May 2011 - tor-commits - lists.torproject.org

[tor/master] Fix a -Wunused-but-set-variable instance in master
by nickm＠torproject.org 28 May '11

28 May '11

commit 8e09f7cf107056f99e47029ccf9a9403ef45bc59 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat May 28 01:57:38 2011 -0400 Fix a -Wunused-but-set-variable instance in master --- src/common/util.c | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/src/common/util.c b/src/common/util.c index 7177651..ad321ee 100644 --- a/src/common/util.c +++ b/src/common/util.c @@ -3084,6 +3084,8 @@ tor_spawn_background(const char *const filename, int *stdout_read, nbytes = write(STDOUT_FILENO, error_message, error_message_length); nbytes = write(STDOUT_FILENO, hex_errno, sizeof(hex_errno)); + (void) nbytes; + _exit(255); return -1; /* Never reached, but avoids compiler warning */ }

1 0

[tor/master] Remove the -F option from tor-resolve.
by nickm＠torproject.org 28 May '11

28 May '11

commit 57810c333a38c72c1e361c02e31de7712d1f221a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 23 16:59:41 2011 -0400 Remove the -F option from tor-resolve. It used to mean "Force": it would tell tor-resolve to ask tor to resolve an address even if it ended with .onion. But when AutomapHostsOnResolve was added, automatically refusing to resolve .onion hosts stopped making sense. So in 0.2.1.16-rc (commit 298dc95dfd8), we made tor-resolve happy to resolve anything. The -F option stayed in, though, even though it didn't do anything. Oddly, it never got documented. Found while fixing GCC 4.6 "set, unused variable" warnings. --- changes/bug3208 | 4 ++++ src/tools/tor-resolve.c | 4 +--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/changes/bug3208 b/changes/bug3208 new file mode 100644 index 0000000..731c96e --- /dev/null +++ b/changes/bug3208 @@ -0,0 +1,4 @@ + o Removed options: + - Remove undocumented option "-F" from tor-resolve: it hasn't done + anything since 0.2.1.16-rc. + diff --git a/src/tools/tor-resolve.c b/src/tools/tor-resolve.c index 12349d9..8c4d3f6 100644 --- a/src/tools/tor-resolve.c +++ b/src/tools/tor-resolve.c @@ -319,7 +319,7 @@ main(int argc, char **argv) { uint32_t sockshost; uint16_t socksport = 0, port_option = 0; - int isSocks4 = 0, isVerbose = 0, isReverse = 0, force = 0; + int isSocks4 = 0, isVerbose = 0, isReverse = 0; char **arg; int n_args; struct in_addr a; @@ -349,8 +349,6 @@ main(int argc, char **argv) isSocks4 = 0; else if (!strcmp("-x", arg[0])) isReverse = 1; - else if (!strcmp("-F", arg[0])) - force = 1; else if (!strcmp("-p", arg[0])) { int p; if (n_args < 2) {

1 0

[tor/master] Fix GCC 4.6's new -Wunused-but-set-variable warnings.
by nickm＠torproject.org 28 May '11

