May 2014 - tor-commits - lists.torproject.org

[tor/release-0.2.4] match the changelog entries from 0.2.5.x when possible
by arma＠torproject.org 14 May '14

14 May '14

commit a7d700aa04f2869bc0271f3ed9677d36093810be Author: Roger Dingledine <arma(a)torproject.org> Date: Wed May 14 16:04:16 2014 -0400 match the changelog entries from 0.2.5.x when possible --- ChangeLog | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index 5dddae2..96cb28c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -46,7 +46,7 @@ Changes in version 0.2.4.22 - 2014-05-1? bugfix on 0.2.1.1-alpha. o Minor bugfixes (controller, backport from 0.2.5.4-alpha): - - Avoid sending an garbage value to the controller when a circuit is + - Avoid sending a garbage value to the controller when a circuit is cannibalized. Fixes bug 11519; bugfix on 0.2.3.11-alpha. o Minor bugfixes (exit relay, backport from 0.2.5.4-alpha): @@ -85,8 +85,8 @@ Changes in version 0.2.4.22 - 2014-05-1? o Documentation (backport from 0.2.5.4-alpha): - Correctly document that we search for a system torrc file before - looking in ~/.torrc. Fixes documentation side of 9213; bugfix - on 0.2.3.18-rc. + looking in ~/.torrc. Fixes documentation side of 9213; bugfix on + 0.2.3.18-rc. Changes in version 0.2.4.21 - 2014-02-28

1 0

[tor/release-0.2.4] group the sections
by arma＠torproject.org 14 May '14

14 May '14

commit 9aba2117e2a6894a6bfac62b4cbc57786b7a83db Author: Roger Dingledine <arma(a)torproject.org> Date: Wed May 14 15:55:52 2014 -0400 group the sections --- ChangeLog | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/ChangeLog b/ChangeLog index 4e5bfa6..5dddae2 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,18 +6,18 @@ Changes in version 0.2.4.22 - 2014-05-1? a couple of memory leaks that could be used to run a target relay out of RAM, and several others. - o Major bugfixes (security, OOM): - - Fix a memory leak that could occur if a microdescriptor parse - fails during the tokenizing step. This bug could enable a memory - exhaustion attack by directory servers. Fixes bug 11649; bugfix - on 0.2.2.6-alpha. - o Major features (security, backport from 0.2.5.4-alpha): - Block authority signing keys that were used on authorities vulnerable to the "heartbleed" bug in OpenSSL (CVE-2014-0160). (We don't have any evidence that these keys _were_ compromised; we're doing this to be prudent.) Resolves ticket 11464. + o Major bugfixes (security, OOM): + - Fix a memory leak that could occur if a microdescriptor parse + fails during the tokenizing step. This bug could enable a memory + exhaustion attack by directory servers. Fixes bug 11649; bugfix + on 0.2.2.6-alpha. + o Major bugfixes (TLS cipher selection, backport from 0.2.5.4-alpha): - The relay ciphersuite list is now generated automatically based on uniform criteria, and includes all OpenSSL ciphersuites with @@ -53,16 +53,6 @@ Changes in version 0.2.4.22 - 2014-05-1? - Stop leaking memory when we successfully resolve a PTR record. Fixes bug 11437; bugfix on 0.2.4.7-alpha. - o Minor features (log verbosity, backport from 0.2.5.4-alpha): - - When we run out of usable circuit IDs on a channel, log only one - warning for the whole channel, and describe how many circuits - there were on the channel. Fixes part of ticket 11553. - - o Documentation (backport from 0.2.5.4-alpha): - - Correctly document that we search for a system torrc file before - looking in ~/.torrc. Fixes documentation side of 9213; bugfix - on 0.2.3.18-rc. - o Minor bugfixes (bridge client, backport from 0.2.5.4-alpha): - Avoid 60-second delays in the bootstrapping process when Tor is launching for a second time while using bridges. Fixes bug 9229; @@ -72,11 +62,6 @@ Changes in version 0.2.4.22 - 2014-05-1? - Give the correct URL in the warning message when trying to run a relay on an ancient version of Windows. Fixes bug 9393. - o Minor features (security, backport from 0.2.5.4-alpha): - - Decrease the lower limit of MaxMemInCellQueues to 256 MBytes (but - leave the default at 8GBytes), to better support Raspberry Pi - users. Fixes bug 9686; bugfix on 0.2.4.14-alpha. - o Minor bugfixes (compilation): - Fix a compilation error when compiling with --disable-curve25519. Fixes bug 9700; bugfix on 0.2.4.17-rc. @@ -88,6 +73,21 @@ Changes in version 0.2.4.22 - 2014-05-1? earlier versions of tor achieves nothing useful. Addresses warning from bug 7164. + o Minor features (log verbosity, backport from 0.2.5.4-alpha): + - When we run out of usable circuit IDs on a channel, log only one + warning for the whole channel, and describe how many circuits + there were on the channel. Fixes part of ticket 11553. + + o Minor features (security, backport from 0.2.5.4-alpha): + - Decrease the lower limit of MaxMemInCellQueues to 256 MBytes (but + leave the default at 8GBytes), to better support Raspberry Pi + users. Fixes bug 9686; bugfix on 0.2.4.14-alpha. + + o Documentation (backport from 0.2.5.4-alpha): + - Correctly document that we search for a system torrc file before + looking in ~/.torrc. Fixes documentation side of 9213; bugfix + on 0.2.3.18-rc. + Changes in version 0.2.4.21 - 2014-02-28 Tor 0.2.4.21 further improves security against potential adversaries who

