November 2013 - tor-commits - lists.torproject.org

[flashproxy/master] ChangeLog for #9069.
by dcf＠torproject.org 10 Nov '13

10 Nov '13

commit b243d78a8320407df21a2a9a9e495581c606bb0a Author: David Fifield <david(a)bamsoftware.com> Date: Sat Nov 9 23:45:31 2013 -0800 ChangeLog for #9069. --- ChangeLog | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ChangeLog b/ChangeLog index 3ef4550..f90579e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,6 @@ + o Enabled binary frames (avoiding the overhead of base64 encoding) for + Firefox 11 and later. Patch by Arlo Breault. Fixes bug 9069. + Changes in version 1.4 o Allowed websocket-server to gracefully handle SIGTERM.

1 0

[flashproxy/master] Whitespace.
by dcf＠torproject.org 10 Nov '13

10 Nov '13

commit 191f6126bd62c68f785020d2fc3473f3ab85323f Author: David Fifield <david(a)bamsoftware.com> Date: Sun Nov 10 00:03:28 2013 -0800 Whitespace. --- proxy/flashproxy.js | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/proxy/flashproxy.js b/proxy/flashproxy.js index 8aca4e5..48839ae 100644 --- a/proxy/flashproxy.js +++ b/proxy/flashproxy.js @@ -433,19 +433,18 @@ function have_websocket_binary_frames() { return false; browsers = [ - { idString: "Chrome", verString: "Chrome", version: 16 }, - { idString: "Safari", verString: "Version", version: 6 }, - { idString: "Firefox", verString: "Firefox", version: 11 } + { idString: "Chrome", verString: "Chrome", version: 16 }, + { idString: "Safari", verString: "Version", version: 6 }, + { idString: "Firefox", verString: "Firefox", version: 11 } ]; for (var i = 0; i < browsers.length; i++) { - reg = "\\b" + browsers[i].idString + "\\b"; - if (ua.match(new RegExp(reg, "i")) == null) - continue; - reg = "\\b" + browsers[i].verString + "\\/(\\d+)"; - matches = ua.match(new RegExp(reg, "i")); - return (matches != null - && Number(matches[1]) >= browsers[i].version) ? true : false; + reg = "\\b" + browsers[i].idString + "\\b"; + if (ua.match(new RegExp(reg, "i")) == null) + continue; + reg = "\\b" + browsers[i].verString + "\\/(\\d+)"; + matches = ua.match(new RegExp(reg, "i")); + return (matches != null && Number(matches[1]) >= browsers[i].version) ? true : false; } return false;

1 0

[flashproxy/master] Change style a bit.
by dcf＠torproject.org 10 Nov '13

10 Nov '13

commit 0b1f47a4bbed04d91000949e7cd5c1100f0f0490 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Nov 10 00:12:17 2013 -0800 Change style a bit. --- proxy/flashproxy.js | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/proxy/flashproxy.js b/proxy/flashproxy.js index 48839ae..133266a 100644 --- a/proxy/flashproxy.js +++ b/proxy/flashproxy.js @@ -426,25 +426,26 @@ function format_addr(addr) { 6455 section 5.6.) If not, we have to use base64-encoded text frames. It is assumed that the client and relay endpoints always support binary frames. */ function have_websocket_binary_frames() { - var ua, matches, browsers, reg; + var BROWSERS = [ + { idString: "Chrome", verString: "Chrome", version: 16 }, + { idString: "Safari", verString: "Version", version: 6 }, + { idString: "Firefox", verString: "Firefox", version: 11 } + ]; + var ua; ua = window.navigator.userAgent; if (!ua) return false; - browsers = [ - { idString: "Chrome", verString: "Chrome", version: 16 }, - { idString: "Safari", verString: "Version", version: 6 }, - { idString: "Firefox", verString: "Firefox", version: 11 } - ]; + for (var i = 0; i < BROWSERS.length; i++) { + var matches, reg; - for (var i = 0; i < browsers.length; i++) { - reg = "\\b" + browsers[i].idString + "\\b"; - if (ua.match(new RegExp(reg, "i")) == null) + reg = "\\b" + BROWSERS[i].idString + "\\b"; + if (!ua.match(new RegExp(reg, "i"))) continue; - reg = "\\b" + browsers[i].verString + "\\/(\\d+)"; + reg = "\\b" + BROWSERS[i].verString + "\\/(\\d+)"; matches = ua.match(new RegExp(reg, "i")); - return (matches != null && Number(matches[1]) >= browsers[i].version) ? true : false; + return matches !== null && Number(matches[1]) >= BROWSERS[i].version; } return false;

1 0

r26419: {website} fix grammar error, and make it clearer to mail donations whe (website/trunk/getinvolved/en)
by Roger Dingledine 10 Nov '13

