August 2012 - tor-commits - lists.torproject.org

r25773: {website} remove the expired keys per #6706. (website/trunk/docs/en)
by Andrew Lewman 28 Aug '12

28 Aug '12

Author: phobos Date: 2012-08-28 00:15:36 +0000 (Tue, 28 Aug 2012) New Revision: 25773 Modified: website/trunk/docs/en/signing-keys.wml Log: remove the expired keys per #6706. Modified: website/trunk/docs/en/signing-keys.wml =================================================================== --- website/trunk/docs/en/signing-keys.wml 2012-08-27 20:52:57 UTC (rev 25772) +++ website/trunk/docs/en/signing-keys.wml 2012-08-28 00:15:36 UTC (rev 25773) @@ -23,14 +23,10 @@ Windows and OS X.</li> <li>Tor Project Archive (0x886DDD89) signs the deb.torproject.org repositories and archives.</li> - <li>Nathan Freitas (0xB374CBD2) signs the Android APK file for - Orbot.</li> <li>Tomás Touceda (0x9A753A6B) signs current Vidalia tarballs. Matt Edman (0x5FA14861) signed older Vidalia tarballs.</li> <li>Damian Johnson (0x9ABBEEC6) signs Arm releases.</li> <li>Mike Perry (0xDDC6C0AD) signs the Torbutton xpi.</li> - <li>Karsten Loesing (0xF7C11265) signs the metrics archives and - tools.</li> <li>Robert Hogan (0x22F6856F) signs torsocks release tarballs.</li> <li>Sebastian Hahn (0xC5AA446D) signs Obfsproxy Tor Browser Bundles, and sometimes signs the Tor Browser Bundles.</li> @@ -94,12 +90,6 @@ uid deb.torproject.org archive signing key sub 2048R/219EC810 2009-09-04 [expires: 2012-09-03] - pub 3072D/B374CBD2 2010-06-09 [expires: 2012-06-09] - Key fingerprint = B92B CA64 72F7 C6F0 8D47 8503 D2AC D203 B374 CBD2 - uid Nathan of Guardian <nathan(a)guardianproject.info> - uid [jpeg image of size 6978] - sub 4096g/B5878C3B 2010-06-09 [expires: 2012-06-09] - pub 1024D/9A753A6B 2009-09-11 Key fingerprint = 553D 7C2C 626E F16F 27F3 30BC 95E3 881D 9A75 3A6B uid Tomás Touceda <chiiph(a)gmail.com> @@ -125,11 +115,6 @@ uid Mike Perry <mikepery(a)fscked.org> sub 4096g/AF0A91D7 2006-07-26 - pub 1024D/F7C11265 2007-03-09 [expires: 2012-03-01] - Key fingerprint = FC8A EEF1 792E EE71 D721 7D47 D0CF 963D F7C1 1265 - uid Karsten Loesing <karsten.loesing(a)gmx.net> - sub 2048g/75D85E4B 2007-03-09 [expires: 2012-03-01] - pub 1024D/22F6856F 2006-08-19 Key fingerprint = DDB4 6B5B 7950 CD47 E59B 5189 4C09 25CF 22F6 856F uid Robert Hogan <robert(a)roberthogan.net> @@ -147,11 +132,6 @@ uid Peter Palfrader <peter(a)palfrader.org> uid Peter Palfrader <weasel(a)debian.org> - pub 4096R/42DDE84F 2011-04-19 [expires: 2012-04-18] - uid Jacob Appelbaum <jacob(a)torproject.org> - uid Jacob Appelbaum <jacob(a)appelbaum.net> - sub 4096R/437C9647 2011-04-19 [expires: 2012-04-18] - pub 4096R/BE2CD9C1 2010-10-07 [expires: 2012-10-06] Key fingerprint = 0D24 B36A A9A2 A651 7878 7645 1202 821C BE2C D9C1 uid Tails developers (signing key) <tails(a)boum.org>

1 0

[tor-cloud/master] new config for blocking diagnostics
by runa＠torproject.org 27 Aug '12

