[tor-bugs] #23588 [Core Tor/Tor]: Write fascist_firewall_choose_address_ls() and use it in hs_get_extend_info_from_lspecs()

Tor Bug Tracker & Wiki blackhole at torproject.org
Fri Aug 17 00:36:42 UTC 2018


#23588: Write fascist_firewall_choose_address_ls() and use it in
hs_get_extend_info_from_lspecs()
-------------------------------------------------+-------------------------
 Reporter:  teor                                 |          Owner:  neel
     Type:  defect                               |         Status:
                                                 |  needs_revision
 Priority:  Medium                               |      Milestone:  Tor:
                                                 |  0.3.5.x-final
Component:  Core Tor/Tor                         |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:  prop224, tor-hs, single-onion,       |  Actual Points:
  ipv6, 034-triage-20180328,                     |
  034-removed-20180328                           |
Parent ID:  #23493                               |         Points:  1
 Reviewer:  teor                                 |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by neel):

 I looked closer and after inserting `log_warn` statements containing the
 IP address, I learned that while `ap->addr` gets set in
 `fascist_firewall_choose_address_base()`, if `ap->addr` can be an unknown
 address (probably `AF_UNSPEC` and `ap->port` is 0.

 For instance, if I use this code on my branch:
 {{{
 diff --git a/src/core/or/policies.c b/src/core/or/policies.c
 index e9e2cb4a5..a9a98ecc3 100644
 --- a/src/core/or/policies.c
 +++ b/src/core/or/policies.c
 @@ -877,6 +877,9 @@ fascist_firewall_choose_address_base(const tor_addr_t
 *ipv4_addr,
    if (result) {
      tor_addr_copy(&ap->addr, &result->addr);
      ap->port = result->port;
 +    char *out_addr = tor_addr_to_str_dup(&ap->addr);
 +    log_warn(LD_BUG, "%s %d\n", out_addr, ap->port);
 +    tor_free(out_addr);
    }
  }

 @@ -1049,6 +1052,10 @@ fascist_firewall_choose_address_ls(const
 smartlist_t *lspecs,
                                         FIREWALL_OR_CONNECTION,
                                         pref_only, pref_ipv6,
                                         ap);
 +
 +  char *out_addr = tor_addr_to_str_dup(&ap->addr);
 +  log_warn(LD_BUG, "%s %d\n", out_addr, ap->port);
 +  tor_free(out_addr);
  }

  /** Like fascist_firewall_choose_address_base(), but takes <b>node</b>,
 and
 }}}

 and running `make test-network-all` gave me this for `hs-v23-ipv6-md`:
 {{{
 FAIL: hs-v23-ipv6-md
 Detail: chutney/tools/warnings.sh
 /usr/home/neel/code/tor/chutney//net/nodes.1534465377
 Warning: Bug:     0x111f299 <main+0x19> at
 /usr/home/neel/code/tor/tor/src/app/tor (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug:     0x111f43c <tor_main+0x4c> at
 /usr/home/neel/code/tor/tor/src/app/tor (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug:     0x111f744 <connection_add_impl+0x1f4> at
 /usr/home/neel/code/tor/tor/src/app/tor (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug:     0x1122271 <do_main_loop+0x421> at
 /usr/home/neel/code/tor/tor/src/app/tor (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug:     0x1124028 <tor_run_main+0xe8> at
 /usr/home/neel/code/tor/tor/src/app/tor (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug:     0x1153037 <connection_handle_read+0xb57> at
 /usr/home/neel/code/tor/tor/src/app/tor (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug:     0x11bdb1e <connection_dir_reached_eof+0x2e> at
 /usr/home/neel/code/tor/tor/src/app/tor (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug:     0x11bfcc8 <connection_dir_reached_eof+0x21d8> at
 /usr/home/neel/code/tor/tor/src/app/tor (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug:     0x11daade <hs_client_dir_info_changed+0x5e> at
 /usr/home/neel/code/tor/tor/src/app/tor (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug:     0x11efb34 <networkstatus_set_current_consensus+0xe04> at
 /usr/home/neel/code/tor/tor/src/app/tor (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug:     0x12b51b1 <tor_bug_occurred_+0x111> at
 /usr/home/neel/code/tor/tor/src/app/tor (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug:     0x12b8bcc <log_backtrace_impl+0x4c> at
 /usr/home/neel/code/tor/tor/src/app/tor (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug:     0x80139076f <event_base_loop+0x51f> at
 /usr/local/lib/libevent-2.1.so.6 (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug:     0x80139481d <event_base_assert_ok_nolock_+0xc8d> at
 /usr/local/lib/libevent-2.1.so.6 (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Bug: Non-fatal assertion !(status == HS_CLIENT_FETCH_HAVE_DESC)
 failed in retry_all_socks_conn_waiting_for_desc at
 src/feature/hs/hs_client.c:275. Stack trace: (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 Warning: Every introduction point for service
 6zlc2ni5rciibhqtva3354stgd6rywukmhb6cnevps3rdnucozisshyd is unusable or we
 can't extend to it. We can't connect. Number: 7
 Warning: Not enough info to open a circuit to a rendezvous point for
 hidden service 6zlc2ni5rciibhqtva3354stgd6rywukmhb6cnevps3rdnucozisshyd.
 Number: 1
 Warning: fascist_firewall_choose_address_base: Bug: 127.0.0.1 5000 Number:
 70
 Warning: fascist_firewall_choose_address_base: Bug: 127.0.0.1 5001 Number:
 77
 Warning: fascist_firewall_choose_address_base: Bug: 127.0.0.1 5002 Number:
 6
 Warning: fascist_firewall_choose_address_base: Bug: 127.0.0.1 5003 Number:
 10
 Warning: fascist_firewall_choose_address_base: Bug: 127.0.0.1 7000 Number:
 93
 Warning: fascist_firewall_choose_address_base: Bug: 127.0.0.1 7001 Number:
 102
 Warning: fascist_firewall_choose_address_base: Bug: ::1 5000 Number: 95
 Warning: fascist_firewall_choose_address_base: Bug: ::1 5001 Number: 51
 Warning: fascist_firewall_choose_address_base: Bug: ::1 5002 Number: 7
 Warning: fascist_firewall_choose_address_base: Bug: ::1 5003 Number: 4
 Warning: fascist_firewall_choose_address_base: Bug: ::1 5004 Number: 21
 Warning: fascist_firewall_choose_address_ls: Bug: 127.0.0.1 5001 Number: 1
 Warning: fascist_firewall_choose_address_ls: Bug: <unknown address type> 0
 Number: 22
 Warning: tor_bug_occurred_: Bug: src/feature/hs/hs_client.c:275:
 retry_all_socks_conn_waiting_for_desc: Non-fatal assertion !(status ==
 HS_CLIENT_FETCH_HAVE_DESC) failed. (on Tor 0.3.5.0-alpha-dev
 9320918155a5ad74) Number: 3
 }}}

 I think the address referred to by this line:

 {{{
 Warning: fascist_firewall_choose_address_ls: Bug: <unknown address type> 0
 Number: 22
 }}}

 is the one which crashes Tor.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/23588#comment:45>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online


More information about the tor-bugs mailing list