28 May '11

commit a5232e0c4c572cdff85701f698b8b90c9443d7e4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 23 17:04:38 2011 -0400 Fix GCC 4.6's new -Wunused-but-set-variable warnings. Most instances were dead code; for those, I removed the assignments. Some were pieces of info we don't currently plan to use, but which we might in the future. For those, I added an explicit cast-to-void to indicate that we know that the thing's unused. Finally, one was a case where we were testing the wrong variable in a unit test. That one I fixed. This resolves bug 3208. --- changes/bug3208 | 2 ++ src/or/circuitbuild.c | 3 --- src/or/command.c | 1 + src/or/control.c | 2 -- src/or/directory.c | 2 -- src/or/dirvote.c | 3 +-- src/or/eventdns.c | 3 +++ src/test/test_crypto.c | 4 +++- 8 files changed, 10 insertions(+), 10 deletions(-) diff --git a/changes/bug3208 b/changes/bug3208 index 731c96e..fd737ba 100644 --- a/changes/bug3208 +++ b/changes/bug3208 @@ -2,3 +2,5 @@ - Remove undocumented option "-F" from tor-resolve: it hasn't done anything since 0.2.1.16-rc. + o Minor bugfixes: + - Fix warnings from GCC 4.6's "-Wunused-but-set-variable" option. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 08bfb98..108007e 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -3766,7 +3766,6 @@ void entry_guards_compute_status(or_options_t *options, time_t now) { int changed = 0; - int severity = LOG_DEBUG; digestmap_t *reasons; if (! entry_guards) @@ -3793,8 +3792,6 @@ entry_guards_compute_status(or_options_t *options, time_t now) if (remove_dead_entry_guards(now)) changed = 1; - severity = changed ? LOG_DEBUG : LOG_INFO; - if (changed) { SMARTLIST_FOREACH_BEGIN(entry_guards, entry_guard_t *, entry) { const char *reason = digestmap_get(reasons, entry->identity); diff --git a/src/or/command.c b/src/or/command.c index 00d9af3..e377f4f 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -645,6 +645,7 @@ command_process_netinfo_cell(cell_t *cell, or_connection_t *conn) /* XXX maybe act on my_apparent_addr, if the source is sufficiently * trustworthy. */ + (void)my_apparent_addr; if (connection_or_set_state_open(conn)<0) connection_mark_for_close(TO_CONN(conn)); diff --git a/src/or/control.c b/src/or/control.c index 0dad1b9..f75ac67 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -3142,7 +3142,6 @@ control_event_circuit_status(origin_circuit_t *circ, circuit_status_event_t tp, { const char *status; char extended_buf[96]; - int providing_reason=0; if (!EVENT_IS_INTERESTING(EVENT_CIRCUIT_STATUS)) return 0; tor_assert(circ); @@ -3166,7 +3165,6 @@ control_event_circuit_status(origin_circuit_t *circ, circuit_status_event_t tp, const char *reason_str = circuit_end_reason_to_control_string(reason_code); char *reason = NULL; size_t n=strlen(extended_buf); - providing_reason=1; if (!reason_str) { reason = tor_malloc(16); tor_snprintf(reason, 16, "UNKNOWN_%d", reason_code); diff --git a/src/or/directory.c b/src/or/directory.c index eb99e9d..ff0a5a4 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -1900,7 +1900,6 @@ connection_dir_client_reached_eof(dir_connection_t *conn) router_get_trusteddirserver_by_digest(conn->identity_digest); char *rejected_hdr = http_get_header(headers, "X-Descriptor-Not-New: "); - int rejected = 0; if (rejected_hdr) { if (!strcmp(rejected_hdr, "Yes")) { log_info(LD_GENERAL, @@ -1913,7 +1912,6 @@ connection_dir_client_reached_eof(dir_connection_t *conn) * last descriptor, not on the published time of the last * descriptor. If those are different, that's a bad thing to * do. -NM */ - rejected = 1; } tor_free(rejected_hdr); } diff --git a/src/or/dirvote.c b/src/or/dirvote.c index 96e3df5..c6ce9f6 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -1592,7 +1592,7 @@ networkstatus_compute_consensus(smartlist_t *votes, * is the same flag as votes[j]->known_flags[b]. */ int *named_flag; /* Index of the flag "Named" for votes[j] */ int *unnamed_flag; /* Index of the flag "Unnamed" for votes[j] */ - int chosen_named_idx, chosen_unnamed_idx; + int chosen_named_idx; strmap_t *name_to_id_map = strmap_new(); char conflict[DIGEST_LEN]; @@ -1610,7 +1610,6 @@ networkstatus_compute_consensus(smartlist_t *votes, for (i = 0; i < smartlist_len(votes); ++i) unnamed_flag[i] = named_flag[i] = -1; chosen_named_idx = smartlist_string_pos(flags, "Named"); - chosen_unnamed_idx = smartlist_string_pos(flags, "Unnamed"); /* Build the flag index. */ SMARTLIST_FOREACH(votes, networkstatus_t *, v, diff --git a/src/or/eventdns.c b/src/or/eventdns.c index fc005df..b7cc292 100644 --- a/src/or/eventdns.c +++ b/src/or/eventdns.c @@ -1028,6 +1028,9 @@ request_parse(u8 *packet, ssize_t length, struct evdns_server_port *port, struct GET16(answers); GET16(authority); GET16(additional); + (void)additional; + (void)authority; + (void)answers; if (flags & 0x8000) return -1; /* Must not be an answer. */ flags &= 0x0110; /* Only RD and CD get preserved. */ diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index 781081a..bf2cc48 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -69,7 +69,7 @@ test_crypto_rng(void) uint64_t big; char *host; j = crypto_rand_int(100); - if (i < 0 || i >= 100) + if (j < 0 || j >= 100) allok = 0; big = crypto_rand_uint64(U64_LITERAL(1)<<40); if (big >= (U64_LITERAL(1)<<40)) @@ -240,11 +240,13 @@ test_crypto_sha(void) /* Test SHA-1 with a test vector from the specification. */ i = crypto_digest(data, "abc", 3); test_memeq_hex(data, "A9993E364706816ABA3E25717850C26C9CD0D89D"); + tt_int_op(i, ==, 0); /* Test SHA-256 with a test vector from the specification. */ i = crypto_digest256(data, "abc", 3, DIGEST_SHA256); test_memeq_hex(data, "BA7816BF8F01CFEA414140DE5DAE2223B00361A3" "96177A9CB410FF61F20015AD"); + tt_int_op(i, ==, 0); /* Test HMAC-SHA-1 with test cases from RFC2202. */

