tor-commits January 2013

tor-commits@lists.torproject.org

19 participants
1125 discussions

[tor/master] start folding in the changes entries
by arma＠torproject.org 14 Jan '13

14 Jan '13

commit 19d37202362c0298ae2f3954b0065ccfcef0dbda Author: Roger Dingledine <arma(a)torproject.org> Date: Mon Jan 14 13:34:59 2013 -0500 start folding in the changes entries --- ChangeLog | 126 +++++++++++++++++++++++++++++++++++++++++++ changes/bug7157 | 26 --------- changes/bug7341 | 7 --- changes/bug7799.ratelim | 6 -- changes/bug7814 | 4 -- changes/bug7836 | 5 -- changes/bug7935 | 4 -- changes/clang_enum_warnings | 3 - changes/dh_benchmarks | 3 - changes/dirguards | 8 --- changes/ntor | 40 -------------- changes/tls_ecdhe | 26 --------- src/or/connection.c | 3 +- src/or/relay.c | 8 +++ 14 files changed, 136 insertions(+), 133 deletions(-) diff --git a/ChangeLog b/ChangeLog index 4998730..03ed907 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,129 @@ +Changes in version 0.2.4.8-alpha - 2013-01-14 + + o Major features: + - Preliminary support for directory guards (proposal 207): when + possible, clients now use their entry guards for non-anonymous + directory requests. This can help prevent client enumeration. Note + that this behavior only works when we have a usable consensus + directory: and when options about what to download are more or + less standard. Resolves ticket 6526. + - Tor servers and clients now support a better CREATE/EXTEND cell + format, allowing the sender to specify multiple address, identity, + and handshake types. Implements Robert Ransom's proposal 200; + closes ticket 7199. + + o Major features (new circuit handshake): + - Tor now supports a new circuit extension handshake designed by Ian + Goldberg, Douglas Stebila, and Berkant Ustaoglu. Our original + circuit extension handshake, later called "TAP", was a bit slow + (especially on the server side), had a fragile security proof, and + used weaker keys than we'd now prefer. The new circuit handshake + uses Dan Bernstein's "curve25519" elliptic-curve Diffie-Hellman + function, making it significantly more secure than the older + handshake, and significantly faster. Tor can use one of two built-in + pure-C curve25519-donna implementations by Adam Langley, or it + can link against the "nacl" library for a tuned version if present. + + The built-in version is very fast for 64-bit systems when building + with GCC. The built-in 32-bit version is still faster than the + old TAP protocol, but using libnacl is better on most such hosts. + + Clients don't currently use this protocol by default, since + comparatively few clients support it so far. To try it, set + UseNTorHandshake to 1. + + Implements proposal 216; closes ticket 7202. + + o Major features (better link encryption): + - Servers can now enable the ECDHE TLS ciphersuites when available + and appropriate. These ciphersuites let us negotiate forward- + secure TLS secret keys more safely and more efficiently than with + our previous use of Diffie-Hellman modulo a 1024-bit prime. + By default, public servers prefer the (faster) P224 group, and + bridges prefer the (more common) P256 group; you can override this + with the TLSECGroup option. + + Enabling these ciphers was a little tricky, since for a long time, + clients had been claiming to support them without actually doing + so, in order to foil fingerprinting. But with the client-side + implementation of proposal 198 in 0.2.3.17-beta, clients can now + match the ciphers from recent Firefox versions *and* list the + ciphers they actually mean, so servers can believe such clients + when they advertise ECDHE support in their TLS ClientHello messages. + + This feature requires clients running 0.2.3.17-beta or later, + and requires both sides to be running OpenSSL 1.0.0 or later + with ECC support. OpenSSL 1.0.1, with the compile-time option + "enable-ec_nistp_64_gcc_128", is highly recommended. Implements + the server side of proposal 198; closes ticket 7200. + + o Major bugfixes: + - Avoid crashing when, as a node without IPv6-exit support, a + client insists on getting an IPv6 address or nothing. Fixes bug + 7814; bugfix on 0.2.4.7-alpha. + + o Minor features: + - Improve circuit build timeout handling for hidden services. + In particular: adjust build timeouts more accurately depending + upon the number of hop-RTTs that a particular circuit type + undergoes. Additionally, launch intro circuits in parallel + if they timeout, and take the first one to reply as valid. + - Work correctly on unix systems where EAGAIN and EWOULDBLOCK are + separate error codes--or at least, don't break for that reason. + Fixes bug 7935. Reported by "oftc_must_be_destroyed". + + o Minor features (testing): + - Add benchmarks for DH (1024-bit multiplicative group) and ECDH + (P-256) diffie-hellman handshakes to src/or/bench. + - Add benchmark functions to test onion handshake performance. + + o Minor features (path bias detection): + - Alter the Path Bias log messages to be more descriptive in terms + of reporting timeouts and other statistics. + - Create three levels of Path Bias log messages, as opposed to just + two. These are configurable via consensus as well as via the torrc + options PathBiasNoticeRate, PathBiasWarnRate, PathBiasExtremeRate. + The default values are 0.70, 0.50, and 0.30 respectively. + - Separate the log message levels from the decision to drop guards, + which also is available via torrc option PathBiasDropGuards. + PathBiasDropGuards still defaults to 0 (off). + - Deprecate PathBiasDisableRate in favor of PathBiasDropGuards + in combination with PathBiasExtremeRate. + - Increase the default values for PathBiasScaleThreshold and + PathBiasCircThreshold from (200, 20) to (300, 150). + - Add in circuit usage accounting to path bias. If we try to use a + built circuit but fail for any reason, it counts as path bias. + Certain classes of circuits where the adversary gets to pick your + destination node are exempt from this accounting. Usage accounting + can be specifically disabled via consensus parameter or torrc. + - Convert all internal path bias state to double-precision floating + point, to avoid roundoff error and other issues. + - Only record path bias information for circuits that have completed + *two* hops. Assuming end-to-end tagging is the attack vector, this + makes us more resilient to ambient circuit failure without any + detection capability loss. + + o Minor bugfixes: + - Rate-limit the "No circuits are opened. Relaxed timeout for a + circuit with channel state open..." message to once per hour to + keep it from filling the notice logs. Mitigates bug 7799 but does + not fix the underlying cause. Bugfix on 0.2.4.7-alpha. + - Avoid spurious warnings when configuring multiple client ports of + which only some are nonlocal. Previously, we had claimed that some + were nonlocal when in fact they weren't. Fixes bug 7836; bugfix on + 0.2.3.3-alpha. + + o Code simplifications and refactoring: + - Get rid of a couple of harmless clang warnings, where we compared + enums to ints. These warnings are newly introduced in clang 3.2. + - Split the onion.c file into separate modules for the onion queue + and the different handshakes it supports. + - Remove the marshalling/unmarshalling code for sending requests to + cpuworkers over a socket, and instead just send structs. The + recipient will always be the same Tor binary as the sender, so + any encoding is overkill. + + Changes in version 0.2.4.7-alpha - 2012-12-24 Tor 0.2.4.7-alpha introduces a new approach to providing fallback directory mirrors for more robust bootstrapping; fixes more issues where diff --git a/changes/bug7157 b/changes/bug7157 deleted file mode 100644 index 4f0e3b3..0000000 --- a/changes/bug7157 +++ /dev/null @@ -1,26 +0,0 @@ - - o Minor features: - - Alter the Path Bias log messages to be more descriptive in terms - of reporting timeouts and other statistics. - - Create three levels of Path Bias log messages, as opposed to just - two. These are configurable via consensus as well as via torrc - options PathBiasNoticeRate, PathBiasWarnRate, PathBiasExtremeRate. - The default values are 0.70, 0.50, and 0.30 respectively. - - Separate the log message levels from the decision to drop guards, - which also is available via torrc option PathBiasDropGuards. - PathBiasDropGuards defaults to 0 (off). - - Deprecate PathBiasDisableRate in favor of PathBiasDropGuards - in combination with PathBiasExtremeRate. - - Increase the default values for PathBiasScaleThreshold and - PathBiasCircThreshold from 200 and 20 to 300 and 150, respectively. - - Add in circuit usage accounting to path bias. If we try to use a - built circuit