February 2015 - tor-commits - lists.torproject.org

[bridgedb/develop] Add three unittests for parseExtraInfoFiles() with bad router-signatures.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit e8395678b7bfaaab55e4e6dcb59437c42263f29f Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 00:46:30 2015 +0000 Add three unittests for parseExtraInfoFiles() with bad router-signatures. --- lib/bridgedb/test/test_parse_descriptors.py | 50 +++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/lib/bridgedb/test/test_parse_descriptors.py b/lib/bridgedb/test/test_parse_descriptors.py index d67ff88..6395fdb 100644 --- a/lib/bridgedb/test/test_parse_descriptors.py +++ b/lib/bridgedb/test/test_parse_descriptors.py @@ -526,6 +526,56 @@ class ParseDescriptorsTests(unittest.TestCase): self.assertIn("2B5DA67FBA13A6449DE625673B7AE9E3AA7DF75F", routers.keys(), "The 'parseable' descriptor wasn't returned by the parser.") + def test_parse_descriptors_parseExtraInfoFiles_bad_signature_footer(self): + """Calling parseExtraInfoFiles() with a descriptor which has a + signature with a bad "-----END SIGNATURE-----" footer should return + zero parsed descriptors. + """ + unparseable = BRIDGE_EXTRA_INFO_DESCRIPTOR.replace( + '-----END SIGNATURE-----', + '-----END SIGNATURE FOR REALZ-----') + # This must be a "real" file or _copyUnparseableDescriptorFile() will + # raise an AttributeError saying: + # '_io.BytesIO' object has no attribute 'rpartition'" + descFileOne = self.writeTestDescriptorsToFile( + "bad-signature-footer", unparseable) + routers = descriptors.parseExtraInfoFiles(descFileOne) + + self.assertEqual(len(routers), 0) + + def test_parse_descriptors_parseExtraInfoFiles_missing_signature(self): + """Calling parseExtraInfoFiles() with a descriptor which is + missing the signature should return zero parsed descriptors. + """ + # Remove the signature + BEGIN_SIG = '-----BEGIN SIGNATURE-----' + unparseable, _ = BRIDGE_EXTRA_INFO_DESCRIPTOR.split(BEGIN_SIG) + # This must be a "real" file or _copyUnparseableDescriptorFile() will + # raise an AttributeError saying: + # '_io.BytesIO' object has no attribute 'rpartition'" + descFileOne = self.writeTestDescriptorsToFile( + "missing-signature", unparseable) + routers = descriptors.parseExtraInfoFiles(descFileOne) + + self.assertEqual(len(routers), 0) + + def test_parse_descriptors_parseExtraInfoFiles_bad_signature_too_short(self): + """Calling _verifyExtraInfoSignature() with a descriptor which has a + bad signature should raise an InvalidExtraInfoSignature exception. + """ + # Truncate the signature to 50 bytes + BEGIN_SIG = '-----BEGIN SIGNATURE-----' + doc, sig = BRIDGE_EXTRA_INFO_DESCRIPTOR.split(BEGIN_SIG) + unparseable = BEGIN_SIG.join([doc, sig[:50]]) + # This must be a "real" file or _copyUnparseableDescriptorFile() will + # raise an AttributeError saying: + # '_io.BytesIO' object has no attribute 'rpartition'" + descFileOne = self.writeTestDescriptorsToFile( + "truncated-signature", unparseable) + routers = descriptors.parseExtraInfoFiles(descFileOne) + + self.assertEqual(len(routers), 0) + def test_parse_descriptors_parseExtraInfoFiles_unparseable_BytesIO(self): """Test parsing three extrainfo descriptors: one is a valid descriptor, one is an older duplicate, and one is unparseable (it has a bad

1 0

[bridgedb/develop] Add missing warnings module import in bridgedb.bridges.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit b8a359029d2ebb536e556b95c15257cf847101a6 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 03:28:53 2015 +0000 Add missing warnings module import in bridgedb.bridges. --- lib/bridgedb/bridges.py | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/bridgedb/bridges.py b/lib/bridgedb/bridges.py index e59a2ad..b882e5b 100644 --- a/lib/bridgedb/bridges.py +++ b/lib/bridgedb/bridges.py @@ -17,6 +17,7 @@ import hashlib import ipaddr import logging import os +import warnings from Crypto.Util import asn1 from Crypto.Util.number import bytes_to_long

