Merge branch 'maint-0.2.2' into release-0.2.2

changes/bug2379

@@ -0,0 +1,5 @@
+  o Documentation:
+    - Add missing documentation for the authority-related torrc options
+      RephistTrackTime, BridgePassword, and V3AuthUseLegacyKey.  Resolves
+      issue 2379.
+      

changes/bug3022

@@ -0,0 +1,6 @@
+  o Removed features
+    - Caches no longer download and serve v2 networkstatus documents
+      unless FetchV2Networkstatus flag is set: these documents haven't
+      haven't been used by clients or relays since 0.2.0.x.  Resolves
+      bug 3022.
+

changes/dirvote_null_deref

@@ -0,0 +1,4 @@
+  o Minor bugfixes:
+    - Fix a potential null-pointer dereference while computing a consensus.
+      Bugfix on tor-0.2.0.3-alpha, found with the help of clang's analyzer.
+

changes/geoip-may2011

@@ -0,0 +1,3 @@
+  o Minor features:
+    - Update to the May 1 2011 Maxmind GeoLite Country database.
+

changes/mdesc_null_deref

@@ -0,0 +1,5 @@
+  o Minor bugfixes:
+    - Avoid a possible null-pointer dereference when rebuilding the mdesc
+      cache without actually having any descriptors to cache. Bugfix on
+      0.2.2.6-alpha. Issue discovered using clang's static analyzer.
+

changes/warn-if-get_digest-fails

@@ -0,0 +1,6 @@
+  o Minor bugfixes:
+    - If we fail to compute the identity digest of a v3 legacy
+      keypair, warn, and don't use a buffer-full of junk instead.
+      Bugfix on 0.2.1.1-alpha; fixes bug 3106.
+
+

doc/HACKING

@@ -435,6 +435,8 @@ interesting and understandable.
 
    Make stuff very terse
 
+   Make sure each section name ends with a colon
+
    Describe the user-visible problem right away
 
    Mention relevant config options by name.  If they're rare or unusual,
@@ -474,10 +476,11 @@ in their approved versions list.
 and push the git tag.
    (That's either "git tag -u <keyid> tor-0.2.x.y-status", then
     "git push origin tag tor-0.2.x.y-status".  To sign the
-    tarball, "gpg -ba <the_tarball>")
+    tarball, "gpg -ba <the_tarball>".  Put the files in
+    /srv/www-master.torproject.org/htdocs/dist/ on vescum.)
 
-8) Edit include/versions.wmi to note the new version. Rebuild and push
-the website.
+8) Edit include/versions.wmi to note the new version. From your website
+checkout, run ./publish to build and publish the website.
 
 9) Email Erinn and weasel (cc'ing tor-assistants) that a new tarball
 is up. This step should probably change to mailing more packagers.

doc/tor.1.txt

@@ -1171,6 +1171,12 @@ if DirPort is non-zero):
     Set an entrance policy for this server, to limit who can connect to the
     directory ports. The policies have the same form as exit policies above.
 
+**FetchV2Networkstatus** **0**|**1**::
+    If set, we try to fetch the (obsolete, unused) version 2 network status
+    consensus documents from the directory authorities. No currently
+    supported Tor version uses them.  (Default: 0.)
+
+
 DIRECTORY AUTHORITY SERVER OPTIONS
 ----------------------------------
 
@@ -1253,6 +1259,11 @@ DIRECTORY AUTHORITY SERVER OPTIONS
     Authoritative directories only. Like AuthDirMaxServersPerAddr, but applies
     to addresses shared with directory authorities. (Default: 5)
 
+**BridgePassword** __Password__::
+    If set, contains an HTTP authenticator that tells a bridge authority to
+    serve all requested bridge information.  Used for debugging.  (Default:
+    not set.)
+
 **V3AuthVotingInterval** __N__ **minutes**|**hours**::
     V3 authoritative directories only. Configures the server's preferred voting
     interval. Note that voting will __actually__ happen at an interval chosen
@@ -1285,6 +1296,17 @@ DIRECTORY AUTHORITY SERVER OPTIONS
     bandiwdth-authority generated file storing information on relays' measured
     bandwidth capacities. (Default: unset.)
 
+**V3AuthUseLegacyKey** **0**|**1**::
+    If set, the directory authority will sign consensuses not only with its
+    own signing key, but also with a "legacy" key and certificate with a
+    different identity.  This feature is used to migrate directory authority
+    keys in the event of a compromise.  (Default: 0.)
+
+**RephistTrackTime** __N__ **seconds**|**minutes**|**hours**|**days**|**weeks**::
+    Tells an authority, or other node tracking node reliability and history,
+    that fine-grained information about nodes can be discarded when it hasn't
+    changed for a given amount of time.  (Default: 24 hours)
+
 HIDDEN SERVICE OPTIONS
 ----------------------
 

src/common/compat.c

@@ -2062,7 +2062,6 @@ correct_tm(int islocal, const time_t *timep, struct tm *resultbuf,
   return r;
 }
 