1 0

[tor/release-0.2.4] two small fixes, and downgrade a severity
by arma＠torproject.org 14 May '14

14 May '14

commit ca085ba3413ee133618550598e5087a8504f9a36 Author: Roger Dingledine <arma(a)torproject.org> Date: Wed May 14 15:48:57 2014 -0400 two small fixes, and downgrade a severity --- ChangeLog | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/ChangeLog b/ChangeLog index b7831bc..4e5bfa6 100644 --- a/ChangeLog +++ b/ChangeLog @@ -9,16 +9,9 @@ Changes in version 0.2.4.22 - 2014-05-1? o Major bugfixes (security, OOM): - Fix a memory leak that could occur if a microdescriptor parse fails during the tokenizing step. This bug could enable a memory - exhaustion attack by directory servers. Fixes bug #11649; bugfix + exhaustion attack by directory servers. Fixes bug 11649; bugfix on 0.2.2.6-alpha. - o Major bugfixes (configuration, security): - - When running a hidden service, do not allow TunneledDirConns 0: - trying to set that option together with a hidden service would - otherwise prevent the hidden service from running, and also make - it publish its descriptors directly over HTTP. Fixes bug 10849; - bugfix on 0.2.1.1-alpha. - o Major features (security, backport from 0.2.5.4-alpha): - Block authority signing keys that were used on authorities vulnerable to the "heartbleed" bug in OpenSSL (CVE-2014-0160). (We @@ -45,6 +38,13 @@ Changes in version 0.2.4.22 - 2014-05-1? advertising the ECDH (not to be confused with ECDHE) ciphersuites. Resolves ticket 11438. + o Minor bugfixes (configuration, security): + - When running a hidden service, do not allow TunneledDirConns 0: + trying to set that option together with a hidden service would + otherwise prevent the hidden service from running, and also make + it publish its descriptors directly over HTTP. Fixes bug 10849; + bugfix on 0.2.1.1-alpha. + o Minor bugfixes (controller, backport from 0.2.5.4-alpha): - Avoid sending an garbage value to the controller when a circuit is cannibalized. Fixes bug 11519; bugfix on 0.2.3.11-alpha. @@ -78,7 +78,7 @@ Changes in version 0.2.4.22 - 2014-05-1? users. Fixes bug 9686; bugfix on 0.2.4.14-alpha. o Minor bugfixes (compilation): - - Fix a compilation error when compiling with --disable-cuve25519. + - Fix a compilation error when compiling with --disable-curve25519. Fixes bug 9700; bugfix on 0.2.4.17-rc. o Minor bugfixes:

1 0

[translation/torbutton-brandproperties_completed] Update translations for torbutton-brandproperties_completed
by translation＠torproject.org 14 May '14

