Commit Graph

37499 Commits

Author SHA1 Message Date
David Goulet
f748a497c7 Merge branch 'ticket40476_045_01' into ticket40476_046_01 2021-10-19 09:48:13 -04:00
David Goulet
db297a177e hs: Improve warning for bad service version
Now that we don't have version 2, it gives us:

  [warn] HiddenServiceVersion must be between 3 and 3, not 2.

This commit changes it to:

  [warn] HiddenServiceVersion must be 3, not 2.

Part of #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19 09:36:14 -04:00
David Goulet
2a4a0c9012 changes: Add file for ticket 40476
Closes #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19 09:36:14 -04:00
David Goulet
ce1f1dcbe5 test: Don't run HSv2 Chutney test networks
Part of #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19 09:36:14 -04:00
David Goulet
df8ff6f1ac test: Fix unit tests after disabling version 2
Some tests were removed because they were testing something not usable
anymore.

Some tests remains to make sure that things are indeed disabled.

Part of #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19 09:36:14 -04:00
David Goulet
044eadae65 hs-v2: Disable version 2 HSPOST and HSFETCH command
Part of #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19 09:20:53 -04:00
David Goulet
a7d28da272 hs-v2: Disable version 2 directory
Relay do not accept both stores and lookups of version 2 descriptor.
This effectively disable version 2 HSDir supports for relays.

Part of #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19 09:16:13 -04:00
David Goulet
e284b9f779 hs-v2: Disable version 2 introduction point
Upon receiving a v2 introduction request, the relay will close the
circuit and send back a tor protocol error.

Part of #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19 09:13:08 -04:00
David Goulet
471149b651 hs-v2: Disable version 2 service
The minimum service version is raised from 2 to 3 which effectively
disable loading or creating an onion service v2.

As for ADD_ONION, for version 2, a 551 error is returned:

  "551 Failed to add Onion Service"

Part of #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19 09:11:12 -04:00
David Goulet
ed4d6a0030 hs-v2: Disable SOCKS connection for v2 addresses
This effectively turns off the ability of tor to use HSv2 as a client by
invalidating the v2 onion hostname passed through a SOCKS request.

Part of #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19 09:08:05 -04:00
David Goulet
ce5b240c19 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-10-06 15:45:19 -04:00
David Goulet
adcb094cb6 Merge branch 'tor-gitlab/mr/392' into maint-0.4.5 2021-10-06 15:45:13 -04:00
David Goulet
a160a9ec30 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-10-06 15:41:17 -04:00
David Goulet
065ebd10c2 Merge branch 'tor-gitlab/mr/393' into maint-0.4.5 2021-10-06 15:41:12 -04:00
David Goulet
474c85a98d Merge branch 'maint-0.4.5' into maint-0.4.6 2021-10-06 15:35:43 -04:00
David Goulet
a53c949dcf Merge branch 'tor-gitlab/mr/420' into maint-0.4.5 2021-10-06 15:35:30 -04:00
David Goulet
82b7939d19 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-10-06 13:25:02 -04:00
David Goulet
602dcd8e37 hs-v2: Only log once the connection warning to v2
Closes #40474

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-06 13:22:02 -04:00
David Goulet
f0d1240a07 hs-v2: Only log once the connection warning to v2
Closes #40474

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-06 13:20:22 -04:00
David Goulet
ef7a64e3b8 hs-v2: Disable version 2 HSPOST and HSFETCH command
Part of #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-09-30 11:18:08 -04:00
David Goulet
59bae7cbee hs-v2: Disable version 2 directory
Relay do not accept both stores and lookups of version 2 descriptor.
This effectively disable version 2 HSDir supports for relays.

Part of #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-09-30 10:46:17 -04:00
David Goulet
ff3ac02702 hs-v2: Disable version 2 introduction point
Upon receiving a v2 introduction request, the relay will close the
circuit and send back a tor protocol error.

Part of #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-09-30 10:40:19 -04:00
David Goulet
765bdb9c33 hs-v2: Disable version 2 service
The minimum service version is raised from 2 to 3 which effectively
disable loading or creating an onion service v2.

As for ADD_ONION, for version 2, a 551 error is returned:

  "551 Failed to add Onion Service"

Part of #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-09-30 10:38:08 -04:00
David Goulet
13b2b1108f hs-v2: Disable SOCKS connection for v2 addresses
This effectively turns off the ability of tor to use HSv2 as a client by
invalidating the v2 onion hostname passed through a SOCKS request.