-
 /** @{ */
 /** As localtime_r, but defined for platforms that don't have it:
  *

src/or/circuitbuild.c

@@ -559,7 +559,9 @@ circuit_build_times_create_histogram(circuit_build_times_t *cbt,
  * Return the Pareto start-of-curve parameter Xm.
  *
  * Because we are not a true Pareto curve, we compute this as the
- * weighted average of the N=3 most frequent build time bins.
+ * weighted average of the N most frequent build time bins. N is either
+ * 1 if we don't have enough circuit build time data collected, or
+ * determined by the consensus parameter cbtnummodes (default 3).
  */
 static build_time_t
 circuit_build_times_get_xm(circuit_build_times_t *cbt)
@@ -572,6 +574,9 @@ circuit_build_times_get_xm(circuit_build_times_t *cbt)
   int n=0;
   int num_modes = circuit_build_times_default_num_xm_modes();
 
+  tor_assert(nbins > 0);
+  tor_assert(num_modes > 0);
+
   // Only use one mode if < 1000 buildtimes. Not enough data
   // for multiple.
   if (cbt->total_build_times < CBT_NCIRCUITS_TO_OBSERVE)
@@ -579,6 +584,7 @@ circuit_build_times_get_xm(circuit_build_times_t *cbt)
 
   nth_max_bin = (build_time_t*)tor_malloc_zero(num_modes*sizeof(build_time_t));
 
+  /* Determine the N most common build times */
   for (i = 0; i < nbins; i++) {
     if (histogram[i] >= histogram[nth_max_bin[0]]) {
       nth_max_bin[0] = i;
@@ -600,6 +606,10 @@ circuit_build_times_get_xm(circuit_build_times_t *cbt)
              histogram[nth_max_bin[n]]);
   }
 
+  /* The following assert is safe, because we don't get called when we
+   * haven't observed at least CBT_MIN_MIN_CIRCUITS_TO_OBSERVE circuits. */
+  tor_assert(bin_counts > 0);
+
   ret /= bin_counts;
   tor_free(histogram);
   tor_free(nth_max_bin);

src/or/config.c

@@ -255,6 +255,7 @@ static config_var_t _option_vars[] = {
   V(FetchServerDescriptors,      BOOL,     "1"),
   V(FetchHidServDescriptors,     BOOL,     "1"),
   V(FetchUselessDescriptors,     BOOL,     "0"),
+  V(FetchV2Networkstatus,        BOOL,     "0"),
 #ifdef WIN32
   V(GeoIPFile,                   FILENAME, "<default>"),
 #else

src/or/connection.c

@@ -1240,7 +1240,7 @@ connection_connect(connection_t *conn, const char *address,
 {
   int s, inprogress = 0;
   char addrbuf[256];
-  struct sockaddr *dest_addr = (struct sockaddr*) addrbuf;
+  struct sockaddr *dest_addr;
   socklen_t dest_addr_len;
   or_options_t *options = get_options();
   int protocol_family;

src/or/connection_or.c

@@ -1414,9 +1414,8 @@ connection_or_send_netinfo(or_connection_t *conn)
     len = append_address_to_payload(out, &my_addr);
     if (len < 0)
       return -1;
-    out += len;
   } else {
-    *out++ = 0;
+    *out = 0;
   }
 
   connection_or_write_cell_to_buf(&cell, conn);

src/or/control.c

@@ -3875,7 +3875,7 @@ static int bootstrap_problems = 0;
  * information and initial circuits.
  *
  * <b>status</b> is the new status, that is, what task we will be doing
- * next. <b>percent</b> is zero if we just started this task, else it
+ * next. <b>progress</b> is zero if we just started this task, else it
  * represents progress on the task. */
 void
 control_event_bootstrap(bootstrap_status_t status, int progress)
@@ -3931,6 +3931,9 @@ control_event_bootstrap_problem(const char *warn, int reason)
   char buf[BOOTSTRAP_MSG_LEN];
   const char *recommendation = "ignore";
 
+  /* bootstrap_percent must not be in "undefined" state here. */
+  tor_assert(status >= 0);
+
   if (bootstrap_percent == 100)
     return; /* already bootstrapped; nothing to be done here. */
 

src/or/directory.c

@@ -353,6 +353,7 @@ directory_get_from_dirserver(uint8_t dir_purpose, uint8_t router_purpose,
       break;
     case DIR_PURPOSE_FETCH_V2_NETWORKSTATUS:
       type = V2_AUTHORITY;
+      prefer_authority = 1; /* Only v2 authorities have these anyway. */
       break;
     case DIR_PURPOSE_FETCH_SERVERDESC:
       type = (router_purpose == ROUTER_PURPOSE_BRIDGE ? BRIDGE_AUTHORITY :

