August 2014 - tor-commits - lists.torproject.org

[translation/tor-launcher-network-settings_completed] Update translations for tor-launcher-network-settings_completed
by translation＠torproject.org 27 Aug '14

27 Aug '14

commit 9fb220724a142445073988e549354288ad8d62f6 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Aug 27 13:45:43 2014 +0000 Update translations for tor-launcher-network-settings_completed --- fr_CA/network-settings.dtd | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/fr_CA/network-settings.dtd b/fr_CA/network-settings.dtd index 95b5488..5df779b 100644 --- a/fr_CA/network-settings.dtd +++ b/fr_CA/network-settings.dtd @@ -8,8 +8,8 @@ <!ENTITY torSettings.no "Non"> <!ENTITY torSettings.firstQuestion "Laquelle des suivantes décrit le mieux votre situation?"> -<!ENTITY torSettings.configurePrompt1 "La connexion Internet de cet ordinateur est censurée, filtrée ou relayée par un serveur mandataire."> -<!ENTITY torSettings.configurePrompt2 "Je dois configurer des paramètres de pont, de coupe-feu ou de serveur mandataire."> +<!ENTITY torSettings.configurePrompt1 "La connexion Internet de cet ordinateur est censurée ou relayée."> +<!ENTITY torSettings.configurePrompt2 "Je dois configurer des paramètres de pont ou de serveur mandataire."> <!ENTITY torSettings.configure "Configurer"> <!ENTITY torSettings.connectPrompt2 "Je voudrais me connecter directement au réseau Tor."> <!ENTITY torSettings.connectPrompt3 "Ceci fonctionnera dans la plupart des situations."> @@ -19,9 +19,6 @@  <!ENTITY torSettings.proxyHelp "Si vous ne savez pas comment répondre à cette question, regarder les paramètres Internet d'un autre navigateur afin de voir s'il est configuré pour utiliser un mandataire."> <!ENTITY torSettings.enterProxy "Saisir les paramètres du serveur mandataire."> -<!ENTITY torSettings.firewallQuestion "Est-ce que la connexion Internet de cet ordinateur passe par un pare-feu qui n'autorise les connexions que vers certains ports?"> -<!ENTITY torSettings.firewallHelp "Si vous ne savez par comment répondre à cette question, choisissez Non. Si vous éprouvez des difficultés à vous connecter au réseau Tor, changer ce paramètre."> -<!ENTITY torSettings.enterFirewall "Saisir une liste de ports, séparés par des virgules, qui sont autorisés par le pare-feu."> <!ENTITY torSettings.bridgeQuestion "Votre fournisseur de service Internet (FSI) bloque-t-il ou censure-t-il vos connexions au réseau Tor?"> <!ENTITY torSettings.bridgeHelp "Si vous ne savez pas comment répondre à cette question, choisissez Non.  Si vous choisissez Oui, on vous demandera de configurer les ponts Tor qui sont des relais non listés rendant le bloquage des connexions au réseau Tor plus difficile."> <!ENTITY torSettings.bridgeSettingsPrompt "Vous pouvez utiliser le jeu de ponts fourni ou vous pouvez obtenir et saisir un jeu de ponts personnalisé.">

1 0

[translation/tor-launcher-network-settings] Update translations for tor-launcher-network-settings
by translation＠torproject.org 27 Aug '14

27 Aug '14

commit 34f82518552280090154241f72adfcf1e9df8027 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Aug 27 13:45:40 2014 +0000 Update translations for tor-launcher-network-settings --- fr_CA/network-settings.dtd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fr_CA/network-settings.dtd b/fr_CA/network-settings.dtd index bcf55c5..5df779b 100644 --- a/fr_CA/network-settings.dtd +++ b/fr_CA/network-settings.dtd @@ -8,8 +8,8 @@ <!ENTITY torSettings.no "Non"> <!ENTITY torSettings.firstQuestion "Laquelle des suivantes décrit le mieux votre situation?"> -<!ENTITY torSettings.configurePrompt1 "This computer's Internet connection is censored or proxied."> -<!ENTITY torSettings.configurePrompt2 "I need to configure bridge or proxy settings."> +<!ENTITY torSettings.configurePrompt1 "La connexion Internet de cet ordinateur est censurée ou relayée."> +<!ENTITY torSettings.configurePrompt2 "Je dois configurer des paramètres de pont ou de serveur mandataire."> <!ENTITY torSettings.configure "Configurer"> <!ENTITY torSettings.connectPrompt2 "Je voudrais me connecter directement au réseau Tor."> <!ENTITY torSettings.connectPrompt3 "Ceci fonctionnera dans la plupart des situations.">