27 Aug '12

commit 05a2bebdb2597b94e8390f40ef883bd97e770559 Author: Runa A. Sandvik <runa.sandvik(a)gmail.com> Date: Tue Aug 28 00:44:05 2012 +0100 new config for blocking diagnostics --- ec2-prep.sh | 33 +++++++++++++++++++++++++++++++-- 1 files changed, 31 insertions(+), 2 deletions(-) diff --git a/ec2-prep.sh b/ec2-prep.sh index 331017c..3f5b615 100644 --- a/ec2-prep.sh +++ b/ec2-prep.sh @@ -230,10 +230,11 @@ aptitude -y install tor tor-geoipdb tor-arm echo "Configuring Tor..."; cp /etc/tor/torrc /etc/tor/torrc.bkp +# Normal bridge if [ $CONFIG == "bridge" ]; then echo "Configuring Tor as a $CONFIG"; cat << EOF > $CONFIG_FILE -# Auto generated public Tor $CONFIG config file +# Auto generated Tor $CONFIG config file # A unique handle for your server. Nickname ec2$CONFIG$RESERVATION @@ -267,10 +268,11 @@ echo "Your system has been configured as a Tor bridge, see https://cloud.torproj reboot fi +# Private bridge if [ $CONFIG == "privatebridge" ]; then echo "Configuring Tor as a $CONFIG"; cat << EOF > $CONFIG_FILE -# Auto generated public Tor $CONFIG config file +# Auto generated Tor $CONFIG config file # A unique handle for your server. Nickname ec2priv$RESERVATION @@ -305,6 +307,33 @@ echo "Your system has been configured as a private Tor bridge, see https://cloud reboot fi +# Blocking diagnostics (private bridge and then some) +if [ $CONFIG == "blockingdiagnostics" ]; then +echo "Configuring a Tor blocking diagnostics image"; + +# Configure Tor to run as a private bridge +cat << EOF > $CONFIG_FILE +SocksPort 0 +ORPort 443 +ORListenAddress 0.0.0.0:9001 +BridgeRelay 1 +PublishServerDescriptor 0 +Log info file /var/log/tor/info.log +AccountingStart week 1 10:00 +AccountingMax 10 GB +ExitPolicy reject *:* +EOF + +# Run tcpdump on boot +cat << EOF > /etc/rc.local +#!/bin/sh -e +sudo screen tcpdump -v -i any -s 0 -w /root/bridge_test.cap +EOF +echo "Done configuring the system, will reboot" +echo "Your system has been configured for blocking diagnostics" > /etc/ec2-prep.sh +reboot +fi + # XXX TODO # Generally, we'll want to rm /var/lib/tor/* and remove all state from the system #

1 0

r25772: {website} Patch by Ondrej (website/trunk/docs/en)
by Peter Palfrader 27 Aug '12

27 Aug '12

Author: weasel Date: 2012-08-27 20:52:57 +0000 (Mon, 27 Aug 2012) New Revision: 25772 Modified: website/trunk/docs/en/rpms.wml Log: Patch by Ondrej Modified: website/trunk/docs/en/rpms.wml =================================================================== --- website/trunk/docs/en/rpms.wml 2012-08-24 17:04:46 UTC (rev 25771) +++ website/trunk/docs/en/rpms.wml 2012-08-27 20:52:57 UTC (rev 25772) @@ -46,6 +46,12 @@ + The keys's fingerprint should be (for RPM-GPG-KEY-torproject.org.asc above, + yum will ask about the fingerprint): + +<pre>3B9E EEB9 7B1E 827B CF0A 0D96 8AF5 653C 5AC0 01F1</pre> + + Then install Tor by running: <pre>yum install tor</pre>

