April 2013 - tor-commits - lists.torproject.org

[flashproxy/master] Add --facilitator-pubkey option to registration helpers.
by dcf＠torproject.org 30 Apr '13

30 Apr '13

commit e0dacb98ad9737b3c86b47df14cc8dd7da46f2f5 Author: Arlo Breault <arlolra(a)gmail.com> Date: Mon Apr 29 12:04:51 2013 -0700 Add --facilitator-pubkey option to registration helpers. It lets you give the name of a file holding a non-default facilitator public key. See https://trac.torproject.org/projects/tor/ticket/8800. --- flashproxy-reg-email | 18 +++++++++++++++--- flashproxy-reg-url | 45 ++++++++++++++++++++++++++++----------------- 2 files changed, 43 insertions(+), 20 deletions(-) diff --git a/flashproxy-reg-email b/flashproxy-reg-email index e446590..6336bb1 100755 --- a/flashproxy-reg-email +++ b/flashproxy-reg-email @@ -66,7 +66,7 @@ PUBKEY_SHA1 = "1926a5cb3fd7e48328188946e73ade84f55787dc".decode("hex") # the facilitator operators should have the corresponding private key. Given a # private key in reg-email, get the public key like this: # openssl rsa -pubout < reg-email > reg-email.pub -FACILITATOR_PUBKEY_PEM = """\ +DEFAULT_FACILITATOR_PUBKEY_PEM = """\ -----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA44Mt8c599/4N2fgu6ppN oatPW1GOgZxxObljFtEy0OWM1eHB35OOn+Kn9MxNHTRxVWwCEi0HYxWNVs2qrXxV @@ -78,6 +78,13 @@ gwIDAQAB -----END PUBLIC KEY----- """ +def get_facilitator_pubkey(filename): + if filename is not None: + return RSA.load_pub_key(filename) + else: + return RSA.load_pub_key_bio( + BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) + class options(object): remote_addr = None email_addr = None @@ -102,6 +109,7 @@ This program requires the M2Crypto library for Python. -6 name lookups use only IPv6. -d, --debug enable debugging output (Python smtplib messages). -e, --email=ADDRESS send mail to ADDRESS (default "%(email_addr)s"). + -k, --facilitator-pubkey=FILE corresponds to the reg-daemon private key -h, --help show this help. -s, --smtp=HOST[:PORT] use the given SMTP server (default "%(smtp_addr)s").\ @@ -178,8 +186,10 @@ def get_state_dir(): options.remote_addr = (DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) options.email_addr = DEFAULT_EMAIL_ADDRESS options.smtp_addr = (DEFAULT_SMTP_HOST, DEFAULT_SMTP_PORT) +options.facilitator_publickey_filename = None -opts, args = getopt.gnu_getopt(sys.argv[1:], "46de:hs:", ["debug", "email=", "help", "smtp="]) +opts, args = getopt.gnu_getopt(sys.argv[1:], "46de:k:hs:", + ["debug", "email=", "facilitator-pubkey=", "help", "smtp="]) for o, a in opts: if o == "-4": options.address_family = socket.AF_INET @@ -189,6 +199,8 @@ for o, a in opts: options.debug = True elif o == "-e" or o == "--email": options.email_addr = a + elif o == "-k" or o == "--facilitator-pubkey": + options.facilitator_publickey_filename = a elif o == "-h" or o == "--help": usage() sys.exit() @@ -269,7 +281,7 @@ try: options.remote_addr = parse_addr_spec(spec, *options.remote_addr) body_plain = (u"client=%s" % format_addr(options.remote_addr)).encode("utf-8") - rsa = RSA.load_pub_key_bio(BIO.MemoryBuffer(FACILITATOR_PUBKEY_PEM)) + rsa = get_facilitator_pubkey(options.facilitator_publickey_filename) body_crypt = rsa.public_encrypt(body_plain, RSA.pkcs1_oaep_padding) body = body_crypt.encode("base64") diff --git a/flashproxy-reg-url b/flashproxy-reg-url index 75f6905..4a4a555 100755 --- a/flashproxy-reg-url +++ b/flashproxy-reg-url @@ -11,6 +11,24 @@ from M2Crypto import RSA, BIO DEFAULT_REMOTE_PORT = 9000 DEFAULT_FACILITATOR_URL = "https://fp-facilitator.org/" +DEFAULT_FACILITATOR_PUBKEY_PEM = """\ +-----BEGIN PUBLIC KEY----- +MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA44Mt8c599/4N2fgu6ppN +oatPW1GOgZxxObljFtEy0OWM1eHB35OOn+Kn9MxNHTRxVWwCEi0HYxWNVs2qrXxV +84LmWBz6A65d2qBlgltgLXusiXLrpwxVmJeO+GfmbF8ur0U9JSYxA20cGW/kujNg +XYDGQxO1Gvxq2lHK2LQmBpkfKEE1DMFASmIvlHDQgDj3XBb5lYeOsHZmg16UrGAq +1UH238hgJITPGLXBtwLtJkYbrATJvrEcmvI7QSm57SgYGpaB5ZdCbJL5bag5Pgt6 +M5SDDYYY4xxEPzokjFJfCQv+kcyAnzERNMQ9kR41ePTXG62bpngK5iWGeJ5XdkxG +gwIDAQAB +-----END PUBLIC KEY----- +""" + +def get_facilitator_pubkey(filename): + if filename is not None: + return RSA.load_pub_key(filename) + else: + return RSA.load_pub_key_bio( + BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) class options(object): facilitator_url = None @@ -22,27 +40,16 @@ Print a URL, which, when retrieved, will cause the client address REMOTE[:PORT] to be registered with the flash proxy facilitator. The default PORT is %(port)d. - -f, --facilitator=URL register with the given facilitator - (by default "%(fac_url)s"). - -h, --help show this help.\ + -f, --facilitator=URL register with the given facilitator + (by default "%(fac_url)s"). + -k, --facilitator-pubkey=FILE corresponds to the reg-daemon private key + -h, --help show this help.\ """ % { "progname": sys.argv[0], "fac_url": DEFAULT_FACILITATOR_URL, "port": DEFAULT_REMOTE_PORT, } -FACILITATOR_PUBKEY_PEM = """\ ------BEGIN PUBLIC KEY----- -MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA44Mt8c599/4N2fgu6ppN -oatPW1GOgZxxObljFtEy0OWM1eHB35OOn+Kn9MxNHTRxVWwCEi0HYxWNVs2qrXxV -84LmWBz6A65d2qBlgltgLXusiXLrpwxVmJeO+GfmbF8ur0U9JSYxA20cGW/kujNg -XYDGQxO1Gvxq2lHK2LQmBpkfKEE1DMFASmIvlHDQgDj3XBb5lYeOsHZmg16UrGAq -1UH238hgJITPGLXBtwLtJkYbrATJvrEcmvI7QSm57SgYGpaB5ZdCbJL5bag5Pgt6 -M5SDDYYY4xxEPzokjFJfCQv+kcyAnzERNMQ9kR41ePTXG62bpngK5iWGeJ5XdkxG -gwIDAQAB ------END PUBLIC KEY----- -""" - def parse_addr_spec(spec, defhost = None, defport = None): host = None port = None @@ -94,11 +101,15 @@ def format_addr(addr): return result options.facilitator_url = DEFAULT_FACILITATOR_URL +options.facilitator_publickey_filename = None -opt, args = getopt.gnu_getopt(sys.argv[1:], "f:h", ["facilitator=", "help"]) +opt, args = getopt.gnu_getopt(sys.argv[1:], "f:k:h", + ["facilitator=", "facilitator-pubkey=", "help"]) for o, a in opt: if o == "-f" or o == "--facilitator": options.facilitator_url = a + elif o == "-k" or o == "--facilitator-pubkey": + options.facilitator_publickey_filename = a elif o == "-h" or o == "--help": usage() sys.exit() @@ -113,7 +124,7 @@ if remote_addr[0] is None: sys.exit(1) reg_plain = (u"client=%s" % format_addr(remote_addr)).encode("utf-8") -rsa = RSA.load_pub_key_bio(BIO.MemoryBuffer(FACILITATOR_PUBKEY_PEM)) +rsa = get_facilitator_pubkey(options.facilitator_publickey_filename) reg_crypt = rsa.public_encrypt(reg_plain, RSA.pkcs1_oaep_padding) reg = base64.urlsafe_b64encode(reg_crypt)