1 0

[bridgedb/develop] Add test for Bridges with additional ORAddresses which are IPv4.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit bdd90d749ff31b626a9fce2d3616821062d3acfa Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 03:35:35 2015 +0000 Add test for Bridges with additional ORAddresses which are IPv4. --- lib/bridgedb/test/test_bridges.py | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/lib/bridgedb/test/test_bridges.py b/lib/bridgedb/test/test_bridges.py index c305c10..2f21c36 100644 --- a/lib/bridgedb/test/test_bridges.py +++ b/lib/bridgedb/test/test_bridges.py @@ -839,6 +839,30 @@ class BridgeTests(unittest.TestCase): ''.join(['$', '0'*40, '~', bridge.nickname])) + def test_Bridge_updateFromNetworkStatus_IPv4_ORAddress(self): + """Calling updateFromNetworkStatus() with a descriptor which has an + IPv4 address as an additional ORAddress should result in a + FutureWarning before continuing parsing. + """ + # Add an additional IPv4 ORAddress: + ns = BRIDGE_NETWORKSTATUS.replace( + 'a [6bf3:806b:78cd:d4b4:f6a7:4ced:cfad:dad4]:36488', + 'a [6bf3:806b:78cd:d4b4:f6a7:4ced:cfad:dad4]:36488\na 123.34.56.78:36488') + self._writeNetworkstatus(ns) + self._parseAllDescriptorFiles() + + self.assertWarns( + FutureWarning, + "Got IPv4 address in 'a'/'or-address' line! Descriptor format may have changed!", + bridges.__file__, # filename + self.bridge.updateFromNetworkStatus, + self.networkstatus) + + self.assertEqual(self.bridge.fingerprint, + '2C3225C4805331025E211F4B6E5BF45C333FDD2C') + self.assertIn((ipaddr.IPAddress('123.34.56.78'), 36488, 4), + self.bridge.allVanillaAddresses) + def test_Bridge_updateFromServerDescriptor(self): """ """ self.bridge.updateFromNetworkStatus(self.networkstatus)

1 0

[bridgedb/develop] Add test for Bridge.updateFromExtraInfoDescriptor() with a changed PT.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit d1909c8a0aa52168d9456df7b0a06f432c61dce5 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 00:50:29 2015 +0000 Add test for Bridge.updateFromExtraInfoDescriptor() with a changed PT. This tests what happens if we receive an updated extrainfo descriptor for a Bridge where one of its PTs has changed its port number. --- lib/bridgedb/test/test_bridges.py | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/lib/bridgedb/test/test_bridges.py b/lib/bridgedb/test/test_bridges.py index bae418a..ae9aa92 100644 --- a/lib/bridgedb/test/test_bridges.py +++ b/lib/bridgedb/test/test_bridges.py @@ -904,6 +904,34 @@ class BridgeTests(unittest.TestCase): self.assertEqual(len(self.bridge.transports), 0) self.assertIsNone(self.bridge.descriptors['extrainfo']) + def test_Bridge_updateFromExtraInfoDescriptor_pt_changed_port(self): + """Calling updateFromExtraInfoDescriptor() with a descriptor which + includes a different port for a known bridge with a known pluggable + transport should update that transport. + """ + self.bridge.updateFromNetworkStatus(self.networkstatus) + self.bridge.updateFromServerDescriptor(self.serverdescriptor) + self.bridge.updateFromExtraInfoDescriptor(self.extrainfo) + + self.assertEqual(len(self.bridge.transports), 4) + + for pt in self.bridge.transports: + if pt.methodname == 'obfs4': + self.assertEqual(pt.address, ipaddr.IPv4Address('179.178.155.140')) + self.assertEqual(pt.port, 36493) + + # Change the port of obfs4 transport in the extrainfo descriptor: + transportline = self.extrainfo.transport['obfs4'] + self.extrainfo.transport['obfs4'] = (transportline[0], + 31337, + transportline[2]) + self.bridge.updateFromExtraInfoDescriptor(self.extrainfo) + + for pt in self.bridge.transports: + if pt.methodname == 'obfs4': + self.assertEqual(pt.address, ipaddr.IPv4Address('179.178.155.140')) + self.assertEqual(pt.port, 31337) + def test_Bridge_updateFromExtraInfoDescriptor_pt_changed_args(self): """Calling updateFromExtraInfoDescriptor() with a descriptor which includes different PT args for a known bridge with a known pluggable

