diff options
| -rw-r--r-- | ChangeLog | 3 | ||||
| -rw-r--r-- | src/or/circuituse.c | 10 | ||||
| -rw-r--r-- | src/or/directory.c | 11 | ||||
| -rw-r--r-- | src/or/or.h | 4 | ||||
| -rw-r--r-- | src/or/router.c | 3 | ||||
| -rw-r--r-- | src/or/routerlist.c | 45 |
6 files changed, 53 insertions, 23 deletions
@@ -10,6 +10,9 @@ Changes in version 0.2.0.1-alpha - 2007-??-?? especially on platforms where malloc() is inefficient. - Stop reading on edge connections when their corresponding circuit buffers are full; start again as the circuits empty out. + - Make PreferTunneledDirConns and TunnelDirConns work even when + we have no cached directory info. This means Tor clients can now + do all of their connections protected by TLS. o Security fixes: - Directory authorities now call routers stable if they have an diff --git a/src/or/circuituse.c b/src/or/circuituse.c index fd0e609d2..8b3e1a8f1 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -91,10 +91,18 @@ circuit_is_acceptable(circuit_t *circ, edge_connection_t *conn, log_debug(LD_CIRC,"Skipping one-hop circuit."); return 0; } + tor_assert(conn->chosen_exit_name); + if (build_state->chosen_exit) { + char digest[DIGEST_LEN]; + if (hexdigest_to_digest(conn->chosen_exit_name, digest) < 0 || + memcmp(digest, build_state->chosen_exit->identity_digest, + DIGEST_LEN)) + return 0; /* this is a circuit to somewhere else */ + } } else { if (conn->socks_request->command == SOCKS_COMMAND_CONNECT_DIR) { /* don't use three-hop circuits -- that could hurt our anonymity. */ - log_debug(LD_CIRC,"Skipping multi-hop circuit for CONNECT_DIR."); +// log_debug(LD_CIRC,"Skipping multi-hop circuit for CONNECT_DIR."); return 0; } } diff --git a/src/or/directory.c b/src/or/directory.c index d21882732..e768f1d00 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -248,7 +248,8 @@ directory_initiate_command_routerstatus(routerstatus_t *status, tor_inet_ntoa(&in, address_buf, sizeof(address_buf)); address = address_buf; } - directory_initiate_command(address, status->addr, status->dir_port, + directory_initiate_command(address, status->addr, + status->or_port, status->dir_port, status->version_supports_begindir, status->identity_digest, purpose, private_connection, resource, @@ -365,7 +366,8 @@ connection_dir_download_routerdesc_failed(dir_connection_t *conn) * <b>digest</b>. */ void directory_initiate_command(const char *address, uint32_t addr, - uint16_t dir_port, int supports_begindir, + uint16_t or_port, uint16_t dir_port, + int supports_begindir, const char *digest, uint8_t purpose, int private_connection, const char *resource, const char *payload, size_t payload_len) @@ -373,7 +375,8 @@ directory_initiate_command(const char *address, uint32_t addr, dir_connection_t *conn; or_options_t *options = get_options(); int want_to_tunnel = options->TunnelDirConns && supports_begindir && - router_get_by_digest(digest); + !private_connection && or_port && + fascist_firewall_allows_address_or(addr, or_port); tor_assert(address); tor_assert(addr); @@ -414,7 +417,7 @@ directory_initiate_command(const char *address, uint32_t addr, /* set up conn so it's got all the data we need to remember */ conn->_base.addr = addr; - conn->_base.port = dir_port; + conn->_base.port = want_to_tunnel ? or_port : dir_port; conn->_base.address = tor_strdup(address); memcpy(conn->identity_digest, digest, DIGEST_LEN); diff --git a/src/or/or.h b/src/or/or.h index a61f33a34..ed89e5cc8 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2487,7 +2487,8 @@ int connection_dir_finished_flushing(dir_connection_t *conn); int connection_dir_finished_connecting(dir_connection_t *conn); void connection_dir_request_failed(dir_connection_t *conn); void directory_initiate_command(const char *address, uint32_t addr, - uint16_t dir_port, int supports_begindir, + uint16_t or_port, uint16_t dir_port, + int supports_begindir, const char *digest, uint8_t purpose, int private_connection, const char *resource, const char *payload, size_t payload_len); @@ -3021,6 +3022,7 @@ routerinfo_t *router_choose_random_node(const char *preferred, int