May 2014 - tor-commits - lists.torproject.org

[torspec/master] Describe 'id' line in microdescs, and consensus method 18
by nickm＠torproject.org 06 May '14

06 May '14

commit 22cda727f5f8457fbaece944d6ef34bb971d0541 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 5 11:35:27 2014 -0400 Describe 'id' line in microdescs, and consensus method 18 --- dir-spec.txt | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/dir-spec.txt b/dir-spec.txt index 1fb2392..2619b2b 100644 --- a/dir-spec.txt +++ b/dir-spec.txt @@ -1197,6 +1197,16 @@ (Only included when generating microdescriptors for consensus-method 15 or later.) + "id" SP base64-encoded-identity-digest NL + + [At most once] + + The node identity digest (as described in tor-spec.txt), base64 + encoded, without trailing =s. This line is included to prevent + collisions between microdescriptors. + + (Only included when generating microdescriptors for + consensus-method 18 or later.) (Note that with microdescriptors, clients do not learn the identity of their routers: they only learn a hash of the identity key. This is all @@ -2072,6 +2082,9 @@ bandwidth values in votes. They also add an "Unmeasured=1" flag to such 'w' lines. + * If consensus method 18 or later is used, authorities include + "id" lines in microdescriptors. + The signatures at the end of a consensus document are sorted in ascending order by identity digest.

1 0

[torspec/master] Use the prop220-aware format for id lines in mds
by nickm＠torproject.org 06 May '14

06 May '14

commit b1baf945e9a79ec289253ee41e2435283b64fb91 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 6 20:43:31 2014 -0400 Use the prop220-aware format for id lines in mds --- dir-spec.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dir-spec.txt b/dir-spec.txt index f8ad450..7e1fe13 100644 --- a/dir-spec.txt +++ b/dir-spec.txt @@ -1197,7 +1197,7 @@ (Only included when generating microdescriptors for consensus-method 15 or later.) - "id" SP base64-encoded-identity-digest NL + "id" SP "rsa1024" SP base64-encoded-identity-digest NL [At most once]

1 0

[tor/master] Unit test for dirvote_create_microdescriptor
by nickm＠torproject.org 06 May '14