1 0

[bridgedb/develop] Change allVanillaAddresses; Stem only allows the ORAddresses to be IPv4.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit 281aa6deda4a4d43f8fd57f72ffa4c324ec7767a Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 03:16:17 2015 +0000 Change allVanillaAddresses; Stem only allows the ORAddresses to be IPv4. * CHANGE Bridge.allVanillaAddresses to only expect the Bridge's primary ORAddress to be IPv4. --- lib/bridgedb/bridges.py | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/lib/bridgedb/bridges.py b/lib/bridgedb/bridges.py index 3c47967..e59a2ad 100644 --- a/lib/bridgedb/bridges.py +++ b/lib/bridgedb/bridges.py @@ -1020,11 +1020,9 @@ class Bridge(BridgeBackwardsCompatibility): address and port. """ addresses = self.orAddresses - # Add the default ORPort address: - if isIPv4(self.address): - addresses.append((self.address, self.orPort, 4)) - elif isIPv6(self.address): - addresses.append((self.address, self.orPort, 6)) + # Add the default ORPort address (it will always be IPv4, otherwise + # Stem should have raised a ValueError during parsing): + addresses.append((self.address, self.orPort, 4)) return addresses def assertOK(self):

1 0

[bridgedb/develop] Add missing super() call in BridgeBase.__init__().
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit e81580aa7abd5dd4ba246860489c957ccc903027 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 03:07:56 2015 +0000 Add missing super() call in BridgeBase.__init__(). --- lib/bridgedb/bridges.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/bridgedb/bridges.py b/lib/bridgedb/bridges.py index 54ffbe8..901baf5 100644 --- a/lib/bridgedb/bridges.py +++ b/lib/bridgedb/bridges.py @@ -482,6 +482,8 @@ class BridgeBase(BridgeAddressBase): """The base class for all bridge implementations.""" def __init__(self): + super(BridgeBase, self).__init__() + self._nickname = None self._orPort = None self.socksPort = 0 # Bridges should always have ``SOCKSPort`` and

