February 2015 - tor-commits - lists.torproject.org

[translation/torcheck] Update translations for torcheck
by translation＠torproject.org 17 Feb '15

17 Feb '15

commit de86b186927c54d9632288fc1887ce4c98d1b1c4 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Feb 17 14:15:07 2015 +0000 Update translations for torcheck --- hr_HR/torcheck.po | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/hr_HR/torcheck.po b/hr_HR/torcheck.po index bd89be3..0c66d17 100644 --- a/hr_HR/torcheck.po +++ b/hr_HR/torcheck.po @@ -2,15 +2,15 @@ # Copyright (C) 2008-2013 The Tor Project, Inc # # Translators: -# skiddiep <lyricaltumor(a)gmail.com>, 2014 +# skiddiep <lyricaltumor(a)gmail.com>, 2014-2015 # nvucinic <nvucinic(a)nestabilni.com>, 2012 # Tea Horvatic <teahorvatic(a)yahoo.co.uk>, 2014 msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "POT-Creation-Date: 2012-02-16 20:28+PDT\n" -"PO-Revision-Date: 2015-02-16 14:02+0000\n" -"Last-Translator: runasand <runa.sandvik(a)gmail.com>\n" +"PO-Revision-Date: 2015-02-17 13:58+0000\n" +"Last-Translator: skiddiep <lyricaltumor(a)gmail.com>\n" "Language-Team: Croatian (Croatia) (http://www.transifex.com/projects/p/torproject/language/hr_HR/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -20,21 +20,21 @@ msgstr "" "Plural-Forms: nplurals=3; plural=n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2;\n" msgid "Congratulations. This browser is configured to use Tor." -msgstr "Čestitamo. Ovaj preglednik je konfiguriran za uporabu Tora." +msgstr "Čestitamo. Ovaj preglednik je konfiguriran za uporabu Tor-a." msgid "" "Please refer to the <a href=\"https://www.torproject.org/\">Tor website</a> " "for further information about using Tor safely. You are now free to browse " "the Internet anonymously." -msgstr "Pogledajte <a href=\"https://www.torproject.org/\">Tor web lokaciju </a> za daljnje informacije kako sigurno koristiti Tor. Sada možete anonimno pregledavati internet." +msgstr "Pogledajte <a href=\"https://www.torproject.org/\">Tor web stranicu </a> za daljnje informacije o tome kako sigurno koristiti Tor. Sad možete anonimno pregledavati internet." msgid "There is a security update available for Tor Browser." -msgstr "" +msgstr "Dostupno je sigurnosno ažuriranje za Tor Preglednik." msgid "" "<a href=\"https://www.torproject.org/download/download-easy.html\">Click " "here to go to the download page</a>" -msgstr "<a href=\"https://www.torproject.org/download/download-easy.html\">Preuzmite Tor ovdje. .</a>" +msgstr "<a href=\"https://www.torproject.org/download/download-easy.html\">Preuzmite Tor ovdje</a>" msgid "Sorry. You are not using Tor." msgstr "Nažalost, Vi ne koristite Tor." @@ -44,18 +44,18 @@ msgid "" "href=\"https://www.torproject.org/\">Tor website</a> and specifically the <a" " href=\"https://www.torproject.org/docs/faq#DoesntWork\">instructions for " "configuring your Tor client</a>." -msgstr "Ako pokušavate koristiti Tor klijent provjerite <a href=\"https://www.torproject.org/\"> Tor web lokaciju </a> ili <ahref=\"https://www.torproject.org/docs/faq#DoesntWork\">upute za konfiguraciju Vašeg Tor klijenta/a>." +msgstr "Ako pokušavate koristiti Tor klijent provjerite <a href=\"https://www.torproject.org/\">Tor web stranicu</a>, posebice <a href=\"https://www.torproject.org/docs/faq#DoesntWork\">upute za konfiguraciju Vašeg Tor klijenta</a>." msgid "Sorry, your query failed or an unexpected response was received." -msgstr "Nažalost Vaš upit nije uspio ili se dogodio neočekivani zahtjev." +msgstr "Nažalost Vaš upit nije uspio ili je primljen neočekivan odgovor." msgid "" "A temporary service outage prevents us from determining if your source IP " "address is a <a href=\"https://www.torproject.org/\">Tor</a> node." -msgstr "Privremni tehnički problemi spriječavaju nas da potvrdimo dali je Vaša IP adresa <a href=\"https://www.torproject.org/\">Tor</a> čvor." +msgstr "Privremni tehnički problemi spriječavaju nas da potvrdimo da li je Vaša IP adresa <a href=\"https://www.torproject.org/\">Tor</a> čvor." msgid "Your IP address appears to be: " -msgstr "Vaša IP adresa je:" +msgstr "Čini se da je Vaša IP adresa:" msgid "Are you using Tor?" msgstr "Koristite li Tor?" @@ -69,7 +69,7 @@ msgstr "Za više informacija o ovom izlaznom releju pogledajte:" msgid "" "The Tor Project is a US 501(c)(3) non-profit dedicated to the research, " "development, and education of online anonymity and privacy." -msgstr "Tor Projekt je US 501 (c)(3) neprofitna organizacija koja se bavi istraživanjem, razvojem i edukacijom o online anonimnosti i privatnosti." +msgstr "Tor Projekt je US 501(c)(3) neprofitna organizacija koja je posvećena istraživanju, razvoju i obrazovanju o online anonimnosti i privatnosti." msgid "Learn More »" msgstr "Saznajte više »" @@ -96,10 +96,10 @@ msgid "JavaScript is disabled." msgstr "JavaScript je onemogućen." msgid "However, it does not appear to be Tor Browser." -msgstr "" +msgstr "Međutim, čini se da to nije Tor Preglednik." msgid "Run a Relay" -msgstr "" +msgstr "Pokreni relej" msgid "Stay Anonymous" -msgstr "" +msgstr "Ostani Anoniman"

1 0

[tor/master] Have tinytest tolerate systems where char has > 8 bytes
by nickm＠torproject.org 17 Feb '15

17 Feb '15

commit 7620c613e8bdaa34120136c91f71ae0cf8cb8506 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 17 08:40:55 2015 -0500 Have tinytest tolerate systems where char has > 8 bytes CID 1064418 --- src/ext/tinytest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ext/tinytest.c b/src/ext/tinytest.c index cc054ad..f6baeeb 100644 --- a/src/ext/tinytest.c +++ b/src/ext/tinytest.c @@ -490,7 +490,7 @@ tinytest_format_hex_(const void *val_, unsigned long len) return strdup("<allocation failure>"); cp = result; for (i=0;i<len;++i) { - *cp++ = "0123456789ABCDEF"[val[i] >> 4]; + *cp++ = "0123456789ABCDEF"[(val[i] >> 4)&0x0f]; *cp++ = "0123456789ABCDEF"[val[i] & 0x0f]; } while (ellipses--)

1 0

[tor/master] Check thread count for negative; realloc->reallocarray
by nickm＠torproject.org 17 Feb '15