src/or/dirserv.c

@@ -2705,7 +2705,10 @@ dirserv_generate_networkstatus_vote_obj(crypto_pk_env_t *private_key,
   if (options->V3AuthUseLegacyKey) {
     authority_cert_t *c = get_my_v3_legacy_cert();
     if (c) {
-      crypto_pk_get_digest(c->identity_key, voter->legacy_id_digest);
+      if (crypto_pk_get_digest(c->identity_key, voter->legacy_id_digest)) {
+        log_warn(LD_BUG, "Unable to compute digest of legacy v3 identity key");
+        memset(voter->legacy_id_digest, 0, DIGEST_LEN);
+      }
     }
   }
 

src/or/dirvote.c

@@ -444,9 +444,9 @@ compute_routerstatus_consensus(smartlist_t *votes, int consensus_method,
     if (cur && !compare_vote_rs(cur, rs)) {
       ++cur_n;
     } else {
-      if (cur_n > most_n ||
-          (cur && cur_n == most_n &&
-           cur->status.published_on > most_published)) {
+      if (cur && (cur_n > most_n ||
+                  (cur_n == most_n &&
+                   cur->status.published_on > most_published))) {
         most = cur;
         most_n = cur_n;
         most_published = cur->status.published_on;
@@ -3129,8 +3129,12 @@ dirvote_compute_consensuses(void)
       authority_cert_t *cert = get_my_v3_legacy_cert();
       legacy_sign = get_my_v3_legacy_signing_key();
       if (cert) {
-        crypto_pk_get_digest(cert->identity_key, legacy_dbuf);
-        legacy_id_digest = legacy_dbuf;
+        if (crypto_pk_get_digest(cert->identity_key, legacy_dbuf)) {
+          log_warn(LD_BUG,
+                   "Unable to compute digest of legacy v3 identity key");
+        } else {
+          legacy_id_digest = legacy_dbuf;
+        }
       }
     }
 

src/or/main.c

@@ -1587,6 +1587,7 @@ do_main_loop(void)
   }
 }
 
+#ifndef MS_WINDOWS /* Only called when we're willing to use signals */
 /** Libevent callback: invoked when we get a signal.
  */
 static void
@@ -1598,6 +1599,7 @@ signal_callback(int fd, short events, void *arg)
 
   process_signal(sig);
 }
+#endif
 
 /** Do the work of acting on a signal received in <b>sig</b> */
 void

src/or/microdesc.c

@@ -423,7 +423,7 @@ microdesc_cache_rebuild(microdesc_cache_t *cache, int force)
   cache->journal_len = 0;
   cache->bytes_dropped = 0;
 
-  new_size = (int)cache->cache_content->size;
+  new_size = cache->cache_content ? (int)cache->cache_content->size : 0;
   log_info(LD_DIR, "Done rebuilding microdesc cache. "
            "Saved %d bytes; %d still used.",
            orig_size-new_size, new_size);

src/or/networkstatus.c

@@ -1356,7 +1356,7 @@ update_networkstatus_downloads(time_t now)
   or_options_t *options = get_options();
   if (should_delay_dir_fetches(options))
     return;
-  if (directory_fetches_dir_info_early(options))
+  if (authdir_mode_any_main(options) || options->FetchV2Networkstatus)
     update_v2_networkstatus_cache_downloads(now);
   update_consensus_networkstatus_downloads(now);
   update_certificate_downloads(now);

src/or/or.h

@@ -2489,7 +2489,9 @@ typedef struct {
   /** Boolean: do we publish hidden service descriptors to the HS auths? */
   int PublishHidServDescriptors;
   int FetchServerDescriptors; /**< Do we fetch server descriptors as normal? */
-  int FetchHidServDescriptors; /** and hidden service descriptors? */
+  int FetchHidServDescriptors; /**< and hidden service descriptors? */
+  int FetchV2Networkstatus; /**< Do we fetch v2 networkstatus documents when
+                             * we don't need to? */
   int HidServDirectoryV2; /**< Do we participate in the HS DHT? */
 
   int MinUptimeHidServDirectoryV2; /**< As directory authority, accept hidden
@@ -3203,7 +3205,9 @@ typedef enum buildtimeout_set_event_t {
  */
 #define CONN_LOG_PROTECT(conn, stmt)                                    \
   STMT_BEGIN                                                            \
-    int _log_conn_is_control = (conn && conn->type == CONN_TYPE_CONTROL); \
+    int _log_conn_is_control;                                           \
+    tor_assert(conn);                                                   \
+    _log_conn_is_control = (conn->type == CONN_TYPE_CONTROL);           \
     if (_log_conn_is_control)                                           \
       disable_control_logging();                                        \
   STMT_BEGIN stmt; STMT_END;                                            \

src/or/rendclient.c

@@ -277,7 +277,7 @@ rend_client_send_introduction(origin_circuit_t *introcirc,
   introcirc->_base.purpose = CIRCUIT_PURPOSE_C_INTRODUCE_ACK_WAIT;
 
   return 0;
-perm_err:
+ perm_err:
   if (!introcirc->_base.marked_for_close)
     circuit_mark_for_close(TO_CIRCUIT(introcirc), END_CIRC_REASON_INTERNAL);
   circuit_mark_for_close(TO_CIRCUIT(rendcirc), END_CIRC_REASON_INTERNAL);