1 0

[translation/tor-launcher-properties_completed] Update translations for tor-launcher-properties_completed
by translation＠torproject.org 27 Aug '14

27 Aug '14

commit 1144921c171f40bb274c7fd224ea8541232c32f9 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Aug 27 13:45:34 2014 +0000 Update translations for tor-launcher-properties_completed --- fr_CA/torlauncher.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fr_CA/torlauncher.properties b/fr_CA/torlauncher.properties index bf94fac..bd66071 100644 --- a/fr_CA/torlauncher.properties +++ b/fr_CA/torlauncher.properties @@ -37,7 +37,7 @@ torlauncher.done=Fait torlauncher.forAssistance=Pour l'assistance, contacter %S -torlauncher.copiedNLogMessages=La copie est terminée. %S messages de journalisation de Tor sont prêts à être collés dans un éditeur de texte ou un courriel. +torlauncher.copiedNLogMessages=La copie est terminée. %S messages de journalisation de Tor sont prêts à être coller dans un éditeur de texte ou un courriel. torlauncher.bootstrapStatus.conn_dir=Connexion à un annuaire de relais torlauncher.bootstrapStatus.handshake_dir=Mise en place d'une connexion chiffrée à l'annuaire

1 0

[translation/tor-launcher-properties] Update translations for tor-launcher-properties
by translation＠torproject.org 27 Aug '14

27 Aug '14

commit 7cce0d15b560f7ad5940d8b4c3d2b8e9d3614a35 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Aug 27 13:45:31 2014 +0000 Update translations for tor-launcher-properties --- fr_CA/torlauncher.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fr_CA/torlauncher.properties b/fr_CA/torlauncher.properties index 9213e20..bd66071 100644 --- a/fr_CA/torlauncher.properties +++ b/fr_CA/torlauncher.properties @@ -37,7 +37,7 @@ torlauncher.done=Fait torlauncher.forAssistance=Pour l'assistance, contacter %S -torlauncher.copiedNLogMessages=Copy complete. %S Tor log messages are ready to be pasted into a text editor or an email message. +torlauncher.copiedNLogMessages=La copie est terminée. %S messages de journalisation de Tor sont prêts à être coller dans un éditeur de texte ou un courriel. torlauncher.bootstrapStatus.conn_dir=Connexion à un annuaire de relais torlauncher.bootstrapStatus.handshake_dir=Mise en place d'une connexion chiffrée à l'annuaire

1 0

[translation/tor-launcher-network-settings_completed] Update translations for tor-launcher-network-settings_completed
by translation＠torproject.org 27 Aug '14