17 Feb '15

commit 0b46b082252935a57f960a2b461857b296b33d51 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 17 08:46:11 2015 -0500 Check thread count for negative; realloc->reallocarray CID 1268069 --- src/common/workqueue.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/common/workqueue.c b/src/common/workqueue.c index 823fb51..c1bd6d4 100644 --- a/src/common/workqueue.c +++ b/src/common/workqueue.c @@ -363,10 +363,14 @@ threadpool_queue_update(threadpool_t *pool, static int threadpool_start_threads(threadpool_t *pool, int n) { + if (n < 0) + return -1; + tor_mutex_acquire(&pool->lock); if (pool->n_threads < n) - pool->threads = tor_realloc(pool->threads, sizeof(workerthread_t*)*n); + pool->threads = tor_reallocarray(pool->threads, + sizeof(workerthread_t*), n); while (pool->n_threads < n) { void *state = pool->new_thread_state_fn(pool->new_thread_state_arg);

1 0

[tor/master] Use --list-fingerprint instead of process control in zero_length_keys.sh
by nickm＠torproject.org 17 Feb '15

17 Feb '15

commit c3813e2e64e7efa6c07fc5741f94a2f6876bc317 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 17 08:30:32 2015 -0500 Use --list-fingerprint instead of process control in zero_length_keys.sh Using kill and wait in this way may have been making windows builders unhappy. --- src/test/zero_length_keys.sh | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/src/test/zero_length_keys.sh b/src/test/zero_length_keys.sh index 81ba3e0..4dea283 100755 --- a/src/test/zero_length_keys.sh +++ b/src/test/zero_length_keys.sh @@ -46,12 +46,7 @@ if [ -s "$DATA_DIR"/keys/secret_id_key ] && [ -s "$DATA_DIR"/keys/secret_onion_k exit 3 else echo "Generating initial tor keys" - $TOR --DataDirectory "$DATA_DIR" --PidFile "$DATA_DIR"/pid & - TOR_PID=$! - # generate SIGTERM, hopefully after the keys have been regenerated - sleep 5 - kill $TOR_PID - wait $TOR_PID + $TOR --DataDirectory "$DATA_DIR" --list-fingerprint # tor must successfully generate non-zero-length key files if [ -s "$DATA_DIR"/keys/secret_id_key ] && [ -s "$DATA_DIR"/keys/secret_onion_key ] && @@ -88,12 +83,7 @@ if [ "$1" = "-z" ]; then fi echo "Running tor again to check if it $FILE_DESC keys" -$TOR --DataDirectory "$DATA_DIR" --PidFile "$DATA_DIR"/pid & -TOR_PID=$! -# generate SIGTERM, hopefully after the keys have been regenerated -sleep 5 -kill $TOR_PID -wait $TOR_PID +$TOR --DataDirectory "$DATA_DIR" --list-fingerprint #ls -lh "$DATA_DIR"/keys/ || exit 3

1 0

[tor/master] Wrap two long lines
by nickm＠torproject.org 17 Feb '15

17 Feb '15

commit 8375663adf9b3150d3970b539cc941cc0e548eb5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 17 08:30:28 2015 -0500 Wrap two long lines --- src/test/test_entrynodes.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/test/test_entrynodes.c b/src/test/test_entrynodes.c index 5f2051c..a7e18cd 100644 --- a/src/test/test_entrynodes.c +++ b/src/test/test_entrynodes.c @@ -150,7 +150,8 @@ populate_live_entry_guards_test_helper(int num_needed) } SMARTLIST_FOREACH_END(node); /* Make sure the nodes were added as entry guards. */ - tt_int_op(smartlist_len(all_entry_guards), OP_EQ, HELPER_NUMBER_OF_DESCRIPTORS); + tt_int_op(smartlist_len(all_entry_guards), OP_EQ, + HELPER_NUMBER_OF_DESCRIPTORS); /* Ensure that all the possible entry guards are enough to satisfy us. */ tt_int_op(smartlist_len(all_entry_guards), OP_GE, num_needed); @@ -603,7 +604,8 @@ test_entry_is_live(void *arg) } SMARTLIST_FOREACH_END(node); /* Make sure the nodes were added as entry guards. */ - tt_int_op(smartlist_len(all_entry_guards), OP_EQ, HELPER_NUMBER_OF_DESCRIPTORS); + tt_int_op(smartlist_len(all_entry_guards), OP_EQ, + HELPER_NUMBER_OF_DESCRIPTORS); /* Now get a random test entry that we will use for this unit test. */ which_node = 3; /* (chosen by fair dice roll) */

1 0

[obfs4/master] Add support for acting as a ScrambleSuit client.
by yawning＠torproject.org 17 Feb '15

