tor-commits January 2012

tor-commits@lists.torproject.org

14 participants
852 discussions

r25314: {} add 3 straggler images, commit my presentation from today. (in projects/presentations: . images)
by Andrew Lewman 17 Jan '12

17 Jan '12

Author: phobos Date: 2012-01-17 21:15:42 +0000 (Tue, 17 Jan 2012) New Revision: 25314 Added: projects/presentations/2012-01-17-FBI-presentation.pdf projects/presentations/2012-01-17-FBI-presentation.tex projects/presentations/images/2011-09-04-DigiNotar-blog-disclosure.png projects/presentations/images/tripoli-internet-monitoring-map.jpg projects/presentations/images/tripoli-internet-monitoring-room-sign.jpg Log: add 3 straggler images, commit my presentation from today. Added: projects/presentations/2012-01-17-FBI-presentation.pdf =================================================================== (Binary files differ) Property changes on: projects/presentations/2012-01-17-FBI-presentation.pdf ___________________________________________________________________ Added: svn:mime-type + application/octet-stream Added: projects/presentations/2012-01-17-FBI-presentation.tex =================================================================== --- projects/presentations/2012-01-17-FBI-presentation.tex (rev 0) +++ projects/presentations/2012-01-17-FBI-presentation.tex 2012-01-17 21:15:42 UTC (rev 25314) @@ -0,0 +1,273 @@ +\documentclass{beamer} +\mode<presentation> +\usetheme{Boadilla} +\title{FBI Tor Overview} +\author{Andrew Lewman \\ andrew(a)torproject.org} +\date{January 17, 2012} +\begin{document} + +\begin{frame} +\maketitle +\begin{center} +\includegraphics[height=3cm]{./images/2009-tor-logo} +\end{center} +\end{frame} + +\begin{frame} +\frametitle{What are we talking about?} +\begin{itemize} +\item Crash course on anonymous communications +\item Quick overview of Tor +\item Quick overview of Tor Hidden Services +\item Future directions +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{The Tor Project, Inc.} +501(c)(3) non-profit organization dedicated to the research and development of technologies for online anonymity and privacy +\begin{center} +\includegraphics[height=5cm]{./images/2009-oval_sticker_new} +\end{center} +\end{frame} + +\begin{frame} +\frametitle{What is anonymity?} +\includegraphics[width=10cm]{./images/2llg3ts} +\end{frame} + +\begin{frame} +\frametitle{Anonymity isn't cryptography} +\begin{itemize} +\item Cryptography protects the contents in transit +\item You still know who is talking to whom, how often, and how much data is sent. +\end{itemize} +\begin{center} +\includegraphics[width=5cm]{./images/encryption-cc-by-sa} +\end{center} +\end{frame} + +\begin{frame} +\frametitle{Anonymity isn't steganography} +Attacker can tell Alice is talking to someone, how often, and how much data is sent. +\bigskip + +\begin{center} +\includegraphics[width=5cm]{./images/steganography-cc-by-sa} +\end{center} +\end{frame} + +\begin{frame} +\frametitle{Anonymity isn't just wishful thinking...} +\begin{itemize} +\item "You can't prove it was me!" +\pause \item "Promise you won't look" +\pause \item "Promise you won't remember" +\pause \item "Promise you won't tell" +\pause \item "I didn't write my name on it!" +\pause \item "Isn't the Internet already anonymous?" +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{..since "weak" isn't anonymity.} +\begin{itemize} +\item \textit{"You can't prove it was me!"} Proof is a very \textbf{strong} word. Statistical analysis allows suspicion to become certainty. +\pause \item \textit{"Promise you won't look/remember/tell"} Will other parties have the abilities and incentives to keep these promises? +\pause \item \textit{"I didn't write my name on it!"} Not what we're talking about. +\pause \item \textit{"Isn't the Internet already anonymous?"