April 2013 - tor-commits - lists.torproject.org

[ooni-probe/master] Fix travis file
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 321543793b6a81bf90d4f79a965ce29bf02ce89d Author: Arturo Filastò <art(a)fuffa.org> Date: Mon Apr 22 17:29:44 2013 +0200 Fix travis file --- .travis.yml | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.travis.yml b/.travis.yml index 9c89f6d..2dc900f 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,8 +1,7 @@ language: python before_install: - - sudo apt-get install tor + - sudo apt-get install tor python-pyrex python: - - "3.3" - "2.7" - "2.6" # command to install dependencies @@ -16,4 +15,4 @@ script: # - trial ooni - cp ooniprobe.conf.sample ooniprobe.conf - sh scripts/before_i_commit.sh - - bin/ooniprobe nettest/blocking/tcpconnect.py -f example_inputs/alexa-top-1k.txt \ No newline at end of file + - bin/ooniprobe nettest/blocking/tcpconnect.py -f example_inputs/alexa-top-1k.txt

1 0

[ooni-probe/master] Only run trial unittests
by art＠torproject.org 30 Apr '13

30 Apr '13

commit a42421fefd213f49a9dc54e7bfae28bf6b4494d8 Author: Arturo Filastò <art(a)fuffa.org> Date: Mon Apr 22 18:11:23 2013 +0200 Only run trial unittests --- .travis.yml | 2 -- 1 files changed, 0 insertions(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index 2845bdf..8a3f99c 100644 --- a/.travis.yml +++ b/.travis.yml @@ -15,5 +15,3 @@ script: # To be activated after merge of PR#64 - cp ooniprobe.conf.sample ooniprobe.conf - trial ooni - - sh scripts/before_i_commit.sh - - bin/ooniprobe nettest/blocking/tcpconnect.py -f example_inputs/alexa-top-1k.txt

1 0

[ooni-probe/master] Install pyrex and python deps via pip
by art＠torproject.org 30 Apr '13

30 Apr '13

commit c3665b2ab816f0160cf5e391a44f020cc876d5a5 Author: Arturo Filastò <art(a)fuffa.org> Date: Mon Apr 22 17:43:20 2013 +0200 Install pyrex and python deps via pip --- .travis.yml | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.travis.yml b/.travis.yml index 1631ae5..78cf20e 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,13 +1,14 @@ language: python before_install: - - sudo apt-get install tor python-pyrex + - sudo apt-get install tor python: - "2.7" - "2.6" # command to install dependencies # the first is for testing pip and the second for setuptools install: - #- pip install -r requirements.txt --use-mirrors + - pip install pyrex + - pip install -r requirements.txt --use-mirrors - python setup.py install # command to run tests, e.g. python setup.py test script:

1 0

[ooni-probe/master] Fix typo in ooniprobe sample config file
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 1c24514e6418fb47307249734bfd7b6e23f766aa Author: Arturo Filastò <art(a)fuffa.org> Date: Mon Apr 22 17:57:35 2013 +0200 Fix typo in ooniprobe sample config file --- ooniprobe.conf.sample | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/ooniprobe.conf.sample b/ooniprobe.conf.sample index ab01583..27a4fb3 100644 --- a/ooniprobe.conf.sample +++ b/ooniprobe.conf.sample @@ -38,7 +38,7 @@ advanced: # After how many retries we should give up on a measurement measurement_retries: 2 # How many measurments to perform concurrently - measurement_concurrency = 100 + measurement_concurrency: 100 # After how may seconds we should give up reporting reporting_timeout: 30 # After how many retries to give up on reporting

1 0

[ooni-probe/master] Add libpcap-dev to dependencies
by art＠torproject.org 30 Apr '13

30 Apr '13

commit d409e2ec21c6433e166a66b6f3620cb9ce3a9a6a Author: Arturo Filastò <art(a)fuffa.org> Date: Mon Apr 22 17:50:42 2013 +0200 Add libpcap-dev to dependencies --- .travis.yml | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/.travis.yml b/.travis.yml index 78cf20e..2845bdf 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,6 +1,6 @@ language: python before_install: - - sudo apt-get install tor + - sudo apt-get install tor libpcap-dev python: - "2.7" - "2.6"

