January 2015 - tor-commits - lists.torproject.org

[tor/master] Tweak tor-resolve docs and logs
by nickm＠torproject.org 28 Jan '15

28 Jan '15

commit f75ca04520f9494e10ea8c4a5de584270efa3462 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 28 10:11:08 2015 -0500 Tweak tor-resolve docs and logs Resolves 14325 --- changes/ticket14325 | 5 +++++ doc/tor-resolve.1.txt | 5 ++++- src/tools/tor-resolve.c | 27 ++++++++++++++++----------- 3 files changed, 25 insertions(+), 12 deletions(-) diff --git a/changes/ticket14325 b/changes/ticket14325 new file mode 100644 index 0000000..38daa05 --- /dev/null +++ b/changes/ticket14325 @@ -0,0 +1,5 @@ + o Documentation fixes: + - Make the tor-resolve documentation match its help string and its + options. Resolves part of ticket 14325. + - Log a more useful error message from tor-resolve when failing to + look up a hidden service address. Resolves part of ticket 14325. diff --git a/doc/tor-resolve.1.txt b/doc/tor-resolve.1.txt index 341d302..30e16d5 100644 --- a/doc/tor-resolve.1.txt +++ b/doc/tor-resolve.1.txt @@ -14,7 +14,7 @@ tor-resolve - resolve a hostname to an IP address via tor SYNOPSIS -------- -**tor-resolve** [-4|-5] [-v] [-x] __hostname__ [__sockshost__[:__socksport__]] +**tor-resolve** [-4|-5] [-v] [-x] [-p __socksport__] __hostname__ [__sockshost__[:__socksport__]] DESCRIPTION ----------- @@ -40,6 +40,9 @@ OPTIONS Use the SOCKS4a protocol rather than the default SOCKS5 protocol. Doesn't support reverse DNS. +**-p** __socksport__:: + Override the default SOCKS port without setting the hostname. + SEE ALSO -------- **tor**(1), **torify**(1). + diff --git a/src/tools/tor-resolve.c b/src/tools/tor-resolve.c index e6eadf1..04815a6 100644 --- a/src/tools/tor-resolve.c +++ b/src/tools/tor-resolve.c @@ -108,6 +108,18 @@ build_socks_resolve_request(char **out, return len; } +static void +onion_warning(const char *hostname) +{ + log_warn(LD_NET, + "%s is a hidden service; those don't have IP addresses. " + "You can use the AutomapHostsOnResolve option to have Tor return a " + "fake address for hidden services. Or you can have your " + "application send the address to Tor directly; we recommend an " + "application that uses SOCKS 5 with hostnames.", + hostname); +} + /** Given a len-byte SOCKS4a response in response, set * *addr_out to the address it contains (in host order). * Return 0 on success, -1 on error. @@ -137,10 +149,7 @@ parse_socks4a_resolve_response(const char *hostname, if (status != 90) { log_warn(LD_NET,"Got status response '%d': socks request failed.", status); if (!strcasecmpend(hostname, ".onion")) { - log_warn(LD_NET, - "%s is a hidden service; those don't have IP addresses. " - "To connect to a hidden service, you need to send the hostname " - "to Tor; we suggest an application that uses SOCKS 4a.",hostname); + onion_warning(hostname); return -1; } return -1; @@ -276,11 +285,7 @@ do_resolve(const char *hostname, uint32_t sockshost, uint16_t socksport, (unsigned)reply_buf[1], socks5_reason_to_string(reply_buf[1])); if (reply_buf[1] == 4 && !strcasecmpend(hostname, ".onion")) { - log_warn(LD_NET, - "%s is a hidden service; those don't have IP addresses. " - "To connect to a hidden service, you need to send the hostname " - "to Tor; we suggest an application that uses SOCKS 4a.", - hostname); + onion_warning(hostname); } goto err; } @@ -326,8 +331,8 @@ do_resolve(const char *hostname, uint32_t sockshost, uint16_t socksport, static void usage(void) { - puts("Syntax: tor-resolve [-4] [-v] [-x] [-F] [-p port] " - "hostname [sockshost:socksport]"); + puts("Syntax: tor-resolve [-4] [-5] [-v] [-x] [-F] [-p port] " + "hostname [sockshost[:socksport]]"); exit(1); }

1 0

[tor/master] Bump a client authorization message from debug to info.
by nickm＠torproject.org 28 Jan '15