10 Nov '13

Author: arma Date: 2013-11-10 06:10:51 +0000 (Sun, 10 Nov 2013) New Revision: 26419 Modified: website/trunk/getinvolved/en/tshirt.wml Log: fix grammar error, and make it clearer to mail donations when you get your relay mail from weather Modified: website/trunk/getinvolved/en/tshirt.wml =================================================================== --- website/trunk/getinvolved/en/tshirt.wml 2013-11-10 06:09:35 UTC (rev 26418) +++ website/trunk/getinvolved/en/tshirt.wml 2013-11-10 06:10:51 UTC (rev 26419) @@ -37,9 +37,9 @@ The <a href="https://weather.torproject.org/">Tor Weather</a> system watches all of the relays. If you have a valid email address (lightly obfuscated is acceptable) in your ContactInfo field, - we'll automatically email you when your relays earns you a free - t-shirt. If you've done something else cool, email us directly - donations(a)torproject.org with the details. + we'll automatically email you when your relay earns you a free + t-shirt. If you get such a mail, or you've done something else cool, + email us at donations(a)torproject.org with the details.

1 0

r26418: {website} reformat (no changes) (website/trunk/getinvolved/en)
by Roger Dingledine 10 Nov '13

10 Nov '13

Author: arma Date: 2013-11-10 06:09:35 +0000 (Sun, 10 Nov 2013) New Revision: 26418 Modified: website/trunk/getinvolved/en/tshirt.wml Log: reformat (no changes) Modified: website/trunk/getinvolved/en/tshirt.wml =================================================================== --- website/trunk/getinvolved/en/tshirt.wml 2013-11-10 01:21:19 UTC (rev 26417) +++ website/trunk/getinvolved/en/tshirt.wml 2013-11-10 06:09:35 UTC (rev 26418) @@ -34,7 +34,12 @@ </ol> - The <a href="https://weather.torproject.org/">Tor Weather</a> system watches all of the relays. If you have a valid email address (lightly obfuscated is acceptable) in your ContactInfo field, we'll automatically email you when your relays earns you a free t-shirt. If you've done something else cool, email us directly donations(a)torproject.org with the details. + The <a href="https://weather.torproject.org/">Tor Weather</a> + system watches all of the relays. If you have a valid email address + (lightly obfuscated is acceptable) in your ContactInfo field, + we'll automatically email you when your relays earns you a free + t-shirt. If you've done something else cool, email us directly + donations(a)torproject.org with the details.

1 0

[goptlib/master] Actually stop name resolution.
by dcf＠torproject.org 10 Nov '13

10 Nov '13

commit 78e518c824d9541056ba2ca870df2bb01b810b05 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Nov 9 19:16:27 2013 -0800 Actually stop name resolution. net.ResolveIPAddr still resolves "localhost" to 127.0.0.1. Use net.ParseIP instead. --- pt.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pt.go b/pt.go index 308238c..b5466fd 100644 --- a/pt.go +++ b/pt.go @@ -270,15 +270,15 @@ func resolveAddr(addrStr string) (*net.TCPAddr, error) { if portStr == "" { return nil, net.InvalidAddrError(fmt.Sprintf("address string %q lacks a port part", addrStr)) } - ip, err := net.ResolveIPAddr("ip", ipStr) - if err != nil { - return nil, err + ip := net.ParseIP(ipStr) + if ip == nil { + return nil, net.InvalidAddrError(fmt.Sprintf("not an IP string: %q", ipStr)) } port, err := net.LookupPort("tcp", portStr) if err != nil { return nil, err } - return &net.TCPAddr{IP: ip.IP, Port: port, Zone: ip.Zone}, nil + return &net.TCPAddr{IP: ip, Port: port}, nil } // Return a new slice, the members of which are those members of addrs having a

1 0

[goptlib/master] Factor out the reading and validation from readAuthCookieFile.
by dcf＠torproject.org 10 Nov '13

10 Nov '13

commit e68e6610007a3fcd388c2a93d7e13dbd31ff4d09 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Nov 9 16:37:55 2013 -0800 Factor out the reading and validation from readAuthCookieFile. To facilitatate tests that don't need an actual file with a name. --- pt.go | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/pt.go b/pt.go index b79f08b..28c8639 100644 --- a/pt.go +++ b/pt.go @@ -321,19 +321,11 @@ func getServerBindAddrs(methodNames []string) ([]BindAddr, error) { return result, nil } -// Read and validate the contents of an auth cookie file. Returns the 32-byte -// cookie. See section 4.2.1.2 of pt-spec.txt. -func readAuthCookieFile(filename string) ([]byte, error) { +func readAuthCookie(f io.Reader) ([]byte, error) { authCookieHeader := []byte("! Extended ORPort Auth Cookie !\x0a") header := make([]byte, 32) cookie := make([]byte, 32) - f, err := os.Open(filename) - if err != nil { - return cookie, err - } - defer f.Close() - n, err := io.ReadFull(f, header) if err != nil { return cookie, err @@ -357,6 +349,18 @@ func readAuthCookieFile(filename string) ([]byte, error) { return cookie, nil } +// Read and validate the contents of an auth cookie file. Returns the 32-byte +// cookie. See section 4.2.1.2 of pt-spec.txt. +func readAuthCookieFile(filename string) ([]byte, error) { + f, err := os.Open(filename) + if err != nil { + return nil, err + } + defer f.Close() + + return readAuthCookie(f) +} + // This structure is returned by ServerSetup. It consists of a list of // BindAddrs, an address for the ORPort, an address for the extended ORPort (if // any), and an authentication cookie (if any).

