November 2014 - tor-commits - lists.torproject.org

[translation/tails-misc] Update translations for tails-misc
by translation＠torproject.org 07 Nov '14

07 Nov '14

commit dd551c42c302d60d946ee29534d9dcfd17349fd2 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Nov 7 22:15:41 2014 +0000 Update translations for tails-misc --- nb.po | 39 ++++++++++++++++++++------------------- 1 file changed, 20 insertions(+), 19 deletions(-) diff --git a/nb.po b/nb.po index 410fe2b..4f134b1 100644 --- a/nb.po +++ b/nb.po @@ -6,13 +6,14 @@ # Allan Nordhøy <comradekingu(a)gmail.com>, 2014 # Jan-Erik Ek <jan.erik.ek(a)gmail.com>, 2013 # lateralus, 2014 +# pr0xity, 2014 msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2014-10-10 13:00+0200\n" -"PO-Revision-Date: 2014-10-15 17:12+0000\n" -"Last-Translator: runasand <runa.sandvik(a)gmail.com>\n" +"POT-Creation-Date: 2014-10-15 17:57+0200\n" +"PO-Revision-Date: 2014-11-07 22:15+0000\n" +"Last-Translator: pr0xity\n" "Language-Team: Norwegian Bokmål (http://www.transifex.com/projects/p/torproject/language/nb/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -304,12 +305,12 @@ msgid "" msgstr "MAC-parodiering feilet for nettverkskort ${nic_name} (${nic}). Feilgjenopprettingen feilet også, så alt nettverk er deaktivert. \nDet anbefales å starte Tails på nytt og deaktivere MAC-parodiering. Se <a href='file:///usr/share/doc/first_steps/startup_options/mac_spoofing.en.html'>dokumentasjonen</a>." #: config/chroot_local-includes/usr/local/bin/tails-upgrade-frontend-wrapper:19 -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:60 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:62 msgid "error:" msgstr "feil:" #: config/chroot_local-includes/usr/local/bin/tails-upgrade-frontend-wrapper:20 -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:61 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:63 msgid "Error" msgstr "Feil" @@ -359,63 +360,63 @@ msgstr "Start Tor Browser" msgid "Cancel" msgstr "Avbryt" -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:71 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:73 msgid "Do you really want to launch the Unsafe Browser?" msgstr "Vil du virkelig starte den usikre nettleseren?" -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:73 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:75 msgid "" "Network activity within the Unsafe Browser is <b>not anonymous</b>. Only use" " the Unsafe Browser if necessary, for example if you have to login or " "register to activate your Internet connection." msgstr "Nettverkstrafikken i den usikre nettleseren er <b>ikke anonym</b>. Bruk kun den usikre nettleseren om absolutt nødvendig, for eksempel når du må logge inn eller registrere deg for å aktivere internettforbindelsen din." -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:74 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:76 msgid "_Launch" msgstr "_Start" -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:75 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:77 msgid "_Exit" msgstr "_Avslutt" -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:85 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:87 msgid "Starting the Unsafe Browser..." msgstr "Starter den usikre nettleseren..." -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:86 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:88 msgid "This may take a while, so please be patient." msgstr "Dette kan ta litt tid, så vennligst vær tålmodig." -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:104 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:106 msgid "Failed to setup chroot." msgstr "Feilet i å opprette et chroot-miljø." -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:184 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:180 #: ../config/chroot_local-includes/usr/share/applications/unsafe-browser.desktop.in.h:1 msgid "Unsafe Browser" msgstr "Usikker Nettleser" -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:240 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:236 msgid "Shutting down the Unsafe Browser..." msgstr "Avslutter den Usikre Nettleseren..." -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:241 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:237 msgid "" "This may take a while, and you may not restart the Unsafe Browser until it " "is properly shut down." msgstr "Dette kan ta en stund, og den usikre nettleseren kan ikke startes på nytt før den forrige er helt avsluttet. " -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:253 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:249 msgid "Failed to restart Tor." msgstr "Kunne ikke starte om Tor." -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:261 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:257 msgid "" "Another Unsafe Browser is currently running, or being cleaned up. Please " "retry in a while." msgstr "En annen Usikker Nettleser kjører for øyeblikket, eller blir renset. Vennligst prøv på nytt om en stund." -#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:274 +#: config/chroot_local-includes/usr/local/sbin/unsafe-browser:270 msgid "" "No DNS server was obtained through DHCP or manually configured in " "NetworkManager." @@ -423,7 +424,7 @@ msgstr "Ingen DNS server ble tildelt gjennom DHCP eller manuell konfigurasjon i #: config/chroot_local-includes/usr/share/tails/truecrypt-wrapper.disabled:11 msgid "TrueCrypt will be removed in Tails 1.2.1" -msgstr "" +msgstr "TrueCrypt vil bli fjernet i Tails 1.2.1" #: config/chroot_local-includes/usr/share/tails/truecrypt-wrapper.disabled:12 msgid ""

1 0

[translation/tails-persistence-setup_completed] Update translations for tails-persistence-setup_completed
by translation＠torproject.org 07 Nov '14

07 Nov '14

commit 10db43b9a59de2074d0bf9f1e2ca4ee5bb9bfbcd Author: Translation commit bot <translation(a)torproject.org> Date: Fri Nov 7 22:15:23 2014 +0000 Update translations for tails-persistence-setup_completed --- nb/nb.po | 47 ++++++++++++++++++++++++----------------------- 1 file changed, 24 insertions(+), 23 deletions(-) diff --git a/nb/nb.po b/nb/nb.po index e860360..10e3ac9 100644 --- a/nb/nb.po +++ b/nb/nb.po @@ -3,15 +3,16 @@ # This file is distributed under the same license as the PACKAGE package. # # Translators: -# Ylada <jan.erik.ek(a)gmail.com>, 2013 +# Jan-Erik Ek <jan.erik.ek(a)gmail.com>, 2013 # lateralus, 2013-2014 +# pr0xity, 2014 msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: Tails developers <tails(a)boum.org>\n" -"POT-Creation-Date: 2014-04-16 21:26+0200\n" -"PO-Revision-Date: 2014-04-17 14:43+0000\n" -"Last-Translator: lateralus\n" +"POT-Creation-Date: 2014-10-08 21:13+0200\n" +"PO-Revision-Date: 2014-11-07 22:07+0000\n" +"Last-Translator: pr0xity\n" "Language-Team: Norwegian Bokmål (http://www.transifex.com/projects/p/torproject/language/nb/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -80,8 +81,8 @@ msgid "Browser bookmarks" msgstr "Nettleser bokmerker" #: ../lib/Tails/Persistence/Configuration/Presets.pm:120 -msgid "Bookmarks saved in Iceweasel browser" -msgstr "Bokmerker lagret i Iceweasel nettleseren" +msgid "Bookmarks saved in the Tor Browser" +msgstr "Bokmerker lagret i Tor nettleseren" #: ../lib/Tails/Persistence/Configuration/Presets.pm:128 msgid "Printers" @@ -120,67 +121,67 @@ msgstr "Symlink alle filene eller katalogene funnet i `dotfiles' katalogen til $ msgid "Setup Tails persistent volume" msgstr "Konfigurer Tails med vedvarende enhet" -#: ../lib/Tails/Persistence/Setup.pm:337 +#: ../lib/Tails/Persistence/Setup.pm:307 ../lib/Tails/Persistence/Setup.pm:452 +msgid "Error" +msgstr "Feil" + +#: ../lib/Tails/Persistence/Setup.pm:339 #, perl-format msgid "Device %s already has a persistent volume." msgstr "Enheten %s er allerede satt opp med en vedvarende enhet." -#: ../lib/Tails/Persistence/Setup.pm:345 +#: ../lib/Tails/Persistence/Setup.pm:347 #, perl-format msgid "Device %s has not enough unallocated space." msgstr "Enheten %s har ikke nok upartisjonert plass ledig." -#: ../lib/Tails/Persistence/Setup.pm:353 ../lib/Tails/Persistence/Setup.pm:367 +#: ../lib/Tails/Persistence/Setup.pm:355 ../lib/Tails/Persistence/Setup.pm:369 #, perl-format msgid "Device %s has no persistent volume." msgstr "Enheten %s er ikke satt opp med en vedvarende enhet. " -#: ../lib/Tails/Persistence/Setup.pm:359 +#: ../lib/Tails/Persistence/Setup.pm:361 msgid "" "Cannot delete the persistent volume while in use. You should restart Tails " "without persistence." msgstr "Den vedvarende enheten kan ikke fjernes mens den er i bruk. Du bør starte Tails på nytt uten vedvarende enhet." -#: ../lib/Tails/Persistence/Setup.pm:378 +#: ../lib/Tails/Persistence/Setup.pm:380 