipv4, + true, true, LOG_PROTOCOL_WARN); + circuit_extend_addr_port_is_valid(&ec->orport_ipv6, + true, true, LOG_PROTOCOL_WARN); /* And fail */ return -1; } else if (!ipv4_valid) { /* Always log unexpected internal addresses, but go on to use the other * valid address */ - circuit_extend_addr_port_helper(&ec->orport_ipv4, false, true, - LOG_PROTOCOL_WARN); + circuit_extend_addr_port_is_valid(&ec->orport_ipv4, + false, true, LOG_PROTOCOL_WARN); } else if (!ipv6_valid) { - circuit_extend_addr_port_helper(&ec->orport_ipv6, false, true, - LOG_PROTOCOL_WARN); + circuit_extend_addr_port_is_valid(&ec->orport_ipv6, + false, true, LOG_PROTOCOL_WARN); } IF_BUG_ONCE(circ->magic != OR_CIRCUIT_MAGIC) { @@ -316,10 +317,10 @@ circuit_open_connection_for_extend(const struct extend_cell_t *ec, } /* Check the addresses, without logging */ - const int ipv4_valid = - (circuit_extend_addr_port_helper(&ec->orport_ipv4, false, false, 0) == 0); - const int ipv6_valid = - (circuit_extend_addr_port_helper(&ec->orport_ipv6, false, false, 0) == 0); + const int ipv4_valid = circuit_extend_addr_port_is_valid(&ec->orport_ipv4, + false, false, 0); + const int ipv6_valid = circuit_extend_addr_port_is_valid(&ec->orport_ipv6, + false, false, 0); IF_BUG_ONCE(!ipv4_valid && !ipv6_valid) { /* circuit_extend_lspec_valid_helper() should have caught this */ @@ -412,10 +413,10 @@ circuit_extend(struct cell_t *cell, struct circuit_t *circ) return -1; /* Check the addresses, without logging */ - const int ipv4_valid = - (circuit_extend_addr_port_helper(&ec.orport_ipv4, false, false, 0) == 0); - const int ipv6_valid = - (circuit_extend_addr_port_helper(&ec.orport_ipv6, false, false, 0) == 0); + const int ipv4_valid = circuit_extend_addr_port_is_valid(&ec.orport_ipv4, + false, false, 0); + const int ipv6_valid = circuit_extend_addr_port_is_valid(&ec.orport_ipv6, + false, false, 0); IF_BUG_ONCE(!ipv4_valid && !ipv6_valid) { /* circuit_extend_lspec_valid_helper() should have caught this */ return -1;

1 0

[tor/master] relay: Refactor can extend over IPv6 checks
by nickm＠torproject.org 29 Apr '20