17 Feb '15

commit 0066cfc3932c50323fa596981f18ef5b0e862742 Author: Yawning Angel <yawning(a)torproject.org> Date: Tue Feb 17 11:33:29 2015 +0000 Add support for acting as a ScrambleSuit client. This allows obfs4proxy to be used as a ScrambleSuit client that is wire compatible with the obfs4proxy implementation, including session ticket support, and length obfuscation. The current implementation has the following limitations: * IAT obfuscation is not supported (and is disabled in all other ScrambleSuit implementations by default). * The length distribution and probabilites are different from those generated by obfsproxy and obfsclient due to a different DRBG. * Server support is missing and is unlikely to be implemented. --- ChangeLog | 1 + README.md | 3 + common/probdist/weighted_dist.go | 25 ++ doc/obfs4proxy.1 | 5 +- transports/scramblesuit/base.go | 88 ++++ transports/scramblesuit/conn.go | 521 ++++++++++++++++++++++++ transports/scramblesuit/handshake_ticket.go | 228 +++++++++++ transports/scramblesuit/handshake_uniformdh.go | 174 ++++++++ transports/scramblesuit/hkdf_expand.go | 67 +++ transports/transports.go | 2 + 10 files changed, 1112 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index b2387e1..85fc60f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,7 @@ Changes in version 0.0.4 - UNRELEASED - Improve the runtime performance of the obfs4 handshake tests. - Changed the go.crypto import path to the new location (golang.org/x/crypto) + - Added client only support for ScrambleSuit. Changes in version 0.0.3 - 2014-10-01 - Change the obfs4 bridge line format to use a "cert" argument instead of the diff --git a/README.md b/README.md index e4d4595..31c9e2b 100644 --- a/README.md +++ b/README.md @@ -81,6 +81,9 @@ ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy `ClientTransportPlugin` and `ServerTransportPlugin` lines in the torrc as appropriate. + * obfs4proxy can also act as a ScrambleSuit client. Adjust the + `ClientTransportPlugin` line in the torrc as appropriate. + * The autogenerated obfs4 bridge parameters are placed in `DataDir/pt_state/obfs4_state.json`. To ease deployment, the client side bridge line is written to `DataDir/pt_state/obfs4_bridgeline.txt`. diff --git a/common/probdist/weighted_dist.go b/common/probdist/weighted_dist.go index 2386bbe..811a8a0 100644 --- a/common/probdist/weighted_dist.go +++ b/common/probdist/weighted_dist.go @@ -31,9 +31,11 @@ package probdist import ( + "bytes" "container/list" "fmt" "math/rand" + "sync" "git.torproject.org/pluggable-transports/obfs4.git/common/csrand" "git.torproject.org/pluggable-transports/obfs4.git/common/drbg" @@ -46,6 +48,8 @@ const ( // WeightedDist is a weighted distribution. type WeightedDist struct { + sync.Mutex + minValue int maxValue int biased bool @@ -192,6 +196,9 @@ func (w *WeightedDist) Reset(seed *drbg.Seed) { drbg, _ := drbg.NewHashDrbg(seed) rng := rand.New(drbg) + w.Lock() + defer w.Unlock() + w.genValues(rng) if w.biased { w.genBiasedWeights(rng) @@ -205,6 +212,9 @@ func (w *WeightedDist) Reset(seed *drbg.Seed) { func (w *WeightedDist) Sample() int { var idx int + w.Lock() + defer w.Unlock() + // Generate a fair die roll from an $n$-sided die; call the side $i$. i := csrand.Intn(len(w.values)) // Flip a biased coin that comes up heads with probability $Prob[i]$. @@ -218,3 +228,18 @@ func (w *WeightedDist) Sample() int { return w.minValue + w.values[idx] } + +// String returns a dump of the distribution table. +func (w *WeightedDist) String() string { + var buf bytes.Buffer + + buf.WriteString("[ ") + for i, v := range w.values { + p := w.weights[i] + if p > 0.01 { // Squelch tiny probabilities. + buf.WriteString(fmt.Sprintf("%d: %f ", v, p)) + } + } + buf.WriteString("]") + return buf.String() +} diff --git a/doc/obfs4proxy.1 b/doc/obfs4proxy.1 index e442946..a9c6257 100644 --- a/doc/obfs4proxy.1 +++ b/doc/obfs4proxy.1 @@ -1,4 +1,4 @@ -.TH OBFS4PROXY 1 "2014-09-24" +.TH OBFS4PROXY 1 "2015-01-20" .SH NAME obfs4proxy \- pluggable transport proxy for Tor, implementing obfs4 .SH SYNOPSIS @@ -11,7 +11,8 @@ censors, who usually monitor traffic between the client and the bridge, will see innocent-looking transformed traffic instead of the actual Tor traffic. .PP -obfs4proxy implements the obfuscation protocols obfs2, obfs3 and obfs4. +obfs4proxy implements the obfuscation protocols obfs2, obfs3, +ScrambleSuit (client only) and obfs4. .PP obfs4proxy is currently only supported as a managed pluggable transport spawned as a helper process via the \fBtor\fR daemon. diff --git a/transports/scramblesuit/base.go b/transports/scramblesuit/base.go new file mode 100644 index 0000000..711c046 --- /dev/null +++ b/transports/scramblesuit/base.go @@ -0,0 +1,88 @@ +/* + * Copyright (c) 2015, Yawning Angel <yawning at torproject dot org> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +// Package scramblesuit provides an implementation of the ScrambleSuit +// obfuscation protocol. The implementation is client only. +package scramblesuit + +import ( + "fmt" + "net" + + "git.torproject.org/pluggable-transports/goptlib.git" + "git.torproject.org/pluggable-transports/obfs4.git/transports/base" +) + +const transportName = "scramblesuit" + +// Transport is the ScrambleSuit implementation of the base.Transport interface. +type Transport struct{} + +// Name returns the name of the ScrambleSuit transport protocol. +func (t *Transport) Name() string { + return transportName +} + +// ClientFactory returns a new ssClientFactory instance. +func (t *Transport) ClientFactory(stateDir string) (base.ClientFactory, error) { + tStore, err := loadTicketStore(stateDir) + if err != nil { + return nil, err + } + cf := &ssClientFactory{transport: t, ticketStore: tStore} + return cf, nil +} + +// ServerFactory will one day return a new ssServerFactory instance. +func (t *Transport) ServerFactory(stateDir string, args *pt.Args) (base.ServerFactory, error) { + // TODO: Fill this in eventually, though obfs4 is better. + return nil, fmt.Errorf("server not supported") +} + +type ssClientFactory struct { + transport base.Transport + ticketStore *ssTicketStore +} + +func (cf *ssClientFactory) Transport() base.Transport { + return cf.transport +} + +func (cf *ssClientFactory) ParseArgs(args *pt.Args) (interface{}, error) { + return newClientArgs(args) +} + +func (cf *ssClientFactory) WrapConn(conn net.Conn, args interface{}) (net.Conn, error) { + ca, ok := args.(*ssClientArgs) + if !ok { + return nil, fmt.Errorf("invalid argument type for args") + } + return newScrambleSuitClientConn(conn, cf.ticketStore, ca) +} + +var _ base.ClientFactory = (*ssClientFactory)(nil) +var _ base.Transport = (*Transport)(nil) diff --git a/transports/scramblesuit/conn.go b/transports/scramblesuit/conn.go new file mode 100644 index 0000000..b77bc5f --- /dev/null +++ b/transports/scramblesuit/conn.go @@ -0,0 +1,521 @@ +/* + * Copyright (c) 2015, Yawning Angel <yawning at torproject dot org> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +package scramblesuit + +import ( + "bytes" + "crypto/aes" + "crypto/cipher" + "crypto/hmac" + "crypto/sha256" + "encoding/base32" + "encoding/binary" + "errors" + "fmt" + "hash" + "io" + "net" + "time" + + "git.torproject.org/pluggable-transports/goptlib.git" + "git.torproject.org/pluggable-transports/obfs4.git/common/csrand" + "git.torproject.org/pluggable-transports/obfs4.git/common/drbg" + "git.torproject.org/pluggable-transports/obfs4.git/common/probdist" + "git.torproject.org/pluggable-transports/obfs4.git/common/uniformdh" +) + +const ( + passwordArg = "password" + + maxSegmentLength = 1448 + maxPayloadLength = 1427 + sharedSecretLength = 160 / 8 // k_B + clientHandshakeTimeout = time.Duration(60) * time.Second + + minLenDistLength = 21 + maxLenDistLength = maxSegmentLength + + keyLength = 32 + 8 + 32 + + pktPrngSeedLength = 32 + pktOverhead = macLength + pktHdrLength + pktHdrLength = 2 + 2 + 1 + pktPayload = 1 + pktNewTicket = 1 << 1 + pktPrngSeed = 1 << 2 +) + +var ( + // ErrNotSupported is the error returned for a unsupported operation. + ErrNotSupported = errors.New("scramblesuit: operation not supported") + + // ErrInvalidPacket is the error returned when a invalid packet is received. + ErrInvalidPacket = errors.New("scramblesuit: invalid packet") + + zeroPadBytes [maxPayloadLength]byte +) + +type ssSharedSecret [sharedSecretLength]byte + +type ssClientArgs struct { + kB *ssSharedSecret + sessionKey *uniformdh.PrivateKey +} + +func newClientArgs(args *pt.Args) (ca *ssClientArgs, err error) { + ca = &ssClientArgs{} + if ca.kB, err = parsePasswordArg(args); err != nil { + return nil, err + } + + // Generate the client keypair before opening a connection since the time + // taken is visible to an adversary. This key might not end up being used + // if a session ticket is present, but this doesn't take that long. + if ca.sessionKey, err = uniformdh.GenerateKey(csrand.Reader); err != nil { + return nil, err + } + return +} + +func parsePasswordArg(args *pt.Args) (*ssSharedSecret, error) { + str, ok := args.Get(passwordArg) + if !ok { + return nil, fmt.Errorf("missing argument '%s'", passwordArg) + } + + // To match the obfsproxy behavior, 'str' should contain a Base32 encoded + // shared secret (k_B) used for handshaking. + decoded, err := base32.StdEncoding.DecodeString(str) + if err != nil { + return nil, fmt.Errorf("failed to decode password: %s", err) + } + if len(decoded) != sharedSecretLength { + return nil, fmt.Errorf("password length %d is invalid", len(decoded)) + } + ss := new(ssSharedSecret) + copy(ss[:], decoded) + return ss, nil +} + +type ssCryptoState struct { + s cipher.Stream + mac hash.Hash +} + +func newCryptoState(aesKey []byte, ivPrefix []byte, macKey []byte) (*ssCryptoState, error) { + // The ScrambleSuit CTR-AES256 link crypto uses an 8 byte prefix from the + // KDF, and a 64 bit counter initialized to 1 as the IV. The initial value + // of the counter isn't documented in the spec either. + var initialCtr = []byte{0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01} + iv := make([]byte, 0, aes.BlockSize) + iv = append(iv, ivPrefix...) + iv = append(iv, initialCtr...) + b, err := aes.NewCipher(aesKey) + if err != nil { + return nil, err + } + s := cipher.NewCTR(b, iv) + mac := hmac.New(sha256.New, macKey) + return &ssCryptoState{s: s, mac: mac}, nil +} + +type ssConn struct { + net.Conn + + isServer bool + + lenDist *probdist.WeightedDist + receiveBuffer *bytes.Buffer + receiveDecodedBuffer *bytes.Buffer + receiveState ssRxState + + txCrypto *ssCryptoState + rxCrypto *ssCryptoState + + ticketStore *ssTicketStore +} + +type ssRxState struct { + mac []byte + hdr []byte + + totalLen int + payloadLen int +} + +func (conn *ssConn) Read(b []byte) (n int, err error) { + // If the receive payload buffer is empty, consume data off the network. + for conn.receiveDecodedBuffer.Len() == 0 { + if err = conn.readPackets(); err != nil { + break + } + } + + // Service the read request using buffered payload. + if conn.receiveDecodedBuffer.Len() > 0 { + n, _ = conn.receiveDecodedBuffer.Read(b) + } + return +} + +func (conn *ssConn) Write(b []byte) (n int, err error) { + var frameBuf bytes.Buffer + p := b + toSend := len(p) + + for toSend > 0 { + // Send as much payload as will fit into each frame as possible. + wrLen := len(p) + if wrLen > maxPayloadLength { + wrLen = maxPayloadLength + } + payload := p[:wrLen] + if err = conn.makePacket(&frameBuf, pktPayload, payload, 0); err != nil { + return 0, err + } + + toSend -= wrLen + p = p[wrLen:] + n += wrLen + } + + // Pad out the burst as appropriate. + if err = conn.padBurst(&frameBuf, conn.lenDist.Sample()); err != nil { + return 0, err + } + + // Write and return. + _, err = conn.Conn.Write(frameBuf.Bytes()) + return +} + +func (conn *ssConn) SetDeadline(t time.Time) error { + return ErrNotSupported +} + +func (conn *ssConn) SetReadDeadline(t time.Time) error { + return ErrNotSupported +} + +func (conn *ssConn) SetWriteDeadline(t time.Time) error { + return ErrNotSupported +} + +func (conn *ssConn) makePacket(w io.Writer, pktType byte, data []byte, padLen int) error { + payloadLen := len(data) + totalLen := payloadLen + padLen + if totalLen > maxPayloadLength { + panic(fmt.Sprintf("BUG: makePacket() len(data) + padLen > maxPayloadLength: %d + %d > %d", len(data), padLen, maxPayloadLength)) + } + + // Build the packet header (total length, payload length, flags), + // and append the payload and padding. + pkt := make([]byte, pktHdrLength, pktHdrLength+payloadLen+padLen) + binary.BigEndian.PutUint16(pkt[0:], uint16(totalLen)) + binary.BigEndian.PutUint16(pkt[2:], uint16(payloadLen)) + pkt[4] = pktType + pkt = append(pkt, data...) + pkt = append(pkt, zeroPadBytes[:padLen]...) + + // Encrypt the packet, and calculate the MAC. + conn.txCrypto.s.XORKeyStream(pkt, pkt) + conn.txCrypto.mac.Reset() + conn.txCrypto.mac.Write(pkt) + mac := conn.txCrypto.mac.Sum(nil)[:macLength] + + // Write out MAC | Packet. Note that this does not go onto the network + // yet, as w is a byte.Buffer (This is done so each call to conn.Write() + // gets padding added). + if _, err := w.Write(mac); err != nil { + return err + } + _, err := w.Write(pkt) + return err +} + +func (conn *ssConn) readPackets() error { + // Consume and buffer up to 1 MSS worth of data. + var buf [maxSegmentLength]byte + rdLen, rdErr := conn.Conn.Read(buf[:]) + conn.receiveBuffer.Write(buf[:rdLen]) + + // Process incoming packets incrementally. conn.receiveState stores + // the results of partial processing. + for conn.receiveBuffer.Len() > 0 { + if conn.receiveState.mac == nil { + // Read and store the packet MAC. + if conn.receiveBuffer.Len() < macLength { + break + } + mac := make([]byte, macLength) + conn.receiveBuffer.Read(mac) + conn.receiveState.mac = mac + } + + if conn.receiveState.hdr == nil { + // Read and store the packet header. + if conn.receiveBuffer.Len() < pktHdrLength { + break + } + hdr := make([]byte, pktHdrLength) + conn.receiveBuffer.Read(hdr) + + // Add the encrypted packet header to the HMAC instance, and then + // decrypt it so that the length of the packet can be determined. + conn.rxCrypto.mac.Reset() + conn.rxCrypto.mac.Write(hdr) + conn.rxCrypto.s.XORKeyStream(hdr, hdr) + + // Store the plaintext packet header, and host byte order length + // values. + totalLen := int(binary.BigEndian.Uint16(hdr[0:])) + payloadLen := int(binary.BigEndian.Uint16(hdr[2:])) + if payloadLen > totalLen || totalLen > maxPayloadLength { + return ErrInvalidPacket + } + conn.receiveState.hdr = hdr + conn.receiveState.totalLen = totalLen + conn.receiveState.payloadLen = payloadLen + } + + var data []byte + if conn.receiveState.totalLen > 0 { + // If the packet actually has payload (including padding), read, + // digest and decrypt it. + if conn.receiveBuffer.Len() < conn.receiveState.totalLen { + break + } + data = make([]byte, conn.receiveState.totalLen) + conn.receiveBuffer.Read(data) + conn.rxCrypto.mac.Write(data) + conn.rxCrypto.s.XORKeyStream(data, data) + } + + // Authenticate the packet, by comparing the received MAC with the one + // calculated over the ciphertext consumed off the network. + cmpMAC := conn.rxCrypto.mac.Sum(nil)[:macLength] + if !hmac.Equal(cmpMAC, conn.receiveState.mac[:]) { + return ErrInvalidPacket + } + + // Based on the packet flags, do something useful with the payload. + data = data[:conn.receiveState.payloadLen] + switch conn.receiveState.hdr[4] { + case pktPayload: + // User data, write it into the decoded payload buffer so that Read + // calls can be serviced. + conn.receiveDecodedBuffer.Write(data) + case pktNewTicket: + // New Session Ticket to be used for future handshakes, store it in + // the Session Ticket store. + if conn.isServer || len(data) != ticketKeyLength+ticketLength { + return ErrInvalidPacket + } + conn.ticketStore.storeTicket(conn.RemoteAddr(), data) + case pktPrngSeed: + // New PRNG_SEED for the protocol polymorphism. Regenerate the + // length obfuscation probability distribution. + if conn.isServer || len(data) != pktPrngSeedLength { + return ErrInvalidPacket + } + seed, err := drbg.SeedFromBytes(data) + if err != nil { + return