1 0

[tor/master] Quiet "Set buildtimeout to low val" warnings: make them info
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit a7a4bbff47c92aa4df0a932492867d1601834118 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:37:09 2012 -0400 Quiet "Set buildtimeout to low val" warnings: make them info Fix for #6251 --- changes/bug6251 | 6 ++++++ src/or/circuitbuild.c | 2 +- 2 files changed, 7 insertions(+), 1 deletions(-) diff --git a/changes/bug6251 b/changes/bug6251 new file mode 100644 index 0000000..c782a93 --- /dev/null +++ b/changes/bug6251 @@ -0,0 +1,6 @@ + o Minor bugfixes: + - Downgrade "set buildtimeout to low value" messages to INFO + severity; they were never an actual problem, there was never + anything reasonable to do about them, and they tended to spam + logs from time to time. Fix for bug 6251; bugfix on + 0.2.2.2-alpha. \ No newline at end of file diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index fcd13dc..e557601 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1627,7 +1627,7 @@ circuit_build_times_set_timeout(circuit_build_times_t *cbt) return; if (cbt->timeout_ms < circuit_build_times_min_timeout()) { - log_warn(LD_CIRC, "Set buildtimeout to low value %fms. Setting to %dms", + log_info(LD_CIRC, "Set buildtimeout to low value %fms. Setting to %dms", cbt->timeout_ms, circuit_build_times_min_timeout()); cbt->timeout_ms = circuit_build_times_min_timeout(); if (cbt->close_ms < cbt->timeout_ms) {

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3'
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 3363a0d26e553378084415b1bcc67c36929d9c07 Merge: f403781 a7a4bbf Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:39:30 2012 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' changes/bug6251 | 6 ++++++ src/or/circuitbuild.c | 2 +- 2 files changed, 7 insertions(+), 1 deletions(-)

1 0

[tor/maint-0.2.3] Quiet "Set buildtimeout to low val" warnings: make them info
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit a7a4bbff47c92aa4df0a932492867d1601834118 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 27 16:37:09 2012 -0400 Quiet "Set buildtimeout to low val" warnings: make them info Fix for #6251 --- changes/bug6251 | 6 ++++++ src/or/circuitbuild.c | 2 +- 2 files changed, 7 insertions(+), 1 deletions(-) diff --git a/changes/bug6251 b/changes/bug6251 new file mode 100644 index 0000000..c782a93 --- /dev/null +++ b/changes/bug6251 @@ -0,0 +1,6 @@ + o Minor bugfixes: + - Downgrade "set buildtimeout to low value" messages to INFO + severity; they were never an actual problem, there was never + anything reasonable to do about them, and they tended to spam + logs from time to time. Fix for bug 6251; bugfix on + 0.2.2.2-alpha. \ No newline at end of file diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index fcd13dc..e557601 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -1627,7 +1627,7 @@ circuit_build_times_set_timeout(circuit_build_times_t *cbt) return; if (cbt->timeout_ms < circuit_build_times_min_timeout()) { - log_warn(LD_CIRC, "Set buildtimeout to low value %fms. Setting to %dms", + log_info(LD_CIRC, "Set buildtimeout to low value %fms. Setting to %dms", cbt->timeout_ms, circuit_build_times_min_timeout()); cbt->timeout_ms = circuit_build_times_min_timeout(); if (cbt->close_ms < cbt->timeout_ms) {

1 0

[tor/master] Disable path bias accounting if we have no guards.
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 880c71304b6592fccd812315d8c27d234b694221 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Mon Aug 20 19:03:00 2012 -0700 Disable path bias accounting if we have no guards. This should eliminate a lot of notices for Directory Authorities and other situations where circuits built without using guard nodes. --- src/or/circuitbuild.c | 21 ++++++++++++++++++++- 1 files changed, 20 insertions(+), 1 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 39a223b..35a32d8 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2638,6 +2638,14 @@ pathbias_count_first_hop(origin_circuit_t *circ) RATELIM_INIT(FIRST_HOP_NOTICE_INTERVAL); char *rate_msg = NULL; + /* We can't do path bias accounting without entry guards. + * Testing and controller circuits also have no guards. */ + if (get_options()->UseEntryGuards == 0 || + circ->_base.purpose == CIRCUIT_PURPOSE_TESTING || + circ->_base.purpose == CIRCUIT_PURPOSE_CONTROLLER) { + return 0; + } + /* Completely ignore one hop circuits */ if (circ->build_state->onehop_tunnel) { tor_assert(circ->build_state->desired_path_len == 1); @@ -2732,6 +2740,14 @@ pathbias_count_success(origin_circuit_t *circ) RATELIM_INIT(SUCCESS_NOTICE_INTERVAL); char *rate_msg = NULL; + /* We can't do path bias accounting without entry guards. + * Testing and controller circuits also have no guards. */ + if (get_options()->UseEntryGuards == 0 || + circ->_base.purpose == CIRCUIT_PURPOSE_TESTING || + circ->_base.purpose == CIRCUIT_PURPOSE_CONTROLLER) { + return; + } + /* Ignore one hop circuits */ if (circ->build_state->onehop_tunnel) { tor_assert(circ->build_state->desired_path_len == 1); @@ -2770,7 +2786,10 @@ pathbias_count_success(origin_circuit_t *circ) guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); } - } else { + /* In rare cases, CIRCUIT_PURPOSE_TESTING can get converted to + * CIRCUIT_PURPOSE_C_MEASURE_TIMEOUT and have no guards here. + * No need to log that case. */ + } else if (circ->_base.purpose != CIRCUIT_PURPOSE_C_MEASURE_TIMEOUT) { if ((rate_msg = rate_limit_log(&success_notice_limit, approx_time()))) { log_notice(LD_BUG,

