August 2012 - tor-commits - lists.torproject.org

[translation/vidalia_help] Update translations for vidalia_help
by translation＠torproject.org 22 Aug '12

22 Aug '12

commit 9f3c0c4298a6db3815f36c252efb434a4a32a1fb Author: Translation commit bot <translation(a)torproject.org> Date: Wed Aug 22 12:45:19 2012 +0000 Update translations for vidalia_help --- pl/troubleshooting.po | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pl/troubleshooting.po b/pl/troubleshooting.po index 81051d0..23f3661 100644 --- a/pl/troubleshooting.po +++ b/pl/troubleshooting.po @@ -6,7 +6,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2010-08-03 15:49-0300\n" -"PO-Revision-Date: 2012-08-22 11:58+0000\n" +"PO-Revision-Date: 2012-08-22 12:19+0000\n" "Last-Translator: JerBen <ayurveda63(a)gmail.com>\n" "Language-Team: LANGUAGE <LL(a)li.org>\n" "MIME-Version: 1.0\n" @@ -27,7 +27,7 @@ msgid "" "running Tor. If you can't find anything about the particular problem you're " "having, check out our website at <i>www.vidalia-project.net</i> for more " "support and information. <a name=\"start\"/>" -msgstr "" +msgstr "Poniżej znajdują się często występujące problemy lub pytania jakie występują podczas używania Tora. Jeżeli nie możesz znaleźć odpowiedzi na poszczególne problemy, sprawdź naszą stronę: <i>www.vidalia-project.net</i> for more support and information. <a name=\"start\"/>" # type: Content of: <html><body><h3> #: en/troubleshooting.html:25

1 0

[translation/vidalia_help] Update translations for vidalia_help
by translation＠torproject.org 22 Aug '12

22 Aug '12

commit 4956a11a08fc189030a7e8dfd8b36349eab17288 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Aug 22 12:15:19 2012 +0000 Update translations for vidalia_help --- pl/troubleshooting.po | 9 ++++----- 1 files changed, 4 insertions(+), 5 deletions(-) diff --git a/pl/troubleshooting.po b/pl/troubleshooting.po index 95fb07c..81051d0 100644 --- a/pl/troubleshooting.po +++ b/pl/troubleshooting.po @@ -1,12 +1,13 @@ # # Translators: +# <ayurveda63(a)gmail.com>, 2012. msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2010-08-03 15:49-0300\n" -"PO-Revision-Date: 2010-11-30 05:04+0000\n" -"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" +"PO-Revision-Date: 2012-08-22 11:58+0000\n" +"Last-Translator: JerBen <ayurveda63(a)gmail.com>\n" "Language-Team: LANGUAGE <LL(a)li.org>\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -17,7 +18,7 @@ msgstr "" # type: Content of: <html><body><h1> #: en/troubleshooting.html:16 msgid "Troubleshooting" -msgstr "" +msgstr "Rozwiązywanie problemów" # type: Content of: <html><body> #: en/troubleshooting.html:19 @@ -241,5 +242,3 @@ msgid "" "href=\"log.html\">message log</a> to see if Tor reported any errors while " "trying to exit." msgstr "" - -

1 0

[translation/orbot] Update translations for orbot
by translation＠torproject.org 22 Aug '12

22 Aug '12

commit 701480b137a7274ca90d104d9c823a83641159b7 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Aug 22 11:45:06 2012 +0000 Update translations for orbot --- values-pl_PL/strings.xml | 20 ++++++++++++++++++-- 1 files changed, 18 insertions(+), 2 deletions(-) diff --git a/values-pl_PL/strings.xml b/values-pl_PL/strings.xml index 92c864a..3355fd6 100644 --- a/values-pl_PL/strings.xml +++ b/values-pl_PL/strings.xml @@ -36,7 +36,7 @@ <string name="pref_transparent_all_summary">Ruch proxy dla wszystkich aplikacji przez Tor\'a</string> <string name="pref_transparent_port_title">Lista portów</string> <string name="pref_transparent_port_dialog">Wprowadź porty dla proxy</string> - <string name="pref_has_root">Wymaga dostępu ROOT\'a</string> + <string name="pref_has_root">Wymaga dostępu Root\'a</string> <string name="status_install_success">Pliki binarne Tora zainstalowane poprawnie!</string> <string name="status_install_fail">Pliki binarne Tora nie mogły być zainstalowane. Sprawdź Log i skontaktuj się z nami mailowo: tor-assistants(a)torproject.org</string> <string name="title_error">Błąd aplikacji</string> @@ -49,13 +49,29 @@ <string name="btn_cancel">Anuluj</string>  <string name="wizard_details">Szczegóły</string> - <string name="wizard_details_msg">Orbot jest aplikacją open-source zawierającą Tor\'a, LibEvent oraz Privoxy. Ortbot zapewnia </string> + <string name="wizard_details_msg">Orbot jest aplikacją open-source zawierającą Tor\'a, LibEvent oraz Privoxy. Ortbot zapewnia local HTTP proxy (8118) oraz SOCKS proxy (9050) w sieci Tor. Na urządzeniach z ROOT\'em możliwe jest przekierowanie całego ruchu przez TOR\'a.</string> + <string name="wizard_permissions_root">Pozwolenie Udzielone</string> + <string name="wizard_permissions_stock">Pozwolenia Orbot\'a</string> + <string name="wizard_premissions_msg_root">Doskonale! Wykryliśmy, że posiadasz pozwolenia Root\'a dla Orbot\'a.\nBędziemy używać tych możliwości mądrze.</string> + <string name="wizard_permissions_msg_stock">Choć nie jest to wymagane, Orbot staje się potężniejszym narzędziem, jeżeli twoje urządzenie posiada pozwolenia Root\'a. Użyj poniższego przycisku by dać Orbot\'owi dodatkowe możliwości.</string> + <string name="wizard_permissions_no_root">Jeżeli nie masz pozwoleń Root\'a lub nie wiesz o czym tak naprawdę jest mowa, pamiętaj tylko by używać aplikacji, które są przystosowane do pracy z Orbot\'em</string> + <string name="wizard_permissions_consent">Rozumiem, chcę kontynuować bez pozwoleń \"Super użytkownika\"</string> + <string name="wizard_permission_enable_root">Udostępnij pozwolenia Root\'a dla Orbot\'a</string> + <string name="wizard_configure_msg">Orbot daje ci możliwość przekierowywania całęgo ruchu przez Tor\'a lub przekierowywania tylko wybranych aplikacji.</string> + <string name="wizard_configure_all">Przekieruj cały ruch przez Tor\'a</string> + <string name="wizard_configure_select_apps">Przekieruj wybrane aplikacje przez Tor\'a</string> + <string name="wizard_tips_tricks">Aplikacje z działającym Orbot\'em</string> + <string name="wizard_tips_msg">Poniższe aplikacje zostały stworzone do pracy z Orbot\'em. Naciśnij każdy z przycisków by zainstalować aplikacje lub zrób to później wyszukując je w Android Market/Google PLAY</string> + <string name="wizard_tips_otrchat">Gibberbot - bezpieczny klient \"instant messaging\" dla Androida</string> + <string name="wizard_tips_proxy">Ustawienia Proxy - Naucz się jak skonfigurować aplikacje by działały z Orbot\'em</string> + <string name="wizard_proxy_help_info">Ustawienia Proxy</string>       + <string name="wizard_tips_orweb">Orweb: Przeglądarka działająca z Tor\'em, posiadająca wzmocnioną ochronę prywatności.</string> <!--<string name="wizard_tips_firefox">Firefox - Android browser - To be used along with ProxyMob Add-on </string> <string name="wizard_tips_proxymob">ProxyMob - Simple Firefox Add-on for setting HTTP, SOCKS and SSL proxy settings</string> <string name="firefox_apk_url">https://market.android.com/details?id=org.mozilla.firefox</string>

1 0

[translation/orbot] Update translations for orbot
by translation＠torproject.org 22 Aug '12