ErrInvalidPacket + } + conn.lenDist.Reset(seed) + default: + return ErrInvalidPacket + } + + // Done processing a packet, clear the partial state. + conn.receiveState.mac = nil + conn.receiveState.hdr = nil + conn.receiveState.totalLen = 0 + conn.receiveState.payloadLen = 0 + } + return rdErr +} + +func (conn *ssConn) clientHandshake(kB *ssSharedSecret, sessionKey *uniformdh.PrivateKey) error { + if conn.isServer { + return fmt.Errorf("clientHandshake called on server connection") + } + + // Query the Session Ticket store to see if there is a stored session + // ticket. + ticket, err := conn.ticketStore.getTicket(conn.RemoteAddr()) + if err != nil { + return err + } else if ticket != nil { + // Ok, there is an existing ticket, so attempt to do a Session Ticket + // handshake. Until we write to the network, failures are non-fatal as + // we can transition gracefully into doing a UniformDH handshake. + + // Derive the keys from the prestored master key received with the + // ticket. This is done before the actual handshake since the + // handshake uses the outgoing HMAC-SHA256-128 key for authentication. + if err = conn.initCrypto(ticket.key[:]); err != nil { + goto handshakeUDH + } + + // Generate and send the ticket handshake. There is no response, since + // both sides have the keying material. + hs := newTicketClientHandshake(conn.txCrypto.mac, ticket) + blob, err := hs.generateHandshake() + if err != nil { + goto handshakeUDH + } + if _, err = conn.Conn.Write(blob); err != nil { + return err + } + return nil + } + +handshakeUDH: + // No session ticket, so take the slow path and do a UniformDH based + // handshake. + + // Generate and send the client handshake. + hs := newDHClientHandshake(kB, sessionKey) + blob, err := hs.generateHandshake() + if err != nil { + return err + } + if _, err = conn.Conn.Write(blob); err != nil { + return err + } + + // Consume the server handshake. Since we don't actually know the length + // of the respose, we need to consume data off the network till we either + // find the tail marker + MAC digest indicating that a handshake response + // has been received, or the maximum handshake size passes without a valid + // response. + var hsBuf [maxHandshakeLength]byte + for { + var n int + if n, err = conn.Conn.Read(hsBuf[:]); err != nil { + return err + } + conn.receiveBuffer.Write(hsBuf[:n]) + + // Attempt to process all the data seen so far as a response. + var seed []byte + n, seed, err = hs.parseServerHandshake(conn.receiveBuffer.Bytes()) + if err == errMarkNotFoundYet { + // No response found yet, keep trying. + continue + } else if err != nil { + return err + } + + // Ok, done processing the handshake, discard the response, and do the + // key derivation based off the calculated shared secret. + _ = conn.receiveBuffer.Next(n) + err = conn.initCrypto(seed) + return err + } +} + +func (conn *ssConn) initCrypto(seed []byte) (err error) { + // Use HKDF-SHA256 (Expand only, no Extract) to generate session keys from + // initial keying material. + okm := hkdfExpand(sha256.New, seed, nil, kdfSecretLength) + if conn.txCrypto, err = newCryptoState(okm[0:32], okm[32:40], okm[80:112]); err != nil { + return + } + if conn.rxCrypto, err = newCryptoState(okm[40:72], okm[72:80], okm[112:144]); err != nil { + return + } + return +} + +func (conn *ssConn) padBurst(burst *bytes.Buffer, sampleLen int) (err error) { + // Burst contains the fully encrypted+MACed outgoing payload that will be + // written to the network. Pad it out so that the last segment (based on + // the ScrambleSuit MTU) is sampleLen bytes. + + dataLen := burst.Len() % maxSegmentLength + padLen := 0 + if sampleLen >= dataLen { + padLen = sampleLen - dataLen + } else { + padLen = (maxSegmentLength - dataLen) + sampleLen + } + if padLen < pktOverhead { + // The padLen is less than the MAC + packet header in length, so + // two packets are required. + padLen += maxSegmentLength + } + + if padLen == 0 { + return + } else if padLen > maxSegmentLength { + // Note: packetmorpher.py: getPadding is slightly wrong and only + // accounts for one of the two packet headers. + if err = conn.makePacket(burst, pktPayload, nil, 700-pktOverhead); err != nil { + return + } + err = conn.makePacket(burst, pktPayload, nil, padLen-(700+2*pktOverhead)) + } else { + err = conn.makePacket(burst, pktPayload, nil, padLen-pktOverhead) + } + return +} + +func newScrambleSuitClientConn(conn net.Conn, tStore *ssTicketStore, ca *ssClientArgs) (net.Conn, error) { + // At this point we have kB and our session key, so we can directly + // start handshaking and seeing what happens. + + // Seed the initial polymorphism distribution. + seed, err := drbg.NewSeed() + if err != nil { + return nil, err + } + dist := probdist.New(seed, minLenDistLength, maxLenDistLength, true) + + // Allocate the client structure. + c := &ssConn{conn, false, dist, bytes.NewBuffer(nil), bytes.NewBuffer(nil), ssRxState{}, nil, nil, tStore} + + // Start the handshake timeout. + deadline := time.Now().Add(clientHandshakeTimeout) + if err := conn.SetDeadline(deadline); err != nil { + return nil, err + } + + // Attempt to handshake. + if err := c.clientHandshake(ca.kB, ca.sessionKey); err != nil { + return nil, err + } + + // Stop the handshake timeout. + if err := conn.SetDeadline(time.Time{}); err != nil { + return nil, err + } + + return c, nil +} diff --git a/transports/scramblesuit/handshake_ticket.go b/transports/scramblesuit/handshake_ticket.go new file mode 100644 index 0000000..ad9b4d4 --- /dev/null +++ b/transports/scramblesuit/handshake_ticket.go @@ -0,0 +1,228 @@ +/* + * Copyright (c) 2015, Yawning Angel <yawning at torproject dot org> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +package scramblesuit + +import ( + "bytes" + "encoding/base32" + "encoding/json" + "errors" + "fmt" + "hash" + "io/ioutil" + "net" + "os" + "path" + "strconv" + "sync" + "time" + + "git.torproject.org/pluggable-transports/obfs4.git/common/csrand" +) + +const ( + ticketFile = "scramblesuit_tickets.json" + + ticketKeyLength = 32 + ticketLength = 112 + ticketLifetime = 60 * 60 * 24 * 7 + + ticketMinPadLength = 0 + ticketMaxPadLength = 1388 +) + +var ( + errInvalidTicket = errors.New("scramblesuit: invalid serialized ticket") +) + +type ssTicketStore struct { + sync.Mutex + + filePath string + store map[string]*ssTicket +} + +type ssTicket struct { + key [ticketKeyLength]byte + ticket [ticketLength]byte + issuedAt int64 +} + +type ssTicketJSON struct { + KeyTicket string `json:"key-ticket"` + IssuedAt int64 `json:"issuedAt"` +} + +func (t *ssTicket) isValid() bool { + return t.issuedAt+ticketLifetime > time.Now().Unix() +} + +func newTicket(raw []byte) (*ssTicket, error) { + if len(raw) != ticketKeyLength+ticketLength { + return nil, errInvalidTicket + } + t := &ssTicket{issuedAt: time.Now().Unix()} + copy(t.key[:], raw[0:]) + copy(t.ticket[:], raw[ticketKeyLength:]) + return t, nil +} + +func (s *ssTicketStore) storeTicket(addr net.Addr, rawT []byte) { + t, err := newTicket(rawT) + if err != nil { + // Silently ignore ticket store failures. + return + } + + s.Lock() + defer s.Unlock() + + // Add the ticket to the map, and checkpoint to disk. Serialization errors + // are ignored because the handshake code will just use UniformDH if a + // ticket is not available. + s.store[addr.String()] = t + s.serialize() +} + +func (s *ssTicketStore) getTicket(addr net.Addr) (*ssTicket, error) { + aStr := addr.String() + + s.Lock() + defer s.Unlock() + + t, ok := s.store[aStr] + if ok && t != nil { + // Tickets are one use only, so remove tickets from the map, and + // checkpoint the map to disk. + delete(s.store, aStr) + err := s.serialize() + if !t.isValid() { + // Expired ticket, ignore it. + return nil, err + } + return t, err + } + + // No ticket was found, that's fine. + return nil, nil +} + +func (s *ssTicketStore) serialize() error { + encMap := make(map[string]*ssTicketJSON) + for k, v := range s.store { + kt := make([]byte, 0, ticketKeyLength+ticketLength) + kt = append(kt, v.key[:]...) + kt = append(kt, v.ticket[:]...) + ktStr := base32.StdEncoding.EncodeToString(kt) + jsonObj := &ssTicketJSON{KeyTicket: ktStr, IssuedAt: v.issuedAt} + encMap[k] = jsonObj + } + jsonStr, err := json.Marshal(encMap) + if err != nil { + return err + } + return ioutil.WriteFile(s.filePath, jsonStr, 0600) +} + +func loadTicketStore(stateDir string) (*ssTicketStore, error) { + fPath := path.Join(stateDir, ticketFile) + s := &ssTicketStore{filePath: fPath} + s.store = make(map[string]*ssTicket) + + f, err := ioutil.ReadFile(fPath) + if err != nil { + // No ticket store is fine. + if os.IsNotExist(err) { + return s, nil + } + + // But a file read error is not. + return nil, err + } + + encMap := make(map[string]*ssTicketJSON) + if err = json.Unmarshal(f, &encMap); err != nil { + return nil, fmt.Errorf("failed to load ticket store '%s': '%s'", fPath, err) + } + for k, v := range encMap { + raw, err := base32.StdEncoding.DecodeString(v.KeyTicket) + if err != nil || len(raw) != ticketKeyLength+ticketLength { + // Just silently skip corrupted tickets. + continue + } + t := &ssTicket{issuedAt: v.IssuedAt} + if !t.isValid() { + // Just ignore expired tickets. + continue + } + copy(t.key[:], raw[0:]) + copy(t.ticket[:], raw[ticketKeyLength:]) + s.store[k] = t + } + return s, nil +} + +type ssTicketClientHandshake struct { + mac hash.Hash + ticket *ssTicket + padLen int +} + +func (hs *ssTicketClientHandshake) generateHandshake() ([]byte, error) { + var buf bytes.Buffer + hs.mac.Reset() + + // The client handshake is T | P | M | MAC(T | P | M | E) + hs.mac.Write(hs.ticket.ticket[:]) + m := hs.mac.Sum(nil)[:macLength] + p, err := makePad(hs.padLen) + if err != nil { + return nil, err + } + + // Write T, P, M. + buf.Write(hs.ticket.ticket[:]) + buf.Write(p) + buf.Write(m) + + // Calculate and write the MAC. + e := []byte(strconv.FormatInt(getEpochHour(), 10)) + hs.mac.Write(p) + hs.mac.Write(m) + hs.mac.Write(e) + buf.Write(hs.mac.Sum(nil)[:macLength]) + + hs.mac.Reset() + return buf.Bytes(), nil +} + +func newTicketClientHandshake(mac hash.Hash, ticket *ssTicket) *ssTicketClientHandshake { + hs := &ssTicketClientHandshake{mac: mac, ticket: ticket} + hs.padLen = csrand.IntRange(ticketMinPadLength, ticketMaxPadLength) + return hs +} diff --git a/transports/scramblesuit/handshake_uniformdh.go b/transports/scramblesuit/handshake_uniformdh.go new file mode 100644 index 0000000..4345d65 --- /dev/null +++ b/transports/scramblesuit/handshake_uniformdh.go @@ -0,0 +1,174 @@ +/* + * Copyright (c) 2015, Yawning Angel <yawning at torproject dot org> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +package scramblesuit + +import ( + "bytes" + "crypto/hmac" + "crypto/sha256" + "errors" + "hash" + "strconv" + "time" + + "git.torproject.org/pluggable-transports/obfs4.git/common/csrand" + "git.torproject.org/pluggable-transports/obfs4.git/common/uniformdh" +) + +const ( + minHandshakeLength = uniformdh.Size + macLength*2 + maxHandshakeLength = 1532 + dhMinPadLength = 0 + dhMaxPadLength = 1308 + macLength = 128 / 8 // HMAC-SHA256-128() + + kdfSecretLength = keyLength * 2 +) + +var ( + errMarkNotFoundYet = errors.New("mark not found yet") + + // ErrInvalidHandshake is the error returned when the handshake fails. + ErrInvalidHandshake = errors.New("invalid handshake") +) + +type ssDHClientHandshake struct { + mac hash.Hash + keypair *uniformdh.PrivateKey + epochHour []byte + padLen int + + serverPublicKey *uniformdh.PublicKey + serverMark []byte +} + +func (hs *ssDHClientHandshake) generateHandshake() ([]byte, error) { + var buf bytes.Buffer + hs.mac.Reset() + + // The client handshake is X | P_C | M_C | MAC(X | P_C | M_C | E) + x, err := hs.keypair.PublicKey.Bytes() + if err != nil { + return nil, err + } + hs.mac.Write(x) + mC := hs.mac.Sum(nil)[:macLength] + pC, err := makePad(hs.padLen) + if err != nil { + return nil, err + } + + // Write X, P_C, M_C. + buf.Write(x) + buf.Write(pC) + buf.Write(mC) + + // Calculate and write the MAC. + hs.epochHour = []byte(strconv.FormatInt(getEpochHour(), 10)) + hs.mac.Write(pC) + hs.mac.Write(mC) + hs.mac.Write(hs.epochHour) + buf.Write(hs.mac.Sum(nil)[:macLength]) + + return buf.Bytes(), nil +} + +func (hs *ssDHClientHandshake) parseServerHandshake(resp []byte) (int, []byte, error) { + if len(resp) < minHandshakeLength { + return 0, nil, errMarkNotFoundYet + } + + // The server response is Y | P_S | M_S | MAC(Y | P_S | M_S | E). + if hs.serverPublicKey == nil { + y := resp[:uniformdh.Size] + + // Pull out the public key, and derive the server mark. + hs.serverPublicKey = &uniformdh.PublicKey{} + err := hs.serverPublicKey.SetBytes(y) + if err != nil { + return 0, nil, err + } + hs.mac.Reset() + hs.mac.Write(y) + hs.serverMark = hs.mac.Sum(nil)[:macLength] + } + + // Find the mark+MAC, if it exits. + endPos := len(resp) + if endPos > maxHandshakeLength-macLength { + endPos = maxHandshakeLength - macLength + } + pos := bytes.Index(resp[uniformdh.Size:endPos], hs.serverMark) + if pos == -1 { + if len(resp) >= maxHandshakeLength { + // Couldn't find the mark in a maximum length response. + return 0, nil, ErrInvalidHandshake + } + return 0, nil, errMarkNotFoundYet + } else if len(resp) < pos+2*macLength { + // Didn't receive the full M_S. + return 0, nil, errMarkNotFoundYet + } + pos += uniformdh.Size + + // Validate the MAC. + hs.mac.Write(resp[uniformdh.Size : pos+macLength]) + hs.mac.Write(hs.epochHour) + macCmp := hs.mac.Sum(nil)[:macLength] + macRx := resp[pos+macLength : pos+2*macLength] + if !hmac.Equal(macCmp, macRx) { + return 0, nil, ErrInvalidHandshake + } + + // Derive the shared secret. + ss, err := uniformdh.Handshake(hs.keypair, hs.serverPublicKey) + if err != nil { + return 0, nil, err + } + seed := sha256.Sum256(ss) + return pos + 2*macLength, seed[:], nil +} + +func newDHClientHandshake(kB *ssSharedSecret, sessionKey *uniformdh.PrivateKey) *ssDHClientHandshake { + hs := &ssDHClientHandshake{keypair: sessionKey} + hs.mac = hmac.New(sha256.New, kB[:]) + hs.padLen = csrand.IntRange(dhMinPadLength, dhMaxPadLength) + return hs +} + +func getEpochHour() int64 { + return time.Now().Unix() / 3600 +} + +func makePad(padLen int) ([]byte, error) { + pad := make([]byte, padLen) + if err := csrand.Bytes(pad); err != nil { + return nil, err + } + return pad, nil +} diff --git a/transports/scramblesuit/hkdf_expand.go b/transports/scramblesuit/hkdf_expand.go new file mode 100644 index 0000000..9626b38 --- /dev/null +++ b/transports/scramblesuit/hkdf_expand.go @@ -0,0 +1,67 @@ +/* + * Copyright (c) 2015, Yawning Angel <yawning at torproject dot org> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +package scramblesuit + +import ( + "crypto/hmac" + "hash" +) + +func hkdfExpand(hashFn func() hash.Hash, prk []byte, info []byte, l int) []byte { + // Why, yes. golang.org/x/crypto/hkdf exists, and is a fine + // implementation of HKDF. However it does both the extract + // and expand, while ScrambleSuit only does extract, with no + // way to separate the two steps. + + h := hmac.New(hashFn, prk) + digestSz := h.Size() + if l > 255*digestSz { + panic("hkdf: requested OKM length > 255*HashLen") + } + + var t []byte + okm := make([]byte, 0, l) + toAppend := l + ctr := byte(1) + for toAppend > 0 { + h.Reset() + h.Write(t) + h.Write(info) + h.Write([]byte{ctr}) + t = h.Sum(nil) + ctr++ + + aLen := digestSz + if toAppend < digestSz { + aLen = toAppend + } + okm = append(okm, t[:aLen]...) + toAppend -= aLen + } + return okm +} diff --git a/transports/transports.go b/transports/transports.go index 6b80bdc..ba4e099 100644 --- a/transports/transports.go +++ b/transports/transports.go @@ -37,6 +37,7 @@ import ( "git.torproject.org/pluggable-transports/obfs4.git/transports/obfs2" "git.torproject.org/pluggable-transports/obfs4.git/transports/obfs3" "git.torproject.org/pluggable-transports/obfs4.git/transports/obfs4" + "git.torproject.org/pluggable-transports/obfs4.git/transports/scramblesuit" ) var transportMapLock sync.Mutex @@ -88,4 +89,5 @@ func init() { Register(new(obfs2.Transport)) Register(new(obfs3.Transport)) Register(new(obfs4.Transport)) + Register(new(scramblesuit.Transport)) }