but fail for any reason, it counts as path bias. - Certain classes of circuits where the adversary gets to pick your - destination node are exempt from this accounting. Usage accounting - can be specifically disabled via consensus parameter or torrc. - - Convert all internal path bias state to double-precision floating - point, to avoid roundoff error and other issues. - - Only record path bias information for circuits that have completed - *two* hops. Assuming end-to-end tagging is the attack vector, this - makes us more resilient to ambient circuit failure without any - detection capability loss. diff --git a/changes/bug7341 b/changes/bug7341 deleted file mode 100644 index 7f046d2..0000000 --- a/changes/bug7341 +++ /dev/null @@ -1,7 +0,0 @@ - - o Minor features: - - Improve circuit build timeout handling for hidden services. - In particular: adjust build timeouts more accurately depending - upon the number of hop-RTTs that a particular circuit type - undergoes. Additionally, launch intro circuits in parallel - if they timeout, and take the first one to reply as valid. diff --git a/changes/bug7799.ratelim b/changes/bug7799.ratelim deleted file mode 100644 index cb7742c..0000000 --- a/changes/bug7799.ratelim +++ /dev/null @@ -1,6 +0,0 @@ - o Minor bugfixes: - - Rate-limit the "No circuits are opened. Relaxed timeout for a - circuit with channel state open..." message to once per hour to - keep it from filling the notice logs. Mitigates bug 7799 but does - not fix the underlying cause. Bugfix on 0.2.4.7-alpha. - diff --git a/changes/bug7814 b/changes/bug7814 deleted file mode 100644 index 7ecc242..0000000 --- a/changes/bug7814 +++ /dev/null @@ -1,4 +0,0 @@ - o Major bugfixes: - - Avoid crashing when, as a node without IPv6-exit support, a - client insists on getting an IPv6 address or nothing. Fixes bug - #7814; bugfix on 0.2.4.7-alpha. diff --git a/changes/bug7836 b/changes/bug7836 deleted file mode 100644 index 730d807..0000000 --- a/changes/bug7836 +++ /dev/null @@ -1,5 +0,0 @@ - o Minor bugfixes: - - Avoid spurious warnings when configuring multiple client ports of - which only some are nonlocal. Previously, we had claimed that some - were nonlocal when in fact they weren't. Fixes bug 7836; bugfix on - 0.2.3.3-alpha. diff --git a/changes/bug7935 b/changes/bug7935 deleted file mode 100644 index ef91001..0000000 --- a/changes/bug7935 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor features (portability): - - Work correctly on unix systems where EAGAIN and EWOULDBLOCK are - separate error codes--or at least, don't break for that reason. - Fixes bug 7935. Reported by "oftc_must_be_destroyed". diff --git a/changes/clang_enum_warnings b/changes/clang_enum_warnings deleted file mode 100644 index 50de605..0000000 --- a/changes/clang_enum_warnings +++ /dev/null @@ -1,3 +0,0 @@ - o Code simplifications and refactoring: - - Get rid of a couple of harmless clang warnings, where we compared - enums to ints. These warnings are newly introduced in clang 3.2. diff --git a/changes/dh_benchmarks b/changes/dh_benchmarks deleted file mode 100644 index 2301995..0000000 --- a/changes/dh_benchmarks +++ /dev/null @@ -1,3 +0,0 @@ - o Minor features (testing): - - Add benchmarks for DH (1024-bit multiplicative group) and ECDH - (P-256) diffie-hellman handshakes to src/or/bench. diff --git a/changes/dirguards b/changes/dirguards deleted file mode 100644 index 942ae6c..0000000 --- a/changes/dirguards +++ /dev/null @@ -1,8 +0,0 @@ - o Major features: - - Preliminary support for directory guards: when possible, - clients now use guards for non-anonymous directory requests. - This can help prevent client enumeration. Note that this - behavior only works when we have a usable consensus directory: - and when options about what to download are more or less - standard. Implements proposal 207; closes ticket 6526. - diff --git a/changes/ntor b/changes/ntor deleted file mode 100644 index 3aca820..0000000 --- a/changes/ntor +++ /dev/null @@ -1,40 +0,0 @@ - o Major features: - - - Tor now supports a new circuit extension handshake designed by Ian - Goldberg, Douglas Stebila, and Berkant Ustaoglu. Our original - circuit extension handshake, later called "TAP", was a bit slow - (especially on the server side), had a fragile security proof, and - used weaker keys than we'd now prefer. The new circuit handshake - uses Dan Bernstein's "curve25519" elliptic-curve Diffie-Hellman - function, making it significantly more secure than the older - handshake, and significantly faster. Tor can either use one of two - built-in pure-C curve25519-donna implementations by Adam Langley, - or link against the "nacl" library for a tuned version if present. - - The built-in version is very fast for 64-bit systems building with - GCC. (About 10-14x faster on the server side, and about 7x faster - on the client side.) The built-in 32-bit version is still faster - than the old TAP protocol (about 3x), but using libnacl would be - better on most 32-bit x86 hosts. - - Clients don't currently use this protocol by default, since - comparatively few clients support it so far. To try it, set - UseNTorHandshake to 1. - - Implements proposal 216; closes ticket #7202. - - - Tor servers and clients now support a better CREATE/EXTEND cell - format, allowing the sender to specify multiple address, identity, - and handshake types. Implements Robert Ransom's proposal 200; - closes ticket #7199. - - o Code simplification and refactoring: - - Split the onion.c file into separate modules for the onion queue - and the different handshakes it supports. - - Remove the marshalling/unmarshalling code for sending requests to - cpuworkers over a socket, and instead just send structs. The - recipient will always be the same Tor binary as the sender, so - any encoding is overkill. - - o Testing: - - Add benchmark functions to test onion handshake performance. diff --git a/changes/tls_ecdhe b/changes/tls_ecdhe deleted file mode 100644 index 48c6384..0000000 --- a/changes/tls_ecdhe +++ /dev/null @@ -1,26 +0,0 @@ - o Major features: - - - Servers can now enable the ECDHE TLS ciphersuites when available - and appropriate. These ciphersuites let us negotiate forward- - secure TLS secret keys more safely and more efficiently than with - our previous use of Diffie Hellman modulo a 1024-bit prime. - By default, public servers prefer the (faster) P224 group, and - bridges prefer the (more common) P256 group; you can override this - with the TLSECGroup option. - - Enabling these ciphers was a little tricky, since for a long - time, clients had been claiming to support them without - actually doing so, in order to foil fingerprinting. But with - the client-side implementation of proposal 198 in - 0.2.3.17-beta, clients can now match the ciphers from recent - firefox versions *and* list the ciphers they actually mean, so - servers can believe such clients when they advertise ECDHE - support in their TLS ClientHello messages. - - This feature requires clients running 0.2.3.17-beta or later, - and requires both sides to be running OpenSSL 1.0.0 or later - with ECC support. OpenSSL 1.0.1, with the compile-time option - "enable-ec_nistp_64_gcc_128", is highly recommended. - Implements the server side of proposal 198; closes ticket - 7200. - diff --git a/src/or/connection.c b/src/or/connection.c index 740462e..42ff7e1 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -1245,6 +1245,7 @@ connection_handle_listener_read(connection_t *conn, int new_type) if (!SOCKET_OK(news)) { /* accept() error */ int e = tor_socket_errno(conn->s); if (ERRNO_IS_ACCEPT_EAGAIN(e)) { + log_notice(LD_APP, "he hung up before we could accept(). that's fine."); return 0; /* he hung up before we could accept(). that's fine. */ } else if (ERRNO_IS_ACCEPT_RESOURCE_LIMIT(e)) { warn_too_many_conns(); @@ -1256,7 +1257,7 @@ connection_handle_listener_read(connection_t *conn, int new_type) connection_mark_for_close(conn); return -1; } - log_debug(LD_NET, + log_notice(LD_NET, "Connection accepted on socket %d (child of fd %d).", (int)news,(int)conn->s); diff --git a/src/or/relay.c b/src/or/relay.c index a942e44..874aade 100644 --- a/src/or/relay.c +++ b/src/or/relay.c @@ -1619,6 +1619,14 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial, conn->base_.s, (int)length, (int)connection_get_inbuf_len(TO_CONN(conn))); + if (conn->base_.type == CONN_TYPE_AP) { + char *text = tor_memdup(payload, length+1); + text[length] = 0; + log_notice(LD_APP, "Incoming socks text (%d):===\n%s\n===", + conn->base_.s, text); + tor_free(text); + } + if (sending_optimistically && !sending_from_optimistic) { /* This is new optimistic data; remember it in case we need to detach and retry */