1 0

[bridgedb/develop] Add test for Bridge.updateFromExtraInfoDescriptor() with bad signature.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit 5309a94c376529e77008b36c63cc55e91d76ca67 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 00:48:51 2015 +0000 Add test for Bridge.updateFromExtraInfoDescriptor() with bad signature. --- lib/bridgedb/test/test_bridges.py | 53 ++++++++++++++++++++++++++++--------- 1 file changed, 41 insertions(+), 12 deletions(-) diff --git a/lib/bridgedb/test/test_bridges.py b/lib/bridgedb/test/test_bridges.py index 9353d1c..bae418a 100644 --- a/lib/bridgedb/test/test_bridges.py +++ b/lib/bridgedb/test/test_bridges.py @@ -706,19 +706,34 @@ class BridgeBackwardsCompatibilityTests(unittest.TestCase): class BridgeTests(unittest.TestCase): """Tests for :class:`bridgedb.bridges.Bridge`.""" - def _writeDescriptorFiles(self): + def _parseAllDescriptorFiles(self): + self.networkstatus = descriptors.parseNetworkStatusFile( + self._networkstatusFile)[0] + self.serverdescriptor = descriptors.parseServerDescriptorsFile( + self._serverDescriptorFile)[0] + self.extrainfo = descriptors.parseExtraInfoFiles( + self._extrainfoFile).values()[0] + + def _writeNetworkstatus(self, networkstatus): with open(self._networkstatusFile, 'w') as fh: - fh.write(BRIDGE_NETWORKSTATUS) + fh.write(networkstatus) fh.flush() + def _writeServerdesc(self, serverdesc): with open(self._serverDescriptorFile, 'w') as fh: - fh.write(BRIDGE_SERVER_DESCRIPTOR) + fh.write(serverdesc) fh.flush() + def _writeExtrainfo(self, extrainfo): with open(self._extrainfoFile, 'w') as fh: - fh.write(BRIDGE_EXTRAINFO) + fh.write(extrainfo) fh.flush() + def _writeDescriptorFiles(self, networkstatus, serverdesc, extrainfo): + self._writeNetworkstatus(networkstatus) + self._writeServerdesc(serverdesc) + self._writeExtrainfo(extrainfo) + def setUp(self): def _cwd(filename): return os.path.sep.join([os.getcwd(), filename]) @@ -727,14 +742,10 @@ class BridgeTests(unittest.TestCase): self._serverDescriptorFile = _cwd('BridgeTests-bridge-descriptors') self._extrainfoFile = _cwd('BridgeTests-cached-extrainfo') - self._writeDescriptorFiles() - - self.networkstatus = descriptors.parseNetworkStatusFile( - self._networkstatusFile)[0] - self.serverdescriptor = descriptors.parseServerDescriptorsFile( - self._serverDescriptorFile)[0] - self.extrainfo = descriptors.parseExtraInfoFiles( - self._extrainfoFile).values()[0] + self._writeDescriptorFiles(BRIDGE_NETWORKSTATUS, + BRIDGE_SERVER_DESCRIPTOR, + BRIDGE_EXTRAINFO) + self._parseAllDescriptorFiles() self.bridge = bridges.Bridge() @@ -875,6 +886,24 @@ class BridgeTests(unittest.TestCase): self.assertEqual(self.bridge.bandwidthObserved, 1623207134) self.assertEqual(len(self.bridge.transports), 4) + def test_Bridge_updateFromExtraInfoDescriptor_bad_signature_changed(self): + """Calling updateFromExtraInfoDescriptor() with a descriptor which + has a bad signature should not continue to process the descriptor. + """ + # Make the signature uppercased + BEGIN_SIG = '-----BEGIN SIGNATURE-----' + doc, sig = BRIDGE_EXTRAINFO.split(BEGIN_SIG) + ei = BEGIN_SIG.join([doc, sig.upper()]) + self._writeExtrainfo(ei) + self._parseAllDescriptorFiles() + + self.bridge.updateFromNetworkStatus(self.networkstatus) + self.bridge.updateFromServerDescriptor(self.serverdescriptor) + self.bridge.updateFromExtraInfoDescriptor(self.extrainfo) + + self.assertEqual(len(self.bridge.transports), 0) + self.assertIsNone(self.bridge.descriptors['extrainfo']) + def test_Bridge_updateFromExtraInfoDescriptor_pt_changed_args(self): """Calling updateFromExtraInfoDescriptor() with a descriptor which includes different PT args for a known bridge with a known pluggable

1 0

[bridgedb/develop] Add test for b.p.d.parseNetworkStatusFile() with IPv6 primary ORAddress.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit 4a4d2ec746ef277e3a915eeb895a5ae104098cce Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 03:14:58 2015 +0000 Add test for b.p.d.parseNetworkStatusFile() with IPv6 primary ORAddress. --- lib/bridgedb/test/test_parse_descriptors.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/lib/bridgedb/test/test_parse_descriptors.py b/lib/bridgedb/test/test_parse_descriptors.py index 6395fdb..6a04861 100644 --- a/lib/bridgedb/test/test_parse_descriptors.py +++ b/lib/bridgedb/test/test_parse_descriptors.py @@ -286,6 +286,18 @@ class ParseDescriptorsTests(unittest.TestCase): descriptors.parseNetworkStatusFile, descFile) + def test_parse_descriptors_parseNetworkStatusFile_IPv6_ORAddress(self): + """A Bridge can't have its primary ORAddress be IPv6 without raising + a ValueError. + """ + unparseable = BRIDGE_NETWORKSTATUS_0.replace( + '2.215.61.223', '[2837:fcd2:387b:e376:34c:1ec7:11ff:1686]') + descFile = self.writeTestDescriptorsToFile('networkstatus-bridges', + unparseable) + self.assertRaises(ValueError, + descriptors.parseNetworkStatusFile, + descFile) + def test_parse_descriptors_parseNetworkStatusFile_with_annotations(self): """Test ``b.p.descriptors.parseNetworkStatusFile`` with some document headers before the first 'r'-line.

