aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/feature/dircache/dircache.c10
-rw-r--r--src/feature/dircommon/directory.c23
-rw-r--r--src/feature/hs/hs_client.c8
-rw-r--r--src/test/test_options.c20
4 files changed, 44 insertions, 17 deletions
diff --git a/src/feature/dircache/dircache.c b/src/feature/dircache/dircache.c
index 7c6af3582b..d4d0ad9939 100644
--- a/src/feature/dircache/dircache.c
+++ b/src/feature/dircache/dircache.c
@@ -1393,7 +1393,8 @@ handle_get_hs_descriptor_v3(dir_connection_t *conn,
/* Reject non anonymous dir connections (which also tests if encrypted). We
* do not allow single hop clients to query an HSDir. */
if (!connection_dir_is_anonymous(conn)) {
- write_short_http_response(conn, 404, "Not found");
+ write_short_http_response(conn, 503,
+ "Rejecting single hop HS v3 descriptor request");
goto done;
}
@@ -1636,7 +1637,12 @@ directory_handle_command_post,(dir_connection_t *conn, const char *headers,
/* Handle HS descriptor publish request. We force an anonymous connection
* (which also tests for encrypted). We do not allow single-hop client to
* post a descriptor onto an HSDir. */
- if (connection_dir_is_anonymous(conn) && !strcmpstart(url, "/tor/hs/")) {
+ if (!strcmpstart(url, "/tor/hs/")) {
+ if (!connection_dir_is_anonymous(conn)) {
+ write_short_http_response(conn, 503,
+ "Rejecting single hop HS descriptor post");
+ goto done;
+ }
const char *msg = "HS descriptor stored successfully.";
/* We most probably have a publish request for an HS descriptor. */
diff --git a/src/feature/dircommon/directory.c b/src/feature/dircommon/directory.c
index b3db0aa108..8e5b413326 100644
--- a/src/feature/dircommon/directory.c
+++ b/src/feature/dircommon/directory.c
@@ -212,7 +212,8 @@ connection_dir_is_anonymous(const dir_connection_t *dir_conn)
* be closed or marked for close. */
if (linked_conn == NULL || linked_conn->magic != EDGE_CONNECTION_MAGIC ||
conn->linked_conn_is_closed || conn->linked_conn->marked_for_close) {
- log_info(LD_DIR, "Rejected HSDir request: not linked to edge");
+ log_debug(LD_DIR, "Directory connection is not anonymous: "
+ "not linked to edge");
return false;
}
@@ -221,13 +222,27 @@ connection_dir_is_anonymous(const dir_connection_t *dir_conn)
/* Can't be a circuit we initiated and without a circuit, no channel. */
if (circ == NULL || CIRCUIT_IS_ORIGIN(circ)) {
- log_info(LD_DIR, "Rejected HSDir request: not on OR circuit");
+ log_debug(LD_DIR, "Directory connection is not anonymous: "
+ "not on OR circuit");
return false;
}
- /* Get the previous channel to learn if it is a client or relay link. */
+ /* It is possible that the circuit was closed because one of the channel was
+ * closed or a DESTROY cell was received. Either way, this connection can
+ * not continue so return that it is not anonymous since we can not know for
+ * sure if it is. */
+ if (circ->marked_for_close) {
+ log_debug(LD_DIR, "Directory connection is not anonymous: "
+ "circuit marked for close");
+ return false;
+ }
+
+ /* Get the previous channel to learn if it is a client or relay link. We
+ * BUG() because if the circuit is not mark for close, we ought to have a
