May 2014 - tor-commits - lists.torproject.org

[meek/master] Add some proxy support functions.
by dcf＠torproject.org 28 May '14

28 May '14

commit daab1193f4234bd23e26f7a525356b67630c6ba2 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 24 20:25:49 2014 -0700 Add some proxy support functions. These are candidates to move to goptlib for proposal 232 support. I assumed that you should be able to give a proxy host as a domain name, but it turns out that proposal 232 doesn't actually say that (https://trac.torproject.org/projects/tor/ticket/12125#comment:3) Some of the tests use IP addresses and some use host names. --- meek-client/proxy.go | 53 ++++++++++++++++++++++++++++++++++ meek-client/proxy_test.go | 69 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 122 insertions(+) diff --git a/meek-client/proxy.go b/meek-client/proxy.go new file mode 100644 index 0000000..56717a3 --- /dev/null +++ b/meek-client/proxy.go @@ -0,0 +1,53 @@ +package main + +import ( + "errors" + "fmt" + "net/url" + "os" +) + +import "git.torproject.org/pluggable-transports/goptlib.git" + +// The code in this file has to do with configuring an upstream proxy, whether +// through the command line or the managed interface of proposal 232 +// (TOR_PT_PROXY). +// +// https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/232-pluggabl… + +// Get the upstream proxy URL. Returns nil if no proxy is requested. The +// function ensures that the Scheme and Host fields are set; i.e., that the URL +// is absolute. This function reads the environment variable TOR_PT_PROXY. +// +// This function doesn't check that the scheme is one of Tor's supported proxy +// schemes; that is, one of "http", "socks5", or "socks4a". The caller must be +// able to handle any returned scheme (which may be by calling PtProxyError if +// it doesn't know how to handle the scheme). +func PtGetProxyURL() (*url.URL, error) { + rawurl := os.Getenv("TOR_PT_PROXY") + if rawurl == "" { + return nil, nil + } + u, err := url.Parse(rawurl) + if err != nil { + return nil, err + } + if u.Scheme == "" { + return nil, errors.New("missing scheme") + } + if u.Host == "" { + return nil, errors.New("missing host") + } + return u, nil +} + +// Emit a PROXY-ERROR line with explanation text. +func PtProxyError(msg string) { + fmt.Fprintf(pt.Stdout, "PROXY-ERROR %s\n", msg) +} + +// Emit a PROXY DONE line. Call this after parsing the return value of +// PtGetProxyURL. +func PtProxyDone() { + fmt.Fprintf(pt.Stdout, "PROXY DONE\n") +} diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go new file mode 100644 index 0000000..9565101 --- /dev/null +++ b/meek-client/proxy_test.go @@ -0,0 +1,69 @@ +package main + +import ( + "os" + "testing" +) + +func TestGetProxyURL(t *testing.T) { + badTests := [...]string{ + "bogus", + "http:", + "://127.0.0.1", + "//127.0.0.1", + "http:127.0.0.1", + "://[::1]", + "//[::1]", + "http:[::1]", + "://localhost", + "//localhost", + "http:localhost", + } + goodTests := [...]struct { + input, expected string + }{ + {"http://127.0.0.1", "http://127.0.0.1"}, + {"http://127.0.0.1:8080", "http://127.0.0.1:8080"}, + {"http://127.0.0.1:8080/", "http://127.0.0.1:8080/"}, + {"http://127.0.0.1:8080/path", "http://127.0.0.1:8080/path"}, + {"http://[::1]", "http://[::1]"}, + {"http://[::1]:8080", "http://[::1]:8080"}, + {"http://[::1]:8080/", "http://[::1]:8080/"}, + {"http://[::1]:8080/path", "http://[::1]:8080/path"}, + {"http://localhost", "http://localhost"}, + {"http://localhost:8080", "http://localhost:8080"}, + {"http://localhost:8080/", "http://localhost:8080/"}, + {"http://localhost:8080/path", "http://localhost:8080/path"}, + {"http://user@localhost:8080", "http://user@localhost:8080"}, + {"http://user:password@localhost:8080", "http://user:password@localhost:8080"}, + {"unknown://localhost/whatever", "unknown://localhost/whatever"}, + } + + os.Clearenv() + u, err := PtGetProxyURL() + if err != nil { + t.Errorf("empty environment unexpectedly returned an error: %s", err) + } + if u != nil { + t.Errorf("empty environment returned %q", u) + } + + for _, input := range badTests { + os.Setenv("TOR_PT_PROXY", input) + u, err = PtGetProxyURL() + if err == nil { + t.Errorf("TOR_PT_PROXY=%q unexpectedly succeeded and returned %q", input, u) + } + } + + for _, test := range goodTests { + os.Setenv("TOR_PT_PROXY", test.input) + u, err := PtGetProxyURL() + if err != nil { + t.Errorf("TOR_PT_PROXY=%q unexpectedly returned an error: %s", test.input, err) + } + if u == nil || u.String() != test.expected { + t.Errorf("TOR_PT_PROXY=%q → %q (expected %q)", test.input, u, test.expected) + } + } +}

1 0

[meek/master] Honor a socks5 proxy when roundtripping through the helper.
by dcf＠torproject.org 28 May '14

28 May '14

commit 3aab55c820d25a9881b66982589573057a67c5b1 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 24 23:39:57 2014 -0700 Honor a socks5 proxy when roundtripping through the helper. --- meek-client/helper.go | 2 +- meek-client/helper_test.go | 5 +++++ meek-client/meek-client.go | 2 +- meek-client/proxy_test.go | 1 + 4 files changed, 8 insertions(+), 2 deletions(-) diff --git a/meek-client/helper.go b/meek-client/helper.go index d349ff7..872f401 100644 --- a/meek-client/helper.go +++ b/meek-client/helper.go @@ -59,7 +59,7 @@ func makeProxySpec(u *url.URL) (*ProxySpec, error) { } switch u.Scheme { - case "http", "socks4a": + case "http", "socks5", "socks4a": spec.Type = u.Scheme default: return nil, errors.New("unknown scheme") diff --git a/meek-client/helper_test.go b/meek-client/helper_test.go index f33bb38..291ab11 100644 --- a/meek-client/helper_test.go +++ b/meek-client/helper_test.go @@ -19,6 +19,7 @@ func TestMakeProxySpec(t *testing.T) { url.URL{Scheme: "http", User: url.UserPassword("username", "password"), Host: "localhost:8080"}, url.URL{Scheme: "http", Host: "localhost:-1"}, url.URL{Scheme: "http", Host: "localhost:65536"}, + url.URL{Scheme: "socks5", Host: ":"}, url.URL{Scheme: "socks4a", Host: ":"}, // "socks" and "socks4" are unknown types. url.URL{Scheme: "socks", Host: "localhost:1080"}, @@ -34,6 +35,10 @@ func TestMakeProxySpec(t *testing.T) { ProxySpec{"http", "localhost", 8080}, }, { + url.URL{Scheme: "socks5", Host: "localhost:1080"}, + ProxySpec{"socks5", "localhost", 1080}, + }, + { url.URL{Scheme: "socks4a", Host: "localhost:1080"}, ProxySpec{"socks4a", "localhost", 1080}, }, diff --git a/meek-client/meek-client.go b/meek-client/meek-client.go index b4f9dee..0093cc0 100644 --- a/meek-client/meek-client.go +++ b/meek-client/meek-client.go @@ -325,7 +325,7 @@ func checkProxyURL(u *url.URL) error { // With the helper we can use HTTP and SOCKS (because it is the // browser that does the proxying, not us). switch options.ProxyURL.Scheme { - case "http", "socks4a": + case "http", "socks5", "socks4a": default: return errors.New(fmt.Sprintf("don't understand proxy URL scheme %q", options.ProxyURL.Scheme)) } diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go index 7ce206f..d26362d 100644 --- a/meek-client/proxy_test.go +++ b/meek-client/proxy_test.go @@ -36,6 +36,7 @@ func TestGetProxyURL(t *testing.T) { {"http://localhost:8080/path", "http://localhost:8080/path"}, {"http://user@localhost:8080", "http://user@localhost:8080"}, {"http://user:password@localhost:8080", "http://user:password@localhost:8080"}, + {"socks5://localhost:1080", "socks5://localhost:1080"}, {"socks4a://localhost:1080", "socks4a://localhost:1080"}, {"unknown://localhost/whatever", "unknown://localhost/whatever"}, }

1 0

[meek/master] Honor an http proxy when roundtripping through the helper.
by dcf＠torproject.org 28 May '14

28 May '14

commit bb22b14120357f084d7e63d26c3ee493bc270236 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 24 22:37:17 2014 -0700 Honor an http proxy when roundtripping through the helper. --- meek-client/helper.go | 55 ++++++++++++++++++++++++++++++++++++++++++++ meek-client/helper_test.go | 50 ++++++++++++++++++++++++++++++++++++++++ meek-client/meek-client.go | 4 +++- 3 files changed, 108 insertions(+), 1 deletion(-) diff --git a/meek-client/helper.go b/meek-client/helper.go index 49423fb..d85ac8d 100644 --- a/meek-client/helper.go +++ b/meek-client/helper.go @@ -10,6 +10,8 @@ import ( "io/ioutil" "net" "net/http" + "net/url" + "strconv" "time" ) @@ -21,6 +23,7 @@ type JSONRequest struct { URL string `json:"url,omitempty"` Header map[string]string `json:"header,omitempty"` Body []byte `json:"body,omitempty"` + Proxy *ProxySpec `json:"proxy,omitempty"` } type JSONResponse struct { @@ -29,6 +32,54 @@ type JSONResponse struct { Body []byte `json:"body"` } +// ProxySpec encodes information we need to connect through a proxy. +type ProxySpec struct { + // Acceptable values for Type are as in proposal 232: "http", "socks5", + // or "socks4a". + Type string `json:"type"` + Host string `json:"host"` + Port int `json:"port"` +} + +// Return a ProxySpec suitable for the proxy URL in u. +func makeProxySpec(u *url.URL) (*ProxySpec, error) { + spec := new(ProxySpec) + var err error + var portStr string + var port uint64 + + if u == nil { + // No proxy. + return nil, nil + } + + // Firefox's nsIProxyInfo doesn't allow credentials. + if u.User != nil { + return nil, errors.New("proxy URLs with a username or password can't be used with the helper") + } + + if u.Scheme == "http" { + spec.Type = "http" + } else { + return nil, errors.New("unknown scheme") + } + + spec.Host, portStr, err = net.SplitHostPort(u.Host) + if err != nil { + return nil, err + } + if spec.Host == "" { + return nil, errors.New("missing host") + } + port, err = strconv.ParseUint(portStr, 10, 16) + if err != nil { + return nil, err + } + spec.Port = int(port) + + return spec, nil +} + // Do an HTTP roundtrip through the configured browser extension, using the // payload data in buf and the request metadata in info. func roundTripWithHelper(buf []byte, info *RequestInfo) (*http.Response, error) { @@ -49,6 +100,10 @@ func roundTripWithHelper(buf []byte, info *RequestInfo) (*http.Response, error) if info.Host != "" { req.Header["Host"] = info.Host } + req.Proxy, err = makeProxySpec(options.ProxyURL) + if err != nil { + return nil, err + } encReq, err := json.Marshal(&req) if err != nil { return nil, err diff --git a/meek-client/helper_test.go b/meek-client/helper_test.go new file mode 100644 index 0000000..4a34e35 --- /dev/null +++ b/meek-client/helper_test.go @@ -0,0 +1,50 @@ +package main + +import ( + "net/url" + "testing" +) + +func TestMakeProxySpec(t *testing.T) { + badTests := [...]url.URL{ + url.URL{Scheme: "http"}, + url.URL{Scheme: "http", Host: ":"}, + url.URL{Scheme: "http", Host: "localhost"}, + url.URL{Scheme: "http", Host: "localhost:"}, + url.URL{Scheme: "http", Host: ":8080"}, + url.URL{Scheme: "http", Host: "localhost:https"}, + url.URL{Scheme: "http", Host: "localhost:8080", User: url.User("username")}, + url.URL{Scheme: "http", Host: "localhost:8080", User: url.UserPassword("username", "password")}, + url.URL{Scheme: "http", User: url.User("username"), Host: "localhost:8080"}, + url.URL{Scheme: "http", User: url.UserPassword("username", "password"), Host: "localhost:8080"}, + url.URL{Scheme: "http", Host: "localhost:-1"}, + url.URL{Scheme: "http", Host: "localhost:65536"}, + url.URL{Scheme: "unknown", Host: "localhost:9999"}, + } + goodTests := [...]struct { + input url.URL + expected ProxySpec + }{ + { + url.URL{Scheme: "http", Host: "localhost:8080"}, + ProxySpec{"http", "localhost", 8080}, + }, + } + + for _, input := range badTests { + _, err := makeProxySpec(&input) + if err == nil { + t.Errorf("%q unexpectedly succeeded", input) + } + } + + for _, test := range goodTests { + spec, err := makeProxySpec(&test.input) + if err != nil { + t.Fatalf("%q unexpectedly returned an error: %s", test.input, err) + } + if *spec != test.expected { + t.Errorf("%q → %q (expected %q)", test.input, spec, test.expected) + } + } +} diff --git a/meek-client/meek-client.go b/meek-client/meek-client.go index 5f7228e..72e379f 100644 --- a/meek-client/meek-client.go +++ b/meek-client/meek-client.go @@ -320,7 +320,9 @@ func checkProxyURL(u *url.URL) error { return errors.New(fmt.Sprintf("don't understand proxy URL scheme %q", options.ProxyURL.Scheme)) } if options.HelperAddr != nil { - return errors.New("--helper can't be used with an upstream proxy") + if options.ProxyURL.User != nil { + return errors.New("a proxy URL with a username or password can't be used with --helper") + } } return nil }

1 0

[meek/master] Add Proxy configuration examples to torrc.
by dcf＠torproject.org 28 May '14

28 May '14

commit 1e099c54089b1ed1aef556069c2546709acb5cdf Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 24 23:00:33 2014 -0700 Add Proxy configuration examples to torrc. --- meek-client/torrc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/meek-client/torrc b/meek-client/torrc index 62f2c72..6ed137b 100644 --- a/meek-client/torrc +++ b/meek-client/torrc @@ -1,4 +1,9 @@ UseBridges 1 + +# Socks4Proxy localhost:1080 +# Socks5Proxy localhost:1080 +# HTTPSProxy localhost:8080 + # Bridge meek 0.0.2.0:1 url=https://meek-reflect.appspot.com/ front=www.google.com # ClientTransportPlugin meek exec ./meek-client --log meek-client.log Bridge meek 0.0.2.0:1

1 0

[meek/master] Honor a socks4a proxy when roundtripping through the helper.
by dcf＠torproject.org 28 May '14

28 May '14

commit 79e3e5ff285d698636d0ad4b797d89a3f56749e8 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 24 23:39:23 2014 -0700 Honor a socks4a proxy when roundtripping through the helper. --- meek-client/helper.go | 7 ++++--- meek-client/helper_test.go | 8 ++++++++ meek-client/meek-client.go | 17 +++++++++++++---- meek-client/proxy_test.go | 1 + 4 files changed, 26 insertions(+), 7 deletions(-) diff --git a/meek-client/helper.go b/meek-client/helper.go index d85ac8d..d349ff7 100644 --- a/meek-client/helper.go +++ b/meek-client/helper.go @@ -58,9 +58,10 @@ func makeProxySpec(u *url.URL) (*ProxySpec, error) { return nil, errors.New("proxy URLs with a username or password can't be used with the helper") } - if u.Scheme == "http" { - spec.Type = "http" - } else { + switch u.Scheme { + case "http", "socks4a": + spec.Type = u.Scheme + default: return nil, errors.New("unknown scheme") } diff --git a/meek-client/helper_test.go b/meek-client/helper_test.go index 4a34e35..f33bb38 100644 --- a/meek-client/helper_test.go +++ b/meek-client/helper_test.go @@ -19,6 +19,10 @@ func TestMakeProxySpec(t *testing.T) { url.URL{Scheme: "http", User: url.UserPassword("username", "password"), Host: "localhost:8080"}, url.URL{Scheme: "http", Host: "localhost:-1"}, url.URL{Scheme: "http", Host: "localhost:65536"}, + url.URL{Scheme: "socks4a", Host: ":"}, + // "socks" and "socks4" are unknown types. + url.URL{Scheme: "socks", Host: "localhost:1080"}, + url.URL{Scheme: "socks4", Host: "localhost:1080"}, url.URL{Scheme: "unknown", Host: "localhost:9999"}, } goodTests := [...]struct { @@ -29,6 +33,10 @@ func TestMakeProxySpec(t *testing.T) { url.URL{Scheme: "http", Host: "localhost:8080"}, ProxySpec{"http", "localhost", 8080}, }, + { + url.URL{Scheme: "socks4a", Host: "localhost:1080"}, + ProxySpec{"socks4a", "localhost", 1080}, + }, } for _, input := range badTests { diff --git a/meek-client/meek-client.go b/meek-client/meek-client.go index 72e379f..b4f9dee 100644 --- a/meek-client/meek-client.go +++ b/meek-client/meek-client.go @@ -316,10 +316,19 @@ func acceptLoop(ln *pt.SocksListener) error { // Return an error if this proxy URL doesn't work with the rest of the // configuration. func checkProxyURL(u *url.URL) error { - if options.ProxyURL.Scheme != "http" { - return errors.New(fmt.Sprintf("don't understand proxy URL scheme %q", options.ProxyURL.Scheme)) - } - if options.HelperAddr != nil { + if options.HelperAddr == nil { + // Without the helper we only support HTTP proxies. + if options.ProxyURL.Scheme != "http" { + return errors.New(fmt.Sprintf("don't understand proxy URL scheme %q", options.ProxyURL.Scheme)) + } + } else { + // With the helper we can use HTTP and SOCKS (because it is the + // browser that does the proxying, not us). + switch options.ProxyURL.Scheme { + case "http", "socks4a": + default: + return errors.New(fmt.Sprintf("don't understand proxy URL scheme %q", options.ProxyURL.Scheme)) + } if options.ProxyURL.User != nil { return errors.New("a proxy URL with a username or password can't be used with --helper") } diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go index 9565101..7ce206f 100644 --- a/meek-client/proxy_test.go +++ b/meek-client/proxy_test.go @@ -36,6 +36,7 @@ func TestGetProxyURL(t *testing.T) { {"http://localhost:8080/path", "http://localhost:8080/path"}, {"http://user@localhost:8080", "http://user@localhost:8080"}, {"http://user:password@localhost:8080", "http://user:password@localhost:8080"}, + {"socks4a://localhost:1080", "socks4a://localhost:1080"}, {"unknown://localhost/whatever", "unknown://localhost/whatever"}, }

1 0

[meek/master] Add some commented test cases to think about.
by dcf＠torproject.org 28 May '14

28 May '14

commit 40007e4fa55f77e4657bbc8931f8d540c002057d Author: David Fifield <david(a)bamsoftware.com> Date: Sun May 25 11:18:33 2014 -0700 Add some commented test cases to think about. It may make sense for use to ensure that the proxy URL has a separable host name and port. On the other hand, that's one of the error conditions the application is going to have to check for anyway when it goes to connect to the proxy. --- meek-client/proxy_test.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go index d26362d..77123b9 100644 --- a/meek-client/proxy_test.go +++ b/meek-client/proxy_test.go @@ -40,6 +40,16 @@ func TestGetProxyURL(t *testing.T) { {"socks4a://localhost:1080", "socks4a://localhost:1080"}, {"unknown://localhost/whatever", "unknown://localhost/whatever"}, } + /* + No port: reject; or infer from scheme? + http://localhost + socks4a://localhost + socks5://localhost + Port without host: probably reject? + http://:8080 + socks4a://:1080 + socks5://:1080 + */ os.Clearenv() u, err := PtGetProxyURL()

1 0

[translation/https_everywhere_completed] Update translations for https_everywhere_completed
by translation＠torproject.org 28 May '14

28 May '14

commit 9eef11414d80a3ba25b372e47909baef5e01a82b Author: Translation commit bot <translation(a)torproject.org> Date: Wed May 28 06:15:20 2014 +0000 Update translations for https_everywhere_completed --- fi/ssl-observatory.dtd | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fi/ssl-observatory.dtd b/fi/ssl-observatory.dtd index 9270c4f..86bb49d 100644 --- a/fi/ssl-observatory.dtd +++ b/fi/ssl-observatory.dtd @@ -41,6 +41,12 @@ to turn it on?">--> <!ENTITY ssl-observatory.prefs.asn_tooltip "Tämä noutaa ja lähettää verkkosi autonomisen järjestelmän numerotunnuksen (ASN). Näin pystymme paikantamaan HTTPS:ään kohdistuvat hyökkäykset ja voimme selvittää, ovatko havainnot Iranin ja Syyrian kaltaisten alueiden verkoista, joissa hyökkäykset ovat yleisiä."> +<!ENTITY ssl-observatory.prefs.show_cert_warning +"Näytä varoitus, kun Observatorio havaitsee suljetun varmenteen jotka eivät kuulu selaimeesi."> + +<!ENTITY ssl-observatory.prefs.show_cert_warning_tooltip +"Tämä tarkistaa toimitetut varmenteet tiedettyjen varmenteiden listasta. Valitettavasti emme voi taata että merkitsemme kaikki suljetut varmenteet, mutta jos näet varoituksen on hyvä mahdollisuus että jotain on vialla."> + <!ENTITY ssl-observatory.prefs.done "Valmis"> <!ENTITY ssl-observatory.prefs.explanation @@ -78,7 +84,7 @@ Mouseover the options for further details:">--> <!ENTITY ssl-observatory.warning.showcert "Näytä palvelimen varmenneketju"> <!ENTITY ssl-observatory.warning.okay "Ymmärrän"> <!ENTITY ssl-observatory.warning.text "EFFin SSL Observatory on varoittanut tämän sivuston yhdestä tai useammasta HTTPS-varmenteesta:"> -<!ENTITY ssl-observatory.warning.defense "Jos olet kirjautunut sivustolle, voi olla suositeltavaa vaihtaa salasana, sitten kun käytössäsi on turvallinen yhteys."> +<!ENTITY ssl-observatory.warning.defense "Jos olet kirjautunut sivustolle, voi olla suositeltavaa vaihtaa salasana, kun sinulla on käytössä turvallinen yhteys. (Nämä varoitukset voidaan laittaa pois päältä ''SSL Observatoryssä'' klikkaa HTTPS Kaikkialla mieltymyksiä.)"> <!ENTITY ssl-observatory.prefs.self_signed "Lähetä ja tarkista sivuston itsensä allekirjoittama varmenne">

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 28 May '14

28 May '14

commit 285cee8155f0d40be5735688b657c8df113aaa3d Author: Translation commit bot <translation(a)torproject.org> Date: Wed May 28 06:15:16 2014 +0000 Update translations for https_everywhere --- fi/ssl-observatory.dtd | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fi/ssl-observatory.dtd b/fi/ssl-observatory.dtd index 48a2857..86bb49d 100644 --- a/fi/ssl-observatory.dtd +++ b/fi/ssl-observatory.dtd @@ -42,10 +42,10 @@ to turn it on?">--> "Tämä noutaa ja lähettää verkkosi autonomisen järjestelmän numerotunnuksen (ASN). Näin pystymme paikantamaan HTTPS:ään kohdistuvat hyökkäykset ja voimme selvittää, ovatko havainnot Iranin ja Syyrian kaltaisten alueiden verkoista, joissa hyökkäykset ovat yleisiä."> <!ENTITY ssl-observatory.prefs.show_cert_warning -"Show a warning when the Observatory detects a revoked certificate not caught by your browser"> +"Näytä varoitus, kun Observatorio havaitsee suljetun varmenteen jotka eivät kuulu selaimeesi."> <!ENTITY ssl-observatory.prefs.show_cert_warning_tooltip -"This will check submitted certificates against known Certificate Revocation Lists. Unfortunately we cannot guarantee that we will flag every revoked certificate, but if you do see a warning there's a good chance something is wrong."> +"Tämä tarkistaa toimitetut varmenteet tiedettyjen varmenteiden listasta. Valitettavasti emme voi taata että merkitsemme kaikki suljetut varmenteet, mutta jos näet varoituksen on hyvä mahdollisuus että jotain on vialla."> <!ENTITY ssl-observatory.prefs.done "Valmis"> @@ -84,7 +84,7 @@ Mouseover the options for further details:">--> <!ENTITY ssl-observatory.warning.showcert "Näytä palvelimen varmenneketju"> <!ENTITY ssl-observatory.warning.okay "Ymmärrän"> <!ENTITY ssl-observatory.warning.text "EFFin SSL Observatory on varoittanut tämän sivuston yhdestä tai useammasta HTTPS-varmenteesta:"> -<!ENTITY ssl-observatory.warning.defense "If you are logged in to this site, it may be advisable to change your password once you have a safe connection. (These warnings can be disabled in the "SSL Observatory" tab of the HTTPS Everywhere preferences dialog.)"> +<!ENTITY ssl-observatory.warning.defense "Jos olet kirjautunut sivustolle, voi olla suositeltavaa vaihtaa salasana, kun sinulla on käytössä turvallinen yhteys. (Nämä varoitukset voidaan laittaa pois päältä ''SSL Observatoryssä'' klikkaa HTTPS Kaikkialla mieltymyksiä.)"> <!ENTITY ssl-observatory.prefs.self_signed "Lähetä ja tarkista sivuston itsensä allekirjoittama varmenne">

1 0

[tor/master] sandbox: permit listen(2)
by nickm＠torproject.org 28 May '14

28 May '14

commit a056ffabbbdc76598830331c6550740a24fadeb8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 27 19:28:12 2014 -0400 sandbox: permit listen(2) Fix for 12115; bugfix on 0.2.5.1-alpha --- changes/bug12115 | 3 +++ src/common/sandbox.c | 1 + 2 files changed, 4 insertions(+) diff --git a/changes/bug12115 b/changes/bug12115 new file mode 100644 index 0000000..7b84649 --- /dev/null +++ b/changes/bug12115 @@ -0,0 +1,3 @@ + o Minor bugfixes (linux seccomp sandbox): + - Avoid crashing when re-opening listener ports with the seccomp + sandbox active. Fixes bug 12115; bugfix on 0.2.5.1-alpha. diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 7586c0c..ba1956b 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -186,6 +186,7 @@ static int filter_nopar_gen[] = { // socket syscalls SCMP_SYS(bind), + SCMP_SYS(listen), SCMP_SYS(connect), SCMP_SYS(getsockname), SCMP_SYS(recvmsg),

1 0

[tor/master] sandbox: Allow DirPortFrontPage unconditionally if it's set
by nickm＠torproject.org 28 May '14

28 May '14

commit 14842de9a731b6bbb348583645a31a3f3ab68af8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 27 19:21:11 2014 -0400 sandbox: Allow DirPortFrontPage unconditionally if it's set fixes 12114; bug not in any release. Improves fix for 12028 --- src/or/main.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/or/main.c b/src/or/main.c index 8b79c42..a3be9a2 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2870,6 +2870,11 @@ sandbox_init_filter(void) } } + if (options->DirPortFrontPage) { + sandbox_cfg_allow_open_filename(&cfg, + tor_strdup(options->DirPortFrontPage)); + } + // orport if (server_mode(get_options())) { sandbox_cfg_allow_open_filename_array(&cfg, @@ -2905,11 +2910,6 @@ sandbox_init_filter(void) NULL, 0 ); - if (options->DirPortFrontPage) { - sandbox_cfg_allow_open_filename(&cfg, - tor_strdup(options->DirPortFrontPage)); - } - RENAME_SUFFIX("fingerprint", ".tmp"); RENAME_SUFFIX2("keys", "secret_onion_key_ntor", ".tmp"); RENAME_SUFFIX2("keys", "secret_id_key", ".tmp");

1 0