1 0

[obfs4/master] Do the release ritual for obfs4proxy-0.0.4.
by yawning＠torproject.org 17 Feb '15

17 Feb '15

commit 714581df514c74199c47451a2bc3a51cb34ccabd Author: Yawning Angel <yawning(a)torproject.org> Date: Tue Feb 17 11:45:41 2015 +0000 Do the release ritual for obfs4proxy-0.0.4. --- ChangeLog | 2 +- obfs4proxy/obfs4proxy.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 85fc60f..c0c57e3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,4 @@ -Changes in version 0.0.4 - UNRELEASED +Changes in version 0.0.4 - 2015-02-17 - Improve the runtime performance of the obfs4 handshake tests. - Changed the go.crypto import path to the new location (golang.org/x/crypto) - Added client only support for ScrambleSuit. diff --git a/obfs4proxy/obfs4proxy.go b/obfs4proxy/obfs4proxy.go index 5c93053..da8f011 100644 --- a/obfs4proxy/obfs4proxy.go +++ b/obfs4proxy/obfs4proxy.go @@ -51,7 +51,7 @@ import ( ) const ( - obfs4proxyVersion = "0.0.3" + obfs4proxyVersion = "0.0.4" obfs4proxyLogFile = "obfs4proxy.log" socksAddr = "127.0.0.1:0" elidedAddr = "[scrubbed]"