1 0

[goptlib/master] Add tests for readAuthCookie.
by dcf＠torproject.org 10 Nov '13

10 Nov '13

commit 602b719604c0a9935482bcfca5549384d1e57277 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Nov 9 17:02:27 2013 -0800 Add tests for readAuthCookie. --- pt_test.go | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/pt_test.go b/pt_test.go index ada9ed5..44cfa54 100644 --- a/pt_test.go +++ b/pt_test.go @@ -1,5 +1,6 @@ package pt +import "bytes" import "os" import "testing" @@ -79,3 +80,39 @@ func TestGetManagedTransportVer(t *testing.T) { } } } + +func TestReadAuthCookie(t *testing.T) { + badTests := [...][]byte{ + []byte(""), + // bad header + []byte("! Impostor ORPort Auth Cookie !\x0a0123456789ABCDEF0123456789ABCDEF"), + // too short + []byte("! Extended ORPort Auth Cookie !\x0a0123456789ABCDEF0123456789ABCDE"), + // too long + []byte("! Extended ORPort Auth Cookie !\x0a0123456789ABCDEF0123456789ABCDEFX"), + } + goodTests := [...][]byte{ + []byte("! Extended ORPort Auth Cookie !\x0a0123456789ABCDEF0123456789ABCDEF"), + } + + for _, input := range badTests { + var buf bytes.Buffer + buf.Write(input) + _, err := readAuthCookie(&buf) + if err == nil { + t.Errorf("%q unexpectedly succeeded", input) + } + } + + for _, input := range goodTests { + var buf bytes.Buffer + buf.Write(input) + cookie, err := readAuthCookie(&buf) + if err != nil { + t.Errorf("%q unexpectedly returned an error: %s", input, err) + } + if !bytes.Equal(cookie, input[32:64]) { + t.Errorf("%q → %q (expected %q)", input, cookie, input[:32]) + } + } +}

1 0

[goptlib/master] Read the auth cookie file in one operation.
by dcf＠torproject.org 10 Nov '13

10 Nov '13

commit 3c6f785a8d34cb2f93fcdf8eaf314dfb61cd9814 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Nov 9 17:05:08 2013 -0800 Read the auth cookie file in one operation. --- pt.go | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/pt.go b/pt.go index 28c8639..d64f169 100644 --- a/pt.go +++ b/pt.go @@ -323,27 +323,23 @@ func getServerBindAddrs(methodNames []string) ([]BindAddr, error) { func readAuthCookie(f io.Reader) ([]byte, error) { authCookieHeader := []byte("! Extended ORPort Auth Cookie !\x0a") - header := make([]byte, 32) - cookie := make([]byte, 32) + buf := make([]byte, 64) - n, err := io.ReadFull(f, header) + n, err := io.ReadFull(f, buf) if err != nil { - return cookie, err - } - n, err = io.ReadFull(f, cookie) - if err != nil { - return cookie, err + return nil, err } // Check that the file ends here. n, err = f.Read(make([]byte, 1)) if n != 0 { - return cookie, errors.New(fmt.Sprintf("file is longer than 64 bytes")) + return nil, errors.New(fmt.Sprintf("file is longer than 64 bytes")) } else if err != io.EOF { - return cookie, errors.New(fmt.Sprintf("did not find EOF at end of file")) + return nil, errors.New(fmt.Sprintf("did not find EOF at end of file")) } - + header := buf[0:32] + cookie := buf[32:64] if !bytes.Equal(header, authCookieHeader) { - return cookie, errors.New(fmt.Sprintf("missing auth cookie header")) + return nil, errors.New(fmt.Sprintf("missing auth cookie header")) } return cookie, nil

1 0

[goptlib/master] Use constant-time compare for auth cookie header.
by dcf＠torproject.org 10 Nov '13

10 Nov '13

commit c00891640650bc553f7c4e7eb12ba43cce23f273 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Nov 9 17:08:58 2013 -0800 Use constant-time compare for auth cookie header. Why not. --- pt.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pt.go b/pt.go index d64f169..a8bd001 100644 --- a/pt.go +++ b/pt.go @@ -338,7 +338,7 @@ func readAuthCookie(f io.Reader) ([]byte, error) { } header := buf[0:32] cookie := buf[32:64] - if !bytes.Equal(header, authCookieHeader) { + if subtle.ConstantTimeCompare(header, authCookieHeader) != 1 { return nil, errors.New(fmt.Sprintf("missing auth cookie header")) }

1 0