} Nope! +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Anonymous communication} +\begin{itemize} +\item People have to hide in a crowd of other people ("anonymity loves company") +\item The goal of the system is to make all users look as similar as possible, to give a bigger crowd +\item Hide who is communicating with whom +\item Layered encryption and random delays hide correlation between input traffic and output traffic +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Low versus High-latency anonymous communication systems} +\begin{itemize} +\item Tor is not the first system; ZKS, mixmaster, single-hop proxies, Crowds, Java Anon Proxy. +\item Low-latency systems are vulnerable to end-to-end correlation attacks. +\item High-latency systems are more resistant to end-to-end correlation attacks, but by definition, less interactive. +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Low-latency systems are generally more attractive to today's user} +\begin{itemize} +\item Interactive apps: web, instant messaging, VOIP, ssh, X11, cifs/nfs, video streaming (millions of users) +\item Multi-hour delays: email, nntp, blog posting? (tens of thousands of users?) +\pause \item \begin{center}\begin{Large}And if anonymity loves company...\end{Large}\end{center} +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{What is Tor?} +\begin{itemize} +\item online anonymity software and network +\pause \item open source, freely available (3-clause BSD license) +\pause \item active research environment: \\ +Drexel, Univ of Waterloo, Georgia Tech, Princeton, Boston University, University College London, Univ of Minnesota, National Science Foundation, Naval Research Labs, Cambridge UK, Bamberg Germany, MIT... +\pause \item increasingly diverse toolset: \\ +Tor, Tor Browser Bundle, Tails LiveCD, Tor Weather, Tor auto-responder, Secure Updater, Orbot, Torora, Tor Check, Arm, Nymble, Tor Control, and so on. +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Other Systems} +\begin{itemize} +\item VPN - Virtual Private Network, 1 to 1 connection, can redirect all traffic, generally encrypted +\pause \item Proxy - 1 to 1 connection, per application traffic redirection, sometimes encrypted +\pause \item I2P - Garlic routing, closed network, anonymity and reputation +\pause \item Freenet - closed network, anonymity, distributed file storage and sharing +\pause \item GNUnet - closed network, anonymity, distributed file storage and sharing +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{How is Tor different from other systems?} +\begin{overlayarea}{9cm}{6cm} +\only<1>{\includegraphics[height=7cm]{./images/single_hop_relay}} +\only<2>{\includegraphics[height=7cm]{./images/evil_single_hop_relay}} +\only<3>{\includegraphics[height=7cm]{./images/data_snooping_single_hop_relay}} +\end{overlayarea} +\end{frame} + +\begin{frame} +\frametitle{Who uses Tor?} +\parbox{8cm}{\sloppy \setbeamercolor{background}[\includegraphics[scale=0.35]{./images/anonymousman}} +\parbox{3cm}{\sloppy +\begin{flushleft} +\begin{itemize} +\begin{small} +\item Normal people +\item Law Enforcement +\item Human Rights Activists +\item Business Execs +\item Militaries +\item Abuse Victims +\end{small} +\end{itemize} +\end{flushleft} +} +\end{frame} + +\begin{frame} +\frametitle{Who uses Tor?} +\begin{itemize} +\item <1> \textit{Normal users} \\ linking sensitive information to their current identities, online advertising networks, search engines, censorship circumvention +\item <2> \textit{Law enforcement}\\ accidental disclosure to targets, family and friend concerns, separating work from home life +\item <3> \textit{Rights Activists}\\ Personal safety, family safety, narrowly-defined publicity, censorship circumvention +\item <4> \textit{Business Execs}\\ separating work from home life, competitor research, censorship circumvention +\item <5> \textit{Abuse Victims and Survivors}\\ complete separation of past abuse and current life, finding help and safety, need to help others anonymously +\item <6> \textit{Militaries}\\ intelligence gathering, separating work from home life, other activities +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{You missed a use case} +\includegraphics[scale=0.8]{./images/zscaler-research-security-blocks-dec2011} +\end{frame} + +\begin{frame} +\frametitle{estimated 400k to 800k daily users} +\setbeamercolor{background}[\includegraphics[scale=0.4]{./images/huge-crowd}] +\flushright +\tiny Source: zscaler research, Dec 2011 +\end{frame} + +\begin{frame} +\frametitle{Tor hides communication patterns by relaying data through volunteer