nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-11 21:23:35 +01:00
Code Issues Packages Projects Releases Wiki Activity
37,754 Commits 53 Branches 631 Tags 130 MiB
809b636b6e
Commit Graph

27480 Commits

Author SHA1 Message Date
Nick Mathewson
1ec4c7b34a Make the version 0.4.5.10, not 0.4.5.10-dev. 2021-08-16 08:18:57 -04:00
Nick Mathewson
2984fba97a Make the version 0.3.6.16, not 0.3.6.16-dev. 2021-08-16 08:17:59 -04:00
David Goulet
041a0a362f Update version to 0.3.5.16 
Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-08-13 09:43:44 -04:00
David Goulet
685b3e4383 Update version to 0.4.5.10 
Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-08-13 09:42:52 -04:00
David Goulet
07c417b207 Update version to 0.4.6.7 
Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-08-13 09:42:26 -04:00
David Goulet
4252744788 Merge branch 'maint-0.4.6' 2021-08-12 12:13:26 -04:00
David Goulet
4c3c40e70c Merge branch 'maint-0.4.5' into maint-0.4.6 2021-08-12 12:13:26 -04:00
David Goulet
33abeeab94 Merge branch 'maint-0.3.5' into maint-0.4.5 2021-08-12 12:13:25 -04:00
Alexander Færøy
eca5b62213 Update GeoIP files to match IPFire location DB as per 2021/08/12. 2021-08-12 15:38:11 +00:00
Alexander Færøy
2160697d14 Merge branch 'maint-0.4.6' into main 2021-08-11 13:15:59 +00:00
Alexander Færøy
b8660e384f Merge branch 'maint-0.4.5' into maint-0.4.6 2021-08-11 13:15:59 +00:00
Alexander Færøy
81635ec577 Merge branch 'maint-0.3.5' into maint-0.4.5 2021-08-11 13:15:58 +00:00
Alexander Færøy
7e0971d868 Merge remote-tracking branch 'tor-gitlab/mr/417' into maint-0.3.5 2021-08-11 13:15:35 +00:00
Alexander Færøy
ac254d5334 Merge branch 'maint-0.4.6' into main 2021-08-11 13:14:26 +00:00
Alexander Færøy
e3c2179f25 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-08-11 13:14:26 +00:00
Alexander Færøy
c48d1c3f7c Merge branch 'maint-0.3.5' into maint-0.4.5 2021-08-11 13:14:26 +00:00
George Kadianakis
fe5a9db1e6 Disable ed25519-donna's batch verification. 
Fixes bug 40078.

As reported by hdevalence our batch verification logic can cause an assert
crash.

The assert happens because when the batch verification of ed25519-donna fails,
the code in `ed25519_checksig_batch()` falls back to doing a single
verification for each signature.

The crash occurs because batch verification failed, but then all signatures
individually verified just fine.

That's because batch verification and single verification use a different
equation which means that there are sigs that can pass single verification
but fail batch verification.

Fixing this would require modding ed25519-donna which is not in scope for
this ticket, and will be soon deprecated in favor of arti and
ed25519-dalek, so my branch instead removes batch verification.
 2021-08-11 13:14:05 +00:00
David Goulet
0e60b65f6c fallbackdir: Regenerate list 
New list for all stable releases.

Closes #40447

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-08-11 09:07:05 -04:00
David Goulet
399518da02 relay: Reduce streaming compression ratio from HIGH to LOW 
Fixes #40301

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-08-11 12:51:32 +00:00
David Goulet
70d8fb3eab relay: Reduce streaming compression ratio from HIGH to LOW 
Fixes #40301

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-08-11 12:47:20 +00:00
Mike Perry
5c3021be85 Make inbuf and outbuf len check params const 2021-07-30 12:57:31 -04:00
Mike Perry
a0368b3759 MAKEFILE: include new CC algs in makefile 2021-07-30 12:57:31 -04:00
Mike Perry
ed1e91ffc2 TOR_NOLA: Implement a pure BDP tracking CC alg 
How come no one ever named a congestion control algorithm after New Orleans?
 2021-07-30 12:57:31 -04:00
Mike Perry
663cd052b5 TOR_VEGAS: Implement Prop#324 TOR_VEGAS. 2021-07-30 12:57:30 -04:00
Mike Perry
33cd92922a TOR_WESTWOOD: Implement Prop#324 TOR_WESTWOOD 2021-07-30 12:57:30 -04:00
Mike Perry
66f975e4e6 Prop#324: Free congestion control object on circ and cpath 2021-07-30 12:57:30 -04:00
Mike Perry
4d8c6d5701 Prop#324: Hook up CC window checks for relay cell packaging 2021-07-30 12:57:30 -04:00
Mike Perry
31fc7591a1 Prop#324: Hook up CC algs to main sendme callpoints 2021-07-30 12:57:30 -04:00
Mike Perry
802d7e22c5 Prop#324: Add congestion control state to structs 2021-07-30 12:57:30 -04:00
Mike Perry
f1d0c2d826 Prop#324: Common RTT, BDP, and blocked channel signal support 2021-07-30 12:57:30 -04:00
George Kadianakis
4f68fe3e6c Merge branch 'vanguards-lite-dev-rebased' 2021-07-28 12:00:37 +03:00
George Kadianakis
72aa23a9fd circpad: Be smarter on when to send back STOP cells. 2021-07-22 15:03:56 +03:00
George Kadianakis
30a97d9bb3 Increase frequency of vg-lite callback to 15 minutes 2021-07-20 13:03:32 +03:00
Nick Mathewson
27d6b3ae7a Remove some needless includes 2021-07-12 15:53:56 -04:00
Nick Mathewson
c63541a0b0 Remove fuzz_hexdigest.c: It is already covered by other fuzzers 2021-07-12 15:42:32 -04:00
Nick Mathewson
45bb6ae60b Merge remote-tracking branch 'tor-gitlab/mr/407' 2021-07-12 15:41:12 -04:00
Nick Mathewson
a11a9bb3a0 test_hs_ob: initialize pointers to NULL 
This is an attempt to fix CID 1486280, where coverity warns us that,
if the tests failed, we might free() an uninitialized pointer.
 2021-07-12 15:04:43 -04:00
Nick Mathewson
1d9de2948b test_hs_control: initialize pointers to NULL 
This is an attempt to fix CID 1486276, where coverity warns us that,
if the tests failed, we might free() an uninitialized pointer.
 2021-07-12 14:59:29 -04:00
George Kadianakis
5949a70b58 Add stricter limits to the number of L2 nodes 2021-07-12 12:27:25 +03:00
George Kadianakis
7f701794e7 Add a switch to toggle the feature on/off 2021-07-12 12:22:58 +03:00
George Kadianakis
7ec9a68477 Service intro circuits are now 4-hop to avoid linkability by intro 
Now the circuits look like this:

	 client rend:   C -> G -> L2 -> Rend
	 client intro:  C -> G -> L2 -> M -> Intro
	 client hsdir:  C -> G -> L2 -> M -> HSDir
	 service rend:  C -> G -> L2 -> M -> Rend
	 service intro: C -> G -> L2 -> M -> Intro
	 service hsdir: C -> G -> L2 -> M -> HSDir
 2021-07-12 11:24:58 +03:00
George Kadianakis
9b464cdc36 Add layer2_guard_free() 2021-07-09 17:06:26 +03:00
George Kadianakis
a77727cdca Don't double-pick L2 nodes 2021-07-09 17:06:22 +03:00
Nick Mathewson
9b2d179d95 Merge remote-tracking branch 'tor-gitlab/mr/410' 2021-07-08 14:17:54 -04:00
George Kadianakis
8b026b4eee Merge remote-tracking branch 'tor-gitlab/mr/406' into maint-0.4.6 2021-07-07 13:04:24 +03:00
George Kadianakis
e79d73de9b Merge remote-tracking branch 'tor-gitlab/mr/406' 2021-07-07 13:02:11 +03:00
Cecylia Bocovich
16e517245b Update torrc to encourage use of BridgeDistribution 
Bridge operators should generally publish their descriptors except for
rare cases, and instead use the BridgeDistribution none setting to
prevent their bridge from being distributed by BridgeDB.
 2021-07-06 13:09:24 -04:00
George Kadianakis
8949317ecc Merge branch 'maint-0.4.6' 2021-07-06 13:52:16 +03:00
George Kadianakis
a522aabd3b Merge branch 'maint-0.4.5' into maint-0.4.6 2021-07-06 13:52:15 +03:00
George Kadianakis
4865eabd18 Merge remote-tracking branch 'tor-gitlab/mr/409' into maint-0.4.5 2021-07-06 13:51:58 +03:00
George Kadianakis
6aff048978 Merge branch 'maint-0.4.6' 2021-07-06 13:42:53 +03:00
George Kadianakis
167f3bc4ec Merge branch 'maint-0.4.5' into maint-0.4.6 2021-07-06 13:42:53 +03:00
George Kadianakis
98b9df61f6 Merge branch 'mr/395' into maint-0.4.5 2021-07-06 13:42:29 +03:00
Nick Mathewson
c1d96358d4 Use native timegm when available. 
Continue having a tor_gmtime_impl() unit test so that we can detect
any problems in our replacement function; add a new test function to
make sure that gmtime<->timegm are a round-trip on now-ish times.