27 Aug '14

commit af665d02a9da2387a2f9d2e5cbfb4b08b6b62af4 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Aug 27 13:15:39 2014 +0000 Update translations for tor-launcher-network-settings_completed --- de/network-settings.dtd | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/de/network-settings.dtd b/de/network-settings.dtd index 8590643..2ccb333 100644 --- a/de/network-settings.dtd +++ b/de/network-settings.dtd @@ -8,8 +8,8 @@ <!ENTITY torSettings.no "Nein"> <!ENTITY torSettings.firstQuestion "Was beschreibt Ihre Situation am besten?"> -<!ENTITY torSettings.configurePrompt1 "Die Internetverbindung dieses Rechner ist zensiert, gefiltert oder vermittelt."> -<!ENTITY torSettings.configurePrompt2 "Ich muss die Einstellungen der Brücke, der Firewall oder des Vermittlungsservers einstellen."> +<!ENTITY torSettings.configurePrompt1 "Die Internetverbindung dieses Rechner ist zensiert oder vermittelt."> +<!ENTITY torSettings.configurePrompt2 "Ich muss die Brücken- und Vermittlungsservereinstellungen konfigurieren."> <!ENTITY torSettings.configure "Konfigurieren"> <!ENTITY torSettings.connectPrompt2 "Ich würde gerne direkt eine Verbindung zum Tor-Netzwerk herstellen."> <!ENTITY torSettings.connectPrompt3 "Das wird in den meisten Situationen funktionieren."> @@ -19,9 +19,6 @@  <!ENTITY torSettings.proxyHelp "Wenn Sie sich nicht sicher sind, dann schauen Sie in die Einstellungen ihres normalen Browsers ob dort ein Vermittlungsserver eingerichtet ist."> <!ENTITY torSettings.enterProxy "Vermittlungseinstellungen eingeben."> -<!ENTITY torSettings.firewallQuestion "Benutzt die Internetverbindung dieses Rechners eine Firewall, die nur Verbindungen zu bestimmten Anschlüssen zulässt?"> -<!ENTITY torSettings.firewallHelp "Wenn Sie sich nicht sicher sind, wählen Sie Nein. Wenn Sie dann Probleme haben eine Verbindung zum Tor-Netzwerk herzustellen, ändern Sie diese Einstellung."> -<!ENTITY torSettings.enterFirewall "Geben Sie hier die Anschlüsse ein, die von der Firewall erlaubt werden. Trennen Sie die Anschlüsse jeweils mit einem Komma."> <!ENTITY torSettings.bridgeQuestion "Blockiert oder zensiert Ihr Internetdienstanbieter (ISP) Verbindungen zum Tor-Netzwerk?"> <!ENTITY torSettings.bridgeHelp "Wenn Sie sich nicht sicher sind, wie Sie diese Frage beantworten sollen, wählen Sie Nr.  Wenn Sie Ja wählen, werden Sie aufgefordert, die Torbrücken zu konfigurieren. Die nicht aufgeführte Relais sind, was es schwieriger macht, Verbindungen zum Tor-Netzwerk zu blockieren."> <!ENTITY torSettings.bridgeSettingsPrompt "Sie könne den bereitgestellten Satz an Brücken verwenden oder Sie können welche erhalten, und geben einen benutzerdefinierten Satz an Brücken ein.">

1 0

[translation/tor-launcher-network-settings] Update translations for tor-launcher-network-settings
by translation＠torproject.org 27 Aug '14

27 Aug '14

commit 418f53e3ae0cd09738aabd7969c963f66519f13d Author: Translation commit bot <translation(a)torproject.org> Date: Wed Aug 27 13:15:37 2014 +0000 Update translations for tor-launcher-network-settings --- de/network-settings.dtd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/de/network-settings.dtd b/de/network-settings.dtd index fb18b72..2ccb333 100644 --- a/de/network-settings.dtd +++ b/de/network-settings.dtd @@ -8,8 +8,8 @@ <!ENTITY torSettings.no "Nein"> <!ENTITY torSettings.firstQuestion "Was beschreibt Ihre Situation am besten?"> -<!ENTITY torSettings.configurePrompt1 "This computer's Internet connection is censored or proxied."> -<!ENTITY torSettings.configurePrompt2 "I need to configure bridge or proxy settings."> +<!ENTITY torSettings.configurePrompt1 "Die Internetverbindung dieses Rechner ist zensiert oder vermittelt."> +<!ENTITY torSettings.configurePrompt2 "Ich muss die Brücken- und Vermittlungsservereinstellungen konfigurieren."> <!ENTITY torSettings.configure "Konfigurieren"> <!ENTITY torSettings.connectPrompt2 "Ich würde gerne direkt eine Verbindung zum Tor-Netzwerk herstellen."> <!ENTITY torSettings.connectPrompt3 "Das wird in den meisten Situationen funktionieren.">

1 0

[translation/tor-launcher-properties] Update translations for tor-launcher-properties
by translation＠torproject.org 27 Aug '14

27 Aug '14

commit c591cc0f05332ce3c88644bca8d48df186988e68 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Aug 27 13:15:28 2014 +0000 Update translations for tor-launcher-properties --- de/torlauncher.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/de/torlauncher.properties b/de/torlauncher.properties index 4f17c82..5dc89c9 100644 --- a/de/torlauncher.properties +++ b/de/torlauncher.properties @@ -37,7 +37,7 @@ torlauncher.done=Fertig torlauncher.forAssistance=Falls Sie Hilfe benötigen, kontaktieren Sie %S -torlauncher.copiedNLogMessages=Copy complete. %S Tor log messages are ready to be pasted into a text editor or an email message. +torlauncher.copiedNLogMessages=Kopie vollständig. %S Tor-Protokollnachrichten sind bereit, um in eine Textbearbeitung oder in eine E-Mail-Nachricht eingefügt zu werden. torlauncher.bootstrapStatus.conn_dir=Zu einem Relaisverzeichnis wird verbunden torlauncher.bootstrapStatus.handshake_dir=Es wird eine verschlüsselte Verbindung zu einem Verzeichnis hergestellt

