January 2015 - tor-commits - lists.torproject.org

[tor-browser-bundle/master] Fix Changelog
by gk＠torproject.org 20 Jan '15

20 Jan '15

commit df55f898a05620110275c3e6e72c3cfbc54aca3d Author: Georg Koppen <gk(a)torproject.org> Date: Tue Jan 20 11:36:02 2015 +0000 Fix Changelog --- Bundle-Data/Docs/ChangeLog.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Bundle-Data/Docs/ChangeLog.txt b/Bundle-Data/Docs/ChangeLog.txt index 7416e0c..2dd58e7 100644 --- a/Bundle-Data/Docs/ChangeLog.txt +++ b/Bundle-Data/Docs/ChangeLog.txt @@ -1,4 +1,4 @@ -Tor Browser 4.5-alpha-3 -- Jan 16 2015 +Tor Browser 4.5a3 -- Jan 19 2015 * All Platforms * Update Firefox to 31.4.0esr * Update Tor to 0.2.6.2-alpha @@ -16,6 +16,7 @@ Tor Browser 4.5-alpha-3 -- Jan 16 2015 * Bug 13671: Fixup for circuit display if bridges are used * Translation updates * Update Tor Launcher to 0.2.7.1 + * Bug 14122: Hide logo if TOR_HIDE_BROWSER_LOGO set * Translation updates * Bug 13379: Sign our MAR files * Bug 13788: Fix broken meek in 4.5-alpha series

1 0

[metrics-web/master] Change MiB/s to the more common Gbit/s.
by karsten＠torproject.org 20 Jan '15

