November 2012 - tor-commits - lists.torproject.org

[torsocks/pending-changes] Update ChangeLog for formatting and issue 33
by ioerror＠torproject.org 07 Nov '12

07 Nov '12

commit e39ac68c3e321e2d4c818ff0ccca5d06ed31c87d Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Tue Nov 6 20:16:49 2012 -0800 Update ChangeLog for formatting and issue 33 --- ChangeLog | 12 +++++++++++- 1 files changed, 11 insertions(+), 1 deletions(-) diff --git a/ChangeLog b/ChangeLog index 1a52d25..79150c5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -2,14 +2,24 @@ Torsocks 1.3 XXX XXX o Issue 47: Invocation without argument is broken - + Added '--shell' as the documented way to spawn a shell with torsocks This removes the never working documented case where torsocks without arguments was supposed to spawn a shell. + o Issue 48: Typos in manpage + Updated man page to fix typos. + o Issue 37: Torsocks lets through tcp6 connections to tcp4 hosts + Explicitly fail closed on connect() calls of AF_INET6 type + Set errno to EAFNOSUPPORT in the IPv6 case. + + o Issue 33: LIBDIR hardcoded to /usr/lib, s/b/ /usr/lib64 on x86_64 + + We now look for torsocks in /usr/lib and then /usr/lib64 + We assume that the first found is the correct one. Torsocks 1.2 2011-10-28 Robert Hogan <robert(a)roberthogan.net>

1 0

[flashproxy/master] ChangeLog for #7271.
by dcf＠torproject.org 07 Nov '12

07 Nov '12

commit a6cf556eb0c5216c467c4e81bcb66437e3f76dc6 Author: David Fifield <david(a)bamsoftware.com> Date: Tue Nov 6 19:45:43 2012 -0800 ChangeLog for #7271. --- ChangeLog | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/ChangeLog b/ChangeLog index 4f2de05..e1ee6a1 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,3 +7,8 @@ Changes in version 0.8 o Fixed a runtime error in flashproxy-client on Windows: AttributeError: 'module' object has no attribute 'IPPROTO_IPV6' Fixes bug 7147. Patch by Alexandre Allaire. + + o Fixed an exception that happened in Windows in flashproxy-reg-email + in reading the trusted CA list. The exception message was: + Failed to register: [Errno 185090050] _ssl.c:340: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib + Fixes bug 7271. Patch by Alexandre Allaire.

1 0

[flashproxy/master] Use mkstemp instead of NamedTemporaryFile to create temporary file in flashproxy-reg-email.
by dcf＠torproject.org 07 Nov '12

07 Nov '12

commit b3989fda65cb7f32f04369df656600e2655243b9 Author: Alexandre Allaire <alexandre.allaire(a)mail.mcgill.ca> Date: Mon Nov 5 14:39:29 2012 -0500 Use mkstemp instead of NamedTemporaryFile to create temporary file in flashproxy-reg-email. A NamedTemporaryFile is not reopenable by file name on Windows. --- flashproxy-reg-email | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) diff --git a/flashproxy-reg-email b/flashproxy-reg-email index d9a6546..7c5fd3f 100755 --- a/flashproxy-reg-email +++ b/flashproxy-reg-email @@ -212,10 +212,10 @@ if options.debug: smtp.set_debuglevel(1) try: - ca_certs_file = tempfile.NamedTemporaryFile(prefix="flashproxy-reg-email-", suffix=".crt", delete=True) + ca_certs_fd, ca_certs_path = tempfile.mkstemp(prefix="flashproxy-reg-email-", suffix=".crt") try: - ca_certs_file.write(CA_CERTS) - ca_certs_file.flush() + os.write(ca_certs_fd, CA_CERTS) + os.close(ca_certs_fd) # We roll our own initial EHLO/STARTTLS because smtplib.SMTP.starttls # doesn't allow enough certificate validation. code, msg = smtp.docmd("EHLO", EHLO_FQDN) @@ -225,10 +225,10 @@ try: if code != 220: raise ValueError("Got code %d after STARTTLS" % code) smtp.sock = ssl.wrap_socket(smtp.sock, ssl_version=ssl.PROTOCOL_TLSv1, - cert_reqs=ssl.CERT_REQUIRED, ca_certs=ca_certs_file.name) + cert_reqs=ssl.CERT_REQUIRED, ca_certs=ca_certs_path) smtp.file = smtp.sock.makefile() finally: - ca_certs_file.close() + os.unlink(ca_certs_path) # Check that the public key is what we expect. cert_der = smtp.sock.getpeercert(binary_form=True)