This is a fix for bug #40383, wherein we ran into trouble because
tor_timegm() does not believe that time_t should include a count of
leap seconds, but FreeBSD's gmtime believes that it should.  This
disagreement meant that for a certain amount of time each day,
instead of calculating the most recent midnight, our voting-schedule
functions would calculate the second-most-recent midnight, and lead
to an assertion failure.

I am calling this a bugfix on 0.2.0.3-alpha when we first started
calculating our voting schedule in this way.
 2021-07-06 13:33:05 +03:00
George Kadianakis
1f87269cf4 Code improvements 2021-07-06 13:22:59 +03:00
Nick Mathewson
2bc02b2199 Suppress a clang 12 warning about "suspicious concatenation". 
My clang doesn't like it when we write code like this:

    char *list[] = {
       "abc",
       "def",
       "ghi"
       "jkl"
    }

It wonders whether we meant to put a comma between "ghi" and "jkl"
or not, and gives a warning.

To suppress this warning (since in this case, we did mean to omit
the comma), we just wrap the two strings in parentheses.

Closes #40426; bugfix on 0.4.0.4-rc.
 2021-07-01 13:03:19 -04:00
George Kadianakis
52c5b8aa12 Simplify cannibalization logic now that all HS is vanguards 
Co-authored-by: Mike Perry <mikeperry-git@torproject.org>
 2021-07-01 18:15:55 +03:00
George Kadianakis
9afd9d0940 Special vanguard L3 increased path length does not apply for vanguards-lite 
Co-authored-by: Mike Perry <mikeperry-git@torproject.org>
 2021-07-01 18:15:55 +03:00
George Kadianakis
0240c00929 Preemptive circuits for HSes should now be vanguard circuits 
Co-authored-by: Mike Perry <mikeperry-git@torproject.org>
 2021-07-01 18:15:55 +03:00
George Kadianakis
e23947716e Use L2 vanguards during path selection 
Co-authored-by: Mike Perry <mikeperry-git@torproject.org>
 2021-07-01 18:15:55 +03:00
George Kadianakis
314a6b42c5 Introduce vanguards-lite subsystem and some of its entry points 
Co-authored-by: Mike Perry <mikeperry-git@torproject.org>
 2021-07-01 18:15:55 +03:00
pedbap
66c5bbb435 Update fuzz_hexdigest.c 2021-07-01 14:37:05 +00:00
pedbap
cb178ab65c Update fuzz_address.c 2021-07-01 14:36:39 +00:00
pedbap
5066f5a608 Update fuzz_addressPTR.c 2021-07-01 14:36:06 +00:00
Nick Mathewson
e71db3a4be Merge remote-tracking branch 'tor-gitlab/mr/405' 2021-07-01 09:56:35 -04:00
pedbap
b31932dfcf Update include.am 2021-07-01 13:16:10 +00:00
Nick Mathewson
2758ae30b3 Bump to 0.4.6.6-dev 2021-06-30 12:01:21 -04:00
Nick Mathewson
2fff1fc835 Update version to 0.4.6.6. 2021-06-30 08:17:56 -04:00
pedbap
7257791874 Adding new fuzzing harnesses for Makefile 2021-06-29 19:31:08 +00:00
pedbap
ad3519c165 tor_addr_parse_PTR_name() isolated harness 2021-06-29 19:15:24 +00:00
pedbap
453ea20827 tor_addr_parse() fuzzing harness 2021-06-29 19:13:38 +00:00
pedbap
a0d65d8275 hexdigest_to_digest() isolated harness 2021-06-29 19:11:45 +00:00
David Goulet
e9edcea0ca Merge branch 'tor-gitlab/mr/275' 2021-06-29 10:55:46 -04:00
David Goulet
f2647295c0 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-06-29 10:41:36 -04:00
David Goulet
23451ef2fe Merge branch 'maint-0.4.6' 2021-06-29 10:41:36 -04:00
David Goulet
301ffb71a6 hs: Send back 0xF6 for a v2 onion address 
Fixes #40421

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-06-29 09:56:44 -04:00
Steven Engler
f944e46399 If TestingTorNetwork, skip perm check on the hs directory 2021-06-28 13:51:06 -04:00
Nick Mathewson
fce99957e2 Suppress strict-prototypes warning on NSS pk11pub.h header 
We already did this in a couple of places, but there are more that
we didn't get.  This is necessary for systems with versions of
NSS that don't do their prototypes properly.

Fixes #40409; bugfix on 0.3.5.1-alpha.
 2021-06-28 09:10:28 -04:00
George Kadianakis
2b97c1dd34 Merge remote-tracking branch 'tor-gitlab/mr/385' 2021-06-28 14:11:46 +03:00
Nick Mathewson
45c8d69cbb Merge branch 'maint-0.4.5' into maint-0.4.6 2021-06-26 10:04:38 -04:00
Nick Mathewson
45b5987115 Merge branch 'maint-0.4.6' 2021-06-26 10:04:38 -04:00
Alexander Færøy
83483bd4f6 Enable deterministic RNG for address set tests. 
This patch enables the deterministic RNG for address set tests,
including the tests which uses address set indirectly via the nodelist
API.

This should prevent random test failures in the highly unlikely case of
a false positive which was seen in tor#40419.

See: tpo/core/tor#40419.
 2021-06-25 16:43:10 +00:00
David Goulet
270398fa31 Merge branch 'maint-0.4.6' 2021-06-18 14:29:15 -04:00
Alexander Færøy
2c00ad36cd Fix compilation on systems with older compilers. 
This patch fixes a build error with GCC 7.x which doesn't seem to accept
const int's as constants in macro initialization.

See: tpo/core/tor#40410
 2021-06-18 18:14:07 +00:00
Nick Mathewson
d642da020e Merge remote-tracking branch 'tor-gitlab/mr/338' 2021-06-14 13:10:18 -04:00
Nick Mathewson
982829650c Merge remote-tracking branch 'tor-gitlab/mr/397' 2021-06-14 13:05:03 -04:00
Nick Mathewson
91aec8dbc1 Bump to 0.4.6.5-dev 2021-06-14 11:48:30 -04:00
Nick Mathewson
9085508310 Bump to 0.4.5.9-dev 2021-06-14 11:47:41 -04:00
Nick Mathewson
87492154e0 Bump to 0.3.5.15-dev 2021-06-14 11:45:30 -04:00
George Kadianakis
7034c8449d Implement fuzzing for superencrypted HSv3 desc layer 
Here is a corpus:

desc-auth-type x25519
desc-auth-ephemeral-key 68GrIdhTe01n7WfZroM+Uwqzd4N6GpFWgVfperanvDM=
auth-client viYu6HEs7bo ljriJfI9acOhbwhjksBvAg omzl9Hz/XK6fMdifuIAXiw
auth-client SNzxBNMmHiU Mh0Zv0GrGxjFaKr9OG1QNg 9xayJnQoEXsuakxolL54nQ
auth-client Ho28DFsBhTE tBB4ebOhBu95a+3dHEv+Fg XUkBvpJXerGUX/eS3uwXdQ
auth-client 7BHnYML5O20 eMm3Csm92XdR9Mt/Xzy/ug HrEx44IVpQlQBu7tcP4F2g
auth-client xsrAsjgWj/0 5QdhG282mmK35U5BCkqaMg Ops8Lgl+ASOXKnfii7egdA
auth-client 6FO1oPHXwmI mEl0Z5Pn8GLlCNH5xbUeWg 9610jM1OWyASws80exma6Q
auth-client MvOMOF2ynd0 t2TFwq3mj5ZKm8yH6wDEIg hM1wsvG4CTY8X1MLOInIIg
auth-client WJs5l92CN4Y vfmHF82nJ8qmGqJ/DLRTGg g9d51VyUEi9LOsmdQvaQJQ
auth-client 1TiTYG9rpDU xPJPjzHtQYmJTFm8zR1j9Q /Uv+1B5co/86sOKEGJzCqQ
auth-client ZBkeY2qXdTc ir85lASBZRF/pD4PQIK+EQ 2LxDABMvmv86KaNQqzNenQ
auth-client 1AOfLh0KtmI 2+yYUfy1BAKB+PKwMukTrA S1d6QTczWqADotn+yl+2aQ
auth-client xd2xsZiNr3A FWk/SsFrech49gODym+7gA 5ydb7Ji0e7yCNZFlVD4Q5Q
auth-client DQYYX5iSlGA VIV3wSGKIfK1GxF0xxm4dg wdH1bc2zm5dSvCVJX8ZzLg
auth-client 1rqVzmtYgGU aSQbgq+/sF93k5stnA+8KA aAWoQMV0VM262Znc7RCMxw
auth-client sx7Br+mYTp8 b/0rd+9e5Q1zGa79I1O41A jc1sm3lOfujPljWA09Q3ng
auth-client S4C/qS7s5N8 XtRzoNhqQGcrVaeTQqMk2A O4bBlq8d3gopBRMWkpuyeg
encrypted
-----BEGIN MESSAGE-----
BxzghAOjM4De6Z6eGTvBrTP2SJDdQOYV/u9qtvlFsa2FRQWk20Adv3zJ/AI10CQO
mUP4DNXM8FWQYGTvmD7wGz2/cXGjKwBXg1qO7zF5eP/D/My1sXsIfCcb41mkheNt
xn1I5eKXcnghtd4lw7OkPVjSb/Z+VARUMmf+0qSNgmHLgEVnAoGJsn8W8B4qtIay
4h4PuV0jPPlqJx6jMFOOEW72uqnfmqeNvClENXXW60xhnaxsf0up62fuW8ktu6Wf
lnX/lvTstBFZZQ8/XI1+G+BPf8TZf7mxu0WYVg1s/KWYasYMSw46as59nkqdq2Ii
qJnqHX/R20mWBhgpLse6wO0aNpky/rozEnikaPqyO1DShf6a6jXY8ADBg7spnK2/
h7sf1+F1xfi2dy2WGxc1EUMP1kTVUmbft7kOo2nA7+3YZwQuSJHaN/66HrzU2x5z
ayRUJ8+qDtfpEf17xthc/Uh253blFK96IoJJiqBfI6xt3IqOdHJq0OOC9zBbF6Rj
vKMsaxmc/nc6uOB2WePYSgkZ0qs/dRKBJs6+Ahn1KdGkadyd8mDKL86Oe8lncHdB
m/6sQjhKqFgngkCDOIlEJyWizqfN84AGqD5Zyxq0rbsN+9KLsHFfEbCRjgqjO5nS
FYSFtuKgCZl2gaYEslL1pIEYE6BD2Whjn/HWTRyWiULJr6SuavgcbxeNEQDuVCC+
fm0X7Z+qERaMAMR0vTMJK/NzT4GifrDpgmgbxc+34CtNBF5TriM8aXTNZZlsW00k
d0XRxFbbbtiT5VOaEHbny7R3MdTVutEc9E/BhLBvjSSrGX7vrryh6Oj++nthIIzm
F4M7I11S0TyA+UE06qF1C8rKmhcqU9MWy1SiccJ9KOWhJ5xwlsXBIID7wVygUhVl
ovzfKkDDPfRoBch6NdVkxNJx3gb63CUmC2TzfwOMh973nntMVzqqw9A7jYkro9ln
217kHUwMk3e83UgFL4nn7NCf3Kj0zhJ4jSfAsuQpV6e7dhzrlNya0lqrUsY2zFXP
xv8wUtg6Vo1KewgVQas4oElkgFjDN8RJ7uBAwfuE/b9NnYJoQd76G8DHei/1PHbu
tbtwN9I5RHaTvEOfetsJFnIAkCG6O4CQpzwHu1DdvEP4s6/el10b/4awBJ4VwOVZ
YHSe4X0DStTV4Cu6aLh5OvrOmGbieRj6HdGQ6syYCaEBTuxbBUUpjIAfVlReAIph
6aOrY6HNcCmeVmL5qm4dKr2XXOREsnUFuMqmfQuQd9pN3zlmS+RqCgSJuFrguFpd
mjo6UxZvbjE7yJjtCih38HRe5BaigP5RDRkXmiXjqJ4koLJpyjQh19k3BYGcdxUC
RCcYXydbGF7qHlnoaX9HnX7y6ZRsyKQpt91PMTGOUsB4fS8NhsqPpl2gdp4poLNs
+hqjWZJ3uuLotXBcgM39Dtq9tqqu9vM12T80UAfWnVEHrBphmukh49EhEr2sx/la
kAzRoTbLyTdlGVei8hI7/RtZIaIcOkzlhcFI5zmBlydyrv6/79vzt6WI/w9GVGpM
OuSM0NS2CDJ7Iw412nz3CV1pEXB551ZBmbme6NHUe4EtEsDbgkP1Z201H4j51yVz
wNoIksE5Bh5XRKuu4We5f9KZb+AEG9kxKJ5DbJk2YGJEQFTyfv0H68pl9urstPXD
aMQF806COe2uhGm5gV/skvPVTeEvStE3K8DxZgcWNcTMVk8ZjrUHNfguVVToP8hT
Fl4Iqo3r+JZEAGXnAbTpxUVC2Xxspf3jsT5xhUfB/NOexZxrXWnQZ+pscsbow0ba
GATtakD3TF2WBqq5WscmOex+lrJcBCWVIzVWdwi5ngAtm1S7efkJlFUvmi4OuYnN
RyZfxVIpoer8f2/xPXvxkOWFminDy5sFEvlh2/pnymfKOUV+CKih9ZApt+izlRJn
+sMIOW6Jhf/WYyjeN6KQpwi6CDpclQJXA1SVoOVVL5A3lotLjs0x7ThIcBoxCZBq
rFBhBu1gJgJ8guMySAHssIvhHHwXJsYEwzWCVAg/zIUXy4PLwIkgHApl+vGcldGv
Br5HNCuqQ2pD9z2RvzNneB/LrYB214i+BP2piO5HbmeJBhby93blGXVfQewQT6aF
dBlK8/jQM0rvb+LkmvQm2ypOttRpX2kyQXooJHYTTusaUr4jVmgngCvGtgqAQVqD
HULXfHWvugZbAh6dXF7gKnnsyDOWwAgy4OJRi8i0jCaZ8aWSFRUjeGKT26dg/ayB
U4QfMb8vL8tMdXVBfQLGcBgvrzQYrY69//pV6bX3SbLfUfWXV9eqUVWVPqVyPEwa
Tz/aGVnGv/dY8h2cVnrgSXJGlOO+mCwSl+k9nk7VcEaKYuNlaOP3ZlKJvVj1LefM
FODh4qTDBo5NkyfKu5fcZcOqDMBeGWXZzltE7CmvY7fOpDNMsuAoXYWI7q9gK82F
w+nS0tVFCIWYa9DgGMv9GKTOk4Ia9elkbWypdRE/4oz4QxmHsArEsK4gDI+wmcp7
/NsAZeuy96r2YDIUam4uASKOiAqrEfCv6B6cYctdYwZbAEXdo4fkGrCIjNRZmZGv
kcZzHzIymnAmKRTkPt/LQ7Rx27Qd/Vt++B3zt2ORFuopqowOP0ocGZtkm0daK3Fc
YDXMwIpf6Z8PwvvsG1bQHcSR+cUZi7vK7+hj/LGhMPafHM7HmFUbAxpJYr5CvR6y
V1pZQYltT8xWayCeMHlLAAg10RgDkqCnY4dHnrY4GdwI2O7Wpxomni7qVHMjn+cN
UTrd7EeVw+dxAIYosuqG7ua7ee3VGoOs+XMLrscAqHahfGbyYC+j+6Tow4qwWBdU
/W3NJXnRWaHTXFHllpClnxggPRQx4yPtgTOmBBVl/O0T6i4Bv0ygsJeZAqC3VmAJ
QodQTzGf2jwqsZf4uHKQa0EKGQvTGjFVgAFNpHmAuzyqh0b1pq5JeXiFERGsKC3j
xcJilq1XeIx4SL38YNuCxi4pnyJyLnGGHpNjdjeFO5lvgCaKPegsPo4hpNpTvBJ1
D7+o3E5CqxzjRt9kQmtwBbuH/SQX2T0x8aQ6vhwjj8ftDfw+FbjpMR9zfU0Lf8V7
UjVGIl2yiVBGScBZu1nSD83PxjFy3XdFtBYoU5OrlXwBEYQs91jwK7UCiGtjI2Ao
ZGkJaBd4AqP6voyJiGnC3LWFcmeMyzfExgiclQwfhFqqf762TX5JwG6xGqtdcNKS
k54LlcI/RfvJw3ncSs9YsodZr6Jz5irpRTHX5WwCrX9mLukP96SXo29bIXEZAqEr
ZxEcF0zlYE+km5bRfRCRcVVrScugCshSNLOdQp6fOAtHCl7rdQ/8Rz7oHuqieLVi
UldRsAmpk9fIfRLphXj4j24jRP0VtL/LoJwakWTa0xO8K7eBAMVITI+HgFfN4wSO
Yh1B+bGD5WKxFsWSgBMmW+YLF5ZtxVmmbg7wK2dIpJs4pjg2YO/MTO7SifJ9kjcb
bCc74Tjs5mLLGGjGCIoXfda6WXbt2it40XhFk2zUAcPPsgjbctftkaWph7JSZpmZ
fVcPqKdhmA1U0LA2XEOMTxGyCAeseH6pJXZm9LdBozc1CwyWP8XEDHHJf35vfPKY
JDe2PanFepIOHaoRTgE7ZkGWKzOIKlS0Ucr1ezVfcxiFgQUNM+MYXXbUz51BVVq1
Dulg4VvX104nt/ULijcfa/TsE+uklEnkyk1mhavH337NQg38XF4cAngNlUF4nSW/
j0jizbAtaSx1f7q6xqPm3zPRlHrGQizHXLyl+SLzDUVPOXbPwcoeev97YeeyB6h5
NBbIK9hmekNDmYIwI0bmlrg6IXhC5pyvRe8sQlV+9wBY2liF0M1mq5onW3a55afp
+ynxXfQucb1HxZLXvRIGMBgWSQ7HfIPASqSE90Vu6qQCfkOW5PDqONr4BM65V4+g
AYsVEgaosgHw9CF7yKgkvmZpToOtGpCHVcdUeeY2/rrQnAQeSy19gj/baJ+OKl6Q
i1EGU8Yqo2r0d4XDFp/eKgC4sv57qp1PwkYQ/HKqoelJ09IAZL2sQWc05BGwt1A0
11qDIEdkZBjzK3qUnY3QlOuoZtALZrnPg56SlF1RGDOPqbcF+3opqsvzBoiikh4V
WV5OUYjRDMUDLQqf/OkuktdYf5N3RcbYP0XsAvY0ZWG3Gp068b3p8peCpkDzrF9p
bQ2ZvS304tN7+p0hif3+JyZy5/sxl17RxTeg5I3mo2+J0ptQDYwF/WadONO8r7uU
YlRltFtQfyMzyVzHON4NHGjZh7dDGtWp0MGeHRBHQsC8bEChhvWme19VXhgZoWpl
dUIZkSuvRwiURXjhKbZrEdJbVmr9FX6zoyOahv3VnmcEARoR+umxzvo3hGQPbHyH
jTsQtSBjs75/9fCxcYmBWkh3JHVDVsCbV+z+5KZpk3m50J4Y1hC8hvepC9CaBqOM
DjfyXh58x1yKiueEbcjSWsRuF7CjcrYnFUBHOs9U1j9WytCI3fhOWPMgR4UZpGuU
WlcR1BXg1wYxX273xOS/jYn9MLAVlbRpPTUMIH9VRP+sc8+XaxKpJSCl4C+vcwNY
1YdKD2QiuoBJ3fXGtqMVRtn9eZvatSJuY9CnRKRbf0hWmFD4D5RkiwE0WkdtwoHR
uEXJ47RlF0/JDU1fY1mXBkq3usvB4Absy78qL06vh45xkk9bHbdf+7Ao1RQKmqiB
NL5XnjBu+YX535WG7t7Su3mTCJXYHvn72ATxry8yhSLgWqt81STkRwc14HmrOGG8
Gw7bz7y5vikj/rnPyr7ry+QRgNNDDayAqenAu2vEAzWir0RQC/iZ9rc/r7YQWGgL
Xrd4TQ6rTZePARhwB3VomnLDDvLvi2oq/jPzLKSYM2a7qj/vBSbJ/NnNaDW5Ccew
RjMI1lIHeedqYTVAW/CKoSEPcFSAzi/Ija0gcWLgX5xsFDGIYBepAX0KS9426kMu
0r/V66zmPMusMilqRTx7KW+jZMVxXVc2zClcdmohMmtjsbqLkczprfSbdGswMv9Q
I1ktHJHIRD0vPeZXnvKZsRKZw3sKb0ltZi33ZxCJFQPeGGtM5aAFthj6awcXy6Tt
DPUQdCU/vh1zmGRAX17/Xb0irfvN+GhQLEl42pzhigJXc/rCG3a4Na8wT+xAIZVf
WUI7hMslx5wA+iB4lrAjCq0YIrjINI/lHYpotXUZGmz5wz0jOciTmXMSx9du4cpk
fIQJfR+fr5tG3fjHMgSP+p+RewHkd/7RUAmHC2k3cuk5pCJvUVJrhUIqsi1fa0LG
GA0UU6Nr9tpYdNr1WkbKQjxTg0D//AXe61jmUS5XUU4AQf6zQVfN0TMtmuYeacbK
4r6Z1CSIRbsgcnL1BN8GSd4KddkCqSk941aJUCoX+77ou4t0btVSB9FnLKipigtE
E/Rpmv+81lA4fLiIag62/pcJ3uppsZ9aaHdR10SMmuCjAVLYHqhJfrHHn32dyqLK
UI8kEZJ6GQzHLUXcGbbdnk1Qm6JwO8TeF/oQvh9y9py+oAyFy0qzP2UeUMUI2yRQ
mlWSy+wX1DbVDQ3UHwJjWp65CgyYXuW8eCB0AbyF0kF4KGf7/7Ae7tEGbmYSm5MA
71z+Azxtv5gRyRb787V2dyo0wcmbRlL7iUBVXNM/czQo31tAZIwLc+lKNp0SPH6g
gJ2yX/GeDSFNAeEVUZ/f4KZIa7QQsnGWrUr+agSnQFkySmIjWYjwC/abJwah0v0d
ulwr3tECaaXtoWVdYXa3utEclBz9umBwMJ9MQCm4Kx7dTYUWFT3bMM/ESTkGPcfm
m+C4FsqFBs80WY0ududu50vTDSdJt1RqZ7Sg6DNH6acBvWyXOpT5mPJKUjnSFwyG
oVLgv0aDDx7lLZdCkhyz/Ff5LNmBgQsjGllPszJ2gTZxZ5LD68S4kUirQG/qtzlS
PGfDOC79SMZGgsoAnr4wV3RUTxsTVFlxVHsBMB+EXOFHAr3wHTVxUGBbGzxBlQ9w
I/jlu8LIIexXAU75HS5KCGGfg0Z7BLqEzqpMKqcBQC7BD7GnCXrDSQ2DCXnl7bLN
lIrQ/z2Y8AgSdED46R40MqyyN6CPPNiOCjONHZ30fLEXuEgCp4R/+x0WWsWpjGk2
Ydkc03cx/X6moUYxB5HTqTodBmAQuWMX0rxFDrnR0SWghWjdWth9gjd+dvZ82tt1
UMUywDPhcYchtUi2lnqnYJm5p00GN9Mk14MC5ZC5qP57IJVqxu0ktOMpks+CLPnz
qp9OBpI4sIzd0y0aUJC2Gd+E9aAhlREIiicyBDmxLdk1i37QeeCralI3eubLNmE+
CjDjD8t8FUGPpKglSD3lfLTqbp2TUvyWfvJC6ulFPNsAbeLHTnPnpyPQmWxhMNGt
h67B9tbYww2TvNwqIgmB4+YIR4/pSs15TpAqvuUvjpmRwGklqgiSmrQrlIxCxux/
mfsaL3KE97wm8BsaMpMkjUL7ByTIFhFZ/gHPTxaFpbqTZ4G+lABLgp3bIsB9Dl/P
ovoqX+qL2Mq9T0GrVJGfRBuA5hISw63hx5zdsj2Cj3A3khHPqR+GRN/rVYUuOpLm
z3v5pU/74vZRmNMAIhyhmweSEPNtyVkgSdgbFErqvhxN0om2Cd/7cWh2g5BXHyUL
PBr7ZkgfsE9TnuDH7Z0JoBqXJki+MO6nqz73oH2Mm86yxcXp6O/ieKTollrUJ3yQ
P6hLcEbYPzUV99del7Va5Wi0nn0wbRXCGVQdwY+iWc7pT+VVlncyg0TvLXi0OtOt
O8xbT2DAzVXxMwOsKV9ZgS/0dtwzwICpnTzBI/47V8GYhHbOUNTBPZ52GaXMeWlX
cuRGb0+7OkKWuriyOQ5z5xaASCVfqgnOwSZYiAk0gcDoK+JHdr64/sMoJhH87R4i