14 May '14

commit 63c9d784a476dfe3196dcb2c1c0d3f9bd54eae5f Author: Translation commit bot <translation(a)torproject.org> Date: Wed May 14 19:45:40 2014 +0000 Update translations for torbutton-brandproperties_completed --- pt_BR/brand.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pt_BR/brand.properties b/pt_BR/brand.properties index 565953a..4a2fa36 100644 --- a/pt_BR/brand.properties +++ b/pt_BR/brand.properties @@ -6,7 +6,7 @@ brandShortName=NavegadorTor brandFullName=Navegador Tor vendorShortName=Projeto Tor -homePageSingleStartMain=Iniciar o Firefox, uma página inicial rápida com pesquisa embutida +homePageSingleStartMain=Firefox Start, uma página inicial rápida com pesquisa embutida homePageImport=Importar sua página inicial de %S homePageMigrationPageTitle=Seleção da Página Inicial

1 0

[translation/torbutton-brandproperties] Update translations for torbutton-brandproperties
by translation＠torproject.org 14 May '14

14 May '14

commit 81a5647d0390abbee64a14c38b34c621d58817a1 Author: Translation commit bot <translation(a)torproject.org> Date: Wed May 14 19:45:37 2014 +0000 Update translations for torbutton-brandproperties --- pt_BR/brand.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pt_BR/brand.properties b/pt_BR/brand.properties index 565953a..4a2fa36 100644 --- a/pt_BR/brand.properties +++ b/pt_BR/brand.properties @@ -6,7 +6,7 @@ brandShortName=NavegadorTor brandFullName=Navegador Tor vendorShortName=Projeto Tor -homePageSingleStartMain=Iniciar o Firefox, uma página inicial rápida com pesquisa embutida +homePageSingleStartMain=Firefox Start, uma página inicial rápida com pesquisa embutida homePageImport=Importar sua página inicial de %S homePageMigrationPageTitle=Seleção da Página Inicial

1 0

[tor/master] make the changelog text wrapper respect arma's no-initial-openparen rule
by nickm＠torproject.org 14 May '14

14 May '14

commit 747f368c6d72cc6a68bb0a12c4209c534517b656 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 14 12:56:09 2014 -0400 make the changelog text wrapper respect arma's no-initial-openparen rule --- scripts/maint/format_changelog.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/scripts/maint/format_changelog.py b/scripts/maint/format_changelog.py index 35044b3..ac96a7e 100755 --- a/scripts/maint/format_changelog.py +++ b/scripts/maint/format_changelog.py @@ -23,6 +23,8 @@ import sys # 100 * the fourth power of overflowed characters # PLUS # .1 * a bit more than the cube of ragged space on the last line. +# PLUS +# OPENPAREN_PENALTY for each line that starts with ( # # We use an obvious dynamic programming algorithm to sorta approximate this. # It's not coded right or optimally, but it's fast enough for changelogs @@ -44,6 +46,8 @@ OVERFLOW_PENALTY = 2000 ORPHAN_PENALTY = 10000 +OPENPAREN_PENALTY = 200 + def generate_wrapping(words, divisions): lines = [] last = 0 @@ -65,6 +69,9 @@ def wrapping_quality(words, divisions, width1, width2): else: width = width2 + if line[0:1] == '(': + total += OPENPAREN_PENALTY + if length > width: total += OVERFLOW_PENALTY * ( (length - width) ** OVERFLOW_EXPONENT )

1 0

[tor/release-0.2.4] Bump release-0.2.4 version to 0.2.4.22
by nickm＠torproject.org 14 May '14

14 May '14

commit 0fed6ad45b5b41be354df70dee742e0a3e8357ed Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 14 11:14:25 2014 -0400 Bump release-0.2.4 version to 0.2.4.22 This is not officially released yet; it needs some QA first. --- configure.ac | 2 +- contrib/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index c514eb4..3e57bed 100644 --- a/configure.ac +++ b/configure.ac @@ -3,7 +3,7 @@ dnl Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson dnl Copyright (c) 2007-2013, The Tor Project, Inc. dnl See LICENSE for licensing information -AC_INIT([tor],[0.2.4.21]) +AC_INIT([tor],[0.2.4.22]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE diff --git a/contrib/tor-mingw.nsi.in b/contrib/tor-mingw.nsi.in index 3d4d4b3..a213211 100644 --- a/contrib/tor-mingw.nsi.in +++ b/contrib/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.4.21" +!define VERSION "0.2.4.22" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index ac355a7..fe7491f 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -241,7 +241,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.4.21" +#define VERSION "0.2.4.22"

1 0

[tor/release-0.2.4] Reflow, slightly tidy Changelog
by nickm＠torproject.org 14 May '14