20 Jan '15

commit 7ad2f025ae9516c8db75959fec4d5569ffd1e192 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Tue Jan 20 08:57:46 2015 +0100 Change MiB/s to the more common Gbit/s. Suggested by Sebastian Urbach and grarpamp. Implements #14257. --- website/rserve/graphs.R | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/website/rserve/graphs.R b/website/rserve/graphs.R index d546127..022aa12 100644 --- a/website/rserve/graphs.R +++ b/website/rserve/graphs.R @@ -440,15 +440,15 @@ plot_bandwidth <- function(start, end, path) { date_breaks <- date_breaks( as.numeric(max(as.Date(bandwidth$date, "%Y-%m-%d")) - min(as.Date(bandwidth$date, "%Y-%m-%d")))) - ggplot(bandwidth, aes(x = as.Date(date, "%Y-%m-%d"), y = value / 2^20, - colour = variable)) + + ggplot(bandwidth, aes(x = as.Date(date, "%Y-%m-%d"), + y = value * 8 / 1e9, colour = variable)) + geom_line(size = 1) + scale_x_date(name = paste("\nThe Tor Project - ", "https://metrics.torproject.org/", sep = ""), format = date_breaks$format, major = date_breaks$major, minor = date_breaks$minor) + - scale_y_continuous(name="Bandwidth (MiB/s)", - limits = c(0, max(bandwidth$value, na.rm = TRUE) / 2^20)) + + scale_y_continuous(name = "Bandwidth (Gbit/s)", + limits = c(0, max(bandwidth$value, na.rm = TRUE) * 8 / 1e9)) + scale_colour_hue(name = "", h.start = 90, breaks = c("bwadv", "bwhist"), labels = c("Advertised bandwidth", "Bandwidth history")) + @@ -485,15 +485,15 @@ plot_bwhist_flags <- function(start, end, path) { date_breaks <- date_breaks( as.numeric(max(as.Date(bw$date, "%Y-%m-%d")) - min(as.Date(bw$date, "%Y-%m-%d")))) - ggplot(bw, aes(x = as.Date(date, "%Y-%m-%d"), y = value / 2^20, + ggplot(bw, aes(x = as.Date(date, "%Y-%m-%d"), y = value * 8 / 1e9, colour = variable)) + geom_line(size = 1) + scale_x_date(name = paste("\nThe Tor Project - ", "https://metrics.torproject.org/", sep = ""), format = date_breaks$format, major = date_breaks$major, minor = date_breaks$minor) + - scale_y_continuous(name="Bandwidth (MiB/s)", - limits = c(0, max(bw$value, na.rm = TRUE) / 2^20)) + + scale_y_continuous(name="Bandwidth (Gbit/s)", + limits = c(0, max(bw$value, na.rm = TRUE) * 8 / 1e9)) + scale_colour_manual(name = "", values = c("#E69F00", "#56B4E9", "#009E73", "#0072B2")) + opts(title = "Bandwidth history by relay flags", @@ -513,15 +513,15 @@ plot_dirbytes <- function(start, end, path) { date_breaks <- date_breaks( as.numeric(max(as.Date(dir$date, "%Y-%m-%d")) - min(as.Date(dir$date, "%Y-%m-%d")))) - ggplot(dir, aes(x = as.Date(date, "%Y-%m-%d"), y = value / 2^20, + ggplot(dir, aes(x = as.Date(date, "%Y-%m-%d"), y = value * 8 / 1e9, colour = variable)) + geom_line(size = 1) + scale_x_date(name = paste("\nThe Tor Project - ", "https://metrics.torproject.org/", sep = ""), format = date_breaks$format, major = date_breaks$major, minor = date_breaks$minor) + - scale_y_continuous(name="Bandwidth (MiB/s)", - limits = c(0, max(dir$value, na.rm = TRUE) / 2^20)) + + scale_y_continuous(name="Bandwidth (Gbit/s)", + limits = c(0, max(dir$value, na.rm = TRUE) * 8 / 1e9)) + scale_colour_hue(name = "", breaks = c("dirwrite", "dirread"), labels = c("Written dir bytes", "Read dir bytes")) + @@ -763,15 +763,15 @@ plot_bandwidth_flags <- function(start, end, path) { sep = "")), value = bandwidth$value) bandwidth$variable <- factor(bandwidth$variable, levels = levels(bandwidth$variable)[c(3, 4, 1, 2)]) - ggplot(bandwidth, aes(x = as.Date(date, "%Y-%m-%d"), y = value / 2^20, - colour = variable)) + + ggplot(bandwidth, aes(x = as.Date(date, "%Y-%m-%d"), + y = value * 8 / 1e9, colour = variable)) + geom_line(size = 1) + scale_x_date(name = paste("\nThe Tor Project - ", "https://metrics.torproject.org/", sep = ""), format = date_breaks$format, major = date_breaks$major, minor = date_breaks$minor) + - scale_y_continuous(name="Bandwidth (MiB/s)", - limits = c(0, max(bandwidth$value, na.rm = TRUE) / 2^20)) + + scale_y_continuous(name="Bandwidth (Gbit/s)", + limits = c(0, max(bandwidth$value, na.rm = TRUE) * 8 / 1e9)) + scale_colour_manual(name = "", values = c("#E69F00", "#D6C827", "#009E73", "#00C34F")) + opts(title = paste("Advertised bandwidth and bandwidth history by", @@ -941,7 +941,7 @@ plot_advbwdist_perc <- function(start, end, p, path) { "advbwdist.csv", sep = ""), stringsAsFactors = FALSE) t <- t[t$date >= start & t$date <= end & t$percentile %in% as.numeric(p), ] - t <- data.frame(date = t$date, advbw = t$advbw / 2^20, + t <- data.frame(date = t$date, advbw = t$advbw * 8 / 1e9, variable = ifelse(t$isexit != "t", "All relays", "Exits only"), percentile = as.factor(t$percentile)) @@ -955,7 +955,7 @@ plot_advbwdist_perc <- function(start, end, p, path) { "https://metrics.torproject.org/", sep = ""), format = date_breaks$format, major = date_breaks$major, minor = date_breaks$minor) + - scale_y_continuous(name = "Advertised bandwidth in MiB/s\n", + scale_y_continuous(name = "Advertised bandwidth in Gbit/s\n", limits = c(0, max(t$advbw, na.rm = TRUE))) + scale_colour_hue(name = "Percentile", breaks = rev(levels(t$percentile))) + @@ -968,7 +968,7 @@ plot_advbwdist_relay <- function(start, end, n, path) { t <- read.csv(paste("/srv/metrics.torproject.org/web/shared/stats/", "advbwdist.csv", sep = ""), stringsAsFactors = FALSE) t <- t[t$date >= start & t$date <= end & t$relay %in% as.numeric(n), ] - t <- data.frame(date = t$date, advbw = t$advbw / 2^20, + t <- data.frame(date = t$date, advbw = t$advbw * 8 / 1e9, variable = ifelse(t$isexit != "t", "All relays", "Exits only"), relay = as.factor(t$relay)) @@ -982,7 +982,7 @@ plot_advbwdist_relay <- function(start, end, n, path) { "https://metrics.torproject.org/", sep = ""), format = date_breaks$format, major = date_breaks$major, minor = date_breaks$minor) + - scale_y_continuous(name = "Advertised bandwidth in MiB/s\n", + scale_y_continuous(name = "Advertised bandwidth in Gbit/s\n", limits = c(0, max(t$advbw, na.rm = TRUE))) + scale_colour_hue(name = "n", breaks = levels(t$relay)) + opts(title = "Advertised bandwidth of n-th fastest relays\n")

1 0

[metrics-web/master] Add temporary note for changing bandwidth unit.
by karsten＠torproject.org 20 Jan '15

