Nick Mathewson [Thu, 6 Feb 2014 22:08:50 +0000 (17:08 -0500)]
Discard circuit paths on which nobody supports ntor
Right now this accounts for about 1% of circuits over all, but if you
pick a guard that's running 0.2.3, it will be about 6% of the circuits
running through that guard.
Making sure that every circuit has at least one ntor link means that
we're getting plausibly good forward secrecy on every circuit.
Nick Mathewson [Fri, 17 Jan 2014 18:39:04 +0000 (13:39 -0500)]
Make the handling for usable-exit counting handle ExitNodes better
It's possible to set your ExitNodes to contains only exits that don't
have the Exit flag. If you do that, we'll decide that 0 of your exits
are working. Instead, in that case we should look at nodes which have
(or which might have) exit policies that don't reject everything.
Nick Mathewson [Mon, 3 Feb 2014 21:12:30 +0000 (16:12 -0500)]
Clean up test_hs.c: warning fix; tor_free() usage.
My OSX laptop rightly gave a warning because of sticking strlen() into
an int, but once I took a closer look... it appears that the strlen()
was part of a needlessly verbose implementation for tor_strdup().
While I was there, I fixed the usage of tor_free() in test_hs.c: It
checks for NULL, and it zeros its argument. So instead of
if (foo) {
tor_free(foo);
foo = NULL;
}
we should just say
tor_free(foo);
Nick Mathewson [Mon, 3 Feb 2014 16:34:13 +0000 (11:34 -0500)]
slownacl's pure-python curve25519 lets us test ntor everywhere.
Improvement on f308adf8382bc7e61ea05a172, where we made the ntor
unit tests run everywhere... so long as a python curve25519 module
was installed. Now the unit tests don't require that module.
Nick Mathewson [Sun, 2 Feb 2014 20:45:00 +0000 (15:45 -0500)]
Move the friendly warning about TPROXY and root to EPERM time
I'm doing this because:
* User doesn't mean you're running as root, and running as root
doesn't mean you've set User.
* It's possible that the user has done some other
capability-based hack to retain the necessary privileges.
Nick Mathewson [Wed, 29 Jan 2014 20:17:05 +0000 (15:17 -0500)]
Rip out all of the v2 directory code.
The remaining vestige is that we continue to publish the V2dir flag,
and that, for the controller, we continue to emit v2 directory
formats when requested.
Nick Mathewson [Sat, 21 Dec 2013 15:15:09 +0000 (10:15 -0500)]
Fix a logic error in circuit_stream_is_being_handled.
When I introduced the unusable_for_new_circuits flag in 62fb209d837f3f551, I had a spurious ! in the
circuit_stream_is_being_handled loop. This made us decide that
non-unusable circuits (that is, usable ones) were the ones to avoid,
and caused it to launch a bunch of extra circuits.
Nick Mathewson [Wed, 18 Dec 2013 16:49:44 +0000 (11:49 -0500)]
Never allow OpenSSL engines to replace the RAND_SSLeay method
This fixes bug 10402, where the rdrand engine would use the rdrand
instruction, not as an additional entropy source, but as a replacement
for the entire userspace PRNG. That's obviously stupid: even if you
don't think that RDRAND is a likely security risk, the right response
to an alleged new alleged entropy source is never to throw away all
previously used entropy sources.
Thanks to coderman and rl1987 for diagnosing and tracking this down.
Nick Mathewson [Mon, 16 Dec 2013 18:00:15 +0000 (13:00 -0500)]
Avoid free()ing from an mmap on corrupted microdesc cache
The 'body' field of a microdesc_t holds a strdup()'d value if the
microdesc's saved_location field is SAVED_IN_JOURNAL or
SAVED_NOWHERE, and holds a pointer to the middle of an mmap if the
microdesc is SAVED_IN_CACHE. But we weren't setting that field
until a while after we parsed the microdescriptor, which left an
interval where microdesc_free() would try to free() the middle of
the mmap().
This patch also includes a regression test.
This is a fix for #10409; bugfix on 0.2.2.6-alpha.
The old behavior was that NULL matched only bridges without known
identities; the correct behavior is that NULL should match all
bridges (assuming that their addr:port matches).
Nick Mathewson [Mon, 9 Dec 2013 16:02:34 +0000 (11:02 -0500)]
Remove a check in channeltls.c that could never fail.
We were checking whether a 8-bit length field had overflowed a
503-byte buffer. Unless somebody has found a way to store "504" in a
single byte, it seems unlikely.
Fix for 10313 and 9980. Based on a pach by Jared L Wong. First found
by David Fifield with STACK.
David Fifield [Thu, 5 Dec 2013 04:56:28 +0000 (04:56 +0000)]
Set CREATE_NO_WINDOW in tor_spawn_background.
This flag prevents the creation of a console window popup on Windows. We
need it for pluggable transport executables--otherwise you get blank
console windows when you launch the 3.x browser bundle with transports
enabled.
The browser bundles that used Vidalia used to set this flag when
launching tor itself; it was apparently inherited by the pluggable
transports launched by tor. In the 3.x bundles, tor is launched by some
JavaScript code, which doesn't have the ability to set CREATE_NO_WINDOW.
tor itself is now being compiled with the -mwindows option, so that it
is a GUI application, not a console application, and doesn't show a
console window in any case. This workaround doesn't work for pluggable
transports, because they need to be able to write control messages to
stdout.
Nick Mathewson [Mon, 25 Nov 2013 15:53:37 +0000 (10:53 -0500)]
Restore prop198 behavior from 4677 patch
The previous commit from piet would have backed out some of proposal
198 and made servers built without the V2 handshake not use the
unrestricted cipher list from prop198.
Nick Mathewson [Mon, 18 Nov 2013 16:20:35 +0000 (11:20 -0500)]
Remove 'struct timeval now' that was shadowing 'struct timeval now'.
This was a mistake in the merge commit 7a2b30fe16eacc040b3dd11. It
would have made the CellStatistics code give completely bogus
results. Bug not in any released Tor.
projects / thirdparty / tor.git / log