servers} +\begin{center} +\begin{overlayarea}{9cm}{6cm} +\only<1>{\includegraphics[width=9cm]{./images/tor-network}} +\only<2>{\includegraphics[width=9cm]{./images/tor-safe-selection}} +\only<3>{\includegraphics[width=9cm]{./images/tor-safe-path}} +\only<4>{\includegraphics[width=9cm]{./images/tor-keys1}} +\end{overlayarea} +\flushright +\tiny Diagram: Robert Watson +\end{center} +\end{frame} + +\begin{frame} +\frametitle{Vidalia Network Map} +\includegraphics[scale=0.4]{./images/vidalia-network-map} +\end{frame} + +\begin{frame} +\frametitle{Metrics} +\begin{itemize} +\item Measuring metrics anonymously +\item NSF grant to find out +\item Archive of hourly consensus, ExoneraTor, VisiTor +\item Metrics portal: \\ \url{https://metrics.torproject.org/} +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Tor hidden services allow privacy enhanced hosting of services} +\includegraphics[scale=0.5]{./images/hidden-federalist} +\end{frame} + +\begin{frame} +\frametitle{dot onion you say?} +\includegraphics[scale=0.6]{./images/hidden-federalist-zoom} +\end{frame} + +\begin{frame} +\frametitle{Hidden Services, in graphics} +\begin{overlayarea}{9cm}{6cm} +\only<1>{\includegraphics[scale=0.5]{../../website/trunk/images/THS-1}} +\only<2>{\includegraphics[scale=0.5]{../../website/trunk/images/THS-2}} +\only<3>{\includegraphics[scale=0.5]{../../website/trunk/images/THS-3}} +\only<4>{\includegraphics[scale=0.5]{../../website/trunk/images/THS-4}} +\only<5>{\includegraphics[scale=0.5]{../../website/trunk/images/THS-5}} +\only<6>{\includegraphics[scale=0.5]{../../website/trunk/images/THS-6}} +\end{overlayarea} +\end{frame} + +\begin{frame} +\frametitle{Operating Systems leak info like a sieve} +\parbox{5cm}{\sloppy \setbeamercolor{background}[\includegraphics[height=7cm]{./images/cropped-hijack-sign-south-africa}} +\parbox{5cm}{\begin{itemize} +\item Applications, network stacks, plugins, oh my.... +\pause some call this "sharing" +\pause \item Did you know Microsoft Word and OpenOffice Writer are browsers? +\pause \item \url{www.decloak.net} is a fine test +\end{itemize} +} +\end{frame} + +\begin{frame} +\frametitle{Mobile Operating Systems} +\begin{itemize} +\item Entirely new set of challenges for something designed to know where you are at all times. +\item Orbot: Tor on Android. \url{https://guardianproject.info/apps/} +\item Tor on iphone, maemo/meego, symbian, etc +\item Tor on Windows Mobile, \url{http://www.gsmk.de} as an example. +\item Guardian Project, \url{https://guardianproject.info/} +\end{itemize} +\end{frame} + +\begin{frame} +\frametitle{Next steps} +Visit \url{https://www.torproject.org/} for more information, links, and ideas. +\end{frame} + +\begin{frame} +\frametitle{Credits \& Thanks} +\begin{itemize} +\item who uses tor? \url{http://www.flickr.com/photos/mattw/2336507468/siz}, Matt Westervelt, CC-BY-SA. +\item danger!, \url{http://flickr.com/photos/hmvh/58185411/sizes/o/}, hmvh, CC-BY-SA. +\item 500k, \url{http://www.flickr.com/photos/lukaskracic/334850378/sizes/l/}, Luka Skracic, used with permission. +\end{itemize} +\end{frame} + +\end{document} Property changes on: projects/presentations/2012-01-17-FBI-presentation.tex ___________________________________________________________________ Added: svn:mime-type + text/x-tex Added: projects/presentations/images/2011-09-04-DigiNotar-blog-disclosure.png =================================================================== (Binary files differ) Property changes on: projects/presentations/images/2011-09-04-DigiNotar-blog-disclosure.png ___________________________________________________________________ Added: svn:mime-type + image/png Added: projects/presentations/images/tripoli-internet-monitoring-map.jpg =================================================================== (Binary files differ) Property changes on: projects/presentations/images/tripoli-internet-monitoring-map.jpg ___________________________________________________________________ Added: svn:mime-type + image/jpeg Added: projects/presentations/images/tripoli-internet-monitoring-room-sign.jpg =================================================================== (Binary files differ) Property changes on: projects/presentations/images/tripoli-internet-monitoring-room-sign.jpg ___________________________________________________________________ Added: svn:mime-type + image/jpeg

