From 56ee61b8aed058c20edc9c7e10dc48f1ab798bbc Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Wed, 23 Jul 2014 12:23:49 -0400 Subject: [PATCH 1/3] Add and use a new NumEntryGuards consensus parameter. When specified, it overrides our default of 3 entry guards. (By default, it overrides the number of directory guards too.) Implements ticket 12688. --- changes/ticket12688 | 5 +++++ src/or/config.c | 5 +---- src/or/entrynodes.c | 8 ++++++-- 3 files changed, 12 insertions(+), 6 deletions(-) create mode 100644 changes/ticket12688 diff --git a/changes/ticket12688 b/changes/ticket12688 new file mode 100644 index 0000000000..d8e56c1537 --- /dev/null +++ b/changes/ticket12688 @@ -0,0 +1,5 @@ + Major features: + - Make the number of entry guards (and thus, by default, directory + guards too) configurable via a new NumEntryGuards consensus + parameter. Implements ticket 12688. + diff --git a/src/or/config.c b/src/or/config.c index 09fdc0c493..a2811ebc21 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -315,7 +315,7 @@ static config_var_t option_vars_[] = { VAR("NodeFamily", LINELIST, NodeFamilies, NULL), V(NumCPUs, UINT, "0"), V(NumDirectoryGuards, UINT, "0"), - V(NumEntryGuards, UINT, "3"), + V(NumEntryGuards, UINT, "0"), V(ORListenAddress, LINELIST, NULL), VPORT(ORPort, LINELIST, NULL), V(OutboundBindAddress, LINELIST, NULL), @@ -3031,9 +3031,6 @@ options_validate(or_options_t *old_options, or_options_t *options, "have it group-readable."); } - if (options->UseEntryGuards && ! options->NumEntryGuards) - REJECT("Cannot enable UseEntryGuards with NumEntryGuards set to 0"); - if (options->MyFamily && options->BridgeRelay) { log_warn(LD_CONFIG, "Listing a family for a bridge relay is not " "supported: it can reveal bridge fingerprints to censors. " diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 59770fa658..abd10e385e 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -435,7 +435,10 @@ decide_num_guards(const or_options_t *options, int for_directory) { if (for_directory && options->NumDirectoryGuards != 0) return options->NumDirectoryGuards; - return options->NumEntryGuards; + if (options->NumEntryGuards) + return options->NumEntryGuards; + /* Use the value from the consensus, or 3 if no guidance. */ + return networkstatus_get_param(NULL, "NumEntryGuards", 3, 1, 10); } /** If the use of entry guards is configured, choose more entry guards @@ -815,6 +818,7 @@ entry_guards_set_from_config(const or_options_t *options) { smartlist_t *entry_nodes, *worse_entry_nodes, *entry_fps; smartlist_t *old_entry_guards_on_list, *old_entry_guards_not_on_list; + const int numentryguards = decide_num_guards(options, 0); tor_assert(entry_guards); should_add_entry_nodes = 0; @@ -883,7 +887,7 @@ entry_guards_set_from_config(const or_options_t *options) /* Next, the rest of EntryNodes */ SMARTLIST_FOREACH_BEGIN(entry_nodes, const node_t *, node) { add_an_entry_guard(node, 0, 0, 1, 0); - if (smartlist_len(entry_guards) > options->NumEntryGuards * 10) + if (smartlist_len(entry_guards) > numentryguards * 10) break; } SMARTLIST_FOREACH_END(node); log_notice(LD_GENERAL, "%d entries in guards", smartlist_len(entry_guards)); From 9fc276a1c7f94d1e0a48e00a358536027a9a7820 Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Wed, 23 Jul 2014 15:28:40 -0400 Subject: [PATCH 2/3] add a NumDirectoryGuards consensus param too --- changes/ticket12688 | 5 +++-- src/or/entrynodes.c | 12 ++++++++++-- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/changes/ticket12688 b/changes/ticket12688 index d8e56c1537..88228e5506 100644 --- a/changes/ticket12688 +++ b/changes/ticket12688 @@ -1,5 +1,6 @@ Major features: - - Make the number of entry guards (and thus, by default, directory - guards too) configurable via a new NumEntryGuards consensus + - Make the number of entry guards configurable via a new + NumEntryGuards consensus parameter, and the number of directory + guards configurable via a new NumDirectoryGuards consensus parameter. Implements ticket 12688. diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index abd10e385e..484b88dbf8 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -433,10 +433,18 @@ add_an_entry_guard(const node_t *chosen, int reset_status, int prepend, static int decide_num_guards(const or_options_t *options, int for_directory) { - if (for_directory && options->NumDirectoryGuards != 0) - return options->NumDirectoryGuards; + if (for_directory) { + int answer; + if (options->NumDirectoryGuards != 0) + return options->NumDirectoryGuards; + answer = networkstatus_get_param(NULL, "NumDirectoryGuards", 0, 0, 10); + if (answer) /* non-zero means use the consensus value */ + return answer; + } + if (options->NumEntryGuards) return options->NumEntryGuards; + /* Use the value from the consensus, or 3 if no guidance. */ return networkstatus_get_param(NULL, "NumEntryGuards", 3, 1, 10); } From 71c62b15ca809105cbba0bf2fa86484793701b64 Mon Sep 17 00:00:00 2001 From: Roger Dingledine Date: Thu, 24 Jul 2014 12:19:15 -0400 Subject: [PATCH 3/3] update manpage for numentryguards / numdirectoryguards --- doc/tor.1.txt | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index eb9ad6770a..779db61c29 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1054,12 +1054,16 @@ The following options are useful only for clients (that is, if [[NumEntryGuards]] **NumEntryGuards** __NUM__:: If UseEntryGuards is set to 1, we will try to pick a total of NUM routers - as long-term entries for our circuits. (Default: 3) + as long-term entries for our circuits. If NUM is 0, we try to learn + the number from the NumEntryGuards consensus parameter, and default + to 3 if the consensus parameter isn't set. (Default: 0) [[NumDirectoryGuards]] **NumDirectoryGuards** __NUM__:: If UseEntryGuardsAsDirectoryGuards is enabled, we try to make sure we have at least NUM routers to use as directory guards. If this option - is set to 0, use the value from NumEntryGuards. (Default: 0) + is set to 0, use the value from the NumDirectoryGuards consensus + parameter, falling back to the value from NumEntryGuards if the + consensus parameter is 0 or isn't set. (Default: 0) [[GuardLifetime]] **GuardLifetime** __N__ **days**|**weeks**|**months**:: If nonzero, and UseEntryGuards is set, minimum time to keep a guard before