1 0

[torspec/master] Add proposal 214 for 4-byte circuit IDs
by nickm＠torproject.org 07 Nov '12

07 Nov '12

commit 4fa4febaed361f453bb430c57b5784863f1e0b3d Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Nov 6 21:35:54 2012 -0500 Add proposal 214 for 4-byte circuit IDs --- proposals/000-index.txt | 2 + proposals/214-longer-circids.txt | 93 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 95 insertions(+), 0 deletions(-) diff --git a/proposals/000-index.txt b/proposals/000-index.txt index a23c412..332b64d 100644 --- a/proposals/000-index.txt +++ b/proposals/000-index.txt @@ -134,6 +134,7 @@ Proposals by number: 211 Internal Mapaddress for Tor Configuration Testing [OPEN] 212 Increase Acceptable Consensus Age [OPEN] 213 Remove stream-level sendmes from the design [OPEN] +214 Allow 4-byte circuit IDs in a new link protocol [OPEN] Proposals by status: @@ -184,6 +185,7 @@ Proposals by status: 211 Internal Mapaddress for Tor Configuration Testing [for 0.2.4.x+] 212 Increase Acceptable Consensus Age [for 0.2.4.x+] 213 Remove stream-level sendmes from the design + 214 Allow 4-byte circuit IDs in a new link protocol ACCEPTED: 117 IPv6 exits [for 0.2.4.x] 140 Provide diffs between consensuses diff --git a/proposals/214-longer-circids.txt b/proposals/214-longer-circids.txt new file mode 100644 index 0000000..9b42424 --- /dev/null +++ b/proposals/214-longer-circids.txt @@ -0,0 +1,93 @@ +Filename: 214-longer-circids.txt +Title: Allow 4-byte circuit IDs in a new link protocol +Author: Nick Mathewson +Created: 6 Nov 2012 +Status: Open + + +0. Overview + + Relays are running out of circuit IDs. It's time to make the field + bigger. + +1. Background and Motivation + + Long ago, we thought that 65535 circuit IDs would be enough for anybody. + It wasn't. But our cell format in link protocols is still: + + Cell [512 bytes] + CircuitID [2 bytes] + Command [1 byte] + Payload [509 bytes] + + Variable-length cell [Length+5 bytes] + CircID [4 bytes] + Command [1 byte] + Length [2 bytes] + Payload [Length bytes] + + This means that a relay can run out of circuit IDs pretty easily. + +2. Design + + I propose a new link cell format for relays that support it. It should + be: + + Cell [514 bytes] + CircuitID [4 bytes] + Command [1 byte] + Payload [509 bytes] + + Variable cell (Length+7 bytes) + CircID [4 bytes] + Command [1 byte] + Length [2 bytes] + Payload [Length bytes] + + We need to keep the payload size in fixed-length cells to its current + value, since otherwise the relay protocol won't work. + + This new cell format should be used only when the link protocol is 4. + (To negotiation link protocol 4, both sides need to use the "v3" + handshake, and include "4" in their version cells. If version 4 or + later is negotiated, this is the cell format to use.) + +2.1. Better allocation of circuitID space + + In the current Tor design, circuit ID allocation is determined by + whose RSA public key has the lower modulus. How ridiculous! + Instead, I propose that when the version 4 link protocol is in use, + the connection initiator use the low half of the circuit ID space, + and the responder use the low half of the circuit ID space. + +3. Discussion + + * Why 4 bytes? + + Because 3 would result in an odd cell size, and 8 seems like + overkill. + + * Will this be distinguishable from the v3 protocol? + + Yes. Anybody who knows they're seeing the Tor protocol can probably + tell by the TLS record sizes which version of the protocol is in + use. Probably not a huge deal though; which approximate range of + versions of Tor a client or server is running is not something + we've done much to hide in the past. + + * Why a new link protocol and not a new cell type? + + Because pretty much every cell has a meaningful circuit ID. + + * Okay, why a new link protocol and not a new _set of_ cell types? + + Because it's a bad idea to mix short and long circIDs on the same + channel. (That would leak which cells go with what kind of + circuits ID, potentially.) + + * How hard is this to implement? + + I wasn't sure, so I coded it up. I've got a probably-buggy + implementation in branch "wide_cird_ids" in my public repository. + Be afraid! More testing is needed! +

1 0

[torsocks/pending-changes] First stab at ensuring IPv6 connections are dropped on the floor.
by ioerror＠torproject.org 07 Nov '12