1 0

[tor/master] Bug 6647: Use correct scale constant and prevent rounding error
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit e13abda470c347f95cb2bc9fc499bf93d1f85a68 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Thu Aug 23 20:27:41 2012 -0700 Bug 6647: Use correct scale constant and prevent rounding error We were effectively resetting our counts, and the rounding error leads to incorrect log messages. --- src/or/circuitbuild.c | 23 ++++++++++++++--------- 1 files changed, 14 insertions(+), 9 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 8ad6d17..fc4d4ae 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2601,12 +2601,12 @@ pathbias_get_scale_threshold(const or_options_t *options) static int pathbias_get_scale_factor(const or_options_t *options) { -#define DFLT_PATH_BIAS_SCALE_FACTOR 4 +#define DFLT_PATH_BIAS_SCALE_FACTOR 2 if (options->PathBiasScaleFactor >= 1) return options->PathBiasScaleFactor; else return networkstatus_get_param(NULL, "pb_scalefactor", - DFLT_PATH_BIAS_SCALE_THRESHOLD, 1, INT32_MAX); + DFLT_PATH_BIAS_SCALE_FACTOR, 1, INT32_MAX); } static const char * @@ -2859,13 +2859,18 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) /* If we get a ton of circuits, just scale everything down */ if (guard->first_hops > (unsigned)pathbias_get_scale_threshold(options)) { const int scale_factor = pathbias_get_scale_factor(options); - log_info(LD_PROTOCOL, - "Scaling pathbias counts to (%u/%u)/%d for guard %s=%s", - guard->circuit_successes, guard->first_hops, - scale_factor, guard->nickname, hex_str(guard->identity, - DIGEST_LEN)); - guard->first_hops /= scale_factor; - guard->circuit_successes /= scale_factor; + /* For now, only scale if there will be no rounding error... + * XXX024: We want to switch to a real moving average for 0.2.4. */ + if ((guard->first_hops % scale_factor) == 0 && + (guard->circuit_successes % scale_factor) == 0) { + log_info(LD_PROTOCOL, + "Scaling pathbias counts to (%u/%u)/%d for guard %s=%s", + guard->circuit_successes, guard->first_hops, + scale_factor, guard->nickname, hex_str(guard->identity, + DIGEST_LEN)); + guard->first_hops /= scale_factor; + guard->circuit_successes /= scale_factor; + } } guard->first_hops++; log_info(LD_PROTOCOL, "Got success count %u/%u for guard %s=%s",