14 May '14

commit 1b37d8bef08b6288d3b07616942fb7fc56557a0a Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed May 14 10:02:55 2014 -0400 Reflow, slightly tidy Changelog --- ChangeLog | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/ChangeLog b/ChangeLog index c8cdfc1..b7831bc 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,11 +1,12 @@ Changes in version 0.2.4.22 - 2014-05-1? Tor 0.2.4.22 backports numerous high-priority fixes from the Tor 0.2.5 - alpha release series. These include blocking all authority signing keys - that may have been affected by the OpenSSL "heartbleed" bug, choosing - a far more secure set of TLS ciphersuites by default, closing a couple of - memory leaks that could be used to run a target relay out of RAM, and + alpha release series. These include blocking all authority signing + keys that may have been affected by the OpenSSL "heartbleed" bug, + choosing a far more secure set of TLS ciphersuites by default, closing + a couple of memory leaks that could be used to run a target relay out + of RAM, and several others. - o Major bugfixes (security, OOM) + o Major bugfixes (security, OOM): - Fix a memory leak that could occur if a microdescriptor parse fails during the tokenizing step. This bug could enable a memory exhaustion attack by directory servers. Fixes bug #11649; bugfix @@ -14,8 +15,8 @@ Changes in version 0.2.4.22 - 2014-05-1? o Major bugfixes (configuration, security): - When running a hidden service, do not allow TunneledDirConns 0: trying to set that option together with a hidden service would - otherwise prevent the hidden service from running, and also - make it publish its descriptors directly over HTTP. Fixes bug 10849; + otherwise prevent the hidden service from running, and also make + it publish its descriptors directly over HTTP. Fixes bug 10849; bugfix on 0.2.1.1-alpha. o Major features (security, backport from 0.2.5.4-alpha): @@ -59,8 +60,8 @@ Changes in version 0.2.4.22 - 2014-05-1? o Documentation (backport from 0.2.5.4-alpha): - Correctly document that we search for a system torrc file before - looking in ~/.torrc. Fixes documentation side of 9213; bugfix on - 0.2.3.18-rc. + looking in ~/.torrc. Fixes documentation side of 9213; bugfix + on 0.2.3.18-rc. o Minor bugfixes (bridge client, backport from 0.2.5.4-alpha): - Avoid 60-second delays in the bootstrapping process when Tor is @@ -72,19 +73,20 @@ Changes in version 0.2.4.22 - 2014-05-1? relay on an ancient version of Windows. Fixes bug 9393. o Minor features (security, backport from 0.2.5.4-alpha): - - Decrease the lower limit of MaxMemInCellQueues to 256 MBytes (but leave - the default at 8GBytes), to better support Raspberry Pi users. Fixes - bug 9686; bugfix on 0.2.4.14-alpha. + - Decrease the lower limit of MaxMemInCellQueues to 256 MBytes (but + leave the default at 8GBytes), to better support Raspberry Pi + users. Fixes bug 9686; bugfix on 0.2.4.14-alpha. o Minor bugfixes (compilation): - Fix a compilation error when compiling with --disable-cuve25519. Fixes bug 9700; bugfix on 0.2.4.17-rc. o Minor bugfixes: - - Downgrade the warning severity for the the "md was still referenced 1 - node(s)" warning. Tor 0.2.5.4-alpha has better code for trying to - diagnose this bug, and the current warning in earlier versions of - tor achieves nothing useful. Addresses warning from bug 7164. + - Downgrade the warning severity for the the "md was still + referenced 1 node(s)" warning. Tor 0.2.5.4-alpha has better code + for trying to diagnose this bug, and the current warning in + earlier versions of tor achieves nothing useful. Addresses warning + from bug 7164. Changes in version 0.2.4.21 - 2014-02-28

1 0

[ooni-probe/master] Make pep8 related fixes to bridge_reachability test.
by art＠torproject.org 14 May '14