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2'
by nickm＠torproject.org 28 May '11

28 May '11

commit 42b15a0aaa6e00c2ce0ce030abdb87e787f27fe4 Merge: 6f200b6 a5232e0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat May 28 01:55:34 2011 -0400 Merge remote-tracking branch 'origin/maint-0.2.2' changes/bug3208 | 6 ++++++ src/or/circuitbuild.c | 3 --- src/or/command.c | 1 + src/or/control.c | 2 -- src/or/directory.c | 2 -- src/or/dirvote.c | 3 +-- src/or/eventdns.c | 3 +++ src/test/test_crypto.c | 4 +++- src/tools/tor-resolve.c | 4 +--- 9 files changed, 15 insertions(+), 13 deletions(-)

1 0

[tor/maint-0.2.2] Remove the -F option from tor-resolve.
by nickm＠torproject.org 28 May '11

28 May '11

commit 57810c333a38c72c1e361c02e31de7712d1f221a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 23 16:59:41 2011 -0400 Remove the -F option from tor-resolve. It used to mean "Force": it would tell tor-resolve to ask tor to resolve an address even if it ended with .onion. But when AutomapHostsOnResolve was added, automatically refusing to resolve .onion hosts stopped making sense. So in 0.2.1.16-rc (commit 298dc95dfd8), we made tor-resolve happy to resolve anything. The -F option stayed in, though, even though it didn't do anything. Oddly, it never got documented. Found while fixing GCC 4.6 "set, unused variable" warnings. --- changes/bug3208 | 4 ++++ src/tools/tor-resolve.c | 4 +--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/changes/bug3208 b/changes/bug3208 new file mode 100644 index 0000000..731c96e --- /dev/null +++ b/changes/bug3208 @@ -0,0 +1,4 @@ + o Removed options: + - Remove undocumented option "-F" from tor-resolve: it hasn't done + anything since 0.2.1.16-rc. + diff --git a/src/tools/tor-resolve.c b/src/tools/tor-resolve.c index 12349d9..8c4d3f6 100644 --- a/src/tools/tor-resolve.c +++ b/src/tools/tor-resolve.c @@ -319,7 +319,7 @@ main(int argc, char **argv) { uint32_t sockshost; uint16_t socksport = 0, port_option = 0; - int isSocks4 = 0, isVerbose = 0, isReverse = 0, force = 0; + int isSocks4 = 0, isVerbose = 0, isReverse = 0; char **arg; int n_args; struct in_addr a; @@ -349,8 +349,6 @@ main(int argc, char **argv) isSocks4 = 0; else if (!strcmp("-x", arg[0])) isReverse = 1; - else if (!strcmp("-F", arg[0])) - force = 1; else if (!strcmp("-p", arg[0])) { int p; if (n_args < 2) {

1 0

[tor/maint-0.2.2] Fix GCC 4.6's new -Wunused-but-set-variable warnings.
by nickm＠torproject.org 28 May '11