1 0

[obfs4/master] Various IAT related changes.
by yawning＠torproject.org 27 Aug '14

27 Aug '14

commit bfca92cf1627c2e380eb44f4314bb121935108ec Author: Yawning Angel <yawning(a)torproject.org> Date: Wed Aug 27 12:30:11 2014 +0000 Various IAT related changes. * Unbreak inbound TYPE_PRNG_SEED processing. * IAT obfuscation is now a per-bridge argument (iat-mode). * 0 (default) = Disabled. * 1 = Enabled, ScrambleSuit-style with bulk throughput optimizations. * 2 = Paranoid, Each IAT write will send a length sampled from the length distribution. (EXPENSIVE). The "iat-mode" argument is mandatory on the Bridge lines, and as a ServerTransportOption. Old statefiles will continue to load and use the default value, edit it if your hat is made of tin foil. --- transports/obfs4/obfs4.go | 86 ++++++++++++++++++++++++++++++----------- transports/obfs4/statefile.go | 22 ++++++++++- 2 files changed, 85 insertions(+), 23 deletions(-) diff --git a/transports/obfs4/obfs4.go b/transports/obfs4/obfs4.go index f9b02ad..b862e5a 100644 --- a/transports/obfs4/obfs4.go +++ b/transports/obfs4/obfs4.go @@ -36,6 +36,7 @@ import ( "fmt" "math/rand" "net" + "strconv" "syscall" "time" @@ -55,11 +56,11 @@ const ( publicKeyArg = "public-key" privateKeyArg = "private-key" seedArg = "drbg-seed" + iatArg = "iat-mode" - iatCmdArg = "obfs4-iatObfuscation" biasCmdArg = "obfs4-distBias" - seedLength = 32 + seedLength = drbg.SeedLength headerLength = framing.FrameOverhead + packetOverhead clientHandshakeTimeout = time.Duration(60) * time.Second serverHandshakeTimeout = time.Duration(30) * time.Second @@ -70,8 +71,11 @@ const ( maxCloseDelay = 60 ) -// iatObfuscation controls if Inter-Arrival Time obfuscation will be enabled. -var iatObfuscation bool +const ( + iatNone = iota + iatEnabled + iatParanoid +) // biasedDist controls if the probability table will be ScrambleSuit style or // uniformly distributed. @@ -81,6 +85,7 @@ type obfs4ClientArgs struct { nodeID *ntor.NodeID publicKey *ntor.PublicKey sessionKey *ntor.Keypair + iatMode int } // Transport is the obfs4 implementation of the base.Transport interface. @@ -107,7 +112,7 @@ func (t *Transport) ServerFactory(stateDir string, args *pt.Args) (base.ServerFa } var iatSeed *drbg.Seed - if iatObfuscation { + if st.iatMode != iatNone { iatSeedSrc := sha256.Sum256(st.drbgSeed.Bytes()[:]) iatSeed, err = drbg.SeedFromBytes(iatSeedSrc[:]) if err != nil { @@ -119,6 +124,7 @@ func (t *Transport) ServerFactory(stateDir string, args *pt.Args) (base.ServerFa ptArgs := pt.Args{} ptArgs.Add(nodeIDArg, st.nodeID.Hex()) ptArgs.Add(publicKeyArg, st.identityKey.Public().Hex()) + ptArgs.Add(iatArg, strconv.Itoa(st.iatMode)) // Initialize the replay filter. filter, err := replayfilter.New(replayTTL) @@ -133,7 +139,7 @@ func (t *Transport) ServerFactory(stateDir string, args *pt.Args) (base.ServerFa } rng := rand.New(drbg) - sf := &obfs4ServerFactory{t, &ptArgs, st.nodeID, st.identityKey, st.drbgSeed, iatSeed, filter, rng.Intn(maxCloseDelayBytes), rng.Intn(maxCloseDelay)} + sf := &obfs4ServerFactory{t, &ptArgs, st.nodeID, st.identityKey, st.drbgSeed, iatSeed, st.iatMode, filter, rng.Intn(maxCloseDelayBytes), rng.Intn(maxCloseDelay)} return sf, nil } @@ -157,6 +163,15 @@ func (cf *obfs4ClientFactory) ParseArgs(args *pt.Args) (interface{}, error) { if nodeID, err = ntor.NodeIDFromHex(nodeIDStr); err != nil { return nil, err } + iatStr, ok := args.Get(iatArg) + if !ok { + return nil, fmt.Errorf("missing argument '%s'", iatArg) + } + var iatMode int + iatMode, err = strconv.Atoi(iatStr) + if err != nil || iatMode < iatNone || iatMode > iatParanoid { + return nil, fmt.Errorf("invalid iat-mode '%d'", iatMode) + } publicKeyStr, ok := args.Get(publicKeyArg) if !ok { @@ -174,7 +189,7 @@ func (cf *obfs4ClientFactory) ParseArgs(args *pt.Args) (interface{}, error) { return nil, err } - return &obfs4ClientArgs{nodeID, publicKey, sessionKey}, nil + return &obfs4ClientArgs{nodeID, publicKey, sessionKey, iatMode}, nil } func (cf *obfs4ClientFactory) WrapConn(conn net.Conn, args interface{}) (net.Conn, error) { @@ -194,6 +209,7 @@ type obfs4ServerFactory struct { identityKey *ntor.Keypair lenSeed *drbg.Seed iatSeed *drbg.Seed + iatMode int replayFilter *replayfilter.ReplayFilter closeDelayBytes int @@ -228,7 +244,7 @@ func (sf *obfs4ServerFactory) WrapConn(conn net.Conn) (net.Conn, error) { iatDist = probdist.New(sf.iatSeed, 0, maxIATDelay, biasedDist) } - c := &obfs4Conn{conn, true, lenDist, iatDist, bytes.NewBuffer(nil), bytes.NewBuffer(nil), nil, nil} + c := &obfs4Conn{conn, true, lenDist, iatDist, sf.iatMode, bytes.NewBuffer(nil), bytes.NewBuffer(nil), nil, nil} startTime := time.Now() @@ -247,6 +263,7 @@ type obfs4Conn struct { lenDist *probdist.WeightedDist iatDist *probdist.WeightedDist + iatMode int receiveBuffer *bytes.Buffer receiveDecodedBuffer *bytes.Buffer @@ -263,7 +280,7 @@ func newObfs4ClientConn(conn net.Conn, args *obfs4ClientArgs) (c *obfs4Conn, err } lenDist := probdist.New(seed, 0, framing.MaximumSegmentLength, biasedDist) var iatDist *probdist.WeightedDist - if iatObfuscation { + if args.iatMode != iatNone { var iatSeed *drbg.Seed iatSeedSrc := sha256.Sum256(seed.Bytes()[:]) if iatSeed, err = drbg.SeedFromBytes(iatSeedSrc[:]); err != nil { @@ -273,7 +290,7 @@ func newObfs4ClientConn(conn net.Conn, args *obfs4ClientArgs) (c *obfs4Conn, err } // Allocate the client structure. - c = &obfs4Conn{conn, false, lenDist, iatDist, bytes.NewBuffer(nil), bytes.NewBuffer(nil), nil, nil} + c = &obfs4Conn{conn, false, lenDist, iatDist, args.iatMode, bytes.NewBuffer(nil), bytes.NewBuffer(nil), nil, nil} // Start the handshake timeout. deadline := time.Now().Add(clientHandshakeTimeout) @@ -466,24 +483,51 @@ func (conn *obfs4Conn) Write(b []byte) (n int, err error) { } } - // Add the length obfuscation padding. In theory, this could be inlined - // with the last chopped packet for certain (most?) payload lenghts, but - // this is simpler. - - if err = conn.padBurst(&frameBuf); err != nil { - return 0, err + if conn.iatMode != iatParanoid { + // For non-paranoid IAT, pad once per burst. Paranoid IAT handles + // things differently. + if err = conn.padBurst(&frameBuf, conn.lenDist.Sample()); err != nil { + return 0, err + } } // Write the pending data onto the network. Partial writes are fatal, // because the frame encoder state is advanced, and the code doesn't keep // frameBuf around. In theory, write timeouts and whatnot could be // supported if this wasn't the case, but that complicates the code. - - if conn.iatDist != nil { + if conn.iatMode != iatNone { var iatFrame [framing.MaximumSegmentLength]byte for frameBuf.Len() > 0 { iatWrLen := 0 - iatWrLen, err = frameBuf.Read(iatFrame[:]) + + switch conn.iatMode { + case iatEnabled: + // Standard (ScrambleSuit-style) IAT obfuscation optimizes for + // bulk transport and will write ~MTU sized frames when + // possible. + iatWrLen, err = frameBuf.Read(iatFrame[:]) + + case iatParanoid: + // Paranoid IAT obfuscation throws performance out of the + // window and will sample the length distribution every time a + // write is scheduled. + targetLen := conn.lenDist.Sample() + if frameBuf.Len() < targetLen { + // There's not enough data buffered for the target write, + // so padding must be inserted. + if err = conn.padBurst(&frameBuf, targetLen); err != nil { + return 0, err + } + if