On Tue, 19 Sep 2023 22:52:11 +0000, Anonymous <nobody@yamn.paranoici.org> wrote:
>Anonymous <nobody@yamn.paranoici.org> wrote:
>>In Omnimix > tor tab
>>07:57:32.640 650 WARN Relay address suggestion coming from non trusted
>>source 37.252.187.14 accepted due to OmniMix patch
>
>That's only relevant in case you use TorIP as a DynDNS replacement (with
>the own IP address also being shown at Tor/Data).
>The patch enables the local tor client to pass through its own WAN
>address, requested from the entry node, to the OmniMix Tor controller,
>even if that Tor node isn't a trusted directory authority.
><https://gitlab.torproject.org/tpo/core/tor/-/blob/main/src/feature/relay/relay_find_addr.c?ref_type=heads#L66>

(using Tor Browser 12.5.4, quoted plain text)
https://gitlab.torproject.org/tpo/core/tor/-/blob/main/src/feature/relay/relay_find_addr.c
>relay_find_addr.c 8.75 KiB
>
> 1 /* Copyright (c) 2001-2021, The Tor Project, Inc. */
> 2 /* See LICENSE for licensing information */
> 3
> 4 /**
> 5 * \file relay_find_addr.c
> 6 * \brief Implement mechanism for a relay to find its address.
> 7 **/
> 8
> 9 #include "core/or/or.h"
> 10
> 11 #include "app/config/config.h"
> 12 #include "app/config/resolve_addr.h"
> 13
> 14 #include "core/mainloop/mainloop.h"
> 15 #include "core/or/circuitlist.h"
> 16 #include "core/or/circuituse.h"
> 17 #include "core/or/extendinfo.h"
> 18
> 19 #include "feature/control/control_events.h"
> 20 #include "feature/dircommon/dir_connection_st.h"
> 21 #include "feature/nodelist/dirlist.h"
> 22 #include "feature/nodelist/node_select.h"
> 23 #include "feature/nodelist/nodelist.h"
> 24 #include "feature/nodelist/routerstatus_st.h"
> 25 #include "feature/relay/relay_find_addr.h"
> 26 #include "feature/relay/router.h"
> 27 #include "feature/relay/routermode.h"
> 28
> 29 /** Consider the address suggestion suggested_addr as a possible one to use as
> 30 * our address.
> 31 *
> 32 * This is called when a valid NETINFO cell is received containing a candidate
> 33 * for our address or when a directory sends us back the X-Your-Address-Is
> 34 * header.
> 35 *
> 36 * The suggested address is ignored if it does NOT come from a trusted source.
> 37 * At the moment, we only look a trusted directory authorities.
> 38 *
> 39 * The suggested address is ignored if it is internal or it is the same as the
> 40 * given peer_addr which is the address from the endpoint that sent the
> 41 * NETINFO cell.
> 42 *
> 43 * The identity_digest is NULL if this is an address suggested by a directory
> 44 * since this is a plaintext connection.
> 45 *
> 46 * The suggested address is set in our suggested address cache if everything
> 47 * passes. */
> 48 void
> 49 relay_address_new_suggestion(const tor_addr_t *suggested_addr,
> 50 const tor_addr_t *peer_addr,
> 51 const char *identity_digest)
> 52 {
> 53 const or_options_t *options = get_options();
> 54
> 55 tor_assert(suggested_addr);
> 56 tor_assert(peer_addr);
> 57
> 58 /* Non server should just ignore this suggestion. Clients don't need to
> 59 * learn their address let alone cache it. */
> 60 if (!server_mode(options)) {
> 61 return;
> 62 }
> 63
> 64 /* Is the peer a trusted source? Ignore anything coming from non trusted
> 65 * source. In this case, we only look at trusted directory authorities. */
> 66 if (!router_addr_is_trusted_dir(peer_addr) ||
> 67 (identity_digest && !router_digest_is_trusted_dir(identity_digest))) {
> 68 return;
> 69 }
> 70
> 71 /* Ignore a suggestion that is an internal address or the same as the one
> 72 * the peer address. */
> 73 if (tor_addr_is_internal(suggested_addr, 0)) {
> 74 /* Do not believe anyone who says our address is internal. */
> 75 return;
> 76 }
> 77 if (tor_addr_eq(suggested_addr, peer_addr)) {
> 78 /* Do not believe anyone who says our address is their address. */
> 79 log_fn(LOG_PROTOCOL_WARN, LD_PROTOCOL,
> 80 "A relay endpoint %s is telling us that their address is ours.",
> 81 safe_str(fmt_addr(peer_addr)));
> 82 return;
> 83 }
> 84
> 85 /* Save the suggestion in our cache. */
> 86 resolved_addr_set_suggested(suggested_addr);
> 87 }
> 88
> 89 /** Find our address to be published in our descriptor. Three places are
> 90 * looked at:
> 91 *
> 92 * 1. Resolved cache. Populated by find_my_address() during the relay
> 93 * periodic event that attempts to learn if our address has changed.
> 94 *
> 95 * 2. If flags is set with RELAY_FIND_ADDR_CACHE_ONLY, only the resolved
> 96 * and suggested cache are looked at. No address discovery will be done.
> 97 *
> 98 * 3. Finally, if all fails, use the suggested address cache which is
> 99 * populated by the NETINFO cell content or HTTP header from a
>100 * directory.
>101 *
>102 * The AddressDisableIPv6 is checked here for IPv6 address discovery and if
>103 * set, false is returned and addr_out is UNSPEC.
>104 *
>105 * Before doing any discovery, the configuration is checked for an ORPort of
>106 * the given family. If none can be found, false is returned and addr_out is
>107 * UNSPEC.