1 0

r25313: {website} remove extraneous word (website/trunk/projects/en)
by Roger Dingledine 17 Jan '12

17 Jan '12

Author: arma Date: 2012-01-17 21:01:59 +0000 (Tue, 17 Jan 2012) New Revision: 25313 Modified: website/trunk/projects/en/vidalia.wml Log: remove extraneous word Modified: website/trunk/projects/en/vidalia.wml =================================================================== --- website/trunk/projects/en/vidalia.wml 2012-01-17 20:55:39 UTC (rev 25312) +++ website/trunk/projects/en/vidalia.wml 2012-01-17 21:01:59 UTC (rev 25313) @@ -142,7 +142,7 @@ </p> <p> - If you have any doubts about any of the points in here, you can email + If you have any doubts about any of the points in here, you can <a href="<page about/contact>">contact us</a> about it. </p>

1 0

r25312: {website} Adding obfsproxy to the volunteer project table As requested (website/trunk/getinvolved/en)
by Damian Johnson 17 Jan '12

17 Jan '12

Author: atagar Date: 2012-01-17 20:55:39 +0000 (Tue, 17 Jan 2012) New Revision: 25312 Modified: website/trunk/getinvolved/en/volunteer.wml Log: Adding obfsproxy to the volunteer project table As requested on https://trac.torproject.org/projects/tor/ticket/4905 Modified: website/trunk/getinvolved/en/volunteer.wml =================================================================== --- website/trunk/getinvolved/en/volunteer.wml 2012-01-16 13:47:56 UTC (rev 25311) +++ website/trunk/getinvolved/en/volunteer.wml 2012-01-17 20:55:39 UTC (rev 25312) @@ -162,6 +162,14 @@ </tr> <tr> + <td><a href="#project-obfsproxy">Obfsproxy</a></td> + <td>Client Add-on</td> + <td>C</td> + <td>Moderate</td> + <td>nickm, asn</td> + </tr> + + <tr class="alt"> <td>*<a href="#project-thandy">Thandy</a></td> <td>Updater</td> <td>Python</td> @@ -169,7 +177,7 @@ <td>chiiph, Erinn, nickm</td> </tr> - <tr class="alt"> + <tr> <td><a href="#project-torctl">TorCtl</a></td> <td>Library</td> <td>Python</td> @@ -177,7 +185,7 @@ <td>mikeperry</td> </tr> - <tr> + <tr class="alt"> <td>*<a href="#project-stem">Stem</a></td> <td>Library</td> <td>Python</td> @@ -185,7 +193,7 @@ <td>atagar</td> </tr> - <tr class="alt"> + <tr> <td><a href="#project-metrics">Metrics</a></td> <td>Client Service</td> <td>Java</td> @@ -193,7 +201,7 @@ <td>karsten</td> </tr> - <tr> + <tr class="alt"> <td><a href="#project-torstatus">TorStatus</a></td> <td>Client Service</td> <td>PHP</td> @@ -201,7 +209,7 @@ <td></td> </tr> - <tr class="alt"> + <tr> <td><a href="#project-weather">Weather</a></td> <td>Client Service</td> <td>Python</td> @@ -209,7 +217,7 @@ <td>kaner</td> </tr> - <tr> + <tr class="alt"> <td><a href="#project-gettor">GetTor</a></td> <td>Client Service</td> <td>Python</td> @@ -217,7 +225,7 @@ <td>kaner</td> </tr> - <tr class="alt"> + <tr> <td><a href="#project-torcheck">TorCheck</a></td> <td>Client Service</td> <td>Python, Perl</td> @@ -225,7 +233,7 @@ <td></td> </tr> - <tr> + <tr class="alt"> <td><a href="#project-bridgedb">BridgeDB</a></td> <td>Backend Service</td> <td>Python</td> @@ -233,7 +241,7 @@ <td>kaner, nickm</td> </tr> - <tr class="alt"> + <tr> <td><a href="#project-torflow">TorFlow</a></td> <td>Backend Service</td> <td>Python</td> @@ -241,7 +249,7 @@ <td>mikeperry</td> </tr> - <tr> + <tr class="alt"> <td>*<a href="#project-torbel">TorBEL</a></td> <td>Backend Service</td> <td>Python</td> @@ -432,6 +440,17 @@ <i><a href="#torbuttonForThunderbird">Torbutton equivalent for Thunderbird</a></i> </p> + <a id="project-obfsproxy"></a> + <h3><a href="https://gitweb.torproject.org/obfsproxy.git/tree/HEAD:/doc">Obfsproxy</a> (<a + href="https://gitweb.torproject.org/obfsproxy.git">code</a>, <a + href="https://trac.torproject.org/projects/tor/query?status=accepted&status=assig…">bug + tracker</a>)</h3> + + <p> + A proxy that shapes Tor traffic, making it harder for censors to detect and + block Tor. + </p> + <a id="project-thandy"></a> <h3>Thandy (<a href="https://gitweb.torproject.org/thandy.git">code</a>)</h3>

