April 2013 - tor-commits - lists.torproject.org

[ooni-probe/master] Add Exception classes for conditions when the network is not reachable and
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 0dc64291dcf0c4ad6459d20b33123fc9cbe71ed6 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 01:45:54 2013 +0000 Add Exception classes for conditions when the network is not reachable and when a TLS/SSL context was not chosen from the test commandline options. --- nettests/experimental/tls_handshake.py | 16 ++++++++++++++++ 1 files changed, 16 insertions(+), 0 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index d909603..fc673cb 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -54,6 +54,22 @@ firefox_ciphers = ["ECDHE-ECDSA-AES256-SHA", "DHE-DSS-CAMELLIA128-SHA",] +class NoSSLContextError(Exception): + """ + Raised when we're missing the SSL context method, which should be one of + the following: + + * :attr:`OpenSSL.SSL.SSLv2_METHOD` + * :attr:`OpenSSL.SSL.SSLv23_METHOD` + * :attr:`OpenSSL.SSL.SSLv3_METHOD` + * :attr:`OpenSSL.SSL.TLSv1_METHOD` + """ + pass + +class HostUnreachableError(Exception): + """Raised when there the host IP address appears to be unreachable.""" + pass + class UsageOptions(usage.Options): optParameters = [ ['host', 'h', None, 'Remote host IP address (v4/v6)'],

1 0

[ooni-probe/master] Fix an error in the commandline options parsing which allowed commandline host
by art＠torproject.org 30 Apr '13

30 Apr '13

commit ac8824101fb99e5fd06e03d36bac1ffe7d03293d Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 01:49:57 2013 +0000 Fix an error in the commandline options parsing which allowed commandline host IP:port inputs in addition to a file of inputs, which would throw off the input_id counter and mess up reporting. --- nettests/experimental/tls_handshake.py | 6 ++---- 1 files changed, 2 insertions(+), 4 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index fc673cb..7f3c8ad 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -103,10 +103,8 @@ class TLSHandshakeTest(nettest.NetTestCase): self.ciphers = [] self.methods = [] - ## check that we're actually testing an IP:PORT, else exit - ## gracefully: - if not (options['host'] and options['port']) \ - and not options['file']: + ## check that we're testing an IP:PORT, else exit gracefully: + if not ((options['host'] and options['port']) or options['file']): sys.exit("Need --host and --port, or --file!") ## set the SSL/TLS method to use:

1 0

[ooni-probe/master] Add notes explaining defaults chosen if no commandline options are chosen, and
by art＠torproject.org 30 Apr '13

30 Apr '13

commit a4254fd3e90e3960497be61d4abd4eaf34cdce73 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 01:53:25 2013 +0000 Add notes explaining defaults chosen if no commandline options are chosen, and a note-to-self to explain to users that currently only one TLS/SSL context method can be chosen at a time. * TODO add support for looping through multiple TLS/SSL contexts. --- nettests/experimental/tls_handshake.py | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 7f3c8ad..6474792 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -107,16 +107,19 @@ class TLSHandshakeTest(nettest.NetTestCase): if not ((options['host'] and options['port']) or options['file']): sys.exit("Need --host and --port, or --file!") + ## xxx TODO there's nothing that tells the user they can only have + ## one of the TLS/SSL methods at a time. + ## set the SSL/TLS method to use: for method in ['ssl2', 'ssl3', 'tls1']: if options[method]: self.methods.append(method) - ## if we weren't given a file with a list of ciphersuites to use, - ## then use the firefox default list: if not options['ciphersuite']: self.ciphers = firefox_ciphers else: + ## if we weren't given a file with a list of ciphersuites to + ## use, then use the firefox default list: if os.path.isfile(options['ciphersuite']): with open(options['ciphersuite']) as cipherfile: for line in cipherfile.readlines():

1 0

[ooni-probe/master] Fix the logic on detecting if we have a config setting.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit c0b2e453e20303780b941d90c54aa04fd8b6a1ec Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 03:56:25 2013 +0000 Fix the logic on detecting if we have a config setting. * We can't use hasattr(config.basic, 'foo') because this gives None if not set, which means the default in the test doesn't get set. Instead, we want to use: if getattr(config.basic, 'foo', None) is not None: --- nettests/experimental/tls_handshake.py | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index c57545c..8bd4820 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -138,8 +138,8 @@ class TLSHandshakeTest(nettest.NetTestCase): self.ciphers.append(line.strip()) self.ciphersuite = ":".join(self.ciphers) - if hasattr(config.advanced, 'default_timeout'): - timeout = config.advanced.default_timeout + if getattr(config.advanced, 'default_timeout', None) is not None: + self.timeout = config.advanced.default_timeout else: timeout = 10 ## default the timeout to 10 seconds socket.setdefaulttimeout(timeout)

1 0

[ooni-probe/master] Switch to setting the TLS/SSL methods in setUp(), rather than in getContext().
by art＠torproject.org 30 Apr '13