28 Jan '15

commit 20d0b1a04e0949c1bb46858c117947131ee448e1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jan 28 09:42:28 2015 -0500 Bump a client authorization message from debug to info. A user wants this for 14015, and it seems fairly reasonable. --- changes/feature14015 | 3 +++ src/or/rendservice.c | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/changes/feature14015 b/changes/feature14015 new file mode 100644 index 0000000..bd09b49 --- /dev/null +++ b/changes/feature14015 @@ -0,0 +1,3 @@ + o Minor features (logging, hidden services): + - Elevate authorized-client message from DEBUG to INFO. Closes + ticket 14015. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 5a12d07..588d1bf 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -1070,8 +1070,8 @@ rend_check_authorization(rend_service_t *service, } /* Allow the request. */ - log_debug(LD_REND, "Client %s authorized for service %s.", - auth_client->client_name, service->service_id); + log_info(LD_REND, "Client %s authorized for service %s.", + auth_client->client_name, service->service_id); return 1; }

1 0

[translation/https_everywhere_completed] Update translations for https_everywhere_completed
by translation＠torproject.org 28 Jan '15

28 Jan '15

commit dad434d1168c1f17dd0593f1c00e10d1aa8a3a7b Author: Translation commit bot <translation(a)torproject.org> Date: Wed Jan 28 14:15:20 2015 +0000 Update translations for https_everywhere_completed --- hr_HR/ssl-observatory.dtd | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/hr_HR/ssl-observatory.dtd b/hr_HR/ssl-observatory.dtd index c5adb70..67e2810 100644 --- a/hr_HR/ssl-observatory.dtd +++ b/hr_HR/ssl-observatory.dtd @@ -1,5 +1,5 @@  -<!ENTITY ssl-observatory.popup.details "Pojedinosti i informacije privatnosti"> +<!ENTITY ssl-observatory.popup.details "Pojedinosti i informacije o privatnosti"> <!ENTITY ssl-observatory.popup.later "Pitaj me kasnije"> <!ENTITY ssl-observatory.popup.no "Ne"> @@ -20,16 +20,17 @@ to turn it on?">-->  <!ENTITY ssl-observatory.prefs.adv_priv_opts1 -"Sigurnije je da omogućite ovo, osim ako koristite jako ometajuću korporativnu mrežu:"> +"Sigurno je omogućiti ovo, osim ako koristite jako +ometajuću korporativnu mrežu:"> <!ENTITY ssl-observatory.prefs.adv_priv_opts2 -"Sigurno, osim ako koristite korporativnu mrežu sa tajnim internet nazivima poslužitelja:"> +"Sigurno, osim ako koristite korporativnu mrežu sa tajnim intranet nazivima poslužitelja:"> <!ENTITY ssl-observatory.prefs.alt_roots -"Prijavi i provjeri certifikate potpisanim od ne-standardnih korijenskih certifikata"> +"Podnesi i provjeri certifikate potpisane od ne-standardnih root CA-ova"> <!ENTITY ssl-observatory.prefs.alt_roots_tooltip -"Sigurno je (i dobra je ideja) da omogućite ovu mogućnost, osim ako koristite ometajuću korporativnu mrežu ili Kaspersky antivirusni softver koji nadgleda vaše surfanje sa TLS proxyjem i privatnim korijenskim certifikatima ovlasti. Ako je omogućeno na takvoj mreži, ova mogućnost bi mogla objaviti dokaz koja https:// domena je bila posjećena kroz taj proxy, zbog jedinstvenog certifikata kojeg bi proizvela. Stoga je zadano, ostavljena isključena."> +"Sigurno je (i dobra je ideja) omogućiti ovu opciju, osim ako koristite ometajuću korporativnu mrežu ili Kaspersky antivirusni software koji nadgleda vaše surfanje s TLS proxy-em i privatnim root CA-ovima. Ako je omogućeno na takvoj mreži, ova mogućnost bi mogla objaviti dokaz koja https:// domena je bila posjećena kroz taj proxy, zbog jedinstvenog certifikata kojeg bi proizvela. Stoga je zadano ostavljena isključena."> <!ENTITY ssl-observatory.prefs.anonymous "Provjeri certifikate koristeći Tor za anonimnost"> <!ENTITY ssl-observatory.prefs.anonymous_unavailable