29 Apr '20

commit 15a4180a7e041531d6923a41684e9e6ffc833760 Author: teor <teor(a)torproject.org> Date: Thu Apr 30 06:47:46 2020 +1000 relay: Refactor can extend over IPv6 checks Split "can extend over IPv6" and "has advertised IPv6 ORPort" into separate functions. They currently have the same result, but this may change in 33818 with ExtendAllowIPv6Addresses. Part of 33817. --- src/feature/relay/circuitbuild_relay.c | 2 +- src/feature/relay/router.c | 13 +++++- src/feature/relay/router.h | 4 +- src/test/test_circuitbuild.c | 76 +++++++++++++++++----------------- 4 files changed, 52 insertions(+), 43 deletions(-) diff --git a/src/feature/relay/circuitbuild_relay.c b/src/feature/relay/circuitbuild_relay.c index 75b2767b8..b89866b47 100644 --- a/src/feature/relay/circuitbuild_relay.c +++ b/src/feature/relay/circuitbuild_relay.c @@ -251,7 +251,7 @@ STATIC const tor_addr_port_t * circuit_choose_ip_ap_for_extend(const tor_addr_port_t *ipv4_ap, const tor_addr_port_t *ipv6_ap) { - const bool ipv6_supported = router_has_advertised_ipv6_orport(get_options()); + const bool ipv6_supported = router_can_extend_over_ipv6(get_options()); /* If IPv6 is not supported, we can't use the IPv6 address. */ if (!ipv6_supported) { diff --git a/src/feature/relay/router.c b/src/feature/relay/router.c index b0a56012d..2858371af 100644 --- a/src/feature/relay/router.c +++ b/src/feature/relay/router.c @@ -1491,14 +1491,23 @@ router_get_advertised_ipv6_or_ap(const or_options_t *options, } /** Returns true if this router has an advertised IPv6 ORPort. */ -MOCK_IMPL(bool, -router_has_advertised_ipv6_orport,(const or_options_t *options)) +bool +router_has_advertised_ipv6_orport(const or_options_t *options) { tor_addr_port_t ipv6_ap; router_get_advertised_ipv6_or_ap(options, &ipv6_ap); return tor_addr_port_is_valid_ap(&ipv6_ap, 0); } +/** Returns true if this router has an advertised IPv6 ORPort. */ +MOCK_IMPL(bool, +router_can_extend_over_ipv6,(const or_options_t *options)) +{ + /* We might add some extra checks here, such as ExtendAllowIPv6Addresses + * from ticket 33818. */ + return router_has_advertised_ipv6_orport(options); +} + /** Return the port that we should advertise as our DirPort; * this is one of three possibilities: * The one that is passed as dirport if the DirPort option is 0, or diff --git a/src/feature/relay/router.h b/src/feature/relay/router.h index 1a262a679..39c550dd2 100644 --- a/src/feature/relay/router.h +++ b/src/feature/relay/router.h @@ -68,8 +68,8 @@ uint16_t router_get_active_listener_port_by_type_af(int listener_type, uint16_t router_get_advertised_or_port(const or_options_t *options); void router_get_advertised_ipv6_or_ap(const or_options_t *options, tor_addr_port_t *ipv6_ap_out); -MOCK_DECL(bool, router_has_advertised_ipv6_orport,( - const or_options_t *options)); +bool router_has_advertised_ipv6_orport(const or_options_t *options); +MOCK_DECL(bool, router_can_extend_over_ipv6,(const or_options_t *options)); uint16_t router_get_advertised_or_port_by_af(const or_options_t *options, sa_family_t family); uint16_t router_get_advertised_dir_port(const or_options_t *options, diff --git a/src/test/test_circuitbuild.c b/src/test/test_circuitbuild.c index ed75d102b..03fd176ea 100644 --- a/src/test/test_circuitbuild.c +++ b/src/test/test_circuitbuild.c @@ -821,14 +821,14 @@ test_circuit_extend_lspec_valid(void *arg) tor_free(p_chan); } -static bool router_has_ipv6_orport_result = false; -static int mock_router_ipv6_orport_calls = 0; +static bool can_extend_over_ipv6_result = false; +static int mock_router_can_extend_over_ipv6_calls = 0; static bool -mock_router_has_advertised_ipv6_orport(const or_options_t *options) +mock_router_can_extend_over_ipv6(const or_options_t *options) { (void)options; - mock_router_ipv6_orport_calls++; - return router_has_ipv6_orport_result; + mock_router_can_extend_over_ipv6_calls++; + return can_extend_over_ipv6_result; } /* Test the different cases in circuit_choose_ip_ap_for_extend(). */ @@ -849,65 +849,65 @@ test_circuit_choose_ip_ap_for_extend(void *arg) MOCK(get_options, mock_get_options); mocked_options = fake_options; - MOCK(router_has_advertised_ipv6_orport, - mock_router_has_advertised_ipv6_orport); - router_has_ipv6_orport_result = true; - mock_router_ipv6_orport_calls = 0; + MOCK(router_can_extend_over_ipv6, + mock_router_can_extend_over_ipv6); + can_extend_over_ipv6_result = true; + mock_router_can_extend_over_ipv6_calls = 0; /* No valid addresses */ - router_has_ipv6_orport_result = true; - mock_router_ipv6_orport_calls = 0; + can_extend_over_ipv6_result = true; + mock_router_can_extend_over_ipv6_calls = 0; tt_ptr_op(circuit_choose_ip_ap_for_extend(NULL, NULL), OP_EQ, NULL); - tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + tt_int_op(mock_router_can_extend_over_ipv6_calls, OP_EQ, 1); - router_has_ipv6_orport_result = false; - mock_router_ipv6_orport_calls = 0; + can_extend_over_ipv6_result = false; + mock_router_can_extend_over_ipv6_calls = 0; tt_ptr_op(circuit_choose_ip_ap_for_extend(NULL, NULL), OP_EQ, NULL); - tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + tt_int_op(mock_router_can_extend_over_ipv6_calls, OP_EQ, 1); /* One valid address: IPv4 */ - router_has_ipv6_orport_result = true; - mock_router_ipv6_orport_calls = 0; + can_extend_over_ipv6_result = true; + mock_router_can_extend_over_ipv6_calls = 0; tt_ptr_op(circuit_choose_ip_ap_for_extend(&ipv4_ap, NULL), OP_EQ, &ipv4_ap); - tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + tt_int_op(mock_router_can_extend_over_ipv6_calls, OP_EQ, 1); - router_has_ipv6_orport_result = false; - mock_router_ipv6_orport_calls = 0; + can_extend_over_ipv6_result = false; + mock_router_can_extend_over_ipv6_calls = 0; tt_ptr_op(circuit_choose_ip_ap_for_extend(&ipv4_ap, NULL), OP_EQ, &ipv4_ap); - tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + tt_int_op(mock_router_can_extend_over_ipv6_calls, OP_EQ, 1); /* One valid address: IPv6 */ - router_has_ipv6_orport_result = true; - mock_router_ipv6_orport_calls = 0; + can_extend_over_ipv6_result = true; + mock_router_can_extend_over_ipv6_calls = 0; tt_ptr_op(circuit_choose_ip_ap_for_extend(NULL, &ipv6_ap), OP_EQ, &ipv6_ap); - tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + tt_int_op(mock_router_can_extend_over_ipv6_calls, OP_EQ, 1); - router_has_ipv6_orport_result = false; - mock_router_ipv6_orport_calls = 0; + can_extend_over_ipv6_result = false; + mock_router_can_extend_over_ipv6_calls = 0; tt_ptr_op(circuit_choose_ip_ap_for_extend(NULL, &ipv6_ap), OP_EQ, NULL); - tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + tt_int_op(mock_router_can_extend_over_ipv6_calls, OP_EQ, 1); /* Two valid addresses */ const tor_addr_port_t *chosen_addr = NULL; - router_has_ipv6_orport_result = true; - mock_router_ipv6_orport_calls = 0; + can_extend_over_ipv6_result = true; + mock_router_can_extend_over_ipv6_calls = 0; chosen_addr = circuit_choose_ip_ap_for_extend(&ipv4_ap, &ipv6_ap); tt_assert(chosen_addr == &ipv4_ap || chosen_addr == &ipv6_ap); - tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + tt_int_op(mock_router_can_extend_over_ipv6_calls, OP_EQ, 1); - router_has_ipv6_orport_result = false; - mock_router_ipv6_orport_calls = 0; + can_extend_over_ipv6_result = false; + mock_router_can_extend_over_ipv6_calls = 0; tt_ptr_op(circuit_choose_ip_ap_for_extend(&ipv4_ap, &ipv6_ap), OP_EQ, &ipv4_ap); - tt_int_op(mock_router_ipv6_orport_calls, OP_EQ, 1); + tt_int_op(mock_router_can_extend_over_ipv6_calls, OP_EQ, 1); done: UNMOCK(get_options); or_options_free(fake_options); mocked_options = NULL; - UNMOCK(router_has_advertised_ipv6_orport); + UNMOCK(router_can_extend_over_ipv6); tor_free(fake_options); } @@ -968,9 +968,9 @@ test_circuit_open_connection_for_extend(void *arg) mock_channel_connect_calls = 0; mock_channel_connect_nchan = NULL; - MOCK(router_has_advertised_ipv6_orport, - mock_router_has_advertised_ipv6_orport); - router_has_ipv6_orport_result = true; + MOCK(router_can_extend_over_ipv6, + mock_router_can_extend_over_ipv6); + can_extend_over_ipv6_result = true; setup_full_capture_of_logs(LOG_INFO); @@ -1110,7 +1110,7 @@ test_circuit_open_connection_for_extend(void *arg) or_options_free(fake_options); mocked_options = NULL; - UNMOCK(router_has_advertised_ipv6_orport); + UNMOCK(router_can_extend_over_ipv6); tor_free(ec); tor_free(circ->n_hop);