weight_for_exit); routerinfo_t *router_get_by_nickname(const char *nickname, int warn_if_unnamed); +int hexdigest_to_digest(const char *hexdigest, char *digest); routerinfo_t *router_get_by_hexdigest(const char *hexdigest); routerinfo_t *router_get_by_digest(const char *digest); signed_descriptor_t *router_get_by_descriptor_digest(const char *digest); diff --git a/src/or/router.c b/src/or/router.c index ad7ad96a2..0dfe62d62 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -507,7 +507,8 @@ consider_testing_reachability(int test_or, int test_dir) CONN_TYPE_DIR, me->addr, me->dir_port, DIR_PURPOSE_FETCH_SERVERDESC)) { /* ask myself, via tor, for my server descriptor. */ - directory_initiate_command(me->address, me->addr, me->dir_port, + directory_initiate_command(me->address, me->addr, + me->or_port, me->dir_port, 0, me->cache_info.identity_digest, DIR_PURPOSE_FETCH_SERVERDESC, 1, "authority", NULL, 0); diff --git a/src/or/routerlist.c b/src/or/routerlist.c index b1efe89ea..0dfa4dbca 100644 --- a/src/or/routerlist.c +++ b/src/or/routerlist.c @@ -574,16 +574,15 @@ router_pick_directory_server_impl(int requireother, int fascistfirewall, is_trusted = router_digest_is_trusted_dir(status->identity_digest); if (for_v2_directory && !(status->is_v2_dir || is_trusted)) continue; - if (fascistfirewall && - prefer_tunnel && + if (prefer_tunnel && status->version_supports_begindir && - router_get_by_digest(status->identity_digest) && - fascist_firewall_allows_address_or(status->addr, status->or_port)) + (!fascistfirewall || + fascist_firewall_allows_address_or(status->addr, status->or_port))) smartlist_add(is_trusted ? trusted_tunnel : is_overloaded ? overloaded_tunnel : tunnel, status); - else if (!fascistfirewall || (fascistfirewall && + else if (!fascistfirewall || fascist_firewall_allows_address_dir(status->addr, - status->dir_port))) + status->dir_port)) smartlist_add(is_trusted ? trusted_direct : is_overloaded ? overloaded_direct : direct, status); }); @@ -652,17 +651,14 @@ router_pick_trusteddirserver_impl(authority_type_t type, continue; if (requireother && me && router_digest_is_me(d->digest)) continue; - - if (fascistfirewall && - prefer_tunnel && + if (prefer_tunnel && d->or_port && - router_get_by_digest(d->digest) && - fascist_firewall_allows_address_or(d->addr, d->or_port)) + (!fascistfirewall || + fascist_firewall_allows_address_or(d->addr, d->or_port))) smartlist_add(is_overloaded ? overloaded_tunnel : tunnel, &d->fake_status.status); - else if (!fascistfirewall || (fascistfirewall && - fascist_firewall_allows_address_dir(d->addr, - d->dir_port))) + else if (!fascistfirewall || + fascist_firewall_allows_address_dir(d->addr, d->dir_port)) smartlist_add(is_overloaded ? overloaded_direct : direct, &d->fake_status.status); }); @@ -1379,6 +1375,21 @@ router_digest_is_trusted_dir(const char *digest) return 0; } +/** If hexdigest is correctly formed, base16_decode it into + * digest, which must have DIGEST_LEN space in it. + * Return 0 on success, -1 on failure. + */ +int +hexdigest_to_digest(const char *hexdigest, char *digest) +{ + if (hexdigest[0]=='$') + ++hexdigest; + if (strlen(hexdigest) < HEX_DIGEST_LEN || + base16_decode(digest,DIGEST_LEN,hexdigest,HEX_DIGEST_LEN) < 0) + return -1; + return 0; +} + /** Return the router in our routerlist whose hexadecimal key digest * is <b>hexdigest</b>. Return NULL if no such router is known. */ routerinfo_t * @@ -1394,8 +1405,7 @@ router_get_by_hexdigest(const char *hexdigest) if (hexdigest[0]=='$') ++hexdigest; len = strlen(hexdigest); - if (len < HEX_DIGEST_LEN || - base16_decode(digest,DIGEST_LEN,hexdigest,HEX_DIGEST_LEN) < 0) + if (hexdigest_to_digest(hexdigest, digest) < 0) return NULL; ri = router_get_by_digest(digest); @@ -3189,6 +3199,9 @@ add_trusted_dir_server(const char *nickname, const char *address, ent->fake_status.status.dir_port = ent->dir_port; ent->fake_status.status.or_port = ent->or_port; + if (ent->or_port) + ent->fake_status.status.version_supports_begindir = 1; + smartlist_add(trusted_dir_servers, ent); router_dir_info_changed(); } |