28 May '11

commit a5232e0c4c572cdff85701f698b8b90c9443d7e4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 23 17:04:38 2011 -0400 Fix GCC 4.6's new -Wunused-but-set-variable warnings. Most instances were dead code; for those, I removed the assignments. Some were pieces of info we don't currently plan to use, but which we might in the future. For those, I added an explicit cast-to-void to indicate that we know that the thing's unused. Finally, one was a case where we were testing the wrong variable in a unit test. That one I fixed. This resolves bug 3208. --- changes/bug3208 | 2 ++ src/or/circuitbuild.c | 3 --- src/or/command.c | 1 + src/or/control.c | 2 -- src/or/directory.c | 2 -- src/or/dirvote.c | 3 +-- src/or/eventdns.c | 3 +++ src/test/test_crypto.c | 4 +++- 8 files changed, 10 insertions(+), 10 deletions(-) diff --git a/changes/bug3208 b/changes/bug3208 index 731c96e..fd737ba 100644 --- a/changes/bug3208 +++ b/changes/bug3208 @@ -2,3 +2,5 @@ - Remove undocumented option "-F" from tor-resolve: it hasn't done anything since 0.2.1.16-rc. + o Minor bugfixes: + - Fix warnings from GCC 4.6's "-Wunused-but-set-variable" option. diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 08bfb98..108007e 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -3766,7 +3766,6 @@ void entry_guards_compute_status(or_options_t *options, time_t now) { int changed = 0; - int severity = LOG_DEBUG; digestmap_t *reasons; if (! entry_guards) @@ -3793,8 +3792,6 @@ entry_guards_compute_status(or_options_t *options, time_t now) if (remove_dead_entry_guards(now)) changed = 1; - severity = changed ? LOG_DEBUG : LOG_INFO; - if (changed) { SMARTLIST_FOREACH_BEGIN(entry_guards, entry_guard_t *, entry) { const char *reason = digestmap_get(reasons, entry->identity); diff --git a/src/or/command.c b/src/or/command.c index 00d9af3..e377f4f 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -645,6 +645,7 @@ command_process_netinfo_cell(cell_t *cell, or_connection_t *conn) /* XXX maybe act on my_apparent_addr, if the source is sufficiently * trustworthy. */ + (void)my_apparent_addr; if (connection_or_set_state_open(conn)<0) connection_mark_for_close(TO_CONN(conn)); diff --git a/src/or/control.c b/src/or/control.c index 0dad1b9..f75ac67 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -3142,7 +3142,6 @@ control_event_circuit_status(origin_circuit_t *circ, circuit_status_event_t tp, { const char *status; char extended_buf[96]; - int providing_reason=0; if (!EVENT_IS_INTERESTING(EVENT_CIRCUIT_STATUS)) return 0; tor_assert(circ); @@ -3166,7 +3165,6 @@ control_event_circuit_status(origin_circuit_t *circ, circuit_status_event_t tp, const char *reason_str = circuit_end_reason_to_control_string(reason_code); char *reason = NULL; size_t n=strlen(extended_buf); - providing_reason=1; if (!reason_str) { reason = tor_malloc(16); tor_snprintf(reason, 16, "UNKNOWN_%d", reason_code); diff --git a/src/or/directory.c b/src/or/directory.c index eb99e9d..ff0a5a4 100644 --- a/src/or/directory.c +++ b/src/or/directory.c @@ -1900,7 +1900,6 @@ connection_dir_client_reached_eof(dir_connection_t *conn) router_get_trusteddirserver_by_digest(conn->identity_digest); char *rejected_hdr = http_get_header(headers, "X-Descriptor-Not-New: "); - int rejected = 0; if (rejected_hdr) { if (!strcmp(rejected_hdr, "Yes")) { log_info(LD_GENERAL, @@ -1913,7 +1912,6 @@ connection_dir_client_reached_eof(dir_connection_t *conn) * last descriptor, not on the published time of the last * descriptor. If those are different, that's a bad thing to * do. -NM */ - rejected = 1; } tor_free(rejected_hdr); } diff --git a/src/or/dirvote.c b/src/or/dirvote.c index 96e3df5..c6ce9f6 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -1592,7 +1592,7 @@ networkstatus_compute_consensus(smartlist_t *votes, * is the same flag as votes[j]->known_flags[b]. */ int *named_flag; /* Index of the flag "Named" for votes[j] */ int *unnamed_flag; /* Index of the flag "Unnamed" for votes[j] */ - int chosen_named_idx, chosen_unnamed_idx; + int chosen_named_idx; strmap_t *name_to_id_map = strmap_new(); char conflict[DIGEST_LEN]; @@ -1610,7 +1610,6 @@ networkstatus_compute_consensus(smartlist_t *votes, for (i = 0; i < smartlist_len(votes); ++i) unnamed_flag[i] = named_flag[i] = -1; chosen_named_idx = smartlist_string_pos(flags, "Named"); - chosen_unnamed_idx = smartlist_string_pos(flags, "Unnamed"); /* Build the flag index. */ SMARTLIST_FOREACH(votes, networkstatus_t *, v, diff --git a/src/or/eventdns.c b/src/or/eventdns.c index fc005df..b7cc292 100644 --- a/src/or/eventdns.c +++ b/src/or/eventdns.c @@ -1028,6 +1028,9 @@ request_parse(u8 *packet, ssize_t length, struct evdns_server_port *port, struct GET16(answers); GET16(authority); GET16(additional); + (void)additional; + (void)authority; + (void)answers; if (flags & 0x8000) return -1; /* Must not be an answer. */ flags &= 0x0110; /* Only RD and CD get preserved. */ diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index 781081a..bf2cc48 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -69,7 +69,7 @@ test_crypto_rng(void) uint64_t big; char *host; j = crypto_rand_int(100); - if (i < 0 || i >= 100) + if (j < 0 || j >= 100) allok = 0; big = crypto_rand_uint64(U64_LITERAL(1)<<40); if (big >= (U64_LITERAL(1)<<40)) @@ -240,11 +240,13 @@ test_crypto_sha(void) /* Test SHA-1 with a test vector from the specification. */ i = crypto_digest(data, "abc", 3); test_memeq_hex(data, "A9993E364706816ABA3E25717850C26C9CD0D89D"); + tt_int_op(i, ==, 0); /* Test SHA-256 with a test vector from the specification. */ i = crypto_digest256(data, "abc", 3, DIGEST_SHA256); test_memeq_hex(data, "BA7816BF8F01CFEA414140DE5DAE2223B00361A3" "96177A9CB410FF61F20015AD"); + tt_int_op(i, ==, 0); /* Test HMAC-SHA-1 with test cases from RFC2202. */