1 0

[flashproxy/master] Get rid of -k alias for --facilitator-pubkey.
by dcf＠torproject.org 30 Apr '13

30 Apr '13

commit a921d1becd608541fcfc84998895649ebd8e52bb Author: David Fifield <david(a)bamsoftware.com> Date: Mon Apr 29 23:51:05 2013 -0700 Get rid of -k alias for --facilitator-pubkey. I expect this will be an option used only in special circumstances. --- flashproxy-reg-email | 8 +++++--- flashproxy-reg-url | 14 ++++++++------ 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/flashproxy-reg-email b/flashproxy-reg-email index 5164c7e..f5ab0d0 100755 --- a/flashproxy-reg-email +++ b/flashproxy-reg-email @@ -110,7 +110,9 @@ This program requires the M2Crypto library for Python. -6 name lookups use only IPv6. -d, --debug enable debugging output (Python smtplib messages). -e, --email=ADDRESS send mail to ADDRESS (default "%(email_addr)s"). - -k, --facilitator-pubkey=FILE corresponds to the reg-daemon private key + --facilitator-pubkey=FILENAME + encrypt registrations to the given PEM-formatted + public key (default built-in). -h, --help show this help. -s, --smtp=HOST[:PORT] use the given SMTP server (default "%(smtp_addr)s").\ @@ -188,7 +190,7 @@ options.remote_addr = (DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) options.email_addr = DEFAULT_EMAIL_ADDRESS options.smtp_addr = (DEFAULT_SMTP_HOST, DEFAULT_SMTP_PORT) -opts, args = getopt.gnu_getopt(sys.argv[1:], "46de:k:hs:", +opts, args = getopt.gnu_getopt(sys.argv[1:], "46de:hs:", ["debug", "email=", "facilitator-pubkey=", "help", "smtp="]) for o, a in opts: if o == "-4": @@ -199,7 +201,7 @@ for o, a in opts: options.debug = True elif o == "-e" or o == "--email": options.email_addr = a - elif o == "-k" or o == "--facilitator-pubkey": + elif o == "--facilitator-pubkey": options.facilitator_pubkey_filename = a elif o == "-h" or o == "--help": usage() diff --git a/flashproxy-reg-url b/flashproxy-reg-url index b094b9b..548e965 100755 --- a/flashproxy-reg-url +++ b/flashproxy-reg-url @@ -41,10 +41,12 @@ Print a URL, which, when retrieved, will cause the client address REMOTE[:PORT] to be registered with the flash proxy facilitator. The default PORT is %(port)d. - -f, --facilitator=URL register with the given facilitator - (by default "%(fac_url)s"). - -k, --facilitator-pubkey=FILE corresponds to the reg-daemon private key - -h, --help show this help.\ + -f, --facilitator=URL register with the given facilitator + (by default "%(fac_url)s"). + --facilitator-pubkey=FILENAME + encrypt registrations to the given PEM-formatted + public key (default built-in). + -h, --help show this help.\ """ % { "progname": sys.argv[0], "fac_url": DEFAULT_FACILITATOR_URL, @@ -103,12 +105,12 @@ def format_addr(addr): options.facilitator_url = DEFAULT_FACILITATOR_URL -opt, args = getopt.gnu_getopt(sys.argv[1:], "f:k:h", +opt, args = getopt.gnu_getopt(sys.argv[1:], "f:h", ["facilitator=", "facilitator-pubkey=", "help"]) for o, a in opt: if o == "-f" or o == "--facilitator": options.facilitator_url = a - elif o == "-k" or o == "--facilitator-pubkey": + elif o == "--facilitator-pubkey": options.facilitator_pubkey_filename = a elif o == "-h" or o == "--help": usage()

1 0

[flashproxy/master] Formatting.
by dcf＠torproject.org 30 Apr '13

30 Apr '13

commit e5dd34164888767126b3430530733bca6460e7cd Author: David Fifield <david(a)bamsoftware.com> Date: Mon Apr 29 23:52:43 2013 -0700 Formatting. --- flashproxy-reg-email | 6 ++---- flashproxy-reg-url | 6 ++---- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/flashproxy-reg-email b/flashproxy-reg-email index f5ab0d0..b2e5ba4 100755 --- a/flashproxy-reg-email +++ b/flashproxy-reg-email @@ -82,8 +82,7 @@ def get_facilitator_pubkey(): if options.facilitator_pubkey_filename is not None: return RSA.load_pub_key(options.facilitator_pubkey_filename) else: - return RSA.load_pub_key_bio( - BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) + return RSA.load_pub_key_bio(BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) class options(object): remote_addr = None @@ -190,8 +189,7 @@ options.remote_addr = (DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) options.email_addr = DEFAULT_EMAIL_ADDRESS options.smtp_addr = (DEFAULT_SMTP_HOST, DEFAULT_SMTP_PORT) -opts, args = getopt.gnu_getopt(sys.argv[1:], "46de:hs:", - ["debug", "email=", "facilitator-pubkey=", "help", "smtp="]) +opts, args = getopt.gnu_getopt(sys.argv[1:], "46de:hs:", ["debug", "email=", "facilitator-pubkey=", "help", "smtp="]) for o, a in opts: if o == "-4": options.address_family = socket.AF_INET diff --git a/flashproxy-reg-url b/flashproxy-reg-url index 548e965..e8aa61a 100755 --- a/flashproxy-reg-url +++ b/flashproxy-reg-url @@ -27,8 +27,7 @@ def get_facilitator_pubkey(): if options.facilitator_pubkey_filename is not None: return RSA.load_pub_key(options.facilitator_pubkey_filename) else: - return RSA.load_pub_key_bio( - BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) + return RSA.load_pub_key_bio(BIO.MemoryBuffer(DEFAULT_FACILITATOR_PUBKEY_PEM)) class options(object): facilitator_url = None @@ -105,8 +104,7 @@ def format_addr(addr): options.facilitator_url = DEFAULT_FACILITATOR_URL -opt, args = getopt.gnu_getopt(sys.argv[1:], "f:h", - ["facilitator=", "facilitator-pubkey=", "help"]) +opt, args = getopt.gnu_getopt(sys.argv[1:], "f:h", ["facilitator=", "facilitator-pubkey=", "help"]) for o, a in opt: if o == "-f" or o == "--facilitator": options.facilitator_url = a

1 0

[flashproxy/master] Move facilitator_publickey_filename into the global options block.
by dcf＠torproject.org 30 Apr '13

30 Apr '13

commit b1be79a1132d6b16e46af4148711ae7a8bb147de Author: David Fifield <david(a)bamsoftware.com> Date: Mon Apr 29 23:41:45 2013 -0700 Move facilitator_publickey_filename into the global options block. --- flashproxy-reg-email | 2 +- flashproxy-reg-url | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/flashproxy-reg-email b/flashproxy-reg-email index 6336bb1..2d333bc 100755 --- a/flashproxy-reg-email +++ b/flashproxy-reg-email @@ -91,6 +91,7 @@ class options(object): smtp_addr = None debug = False address_family = socket.AF_UNSPEC + facilitator_publickey_filename = None def usage(f = sys.stdout): print >> f, """\ @@ -186,7 +187,6 @@ def get_state_dir(): options.remote_addr = (DEFAULT_REMOTE_ADDRESS, DEFAULT_REMOTE_PORT) options.email_addr = DEFAULT_EMAIL_ADDRESS options.smtp_addr = (DEFAULT_SMTP_HOST, DEFAULT_SMTP_PORT) -options.facilitator_publickey_filename = None opts, args = getopt.gnu_getopt(sys.argv[1:], "46de:k:hs:", ["debug", "email=", "facilitator-pubkey=", "help", "smtp="]) diff --git a/flashproxy-reg-url b/flashproxy-reg-url index 4a4a555..e1497de 100755 --- a/flashproxy-reg-url +++ b/flashproxy-reg-url @@ -32,6 +32,7 @@ def get_facilitator_pubkey(filename): class options(object): facilitator_url = None + facilitator_publickey_filename = None def usage(f = sys.stdout): print >> f, """\ @@ -101,7 +102,6 @@ def format_addr(addr): return result options.facilitator_url = DEFAULT_FACILITATOR_URL -options.facilitator_publickey_filename = None opt, args = getopt.gnu_getopt(sys.argv[1:], "f:k:h", ["facilitator=", "facilitator-pubkey=", "help"])

1 0

[flashproxy/master] facilitator_publickey_filename → facilitator_pubkey_filename.
by dcf＠torproject.org 30 Apr '13

30 Apr '13

commit eeb4bcbd52556c0b756ba1bd53c10509e191972a Author: David Fifield <david(a)bamsoftware.com> Date: Mon Apr 29 23:42:25 2013 -0700 facilitator_publickey_filename → facilitator_pubkey_filename. --- flashproxy-reg-email | 4 ++-- flashproxy-reg-url | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/flashproxy-reg-email b/flashproxy-reg-email index 2d333bc..45609c9 100755 --- a/flashproxy-reg-email +++ b/flashproxy-reg-email @@ -91,7 +91,7 @@ class options(object): smtp_addr = None debug = False address_family = socket.AF_UNSPEC - facilitator_publickey_filename = None + facilitator_pubkey_filename = None def usage(f = sys.stdout): print >> f, """\ @@ -200,7 +200,7 @@ for o, a in opts: elif o == "-e" or o == "--email": options.email_addr = a elif o == "-k" or o == "--facilitator-pubkey": - options.facilitator_publickey_filename = a + options.facilitator_pubkey_filename = a elif o == "-h" or o == "--help": usage() sys.exit() diff --git a/flashproxy-reg-url b/flashproxy-reg-url index e1497de..b9cdcc9 100755 --- a/flashproxy-reg-url +++ b/flashproxy-reg-url @@ -32,7 +32,7 @@ def get_facilitator_pubkey(filename): class options(object): facilitator_url = None - facilitator_publickey_filename = None + facilitator_pubkey_filename = None def usage(f = sys.stdout): print >> f, """\ @@ -109,7 +109,7 @@ for o, a in opt: if o == "-f" or o == "--facilitator": options.facilitator_url = a elif o == "-k" or o == "--facilitator-pubkey": - options.facilitator_publickey_filename = a + options.facilitator_pubkey_filename = a elif o == "-h" or o == "--help": usage() sys.exit()

1 0

[flashproxy/master] Update imap.gmail.com public key pin.
by dcf＠torproject.org 30 Apr '13