20 Jan '15

commit 90edbbe0e13aa35bdb0e79ba7380541121a05e5b Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Tue Jan 20 09:04:25 2015 +0100 Add temporary note for changing bandwidth unit. Related to #14257, to be reverted in a month or two. --- website/web/WEB-INF/advbwdist-perc.jsp | 4 +++- website/web/WEB-INF/advbwdist-relay.jsp | 4 +++- website/web/WEB-INF/bandwidth-flags.jsp | 4 +++- website/web/WEB-INF/bandwidth.jsp | 4 +++- website/web/WEB-INF/bwhist-flags.jsp | 4 +++- website/web/WEB-INF/dirbytes.jsp | 4 +++- 6 files changed, 18 insertions(+), 6 deletions(-) diff --git a/website/web/WEB-INF/advbwdist-perc.jsp b/website/web/WEB-INF/advbwdist-perc.jsp index c51902b..8b5352d 100644 --- a/website/web/WEB-INF/advbwdist-perc.jsp +++ b/website/web/WEB-INF/advbwdist-perc.jsp @@ -24,7 +24,9 @@ percentage of relays does not exceed (and that in turn the remaining relays either match or exceed). For example, 99% of relays advertise at most the bandwidth value shown in the 99th percentile line (and the remaining 1% advertise at least that -amount). +amount). +Note that the unit has recently changed from MiB/s to +Gbit/s. <img src="advbwdist-perc.png${advbwdist_perc_url}" width="576" height="360" alt="Advertised bandwidth distribution graph"> diff --git a/website/web/WEB-INF/advbwdist-relay.jsp b/website/web/WEB-INF/advbwdist-relay.jsp index 0de9400..a62ca37 100644 --- a/website/web/WEB-INF/advbwdist-relay.jsp +++ b/website/web/WEB-INF/advbwdist-relay.jsp @@ -18,7 +18,9 @@ The following graph shows the <a href="about.html#advertised-bandwidth">advertised bandwidth</a> of the -n-th fastest relays in the network for different values of n. +n-th fastest relays in the network for different values of n. +Note that the unit has recently changed from MiB/s to +Gbit/s. <img src="advbwdist-relay.png${advbwdist_relay_url}" width="576" height="360" alt="Advertised bandwidth of n-th fastest relays graph"> diff --git a/website/web/WEB-INF/bandwidth-flags.jsp b/website/web/WEB-INF/bandwidth-flags.jsp index 7207b9b..1cf591f 100644 --- a/website/web/WEB-INF/bandwidth-flags.jsp +++ b/website/web/WEB-INF/bandwidth-flags.jsp @@ -22,7 +22,9 @@ with either "Exit" or "Guard" <a href="about.html#relay-flag">flags</a> assigned by the directory authorities. These sets are not distinct, because a relay that has both the "Exit" and -"Guard" flags assigned will be included in both sets. +"Guard" flags assigned will be included in both sets. +Note that the unit has recently changed from MiB/s to +Gbit/s. <img src="bandwidth-flags.png${bandwidth_flags_url}" width="576" height="360" alt="Advertised bandwidth and bandwidth history by relay flags graph"> <form action="bandwidth-flags.html"> diff --git a/website/web/WEB-INF/bandwidth.jsp b/website/web/WEB-INF/bandwidth.jsp index f3b22b1..cbebe0a 100644 --- a/website/web/WEB-INF/bandwidth.jsp +++ b/website/web/WEB-INF/bandwidth.jsp @@ -19,7 +19,9 @@ The following graph shows the total <a href="about.html#advertised-bandwidth">advertised</a> and <a href="about.html#bandwidth-history">consumed bandwidth</a> of all -<a href="about.html#relay">relays</a> in the network. +<a href="about.html#relay">relays</a> in the network. +Note that the unit has recently changed from MiB/s to +Gbit/s. <img src="bandwidth.png${bandwidth_url}" width="576" height="360" alt="Relay bandwidth graph"> <form action="bandwidth.html"> diff --git a/website/web/WEB-INF/bwhist-flags.jsp b/website/web/WEB-INF/bwhist-flags.jsp index 36e3cd5..e7bf330 100644 --- a/website/web/WEB-INF/bwhist-flags.jsp +++ b/website/web/WEB-INF/bwhist-flags.jsp @@ -19,7 +19,9 @@ The following graph shows the <a href="about.html#bandwidth-history">consumed bandwidth</a> reported by relays, subdivided into four distinct subsets by assigned "Exit" and/or -"Guard" <a href="about.html#relay-flag">flags</a>. +"Guard" <a href="about.html#relay-flag">flags</a>. +Note that the unit has recently changed from MiB/s to +Gbit/s. <img src="bwhist-flags.png${bwhist_flags_url}" width="576" height="360" alt="Relay bandwidth by flags graph"> <form action="bwhist-flags.html"> diff --git a/website/web/WEB-INF/dirbytes.jsp b/website/web/WEB-INF/dirbytes.jsp index 384f71c..c13d071 100644 --- a/website/web/WEB-INF/dirbytes.jsp +++ b/website/web/WEB-INF/dirbytes.jsp @@ -23,7 +23,9 @@ directory requests. Not all directories report these statistics, so the graph shows an estimation of total consumed bandwidth as it would be observed if all -directories reported these statistics. +directories reported these statistics. +Note that the unit has recently changed from MiB/s to +Gbit/s. <img src="dirbytes.png${dirbytes_url}" width="576" height="360" alt="Dir bytes graph"> <form action="dirbytes.html">

1 0

[webwml/master] Add recent articles and PR to press page
by arma＠torproject.org 19 Jan '15

19 Jan '15

commit 0a5f322605a040b3b195a8dd0677c0e3c816c262 Author: Matthew Finkel <Matthew.Finkel(a)gmail.com> Date: Tue Jan 20 01:46:01 2015 +0000 Add recent articles and PR to press page --- press/en/press.wml | 75 +++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 74 insertions(+), 1 deletion(-) diff --git a/press/en/press.wml b/press/en/press.wml index 756ae5a..0774f61 100644 --- a/press/en/press.wml +++ b/press/en/press.wml @@ -33,6 +33,77 @@ newest to oldest: </tr> </thead> <tr style="background-color: #e5e5e5;"> +<td>2015 Jan 7</td> +<td>Inside BitCoins</td> +<td><a +href="http://insidebitcoins.com/news/developers-say-privacy-network-tor-was-not-c…">Developers +Say Privacy Network Tor Was Not Compromised During Silk Road Takedown</a></td> +</tr> +<tr style=""> +<td>2014 Dec 30</td> +<td>31C3</td> +<td><a +href="http://media.ccc.de/browse/congress/2014/31c3_-_6251_-_en_-_saal_1_-_201412…">“State +of the Onion"</a> video on the state of the Tor Project with Roger +Dingledine, Jacob Appelbaum, Arturo Filastò, and Laura Poitras.</td> +</tr> +<tr style="background-color: #e5e5e5;"> +<td>2014 Dec 26</td> +<td>Engadget</td> +<td><a +href="http://www.engadget.com/2014/12/26/lizard-squad-hackers-attack-tor/">Band +of hackers manages to take down Sony--but not Tor</a></td> +</tr> +<tr style=""> +<td>2014 Dec 19</td> +<td>The Guardian</td> +<td><a +href="http://www.theguardian.com/technology/2014/dec/05/how-faceboook-tor-service…">How +Facebook's Tor service could encourage a more open web</a></td> +</tr> +<tr style="background-color: #e5e5e5;"> +<td>2014 Dec 17</td> +<td>Gizmodo</td> +<td><a +href="http://gizmodo.com/tor-is-still-safe-1669011966">Tor is Still Safe +</a></td> +</tr> +<tr style=""> +<td>2014 Dec 12</td> +<td>The Independent</td> +<td><a +href="http://www.independent.co.uk/voices/comment/the-dark-web-is-not-just-for-pa…">OpEd +</a>on hidden services and censorship</td> +</tr> +<tr style="background-color: #e5e5e5;"> +<td>2014 Dec 11</td> +<td>DCInno</td> +<td><a +href="http://dcinno.streetwise.co/2014/11/11/mozilla-firefox-anonymous-internet-t…">Firefox +is Building an Anonymous Internet Browser With Tor</a> via @DC_Inno</td> +</tr> +<tr style=""> +<td>2014 Nov 10</td> +<td>Gizmodo</td> +<td><a +href="http://gizmodo.com/mozilla-is-helping-tor-get-bigger-and-better-1656860653">Mozilla +get bigger and better</a></td> +</tr> +<tr style="background-color: #e5e5e5;"> +<td>2014 Nov 20</td> +<td>Wired.co.UK</td> +<td><a +href="http://www.wired.co.uk/news/archive/2014-11/20/tor-still-secure">Don't +panic, Tor is still safe and Here’s Why</a></td> +</tr> +<tr style=""> +<td>2014 Oct 31</td> +<td>The Next Web</td> +<td><a +href="http://thenextweb.com/facebook/2014/10/31/facebook-now-available-tor-networ…">Facebook +is now available on Tor for more secure browsing</a></td> +</tr> +<tr style="background-color: #e5e5e5;"> <td>2014 Jul 8</td> <td>Cambridge Community Television</td> <td><a href="http://www.cctvcambridge.org/NSATor">NSA Surveillance Targets Cambridge - based TOR Project</a></td> @@ -2047,7 +2118,9 @@ Traffic</a></td> <tr style="background-color: #e5e5e5;"> <td>2004 Aug 30</td> <td>Newsweek</td> -<td>Technology: Instant Security (no link)</td> +<td><a +href="http://www.newsweek.com/technology-instant-security-126733">Technology: +Instant Security</a></td> </tr> <tr>