22 Aug '12

commit 45e2b22d4c5fff810747e5be71051f895c8c6387 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Aug 22 11:15:05 2012 +0000 Update translations for orbot --- values-pl_PL/strings.xml | 226 ++++++++-------------------------------------- 1 files changed, 40 insertions(+), 186 deletions(-) diff --git a/values-pl_PL/strings.xml b/values-pl_PL/strings.xml index 461bf86..92c864a 100644 --- a/values-pl_PL/strings.xml +++ b/values-pl_PL/strings.xml @@ -5,210 +5,64 @@ <string name="default_web_url">http://check.torproject.org</string> <string name="secure_default_web_url">https://check.torproject.org</string> <string name="tor_check_api_url">https://check.torproject.org/?TorButton=true</string> - <string name="control_permission_label">start and stop Tor</string> + <string name="control_permission_label">Uruchom / Zatrzymaj Tor</string> <string name="tor_proxy_service_process">torproxyservice</string> - <string name="status_starting_up">Orbot is starting...</string> - <string name="status_activated">Connected to the Tor network</string> - <string name="status_disabled">\"Orbot is Deactivated</string> - <string name="status_shutting_down">Orbot is shutting down</string> - <string name="tor_process_starting">Starting Tor client...</string> - <string name="tor_process_complete">complete.</string> - <string name="tor_process_waiting">waiting.</string> - <string name="not_anonymous_yet">WARNING: Your traffic is not anonymous yet! Please configure your applications to use HTTP proxy 127.0.0.1:8118 or SOCKS4A or SOCKS5 proxy 127.0.0.1:9050</string> - <string name="menu_home">Home</string> - <string name="menu_browse">Browse</string> - <string name="menu_settings">Settings</string> - <string name="menu_log">Log</string> - <string name="menu_info">Help</string> - <string name="menu_apps">Apps</string> + <string name="status_starting_up">Orbot uruchamia się...</string> + <string name="status_activated">Połączony do Sieci Tor</string> + <string name="status_disabled">Orbot jest Nieaktywny</string> + <string name="status_shutting_down">Ortbot wyłącza się</string> + <string name="not_anonymous_yet">UWAGA: twój ruch w sieci nie jest jeszcze anonimowy! Skonfiguruj swoje aplikacje by używały HTTP proxy 127.0.0.1:8118 lub SOCKS4A lub SOCKS5 proxy 127.0.0.1:9050</string> + <string name="menu_home">Strona Główna</string> + <string name="menu_browse">Przeglądaj</string> + <string name="menu_settings">Ustawienia</string> + <string name="menu_log">Logi</string> + <string name="menu_info">Pomoc</string> + <string name="menu_apps">Aplikacje</string> <string name="menu_start">Start</string> <string name="menu_stop">Stop</string> - <string name="menu_about">About</string> + <string name="menu_about">Informacje</string> <string name="menu_wizard">Wizard</string> - <string name="button_help">Help</string> - <string name="button_close">Close</string> - <string name="button_about">About</string> - <string name="button_clear_log">Clear Log</string> - <string name="menu_verify">Check</string> - <string name="menu_exit">Exit</string> - <string name="press_to_start">- long press to start -</string> - <string name="pref_trans_proxy_group">Transparent Proxying (Requires Root)</string> - <string name="pref_trans_proxy_title">Transparent Proxying</string> - <string name="pref_trans_proxy_summary">Automatic Torifying of Apps</string> - <string name="pref_transparent_all_title">Tor Everything</string> - <string name="pref_transparent_all_summary">Proxy traffic for all apps through Tor</string> - <string name="pref_transparent_port_fallback_title">Port Proxy Fallback</string> - <string name="pref_transparent_port_fallback_summary">WARNING: Circumvents common ports (80, 443, etc). *USE ONLY* if \'All\' or \'App\' mode doesn\'t work.</string> - <string name="pref_transparent_port_title">Port List</string> - <string name="pref_transparent_port_summary">List of ports to proxy. *USE ONLY* if \'All\' or \'App\' mode doesn\'t work</string> - <string name="pref_transparent_port_dialog">Enter ports to proxy</string> - <string name="pref_has_root">Request Root Access</string> - <string name="pref_has_root_summary">Request root access for transparent proxying</string> - <string name="status_install_success">Tor binaries successfully installed!</string> - <string name="status_install_fail">The Tor binary files were unable to be installed. Please check the log and notify tor-assistants(a)torproject.org</string> - <string name="title_error">Application Error</string> + <string name="button_help">Pomoc</string> + <string name="button_close">Zamknij</string> + <string name="button_about">Informacje</string> + <string name="button_clear_log">Wyczyść Logi</string> + <string name="menu_verify">Zaznacz</string> + <string name="menu_exit">Wyjście</string> + <string name="press_to_start">-Naciśnij i przytrzymaj by uruchomić-</string> + <string name="pref_trans_proxy_group">Transparenty Proxing (wymaga ROOT\'a)</string> + <string name="pref_trans_proxy_title">Transparenty Proxing</string> + <string name="pref_trans_proxy_summary">Automatyczne zastosowanie Tor\'a do aplikacji</string> + <string name="pref_transparent_all_title">Użyj Tor\'a dla wszystkich aplikacji</string> + <string name="pref_transparent_all_summary">Ruch proxy dla wszystkich aplikacji przez Tor\'a</string> + <string name="pref_transparent_port_title">Lista portów</string> + <string name="pref_transparent_port_dialog">Wprowadź porty dla proxy</string> + <string name="pref_has_root">Wymaga dostępu ROOT\'a</string> + <string name="status_install_success">Pliki binarne Tora zainstalowane poprawnie!</string> + <string name="status_install_fail">Pliki binarne Tora nie mogły być zainstalowane. Sprawdź Log i skontaktuj się z nami mailowo: tor-assistants(a)torproject.org</string> + <string name="title_error">Błąd aplikacji</string> <string name="wizard_title">Orbot</string> - <string name="wizard_btn_tell_me_more">About Orbot</string> - <string name="btn_next">Next</string> - <string name="btn_back">Back</string> - <string name="btn_finish">Finish</string> - <string name="btn_okay">Okay</string> - <string name="btn_cancel">Cancel</string> + <string name="wizard_btn_tell_me_more">O aplikacji Orbot</string> + <string name="btn_next">Dalej</string> + <string name="btn_back">Powrót</string> + <string name="btn_finish">Zakończ</string> + <string name="btn_okay">OK</string> + <string name="btn_cancel">Anuluj</string>  - <string name="wizard_details">Some Orbot Details</string> - <string name="wizard_details_msg">Orbot is an open-source application that contains Tor, LibEvent and Privoxy. It provides a local HTTP proxy (8118) and a SOCKS proxy (9050) into the Tor network. Orbot also has the ability, on rooted device, to send all internet traffic through Tor.</string> - <string name="wizard_permissions_root">Permission Granted</string> - <string name="wizard_permissions_stock">Orbot Permissions</string> - <string name="wizard_premissions_msg_root">Excellent! We\'ve detected that you have root permissions enabled for Orbot. We will use this power wisely.</string> - <string name="wizard_permissions_msg_stock"> While it is not required, Orbot can become a more powerful tool if your device has root access. Use the button below to grant Orbot superpowers! </string> - <string name="wizard_permissions_no_root">If you don\'t have root access or have no idea what we\'re talking about, just be sure to use apps made to work with Orbot.</string> - <string name="wizard_permissions_consent">I understand and would like to continue without Superuser</string> - <string name="wizard_permission_enable_root">Grant Root for Orbot</string> - <string name="wizard_configure">Configure Torification</string> - <string name="wizard_configure_msg">Orbot gives you the option to route all application traffic through Tor OR to choose your applications individually.</string> - <string name="wizard_configure_all">Proxy All Apps Through Tor</string> - <string name="wizard_configure_select_apps">Select Individual Apps for Tor</string> - <string name="wizard_tips_tricks">Orbot-enabled Apps</string> - <string name="wizard_tips_msg">The apps below were developed to work with Orbot. Click each button to install now, or you can find them later in the Android Market.</string> - <string name="wizard_tips_otrchat">Gibberbot - Secure instant messaging client for Android</string> - <string name="wizard_tips_proxy">Proxy Settings - Learn how to configure apps to work with Orbot</string> - <string name="wizard_proxy_help_info">Proxy Settings</string> - <string name="wizard_proxy_help_msg">If the Android app you are using can support the use of an HTTP or SOCKS proxy, then you can configure it to connect to Orbot and use Tor.\n\n\n The host settings is 127.0.0.1 or \"localhost\". For HTTP, the port setting is 8118. For SOCKS, the proxy is 9050. You should use SOCKS4A or SOCKS5 if possible.\n \n\n\n You can learn more about proxying on Android via the FAQ at: http://tinyurl.com/proxyandroid\n </string> - <string name="wizard_final">Orbot is ready!</string> - <string name="wizard_final_msg">Hundreds of thousands of people around the world use Tor for a wide variety of reasons.\n\nJournalists and bloggers, human rights defenders, law enforcement officers, soldiers, corporations, citizens of repressive regimes, and just ordinary citizens... and now you are ready to, as well!</string> + <string name="wizard_details">Szczegóły</string> + <string name="wizard_details_msg">Orbot jest aplikacją open-source zawierającą Tor\'a, LibEvent oraz Privoxy. Ortbot zapewnia </string>  - <string name="connect_first_time">You\'ve successfully connected to the Tor network - but this does NOT mean your device is secure. You can use the \'Check\' option from the menu to test your browser. \n\nVisit us at https://guardianproject.info/apps/orbot or send an email to help(a)guardianproject.info to learn more.</string> - <string name="tor_check">This will open your web browser to https://check.torproject.org in order to see if Orbot is probably configured and you are connected to Tor.</string> - <string name="pref_hs_group">Hidden Service Hosting</string> - <string name="pref_general_group">General</string> - <string name="pref_start_boot_title">Start Orbot on Boot</string> - <string name="pref_start_boot_summary">Automatically start Orbot and connect Tor when your Android device boots</string>   - <string name="wizard_title_msg">Orbot brings Tor to Android!