David Goulet [Wed, 9 May 2018 16:40:06 +0000 (12:40 -0400)]
Having a ControlPort open doesn't mean we are a client
The any_client_port_set() returns true if the ControlPort is set which is
wrong because we can have that port open but still not behave as a tor client
(like many relays for instance).
Fixes #26062
Signed-off-by: David Goulet <dgoulet@torproject.org>
teor [Wed, 2 May 2018 12:33:21 +0000 (22:33 +1000)]
Stop logging stack contents when reading a zero-length bandwidth file
When directory authorities read a zero-byte bandwidth file, they log
a warning with the contents of an uninitialised buffer. Log a warning
about the empty file instead.
teor [Wed, 2 May 2018 12:33:21 +0000 (22:33 +1000)]
Stop logging stack contents when reading a zero-length bandwidth file
When directory authorities read a zero-byte bandwidth file, they log
a warning with the contents of an uninitialised buffer. Log a warning
about the empty file instead.
Taylor Yu [Thu, 26 Apr 2018 19:22:52 +0000 (14:22 -0500)]
Show test-suite.log for distcheck on Travis CI
When Travis CI runs make distcheck, test-suite.log doesn't exist in
the expected place. Add a new make target to show this file and use
it when DISTCHECK=yes in .travis.yml. Fixes bug 25814; bug not in any
released Tor.
Alexander Færøy [Fri, 6 Apr 2018 01:58:16 +0000 (03:58 +0200)]
Lift the list of default directory servers into their own file.
This patch lifts the list of default directory authorities from config.c
into their own auth_dirs.inc file, which is then included in config.c
using the C preprocessor.
Coverity found a null pointer reference in nodelist_add_microdesc().
This is almost certainly impossible assuming that the routerstatus_t
returned by router_get_consensus_status_by_descriptor_digest() always
corresponds to an entry in the nodelist. Fixes bug 25629.
Nick Mathewson [Thu, 15 Feb 2018 14:05:55 +0000 (09:05 -0500)]
Forbid UINT32_MAX as a protocol version
The C code and the rust code had different separate integer overflow
bugs here. That suggests that we're better off just forbidding this
pathological case.
Also, add tests for expected behavior on receiving a bad protocol
list in a consensus.
Nick Mathewson [Thu, 1 Feb 2018 21:33:52 +0000 (16:33 -0500)]
Correctly handle NULL returns from parse_protocol_list when voting.
In some cases we had checked for it, but in others we had not. One
of these cases could have been used to remotely cause
denial-of-service against directory authorities while they attempted
to vote.
Roger Dingledine [Wed, 31 Jan 2018 08:21:27 +0000 (03:21 -0500)]
stop calling channel_mark_client in response to a create_fast
since all it does is produce false positives
this commit should get merged into 0.2.9 and 0.3.0 *and* 0.3.1, even
though the code in the previous commit is already present in 0.3.1. sorry
for the mess.
Roger Dingledine [Tue, 30 Jan 2018 23:05:39 +0000 (18:05 -0500)]
backport to make channel_is_client() accurate
This commit takes a piece of commit af8cadf3a9 and a piece of commit 46fe353f25, with the goal of making channel_is_client() be based on what
sort of connection handshake the other side used, rather than seeing
whether the other side ever sent a create_fast cell to us.
David Goulet [Tue, 13 Feb 2018 15:29:41 +0000 (10:29 -0500)]
dos: Don't set consensus param if we aren't a public relay
We had this safeguard around dos_init() but not when the consensus changes
which can modify consensus parameters and possibly enable the DoS mitigation
even if tor wasn't a public relay.
Fixes #25223
Signed-off-by: David Goulet <dgoulet@torproject.org>
Nick Mathewson [Mon, 12 Feb 2018 16:08:33 +0000 (11:08 -0500)]
Have tor_addr hashes return a randomized hash for AF_UNSPEC.
We don't expect this to come up very much, but we may as well make
sure that the value isn't predictable (as we do for the other
addresses) in case the issue ever comes up.
David Goulet [Fri, 9 Feb 2018 16:11:41 +0000 (11:11 -0500)]
dos: Exclude known relays from client connection count
This is to avoid positively identifying Exit relays if tor client connection
comes from them that is reentering the network.
One thing to note is that this is done only in the DoS subsystem but we'll
still add it to the geoip cache as a "client" seen. This is done that way so
to avoid as much as possible changing the current behavior of the geoip client
cache since this is being backported.
Closes #25193
Signed-off-by: David Goulet <dgoulet@torproject.org>
David Goulet [Mon, 5 Feb 2018 15:39:10 +0000 (10:39 -0500)]
geoip: Make geoip_client_cache_total_allocation() return the counter
The HT_FOREACH() is insanely heavy on the CPU and this is part of the fast
path so make it return the nice memory size counter we added in 4d812e29b9b1ec88.
Fixes #25148
Signed-off-by: David Goulet <dgoulet@torproject.org>
David Goulet [Fri, 2 Feb 2018 22:04:12 +0000 (17:04 -0500)]
dos: We can put less token than the current amount
Becasue the circuit creation burst and rate can change at runtime it is
possible that between two refill of a bucket, we end up setting the bucket
value to less than there currently is.
Fixes #25128
Signed-off-by: David Goulet <dgoulet@torproject.org>
David Goulet [Mon, 29 Jan 2018 16:50:11 +0000 (11:50 -0500)]
dos: Make circuit rate limit per second, not tenths anymore
Because this touches too many commits at once, it is made into one single
commit.
Remove the use of "tenths" for the circuit rate to simplify things. We can
only refill the buckets at best once every second because of the use of
approx_time() and our token system is set to be 1 token = 1 circuit so make
the rate a flat integer of circuit per second.
Signed-off-by: David Goulet <dgoulet@torproject.org>
David Goulet [Thu, 25 Jan 2018 14:44:21 +0000 (09:44 -0500)]
dos: Clear connection tracked flag if geoip entry is removed
Imagine this scenario. We had 10 connections over the 24h lifetime of a geoip
cache entry. The lifetime of the entry has been reached so it is about to get
freed but 2 connections remain for it. After the free, a third connection
comes in thus making us create a new geoip entry for that address matching the
2 previous ones that are still alive. If they end up being closed, we'll have
a concurrent count desynch from what the reality is.
To mitigate this probably very rare scenario in practice, when we free a geoip
entry and it has a concurrent count above 0, we'll go over all connections
matching the address and clear out the tracked flag. So once they are closed,
we don't try to decrement the count.
Signed-off-by: David Goulet <dgoulet@torproject.org>
David Goulet [Thu, 25 Jan 2018 21:32:28 +0000 (16:32 -0500)]
dos: Add the DoSRefuseSingleHopClientRendezvous option
This option refuses any ESTABLISH_RENDEZVOUS cell arriving from a client
connection. Its default value is "auto" for which we can turn it on or off
with a consensus parameter. Default value is 0.
Signed-off-by: David Goulet <dgoulet@torproject.org>
David Goulet [Thu, 25 Jan 2018 21:14:40 +0000 (16:14 -0500)]
dos: Detect circuit creation denial of service
Add a function that notifies the DoS subsystem that a new CREATE cell has
arrived. The statistics are updated accordingly and the IP address can also be
marked as malicious if it is above threshold.
At this commit, no defense is applied, just detection with a circuit creation
token bucket system.
Signed-off-by: David Goulet <dgoulet@torproject.org>
projects / thirdparty / tor.git / log