1 0

[metrics-web/master] Clarify what data the torperf graph shows.
by karsten＠torproject.org 17 Jan '12

17 Jan '12

commit 0cfd18208a9a199a09b1280572a78a39cede5868 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Tue Jan 17 20:20:22 2012 +0100 Clarify what data the torperf graph shows. --- web/WEB-INF/performance.jsp | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/web/WEB-INF/performance.jsp b/web/WEB-INF/performance.jsp index 05b9bf3..5f25b8a 100644 --- a/web/WEB-INF/performance.jsp +++ b/web/WEB-INF/performance.jsp @@ -21,7 +21,10 @@ Tor</a></h3> <p>The following graphs show the performance of the Tor network as experienced by its users. The graphs contain the average (median) time to request files of three different sizes over Tor as well as first and third -quartile of request times.</p> +quartile of request times. Medians and quartiles are calculated multiple +times per day for completed days only, resulting in a delay of 1 to 1.5 +days before changes to network performance become visible in the +graph.</p> <img src="torperf.png${torperf_url}" width="576" height="360" alt="Torperf graph"> <form action="performance.html#torperf">

1 0

[torspec/master] Make 190 needs-revision
by nickm＠torproject.org 17 Jan '12

17 Jan '12

commit c17168500419d626547d1cbdbf19a2430f9bfa2d Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 17 12:19:57 2012 -0500 Make 190 needs-revision --- proposals/000-index.txt | 4 ++-- .../190-shared-secret-bridge-authorization.txt | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/proposals/000-index.txt b/proposals/000-index.txt index 1457498..d539742 100644 --- a/proposals/000-index.txt +++ b/proposals/000-index.txt @@ -110,7 +110,7 @@ Proposals by number: 187 Reserve a cell type to allow client authorization [CLOSED] 188 Bridge Guards and other anti-enumeration defenses [OPEN] 189 AUTHORIZE and AUTHORIZED cells [OPEN] -190 Bridge Client Authorization Based on a Shared Secret [OPEN] +190 Bridge Client Authorization Based on a Shared Secret [NEEDS-REVISION] 191 Bridge Detection Resistance against MITM-capable Adversaries [OPEN] 192 Automatically retrieve and store information about bridges [OPEN] @@ -129,6 +129,7 @@ Proposals by status: 186 Multiple addresses for one OR or bridge NEEDS-REVISION: 131 Help users to verify they are using Tor + 190 Bridge Client Authorization Based on a Shared Secret NEEDS-RESEARCH: 145 Separate "suitable as a guard" from "suitable as a new guard" 146 Add new flag to reflect long-term stability @@ -144,7 +145,6 @@ Proposals by status: 185 Directory caches without DirPort 188 Bridge Guards and other anti-enumeration defenses 189 AUTHORIZE and AUTHORIZED cells - 190 Bridge Client Authorization Based on a Shared Secret 191 Bridge Detection Resistance against MITM-capable Adversaries 192 Automatically retrieve and store information about bridges [for 0.2.[45].x] ACCEPTED: diff --git a/proposals/190-shared-secret-bridge-authorization.txt b/proposals/190-shared-secret-bridge-authorization.txt index 95a0d19..8683652 100644 --- a/proposals/190-shared-secret-bridge-authorization.txt +++ b/proposals/190-shared-secret-bridge-authorization.txt @@ -2,7 +2,7 @@ Filename: 190-shared-secret-bridge-authorization.txt Title: Bridge Client Authorization Based on a Shared Secret Author: George Kadianakis Created: 04 Nov 2011 -Status: Open +Status: Needs-Revision 1. Overview