frameBuf.Len() != targetLen { + // Ugh, padding came out to a value that required more + // than one frame, this is relatively unlikely so just + // resample since there's enough data to ensure that + // the next sample will be written. + continue + } + } + iatWrLen, err = frameBuf.Read(iatFrame[:targetLen]) + } if err != nil { return 0, err } else if iatWrLen == 0 { @@ -543,9 +587,8 @@ func (conn *obfs4Conn) closeAfterDelay(sf *obfs4ServerFactory, startTime time.Ti } } -func (conn *obfs4Conn) padBurst(burst *bytes.Buffer) (err error) { +func (conn *obfs4Conn) padBurst(burst *bytes.Buffer, toPadTo int) (err error) { tailLen := burst.Len() % framing.MaximumSegmentLength - toPadTo := conn.lenDist.Sample() padLen := 0 if toPadTo >= tailLen { @@ -577,7 +620,6 @@ func (conn *obfs4Conn) padBurst(burst *bytes.Buffer) (err error) { } func init() { - flag.BoolVar(&iatObfuscation, iatCmdArg, false, "Enable obfs4 IAT obfuscation (expensive)") flag.BoolVar(&biasedDist, biasCmdArg, false, "Enable obfs4 using ScrambleSuit style table generation") } diff --git a/transports/obfs4/statefile.go b/transports/obfs4/statefile.go index 7949dd9..8690178 100644 --- a/transports/obfs4/statefile.go +++ b/transports/obfs4/statefile.go @@ -33,6 +33,7 @@ import ( "io/ioutil" "os" "path" + "strconv" "git.torproject.org/pluggable-transports/goptlib.git" "git.torproject.org/pluggable-transports/obfs4.git/common/csrand" @@ -49,12 +50,14 @@ type jsonServerState struct { PrivateKey string `json:"private-key"` PublicKey string `json:"public-key"` DrbgSeed string `json:"drbg-seed"` + IATMode int `json:"iat-mode"` } type obfs4ServerState struct { nodeID *ntor.NodeID identityKey *ntor.Keypair drbgSeed *drbg.Seed + iatMode int } func serverStateFromArgs(stateDir string, args *pt.Args) (*obfs4ServerState, error) { @@ -64,8 +67,9 @@ func serverStateFromArgs(stateDir string, args *pt.Args) (*obfs4ServerState, err js.NodeID, nodeIDOk = args.Get(nodeIDArg) js.PrivateKey, privKeyOk = args.Get(privateKeyArg) js.DrbgSeed, seedOk = args.Get(seedArg) + iatStr, iatOk := args.Get(iatArg) - if !privKeyOk && !nodeIDOk && !seedOk { + if !privKeyOk && !nodeIDOk && !seedOk && !iatOk { if err := jsonServerStateFromFile(stateDir, &js); err != nil { return nil, err } @@ -75,6 +79,16 @@ func serverStateFromArgs(stateDir string, args *pt.Args) (*obfs4ServerState, err return nil, fmt.Errorf("missing argument '%s'", nodeIDArg) } else if !seedOk { return nil, fmt.Errorf("missing argument '%s'", seedArg) + } else if !iatOk { + // Disable IAT if not specified. + return nil, fmt.Errorf("missing argument '%s'", iatArg) + } else { + // Parse and validate the iat-mode argument. + iatMode, err := strconv.Atoi(iatStr) + if err != nil { + return nil, fmt.Errorf("malformed iat-mode '%s'", iatStr) + } + js.IATMode = iatMode } return serverStateFromJSONServerState(&js) @@ -93,6 +107,10 @@ func serverStateFromJSONServerState(js *jsonServerState) (*obfs4ServerState, err if st.drbgSeed, err = drbg.SeedFromHex(js.DrbgSeed); err != nil { return nil, err } + if js.IATMode < iatNone || js.IATMode > iatParanoid { + return nil, fmt.Errorf("invalid iat-mode '%d'", js.IATMode) + } + st.iatMode = js.IATMode return st, nil } @@ -132,12 +150,14 @@ func newJSONServerState(stateDir string, js *jsonServerState) (err error) { if st.drbgSeed, err = drbg.NewSeed(); err != nil { return } + st.iatMode = iatNone // Encode it into JSON format and write the state file. js.NodeID = st.nodeID.Hex() js.PrivateKey = st.identityKey.Private().Hex() js.PublicKey = st.identityKey.Public().Hex() js.DrbgSeed = st.drbgSeed.Hex() + js.IATMode = st.iatMode var encoded []byte if encoded, err = json.Marshal(js); err != nil {