\n\nTor helps you defend against content filtering, traffic analysis and network surveillance that threatens privacy, confidential information and personal relationships.\n\nThis wizard will help you configure Orbot and Tor on your device.</string>  - <string name="wizard_warning_title">Warning</string> - <string name="wizard_warning_msg">Simply installing Orbot will not automatically anonymize your mobile traffic.\n\nYou must properly configure Orbot, your device and other apps to successfully use Tor.</string>  - <string name="wizard_permissions_title">Permissions</string> - <string name="wizard_permissions_root_msg1">You can optionally grant Orbot \'Superuser\' access to enable advanced features, such as Transparent Proxying.</string> - <string name="wizard_permissions_root_msg2">If you do not want to do this, please make sure to use apps made to work with Orbot</string> - <string name="wizard_permissions_no_root_msg">Your device does not appear to be rooted or provide \'Superuser\' access.\n\nIn order to you to benefit from Tor, you will need to use apps built to work with Orbot, or that support HTTP or SOCKS proxy settings.\n\n</string>  - <string name="wizard_tips_title">Orbot-Enabled Apps</string> - <string name="wizard_tips_gibberbot">Gibberbot: Secure chat app with Off-the-Record Encryption</string> - <string name="gibberbot_apk_url">https://market.android.com/details?id=info.guardianproject.otr.app.im</string> - <string name="wizard_tips_orweb">Orweb: Privacy-enhanced browser that works through Tor</string> - <string name="orweb_apk_url">https://market.android.com/details?id=info.guardianproject.browser</string>   - <string name="wizard_transproxy_title">Transparent Proxying</string> - <string name="wizard_transproxy_msg">This allows your apps to automatically run through the Tor network without any configuration.</string> - <string name="wizard_transproxy_hint">(Check this box if you have no idea what we are talking about)</string> - <string name="wizard_transproxy_none">None</string> - <string name="pref_transparent_tethering_title">Tor Tethering</string> - <string name="pref_transparent_tethering_summary">Enable Tor Transparent Proxying for Wifi and USB Tethered Devices (requires restart)</string> - <string name="button_grant_superuser">Request Superuser Access</string> - <string name="pref_select_apps">Select Apps</string> - <string name="pref_select_apps_summary">Choose Apps to Route Through Tor</string> - <string name="pref_node_configuration">Node Configuration</string> - <string name="pref_node_configuration_summary">These are advanced settings that can reduce your anonymity</string> - <string name="pref_entrance_node">Entrance Nodes</string> - <string name="pref_entrance_node_summary">Fingerprints, nicks, countries and addresses for the first hop</string> - <string name="pref_entrance_node_dialog">Enter Entrance Nodes</string>  - <string name="pref_proxy_title">Outbound Network Proxy</string> - <string name="pref_proxy_type_title">Outbound Proxy Type</string> - <string name="pref_proxy_type_summary">Protocol to use for proxy server: HTTP, HTTPS, Socks4, Socks5</string> - <string name="pref_proxy_type_dialog">Enter Proxy Type</string> - <string name="pref_proxy_host_title">Outbound Proxy Host</string> - <string name="pref_proxy_host_summary">Proxy server hostname</string> - <string name="pref_proxy_host_dialog">Enter Proxy Host</string> - <string name="pref_proxy_port_title">Outbound Proxy Port</string> - <string name="pref_proxy_port_summary">Proxy server port</string> - <string name="pref_proxy_port_dialog">Enter Proxy port</string> - <string name="status">Status</string> - <string name="setting_up_full_transparent_proxying_">Setting up full transparent proxying...</string> - <string name="setting_up_app_based_transparent_proxying_">Setting up app-based transparent proxying...</string> - <string name="transparent_proxying_enabled">Transparent proxying ENABLED</string> - <string name="transproxy_enabled_for_tethering_">TransProxy enabled for Tethering!</string> - <string name="warning_error_starting_transparent_proxying_">WARNING: error starting transparent proxying!</string> - <string name="transproxy_rules_cleared">TransProxy rules cleared</string> - <string name="couldn_t_start_tor_process_">Couldn\'t start Tor process: </string> - <string name="privoxy_is_running_on_port_">Privoxy is running on port: </string> - <string name="setting_up_port_based_transparent_proxying_">Setting up port-based transparent proxying...</string> - <string name="bridge_error">Bridge Error</string> - <string name="bridge_requires_ip">In order to use the bridge feature, you must enter at least one bridge IP address.</string> - <string name="send_email_for_bridges">Send an email to bridges(a)torproject.org with the line \"get bridges\" by itself in the body of the mail from a gmail account.</string> - <string name="error">Error</string> - <string name="your_reachableaddresses_settings_caused_an_exception_">Your ReachableAddresses settings caused an exception!</string> - <string name="your_relay_settings_caused_an_exception_">Your relay settings caused an exception!</string> - <string name="exit_nodes">Exit Nodes</string> - <string name="fingerprints_nicks_countries_and_addresses_for_the_last_hop">Fingerprints, nicks, countries and addresses for the last hop</string> - <string name="enter_exit_nodes">Enter Exit Nodes</string> - <string name="exclude_nodes">Exclude Nodes</string> - <string name="fingerprints_nicks_countries_and_addresses_to_exclude">Fingerprints, nicks, countries and addresses to exclude</string> - <string name="enter_exclude_nodes">Enter Exclude Nodes</string> - <string name="strict_nodes">Strict Nodes</string> - <string name="use_only_these_specified_nodes">Use *only* these specified nodes</string> - <string name="bridges">Bridges</string> - <string name="use_bridges">Use Bridges</string> - <string name="bridges_obfuscated">Obfuscated Bridges</string> - <string name="enable_alternate_entrance_nodes_into_the_tor_network">Enable alternate entrance nodes into the Tor Network</string> - <string name="enable_if_configured_bridges_are_obfuscated_bridges">Enable if configured bridges are obfuscated bridges</string> - <string name="ip_address_and_port_of_bridges">IP address and port of bridges</string> - <string name="enter_bridge_addresses">Enter Bridge Addresses</string> - <string name="relays">Relays</string> - <string name="relaying">Relaying</string> - <string name="enable_your_device_to_be_a_non_exit_relay">Enable your device to be a non-exit relay</string> - <string name="relay_port">Relay Port</string> - <string name="listening_port_for_your_tor_relay">Listening port for your Tor relay</string> - <string name="enter_or_port">Enter OR port</string> - <string name="relay_nickname">Relay nickname</string> - <string name="the_nickname_for_your_tor_relay">The nickname for your Tor relay</string> - <string name="enter_a_custom_relay_nickname">Enter a custom relay nickname</string> - <string name="reachable_addresses">Reachable Addresses</string> - <string name="run_as_a_client_behind_a_firewall_with_restrictive_policies">Run as a client behind a firewall with restrictive policies</string> - <string name="reachable_ports">Reachable ports</string> - <string name="ports_reachable_behind_a_restrictive_firewall">Ports reachable behind a restrictive firewall</string> - <string name="enter_ports">Enter ports</string> - <string name="enable_hidden_services">Hidden Service Hosting</string> - <string name="run_servers_accessible_via_the_tor_network">allow on-device server to be accessible via the Tor network</string> - <string name="enter_localhost_ports_for_hidden_services">enter localhost ports for hidden services</string> - <string name="hidden_service_ports">Hidden Service Ports</string> - <string name="the_addressable_name_for_your_hidden_service_generated_automatically_">the addressable name for your hidden service (generated automatically)</string> - <string name="enable_debug_log_to_output_must_use_adb_or_alogcat_to_view_">enable debug log to output (must use adb or aLogCat to view)</string> - <string name="project_home">Project Home(s): </string> - <string name="project_urls">https://www.torproject.org/docs/android\nhttps://guardianproject.info/apps/…</string> - <string name="the_tor_license">The Tor License</string> - <string name="https_torproject_org">https://torproject.org</string> - <string name="third_party_software">3rd-Party-Software: </string> - <string name="tor_version">Tor v0.2.3.17: https://www.torproject.org</string> - <string name="libevent_version">LibEvent v2.1: http://www.monkey.org/~provos/libevent/</string> - <string name="privoxy_version">Privoxy v3.0.12: http://www.privoxy.org</string> - <string name="iptables_version">Iptables v1.4.7: http://www.netfilter.org</string> - <string name="openssl_version">OpenSSL v0.9.8h: http://www.openssl.org</string> - <string name="hidden_service_request">An app wants to open hidden server port %S to the Tor network. This is safe if you trust the app.</string> - <string name="found_existing_tor_process">found existing Tor process...</string> - <string name="something_bad_happened">Something bad happened. Check the log</string> - <string name="hidden_service_on">hidden service on:</string> - <string name="unable_to_read_hidden_service_name">unable to read hidden service name</string> - <string name="unable_to_start_tor">Unable to start Tor:</string> - <string name="pref_use_sys_iptables_title">Use Default Iptables</string> - <string name="pref_use_sys_iptables_summary">use the built-in iptables binary instead of the one bundled with Orbot</string> - <string name="error_installing_binares">The Tor binaries were not able to be installed or upgraded.</string> - <string name="pref_use_persistent_notifications">Always keep the icon in toolbar when Orbot is connected</string> - <string name="pref_use_persistent_notifications_title">Always-On Notifications</string> - <string name="notification_using_bridges">Bridges enabled!</string> <string name="default_bridges"/> - <string name="set_locale_title">Set Locale</string> - <string name="set_locale_summary">Choose the locale and language for Orbot</string> - <string name="wizard_locale_title">Choose Language</string> - <string name="wizard_locale_msg">Leave default or switch the current language</string> - <string name="powered_by">powered by The Tor Project </string> - <string name="btn_save_settings">Save Settings</string> + <string name="powered_by">powered by The Tor Project </string> </resources>