1 0

[torspec/master] Clarify contents of pre-method-9 footers
by nickm＠torproject.org 14 Jan '13

14 Jan '13

commit 5eb3b9bbeae591e3a858566b8e0cfc8964ca2495 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 14 12:49:55 2013 -0500 Clarify contents of pre-method-9 footers bug 7932 --- dir-spec.txt | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/dir-spec.txt b/dir-spec.txt index ca5434b..40ec304 100644 --- a/dir-spec.txt +++ b/dir-spec.txt @@ -1487,7 +1487,9 @@ "directory-footer" NL It contains two subsections, a bandwidths-weights line and a - directory-signature. + directory-signature. (Prior to conensus method 9, footers only contained + directory-signatures without a 'directory-footer' line or + bandwidth-weights.) The bandwidths-weights line appears At Most Once for a consensus. It does not appear in votes.

1 0

[tor/master] Merge branch 'bug7869'
by nickm＠torproject.org 14 Jan '13

14 Jan '13

commit c9242f4fd4c0ae783946db77b9ecc6214d41bd72 Merge: d357b97 31d888c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jan 14 12:32:00 2013 -0500 Merge branch 'bug7869' src/common/crypto_curve25519.c | 30 ++++++++++++++++++++++++++++++ src/common/crypto_curve25519.h | 7 +++++++ src/or/routerparse.c | 25 ++++++++----------------- src/test/test_crypto.c | 37 +++++++++++++++++++++++++++++++++++++ 4 files changed, 82 insertions(+), 17 deletions(-)

1 0

[tor/master] Make the = at the end of ntor-onion-key optional.
by nickm＠torproject.org 14 Jan '13