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 28 Jan '15

28 Jan '15

commit edcffae42d94cd2429fdc8e4738c05ea2d412682 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Jan 28 14:15:13 2015 +0000 Update translations for https_everywhere --- hr_HR/ssl-observatory.dtd | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/hr_HR/ssl-observatory.dtd b/hr_HR/ssl-observatory.dtd index c5adb70..67e2810 100644 --- a/hr_HR/ssl-observatory.dtd +++ b/hr_HR/ssl-observatory.dtd @@ -1,5 +1,5 @@  -<!ENTITY ssl-observatory.popup.details "Pojedinosti i informacije privatnosti"> +<!ENTITY ssl-observatory.popup.details "Pojedinosti i informacije o privatnosti"> <!ENTITY ssl-observatory.popup.later "Pitaj me kasnije"> <!ENTITY ssl-observatory.popup.no "Ne"> @@ -20,16 +20,17 @@ to turn it on?">-->  <!ENTITY ssl-observatory.prefs.adv_priv_opts1 -"Sigurnije je da omogućite ovo, osim ako koristite jako ometajuću korporativnu mrežu:"> +"Sigurno je omogućiti ovo, osim ako koristite jako +ometajuću korporativnu mrežu:"> <!ENTITY ssl-observatory.prefs.adv_priv_opts2 -"Sigurno, osim ako koristite korporativnu mrežu sa tajnim internet nazivima poslužitelja:"> +"Sigurno, osim ako koristite korporativnu mrežu sa tajnim intranet nazivima poslužitelja:"> <!ENTITY ssl-observatory.prefs.alt_roots -"Prijavi i provjeri certifikate potpisanim od ne-standardnih korijenskih certifikata"> +"Podnesi i provjeri certifikate potpisane od ne-standardnih root CA-ova"> <!ENTITY ssl-observatory.prefs.alt_roots_tooltip -"Sigurno je (i dobra je ideja) da omogućite ovu mogućnost, osim ako koristite ometajuću korporativnu mrežu ili Kaspersky antivirusni softver koji nadgleda vaše surfanje sa TLS proxyjem i privatnim korijenskim certifikatima ovlasti. Ako je omogućeno na takvoj mreži, ova mogućnost bi mogla objaviti dokaz koja https:// domena je bila posjećena kroz taj proxy, zbog jedinstvenog certifikata kojeg bi proizvela. Stoga je zadano, ostavljena isključena."> +"Sigurno je (i dobra je ideja) omogućiti ovu opciju, osim ako koristite ometajuću korporativnu mrežu ili Kaspersky antivirusni software koji nadgleda vaše surfanje s TLS proxy-em i privatnim root CA-ovima. Ako je omogućeno na takvoj mreži, ova mogućnost bi mogla objaviti dokaz koja https:// domena je bila posjećena kroz taj proxy, zbog jedinstvenog certifikata kojeg bi proizvela. Stoga je zadano ostavljena isključena."> <!ENTITY ssl-observatory.prefs.anonymous "Provjeri certifikate koristeći Tor za anonimnost"> <!ENTITY ssl-observatory.prefs.anonymous_unavailable

1 0

[tor-browser-bundle/master] Fix stupid LOGSENDER bug.
by gk＠torproject.org 28 Jan '15

28 Jan '15

commit cb718087cb08049ea3f672ac0461d7a1055ed267 Author: Linus Nordberg <linus(a)torproject.org> Date: Wed Jan 28 14:07:26 2015 +0100 Fix stupid LOGSENDER bug. --- tools/continuous-builds/build-tbb.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/continuous-builds/build-tbb.sh b/tools/continuous-builds/build-tbb.sh index 271f1ec..434d61b 100755 --- a/tools/continuous-builds/build-tbb.sh +++ b/tools/continuous-builds/build-tbb.sh @@ -73,6 +73,6 @@ else ../../gitian-builder/var/build.log \ ../../gitian-builder/var/target.log" tail -n 50 $FILES | $MAILX -E -s "Nightly build failure -- $(date +%F)" \ - $sender -- $LOGRECIPIENTS + $LOGSENDER -- $LOGRECIPIENTS fi fi

1 0

[tor-browser-bundle/master] Merge remote-tracking branch 'linus/stupid-sender-bug'
by gk＠torproject.org 28 Jan '15

28 Jan '15

commit 437e1beec2207dca79c2917b55b6f3a468150d7f Merge: e64e8d5 cb71808 Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jan 28 14:12:22 2015 +0000 Merge remote-tracking branch 'linus/stupid-sender-bug' tools/continuous-builds/build-tbb.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[tor-browser-bundle/maint-4.0] Bug #14420: Remove old auth cruft from fetch-inputs.sh
by gk＠torproject.org 28 Jan '15