1 0

[research-web/master] Add Jake's NAT-PMP/UPnP report.
by karsten＠torproject.org 22 Aug '12

22 Aug '12

commit a7f399a8e814562139e0e698da4de2b17c0a650d Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed Aug 22 11:37:19 2012 +0200 Add Jake's NAT-PMP/UPnP report. --- techreports.html | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/techreports.html b/techreports.html index c104a00..2d7f316 100644 --- a/techreports.html +++ b/techreports.html @@ -31,6 +31,13 @@ <h3>2012</h3> <br> +<p>Jacob Appelbaum. +<i>Tor and NAT devices: increasing bridge & relay reachability or, +enabling the use of NAT-PMP and UPnP by default.</i> +Tor Tech Report 2012-08-001. +August 22, 2012. +<a href="techreports/tor-nat-plan-2012-08-22.pdf">PDF</a>.</p> + <!--<p>Steven J. Murdoch and George Kadianakis. <i>Pluggable Transports Roadmap.</i> March 17, 2012.

1 0

[tech-reports/master] Turn tor-nat-plan into a Tor Tech Report.
by karsten＠torproject.org 22 Aug '12

22 Aug '12

commit df7b3707a9a082377772e9bc580f0094d9bee742 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed Aug 22 08:01:07 2012 +0200 Turn tor-nat-plan into a Tor Tech Report. --- 2012/tor-nat-plan/.gitignore | 1 + 2012/tor-nat-plan/tor-nat-plan.bib | 56 +++++++++--------------------------- 2012/tor-nat-plan/tor-nat-plan.tex | 50 +++++++++++--------------------- 2012/tor-nat-plan/tortechrep.cls | 1 + 4 files changed, 33 insertions(+), 75 deletions(-) diff --git a/2012/tor-nat-plan/.gitignore b/2012/tor-nat-plan/.gitignore index 59cf12a..1053ba0 100644 --- a/2012/tor-nat-plan/.gitignore +++ b/2012/tor-nat-plan/.gitignore @@ -1,2 +1,3 @@ tor-nat-plan.pdf +tor-nat-plan-2012-08-22.pdf diff --git a/2012/tor-nat-plan/tor-nat-plan.bib b/2012/tor-nat-plan/tor-nat-plan.bib index e2a5dfd..35715bd 100644 --- a/2012/tor-nat-plan/tor-nat-plan.bib +++ b/2012/tor-nat-plan/tor-nat-plan.bib @@ -1,47 +1,19 @@ -@MISC{dummy, - author={nobody}, - title = {nothing}, - note = {\url{http://example.com}}, - year = {2011} +@inproceedings{dingledine2004tor, + title = {{Tor}: The Second-Generation Onion Router}, + author = {Roger Dingledine and Nick Mathewson and Paul Syverson}, + booktitle = {Proceedings of the 13th USENIX Security Symposium}, + year = {2004}, + month = {August}, + note = {\url{https://svn.torproject.org/svn/projects/design-paper/tor-design.pdf}}, } - -@techreport{dingledine2004tor, - title={Tor: The second-generation onion router}, - author={Dingledine, R. and Mathewson, N. and Syverson, P.}, - year={2004}, - institution={DTIC Document} -} @inproceedings{muller2010autonomous, - title={Autonomous nat traversal}, - author={Muller, A. and Evans, N. and Grothoff, C. and Kamkar, S.}, - booktitle={Peer-to-Peer Computing (P2P), 2010 IEEE Tenth International -Conference on}, - pages={1--4}, - year={2010}, - organization={IEEE} -} - -@misc{wiki:000, - author = "Wikipedia", - title = "STUN --- {W}ikipedia{,} The Free Encyclopedia", - year = "2012", - url = "\url{https://en.wikipedia.org/w/index.php?title=STUN&oldid=480053418}", - note = "[Online; accessed 20-March-2012]" + title = {Autonomous {NAT} Traversal}, + author = {Andreas M\"{u}ller and Nathan Evans and Christian Grothoff and Samy Kamkar}, + booktitle = {10th IEEE International Conference on Peer-to-Peer Computing (P2P)}, + year = {2010}, + month = {August}, + pages = {1--4}, + organization={IEEE}, } -@misc{wiki:001, - author = "Wikipedia", - title = "TURN --- {W}ikipedia{,} The Free Encyclopedia", - year = "2012", - url = "\url{https://en.wikipedia.org/w/index.php?title=Traversal_Using_Relays_around_NAT&oldid=480053422}", - note = "[Online; accessed 20-March-2012]" -} - -@misc{wiki:002, - author = "Wikipedia", - title = "ICE --- {W}ikipedia{,} The Free Encyclopedia", - year = "2012", - url = "\url{https://en.wikipedia.org/w/index.php?title=Interactive_Connectivity_Establishment&oldid=472491355}", - note = "[Online; accessed 20-March-2012]" -} diff --git a/2012/tor-nat-plan/tor-nat-plan.tex b/2012/tor-nat-plan/tor-nat-plan.tex index af19aff..0c0b44d 100644 --- a/2012/tor-nat-plan/tor-nat-plan.tex +++ b/2012/tor-nat-plan/tor-nat-plan.tex @@ -1,17 +1,5 @@ -\documentclass{article} -%\usepackage{palatcm} -\usepackage{censor} - -\usepackage{listings} -\lstset{language=python,breaklines=true} - -\usepackage{fancyhdr} -\usepackage{color} +\documentclass{tortechrep} \usepackage{graphicx} -\usepackage{fullpage} -\setlength{\headheight}{12pt} -\setlength{\headsep}{12pt} -\addtolength{\textheight}{-24pt} \usepackage{prettyref} \newrefformat{sec}{Section~\ref{#1}} @@ -42,26 +30,20 @@ \newcommand{\ia}{inter alia\xspace} \makeatother - -\newcommand{\thetitle}{Tor and NAT devices: increasing bridge \& relay reachability} -\title{\thetitle\\or,\\enabling the use of NAT--PMP and UPnP by default} +\title{Tor and NAT devices:\\increasing bridge \& relay reachability\\% +or,\\enabling the use of NAT--PMP and UPnP by default} %% Please add your name in here if you contribute -\author{Jacob Appelbaum - \\jacob(a)torproject.org - } -\pagestyle{fancy} -\fancyhf{} - -\fancyhead[C]{\thetitle} -\fancyfoot[C]{\thepage} +\author{Jacob Appelbaum} +\contact{jacob(a)torproject.org} +\reportid{2012-08-001} +\date{August 22, 2012} \begin{document} -\thispagestyle{plain} - \maketitle +\begin{abstract} Tor relays and Tor bridges require at least a single reachable TCP port. This document discusses the current methods for enabling and enhancing Tor bridge and Tor relay reachability when behind a consumer grade @@ -69,10 +51,7 @@ NAT device. Such reachability improvements are extremely important for embedded devices that provide Tor relaying or Tor bridging services. We propose the use of NAT--PMP and/or UPnP protocol(s) to ensure that inbound connectivity is possible. - -\pagebreak -\tableofcontents -\pagebreak +\end{abstract} %\section{License} %This work is released under the Creative Commons @@ -87,7 +66,7 @@ possible. \label{introduction} -Tor\cite{dingledine2004tor} is the second-generation onion router -- it is both +Tor~\cite{dingledine2004tor} is the second-generation onion router -- it is both client and server software in a single program. When {\em Tor} is configured to be a relay or bridge, it requires a public IPv4 address and at least a single TCP port for its Onion Router Port (ORPort). Tor does not directly need to be @@ -115,7 +94,13 @@ mention it when applicable. While other methods of NAT traversal are possible, we consider them to be out of scope at this time due to their reliance on third parties -(STUN~\cite{wiki:000}, TURN~\cite{wiki:001}, ICE~\cite{wiki:002}, etc) or +(STUN% +\footnote{\url{https://en.wikipedia.org/w/index.php?title=STUN\&oldid=480053418}}, +TURN% +\footnote{\url{https://en.wikipedia.org/w/index.php?title=Traversal\_Using\_Relays\_around\_NAT&oldid=480053422}}, +ICE% +\footnote{\url{https://en.wikipedia.org/w/index.php?title=Interactive\_Connectivity\_Establishment\&oldid=472491355}}, +etc) or because they require specialized client software (pwnat~\cite{muller2010autonomous}, etc) to access services offered behind a NAT device; this topic is discussed in section \ref{third}. The @@ -297,7 +282,6 @@ size or complexity. I would like to thank the University of Washington Security and Privacy Research Lab and other anonymous cypherpunks who contributed valuable feedback. -\bibliographystyle{acm} \bibliography{tor-nat-plan} \end{document} diff --git a/2012/tor-nat-plan/tortechrep.cls b/2012/tor-nat-plan/tortechrep.cls new file mode 120000 index 0000000..4c24db2 --- /dev/null +++ b/2012/tor-nat-plan/tortechrep.cls @@ -0,0 +1 @@ +../../tortechrep.cls \ No newline at end of file

1 0

[tech-reports/master] Add mostly unmodified tor-nat-plan sources.
by karsten＠torproject.org 22 Aug '12

