ooni-dev

Download

ooni-dev@lists.torproject.org

May 2014

1 participants
2 discussions

ooniprobe 1.0.2 released
by Arturo Filastò 11 May '14

11 May '14

We are pleased to announce that ooniprobe 1.0.2 has been released. It includes a series of bugfixes and improvements including: * Add ooniprobe manpage. * Fix various security issues raised by the least authority audit. * Add a test that checks for Tor bridge reachability. * Record the IP address of the exit node being used in torified requests. * Captive portal test now uses the ooni-probe test templates. * Have better test naming consistency. You may download it from pypi here: https://pypi.python.org/pypi/ooniprobe/1.0.2 Soon the debian package for it will also be updated. Have fun, ~ Art.

1 0

OONI team report April 2014
by Arturo Filastò 05 May '14

05 May '14

# OONI team report April 2014 ## Least Authority security audit This month we mainly focused on addressing the issues raised during the Least Authority audit of the application. In particular the following issues were found and a resolution for them has been provided. No critical vulnerability has been found inside of the probe software. Users are nonetheless highly encouraged to update to the latest version of ooni-probe as soon as a release is out. * Issue A. CSRF Token Not Compared in Constant Time https://github.com/TheTorProject/ooni-probe/issues/317 * Issue B. Arbitrary File Write in Input File Uploader https://github.com/TheTorProject/ooni-probe/issues/318 * Issue C. User Input Written to Logs: https://github.com/TheTorProject/ooni-probe/issues/302 * Issue D. Tor Build Script Downloads zlib Over HTTP: https://github.com/TheTorProject/ooni-probe/issues/303 * Issue E. Denial of Service by Uploading Lots of Header Lines: https://github.com/TheTorProject/ooni-probe/issues/304 * Issue G. Cross-Site Scripting in HTTPRandomPage: https://github.com/TheTorProject/ooni-probe/issues/305 * Issue F. `oonid` Lacks Authentication Checks https://github.com/TheTorProject/ooni-probe/issues/319 ## Improvements to ooni-probe * Added support for recording the Tor Exit IP used when performing the http_requests test: https://github.com/TheTorProject/ooni-probe/issues/81 https://github.com/TheTorProject/ooni-probe/pull/299 * We now have a manpage for the ooniprobe cli tool. https://github.com/TheTorProject/ooni-probe/pull/315 * Fixed an issue that lead to unittests writing outside the build directory leading to the debian package build bot complaining: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=743108 https://github.com/TheTorProject/ooni-probe/pull/314 * The bridge_reachability test now supports fteproxy and includes the Tor version in the report: https://github.com/TheTorProject/ooni-probe/pull/297 ~ Art.

1 0