Part of #40476

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-09-30 10:26:37 -04:00
David Goulet
f728e09ebe Merge branch 'maint-0.4.5' into maint-0.4.6 2021-09-13 13:34:48 -04:00
David Goulet
0dbb2f53b9 Merge branch 'maint-0.3.5' into maint-0.4.5 2021-09-13 13:34:44 -04:00
Alexander Færøy
fcef8e3f75 Only check for bindable ports if we are unsure if it will fail.
We currently assume that the only way for Tor to listen on ports in the
privileged port range (1 to 1023), on Linux, is if we are granted the
NET_BIND_SERVICE capability. Today on Linux, it's possible to specify
the beginning of the unprivileged port range using a sysctl
configuration option. Docker (and thus the CI service Tor uses) recently
changed this sysctl value to 0, which causes our tests to fail as they
assume that we should NOT be able to bind to a privileged port *without*
the NET_BIND_SERVICE capability.

In this patch, we read the value of the sysctl value via the /proc/sys/
filesystem iff it's present, otherwise we assume the default
unprivileged port range begins at port 1024.

See: tor#40275
2021-09-13 18:33:27 +02:00
Alexander Færøy
12b64845ae Use Debian bullseye for our hardened build. 2021-09-13 18:13:10 +02:00
Alexander Færøy
84d6f977e7 Force amd64 for CI builds. 2021-09-13 18:08:49 +02:00
David Goulet
cac612af42 dir: Do not flag non-running failing HSDir
When a directory request fails, we flag the relay as non Running so we
don't use it anymore.

This can be problematic with onion services because there are cases
where a tor instance could have a lot of services, ephemeral ones, and
keeps failing to upload descriptors, let say due to a bad network, and
thus flag a lot of nodes as non Running which then in turn can not be
used for circuit building.

This commit makes it that we never flag nodes as non Running on a onion
service directory request (upload or fetch) failure as to keep the
hashring intact and not affect other parts of tor.

Fortunately, the onion service hashring is _not_ selected by looking at
the Running flag but since we do a 3-hop circuit to the HSDir, other
services on the same instance can influence each other by removing nodes
from the consensus for path selection.

This was made apparent with a small network that ran out of nodes to
used due to rapid succession of onion services uploading and failing.
See #40434 for details.

Fixes #40434

Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-08-17 13:27:14 -04:00
David Goulet
2be49cdbe5 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-08-16 16:34:39 -04:00
David Goulet
e3382afccd Bump version to -dev
Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-08-16 16:34:33 -04:00
David Goulet
da9ff3936d Merge branch 'maint-0.3.5' into maint-0.4.5 2021-08-16 16:34:19 -04:00
David Goulet
18f2a7c012 Bump version to -dev
Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-08-16 16:34:10 -04:00
David Goulet
a8ce645ab0 Bump version to -dev
Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-08-16 16:33:58 -04:00
Alexander Færøy
46ad2240de Merge branch 'maint-0.4.5' into maint-0.4.6 2021-08-16 15:28:22 +00:00
Alexander Færøy
903c578119 Always teardown capture of logs in CAPTURE().
This will hopefully solve an issue where our gmtime related tests are
failing on 32-bit builds.
2021-08-16 15:27:38 +00:00
Alexander Færøy
d1c781e67e Merge branch 'maint-0.4.5' into maint-0.4.6 2021-08-16 13:58:32 +00:00
Alexander Færøy
78712990ab Merge branch 'maint-0.3.5' into maint-0.4.5 2021-08-16 13:58:32 +00:00
Alexander Færøy
b07cd2ee90 Use debian:buster instead of debian:stable for now. 2021-08-16 13:57:56 +00:00
Nick Mathewson
6a01c34bb8 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-08-16 09:51:27 -04:00
Nick Mathewson
b2d6fed3e9 Disable message checking for some 32-bit tests about timegm failure.
Since we merged 40383, we don't expect these to give the same
warning on every platform.
2021-08-16 09:48:08 -04:00
Nick Mathewson
fd38609ae2 Make the version 0.4.6.7, not 0.4.6.7-dev. 2021-08-16 08:21:04 -04:00
Nick Mathewson
df6a92dcc3 Merge branch 'maint-0.4.5' into maint-0.4.6
"ours" to avoid version bump
2021-08-16 08:19:17 -04:00
Nick Mathewson
1ec4c7b34a Make the version 0.4.5.10, not 0.4.5.10-dev. 2021-08-16 08:18:57 -04:00
Nick Mathewson
1667e122de Merge branch 'maint-0.3.5' into maint-0.4.5
"ours" to avoid version bump
2021-08-16 08:18:09 -04:00
Nick Mathewson
2984fba97a Make the version 0.3.6.16, not 0.3.6.16-dev. 2021-08-16 08:17:59 -04:00
David Goulet
70e249123a Merge branch 'maint-0.4.5' into maint-0.4.6 2021-08-13 09:46:31 -04:00
David Goulet
ca249131b0 Merge branch 'maint-0.3.5' into maint-0.4.5 2021-08-13 09:44:53 -04:00
David Goulet
041a0a362f Update version to 0.3.5.16
Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-08-13 09:43:44 -04:00