1 0

[torspec/master] Tweaks/TODOs on 186 based on mail from arma
by nickm＠torproject.org 17 Jan '12

17 Jan '12

commit 4524415cc8ac3616376c3f7be01d3492b4a160e5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 17 11:46:28 2012 -0500 Tweaks/TODOs on 186 based on mail from arma --- proposals/186-multiple-orports.txt | 11 ++++++++++- 1 files changed, 10 insertions(+), 1 deletions(-) diff --git a/proposals/186-multiple-orports.txt b/proposals/186-multiple-orports.txt index aa1a789..5cb2ddd 100644 --- a/proposals/186-multiple-orports.txt +++ b/proposals/186-multiple-orports.txt @@ -165,7 +165,7 @@ Consensus directories and microdescriptors: We will have to define a new voting algorithm version; when using this version or later, votes should include a single "a" line for every relay that has an IPv6 address, to include the first IPv6 - line in its descriptor. (If there are no or-address lines, then + line in its descriptor. (If there are no IPv6 or-address lines, then they shouldn't include any "a" lines.) The remaining or-address lines will turn into "a" lines in the microdescriptor. @@ -268,3 +268,12 @@ Coding impact: under the assumptions that each node has only a single address or ORPort. +TODO: + + * Make it so that authorities can vote on which addresses are working + somehow. + + * Specify some way to say "I only want to connect to v4/v6 addresses". + + * Come up with a better alternative to running6 for the longterm? +

1 0

[torspec/master] apply notes from karsten and roger to proposal 186
by nickm＠torproject.org 17 Jan '12

17 Jan '12

commit 90744e95f4b49a4026126c3cdc99bdc85dc7abc3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 17 11:35:01 2012 -0500 apply notes from karsten and roger to proposal 186 --- proposals/186-multiple-orports.txt | 16 +++++++++------- 1 files changed, 9 insertions(+), 7 deletions(-) diff --git a/proposals/186-multiple-orports.txt b/proposals/186-multiple-orports.txt index 192d758..d76377d 100644 --- a/proposals/186-multiple-orports.txt +++ b/proposals/186-multiple-orports.txt @@ -64,9 +64,9 @@ Configuring additional addresses and ports: In current operating systems (unless we get into crazy nonportable tricks) we need to use one socket for every address:port that Tor - binds on. As a sanity check, we can limit the number of such - sockets we use to, say, 64. If you want to bind lots of - address:port combinations, you'll want to do it at the + binds on. As a sanity check, we can limit the number of such sockets + we use to, say, something between 8 and 64. If you want to bind lots + of address:port combinations, you'll want to do it at the firewall/routing level. Example: We want to bind on 0.0.0.0:9001 @@ -74,10 +74,10 @@ Configuring additional addresses and ports: ORPort 9001 Example: Our firewall is redirecting ports 80, 443, and 7000-8000 - on all hosts in 18.244.2.0/24 onto our port 2929. + on all hosts in 18.244.2.0 onto our port 2929. ORPort 2929 noadvertise - ORPort 18.244.2.0/24:80,443,7000-8000 nolisten + ORPort 18.244.2.0:80,443,7000-8000 nolisten Example: We have a dynamic DNS provider that maps tornode.example.com to our current external IPv4 and IPv6 @@ -98,8 +98,10 @@ Self-testing: combinations. It will now be possible for a Tor node to find that some addresses - work and others do not. In this case, the node should only - advertise ORPort lines that have been checked. + work and others do not. In this case, the node should only advertise + ORPort lines that have been checked. (As a consequence, the node + should not advertise any address unless at least one ORPort without + nolisten has been specified.) {Until support is added for extend cells to IPv6 addresses, it will only be possible to test IPv6 addresses by connecting