1 0

[tor-browser/tor-browser-31.4.0esr-4.5-1] Fixup! Bug #9701: Prevent ClipBoardCache from writing to disk.
by brade＠torproject.org 19 Jan '15

19 Jan '15

commit a78a094886091a90e5f4e13c0579f9ad730ea8b5 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Mon Jan 19 16:45:26 2015 -0500 Fixup! Bug #9701: Prevent ClipBoardCache from writing to disk. Update the DataStruct::SetData() prototype (my clang-based Mac build failed). --- widget/xpwidgets/nsTransferable.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/widget/xpwidgets/nsTransferable.h b/widget/xpwidgets/nsTransferable.h index 4c80bfe..73dcf49 100644 --- a/widget/xpwidgets/nsTransferable.h +++ b/widget/xpwidgets/nsTransferable.h @@ -27,7 +27,7 @@ struct DataStruct ~DataStruct(); const nsCString& GetFlavor() const { return mFlavor; } - void SetData( nsISupports* inData, uint32_t inDataLen ); + void SetData( nsISupports* inData, uint32_t inDataLen, bool aIsPrivBrowsing ); void GetData( nsISupports** outData, uint32_t *outDataLen ); already_AddRefed<nsIFile> GetFileSpec(const char* aFileName); bool IsDataAvailable() const { return (mData && mDataLen > 0) || (!mData && mCacheFileName); }

1 0

[tor-browser/tor-browser-31.4.0esr-4.5-1] Revert "Bug #9701: Prevent ClipBoardCache from writing to disk."
by brade＠torproject.org 19 Jan '15

19 Jan '15

commit ba4eca38fdad352c564719ff49aaa8c87e8a8ded Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Mon Jan 19 16:01:11 2015 -0500 Revert "Bug #9701: Prevent ClipBoardCache from writing to disk." This reverts commit ba34a65a5e33473cb6f53b06542a3ce087c26115. An improved fix is forthcoming. --- widget/xpwidgets/nsTransferable.cpp | 2 -- 1 file changed, 2 deletions(-) diff --git a/widget/xpwidgets/nsTransferable.cpp b/widget/xpwidgets/nsTransferable.cpp index e6af15e..094836b 100644 --- a/widget/xpwidgets/nsTransferable.cpp +++ b/widget/xpwidgets/nsTransferable.cpp @@ -58,7 +58,6 @@ DataStruct::~DataStruct() void DataStruct::SetData ( nsISupports* aData, uint32_t aDataLen ) { -#if 0 // Remove unnecessary disk caching to accommodate https://www.torproject.org/projects/torbrowser/design/#disk-avoidance // Now, check to see if we consider the data to be "too large" if (aDataLen > kLargeDatasetSize) { // if so, cache it to disk instead of memory @@ -67,7 +66,6 @@ DataStruct::SetData ( nsISupports* aData, uint32_t aDataLen ) else NS_WARNING("Oh no, couldn't write data to the cache file"); } -#endif // #if 0 mData = aData; mDataLen = aDataLen;

1 0

[tor-browser/tor-browser-31.4.0esr-4.5-1] Bug #9701: Prevent ClipBoardCache from writing to disk.
by brade＠torproject.org 19 Jan '15

19 Jan '15

commit 453b4ee4b2cd1c3dd22ee2040b38f09d26e8a60f Author: Michael Schloh von Bennewitz <michael(a)schloh.com> Date: Mon Jan 19 16:04:36 2015 -0500 Bug #9701: Prevent ClipBoardCache from writing to disk. Do not write clipboard data to disk when private browsing mode is on. --- widget/xpwidgets/nsTransferable.cpp | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/widget/xpwidgets/nsTransferable.cpp b/widget/xpwidgets/nsTransferable.cpp index 094836b..1a0e96e 100644 --- a/widget/xpwidgets/nsTransferable.cpp +++ b/widget/xpwidgets/nsTransferable.cpp @@ -56,19 +56,20 @@ DataStruct::~DataStruct() //------------------------------------------------------------------------- void -DataStruct::SetData ( nsISupports* aData, uint32_t aDataLen ) +DataStruct::SetData ( nsISupports* aData, uint32_t aDataLen, bool aIsPrivBrowsing ) { // Now, check to see if we consider the data to be "too large" - if (aDataLen > kLargeDatasetSize) { + // as well as ensuring that private browsing mode is disabled + if (aDataLen > kLargeDatasetSize && !aIsPrivBrowsing) { // if so, cache it to disk instead of memory if ( NS_SUCCEEDED(WriteCache(aData, aDataLen)) ) return; else - NS_WARNING("Oh no, couldn't write data to the cache file"); - } + NS_WARNING("Oh no, couldn't write data to the cache file"); + } mData = aData; - mDataLen = aDataLen; + mDataLen = aDataLen; } @@ -401,7 +402,7 @@ nsTransferable::SetTransferData(const char *aFlavor, nsISupports *aData, uint32_ for (i = 0; i < mDataArray.Length(); ++i) { DataStruct& data = mDataArray.ElementAt(i); if ( data.GetFlavor().Equals(aFlavor) ) { - data.SetData ( aData, aDataLen ); + data.SetData ( aData, aDataLen, mPrivateData ); return NS_OK; } } @@ -417,7 +418,7 @@ nsTransferable::SetTransferData(const char *aFlavor, nsISupports *aData, uint32_ nsCOMPtr<nsISupports> ConvertedData; uint32_t ConvertedLen; mFormatConv->Convert(aFlavor, aData, aDataLen, data.GetFlavor().get(), getter_AddRefs(ConvertedData), &ConvertedLen); - data.SetData(ConvertedData, ConvertedLen); + data.SetData(ConvertedData, ConvertedLen, mPrivateData); return NS_OK; } }