28 Jan '15

commit d4cfa02d22cefb43a5b66e6f0d10a876a78a3b33 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Jan 27 08:03:44 2015 -0800 Bug #14420: Remove old auth cruft from fetch-inputs.sh --- gitian/fetch-inputs.sh | 44 ++------------------------------------------ 1 file changed, 2 insertions(+), 42 deletions(-) diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index ef4dbf7..d4eee57 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -111,30 +111,13 @@ update_git() { } ############################################################################## -# Get package files from mirror - # Get+verify sigs that exist -for i in OPENSSL # OBFSPROXY -do - PACKAGE="${i}_PACKAGE" - URL="${MIRROR_URL}${!PACKAGE}" - SUFFIX="asc" - get "${!PACKAGE}" "$URL" - get "${!PACKAGE}.$SUFFIX" "$URL.$SUFFIX" - - if ! verify "${!PACKAGE}" "$WRAPPER_DIR/gpg/$i.gpg" $SUFFIX; then - echo "$i: GPG signature is broken for ${URL}" - mv "${!PACKAGE}" "${!PACKAGE}.badgpg" - exit 1 - fi -done - -for i in BINUTILS GCC PYTHON PYCRYPTO M2CRYPTO PYTHON_MSI GMP LXML +for i in OPENSSL BINUTILS GCC PYTHON PYCRYPTO M2CRYPTO PYTHON_MSI GMP LXML do PACKAGE="${i}_PACKAGE" URL="${i}_URL" if [ "${i}" == "PYTHON" -o "${i}" == "PYCRYPTO" -o "${i}" == "M2CRYPTO" -o \ - "${i}" == "PYTHON_MSI" -o "${i}" == "LXML" ]; then + "${i}" == "PYTHON_MSI" -o "${i}" == "LXML" -o "${i}" == "OPENSSL" ]; then SUFFIX="asc" else SUFFIX="sig" @@ -179,29 +162,6 @@ do get "${!PACKAGE}" "${!URL}" done -# Verify packages with weak or no signatures via multipath downloads -# (OpenSSL is signed with MD5, and OSXSDK is not signed at all) -# XXX: Google won't allow wget -N.. We need to re-download the whole -# TOOLCHAIN4 each time. Rely only on SHA256 for now.. -mkdir -p verify -cd verify -for i in OPENSSL OSXSDK -do - URL="${i}_URL" - PACKAGE="${i}_PACKAGE" - if ! wget -U "" -N --no-remove-listing "${!URL}"; then - echo "$i url ${!URL} is broken!" - mv "${!PACKAGE}" "${!PACKAGE}.removed" - exit 1 - fi - if ! diff "${!PACKAGE}" "../${!PACKAGE}"; then - echo "Package ${!PACKAGE} differs from our mirror's version!" - exit 1 - fi -done - -cd .. - # NoScript and HTTPS-Everywhere are magikal and special: wget -U "" -N ${NOSCRIPT_URL} wget -U "" -N ${HTTPSE_URL}

1 0

[tor-browser-bundle/maint-4.0] Bug 14420: Also verify OpenSSL during tag check.
by gk＠torproject.org 28 Jan '15

28 Jan '15

commit 7082e1ff92942409eea40a7d19b5bba25a9a0272 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Jan 27 09:30:00 2015 -0800 Bug 14420: Also verify OpenSSL during tag check. --- gitian/verify-tags.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index b7a89f1..c9e9a0f 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -116,12 +116,12 @@ faketime $FAKETIME_TAG EOF # Verify signatures on signed packages -for i in BINUTILS GCC PYTHON PYCRYPTO M2CRYPTO PYTHON_MSI GMP LXML +for i in OPENSSL BINUTILS GCC PYTHON PYCRYPTO M2CRYPTO PYTHON_MSI GMP LXML do PACKAGE="${i}_PACKAGE" URL="${i}_URL" if [ "${i}" == "PYTHON" -o "${i}" == "PYCRYPTO" -o "${i}" == "M2CRYPTO" -o \ - "${i}" == "PYTHON_MSI" -o "${i}" == "LXML" ]; then + "${i}" == "PYTHON_MSI" -o "${i}" == "LXML" -o "${i}" == "OPENSSL" ]; then SUFFIX="asc" else SUFFIX="sig"

1 0

[tor-browser-bundle/master] Bug 14420: Also verify OpenSSL during tag check.
by gk＠torproject.org 28 Jan '15

