aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-02-05Only check for bindable ports if we are unsure if it will fail.Alexander Færøy
We currently assume that the only way for Tor to listen on ports in the privileged port range (1 to 1023), on Linux, is if we are granted the NET_BIND_SERVICE capability. Today on Linux, it's possible to specify the beginning of the unprivileged port range using a sysctl configuration option. Docker (and thus the CI service Tor uses) recently changed this sysctl value to 0, which causes our tests to fail as they assume that we should NOT be able to bind to a privileged port *without* the NET_BIND_SERVICE capability. In this patch, we read the value of the sysctl value via the /proc/sys/ filesystem iff it's present, otherwise we assume the default unprivileged port range begins at port 1024. See: tor#40275
2021-02-03Merge branch 'maint-0.4.4' into release-0.4.4Nick Mathewson
2021-02-03Merge branch 'maint-0.4.3' into maint-0.4.4Nick Mathewson
"ours" to avoid version bump.
2021-02-03Merge branch 'maint-0.3.5' into maint-0.4.3maint-0.4.3Nick Mathewson
"ours" to avoid version bump.
2021-02-03bump to 0.4.4.7-devNick Mathewson
2021-02-03bump to 0.4.3.8-devNick Mathewson
2021-02-03Bump to 0.3.5.13-dev.Nick Mathewson
2021-02-03copy changelog into releasenotesNick Mathewson
2021-02-03Fold in the entry for 2667tor-0.4.4.7Nick Mathewson
2021-02-03Merge branch 'maint-0.4.4' into release-0.4.4David Goulet
2021-02-03Merge branch 'maint-0.4.3' into maint-0.4.4David Goulet
2021-02-03Merge branch 'maint-0.3.5' into maint-0.4.3David Goulet
2021-02-03Merge branch 'ticket40269_035_01' into maint-0.3.5David Goulet
2021-02-03Remove unused addr_port_set codeDavid Goulet
Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-02-03Merge branch 'maint-0.4.4' into release-0.4.4David Goulet
2021-02-03Merge branch 'maint-0.4.3' into maint-0.4.4David Goulet
2021-02-03Merge branch 'maint-0.3.5' into maint-0.4.3David Goulet
2021-02-03Merge branch 'ticket40270_035_01' into maint-0.3.5David Goulet
2021-02-03Merge branch 'maint-0.4.4' into release-0.4.4David Goulet
2021-02-03Merge branch 'maint-0.4.3' into maint-0.4.4David Goulet
2021-02-03Merge branch 'maint-0.3.5' into maint-0.4.3David Goulet
2021-02-03node: Move reentry set to use a digestmap_tDavid Goulet
Any lookup now will be certain and not probabilistic as the bloomfilter. Closes #40269 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-02-03relay: Send back CONNECTION_REFUSED on reentryDavid Goulet
The TORPROTOCOL reason causes the client to close the circuit which is not what we want because other valid streams might be on it. Instead, CONNECTION_REFUSED will leave it open but will not allow more streams to be attached to it. The client then open a new circuit to the destination. Closes #40270 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-02-03Merge branch 'maint-0.4.4' into release-0.4.4David Goulet
2021-02-03Merge branch 'maint-0.4.3' into maint-0.4.4David Goulet
2021-02-03Merge branch 'maint-0.3.5' into maint-0.4.3David Goulet
2021-02-03relay: Double the size of the relay reentry setDavid Goulet
This is to minimize false positive and thus deny reentry to Exit connections that were in reality not re-entering. Helps with overall UX. Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-02-03relay: Follow consensus parameter for network reentryDavid Goulet
Obey the "allow-network-reentry" consensus parameters in order to decide to allow it or not at the Exit. Closes #40268 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-02-03Merge branch 'maint-0.4.4' into release-0.4.4David Goulet
2021-02-020447 changelog blurbNick Mathewson
2021-02-02Start a changelog for 0.4.4.7Nick Mathewson
2021-01-29Merge branch 'tor-gitlab/mr/285' into ticket2667_044_01David Goulet
2021-01-29Merge branch 'tor-gitlab/mr/284' into ticket2667_043_01David Goulet
2021-01-29test: Add test for exits blocking reentry to the networkGeorge Kadianakis
Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-01-29exit: Deny re-entry into the networkRoger Dingledine
Exit relays now reject exit attempts to known relay addresses + ORPort and also to authorities on the ORPort and DirPort. Closes #2667 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-01-29relay: Add bloomfiter of relay address + {OR|Dir}PortDavid Goulet
In order to deny re-entry in the network, we now keep a bloomfilter of relay ORPort + address and authorities ORPort + address and DirPort + address combinations. So when an Exit stream is handled, we deny anything connecting back into the network on the ORPorts for relays and on the ORPort+DirPort for the authorities. Related to #2667 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-01-28Merge branch 'maint-0.4.4' into release-0.4.4David Goulet
2021-01-28Merge branch 'maint-0.4.3' into maint-0.4.4David Goulet
2021-01-28Merge branch 'maint-0.3.5' into maint-0.4.3David Goulet
2021-01-28Merge branch 'tor-gitlab/mr/50' into maint-0.3.5David Goulet
2021-01-28Merge branch 'maint-0.4.4' into release-0.4.4David Goulet
2021-01-28Merge branch 'maint-0.4.3' into maint-0.4.4David Goulet
2021-01-28Merge branch 'maint-0.3.5' into maint-0.4.3David Goulet
2021-01-28Merge branch 'tor-gitlab/mr/239' into maint-0.3.5David Goulet
2021-01-28Merge branch 'maint-0.4.4' into release-0.4.4David Goulet
2021-01-28Merge branch 'maint-0.4.3' into maint-0.4.4David Goulet
2021-01-28Merge branch 'maint-0.3.5' into maint-0.4.3David Goulet
2021-01-28Merge branch 'tor-gitlab/mr/243' into maint-0.3.5David Goulet
2021-01-28Merge branch 'maint-0.4.4' into release-0.4.4David Goulet
2021-01-28Merge branch 'maint-0.4.3' into maint-0.4.4David Goulet
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion