tor-commits November 2013

tor-commits@lists.torproject.org

17 participants
1171 discussions

[translation/tsum] Update translations for tsum
by translation＠torproject.org 21 Nov '13

21 Nov '13

commit 8ee30ac6062a7ead060b9cb19e5a273c6d6fa817 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Nov 21 15:45:08 2013 +0000 Update translations for tsum --- gl/short-user-manual_gl_noimg.xhtml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/gl/short-user-manual_gl_noimg.xhtml b/gl/short-user-manual_gl_noimg.xhtml index 73a08c6..dfda0bd 100644 --- a/gl/short-user-manual_gl_noimg.xhtml +++ b/gl/short-user-manual_gl_noimg.xhtml @@ -70,15 +70,15 @@ sub 2048R/EB399FD7 2003-10-16 Se precisa de axuda con descubrir por que Tor non pode conectarse, envíe un correo-e a help(a)rt.torproject.org e inclúa as partes relevantes do ficheiro de rexistro. <h3 id="how-to-find-a-bridge">Como atopar unha ponte</h3> Para utilizar unha ponte, primeiro ten que atopala, pode ir ata <a href="https://bridges.torproject.org/">bridges.torproject.org</a>, ou pode enviar un correo-e a bridges(a)torproject.org. Se envía un correo-e, por favor, asegúrese de que escribe obter pontes no corpo do correo electrónico. Sen iso, non vai obter resposta. Teña en conta que ten que enviar este correo dende calquera enderezo gmail.com ou yahoo.com. - Configuring more than one bridge address will make your Tor connection more stable, in case some of the bridges become unreachable. There is no guarantee that the bridge you are using now will work tomorrow, so you should make a habit of updating your list of bridges every so often. - <h3 id="how-to-use-a-bridge">How to use a bridge</h3> - Once you have a set of bridges to use, open the Vidalia control panel, click on Settings, Network and tick the box that says My ISP blocks connections to the Tor network. Enter the bridges in the box below, hit OK and start Tor again. - <h3 id="how-to-use-an-open-proxy">How to use an open proxy</h3> - If using a bridge does not work, try configuring Tor to use any HTTPS or SOCKS proxy to get access to the Tor network. This means even if Tor is blocked by your local network, open proxies can be safely used to connect to the Tor Network and on to the uncensored Internet. - The steps below assume you have a functional Tor/Vidalia configuration, and you have found a list of HTTPS, SOCKS4, or SOCKS5 proxies. + Configurar enderezos de máis dunha ponte fará a conexión Tor máis estable, no caso de que algunha das pontes se faga inaccesible. Non hai garantía de que a ponte que está a usar agora vai traballar mañá, así que ten que coller o hábito de actualizar a súa lista de pontes de cando en vez. + <h3 id="how-to-use-a-bridge">Como usar unha ponte</h3> + Unha vez que teña varias pontes para usar, abra o panel de control do Vidalia, prema en Configuración, Rede e marque a caixa que di meu ISP bloquea conexións á rede Tor. Escriba as pontes no cadro de abaixo, prema en Aceptar e reinicie o Tor. + <h3 id="how-to-use-an-open-proxy">Como usar un proxy aberto</h3> + Se usar unha ponte non funciona, tente configurar Tor para que use calquera proxy HTTPS ou SOCKS para acceder á rede Tor. Isto significa que aínda que Tor estea bloqueado pola rede local, os proxies abertos pódense empregar con seguridade para conectarse á rede Tor e á Internet sen censura. + Nos pasos a seguir asúmese que ten unha configuración Tor/Vidalia funcional, e que atopou unha lista de proxies HTTPS, SOCKS4 ou SOCKS5. <ol style="list-style-type: decimal"> - <li>Open the Vidalia control panel, click on Settings.</li> - <li>Click Network. Select I use a proxy to access the Internet.</li> + <li>Abra o panel de control do Vidalia, prema en Configuración.</li> + <li>Prema Rede. Seleccione Eu uso un proxy para acceder a Internet.</li> <li>On the Address line, enter the open proxy address. This can be a hostname or an IP Address.</li> <li>Enter the port for the proxy.</li> <li>Generally, you do not need a username and password. If you do, enter the information in the proper fields.</li>

1 0

[translation/tsum] Update translations for tsum
by translation＠torproject.org 21 Nov '13

21 Nov '13

commit 3e626b1a84ea0bfcfdb02eaf9b40dac40d08aa00 Author: Translation commit bot <translation(a)torproject.org> Date: Thu Nov 21 15:15:09 2013 +0000 Update translations for tsum --- gl/short-user-manual_gl_noimg.xhtml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/gl/short-user-manual_gl_noimg.xhtml b/gl/short-user-manual_gl_noimg.xhtml index 3268f28..73a08c6 100644 --- a/gl/short-user-manual_gl_noimg.xhtml +++ b/gl/short-user-manual_gl_noimg.xhtml @@ -66,10 +66,10 @@ sub 2048R/EB399FD7 2003-10-16 O reloxo do sistema está desactivado: Asegúrese de que a hora e data do seu sistema é correcta e reinicie Tor. Pode ser necesario sincronizar o reloxo do sistema con un servidor horario en Internet. Está detrás dun firewall restritivo: Para que Tor só use os portos 80 e 443, abra o panel de control do Vidalia, prema en Configuración e Rede e marque a caixa que di Meu firewall só me permite conectarse a determinados portos. Seu programa antivirus está bloqueado o Tor: Asegúrese de que o seu antivirus non está impedindo que o Tor faga conexións de rede. - If Tor still doesn't work, it's likely that your Internet Service Provider (ISP) is blocking Tor. Very often this can be worked around with Tor bridges, hidden relays that aren't as easy to block. - If you need help with figuring out why Tor can't connect, send an email to help(a)rt.torproject.org and include the relevant parts from the log file. - <h3 id="how-to-find-a-bridge">How to find a bridge</h3> - To use a bridge, you will first have to locate one; you can either browse to <a href="https://bridges.torproject.org/">bridges.torproject.org</a>, or you can send an email to bridges(a)torproject.org. If you do send an email, please make sure that you write get bridges in the body of the email. Without this, you will not get a reply. Note that you need to send this email from either a gmail.com or a yahoo.com address. + Se Tor aínda así non funciona, é probable que o seu fornecedor de Internet (ISP) estea bloqueando Tor. Moitas veces isto pode ser contornado con pontes Tor, repetidores ocultos que non son tan fáciles de bloquear. + Se precisa de axuda con descubrir por que Tor non pode conectarse, envíe un correo-e a help(a)rt.torproject.org e inclúa as partes relevantes do ficheiro de rexistro. + <h3 id="how-to-find-a-bridge">Como atopar unha ponte</h3> + Para utilizar unha ponte, primeiro ten que atopala, pode ir ata <a href="https://bridges.torproject.org/">bridges.torproject.org</a>, ou pode enviar un correo-e a bridges(a)torproject.org. Se envía un correo-e, por favor, asegúrese de que escribe obter pontes no corpo do correo electrónico. Sen iso, non vai obter resposta. Teña en conta que ten que enviar este correo dende calquera enderezo gmail.com ou yahoo.com. Configuring more than one bridge address will make your Tor connection more stable, in case some of the bridges become unreachable. There is no guarantee that the bridge you are using now will work tomorrow, so you should make a habit of updating your list of bridges every so often. <h3 id="how-to-use-a-bridge">How to use a bridge</h3> Once you have a set of bridges to use, open the Vidalia control panel, click on Settings, Network and tick the box that says My ISP blocks connections to the Tor network. Enter the bridges in the box below, hit OK and start Tor again.

1 0

[flashproxy/master] FP_FACILITATOR can contain a base path too
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit 134e55a2337be2e51b3b68becb21c8b8678e9769 Author: Ximin Luo <infinity0(a)gmx.com> Date: Mon Nov 18 15:17:14 2013 +0000 FP_FACILITATOR can contain a base path too --- facilitator/appengine/config.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/facilitator/appengine/config.go b/facilitator/appengine/config.go index 17098b5..0f2ffb1 100644 --- a/facilitator/appengine/config.go +++ b/facilitator/appengine/config.go @@ -1,5 +1,6 @@ package fp_reg -// host[:port] of the facilitator you want to register with -// for example, fp-facilitator.org +// host:port/basepath of the facilitator you want to register with +// for example, fp-facilitator.org or example.com:12345/facilitator +// https:// and /reg/ will be prepended and appended respectively. const FP_FACILITATOR = ""

1 0

[flashproxy/master] merge appengine/README into config.go, mention --no_cookies and testing on a separate machine
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit de0cfe5ecdfa3b85bd28d155b3ebef7faf490160 Author: Ximin Luo <infinity0(a)gmx.com> Date: Mon Nov 18 16:32:14 2013 +0000 merge appengine/README into config.go, mention --no_cookies and testing on a separate machine --- facilitator/Makefile.am | 2 +- facilitator/appengine/README | 11 ----------- facilitator/appengine/config.go | 10 ++++++++++ facilitator/doc/appspot-howto.txt | 34 ++++++++++++++++++++++++---------- 4 files changed, 35 insertions(+), 22 deletions(-) diff --git a/facilitator/Makefile.am b/facilitator/Makefile.am index 2b3ac8e..784ec2d 100644 --- a/facilitator/Makefile.am +++ b/facilitator/Makefile.am @@ -26,7 +26,7 @@ endif dist_doc_DATA = doc/appspot-howto.txt doc/facilitator-design.txt doc/email-howto.txt doc/http-howto.txt doc/server-howto.txt README dist_example_DATA = examples/fp-facilitator.conf examples/reg-email.pass examples/facilitator-relays pkgconf_DATA = examples/facilitator-relays -dist_appengine_DATA = appengine/app.yaml appengine/config.go appengine/fp-reg.go appengine/README +dist_appengine_DATA = appengine/app.yaml appengine/config.go appengine/fp-reg.go appengineconf_DATA = appengine/config.go CLEANFILES = examples/fp-facilitator.conf EXTRA_DIST = examples/fp-facilitator.conf.in $(TESTS) diff --git a/facilitator/appengine/README b/facilitator/appengine/README deleted file mode 100644 index 95215d3..0000000 --- a/facilitator/appengine/README +++ /dev/null @@ -1,11 +0,0 @@ -This is the server-side code that runs on Google App Engine for the -"appspot" registration method. - -See doc/appspot-howto.txt for information about setting up an -application. - -To run locally using the development server: -$ ~/google_appengine/dev_appserver.py . - -To upload a new version: -$ torify ~/google_appengine/appcfg.py -A $YOUR_APP_ID update . diff --git a/facilitator/appengine/config.go b/facilitator/appengine/config.go index 0f2ffb1..20898e0 100644 --- a/facilitator/appengine/config.go +++ b/facilitator/appengine/config.go @@ -1,3 +1,13 @@ +/* +This is the server-side code that runs on Google App Engine for the +"appspot" registration method. + +See doc/appspot-howto.txt for more details about setting up an +application, and advice on running one. + +To upload a new version: +$ torify ~/go_appengine/appcfg.py --no_cookies -A $YOUR_APP_ID update . +*/ package fp_reg // host:port/basepath of the facilitator you want to register with diff --git a/facilitator/doc/appspot-howto.txt b/facilitator/doc/appspot-howto.txt index 9202417..8ed1284 100644 --- a/facilitator/doc/appspot-howto.txt +++ b/facilitator/doc/appspot-howto.txt @@ -5,13 +5,12 @@ ensure it is working correctly, or find someone else's to use. If you choose the latter, note that it is *their* reg-daemon.pub that your users must give to flashproxy-reg-appspot. -General links: -https://developers.google.com/appengine/ -https://developers.google.com/appengine/docs/whatisgoogleappengine -https://developers.google.com/appengine/docs/go/gettingstarted/ +For more information about Google App Engine, see the links at the bottom +of this document. -You first need to create a Google account. See email-howto.txt for how -to do that. +You are strongly recommended to create a Google account dedicated for +this purpose, rather than a personal or organisation account. See +email-howto.txt for how to do that. Download the SDK: https://developers.google.com/appengine/docs/go/gettingstarted/devenvironme… @@ -24,10 +23,15 @@ Follow the directions to register a new application: https://developers.google.com/appengine/docs/go/gettingstarted/uploading Enter an application ID and create the application. +To run locally using the development server: +$ ~/go_appengine/dev_appserver.py reg-appspot/ +You are advised to do this on a non-production machine, away from the main +facilitator. + Use the appcfg.py program to upload the program. It should look something like this: -$ torify ./google_appengine/appcfg.py -A <YOUR_APP_ID> update reg-appspot/ +$ torify ./google_appengine/appcfg.py --no_cookies -A <YOUR_APP_ID> update reg-appspot/ 07:25 PM Host: appengine.google.com 07:25 PM Application: application-id; version: 1 07:25 PM @@ -48,11 +52,21 @@ Password for xxx(a)gmail.com: 07:26 PM Checking if updated app version is serving. 07:26 PM Completed update of app: application-id, version: 1 -Uploading the program in this way seems to create the files -~/.appcfg_nag and ~/.appcfg_cookies. Running the update command again -doesn't require you to enter your password again. +The --no_cookies flag stops authentication cookies from being written +to disk, in ~/.appcfg_cookies. We recommend this for security, since no +long-running services need this password, only the update process above +which is run once. However, if this reasoning doesn't apply to you +(e.g. if your facilitator-email-poller uses the same account, so that +the password is already on the disk) *and* you find yourself running +update a lot for some reason, then you may at your own risk omit it for +convenience. Once logged in, you can disable logging for the application. Click "Logs" on the left panel. Under "Total Logs Storage", click "Change Settings". Enter "0" in the "days of logs" box and click "Save Settings". + +General links: +https://developers.google.com/appengine/ +https://developers.google.com/appengine/docs/whatisgoogleappengine +https://developers.google.com/appengine/docs/go/gettingstarted/

1 0

[flashproxy/master] auto-mkdir directories used by the initscripts
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit 60cae9bc22834538d8fc5f3c1731b9415dc66477 Author: Ximin Luo <infinity0(a)gmx.com> Date: Mon Nov 18 19:45:44 2013 +0000 auto-mkdir directories used by the initscripts --- facilitator/Makefile.am | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/facilitator/Makefile.am b/facilitator/Makefile.am index 784ec2d..58872a4 100644 --- a/facilitator/Makefile.am +++ b/facilitator/Makefile.am @@ -122,6 +122,9 @@ remove-symlinks: install-daemon: if DO_INITSCRIPTS +# initscripts use these directories for logs and runtime data + mkdir -p $(localstatedir)/log + mkdir -p $(localstatedir)/run for i in facilitator facilitator-email-poller facilitator-reg-daemon; do \ update-rc.d $$i defaults; \ invoke-rc.d $$i start; \ @@ -130,6 +133,7 @@ endif remove-daemon: if DO_INITSCRIPTS +# we don't rm created directories since they might be system-managed for i in facilitator facilitator-email-poller facilitator-reg-daemon; do \ invoke-rc.d $$i stop; \ update-rc.d $$i remove; \

1 0

[flashproxy/master] split name-resolution behaviour out of parse_addr_spec to match flashproxy-common
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit d3e27be5f375a80917c84e0881aa5c78bfd3d1f1 Author: Ximin Luo <infinity0(a)gmx.com> Date: Mon Nov 18 19:15:29 2013 +0000 split name-resolution behaviour out of parse_addr_spec to match flashproxy-common - keep named relays as names rather than numeric addresses --- facilitator/fac.py | 38 +++++++++++++++++++--------------- facilitator/facilitator | 4 ++-- facilitator/facilitator-email-poller | 2 +- facilitator/facilitator-test.py | 11 +++------- 4 files changed, 27 insertions(+), 28 deletions(-) diff --git a/facilitator/fac.py b/facilitator/fac.py index f5649b3..00c103c 100644 --- a/facilitator/fac.py +++ b/facilitator/fac.py @@ -50,7 +50,7 @@ def catch_epipe(fn): raise return ret -def parse_addr_spec(spec, defhost = None, defport = None, resolve = False, nameOk = False): +def parse_addr_spec(spec, defhost = None, defport = None): """Parse a host:port specification and return a 2-tuple ("host", port) as understood by the Python socket functions. >>> parse_addr_spec("192.168.0.1:9999") @@ -70,11 +70,6 @@ def parse_addr_spec(spec, defhost = None, defport = None, resolve = False, nameO ('192.168.0.1', 9999) >>> parse_addr_spec("", defhost="192.168.0.1", defport=9999) ('192.168.0.1', 9999) - - If nameOk is true, then the host in the specification or the defhost may be - a domain name. Otherwise, it must be a numeric IPv4 or IPv6 address. - If resolve is true, this implies nameOk, and the host will be resolved. - IPv6 addresses must be enclosed in square brackets.""" host = None port = None @@ -105,19 +100,24 @@ def parse_addr_spec(spec, defhost = None, defport = None, resolve = False, nameO port = port or defport if host is None or port is None: raise ValueError("Bad address specification \"%s\"" % spec) + return host, int(port) + +def resolve_to_ip(host, port, af=0, gai_flags=0): + """Resolves a host string to an IP address in canonical format. + + Note: in many cases this is not necessary since the consumer of the address + can probably accept host names directly. - # Now we have split around the colon and have a guess at the address family. + :param: host string to resolve; may be a DNS name or an IP address. + :param: port of the host + :param: af address family, default unspecified. set to socket.AF_INET or + socket.AF_INET6 to force IPv4 or IPv6 name resolution. + :returns: (IP address in canonical format, port) + """ # Forward-resolve the name into an addrinfo struct. Real DNS resolution is # done only if resolve is true; otherwise the address must be numeric. - if resolve: - flags = 0 - elif nameOk: - # don't pass through the getaddrinfo numeric check, just return directly - return host, int(port) - else: - flags = socket.AI_NUMERICHOST try: - addrs = socket.getaddrinfo(host, port, af, socket.SOCK_STREAM, socket.IPPROTO_TCP, flags) + addrs = socket.getaddrinfo(host, port, af, 0, 0, gai_flags) except socket.gaierror, e: raise ValueError("Bad host or port: \"%s\" \"%s\": %s" % (host, port, str(e))) if not addrs: @@ -126,8 +126,12 @@ def parse_addr_spec(spec, defhost = None, defport = None, resolve = False, nameO # Convert the result of socket.getaddrinfo (which is a 2-tuple for IPv4 and # a 4-tuple for IPv6) into a (host, port) 2-tuple. host, port = socket.getnameinfo(addrs[0][4], socket.NI_NUMERICHOST | socket.NI_NUMERICSERV) - port = int(port) - return host, port + return host, int(port) + +def canonical_ip(host, port, af=0): + """Convert an IP address to a canonical format. Identical to resolve_to_ip, + except that the host param must already be an IP address.""" + return resolve_to_ip(host, port, af, gai_flags=socket.AI_NUMERICHOST) def format_addr(addr): host, port = addr diff --git a/facilitator/facilitator b/facilitator/facilitator index 9d90833..a2dd56a 100755 --- a/facilitator/facilitator +++ b/facilitator/facilitator @@ -290,7 +290,7 @@ class Handler(SocketServer.StreamRequestHandler): if proxy_spec is None: return self.error(u"GET missing FROM param") try: - proxy_addr = fac.parse_addr_spec(proxy_spec, defport=0) + proxy_addr = fac.canonical_ip(*fac.parse_addr_spec(proxy_spec, defport=0)) except ValueError, e: return self.error(u"syntax error in proxy address %s: %s" % (safe_str(repr(proxy_spec)), safe_str(repr(str(e))))) @@ -422,7 +422,7 @@ def parse_relay_file(servers, fp): transport_spec, addr_spec = line.strip().split() except ValueError, e: raise ValueError("Wrong line format: %s." % repr(line)) - addr = fac.parse_addr_spec(addr_spec, defport=DEFAULT_RELAY_PORT, resolve=True) + addr = fac.parse_addr_spec(addr_spec, defport=DEFAULT_RELAY_PORT) transport = Transport.parse(transport_spec) if transport.outer not in options.outer_transports: raise ValueError(u"Unrecognized transport: %s" % transport) diff --git a/facilitator/facilitator-email-poller b/facilitator/facilitator-email-poller index f087507..2efceec 100755 --- a/facilitator/facilitator-email-poller +++ b/facilitator/facilitator-email-poller @@ -222,7 +222,7 @@ try: raise ValueError("could not find email or password on line %s" % (lineno0+1)) (imap_addr_spec, email_addr, email_password) = res.groups() imap_addr = fac.parse_addr_spec( - imap_addr_spec or "", DEFAULT_IMAP_HOST, DEFAULT_IMAP_PORT, nameOk=True) + imap_addr_spec or "", DEFAULT_IMAP_HOST, DEFAULT_IMAP_PORT) break else: raise ValueError("no email line found") diff --git a/facilitator/facilitator-test.py b/facilitator/facilitator-test.py index 3a960fe..d63e0b5 100755 --- a/facilitator/facilitator-test.py +++ b/facilitator/facilitator-test.py @@ -346,14 +346,9 @@ class ParseAddrSpecTest(unittest.TestCase): self.assertEqual(fac.parse_addr_spec(":", defhost="1234::1", defport=9999), ("1234::1", 9999)) self.assertEqual(fac.parse_addr_spec("", defhost="1234::1", defport=9999), ("1234::1", 9999)) - def test_noresolve(self): - """Test that parse_addr_spec does not do DNS resolution by default.""" - self.assertRaises(ValueError, fac.parse_addr_spec, "example.com") - - def test_noresolve_nameok(self): - """Test that nameok passes through a domain name without resolving it.""" - self.assertEqual(fac.parse_addr_spec("example.com:8888", defhost="other.com", defport=9999, nameOk=True), ("example.com", 8888)) - self.assertEqual(fac.parse_addr_spec("", defhost="other.com", defport=9999, nameOk=True), ("other.com", 9999)) + def test_canonical_ip_noresolve(self): + """Test that canonical_ip does not do DNS resolution by default.""" + self.assertRaises(ValueError, fac.canonical_ip, *fac.parse_addr_spec("example.com:80")) class ParseTransactionTest(unittest.TestCase): def test_empty_string(self):