28 Jan '15

commit e64e8d53b511525671d83d6d3631f82388b5e7bc Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Jan 27 09:30:00 2015 -0800 Bug 14420: Also verify OpenSSL during tag check. --- gitian/verify-tags.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gitian/verify-tags.sh b/gitian/verify-tags.sh index 55bb857..df30143 100755 --- a/gitian/verify-tags.sh +++ b/gitian/verify-tags.sh @@ -120,12 +120,12 @@ goxcrypto $GO_X_CRYPTO_TAG EOF # Verify signatures on signed packages -for i in BINUTILS GCC PYTHON PYCRYPTO M2CRYPTO PYTHON_MSI GMP LXML +for i in OPENSSL BINUTILS GCC PYTHON PYCRYPTO M2CRYPTO PYTHON_MSI GMP LXML do PACKAGE="${i}_PACKAGE" URL="${i}_URL" if [ "${i}" == "PYTHON" -o "${i}" == "PYCRYPTO" -o "${i}" == "M2CRYPTO" -o \ - "${i}" == "PYTHON_MSI" -o "${i}" == "LXML" ]; then + "${i}" == "PYTHON_MSI" -o "${i}" == "LXML" -o "${i}" == "OPENSSL" ]; then SUFFIX="asc" else SUFFIX="sig"

1 0

[tor-browser-bundle/master] Bug #14420: Remove old auth cruft from fetch-inputs.sh
by gk＠torproject.org 28 Jan '15

28 Jan '15

commit 9a8c0663abb0359b743865bca24b22316bb16fac Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Tue Jan 27 08:05:16 2015 -0800 Bug #14420: Remove old auth cruft from fetch-inputs.sh --- gitian/fetch-inputs.sh | 44 ++------------------------------------------ 1 file changed, 2 insertions(+), 42 deletions(-) diff --git a/gitian/fetch-inputs.sh b/gitian/fetch-inputs.sh index 3311547..fdbbc69 100755 --- a/gitian/fetch-inputs.sh +++ b/gitian/fetch-inputs.sh @@ -112,30 +112,13 @@ update_git() { } ############################################################################## -# Get package files from mirror - # Get+verify sigs that exist -for i in OPENSSL # OBFSPROXY -do - PACKAGE="${i}_PACKAGE" - URL="${MIRROR_URL}${!PACKAGE}" - SUFFIX="asc" - get "${!PACKAGE}" "$URL" - get "${!PACKAGE}.$SUFFIX" "$URL.$SUFFIX" - - if ! verify "${!PACKAGE}" "$WRAPPER_DIR/gpg/$i.gpg" $SUFFIX; then - echo "$i: GPG signature is broken for ${URL}" - mv "${!PACKAGE}" "${!PACKAGE}.badgpg" - exit 1 - fi -done - -for i in BINUTILS GCC PYTHON PYCRYPTO M2CRYPTO PYTHON_MSI GMP LXML +for i in OPENSSL BINUTILS GCC PYTHON PYCRYPTO M2CRYPTO PYTHON_MSI GMP LXML do PACKAGE="${i}_PACKAGE" URL="${i}_URL" if [ "${i}" == "PYTHON" -o "${i}" == "PYCRYPTO" -o "${i}" == "M2CRYPTO" -o \ - "${i}" == "PYTHON_MSI" -o "${i}" == "LXML" ]; then + "${i}" == "PYTHON_MSI" -o "${i}" == "LXML" -o "${i}" == "OPENSSL" ]; then SUFFIX="asc" else SUFFIX="sig" @@ -189,29 +172,6 @@ do get "${!PACKAGE}" "${MIRROR_URL_YAWNING}${!PACKAGE}" done -# Verify packages with weak or no signatures via multipath downloads -# (OpenSSL is signed with MD5, and OSXSDK is not signed at all) -# XXX: Google won't allow wget -N.. We need to re-download the whole -# TOOLCHAIN4 each time. Rely only on SHA256 for now.. -mkdir -p verify -cd verify -for i in OPENSSL OSXSDK -do - URL="${i}_URL" - PACKAGE="${i}_PACKAGE" - if ! wget -U "" -N --no-remove-listing "${!URL}"; then - echo "$i url ${!URL} is broken!" - mv "${!PACKAGE}" "${!PACKAGE}.removed" - exit 1 - fi - if ! diff "${!PACKAGE}" "../${!PACKAGE}"; then - echo "Package ${!PACKAGE} differs from our mirror's version!" - exit 1 - fi -done - -cd .. - # NoScript and HTTPS-Everywhere are magikal and special: wget -U "" -N ${NOSCRIPT_URL} wget -U "" -N ${HTTPSE_URL}

1 0