November 2011 - tor-commits - lists.torproject.org

[translation/vidalia] Update translations for vidalia
by translation＠torproject.org 27 Nov '11

27 Nov '11

commit 4f6bef39bbe4521ea8590185aaf1fb0f44ff37ba Author: Translation commit bot <translation(a)torproject.org> Date: Sun Nov 27 15:15:32 2011 +0000 Update translations for vidalia --- ar/vidalia_ar.po | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/ar/vidalia_ar.po b/ar/vidalia_ar.po index 440df2e..8db1834 100644 --- a/ar/vidalia_ar.po +++ b/ar/vidalia_ar.po @@ -11,7 +11,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2011-09-07 14:40+0000\n" -"PO-Revision-Date: 2011-11-27 14:41+0000\n" +"PO-Revision-Date: 2011-11-27 15:13+0000\n" "Last-Translator: macdeath <manmacdeath(a)gmail.com>\n" "Language-Team: translations(a)vidalia-project.net\n" "MIME-Version: 1.0\n" @@ -3427,10 +3427,12 @@ msgid "" " is not correct, please consider setting the 'Address' option in your " "relay's configuration." msgstr "" +"حدد تور أن عنوان الآي بي الخاص بمرحلك هو %1%2. لو لم يكن هذا صحيحا، رجاءً " +"فكر في تغيير خيار الـ\"عنوان\" على مرحلك." msgctxt "StatusEventWidget" msgid "DNS Hijacking Detected" -msgstr "" +msgstr "تم كشف احتلال دي إن إس." msgctxt "StatusEventWidget" msgid ""

1 0

(no subject)
by FLAVIO 27 Nov '11

27 Nov '11

did not understand what voces wants, will be the confirmation of my register comes the reply that the site does not exist. thus being cannot make nothing!

1 0

[translation/vidalia] Update translations for vidalia
by translation＠torproject.org 27 Nov '11

27 Nov '11

commit efca5a6c910dc6352d53748397e5ce63b61d4204 Author: Translation commit bot <translation(a)torproject.org> Date: Sun Nov 27 14:45:20 2011 +0000 Update translations for vidalia --- ar/vidalia_ar.po | 31 +++++++++++++++++++++++++++++-- 1 files changed, 29 insertions(+), 2 deletions(-) diff --git a/ar/vidalia_ar.po b/ar/vidalia_ar.po index 28642d8..440df2e 100644 --- a/ar/vidalia_ar.po +++ b/ar/vidalia_ar.po @@ -11,7 +11,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2011-09-07 14:40+0000\n" -"PO-Revision-Date: 2011-11-27 14:14+0000\n" +"PO-Revision-Date: 2011-11-27 14:41+0000\n" "Last-Translator: macdeath <manmacdeath(a)gmail.com>\n" "Language-Team: translations(a)vidalia-project.net\n" "MIME-Version: 1.0\n" @@ -174,13 +174,17 @@ msgctxt "AdvancedPage" msgid "" "The specified Tor configuration file location contains characters that " "cannot be represented in your system's current 8-bit character encoding." -msgstr "ملف الإعدادات المحدد يحتوي على أحرف لا يستطيع نظامك إظهارها " +msgstr "" +"ملف الإعدادات المحدد يحتوي على أحرف لا يستطيع نظامك إظهارها لاعتماده على " +"نظام ترقيم 8-بت " msgctxt "AdvancedPage" msgid "" "The specified Tor data directory location contains characters that cannot be" " represented in your system's current 8-bit character encoding." msgstr "" +"مجلد المعلومات المحدد يحتوي على أحرف لا يستطيع نظامك إظهارها لاعتماده على " +"نظام ترقيم 8-بت" msgctxt "AdvancedPage" msgid "Warning" @@ -3295,6 +3299,9 @@ msgid "" "version of the software, which may contain important security, reliability " "and performance fixes." msgstr "" +"أنت الآن على إصدار \"%1\" من التور, والذي قد لا يعمل مع الشبكة التورية " +"الحالية. رجاءً طوره إلى آخر نسخ، والتي قد تحتوي على إصلاحات مهمة في الأمن " +"والكفائة." msgctxt "StatusEventWidget" msgid "Your Tor Software is Out-of-date" @@ -3320,6 +3327,8 @@ msgid "" "The Tor software encountered an internal bug. Please report the following " "error message to the Tor developers at bugs.torproject.org: \"%1\"" msgstr "" +"أعاق البرنامج خلل داخلي. رجاءً أبلغ مبرمجي \"تور\" عن الخلل التالي على " +"bugs.torproject.org: \"%1\"" msgctxt "StatusEventWidget" msgid "" @@ -3328,6 +3337,9 @@ msgid "" "will not be able to function. Please verify your computer displays the " "correct time." msgstr "" +"يظن تور أن ساعة حاسبك الآلي أخرت %1 ثانية عن الأصل \"%2\". لو لم تكن ساعتك " +"مضبوطة، لن يستطيع تور العمل بشكل سليم. رجاءً تأكد من صحة الوفت الذي يظهره " +"حاسبك." msgctxt "StatusEventWidget" msgid "" @@ -3336,6 +3348,9 @@ msgid "" "will not be able to function. Please verify your computer displays the " "correct time." msgstr "" +"يظن تور أن ساعة حاسبك الآلي قدمت %1 ثانية عن الأصل \"%2\". لو لم تكن ساعتك " +"مضبوطة، لن يستطيع تور العمل بشكل سليم. رجاءً تأكد من صحة الوفت الذي يظهره " +"حاسبك." msgctxt "StatusEventWidget" msgid "Your Computer's Clock is Potentially Incorrect" @@ -3348,6 +3363,9 @@ msgid "" "information over the Tor network is dangerous and not recommended. For your " "protection, Tor has automatically closed this connection." msgstr "" +"أظن أن أحد البرامج التي على حاسبك حاول أن يتصل بلا تشفير من المحطة %1. إرسال" +" معلومات غير مشفرة من خلال الشبكة التورية خطر ولا ينصح به. لأجل حمايتك، أغلق" +" تور الإتصال ذاتيا." msgctxt "StatusEventWidget" msgid "" @@ -3355,6 +3373,8 @@ msgid "" "unencrypted connection through Tor to port %1. Sending unencrypted " "information over the Tor network is dangerous and not recommended." msgstr "" +"أظن أن أحد البرامج التي على حاسبك حاول أن يتصل بلا تشفير من المحطة %1. إرسال" +" معلومات غير مشفرة من خلال الشبكة التورية خطر ولا ينصح به." msgctxt "StatusEventWidget" msgid "Potentially Dangerous Connection!" @@ -3367,6 +3387,9 @@ msgid "" "ensure you configure your applications to use only SOCKS4a or SOCKS5 with " "remote hostname resolution." msgstr "" +" أحد برامجك اتصل بـ%1 من خلال تور باستخدام بروتوكول قد يسرب بعض المعلومات عن" +" اتجاهك. رجاءً تأكد من ترتيب برامجك لاستخدام الـSocks4a أو الSocks5ـ لا غير " +"حسن الاتصال بمستضفين غير محلين." msgctxt "StatusEventWidget" msgid "Unknown SOCKS Protocol" @@ -3378,6 +3401,8 @@ msgid "" " protocol that Tor does not understand. Please ensure you configure your " "applications to use only SOCKS4a or SOCKS5 with remote hostname resolution." msgstr "" +" حاول أحد برامجك أن يتصل ببروتركول لا يفهمه تور. رجاءً تأكد من ترتيب برامجك " +"لاستخدام الـSocks4a أو الSocks5ـ لا غير حسن الاتصال بمستضفين غير محلين." msgctxt "StatusEventWidget" msgid "Invalid Destination Hostname" @@ -3389,6 +3414,8 @@ msgid "" "\"%1\", which Tor does not recognize as a valid hostname. Please check your " "application's configuration." msgstr "" +"حاول أحد برامجك أن يتصل بـ%1، والذي لا يعتبره تور مستضيف ممكن. رجاءً تحقق من" +" إعداد برنامجك." msgctxt "StatusEventWidget" msgid "External IP Address Changed"