1 0

[flashproxy/master] anchor path for manual import so `make distcheck` works
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit 053b75bfe2c7d14e0a92376b2569dff78bcf775d Author: Ximin Luo <infinity0(a)gmx.com> Date: Mon Nov 18 16:38:06 2013 +0000 anchor path for manual import so `make distcheck` works --- facilitator/facilitator-test.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/facilitator/facilitator-test.py b/facilitator/facilitator-test.py index 8debb82..3a960fe 100755 --- a/facilitator/facilitator-test.py +++ b/facilitator/facilitator-test.py @@ -16,7 +16,7 @@ from fac import Transport, Endpoint import imp dont_write_bytecode = sys.dont_write_bytecode sys.dont_write_bytecode = True -facilitator = imp.load_source("facilitator", "facilitator") +facilitator = imp.load_source("facilitator", os.path.join(os.path.dirname(__file__), "facilitator")) Endpoints = facilitator.Endpoints parse_relay_file = facilitator.parse_relay_file sys.dont_write_bytecode = dont_write_bytecode

1 0

[flashproxy/master] safe logging is appropriate for most cases, not just high-risk
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit cf9ebbd24c9db0f7996b8a758ea74f7b1375a9d4 Author: Ximin Luo <infinity0(a)gmx.com> Date: Mon Nov 18 14:46:47 2013 +0000 safe logging is appropriate for most cases, not just high-risk --- facilitator/default/facilitator | 2 +- facilitator/default/facilitator-email-poller | 2 +- facilitator/default/facilitator-reg-daemon | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/facilitator/default/facilitator b/facilitator/default/facilitator index 51ed4a1..b45c042 100644 --- a/facilitator/default/facilitator +++ b/facilitator/default/facilitator @@ -3,7 +3,7 @@ RUN_DAEMON="no" # Uncomment this to log potentially sensitive information from your users. # This may be useful for debugging or diagnosing functional problems, but -# should be avoided in a high-risk environment. +# should be avoided in most other cases. #UNSAFE_LOGGING="yes" # Set the port for this service to listen on. diff --git a/facilitator/default/facilitator-email-poller b/facilitator/default/facilitator-email-poller index b71503f..9369e18 100644 --- a/facilitator/default/facilitator-email-poller +++ b/facilitator/default/facilitator-email-poller @@ -3,5 +3,5 @@ RUN_DAEMON="no" # Uncomment this to log potentially sensitive information from your users. # This may be useful for debugging or diagnosing functional problems, but -# should be avoided in a high-risk environment. +# should be avoided in most other cases. #UNSAFE_LOGGING="yes" diff --git a/facilitator/default/facilitator-reg-daemon b/facilitator/default/facilitator-reg-daemon index d39be20..ba0773e 100644 --- a/facilitator/default/facilitator-reg-daemon +++ b/facilitator/default/facilitator-reg-daemon @@ -3,7 +3,7 @@ RUN_DAEMON="no" # Uncomment this to log potentially sensitive information from your users. # This may be useful for debugging or diagnosing functional problems, but -# should be avoided in a high-risk environment. +# should be avoided in most other cases. #UNSAFE_LOGGING="yes" # Set the port for this service to listen on.