1 0

[tor/master] practracker: Allow an extra line in tor_addr_parse_mask_ports()
by nickm＠torproject.org 29 Apr '20

29 Apr '20

commit ed4420b4b8b891bd29587a27cb51e9184ff3e093 Author: teor <teor(a)torproject.org> Date: Thu Apr 30 06:52:43 2020 +1000 practracker: Allow an extra line in tor_addr_parse_mask_ports() We added a cast, and wrapped a line. --- scripts/maint/practracker/exceptions.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/maint/practracker/exceptions.txt b/scripts/maint/practracker/exceptions.txt index cf2ec701e..bf37d476f 100644 --- a/scripts/maint/practracker/exceptions.txt +++ b/scripts/maint/practracker/exceptions.txt @@ -305,7 +305,7 @@ problem function-size /src/lib/encoding/confline.c:parse_config_line_from_str_ve problem function-size /src/lib/encoding/cstring.c:unescape_string() 108 problem function-size /src/lib/fs/dir.c:check_private_dir() 230 problem function-size /src/lib/math/prob_distr.c:sample_uniform_interval() 145 -problem function-size /src/lib/net/address.c:tor_addr_parse_mask_ports() 194 +problem function-size /src/lib/net/address.c:tor_addr_parse_mask_ports() 195 problem function-size /src/lib/net/address.c:tor_addr_compare_masked() 110 problem function-size /src/lib/net/inaddr.c:tor_inet_pton() 107 problem function-size /src/lib/net/socketpair.c:tor_ersatz_socketpair() 102

1 0

[meek/master] Remove d2zfqthxsdq309.cloudfront.net from the example torrc.
by dcf＠torproject.org 29 Apr '20

29 Apr '20

commit ec78bba23155908ba3a46eb4e06fa7753c249a76 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Apr 29 13:23:42 2020 -0600 Remove d2zfqthxsdq309.cloudfront.net from the example torrc. --- meek-client/torrc | 1 - 1 file changed, 1 deletion(-) diff --git a/meek-client/torrc b/meek-client/torrc index dcac2f0..9272271 100644 --- a/meek-client/torrc +++ b/meek-client/torrc @@ -4,6 +4,5 @@ UseBridges 1 # Socks5Proxy localhost:1080 # HTTPSProxy localhost:8080 -Bridge meek 0.0.2.0:2 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com Bridge meek 0.0.2.0:3 url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com ClientTransportPlugin meek exec ./meek-client --log meek-client.log

1 0

[meek/master] Do the go.mod thing.
by dcf＠torproject.org 29 Apr '20

29 Apr '20

commit 1b9883a620c9b12096c83809524b9f12076955bc Author: David Fifield <david(a)bamsoftware.com> Date: Wed Apr 29 13:34:58 2020 -0600 Do the go.mod thing. --- go.mod | 11 +++++++++++ go.sum | 17 +++++++++++++++++ 2 files changed, 28 insertions(+) diff --git a/go.mod b/go.mod new file mode 100644 index 0000000..1216057 --- /dev/null +++ b/go.mod @@ -0,0 +1,11 @@ +module git.torproject.org/pluggable-transports/meek.git + +go 1.13 + +require ( + git.torproject.org/pluggable-transports/goptlib.git v1.1.0 + github.com/refraction-networking/utls v0.0.0-20190909200633-43c36d3c1f57 + golang.org/x/crypto v0.0.0-20200429183012-4b2356b1ed79 + golang.org/x/net v0.0.0-20200425230154-ff2c4b7c35a0 + golang.org/x/sys v0.0.0-20200428200454-593003d681fa +) diff --git a/go.sum b/go.sum new file mode 100644 index 0000000..effe803 --- /dev/null +++ b/go.sum @@ -0,0 +1,17 @@ +git.torproject.org/pluggable-transports/goptlib.git v1.1.0 h1:LMQAA8pAho+QtYrrVNimJQiINNEwcwuuD99vezD/PAo= +git.torproject.org/pluggable-transports/goptlib.git v1.1.0/go.mod h1:YT4XMSkuEXbtqlydr9+OxqFAyspUv0Gr9qhM3B++o/Q= +github.com/refraction-networking/utls v0.0.0-20190909200633-43c36d3c1f57 h1:SL1K0QAuC1b54KoY1pjPWe6kSlsFHwK9/oC960fKrTY= +github.com/refraction-networking/utls v0.0.0-20190909200633-43c36d3c1f57/go.mod h1:tz9gX959MEFfFN5whTIocCLUG57WiILqtdVxI8c6Wj0= +golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20200429183012-4b2356b1ed79 h1:IaQbIIB2X/Mp/DKctl6ROxz1KyMlKp4uyvL6+kQ7C88= +golang.org/x/crypto v0.0.0-20200429183012-4b2356b1ed79/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= +golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20200425230154-ff2c4b7c35a0 h1:Jcxah/M+oLZ/R4/z5RzfPzGbPXnVDPkEDtf2JnuxN+U= +golang.org/x/net v0.0.0-20200425230154-ff2c4b7c35a0/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200428200454-593003d681fa h1:yMbJOvnfYkO1dSAviTu/ZguZWLBTXx4xE3LYrxUCCiA= +golang.org/x/sys v0.0.0-20200428200454-593003d681fa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