1 0

[torspec/master] Trivial whitespace cleanup
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit 57efa12578944a1afb535e2c28374257c40f5c23 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sat Nov 26 03:57:54 2011 +0100 Trivial whitespace cleanup --- control-spec.txt | 4 ++-- dir-spec-v2.txt | 5 +++-- dir-spec.txt | 14 +++++++------- gettor-spec.txt | 53 +++++++++++++++++++++++++++-------------------------- path-spec.txt | 7 ++++--- 5 files changed, 43 insertions(+), 40 deletions(-) diff --git a/control-spec.txt b/control-spec.txt index 01dc4d5..88be91e 100644 --- a/control-spec.txt +++ b/control-spec.txt @@ -541,7 +541,7 @@ 0.2.2.1-alpha and later by default, each line is of the form: LongName SP ORStatus CRLF - In Tor versions 0.1.2.2-alpha through 0.2.2.1-alpha with feature + In Tor versions 0.1.2.2-alpha through 0.2.2.1-alpha with feature VERBOSE_NAMES turned off and before version 0.1.2.2-alpha, each line is of the form: ServerID SP ORStatus CRLF @@ -552,7 +552,7 @@ 0.2.2.1-alpha and later by default, each line is of the form: LongName SP Status [SP ISOTime] CRLF - In Tor versions 0.1.2.2-alpha through 0.2.2.1-alpha with feature + In Tor versions 0.1.2.2-alpha through 0.2.2.1-alpha with feature VERBOSE_NAMES turned off and before version 0.1.2.2-alpha, each line is of the form: ServerID2 SP Status [SP ISOTime] CRLF diff --git a/dir-spec-v2.txt b/dir-spec-v2.txt index d1be27f..7b06b02 100644 --- a/dir-spec-v2.txt +++ b/dir-spec-v2.txt @@ -155,7 +155,7 @@ Every router descriptor MUST start with a "router" Item; MUST end with a "router-signature" Item and an extra NL; and MUST contain exactly one instance of each of the following Items: "published" "onion-key" - "signing-key" "bandwidth". + "signing-key" "bandwidth". A router descriptor MAY have zero or one of each of the following Items, but MUST NOT have more than one: "contact", "uptime", "fingerprint", @@ -892,5 +892,6 @@ 7.2. HTTP status codes - XXX We should write down what return codes dirservers send in what situations. + XXX We should write down what return codes dirservers send in what + situations. diff --git a/dir-spec.txt b/dir-spec.txt index b4db02e..539581b 100644 --- a/dir-spec.txt +++ b/dir-spec.txt @@ -1342,12 +1342,12 @@ An estimate of the bandwidth of this relay, in an arbitrary unit (currently kilobytes per second). Used to weight router - selection. + selection. - Additionally, the Measured= keyword is present in votes by + Additionally, the Measured= keyword is present in votes by participating bandwidth measurement authorities to indicate - a measured bandwidth currently produced by measuring stream - capacities. + a measured bandwidth currently produced by measuring stream + capacities. Other weighting keywords may be added later. Clients MUST ignore keywords they do not recognize. @@ -1632,9 +1632,9 @@ one, breaking ties in favor of the lexicographically larger vote.) The port list is encoded as specified in 3.4.2. - * If consensus-method 6 or later is in use and if 3 or more - authorities provide a Measured= keyword in their votes for - a router, the authorities produce a consensus containing a + * If consensus-method 6 or later is in use and if 3 or more + authorities provide a Measured= keyword in their votes for + a router, the authorities produce a consensus containing a Bandwidth= keyword equal to the median of the Measured= votes. * If consensus-method 7 or later is in use, the params line is diff --git a/gettor-spec.txt b/gettor-spec.txt index 0a30efc..dd26b3d 100644 --- a/gettor-spec.txt +++ b/gettor-spec.txt @@ -8,27 +8,27 @@ 1. Overview - GetTor was created to resolve direct and indirect censorship of Tor's software. - In many countries and networks Tor's main website is blocked and would be Tor - users are unable to download even the source code to the Tor program. Other - software hosted by the Tor Project is similarly censored. The filtering - of the possible download sites is sometimes easy to bypass by using our TLS enabled - website. In other cases the website and all of the mirrors are entirely - blocked; this is a situation where a user seems to actually need Tor to fetch - Tor. We discovered that it is feasible to use alternate transport methods such - as SMTP between a non-trusted third party or with IRC and XDCC. + GetTor was created to resolve direct and indirect censorship of Tor's + software. In many countries and networks Tor's main website is blocked and + would be Tor