1 0

[flashproxy/master] Merge branch 'fac-build'
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit 4ff2130c877f931ccd1e892fd96652a481003ae7 Merge: 6de8015 4c554d7 Author: Ximin Luo <infinity0(a)gmx.com> Date: Wed Nov 20 16:05:12 2013 +0000 Merge branch 'fac-build' Conflicts: facilitator/doc/facilitator-howto.txt Makefile | 12 +- facilitator/.gitignore | 28 ++ facilitator/INSTALL | 31 ++ facilitator/Makefile | 21 -- facilitator/Makefile.am | 149 ++++++++ facilitator/README | 37 +- facilitator/appengine/README | 11 - facilitator/appengine/app.yaml | 3 +- facilitator/appengine/config.go | 16 + facilitator/appengine/fp-reg.go | 7 +- facilitator/autogen.sh | 2 + facilitator/configure.ac | 49 +++ facilitator/default/facilitator | 11 + facilitator/default/facilitator-email-poller | 7 + facilitator/default/facilitator-reg-daemon | 11 + facilitator/doc/appengine-howto.txt | 56 --- facilitator/doc/appspot-howto.txt | 72 ++++ facilitator/doc/email-howto.txt | 75 ++++ facilitator/doc/facilitator-design.txt | 44 +++ facilitator/doc/facilitator-howto.txt | 199 ----------- facilitator/doc/gmail-howto.txt | 61 ---- facilitator/doc/http-howto.txt | 49 +++ facilitator/doc/server-howto.txt | 55 +++ facilitator/examples/facilitator-relays | 7 + facilitator/examples/fp-facilitator.conf.in | 30 ++ facilitator/examples/reg-email.pass | 10 + facilitator/fac.py | 35 +- facilitator/facilitator | 16 +- facilitator/facilitator-email-poller | 47 ++- facilitator/facilitator-test | 437 ----------------------- facilitator/facilitator-test.py | 439 ++++++++++++++++++++++++ facilitator/init.d/facilitator | 120 ------- facilitator/init.d/facilitator-email-poller | 119 ------- facilitator/init.d/facilitator-email-poller.in | 131 +++++++ facilitator/init.d/facilitator-reg-daemon | 119 ------- facilitator/init.d/facilitator-reg-daemon.in | 132 +++++++ facilitator/init.d/facilitator.in | 133 +++++++ facilitator/relays | 4 - 38 files changed, 1591 insertions(+), 1194 deletions(-) diff --cc facilitator/doc/server-howto.txt index 0000000,6f71772..bf1bb0b mode 000000,100644..100644 --- a/facilitator/doc/server-howto.txt +++ b/facilitator/doc/server-howto.txt @@@ -1,0 -1,55 +1,55 @@@ + This document describes how to configure a server running the facilitator on + Debian 7. It is not necessary to make things work, but gives you some added + security, and is a good reference if you want to create a dedicated VM for a + facilitator from scratch. + + We will use the domain name fp-facilitator.example.com. + + == Basic and security setup + + Install some essential packages and configure a firewall. + + # cat >/etc/apt/apt.conf.d/90suggests<<EOF + APT::Install-Recommends "0"; + APT::Install-Suggests "0"; + EOF - # apt-get remove portmap ++ # apt-get remove rpcbind + # apt-get update + # apt-get upgrade + # apt-get install shorewall shorewall6 + + Away from the facilitator, generate an SSH key for authentication: + + $ ssh-keygen -f ~/.ssh/fp-facilitator + $ ssh-copy-id -i ~/.ssh/fp-facilitator.pub root(a)fp-facilitator.example.com + + Then log in and edit /etc/ssh/sshd_config to disable password + authentication: + + PasswordAuthentication no + + Configure the firewall to allow only SSH and HTTPS. + + # cd /etc/shorewall + # cp /usr/share/doc/shorewall/examples/Universal/{interfaces,policy,rules,zones} . + Edit /etc/shorewall/rules: + SECTION NEW + SSH(ACCEPT) net $FW + HTTPS(ACCEPT) net $FW + + # cd /etc/shorewall6 + # cp /usr/share/doc/shorewall6/examples/Universal/{interfaces,policy,rules,zones} . + Edit /etc/shorewall6/rules: + SECTION NEW + SSH(ACCEPT) all $FW + HTTPS(ACCEPT) all $FW + + Edit /etc/default/shorewall and /etc/default/shorewall6 and set + + startup=1 + + Restart servers. + + # /etc/init.d/ssh restart + # /etc/init.d/shorewall start + # /etc/init.d/shorewall6 start

1 0

[flashproxy/master] add a pylint phony target for the facilitator too
by infinity0＠torproject.org 21 Nov '13

21 Nov '13

commit 4c554d7b489bbcbe5983156a24c4f2f025dd88f6 Author: Ximin Luo <infinity0(a)gmx.com> Date: Wed Nov 13 17:29:03 2013 +0000 add a pylint phony target for the facilitator too --- facilitator/Makefile.am | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/facilitator/Makefile.am b/facilitator/Makefile.am index 58872a4..2d315b9 100644 --- a/facilitator/Makefile.am +++ b/facilitator/Makefile.am @@ -49,6 +49,9 @@ examples/fp-facilitator.conf: examples/fp-facilitator.conf.in Makefile mkdir -p $$(dirname "$@") $(subst_vars) "$<" > "$@" +pylint: $(dist_bin_SCRIPTS) + pylint -E $^ + # The {pre,post}-{install,remove} targets are just given as reference, and # ought to be separate scripts as part of your distro's installation process. # They are intentionally not linked to the install target since they require @@ -143,3 +146,4 @@ endif .PHONY: pre-install post-install pre-remove post-remove pre-purge post-purge .PHONY: install-user install-secrets install-symlinks install-daemon .PHONY: remove-user remove-secrets remove-symlinks remove-daemon +.PHONY: pylint

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits November 2013