1 0

[meek/master] Update utls fingerprints
by dcf＠torproject.org 29 Apr '20

29 Apr '20

commit 9bd0572a639e0e33085496ecb9539c618229df0e Author: David Fifield <david(a)bamsoftware.com> Date: Wed Apr 29 13:30:40 2020 -0600 Update utls fingerprints github.com/refraction-networking/utls Adds HelloFirefox_65 HelloChrome_72 HelloIOS_12_1 --- doc/meek-client.1 | 37 +++++++++++++++++++++++++++++++++++-- doc/meek-client.1.txt | 3 +++ meek-client/utls.go | 3 +++ 3 files changed, 41 insertions(+), 2 deletions(-) diff --git a/doc/meek-client.1 b/doc/meek-client.1 index 58fd755..8215537 100644 --- a/doc/meek-client.1 +++ b/doc/meek-client.1 @@ -2,12 +2,12 @@ .\" Title: meek-client .\" Author: [FIXME: author] [see http://docbook.sf.net/el/author] .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/> -.\" Date: 02/06/2019 +.\" Date: 04/29/2020 .\" Manual: \ \& .\" Source: \ \& .\" Language: English .\" -.TH "MEEK\-CLIENT" "1" "02/06/2019" "\ \&" "\ \&" +.TH "MEEK\-CLIENT" "1" "04/29/2020" "\ \&" "\ \&" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -128,6 +128,17 @@ HelloFirefox_63 .sp -1 .IP \(bu 2.3 .\} +HelloFirefox_65 +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} HelloFirefox_Auto .RE .sp @@ -172,6 +183,17 @@ HelloChrome_70 .sp -1 .IP \(bu 2.3 .\} +HelloChrome_72 +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} HelloChrome_Auto .RE .sp @@ -194,6 +216,17 @@ HelloIOS_11_1 .sp -1 .IP \(bu 2.3 .\} +HelloIOS_12_1 +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} HelloIOS_Auto .RE .sp diff --git a/doc/meek-client.1.txt b/doc/meek-client.1.txt index 33e2916..bd1ce5b 100644 --- a/doc/meek-client.1.txt +++ b/doc/meek-client.1.txt @@ -56,12 +56,15 @@ The possible values of __CLIENTHELLOID__ are: - HelloFirefox_55 - HelloFirefox_56 - HelloFirefox_63 +- HelloFirefox_65 - HelloFirefox_Auto - HelloChrome_58 - HelloChrome_62 - HelloChrome_70 +- HelloChrome_72 - HelloChrome_Auto - HelloIOS_11_1 +- HelloIOS_12_1 - HelloIOS_Auto As a special case, the values "none" and "HelloGolang" diff --git a/meek-client/utls.go b/meek-client/utls.go index 576eb26..e7f2b5f 100644 --- a/meek-client/utls.go +++ b/meek-client/utls.go @@ -263,12 +263,15 @@ var clientHelloIDMap = map[string]*utls.ClientHelloID{ "hellofirefox_55": &utls.HelloFirefox_55, "hellofirefox_56": &utls.HelloFirefox_56, "hellofirefox_63": &utls.HelloFirefox_63, + "hellofirefox_65": &utls.HelloFirefox_65, "hellochrome_auto": &utls.HelloChrome_Auto, "hellochrome_58": &utls.HelloChrome_58, "hellochrome_62": &utls.HelloChrome_62, "hellochrome_70": &utls.HelloChrome_70, + "hellochrome_72": &utls.HelloChrome_72, "helloios_auto": &utls.HelloIOS_Auto, "helloios_11_1": &utls.HelloIOS_11_1, + "helloios_12_1": &utls.HelloIOS_12_1, } func NewUTLSRoundTripper(name string, cfg *utls.Config, proxyURL *url.URL) (http.RoundTripper, error) {