30 Apr '13

commit a00f0700f0d6f2e3eed700f8c9bb8a5c77097d8b Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 03:38:21 2013 +0000 Switch to setting the TLS/SSL methods in setUp(), rather than in getContext(). --- nettests/experimental/tls_handshake.py | 20 ++++++++++++++++---- 1 files changed, 16 insertions(+), 4 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 6474792..c57545c 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -101,7 +101,6 @@ class TLSHandshakeTest(nettest.NetTestCase): if self.localOptions: options = self.localOptions self.ciphers = [] - self.methods = [] ## check that we're testing an IP:PORT, else exit gracefully: if not ((options['host'] and options['port']) or options['file']): @@ -111,9 +110,22 @@ class TLSHandshakeTest(nettest.NetTestCase): ## one of the TLS/SSL methods at a time. ## set the SSL/TLS method to use: - for method in ['ssl2', 'ssl3', 'tls1']: - if options[method]: - self.methods.append(method) + if options['ssl2']: + if not options['ssl3']: + self.context = SSL.Context(SSL.SSLv2_METHOD) + else: + self.context = SSL.Context(SSL.SSLv23_METHOD) + elif options['ssl3']: + self.context = SSL.Context(SSL.SSLv3_METHOD) + elif options['tls1']: + self.context = SSL.Context(SSL.TLSv1_METHOD) + else: + try: + raise NoSSLContextError( + "No SSL/TLS context chosen! Defaulting to TLSv1...") + except NoSSLContextError, ncse: + log.err(ncse.message) + self.context = SSL.Context(SSL.TLSv1_METHOD) if not options['ciphersuite']: self.ciphers = firefox_ciphers

1 0

[ooni-probe/master] Set the default socket timeout to 30 seconds.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 7daa7f2208542e55c617e542f0be322f52d103e4 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 04:02:24 2013 +0000 Set the default socket timeout to 30 seconds. --- nettests/experimental/tls_handshake.py | 10 +++++++--- 1 files changed, 7 insertions(+), 3 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 8bd4820..2c11122 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -141,9 +141,13 @@ class TLSHandshakeTest(nettest.NetTestCase): if getattr(config.advanced, 'default_timeout', None) is not None: self.timeout = config.advanced.default_timeout else: - timeout = 10 ## default the timeout to 10 seconds - socket.setdefaulttimeout(timeout) - self.timeout = struct.pack('ll', int(timeout), 0) + self.timeout = 30 ## default the timeout to 30 seconds + + ## xxx For debugging, set the socket timeout higher anyway: + self.timeout = 30 + + ## We have to set the default timeout on our sockets before creation: + socket.setdefaulttimeout(self.timeout) def splitInput(self, input): addr, port = input.strip().rsplit(':', 1)

1 0

[ooni-probe/master] Change getContext() to only set the ciphersuite list, and add method
by art＠torproject.org 30 Apr '13

30 Apr '13

commit dfc16658964a3bcbec5d94c970bde8c8927286d5 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 04:05:42 2013 +0000 Change getContext() to only set the ciphersuite list, and add method getPeerCert() for dumping the server x509 certificate. --- nettests/experimental/tls_handshake.py | 18 +++++++++--------- 1 files changed, 9 insertions(+), 9 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 2c11122..3e22f38 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -172,15 +172,15 @@ class TLSHandshakeTest(nettest.NetTestCase): return s def getContext(self): - if 'ssl2' in self.methods: - if not 'ssl3' in self.methods: - context = SSL.Context(SSL.SSLv2_METHOD) - else: - context = SSL.Context(SSL.SSLv23_METHOD) - elif 'ssl3' in self.methods: - context = SSL.Context(SSL.SSLv3_METHOD) - elif 'tls1' in self.methods: - context = SSL.Context(SSL.TLSv1_METHOD) + self.context.set_cipher_list(self.ciphersuite) + return self.context + + @staticmethod + def getPeerCert(connection, get_chain=False): + if not get_chain: + x509_cert = connection.get_peer_certificate() + pem_cert = dump_certificate(FILETYPE_PEM, x509_cert) + return pem_cert else: raise Exception("No SSL/TLS method chosen!") context.set_cipher_list(self.ciphersuite)

1 0

[ooni-probe/master] Add support for parsing the server certificate chain into a list of x509 certs
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 638359fa3df1901d150671c95087827fba8f4b7b Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 04:07:28 2013 +0000 Add support for parsing the server certificate chain into a list of x509 certs in method getPeerCert(). --- nettests/experimental/tls_handshake.py | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 3e22f38..af59227 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -182,9 +182,12 @@ class TLSHandshakeTest(nettest.NetTestCase): pem_cert = dump_certificate(FILETYPE_PEM, x509_cert) return pem_cert else: - raise Exception("No SSL/TLS method chosen!") - context.set_cipher_list(self.ciphersuite) - return context + cert_chain = [] + x509_cert_chain = connection.get_peer_cert_chain() + for x509_cert in x509_cert_chain: + pem_cert = dump_certificate(FILETYPE_PEM, x509_cert) + cert_chain.append(pem_cert) + return cert_chain def test_tlsv1_handshake(self):

1 0

[ooni-probe/master] Change method makeConnection to use self.input as-is, and add docstring.
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 54846399504b326fa010a750d3d0c53126adf54f Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 04:09:25 2013 +0000 Change method makeConnection to use self.input as-is, and add docstring. --- nettests/experimental/tls_handshake.py | 20 +++++++++++++++++--- 1 files changed, 17 insertions(+), 3 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index af59227..322ec72 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -190,10 +190,24 @@ class TLSHandshakeTest(nettest.NetTestCase): return cert_chain def test_tlsv1_handshake(self): - - def makeConnection(addr, port): - socket = self.buildSocket(addr) + """xxx fill me in""" + + def makeConnection(host): + """ + Create a socket to the host's IP address, then get the TLS/SSL context + method and ciphersuite list. Lastly, initiate a connection to the + host. + + @param host: A tuple of the host IP and port, i.e. (addr, port). + @returns: A :class:`OpenSSL.SSL.Connection` object (or any Exception + that was raised), and the :param:`host`. + """ + addr, port = host + sckt = self.buildSocket(addr) context = self.getContext() + connection = SSL.Connection(context, sckt) + connection.connect(host) + return connection connection = SSL.Connection(context, socket)

1 0

[ooni-probe/master] In connectionFailed, handle an error from makeConnection() where on some
by art＠torproject.org 30 Apr '13

30 Apr '13

commit 5cd30dababdf6f61187de215e2440a1917388007 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Feb 28 04:12:02 2013 +0000 In connectionFailed, handle an error from makeConnection() where on some systems, /dev/random is apparently set to 0600 root:root, and also add handling for propagating errors due to the network/server being unreachable. --- nettests/experimental/tls_handshake.py | 72 ++++++++++++++++++++++++++------ 1 files changed, 59 insertions(+), 13 deletions(-) diff --git a/nettests/experimental/tls_handshake.py b/nettests/experimental/tls_handshake.py index 322ec72..d84f174 100644 --- a/nettests/experimental/tls_handshake.py +++ b/nettests/experimental/tls_handshake.py @@ -209,20 +209,66 @@ class TLSHandshakeTest(nettest.NetTestCase): connection.connect(host) return connection - connection = SSL.Connection(context, socket) + def connectionFailed(connection, host): + """ + Handle errors raised while attempting to create the socket, TLS/SSL + context, and :class:`OpenSSL.SSL.Connection` object. - try: - connection.connect((addr, port)) - except serror, se: - if se.message.find("[Errno 101]"): - connection.shutdown() - log.err(se) + @param connection: The Exception that was raised in + :func:`makeConnection`. + @param host: A tuple of the host IP address as a string, and an int + specifying the host port, i.e. ('1.1.1.1', 443) + """ + addr, port = host + if isinstance(connection, IOError): + ## On some *nix distros, /dev/random is 0600 root:root and we get + ## a permissions error when trying to read + if connection.message.find("[Errno 13]"): + raise NotRootError( + "%s" % connection.message.split("[Errno 13]", 1)[1]) + + if isinstance(connection, socket_error): + if connection.message.find("[Errno 101]"): + raise HostUnreachableError( + "Host unreachable: %s:%s" % (addr, port)) + + log.err(connection) + self.report['host'] = addr + self.report['port'] = port + self.report['state'] = 'CONNECTION_FAILED' + return connection + + def connectionSucceeded(connection, host, timeout): + """ + If we have created a connection, set the socket options, and log the + connection state and peer name. + + @param connection: A :class:`OpenSSL.SSL.Connection` object. + @param host: A tuple of the host IP and port, i.e. ('1.1.1.1', 443). + """ + connection.setblocking(1) + ## Set the timeout on the connection: + ## + ## We want to set SO_RCVTIMEO and SO_SNDTIMEO, which both are + ## defined in the socket option definitions in <sys/socket.h>, and + ## which both take as their value, according to socket(7), a + ## struct timeval, which is defined in the libc manual: + ## https://www.gnu.org/software/libc/manual/html_node/Elapsed-Time.html + timeval = struct.pack('ll', int(timeout), 0) + connection.setsockopt(socket.SOL_SOCKET, socket.SO_RCVTIMEO, timeval) + connection.setsockopt(socket.SOL_SOCKET, socket.SO_SNDTIMEO, timeval) + + ## Set the connection state to client mode: + connection.set_connect_state() + + peer_name, peer_port = connection.getpeername() + if peer_name: + log.msg("Connected to %s" % peer_name) else: - connection.setblocking(1) - connection.setsockopt(socket.SOL_SOCKET, socket.SO_RCVTIMEO, - self.timeout) - log.msg("Connected to %s" % connection.getpeername()) - log.msg("Connection state: %s " % connection.state_string()) + log.debug("Couldn't get peer name from connection: %s" % host) + log.msg("Connected to: %s" % host) + log.msg("Connection state: %s " % connection.state_string()) + return connection def doHandshake(connection):

1 0