1 0

[torsocks/master] Test: support out of tree make check
by dgoulet＠torproject.org 19 Jan '15

19 Jan '15

commit 52e191d81320b732fd0d184423fe141f0968dfde Author: David Goulet <dgoulet(a)ev0ke.net> Date: Mon Jan 19 13:14:58 2015 -0500 Test: support out of tree make check Fixes #14268 Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- tests/Makefile.am | 14 ++++++++++++++ tests/unit/Makefile.am | 16 ++++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/tests/Makefile.am b/tests/Makefile.am index 630492d..27214f8 100644 --- a/tests/Makefile.am +++ b/tests/Makefile.am @@ -28,3 +28,17 @@ check-am: dist_noinst_SCRIPTS = test_list run.sh EXTRA_DIST = run.sh test_list + +all-local: + @if [ x"$(srcdir)" != x"$(builddir)" ]; then \ + for script in $(EXTRA_DIST); do \ + cp -f $(srcdir)/$$script $(builddir); \ + done; \ + fi + +clean-local: + @if [ x"$(srcdir)" != x"$(builddir)" ]; then \ + for script in $(EXTRA_DIST); do \ + rm -f $(builddir)/$$script; \ + done; \ + fi diff --git a/tests/unit/Makefile.am b/tests/unit/Makefile.am index b85f910..66ae37c 100644 --- a/tests/unit/Makefile.am +++ b/tests/unit/Makefile.am @@ -32,3 +32,19 @@ test_socks5_LDADD = $(LIBTAP) $(LIBCOMMON) $(LIBTORSOCKS) test_compat_SOURCES = test_compat.c test_compat_LDADD = $(LIBTAP) $(LIBCOMMON) $(LIBTORSOCKS) + +all-local: + @if [ x"$(srcdir)" != x"$(builddir)" ]; then \ + for script in $(EXTRA_DIST); do \ + cp -rf $(srcdir)/$$script $(builddir); \ + done; \ + fi + +# Force remove here so make sure EXTRA_DIST does not contain something like +# /usr. ;) +clean-local: + @if [ x"$(srcdir)" != x"$(builddir)" ]; then \ + for script in $(EXTRA_DIST); do \ + rm -rf $(builddir)/$$script; \ + done; \ + fi

1 0

[torsocks/master] configure.ac: avoid tests which have both -pie and -static
by dgoulet＠torproject.org 19 Jan '15