14 Jan '13

commit 31d888c834b135d8f36ceec181f3d1ea7af62267 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Jan 5 22:53:32 2013 -0500 Make the = at the end of ntor-onion-key optional. Makes bug 7869 more easily fixable if we ever choose to do so. --- src/common/crypto_curve25519.c | 30 ++++++++++++++++++++++++++++++ src/common/crypto_curve25519.h | 7 +++++++ src/or/routerparse.c | 25 ++++++++----------------- src/test/test_crypto.c | 37 +++++++++++++++++++++++++++++++++++++ 4 files changed, 82 insertions(+), 17 deletions(-) diff --git a/src/common/crypto_curve25519.c b/src/common/crypto_curve25519.c index a4ab65c..aead4f8 100644 --- a/src/common/crypto_curve25519.c +++ b/src/common/crypto_curve25519.c @@ -178,3 +178,33 @@ curve25519_handshake(uint8_t *output, curve25519_impl(output, skey->secret_key, pkey->public_key); } +int +curve25519_public_to_base64(char *output, + const curve25519_public_key_t *pkey) +{ + char buf[128]; + base64_encode(buf, sizeof(buf), + (const char*)pkey->public_key, CURVE25519_PUBKEY_LEN); + buf[CURVE25519_BASE64_PADDED_LEN] = '\0'; + memcpy(output, buf, CURVE25519_BASE64_PADDED_LEN+1); + return 0; +} + +int +curve25519_public_from_base64(curve25519_public_key_t *pkey, + const char *input) +{ + size_t len = strlen(input); + if (len == CURVE25519_BASE64_PADDED_LEN - 1) { + /* not padded */ + return digest256_from_base64((char*)pkey->public_key, input); + } else if (len == CURVE25519_BASE64_PADDED_LEN) { + char buf[128]; + if (base64_decode(buf, sizeof(buf), input, len) != CURVE25519_PUBKEY_LEN) + return -1; + memcpy(pkey->public_key, buf, CURVE25519_PUBKEY_LEN); + return 0; + } else { + return -1; + } +} diff --git a/src/common/crypto_curve25519.h b/src/common/crypto_curve25519.h index e768b8c..9c732b9 100644 --- a/src/common/crypto_curve25519.h +++ b/src/common/crypto_curve25519.h @@ -51,6 +51,13 @@ int curve25519_keypair_read_from_file(curve25519_keypair_t *keypair_out, char **tag_out, const char *fname); +#define CURVE25519_BASE64_PADDED_LEN 44 + +int curve25519_public_from_base64(curve25519_public_key_t *pkey, + const char *input); +int curve25519_public_to_base64(char *output, + const curve25519_public_key_t *pkey); + #ifdef CRYPTO_CURVE25519_PRIVATE int curve25519_impl(uint8_t *output, const uint8_t *secret, const uint8_t *basepoint); diff --git a/src/or/routerparse.c b/src/or/routerparse.c index c873784..dca4176 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -1288,18 +1288,14 @@ router_parse_entry_from_string(const char *s, const char *end, tok->key = NULL; /* Prevent free */ if ((tok = find_opt_by_keyword(tokens, K_ONION_KEY_NTOR))) { - uint8_t k[CURVE25519_PUBKEY_LEN+32]; - int r; + curve25519_public_key_t k; tor_assert(tok->n_args >= 1); - r = base64_decode((char*)k, sizeof(k), tok->args[0], strlen(tok->args[0])); - if (r != CURVE25519_PUBKEY_LEN) { - log_warn(LD_DIR, "Bogus onion-key-ntor in routerinfo"); + if (curve25519_public_from_base64(&k, tok->args[0]) < 0) { + log_warn(LD_DIR, "Bogus ntor-onion-key in routerinfo"); goto err; } router->onion_curve25519_pkey = - tor_malloc(sizeof(curve25519_public_key_t)); - memcpy(router->onion_curve25519_pkey->public_key, - k, CURVE25519_PUBKEY_LEN); + tor_memdup(&k, sizeof(curve25519_public_key_t)); } tok = find_by_keyword(tokens, K_SIGNING_KEY); @@ -4264,19 +4260,14 @@ microdescs_parse_from_string(const char *s, const char *eos, tok->key = NULL; if ((tok = find_opt_by_keyword(tokens, K_ONION_KEY_NTOR))) { - uint8_t k[CURVE25519_PUBKEY_LEN+32]; - int r; + curve25519_public_key_t k; tor_assert(tok->n_args >= 1); - r = base64_decode((char*)k, sizeof(k), - tok->args[0], strlen(tok->args[0])); - if (r != CURVE25519_PUBKEY_LEN) { - log_warn(LD_DIR, "Bogus onion-key-ntor in microdesc"); + if (curve25519_public_from_base64(&k, tok->args[0]) < 0) { + log_warn(LD_DIR, "Bogus ntor-onion-key in microdesc"); goto next; } md->onion_curve25519_pkey = - tor_malloc(sizeof(curve25519_public_key_t)); - memcpy(md->onion_curve25519_pkey->public_key, - k, CURVE25519_PUBKEY_LEN); + tor_memdup(&k, sizeof(curve25519_public_key_t)); } { diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index 67d2b83..0c846b6 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -1008,6 +1008,42 @@ test_crypto_curve25519_wrappers(void *arg) } static void +test_crypto_curve25519_encode(void *arg) +{ + curve25519_secret_key_t seckey; + curve25519_public_key_t key1, key2, key3; + char buf[64]; + + (void)arg; + + curve25519_secret_key_generate(&seckey, 0); + curve25519_public_key_generate(&key1, &seckey); + tt_int_op(0, ==, curve25519_public_to_base64(buf, &key1)); + tt_int_op(CURVE25519_BASE64_PADDED_LEN, ==, strlen(buf)); + + tt_int_op(0, ==, curve25519_public_from_base64(&key2, buf)); + test_memeq(key1.public_key, key2.public_key, CURVE25519_PUBKEY_LEN); + + buf[CURVE25519_BASE64_PADDED_LEN - 1] = '\0'; + tt_int_op(CURVE25519_BASE64_PADDED_LEN-1, ==, strlen(buf)); + tt_int_op(0, ==, curve25519_public_from_base64(&key3, buf)); + test_memeq(key1.public_key, key3.public_key, CURVE25519_PUBKEY_LEN); + + /* Now try bogus parses. */ + strlcpy(buf, "$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$=", sizeof(buf)); + tt_int_op(-1, ==, curve25519_public_from_base64(&key3, buf)); + + strlcpy(buf, "$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$", sizeof(buf)); + tt_int_op(-1, ==, curve25519_public_from_base64(&key3, buf)); + + strlcpy(buf, "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", sizeof(buf)); + tt_int_op(-1, ==, curve25519_public_from_base64(&key3, buf)); + + done: + ; +} + +static void test_crypto_curve25519_persist(void *arg) { curve25519_keypair_t keypair, keypair2; @@ -1100,6 +1136,7 @@ struct testcase_t crypto_tests[] = { #ifdef CURVE25519_ENABLED { "curve25519_impl", test_crypto_curve25519_impl, 0, NULL, NULL }, { "curve25519_wrappers", test_crypto_curve25519_wrappers, 0, NULL, NULL }, + { "curve25519_encode", test_crypto_curve25519_encode, 0, NULL, NULL }, { "curve25519_persist", test_crypto_curve25519_persist, 0, NULL, NULL }, #endif END_OF_TESTCASES

1 0

[atlas/master] strip whitespaces in search
by karsten＠torproject.org 14 Jan '13

14 Jan '13

commit 5d6e5dab309472aea06d580dbc96ba50e9c2ed00 Author: Sathyanarayanan Gunasekaran <gsathya.ceg(a)gmail.com> Date: Fri Jan 4 22:05:07 2013 +0530 strip whitespaces in search --- js/router.js | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/js/router.js b/js/router.js index 3fd4a8b..543b8b4 100644 --- a/js/router.js +++ b/js/router.js @@ -105,6 +105,7 @@ define([ $("#nav-search").submit(function(e){ var query = _.escape($(this).children("input.search-query").val()); + query = query.trim(); console.log(query); $("#suggestion").hide(); document.location = "#search/"+query;