1 0

[torspec/master] Remove port ranges from prop186
by nickm＠torproject.org 17 Jan '12

17 Jan '12

commit ed801b7af052b2fc39d06d524e6db797da8af6dc Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 17 11:37:25 2012 -0500 Remove port ranges from prop186 --- proposals/186-multiple-orports.txt | 16 +++++++++------- 1 files changed, 9 insertions(+), 7 deletions(-) diff --git a/proposals/186-multiple-orports.txt b/proposals/186-multiple-orports.txt index d76377d..aa1a789 100644 --- a/proposals/186-multiple-orports.txt +++ b/proposals/186-multiple-orports.txt @@ -119,7 +119,7 @@ New descriptor syntax: IPV6ADDR = an ipv6 address, surrounded by square brackets. IPV4ADDR = an ipv4 address, represented as a dotted quad. PORTLIST = PORTSPEC | PORTSPEC "," PORTLIST - PORTSPEC = PORT | PORT "-" PORT + PORTSPEC = PORT PORT = a number between 1 and 65535 inclusive. [This is the regular format for specifying sets of addresses and @@ -251,13 +251,15 @@ Why not extend DirPort this way too? That is, clients tunnel their directory requests inside OR connections, and don't generally connect to DirPorts at all. -Why not have address ranges? +Why not have address and port ranges? - Earlier drafts of this proposal suggested that clients should - provide not only ranges of ports, but also ranges of addresses, - specified with bitmasks. That's a neat idea for circumvention, - but if we did that, you wouldn't want to advertise publicly that - you have an entire address range. + Earlier drafts of this proposal suggested that servers should provide + ranges of addresses, specified with bitmasks. That's a neat idea for + circumvention, but if we did that, you wouldn't want to advertise + publicly that you have an entire address range. + + Port ranges are out because I don't think they would actually get used + much, and they add a fair bit of complexity. Coding impact:

1 0

[torspec/master] Revise prop 185 based on comment from Karsten and Roger
by nickm＠torproject.org 17 Jan '12

17 Jan '12

commit f08a04058a93b2f0a44ba27b5a76ff05706a2089 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 17 11:16:11 2012 -0500 Revise prop 185 based on comment from Karsten and Roger --- proposals/185-dir-without-dirport.txt | 11 +++++++---- 1 files changed, 7 insertions(+), 4 deletions(-) diff --git a/proposals/185-dir-without-dirport.txt b/proposals/185-dir-without-dirport.txt index 838a58a..62d5460 100644 --- a/proposals/185-dir-without-dirport.txt +++ b/proposals/185-dir-without-dirport.txt @@ -25,16 +25,19 @@ Configuration: if DirPort is set. If it is 1, then we act as a directory cache according to same rules as those used for nodes that set a DirPort. If it is "auto", then Tor decides whether to act as a - directory cache. + directory cache based on some future intelligent algorithm. "Auto" + should be the new default. Advertising cache status: Nodes which are running as a directory cache but which do not have a DirPort set, or which do not have a working DirPort, should set the entry "dir-cache 1" in their router descriptors and give their - directory port as 0 in their router lines. (Nodes which have a - working directory port advertise it as usual, and do not include - a "dir-cache" line. Implementations should accept and ignore + directory port as 0 in their router lines. (Nodes that have a + working directory port advertise it as usual, and do not include a + "dir-cache" line. Nodes that do not serve directory information + should set their directory port to 0, and not include any + dir-cache line. Implementations should accept and ignore dir-cache lines with values other than "dir-cache 1".) Consensus:

1 0

[torspec/master] Mark proposal 110 closed at last
by nickm＠torproject.org 17 Jan '12