19 Jan '15

commit a791f32a4dff71aaf03f086723572d7f98e2ac12 Author: Anthony G. Basile <blueness(a)gentoo.org> Date: Sun Jan 11 17:13:35 2015 +0000 configure.ac: avoid tests which have both -pie and -static Building and linking with both -pie and -static is not supported for some toolchain combinations (eg. glibc or binutil's gold). Yet this combination is hit if the check for gcc hardening is done before AC_PROG_LIBTOOL and AC_ENABLE_STATIC. We avoid the issue by moving the gcc hardening check to after AC_PROG_LIBTOOL and friends. See: https://sourceware.org/bugzilla/show_bug.cgi?id=17826 https://sourceware.org/bugzilla/show_bug.cgi?id=16428 https://bugs.gentoo.org/show_bug.cgi?id=533862 Signed-off-by: Anthony G. Basile <blueness(a)gentoo.org> Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- configure.ac | 46 ++++++++++++++++++++++++++++------------------ 1 file changed, 28 insertions(+), 18 deletions(-) diff --git a/configure.ac b/configure.ac index 3eb9060..f4aadfb 100644 --- a/configure.ac +++ b/configure.ac @@ -144,24 +144,6 @@ AC_SUBST(TESTLDFLAGS) # Version information for libtorsocks TORSOCKSLDFLAGS="$LDFLAGS -version-info 1:0:0" -# Check for the gcc hardening flags. -AX_CHECK_COMPILE_FLAG([-fPIE],[CFLAGS="$CFLAGS -fPIE"],[],[]) -AX_CHECK_COMPILE_FLAG([-fwrapv],[CFLAGS="$CFLAGS -fwrapv"],[],[]) -AX_CHECK_COMPILE_FLAG([--param ssp-buffer-size=1], - [CFLAGS="$CFLAGS --param ssp-buffer-size=1"],[],[]) -AX_CHECK_COMPILE_FLAG([-fstack-protector-all], - [CFLAGS="$CFLAGS -fstack-protector-all"],[],[] -) -AX_CHECK_COMPILE_FLAG([-fno-strict-overflow], - [CFLAGS="$CFLAGS -fno-strict-overflow"],[],[] -) - -dnl Add hardening linker flags -AX_CHECK_LINK_FLAG([-pie],[LDFLAGS="$LDFLAGS -pie"],[],[]) -AX_CHECK_LINK_FLAG([-z relro],[LDFLAGS="$LDFLAGS -z relro"],[],[]) -AX_CHECK_LINK_FLAG([-z now],[LDFLAGS="$LDFLAGS -z now"],[],[]) -LDFLAGS="$LDFLAGS -D_FORTIFY_SOURCE=2" - dnl Linker checks for Mac OSX, which uses DYLD_INSERT_LIBRARIES dnl instead of LD_PRELOAD case "$host_os" in @@ -255,6 +237,34 @@ AC_ENABLE_STATIC DEFAULT_INCLUDES="-I\$(top_srcdir) -I\$(top_builddir) -I\$(top_builddir)/src -I\$(top_builddir)/include -include config.h" AC_SUBST(DEFAULT_INCLUDES) +############################################################################## +# 9. Test and add hardening flags +############################################################################## + +# Check for the gcc hardening flags. +AX_CHECK_COMPILE_FLAG([-fPIE],[CFLAGS="$CFLAGS -fPIE"],[],[]) +AX_CHECK_COMPILE_FLAG([-fwrapv],[CFLAGS="$CFLAGS -fwrapv"],[],[]) +AX_CHECK_COMPILE_FLAG([--param ssp-buffer-size=1], + [CFLAGS="$CFLAGS --param ssp-buffer-size=1"],[],[]) +AX_CHECK_COMPILE_FLAG([-fstack-protector-all], + [CFLAGS="$CFLAGS -fstack-protector-all"],[],[] +) +AX_CHECK_COMPILE_FLAG([-fno-strict-overflow], + [CFLAGS="$CFLAGS -fno-strict-overflow"],[],[] +) + +dnl Add hardening linker flags +AX_CHECK_LINK_FLAG([-pie],[LDFLAGS="$LDFLAGS -pie"],[],[]) +AX_CHECK_LINK_FLAG([-z relro],[LDFLAGS="$LDFLAGS -z relro"],[],[]) +AX_CHECK_LINK_FLAG([-z now],[LDFLAGS="$LDFLAGS -z now"],[],[]) + +dnl Add glibc hardening +CPPFLAGS="$CPPFLAGS -D_FORTIFY_SOURCE=2" + +############################################################################## +# 10. Finish up +############################################################################## + AC_CONFIG_FILES([ Makefile extras/Makefile

1 0

[torsocks/master] Add AllowOutboundLocalhost.
by dgoulet＠torproject.org 19 Jan '15