1 0

[atlas/master] Merge branch 'task-7861'
by karsten＠torproject.org 14 Jan '13

14 Jan '13

commit 8f0772de00ceb08da1de5b699897c5c31b03c3f6 Merge: 20ee699 5d6e5da Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Mon Jan 14 10:27:36 2013 +0100 Merge branch 'task-7861' js/router.js | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)

1 0

[compass/master] Fix for #7924.
by karsten＠torproject.org 14 Jan '13

14 Jan '13

commit 8c2259c944f8e737a7728c74e9e5dcd3e8534bf2 Author: Chris Wacek <cwacek(a)cs.georgetown.edu> Date: Fri Jan 11 11:11:28 2013 -0500 Fix for #7924. AS filters weren't being correctly treated as lists. Now they are. --- app.py | 6 +++--- templates/index.html | 6 +++--- util.py | 8 +++++++- 3 files changed, 13 insertions(+), 7 deletions(-) diff --git a/app.py b/app.py index f323ebc..45217a6 100644 --- a/app.py +++ b/app.py @@ -1,7 +1,7 @@ import os import re import compass -from util import Result,Boolean,NullFn,Int,Container,ResultEncoder +from util import Result,Boolean,NullFn,Int,List,ResultEncoder,JSON import json from flask import Flask, request, jsonify, render_template,Response @@ -19,8 +19,8 @@ class Opt(object): 'sort_reverse':Boolean, 'top':Int, 'family':NullFn, - 'ases':NullFn, - 'country':Container, + 'ases':List, + 'country':JSON, 'exit_filter':NullFn } diff --git a/templates/index.html b/templates/index.html index 158ae53..1800c7a 100644 --- a/templates/index.html +++ b/templates/index.html @@ -285,9 +285,9 @@ <script src="static/js/jquery-1.8.0.min.js"></script> <script src="static/js/bootstrap.min.js"></script> <script src="static/js/bootstrap-tooltip.js"></script> - <script src="static/lib/select2/select2.js" type="text/javascript"></script> - <script src="static/js/angular/angular.js"> </script> - <script src="static/lib/angular-ui/angular-ui.js"></script> + <script src="static/lib/select2/select2.min.js" type="text/javascript"></script> + <script src="static/js/angular/angular.min.js"> </script> + <script src="static/lib/angular-ui/angular-ui.min.js"></script> <script src="static/js/directives.js"></script> <script src="static/js/filters.js"></script> <script src="static/js/angularize.js"></script> diff --git a/util.py b/util.py index 2ae6a37..73c24db 100644 --- a/util.py +++ b/util.py @@ -1,11 +1,17 @@ import json +import shlex -def Container(val): +def JSON(val): try: return json.loads(val) except ValueError: return [] +def List(val): + lex = shlex.shlex(val) + lex.whitespace += "[]," + return list(lex) + def NullFn(val): return val

1 0

[arm/master] Dropping the test module
by atagar＠torproject.org 14 Jan '13

14 Jan '13

commit a600654c018ed4655cc78663f789353cd4944f39 Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Jan 13 20:00:39 2013 -0800 Dropping the test module 'Test' had always been the wrong word for this module. It was a demo module, for quickly running various utilities. As those utilities move to stem this module has both fallen out of date and become kinda pointless. Stem's unit/integ tests are better. :) --- src/__init__.py | 2 +- src/test.py | 144 ------------------------------------------------------- 2 files changed, 1 insertions(+), 145 deletions(-) diff --git a/src/__init__.py b/src/__init__.py index ee848ac..461b0ce 100644 --- a/src/__init__.py +++ b/src/__init__.py @@ -2,5 +2,5 @@ Scripts involved in validating user input, system state, and initializing arm. """ -__all__ = ["starter", "prereq", "version", "test"] +__all__ = ["starter", "prereq", "version"] diff --git a/src/test.py b/src/test.py deleted file mode 100644 index 10eddb0..0000000 --- a/src/test.py +++ /dev/null @@ -1,144 +0,0 @@ -#!/usr/bin/env python - -""" -Handler for arm tests and demos. -""" - -import time -from util import connections, torTools, uiTools - -MENU = """Arm Test Options: - 1. Resolver Performance Test - 2. Resolver Dump - 3. Glyph Demo - 4. Exit Policy Check - q. Quit - -Selection: """ - -def printDivider(): - print("\n" + "-" * 40 + "\n") - -conn = None -while True: - userInput = raw_input(MENU) - - # initiate the stem connection if the test needs it - if userInput in ("1", "2", "4") and not conn: - conn = torTools.getConn() - conn.init() - - # prefetch pid so extra system calls don't effect the timing of tests - conn.getMyPid() - - if userInput == "q": - break # quit test script - elif userInput == "1": - systemResolvers = connections.getSystemResolvers() - printDivider() - - allConnectionResults = [] - for resolver in systemResolvers: - startTime = time.time() - connectionResults = connections.getConnections(resolver, "tor", conn.getMyPid()) - connectionResults.sort() - allConnectionResults.append(connectionResults) - - resolverLabel = "%-10s" % resolver - countLabel = "%4i results" % len(connectionResults) - timeLabel = "%0.4f seconds" % (time.time() - startTime) - print "%s %s %s" % (resolverLabel, countLabel, timeLabel) - - allResolversMatch = True - firstResult = allConnectionResults.pop() - while allConnectionResults: - if allConnectionResults.pop() != firstResult: - allResolversMatch = False - break - - if allResolversMatch: - print("\nThe results of all the connection resolvers match") - else: - print("\nWarning: Connection resolver results differ") - - printDivider() - elif userInput == "2": - # use the given resolver to fetch tor's connections - while True: - # provide the selection options - printDivider() - print("Select a resolver:") - availableResolvers = list(connections.Resolver) - for i in range(len(availableResolvers)): - print(" %i. %s" % (i, availableResolvers[i])) - print(" q. Go back to the main menu") - - userSelection = raw_input("\nSelection: ") - if userSelection == "q": - printDivider() - break - - if userSelection.isdigit() and int(userSelection) in range(0, 7): - try: - resolver = list(connections.Resolver)[int(userSelection)] - startTime = time.time() - - print(connections.getResolverCommand(resolver, "tor", conn.getMyPid())) - connectionResults = connections.getConnections(resolver, "tor", conn.getMyPid()) - connectionResults.sort() - - # prints results - printDivider() - for lIp, lPort, fIp, fPort in connectionResults: - print(" %s:%s -> %s:%s" % (lIp, lPort, fIp, fPort)) - - print("\n Runtime: %0.4f seconds" % (time.time() - startTime)) - except (IOError, IndexError), exc: - print exc - else: - print("'%s' isn't a valid selection\n" % userSelection) - elif userInput == "3": - uiTools.demoGlyphs() - - # Switching to a curses context and back repeatedly seems to screw up the - # terminal. Just to be safe this ends the process after the demo. - break - elif userInput == "4": - # display the current exit policy and query if destinations are allowed by it - exitPolicy = conn.getExitPolicy() - print("Exit Policy: %s" % exitPolicy) - printDivider() - - while True: - # provide the selection options - userSelection = raw_input("\nCheck if destination is allowed (q to go back): ") - userSelection = userSelection.replace(" ", "").strip() # removes all whitespace - - isValidQuery, isExitAllowed = True, False - if userSelection == "q": - printDivider() - break - elif connections.isValidIpAddress(userSelection): - # just an ip address (use port 80) - isExitAllowed = exitPolicy.check(userSelection, 80) - elif userSelection.isdigit(): - # just a port (use a common ip like 4.2.2.2) - isExitAllowed = exitPolicy.check("4.2.2.2", userSelection) - elif ":" in userSelection: - # ip/port combination - ipAddr, port = userSelection.split(":", 1) - - if connections.isValidIpAddress(ipAddr) and port.isdigit(): - isExitAllowed = exitPolicy.check(ipAddr, port) - else: isValidQuery = False - else: isValidQuery = False # invalid input - - if isValidQuery: - resultStr = "is" if isExitAllowed else "is *not*" - print("Exiting %s allowed to that destination" % resultStr) - else: - print("'%s' isn't a valid destination (should be an ip, port, or ip:port)\n" % userSelection) - - else: - print("'%s' isn't a valid selection\n" % userInput) -

