September 2014 - tor-commits - lists.torproject.org

[tor/master] changes file for 7733
by nickm＠torproject.org 22 Sep '14

22 Sep '14

commit 01b23a6d49f039d831074ead18dfd38548809a7d Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 22 10:39:51 2014 -0400 changes file for 7733 --- changes/bug7733a | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/changes/bug7733a b/changes/bug7733a new file mode 100644 index 0000000..183c009 --- /dev/null +++ b/changes/bug7733a @@ -0,0 +1,4 @@ + o Minor bugfixes: + - When a bridge has been configured without an identity digest + (not recommended), avoid launching an extra channel to it when + bootstrapping. Fixes bug 7733; bugfix on 0.2.4.4-alpha.

1 0

[tor/master] Add changes file for #13196.
by nickm＠torproject.org 22 Sep '14

22 Sep '14

commit 2f47ab247af79203ba08dec718306c416db41372 Author: intrigeri <intrigeri(a)boum.org> Date: Fri Sep 19 16:07:31 2014 +0000 Add changes file for #13196. Note that this will likely need to be folded with the changes file for #12751, as this change is a mere fixup on top of the changes introduced for #12751. --- changes/bug13196-systemd-writable-run-directory | 3 +++ 1 file changed, 3 insertions(+) diff --git a/changes/bug13196-systemd-writable-run-directory b/changes/bug13196-systemd-writable-run-directory new file mode 100644 index 0000000..737c354 --- /dev/null +++ b/changes/bug13196-systemd-writable-run-directory @@ -0,0 +1,3 @@ + o Distribution: + - systemd unit file: set up /var/run/tor as writable for the Tor service. + Patch by intrigeri; resolves ticket 13196.

1 0

[tor/master] systemd unit file: set up /var/run/tor as writable for the Tor service.
by nickm＠torproject.org 22 Sep '14

22 Sep '14

commit da384090f752ab9eb46dc60728be8bfa11e8cb37 Author: intrigeri <intrigeri(a)boum.org> Date: Fri Sep 19 16:04:59 2014 +0000 systemd unit file: set up /var/run/tor as writable for the Tor service. For some strange reason, this was not needed with systemd v208. But it's needed with systemd v215 on current Debian sid, and entirely makes sense. --- contrib/dist/tor.service.in | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/dist/tor.service.in b/contrib/dist/tor.service.in index 20ceecf..57409a7 100644 --- a/contrib/dist/tor.service.in +++ b/contrib/dist/tor.service.in @@ -22,6 +22,7 @@ InaccessibleDirectories = /home ReadOnlyDirectories = / ReadWriteDirectories = @LOCALSTATEDIR@/lib/tor ReadWriteDirectories = @LOCALSTATEDIR@/log/tor +ReadWriteDirectories = @LOCALSTATEDIR@/run/tor NoNewPrivileges = yes [Install]

1 0

[tor/master] Merge remote-tracking branch 'intrigeri/bug13196-systemd-writable-run-directory'
by nickm＠torproject.org 22 Sep '14

22 Sep '14

commit bc758e4a5e10739d65eafa9ce2624c49859f317b Merge: 4c8b809 2f47ab2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Sep 22 10:31:24 2014 -0400 Merge remote-tracking branch 'intrigeri/bug13196-systemd-writable-run-directory' changes/bug13196-systemd-writable-run-directory | 3 +++ contrib/dist/tor.service.in | 1 + 2 files changed, 4 insertions(+)

1 0

[gitian-builder/tor-browser-builder-3] Bug 13215: Use 15GiB VM space if needed.
by gk＠torproject.org 22 Sep '14