14 May '14

commit 458a992bb31d66735dc978185f7c5f921f5ea0df Author: Arturo Filastò <art(a)fuffa.org> Date: Wed May 14 15:28:47 2014 +0200 Make pep8 related fixes to bridge_reachability test. --- ooni/nettests/blocking/bridge_reachability.py | 59 ++++++++++++++++--------- 1 file changed, 39 insertions(+), 20 deletions(-) diff --git a/ooni/nettests/blocking/bridge_reachability.py b/ooni/nettests/blocking/bridge_reachability.py index c0cdb76..a70c16f 100644 --- a/ooni/nettests/blocking/bridge_reachability.py +++ b/ooni/nettests/blocking/bridge_reachability.py @@ -1,27 +1,31 @@ # -*- encoding: utf-8 -*- import random -import string -import subprocess from distutils.spawn import find_executable from twisted.python import usage -from twisted.internet import defer, reactor, error +from twisted.internet import reactor, error import txtorcon from ooni.utils import log, onion from ooni import nettest -class TorIsNotInstalled(Exception): pass + +class TorIsNotInstalled(Exception): + pass + class UsageOptions(usage.Options): - optParameters = [['timeout', 't', 120, - 'Specify the timeout after which to consider the Tor bootstrapping process to have failed'], - ] + optParameters = [ + ['timeout', 't', 120, + 'Specify the timeout after which to consider ' + 'the Tor bootstrapping process to have failed'], ] + class BridgeReachability(nettest.NetTestCase): name = "Bridge Reachability" - description = "A test for checking if bridges are reachable from a given location." + description = "A test for checking if bridges are reachable " \ + "from a given location." author = "Arturo Filastò" version = "0.1" @@ -33,10 +37,12 @@ class BridgeReachability(nettest.NetTestCase): 'TransportType IP:ORPort (ex. obfs2 127.0.0.1:443)'] requiredOptions = ['file'] - + def requirements(self): if not onion.find_tor_binary(): - raise TorIsNotInstalled("For instructions on installing Tor see: https://www.torproject.org/download/download") + raise TorIsNotInstalled( + "For instructions on installing Tor see: " + "https://www.torproject.org/download/download") def setUp(self): self.tor_progress = 0 @@ -58,7 +64,7 @@ class BridgeReachability(nettest.NetTestCase): self.bridge = self.input.replace('Bridge ', '') self.pyobfsproxy_bin = find_executable('obfsproxy') self.fteproxy_bin = find_executable('fteproxy') - + def postProcessor(self, measurements): if 'successes' not in self.summary: self.summary['successes'] = [] @@ -79,6 +85,7 @@ class BridgeReachability(nettest.NetTestCase): def displaySummary(self, summary): successful_count = {} failure_count = {} + def count(results, counter): for result in results: if result['transport_name'] not in counter: @@ -87,8 +94,13 @@ class BridgeReachability(nettest.NetTestCase): count(summary['successes'], successful_count) count(summary['failures'], failure_count) - working_bridges = ', '.join(["%s %s" % (x['transport_name'], x['address']) for x in summary['successes']]) - failing_bridges = ', '.join(["%s %s (at %s%%)" % (x['transport_name'], x['address'], x['tor_progress']) for x in summary['failures']]) + working_bridges = ', '.join( + ["%s %s" % (x['transport_name'], x['address']) + for x in summary['successes']]) + failing_bridges = ', '.join( + ["%s %s (at %s%%)" + % (x['transport_name'], x['address'], x['tor_progress']) + for x in summary['failures']]) log.msg("Total successes: %d" % len(summary['successes'])) log.msg("Total failures: %d" % len(summary['failures'])) @@ -105,28 +117,34 @@ class BridgeReachability(nettest.NetTestCase): config = txtorcon.TorConfig() config.ControlPort = random.randint(2**14, 2**16) config.SocksPort = random.randint(2**14, 2**16) - log.msg("Connecting to %s with tor %s" % (self.bridge, onion.tor_details['version'])) - + log.msg( + "Connecting to %s with tor %s" % + (self.bridge, onion.tor_details['version'])) + transport_name = onion.transport_name(self.bridge) if transport_name and transport_name == 'fte' and self.fteproxy_bin: - config.ClientTransportPlugin = "%s exec %s --managed" % (transport_name, self.fteproxy_bin) + config.ClientTransportPlugin = "%s exec %s --managed" % ( + transport_name, self.fteproxy_bin) self.report['transport_name'] = transport_name self.report['bridge_address'] = self.bridge.split(' ')[1] - elif transport_name and transport_name == 'fte' and not self.fteproxy_bin: + elif transport_name and transport_name == 'fte'\ + and not self.fteproxy_bin: log.err("Unable to test bridge because fteproxy is not installed") self.report['error'] = 'missing-fteproxy' return elif transport_name and self.pyobfsproxy_bin: - config.ClientTransportPlugin = "%s exec %s managed" % (transport_name, self.pyobfsproxy_bin) + config.ClientTransportPlugin = "%s exec %s managed" % ( + transport_name, self.pyobfsproxy_bin) self.report['transport_name'] = transport_name self.report['bridge_address'] = self.bridge.split(' ')[1] elif transport_name and not self.pyobfsproxy_bin: - log.err("Unable to test bridge because pyobfsproxy is not installed") + log.err( + "Unable to test bridge because pyobfsproxy is not installed") self.report['error'] = 'missing-pyobfsproxy' return else: self.report['bridge_address'] = self.bridge.split(' ')[0] - + if transport_name and transport_name == 'scramblesuit' and \ onion.TorVersion('0.2.5.1') > onion.tor_details['version']: self.report['error'] = 'unsupported-tor-version' @@ -151,6 +169,7 @@ class BridgeReachability(nettest.NetTestCase): d = txtorcon.launch_tor(config, reactor, timeout=self.timeout, progress_updates=updates) + @d.addCallback def setup_complete(proto): try:

1 0

[ooni-probe/master] Fixed 4 bugs:
by art＠torproject.org 14 May '14

14 May '14

commit f845a3f75fa7cbb11add9371cf33b9f50cfebd7d Author: kudrom <kudrom(a)riseup.net> Date: Sat May 10 00:26:04 2014 +0200 Fixed 4 bugs: - Inconsistence in the get_random_url_safe_string between the initial and returned lengths. - Variable resolved_auth_ns undefined in check_0x20_to_auth_ns when a sample_size was given. - Condition unreacheable in compare_random_hostnames. - Double checking for isalpha in get_random_hostname and get_random_url_safe_string It has also been improved the conformance to PEP8. --- ooni/nettests/manipulation/captiveportal.py | 71 +++++++++++++-------------- 1 file changed, 33 insertions(+), 38 deletions(-) diff --git a/ooni/nettests/manipulation/captiveportal.py b/ooni/nettests/manipulation/captiveportal.py index 717bb10..35bfa75 100644 --- a/ooni/nettests/manipulation/captiveportal.py +++ b/ooni/nettests/manipulation/captiveportal.py @@ -40,21 +40,23 @@ from twisted.python import usage from twisted.internet import defer, threads from ooni import nettest -from ooni.templates import httpt,dnst +from ooni.templates import httpt, dnst from ooni.utils import net from ooni.utils import log __plugoo__ = "captiveportal" __desc__ = "Captive portal detection test" + class UsageOptions(usage.Options): optParameters = [['asset', 'a', None, 'Asset file'], - ['experiment-url', 'e', 'http://google.com/', 'Experiment URL'], - ['user-agent', 'u', random.choice(net.userAgents), - 'User agent for HTTP requests'] - ] + ['experiment-url', 'e', 'http://google.com/', 'Experiment URL'], + ['user-agent', 'u', random.choice(net.userAgents), + 'User agent for HTTP requests'] + ] + -class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): +class CaptivePortal(httpt.HTTPTest, dnst.DNSTest): """ Compares content and status codes of HTTP responses, and attempts to determine if content has been altered. @@ -78,7 +80,7 @@ class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): #XXX: HTTP Error 302: The HTTP server returned a redirect error that #would lead to an infinite loop. The last 30x error message was: Found try: - response = yield self.doRequest(url,"GET",headers) + response = yield self.doRequest(url, "GET", headers) defer.returnValue(response) except Exception: log.err("HTTPError") @@ -165,10 +167,10 @@ class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): try: answer = yield self.performALookup(hn) if not answer: - answer = yield self.performALookup(hn, ('8.8.8.8',53)) + answer = yield self.performALookup(hn, ('8.8.8.8', 53)) except error.DNSNameError: - log.msg("DNS resolution for %s returned NXDOMAIN" % hn) - response.append('NXDOMAIN') + log.msg("DNS resolution for %s returned NXDOMAIN" % hn) + response.append('NXDOMAIN') except Exception: log.err("DNS Resolution failed") finally: @@ -251,8 +253,8 @@ class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): if sample_size is None: sample_size = 5 - res = yield self.dns_resolve(auth_nameservers) - resolved_auth_ns = random.sample(res,sample_size) + res = yield self.dns_resolve(auth_nameservers) + resolved_auth_ns = random.sample(res, sample_size) querynames = [] answernames = [] @@ -264,7 +266,7 @@ class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): for auth_ns in resolved_auth_ns: try: - answer = yield self.performSOALookup(hostname,(auth_ns,53)) + answer = yield self.performSOALookup(hostname, (auth_ns, 53)) except Exception: continue querynames.append(hostname) @@ -307,18 +309,16 @@ class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): 0 < length <= 256. The returned string will always start with an alphabetic character. """ - if (length <= 0): + if length <= 0: length = 1 - elif (length > 256): + elif length > 256: length = 256 - random_ascii = base64.urlsafe_b64encode(os.urandom(int(length))) - - while not random_ascii[:1].isalpha(): - random_ascii = base64.urlsafe_b64encode(os.urandom(int(length))) + random_string = '' + while length > 0: + random_string += random.choice(string.lowercase) + length -= 1 - three_quarters = int((len(random_ascii)) * (3.0/4.0)) - random_string = random_ascii[:three_quarters] return random_string def get_random_hostname(self, length=None): @@ -334,11 +334,6 @@ class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): length = 32 random_sld = self.get_random_url_safe_string(length) - - # if it doesn't start with a letter, chuck it. - while not random_sld[:1].isalpha(): - random_sld = self.get_random_url_safe_string(length) - tld_list = ['.com', '.net', '.org', '.info', '.test', '.invalid'] random_tld = random.choice(tld_list) random_hostname = random_sld + random_tld @@ -375,12 +370,12 @@ class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): for x in range(hostname_count): random_hostname = self.get_random_hostname(hostname_length) response_match, response_address = yield self.dns_resolve_match(random_hostname, - control[0]) + control[0]) for address in response_address: if response_match is False: log.msg("Strangely, DNS resolution of the random hostname") log.msg("%s actually points to %s" - % (random_hostname, response_address)) + % (random_hostname, response_address)) responses = responses + [address] else: responses = responses + [address] @@ -391,10 +386,10 @@ class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): if len(intersection) == 1: log.msg("All %d random hostnames properly resolved to NXDOMAIN." - % hostname_count) + % hostname_count) ret = True, relative_complement defer.returnValue(ret) - elif (len(intersection) == 1) and (len(r) > 1): + elif (len(intersection) == 0) and (len(r) > 1): log.msg("Something odd happened. Some random hostnames correctly") log.msg("resolved to NXDOMAIN, but several others resolved to") log.msg("to the following addresses: %s" % relative_complement) @@ -451,7 +446,7 @@ class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): log.msg("test...") msmatch, ms_dns_result = yield self.dns_resolve_match("dns.msftncsi.com", - "131.107.255.255") + "131.107.255.255") if msmatch: log.msg("Microsoft NCSI DNS-based captive portal test did not") log.msg("detect a captive portal.") @@ -497,7 +492,7 @@ class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): 'Microsoft NCSI', '200', 'Microsoft NCSI', - 'MS HTTP Captive Portal',]] + 'MS HTTP Captive Portal', ]] cm = self.http_content_match_fuzzy_opt sm = self.http_status_code_match @@ -510,8 +505,8 @@ class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): log.msg("Running the %s test..." % test_name) content_match, experiment_code, experiment_headers = yield cm(experiment_url, - control_result, - headers, fuzzy) + control_result, + headers, fuzzy) status_match = status_func(experiment_code, control_code) if status_match and content_match: log.msg("The %s test was unable to detect" % test_name) @@ -573,7 +568,7 @@ class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): log.msg("Running test for '%s'..." % experiment_url) content_match, experiment_code, experiment_headers = yield cm(experiment_url, - control_result) + control_result) status_match = sm(experiment_code, control_code) if status_match and content_match: log.msg("The test for '%s'" % experiment_url) @@ -583,10 +578,10 @@ class CaptivePortal(httpt.HTTPTest,dnst.DNSTest): elif status_match and not content_match: log.msg("Retrying '%s' with fuzzy match enabled." - % experiment_url) + % experiment_url) fuzzy_match, experiment_code, experiment_headers = yield cm(experiment_url, - control_result, - fuzzy=True) + control_result, + fuzzy=True) if fuzzy_match: self.report['result'] = True else:

1 0