May 2014 - tor-commits - lists.torproject.org

[meek/master] Honor a socks5 proxy when roundtripping through the helper.
by dcf＠torproject.org 28 May '14

28 May '14

commit 3aab55c820d25a9881b66982589573057a67c5b1 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 24 23:39:57 2014 -0700 Honor a socks5 proxy when roundtripping through the helper. --- meek-client/helper.go | 2 +- meek-client/helper_test.go | 5 +++++ meek-client/meek-client.go | 2 +- meek-client/proxy_test.go | 1 + 4 files changed, 8 insertions(+), 2 deletions(-) diff --git a/meek-client/helper.go b/meek-client/helper.go index d349ff7..872f401 100644 --- a/meek-client/helper.go +++ b/meek-client/helper.go @@ -59,7 +59,7 @@ func makeProxySpec(u *url.URL) (*ProxySpec, error) { } switch u.Scheme { - case "http", "socks4a": + case "http", "socks5", "socks4a": spec.Type = u.Scheme default: return nil, errors.New("unknown scheme") diff --git a/meek-client/helper_test.go b/meek-client/helper_test.go index f33bb38..291ab11 100644 --- a/meek-client/helper_test.go +++ b/meek-client/helper_test.go @@ -19,6 +19,7 @@ func TestMakeProxySpec(t *testing.T) { url.URL{Scheme: "http", User: url.UserPassword("username", "password"), Host: "localhost:8080"}, url.URL{Scheme: "http", Host: "localhost:-1"}, url.URL{Scheme: "http", Host: "localhost:65536"}, + url.URL{Scheme: "socks5", Host: ":"}, url.URL{Scheme: "socks4a", Host: ":"}, // "socks" and "socks4" are unknown types. url.URL{Scheme: "socks", Host: "localhost:1080"}, @@ -34,6 +35,10 @@ func TestMakeProxySpec(t *testing.T) { ProxySpec{"http", "localhost", 8080}, }, { + url.URL{Scheme: "socks5", Host: "localhost:1080"}, + ProxySpec{"socks5", "localhost", 1080}, + }, + { url.URL{Scheme: "socks4a", Host: "localhost:1080"}, ProxySpec{"socks4a", "localhost", 1080}, }, diff --git a/meek-client/meek-client.go b/meek-client/meek-client.go index b4f9dee..0093cc0 100644 --- a/meek-client/meek-client.go +++ b/meek-client/meek-client.go @@ -325,7 +325,7 @@ func checkProxyURL(u *url.URL) error { // With the helper we can use HTTP and SOCKS (because it is the // browser that does the proxying, not us). switch options.ProxyURL.Scheme { - case "http", "socks4a": + case "http", "socks5", "socks4a": default: return errors.New(fmt.Sprintf("don't understand proxy URL scheme %q", options.ProxyURL.Scheme)) } diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go index 7ce206f..d26362d 100644 --- a/meek-client/proxy_test.go +++ b/meek-client/proxy_test.go @@ -36,6 +36,7 @@ func TestGetProxyURL(t *testing.T) { {"http://localhost:8080/path", "http://localhost:8080/path"}, {"http://user@localhost:8080", "http://user@localhost:8080"}, {"http://user:password@localhost:8080", "http://user:password@localhost:8080"}, + {"socks5://localhost:1080", "socks5://localhost:1080"}, {"socks4a://localhost:1080", "socks4a://localhost:1080"}, {"unknown://localhost/whatever", "unknown://localhost/whatever"}, }

1 0

[meek/master] Honor an http proxy when roundtripping through the helper.
by dcf＠torproject.org 28 May '14

28 May '14

commit bb22b14120357f084d7e63d26c3ee493bc270236 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 24 22:37:17 2014 -0700 Honor an http proxy when roundtripping through the helper. --- meek-client/helper.go | 55 ++++++++++++++++++++++++++++++++++++++++++++ meek-client/helper_test.go | 50 ++++++++++++++++++++++++++++++++++++++++ meek-client/meek-client.go | 4 +++- 3 files changed, 108 insertions(+), 1 deletion(-) diff --git a/meek-client/helper.go b/meek-client/helper.go index 49423fb..d85ac8d 100644 --- a/meek-client/helper.go +++ b/meek-client/helper.go @@ -10,6 +10,8 @@ import ( "io/ioutil" "net" "net/http" + "net/url" + "strconv" "time" ) @@ -21,6 +23,7 @@ type JSONRequest struct { URL string `json:"url,omitempty"` Header map[string]string `json:"header,omitempty"` Body []byte `json:"body,omitempty"` + Proxy *ProxySpec `json:"proxy,omitempty"` } type JSONResponse struct { @@ -29,6 +32,54 @@ type JSONResponse struct { Body []byte `json:"body"` } +// ProxySpec encodes information we need to connect through a proxy. +type ProxySpec struct { + // Acceptable values for Type are as in proposal 232: "http", "socks5", + // or "socks4a". + Type string `json:"type"` + Host string `json:"host"` + Port int `json:"port"` +} + +// Return a ProxySpec suitable for the proxy URL in u. +func makeProxySpec(u *url.URL) (*ProxySpec, error) { + spec := new(ProxySpec) + var err error + var portStr string + var port uint64 + + if u == nil { + // No proxy. + return nil, nil + } + + // Firefox's nsIProxyInfo doesn't allow credentials. + if u.User != nil { + return nil, errors.New("proxy URLs with a username or password can't be used with the helper") + } + + if u.Scheme == "http" { + spec.Type = "http" + } else { + return nil, errors.New("unknown scheme") + } + + spec.Host, portStr, err = net.SplitHostPort(u.Host) + if err != nil { + return nil, err + } + if spec.Host == "" { + return nil, errors.New("missing host") + } + port, err = strconv.ParseUint(portStr, 10, 16) + if err != nil { + return nil, err + } + spec.Port = int(port) + + return spec, nil +} + // Do an HTTP roundtrip through the configured browser extension, using the // payload data in buf and the request metadata in info. func roundTripWithHelper(buf []byte, info *RequestInfo) (*http.Response, error) { @@ -49,6 +100,10 @@ func roundTripWithHelper(buf []byte, info *RequestInfo) (*http.Response, error) if info.Host != "" { req.Header["Host"] = info.Host } + req.Proxy, err = makeProxySpec(options.ProxyURL) + if err != nil { + return nil, err + } encReq, err := json.Marshal(&req) if err != nil { return nil, err diff --git a/meek-client/helper_test.go b/meek-client/helper_test.go new file mode 100644 index 0000000..4a34e35 --- /dev/null +++ b/meek-client/helper_test.go @@ -0,0 +1,50 @@ +package main + +import ( + "net/url" + "testing" +) + +func TestMakeProxySpec(t *testing.T) { + badTests := [...]url.URL{ + url.URL{Scheme: "http"}, + url.URL{Scheme: "http", Host: ":"}, + url.URL{Scheme: "http", Host: "localhost"}, + url.URL{Scheme: "http", Host: "localhost:"}, + url.URL{Scheme: "http", Host: ":8080"}, + url.URL{Scheme: "http", Host: "localhost:https"}, + url.URL{Scheme: "http", Host: "localhost:8080", User: url.User("username")}, + url.URL{Scheme: "http", Host: "localhost:8080", User: url.UserPassword("username", "password")}, + url.URL{Scheme: "http", User: url.User("username"), Host: "localhost:8080"}, + url.URL{Scheme: "http", User: url.UserPassword("username", "password"), Host: "localhost:8080"}, + url.URL{Scheme: "http", Host: "localhost:-1"}, + url.URL{Scheme: "http", Host: "localhost:65536"}, + url.URL{Scheme: "unknown", Host: "localhost:9999"}, + } + goodTests := [...]struct { + input url.URL + expected ProxySpec + }{ + { + url.URL{Scheme: "http", Host: "localhost:8080"}, + ProxySpec{"http", "localhost", 8080}, + }, + } + + for _, input := range badTests { + _, err := makeProxySpec(&input) + if err == nil { + t.Errorf("%q unexpectedly succeeded", input) + } + } + + for _, test := range goodTests { + spec, err := makeProxySpec(&test.input) + if err != nil { + t.Fatalf("%q unexpectedly returned an error: %s", test.input, err) + } + if *spec != test.expected { + t.Errorf("%q → %q (expected %q)", test.input, spec, test.expected) + } + } +} diff --git a/meek-client/meek-client.go b/meek-client/meek-client.go index 5f7228e..72e379f 100644 --- a/meek-client/meek-client.go +++ b/meek-client/meek-client.go @@ -320,7 +320,9 @@ func checkProxyURL(u *url.URL) error { return errors.New(fmt.Sprintf("don't understand proxy URL scheme %q", options.ProxyURL.Scheme)) } if options.HelperAddr != nil { - return errors.New("--helper can't be used with an upstream proxy") + if options.ProxyURL.User != nil { + return errors.New("a proxy URL with a username or password can't be used with --helper") + } } return nil }

1 0

[meek/master] Add Proxy configuration examples to torrc.
by dcf＠torproject.org 28 May '14

28 May '14

commit 1e099c54089b1ed1aef556069c2546709acb5cdf Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 24 23:00:33 2014 -0700 Add Proxy configuration examples to torrc. --- meek-client/torrc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/meek-client/torrc b/meek-client/torrc index 62f2c72..6ed137b 100644 --- a/meek-client/torrc +++ b/meek-client/torrc @@ -1,4 +1,9 @@ UseBridges 1 + +# Socks4Proxy localhost:1080 +# Socks5Proxy localhost:1080 +# HTTPSProxy localhost:8080 + # Bridge meek 0.0.2.0:1 url=https://meek-reflect.appspot.com/ front=www.google.com # ClientTransportPlugin meek exec ./meek-client --log meek-client.log Bridge meek 0.0.2.0:1

1 0

[meek/master] Honor a socks4a proxy when roundtripping through the helper.
by dcf＠torproject.org 28 May '14

28 May '14

commit 79e3e5ff285d698636d0ad4b797d89a3f56749e8 Author: David Fifield <david(a)bamsoftware.com> Date: Sat May 24 23:39:23 2014 -0700 Honor a socks4a proxy when roundtripping through the helper. --- meek-client/helper.go | 7 ++++--- meek-client/helper_test.go | 8 ++++++++ meek-client/meek-client.go | 17 +++++++++++++---- meek-client/proxy_test.go | 1 + 4 files changed, 26 insertions(+), 7 deletions(-) diff --git a/meek-client/helper.go b/meek-client/helper.go index d85ac8d..d349ff7 100644 --- a/meek-client/helper.go +++ b/meek-client/helper.go @@ -58,9 +58,10 @@ func makeProxySpec(u *url.URL) (*ProxySpec, error) { return nil, errors.New("proxy URLs with a username or password can't be used with the helper") } - if u.Scheme == "http" { - spec.Type = "http" - } else { + switch u.Scheme { + case "http", "socks4a": + spec.Type = u.Scheme + default: return nil, errors.New("unknown scheme") } diff --git a/meek-client/helper_test.go b/meek-client/helper_test.go index 4a34e35..f33bb38 100644 --- a/meek-client/helper_test.go +++ b/meek-client/helper_test.go @@ -19,6 +19,10 @@ func TestMakeProxySpec(t *testing.T) { url.URL{Scheme: "http", User: url.UserPassword("username", "password"), Host: "localhost:8080"}, url.URL{Scheme: "http", Host: "localhost:-1"}, url.URL{Scheme: "http", Host: "localhost:65536"}, + url.URL{Scheme: "socks4a", Host: ":"}, + // "socks" and "socks4" are unknown types. + url.URL{Scheme: "socks", Host: "localhost:1080"}, + url.URL{Scheme: "socks4", Host: "localhost:1080"}, url.URL{Scheme: "unknown", Host: "localhost:9999"}, } goodTests := [...]struct { @@ -29,6 +33,10 @@ func TestMakeProxySpec(t *testing.T) { url.URL{Scheme: "http", Host: "localhost:8080"}, ProxySpec{"http", "localhost", 8080}, }, + { + url.URL{Scheme: "socks4a", Host: "localhost:1080"}, + ProxySpec{"socks4a", "localhost", 1080}, + }, } for _, input := range badTests { diff --git a/meek-client/meek-client.go b/meek-client/meek-client.go index 72e379f..b4f9dee 100644 --- a/meek-client/meek-client.go +++ b/meek-client/meek-client.go @@ -316,10 +316,19 @@ func acceptLoop(ln *pt.SocksListener) error { // Return an error if this proxy URL doesn't work with the rest of the // configuration. func checkProxyURL(u *url.URL) error { - if options.ProxyURL.Scheme != "http" { - return errors.New(fmt.Sprintf("don't understand proxy URL scheme %q", options.ProxyURL.Scheme)) - } - if options.HelperAddr != nil { + if options.HelperAddr == nil { + // Without the helper we only support HTTP proxies. + if options.ProxyURL.Scheme != "http" { + return errors.New(fmt.Sprintf("don't understand proxy URL scheme %q", options.ProxyURL.Scheme)) + } + } else { + // With the helper we can use HTTP and SOCKS (because it is the + // browser that does the proxying, not us). + switch options.ProxyURL.Scheme { + case "http", "socks4a": + default: + return errors.New(fmt.Sprintf("don't understand proxy URL scheme %q", options.ProxyURL.Scheme)) + } if options.ProxyURL.User != nil { return errors.New("a proxy URL with a username or password can't be used with --helper") } diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go index 9565101..7ce206f 100644 --- a/meek-client/proxy_test.go +++ b/meek-client/proxy_test.go @@ -36,6 +36,7 @@ func TestGetProxyURL(t *testing.T) { {"http://localhost:8080/path", "http://localhost:8080/path"}, {"http://user@localhost:8080", "http://user@localhost:8080"}, {"http://user:password@localhost:8080", "http://user:password@localhost:8080"}, + {"socks4a://localhost:1080", "socks4a://localhost:1080"}, {"unknown://localhost/whatever", "unknown://localhost/whatever"}, }

1 0

[meek/master] Add some commented test cases to think about.
by dcf＠torproject.org 28 May '14

28 May '14

commit 40007e4fa55f77e4657bbc8931f8d540c002057d Author: David Fifield <david(a)bamsoftware.com> Date: Sun May 25 11:18:33 2014 -0700 Add some commented test cases to think about. It may make sense for use to ensure that the proxy URL has a separable host name and port. On the other hand, that's one of the error conditions the application is going to have to check for anyway when it goes to connect to the proxy. --- meek-client/proxy_test.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go index d26362d..77123b9 100644 --- a/meek-client/proxy_test.go +++ b/meek-client/proxy_test.go @@ -40,6 +40,16 @@ func TestGetProxyURL(t *testing.T) { {"socks4a://localhost:1080", "socks4a://localhost:1080"}, {"unknown://localhost/whatever", "unknown://localhost/whatever"}, } + /* + No port: reject; or infer from scheme? + http://localhost + socks4a://localhost + socks5://localhost + Port without host: probably reject? + http://:8080 + socks4a://:1080 + socks5://:1080 + */ os.Clearenv() u, err := PtGetProxyURL()

1 0

[translation/https_everywhere_completed] Update translations for https_everywhere_completed
by translation＠torproject.org 28 May '14

28 May '14

commit 9eef11414d80a3ba25b372e47909baef5e01a82b Author: Translation commit bot <translation(a)torproject.org> Date: Wed May 28 06:15:20 2014 +0000 Update translations for https_everywhere_completed --- fi/ssl-observatory.dtd | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fi/ssl-observatory.dtd b/fi/ssl-observatory.dtd index 9270c4f..86bb49d 100644 --- a/fi/ssl-observatory.dtd +++ b/fi/ssl-observatory.dtd @@ -41,6 +41,12 @@ to turn it on?">--> <!ENTITY ssl-observatory.prefs.asn_tooltip "Tämä noutaa ja lähettää verkkosi autonomisen järjestelmän numerotunnuksen (ASN). Näin pystymme paikantamaan HTTPS:ään kohdistuvat hyökkäykset ja voimme selvittää, ovatko havainnot Iranin ja Syyrian kaltaisten alueiden verkoista, joissa hyökkäykset ovat yleisiä."> +<!ENTITY ssl-observatory.prefs.show_cert_warning +"Näytä varoitus, kun Observatorio havaitsee suljetun varmenteen jotka eivät kuulu selaimeesi."> + +<!ENTITY ssl-observatory.prefs.show_cert_warning_tooltip +"Tämä tarkistaa toimitetut varmenteet tiedettyjen varmenteiden listasta. Valitettavasti emme voi taata että merkitsemme kaikki suljetut varmenteet, mutta jos näet varoituksen on hyvä mahdollisuus että jotain on vialla."> + <!ENTITY ssl-observatory.prefs.done "Valmis"> <!ENTITY ssl-observatory.prefs.explanation @@ -78,7 +84,7 @@ Mouseover the options for further details:">--> <!ENTITY ssl-observatory.warning.showcert "Näytä palvelimen varmenneketju"> <!ENTITY ssl-observatory.warning.okay "Ymmärrän"> <!ENTITY ssl-observatory.warning.text "EFFin SSL Observatory on varoittanut tämän sivuston yhdestä tai useammasta HTTPS-varmenteesta:"> -<!ENTITY ssl-observatory.warning.defense "Jos olet kirjautunut sivustolle, voi olla suositeltavaa vaihtaa salasana, sitten kun käytössäsi on turvallinen yhteys."> +<!ENTITY ssl-observatory.warning.defense "Jos olet kirjautunut sivustolle, voi olla suositeltavaa vaihtaa salasana, kun sinulla on käytössä turvallinen yhteys. (Nämä varoitukset voidaan laittaa pois päältä ''SSL Observatoryssä'' klikkaa HTTPS Kaikkialla mieltymyksiä.)"> <!ENTITY ssl-observatory.prefs.self_signed "Lähetä ja tarkista sivuston itsensä allekirjoittama varmenne">

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 28 May '14

28 May '14

commit 285cee8155f0d40be5735688b657c8df113aaa3d Author: Translation commit bot <translation(a)torproject.org> Date: Wed May 28 06:15:16 2014 +0000 Update translations for https_everywhere --- fi/ssl-observatory.dtd | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fi/ssl-observatory.dtd b/fi/ssl-observatory.dtd index 48a2857..86bb49d 100644 --- a/fi/ssl-observatory.dtd +++ b/fi/ssl-observatory.dtd @@ -42,10 +42,10 @@ to turn it on?">--> "Tämä noutaa ja lähettää verkkosi autonomisen järjestelmän numerotunnuksen (ASN). Näin pystymme paikantamaan HTTPS:ään kohdistuvat hyökkäykset ja voimme selvittää, ovatko havainnot Iranin ja Syyrian kaltaisten alueiden verkoista, joissa hyökkäykset ovat yleisiä."> <!ENTITY ssl-observatory.prefs.show_cert_warning -"Show a warning when the Observatory detects a revoked certificate not caught by your browser"> +"Näytä varoitus, kun Observatorio havaitsee suljetun varmenteen jotka eivät kuulu selaimeesi."> <!ENTITY ssl-observatory.prefs.show_cert_warning_tooltip -"This will check submitted certificates against known Certificate Revocation Lists. Unfortunately we cannot guarantee that we will flag every revoked certificate, but if you do see a warning there's a good chance something is wrong."> +"Tämä tarkistaa toimitetut varmenteet tiedettyjen varmenteiden listasta. Valitettavasti emme voi taata että merkitsemme kaikki suljetut varmenteet, mutta jos näet varoituksen on hyvä mahdollisuus että jotain on vialla."> <!ENTITY ssl-observatory.prefs.done "Valmis"> @@ -84,7 +84,7 @@ Mouseover the options for further details:">--> <!ENTITY ssl-observatory.warning.showcert "Näytä palvelimen varmenneketju"> <!ENTITY ssl-observatory.warning.okay "Ymmärrän"> <!ENTITY ssl-observatory.warning.text "EFFin SSL Observatory on varoittanut tämän sivuston yhdestä tai useammasta HTTPS-varmenteesta:"> -<!ENTITY ssl-observatory.warning.defense "If you are logged in to this site, it may be advisable to change your password once you have a safe connection. (These warnings can be disabled in the "SSL Observatory" tab of the HTTPS Everywhere preferences dialog.)"> +<!ENTITY ssl-observatory.warning.defense "Jos olet kirjautunut sivustolle, voi olla suositeltavaa vaihtaa salasana, kun sinulla on käytössä turvallinen yhteys. (Nämä varoitukset voidaan laittaa pois päältä ''SSL Observatoryssä'' klikkaa HTTPS Kaikkialla mieltymyksiä.)"> <!ENTITY ssl-observatory.prefs.self_signed "Lähetä ja tarkista sivuston itsensä allekirjoittama varmenne">

1 0

[tor/master] sandbox: permit listen(2)
by nickm＠torproject.org 27 May '14

27 May '14

commit a056ffabbbdc76598830331c6550740a24fadeb8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 27 19:28:12 2014 -0400 sandbox: permit listen(2) Fix for 12115; bugfix on 0.2.5.1-alpha --- changes/bug12115 | 3 +++ src/common/sandbox.c | 1 + 2 files changed, 4 insertions(+) diff --git a/changes/bug12115 b/changes/bug12115 new file mode 100644 index 0000000..7b84649 --- /dev/null +++ b/changes/bug12115 @@ -0,0 +1,3 @@ + o Minor bugfixes (linux seccomp sandbox): + - Avoid crashing when re-opening listener ports with the seccomp + sandbox active. Fixes bug 12115; bugfix on 0.2.5.1-alpha. diff --git a/src/common/sandbox.c b/src/common/sandbox.c index 7586c0c..ba1956b 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -186,6 +186,7 @@ static int filter_nopar_gen[] = { // socket syscalls SCMP_SYS(bind), + SCMP_SYS(listen), SCMP_SYS(connect), SCMP_SYS(getsockname), SCMP_SYS(recvmsg),

1 0

[tor/master] sandbox: Allow DirPortFrontPage unconditionally if it's set
by nickm＠torproject.org 27 May '14

27 May '14

commit 14842de9a731b6bbb348583645a31a3f3ab68af8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 27 19:21:11 2014 -0400 sandbox: Allow DirPortFrontPage unconditionally if it's set fixes 12114; bug not in any release. Improves fix for 12028 --- src/or/main.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/or/main.c b/src/or/main.c index 8b79c42..a3be9a2 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -2870,6 +2870,11 @@ sandbox_init_filter(void) } } + if (options->DirPortFrontPage) { + sandbox_cfg_allow_open_filename(&cfg, + tor_strdup(options->DirPortFrontPage)); + } + // orport if (server_mode(get_options())) { sandbox_cfg_allow_open_filename_array(&cfg, @@ -2905,11 +2910,6 @@ sandbox_init_filter(void) NULL, 0 ); - if (options->DirPortFrontPage) { - sandbox_cfg_allow_open_filename(&cfg, - tor_strdup(options->DirPortFrontPage)); - } - RENAME_SUFFIX("fingerprint", ".tmp"); RENAME_SUFFIX2("keys", "secret_onion_key_ntor", ".tmp"); RENAME_SUFFIX2("keys", "secret_id_key", ".tmp");

1 0

[ooni-probe/master] Implementation of the v0.3 spec
by art＠torproject.org 27 May '14

27 May '14

commit c81de40d7d2f8ebf82e63607af5b50112a40a368 Author: kudrom <kudrom(a)riseup.net> Date: Sat May 17 20:13:00 2014 +0200 Implementation of the v0.3 spec --- ooni/nettests/manipulation/captiveportal.py | 42 +++++++++++++++++++-------- 1 file changed, 30 insertions(+), 12 deletions(-) diff --git a/ooni/nettests/manipulation/captiveportal.py b/ooni/nettests/manipulation/captiveportal.py index 35bfa75..eb28104 100644 --- a/ooni/nettests/manipulation/captiveportal.py +++ b/ooni/nettests/manipulation/captiveportal.py @@ -64,7 +64,7 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): name = "captiveportal" description = "Captive Portal Test" - version = '0.2' + version = '0.3' author = "Isis Lovecruft" usageOptions = UsageOptions requiresRoot = False @@ -265,11 +265,11 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): hostname = self.hostname_to_0x20(hostname) for auth_ns in resolved_auth_ns: + querynames.append(hostname) try: answer = yield self.performSOALookup(hostname, (auth_ns, 53)) except Exception: continue - querynames.append(hostname) for soa in answer: answernames.append(soa[0]) serials.append(str(soa[1])) @@ -291,17 +291,22 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): log.msg("Some SOA serial numbers did not match the rest!") serial_match = False - ret = name_match, serial_match, querynames, answernames, serials - if name_match and serial_match: log.msg("Your DNS queries do not appear to be tampered.") - defer.returnValue(ret) elif name_match or serial_match: log.msg("Something is tampering with your DNS queries.") - defer.returnValue(ret) elif not name_match and not serial_match: log.msg("Your DNS queries are definitely being tampered with.") - defer.returnValue(ret) + + ret = { + 'result': name_match and serial_match, + 'name_match': name_match, + 'serial_match': serial_match, + 'querynames': querynames, + 'answernames': answernames, + 'SOA_serials': serials + } + defer.returnValue(ret) def get_random_url_safe_string(self, length): """ @@ -422,16 +427,20 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): log.msg("Running the Google Chrome DNS-based captive portal test...") gmatch, google_dns_result = yield self.compare_random_hostnames(3, 10) + ret = { + 'result': gmatch, + 'addresses': google_dns_result + } if gmatch: log.msg("Google Chrome DNS-based captive portal test did not") log.msg("detect a captive portal.") - defer.returnValue(google_dns_result) + defer.returnValue(ret) else: log.msg("Google Chrome DNS-based captive portal test believes") log.msg("you are in a captive portal, or else something very") log.msg("odd is happening with your DNS.") - defer.returnValue(google_dns_result) + defer.returnValue(ret) @defer.inlineCallbacks def ms_dns_cp_test(self): @@ -447,6 +456,10 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): msmatch, ms_dns_result = yield self.dns_resolve_match("dns.msftncsi.com", "131.107.255.255") + ret = { + 'result': msmatch, + 'address': ms_dns_result + } if msmatch: log.msg("Microsoft NCSI DNS-based captive portal test did not") log.msg("detect a captive portal.") @@ -517,10 +530,9 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): log.msg("is filtered.") defer.returnValue(False) - result = [] + result = {} for vt in vendor_tests: report = {} - report['vt'] = vt experiment_url = vt[0] control_result = vt[1] @@ -541,7 +553,13 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): else: log.err("Ooni is trying to run an undefined CP vendor test.") - result.append(report) + + report['URL'] = experiment_url + report['http_status_summary'] = control_result + report['http_status_number'] = control_code + report['User_Agent'] = vt[3] + result[test_name] = report + defer.returnValue(result) @defer.inlineCallbacks

1 0