1 0

[ooni-probe/master] Add fabfile for updating of ooniprobe docs on ooni.tpo
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 4a27bdbd4a2e306c013c0d8326b6e15aa8d5b4eb Author: Arturo Filastò <art(a)fuffa.org> Date: Thu Jan 31 13:41:12 2013 +0100 Add fabfile for updating of ooniprobe docs on ooni.tpo --- docs/fabfile.py | 20 ++++++++++++++++++++ 1 files changed, 20 insertions(+), 0 deletions(-) diff --git a/docs/fabfile.py b/docs/fabfile.py new file mode 100644 index 0000000..d0461fd --- /dev/null +++ b/docs/fabfile.py @@ -0,0 +1,20 @@ +import os +from fabric.api import run +from fabric.context_managers import settings +from fabric.operations import sudo, local, put + +def update_docs(): + local('make html') + build_dir = os.path.join(os.getcwd(), 'build', 'html') + put(build_dir, '/tmp') + + run("sudo -u ooni rm -rf /home/ooni/website/build/docs/") + run("sudo -u ooni cp -R /tmp/html/ /home/ooni/website/build/docs") + + run("rm -rf /tmp/html") + update_website() + +def update_website(): + run("sudo -u mirroradm /usr/local/bin/static-master-update-component ooni.torproject.org") + +

1 0

[ooni-probe/master] Use ssh config file
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 7f8f366d556cac02e7d92baddc019286cc789b25 Author: Arturo Filastò <art(a)fuffa.org> Date: Sat Mar 2 16:47:45 2013 +0100 Use ssh config file --- docs/fabfile.py | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/docs/fabfile.py b/docs/fabfile.py index d0461fd..4e15993 100644 --- a/docs/fabfile.py +++ b/docs/fabfile.py @@ -1,8 +1,10 @@ import os -from fabric.api import run +from fabric.api import run, env from fabric.context_managers import settings from fabric.operations import sudo, local, put +env.use_ssh_config = True + def update_docs(): local('make html') build_dir = os.path.join(os.getcwd(), 'build', 'html')

1 0

[ooni-probe/master] Update README.md
by art＠torproject.org 30 Apr '13

30 Apr '13

commit cb12b185c5c01f891109282ed75b87a6ba842c5a Author: samsmith <github.com(a)msmith.net> Date: Mon Mar 4 16:01:07 2013 +0000 Update README.md tcpdump seems to be required on a clean debian (6.0.7) install. (this change may also need making in other places) --- README.md | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/README.md b/README.md index 13102d3..b49a69b 100644 --- a/README.md +++ b/README.md @@ -64,7 +64,7 @@ Basic system requirements: On Debian or Ubuntu GNU/Linux based systems these can be installed with: - sudo apt-get install git-core python python-pip python-dev build-essential tor tor-geoipdb + sudo apt-get install git-core python python-pip python-dev build-essential tor tor-geoipdb tcpdump Other packages that may be of interest:

1 0

[ooni-probe/master] Fix #8329, txscapy.PcapDummyWriter.write() has wrong signature method.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit b203c2e26985aa22bd8179da01fbdb642a12fc11 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sun Feb 24 22:45:12 2013 +0000 Fix #8329, txscapy.PcapDummyWriter.write() has wrong signature method. --- ooni/utils/txscapy.py | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/ooni/utils/txscapy.py b/ooni/utils/txscapy.py index 87c0b4a..a6cacb1 100644 --- a/ooni/utils/txscapy.py +++ b/ooni/utils/txscapy.py @@ -64,6 +64,7 @@ else: def __init__(self, pcap_filename, *arg, **kw): log.err("Initializing DummyPcapWriter. We will not actually write to a pcapfile") + @staticmethod def write(self): pass