2TO90whkScgiGR7A06Ba42bT1nJtI6pxvzdB2b4BDAs2Lr2OdcB3BY1dtzKjFkw/
qfIw3F55UQwcs84ZEFQDAB/tmfNHajblDFpXR4N5QvU/PdWVWJUub7oNyhIX6ruu
ln4H7lpTUHJZ7jkr1qpnvkztZtHGlpJ0QdUHgyMYER1xU58Hg77yzIW3EdAa2PyK
1t4udKbQKChShlShIMzwzj57ss/69QobrpYAHYi6IRMaMUGBfipGBACK3yeXsXz0
c3Q2J5vI6QbxNsiJ5t7Ry1IqotbJcU7HND/yVUAUbEg5CpEDOSeSOW/ulyLuFxEV
lRTwIO/68BoIoR7umlP23/1N5OYzaBHhH2nThILBovHeJRXnGXSgeFfwSj7LIYEV
c1MdDSg/HzoADPXyEPLzqFzHRHeNiqEolmOPnFh0hRzbMZ0W5TQPDGWJdF21g816
vA0WW4UQjLM+vnX9kKKLA1ut+9JWk1dGKsmWtdWUDfJjUP/L6dS4OYEl6O6+SjM9
GcyGvHTiC5OpJllYpvELP/NjtTf9or8Bmruuga/axeOuS5ocYLK/sGRlmO6Z96da
QSlyGWEQAnM2D1cDmdd4CetPslOVIcQ41+coWCi2xg3UjO/bFK1CA4R1rb4ekXfs
s5U2XChyHhUPgl57y1r0ILXRXWJTJ0/F9hhu4aYQVFeIV/IuzJbmTKKkAcCOH6ys
qnu2BXz8Pm2tU10JFfRcuZ8rHuUyUErA40ESsLijON98GMwL4Rat9ZSCNS5hlK7y
yRJdr0ITp8oTbduAoulgWOvtcw1L87QBVojWz3cbhXra+WITirYuGNbzfmZn1WQM
kukEZUEHSypGOrHr1XiuY4Rw/DBaJSLyZ+VybEOfXqXkDBh5s1ayypBvzrzFZCIn
PJxIVsvrkhrpEbTJ9d7zLWjhOa9ZWw8lAubllbGm+7qCfdHmGsfBtvJdzx6zhB1Y
otL/PCis2XVTBEDJeB8pGqKFOZjNz8PC5qP+ymtAfy2ktl/u4HsFlxV7CsEKGYPm
p3LqnhPUy5M5gin4E4uPPyzzD2kcM3way49FKWUKlblQU0SyWtHRmMB3vcVmyT85
BRULXF7jgog7XR/EMltwQyJI6GcUCrnWZu+G0BEwXG+CsgCzE7assDavc1NSGLZM
rmzXiFFyfk7CE6lW2Lm+oWaFwKdvpmNZJFGGX8ZHRE9ZvkFMnfw9MYf2W7xa0jf7
k3c6X5wMuk9mznVtq5itNFVXh1mT1ujeWOiiqyH5UhQQjj6O+ZXt4gqt/jT6dd1i
jRuhhxaUGOlhpVBW/ySXhZ+HgOy9aCJ/bgjRGaqGixogk4f4rcgigHruwTpOQuDn
xDZ3Xns70S40WtHSYN+Gbl9nIh4yl78aNnA4FVtTAuLlVKEKlMJi9OBFuP5TEczG
+0HTwL/VPSCI+8FUZBhlz3YwecYq6dY5mS46+luPW+5Wl+5jtzb8V9oxVnRx2hQq
B5HJsM5FOOhHDHMXoCsevj7N/ufK7cU7Wbr0DkgYRwvb0ZJB5WYgcaQ0W7aduhGb
MQsandhP8Ajb2cmLobi3mHHPbcEkvjT8JP9Sim5xtfF+oCMMB5ByA5bI2aIFybZm
jX9e/V8wNgtpDKDVKPjB3+9dj5gU1N5JsrjQwQDB0kVRMWdpJCtD4hZ2+T/QE3SI
f8Rdk8pj8qBzRPbnhW6qsoWZdjMRC8qixZqHw4jol09UF7Ab9hjEF5ZDTfNGXwy8
/hz8su+mr8hhrlCrOF2vBYUayAA96zhbDWfg3Pdxo9bTn3/DmyAngL4J5Gu679xK
rWN4j7uQG4bzTa8WJb09/lW49UzWvmrz0c6/yexk3T//xDD067FafdnP5pYs4Cvp
rCoHpXbKjxx99DJmb5iXW0JRLSpFSCbf1HPHbmzST3minSXap5FCWDJcSgExKIJp
DXZ9rk0LMnQA74MWC5gjjM+5t0AHKuNRhJbQSwYWTKqeApXho53T/COlfDlSs2tb
Vz1Ia5z7IOfu1QheE93huNAHT3Ob+mSmUq782SqFPr6uwud/l5uP3HpcuwugdlFm
Jw8uBBOQ53W4lLbYfQYTVgieClVhmYMu7Ye0xYZ5B2jf714sjZRMa0LCbsyj58xH
uzs8ddNN1fLMzb0JRBE8JWj5PbxhA/sTwMkD7SnEMBUTtP0obmuQ982aTfyvQCH/
ve8OUPtYf5XWNv18mpR+h+riMt1Y8Eb6BJzTMFNWagMJAe3JV6A6upHroNFo2FxY
1XPRM1Rt0zKo7GD+oXnixfpl1aG8yqZhYo1ZC9buaHwH6zvM+xoiGD0iujeDtpVy
Vp6cAqqaGmrNwcPVBLc7hNKrJnbFKyhjL5/xp9j6jQov1aWQ8HsaNvh0p2ljmlwb
daTYZcwLgSgPna7HhiqnOSAmXZ7St/qe/b9TqBtIVzwzmtevgMyG98QV0syFP5X6
2Jc1g9733sTZp7njq4Cu07JhpICpinhLWR3nkODJbjk/mpLcQZgtV6W749AUo8oT
jRVEJ8MpCo1h0bVDxsRnA3DrMneD88L8/b10aHs+bPm1HKbCmT+kJAFaUQNa8JvJ
pReN37qTWvZCte7vaPAIP5cboATMu/J4t3izpm+YJoJlWcIegGx3kQ+17P4MbgDl
S93U4sOLvTk9+MoyPo9yGWU/zHgzcQ6wCFdzWMDRswuh+/4TJ2+yg6maq3iBtj39
gNLMR+sRgGGvYisqE9bfvNQy5IWrABBKcSBTXeTM1DmW6jv3TI8DoCzCbpjqcIwT
u2J+7k8wJEHPcAwnBjlyWphVvwNwM0cXqOnlJZ/4z7OGgjiNEem7TMuvxk+YkiXK
OzftdTjeIpzBwsGRP8/teMBpjS95M7GloKtxO+muBVxXbmsq8GBRC9vtNJ2Ma/xP
bXvd+7caytD3ob6ZfOzCpi4ZS8uByEfIMxlgZ5Sn3jhgEkcIU+YW9b3teMZOuWdA
QpDCoMpXaHVyRqwVV59JjmftiBnNBEo1/QzRj2UxRi7fHMfmNxL5LRM4CHSLUSCq
Y3A3pkxvBHUzemhynSFvtCPa8GHiUpe9so0V/2hlgaENAVELPjMlWytaYufRllgy
tUnCd32C5PrrmYzMKnxKRPXLcxLgziruJGSks9vIspoPk0pWgkZm+M9fRpJKlWHF
yT9OOGBW2yynw/yvXssxJmdUDxVcWL4uS2bZc4s0Zc6RSL9uQPjZVX0JLj+cXfx4
93Gn5bDhMgm+CGM6j3RiAAD7tT5V0sytNFjXd1A4U1u8yj3wzhKqOtZpDmuGUlMn
EODu7I5KtWxOTPThy7TecI5r+F/6KL+2MOtRhj2PmlT/Xed6PaAmDkQeiXGps08x
u0JIpuB61axvT4PAsKZNUd4ExbzNxRDAARUMgY8krpmyKZyHVFIQ19uHM2lGl9/i
h3PKlLHYI8RsHutHElzq+F5tWd5AA99LVRZX4axAVIQNiqRg8IMSoCwUaCCbjUMz
sJCo2t36GYk5S2BRnfrCqYoZRHw+ENYN0tDEMhXq1OqjvNHW3TzL3DsUhM6EZU5n
cRR4ynUvPqqWFphLefRW10vCtaW9roJQZyFYf9kd8xgW/BhcDNbTTaQ1U6xCHgX+
78DKee/NvY1WIEBR8X0iVk5XlSJb14eRtxNawXFyebVdmC/DiMNgnTBncMbePnZi
KCl1r5xqo7tSIoJ6Z0l6qINd89T9fcg9mujTVwsfQ+5/kdEy0Iw7CQcTOGvMaoPX
IAJlWSVeZ8eu8kmsD1Z8ewoPufMKiY4cPRAK5bCDgsrK6bAExOlCwPnNNM8Ym1Hz
aYFeGs5sW468Qww+Nbl5xcNFKtwUKZ6EebRHjwttiyTgCdAhv9wL1u2WFydWWgkG
rwUbNpSLKls+pijCeJAscvxzbZz96iOaYrY8IyzGBFwfgFAESfnzBc8SQjZzMzoO
vmYIRon2m/5w5AZA2IjQ4VxXJDK6XExD/ZLsxNXzMnROD++hE+s8DvPlRPmN4egF
gAzJs/9t7IyE/dDf7gSSBqzEBbwduD8ozzYHwELUc4ERdRzjEdBM0azT61g7Yilr
iT5Hy+2iw/pNwiqVOYiAbj2lwcoMlFZmdxviD4IMXdsNVWsCAVJL0PqIh1UDDb3z
Urv3idBJeSBuuFr6AFS6kAgvrwV/pEGoBoHuyii/rZxVugGKeuMynKEvSHuFNuQU
qIHcNgqQR34v2Ut5pQ1R8s7K3Rae/AhE5GncJa6FJmB9TF8MYMu9PlSZV/eGv8UL
IDWQ7sY3NdhZini//xtwPqIw29yOeZ0X6Aqsek9tfh21UwKSpHb7T+PwXYmoB+23
p3FXkP/rv4AGRq1xJqFYzKJvwsXqTFuNFWP74yhTg6rC90w2p5TeH1rJMAnv4u0L
hGtG/NL+D1Tzdf00TYAjno5Ia5dQJDd/eO+Ygqnhl6hAqGtS6r9JhIEXw1nQD7SC
lj96ZuKdUWO8rpIiAtvHAsn++xvMVPm/S1SwA8oE049iVwS8/eNNiMKoSlTlYc7o
pusBZQrVF4We4HHYFjysBbcXlvoXDd8LkZ8Nh63VQPnoIGNKH2U6aXCnQcJ8dZqO
DNxL4uyM4A578FUUR6vxqt2asnLHQ0Z7pPE4uqtz/WgbiHI/i2oHS8oe1clsifCw
3ZY33kflqLftkTNka1oiftDb0OqFLjkS7/AUorqHazw53gM3gqJY5EXA3Px9+nhu
NzxSK/t41JoCfgQJHMkIWb3yUcO4OFZeGCeAxIJY95hv/brt6/WNielXjNaohYvc
lsSUHEJRHwVxQmWK0LS+g13HAgOI7cNt3MA8sSkzTneHGFgEvmrSyb0wCEmushC9
mjQThvaxfQk9douA/cR2bHr7axXqv9vjztmxUr0a30a7lvLMBQbJmFtJJylW+tJe
v/vKNOB+9mK793cttr2JFnMhwUKFKWiFDQJtxw/eLQWY4BJ19Rs2x4BJgmV+u1jB
zR8uvxuArG/cqVEJsoC6uuSzhAWSwdvumijO6yuyWF6nHY6aAcy8dyFQlDFHAd+/
J05Lrbzj4N9lcI7hPalh0uMdERGvtUdT8QRm5ebP1zogYEkZk/1GOU29dMawkAt/
SWhp2yWdjLt8f5HQKu72vUF/yyTfzfdqQqJwfthP7+vp+sHDO85AMF45uU9g3pxW
IbXSbZ4fFGC1/41db/2GOHFgaheMXj0SIWHqQE1jtihr3BBBO4b3Ccz5QCnrn48J
8L+QRdh4a/cAx4ty/oHEiXwpSBBSFRl5+y2NijC8GITA5dRjCRWP+Y0zuTrJ7j1a
h+3kGs1kxqskhaEuhXnXyknGLjXrU+ewRGhHzP23o5betVhX+c1XjVqmJNZ5OPn/
wrqx/XwoIl/3F5lMmGDG9mPtyg0E227nKl9Sy0Vbwx2tu1unjOlzSCa7lpoD4TIX
PBJ5+Zb0CE6HEt3V0ec1m4uUe/xObAnzyr4UbzdqLaMy8vTcF/qsncXyPBjwqdjR
ReDAtt99bAPY4roPKGt8dgKUPE0t/XoY+SlmUp75TkZDXrOIJXpEW0GpLPf53T+W
Ex3KtfLAnZzrw8+dIageY7IgoQ85h3sYE7uEI8QlcO/o4udqUzTp4Sn4sWvdTLrx
W7ImvK2rsU5ubVdsEaFKM7+7nxGn2JyMpIWFz0SbP34CkXHhrXxyRD+GhMIDHFxV
uBnZnjJsw+ooIm1rL4I7/VMWEwmVegreT6w9Gsmb5igw+zu9v2YBgTOhysA9XZd4
7O3VjqKkhTXcBqdpRWuz8gPQ+4rfwij28Gg2alG04Eh3G3868NOCFJhhaHVmwYR2
ygRm6N9eDW1bHhYSN75HSEb6aIebk+1AT4S1QtJaPSH0EduIXO++JYAs+jIFKy2c
jCVFlO/LbXl7iCdXurJHpSbMNmZFNUri6zEolENODLwke836jBOKiVrWzLnEMxHI
WDDTpLTYhR3C7sEprpEQm9SX2Eik3WxVb4ZTb7SZFU1y1d4tWnjGu3U1D+vO9wVq
Sss9lDipbkhQ9k4j1/Pqozaxvi8lYLbh3WEjK3Iwpr66Bk6Ai2oRg4b+7vzV4o+6
L47JPJhajdHac0CIlmupyA4eejECS6OpoLDf5Wr/616k3dxM//3kAWGUnXVw9GSo
UF5W8AaKlaGZ6EZk09NyGSFRjEs18z+g5ckviGF0EhZI7ZPWQQmlqWUsL9O0S4GO
ZZ9f0UhNmHEspcugbs7e1yfjwGVyxIBkrmxpkmfHE4Gb47UGlJevg2OvZOPT3wMH
vOds2BtqdT3tuss9k+7hsISGse7isEOb7TN5MHb6yyzqnCUZhp5m3Iag7TUkiyfU
jKH5R13tHqKUoJ2rofWoLO2H5xSfp/lqF9sLd4rJ+Pbjhiuvfwz5copYsuTNL4kB
SPUikHlTxSOgTBYNV77qxpsqOI3+iziCrSqHsxNdlaA1T3fiq6SeZBNdD822AYm9
L5hbcgpDPEEwT/n5kWNbRNueerJkJwboaOnT1ZX1601Pwj5QDi+YM1NYy5PsdWxb
bPGpQyZ+uf917q9gV7Ykr5cic10YD11khAghr0n6fYfb8Ijc22uP6m47KItDqQc1
eFym149F56B0yg5FR85Arg==
-----END MESSAGE-----
 2021-06-11 02:00:52 +03:00
Nick Mathewson
ec677c0c2e Merge branch 'maint-0.4.6' 2021-06-10 12:30:30 -04:00
Nick Mathewson
8e590992c4 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-06-10 12:30:29 -04:00
Nick Mathewson
200e9a55e0 Merge branch 'maint-0.4.4' into maint-0.4.5 2021-06-10 12:30:29 -04:00
Nick Mathewson
0ae9fd62fd Merge branch 'maint-0.3.5' into maint-0.4.4 2021-06-10 12:30:11 -04:00
George Kadianakis
f57b5c48e0 Fix TROVE-2021-006: Out-of-bounds read on v3 desc parsing 2021-06-10 12:11:10 -04:00
Nick Mathewson
0667eaa9bf Merge branch 'maint-0.4.6' 2021-06-10 09:55:55 -04:00
Nick Mathewson
7be37a26ac Merge branch 'maint-0.4.5' into maint-0.4.6 2021-06-10 09:55:55 -04:00
Nick Mathewson
ae2254e490 Merge branch 'maint-0.4.4' into maint-0.4.5 2021-06-10 09:55:55 -04:00
Nick Mathewson
014345ed6a Resolve remaining merge conflicts in relay.c 
(My bad!)
 2021-06-10 09:55:35 -04:00
Nick Mathewson
8734eea31b Merge branch 'maint-0.4.6' 2021-06-10 08:53:07 -04:00
Nick Mathewson
3260d323a6 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-06-10 08:53:07 -04:00
Nick Mathewson
ec696a95e5 Merge branch 'maint-0.4.4' into maint-0.4.5 2021-06-10 08:53:07 -04:00
Nick Mathewson
0f2d45328d Merge branch 'maint-0.3.5' into maint-0.4.4 
Conflicts resolved:
	src/core/or/relay.c
 2021-06-10 08:52:39 -04:00
David Goulet
adb248b6d6 TROVE-2021-003: Check layer_hint before half-closed end and resolve cells 
This issue was reported by Jann Horn part of Google's Project Zero.