1 0

[tor/master] trivial whitespace fix
by arma＠torproject.org 17 Feb '15

17 Feb '15

commit d6dbd55849426ca5d7a2ea9f2aa4f1e85ab020f6 Author: Roger Dingledine <arma(a)torproject.org> Date: Tue Feb 17 06:01:33 2015 -0500 trivial whitespace fix --- src/or/circuitlist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/circuitlist.c b/src/or/circuitlist.c index 5355b17..bf7f8da 100644 --- a/src/or/circuitlist.c +++ b/src/or/circuitlist.c @@ -1545,7 +1545,7 @@ circuit_find_to_cannibalize(uint8_t purpose, extend_info_t *info, do { const node_t *ri2; if (tor_memeq(hop->extend_info->identity_digest, - info->identity_digest, DIGEST_LEN)) + info->identity_digest, DIGEST_LEN)) goto next; if (ri1 && (ri2 = node_get_by_id(hop->extend_info->identity_digest))

1 0

[translation/torbutton-torbuttonproperties] Update translations for torbutton-torbuttonproperties
by translation＠torproject.org 17 Feb '15

17 Feb '15

commit ccf3748518f5b3d771472a6586eec33a223ed6e9 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Feb 17 10:15:46 2015 +0000 Update translations for torbutton-torbuttonproperties --- hr_HR/torbutton.properties | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hr_HR/torbutton.properties b/hr_HR/torbutton.properties index 2e53eb2..8a43492 100644 --- a/hr_HR/torbutton.properties +++ b/hr_HR/torbutton.properties @@ -42,10 +42,10 @@ torbutton.popup.no_redirect = Nemoj preusmjeriti torbutton.popup.prompted_language = Da bi Vam dao više privatnosti, Torbutton može zatražiti verziju web stranice na engleskom jeziku. Ovo može prouzročiti da se stranice koje čitate na svom rodnom jeziku prikazuju na engleskom.\n\nŽelite li tražiti stranice na engleskom jeziku radi bolje privatnosti? torbutton.popup.no_newnym = Torbutton Vam ne može sigurno dati novi identitet. Nema pristup Tor Upravljačkom Portu.\n\nRadi li Vam Paket Tor Preglednika? torbutton.popup.use_tbb = Izgleda da koristite Torbutton s Firefox-om, što više nije preporučen sigurna konfiguracija.\n\nUmjesto toga, preporučamo da nabavite posljednji Paket Tor Preglednika tako što će te poslati email na gettor(a)torproject.org ili ga preuziti sa sljedeće adrese: -torbutton.popup.pref_error = Torgumb ne može ažurirati postavke u direktoriju profila Tor Preglednika. +torbutton.popup.pref_error = Torbutton ne može ažurirati postavke u direktoriju profila Tor Preglednika. torbutton.popup.permission_denied = Molimo Vas da ponovno postavite dopuštenja na direktoriju Tor Preglednika ili ga kopirate na novu lokaciju. torbutton.popup.device_full = Izgleda da je disk pun. Molimo Vas da oslobodite prostor ili preselite Tor Preglednik na novi uređaj. -torbutton.title.prompt_torbrowser = Bitne Torgumb informacije +torbutton.title.prompt_torbrowser = Bitne Torbutton informacije torbutton.popup.prompt_torbrowser = Torgumb radi drugačije sad: ne možete ga ugasiti više.\n\nNapravili smo ovu promjenu jer nije sigurno koristit Torgumb u pregledniku koji se koristi za ne-Tor pregledavanje. Bilo je previše grešaka koje nismo mogli ispraviti na drugi način.\n\nAko želite nastaviti koristit Firefox normalno, trebali bi deinstalirati Torgumb i skinuti Pkaet Tor Preglednika. Postavke privatnosti Tor Preglednika su superiorne običnom Firefox-u, čak i kad se koristi s Torgumbom.\n\nDa bi maknuli Torgumb, idite na Alati->Dodatci->Ekstenzije te stisnite gumb Ukloni pokraj Torgumba. torbutton.popup.short_torbrowser = Važne Torgumb informacije!\n\nTorgumb je sad osposobljen.\n\nStisnite Torgumb za više informacija.

1 0

[tor-browser-bundle/master] Bug #14221: fix update of the version -> builddir symlink
by gk＠torproject.org 17 Feb '15

17 Feb '15

commit b90119dd4194209af8168997eeb3181490d609ba Author: Nicolas Vigier <boklm(a)torproject.org> Date: Thu Jan 15 21:30:12 2015 +0100 Bug #14221: fix update of the version -> builddir symlink --- gitian/mkbundle-linux.sh | 2 +- gitian/mkbundle-mac.sh | 2 +- gitian/mkbundle-windows.sh | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/gitian/mkbundle-linux.sh b/gitian/mkbundle-linux.sh index 0dba906..c71981f 100755 --- a/gitian/mkbundle-linux.sh +++ b/gitian/mkbundle-linux.sh @@ -269,7 +269,7 @@ fi cd $WRAPPER_DIR if [ "$TORBROWSER_SYMLINK_VERSION" == '1' ] then - ln -sf $TORBROWSER_BUILDDIR $TORBROWSER_VERSION + ln -sfT $TORBROWSER_BUILDDIR $TORBROWSER_VERSION fi echo diff --git a/gitian/mkbundle-mac.sh b/gitian/mkbundle-mac.sh index 09b3172..309b1a8 100755 --- a/gitian/mkbundle-mac.sh +++ b/gitian/mkbundle-mac.sh @@ -233,7 +233,7 @@ fi cd $WRAPPER_DIR if [ "$TORBROWSER_SYMLINK_VERSION" == '1' ] then - ln -sf $TORBROWSER_BUILDDIR $TORBROWSER_VERSION + ln -sfT $TORBROWSER_BUILDDIR $TORBROWSER_VERSION fi echo diff --git a/gitian/mkbundle-windows.sh b/gitian/mkbundle-windows.sh index 39c57ce..0e2f87f 100755 --- a/gitian/mkbundle-windows.sh +++ b/gitian/mkbundle-windows.sh @@ -238,7 +238,7 @@ fi cd $WRAPPER_DIR if [ "$TORBROWSER_SYMLINK_VERSION" == '1' ] then - ln -sf $TORBROWSER_BUILDDIR $TORBROWSER_VERSION + ln -sfT $TORBROWSER_BUILDDIR $TORBROWSER_VERSION fi echo

1 0