1 0

[bridgedb/develop] Add unittest for Bridge._checkServerDescriptor with mismatched digest.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit 1209ffee6b76b3f849fb326ae6fc41f23665a2f8 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 00:52:08 2015 +0000 Add unittest for Bridge._checkServerDescriptor with mismatched digest. --- lib/bridgedb/test/test_bridges.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/lib/bridgedb/test/test_bridges.py b/lib/bridgedb/test/test_bridges.py index ae9aa92..1d6f678 100644 --- a/lib/bridgedb/test/test_bridges.py +++ b/lib/bridgedb/test/test_bridges.py @@ -1037,6 +1037,18 @@ class BridgeTests(unittest.TestCase): self.bridge.updateFromServerDescriptor, self.serverdescriptor) + def test_Bridge_checkServerDescriptor_digest_mismatch(self): + """Parsing a server descriptor when the corresponding networkstatus + descriptor didn't include a server bridge.descriptorDigest should raise + a MissingServerDescriptorDigest exception. + """ + self.bridge.updateFromNetworkStatus(self.networkstatus) + + self.bridge.descriptorDigest = None + self.assertRaises(bridges.MissingServerDescriptorDigest, + self.bridge._checkServerDescriptor, + self.serverdescriptor) + def test_Bridge_assertOK(self): """If all orAddresses are okay, then assertOK() should return None.""" self.bridge.updateFromNetworkStatus(self.networkstatus)

1 0

[bridgedb/develop] Bridge._constructBridgeLine() won't be handed an invalid addresses.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit fa007b2e422a604f6f3a855720009c2406fb1a96 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 03:08:58 2015 +0000 Bridge._constructBridgeLine() won't be handed an invalid addresses. The only way that Bridge._constructBridgeLine() is called is through Bridge.getBridgeLine() when vanilla bridges are requested. Because of all the sanitisation in Stem and the rest of BridgeDB's parsers, no type of bridgerequest, no matter how malformed, will ever result in an invalid addrport from Bridge._getVanillaForRequest(). Secondly, we'll never get anything other than IPv4 and IPv6 addresses, for the same reasons. * REMOVE lines which raise MalformedBridgeInfo in Bridge._constructBridgeLine(). --- lib/bridgedb/bridges.py | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/lib/bridgedb/bridges.py b/lib/bridgedb/bridges.py index 901baf5..3c47967 100644 --- a/lib/bridgedb/bridges.py +++ b/lib/bridgedb/bridges.py @@ -860,8 +860,6 @@ class Bridge(BridgeBackwardsCompatibility): line. :param bool bridgePrefix: if ``True``, prefix the :term:`Bridge Line` with ``'Bridge '``. - :raises MalformedBridgeInfo: if the **addrport** didn't turn out to be - a 2-tuple containing ``(ipaddress, port)``. :rtype: string :returns: A bridge line suitable for adding into a ``torrc`` file or Tor Launcher. @@ -869,11 +867,7 @@ class Bridge(BridgeBackwardsCompatibility): if not addrport: return - try: - address, port, version = addrport - except (TypeError, ValueError): - raise MalformedBridgeInfo("Can't process addrport: %r" % addrport) - + address, port, version = addrport bridgeLine = [] if bridgePrefix: @@ -883,8 +877,6 @@ class Bridge(BridgeBackwardsCompatibility): bridgeLine.append("%s:%d" % (str(address), port)) elif version == 6: bridgeLine.append("[%s]:%d" % (str(address), port)) - else: - raise MalformedBridgeInfo("IP version must be 4 or 6") if includeFingerprint: bridgeLine.append("%s" % self.fingerprint)

1 0