1 0

[meek/master] Use Clone to make copies of http.DefaultTransport.
by dcf＠torproject.org 29 Apr '20

29 Apr '20

commit bc887de694bc2d2381af099d5c38f0e9efd76c4b Author: David Fifield <david(a)bamsoftware.com> Date: Wed Apr 29 13:22:07 2020 -0600 Use Clone to make copies of http.DefaultTransport. Clone is new in go1.13. https://github.com/golang/go/issues/26013 --- meek-client/meek-client.go | 2 +- meek-client/utls.go | 28 +++------------------------- 2 files changed, 4 insertions(+), 26 deletions(-) diff --git a/meek-client/meek-client.go b/meek-client/meek-client.go index f520a60..3431b53 100644 --- a/meek-client/meek-client.go +++ b/meek-client/meek-client.go @@ -82,7 +82,7 @@ const ( // We use this RoundTripper to make all our requests when neither --helper nor // utls is in effect. We use the defaults, except we take control of the Proxy // setting (notably, disabling the default ProxyFromEnvironment). -var httpRoundTripper *http.Transport = http.DefaultTransport.(*http.Transport) +var httpRoundTripper *http.Transport = http.DefaultTransport.(*http.Transport).Clone() // We use this RoundTripper when --helper is in effect. var helperRoundTripper = &HelperRoundTripper{ diff --git a/meek-client/utls.go b/meek-client/utls.go index 66b1a93..576eb26 100644 --- a/meek-client/utls.go +++ b/meek-client/utls.go @@ -39,7 +39,6 @@ import ( "net" "net/http" "net/url" - "reflect" "strings" "sync" @@ -48,25 +47,6 @@ import ( "golang.org/x/net/proxy" ) -// Copy the public fields (fields for which CanSet is true) from src to dst. -// src and dst must be pointers to the same type. We use this to make copies of -// httpRoundTripper. We cannot use struct assignment, because http.Transport -// contains private mutexes. The idea of using reflection to copy only the -// public fields comes from a post by Nick Craig-Wood: -// https://groups.google.com/d/msg/Golang-Nuts/SDiGYNVE8iY/89hRKTF4BAAJ -func copyPublicFields(dst, src interface{}) { - if reflect.TypeOf(dst) != reflect.TypeOf(src) { - panic("unequal types") - } - dstValue := reflect.ValueOf(dst).Elem() - srcValue := reflect.ValueOf(src).Elem() - for i := 0; i < dstValue.NumField(); i++ { - if dstValue.Field(i).CanSet() { - dstValue.Field(i).Set(srcValue.Field(i)) - } - } -} - // Extract a host:port address from a URL, suitable for passing to net.Dial. func addrForDial(url *url.URL) (string, error) { host := url.Hostname() @@ -264,9 +244,8 @@ func makeRoundTripper(url *url.URL, clientHelloID *utls.ClientHelloID, cfg *utls default: // With http.Transport, copy important default fields from // http.DefaultTransport, such as TLSHandshakeTimeout and - // IdleConnTimeout. - tr := &http.Transport{} - copyPublicFields(tr, httpRoundTripper) + // IdleConnTimeout, before overriding DialTLS. + tr := httpRoundTripper.Clone() tr.DialTLS = dialTLS return tr, nil } @@ -310,8 +289,7 @@ func NewUTLSRoundTripper(name string, cfg *utls.Config, proxyURL *url.URL) (http // This special-case RoundTripper is used for HTTP requests, which don't // use uTLS but should use the specified proxy. - httpRT := &http.Transport{} - copyPublicFields(httpRT, httpRoundTripper) + httpRT := httpRoundTripper.Clone() httpRT.Proxy = http.ProxyURL(proxyURL) return &UTLSRoundTripper{

1 0