1 0

[arm/master] Using stem's ExitPolicy
by atagar＠torproject.org 14 Jan '13

14 Jan '13

commit 3232ce527da8b95cb78f3a52b19ad0634e1cd9da Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Jan 13 20:24:08 2013 -0800 Using stem's ExitPolicy Dropping our ExitPolicy class in favor of stem's. Besides the class replacement this also clears out a fair bit of our custom Controller. Stem provides caching and an easy method to fetch a policy from descriptors. The attempt by getRelayExitPolicy() to use router status entries to get an exit policy has always been broken. 'GETINFO ns/*' gives v2 router status entries, and the exit policy wasn't added until v3. --- src/cli/connections/connEntry.py | 2 +- src/cli/connections/connPanel.py | 5 +- src/util/torTools.py | 358 ++------------------------------------ 3 files changed, 21 insertions(+), 344 deletions(-) diff --git a/src/cli/connections/connEntry.py b/src/cli/connections/connEntry.py index bec5aa9..5b2eda5 100644 --- a/src/cli/connections/connEntry.py +++ b/src/cli/connections/connEntry.py @@ -714,7 +714,7 @@ class ConnectionLine(entries.ConnectionPanelLine): exitPolicy = conn.getRelayExitPolicy(fingerprint) - if exitPolicy: policyLabel = exitPolicy.getSummary() + if exitPolicy: policyLabel = exitPolicy.summary() else: policyLabel = "unknown" dirPortLabel = "" if dirPort == "0" else "dirport: %s" % dirPort diff --git a/src/cli/connections/connPanel.py b/src/cli/connections/connPanel.py index 9f3a5ed..79bc3b4 100644 --- a/src/cli/connections/connPanel.py +++ b/src/cli/connections/connPanel.py @@ -207,8 +207,11 @@ class ConnectionPanel(panel.Panel, threading.Thread): True if exit connections are permissable, false otherwise. """ + if not torTools.getOption("ORPort", None): + return False # no ORPort + policy = torTools.getConn().getExitPolicy() - return policy and policy.isExitingAllowed() + return policy and policy.is_exiting_allowed() def showSortDialog(self): """ diff --git a/src/util/torTools.py b/src/util/torTools.py index c050ea6..c8d12c5 100644 --- a/src/util/torTools.py +++ b/src/util/torTools.py @@ -58,9 +58,6 @@ REQ_EVENTS = {"NOTICE": "this will be unable to detect when tor is shut down", "NS": "information related to the consensus will grow stale", "NEWCONSENSUS": "information related to the consensus will grow stale"} -# ip address ranges substituted by the 'private' keyword -PRIVATE_IP_RANGES = ("0.0.0.0/8", "169.254.0.0/16", "127.0.0.0/8", "192.168.0.0/16", "10.0.0.0/8", "172.16.0.0/12") - # This prevents controllers from spawning worker threads (and by extension # notifying status listeners). This is important when shutting down to prevent # rogue threads from being alive during shutdown. @@ -286,10 +283,6 @@ class Controller: # is. self._notificationQueue = Queue.Queue() - self._exitPolicyChecker = None - self._isExitingAllowed = False - self._exitPolicyLookupCache = {} # mappings of ip/port tuples to if they were accepted by the policy or not - # Logs issues and notices when fetching the path prefix if true. This is # only done once for the duration of the application to avoid pointless # messages. @@ -333,10 +326,6 @@ class Controller: self._consensusLookupCache = {} self._descriptorLookupCache = {} - self._exitPolicyChecker = self.getExitPolicy() - self._isExitingAllowed = self._exitPolicyChecker.isExitingAllowed() - self._exitPolicyLookupCache = {} - self._status = State.INIT self._statusTime = time.time() @@ -495,12 +484,6 @@ class Controller: if not self.isAlive(): raise stem.SocketClosed() - # clears our exit policy chache if it's changing - if "exitpolicy" in [k.lower() for (k, v) in paramList]: - self._exitPolicyChecker = self.getExitPolicy() - self._isExitingAllowed = self._exitPolicyChecker.isExitingAllowed() - self._exitPolicyLookupCache = {} - self.controller.set_options(paramList, isReset) except stem.SocketClosed, exc: self.close() @@ -790,19 +773,16 @@ class Controller: result = False if self.isAlive(): - # query the policy if it isn't yet cached - if not (ipAddress, port) in self._exitPolicyLookupCache: - # If we allow any exiting then this could be relayed DNS queries, - # otherwise the policy is checked. Tor still makes DNS connections to - # test when exiting isn't allowed, but nothing is relayed over them. - # I'm registering these as non-exiting to avoid likely user confusion: - # https://trac.torproject.org/projects/tor/ticket/965 - - if self._isExitingAllowed and port == "53": isAccepted = True - else: isAccepted = self._exitPolicyChecker.check(ipAddress, port) - self._exitPolicyLookupCache[(ipAddress, port)] = isAccepted + # If we allow any exiting then this could be relayed DNS queries, + # otherwise the policy is checked. Tor still makes DNS connections to + # test when exiting isn't allowed, but nothing is relayed over them. + # I'm registering these as non-exiting to avoid likely user confusion: + # https://trac.torproject.org/projects/tor/ticket/965 + + our_policy = self.getExitPolicy() - result = self._exitPolicyLookupCache[(ipAddress, port)] + if our_policy and our_policy.is_exiting_allowed() and port == "53": result = True + else: result = our_policy and our_policy.can_exit_to(ipAddress, port) self.connLock.release() @@ -818,35 +798,10 @@ class Controller: result = None if self.isAlive(): - if self.getOption("ORPort", None): - policyEntries = [] - for exitPolicy in self.getOption("ExitPolicy", [], True): - policyEntries += [policy.strip() for policy in exitPolicy.split(",")] - - # appends the default exit policy - defaultExitPolicy = self.getInfo("exit-policy/default", None) - - if defaultExitPolicy: - policyEntries += defaultExitPolicy.split(",") - - # construct the policy chain backwards - policyEntries.reverse() - - for entry in policyEntries: - result = ExitPolicy(entry, result) - - # Checks if we are rejecting private connections. If set, this appends - # 'reject private' and 'reject <my ip>' to the start of our policy chain. - isPrivateRejected = self.getOption("ExitPolicyRejectPrivate", True) - - if isPrivateRejected: - myAddress = self.getInfo("address", None) - if myAddress: result = ExitPolicy("reject %s" % myAddress, result) - - result = ExitPolicy("reject private", result) - else: - # no ORPort is set so all relaying is disabled - result = ExitPolicy("reject *:*", None) + try: + result = self.controller.get_exit_policy(param) + except: + pass self.connLock.release() @@ -973,7 +928,7 @@ class Controller: return result - def getRelayExitPolicy(self, relayFingerprint, allowImprecision = True): + def getRelayExitPolicy(self, relayFingerprint): """ Provides the ExitPolicy instance associated with the given relay. The tor consensus entries don't indicate if private addresses are rejected or @@ -983,7 +938,6 @@ class Controller: Arguments: relayFingerprint - fingerprint of the relay - allowImprecision - make use of consensus policies as a fallback """ self.connLock.acquire() @@ -991,55 +945,10 @@ class Controller: result = None if self.isAlive(): # attempts to fetch the policy via the descriptor - descriptor = self.getDescriptorEntry(relayFingerprint) + descriptor = self.controller.get_server_descriptor(relayFingerprint, None) if descriptor: - exitPolicyEntries = [] - for line in descriptor.split("\n"): - if line.startswith("accept ") or line.startswith("reject "): - exitPolicyEntries.append(line) - - # construct the policy chain - for entry in reversed(exitPolicyEntries): - result = ExitPolicy(entry, result) - elif allowImprecision: - # Falls back to using the consensus entry, which is both less precise - # and unavailable with older tor versions. This assumes that the relay - # has ExitPolicyRejectPrivate set and won't include address-specific - # policies. - - consensusLine, relayAddress = None, None - - nsEntry = self.getConsensusEntry(relayFingerprint) - if nsEntry: - for line in nsEntry.split("\n"): - if line.startswith("r "): - # fetch the relay's public address, which we'll need for the - # ExitPolicyRejectPrivate policy entry - - lineComp = line.split(" ") - if