1 0

[obfsproxy/master] Beautified protocol-spec.txt a little bit
by nickm＠torproject.org 28 May '11

28 May '11

commit 7f5ce7fefff37b6559db5451c3d1b097629e6d6b Author: George Kadianakis <desnacked(a)gmail.com> Date: Fri May 27 19:42:08 2011 +0200 Beautified protocol-spec.txt a little bit --- doc/protocol-spec.txt | 41 ++++++++++++++++++++++++----------------- 1 files changed, 24 insertions(+), 17 deletions(-) diff --git a/doc/protocol-spec.txt b/doc/protocol-spec.txt index 9a7d4fa..471f2c0 100644 --- a/doc/protocol-spec.txt +++ b/doc/protocol-spec.txt @@ -16,13 +16,13 @@ The Twobfuscator 1. Primitives, notation, and constants. - H(x) is SHA256 of X - E_K(s) is the AES-counter-mode encryption of s using the key K. + H(x) is SHA256 of x. + E_K(s) is the AES-CTR-128 encryption of s using K as key. - x | y is the concatenation of x and y - UINT32(n) is the 4 byte value of n in big-endian (network) order - SR(n) is n bytes of strong random data - WR(n) is n bytes of weaker random data + x | y is the concatenation of x and y. + UINT32(n) is the 4 byte value of n in big-endian (network) order. + SR(n) is n bytes of strong random data. + WR(n) is n bytes of weaker random data. "xyz" is the ASCII characters 'x', 'y', and 'z', not NUL-terminated. s[:n] is the first n bytes of s. s[n:] is the last n bytes of s. @@ -44,9 +44,9 @@ The Twobfuscator 2. Key establishment phase. - The party who opens the connection is the initiator; the one who - accepts it is the responder. Each begins by generating a seed and - a padding key as follows. The initiator generates: + The party who opens the connection is the 'initiator'; the one who + accepts it is the 'responder'. Each begins by generating a seed + and a padding key as follows. The initiator generates: INIT_SEED = SR(SEED_LENGTH) INIT_PAD_KEY = MAC("Initiator obfuscation padding", INIT_SEED)[:KEYLEN] @@ -57,17 +57,24 @@ The Twobfuscator RESP_PAD_KEY = MAC("Responder obfuscation padding", INIT_SEED)[:KEYLEN] Each then generates a random number PADLEN in range from 0 through - MAX_PADDING (inclusive), and sends: + MAX_PADDING (inclusive). - SEED | E_PAD_KEY( UINT32(MAGIC_VALUE) | UINT32(PADLEN) | WR(PADLEN) ) + The initiator then sends: + + SEED | INIT_PAD_KEY( UINT32(MAGIC_VALUE) | UINT32(PADLEN) | WR(PADLEN) ) + + and the responder replies with: + + SEED | RESP_PAD_KEY( UINT32(MAGIC_VALUE) | UINT32(PADLEN) | WR(PADLEN) ) Upon receiving the SEED from the other party, each party derives - the other party's PAD_KEY value as above, and decrypts the next 8 - bytes of the key establishment message. If the MAGIC_VALUE does not - match, or the PADLEN value is greater than MAX_PADDING, the party - receiving it should wait for a random amount of time then close the - connection. Otherwise, it should read the remaining PADLEN bytes of - padding data and discard them. + the other party's padding key value as above, and decrypts the next + 8 bytes of the key establishment message. If the MAGIC_VALUE does + not match, or the PADLEN value is greater than MAX_PADDING, the + party receiving it should wait for a random amount of time (with + maximum wait time being 4 seconds) then close the connection. + Otherwise, it should read the remaining PADLEN bytes of padding data + and discard them. Additional keys are then derived as:

1 0

[obfsproxy/master] Added a first sample of what should become obfs2's threat model.
by nickm＠torproject.org 28 May '11

28 May '11

commit 368073564058981453e3c7a9e3b175ab463e27f5 Author: George Kadianakis <desnacked(a)gmail.com> Date: Fri May 27 19:48:30 2011 +0200 Added a first sample of what should become obfs2's threat model. doc/THREAT_MODEL is a practical list of attacks that obfs2 counters or fails to counter. doc/THREAT_MODEL_PHILOSOPHICAL is a non-practical document of wannabe academia rambling that might prove useful in the future. Of course both files are not in the correct dir since they only refer to obfs2 and not to obfsproxy, but hey! --- doc/THREAT_MODEL | 19 ++++++++ doc/THREAT_MODEL_PHILOSOPHICAL | 99 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 118 insertions(+), 0 deletions(-) diff --git a/doc/THREAT_MODEL b/doc/THREAT_MODEL new file mode 100644 index 0000000..d973317 --- /dev/null +++ b/doc/THREAT_MODEL @@ -0,0 +1,19 @@ +obfs2 was created to work on top of the Tor protocol (and specifically +it's TLS handshake phase). Do not use obfs2 to obfuscate other +protocols, unless you are super-sure of what you are doing. + +A list follows, of known attacks that obfs2 protects or does not +protect against. obfs2 does not protect you against unknown attacks. + +Attacks obfs2 protects against: +* Non-intelligent DPI boxes censoring based on TLS content patterns. +* In the case of a shared secret, it also protects against intelligent DPI boxes. + +Attacks obfs2 does not protect against: +* Any distinguisher based on the Tor protocol. This includes timing, packet + size and replay attacks. +* Any distinguisher based on packet entropy. +* In the case of obfs2 without a shared secret, obfs2 does not protect + against an intelligent DPI box; a DPI box that simply deobfuscates + the obfs2 protocol (for those not familiar with the protocol: this + is quite easy.). diff --git a/doc/THREAT_MODEL_PHILOSOPHICAL b/doc/THREAT_MODEL_PHILOSOPHICAL new file mode 100644 index 0000000..d67af1b --- /dev/null +++ b/doc/THREAT_MODEL_PHILOSOPHICAL @@ -0,0 +1,99 @@ + Role of this document + +The role of this document is to give a clear image of what obfs2 +provides to a censored Tor user. +The role of this document is *not* to describe the censorship ecosystem, +or to analyze the full threat model of Tor. + + Terminology +* Censorship: + 'Censorship is the suppression of speech or other public + communication which may be considered objectionable, harmful, + sensitive, or inconvenient to the general body of people as + determined by a government, media outlet, or other controlling + body.' +* Anonymity + Anonymity is the state of an individual's personal identity being + publicly unknown. Anonymity does not imply Privacy. +* Tor + Tor is a software system and a computer network intended to provide + online anonymity. It's main application is 'tor'. +* Privacy + Privacy is used to prevent the disclosure of information to + unauthorized individuals or systems. Privacy does not imply + Anonymity. +* Tor bridge + A Tor bridge is a component of the tor network that is not publicly + announced as part of it. It's main purpose is Censorship + circumvention since finding and blocking a bridge is considered + non-trivial. +* obfsproxy + obfsproxy is an application that accepts data as input and can + reshape it into another form. + When used with tor, it can transform tor's traffic into other + protocols in the hope of dodging Censorship. +* obfs2 + obfs2 is a protocol