1 0

[ooni-probe/master] Ported tls_handshake.py to be a nettest, rather than an external script.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 348befd12ca6e1f0e0deb75dff43e1994f098325 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Jan 23 19:34:30 2013 +0000 Ported tls_handshake.py to be a nettest, rather than an external script. --- nettests/experimental/tls_handshake.py | 231 ++++++++++++++++++++++++++++++++ 1 files changed, 231 insertions(+), 0 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py new file mode 100644 index 0000000..d909603 --- /dev/null +++ b/nettests/experimental/tls_handshake.py @@ -0,0 +1,231 @@ +#!/usr/bin/env python +# -*- encoding: utf-8 -*- +""" + tls_handshake.py + ---------------- + This file contains test cases for determining if a TLS handshake completes + successfully, including ways to test if a TLS handshake which uses Mozilla + Firefox's current ciphersuite list completes. + + These NetTestCases are a rewrite of a script contributed by Hackerberry + Finn, in order to fit into OONI's core network tests. + + @authors: Isis Agora Lovecruft <isis(a)torproject.org>, + Hackerberry Finn <anon@localhost> + @license: see included LICENSE file +""" + +import os +import socket +from socket import error as serror +import struct +import sys + +from ipaddr import IPAddress +from OpenSSL import SSL +from twisted.internet import defer +from twisted.python import usage + +from ooni import nettest, config +from ooni.utils import log + +## For a way to obtain the current version of Firefox's default ciphersuite +## list, see https://trac.torproject.org/projects/tor/attachment/ticket/4744/ +## and the attached file "get_mozilla_files.py". +## +## Note, however, that doing so requires the source code to the version of +## firefox that you wish to emulate. + +firefox_ciphers = ["ECDHE-ECDSA-AES256-SHA", + "ECDHE-RSA-AES256-SHA", + "DHE-RSA-CAMELLIA256-SHA", + "DHE-DSS-CAMELLIA256-SHA", + "DHE-RSA-AES256-SHA", + "DHE-DSS-AES256-SHA", + "ECDH-ECDSA-AES256-CBC-SHA", + "ECDH-RSA-AES256-CBC-SHA", + "CAMELLIA256-SHA", + "AES256-SHA", + "ECDHE-ECDSA-RC4-SHA", + "ECDHE-ECDSA-AES128-SHA", + "ECDHE-RSA-RC4-SHA", + "ECDHE-RSA-AES128-SHA", + "DHE-RSA-CAMELLIA128-SHA", + "DHE-DSS-CAMELLIA128-SHA",] + + +class UsageOptions(usage.Options): + optParameters = [ + ['host', 'h', None, 'Remote host IP address (v4/v6)'], + ['port', 'p', None, + "Use this port for all hosts, regardless of port specified in file"], + ['ciphersuite', 'c', None , + 'File containing ciphersuite list, one per line'],] + optFlags = [ + ['ssl2', '2', 'Use SSLv2'], + ['ssl3', '3', 'Use SSLv3'], + ['tls1', 't', 'Use TLSv1'],] + +class TLSHandshakeTest(nettest.NetTestCase): + """ + An ooniprobe NetTestCase for determining if we can complete a TLS handshake + with a remote host. + """ + name = 'tls-handshake' + author = 'Isis Lovecruft <isis(a)torproject.org>' + description = 'A test to determing if we can complete a TLS hankshake.' + version = '0.0.1' + + requiresRoot = False + usageOptions = UsageOptions + + inputFile = ['file', 'f', None, 'List of <IP>:<PORT>s to test'] + + def setUp(self, *args, **kwargs): + if self.localOptions: + options = self.localOptions + self.ciphers = [] + self.methods = [] + + ## check that we're actually testing an IP:PORT, else exit + ## gracefully: + if not (options['host'] and options['port']) \ + and not options['file']: + sys.exit("Need --host and --port, or --file!") + + ## set the SSL/TLS method to use: + for method in ['ssl2', 'ssl3', 'tls1']: + if options[method]: + self.methods.append(method) + + ## if we weren't given a file with a list of ciphersuites to use, + ## then use the firefox default list: + if not options['ciphersuite']: + self.ciphers = firefox_ciphers + else: + if os.path.isfile(options['ciphersuite']): + with open(options['ciphersuite']) as cipherfile: + for line in cipherfile.readlines(): + self.ciphers.append(line.strip()) + self.ciphersuite = ":".join(self.ciphers) + + if hasattr(config.advanced, 'default_timeout'): + timeout = config.advanced.default_timeout + else: + timeout = 10 ## default the timeout to 10 seconds + socket.setdefaulttimeout(timeout) + self.timeout = struct.pack('ll', int(timeout), 0) + + def splitInput(self, input): + addr, port = input.strip().rsplit(':', 1) + if self.localOptions['port']: + port = self.localOptions['port'] + return (str(addr), int(port)) + + def inputProcessor(self, file=None): + if os.path.isfile(file): + with open(file) as fh: + for line in fh.readlines(): + if line.startswith('#'): + continue + yield self.splitInput(line) + + def buildSocket(self, addr): + ip = IPAddress(addr) ## learn if we're IPv4 or IPv6 + if ip.version == 4: + s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + elif ip.version == 6: + s = socket.socket(socket.AF_INET6, socket.SOCK_STREAM) + return s + + def getContext(self): + if 'ssl2' in self.methods: + if not 'ssl3' in self.methods: + context = SSL.Context(SSL.SSLv2_METHOD) + else: + context = SSL.Context(SSL.SSLv23_METHOD) + elif 'ssl3' in self.methods: + context = SSL.Context(SSL.SSLv3_METHOD) + elif 'tls1' in self.methods: + context = SSL.Context(SSL.TLSv1_METHOD) + else: + raise Exception("No SSL/TLS method chosen!") + context.set_cipher_list(self.ciphersuite) + return context + + def test_tlsv1_handshake(self): + + def makeConnection(addr, port): + socket = self.buildSocket(addr) + context = self.getContext() + + connection = SSL.Connection(context, socket) + + try: + connection.connect((addr, port)) + except serror, se: + if se.message.find("[Errno 101]"): + connection.shutdown() + log.err(se) + else: + connection.setblocking(1) + connection.setsockopt(socket.SOL_SOCKET, socket.SO_RCVTIMEO, + self.timeout) + log.msg("Connected to %s" % connection.getpeername()) + log.msg("Connection state: %s " % connection.state_string()) + return connection + + def doHandshake(connection): + try: + connection.do_handshake() + except SSL.WantReadError(): + log.msg("Timeout exceeded.") + connection.shutdown() + else: + log.msg("State: %s" % connection.state_string()) + log.msg("Transmitted %d bytes" % connection.send("o\r\n")) + try: + recvstr = connection.recv(1024) + except SSL.WantReadError: + log.msg("Timeout exceeded") + connection.shutdown() + else: + log.msg("Received: %s" % recvstr) + return connection + + def handshakeSucceeded(connection): + if connection: + host, port = connection.getpeername() + self.report['host'] = host + self.report['port'] = port + self.report['state'] = connection.state_string() + + def handshakeFailed(connection, addr, port): + if connection is None: + self.report['host'] = addr + self.report['port'] = port + self.report['state'] = 'FAILED' + else: + return handshakeSucceeded(connection) + + addr, port = self.input + connection = defer.maybeDeferred(makeConnection, addr, port) + connection.addCallback(doHandshake) + connection.addErrback(log.err) + connection.addCallback(handshakeSucceeded) + connection.addErrback(handshakeFailed) + + return connection + +## XXX clean me up +## old function from anonymous contribution: (saved mostly for reference of the +## success string) +## +#def checkBridgeConnection(host, port) +# cipher_arg = ":".join(ciphers) +# cmd = ["openssl", "s_client", "-connect", "%s:%s" % (host,port)] +# cmd += ["-cipher", cipher_arg] +# proc = subprocess.Popen(cmd, stdout=PIPE, stderr=PIPE,stdin=PIPE) +# out, error = proc.communicate() +# success = "Cipher is DHE-RSA-AES256-SHA" in out +# return success

1 0