msgid "Persistence volume is not unlocked." msgstr "Vedvarende enhet er ikke låst opp." -#: ../lib/Tails/Persistence/Setup.pm:383 +#: ../lib/Tails/Persistence/Setup.pm:385 msgid "Persistence volume is not mounted." msgstr "Vedvarende enhet er ikke montert." -#: ../lib/Tails/Persistence/Setup.pm:388 +#: ../lib/Tails/Persistence/Setup.pm:390 msgid "Persistence volume is not readable. Permissions or ownership problems?" msgstr "Vedvarende enhet er ikke leselig. Mangler du de nødvendige rettighetene?" -#: ../lib/Tails/Persistence/Setup.pm:393 +#: ../lib/Tails/Persistence/Setup.pm:395 msgid "Persistence volume is not writable. Maybe it was mounted read-only?" msgstr "Vedvarende enhet er ikke skrivbar. Kanskje den ble montert med skrivebeskyttelse?" -#: ../lib/Tails/Persistence/Setup.pm:402 +#: ../lib/Tails/Persistence/Setup.pm:404 #, perl-format msgid "Tails is running from non-USB / non-SDIO device %s." msgstr "Tails kjører ikke fra en USB / SDIO enhet %s." -#: ../lib/Tails/Persistence/Setup.pm:408 +#: ../lib/Tails/Persistence/Setup.pm:410 #, perl-format msgid "Device %s is optical." msgstr "Enheten %s er optisk." -#: ../lib/Tails/Persistence/Setup.pm:415 +#: ../lib/Tails/Persistence/Setup.pm:417 #, perl-format msgid "Device %s was not created using Tails Installer." msgstr "Enhet %s ble ikke opprettet med Tails installerer." -#: ../lib/Tails/Persistence/Setup.pm:450 -msgid "Error" -msgstr "Feil" - -#: ../lib/Tails/Persistence/Setup.pm:670 +#: ../lib/Tails/Persistence/Setup.pm:677 msgid "Persistence wizard - Finished" msgstr "Veiviser for vedvarende enget - Ferdig" -#: ../lib/Tails/Persistence/Setup.pm:673 +#: ../lib/Tails/Persistence/Setup.pm:680 msgid "" "Any changes you have made will only take effect after restarting Tails.\n" "\n"

1 0

[translation/tails-persistence-setup] Update translations for tails-persistence-setup
by translation＠torproject.org 07 Nov '14

07 Nov '14

commit b4fd1d20510a86635bb92eaf592f0a1b5d697611 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Nov 7 22:15:20 2014 +0000 Update translations for tails-persistence-setup --- nb/nb.po | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/nb/nb.po b/nb/nb.po index 38237c6..10e3ac9 100644 --- a/nb/nb.po +++ b/nb/nb.po @@ -5,13 +5,14 @@ # Translators: # Jan-Erik Ek <jan.erik.ek(a)gmail.com>, 2013 # lateralus, 2013-2014 +# pr0xity, 2014 msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: Tails developers <tails(a)boum.org>\n" "POT-Creation-Date: 2014-10-08 21:13+0200\n" -"PO-Revision-Date: 2014-10-09 10:19+0000\n" -"Last-Translator: runasand <runa.sandvik(a)gmail.com>\n" +"PO-Revision-Date: 2014-11-07 22:07+0000\n" +"Last-Translator: pr0xity\n" "Language-Team: Norwegian Bokmål (http://www.transifex.com/projects/p/torproject/language/nb/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -81,7 +82,7 @@ msgstr "Nettleser bokmerker" #: ../lib/Tails/Persistence/Configuration/Presets.pm:120 msgid "Bookmarks saved in the Tor Browser" -msgstr "" +msgstr "Bokmerker lagret i Tor nettleseren" #: ../lib/Tails/Persistence/Configuration/Presets.pm:128 msgid "Printers"