>108 *
>109 * Return true on success and addr_out contains the address to use for the
>110 * given family. On failure to find the address, false is returned and
>111 * addr_out is set to an AF_UNSPEC address. */
>112 MOCK_IMPL(bool,
>113 relay_find_addr_to_publish, (const or_options_t *options, int family,
>114 int flags, tor_addr_t *addr_out))
>115 {
>116 tor_assert(options);
>117 tor_assert(addr_out);
>118
>119 tor_addr_make_unspec(addr_out);
>120
>121 /* If an IPv6 is requested, check if IPv6 address discovery is disabled on
>122 * this instance. If so, we return a failure. It is done here so we don't
>123 * query the suggested cache that might be populated with an IPv6. */
>124 if (family == AF_INET6 && options->AddressDisableIPv6) {
>125 return false;
>126 }
>127
>128 /* There is no point on attempting an address discovery to publish if we
>129 * don't have an ORPort for this family. */
>130 if (!routerconf_find_or_port(options, family)) {
>131 return false;
>132 }
>133
>134 /* First, check our resolved address cache. It should contain the address
>135 * we've discovered from the periodic relay event. */
>136 resolved_addr_get_last(family, addr_out);
>137 if (!tor_addr_is_null(addr_out)) {
>138 goto found;
>139 }
>140
>141 /* Second, attempt to find our address. The following can do a DNS resolve
>142 * thus only do it when the no cache only flag is flipped. */
>143 if (!(flags & RELAY_FIND_ADDR_CACHE_ONLY)) {
>144 if (find_my_address(options, family, LOG_INFO, addr_out, NULL, NULL)) {
>145 goto found;
>146 }
>147 }
>148
>149 /* Third, consider address from our suggestion cache. */
>150 resolved_addr_get_suggested(family, addr_out);
>151 if (!tor_addr_is_null(addr_out)) {
>152 goto found;
>153 }
>154
>155 /* No publishable address was found even though we have an ORPort thus
>156 * print a notice log so operator can notice. We'll do that every hour so
>157 * it is not too spammy but enough so operators address the issue. */
>158 static ratelim_t rlim = RATELIM_INIT(3600);
>159 log_fn_ratelim(&rlim, LOG_NOTICE, LD_CONFIG,
>160 "Unable to find %s address for ORPort %u. "
>161 "You might want to specify %sOnly to it or set an "
>162 "explicit address or set Address.",
>163 fmt_af_family(family),
>164 routerconf_find_or_port(options, family),
>165 (family == AF_INET) ? fmt_af_family(AF_INET6) :
>166 fmt_af_family(AF_INET));
>167
>168 /* Not found. */
>169 return false;
>170
>171 found:
>172 return true;
>173 }
>174
>175 /** How often should we launch a circuit to an authority to be sure of getting
>176 * a guess for our IP? */
>177 #define DUMMY_DOWNLOAD_INTERVAL (20*60)
>178
>179 void
>180 relay_addr_learn_from_dirauth(void)
>181 {
>182 static time_t last_dummy_circuit = 0;
>183 const or_options_t *options = get_options();
>184 time_t now = time(NULL);
>185 bool have_addr;
>186 tor_addr_t addr_out;
>187
>188 /* This dummy circuit only matter for relays. */
>189 if (BUG(!server_mode(options))) {
>190 return;
>191 }
>192
>193 /* Lookup the address cache to learn if we have a good usable address. We
>194 * still force relays to have an IPv4 so that alone is enough to learn if we
>195 * need a lookup. In case we don't have one, we might want to attempt a
>196 * dummy circuit to learn our address as a suggestion from an authority. */
>197 have_addr = relay_find_addr_to_publish(options, AF_INET,
>198 RELAY_FIND_ADDR_CACHE_ONLY,
>199 &addr_out);
>200
>201 /* If we're a relay or bridge for which we were unable to discover our
>202 * public address, we rely on learning our address from a directory
>203 * authority from the NETINFO cell. */
>204 if (!have_addr && last_dummy_circuit + DUMMY_DOWNLOAD_INTERVAL < now) {
>205 last_dummy_circuit = now;
>206
>207 const routerstatus_t *rs = router_pick_trusteddirserver(V3_DIRINFO, 0);
>208 if (BUG(!rs)) {
>209 /* We should really always have trusted directories configured at this
>210 * stage. They are loaded early either from default list or the one
>211 * given in the configuration file. */
>212 return;
>213 }
>214 const node_t *node = node_get_by_id(rs->identity_digest);
>215 extend_info_t *ei = NULL;
>216 if (node) {
>217 ei = extend_info_from_node(node, 1, false);
>218 }
>219 if (!node || !ei) {
>220 /* This can happen if we are still in the early starting stage where no
>221 * descriptors we actually fetched and thus we have the routerstatus_t
>222 * for the authority but not its descriptor which is needed to build a
>223 * circuit and thus learn our address. */
>224 log_info(LD_GENERAL,
>225 "Trying to learn our IP address by connecting to an "
>226 "authority, but can't build a circuit to one yet. Will try "
>227 "again soon.");
>228 return;
>229 }
>230
>231 log_debug(LD_GENERAL, "Attempting dummy testing circuit to an authority "
>232 "in order to learn our address.");
>233
>234 /* Launch a one-hop testing circuit to a trusted authority so we can learn
>235 * our address through the NETINFO cell. */
>236 circuit_launch_by_extend_info(CIRCUIT_PURPOSE_TESTING, ei,
>237 CIRCLAUNCH_IS_INTERNAL |
>238 CIRCLAUNCH_ONEHOP_TUNNEL);
>239 extend_info_free(ei);
>240 }
>241 }
>242
[end quote]