17 Jan '12

commit e036f2d2b1b533615ebf343d8c1cb2ab9bbd6507 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 17 11:09:05 2012 -0500 Mark proposal 110 closed at last --- proposals/000-index.txt | 4 ++-- proposals/110-avoid-infinite-circuits.txt | 4 ++-- tor-spec.txt | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/proposals/000-index.txt b/proposals/000-index.txt index 92669b9..1457498 100644 --- a/proposals/000-index.txt +++ b/proposals/000-index.txt @@ -30,7 +30,7 @@ Proposals by number: 107 Uptime Sanity Checking [CLOSED] 108 Base "Stable" Flag on Mean Time Between Failures [CLOSED] 109 No more than one server per IP address [CLOSED] -110 Avoiding infinite length circuits [ACCEPTED] +110 Avoiding infinite length circuits [CLOSED] 111 Prioritizing local traffic over relayed traffic [CLOSED] 112 Bring Back Pathlen Coin Weight [SUPERSEDED] 113 Simplifying directory authority administration [SUPERSEDED] @@ -148,7 +148,6 @@ Proposals by status: 191 Bridge Detection Resistance against MITM-capable Adversaries 192 Automatically retrieve and store information about bridges [for 0.2.[45].x] ACCEPTED: - 110 Avoiding infinite length circuits [for 0.2.3.x] [in 0.2.1.3-alpha] 117 IPv6 exits [for 0.2.3.x] 140 Provide diffs between consensuses 147 Eliminate the need for v2 directories in generating v3 directories [for 0.2.3.x] @@ -178,6 +177,7 @@ Proposals by status: 107 Uptime Sanity Checking [in 0.2.0.x] 108 Base "Stable" Flag on Mean Time Between Failures [in 0.2.0.x] 109 No more than one server per IP address [in 0.2.0.x] + 110 Avoiding infinite length circuits [for 0.2.3.x] [in 0.2.1.3-alpha, 0.2.3.11-alpha] 111 Prioritizing local traffic over relayed traffic [in 0.2.0.x] 114 Distributed Storage for Tor Hidden Service Descriptors [in 0.2.0.x] 119 New PROTOCOLINFO command for controllers [in 0.2.0.x] diff --git a/proposals/110-avoid-infinite-circuits.txt b/proposals/110-avoid-infinite-circuits.txt index 5da3261..7d6772d 100644 --- a/proposals/110-avoid-infinite-circuits.txt +++ b/proposals/110-avoid-infinite-circuits.txt @@ -2,9 +2,9 @@ Filename: 110-avoid-infinite-circuits.txt Title: Avoiding infinite length circuits Author: Roger Dingledine Created: 13-Mar-2007 -Status: Accepted +Status: Closed Target: 0.2.3.x -Implemented-In: 0.2.1.3-alpha +Implemented-In: 0.2.1.3-alpha, 0.2.3.11-alpha History: diff --git a/tor-spec.txt b/tor-spec.txt index fea3073..7443644 100644 --- a/tor-spec.txt +++ b/tor-spec.txt @@ -895,7 +895,7 @@ see tor-design.pdf. A RELAY_EARLY cell is designed to limit the length any circuit can reach. When an OR receives a RELAY_EARLY cell, and the next node in the circuit is speaking v2 of the link protocol or later, the OR relays the cell as a - RELAY_EARLY cell. Otherwise, it relays it as a RELAY cell. + RELAY_EARLY cell. Otherwise, older Tors will relay it as a RELAY cell. If a node ever receives more than 8 RELAY_EARLY cells on a given outbound circuit, it SHOULD close the circuit. (For historical reasons, @@ -908,8 +908,8 @@ see tor-design.pdf. RELAY cells that are not targeted at the first hop of any circuit as RELAY_EARLY cells too, in order to partially conceal the circuit length. - [In a future version of Tor, relays will reject any EXTEND cell not - received in a RELAY_EARLY cell. See proposal 110.] + [Starting with Tor 0.2.3.11-alpha, future version of Tor, relays should + reject any EXTEND cell not received in a RELAY_EARLY cell.] 6. Application connections and stream management

1 0

← Newer
1
...
35
36
37
38
39
40
41
...
86
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits January 2012