30 Apr '13

commit eeac0038fbfbe89a33424a3f7c96dec3b21581a7 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Apr 29 23:11:25 2013 -0700 Update imap.gmail.com public key pin. The key appears to have changed between Tue Apr 30 01:53:12 EDT 2013 Tue Apr 30 02:04:24 EDT 2013 This is the new cert: nmap --script=ssl-cert -p 993 -Pn imap.gmail.com -v | ssl-cert: Subject: commonName=imap.gmail.com/organizationName=Google Inc/stateOrProvinceName=California/countryName=US/localityName=Mountain View | Issuer: commonName=Google Internet Authority/organizationName=Google Inc/countryName=US | Public Key type: rsa | Public Key bits: 1024 | Not valid before: 2013-04-15T07:44:00+00:00 | Not valid after: 2013-12-31T15:58:50+00:00 | MD5: a52a 01f4 9bb0 ac6f c519 ab60 d117 fe26 | SHA-1: b0ba 392b ba32 6e6f eb1a dd4d 04fa 0fb8 6cd1 73fa | -----BEGIN CERTIFICATE----- | MIIDgDCCAumgAwIBAgIKVEsbtQABAACELjANBgkqhkiG9w0BAQUFADBGMQswCQYD | VQQGEwJVUzETMBEGA1UEChMKR29vZ2xlIEluYzEiMCAGA1UEAxMZR29vZ2xlIElu | dGVybmV0IEF1dGhvcml0eTAeFw0xMzA0MTUwODQ0MDBaFw0xMzEyMzExNTU4NTBa | MGgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1N | b3VudGFpbiBWaWV3MRMwEQYDVQQKEwpHb29nbGUgSW5jMRcwFQYDVQQDEw5pbWFw | LmdtYWlsLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA3a/wUjZBSOgZ | EeyRqaSaKEwS8+1y/8AK9HdplSR72PU+iBc7HyA4aXgD6XYEJVoyGsO97nMj+oeN | 2iNvKfkPvTrn2YnQfJLuxpEw9gwIHvwVqy3TNpHwt4DHnxOg5CxV8e7PaCAhAXD+ | uj0H09aVFJmfYDnU0VSSukNJX2MZSJUCAwEAAaOCAVEwggFNMB0GA1UdJQQWMBQG | CCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUY9A6EExy3NNFBc2R0vrY8lpf | OB8wHwYDVR0jBBgwFoAUv8Aw6/VDET5nup6R+/xq2uNrEiQwWwYDVR0fBFQwUjBQ | oE6gTIZKaHR0cDovL3d3dy5nc3RhdGljLmNvbS9Hb29nbGVJbnRlcm5ldEF1dGhv | cml0eS9Hb29nbGVJbnRlcm5ldEF1dGhvcml0eS5jcmwwZgYIKwYBBQUHAQEEWjBY | MFYGCCsGAQUFBzAChkpodHRwOi8vd3d3LmdzdGF0aWMuY29tL0dvb2dsZUludGVy | bmV0QXV0aG9yaXR5L0dvb2dsZUludGVybmV0QXV0aG9yaXR5LmNydDAMBgNVHRMB | Af8EAjAAMBkGA1UdEQQSMBCCDmltYXAuZ21haWwuY29tMA0GCSqGSIb3DQEBBQUA | A4GBAAcrDCcXCKZ2VNcJv31SSXTKs1AH0sU1lvAB0kzy3mIB/H8UHvMz1+T3Lfmy | 68bqBSM97W6MO6UiqmVvbMhwPBrktUVT/Q4cWskVf2MONrW3g0UtX47L1ocs/WZe | XdUTkjQ3EFCzxpw4joHefndfZHsEn0VrjZR49kzR9+1Me7Rz |_-----END CERTIFICATE----- --- facilitator/facilitator-email-poller | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/facilitator/facilitator-email-poller b/facilitator/facilitator-email-poller index e2a794e..c90fa66 100755 --- a/facilitator/facilitator-email-poller +++ b/facilitator/facilitator-email-poller @@ -58,7 +58,7 @@ A4GBAFjOKer89961zgK5F7WF0bnj4JXMJTENAKaSbn+2kmOeUJXRmm/kEd5jhW6Y # SHA-1 digest of expected public key. See # http://www.imperialviolet.org/2011/05/04/pinning.html for the reason behind # hashing the public key, not the entire certificate. -PUBKEY_SHA1 = "fc54c0b2fcfcdfe4abf2f1755dfd3376f6481703".decode("hex") +PUBKEY_SHA1 = "63c445c009328b663cdff9cb68f6c523ac7b6c2b".decode("hex") LOG_DATE_FORMAT = "%Y-%m-%d %H:%M:%S"

1 0

[flashproxy/master] ChangeLog for TRANSPORT command.
by dcf＠torproject.org 30 Apr '13

30 Apr '13

commit 5f8ccaff8f74743171e0c7fbb39bdf17513b2412 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Apr 29 22:57:18 2013 -0700 ChangeLog for TRANSPORT command. --- ChangeLog | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/ChangeLog b/ChangeLog index bc64bf2..879563b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -5,6 +5,9 @@ Changes in version 1.0 o Fixed badge rendering for a certain combination of Chrome and AdBlock Plus. Patch by Arlo Breault. Fixes bug 8300. + o websocket-server sends the new TRANSPORT command of the extended OR + port protocol to identify incoming connections as websocket. + o There is now a 10-second HTTP request timeout in websocket-server. Changes in version 0.12

1 0

[flashproxy/master] Send the TRANSPORT extended OR port command.
by dcf＠torproject.org 30 Apr '13