users are unable to download even the source code to the Tor + program. Other software hosted by the Tor Project is similarly censored. The + filtering of the possible download sites is sometimes easy to bypass by using + our TLS enabled website. In other cases the website and all of the mirrors are + entirely blocked; this is a situation where a user seems to actually need Tor + to fetch Tor. We discovered that it is feasible to use alternate transport + methods such as SMTP between a non-trusted third party or with IRC and XDCC. 2. Implementation Any compliant GetTor implementation will implement at least a single transport - to meet the needs of a certain class of users. It should be i18n and l10n compliant - for all user facing interactions; users should be able to manually set their - language and this should serve as their preference for localization of any - software delivered. The implementation must be free software and it should be - freely available by request from the implementation that they interface with - to download any of the other software available from that GetTor instance. - Security and privacy considerations should be described on a per transport - basis. + to meet the needs of a certain class of users. It should be i18n and l10n + compliant for all user facing interactions; users should be able to manually + set their language and this should serve as their preference for localization + of any software delivered. The implementation must be free software and it + should be freely available by request from the implementation that they + interface with to download any of the other software available from that + GetTor instance. Security and privacy considerations should be described on a + per transport basis. 2.1 Reference implementation @@ -36,16 +36,17 @@ 3. SMTP transport - The SMTP transport for GetTor should allow users to send any RFC822 compliant message - in any known human language; GetTor should respond in whatever language is - detected with supplementary translations in the same email. GetTor shall offer - a list of all available software in the body of the email - it should offer the - software as a list of packages and their subsequent descriptions. + The SMTP transport for GetTor should allow users to send any RFC822 compliant + message in any known human language; GetTor should respond in whatever + language is detected with supplementary translations in the same email. + GetTor shall offer a list of all available software in the body of the email - + it should offer the software as a list of packages and their subsequent + descriptions. 3.1 SMTP transport security considerations - Any GetTor instance that offers SMTP as a transport should optionally implement - the checking of DKIM signatures to ensure that email is not forged. + Any GetTor instance that offers SMTP as a transport should optionally + implement the checking of DKIM signatures to ensure that email is not forged. Optionally GetTor should take an OpenPGP key from the user and encrypt the response with a blinded message. @@ -63,8 +64,8 @@ 4. Other transports - At this time no other transports have been specified. IRC XDCC is a likely useful - system as is XMPP/Jabber with the newest OTR file sharing transport. + At this time no other transports have been specified. IRC XDCC is a likely + useful system as is XMPP/Jabber with the newest OTR file sharing transport. 5. Implementation suggestions diff --git a/path-spec.txt b/path-spec.txt index 480772e..7d19889 100644 --- a/path-spec.txt +++ b/path-spec.txt @@ -348,7 +348,8 @@ of their choices. frequently occurring 50ms histogram bin, until the point where 1000 circuits are recorded. After this point, the weighted average of the top 'cbtnummodes' (default: 3) midpoint modes is used as Xm. All times below - this value are counted as having the midpoint value of this weighted average bin. + this value are counted as having the midpoint value of this weighted average + bin. The timeout itself is calculated by using the Pareto Quantile function (the inverted CDF) to give us the value on the CDF such that 80% of the mass @@ -471,8 +472,8 @@ of their choices. Min: Value of cbtquantile parameter Max: 99 Effect: This is the position on the quantile curve to use to set the - timeout value to use to actually close circuits. It is a percent - (0-99). + timeout value to use to actually close circuits. It is a + percent (0-99). cbttestfreq Default: 60