06 May '14

commit 52416f8cfb8bc28207c05d83f50ed878ae358998 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 6 20:36:19 2014 -0400 Unit test for dirvote_create_microdescriptor --- src/test/test_microdesc.c | 107 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 107 insertions(+) diff --git a/src/test/test_microdesc.c b/src/test/test_microdesc.c index 2982484..78f4823 100644 --- a/src/test/test_microdesc.c +++ b/src/test/test_microdesc.c @@ -5,7 +5,10 @@ #include "or.h" #include "config.h" +#include "dirvote.h" #include "microdesc.h" +#include "routerlist.h" +#include "routerparse.h" #include "test.h" @@ -285,9 +288,113 @@ test_md_cache_broken(void *data) microdesc_free_all(); } +/* Generated by chutney. */ +static const char test_ri[] = + "router test005r 127.0.0.1 5005 0 7005\n" + "platform Tor 0.2.5.4-alpha-dev on Linux\n" + "protocols Link 1 2 Circuit 1\n" + "published 2014-05-06 22:57:55\n" + "fingerprint 09DE 3BA2 48C2 1C3F 3760 6CD3 8460 43A6 D5EC F59E\n" + "uptime 0\n" + "bandwidth 1073741824 1073741824 0\n" + "extra-info-digest 361F9428F9FA4DD854C03DDBCC159D0D9FA996C9\n" + "onion-key\n" + "-----BEGIN RSA PUBLIC KEY-----\n" + "MIGJAoGBANBJz8Vldl12aFeSMPLiA4nOetLDN0oxU8bB1SDhO7Uu2zdWYVYAF5J0\n" + "st7WvrVy/jA9v/fsezNAPskBanecHRSkdMTpkcgRPMHE7CTGEwIy1Yp1X4bPgDlC\n" + "VCnbs5Pcts5HnWEYNK7qHDAUn+IlmjOO+pTUY8uyq+GQVz6H9wFlAgMBAAE=\n" + "-----END RSA PUBLIC KEY-----\n" + "signing-key\n" + "-----BEGIN RSA PUBLIC KEY-----\n" + "MIGJAoGBANbGUC4802Ke6C3nOVxN0U0HhIRrs32cQFEL4v+UUMJPgjbistHBvOax\n" + "CWVR/sMXM2kKJeGThJ9ZUs2p9dDG4WHPUXgkMqzTTEeeFa7pQKU0brgbmLaJq0Pi\n" + "mxmqC5RkTHa5bQvq6QlSFprAEoovV27cWqBM9jVdV9hyc//6kwPzAgMBAAE=\n" + "-----END RSA PUBLIC KEY-----\n" + "hidden-service-dir\n" + "ntor-onion-key Gg73xH7+kTfT6bi1uNVx9gwQdQas9pROIfmc4NpAdC4=\n" + "reject *:25\n" + "reject *:119\n" + "reject *:135-139\n" + "reject *:445\n" + "reject *:563\n" + "reject *:1214\n" + "reject *:4661-4666\n" + "reject *:6346-6429\n" + "reject *:6699\n" + "reject *:6881-6999\n" + "accept *:*\n" + "router-signature\n" + "-----BEGIN SIGNATURE-----\n" + "ImzX5PF2vRCrG1YzGToyjoxYhgh1vtHEDjmP+tIS/iil1DSnHZNpHSuHp0L1jE9S\n" + "yZyrtKaqpBE/aecAM3j4CWCn/ipnAAQkHcyRLin1bYvqBtRzyopVCRlUhF+uWrLq\n" + "t0xkIE39ss/EwmQr7iIgkdVH4oRIMsjYnFFJBG26nYY=\n" + "-----END SIGNATURE-----\n"; + +static const char test_md_8[] = + "onion-key\n" + "-----BEGIN RSA PUBLIC KEY-----\n" + "MIGJAoGBANBJz8Vldl12aFeSMPLiA4nOetLDN0oxU8bB1SDhO7Uu2zdWYVYAF5J0\n" + "st7WvrVy/jA9v/fsezNAPskBanecHRSkdMTpkcgRPMHE7CTGEwIy1Yp1X4bPgDlC\n" + "VCnbs5Pcts5HnWEYNK7qHDAUn+IlmjOO+pTUY8uyq+GQVz6H9wFlAgMBAAE=\n" + "-----END RSA PUBLIC KEY-----\n" + "p reject 25,119,135-139,445,563,1214,4661-4666,6346-6429,6699,6881-6999\n"; + +static const char test_md_16[] = + "onion-key\n" + "-----BEGIN RSA PUBLIC KEY-----\n" + "MIGJAoGBANBJz8Vldl12aFeSMPLiA4nOetLDN0oxU8bB1SDhO7Uu2zdWYVYAF5J0\n" + "st7WvrVy/jA9v/fsezNAPskBanecHRSkdMTpkcgRPMHE7CTGEwIy1Yp1X4bPgDlC\n" + "VCnbs5Pcts5HnWEYNK7qHDAUn+IlmjOO+pTUY8uyq+GQVz6H9wFlAgMBAAE=\n" + "-----END RSA PUBLIC KEY-----\n" + "ntor-onion-key Gg73xH7+kTfT6bi1uNVx9gwQdQas9pROIfmc4NpAdC4=\n" + "p reject 25,119,135-139,445,563,1214,4661-4666,6346-6429,6699,6881-6999\n"; + +static const char test_md_18[] = + "onion-key\n" + "-----BEGIN RSA PUBLIC KEY-----\n" + "MIGJAoGBANBJz8Vldl12aFeSMPLiA4nOetLDN0oxU8bB1SDhO7Uu2zdWYVYAF5J0\n" + "st7WvrVy/jA9v/fsezNAPskBanecHRSkdMTpkcgRPMHE7CTGEwIy1Yp1X4bPgDlC\n" + "VCnbs5Pcts5HnWEYNK7qHDAUn+IlmjOO+pTUY8uyq+GQVz6H9wFlAgMBAAE=\n" + "-----END RSA PUBLIC KEY-----\n" + "ntor-onion-key Gg73xH7+kTfT6bi1uNVx9gwQdQas9pROIfmc4NpAdC4=\n" + "p reject 25,119,135-139,445,563,1214,4661-4666,6346-6429,6699,6881-6999\n" + "id rsa1024 Cd47okjCHD83YGzThGBDptXs9Z4\n"; + +static void +test_md_generate(void *arg) +{ + routerinfo_t *ri; + microdesc_t *md = NULL; + (void)arg; + + ri = router_parse_entry_from_string(test_ri, NULL, 0, 0, NULL); + tt_assert(ri); + md = dirvote_create_microdescriptor(ri, 8); + tt_str_op(md->body, ==, test_md_8); + + /* XXXX test family lines. */ + /* XXXX test method 14 for A lines. */ + /* XXXX test method 15 for P6 lines. */ + + microdesc_free(md); + md = NULL; + md = dirvote_create_microdescriptor(ri, 16); + tt_str_op(md->body, ==, test_md_16); + + microdesc_free(md); + md = NULL; + md = dirvote_create_microdescriptor(ri, 18); + tt_str_op(md->body, ==, test_md_18); + + done: + microdesc_free(md); + routerinfo_free(ri); +} + struct testcase_t microdesc_tests[] = { { "cache", test_md_cache, TT_FORK, NULL, NULL }, { "broken_cache", test_md_cache_broken, TT_FORK, NULL, NULL }, + { "generate", test_md_generate, 0, NULL, NULL }, END_OF_TESTCASES };