30 Apr '13

commit 88e36fcd4393c775001af69c4fec351b8efec43a Author: David Fifield <david(a)bamsoftware.com> Date: Mon Apr 29 22:54:59 2013 -0700 Send the TRANSPORT extended OR port command. This is based on the spec from the bug7751_take2 branch from https://trac.torproject.org/projects/tor/ticket/7751. --- websocket-transport/pt.go | 33 ++++++++++++++++++++---------- websocket-transport/websocket-server.go | 4 +- 2 files changed, 24 insertions(+), 13 deletions(-) diff --git a/websocket-transport/pt.go b/websocket-transport/pt.go index 61ec456..0ff1644 100644 --- a/websocket-transport/pt.go +++ b/websocket-transport/pt.go @@ -466,10 +466,11 @@ func extOrPortAuthenticate(s *net.TCPConn, info *PtServerInfo) error { // See section 3.1 of 196-transport-control-ports.txt. const ( - extOrCmdDone = 0x0000 - extOrCmdUserAddr = 0x0001 - extOrCmdOkay = 0x1000 - extOrCmdDeny = 0x1001 + extOrCmdDone = 0x0000 + extOrCmdUserAddr = 0x0001 + extOrCmdTransport = 0x0002 + extOrCmdOkay = 0x1000 + extOrCmdDeny = 0x1001 ) func extOrPortWriteCommand(s *net.TCPConn, cmd uint16, body []byte) error { @@ -497,12 +498,18 @@ func extOrPortWriteCommand(s *net.TCPConn, cmd uint16, body []byte) error { return nil } -// Send a USERADDR command on s. See section 3.1 of +// Send a USERADDR command on s. See section 3.1.2.1 of // 196-transport-control-ports.txt. func extOrPortSendUserAddr(s *net.TCPConn, conn net.Conn) error { return extOrPortWriteCommand(s, extOrCmdUserAddr, []byte(conn.RemoteAddr().String())) } +// Send a TRANSPORT command on s. See section 3.1.2.2 of +// 196-transport-control-ports.txt. +func extOrPortSendTransport(s *net.TCPConn, methodName string) error { + return extOrPortWriteCommand(s, extOrCmdTransport, []byte(methodName)) +} + // Send a DONE command on s. See section 3.1 of 196-transport-control-ports.txt. func extOrPortSendDone(s *net.TCPConn) error { return extOrPortWriteCommand(s, extOrCmdDone, []byte{}) @@ -534,16 +541,20 @@ func extOrPortRecvCommand(s *net.TCPConn) (cmd uint16, body []byte, err error) { return cmd, body, err } -// Send a USERADDR command followed by a DONE command. Wait for an OKAY or DENY -// response command from the server. Returns nil if and only if OKAY is -// received. -func extOrPortDoUserAddr(s *net.TCPConn, conn net.Conn) error { +// Send USERADDR and TRANSPORT commands followed by a DONE command. Wait for an +// OKAY or DENY response command from the server. Returns nil if and only if +// OKAY is received. +func extOrPortSetup(s *net.TCPConn, conn net.Conn, methodName string) error { var err error err = extOrPortSendUserAddr(s, conn) if err != nil { return err } + err = extOrPortSendTransport(s, methodName) + if err != nil { + return err + } err = extOrPortSendDone(s) if err != nil { return err @@ -565,7 +576,7 @@ func extOrPortDoUserAddr(s *net.TCPConn, conn net.Conn) error { // open *net.TCPConn. If connecting to the extended OR port, extended OR port // authentication à la 217-ext-orport-auth.txt is done before returning; an // error is returned if authentication fails. -func PtConnectOr(info *PtServerInfo, conn net.Conn) (*net.TCPConn, error) { +func PtConnectOr(info *PtServerInfo, conn net.Conn, methodName string) (*net.TCPConn, error) { if info.ExtendedOrAddr == nil { return net.DialTCP("tcp", nil, info.OrAddr) } @@ -580,7 +591,7 @@ func PtConnectOr(info *PtServerInfo, conn net.Conn) (*net.TCPConn, error) { s.Close() return nil, err } - err = extOrPortDoUserAddr(s, conn) + err = extOrPortSetup(s, conn, methodName) if err != nil { s.Close() return nil, err diff --git a/websocket-transport/websocket-server.go b/websocket-transport/websocket-server.go index 1abff87..27fc7e2 100644 --- a/websocket-transport/websocket-server.go +++ b/websocket-transport/websocket-server.go @@ -19,6 +19,7 @@ import ( "time" ) +const ptMethodName = "websocket" const requestTimeout = 10 * time.Second var logFile = os.Stderr @@ -168,7 +169,7 @@ func websocketHandler(ws *Websocket) { handlerChan <- -1 }() - s, err := PtConnectOr(&ptInfo, ws.Conn) + s, err := PtConnectOr(&ptInfo, ws.Conn, ptMethodName) if err != nil { Log("Failed to connect to ORPort: " + err.Error()) return @@ -200,7 +201,6 @@ func startListener(addr *net.TCPAddr) (*net.TCPListener, error) { } func main() { - const ptMethodName = "websocket" var defaultPort int var logFilename string

1 0

r26176: {website} Replacing Seth with Micah Lee on GSoC projects Request from (website/trunk/getinvolved/en)
by Damian Johnson 30 Apr '13

30 Apr '13

Author: atagar Date: 2013-04-30 03:22:25 +0000 (Tue, 30 Apr 2013) New Revision: 26176 Modified: website/trunk/getinvolved/en/volunteer.wml Log: Replacing Seth with Micah Lee on GSoC projects Request from Seth since Micah is taking over maintenance of HTTPSEverywhere. Modified: website/trunk/getinvolved/en/volunteer.wml =================================================================== --- website/trunk/getinvolved/en/volunteer.wml 2013-04-30 02:28:39 UTC (rev 26175) +++ website/trunk/getinvolved/en/volunteer.wml 2013-04-30 03:22:25 UTC (rev 26176) @@ -1351,7 +1351,7 @@ Skill Level: Medium - Likely Mentors: Peter Eckersley (pde), Seth Schoen + Likely Mentors: Peter Eckersley (pde), Micah Lee When users manually disable an HTTPS Everywhere ruleset via the toolbar menu, that's a strong hint that that ruleset might be buggy. If we could obtain @@ -1384,7 +1384,7 @@ Skill Level: Medium - Likely Mentors: Peter Eckersley (pde), Seth Schoen + Likely Mentors: Peter Eckersley (pde), Micah Lee In the past a Firefox Mobile port of HTTPS Everywhere was made impractically complicated by the Electrolysis threading architecture used in that variant of @@ -1408,7 +1408,7 @@ Skill Level: Medium - Likely Mentors: Peter Eckersley (pde), Seth Schoen + Likely Mentors: Peter Eckersley (pde), Micah Lee Since version 20, Chrome has automatically blocked the loading of insecure HTTP scripts and CSS in HTTPS pages. Firefox version 23 will do the same. @@ -1449,7 +1449,7 @@ Skill Level: Medium - Likely Mentors: Peter Eckersley (pde), Seth Schoen + Likely Mentors: Peter Eckersley (pde), Micah Lee Ondrej Mikle has implemented a codebase for testing HTTPS Everywhere rulesets by crawling pages that are affected by the ruleset (<a href="https://github.com/hiviah/https-everywhere-checker">repository</a>).

1 0

[torbrowser/master] bump recommended-versions for new alpha tbbs
by erinn＠torproject.org 30 Apr '13

30 Apr '13

commit 567682bdf921b84417a7c282a1ed2dd40aebbc74 Author: Erinn Clark <erinn(a)torproject.org> Date: Mon Apr 29 23:42:49 2013 -0300 bump recommended-versions for new alpha tbbs --- build-scripts/recommended-versions | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) diff --git a/build-scripts/recommended-versions b/build-scripts/recommended-versions index 09129d2..8c3a5b5 100644 --- a/build-scripts/recommended-versions +++ b/build-scripts/recommended-versions @@ -2,7 +2,7 @@ "2.3.25-6-MacOS", "2.3.25-6-Windows", "2.3.25-6-Linux", -"2.4.11-alpha-2-MacOS", -"2.4.11-alpha-2-Windows", -"2.4.11-alpha-2-Linux" +"2.4.12-alpha-1-MacOS", +"2.4.12-alpha-1-Windows", +"2.4.12-alpha-1-Linux" ]

1 0