1 0

[tor-browser/tor-browser-31.2.0esr-4.5-1] squash! Bug #11955 Backport certificate pinning
by mikeperry＠torproject.org 07 Nov '14

07 Nov '14

commit 2822ccdb6d00b563413a285fe63488ab2ca7b460 Author: Camilo Viecco <cviecco(a)mozilla.com> Date: Thu Nov 6 10:30:37 2014 -0800 squash! Bug #11955 Backport certificate pinning Bug #13684: Backport Mozilla's Bug 1066190 --- security/certverifier/CertVerifier.cpp | 48 ++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/security/certverifier/CertVerifier.cpp b/security/certverifier/CertVerifier.cpp index b2db9fc..1af728e 100644 --- a/security/certverifier/CertVerifier.cpp +++ b/security/certverifier/CertVerifier.cpp @@ -197,6 +197,36 @@ SECStatus chainValidationCallback(void* state, const CERTCertList* certList, return SECSuccess; } +// This always returns secfailure but its objective is to replate +// the PR_Error +static void +tryWorsenPRErrorInCallback(CERTCertificate* cert, + ChainValidationCallbackState* callbackState) { + ScopedCERTCertificate certCopy(CERT_DupCertificate(cert)); + if (!certCopy) { + return; + } + ScopedCERTCertList certList(CERT_NewCertList()); + if (!certList) { + return; + } + SECStatus srv = CERT_AddCertToListTail(certList.get(), certCopy.get()); + if (srv != SECSuccess) { + return; + } + certCopy.release(); // now owned by certList + PRBool chainOK = false; + srv = chainValidationCallback(&callbackState, certList.get(), &chainOK); + if (srv != SECSuccess) { + return; + } + if (!chainOK) { + PR_SetError(SEC_ERROR_APPLICATION_CALLBACK_ERROR, 0); // same as libpkix + return ; + } + return; // no change in PR_error +} + static SECStatus ClassicVerifyCert(CERTCertificate* cert, const SECCertificateUsage usage, @@ -276,6 +306,12 @@ ClassicVerifyCert(CERTCertificate* cert, return SECFailure; } } + + // If there is an error we may need to worsen to error to be a pinning failure + if (rv != SECSuccess && usage == certificateUsageSSLServer) { + tryWorsenPRErrorInCallback(cert, callbackState); + } + if (rv == SECSuccess && validationChain) { *validationChain = certChain.release(); } @@ -545,6 +581,12 @@ CertVerifier::MozillaPKIXVerifyCert( return SECFailure; } + // If there is an error we may need to worsen to error to be a pinning failure + if (rv != SECSuccess && usage == certificateUsageSSLServer && + PR_GetError() != SEC_ERROR_APPLICATION_CALLBACK_ERROR) { + tryWorsenPRErrorInCallback(cert, callbackState); + } + if (validationChain && rv == SECSuccess) { *validationChain = builtChain.release(); } @@ -876,6 +918,12 @@ CertVerifier::VerifyCert(CERTCertificate* cert, rv = CERT_PKIXVerifyCert(cert, usage, cvin, cvout, pinArg); pkix_done: + // If there is an error we may need to worsen to error to be a pinning failure + if (rv != SECSuccess && usage == certificateUsageSSLServer && + PR_GetError() != SEC_ERROR_APPLICATION_CALLBACK_ERROR) { + tryWorsenPRErrorInCallback(cert, &callbackState); + } + if (validationChain) { PR_LOG(gCertVerifierLog, PR_LOG_DEBUG, ("VerifyCert: validation chain requested\n")); ScopedCERTCertificate trustAnchor(cvout[validationTrustAnchorLocation].value.pointer.cert);