supported by obfsproxy. It shapes data by + encrypting them with a stream cipher with a randomly generated + key. It also supports pre-shared passwords. + + Players: +* Censored tor/obfsproxy user: + A censored tor/obfsproxy user is an Internet user that is censored + by 'A Man In The Middle'. He wants to use tor to achieve anonymity, + but he also needs privacy, to hide the fact that he is using Tor. +* Bridge Operator: + A bridge operator is a person who runs a tor bridge and has + successfully given to the 'Censored tor/obfsproxy user' the necessary + information so that the latter can access the bridge service. +* A Man In The Middle (MITM): + A MITM is a person or a group of people who have the power to + apply Censorship. + + What Tor does and does not provide: + +Once he is a member of the Tor network a censored Tor user can expect +low-latency anonymity. A Tor user can also expect Privacy with regards +to A Man In The Middle, when he is a member of the Tor network. + +The problem is that before and while becoming a member of the Tor +network the user is *not* anonymous and his communications with the +Tor network are *not* private. This allows A Man In The Middle to +identify the Tor user and censor him/her. + + What obfs2 does and does not provide: + +A Tor user using obfs2 with a Tor Bridge *without* a pre-shared password +can expect low quality privacy on his communications with the Tor +network before becoming part of it. +'low quality privacy' means that A Man In The Middle who has studied +the obfs2 protocol can easily decipher it, effectively extinguishing +the privacy. + +A Tor user using obfs2 with a Tor Bridge *with* a pre-shared password +can expect modest privacy on his communications with the Tor network +before becoming part of it. +'modest privacy' means that A Man In The Middle who has studied the +obfs2 protocol should not be able to decipher it. +Still one should know that: +* Because of the nature of the protocol, it is susceptible to offline + password cracking attacks. +* It is the responsibility of the user and the bridge operator to + decide upon a strong pre-shared password. + +After becoming part of the Tor network, the user is considered +anonymous and his communication private, with regards to A Man In The +Middle, under normal circumstances. + +Since the realm of anti-censorship is quite young and +not well studied, the obfs2 user should be aware that there are known +and unknown attacks that can potentially identify obfs2 and can be +deployed by A Man In The Middle. Known attacks like that include +entropy counting and timing attacks. + +Additionally, a Tor user using obfs2 with a Tor bridge must *not* +expect additional entity authentication, data integrity, availability +or deniability. + +Finally, a Tor user using obfs2 with a Tor bridge must *not* expect +protection from flows of the Tor protocol.

1 0

[obfsproxy/master] Merge remote-tracking branch 'asn/bug3288'
by nickm＠torproject.org 28 May '11

28 May '11

commit 8ac51f3f334b4d2116a8ddcea04483dfc5358b26 Merge: 3d988b6 3680735 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat May 28 00:35:42 2011 -0400 Merge remote-tracking branch 'asn/bug3288' doc/THREAT_MODEL | 19 ++++++++ doc/THREAT_MODEL_PHILOSOPHICAL | 99 ++++++++++++++++++++++++++++++++++++++++ doc/protocol-spec.txt | 41 ++++++++++------- 3 files changed, 142 insertions(+), 17 deletions(-)

1 0

[obfsproxy/master] We can now send 'SOCKS5_FAILED_UNSUPPORTED' replies as well!
by nickm＠torproject.org 28 May '11