19 Jan '15

commit 7cfcd619d6fc293dfd05af42f30b2f39243ff736 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Mon Jan 19 00:44:05 2015 +0000 Add AllowOutboundLocalhost. This addresses the tails problem with #8137 in that, with the options set, all connections to the loopback address is allowed. Since this is a massive foot + gun option for the users, it's off by default. Note that to correctly fix MAPADDRESS and all the things that the Whonix people are complaining about would require bringing back the old tsocks "local" configuration option. Signed-off-by: Yawning Angel <yawning(a)schwanenlied.me> Signed-off-by: David Goulet <dgoulet(a)ev0ke.net> --- doc/torsocks.conf | 5 +++++ doc/torsocks.conf.5 | 6 ++++++ src/common/config-file.c | 36 ++++++++++++++++++++++++++++++++++++ src/common/config-file.h | 7 +++++++ src/lib/connect.c | 9 +++++++++ 5 files changed, 63 insertions(+) diff --git a/doc/torsocks.conf b/doc/torsocks.conf index c1596c0..7e82a27 100644 --- a/doc/torsocks.conf +++ b/doc/torsocks.conf @@ -28,3 +28,8 @@ OnionAddrRange 127.42.42.0/24 # Set Torsocks to accept inbound connections. If set to 1, listen() and # accept() will be allowed to be used with non localhost address. (Default: 0) #AllowInbound 1 + +# Set Torsocks to allow outbound connections to the loopback interface. +# If set to 1, connect() will be allowed to be used to the loopback interface +# bypassing Tor. This option should not be used by most users. (Default: 0) +#AllowOutboundLocalhost 1 diff --git a/doc/torsocks.conf.5 b/doc/torsocks.conf.5 index 451af59..13ac7b9 100644 --- a/doc/torsocks.conf.5 +++ b/doc/torsocks.conf.5 @@ -77,6 +77,12 @@ Allow inbound connections meaning that listen() and accept()/accept4() will be allowed for non localhost address so the applicaton can handle incoming connection. Note that Unix socket are allowed. (Default: 0) +.TP +.I AllowOutboundLocalhost 0|1 +Allow outbound connections to the loopback interface meaning that connect() +will be allowed to connect to localhost addresses bypassing Tor. This option +should not be used by most users. (Default: 0) + .SH EXAMPLE $ export TORSOCKS_CONF_FILE=$PWD/torsocks.conf $ torsocks ssh account(a)sshserver.com diff --git a/src/common/config-file.c b/src/common/config-file.c index 79fe5ca..64b3d42 100644 --- a/src/common/config-file.c +++ b/src/common/config-file.c @@ -38,6 +38,7 @@ static const char *conf_onion_str = "OnionAddrRange"; static const char *conf_socks5_user_str = "SOCKS5Username"; static const char *conf_socks5_pass_str = "SOCKS5Password"; static const char *conf_allow_inbound_str = "AllowInbound"; +static const char *conf_allow_outbound_localhost_str = "AllowOutboundLocalhost"; /* * Once this value reaches 2, it means both user and password for a SOCKS5 @@ -227,6 +228,11 @@ static int parse_config_line(const char *line, struct configuration *config) if (ret < 0) { goto error; } + } else if (!strcmp(tokens[0], conf_allow_outbound_localhost_str)) { + ret = conf_file_set_allow_outbound_localhost(tokens[1], config); + if (ret < 0) { + goto error; + } } else { WARN("Config file contains unknown value: %s", line); } @@ -366,6 +372,36 @@ int conf_file_set_allow_inbound(const char *val, struct configuration *config) } /* + * Set the allow outbound localhost option for the given config. + * + * Return 0 if option is off, 1 if on and negative value on error. + */ +ATTR_HIDDEN +int conf_file_set_allow_outbound_localhost(const char *val, + struct configuration *config) +{ + int ret; + + assert(val); + assert(config); + + ret = atoi(val); + if (ret == 0) { + config->allow_outbound_localhost = 0; + DBG("[config] Outbound localhost connections disallowed."); + } else if (ret == 1) { + config->allow_outbound_localhost = 1; + DBG("[config] Outbound localhost connections allowed."); + } else { + ERR("[config] Invalid %s value for %s", val, + conf_allow_outbound_localhost_str); + ret = -EINVAL; + } + + return ret; +} + +/* * Read and populate the given config parsed data structure. * * Return 0 on success or else a negative value. diff --git a/src/common/config-file.h b/src/common/config-file.h index c35507d..da3d507 100644 --- a/src/common/config-file.h +++ b/src/common/config-file.h @@ -78,6 +78,11 @@ struct configuration { * for non localhost addresses. */ unsigned int allow_inbound:1; + + /* + * Allow outbound connections to localhost that bypass Tor. + */ + unsigned int allow_outbound_localhost:1; }; int config_file_read(const char *filename, struct configuration *config); @@ -87,5 +92,7 @@ int conf_file_set_socks5_pass(const char *password, int conf_file_set_socks5_user(const char *username, struct configuration *config); int conf_file_set_allow_inbound(const char *val, struct configuration *config); +int conf_file_set_allow_outbound_localhost(const char *val, struct + configuration *config); #endif /* CONFIG_FILE_H */ diff --git a/src/lib/connect.c b/src/lib/connect.c index 5e56e4e..1bf81ac 100644 --- a/src/lib/connect.c +++ b/src/lib/connect.c @@ -172,6 +172,15 @@ LIBC_CONNECT_RET_TYPE tsocks_connect(LIBC_CONNECT_SIG) * thus this check is done after the onion entry lookup. */ if (utils_sockaddr_is_localhost(addr)) { + /* + * Certain setups need to be able to reach localhost, despite + * running torsocks. If they enabled the config option, allow such + * connections. + */ + if (tsocks_config.allow_outbound_localhost) { + goto libc_connect; + } + WARN("[connect] Connection to a local address are denied since it " "might be a TCP DNS query to a local DNS server. " "Rejecting it for safety reasons.");

1 0