1 0

[tor/master] Wrong format in log statement
by nickm＠torproject.org 07 Nov '14

07 Nov '14

commit 151f5f90b8a103a35dfbf62426257dc918df4816 Author: David Goulet <dgoulet(a)ev0ke.net> Date: Fri Nov 7 11:40:41 2014 -0500 Wrong format in log statement Fixes bug 13701. --- changes/bug13701 | 4 ++++ src/or/circuituse.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/changes/bug13701 b/changes/bug13701 new file mode 100644 index 0000000..23a08af --- /dev/null +++ b/changes/bug13701 @@ -0,0 +1,4 @@ + o Minor bugfixes (logging): + - Log the circuit identifier correctly in + connection_ap_handshake_attach_circuit(). Fixes bug 13701; + bugfix on 0.0.6. diff --git a/src/or/circuituse.c b/src/or/circuituse.c index 441a8fc..10bc45f 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -2324,7 +2324,7 @@ connection_ap_handshake_attach_circuit(entry_connection_t *conn) tor_assert(rendcirc); /* one is already established, attach */ log_info(LD_REND, - "rend joined circ %d already here. attaching. " + "rend joined circ %u already here. attaching. " "(stream %d sec old)", (unsigned)rendcirc->base_.n_circ_id, conn_age); /* Mark rendezvous circuits as 'newly dirty' every time you use

1 0

[torspec/master] Bring more proposal 220 sections in sync with implementation
by nickm＠torproject.org 07 Nov '14

07 Nov '14

commit 51d8807bb652bfb0e0c23c9bdfc2ce39415e049f Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 1 10:07:43 2014 -0400 Bring more proposal 220 sections in sync with implementation --- proposals/220-ecc-id-keys.txt | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/proposals/220-ecc-id-keys.txt b/proposals/220-ecc-id-keys.txt index 95ed4dd..f669f57 100644 --- a/proposals/220-ecc-id-keys.txt +++ b/proposals/220-ecc-id-keys.txt @@ -186,9 +186,10 @@ Status: Draft We specify the following element that may appear at most once in each router descriptor: - "identity-ed25519" SP certificate NL + "identity-ed25519" NL "-----BEGIN ED25519 CERT-----" NL certificate + "-----END ED25519 CERT-----" NL - The identity-key and certificate are base64-encoded with + The certificate is base64-encoded with terminating =s removed. When this element is present, it MUST appear as the first or second element in the router descriptor. [XXX The rationale here is to allow extracting the identity key and @@ -200,15 +201,15 @@ Status: Draft can extract the identity key. When an identity-ed25519 element is present, there must also be a - "router-signature-ed25519" element. It MUST be the next-to-last - element in the descriptor, appearing immediately before the RSA - signature. (In future versions of the descriptor format that do not - require an RSA identity key, it MUST be last.) It MUST contain an - ed25519 signature of the entire document, from the first character up - to but not including the "router-signature-ed25519" element, prefixed + "router-sig-ed25519" element. It MUST be the next-to-last element in + the descriptor, appearing immediately before the RSA signature. (In + future versions of the descriptor format that do not require an RSA + identity key, it MUST be last.) It MUST contain an ed25519 signature + of a SHA256 digest of the entire document, from the first character + up to but not including the "router-sig-ed25519" element, prefixed with the string "Tor router descriptor signature v1". Its format is: - "router-signature-ed25519" SP signature NL + "router-sig-ed25519" SP signature NL Where 'signature' is encoded in base64 with terminating =s removed.