1 0

[torspec/master] Update dir-spec with proposal 178
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit 71a28234703724b97508936e396f0a028e2523d8 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sat Nov 26 04:11:24 2011 +0100 Update dir-spec with proposal 178 --- dir-spec.txt | 17 ++++++++++++++--- 1 files changed, 14 insertions(+), 3 deletions(-) diff --git a/dir-spec.txt b/dir-spec.txt index 539581b..f1aef64 100644 --- a/dir-spec.txt +++ b/dir-spec.txt @@ -1566,9 +1566,15 @@ Known-flags is the union of all flags known by any voter. - Entries are given on the "params" line for every keyword on which any - authority voted. The values given are the low-median of all votes on - that keyword. + Entries are given on the "params" line for every keyword on which a + majority of authorities (total authorities, not just those + participating in this vote) voted on, or if at least three + authorities voted for that parameter. The values given are the + low-median of all votes on that keyword. + + Consensus methods 11 and before, entries are given on the "params" + line for every keyword on which any authority voted, the value given + being the low-median of all votes on that keyword. "client-versions" and "server-versions" are sorted in ascending order; A version is recommended in the consensus if it is recommended @@ -1645,6 +1651,10 @@ method 11 or later is in use, any router that is determined to get the BadExit flag doesn't count when we're calculating weights. + * If consensus method 12 or later is used, only consensus + parameters that more than half of the total number of + authorities voted for are included in the consensus. + The signatures at the end of a consensus document are sorted in ascending order by identity digest. @@ -1671,6 +1681,7 @@ "9" -- Provides weights for selecting flagged routers in paths "10" -- Fixes edge case bugs in router flag selection weights "11" -- Don't consider BadExits when calculating bandwidth weights + "12" -- Params are only included if enough auths voted for them Before generating a consensus, an authority must decide which consensus

1 0

[torspec/master] mark 178 as closed
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit 11cf7fcd00d6667ab01287cfbf9bf1f4ef15d64c Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 27 09:35:30 2011 -0500 mark 178 as closed --- proposals/000-index.txt | 4 ++-- proposals/178-param-voting.txt | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/proposals/000-index.txt b/proposals/000-index.txt index c270a26..68ce0b2 100644 --- a/proposals/000-index.txt +++ b/proposals/000-index.txt @@ -98,7 +98,7 @@ Proposals by number: 175 Automatically promoting Tor clients to nodes [DRAFT] 176 Proposed version-3 link handshake for Tor [CLOSED] 177 Abstaining from votes on individual flags [OPEN] -178 Require majority of authorities to vote for consensus parameters [OPEN] +178 Require majority of authorities to vote for consensus parameters [CLOSED] 179 TLS certificate and parameter normalization [DRAFT] 180 Pluggable transports for circumvention [OPEN] 181 Optimistic Data for Tor: Client Side [CLOSED] @@ -138,7 +138,6 @@ Proposals by status: 165 Easy migration for voting authority sets 168 Reduce default circuit window 177 Abstaining from votes on individual flags [for 0.2.3.x] - 178 Require majority of authorities to vote for consensus parameters [for 0.2.3.x] 180 Pluggable transports for circumvention [for 0.2.3.x] 185 Directory caches without DirPort 187 Reserve a cell type to allow client authorization [for 0.2.3.x] @@ -198,6 +197,7 @@ Proposals by status: 171 Separate streams across circuits by connection metadata [in 0.2.3.3-alpha] 174 Optimistic Data for Tor: Server Side [in 0.2.3.1-alpha] 176 Proposed version-3 link handshake for Tor [for 0.2.3] + 178 Require majority of authorities to vote for consensus parameters [in 0.2.3.9-alpha] 181 Optimistic Data for Tor: Client Side [in 0.2.3.3-alpha] 183 Refill Intervals [in 0.2.3.5-alpha] 184 Miscellaneous changes for a v3 Tor link protocol [for 0.2.3.x] diff --git a/proposals/178-param-voting.txt b/proposals/178-param-voting.txt index dddfaff..58d2a62 100644 --- a/proposals/178-param-voting.txt +++ b/proposals/178-param-voting.txt @@ -2,8 +2,8 @@ Filename: 178-param-voting.txt Title: Require majority of authorities to vote for consensus parameters Author: Sebastian Hahn Created: 16-Feb-2011 -Status: Open -Target: 0.2.3.x +Status: Closed +Implemented-In: 0.2.3.9-alpha Overview:

1 0

[tor/master] Implement consensus method 12 (proposal 178)
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit e5e4bfd167425699a559a3a1545c0a3d6946f82e Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sun Feb 20 21:05:17 2011 -0500 Implement consensus method 12 (proposal 178) --- changes/proposal178 | 6 ++++ src/or/dirvote.c | 32 ++++++++++++++++----- src/or/dirvote.h | 3 +- src/test/test_dir.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++++--- 4 files changed, 104 insertions(+), 13 deletions(-) diff --git a/changes/proposal178 b/changes/proposal178 new file mode 100644 index 0000000..ee70695 --- /dev/null +++ b/changes/proposal178 @@ -0,0 +1,6 @@ + o Major features: + - Implement a more secure consensus parameter voting algorithm that + ensures that at least three directory authorities or a majority of + them voted on a given parameter before including it in the + consensus. Implements proposal 178. + diff --git a/src/or/dirvote.c b/src/or/dirvote.c index bf34c62..01e2358 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -50,7 +50,7 @@ static int dirvote_publish_consensus(void); static char *make_consensus_method_list(int low, int high, const char *sep); /** The highest consensus method that we currently support. */ -#define MAX_SUPPORTED_CONSENSUS_METHOD 11 +#define MAX_SUPPORTED_CONSENSUS_METHOD 12 /** Lowest consensus method that contains a 'directory-footer' marker */ #define MIN_METHOD_FOR_FOOTER 9 @@ -64,6 +64,10 @@ static char *make_consensus_method_list(int low, int high, const char *sep); /** Lowest consensus method that generates microdescriptors */ #define MIN_METHOD_FOR_MICRODESC 8 +/** Lowest consensus method that ensures a majority of authorities voted + * for a param. */ +#define MIN_METHOD_FOR_MAJORITY_PARAMS 12 + /* ===== * Voting * =====*/ @@ -608,11 +612,16 @@ compute_consensus_versions_list(smartlist_t *lst, int n_versioning) return result; } +/** Minimum number of directory authorities voting for a parameter to + * include it in the consensus, if consensus method 12 or later is to be + * used. See proposal 178 for details. */ +#define MIN_VOTES_FOR_PARAM 3 + /** Helper: given a list of valid networkstatus_t, return a new string * containing the contents of the consensus network parameter set. */ /* private */ char * -dirvote_compute_params(smartlist_t *votes) +dirvote_compute_params(smartlist_t *votes, int method, int total_authorities) { int i; int32_t *vals; @@ -669,11 +678,17 @@ dirvote_compute_params(smartlist_t *votes) next_param = smartlist_get(param_list, param_sl_idx+1); if (!next_param || strncmp(next_param, param, cur_param_len)) { /* We've reached the end of a series. */ - int32_t median = median_int32(vals, i); - char *out_string = tor_malloc(64+cur_param_len); - memcpy(out_string, param, cur_param_len); - tor_snprintf(out_string+cur_param_len,64, "%ld", (long)median); - smartlist_add(output, out_string); + /* Make sure enough authorities voted on this param, unless the + * the consensus method we use is too old for that. */ + if (method < MIN_METHOD_FOR_MAJORITY_PARAMS || + i > total_authorities/2 || + i >= MIN_VOTES_FOR_PARAM) { + int32_t median = median_int32(vals, i); + char *out_string = tor_malloc(64+cur_param_len); + memcpy(out_string, param, cur_param_len); + tor_snprintf(out_string+cur_param_len,64, "%ld", (long)median); + smartlist_add(output, out_string); + } i = 0; if (next_param) { @@ -1496,7 +1511,8 @@ networkstatus_compute_consensus(smartlist_t *votes, } if (consensus_method >= MIN_METHOD_FOR_PARAMS) { - params = dirvote_compute_params(votes); + params = dirvote_compute_params(votes, consensus_method, + total_authorities); if (params) { smartlist_add(chunks, tor_strdup("params ")); smartlist_add(chunks, params); diff --git a/src/or/dirvote.h b/src/or/dirvote.h index d196351..1f4dc36 100644 --- a/src/or/dirvote.h +++ b/src/or/dirvote.h @@ -84,7 +84,8 @@ document_signature_t *voter_get_sig_by_algorithm( #ifdef DIRVOTE_PRIVATE char *format_networkstatus_vote(crypto_pk_env_t *private_key, networkstatus_t *v3_ns); -char *dirvote_compute_params(smartlist_t *votes); +char *dirvote_compute_params(smartlist_t *votes, int method, + int total_authorities); #endif #endif diff --git a/src/test/test_dir.c b/src/test/test_dir.c index 205d7b5..5b7ce5c 100644 --- a/src/test/test_dir.c +++ b/src/test/test_dir.c @@ -620,13 +620,81 @@ test_dir_param_voting(void) test_eq(0, networkstatus_get_param(&vote4, "foobar", 0, -100, 8)); smartlist_add(votes, &vote1); + + /* Do the first tests without adding all the other votes, for + * networks without many dirauths. */ + + res = dirvote_compute_params(votes, 11, 6); + test_streq(res, "ab=90 abcd=20 cw=50 x-yz=-99"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 2); + test_streq(res, ""); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 1); + test_streq(res, "ab=90 abcd=20 cw=50 x-yz=-99"); + tor_free(res); + smartlist_add(votes, &vote2); + + res = dirvote_compute_params(votes, 11, 2); + test_streq(res, "ab=27 abcd=20 cw=5 x-yz=-99"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 2); + test_streq(res, "ab=27 cw=5 x-yz=-99"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 3); + test_streq(res, "ab=27 cw=5 x-yz=-99"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 6); + test_streq(res, ""); + tor_free(res); + smartlist_add(votes, &vote3); + + res = dirvote_compute_params(votes, 11, 3); + test_streq(res, "ab=27 abcd=20 c=60 cw=50 x-yz=-9 zzzzz=101"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 3); + test_streq(res, "ab=27 abcd=20 cw=50 x-yz=-9"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 5); + test_streq(res, "cw=50 x-yz=-9"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 9); + test_streq(res, "cw=50 x-yz=-9"); + tor_free(res); + smartlist_add(votes, &vote4); - res = dirvote_compute_params(votes); - test_streq(res, - "ab=90 abcd=20 c=1 cw=50 x-yz=-9 zzzzz=101"); + res = dirvote_compute_params(votes, 11, 4); + test_streq(res, "ab=90 abcd=20 c=1 cw=50 x-yz=-9 zzzzz=101"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 4); + test_streq(res, "ab=90 abcd=20 cw=50 x-yz=-9"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 5); + test_streq(res, "ab=90 abcd=20 cw=50 x-yz=-9"); + tor_free(res); + + /* Test that the special-cased "at least three dirauths voted for + * this param" logic works as expected. */ + res = dirvote_compute_params(votes, 12, 6); + test_streq(res, "ab=90 abcd=20 cw=50 x-yz=-9"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 10); + test_streq(res, "ab=90 abcd=20 cw=50 x-yz=-9"); + tor_free(res); done: tor_free(res); @@ -1049,7 +1117,7 @@ test_dir_v3_networkstatus(void) "Running:Stable:V2Dir:Valid"); tor_free(cp); cp = smartlist_join_strings(con->net_params, ":", 0, NULL); - test_streq(cp, "bar=2000000000:circuitwindow=80:foo=660"); + test_streq(cp, "circuitwindow=80:foo=660"); tor_free(cp); test_eq(4, smartlist_len(con->voters)); /*3 voters, 1 legacy key.*/

