torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

config: Remove AllowSingleHopExits option

Browse Source 
Deprecated in 0.2.9.2-alpha, this commits changes it as OBSOLETE() and cleans
up the code associated with it.

Partially fixes #22060

Signed-off-by: David Goulet <dgoulet@torproject.org>
This commit is contained in:
David Goulet
2017-04-25 13:44:06 -04:00
committed by Nick Mathewson
parent fea72571df
commit d52a1e2faa
7 changed files with 11 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/or/config.c
+1 -10
View File
@@ -208,7 +208,7 @@ static config_var_t option_vars_[] = {
OBSOLETE("AllowInvalidNodes"),
V(AllowNonRFC953Hostnames, BOOL, "0"),
OBSOLETE("AllowSingleHopCircuits"),
V(AllowSingleHopExits, BOOL, "0"),
OBSOLETE("AllowSingleHopExits"),
V(AlternateBridgeAuthority, LINELIST, NULL),
V(AlternateDirAuthority, LINELIST, NULL),
OBSOLETE("AlternateHSAuthority"),
@@ -662,8 +662,6 @@ static const config_deprecation_t option_deprecation_notes_[] = {
/* Deprecated since 0.2.9.2-alpha... */
{ "AllowDotExit", "Unrestricted use of the .exit notation can be used for "
"a wide variety of application-level attacks." },
{ "AllowSingleHopExits", "Turning this on will make your relay easier "
"to abuse." },
{ "ClientDNSRejectInternalAddresses", "Turning this on makes your client "
"easier to fingerprint, and may open you to esoteric attacks." },
{ "ExcludeSingleHopRelays", "Turning it on makes your client easier to "
@@ -4056,13 +4054,6 @@ options_validate(or_options_t *old_options, or_options_t *options,
"AlternateDirAuthority and AlternateBridgeAuthority configured.");
}
if (options->AllowSingleHopExits && !options->DirAuthorities) {
COMPLAIN("You have set AllowSingleHopExits; now your relay will allow "
"others to make one-hop exits. However, since by default most "
"clients avoid relays that set this option, most clients will "
"ignore you.");
}
#define CHECK_DEFAULT(arg) \
STMT_BEGIN \
if (!options->TestingTorNetwork && \
src/or/connection_edge.c
+5 -7
View File
@@ -3133,15 +3133,13 @@ connection_exit_begin_conn(cell_t *cell, circuit_t *circ)
port = bcell.port;
if (or_circ && or_circ->p_chan) {
if (!options->AllowSingleHopExits &&
(or_circ->is_first_hop ||
(!connection_or_digest_is_known_relay(
if ((or_circ->is_first_hop ||
(!connection_or_digest_is_known_relay(
or_circ->p_chan->identity_digest) &&
should_refuse_unknown_exits(options)))) {
/* Don't let clients use us as a single-hop proxy, unless the user
* has explicitly allowed that in the config. It attracts attackers
* and users who'd be better off with, well, single-hop proxies.
*/
/* Don't let clients use us as a single-hop proxy. It attracts
* attackers and users who'd be better off with, well, single-hop
* proxies. */
log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
"Attempt by %s to open a stream %s. Closing.",
safe_str(channel_get_canonical_remote_descr(or_circ->p_chan)),
src/or/or.h
+1 -4
View File
@@ -4114,10 +4114,7 @@ typedef struct {
* if we are a cache). For authorities, this is always true. */
int DownloadExtraInfo;
/** If true, and we are acting as a relay, allow exit circuits even when
* we are the first hop of a circuit. */
int AllowSingleHopExits;
/** If true, don't allow relays with AllowSingleHopExits=1 to be used in
/** If true, don't allow relays with allow-single-hop-exits to be used in
* circuits that we build. */
int ExcludeSingleHopRelays;
src/or/router.c
+2 -3
View File
@@ -2932,7 +2932,7 @@ router_dump_router_to_string(routerinfo_t *router,
"onion-key\n%s"
"signing-key\n%s"
"%s%s"
"%s%s%s%s",
"%s%s%s",
router->nickname,
address,
router->or_port,
@@ -2955,8 +2955,7 @@ router_dump_router_to_string(routerinfo_t *router,
ntor_cc_line ? ntor_cc_line : "",
family_line,
we_are_hibernating() ? "hibernating 1\n" : "",
"hidden-service-dir\n",
options->AllowSingleHopExits ? "allow-single-hop-exits\n" : "");
"hidden-service-dir\n");
if (options->ContactInfo && strlen(options->ContactInfo)) {
const char *ci = options->ContactInfo;
src/test/test_options.c
-43
View File
@@ -4189,48 +4189,6 @@ test_options_validate__virtual_addr(void *ignored)
tor_free(msg);
}
static void
test_options_validate__exits(void *ignored)
{
(void)ignored;
int ret;
char *msg;
options_test_data_t *tdata = NULL;
setup_capture_of_logs(LOG_WARN);
free_options_test_data(tdata);
tdata = get_options_test_data(TEST_OPTIONS_DEFAULT_VALUES
"AllowSingleHopExits 1"
);
ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg);
tt_int_op(ret, OP_EQ, 0);
expect_log_msg("You have set AllowSingleHopExits; "
"now your relay will allow others to make one-hop exits. However,"
" since by default most clients avoid relays that set this option,"
" most clients will ignore you.\n");
tor_free(msg);
free_options_test_data(tdata);
tdata = get_options_test_data(TEST_OPTIONS_DEFAULT_VALUES
"AllowSingleHopExits 1\n"
VALID_DIR_AUTH
);
mock_clean_saved_logs();
ret = options_validate(tdata->old_opt, tdata->opt, tdata->def_opt, 0, &msg);
tt_int_op(ret, OP_EQ, 0);
expect_no_log_msg("You have set AllowSingleHopExits; "
"now your relay will allow others to make one-hop exits. However,"
" since by default most clients avoid relays that set this option,"
" most clients will ignore you.\n");
tor_free(msg);
done:
policies_free_all();
teardown_capture_of_logs();
free_options_test_data(tdata);
tor_free(msg);
}
static void
test_options_validate__testing_options(void *ignored)
{
@@ -4502,7 +4460,6 @@ struct testcase_t options_tests[] = {
LOCAL_VALIDATE_TEST(constrained_sockets),
LOCAL_VALIDATE_TEST(v3_auth),
LOCAL_VALIDATE_TEST(virtual_addr),
LOCAL_VALIDATE_TEST(exits),
LOCAL_VALIDATE_TEST(testing_options),
LOCAL_VALIDATE_TEST(accel),
END_OF_TESTCASES /* */