len(lineComp) >= 7 and connections.isValidIpAddress(lineComp[6]): - relayAddress = lineComp[6] - elif line.startswith("p "): - consensusLine = line - break - - if consensusLine: - acceptance, ports = consensusLine.split(" ")[1:] - - # starts with a reject-all for whitelists and accept-all for blacklists - if acceptance == "accept": - result = ExitPolicy("reject *:*", None) - else: - result = ExitPolicy("accept *:*", None) - - # adds each of the ports listed in the consensus - for port in reversed(ports.split(",")): - result = ExitPolicy("%s *:%s" % (acceptance, port), result) - - # adds ExitPolicyRejectPrivate since this is the default - if relayAddress: result = ExitPolicy("reject %s" % relayAddress, result) - result = ExitPolicy("reject private", result) + result = descriptor.exit_policy self.connLock.release() @@ -1855,238 +1764,3 @@ class Controller: self.connLock.release() -class ExitPolicyIterator: - """ - Basic iterator for cycling through ExitPolicy entries. - """ - - def __init__(self, head): - self.head = head - - def next(self): - if self.head: - lastHead = self.head - self.head = self.head.nextRule - return lastHead - else: raise StopIteration - -class ExitPolicy: - """ - Single rule from the user's exit policy. These are chained together to form - complete policies. - """ - - def __init__(self, ruleEntry, nextRule): - """ - Exit policy rule constructor. - - Arguments: - ruleEntry - tor exit policy rule (for instance, "reject *:135-139") - nextRule - next rule to be checked when queries don't match this policy - """ - - # cached summary string - self.summaryStr = None - - # sanitize the input a bit, cleaning up tabs and stripping quotes - ruleEntry = ruleEntry.replace("\\t", " ").replace("\"", "") - - self.ruleEntry = ruleEntry - self.nextRule = nextRule - self.isAccept = ruleEntry.startswith("accept") - - # strips off "accept " or "reject " and extra spaces - ruleEntry = ruleEntry[7:].replace(" ", "") - - # split ip address (with mask if provided) and port - if ":" in ruleEntry: entryIp, entryPort = ruleEntry.split(":", 1) - else: entryIp, entryPort = ruleEntry, "*" - - # sets the ip address component - self.isIpWildcard = entryIp == "*" or entryIp.endswith("/0") - - # checks for the private alias (which expands this to a chain of entries) - if entryIp.lower() == "private": - entryIp = PRIVATE_IP_RANGES[0] - - # constructs the chain backwards (last first) - lastHop = self.nextRule - prefix = "accept " if self.isAccept else "reject " - suffix = ":" + entryPort - for addr in PRIVATE_IP_RANGES[-1:0:-1]: - lastHop = ExitPolicy(prefix + addr + suffix, lastHop) - - self.nextRule = lastHop # our next hop is the start of the chain - - if "/" in entryIp: - ipComp = entryIp.split("/", 1) - self.ipAddress = ipComp[0] - self.ipMask = int(ipComp[1]) - else: - self.ipAddress = entryIp - self.ipMask = 32 - - # constructs the binary address just in case of comparison with a mask - if self.ipAddress != "*": - self.ipAddressBin = "" - for octet in self.ipAddress.split("."): - # Converts the int to a binary string, padded with zeros. Source: - # http://www.daniweb.com/code/snippet216539.html - self.ipAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) - else: - self.ipAddressBin = "0" * 32 - - # sets the port component - self.minPort, self.maxPort = 0, 0 - self.isPortWildcard = entryPort == "*" - - if entryPort != "*": - if "-" in entryPort: - portComp = entryPort.split("-", 1) - self.minPort = int(portComp[0]) - self.maxPort = int(portComp[1]) - else: - self.minPort = int(entryPort) - self.maxPort = int(entryPort) - - # if both the address and port are wildcards then we're effectively the - # last entry so cut off the remaining chain - if self.isIpWildcard and self.isPortWildcard: - self.nextRule = None - - def isExitingAllowed(self): - """ - Provides true if the policy allows exiting whatsoever, false otherwise. - """ - - if self.isAccept: return True - elif self.isIpWildcard and self.isPortWildcard: return False - elif not self.nextRule: return False # fell off policy (shouldn't happen) - else: return self.nextRule.isExitingAllowed() - - def check(self, ipAddress, port): - """ - Checks if the rule chain allows exiting to this address, returning true if - so and false otherwise. - """ - - port = int(port) - - # does the port check first since comparing ip masks is more work - isPortMatch = self.isPortWildcard or (port >= self.minPort and port <= self.maxPort) - - if isPortMatch: - isIpMatch = self.isIpWildcard or self.ipAddress == ipAddress - - # expands the check to include the mask if it has one - if not isIpMatch and self.ipMask != 32: - inputAddressBin = "" - for octet in ipAddress.split("."): - inputAddressBin += "".join([str((int(octet) >> y) & 1) for y in range(7, -1, -1)]) - - isIpMatch = self.ipAddressBin[:self.ipMask] == inputAddressBin[:self.ipMask] - - if isIpMatch: return self.isAccept - - # our policy doesn't concern this address, move on to the next one - if self.nextRule: return self.nextRule.check(ipAddress, port) - else: return True # fell off the chain without a conclusion (shouldn't happen...) - - def getSummary(self): - """ - Provides a summary description of the policy chain similar to the - consensus. This excludes entries that don't cover all ips, and is either - a whitelist or blacklist policy based on the final entry. For instance... - accept 80, 443 # just accepts ports 80/443 - reject 1-1024, 5555 # just accepts non-privilaged ports, excluding 5555 - """ - - if not self.summaryStr: - # determines if we're a whitelist or blacklist - isWhitelist = False # default in case we don't have a catch-all policy at the end - - for rule in self: - if rule.isIpWildcard and rule.isPortWildcard: - isWhitelist = not rule.isAccept - break - - # Iterates over the rules and adds the the ports we'll return (ie, allows - # if a whitelist and rejects if a blacklist). Reguardless of a port's - # allow/reject policy, all further entries with that port are ignored since - # policies respect the first matching rule. - - displayPorts, skipPorts = [], [] - - for rule in self: - if not rule.isIpWildcard: continue - - if rule.minPort == rule.maxPort: - portRange = [rule.minPort] - else: - portRange = range(rule.minPort, rule.maxPort + 1) - - for port in portRange: - if port in skipPorts: continue - - # if accept + whitelist or reject + blacklist then add - if rule.isAccept == isWhitelist: - displayPorts.append(port) - - # all further entries with this port are to be ignored - skipPorts.append(port) - - # gets a list of the port ranges - if displayPorts: - displayRanges, tmpRange = [], [] - displayPorts.sort() - displayPorts.append(None) # ending item to include last range in loop - - for port in displayPorts: - if not tmpRange or tmpRange[-1] + 1 == port: - tmpRange.append(port) - else: - if len(tmpRange) > 1: - displayRanges.append("%i-%i" % (tmpRange[0], tmpRange[-1])) - else: - displayRanges.append(str(tmpRange[0])) - - tmpRange = [port] - else: - # everything for the inverse - isWhitelist = not isWhitelist - displayRanges = ["1-65535"] - - # constructs the summary string - labelPrefix = "accept " if isWhitelist else "reject " - - self.summaryStr = (labelPrefix + ", ".join(displayRanges)).strip() - - return self.summaryStr - - def __iter__(self): - return ExitPolicyIterator(self) - - def __str__(self): - # This provides the actual policy rather than the entry used to construct - # it so the 'private' keyword is expanded. - - acceptanceLabel = "accept" if self.isAccept else "reject" - - if self.isIpWildcard: - ipLabel = "*" - elif self.ipMask != 32: - ipLabel = "%s/%i" % (self.ipAddress, self.ipMask) - else: ipLabel = self.ipAddress - - if self.isPortWildcard: - portLabel = "*" - elif self.minPort != self.maxPort: - portLabel = "%i-%i" % (self.minPort, self.maxPort) - else: portLabel = str(self.minPort) - - myPolicy = "%s %s:%s" % (acceptanceLabel, ipLabel, portLabel) - - if self.nextRule: - return myPolicy + ", " + str(self.nextRule) - else: return myPolicy -