22 Aug '12

commit 5477d662aedd8c0953f5d80f9ec326cebb6c8940 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed Aug 22 08:00:17 2012 +0200 Add mostly unmodified tor-nat-plan sources. The main modification is that the license section was removed to avoid committing and later removing the creative commons image. --- 2012/tor-nat-plan/.gitignore | 2 + 2012/tor-nat-plan/tor-nat-plan.bib | 47 ++++++ 2012/tor-nat-plan/tor-nat-plan.tex | 304 ++++++++++++++++++++++++++++++++++++ 3 files changed, 353 insertions(+), 0 deletions(-) diff --git a/2012/tor-nat-plan/.gitignore b/2012/tor-nat-plan/.gitignore new file mode 100644 index 0000000..59cf12a --- /dev/null +++ b/2012/tor-nat-plan/.gitignore @@ -0,0 +1,2 @@ +tor-nat-plan.pdf + diff --git a/2012/tor-nat-plan/tor-nat-plan.bib b/2012/tor-nat-plan/tor-nat-plan.bib new file mode 100644 index 0000000..e2a5dfd --- /dev/null +++ b/2012/tor-nat-plan/tor-nat-plan.bib @@ -0,0 +1,47 @@ +@MISC{dummy, + author={nobody}, + title = {nothing}, + note = {\url{http://example.com}}, + year = {2011} +} + + +@techreport{dingledine2004tor, + title={Tor: The second-generation onion router}, + author={Dingledine, R. and Mathewson, N. and Syverson, P.}, + year={2004}, + institution={DTIC Document} +} +@inproceedings{muller2010autonomous, + title={Autonomous nat traversal}, + author={Muller, A. and Evans, N. and Grothoff, C. and Kamkar, S.}, + booktitle={Peer-to-Peer Computing (P2P), 2010 IEEE Tenth International +Conference on}, + pages={1--4}, + year={2010}, + organization={IEEE} +} + +@misc{wiki:000, + author = "Wikipedia", + title = "STUN --- {W}ikipedia{,} The Free Encyclopedia", + year = "2012", + url = "\url{https://en.wikipedia.org/w/index.php?title=STUN&oldid=480053418}", + note = "[Online; accessed 20-March-2012]" +} + +@misc{wiki:001, + author = "Wikipedia", + title = "TURN --- {W}ikipedia{,} The Free Encyclopedia", + year = "2012", + url = "\url{https://en.wikipedia.org/w/index.php?title=Traversal_Using_Relays_around_NAT&oldid=480053422}", + note = "[Online; accessed 20-March-2012]" +} + +@misc{wiki:002, + author = "Wikipedia", + title = "ICE --- {W}ikipedia{,} The Free Encyclopedia", + year = "2012", + url = "\url{https://en.wikipedia.org/w/index.php?title=Interactive_Connectivity_Establishment&oldid=472491355}", + note = "[Online; accessed 20-March-2012]" +} diff --git a/2012/tor-nat-plan/tor-nat-plan.tex b/2012/tor-nat-plan/tor-nat-plan.tex new file mode 100644 index 0000000..af19aff --- /dev/null +++ b/2012/tor-nat-plan/tor-nat-plan.tex @@ -0,0 +1,304 @@ +\documentclass{article} +%\usepackage{palatcm} +\usepackage{censor} + +\usepackage{listings} +\lstset{language=python,breaklines=true} + +\usepackage{fancyhdr} +\usepackage{color} +\usepackage{graphicx} +\usepackage{fullpage} +\setlength{\headheight}{12pt} +\setlength{\headsep}{12pt} +\addtolength{\textheight}{-24pt} + +\usepackage{prettyref} +\newrefformat{sec}{Section~\ref{#1}} +\newrefformat{tab}{Table~\ref{#1}} +\newrefformat{fig}{Figure~\ref{#1}} +\newrefformat{cha}{Chapter~\ref{#1}} +\newrefformat{eqn}{Equation~\ref{#1}} +\newrefformat{apx}{Appendix~\ref{#1}} + +\usepackage{hyperref} +\hypersetup{colorlinks, citecolor=MyDarkRed, filecolor=MyDarkBlue, linkcolor=MyDarkRed, urlcolor=MyDarkBlue} + +\definecolor{MyDarkBlue}{rgb}{0, 0.0, 0.45} +\definecolor{MyDarkRed}{rgb}{0.45, 0.0, 0} +\definecolor{MyDarkGreen}{rgb}{0, 0.45, 0} +\definecolor{MyLightGray}{gray}{.90} +\definecolor{MyLightGreen}{rgb}{0.5, 0.99, 0.5} + +\usepackage{xspace} +\makeatletter +\newcommand{\ie}{i.e.\@\xspace} +\newcommand{\eg}{e.g.\@\xspace} +\newcommand{\cf}{cf.\@\xspace} +\newcommand{\vs}{vs.\@\xspace} +\newcommand{\wrt}{w.r.t.\@\xspace} +\newcommand{\etal}{\textit{et al.\@\xspace}} +\newcommand{\detal}{\textit{et al.}} +\newcommand{\ia}{inter alia\xspace} +\makeatother + + +\newcommand{\thetitle}{Tor and NAT devices: increasing bridge \& relay reachability} +\title{\thetitle\\or,\\enabling the use of NAT--PMP and UPnP by default} + +%% Please add your name in here if you contribute +\author{Jacob Appelbaum + \\jacob(a)torproject.org + } +\pagestyle{fancy} +\fancyhf{} + +\fancyhead[C]{\thetitle} +\fancyfoot[C]{\thepage} + +\begin{document} + +\thispagestyle{plain} + +\maketitle + +Tor relays and Tor bridges require at least a single reachable TCP port. This +document discusses the current methods for enabling and enhancing Tor +bridge and Tor relay reachability when behind a consumer grade +NAT device. Such reachability improvements are extremely important for embedded +devices that provide Tor relaying or Tor bridging services. We propose the use +of NAT--PMP and/or UPnP protocol(s) to ensure that inbound connectivity is +possible. + +\pagebreak +\tableofcontents +\pagebreak + +%\section{License} +%This work is released under the Creative Commons +%Attribution-NonCommercial-NoDerivs license. +% +%\begin{figure}[htb] +%\centering +%\includegraphics*[keepaspectratio=true]{by-nc-nd.eps} +%\end{figure} + +\section{Introduction} +\label{introduction} + + +Tor\cite{dingledine2004tor} is the second-generation onion router -- it is both +client and server software in a single program. When {\em Tor} is configured to +be a relay or bridge, it requires a public IPv4 address and at least a single +TCP port for its Onion Router Port (ORPort). Tor does not directly need to be +assigned this IP -- it is only required that inbound connectivity is possible on +the advertised TCP port on the respective IP. + +While other terms such as network address and port translation (NAPT), port +address translation (PAT) or IP masquerading are used, we have chosen to use +Network Address Translation (NAT) for brevity and simplicity. + +The ORPort handles connections from either Tor clients or other Tor relays. +When placed behind a NAT device, the {\em Tor} relay or bridge is generally +able to make outgoing connections without restriction. In general, incoming +connections are filtered and require that the NAT device forward traffic. In +general consumer grade NAT devices have a single IPv4 address bound to its +respective Wide Area Network (WAN) interface and that IP address is shared +between many systems on the NAT device's Local Area Network (LAN) interface. +Most consumer grade NAT devices allow for services to be reachable behind the +NAT device with manual configuration and many allow for automatic configuration +with one of two major protocols, UPnP and NAT--PMP. + +Tor only supports IPv6 for bridges at the moment and as NAT is not an issue +with IPv6, we consider IPv6 to be largely out of scope for this document but we +mention it when applicable. + +While other methods of NAT traversal are possible, we consider them +to be out of scope at this time due to their reliance on third parties +(STUN~\cite{wiki:000}, TURN~\cite{wiki:001}, ICE~\cite{wiki:002}, etc) or +because they require specialized client software +(pwnat~\cite{muller2010autonomous}, etc) to access services offered behind a +NAT device; this topic is discussed in section \ref{third}. The +former grouping of third--party--dependent solutions is almost certainly +never a viable NAT piercing technique for anonymity reasons. The latter +technique implemented by {\em pwnat} is much more attractive. It is generally +friendly to privacy and does not rely on NAT router configuration. + +This document explores methods of programmatically configuring NAT routers to +improve Tor relay and bridge reachability. Automatic configuration of NAT +routers is easy to use but slightly controversial. Many consumer grade NAT +devices do support some form of port forwarding or NAT traversal. They are +quite straightforward to configure in a programmatic manner. It is often the +case that these devices support UPnP and/or NAT--PMP by default which allows +for simple NAT traversal. Nearly all of these routers also support a web +interface for configuration of port forwarding; we do not consider methods of +automating configuration through the web interface. + +\section{Why we shouldn't rely on distant third parties} +\label{third} +Full reachability is a serious problem on the modern internet. Offering a +service requires bi--directional IPv4 connectivity. While it may seem +attractive to attempt to use protocols STUN, ICE, or other NAT punching +techniques that involve a third party, such techniques are generally bad for +anonymity. We assume that readers of this paper are familiar with the work by +Grothoff et al in Autonomous NAT Traversal~\cite{muller2010autonomous}, the +basic ideas of NAT--PMP and UPnP and we cover the important aspects as they +apply to Tor in section \ref{sec:protocols}. + +In the case of Tor relays, we expect that a third party relay, such as an ICE +or STUN service becomes a kind of centralized area of the network with high +value. When many relays route through a single third party, we may find that +the anonymity properties provided by all of those nodes is reducible to the +third party itself. The Tor network assumes that there is no global or network +wide observer of all Tor nodes but adding a NAT-piercing third party would +create one or a class of centralized systems to ease such monitoring. While +asymmetric connection properties may create a more subtle security analysis, we +think caution is prudent. + +In the case of Tor bridges, in addition to the challenges faced by relays, we +expect that any given third party used to broker bridge connections would +simply become blocked, perhaps even before the bridge itself is blocked. +Additionally, monitoring of the third party may reveal every bridge attempting +to connect to the third party -- this is certainly not a good property in terms +of censorship resistance. Even if this service is run by a trusted party, we +have no way to protect it from surveillance. + +\section{NAT traversal protocols} +\label{sec:protocols} + +There are two protocols commonly used by consumer grade routers for NAT +configuration. The most common protocol is the UPnP Forum managed standard, +UPnP, and the second, but still extremely common protocol, is the Apple +standard NAT--PMP. + +These two protocols along with experimental ideas such as +pwnat~\cite{muller2010autonomous} perform NAT traversal with nearby third +parties -- generally NAT devices. STUN, ICE and other third party NAT +traversal protocols use a well known third party on the wider internet, UPnP +and NAT--PMP attempt to create a state of bi-directional connectivity through +the nearest upstream NAT device. While this does not strictly remove the third +party from the NAT traversal problem, we ensure that the third party is already +in the network path. + +Only pwnat~\cite{muller2010autonomous} as described by Grothoff et al in +their seminal Autonomous NAT traversal stands alone in its ability to produce +results without a specialized protocol supported by a third party during NAT +traversal. It however requires that both the client and server run specific +software to complete connections. In the future it seems that a pwnat based +pluggable transport for Tor bridges would be suitable for certain reachability +cases. It is unlikely to work for the entire Tor network which requires that +all relays communicate directly with all other relays. + +\subsection{UPnP} +\label{sec:UPnP} + +Configuration of upstream NAT devices is possible with the UPnP protocol in two +different ways. The first method is available in the Vidalia Tor controller and +the second is with the {\em tor--fw--helper} utility. + +\subsection{NAT--PMP} +\label{renumber:natpmp} + +Configuration of upstream NAT devices with the NAT--PMP is not currently +supported by the Vidalia Tor controller. There is currently no known plan to +add NAT--PMP support to the Vidalia controller. It is possible to use the +{\em tor--fw--helper} utility with the NAT--PMP protocol. + +\section{Tor controllers and NAT devices} +\label{sec:tor-controllers} + +When {\em tor} is launched or controlled by a controller such as Vidalia and it +is running as a relay or bridge, the controller may attempt to configure any +upstream NAT devices to forward required TCP ports. Vidalia does this with UPnP +at the request of the user and not by default. + +When {\em tor} is launched without such a controller, the current stable {\em +tor} program itself has no knowledge about NAT piercing techniques. It requires +a pre--configured upstream NAT device or it must be running on a system with a +public IPv4 address. + +\section{Tor and NAT devices} +\label{sec:tor-nat} + +The 0.2.3.x branch of {\em tor} includes two new options, {\em PortForwarding} and +{\em PortForwardingHelper}, to assist in the configuration of upstream NAT +devices. The default {\em PortForwardingHelper} is {\em tor--fw--helper} and +{\em PortForwarding} is disabled by default. + +The {\em tor--fw--helper} utility supports both UPnP and NAT--PMP if compiled +with the requisite libraries. This utility is not currently built by default and +each protocol must be manually specified and enabled at build time. + +When {\em tor--fw--helper} is built with UPnP and NAT--PMP, and {\em +PortForwarding} is enabled with {\em tor} configured as a relay or bridge, {\em +tor} is generally able to pierce supported NAT devices without any additional +software. This is especially important when embedded devices with Tor are +considered as relay or bridge devices. + +\section{Security concerns} +\label{sec:security} + +We presume that if Tor enables UPnP and NAT--PMP by default it will increase Tor +router and Tor bridge availability without requiring manual reconfiguration of +NAT devices. It is generally important to note that NAT devices are largely +deployed to resolve IPv4 resource allocation issues. While NAT devices perform +similar functions to network firewalls they are not by design a security +boundary. If a network operator prefers to not use UPnP and NAT--PMP, it is +suggested that they disable support for the protocols on their respective NAT +devices. Furthermore, such a network operator must manually configure their +respective routers to ensure that the required ports are globally reachable. + +By Tor shipping with support for UPnP and NAT--PMP, we might encourage +users to enable this feature on their NAT devices and thus make them more +vulnerable to other applications also using the enabled UPnP or NAT--PMP +services offered by their NAT device. We believe that this is a reasonable +trade--off. Users have to positively affirm their desire to enable such +a feature on their routers and such consent is a reasonable standard for such a +trade--off. Users who are behind such a NAT device will have log messages +indicating that UPnP or NAT--PMP was the NAT traversal method used by the Tor +relay or Tor bridge. + +Perhaps the greatest security concern is that Tor would depend on libnatpmp and +libminiupnpc. This code could have vulnerabilities which may be exploitable and +{\em tor--fw--helper} would raise the overall attack surface of a given Tor +relay or Tor bridge. + +\section{Suggestions for improvement} +\label{sec:improvements} + +Future releases of {\em tor} should build {\em tor--fw--helper} by +default with full UPnP and NAT--PMP support enabled at compile time. Vidalia +should be extended to understand the {\em tor} {\em PortForwarding} and +{\em PortForwardingHelper} options rather than including UPnP or NAT--PMP +library code directly. When {\em tor} is configured to be a relay or a bridge, it +should ensure that {\em PortForwarding} is enabled without further user +intervention. The exception is that IPv6 enabled bridges will not and should +not ever need NAT traversal services; on such IPv6 enabled devices, we should +not automatically launch our {\em PortForwardingHelper} unless we also have a +corresponding IPv4 IP address that must be globally reachable. + +We suggest that libminiupnpc and libnatpmp must be audited for security related +concerns before any full scale {\em tor--fw--helper} deployment. Any changes +or security improvements should be sent to the upstream authors. + +\section{Conclusion} +\label{sec:conclusion} + +When {\em tor--fw--helper} is built and shipped in various binary releases and +when {\em tor} {\em PortForwarding} is enabled, Tor bridge and relay +reachability and availability will improve. Tor bridges and relays previously +hidden behind many NAT devices will become available. Furthermore, NAT +piercing on embedded devices will improve and graphical Tor controllers will +be able to easily support these new features without significant increases in +size or complexity. + +\section*{Acknowledgements} + +I would like to thank the University of Washington Security and Privacy +Research Lab and other anonymous cypherpunks who contributed valuable feedback. + +\bibliographystyle{acm} +\bibliography{tor-nat-plan} + +\end{document} +