07 Nov '12

commit 95528585c1d13b0e17e9d35387c45adec9774457 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Sun Nov 4 22:58:40 2012 +0000 First stab at ensuring IPv6 connections are dropped on the floor. This almost certainly does not solve all cases and this is a work in progress. --- src/torsocks.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/src/torsocks.c b/src/torsocks.c index f559eec..1c772be 100644 --- a/src/torsocks.c +++ b/src/torsocks.c @@ -296,6 +296,12 @@ int torsocks_connect_guts(CONNECT_SIGNATURE, int (*original_connect)(CONNECT_SIG return -1; } + /* If this is an INET6, we'll refuse it. */ + if ((connaddr->sin_family == AF_INET6)) { + show_msg(MSGERR, "connect: Connection is IPv6: rejecting.\n"); + return -1; + } + /* If this isn't an INET socket we can't */ /* handle it, just call the real connect now */ if ((connaddr->sin_family != AF_INET)) {

1 0

[torsocks/pending-changes] set errno for connect failures related to AF_INET6
by ioerror＠torproject.org 07 Nov '12

07 Nov '12

commit becf4bc03ea6dcb95d22106ebfe08b4d29b3610a Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Tue Nov 6 17:56:32 2012 -0800 set errno for connect failures related to AF_INET6 --- src/torsocks.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/src/torsocks.c b/src/torsocks.c index 1c772be..74ead72 100644 --- a/src/torsocks.c +++ b/src/torsocks.c @@ -299,6 +299,7 @@ int torsocks_connect_guts(CONNECT_SIGNATURE, int (*original_connect)(CONNECT_SIG /* If this is an INET6, we'll refuse it. */ if ((connaddr->sin_family == AF_INET6)) { show_msg(MSGERR, "connect: Connection is IPv6: rejecting.\n"); + errno = EAFNOSUPPORT; return -1; }

1 0

[torsocks/pending-changes] Add ChangeLog entry for issue 37
by ioerror＠torproject.org 07 Nov '12

07 Nov '12

commit e8b9696fbc401c0aa0ab39fc64e424ea64e4c373 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Tue Nov 6 18:07:52 2012 -0800 Add ChangeLog entry for issue 37 --- ChangeLog | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/ChangeLog b/ChangeLog index cfbc893..1a52d25 100644 --- a/ChangeLog +++ b/ChangeLog @@ -8,6 +8,8 @@ XXX XXX arguments was supposed to spawn a shell. o Issue 48: Typos in manpage Updated man page to fix typos. + o Issue 37: Torsocks lets through tcp6 connections to tcp4 hosts + Explicitly fail closed on connect() calls of AF_INET6 type Torsocks 1.2 2011-10-28 Robert Hogan <robert(a)roberthogan.net>

1 0

[torsocks/pending-changes] Merge branch 'ipv6' into pending-changes
by ioerror＠torproject.org 07 Nov '12

07 Nov '12

commit 2e60e8a561cdaf793c08413665ac12df5f316557 Merge: c0c8658 becf4bc Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Tue Nov 6 18:06:51 2012 -0800 Merge branch 'ipv6' into pending-changes src/torsocks.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-)

1 0

[torsocks/pending-changes] Fix typos in manpage
by ioerror＠torproject.org 07 Nov '12

07 Nov '12

commit 52330df60bbacffbb64b14447a96b94659da3050 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Mon Nov 5 15:38:29 2012 -0500 Fix typos in manpage Addresses issue 48 - opened by intrigeri Author: A. Costa <agcosta(a)gis.net> Bug-Debian: http://bugs.debian.org/683358 --- doc/torsocks.8.in | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/torsocks.8.in b/doc/torsocks.8.in index 0cda513..58672e5 100644 --- a/doc/torsocks.8.in +++ b/doc/torsocks.8.in @@ -43,9 +43,9 @@ with the SOCKS server and passes the connection back to the calling program. .BR torsocks -is designed for use in machines which are firewalled from then -internet. It avoids the need to recompile applications like lynx or -telnet so they can use SOCKS to reach the internet. It behaves much like +is designed for use in machines which are firewalled from the +Internet. It avoids the need to recompile applications like lynx or +telnet so they can use SOCKS to reach the Internet. It behaves much like the SOCKSified TCP/IP stacks seen on other platforms. .SS ARGUMENTS

1 0

[torsocks/pending-changes] Merge branch 'documentation' into pending-changes
by ioerror＠torproject.org 07 Nov '12

07 Nov '12

commit 7336d5f60d59ab5699452231ac160ca142f2894f Merge: 24f6411 52330df Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Tue Nov 6 18:03:05 2012 -0800 Merge branch 'documentation' into pending-changes doc/torsocks.8.in | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-)

1 0