We do this by including the instance's subcredentials to the list of
subcredentials that are used during INTRO2 decryption.

Now we use the exact same INTRO2 decrypt logic regardless of whether the
service is an OB instance or not.

The new get_subcredential_for_handling_intro2_cell() function is responsible
for loading the right subcredentials in either case.

We now assign OB subcredentials to the service instead of computing them on the
spot. See hs_ob_refresh_keys() for more details.

This approach saves us a pair of curve25519 operations for every
subcredential but the first.  It is not yet constant-time.

I've noted a few places where IMO we should refactor the code so
that the complete list of subcredentials is passed in earlier.

David Goulet authored 5 years ago and Nick Mathewson committed 5 years ago

Signed-off-by: David Goulet <dgoulet@torproject.org>

David Goulet authored 5 years ago and Nick Mathewson committed 5 years ago

Signed-off-by: David Goulet <dgoulet@torproject.org>

David Goulet authored 5 years ago and Nick Mathewson committed 5 years ago

Signed-off-by: David Goulet <dgoulet@torproject.org>

David Goulet authored 5 years ago and Nick Mathewson committed 5 years ago

Pointed by nickm during the review of #32709.

Signed-off-by: David Goulet <dgoulet@torproject.org>

David Goulet authored 5 years ago and Nick Mathewson committed 5 years ago

Closes #32709

Signed-off-by: David Goulet <dgoulet@torproject.org>

David Goulet authored 5 years ago and Nick Mathewson committed 5 years ago

At this commit, the service reads the config file and parse it to finally set
the service config object with the options.

Part of #32709

Signed-off-by: David Goulet <dgoulet@torproject.org>

George Kadianakis authored 5 years ago and Nick Mathewson committed 5 years ago

Part of #32709

Signed-off-by: David Goulet <dgoulet@torproject.org>

David Goulet authored 5 years ago and Nick Mathewson committed 5 years ago

The hs_parse_address() can not be used without an options_t object existing
since on error it uses the escaped_safe_str() that looks at the options.

This new function won't log and returns an error message in case of failure
that can then be used to log.

Signed-off-by: David Goulet <dgoulet@torproject.org>

Fix a client port list that's missing HTTPTunnelPort.

Wrap a long line.

Explain that:
* most flags default to off
* flags that default to on are specified

Document PreferIPv6Automap in its "No" form, because it's on by
default.

Cleanup after 32637.

Make Tor clients tell dual-stack exits that they prefer IPv6
connections.

This change is equivalent to setting the PreferIPv6 flag on
SOCKSPorts (and most other listener ports). Tor Browser has
been setting this flag for some time, and we want to remove a
client distinguisher at exits.

Also update the man page, putting all the IP flags in their
non-default forms.

Closes ticket 32637.

When we removed obsolete consensus methods in 32695, we also
removed ROUTERSTATUS_FORMAT_NO_CONSENSUS_METHOD, so we need to
remove it from the routerstatus format tests.

Part of 20218.

* ticket 32695 removed networkstatus_consensus_has_ipv6(),
  keep that change in master.
* ticket 20218 modifies the function name and comment for
  routerstatus_has_visibly_changed(), keep that change
  in ticket20218_rebased_squashed.

Nick Mathewson authored 5 years ago and teor committed 5 years ago

This is an automated commit, generated by this command:

./scripts/maint/rename_c_identifier.py \
        routerstatus_has_changed routerstatus_has_visibly_changed

It was generated with --no-verify, since it introduces a wide line.
I'll fix it in a subsequent commit.

Nick Mathewson authored 5 years ago and teor committed 5 years ago

Now they also check whether output of routerstatus_format_entry()
has changed.

Fix dirauth and relay module include.am add_c_file.py
"control line not preceded by a blank line" errors.

Also remove a duplicate ADD_C_FILE: SOURCES in the relay module.

Obviously correct fixes to already-reviewed code.

Closes 32962.

Part of 32962.

Check that the script isn't in a tor build directory, by looking
for a src/include.am file.

Part of 32962.

Fixes bug 32778; bugfix on 0.4.1.1-alpha.

This reverts commit dca26294.