28 May '11

commit 7eb36a85f4884668a259040e5dcb2350ed3b0595 Author: George Kadianakis <desnacked(a)gmail.com> Date: Tue May 24 16:43:28 2011 +0200 We can now send 'SOCKS5_FAILED_UNSUPPORTED' replies as well! --- src/network.c | 13 +++++++++++-- src/socks.c | 22 ++++++++++++---------- src/socks.h | 3 +++ 3 files changed, 26 insertions(+), 12 deletions(-) diff --git a/src/network.c b/src/network.c index 835dff1..1f68804 100644 --- a/src/network.c +++ b/src/network.c @@ -268,6 +268,15 @@ socks_read_cb(struct bufferevent *bev, void *arg) return; /* need to read more data. */ else if (r == -1) conn_free(conn); /* XXXX maybe send socks reply */ + else if (r == -2) { + bufferevent_enable(bev, EV_WRITE); + bufferevent_disable(bev, EV_READ); + socks5_send_reply(bufferevent_get_output(bev), conn->socks_state, + SOCKS5_FAILED_UNSUPPORTED); + bufferevent_setcb(bev, NULL, + close_conn_on_flush, output_event_cb, conn); + return; + } } static void @@ -399,8 +408,8 @@ output_event_cb(struct bufferevent *bev, short what, void *arg) * socks client */ socks_state_set_address(conn->socks_state, sa); } - socks_send_reply(conn->socks_state, bufferevent_get_output(conn->input), - 0); + socks_send_reply(conn->socks_state, + bufferevent_get_output(conn->input), 0); /* we sent a socks reply. We can finally move over to being a regular input bufferevent. */ socks_state_free(conn->socks_state); diff --git a/src/socks.c b/src/socks.c index a388363..367c2f1 100644 --- a/src/socks.c +++ b/src/socks.c @@ -90,13 +90,13 @@ socks_errno_to_reply(socks_state_t *state, int error) return SOCKS5_FAILED_GENERAL; } } - } - return -1; + } else + return -1; } /** Takes a command request from 'source', it evaluates it and if it's - legit it parses into 'parsereq'. + legit it parses it into 'parsereq'. It returns '1' if everything went fine. It returns '0' if we need more data from the client. @@ -138,6 +138,7 @@ socks5_handle_request(struct evbuffer *source, struct parsereq *parsereq) printf("socks: Corrupted packet. Discarding.\n"); goto err; } + if (p[1] != SOCKS5_CMD_CONNECT) return -2; /* We must send reply to the client. */ @@ -495,13 +496,14 @@ handle_socks(struct evbuffer *source, struct evbuffer *dest, if (socks_state->state == ST_NEGOTIATION_DONE) { /* We know this connection. Let's see what it wants. */ r = socks5_handle_request(source,&socks_state->parsereq); - if (r == -1) - goto broken; - else if (r == -2) { - socks5_send_reply(dest,socks_state, - SOCKS5_FAILED_UNSUPPORTED); + if (r == -2) { /* Request CMD != CONNECT. */ + socks_state->broken = 1; + return -2; + } else if (r == -1) /* Broken request. */ goto broken; - } else if (r == 1) + else if (r == 0) /* Incomplete. */ + return 0; + else if (r == 1) /* Neat request. */ socks_state->state = ST_HAVE_ADDR; return r; } @@ -565,6 +567,7 @@ socks_state_set_address(socks_state_t *state, const struct sockaddr *sa) } /** + This function sends a SOCKS{5,4} "Server Reply" to 'dest'. 'error' is 0 if no errors were encountered during the SOCKS operation (normally a CONNECT with no errors means that the connect() was successful). @@ -582,4 +585,3 @@ socks_send_reply(socks_state_t *state, struct evbuffer *dest, int error) else return -1; } - diff --git a/src/socks.h b/src/socks.h index 01a76ff..09ebe28 100644 --- a/src/socks.h +++ b/src/socks.h @@ -28,6 +28,9 @@ int socks_state_get_address(const socks_state_t *state, int *port_out); int socks_state_set_address(socks_state_t *state, const struct sockaddr *sa); int socks_send_reply(socks_state_t *state, struct evbuffer *dest, int error); +int socks5_send_reply(struct evbuffer *reply_dest, + socks_state_t *state, int status); + #define SOCKS_SUCCESS 0x0 #define SOCKS_FAILED 0x01

1 0