22 Sep '14

commit e371d36c295a11bca2c6d3f59777f8a1177e4c14 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Sep 22 11:55:42 2014 +0000 Bug 13215: Use 15GiB VM space if needed. With Firefox ESR 31 10GiB is not enough anymore to build Tor Browser for 64 Bit Linux systems. We bump the upper limit to 15GiB in order to account for the additional capacity needed when starting with the hardened build series. --- bin/make-base-vm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/make-base-vm b/bin/make-base-vm index dccd237..cc5fe5b 100755 --- a/bin/make-base-vm +++ b/bin/make-base-vm @@ -99,7 +99,7 @@ if [ -e $OUT.qcow2 ]; then fi rm -rf $OUT -sudo vmbuilder kvm ubuntu --rootsize 10240 --arch=$ARCH --suite=$SUITE --addpkg=$addpkg --removepkg=$removepkg --ssh-key=var/id_dsa.pub --ssh-user-key=var/id_dsa.pub --mirror=$MIRROR --security-mirror=$SECURITY_MIRROR --dest=$OUT --flavour=$FLAVOUR --firstboot=`pwd`/target-bin/bootstrap-fixup +sudo vmbuilder kvm ubuntu --rootsize 15360 --arch=$ARCH --suite=$SUITE --addpkg=$addpkg --removepkg=$removepkg --ssh-key=var/id_dsa.pub --ssh-user-key=var/id_dsa.pub --mirror=$MIRROR --security-mirror=$SECURITY_MIRROR --dest=$OUT --flavour=$FLAVOUR --firstboot=`pwd`/target-bin/bootstrap-fixup mv $OUT/*.qcow2 $OUT.qcow2 rm -rf $OUT

1 0

[tor-browser-bundle/master] Bug 13031: Adding full RELRO protection on Linux.
by gk＠torproject.org 22 Sep '14

22 Sep '14

commit 71f2ed613d2b2ce6fb40ef27f99fd140b1b86517 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Sep 22 10:04:12 2014 +0000 Bug 13031: Adding full RELRO protection on Linux. Thanks to a patch by a cypherpunk we have now full RELRO protection when using gold as our linker. --- gitian/descriptors/linux/gitian-firefox.yml | 9 +++++++++ gitian/descriptors/linux/gitian-utils.yml | 6 +----- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/gitian/descriptors/linux/gitian-firefox.yml b/gitian/descriptors/linux/gitian-firefox.yml index 0cd4b28..509f63a 100644 --- a/gitian/descriptors/linux/gitian-firefox.yml +++ b/gitian/descriptors/linux/gitian-firefox.yml @@ -65,6 +65,15 @@ script: | export PATH=$INSTDIR/python/bin:$PATH # unzip -d $INSTDIR binutils-linux$GBUILD_BITS-utils.zip + # Make sure gold is used with the hardening wrapper for full RELRO, see + # #13031. + cd $INSTDIR/binutils/bin + rm ld + cp /usr/bin/hardened-ld ./ + mv ld.gold ld.gold.real + ln -sf hardened-ld ld.gold + ln -sf ld.gold ld + cd ~/build export PATH=$INSTDIR/binutils/bin:$PATH mkdir -p $INSTDIR/Browser/ mkdir -p $INSTDIR/Debug/Browser/components diff --git a/gitian/descriptors/linux/gitian-utils.yml b/gitian/descriptors/linux/gitian-utils.yml index ea122db..074076e 100644 --- a/gitian/descriptors/linux/gitian-utils.yml +++ b/gitian/descriptors/linux/gitian-utils.yml @@ -60,11 +60,7 @@ script: | ./configure --prefix=$INSTDIR/binutils --disable-multilib --enable-gold make $MAKEOPTS make install - # Make sure gold is used and not ld. - cd $INSTDIR/binutils/bin - rm ld - ln -sf ld.gold ld - cd ~/build + cd .. # Building Libevent cd libevent

1 0

[tor-browser-bundle/master] Update changelog file.
by gk＠torproject.org 22 Sep '14

22 Sep '14

commit 8c01d6bb195d38d3e236c5ff746b7bf7dc1c5562 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Sep 22 10:07:10 2014 +0000 Update changelog file. --- Bundle-Data/Docs/ChangeLog.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index bd49d11..24fb9b1 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 4.0-alpha-3 -- Sep 21 2014 +Tor Browser 4.0-alpha-3 -- Sep 24 2014 * All Platforms * Update Tor to 0.2.5.7-rc * Update meek to 0.11 @@ -10,6 +10,7 @@ Tor Browser 4.0-alpha-3 -- Sep 21 2014 * Bug 13047: Updater should not send Kernel and GTK version * Linux: * Bug 9150: Make RPATH unavailable on Tor binary. + * Bug 13031: Add full RELRO protection. Tor Browser Bundle 4.0-alpha-2 -- Sep 2 2014 * All Platforms