1 0

[tor/master] Bug 6475: Demote pathbias log messages for 0.2.3.x
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 4950618b135073f23f250520b01a80dd36e5a43f Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Aug 21 18:37:08 2012 -0700 Bug 6475: Demote pathbias log messages for 0.2.3.x Also make a couple of them less scary. We'll do a separate, additional commit on 0.2.4.x to bump them back up again. --- src/or/circuitbuild.c | 25 ++++++++++++++++--------- 1 files changed, 16 insertions(+), 9 deletions(-) diff --git a/src/or/circuitbuild.c b/src/or/circuitbuild.c index 35a32d8..8ad6d17 100644 --- a/src/or/circuitbuild.c +++ b/src/or/circuitbuild.c @@ -2657,7 +2657,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) if (circ->has_opened && circ->path_state != PATH_STATE_DID_FIRST_HOP) { if ((rate_msg = rate_limit_log(&first_hop_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Opened circuit is in strange path state %s. " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2684,7 +2684,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) } else { if ((rate_msg = rate_limit_log(&first_hop_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Unopened circuit has strange path state %s. " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2696,7 +2696,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) } else { if ((rate_msg = rate_limit_log(&first_hop_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Unopened circuit has no known guard. " "Circuit is a %s currently %s. %s", circuit_purpose_to_string(circ->_base.purpose), @@ -2710,7 +2710,7 @@ pathbias_count_first_hop(origin_circuit_t *circ) if (circ->path_state == PATH_STATE_NEW_CIRC) { if ((rate_msg = rate_limit_log(&first_hop_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "A %s circuit is in cpath state %d (opened: %d). " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2770,7 +2770,7 @@ pathbias_count_success(origin_circuit_t *circ) } else { if ((rate_msg = rate_limit_log(&success_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Succeeded circuit is in strange path state %s. " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2781,7 +2781,7 @@ pathbias_count_success(origin_circuit_t *circ) } if (guard->first_hops < guard->circuit_successes) { - log_warn(LD_BUG, "Unexpectedly high circuit_successes (%u/%u) " + log_notice(LD_BUG, "Unexpectedly high circuit_successes (%u/%u) " "for guard %s=%s", guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); @@ -2792,7 +2792,7 @@ pathbias_count_success(origin_circuit_t *circ) } else if (circ->_base.purpose != CIRCUIT_PURPOSE_C_MEASURE_TIMEOUT) { if ((rate_msg = rate_limit_log(&success_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Completed circuit has no known guard. " "Circuit is a %s currently %s. %s", circuit_purpose_to_string(circ->_base.purpose), @@ -2804,7 +2804,7 @@ pathbias_count_success(origin_circuit_t *circ) if (circ->path_state != PATH_STATE_SUCCEEDED) { if ((rate_msg = rate_limit_log(&success_notice_limit, approx_time()))) { - log_notice(LD_BUG, + log_info(LD_BUG, "Opened circuit is in strange path state %s. " "Circuit is a %s currently %s. %s", pathbias_state_to_string(circ->path_state), @@ -2834,9 +2834,11 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) if (guard->circuit_successes/((double)guard->first_hops) < pathbias_get_disable_rate(options)) { + /* This message is currently disabled by default. */ log_warn(LD_PROTOCOL, "Extremely low circuit success rate %u/%u for guard %s=%s. " - "This might indicate an attack, or a bug.", + "This indicates either an overloaded guard, an attack, or " + "a bug.", guard->circuit_successes, guard->first_hops, guard->nickname, hex_str(guard->identity, DIGEST_LEN)); @@ -2857,6 +2859,11 @@ entry_guard_inc_first_hop_count(entry_guard_t *guard) /* If we get a ton of circuits, just scale everything down */ if (guard->first_hops > (unsigned)pathbias_get_scale_threshold(options)) { const int scale_factor = pathbias_get_scale_factor(options); + log_info(LD_PROTOCOL, + "Scaling pathbias counts to (%u/%u)/%d for guard %s=%s", + guard->circuit_successes, guard->first_hops, + scale_factor, guard->nickname, hex_str(guard->identity, + DIGEST_LEN)); guard->first_hops /= scale_factor; guard->circuit_successes /= scale_factor; }

1 0

[tor/master] Bug 6647: Add changes file
by nickm＠torproject.org 27 Aug '12

27 Aug '12

commit 0c13547ea9204975a04ba53daff25020594fbd47 Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Mon Aug 27 11:15:35 2012 -0700 Bug 6647: Add changes file --- changes/bug6647 | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/changes/bug6647 b/changes/bug6647 new file mode 100644 index 0000000..ef29ae3 --- /dev/null +++ b/changes/bug6647 @@ -0,0 +1,7 @@ + o Minor bugfixes: + - Prevent rounding error in path bias counts when scaling + them down, and use the correct scale factor default. + Bugfix against 0.2.3.17-beta. + - Demote some path bias related log messages down a level + and make others less scary sounding. + Bugfix against 0.2.3.17-beta.

1 0