1 0

[tor/master] Merge branch 'safer_params_squashed'
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit b5a306e82c684bdd30b832fdfd9e2b55c06b54ae Merge: 40a87c4 e5e4bfd Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 27 09:30:13 2011 -0500 Merge branch 'safer_params_squashed' changes/proposal178 | 6 ++++ src/or/dirvote.c | 32 ++++++++++++++++----- src/or/dirvote.h | 3 +- src/test/test_dir.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++++--- 4 files changed, 104 insertions(+), 13 deletions(-)

1 0

[tor/master] Use random bytes as our certificate serial numbers.
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit b42ff6545ac550c1e9cf6dbadea71717c210f323 Author: George Kadianakis <desnacked(a)gmail.com> Date: Sun Nov 27 08:20:17 2011 +0100 Use random bytes as our certificate serial numbers. Instead of using time(NULL) in our certificate serial numbers, use eight random bytes as suggested in proposal 179. --- src/common/tortls.c | 17 ++++++++++++++++- 1 files changed, 16 insertions(+), 1 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index 0571b34..9a77bab 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -585,7 +585,11 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa, const char *cname_sign, unsigned int cert_lifetime) { +#define SERIAL_NUMBER_SIZE 8 + time_t start_time, end_time; + BIGNUM *serial_number = NULL; + unsigned char serial_tmp[SERIAL_NUMBER_SIZE]; EVP_PKEY *sign_pkey = NULL, *pkey=NULL; X509 *x509 = NULL; X509_NAME *name = NULL, *name_issuer=NULL; @@ -606,8 +610,15 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa, goto error; if (!(X509_set_version(x509, 2))) goto error; - if (!(ASN1_INTEGER_set(X509_get_serialNumber(x509), (long)start_time))) + + { /* our serial number is 8 random bytes. */ + if (crypto_rand((char *)serial_tmp, sizeof(serial_tmp)) < 0) + goto error; + if (!(serial_number = BN_bin2bn(serial_tmp, sizeof(serial_tmp), NULL))) goto error; + if (!(BN_to_ASN1_INTEGER(serial_number, X509_get_serialNumber(x509)))) + goto error; + } if (!(name = tor_x509_name_new(cname))) goto error; @@ -640,11 +651,15 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa, EVP_PKEY_free(sign_pkey); if (pkey) EVP_PKEY_free(pkey); + if (serial_number) + BN_free(serial_number); if (name) X509_NAME_free(name); if (name_issuer) X509_NAME_free(name_issuer); return x509; + +#undef SERIAL_NUMBER_SIZE } /** List of ciphers that servers should select from.*/

1 0

[tor/master] Add a changes file.
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit efba71b03c5a8361352a4fac22bd7261b643bb7b Author: George Kadianakis <desnacked(a)gmail.com> Date: Sun Nov 27 09:03:37 2011 +0100 Add a changes file. --- changes/bug4584 | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/changes/bug4584 b/changes/bug4584 new file mode 100644 index 0000000..38cf2d6 --- /dev/null +++ b/changes/bug4584 @@ -0,0 +1,4 @@ + o Privacy/anonymity features (bridge detection): + - Make bridge SSL certificates a bit more stealthy by using random + serial numbers, in the same fashion as OpenSSL when generating + self-signed certificates. Implements ticket 4584.

1 0