1 0

[meek/master] Add Azure lines to client torrc.
by dcf＠torproject.org 22 Sep '14

22 Sep '14

commit 3c2d94194a3455971297cbff4e16911e9d2b3d71 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Sep 22 00:32:19 2014 -0700 Add Azure lines to client torrc. --- meek-client/torrc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meek-client/torrc b/meek-client/torrc index ec93d7b..0e2efec 100644 --- a/meek-client/torrc +++ b/meek-client/torrc @@ -8,8 +8,10 @@ UseBridges 1 Bridge meek 0.0.2.0:1 ClientTransportPlugin meek exec ./meek-client --url=https://meek-reflect.appspot.com/ --front=www.google.com --log meek-client.log # ClientTransportPlugin meek exec ./meek-client --url=https://d2zfqthxsdq309.cloudfront.net/ --front=a0.awsstatic.com --log meek-client.log +# ClientTransportPlugin meek exec ./meek-client --url=https://az668014.vo.msecnd.net/ --front=ajax.aspnetcdn.com --log meek-client.log # With tor 0.2.5 you can do it this way: # Bridge meek 0.0.2.0:1 url=https://meek-reflect.appspot.com/ front=www.google.com # Bridge meek 0.0.2.0:2 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com +# Bridge meek 0.0.2.0:3 url=https://az668014.vo.msecnd.net/ front=ajax.aspnetcdn.com # ClientTransportPlugin meek exec ./meek-client --log meek-client.log