Jann's one-sentence summary: entry/middle relays can spoof RELAY_END cells on
half-closed streams, which can lead to stream confusion between OP and
exit.

Fixes #40389
 2021-06-10 08:50:05 -04:00
Nick Mathewson
d9edf143ab Merge branch 'maint-0.4.6' 2021-06-10 08:42:15 -04:00
Nick Mathewson
69bd4a8a2d Merge branch 'maint-0.4.5' into maint-0.4.6 2021-06-10 08:42:15 -04:00
Nick Mathewson
1da8621c0a Merge branch 'maint-0.4.4' into maint-0.4.5 2021-06-10 08:42:15 -04:00
Nick Mathewson
31eaa81f59 Merge branch 'maint-0.3.5' into maint-0.4.4 2021-06-10 08:42:15 -04:00
Nick Mathewson
d71bf986b4 Merge branch 'bug40391_035' into maint-0.3.5 2021-06-10 08:41:59 -04:00
Nick Mathewson
085bf61a35 Merge branch 'maint-0.4.6' 2021-06-10 08:37:34 -04:00
Nick Mathewson
1d11675adb Merge branch 'maint-0.4.5' into maint-0.4.6 2021-06-10 08:37:34 -04:00
Nick Mathewson
e2d01aac9e Merge branch 'maint-0.4.4' into maint-0.4.5 2021-06-10 08:37:34 -04:00
Nick Mathewson
7c19a4d924 Merge branch 'maint-0.3.5' into maint-0.4.4 2021-06-10 08:37:26 -04:00
Nick Mathewson
7fdfc2ea54 Merge branch 'bug40390_035_squashed' into maint-0.3.5 2021-06-10 08:34:25 -04:00
Nick Mathewson
c0aa9e0a1b Assert on _all_ failures from RAND_bytes(). 
Previously, we would detect errors from a missing RNG
implementation, but not failures from the RNG code itself.