1 0

[obfs4/master] Change the TYPE_PRNG_SEED length to 24.
by yawning＠torproject.org 27 Aug '14

27 Aug '14

commit 94d3fe9a0802e2614d4a4b9297ed57b1979865fc Author: Yawning Angel <yawning(a)torproject.org> Date: Wed Aug 27 12:26:09 2014 +0000 Change the TYPE_PRNG_SEED length to 24. This matches what the code actually sends. It's shorter than the ScrambleSuit PRNG seed, but that's because the SipHash-2-4 based Hash_DRBG has 24 bytes of internal state (key + initial output). --- doc/obfs4-spec.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/obfs4-spec.txt b/doc/obfs4-spec.txt index d2aa859..0e844a1 100644 --- a/doc/obfs4-spec.txt +++ b/doc/obfs4-spec.txt @@ -104,7 +104,7 @@ Length of the ntor AUTH tag (A HMAC-SHA256 digest). - InlineSeedFrameLength = 53 + InlineSeedFrameLength = 45 Length of a unpadded TYPE_PRNG_SEED frame. @@ -144,7 +144,7 @@ The amount of padding is chosen such that the smallest possible request and response (requests and responses with the minimum amount of padding) are - equal in size. For details on the InlineSeedFrameLength, see section 7. + equal in size. For details on the InlineSeedFrameLength, see section 6. The client handshake process is as follows. @@ -282,7 +282,7 @@ TYPE_PRNG_SEED (0x01): The entire payload is to be treated as seeding material for the - protocol polymorphism PRNG. The format is 32 bytes of seeding + protocol polymorphism PRNG. The format is 24 bytes of seeding material. Implementations SHOULD ignore unknown packet types for the purposes of

1 0

[translation/tor-launcher-network-settings_completed] Update translations for tor-launcher-network-settings_completed
by translation＠torproject.org 27 Aug '14

27 Aug '14

commit 69b777f2dc861803b72863a020e3e12ad47da0a8 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Aug 27 12:15:51 2014 +0000 Update translations for tor-launcher-network-settings_completed --- tr/network-settings.dtd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tr/network-settings.dtd b/tr/network-settings.dtd index 4b0de44..6642c29 100644 --- a/tr/network-settings.dtd +++ b/tr/network-settings.dtd @@ -8,8 +8,8 @@ <!ENTITY torSettings.no "Hayır"> <!ENTITY torSettings.firstQuestion "Aşağıdakilerden hangisi durumunuzu en iyi açıklıyor?"> -<!ENTITY torSettings.configurePrompt1 "Bu bilgisayarın internet bağlantısı sansürlü yada vekil sunucu arkasında."> -<!ENTITY torSettings.configurePrompt2 "Köprü yada vekil sunucu ayarlarını yapılandırmam gerekli."> +<!ENTITY torSettings.configurePrompt1 "Bu bilgisayarın internet bağlantısı sansürlü veya vekil sunucu arkasında."> +<!ENTITY torSettings.configurePrompt2 "Köprü veya vekil sunucu ayarlarını yapılandırmam gerekli."> <!ENTITY torSettings.configure "Yapılandır"> <!ENTITY torSettings.connectPrompt2 "Doğrudan Tor ağına bağlanmak istiyorum"> <!ENTITY torSettings.connectPrompt3 "Bu çoğu durumda çalışır.">

1 0