1 0

[tor/master] Future-proof "id" lines against proposal 220.
by nickm＠torproject.org 06 May '14

06 May '14

commit 2fa601c797eda2af3ae2d43f30c0622c515cdbe5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 6 17:10:59 2014 -0400 Future-proof "id" lines against proposal 220. --- src/or/dirvote.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/dirvote.c b/src/or/dirvote.c index 8b51306..c7be343 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -3591,7 +3591,7 @@ dirvote_create_microdescriptor(const routerinfo_t *ri, int consensus_method) if (consensus_method >= MIN_METHOD_FOR_ID_HASH_IN_MD) { char idbuf[BASE64_DIGEST_LEN+1]; digest_to_base64(idbuf, ri->cache_info.identity_digest); - smartlist_add_asprintf(chunks, "id %s\n", idbuf); + smartlist_add_asprintf(chunks, "id rsa1024 %s\n", idbuf); } output = smartlist_join_strings(chunks, "", 0, NULL);

1 0

[tor/master] fix a copy-paste comment mistake
by nickm＠torproject.org 06 May '14

06 May '14

commit f077bb55ab2b5d5f16aba3352a2a526ef6358abf Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 6 17:09:16 2014 -0400 fix a copy-paste comment mistake --- src/or/dirvote.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/or/dirvote.h b/src/or/dirvote.h index 2082579..4c57e43 100644 --- a/src/or/dirvote.h +++ b/src/or/dirvote.h @@ -61,8 +61,8 @@ * Unmeasured=1 flag for unmeasured bandwidths */ #define MIN_METHOD_TO_CLIP_UNMEASURED_BW 17 -/** Lowest consensus method that ensures that authorities output an - * Unmeasured=1 flag for unmeasured bandwidths */ +/** Lowest consensus method where authorities may include an "id" line in + * microdescriptors. */ #define MIN_METHOD_FOR_ID_HASH_IN_MD 18 /** Default bandwidth to clip unmeasured bandwidths to using method >=

1 0

[tor/master] Consensus method 18: Add a base64 ID digest to the microdesc
by nickm＠torproject.org 06 May '14

06 May '14

commit 4a621a50f53ebeac62d30f427c2db0c627f80a31 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon May 5 11:28:25 2014 -0400 Consensus method 18: Add a base64 ID digest to the microdesc This is a stopgap measure to make sure that microdescriptors never collide; see bug 11743. --- src/or/dirvote.c | 9 ++++++++- src/or/dirvote.h | 6 +++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/src/or/dirvote.c b/src/or/dirvote.c index 4d3ee9c..8b51306 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -3588,6 +3588,12 @@ dirvote_create_microdescriptor(const routerinfo_t *ri, int consensus_method) tor_free(p6); } + if (consensus_method >= MIN_METHOD_FOR_ID_HASH_IN_MD) { + char idbuf[BASE64_DIGEST_LEN+1]; + digest_to_base64(idbuf, ri->cache_info.identity_digest); + smartlist_add_asprintf(chunks, "id %s\n", idbuf); + } + output = smartlist_join_strings(chunks, "", 0, NULL); { @@ -3657,7 +3663,8 @@ static const struct consensus_method_range_t { {MIN_METHOD_FOR_MICRODESC, MIN_METHOD_FOR_A_LINES - 1}, {MIN_METHOD_FOR_A_LINES, MIN_METHOD_FOR_P6_LINES - 1}, {MIN_METHOD_FOR_P6_LINES, MIN_METHOD_FOR_NTOR_KEY - 1}, - {MIN_METHOD_FOR_NTOR_KEY, MAX_SUPPORTED_CONSENSUS_METHOD}, + {MIN_METHOD_FOR_NTOR_KEY, MIN_METHOD_FOR_ID_HASH_IN_MD - 1}, + {MIN_METHOD_FOR_ID_HASH_IN_MD, MAX_SUPPORTED_CONSENSUS_METHOD}, {-1, -1} }; diff --git a/src/or/dirvote.h b/src/or/dirvote.h index 3a4951a..2082579 100644 --- a/src/or/dirvote.h +++ b/src/or/dirvote.h @@ -22,7 +22,7 @@ #define MIN_VOTE_INTERVAL 300 /** The highest consensus method that we currently support. */ -#define MAX_SUPPORTED_CONSENSUS_METHOD 17 +#define MAX_SUPPORTED_CONSENSUS_METHOD 18 /** Lowest consensus method that contains a 'directory-footer' marker */ #define MIN_METHOD_FOR_FOOTER 9 @@ -61,6 +61,10 @@ * Unmeasured=1 flag for unmeasured bandwidths */ #define MIN_METHOD_TO_CLIP_UNMEASURED_BW 17 +/** Lowest consensus method that ensures that authorities output an + * Unmeasured=1 flag for unmeasured bandwidths */ +#define MIN_METHOD_FOR_ID_HASH_IN_MD 18 + /** Default bandwidth to clip unmeasured bandwidths to using method >= * MIN_METHOD_TO_CLIP_UNMEASURED_BW */ #define DEFAULT_MAX_UNMEASURED_BW_KB 20

1 0

[tor/master] changes file for bug11743
by nickm＠torproject.org 06 May '14

06 May '14

commit ea570fa13c3305406790125d01de301b3f894ab1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 6 16:28:34 2014 -0400 changes file for bug11743 --- changes/bug11743 | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/changes/bug11743 b/changes/bug11743 new file mode 100644 index 0000000..89e4bbc --- /dev/null +++ b/changes/bug11743 @@ -0,0 +1,15 @@ + o Major security fixes (directory authorities): + + - Directory authorities now include a digest of each relay's + identity key as a part of its microdescriptor. + + This is a workaround for bug #11743, where Tor clients do not + support receiving multiple microdescriptors with the same SHA256 + digest in the same consensus. When clients receive a consensus + like this, they only use one of the relays. Without this fix, a + hostile relay could selectively disable client use of target + relays by constucting a router descriptor with a different + identity and the same microdescriptor parameters and getting the + authorities to list it in a microdescriptor consensus. This fix + prevents an attacker from causing a microdescriptor collision, + because the router's identity is not forgeable.

1 0

[tor/master] Merge branch 'bug11743_option_b'
by nickm＠torproject.org 06 May '14

06 May '14

commit 5cea500ce75116abe4deb46d759f5ac1048dd4cc Merge: ed0e2ec 52416f8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 6 20:40:40 2014 -0400 Merge branch 'bug11743_option_b' changes/bug11743 | 15 +++++++ src/or/dirvote.c | 9 +++- src/or/dirvote.h | 6 ++- src/test/test_microdesc.c | 107 +++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 135 insertions(+), 2 deletions(-)

1 0

[translation/torbutton-torbuttonproperties] Update translations for torbutton-torbuttonproperties
by translation＠torproject.org 06 May '14

06 May '14

commit 23e8fd132e4b7d5b1aa5b0bc97ef5fd33af69bbd Author: Translation commit bot <translation(a)torproject.org> Date: Tue May 6 23:45:56 2014 +0000 Update translations for torbutton-torbuttonproperties --- tr/torbutton.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tr/torbutton.properties b/tr/torbutton.properties index 7dc2a90..db32a46 100644 --- a/tr/torbutton.properties +++ b/tr/torbutton.properties @@ -36,7 +36,7 @@ torbutton.popup.redirect = Yönlendir torbutton.popup.no_redirect = Yönlendirme torbutton.popup.prompted_language = Daha fazla gizlilik icin, Torbutton sayfaların İngilizce versiyonlarını göstermeye çalışır. Bu özellik sayfaları anadilinizde görememenize sebep olabilir.\n\nSiz de daha fazla gizlilik için sayfaların İngilizce versiyonarını görüntülemek ister misiniz? torbutton.popup.no_newnym = Torbutton size güvenli yeni bir kimlik sağlayamadı. Tor Control Port una giriş yapılamıyor.\n\nTor Browser Bundle nin çalıştığından emin olun. -torbutton.popup.use_tbb = Görünüşe göre Turbutton u Firefox ile kullanıyorsunuz, bu tavsiye edilen bir güvenlik ayarlaması değildir.\n\nAslında, Size tavsiyemiz Tor Browseri gettor(a)torproject.org adresine mail göndererek veya şu adrese girerek edinmenizdir. +torbutton.popup.use_tbb = Görünüşe göre Torbutton'ı Firefox ile kullanıyorsunuz, bu tavsiye edilen bir güvenlik ayarlaması değildir.\n\nAslında, Size tavsiyemiz Tor Tarayıcısını gettor(a)torproject.org adresine e-posta göndererek veya şu adrese girerek edinmenizdir. torbutton.popup.pref_error = Torbutton, Tor Browser profil klasörünün içinde seçenekleri güncelleyemez. torbutton.popup.permission_denied = Lütfen Tor Browser klasörünün izinlerini sıfırlayın ya da O nu farklı bir konuma taşıyın. torbutton.popup.device_full = Disk dolu gözüküyor. Lütfen diskte yer açın ya da Tor Browser i farklı bir konuma taşıyın.

1 0

[translation/tails-misc_completed] Update translations for tails-misc_completed
by translation＠torproject.org 06 May '14

06 May '14

commit cd2107a65b66295a52cc1d6e2bdf4d1d1e810bfe Author: Translation commit bot <translation(a)torproject.org> Date: Tue May 6 23:45:47 2014 +0000 Update translations for tails-misc_completed --- tr.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tr.po b/tr.po index 18d7cba..cb3ca06 100644 --- a/tr.po +++ b/tr.po @@ -17,7 +17,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2014-04-27 19:29+0200\n" -"PO-Revision-Date: 2014-05-01 22:40+0000\n" +"PO-Revision-Date: 2014-05-06 23:20+0000\n" "Last-Translator: volkangezer <volkangezer(a)gmail.com>\n" "Language-Team: Turkish (http://www.transifex.com/projects/p/torproject/language/tr/)\n" "MIME-Version: 1.0\n" @@ -50,7 +50,7 @@ msgid "" "<p>Anyone who can see this reply will probably infer you are\n" "a Tails user. Time to wonder how much you trust your\n" "Internet and mailbox providers?</p>\n" -msgstr "<h1>Hataları düzeltmemizde bize yardım edin!</h1>\n<p><a href=\"%s\">Hata bildirme talimatlarını okuyun.</a></p>\n<p><strong>Gerekenden daha fazla kişisel bilgi içermesin!</strong></p>\n<h2>Bize e-posta adresi vermekle alakalı</h2>\n<p>Eğer Tails geliştiricilerine karşı kimliğinizin biraz açığa çıkmasını umursamıyorsanız, hata hakkında daha fazla detayı size sorabilmemiz için e-mail adresinizi verebilirsiniz. Ayrıca bir public PGP anahtarı girmeniz gelecekteki iletişimimizin şifrelenmiş olmasına izin verir.</p>\n<p>Bu cevabı gören herkes senin bir Tails kullanıcısı olduğunu muhtemelen anlayacaktır. İnternetinize ve e-posta sağlayıcınıza ne kadar güvenebileceğinizi merak etme zamanı!</p>\n" +msgstr "<h1>Hataları düzeltmemizde bize yardım edin!</h1>\n<p><a href=\"%s\">Hata bildirme talimatlarını okuyun.</a></p>\n<p><strong>Gerekenden daha fazla kişisel bilgi içermesin!</strong></p>\n<h2>Bize e-posta adresi vermekle alakalı</h2>\n<p>Eğer Tails geliştiricilerine karşı kimliğinizin biraz açığa çıkmasını umursamıyorsanız, hata hakkında daha fazla detayı size sorabilmemiz için e-posta adresinizi verebilirsiniz. Ayrıca bir public PGP anahtarı girmeniz gelecekteki iletişimimizin şifrelenmiş olmasına izin verir.</p>\n<p>Bu cevabı gören herkes sizin bir Tails kullanıcısı olduğunuzu muhtemelen anlayacaktır. İnternetinize ve e-posta sağlayıcınıza ne kadar güvenebileceğinizi merak etme zamanı!</p>\n" #: config/chroot_local-includes/usr/local/bin/gpgApplet:136 msgid "OpenPGP encryption applet"

1 0