1 0

[ooni-probe/master] Write some documentation for DOMClass
by art＠torproject.org 22 Aug '12

22 Aug '12

commit 78fe6dea0b46c4055fbc195cf9329001c062cb17 Author: Arturo Filastò <hellais(a)torproject.org> Date: Tue Aug 21 01:51:58 2012 +0200 Write some documentation for DOMClass --- ooni/plugins/domclass.py | 97 ++++++++++++++++++++++++++++++++++----------- ooni/protocols/http.py | 5 ++ 2 files changed, 78 insertions(+), 24 deletions(-) diff --git a/ooni/plugins/domclass.py b/ooni/plugins/domclass.py index 31e2e41..cdcd508 100644 --- a/ooni/plugins/domclass.py +++ b/ooni/plugins/domclass.py @@ -1,8 +1,33 @@ -""" -This is a self genrated test created by scaffolding.py. -you will need to fill it up with all your necessities. -Safe hacking :). -""" +# +# +# domclass +# ******** +# +# :copyright: (c) 2012 by Arturo Filastò +# :license: see LICENSE for more details. +# +# how this works +# -------------- +# +# This classifier uses the DOM structure of a website to determine how similar +# the two sites are. +# The procedure we use is the following: +# * First we parse all the DOM tree of the web page and we build a list of +# TAG parent child relationships (ex. <html><a><b></b></a><c></c></html> => +# (html, a), (a, b), (html, c)). +# +# * We then use this information to build a matrix (M) where m[i][j] = P(of +# transitioning from tag[i] to tag[j]). If tag[i] does not exists P() = 0. +# Note: M is a square matrix that is number_of_tags wide. +# +# * We then calculate the eigenvectors (v_i) and eigenvalues (e) of M. +# +# * The corelation between page A and B is given via this formula: +# correlation = dot_product(e_A, e_B), where e_A and e_B are +# resepectively the eigenvalues for the probability matrix A and the +# probability matrix B. +# + from zope.interface import implements from twisted.python import usage from twisted.plugin import IPlugin @@ -18,6 +43,8 @@ class domclassArgs(usage.Options): ['asset', 'a', None, 'URL List'], ['resume', 'r', 0, 'Resume at this index']] +# All HTML4 tags +# XXX add link to W3C page where these came from alltags = ['A', 'ABBR', 'ACRONYM', 'ADDRESS', 'APPLET', 'AREA', 'B', 'BASE', 'BASEFONT', 'BD', 'BIG', 'BLOCKQUOTE', 'BODY', 'BR', 'BUTTON', 'CAPTION', 'CENTER', 'CITE', 'CODE', 'COL', 'COLGROUP', 'DD', 'DEL', 'DFN', 'DIR', 'DIV', @@ -29,6 +56,7 @@ alltags = ['A', 'ABBR', 'ACRONYM', 'ADDRESS', 'APPLET', 'AREA', 'B', 'BASE', 'STRIKE', 'STRONG', 'STYLE', 'SUB', 'SUP', 'TABLE', 'TBODY', 'TD', 'TEXTAREA', 'TFOOT', 'TH', 'THEAD', 'TITLE', 'TR', 'TT', 'U', 'UL', 'VAR'] +# Reduced subset of only the most common tags commontags = ['A', 'B', 'BLOCKQUOTE', 'BODY', 'BR', 'BUTTON', 'CAPTION', 'CENTER', 'CITE', 'CODE', 'COL', 'DD', 'DIV', 'DL', 'DT', 'EM', 'FIELDSET', 'FONT', 'FORM', 'FRAME', 'FRAMESET', 'H1', 'H2', @@ -39,12 +67,18 @@ commontags = ['A', 'B', 'BLOCKQUOTE', 'BODY', 'BR', 'BUTTON', 'CAPTION', 'STRIKE', 'STRONG', 'STYLE', 'SUB', 'SUP', 'TABLE', 'TBODY', 'TD', 'TEXTAREA', 'TFOOT', 'TH', 'THEAD', 'TITLE', 'TR', 'TT', 'U', 'UL'] +# The tags we are intested in using for our analysis thetags = ['A', 'DIV', 'FRAME', 'H1', 'H2', 'H3', 'H4', 'IFRAME ', 'INPUT', 'LABEL','LI', 'P', 'SCRIPT', 'SPAN', 'STYLE', 'TR'] -def compute_matrix(dataset): +def compute_probability_matrix(dataset): + """ + Compute the probability matrix based on the input dataset. + + :dataset: an array of pairs representing the parent child relationships. + """ import itertools import numpy ret = {} @@ -74,21 +108,38 @@ def compute_matrix(dataset): if possibilities != 0: matrix[x][i] = matrix[x][i]/possibilities - ret['matrix'] = matrix - ret['eigen'] = numpy.linalg.eigvals(matrix) - return ret + return matrix + +def compute_eigenvalues(matrix): + """ + Returns the eigenvalues of the supplied square matrix. + + :matrix: must be a square matrix and diagonalizable. + """ + return numpy.linalg.eigvals(matrix) def readDOM(content=None, filename=None): + """ + Parses the DOM of the HTML page and returns an array of parent, child + pairs. + + :content: the content of the HTML page to be read. + + :filename: the filename to be read from for getting the content of the + page. + """ from bs4 import BeautifulSoup + if filename: f = open(filename) content = ''.join(f.readlines()) + f.close() dom = BeautifulSoup(content) couples = [] for x in dom.findAll(): couples.append((str(x.parent.name), str(x.name))) - #f.close() + return couples class domclassTest(HTTPTest): @@ -100,17 +151,20 @@ class domclassTest(HTTPTest): options = domclassArgs blocking = False - tool = True + follow_redirects = True + #tool = True def runTool(self): import yaml, numpy site_a = readDOM(filename=self.local_options['file']) site_b = readDOM(filename=self.local_options['fileb']) - a = compute_matrix(site_a) + a['matrix'] = compute_probability_matrix(site_a) + a['eigen'] = compute_eigenvalue(a['matrix']) + self.result['eigenvalues'] = a['eigen'] - #self.result['matrix'] = str(a['matrix'] - #self.result['content'] = data[:200] - b = compute_matrix(site_b) + b['matrix'] = compute_probability_matrix(site_b) + b['eigen'] = compute_eigenvalue(b['matrix']) + #print "A: %s" % a #print "B: %s" % b correlation = numpy.vdot(a['eigen'],b['eigen']) @@ -122,24 +176,19 @@ class domclassTest(HTTPTest): import yaml, numpy site_a = readDOM(data) #site_b = readDOM(self.local_options['fileb']) - a = compute_matrix(site_a) + a['matrix'] = compute_probability_matrix(site_a) + a['eigen'] = compute_eigenvalue(a['matrix']) + if len(data) == 0: self.result['eigenvalues'] = None self.result['matrix'] = None else: self.result['eigenvalues'] = a['eigen'] - #self.result['matrix'] = str(a['matrix']) + #self.result['matrix'] = a['matrix'] #self.result['content'] = data[:200] #b = compute_matrix(site_b) print "A: %s" % a return a['eigen'] - #print "B: %s" % b - #correlation = numpy.vdot(a['eigen'],b['eigen']) - #correlation /= numpy.linalg.norm(a['eigen'])*numpy.linalg.norm(b['eigen']) - #correlation = (correlation + 1)/2 - #print "Corelation: %s" % correlation -# We need to instantiate it otherwise getPlugins does not detect it -# XXX Find a way to load plugins without instantiating them. domclass = domclassTest(None, None, None) diff --git a/ooni/protocols/http.py b/ooni/protocols/http.py index 5254a5c..2b38f28 100644 --- a/ooni/protocols/http.py +++ b/ooni/protocols/http.py @@ -40,12 +40,17 @@ class HTTPTest(OONITest): and once the request body has been received. """ randomize_ua = True + follow_redirects = False def initialize(self): from twisted.web.client import Agent import yaml self.agent = Agent(self.reactor) + if self.follow_redirects: + from twisted.web.client import RedirectAgent + self.agent = RedirectAgent(self.agent) + self.request = {} self.response = {}

1 0

[stem/master] Better validation of controller's from_port() function
by atagar＠torproject.org 22 Aug '12

22 Aug '12

commit a6c5a063d1f963a53e012b4c31478f90dea0d795 Author: Damian Johnson <atagar(a)torproject.org> Date: Fri Aug 17 10:24:16 2012 -0700 Better validation of controller's from_port() function I scratched my head due to an awefully misleading stacktrace when I passed a port value into the method's argument slot. Validating the inputs to avoid having this cause confusion in the future. Before: Traceback (most recent call last): File "<stdin>", line 1, in <module> File "test/prompt.py", line 67, in controller controller = stem.control.Controller.from_port(CONTROL_PORT) File "stem/control.py", line 457, in from_port control_port = stem.socket.ControlPort(control_addr, control_port) File "stem/socket.py", line 287, in __init__ if connect: self.connect() File "stem/socket.py", line 171, in connect self._socket = self._make_socket() File "stem/socket.py", line 311, in _make_socket control_socket.connect((self._control_addr, str(self._control_port))) File "/usr/lib/python2.7/socket.py", line 224, in meth return getattr(self._sock,name)(*args) TypeError: coercing to Unicode: need string or buffer, int found After: Traceback (most recent call last): File "<stdin>", line 1, in <module> File "test/prompt.py", line 67, in controller controller = stem.control.Controller.from_port(CONTROL_PORT) File "stem/control.py", line 459, in from_port raise ValueError("Invalid ip address: %s" % control_addr) ValueError: Invalid ip address: 2779 --- stem/control.py | 6 ++++++ stem/util/connection.py | 2 ++ 2 files changed, 8 insertions(+), 0 deletions(-) diff --git a/stem/control.py b/stem/control.py index aca6f41..dd5f812 100644 --- a/stem/control.py +++ b/stem/control.py @@ -48,6 +48,7 @@ import threading import stem.response import stem.socket import stem.version +import stem.util.connection import stem.util.log as log # state changes a control socket can have @@ -454,6 +455,11 @@ class Controller(BaseController): :raises: :class:`stem.socket.SocketError` if we're unable to establish a connection """ + if not stem.util.connection.is_valid_ip_address(control_addr): + raise ValueError("Invalid IP address: %s" % control_addr) + elif not stem.util.connection.is_valid_port(control_port): + raise ValueError("Invalid port: %s" % control_port) + control_port = stem.socket.ControlPort(control_addr, control_port) return Controller(control_port) diff --git a/stem/util/connection.py b/stem/util/connection.py index eda3569..02201bb 100644 --- a/stem/util/connection.py +++ b/stem/util/connection.py @@ -39,6 +39,8 @@ def is_valid_ip_address(address): :returns: True if input is a valid IPv4 address, False otherwise """ + if not isinstance(address, str): return False + # checks if theres four period separated values if address.count(".") != 3: return False

1 0

[stem/master] Caching parsed controller version
by atagar＠torproject.org 22 Aug '12

22 Aug '12

commit 2a34547cc6dc157617c4a485d7e9e41816d46e66 Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Aug 6 08:45:07 2012 -0700 Caching parsed controller version Our controller version is something that we'll frequently look up. There's no reason to leave it uncached. --- stem/control.py | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletions(-) diff --git a/stem/control.py b/stem/control.py index 673261c..6fed090 100644 --- a/stem/control.py +++ b/stem/control.py @@ -627,7 +627,13 @@ class Controller(BaseController): * ValueError if unable to parse the version """ - return stem.version.Version(self.get_info("version")) + if not self.is_caching_enabled(): + return stem.version.Version(self.get_info("version")) + elif not "version" in self._request_cache: + version = stem.version.Version(self.get_info("version")) + self._request_cache["version"] = version + + return self._request_cache["version"] def authenticate(self, *args, **kwargs): """

1 0