1 0

[arm/master] AttributeError in _getRelayFingerprint()
by atagar＠torproject.org 14 Jan '13

14 Jan '13

commit 4232a73f628836e210af05470c0466a9d8db6ad6 Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Jan 13 21:27:33 2013 -0800 AttributeError in _getRelayFingerprint() Fixing a stacktrace I just got... File "/home/atagar/Desktop/arm/src/cli/connections/connEntry.py", line 124, in getFingerprint myFingerprint = conn.getRelayFingerprint(self.ipAddr) File "/home/atagar/Desktop/arm/src/util/torTools.py", line 888, in getRelayFingerprint relayFingerprint = self._getRelayFingerprint(relayAddress, relayPort) File "/home/atagar/Desktop/arm/src/util/torTools.py", line 1425, in _getRelayFingerprint if not stem.descriptor.RUNNING in nsEntry.flags: AttributeError: 'module' object has no attribute 'RUNNING' --- src/util/torTools.py | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/util/torTools.py b/src/util/torTools.py index c8d12c5..0678177 100644 --- a/src/util/torTools.py +++ b/src/util/torTools.py @@ -1422,7 +1422,7 @@ class Controller: try: nsEntry = self.controller.get_network_status(entryFingerprint) - if not stem.descriptor.RUNNING in nsEntry.flags: + if not stem.descriptor.Flag.RUNNING in nsEntry.flags: potentialMatches.remove((entryPort, entryFingerprint)) except stem.ControllerError: pass

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits January 2013