Merge branch 'tor-github/pr/718'

This commit is contained in:
David Goulet 2019-03-01 09:36:23 -05:00
commit 13e93bdfd5
7 changed files with 22 additions and 30 deletions

7
changes/ticket29542 Normal file
View File

@ -0,0 +1,7 @@
o Minor features (defense in depth):
- Tor now uses a fast cryptographically strong PRNG even for decisions
that we do not believe are security-sensitive. Previously, for
performance reasons, we had used a trivially predictable linear
congruential generator algorithm for certain load-balancing and
statistical sampling decisions. Now we use our fast RNG in those cases.
Closes ticket 29542.

View File

@ -669,7 +669,7 @@ tor_init(int argc, char *argv[])
log_err(LD_BUG, "Unable to initialize OpenSSL. Exiting.");
return -1;
}
stream_choice_seed_weak_rng();
if (tor_init_libevent_rng() < 0) {
log_warn(LD_NET, "Problem initializing libevent RNG.");
}

View File

@ -34,7 +34,6 @@
#include "core/crypto/onion_crypto.h"
#include "core/or/or_circuit_st.h"
#include "lib/intmath/weakrng.h"
static void queue_pending_tasks(void);
@ -74,8 +73,6 @@ worker_state_free_void(void *arg)
static replyqueue_t *replyqueue = NULL;
static threadpool_t *threadpool = NULL;
static tor_weak_rng_t request_sample_rng = TOR_WEAK_RNG_INIT;
static int total_pending_tasks = 0;
static int max_pending_tasks = 128;
@ -109,7 +106,6 @@ cpu_init(void)
/* Total voodoo. Can we make this more sensible? */
max_pending_tasks = get_num_cpus(get_options()) * 64;
crypto_seed_weak_rng(&request_sample_rng);
}
/** Magic numbers to make sure our cpuworker_requests don't grow any
@ -235,9 +231,10 @@ should_time_request(uint16_t onionskin_type)
* sample */
if (onionskins_n_processed[onionskin_type] < 4096)
return 1;
/** Otherwise, measure with P=1/128. We avoid doing this for every
* handshake, since the measurement itself can take a little time. */
return tor_weak_random_one_in_n(&request_sample_rng, 128);
return crypto_fast_rng_one_in_n(get_thread_fast_rng(), 128);
}
/** Return an estimate of how many microseconds we will need for a single

View File

@ -94,8 +94,6 @@
#include "feature/nodelist/routerinfo_st.h"
#include "core/or/socks_request_st.h"
#include "lib/intmath/weakrng.h"
static edge_connection_t *relay_lookup_conn(circuit_t *circ, cell_t *cell,
cell_direction_t cell_direction,
crypt_path_t *layer_hint);
@ -134,9 +132,6 @@ uint64_t stats_n_relay_cells_delivered = 0;
* reached (see append_cell_to_circuit_queue()) */
uint64_t stats_n_circ_max_cell_reached = 0;
/** Used to tell which stream to read from first on a circuit. */
static tor_weak_rng_t stream_choice_rng = TOR_WEAK_RNG_INIT;
/**
* Update channel usage state based on the type of relay cell and
* circuit properties.
@ -2180,12 +2175,6 @@ circuit_resume_edge_reading(circuit_t *circ, crypt_path_t *layer_hint)
circ, layer_hint);
}
void
stream_choice_seed_weak_rng(void)
{
crypto_seed_weak_rng(&stream_choice_rng);
}
/** A helper function for circuit_resume_edge_reading() above.
* The arguments are the same, except that <b>conn</b> is the head
* of a linked list of edge streams that should each be considered.
@ -2237,7 +2226,8 @@ circuit_resume_edge_reading_helper(edge_connection_t *first_conn,
int num_streams = 0;
for (conn = first_conn; conn; conn = conn->next_stream) {
num_streams++;
if (tor_weak_random_one_in_n(&stream_choice_rng, num_streams)) {
if (crypto_fast_rng_one_in_n(get_thread_fast_rng(), num_streams)) {
chosen_stream = conn;
}
/* Invariant: chosen_stream has been chosen uniformly at random from

View File

@ -94,8 +94,6 @@ const uint8_t *decode_address_from_payload(tor_addr_t *addr_out,
int payload_len);
void circuit_clear_cell_queue(circuit_t *circ, channel_t *chan);
void stream_choice_seed_weak_rng(void);
circid_t packed_cell_get_circid(const packed_cell_t *cell, int wide_circ_ids);
#ifdef RELAY_PRIVATE
@ -126,4 +124,3 @@ STATIC int connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ,
#endif /* defined(RELAY_PRIVATE) */
#endif /* !defined(TOR_RELAY_H) */

View File

@ -68,6 +68,15 @@ unsigned crypto_fast_rng_get_uint(crypto_fast_rng_t *rng, unsigned limit);
uint64_t crypto_fast_rng_get_uint64(crypto_fast_rng_t *rng, uint64_t limit);
double crypto_fast_rng_get_double(crypto_fast_rng_t *rng);
/**
* Using the fast_rng <b>rng</b>, yield true with probability
* 1/<b>n</b>. Otherwise yield false.
*
* <b>n</b> must not be zero.
**/
#define crypto_fast_rng_one_in_n(rng, n) \
(0 == (crypto_fast_rng_get_uint((rng), (n))))
crypto_fast_rng_t *get_thread_fast_rng(void);
#ifdef CRYPTO_PRIVATE

View File

@ -59,9 +59,6 @@ struct threadpool_s {
* <b>p</b> is work[p]. */
work_tailq_t work[WORKQUEUE_N_PRIORITIES];
/** Weak RNG, used to decide when to ignore priority. */
tor_weak_rng_t weak_rng;
/** The current 'update generation' of the threadpool. Any thread that is
* at an earlier generation needs to run the update function. */
unsigned generation;
@ -238,7 +235,7 @@ worker_thread_extract_next_work(workerthread_t *thread)
this_queue = &pool->work[i];
if (!TOR_TAILQ_EMPTY(this_queue)) {
queue = this_queue;
if (! tor_weak_random_one_in_n(&pool->weak_rng,
if (! crypto_fast_rng_one_in_n(get_thread_fast_rng(),
thread->lower_priority_chance)) {
/* Usually we'll just break now, so that we can get out of the loop
* and use the queue where we found work. But with a small
@ -555,11 +552,6 @@ threadpool_new(int n_threads,
for (i = WORKQUEUE_PRIORITY_FIRST; i <= WORKQUEUE_PRIORITY_LAST; ++i) {
TOR_TAILQ_INIT(&pool->work[i]);
}
{
unsigned seed;
crypto_rand((void*)&seed, sizeof(seed));
tor_init_weak_random(&pool->weak_rng, seed);
}
pool->new_thread_state_fn = new_thread_state_fn;
pool->new_thread_state_arg = arg;