1 0

[torspec/master] Update proposal 228 to reflect implementation status
by nickm＠torproject.org 07 Nov '14

07 Nov '14

commit cc453f956b8f8979e7bfa2f17be7de5587da992a Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Oct 1 14:15:08 2014 -0400 Update proposal 228 to reflect implementation status --- proposals/228-cross-certification-onionkeys.txt | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/proposals/228-cross-certification-onionkeys.txt b/proposals/228-cross-certification-onionkeys.txt index d28b714..b3b401c 100644 --- a/proposals/228-cross-certification-onionkeys.txt +++ b/proposals/228-cross-certification-onionkeys.txt @@ -85,6 +85,8 @@ Status: Open Note that this cert format has 32 bytes of of redundant data, since it includes the identity key an extra time. That seems okay to me. + The signed key here is the master identity key. + The TYPE field in this certificate should be set to [0A] - ntor onion key cross-certifying ntor identity key @@ -151,3 +153,16 @@ B. Security notes oracle for our curve25519 ntor keys. Fortunately, we don't, since nobody else can influence the certificate contents. +C. Implementation notes + + As implemented in Tor, I've decided to make this proposal cross-dependent + on proposal 220. A router descriptor must have ALL or NONE + of the following: + * An Ed25529 identity key + * A TAP cross-certification + * An ntor cross-certification + + Further, if it has the above, it must also have: + * An ntor onion key. + +

1 0

[torspec/master] Update proposal 220 voting process to be actually secure
by nickm＠torproject.org 07 Nov '14

07 Nov '14

commit 3e328861802f3e1d01b3d5488cc6f43400deae8e Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 7 11:25:22 2014 -0500 Update proposal 220 voting process to be actually secure This makes it mirror the existing voting process, and ensures that the results are equivalent once everybody is updated. --- proposals/220-ecc-id-keys.txt | 78 +++++++++++++++++++++++++---------------- 1 file changed, 47 insertions(+), 31 deletions(-) diff --git a/proposals/220-ecc-id-keys.txt b/proposals/220-ecc-id-keys.txt index f669f57..cf11740 100644 --- a/proposals/220-ecc-id-keys.txt +++ b/proposals/220-ecc-id-keys.txt @@ -206,7 +206,8 @@ Status: Draft future versions of the descriptor format that do not require an RSA identity key, it MUST be last.) It MUST contain an ed25519 signature of a SHA256 digest of the entire document, from the first character - up to but not including the "router-sig-ed25519" element, prefixed + up to and including the first space after the "router-sig-ed25519" + string, prefixed with the string "Tor router descriptor signature v1". Its format is: "router-sig-ed25519" SP signature NL @@ -314,6 +315,14 @@ Status: Draft A vote or consensus document is ill-formed if it includes the same ed25519 identity key twice. + A vote listing ed25519 identities must also include a new entry in its + "r" lines, containing a base64-encoded SHA256 digest of the entire + descriptor (including signature). This kills off another place where + we rely on sha1. The format for 'r' lines is now: + + "r" SP nickname SP identity SP digest SP publication SP IP SP ORPort + SP DirPort [ SP digest-sha256 ] NL + 3.3. Generating votes An authority should pick which descriptor to choose for a node as @@ -335,45 +344,52 @@ Status: Draft it, we'll pick the next available vote method in sequence to use for this. - When the new consensus method is in use, we must choose nodes first - by ECC key, then by RSA key. + When the new consensus method is in use, we must choose nodes first by ECC + key, then by RSA key. [This procedure is analogous to the current one, + except that it is aware of multiple kinds of keys.] + +3.4.1. Notation for voting + + We have a set of votes. Each contains either 'old tuples' or 'new tuples'. + + Old tuples are: + <id-RSA, descriptor-digest, published, nickname, IP, ports> + + New tuples are: + <id-Ed, id-RSA, descriptor-digest, dd256, published, nickname, IP, ports> + + +3.4.2. Validating votes - First, for every {ECC identity key, RSA identity key} pair listed by - over half of the voting authorities, list it, unless some other RSA - identity key digest is listed more popularly for the ECC key. Break - ties in favor of low RSA digests. Treat all routerstatus entries that - mention this <ECC,RSA> pair as being for the same router, and all - routerstatus entries that mention the same RSA key with an - unspecified ECC key as being for the same router. + It is an error for a vote to have the same id-RSA or the same id-Ed listed + twice. Throw it away if it does. - Then, for every node that has previously not been listed, perform the - current routerstatus algorithm: listing a node if it has been listed - by at least N/2 voting authorities, and treating all routerstatuses - containing the same identity as the same router. +3.4.3. Decide which ids to include. - In other words: + For each <id-Ed, id-RSA> that is listed by more than half of the total + authorities (not just total votes), include it. (No other <id-Ed, id-RSA'> + can have as many votes.) - Let Entries = [] + Log any other id-RSA values corresponding to an id-Ed we included, and any + other id-Ed values corresponding to an id-RSA we included. - for each ECC ID listed by any voter: - Find the RSA key associated with that ECC ID by the most voters, - breaking ties in favor of low RSA keys. + For each <id-RSA> that is not yet included, if it is listed by more than + half of the total authorities, and we do not already have it listed with + some <id-Ed>, include it without an id-Ed. - If that ECC ID and RSA key ID are listed by > N/2 voting authorities: - Add the consensus of the routerstatus entries for those - voters, along with the routerstatus entry for every voter - that included that RSA key with no ECC key, to Entries. - Include the ECC ID in the consensus. +3.4.4. Decide which descriptors to include. - For each RSA key listed by any voter: - If that RSA key is already in Entries, skip it. + A tuple belongs to an <id-RSA, id-Ed> identity if it is a new tuple that + matches both ID parts, or if it is an old tuple that matches the RSA part. + A tuple belongs to an <id-RSA> identity if its RSA identity matches. - If the RSA key is listed by > N/2 voting authorities: - Add the consensus of the routerstatus entries for those - voters to Entries. Do not include an ECC key in the - consensus. + A tuple matches another tuple if all the fields that are present in both + tuples are the same. - [XXX Think about this even more.] + For every included identity, consider the tuples belonging to that + identity. Group them into sets of matching tuples. Include the tuple + that matches the largest set, breaking ties in favor of the most recently + published, and then in favor of the smaller server descriptor digest. 4. The link protocol

1 0

[torspec/master] Merge branch '220_evolution'
by nickm＠torproject.org 07 Nov '14

07 Nov '14

commit d57bfea27213d839e77c17882df4bb168e13ecc3 Merge: 773f0ae 3e32886 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 7 11:37:43 2014 -0500 Merge branch '220_evolution' This branch reflects changes I've needed to make in proposals 220 and 228 to reflect what's sensible or implementable (as far as I've found while implementing them). proposals/220-ecc-id-keys.txt | 95 +++++++++++++---------- proposals/228-cross-certification-onionkeys.txt | 15 ++++ 2 files changed, 71 insertions(+), 39 deletions(-)

1 0

[tor/master] test_checkdir.c: Perhaps this is what will make this test pass on windows?
by nickm＠torproject.org 07 Nov '14

07 Nov '14

commit 5b1971c7f337371efbab17b88070a7e6f3a11cc8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Nov 7 09:28:49 2014 -0500 test_checkdir.c: Perhaps this is what will make this test pass on windows? --- src/test/test_checkdir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/test/test_checkdir.c b/src/test/test_checkdir.c index 4bbccfc..bece24e 100644 --- a/src/test/test_checkdir.c +++ b/src/test/test_checkdir.c @@ -56,7 +56,7 @@ test_checkdir_perms(void *testdata) testdir = get_datadir_fname("checkdir_new_groupok_err"); tt_int_op(0, ==, mkdir(testdir, 027)); cpd_chkopts = CPD_CHECK_MODE_ONLY|CPD_CREATE|CPD_GROUP_OK; - tt_int_op(-1, ==, check_private_dir(testdir, cpd_chkopts, NULL)); + tt_int_op_nowin(-1, ==, check_private_dir(testdir, cpd_chkopts, NULL)); tor_free(testdir); /* test: create new dir, CPD_GROUP_READ option set. */

1 0