summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-10-19test: Don't run HSv2 Chutney test networksDavid Goulet
Part of #40476 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19test: Fix unit tests after disabling version 2David Goulet
Some tests were removed because they were testing something not usable anymore. Some tests remains to make sure that things are indeed disabled. Part of #40476 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19hs-v2: Disable version 2 HSPOST and HSFETCH commandDavid Goulet
Part of #40476 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19hs-v2: Disable version 2 directoryDavid Goulet
Relay do not accept both stores and lookups of version 2 descriptor. This effectively disable version 2 HSDir supports for relays. Part of #40476 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19hs-v2: Disable version 2 introduction pointDavid Goulet
Upon receiving a v2 introduction request, the relay will close the circuit and send back a tor protocol error. Part of #40476 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19hs-v2: Disable version 2 serviceDavid Goulet
The minimum service version is raised from 2 to 3 which effectively disable loading or creating an onion service v2. As for ADD_ONION, for version 2, a 551 error is returned: "551 Failed to add Onion Service" Part of #40476 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-19hs-v2: Disable SOCKS connection for v2 addressesDavid Goulet
This effectively turns off the ability of tor to use HSv2 as a client by invalidating the v2 onion hostname passed through a SOCKS request. Part of #40476 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-06Merge branch 'maint-0.4.6' into release-0.4.6David Goulet
2021-10-06Merge branch 'maint-0.4.5' into maint-0.4.6David Goulet
2021-10-06Merge branch 'tor-gitlab/mr/392' into maint-0.4.5David Goulet
2021-10-06Merge branch 'maint-0.4.6' into release-0.4.6David Goulet
2021-10-06Merge branch 'maint-0.4.5' into maint-0.4.6David Goulet
2021-10-06Merge branch 'tor-gitlab/mr/393' into maint-0.4.5David Goulet
2021-10-06Merge branch 'maint-0.4.6' into release-0.4.6David Goulet
2021-10-06Merge branch 'maint-0.4.5' into maint-0.4.6David Goulet
2021-10-06Merge branch 'tor-gitlab/mr/420' into maint-0.4.5David Goulet
2021-10-06Merge branch 'maint-0.4.6' into release-0.4.6David Goulet
2021-10-06Merge branch 'maint-0.4.5' into maint-0.4.6David Goulet
2021-10-06hs-v2: Only log once the connection warning to v2David Goulet
Closes #40474 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-10-06hs-v2: Only log once the connection warning to v2David Goulet
Closes #40474 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-09-30hs-v2: Disable version 2 HSPOST and HSFETCH commandDavid Goulet
Part of #40476 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-09-30hs-v2: Disable version 2 directoryDavid Goulet
Relay do not accept both stores and lookups of version 2 descriptor. This effectively disable version 2 HSDir supports for relays. Part of #40476 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-09-30hs-v2: Disable version 2 introduction pointDavid Goulet
Upon receiving a v2 introduction request, the relay will close the circuit and send back a tor protocol error. Part of #40476 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-09-30hs-v2: Disable version 2 serviceDavid Goulet
The minimum service version is raised from 2 to 3 which effectively disable loading or creating an onion service v2. As for ADD_ONION, for version 2, a 551 error is returned: "551 Failed to add Onion Service" Part of #40476 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-09-30hs-v2: Disable SOCKS connection for v2 addressesDavid Goulet
This effectively turns off the ability of tor to use HSv2 as a client by invalidating the v2 onion hostname passed through a SOCKS request. Part of #40476 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-09-13Merge branch 'maint-0.4.6' into release-0.4.6David Goulet
2021-09-13Merge branch 'maint-0.4.5' into maint-0.4.6David Goulet
2021-09-13Merge branch 'maint-0.3.5' into maint-0.4.5David Goulet
2021-09-13Only check for bindable ports if we are unsure if it will fail.Alexander Færøy
We currently assume that the only way for Tor to listen on ports in the privileged port range (1 to 1023), on Linux, is if we are granted the NET_BIND_SERVICE capability. Today on Linux, it's possible to specify the beginning of the unprivileged port range using a sysctl configuration option. Docker (and thus the CI service Tor uses) recently changed this sysctl value to 0, which causes our tests to fail as they assume that we should NOT be able to bind to a privileged port *without* the NET_BIND_SERVICE capability. In this patch, we read the value of the sysctl value via the /proc/sys/ filesystem iff it's present, otherwise we assume the default unprivileged port range begins at port 1024. See: tor#40275
2021-09-13Use Debian bullseye for our hardened build.Alexander Færøy
2021-09-13Force amd64 for CI builds.Alexander Færøy
2021-08-17dir: Do not flag non-running failing HSDirDavid Goulet
When a directory request fails, we flag the relay as non Running so we don't use it anymore. This can be problematic with onion services because there are cases where a tor instance could have a lot of services, ephemeral ones, and keeps failing to upload descriptors, let say due to a bad network, and thus flag a lot of nodes as non Running which then in turn can not be used for circuit building. This commit makes it that we never flag nodes as non Running on a onion service directory request (upload or fetch) failure as to keep the hashring intact and not affect other parts of tor. Fortunately, the onion service hashring is _not_ selected by looking at the Running flag but since we do a 3-hop circuit to the HSDir, other services on the same instance can influence each other by removing nodes from the consensus for path selection. This was made apparent with a small network that ran out of nodes to used due to rapid succession of onion services uploading and failing. See #40434 for details. Fixes #40434 Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-08-16Merge branch 'maint-0.4.6' into release-0.4.6David Goulet
2021-08-16Merge branch 'maint-0.4.5' into maint-0.4.6David Goulet
2021-08-16Bump version to -devDavid Goulet
Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-08-16Merge branch 'maint-0.3.5' into maint-0.4.5David Goulet
2021-08-16Bump version to -devDavid Goulet
Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-08-16Bump version to -devDavid Goulet
Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-08-16changelog: Run format_changelog.pytor-0.4.6.7David Goulet
Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-08-16changelog: Update with security fix stanzaDavid Goulet
Signed-off-by: David Goulet <dgoulet@torproject.org>
2021-08-16Merge branch 'maint-0.4.5' into maint-0.4.6Alexander Færøy
2021-08-16Merge branch 'maint-0.4.6' into release-0.4.6Alexander Færøy
2021-08-16Always teardown capture of logs in CAPTURE().Alexander Færøy
This will hopefully solve an issue where our gmtime related tests are failing on 32-bit builds.
2021-08-16Merge branch 'maint-0.4.5' into maint-0.4.6Alexander Færøy
2021-08-16Merge branch 'maint-0.4.6' into release-0.4.6Alexander Færøy
2021-08-16Merge branch 'maint-0.3.5' into maint-0.4.5Alexander Færøy
2021-08-16Use debian:buster instead of debian:stable for now.Alexander Færøy
2021-08-16Merge branch 'maint-0.4.5' into maint-0.4.6Nick Mathewson
2021-08-16Merge branch 'maint-0.4.6' into release-0.4.6Nick Mathewson
2021-08-16Disable message checking for some 32-bit tests about timegm failure.Nick Mathewson
Since we merged 40383, we don't expect these to give the same warning on every platform.
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion