May 2014 - tor-commits - lists.torproject.org

[ooni-probe/master] Implementation of the v0.3 spec
by art＠torproject.org 27 May '14

27 May '14

commit c81de40d7d2f8ebf82e63607af5b50112a40a368 Author: kudrom <kudrom(a)riseup.net> Date: Sat May 17 20:13:00 2014 +0200 Implementation of the v0.3 spec --- ooni/nettests/manipulation/captiveportal.py | 42 +++++++++++++++++++-------- 1 file changed, 30 insertions(+), 12 deletions(-) diff --git a/ooni/nettests/manipulation/captiveportal.py b/ooni/nettests/manipulation/captiveportal.py index 35bfa75..eb28104 100644 --- a/ooni/nettests/manipulation/captiveportal.py +++ b/ooni/nettests/manipulation/captiveportal.py @@ -64,7 +64,7 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): name = "captiveportal" description = "Captive Portal Test" - version = '0.2' + version = '0.3' author = "Isis Lovecruft" usageOptions = UsageOptions requiresRoot = False @@ -265,11 +265,11 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): hostname = self.hostname_to_0x20(hostname) for auth_ns in resolved_auth_ns: + querynames.append(hostname) try: answer = yield self.performSOALookup(hostname, (auth_ns, 53)) except Exception: continue - querynames.append(hostname) for soa in answer: answernames.append(soa[0]) serials.append(str(soa[1])) @@ -291,17 +291,22 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): log.msg("Some SOA serial numbers did not match the rest!") serial_match = False - ret = name_match, serial_match, querynames, answernames, serials - if name_match and serial_match: log.msg("Your DNS queries do not appear to be tampered.") - defer.returnValue(ret) elif name_match or serial_match: log.msg("Something is tampering with your DNS queries.") - defer.returnValue(ret) elif not name_match and not serial_match: log.msg("Your DNS queries are definitely being tampered with.") - defer.returnValue(ret) + + ret = { + 'result': name_match and serial_match, + 'name_match': name_match, + 'serial_match': serial_match, + 'querynames': querynames, + 'answernames': answernames, + 'SOA_serials': serials + } + defer.returnValue(ret) def get_random_url_safe_string(self, length): """ @@ -422,16 +427,20 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): log.msg("Running the Google Chrome DNS-based captive portal test...") gmatch, google_dns_result = yield self.compare_random_hostnames(3, 10) + ret = { + 'result': gmatch, + 'addresses': google_dns_result + } if gmatch: log.msg("Google Chrome DNS-based captive portal test did not") log.msg("detect a captive portal.") - defer.returnValue(google_dns_result) + defer.returnValue(ret) else: log.msg("Google Chrome DNS-based captive portal test believes") log.msg("you are in a captive portal, or else something very") log.msg("odd is happening with your DNS.") - defer.returnValue(google_dns_result) + defer.returnValue(ret) @defer.inlineCallbacks def ms_dns_cp_test(self): @@ -447,6 +456,10 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): msmatch, ms_dns_result = yield self.dns_resolve_match("dns.msftncsi.com", "131.107.255.255") + ret = { + 'result': msmatch, + 'address': ms_dns_result + } if msmatch: log.msg("Microsoft NCSI DNS-based captive portal test did not") log.msg("detect a captive portal.") @@ -517,10 +530,9 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): log.msg("is filtered.") defer.returnValue(False) - result = [] + result = {} for vt in vendor_tests: report = {} - report['vt'] = vt experiment_url = vt[0] control_result = vt[1] @@ -541,7 +553,13 @@ class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): else: log.err("Ooni is trying to run an undefined CP vendor test.") - result.append(report) + + report['URL'] = experiment_url + report['http_status_summary'] = control_result + report['http_status_number'] = control_code + report['User_Agent'] = vt[3] + result[test_name] = report + defer.returnValue(result) @defer.inlineCallbacks

1 0

[ooni-probe/master] Merge pull request #326 from kudrom/spec_v0.3
by art＠torproject.org 27 May '14

27 May '14

commit da6ac0f0f048102aa6160e0bccb69aa567f2dabf Merge: 6c3086b c81de40 Author: Arturo Filastò <hellais(a)users.noreply.github.com> Date: Mon May 26 18:48:17 2014 +0200 Merge pull request #326 from kudrom/spec_v0.3 Implementation of the v0.3 spec for the captive portal test ooni/nettests/manipulation/captiveportal.py | 42 +++++++++++++++++++-------- 1 file changed, 30 insertions(+), 12 deletions(-)

1 0

[ooni-probe/master] Merge branch 'master' of github.com:TheTorProject/ooni-probe
by art＠torproject.org 27 May '14

27 May '14

commit 2764cc2bca9fc60f978b3361ab2e8de372bc5af6 Merge: 852d8e5 da6ac0f Author: Arturo Filastò <art(a)fuffa.org> Date: Wed May 28 00:10:46 2014 +0200 Merge branch 'master' of github.com:TheTorProject/ooni-probe * 'master' of github.com:TheTorProject/ooni-probe: Implementation of the v0.3 spec ooni/nettests/manipulation/captiveportal.py | 42 +++++++++++++++++++-------- 1 file changed, 30 insertions(+), 12 deletions(-)

1 0

[ooni-probe/master] dns_consistency.py: typos
by art＠torproject.org 27 May '14

27 May '14

commit 6eb1607b51a6d2e18620065361af3cbc5d1d0a21 Author: Simone Basso <bassosimone(a)gmail.com> Date: Wed May 28 00:09:00 2014 +0200 dns_consistency.py: typos --- ooni/nettests/blocking/dns_consistency.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ooni/nettests/blocking/dns_consistency.py b/ooni/nettests/blocking/dns_consistency.py index d6e048f..7959e99 100644 --- a/ooni/nettests/blocking/dns_consistency.py +++ b/ooni/nettests/blocking/dns_consistency.py @@ -94,14 +94,14 @@ class DNSConsistencyTest(dnst.DNSTest): tested and an A lookup on the known good DNS server. We then compare the results from test_resolvers and that from - control_resolver and see if the match up. + control_resolver and see if they match up. If they match up then no censorship is happening (tampering: false). If they do not we do a reverse lookup (PTR) on the test_resolvers and the control resolver for every IP address we got back and check to see if anyone of them matches the control ones. - If they do then we take not of the fact that censorship is probably not + If they do, then we take note of the fact that censorship is probably not happening (tampering: reverse-match). If they do not match then censorship is probably going on (tampering:

1 0

[ooni-probe/master] Merge pull request #1 from bassosimone/patch-1
by art＠torproject.org 27 May '14

27 May '14

commit 852d8e5e489797819cb5a2b4c5c4af6519035341 Merge: 6c3086b 6eb1607 Author: Arturo Filastò <hellais(a)users.noreply.github.com> Date: Wed May 28 00:09:33 2014 +0200 Merge pull request #1 from bassosimone/patch-1 dns_consistency.py: typos ooni/nettests/blocking/dns_consistency.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

[torspec/master] Revise prop 140 for dirspec 3 + other improvements
by nickm＠torproject.org 27 May '14

27 May '14

commit 5cabb13d5119164befa241b2fea861f64474fe7c Author: Daniel Martí <mvdan(a)mvdan.cc> Date: Tue May 27 23:31:57 2014 +0200 Revise prop 140 for dirspec 3 + other improvements Signed-off-by: Daniel Martí <mvdan(a)mvdan.cc> --- proposals/140-consensus-diffs.txt | 37 +++++++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 10 deletions(-) diff --git a/proposals/140-consensus-diffs.txt b/proposals/140-consensus-diffs.txt index f3fcb2b..aa71f79 100644 --- a/proposals/140-consensus-diffs.txt +++ b/proposals/140-consensus-diffs.txt @@ -9,6 +9,9 @@ Status: Accepted 22-May-2009: Restricted the ed format even more strictly for ease of implementation. -nickm + 25-May-2014: Adapted to the new dir-spec version 3 and made the diff urls + backwards-compatible. -mvdan + 1. Overview. Tor clients and servers need a list of which relays are on the @@ -19,6 +22,10 @@ Status: Accepted once they have a consensus instead of hourly downloading a full consensus. + This does not only apply to ordinary directory consensuses, but to the + newer microdescriptor consensuses added in the third version of the + directory specification. + 2. Numbers After implementing proposal 138 which removes nodes that are not @@ -77,12 +84,13 @@ Status: Accepted Directory authorities and servers need to keep up to X [XXX: depends on how long clients try to download diffs per above] old consensus documents so they can build diffs. They should offer a diff to the - most recent consensus at the URL + most recent consensus at the following request: - http://tor.noreply.org/tor/status-vote/current/consensus/diff/<HASH>/<FPRLIST> + HTTP/1.0 GET /tor/status-vote/current/consensus/<FPRLIST>.z + X-Or-Diff-From-Consensus: HASH1 HASH2... - where hash is the full digest of the consensus the client currently - has, and FPRLIST is a list of (abbreviated) fingerprints of + where the hashes are the full digests of the consensuses the client + currently has, and FPRLIST is a list of (abbreviated) fingerprints of authorities the client trusts. Servers will only return a consensus if more than half of the requested @@ -93,8 +101,14 @@ Status: Accepted conditional consensus downloads that Tor supports starting with 0.1.2.1-alpha.) - If a server cannot offer a diff from the consensus identified by the - hash but has a current consensus it MUST return the full consensus. + The advantage of using the same URL that is currently used for + consensuses is that the client doesn't need to know whether a server + supports consensus diffs. If it doesn't, it will simply ignore the + extra header and return the full consensus. + + If a server cannot offer a diff from one of the consensuses identified + by one of the hashes but has a current consensus it MUST return the + full consensus. [XXX: what should we do when the client already has the latest consensus? I can think of the following options: @@ -113,7 +127,12 @@ Status: Accepted to be a full consensus download and would therefore currently start with "network-status-version 3". - Following the network-status-diff header line is a diff, or patch, in + Following the network-status-diff line is another header line, starting with + the token "hash" followed by the full digest of the consensus that this diff + applies to and the full digest of the consensus that the resulting consensus + should have. + + Following the network-status-diff header lines is a diff, or patch, in limited ed format. We choose this format because it is easy to create and process with standard tools (patch, diff -e, ed). This will help us in developing and testing this proposal and it should make future @@ -132,7 +151,6 @@ Status: Accepted following block. - "<n1>a" Append the following block after line n1. - "a" Append the following block after the current line. - - "s/.//" Remove the first character in the current line. Note that line numbers always apply to the file after all previous commands have already been applied. @@ -151,5 +169,4 @@ Status: Accepted appended to the diff after the line with the command. A line with just a period (".") ends the block (and is not part of the lines to add). Note that it is impossible to insert a line with just - a single dot. Recommended procedure is to insert a line with - two dots, then remove the first character of that line using s/.//. + a single dot.

1 0

[tor/master] Make sandbox.c compile on arm
by nickm＠torproject.org 27 May '14

27 May '14

commit b0c1c700114aa8d4dfc180d85870c5bbe15fcacb Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 27 14:50:44 2014 -0400 Make sandbox.c compile on arm This is a minimal set of changes for compilation; I need a more recent kernel to test this stuff. --- changes/11622 | 3 +++ src/common/sandbox.c | 33 ++++++++++++++++++++++++++++++++- src/common/sandbox.h | 16 ---------------- 3 files changed, 35 insertions(+), 17 deletions(-) diff --git a/changes/11622 b/changes/11622 new file mode 100644 index 0000000..9e4be41 --- /dev/null +++ b/changes/11622 @@ -0,0 +1,3 @@ + o Minor bugfixes (linux seccomp sandbox) + - Make the seccomp sandbox code compile with ARM linux. Fixes bug + 11622; bugfix on 0.2.5.1-alpha. \ No newline at end of file diff --git a/src/common/sandbox.c b/src/common/sandbox.c index bb2b3ed..e34268c 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -67,6 +67,28 @@ #include <execinfo.h> #endif +/** + * Linux 32 bit definitions + */ +#if defined(__i386__) + +#define REG_SYSCALL REG_EAX +#define M_SYSCALL gregs[REG_SYSCALL] + +/** + * Linux 64 bit definitions + */ +#elif defined(__x86_64__) + +#define REG_SYSCALL REG_RAX +#define M_SYSCALL gregs[REG_SYSCALL] + +#elif defined(__arm__) + +#define M_SYSCALL arm_r7 + +#endif + /**Determines if at least one sandbox is active.*/ static int sandbox_active = 0; /** Holds the parameter list configuration for the sandbox.*/ @@ -113,7 +135,9 @@ static int filter_nopar_gen[] = { #ifdef __NR_getgid32 SCMP_SYS(getgid32), #endif +#ifdef __NR_getrlimt SCMP_SYS(getrlimit), +#endif SCMP_SYS(gettimeofday), SCMP_SYS(gettid), SCMP_SYS(getuid), @@ -126,7 +150,10 @@ static int filter_nopar_gen[] = { #endif SCMP_SYS(mkdir), SCMP_SYS(mlockall), +#ifdef __NR_mmap + /* XXXX restrict this in the same ways as mmap2 */ SCMP_SYS(mmap), +#endif SCMP_SYS(munmap), SCMP_SYS(read), SCMP_SYS(rt_sigreturn), @@ -245,8 +272,12 @@ static int sb_time(scmp_filter_ctx ctx, sandbox_cfg_t *filter) { (void) filter; +#ifdef __NR_time return seccomp_rule_add_1(ctx, SCMP_ACT_ALLOW, SCMP_SYS(time), SCMP_CMP(0, SCMP_CMP_EQ, 0)); +#else + return 0; +#endif } /** @@ -1499,7 +1530,7 @@ sigsys_debugging(int nr, siginfo_t *info, void *void_context) if (!ctx) return; - syscall = (int) ctx->uc_mcontext.gregs[REG_SYSCALL]; + syscall = (int) ctx->uc_mcontext.M_SYSCALL; #ifdef USE_BACKTRACE depth = backtrace(syscall_cb_buf, MAX_DEPTH); diff --git a/src/common/sandbox.h b/src/common/sandbox.h index b572152..c3c6766 100644 --- a/src/common/sandbox.h +++ b/src/common/sandbox.h @@ -119,22 +119,6 @@ typedef struct { sandbox_cfg_t *filter_dynamic; } sandbox_t; -/** - * Linux 32 bit definitions - */ -#if defined(__i386__) - -#define REG_SYSCALL REG_EAX - -/** - * Linux 64 bit definitions - */ -#elif defined(__x86_64__) - -#define REG_SYSCALL REG_RAX - -#endif - #endif // USE_LIBSECCOMP #ifdef USE_LIBSECCOMP

1 0

[tor/master] Log the errno value if seccomp_load() fails.
by nickm＠torproject.org 27 May '14

27 May '14

commit f0945ac270d08da146b415513fc68c7782f071be Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 27 15:08:10 2014 -0400 Log the errno value if seccomp_load() fails. (This is how I found out I was trying to test with a kernel too old for seccomp. I think.) --- src/common/sandbox.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/common/sandbox.c b/src/common/sandbox.c index e34268c..7586c0c 100644 --- a/src/common/sandbox.c +++ b/src/common/sandbox.c @@ -1470,7 +1470,8 @@ install_syscall_filter(sandbox_cfg_t* cfg) // loading the seccomp2 filter if ((rc = seccomp_load(ctx))) { - log_err(LD_BUG, "(Sandbox) failed to load!"); + log_err(LD_BUG, "(Sandbox) failed to load: %d (%s)!", rc, + strerror(-rc)); goto end; }

1 0

[tor/master] Merge branch 'bug11622'
by nickm＠torproject.org 27 May '14

27 May '14

commit ba9946dda702162f2fc7c35d79825604433eb0a9 Merge: 824bebd f0945ac Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 27 17:35:04 2014 -0400 Merge branch 'bug11622' changes/11622 | 3 +++ src/common/sandbox.c | 36 ++++++++++++++++++++++++++++++++++-- src/common/sandbox.h | 16 ---------------- 3 files changed, 37 insertions(+), 18 deletions(-)

1 0

[translation/torcheck_completed] Update translations for torcheck_completed
by translation＠torproject.org 27 May '14

27 May '14

commit 26bbebbb95ec3ffa10b111cc04aa9e4da3a83b6b Author: Translation commit bot <translation(a)torproject.org> Date: Tue May 27 21:15:13 2014 +0000 Update translations for torcheck_completed --- es/torcheck.po | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/es/torcheck.po b/es/torcheck.po index 9ea6583..1f2388b 100644 --- a/es/torcheck.po +++ b/es/torcheck.po @@ -6,6 +6,7 @@ # her_tor_es_ar <cvmay08(a)gmail.com>, 2014 # cronayu <itacronayu(a)hotmail.com>, 2012 # Envite <envite(a)rolamasao.org>, 2013 +# Paidos <omar_garcia_sierra(a)hotmail.com>, 2014 # Shyish <jgongarrido(a)hotmail.com>, 2011 # strel, 2013-2014 # strel, 2012 @@ -15,8 +16,8 @@ msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "POT-Creation-Date: 2012-02-16 20:28+PDT\n" -"PO-Revision-Date: 2014-05-23 11:11+0000\n" -"Last-Translator: alexiulacio <alexi.ulacio(a)gmail.com>\n" +"PO-Revision-Date: 2014-05-27 21:11+0000\n" +"Last-Translator: Paidos <omar_garcia_sierra(a)hotmail.com>\n" "Language-Team: Spanish (http://www.transifex.com/projects/p/torproject/language/es/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -40,7 +41,7 @@ msgstr "Hay una actualización de seguridad disponible para el Paquete de Navega msgid "" "<a href=\"https://www.torproject.org/download/download-easy.html\">Click " "here to go to the download page</a>" -msgstr "<a href=\"https://www.torproject.org/download/download-easy.html\">Pulse aquí para ir a la página de descarga</a>" +msgstr "<a href=\"https://www.torproject.org/download/download-easy.html\">Click here to go to the download page</a>" msgid "Sorry. You are not using Tor." msgstr "Lo sentimos, no está usando Tor."

1 0