1 0

[meek/master] WSGI reflector.
by dcf＠torproject.org 22 Sep '14

22 Sep '14

commit e28a053e89b9fbdf83283203c26053a39fa72038 Author: David Fifield <david(a)bamsoftware.com> Date: Sun Sep 21 23:38:13 2014 -0700 WSGI reflector. --- README | 3 ++ wsgi/README | 10 +++++ wsgi/reflect.py | 121 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 134 insertions(+) diff --git a/README b/README index b216059..4348942 100644 --- a/README +++ b/README @@ -63,6 +63,9 @@ A php reflector similar to the appengine one above. Ideally, it can be run on any platform that supports php. A public instance is at: https://meek-reflect.herokuapp.com/ +wsgi: +A WSGI Python reflector. + To the extent possible under law, the authors have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any diff --git a/wsgi/README b/wsgi/README new file mode 100644 index 0000000..a0e55b2 --- /dev/null +++ b/wsgi/README @@ -0,0 +1,10 @@ +This is a reflector program using Python and WSGI. The application +string to put in your WSGI configuration is "reflect.main". + +To test locally, run: + python reflect.py + +It will listen on port 8000. Configure tor as: + UseBridges 1 + Bridge meek 0.0.2.0:1 + ClientTransportPlugin meek exec ./meek-client --url=http://127.0.0.1:8000/ diff --git a/wsgi/reflect.py b/wsgi/reflect.py new file mode 100644 index 0000000..be62b1a --- /dev/null +++ b/wsgi/reflect.py @@ -0,0 +1,121 @@ +# WSGI: https://www.python.org/dev/peps/pep-3333/ + +import httplib +import urlparse + +FORWARD_URL = "http://meek.bamsoftware.com:7002/" +TIMEOUT = 20 +BUFSIZ = 2048 + +REFLECTED_HEADER_FIELDS = [ + "X-Session-Id", +] + +# Limits a file-like object to reading only n bytes. Used to keep limit +# wsgi.input to the Content-Length, otherwise it blocks. +class LimitedReader(object): + def __init__(self, f, n): + self.f = f + self.n = n + + def __getattr__(self, name): + return getattr(self.f, name) + + def read(self, size=None): + if self.n <= 0: + return "" + if size is not None and size > self.n: + size = self.n + data = self.f.read(size) + self.n -= len(data) + return data + +# Join two URL paths. +def path_join(a, b): + if a.endswith("/"): + a = a[:-1] + if not b.startswith("/"): + b = "/" + b + return a + b + +def get_header(environ, name): + if name.lower() == "content-type": + envar = "CONTENT_TYPE" + elif name.lower() == "content-length": + envar = "CONTENT_LENGTH" + else: + envar = "HTTP_" + name.replace("-", "_").upper() + return environ.get(envar) + +def copy_request(environ, url): + method = environ["REQUEST_METHOD"] + + # Append PATH_INFO to the path of url. + u = urlparse.urlsplit(url) + path = path_join(u.path, environ["PATH_INFO"]) + url = urlparse.urlunsplit((u.scheme, u.netloc, path, u.query, u.fragment)) + + headers = [] + + content_length = environ.get("CONTENT_LENGTH") + if content_length: + body = LimitedReader(environ["wsgi.input"], int(content_length)) + headers.append(("Content-Length", content_length)) + else: + body = "" + + for name in REFLECTED_HEADER_FIELDS: + value = get_header(environ, name) + if value is not None: + headers.append((name, value)) + headers = dict(headers) + + return method, url, body, headers + +def make_conn(url): + u = urlparse.urlsplit(url) + create_connection = httplib.HTTPConnection + if u.scheme == "https": + create_connection = httplib.HTTPSConnection + return create_connection(u.hostname, u.port, strict=True, timeout=TIMEOUT) + +def make_request(conn, method, url, body, headers): + u = urlparse.urlsplit(url) + path = urlparse.urlunsplit(("", "", u.path, u.query, "")) + conn.request(method, path, body, headers) + return conn.getresponse() + +def main(environ, start_response): + try: + method, url, body, headers = copy_request(environ, FORWARD_URL) + except Exception, e: + start_response("400 Bad Request", [("Content-Type", "text/plain; charset=utf-8")]) + yield "Bad Request" + return + try: + conn = make_conn(url) + resp = make_request(conn, method, url, body, headers) + except Exception, e: + start_response("500 Internal Server Error", [("Content-Type", "text/plain; charset=utf-8")]) + yield "Internal Server Error" + return + + headers = [] + for name in REFLECTED_HEADER_FIELDS: + value = resp.getheader(name) + if value is not None: + headers.append((name, value)) + + start_response("%d %s" % (resp.status, resp.reason), headers) + while True: + data = resp.read(BUFSIZ) + if not data: + break + yield data + + conn.close() + +if __name__ == "__main__": + import wsgiref.simple_server + server = wsgiref.simple_server.make_server("127.0.0.1", 8000, main) + server.serve_forever()

1 0

[translation/https_everywhere_completed] Update translations for https_everywhere_completed
by translation＠torproject.org 22 Sep '14

22 Sep '14

commit 42e22352ec3c9ca21ad2176e27913d36afeef60a Author: Translation commit bot <translation(a)torproject.org> Date: Mon Sep 22 06:15:18 2014 +0000 Update translations for https_everywhere_completed --- th/ssl-observatory.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/th/ssl-observatory.dtd b/th/ssl-observatory.dtd index 2df9a1e..ddc3efc 100644 --- a/th/ssl-observatory.dtd +++ b/th/ssl-observatory.dtd @@ -53,7 +53,7 @@ to turn it on?">--> <!ENTITY ssl-observatory.prefs.done "เสร็จสิ้น"> <!ENTITY ssl-observatory.prefs.explanation -"็็HTTPS Everywhere ใช้ SSL Observatory ของ EFF ซึ่งทำสองอย่าง +"HTTPS Everywhere ใช้ SSL Observatory ของ EFF ซึ่งทำสองอย่าง (1) ส่งใบรับรอง HTTPS ไปที่ Observatory เพื่อที่จะช่วยตรวจจับ 'การโจมตีแบบคนกลาง' เพิ่มความปลอดภัยของเว็บ และ (2)

1 0