August 2013 - tor-commits - lists.torproject.org

[flashproxy/master] Unexport somethings in socks.
by dcf＠torproject.org 11 Aug '13

11 Aug '13

commit 5d8002b4aad3045f7986419d79d3cf93d5cf9366 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Aug 11 17:41:31 2013 -0700 Unexport somethings in socks. --- websocket-transport/src/pt/socks/socks.go | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/websocket-transport/src/pt/socks/socks.go b/websocket-transport/src/pt/socks/socks.go index d6624fd..788d53c 100644 --- a/websocket-transport/src/pt/socks/socks.go +++ b/websocket-transport/src/pt/socks/socks.go @@ -23,22 +23,22 @@ const ( // request failed message. Otherwise, sends a SOCKS request granted message for // the destination address returned by the callback. func AwaitSocks4aConnect(conn *net.TCPConn, connect func(string) (*net.TCPAddr, error)) error { - dest, err := ReadSocks4aConnect(conn) + dest, err := readSocks4aConnect(conn) if err != nil { - SendSocks4aResponseFailed(conn) + sendSocks4aResponseFailed(conn) return err } destAddr, err := connect(dest) if err != nil { - SendSocks4aResponseFailed(conn) + sendSocks4aResponseFailed(conn) return err } - SendSocks4aResponseGranted(conn, destAddr) + sendSocks4aResponseGranted(conn, destAddr) return nil } // Read a SOCKS4a connect request. Returns a "host:port" string. -func ReadSocks4aConnect(s io.Reader) (string, error) { +func readSocks4aConnect(s io.Reader) (string, error) { r := bufio.NewReader(s) var h [8]byte @@ -80,7 +80,7 @@ func ReadSocks4aConnect(s io.Reader) (string, error) { } // Send a SOCKS4a response with the given code and address. -func SendSocks4aResponse(w io.Writer, code byte, addr *net.TCPAddr) error { +func sendSocks4aResponse(w io.Writer, code byte, addr *net.TCPAddr) error { var resp [8]byte resp[0] = socksResponseVersion resp[1] = code @@ -97,11 +97,11 @@ func SendSocks4aResponse(w io.Writer, code byte, addr *net.TCPAddr) error { var emptyAddr = net.TCPAddr{IP: net.IPv4(0, 0, 0, 0), Port: 0} // Send a SOCKS4a response code 0x5a. -func SendSocks4aResponseGranted(w io.Writer, addr *net.TCPAddr) error { - return SendSocks4aResponse(w, socksRequestGranted, addr) +func sendSocks4aResponseGranted(w io.Writer, addr *net.TCPAddr) error { + return sendSocks4aResponse(w, socksRequestGranted, addr) } // Send a SOCKS4a response code 0x5b (with an all-zero address). -func SendSocks4aResponseFailed(w io.Writer) error { - return SendSocks4aResponse(w, socksRequestFailed, &emptyAddr) +func sendSocks4aResponseFailed(w io.Writer) error { + return sendSocks4aResponse(w, socksRequestFailed, &emptyAddr) }

1 0

[flashproxy/master] Comment tweaking.
by dcf＠torproject.org 11 Aug '13

11 Aug '13

commit 5368c14ab65c52d22babb2095ea4bb4c99b3a09e Author: David Fifield <david(a)bamsoftware.com> Date: Sun Aug 11 18:37:22 2013 -0700 Comment tweaking. --- websocket-transport/src/pt/pt.go | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/websocket-transport/src/pt/pt.go b/websocket-transport/src/pt/pt.go index e4fdba4..2a3e348 100644 --- a/websocket-transport/src/pt/pt.go +++ b/websocket-transport/src/pt/pt.go @@ -278,7 +278,7 @@ func getServerBindAddrs(methodNames []string) []BindAddr { return result } -// Reads and validates the contents of an auth cookie file. Returns the 32-byte +// Read and validate the contents of an auth cookie file. Returns the 32-byte // cookie. See section 4.2.1.2 of pt-spec.txt. func readAuthCookieFile(filename string) ([]byte, error) { authCookieHeader := []byte("! Extended ORPort Auth Cookie !\x0a") @@ -315,7 +315,8 @@ func readAuthCookieFile(filename string) ([]byte, error) { } // This structure is returned by ServerSetup. It consists of a list of -// BindAddrs, along with a single address for the ORPort. +// BindAddrs, an address for the ORPort, an address for the extended ORPort (if +// any), and an authentication cookie (if any). type ServerInfo struct { BindAddrs []BindAddr OrAddr *net.TCPAddr @@ -325,7 +326,8 @@ type ServerInfo struct { // Check the server pluggable transports environments, emitting an error message // and exiting the program if any error is encountered. Resolves the various -// requested bind addresses and the server ORPort. Returns a ServerInfo struct. +// requested bind addresses, the server ORPort and extended ORPort, and reads +// the auth cookie file. Returns a ServerInfo struct. func ServerSetup(methodNames []string) ServerInfo { var info ServerInfo var err error

1 0

[flashproxy/master] Move websocket into its own package.
by dcf＠torproject.org 11 Aug '13

11 Aug '13

commit 38c219e18648327e5ed1afa98aa939ce37ca3cd6 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Aug 11 18:41:22 2013 -0700 Move websocket into its own package. --- .../src/websocket-server/websocket-server.go | 11 +- .../src/websocket-server/websocket.go | 432 -------------------- websocket-transport/src/websocket/websocket.go | 432 ++++++++++++++++++++ 3 files changed, 438 insertions(+), 437 deletions(-) diff --git a/websocket-transport/src/websocket-server/websocket-server.go b/websocket-transport/src/websocket-server/websocket-server.go index 3ea7481..01a6f66 100644 --- a/websocket-transport/src/websocket-server/websocket-server.go +++ b/websocket-transport/src/websocket-server/websocket-server.go @@ -20,6 +20,7 @@ import ( ) import "pt" +import "websocket" const ptMethodName = "websocket" const requestTimeout = 10 * time.Second @@ -59,7 +60,7 @@ func Log(format string, v ...interface{}) { // io.ReadWriteCloser. It internally takes care of things like base64 encoding and // decoding. type websocketConn struct { - Ws *Websocket + Ws *websocket.Websocket Base64 bool messageBuf []byte } @@ -67,7 +68,7 @@ type websocketConn struct { // Implements io.Reader. func (conn *websocketConn) Read(b []byte) (n int, err error) { for len(conn.messageBuf) == 0 { - var m WebsocketMessage + var m websocket.WebsocketMessage m, err = conn.Ws.ReadMessage() if err != nil { return @@ -128,7 +129,7 @@ func (conn *websocketConn) Close() error { } // Create a new websocketConn. -func NewWebsocketConn(ws *Websocket) websocketConn { +func NewWebsocketConn(ws *websocket.Websocket) websocketConn { var conn websocketConn conn.Ws = ws conn.Base64 = (ws.Subprotocol == "base64") @@ -164,7 +165,7 @@ func proxy(local *net.TCPConn, conn *websocketConn) { wg.Wait() } -func websocketHandler(ws *Websocket) { +func websocketHandler(ws *websocket.Websocket) { // Undo timeouts on HTTP request handling. ws.Conn.SetDeadline(time.Time{}) conn := NewWebsocketConn(ws) @@ -189,7 +190,7 @@ func startListener(addr *net.TCPAddr) (*net.TCPListener, error) { return nil, err } go func() { - var config WebsocketConfig + var config websocket.WebsocketConfig config.Subprotocols = []string{"base64"} config.MaxMessageSize = maxMessageSize s := &http.Server{ diff --git a/websocket-transport/src/websocket-server/websocket.go b/websocket-transport/src/websocket-server/websocket.go deleted file mode 100644 index f195828..0000000 --- a/websocket-transport/src/websocket-server/websocket.go +++ /dev/null @@ -1,432 +0,0 @@ -// WebSocket library. Only the RFC 6455 variety of WebSocket is supported. -// -// Reading and writing is strictly per-frame (or per-message). There is no way -// to partially read a frame. WebsocketConfig.MaxMessageSize affords control of -// the maximum buffering of messages. -// -// The reason for using this custom implementation instead of -// code.google.com/p/go.net/websocket is that the latter has problems with long -// messages and does not support server subprotocols. -// "Denial of Service Protection in Go HTTP Servers" -// https://code.google.com/p/go/issues/detail?id=2093 -// "go.websocket: Read/Copy fail with long frames" -// https://code.google.com/p/go/issues/detail?id=2134 -// http://golang.org/pkg/net/textproto/#pkg-bugs -// "To let callers manage exposure to denial of service attacks, Reader should -// allow them to set and reset a limit on the number of bytes read from the -// connection." -// "websocket.Dial doesn't limit response header length as http.Get does" -// https://groups.google.com/forum/?fromgroups=#!topic/golang-nuts/2Tge6U8-QYI -// -// Example usage: -// -// func doSomething(ws *Websocket) { -// } -// var config WebsocketConfig -// config.Subprotocols = []string{"base64"} -// config.MaxMessageSize = 2500 -// http.Handle("/", config.Handler(doSomething)) -// err = http.ListenAndServe(":8080", nil) - -package main - -import ( - "bufio" - "bytes" - "crypto/rand" - "crypto/sha1" - "encoding/base64" - "encoding/binary" - "errors" - "fmt" - "io" - "net" - "net/http" - "strings" -) - -// Settings for potential WebSocket connections. Subprotocols is a list of -// supported subprotocols as in RFC 6455 section 1.9. When answering client -// requests, the first of the client's requests subprotocols that is also in -// this list (if any) will be used as the subprotocol for the connection. -// MaxMessageSize is a limit on buffering messages. -type WebsocketConfig struct { - Subprotocols []string - MaxMessageSize int -} - -// Representation of a WebSocket frame. The Payload is always without masking. -type WebsocketFrame struct { - Fin bool - Opcode byte - Payload []byte -} - -// Return true iff the frame's opcode says it is a control frame. -func (frame *WebsocketFrame) IsControl() bool { - return (frame.Opcode & 0x08) != 0 -} - -// Representation of a WebSocket message. The Payload is always without masking. -type WebsocketMessage struct { - Opcode byte - Payload []byte -} - -// A WebSocket connection after hijacking from HTTP. -type Websocket struct { - // Conn and ReadWriter from http.ResponseWriter.Hijack. - Conn net.Conn - Bufrw *bufio.ReadWriter - // Whether we are a client or a server has implications for masking. - IsClient bool - // Set from a parent WebsocketConfig. - MaxMessageSize int - // The single selected subprotocol after negotiation, or "". - Subprotocol string - // Buffer for message payloads, which may be interrupted by control - // messages. - messageBuf bytes.Buffer -} - -func applyMask(payload []byte, maskKey [4]byte) { - for i := 0; i < len(payload); i++ { - payload[i] = payload[i] ^ maskKey[i%4] - } -} - -func (ws *Websocket) maxMessageSize() int { - if ws.MaxMessageSize == 0 { - return 64000 - } - return ws.MaxMessageSize -} - -// Read a single frame from the WebSocket. -func (ws *Websocket) ReadFrame() (frame WebsocketFrame, err error) { - var b byte - err = binary.Read(ws.Bufrw, binary.BigEndian, &b) - if err != nil { - return - } - frame.Fin = (b & 0x80) != 0 - frame.Opcode = b & 0x0f - err = binary.Read(ws.Bufrw, binary.BigEndian, &b) - if err != nil { - return - } - masked := (b & 0x80) != 0 - - payloadLen := uint64(b & 0x7f) - if payloadLen == 126 { - var short uint16 - err = binary.Read(ws.Bufrw, binary.BigEndian, &short) - if err != nil { - return - } - payloadLen = uint64(short) - } else if payloadLen == 127 { - var long uint64 - err = binary.Read(ws.Bufrw, binary.BigEndian, &long) - if err != nil { - return - } - payloadLen = long - } - if payloadLen > uint64(ws.maxMessageSize()) { - err = errors.New(fmt.Sprintf("frame payload length of %d exceeds maximum of %d", payloadLen, ws.MaxMessageSize)) - return - } - - maskKey := [4]byte{} - if masked { - if ws.IsClient { - err = errors.New("client got masked frame") - return - } - err = binary.Read(ws.Bufrw, binary.BigEndian, &maskKey) - if err != nil { - return - } - } else { - if !ws.IsClient { - err = errors.New("server got unmasked frame") - return - } - } - - frame.Payload = make([]byte, payloadLen) - _, err = io.ReadFull(ws.Bufrw, frame.Payload) - if err != nil { - return - } - if masked { - applyMask(frame.Payload, maskKey) - } - - return frame, nil -} - -// Read a single message from the WebSocket. Multiple fragmented frames are -// combined into a single message before being returned. Non-control messages -// may be interrupted by control frames. The control frames are returned as -// individual messages before the message that they interrupt. -func (ws *Websocket) ReadMessage() (message WebsocketMessage, err error) { - var opcode byte = 0 - for { - var frame WebsocketFrame - frame, err = ws.ReadFrame() - if err != nil { - return - } - if frame.IsControl() { - if !frame.Fin { - err = errors.New("control frame has fin bit unset") - return - } - message.Opcode = frame.Opcode - message.Payload = frame.Payload - return message, nil - } - - if opcode == 0 { - if frame.Opcode == 0 { - err = errors.New("first frame has opcode 0") - return - } - opcode = frame.Opcode - } else { - if frame.Opcode != 0 { - err = errors.New(fmt.Sprintf("non-first frame has nonzero opcode %d", frame.Opcode)) - return - } - } - if ws.messageBuf.Len()+len(frame.Payload) > ws.MaxMessageSize { - err = errors.New(fmt.Sprintf("message payload length of %d exceeds maximum of %d", - ws.messageBuf.Len()+len(frame.Payload), ws.MaxMessageSize)) - return - } - ws.messageBuf.Write(frame.Payload) - if frame.Fin { - break - } - } - message.Opcode = opcode - message.Payload = ws.messageBuf.Bytes() - ws.messageBuf.Reset() - - return message, nil -} - -// Write a single frame to the WebSocket stream. Destructively masks payload in -// place if ws.IsClient. Frames are always unfragmented. -func (ws *Websocket) WriteFrame(opcode byte, payload []byte) (err error) { - if opcode >= 16 { - err = errors.New(fmt.Sprintf("opcode %d is >= 16", opcode)) - return - } - ws.Bufrw.WriteByte(0x80 | opcode) - - var maskBit byte - var maskKey [4]byte - if ws.IsClient { - _, err = io.ReadFull(rand.Reader, maskKey[:]) - if err != nil { - return - } - applyMask(payload, maskKey) - maskBit = 0x80 - } else { - maskBit = 0x00 - } - - if len(payload) < 126 { - ws.Bufrw.WriteByte(maskBit | byte(len(payload))) - } else if len(payload) <= 0xffff { - ws.Bufrw.WriteByte(maskBit | 126) - binary.Write(ws.Bufrw, binary.BigEndian, uint16(len(payload))) - } else { - ws.Bufrw.WriteByte(maskBit | 127) - binary.Write(ws.Bufrw, binary.BigEndian, uint64(len(payload))) - } - - if ws.IsClient { - _, err = ws.Bufrw.Write(maskKey[:]) - if err != nil { - return - } - } - _, err = ws.Bufrw.Write(payload) - if err != nil { - return - } - - ws.Bufrw.Flush() - - return -} - -// Write a single message to the WebSocket stream. Destructively masks payload -// in place if ws.IsClient. Messages are always sent as a single unfragmented -// frame. -func (ws *Websocket) WriteMessage(opcode byte, payload []byte) (err error) { - return ws.WriteFrame(opcode, payload) -} - -// Split a string on commas and trim whitespace. -func commaSplit(s string) []string { - var result []string - if strings.TrimSpace(s) == "" { - return result - } - for _, e := range strings.Split(s, ",") { - result = append(result, strings.TrimSpace(e)) - } - return result -} - -// Returns true iff one of the strings in haystack is needle. -func containsCase(haystack []string, needle string) bool { - for _, e := range haystack { - if strings.ToLower(e) == strings.ToLower(needle) { - return true - } - } - return false -} - -// One-step SHA-1 hash of a string. -func sha1Hash(data string) []byte { - h := sha1.New() - h.Write([]byte(data)) - return h.Sum(nil) -} - -func httpError(w http.ResponseWriter, bufrw *bufio.ReadWriter, code int) { - w.Header().Set("Connection", "close") - bufrw.WriteString(fmt.Sprintf("HTTP/1.0 %d %s\r\n", code, http.StatusText(code))) - w.Header().Write(bufrw) - bufrw.WriteString("\r\n") - bufrw.Flush() -} - -// An implementation of http.Handler with a WebsocketConfig. The ServeHTTP -// function calls websocketCallback assuming WebSocket HTTP negotiation is -// successful. -type WebSocketHTTPHandler struct { - Config *WebsocketConfig - WebsocketCallback func(*Websocket) -} - -// Implements the http.Handler interface. -func (handler *WebSocketHTTPHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) { - conn, bufrw, err := w.(http.Hijacker).Hijack() - if err != nil { - http.Error(w, err.Error(), http.StatusInternalServerError) - return - } - defer conn.Close() - - // See RFC 6455 section 4.2.1 for this sequence of checks. - - // 1. An HTTP/1.1 or higher GET request, including a "Request-URI"... - if req.Method != "GET" { - httpError(w, bufrw, http.StatusMethodNotAllowed) - return - } - if req.URL.Path != "/" { - httpError(w, bufrw, http.StatusNotFound) - return - } - // 2. A |Host| header field containing the server's authority. - // We deliberately skip this test. - // 3. An |Upgrade| header field containing the value "websocket", - // treated as an ASCII case-insensitive value. - if !containsCase(commaSplit(req.Header.Get("Upgrade")), "websocket") { - httpError(w, bufrw, http.StatusBadRequest) - return - } - // 4. A |Connection| header field that includes the token "Upgrade", - // treated as an ASCII case-insensitive value. - if !containsCase(commaSplit(req.Header.Get("Connection")), "Upgrade") { - httpError(w, bufrw, http.StatusBadRequest) - return - } - // 5. A |Sec-WebSocket-Key| header field with a base64-encoded value - // that, when decoded, is 16 bytes in length. - websocketKey := req.Header.Get("Sec-WebSocket-Key") - key, err := base64.StdEncoding.DecodeString(websocketKey) - if err != nil || len(key) != 16 { - httpError(w, bufrw, http.StatusBadRequest) - return - } - // 6. A |Sec-WebSocket-Version| header field, with a value of 13. - // We also allow 8 from draft-ietf-hybi-thewebsocketprotocol-10. - var knownVersions = []string{"8", "13"} - websocketVersion := req.Header.Get("Sec-WebSocket-Version") - if !containsCase(knownVersions, websocketVersion) { - // "If this version does not match a version understood by the - // server, the server MUST abort the WebSocket handshake - // described in this section and instead send an appropriate - // HTTP error code (such as 426 Upgrade Required) and a - // |Sec-WebSocket-Version| header field indicating the - // version(s) the server is capable of understanding." - w.Header().Set("Sec-WebSocket-Version", strings.Join(knownVersions, ", ")) - httpError(w, bufrw, 426) - return - } - // 7. Optionally, an |Origin| header field. - // 8. Optionally, a |Sec-WebSocket-Protocol| header field, with a list of - // values indicating which protocols the client would like to speak, ordered - // by preference. - clientProtocols := commaSplit(req.Header.Get("Sec-WebSocket-Protocol")) - // 9. Optionally, a |Sec-WebSocket-Extensions| header field... - // 10. Optionally, other header fields... - - var ws Websocket - ws.Conn = conn - ws.Bufrw = bufrw - ws.IsClient = false - ws.MaxMessageSize = handler.Config.MaxMessageSize - - // See RFC 6455 section 4.2.2, item 5 for these steps. - - // 1. A Status-Line with a 101 response code as per RFC 2616. - bufrw.WriteString(fmt.Sprintf("HTTP/1.0 %d %s\r\n", http.StatusSwitchingProtocols, http.StatusText(http.StatusSwitchingProtocols))) - // 2. An |Upgrade| header field with value "websocket" as per RFC 2616. - w.Header().Set("Upgrade", "websocket") - // 3. A |Connection| header field with value "Upgrade". - w.Header().Set("Connection", "Upgrade") - // 4. A |Sec-WebSocket-Accept| header field. The value of this header - // field is constructed by concatenating /key/, defined above in step 4 - // in Section 4.2.2, with the string - // "258EAFA5-E914-47DA-95CA-C5AB0DC85B11", taking the SHA-1 hash of this - // concatenated value to obtain a 20-byte value and base64-encoding (see - // Section 4 of [RFC4648]) this 20-byte hash. - const magicGUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11" - acceptKey := base64.StdEncoding.EncodeToString(sha1Hash(websocketKey + magicGUID)) - w.Header().Set("Sec-WebSocket-Accept", acceptKey) - // 5. Optionally, a |Sec-WebSocket-Protocol| header field, with a value - // /subprotocol/ as defined in step 4 in Section 4.2.2. - for _, clientProto := range clientProtocols { - for _, serverProto := range handler.Config.Subprotocols { - if clientProto == serverProto { - ws.Subprotocol = clientProto - w.Header().Set("Sec-WebSocket-Protocol", clientProto) - break - } - } - } - // 6. Optionally, a |Sec-WebSocket-Extensions| header field... - w.Header().Write(bufrw) - bufrw.WriteString("\r\n") - bufrw.Flush() - - // Call the WebSocket-specific handler. - handler.WebsocketCallback(&ws) -} - -// Return an http.Handler with the given callback function. -func (config *WebsocketConfig) Handler(callback func(*Websocket)) http.Handler { - return &WebSocketHTTPHandler{config, callback} -} diff --git a/websocket-transport/src/websocket/websocket.go b/websocket-transport/src/websocket/websocket.go new file mode 100644 index 0000000..617b7ff --- /dev/null +++ b/websocket-transport/src/websocket/websocket.go @@ -0,0 +1,432 @@ +// WebSocket library. Only the RFC 6455 variety of WebSocket is supported. +// +// Reading and writing is strictly per-frame (or per-message). There is no way +// to partially read a frame. WebsocketConfig.MaxMessageSize affords control of +// the maximum buffering of messages. +// +// The reason for using this custom implementation instead of +// code.google.com/p/go.net/websocket is that the latter has problems with long +// messages and does not support server subprotocols. +// "Denial of Service Protection in Go HTTP Servers" +// https://code.google.com/p/go/issues/detail?id=2093 +// "go.websocket: Read/Copy fail with long frames" +// https://code.google.com/p/go/issues/detail?id=2134 +// http://golang.org/pkg/net/textproto/#pkg-bugs +// "To let callers manage exposure to denial of service attacks, Reader should +// allow them to set and reset a limit on the number of bytes read from the +// connection." +// "websocket.Dial doesn't limit response header length as http.Get does" +// https://groups.google.com/forum/?fromgroups=#!topic/golang-nuts/2Tge6U8-QYI +// +// Example usage: +// +// func doSomething(ws *Websocket) { +// } +// var config WebsocketConfig +// config.Subprotocols = []string{"base64"} +// config.MaxMessageSize = 2500 +// http.Handle("/", config.Handler(doSomething)) +// err = http.ListenAndServe(":8080", nil) + +package websocket + +import ( + "bufio" + "bytes" + "crypto/rand" + "crypto/sha1" + "encoding/base64" + "encoding/binary" + "errors" + "fmt" + "io" + "net" + "net/http" + "strings" +) + +// Settings for potential WebSocket connections. Subprotocols is a list of +// supported subprotocols as in RFC 6455 section 1.9. When answering client +// requests, the first of the client's requests subprotocols that is also in +// this list (if any) will be used as the subprotocol for the connection. +// MaxMessageSize is a limit on buffering messages. +type WebsocketConfig struct { + Subprotocols []string + MaxMessageSize int +} + +// Representation of a WebSocket frame. The Payload is always without masking. +type WebsocketFrame struct { + Fin bool + Opcode byte + Payload []byte +} + +// Return true iff the frame's opcode says it is a control frame. +func (frame *WebsocketFrame) IsControl() bool { + return (frame.Opcode & 0x08) != 0 +} + +// Representation of a WebSocket message. The Payload is always without masking. +type WebsocketMessage struct { + Opcode byte + Payload []byte +} + +// A WebSocket connection after hijacking from HTTP. +type Websocket struct { + // Conn and ReadWriter from http.ResponseWriter.Hijack. + Conn net.Conn + Bufrw *bufio.ReadWriter + // Whether we are a client or a server has implications for masking. + IsClient bool + // Set from a parent WebsocketConfig. + MaxMessageSize int + // The single selected subprotocol after negotiation, or "". + Subprotocol string + // Buffer for message payloads, which may be interrupted by control + // messages. + messageBuf bytes.Buffer +} + +func applyMask(payload []byte, maskKey [4]byte) { + for i := 0; i < len(payload); i++ { + payload[i] = payload[i] ^ maskKey[i%4] + } +} + +func (ws *Websocket) maxMessageSize() int { + if ws.MaxMessageSize == 0 { + return 64000 + } + return ws.MaxMessageSize +} + +// Read a single frame from the WebSocket. +func (ws *Websocket) ReadFrame() (frame WebsocketFrame, err error) { + var b byte + err = binary.Read(ws.Bufrw, binary.BigEndian, &b) + if err != nil { + return + } + frame.Fin = (b & 0x80) != 0 + frame.Opcode = b & 0x0f + err = binary.Read(ws.Bufrw, binary.BigEndian, &b) + if err != nil { + return + } + masked := (b & 0x80) != 0 + + payloadLen := uint64(b & 0x7f) + if payloadLen == 126 { + var short uint16 + err = binary.Read(ws.Bufrw, binary.BigEndian, &short) + if err != nil { + return + } + payloadLen = uint64(short) + } else if payloadLen == 127 { + var long uint64 + err = binary.Read(ws.Bufrw, binary.BigEndian, &long) + if err != nil { + return + } + payloadLen = long + } + if payloadLen > uint64(ws.maxMessageSize()) { + err = errors.New(fmt.Sprintf("frame payload length of %d exceeds maximum of %d", payloadLen, ws.MaxMessageSize)) + return + } + + maskKey := [4]byte{} + if masked { + if ws.IsClient { + err = errors.New("client got masked frame") + return + } + err = binary.Read(ws.Bufrw, binary.BigEndian, &maskKey) + if err != nil { + return + } + } else { + if !ws.IsClient { + err = errors.New("server got unmasked frame") + return + } + } + + frame.Payload = make([]byte, payloadLen) + _, err = io.ReadFull(ws.Bufrw, frame.Payload) + if err != nil { + return + } + if masked { + applyMask(frame.Payload, maskKey) + } + + return frame, nil +} + +// Read a single message from the WebSocket. Multiple fragmented frames are +// combined into a single message before being returned. Non-control messages +// may be interrupted by control frames. The control frames are returned as +// individual messages before the message that they interrupt. +func (ws *Websocket) ReadMessage() (message WebsocketMessage, err error) { + var opcode byte = 0 + for { + var frame WebsocketFrame + frame, err = ws.ReadFrame() + if err != nil { + return + } + if frame.IsControl() { + if !frame.Fin { + err = errors.New("control frame has fin bit unset") + return + } + message.Opcode = frame.Opcode + message.Payload = frame.Payload + return message, nil + } + + if opcode == 0 { + if frame.Opcode == 0 { + err = errors.New("first frame has opcode 0") + return + } + opcode = frame.Opcode + } else { + if frame.Opcode != 0 { + err = errors.New(fmt.Sprintf("non-first frame has nonzero opcode %d", frame.Opcode)) + return + } + } + if ws.messageBuf.Len()+len(frame.Payload) > ws.MaxMessageSize { + err = errors.New(fmt.Sprintf("message payload length of %d exceeds maximum of %d", + ws.messageBuf.Len()+len(frame.Payload), ws.MaxMessageSize)) + return + } + ws.messageBuf.Write(frame.Payload) + if frame.Fin { + break + } + } + message.Opcode = opcode + message.Payload = ws.messageBuf.Bytes() + ws.messageBuf.Reset() + + return message, nil +} + +// Write a single frame to the WebSocket stream. Destructively masks payload in +// place if ws.IsClient. Frames are always unfragmented. +func (ws *Websocket) WriteFrame(opcode byte, payload []byte) (err error) { + if opcode >= 16 { + err = errors.New(fmt.Sprintf("opcode %d is >= 16", opcode)) + return + } + ws.Bufrw.WriteByte(0x80 | opcode) + + var maskBit byte + var maskKey [4]byte + if ws.IsClient { + _, err = io.ReadFull(rand.Reader, maskKey[:]) + if err != nil { + return + } + applyMask(payload, maskKey) + maskBit = 0x80 + } else { + maskBit = 0x00 + } + + if len(payload) < 126 { + ws.Bufrw.WriteByte(maskBit | byte(len(payload))) + } else if len(payload) <= 0xffff { + ws.Bufrw.WriteByte(maskBit | 126) + binary.Write(ws.Bufrw, binary.BigEndian, uint16(len(payload))) + } else { + ws.Bufrw.WriteByte(maskBit | 127) + binary.Write(ws.Bufrw, binary.BigEndian, uint64(len(payload))) + } + + if ws.IsClient { + _, err = ws.Bufrw.Write(maskKey[:]) + if err != nil { + return + } + } + _, err = ws.Bufrw.Write(payload) + if err != nil { + return + } + + ws.Bufrw.Flush() + + return +} + +// Write a single message to the WebSocket stream. Destructively masks payload +// in place if ws.IsClient. Messages are always sent as a single unfragmented +// frame. +func (ws *Websocket) WriteMessage(opcode byte, payload []byte) (err error) { + return ws.WriteFrame(opcode, payload) +} + +// Split a string on commas and trim whitespace. +func commaSplit(s string) []string { + var result []string + if strings.TrimSpace(s) == "" { + return result + } + for _, e := range strings.Split(s, ",") { + result = append(result, strings.TrimSpace(e)) + } + return result +} + +// Returns true iff one of the strings in haystack is needle. +func containsCase(haystack []string, needle string) bool { + for _, e := range haystack { + if strings.ToLower(e) == strings.ToLower(needle) { + return true + } + } + return false +} + +// One-step SHA-1 hash of a string. +func sha1Hash(data string) []byte { + h := sha1.New() + h.Write([]byte(data)) + return h.Sum(nil) +} + +func httpError(w http.ResponseWriter, bufrw *bufio.ReadWriter, code int) { + w.Header().Set("Connection", "close") + bufrw.WriteString(fmt.Sprintf("HTTP/1.0 %d %s\r\n", code, http.StatusText(code))) + w.Header().Write(bufrw) + bufrw.WriteString("\r\n") + bufrw.Flush() +} + +// An implementation of http.Handler with a WebsocketConfig. The ServeHTTP +// function calls websocketCallback assuming WebSocket HTTP negotiation is +// successful. +type WebSocketHTTPHandler struct { + Config *WebsocketConfig + WebsocketCallback func(*Websocket) +} + +// Implements the http.Handler interface. +func (handler *WebSocketHTTPHandler) ServeHTTP(w http.ResponseWriter, req *http.Request) { + conn, bufrw, err := w.(http.Hijacker).Hijack() + if err != nil { + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + defer conn.Close() + + // See RFC 6455 section 4.2.1 for this sequence of checks. + + // 1. An HTTP/1.1 or higher GET request, including a "Request-URI"... + if req.Method != "GET" { + httpError(w, bufrw, http.StatusMethodNotAllowed) + return + } + if req.URL.Path != "/" { + httpError(w, bufrw, http.StatusNotFound) + return + } + // 2. A |Host| header field containing the server's authority. + // We deliberately skip this test. + // 3. An |Upgrade| header field containing the value "websocket", + // treated as an ASCII case-insensitive value. + if !containsCase(commaSplit(req.Header.Get("Upgrade")), "websocket") { + httpError(w, bufrw, http.StatusBadRequest) + return + } + // 4. A |Connection| header field that includes the token "Upgrade", + // treated as an ASCII case-insensitive value. + if !containsCase(commaSplit(req.Header.Get("Connection")), "Upgrade") { + httpError(w, bufrw, http.StatusBadRequest) + return + } + // 5. A |Sec-WebSocket-Key| header field with a base64-encoded value + // that, when decoded, is 16 bytes in length. + websocketKey := req.Header.Get("Sec-WebSocket-Key") + key, err := base64.StdEncoding.DecodeString(websocketKey) + if err != nil || len(key) != 16 { + httpError(w, bufrw, http.StatusBadRequest) + return + } + // 6. A |Sec-WebSocket-Version| header field, with a value of 13. + // We also allow 8 from draft-ietf-hybi-thewebsocketprotocol-10. + var knownVersions = []string{"8", "13"} + websocketVersion := req.Header.Get("Sec-WebSocket-Version") + if !containsCase(knownVersions, websocketVersion) { + // "If this version does not match a version understood by the + // server, the server MUST abort the WebSocket handshake + // described in this section and instead send an appropriate + // HTTP error code (such as 426 Upgrade Required) and a + // |Sec-WebSocket-Version| header field indicating the + // version(s) the server is capable of understanding." + w.Header().Set("Sec-WebSocket-Version", strings.Join(knownVersions, ", ")) + httpError(w, bufrw, 426) + return + } + // 7. Optionally, an |Origin| header field. + // 8. Optionally, a |Sec-WebSocket-Protocol| header field, with a list of + // values indicating which protocols the client would like to speak, ordered + // by preference. + clientProtocols := commaSplit(req.Header.Get("Sec-WebSocket-Protocol")) + // 9. Optionally, a |Sec-WebSocket-Extensions| header field... + // 10. Optionally, other header fields... + + var ws Websocket + ws.Conn = conn + ws.Bufrw = bufrw + ws.IsClient = false + ws.MaxMessageSize = handler.Config.MaxMessageSize + + // See RFC 6455 section 4.2.2, item 5 for these steps. + + // 1. A Status-Line with a 101 response code as per RFC 2616. + bufrw.WriteString(fmt.Sprintf("HTTP/1.0 %d %s\r\n", http.StatusSwitchingProtocols, http.StatusText(http.StatusSwitchingProtocols))) + // 2. An |Upgrade| header field with value "websocket" as per RFC 2616. + w.Header().Set("Upgrade", "websocket") + // 3. A |Connection| header field with value "Upgrade". + w.Header().Set("Connection", "Upgrade") + // 4. A |Sec-WebSocket-Accept| header field. The value of this header + // field is constructed by concatenating /key/, defined above in step 4 + // in Section 4.2.2, with the string + // "258EAFA5-E914-47DA-95CA-C5AB0DC85B11", taking the SHA-1 hash of this + // concatenated value to obtain a 20-byte value and base64-encoding (see + // Section 4 of [RFC4648]) this 20-byte hash. + const magicGUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11" + acceptKey := base64.StdEncoding.EncodeToString(sha1Hash(websocketKey + magicGUID)) + w.Header().Set("Sec-WebSocket-Accept", acceptKey) + // 5. Optionally, a |Sec-WebSocket-Protocol| header field, with a value + // /subprotocol/ as defined in step 4 in Section 4.2.2. + for _, clientProto := range clientProtocols { + for _, serverProto := range handler.Config.Subprotocols { + if clientProto == serverProto { + ws.Subprotocol = clientProto + w.Header().Set("Sec-WebSocket-Protocol", clientProto) + break + } + } + } + // 6. Optionally, a |Sec-WebSocket-Extensions| header field... + w.Header().Write(bufrw) + bufrw.WriteString("\r\n") + bufrw.Flush() + + // Call the WebSocket-specific handler. + handler.WebsocketCallback(&ws) +} + +// Return an http.Handler with the given callback function. +func (config *WebsocketConfig) Handler(callback func(*Websocket)) http.Handler { + return &WebSocketHTTPHandler{config, callback} +}

1 0

[flashproxy/master] Bail out after failing to open a listener.
by dcf＠torproject.org 11 Aug '13

11 Aug '13

commit 8a082b83677b8c4dcf55abf1fa358cf9283735e9 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Aug 11 17:46:20 2013 -0700 Bail out after failing to open a listener. --- websocket-transport/src/pt/pt.go | 1 + websocket-transport/src/websocket-server/websocket-server.go | 1 + 2 files changed, 2 insertions(+) diff --git a/websocket-transport/src/pt/pt.go b/websocket-transport/src/pt/pt.go index 60e4507..f6262d1 100644 --- a/websocket-transport/src/pt/pt.go +++ b/websocket-transport/src/pt/pt.go @@ -18,6 +18,7 @@ // ln, err := startListener(bindAddr.Addr) // if err != nil { // pt.SmethodError(bindAddr.MethodName, err.Error()) +// continue // } // pt.Smethod(bindAddr.MethodName, ln.Addr()) // } diff --git a/websocket-transport/src/websocket-server/websocket-server.go b/websocket-transport/src/websocket-server/websocket-server.go index b735bd1..3ea7481 100644 --- a/websocket-transport/src/websocket-server/websocket-server.go +++ b/websocket-transport/src/websocket-server/websocket-server.go @@ -237,6 +237,7 @@ func main() { ln, err := startListener(bindAddr.Addr) if err != nil { pt.SmethodError(bindAddr.MethodName, err.Error()) + continue } pt.Smethod(bindAddr.MethodName, ln.Addr()) Log("listening on %s", ln.Addr().String())

1 0

[flashproxy/master] Comment tweaking.
by dcf＠torproject.org 11 Aug '13

11 Aug '13

commit a54c6fe67b3ab9be1f14efcc8898a26b7c60f004 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Aug 11 19:31:12 2013 -0700 Comment tweaking. --- websocket-transport/src/websocket-server/websocket-server.go | 4 ++-- websocket-transport/src/websocket/websocket.go | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/websocket-transport/src/websocket-server/websocket-server.go b/websocket-transport/src/websocket-server/websocket-server.go index 065b76b..d3494c6 100644 --- a/websocket-transport/src/websocket-server/websocket-server.go +++ b/websocket-transport/src/websocket-server/websocket-server.go @@ -57,8 +57,8 @@ func Log(format string, v ...interface{}) { } // An abstraction that makes an underlying WebSocket connection look like an -// io.ReadWriteCloser. It internally takes care of things like base64 encoding and -// decoding. +// io.ReadWriteCloser. It internally takes care of things like base64 encoding +// and decoding. type webSocketConn struct { Ws *websocket.WebSocket Base64 bool diff --git a/websocket-transport/src/websocket/websocket.go b/websocket-transport/src/websocket/websocket.go index d3e8135..f6e8c8b 100644 --- a/websocket-transport/src/websocket/websocket.go +++ b/websocket-transport/src/websocket/websocket.go @@ -285,7 +285,7 @@ func commaSplit(s string) []string { return result } -// Returns true iff one of the strings in haystack is needle. +// Returns true iff one of the strings in haystack is needle (case-insensitive). func containsCase(haystack []string, needle string) bool { for _, e := range haystack { if strings.ToLower(e) == strings.ToLower(needle) {

1 0

[flashproxy/master] Capitalization of WebSocket types.
by dcf＠torproject.org 11 Aug '13

11 Aug '13

commit 5e0ffce04f9600700f2dad4db3cab13957add955 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Aug 11 18:44:01 2013 -0700 Capitalization of WebSocket types. --- .../src/websocket-server/websocket-server.go | 28 ++++++------- websocket-transport/src/websocket/websocket.go | 42 ++++++++++---------- 2 files changed, 35 insertions(+), 35 deletions(-) diff --git a/websocket-transport/src/websocket-server/websocket-server.go b/websocket-transport/src/websocket-server/websocket-server.go index 01a6f66..065b76b 100644 --- a/websocket-transport/src/websocket-server/websocket-server.go +++ b/websocket-transport/src/websocket-server/websocket-server.go @@ -59,16 +59,16 @@ func Log(format string, v ...interface{}) { // An abstraction that makes an underlying WebSocket connection look like an // io.ReadWriteCloser. It internally takes care of things like base64 encoding and // decoding. -type websocketConn struct { - Ws *websocket.Websocket +type webSocketConn struct { + Ws *websocket.WebSocket Base64 bool messageBuf []byte } // Implements io.Reader. -func (conn *websocketConn) Read(b []byte) (n int, err error) { +func (conn *webSocketConn) Read(b []byte) (n int, err error) { for len(conn.messageBuf) == 0 { - var m websocket.WebsocketMessage + var m websocket.WebSocketMessage m, err = conn.Ws.ReadMessage() if err != nil { return @@ -105,7 +105,7 @@ func (conn *websocketConn) Read(b []byte) (n int, err error) { } // Implements io.Writer. -func (conn *websocketConn) Write(b []byte) (n int, err error) { +func (conn *webSocketConn) Write(b []byte) (n int, err error) { if conn.Base64 { buf := make([]byte, base64.StdEncoding.EncodedLen(len(b))) base64.StdEncoding.Encode(buf, b) @@ -122,22 +122,22 @@ func (conn *websocketConn) Write(b []byte) (n int, err error) { } // Implements io.Closer. -func (conn *websocketConn) Close() error { +func (conn *webSocketConn) Close() error { // Ignore any error in trying to write a Close frame. _ = conn.Ws.WriteFrame(8, nil) return conn.Ws.Conn.Close() } -// Create a new websocketConn. -func NewWebsocketConn(ws *websocket.Websocket) websocketConn { - var conn websocketConn +// Create a new webSocketConn. +func NewWebSocketConn(ws *websocket.WebSocket) webSocketConn { + var conn webSocketConn conn.Ws = ws conn.Base64 = (ws.Subprotocol == "base64") return conn } // Copy from WebSocket to socket and vice versa. -func proxy(local *net.TCPConn, conn *websocketConn) { +func proxy(local *net.TCPConn, conn *webSocketConn) { var wg sync.WaitGroup wg.Add(2) @@ -165,10 +165,10 @@ func proxy(local *net.TCPConn, conn *websocketConn) { wg.Wait() } -func websocketHandler(ws *websocket.Websocket) { +func webSocketHandler(ws *websocket.WebSocket) { // Undo timeouts on HTTP request handling. ws.Conn.SetDeadline(time.Time{}) - conn := NewWebsocketConn(ws) + conn := NewWebSocketConn(ws) handlerChan <- 1 defer func() { @@ -190,11 +190,11 @@ func startListener(addr *net.TCPAddr) (*net.TCPListener, error) { return nil, err } go func() { - var config websocket.WebsocketConfig + var config websocket.WebSocketConfig config.Subprotocols = []string{"base64"} config.MaxMessageSize = maxMessageSize s := &http.Server{ - Handler: config.Handler(websocketHandler), + Handler: config.Handler(webSocketHandler), ReadTimeout: requestTimeout, } err = s.Serve(ln) diff --git a/websocket-transport/src/websocket/websocket.go b/websocket-transport/src/websocket/websocket.go index 617b7ff..d3e8135 100644 --- a/websocket-transport/src/websocket/websocket.go +++ b/websocket-transport/src/websocket/websocket.go @@ -1,7 +1,7 @@ // WebSocket library. Only the RFC 6455 variety of WebSocket is supported. // // Reading and writing is strictly per-frame (or per-message). There is no way -// to partially read a frame. WebsocketConfig.MaxMessageSize affords control of +// to partially read a frame. WebSocketConfig.MaxMessageSize affords control of // the maximum buffering of messages. // // The reason for using this custom implementation instead of @@ -20,9 +20,9 @@ // // Example usage: // -// func doSomething(ws *Websocket) { +// func doSomething(ws *WebSocket) { // } -// var config WebsocketConfig +// var config WebSocketConfig // config.Subprotocols = []string{"base64"} // config.MaxMessageSize = 2500 // http.Handle("/", config.Handler(doSomething)) @@ -50,37 +50,37 @@ import ( // requests, the first of the client's requests subprotocols that is also in // this list (if any) will be used as the subprotocol for the connection. // MaxMessageSize is a limit on buffering messages. -type WebsocketConfig struct { +type WebSocketConfig struct { Subprotocols []string MaxMessageSize int } // Representation of a WebSocket frame. The Payload is always without masking. -type WebsocketFrame struct { +type WebSocketFrame struct { Fin bool Opcode byte Payload []byte } // Return true iff the frame's opcode says it is a control frame. -func (frame *WebsocketFrame) IsControl() bool { +func (frame *WebSocketFrame) IsControl() bool { return (frame.Opcode & 0x08) != 0 } // Representation of a WebSocket message. The Payload is always without masking. -type WebsocketMessage struct { +type WebSocketMessage struct { Opcode byte Payload []byte } // A WebSocket connection after hijacking from HTTP. -type Websocket struct { +type WebSocket struct { // Conn and ReadWriter from http.ResponseWriter.Hijack. Conn net.Conn Bufrw *bufio.ReadWriter // Whether we are a client or a server has implications for masking. IsClient bool - // Set from a parent WebsocketConfig. + // Set from a parent WebSocketConfig. MaxMessageSize int // The single selected subprotocol after negotiation, or "". Subprotocol string @@ -95,7 +95,7 @@ func applyMask(payload []byte, maskKey [4]byte) { } } -func (ws *Websocket) maxMessageSize() int { +func (ws *WebSocket) maxMessageSize() int { if ws.MaxMessageSize == 0 { return 64000 } @@ -103,7 +103,7 @@ func (ws *Websocket) maxMessageSize() int { } // Read a single frame from the WebSocket. -func (ws *Websocket) ReadFrame() (frame WebsocketFrame, err error) { +func (ws *WebSocket) ReadFrame() (frame WebSocketFrame, err error) { var b byte err = binary.Read(ws.Bufrw, binary.BigEndian, &b) if err != nil { @@ -171,10 +171,10 @@ func (ws *Websocket) ReadFrame() (frame WebsocketFrame, err error) { // combined into a single message before being returned. Non-control messages // may be interrupted by control frames. The control frames are returned as // individual messages before the message that they interrupt. -func (ws *Websocket) ReadMessage() (message WebsocketMessage, err error) { +func (ws *WebSocket) ReadMessage() (message WebSocketMessage, err error) { var opcode byte = 0 for { - var frame WebsocketFrame + var frame WebSocketFrame frame, err = ws.ReadFrame() if err != nil { return @@ -220,7 +220,7 @@ func (ws *Websocket) ReadMessage() (message WebsocketMessage, err error) { // Write a single frame to the WebSocket stream. Destructively masks payload in // place if ws.IsClient. Frames are always unfragmented. -func (ws *Websocket) WriteFrame(opcode byte, payload []byte) (err error) { +func (ws *WebSocket) WriteFrame(opcode byte, payload []byte) (err error) { if opcode >= 16 { err = errors.New(fmt.Sprintf("opcode %d is >= 16", opcode)) return @@ -269,7 +269,7 @@ func (ws *Websocket) WriteFrame(opcode byte, payload []byte) (err error) { // Write a single message to the WebSocket stream. Destructively masks payload // in place if ws.IsClient. Messages are always sent as a single unfragmented // frame. -func (ws *Websocket) WriteMessage(opcode byte, payload []byte) (err error) { +func (ws *WebSocket) WriteMessage(opcode byte, payload []byte) (err error) { return ws.WriteFrame(opcode, payload) } @@ -310,12 +310,12 @@ func httpError(w http.ResponseWriter, bufrw *bufio.ReadWriter, code int) { bufrw.Flush() } -// An implementation of http.Handler with a WebsocketConfig. The ServeHTTP +// An implementation of http.Handler with a WebSocketConfig. The ServeHTTP // function calls websocketCallback assuming WebSocket HTTP negotiation is // successful. type WebSocketHTTPHandler struct { - Config *WebsocketConfig - WebsocketCallback func(*Websocket) + Config *WebSocketConfig + WebSocketCallback func(*WebSocket) } // Implements the http.Handler interface. @@ -383,7 +383,7 @@ func (handler *WebSocketHTTPHandler) ServeHTTP(w http.ResponseWriter, req *http. // 9. Optionally, a |Sec-WebSocket-Extensions| header field... // 10. Optionally, other header fields... - var ws Websocket + var ws WebSocket ws.Conn = conn ws.Bufrw = bufrw ws.IsClient = false @@ -423,10 +423,10 @@ func (handler *WebSocketHTTPHandler) ServeHTTP(w http.ResponseWriter, req *http. bufrw.Flush() // Call the WebSocket-specific handler. - handler.WebsocketCallback(&ws) + handler.WebSocketCallback(&ws) } // Return an http.Handler with the given callback function. -func (config *WebsocketConfig) Handler(callback func(*Websocket)) http.Handler { +func (config *WebSocketConfig) Handler(callback func(*WebSocket)) http.Handler { return &WebSocketHTTPHandler{config, callback} }

1 0

[translation/gettor] Update translations for gettor
by translation＠torproject.org 11 Aug '13

11 Aug '13

commit 53fd97ef24f54cffa5114050c27265cc57289b32 Author: Translation commit bot <translation(a)torproject.org> Date: Mon Aug 12 02:15:05 2013 +0000 Update translations for gettor --- id/gettor.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/id/gettor.po b/id/gettor.po index 53089be..50bea84 100644 --- a/id/gettor.po +++ b/id/gettor.po @@ -10,7 +10,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2013-01-19 13:40+0100\n" -"PO-Revision-Date: 2013-08-12 01:41+0000\n" +"PO-Revision-Date: 2013-08-12 01:50+0000\n" "Last-Translator: berespost <berespost(a)gmail.com>\n" "Language-Team: Indonesian (http://www.transifex.com/projects/p/torproject/language/id/)\n" "MIME-Version: 1.0\n"

1 0

[translation/gettor] Update translations for gettor
by translation＠torproject.org 11 Aug '13

11 Aug '13

commit c01f8fc1fd8bacc7b46d1b3f5c971ddc68296342 Author: Translation commit bot <translation(a)torproject.org> Date: Mon Aug 12 01:45:06 2013 +0000 Update translations for gettor --- id/gettor.po | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/id/gettor.po b/id/gettor.po index 02ecc07..53089be 100644 --- a/id/gettor.po +++ b/id/gettor.po @@ -3,14 +3,15 @@ # This file is distributed under the same license as the PACKAGE package. # # Translators: +# berespost <berespost(a)gmail.com>, 2013 # Jacob Appelbaum <jacob(a)appelbaum.net>, 2009 msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2013-01-19 13:40+0100\n" -"PO-Revision-Date: 2010-11-30 05:01+0000\n" -"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" +"PO-Revision-Date: 2013-08-12 01:41+0000\n" +"Last-Translator: berespost <berespost(a)gmail.com>\n" "Language-Team: Indonesian (http://www.transifex.com/projects/p/torproject/language/id/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -38,14 +39,14 @@ msgid "" "We only process requests from email services that support \"DKIM\",\n" "which is an email feature that lets us verify that the address in the\n" "\"From\" line is actually the one who sent the mail." -msgstr "" +msgstr "Kami hanya memproses permintaan dari layanan email yang mendukung \"DKIM\", yakni fitur email yang memungkinkan kami memverifikasi alamat yang ada di baris \"Dari:\" adalah yang benar-benar pengirim email." #: lib/gettor/i18n.py:39 msgid "" "(We apologize if you didn't ask for this mail. Since your email is from\n" "a service that doesn't use DKIM, we're sending a short explanation,\n" "and then we'll ignore this email address for the next day or so.)" -msgstr "" +msgstr "(Kami mohon maaf jika Anda tidak mengharapkan email ini. Karena email Anda berasal dari layanan email yang tidak menggunakan DKIM, kami mengirimkan penjelasan singkat dan kami akan mengabaikan alamat email ini untuk beberapa hari atau lebih.) " #: lib/gettor/i18n.py:43 lib/gettor/i18n.py:135 msgid ""

1 0

[stem/master] Dropping document_handler from get_consensus()
by atagar＠torproject.org 11 Aug '13

11 Aug '13

commit bb3de90a82ff927c5005fbadce3b2ea975a15aae Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Aug 11 13:49:30 2013 -0700 Dropping document_handler from get_consensus() Oops, the document_handler is already a query parameter. There's no benefit to having a default value for it in get_consensus(), and that had the drawback of preventing us from asserting a default value. --- stem/descriptor/remote.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/stem/descriptor/remote.py b/stem/descriptor/remote.py index 95934e1..40d9afe 100644 --- a/stem/descriptor/remote.py +++ b/stem/descriptor/remote.py @@ -517,7 +517,7 @@ class DescriptorDownloader(object): return self.query('/tor/micro/d/%s.z' % '-'.join(hashes), **query_args) - def get_consensus(self, authority_v3ident = None, document_handler = stem.descriptor.DocumentHandler.ENTRIES, **query_args): + def get_consensus(self, authority_v3ident = None, **query_args): """ Provides the present router status entries. @@ -525,8 +525,6 @@ class DescriptorDownloader(object): to get the consensus, see `'v3ident' in tor's config.c <https://gitweb.torproject.org/tor.git/blob/f631b73:/src/or/config.c#l816>`_ for the values. - :param stem.descriptor.__init__.DocumentHandler document_handler: method in - which to parse the :class:`~stem.descriptor.networkstatus.NetworkStatusDocumentV3` :param query_args: additional arguments for the :class:`~stem.descriptor.remote.Query` constructor @@ -539,7 +537,7 @@ class DescriptorDownloader(object): if authority_v3ident: resource += '/%s' % authority_v3ident - return self.query(resource + '.z', document_handler = document_handler, **query_args) + return self.query(resource + '.z', **query_args) def get_key_certificates(self, authority_v3idents = None, **query_args): """

1 0

r26299: {website} try a new answer to the javascript question (website/trunk/docs/en)
by Roger Dingledine 11 Aug '13

11 Aug '13

Author: arma Date: 2013-08-11 22:25:09 +0000 (Sun, 11 Aug 2013) New Revision: 26299 Modified: website/trunk/docs/en/faq.wml Log: try a new answer to the javascript question Modified: website/trunk/docs/en/faq.wml =================================================================== --- website/trunk/docs/en/faq.wml 2013-08-11 22:04:21 UTC (rev 26298) +++ website/trunk/docs/en/faq.wml 2013-08-11 22:25:09 UTC (rev 26299) @@ -66,8 +66,6 @@ <li><a href="#TBBJavaScriptEnabled">Why is NoScript configured to allow JavaScript by default in the Tor Browser Bundle? Isn't that unsafe?</a></li> - <li><a href="#TBBCanIBlockJS">I'm an expert! (No, really!) Can I -configure NoScript to block JavaScript by default?</a></li> <li><a href="#TBBOtherBrowser">I want to use Chrome/IE/Opera/etc with Tor.</a></li> <li><a href="#TBBCloseBrowser">I want to leave Tor Browser Bundle @@ -1038,6 +1036,7 @@ <hr> <a id="TBBJavaScriptEnabled"></a> +<a id="TBBCanIBlockJS"></a> <h3><a class="anchor" href="#TBBJavaScriptEnabled">Why is NoScript configured to allow JavaScript by default in the Tor Browser Bundle? Isn't that unsafe?</a></h3> @@ -1051,26 +1050,35 @@ JavaScript might make a website work). </p> -<hr> +<p> +There's a tradeoff here. On the one hand, we should leave +JavaScript enabled by default so websites work the way +users expect. On the other hand, we should disable JavaScript +by default to better protect against browser vulnerabilities (<a +href="https://blog.torproject.org/blog/tor-security-advisory-old-tor-browser-bund…">not +just a theoretical concern!</a>). But there's a third issue: websites +can easily determine whether you have allowed JavaScript for them, +and if you disable JavaScript by default but then allow a few websites +to run scripts (the way most people use NoScript), then your choice of +whitelisted websites acts as a sort of cookie that makes you recognizable +(and distinguishable), thus harming your anonymity. +</p> -<a id="TBBCanIBlockJS"></a> -<h3><a class="anchor" href="#CanIBlockJS">I'm an expert! (No, really!) -Can I configure NoScript to block JavaScript by default?</a></h3> - <p> -You can configure your copies of Tor Browser Bundle however you want -to. However, we recommend that even users who know how to use -NoScript leave JavaScript enabled if possible, because a website or -exit node can easily distinguish users who disable JavaScript from -users who use Tor Browser bundle with its default settings (thus -users who disable JavaScript are less anonymous). +Ultimately, we want the default Tor bundles to use +a combination of firewalls (like the iptables rules +in <a href="https://tails.boum.org/">Tails</a>) and <a +href="https://trac.torproject.org/projects/tor/ticket/7680">sandboxes</a> +to make JavaScript not so scary. In +the shorter term, TBB 3.0 will hopefully <a +href="https://trac.torproject.org/projects/tor/ticket/9387">allow users +to choose their JavaScript settings more easily</a> — but the +partitioning concern will remain. </p> <p> -Disabling JavaScript by default, then allowing a few websites to run -scripts, is especially bad for your anonymity: the set of websites -which you allow to run scripts is very likely to <em>uniquely</em> -identify your browser. +Until we get there, feel free to leave JavaScript on or off depending +on your security, anonymity, and usability priorities. </p> <hr>

1 0