Fortunately, it appears those failures do not happen in practice
when Tor is using OpenSSL's default RNG implementation.  Fixes bug
40390; bugfix on 0.2.8.1-alpha. This issue is also tracked as
TROVE-2021-004. Reported by Jann Horn at Google's Project Zero.
 2021-06-10 08:33:57 -04:00
Nick Mathewson
a2e500f1ff Merge branch 'maint-0.4.6' 2021-06-10 08:21:49 -04:00
Nick Mathewson
cb38219664 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-06-10 08:21:48 -04:00
Nick Mathewson
d60f8fe98a Merge branch 'maint-0.4.4' into maint-0.4.5 2021-06-10 08:21:48 -04:00
Nick Mathewson
57a41348ee Merge branch 'maint-0.3.5' into maint-0.4.4 2021-06-10 08:21:47 -04:00
Nick Mathewson
520d5c108f Update geoip files to match ipfire location db, 2021/06/10. 2021-06-10 08:20:13 -04:00
Nick Mathewson
d2256fe9ce Modernize our libfuzzer usage to close #40407 
Additionally, remove lingering references to hsv2 fuzzers from the
fuzzing_include_am.py script.
 2021-06-08 12:47:57 -04:00
Nick Mathewson
88987ce8eb Quick-and-dirty fuzzer for inner-encrypted layer of hsv3 desc. 
Based on hsv3 outer-layer fuzzer; some code may be unnecessary.
 2021-06-08 11:24:34 -04:00
Nick Mathewson
b3fe9d5162 Bump to 0.4.6.5 2021-06-07 13:32:07 -04:00
Nick Mathewson
c80b98520b Bump to 0.4.5.9. 2021-06-07 13:31:10 -04:00
Nick Mathewson
1956f63d6b Bump to 0.4.4.9 2021-06-07 13:30:18 -04:00
Nick Mathewson
ed7f4ad4a9 Bump to 0.3.5.15. 2021-06-07 13:29:35 -04:00
David Goulet
6994a8d217 Merge branch 'maint-0.4.6' 2021-06-01 08:48:04 -04:00
David Goulet
83009f8003 Merge branch 'tor-gitlab/mr/393' into maint-0.4.6 2021-06-01 08:47:56 -04:00
Nick Mathewson
6ccb858058 Bump to 0.4.6.4-rc-dev 2021-05-28 12:20:48 -04:00
Nick Mathewson
aaf062119e Bump to 0.4.6.4-rc. 2021-05-28 08:04:42 -04:00
Roger Dingledine
896ab165d9 clarify three comments 
based on code-spelunking with nickm
 2021-05-27 14:22:22 -04:00
Nick Mathewson
fc3d4e4c2f Upgrade and rate-limit compression failure message. 
Without this message getting logged at 'WARN', it's hard to
contextualize the messages we get about compression bombs, so this
message should fix #40175.

I'm rate-limiting this, however, since it _could_ get spammy if
somebody on the network starts acting up.  (Right now it should be
very quiet; I've asked Sebastian to check it, and he says that he
doesn't hit this message in practice.)

Closes #40175.
 2021-05-27 10:49:37 -04:00
David Goulet
111e6e7f26 Merge branch 'tor-gitlab/mr/359' 2021-05-27 10:12:16 -04:00
David Goulet
c29ba98ce8 Merge branch 'maint-0.4.6' 2021-05-27 10:01:49 -04:00
David Goulet
fd3678fa60 Merge branch 'tor-gitlab/mr/392' into maint-0.4.6 2021-05-27 10:01:44 -04:00
Nick Mathewson
d12b16614d Prefer mmap()ed consensus files over cached_dir_t entries. 
Cached_dir_t is a somewhat "legacy" kind of storage when used for
consensus documents, and it appears that there are cases when
changing our settings causes us to stop updating those entries.

This can cause trouble, as @arma found out in #40375, where he
changed his settings around, and consensus diff application got
messed up: consensus diffs were being _requested_ based on the
latest consensus, but were being (incorrectly) applied to a
consensus that was no longer the latest one.

This patch is a minimal fix for backporting purposes: it has Tor do
the same search when applying consensus diffs as we use to request
them.  This should be sufficient for correct behavior.

There's a similar case in GETINFO handling; I've fixed that too.

Fixes #40375; bugfix on 0.3.1.1-alpha.
 2021-05-26 13:02:56 -04:00
Alexander Færøy
1665d11942 Merge remote-tracking branch 'tor-gitlab/mr/388' into main 2021-05-25 14:17:12 +00:00
Alexander Færøy
b3d7a56f2a Merge remote-tracking branch 'tor-gitlab/mr/380' into main 2021-05-25 13:58:55 +00:00
Alexander Færøy
11c7e65730 Merge branch 'maint-0.3.5' into maint-0.4.4 2021-05-25 13:25:23 +00:00
Alexander Færøy
4a7379b80a Merge branch 'maint-0.4.4' into maint-0.4.5 2021-05-25 13:25:23 +00:00
Alexander Færøy
bab2b29f89 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-05-25 13:25:23 +00:00
Alexander Færøy
de5f94000c Merge branch 'maint-0.4.6' into main 2021-05-25 13:25:23 +00:00
Nick Mathewson
42ba87d964 Remove the function tor_tls_assert_renegotiation_unblocked. 
It was used nowhere outside its own unit tests, and it was causing
compilation issues with recent OpenSSL 3.0.0 alphas.

Closes ticket 40399.
 2021-05-25 07:38:31 -04:00
Neel Chauhan
96b59fc4d3 Fix the fencepost issue when we check stability_last_downrated 2021-05-20 11:06:50 -07:00
Nick Mathewson
4c06c619fa Use a more secure hash function for the circuitmux hashtable. 
Fixes bug 40931; bugfix on 0.2.4.4-alpha. Also tracked as
TROVE-2021-005.

This issue was reported by Jann Horn from Google's Project Zero.
 2021-05-18 08:40:09 -04:00
Nick Mathewson
debede5e50 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-05-17 09:09:49 -04:00
Nick Mathewson
97b61e21a9 Merge remote-tracking branch 'tor-gitlab/mr/387' into maint-0.4.5 2021-05-17 09:09:42 -04:00
Nick Mathewson
fbd47a5078 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-05-17 09:04:22 -04:00
Nick Mathewson
af560f21ec Merge branch 'maint-0.4.6' 2021-05-17 09:04:22 -04:00
Daniel Pinto
e0a8454691 Make SAVECONF keep only one backup and add sandbox rules for it. #40317 
When seccomp sandbox is active, SAVECONF failed because it was not
able to save the backup files for torrc. This commit simplifies
the implementation of SAVECONF and sandbox by making it keep only
one backup of the configuration file.
 2021-05-17 13:50:19 +02:00
David Goulet
d4fbfb54d4 rephist: Add a counter for the onioniskins stats 
Current counters are reset every heartbeat. This commit adds two
counters for the assigned and dropped onionskins that are not reset so
they can be exported onto the MetricsPort.

Closes #40387

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 15:31:44 -04:00
David Goulet
5f009a59da conn: MetricsPort listener is a listener port 
The connection type for the listener part was missing from the "is
connection a listener" function.

This lead to our periodic event that retries our listeners to keep
trying to bind() again on an already opened MetricsPort.

Closes #40370

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 15:13:50 -04:00
David Goulet
d4718e4db9 relay: We might be noting down an unknown DNS error type 
Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 14:44:04 -04:00
David Goulet
3fbd510c52 metrics: One relay metrics was not using metrics_format_label() 
This resulted in the labels not being surrounded by double quotes and
thus Prometheus not liking it.

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 13:31:40 -04:00
David Goulet
e3f5dc1fd3 metrics: Need to surround label value with double quotes 
Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 13:24:22 -04:00
David Goulet
22861c2f40 relay: Add TCP port exhaustion metrics 
Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 11:58:25 -04:00
David Goulet
c6f41d6038 relay: Add DNS metrics 
Emit on the MetricsPort all the DNS statistics we have that is the total
number of queries seen and errors per record type.

Related to #40367

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 11:58:25 -04:00
David Goulet
423910e01b dns: Gather DNS request statistics 
We now keep track of all errors and total number of request seen. This
is so we can expose those values to the MetricsPort to help Exit
operators monitor the DNS requests and failures.

Related to #40367.

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 11:58:25 -04:00
David Goulet
897344fddc relay: Add the global connection limit metrics 
This emits two events (read and write) of the total number that the
global connection limit was reached.

Related to #40367

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 11:58:25 -04:00
David Goulet
9040a5475d relay: Add number of open and max sockets metrics 
With this commit, a relay will emit metrics that give the total number
of sockets and total number of opened sockets.

Related to #40367

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 11:58:25 -04:00
David Goulet
8bb1874f1e relay: Add the onionskins processing metrics 
With this commit, a relay now emits metrics event on the MetricsPort
related to how many onionskins were handled (processed or dropped) for
each handshake type.

Related to #40367

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 11:58:25 -04:00
David Goulet
9c2fa34982 relay: Add the OOM invocation metrics 
With this commit, a relay now emits metrics event on the MetricsPort
related to the OOM invocation for:

  - DNS cache
  - GeoIP database
  - Cell queues
  - HSDir caches

Everytime the OOM is invoked, the number of bytes is added to the
metrics counter for that specific type of invocation.

Related to #40367

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 11:58:25 -04:00
David Goulet
bdde4579c2 relay: Code and objects to initialize metrics store 
Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 11:58:25 -04:00
David Goulet
0cf25fd3a5 relay: Groundwork for relay metrics support 
The basic functions for the relay subsystem to expose metrics onto the
MetricsPort.

Part of #40367

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 11:58:25 -04:00
David Goulet
3164e55f01 metrics: Add a reset store helper function 
Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 11:58:25 -04:00
David Goulet
455471835d metrics: Move helper function to lib/metrics 
It is a common function that a lot of subsystem can use which is to
format a label so move it out of the HS subsystem into the more generic
metrics library.

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 11:58:25 -04:00
David Goulet
cc2947c007 metrics: Print once the Promtheus comments 
An entry can have multiple labels but only print once the comments at
the first one. This follows the Promtheus best practices.

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-12 11:58:25 -04:00
Nick Mathewson
265cca935a Ignore MAX_BANDWIDTH_CHANGE_FREQ on testing networks. 
Part of the ever-growing 40337 fix.
 2021-05-11 15:54:14 -04:00
Nick Mathewson
9d7fca2306 Make MinTimeToReportBandwidth a testing-only option (and rename it) 2021-05-11 15:49:00 -04:00
Nick Mathewson
6e140c530c Make client heartbeat stats tied to the heartbeat period. 
Patch from cypherpunks. Closes #40330.
 2021-05-11 10:08:52 -04:00
Neel Chauhan
35e5b306a0 Fix typo in comment for handle_control_redirectstream() 2021-05-10 19:03:56 -07:00
Nick Mathewson
d82970c8c3 Merge branch 'maint-0.4.6' 2021-05-10 14:30:09 -04:00
Nick Mathewson
8851861ff0 Merge branch 'ticket40374_046' into maint-0.4.6 2021-05-10 14:30:00 -04:00
Nick Mathewson
af6da4a36b Bump to 0.4.6.3-rc-dev 2021-05-10 10:53:39 -04:00
Nick Mathewson
ce8d6d143c Update to 0.4.5.8-dev 2021-05-10 10:53:00 -04:00
Alexander Færøy
9d59d82d40 Remove unused function: dns_randfn_() in dns.c. 
This patch unbreaks the current build after tor!369 landed.

See: https://bugs.torproject.org/tpo/core/tor/40371
 2021-05-10 13:07:24 +00:00
Alexander Færøy
a56ed0cfa4 Merge remote-tracking branch 'tor-gitlab/mr/369' 2021-05-10 10:58:29 +00:00
Nick Mathewson
e4f2b52deb Merge branch 'maint-0.4.5' into maint-0.4.6 2021-05-07 13:08:25 -04:00
Nick Mathewson
4e62c17114 Merge branch 'maint-0.4.6' 2021-05-07 13:08:25 -04:00
Nick Mathewson
f5acfe6723 Add a sandbox workaround for Glibc 2.33 
This change permits the newfstatat() system call, and fixes issues
40382 (and 40381).

This isn't a free change.  From the commit:

    // Libc 2.33 uses this syscall to implement both fstat() and stat().
    //
    // The trouble is that to implement fstat(fd, &st), it calls:
    //     newfstatat(fs, "", &st, AT_EMPTY_PATH)
    // We can't detect this usage in particular, because "" is a pointer
    // we don't control.  And we can't just look for AT_EMPTY_PATH, since
    // AT_EMPTY_PATH only has effect when the path string is empty.
    //
    // So our only solution seems to be allowing all fstatat calls, which
    // means that an attacker can stat() anything on the filesystem. That's
    // not a great solution, but I can't find a better one.
 2021-05-07 12:12:11 -04:00
Nick Mathewson
5acf18bfaa Merge branch 'maint-0.4.5' into maint-0.4.6 2021-05-07 10:41:34 -04:00
Nick Mathewson
a4c8591c35 Merge branch 'maint-0.4.6' 2021-05-07 10:41:34 -04:00
Nick Mathewson
7c86f34340 Merge branch 'maint-0.4.4' into maint-0.4.5 2021-05-07 10:41:34 -04:00
Nick Mathewson
48dd87933d Merge branch 'maint-0.3.5' into maint-0.4.4 2021-05-07 10:41:33 -04:00
Nick Mathewson
e2c1ac214c Reindent a few lines to fix a GCC warning. 
As of GCC 11.1.1, the compiler warns us about code like this:

     if (a)
         b;
         c;

and that's a good thing: we wouldn't want to "goto fail".  But we
had an instance if this in circuituse.c, which was making our
compilation sad.

Fixes bug 40380; bugfix on 0.3.0.1-alpha.
 2021-05-07 10:39:20 -04:00
Nick Mathewson
0397a9cb49 Merge branch 'maint-0.4.5' into maint-0.4.6 2021-05-07 09:53:58 -04:00
Nick Mathewson
1c9890bd31 Merge branch 'maint-0.4.6' 2021-05-07 09:53:58 -04:00
Nick Mathewson
7fe819c951 Merge branch 'maint-0.4.4' into maint-0.4.5 2021-05-07 09:53:58 -04:00
Nick Mathewson
f68aeda549 Merge branch 'maint-0.3.5' into maint-0.4.4 2021-05-07 09:53:57 -04:00
Nick Mathewson
621f8a304a Update geoip files to match ipfire location db, 2021/05/07. 2021-05-07 09:53:46 -04:00
Nick Mathewson
8142b368e7 Bump to 0.4.6.3-rc 2021-05-07 09:42:18 -04:00
Nick Mathewson
ec0b4bdafd Bump to 0.4.5.8. 2021-05-07 09:39:33 -04:00
David Goulet
93af8b1ad8 Merge branch 'maint-0.4.6' 2021-05-07 09:05:21 -04:00
George Kadianakis
80c404c4b7 Log warning when connecting to soon-to-be-deprecated v2 onions. 2021-05-07 08:44:36 -04:00
George Kadianakis
5e836eb80c Add warning when trying to connect to deprecated v2 onions. 2021-05-07 08:41:46 -04:00
George Kadianakis
f230beadf4 Prepare for #40373: Re-introduce parsing for v2 onion addresses. 
Welcome back ONION_V2_HOSTNAME! :)
 2021-05-05 11:05:45 +03:00
George Kadianakis
d6e7fc00f3 Merge branch 'maint-0.4.6' 2021-05-05 10:21:48 +03:00
David Goulet
cf6e72b702 hs: Fix ADD_ONION with client authorization 
Turns out that passing client authorization keys to ADD_ONION for v3 was
not working because we were not setting the "is_client_auth_enabled"
flag to true once the clients were configured. This lead to the
descriptor being encoded without the clients.

This patch removes that flag and instead adds an inline function that
can be used to check if a given service has client authorization
enabled.

This will be much less error prone of needing to keep in sync the client
list and a flag instead.

Fixes #40378

Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-05-04 10:37:26 -04:00
Nick Mathewson
8d0d7a665a Remove NEED_SKEY_1024 parsing. 
Only v2 onion services needed this, and they are now gone.

Closes #40374.
 2021-04-23 15:55:51 -04:00
David Goulet
1d18ecbc5f Remove HSv2 leftovers after merging #18346 
Signed-off-by: David Goulet <dgoulet@torproject.org>
 2021-04-23 12:54:10 -04:00