| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
These were meant to demonstrate old behavior, or old rust behavior.
One of them _should_ work in Rust, but won't because of
implementation details. We'll fix that up later.
|
|
|
|
The C code and the rust code had different separate integer overflow
bugs here. That suggests that we're better off just forbidding this
pathological case.
Also, add tests for expected behavior on receiving a bad protocol
list in a consensus.
Fixes another part of 25249.
|
|
Fixes part of 24249; bugfix on 0.2.9.4-alpha.
|
|
These are as Teor wrote them; I've disabled the ones that don't pass
yet, with XXXX comments.
|
|
I've refactored these to be a separate function, to avoid tricky
merge conflicts.
Some of these are disabled with "XXXX" comments; they should get
fixed moving forward.
|
|
This one can only be exploited if you can generate a correctly
signed consensus, so it's not as bad as 25074.
Fixes bug 25251; also tracked as TROVE-2018-004.
|
|
In some cases we had checked for it, but in others we had not. One
of these cases could have been used to remotely cause
denial-of-service against directory authorities while they attempted
to vote.
Fixes TROVE-2018-001.
|
|
Add some commented-out allow_failures clauses to make it easier to
temporarily allow less-critical sub-builds to fail while still
reporting success.
|
|
Closes most of #25323.
|
|
|
|
|
|
"ours" merge to avoid conflicts with the cherry-picked fix for 24898.
|
|
since all it does is produce false positives
this commit should get merged into 0.2.9 and 0.3.0 *and* 0.3.1, even
though the code in the previous commit is already present in 0.3.1. sorry
for the mess.
[Cherry-picked]
|
|
since all it does is produce false positives
this commit should get merged into 0.2.9 and 0.3.0 *and* 0.3.1, even
though the code in the previous commit is already present in 0.3.1. sorry
for the mess.
|
|
This commit takes a piece of commit af8cadf3a9 and a piece of commit
46fe353f25, with the goal of making channel_is_client() be based on what
sort of connection handshake the other side used, rather than seeing
whether the other side ever sent a create_fast cell to us.
|
|
|
|
|
|
Signed-off-by: David Goulet <dgoulet@torproject.org>
|
|
Fixes #25236
Signed-off-by: David Goulet <dgoulet@torproject.org>
|
|
|
|
Never allow the function to set a bucket value above the allowed circuit
burst.
Closes #25202
Signed-off-by: David Goulet <dgoulet@torproject.org>
|
|
We had this safeguard around dos_init() but not when the consensus changes
which can modify consensus parameters and possibly enable the DoS mitigation
even if tor wasn't a public relay.
Fixes #25223
Signed-off-by: David Goulet <dgoulet@torproject.org>
|
|
|
|
Explicitly inform the operator of the rejected relay to set a valid email
address in the ContactInfo field and contact bad-relays@ mailing list.
Fixes #25170
Signed-off-by: David Goulet <dgoulet@torproject.org>
|
|
We don't expect this to come up very much, but we may as well make
sure that the value isn't predictable (as we do for the other
addresses) in case the issue ever comes up.
Spotted by teor.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Part of #25193
Signed-off-by: David Goulet <dgoulet@torproject.org>
|
|
This is to avoid positively identifying Exit relays if tor client connection
comes from them that is reentering the network.
One thing to note is that this is done only in the DoS subsystem but we'll
still add it to the geoip cache as a "client" seen. This is done that way so
to avoid as much as possible changing the current behavior of the geoip client
cache since this is being backported.
Closes #25193
Signed-off-by: David Goulet <dgoulet@torproject.org>
|
|
|
|
This also adds one that tests the integration with the nodelist.
Signed-off-by: David Goulet <dgoulet@torproject.org>
|
|
This set is rebuilt whenever a consensus arrives. In between
consensuses, it is add-only.
|
|
This is a convenience function, so callers don't need to wrap
the IPv4 address.
|
|
We're going to need this to make our anti-DoS code (see 24902) more
robust.
|
|
|
|
|
|
|
|
|