+ * p_chan else we have a code flow issue. */
if (BUG(CONST_TO_OR_CIRCUIT(circ)->p_chan == NULL)) {
- log_info(LD_DIR, "Rejected HSDir request: no p_chan");
+ log_debug(LD_DIR, "Directory connection is not anonymous: "
+ "no p_chan on circuit");
return false;
}
diff --git a/src/feature/hs/hs_client.c b/src/feature/hs/hs_client.c
index 4ed34aa9af..c79bc63393 100644
--- a/src/feature/hs/hs_client.c
+++ b/src/feature/hs/hs_client.c
@@ -682,8 +682,12 @@ setup_intro_circ_auth_key(origin_circuit_t *circ)
tor_assert(circ);
desc = hs_cache_lookup_as_client(&circ->hs_ident->identity_pk);
- if (BUG(desc == NULL)) {
- /* Opening intro circuit without the descriptor is no good... */
+ if (desc == NULL) {
+ /* There is a very small race window between the opening of this circuit
+ * and the client descriptor cache that gets purged (NEWNYM) or the
+ * cleaned up because it expired. Mark the circuit for close so a new
+ * descriptor fetch can occur. */
+ circuit_mark_for_close(TO_CIRCUIT(circ), END_CIRC_REASON_INTERNAL);
goto end;
}
diff --git a/src/test/test_options.c b/src/test/test_options.c
index 15fd714f71..268ed57531 100644
--- a/src/test/test_options.c
+++ b/src/test/test_options.c
@@ -4002,9 +4002,9 @@ test_options_init_logs_quiet(void *arg)
tt_assert(a);
tt_assert(a->stream);
tt_int_op(a->fd, OP_EQ, fileno(stdout));
- tt_int_op(a->sev.masks[LOG_INFO-LOG_ERR], OP_EQ, 0);
- tt_int_op(a->sev.masks[LOG_NOTICE-LOG_ERR], OP_EQ, 0);
- tt_int_op(a->sev.masks[LOG_WARN-LOG_ERR], OP_EQ, LD_ALL_DOMAINS);
+ tt_u64_op(a->sev.masks[SEVERITY_MASK_IDX(LOG_INFO)], OP_EQ, 0);
+ tt_u64_op(a->sev.masks[SEVERITY_MASK_IDX(LOG_NOTICE)], OP_EQ, 0);
+ tt_u64_op(a->sev.masks[SEVERITY_MASK_IDX(LOG_WARN)], OP_EQ, LD_ALL_DOMAINS);
clear_added_logs();
quiet_level = QUIET_NONE;
@@ -4015,9 +4015,10 @@ test_options_init_logs_quiet(void *arg)
tt_assert(a);
tt_assert(a->stream);
tt_int_op(a->fd, OP_EQ, fileno(stdout));
- tt_int_op(a->sev.masks[LOG_INFO-LOG_ERR], OP_EQ, 0);
- tt_int_op(a->sev.masks[LOG_NOTICE-LOG_ERR], OP_EQ, LD_ALL_DOMAINS);
- tt_int_op(a->sev.masks[LOG_WARN-LOG_ERR], OP_EQ, LD_ALL_DOMAINS);
+ tt_u64_op(a->sev.masks[SEVERITY_MASK_IDX(LOG_INFO)], OP_EQ, 0);
+ tt_u64_op(a->sev.masks[SEVERITY_MASK_IDX(LOG_NOTICE)], OP_EQ,
+ LD_ALL_DOMAINS);
+ tt_u64_op(a->sev.masks[SEVERITY_MASK_IDX(LOG_WARN)], OP_EQ, LD_ALL_DOMAINS);
clear_added_logs();
/* Make sure that adding a configured log makes the default logs go away. */
@@ -4031,9 +4032,10 @@ test_options_init_logs_quiet(void *arg)
tt_assert(a);
tt_assert(! a->stream);
tt_int_op(a->fd, OP_NE, fileno(stdout));
- tt_int_op(a->sev.masks[LOG_INFO-LOG_ERR], OP_EQ, LD_ALL_DOMAINS);
- tt_int_op(a->sev.masks[LOG_NOTICE-LOG_ERR], OP_EQ, LD_ALL_DOMAINS);
- tt_int_op(a->sev.masks[LOG_WARN-LOG_ERR], OP_EQ, LD_ALL_DOMAINS);
+ tt_u64_op(a->sev.masks[SEVERITY_MASK_IDX(LOG_INFO)], OP_EQ, LD_ALL_DOMAINS);
+ tt_u64_op(a->sev.masks[SEVERITY_MASK_IDX(LOG_NOTICE)], OP_EQ,
+ LD_ALL_DOMAINS);
+ tt_u64_op(a->sev.masks[SEVERITY_MASK_IDX(LOG_WARN)], OP_EQ, LD_ALL_DOMAINS);
done:
free_options_test_data(tdata);
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion