February 2015 - tor-commits - lists.torproject.org

[bridgedb/develop] Make Bridge server-descriptor checks raise exceptions.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit aa6015a7bdb8208a4ca51b05de04f12d6be8b536 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Dec 11 03:54:30 2014 +0000 Make Bridge server-descriptor checks raise exceptions. --- lib/bridgedb/bridges.py | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/lib/bridgedb/bridges.py b/lib/bridgedb/bridges.py index 5498758..4ae54c6 100644 --- a/lib/bridgedb/bridges.py +++ b/lib/bridgedb/bridges.py @@ -1221,15 +1221,13 @@ class Bridge(BridgeBackwardsCompatibility): :type descriptor: :api:`stem.descriptor.server_descriptor.RelayDescriptor` :param descriptor: + :raises MalformedBridgeInfo: If this Bridge has no corresponding + networkstatus entry, or its **descriptor** digest didn't match the + expected digest (from the networkstatus entry). """ + self._checkServerDescriptor(descriptor) self.descriptors['server'] = descriptor - try: - self._checkServerDescriptor(descriptor) - except ValueError as error: - logging.warn(error) - # XXX should we throw away this descriptor? - # Replace the values which we harvested from the networkstatus # descriptor, because that one isn't signed with the bridge's identity # key.

1 0

[bridgedb/develop] Change usage of Bridge.allVanillaAddresses to use new 3-tuple form.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit 0680b5e89aa421778b7659497243a2e788b7a97e Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Dec 11 03:50:39 2014 +0000 Change usage of Bridge.allVanillaAddresses to use new 3-tuple form. --- lib/bridgedb/bridges.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/bridgedb/bridges.py b/lib/bridgedb/bridges.py index 899a091..48dc33a 100644 --- a/lib/bridgedb/bridges.py +++ b/lib/bridgedb/bridges.py @@ -28,6 +28,7 @@ from bridgedb import safelog from bridgedb import bridgerequest from bridgedb.crypto import removePKCS1Padding from bridgedb.parse.addr import isIPAddress +from bridgedb.parse.addr import isIPv4 from bridgedb.parse.addr import isIPv6 from bridgedb.parse.addr import isValidIP from bridgedb.parse.addr import PortList @@ -887,7 +888,10 @@ class Bridge(BridgeBackwardsCompatibility): """ addresses = self.orAddresses # Add the default ORPort address: - addresses.append((self.address, self.orPort,)) + if isIPv4(self.address): + addresses.append((self.address, self.orPort, 4)) + elif isIPv6(self.address): + addresses.append((self.address, self.orPort, 6)) return addresses def assertOK(self): @@ -916,11 +920,13 @@ class Bridge(BridgeBackwardsCompatibility): malformed.append("Invalid ORPort address: '%s'" % self.address) if not (1 <= self.orPort <= 65535): malformed.append("Invalid ORPort port: '%d'" % self.orPort) - for (address, port) in self.orAddresses: + for (address, port, version) in self.orAddresses: if not isValidIP(address): malformed.append("Invalid ORAddress address: '%s'" % address) if not (1 <= port <= 65535): malformed.append("Invalid ORAddress port: '%d'" % port) + if not version in (4, 6): + malformed.append("Invalid ORAddress IP version: %r" % version) if malformed: raise MalformedBridgeInfo('\n'.join(malformed))

1 0

[bridgedb/develop] Fix another typoed name of a Stem descriptor attribute.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit b6d84d3546e2dacc7547d7ccdc0237ae5ceefdee Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Dec 11 03:55:56 2014 +0000 Fix another typoed name of a Stem descriptor attribute. --- lib/bridgedb/bridges.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/bridgedb/bridges.py b/lib/bridgedb/bridges.py index ec5aefe..2e64fdf 100644 --- a/lib/bridgedb/bridges.py +++ b/lib/bridgedb/bridges.py @@ -1253,7 +1253,7 @@ class Bridge(BridgeBackwardsCompatibility): self.os = descriptor.operating_system self.uptime = descriptor.uptime - self.extrainfoDigest = descriptor.extrainfoDigest + self.extrainfoDigest = descriptor.extra_info_digest def _verifyExtraInfoSignature(self, descriptor): """Verify the signature on the contents of this :class:`Bridge`'s

1 0

[bridgedb/develop] Change Bridge.nickname into a @property.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit 293d390ae320d77d09125cfbb70f63f46127f0bf Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Dec 11 04:31:59 2014 +0000 Change Bridge.nickname into a @property. --- lib/bridgedb/bridges.py | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/lib/bridgedb/bridges.py b/lib/bridgedb/bridges.py index 2e64fdf..5c92898 100644 --- a/lib/bridgedb/bridges.py +++ b/lib/bridgedb/bridges.py @@ -35,6 +35,7 @@ from bridgedb.parse.addr import PortList from bridgedb.parse.fingerprint import isValidFingerprint from bridgedb.parse.fingerprint import toHex from bridgedb.parse.fingerprint import fromHex +from bridgedb.parse.nickname import isValidRouterNickname class PluggableTransportUnavailable(Exception): @@ -386,7 +387,7 @@ class BridgeBase(object): def __init__(self): self._fingerprint = None - self.nickname = None + self._nickname = None self.address = None self.orPort = None self.socksPort = 0 # Bridges should always have ``SOCKSPort`` and @@ -424,6 +425,29 @@ class BridgeBase(object): """Reset this Bridge's fingerprint.""" self._fingerprint = None + @property + def nickname(self): + """Get this Bridge's nickname. + + :rtype: str + :returns: The Bridge's nickname. + """ + return self._nickname + + @nickname.setter + def nickname(self, value): + """Set this Bridge's nickname to **value**. + + :param str value: The nickname of this Bridge. + """ + if isValidRouterNickname(value): + self._nickname = value + + @nickname.deleter + def nickname(self, value): + """Reset this Bridge's nickname.""" + self._nickname = None + class BridgeBackwardsCompatibility(BridgeBase): """Backwards compatibility methods for the old Bridge class."""

1 0

[bridgedb/develop] Change isValidRouterNickname() to only return booleans.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit 192a3e876015fd6bc1414af2df55945bb79471a2 Author: Isis Lovecruft <isis(a)torproject.org> Date: Thu Dec 11 04:28:04 2014 +0000 Change isValidRouterNickname() to only return booleans. --- lib/bridgedb/parse/networkstatus.py | 2 ++ lib/bridgedb/parse/nickname.py | 25 +++++++++++++++++-------- 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/lib/bridgedb/parse/networkstatus.py b/lib/bridgedb/parse/networkstatus.py index 106edd9..8140fe0 100644 --- a/lib/bridgedb/parse/networkstatus.py +++ b/lib/bridgedb/parse/networkstatus.py @@ -39,6 +39,8 @@ from twisted.python.log import showwarning from bridgedb.parse import addr from bridgedb.parse import parseUnpaddedBase64 from bridgedb.parse import InvalidBase64 +from bridgedb.parse.nickname import InvalidRouterNickname +from bridgedb.parse.nickname import isValidRouterNickname class NetworkstatusParsingError(Exception): diff --git a/lib/bridgedb/parse/nickname.py b/lib/bridgedb/parse/nickname.py index b38bdb8..9c3a559 100644 --- a/lib/bridgedb/parse/nickname.py +++ b/lib/bridgedb/parse/nickname.py @@ -33,16 +33,25 @@ class InvalidRouterNickname(ValueError): def isValidRouterNickname(nickname): """Determine if a router's given nickname meets the specification. - :raises InvalidRouterNickname: if the nickname is invalid. :param string nickname: An OR's nickname. + :rtype: bool + :returns: ``True`` if the nickname is valid, ``False`` otherwise. """ ALPHANUMERIC = string.letters + string.digits - if not (1 <= len(nickname) <= 19): - raise InvalidRouterNickname( - "Nicknames must be between 1 and 19 characters: %r" % nickname) - for letter in nickname: - if not letter in ALPHANUMERIC: + try: + if not (1 <= len(nickname) <= 19): raise InvalidRouterNickname( - "Nicknames must only use [A-Za-z0-9]: %r" % nickname) - return True + "Nicknames must be between 1 and 19 characters: %r" % nickname) + for letter in nickname: + if not letter in ALPHANUMERIC: + raise InvalidRouterNickname( + "Nicknames must only use [A-Za-z0-9]: %r" % nickname) + except InvalidRouterNickname as error: + logging.error(str(error)) + except TypeError: # The nickname was probably still set to ``None`` + pass + else: + return True + + return False

1 0

[bridgedb/develop] Use new bridgedb.bridges.Bridge API in bridgedb.Bridges functions.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit af54441978c9c56e0cd2371b765ede53cb8ce93d Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon Dec 22 03:40:46 2014 +0000 Use new bridgedb.bridges.Bridge API in bridgedb.Bridges functions. --- lib/bridgedb/Bridges.py | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/lib/bridgedb/Bridges.py b/lib/bridgedb/Bridges.py index 1dd8dfa..43edc3d 100644 --- a/lib/bridgedb/Bridges.py +++ b/lib/bridgedb/Bridges.py @@ -22,6 +22,7 @@ import random import bridgedb.Storage import bridgedb.Bucket +from bridgedb.bridges import Bridge from bridgedb.crypto import getHMACFunc from bridgedb.parse import addr from bridgedb.parse import networkstatus @@ -409,11 +410,11 @@ class BridgeRing(BridgeHolder): """ for tp, val, _, subring in self.subrings: if tp == 'port': - if val == bridge.orport: + if val == bridge.orPort: subring.insert(bridge) else: assert tp == 'flag' and val == 'stable' - if val == 'stable' and bridge.stable: + if val == 'stable' and bridge.flags.stable: subring.insert(bridge) ident = bridge.getID() @@ -423,7 +424,7 @@ class BridgeRing(BridgeHolder): self.isSorted = False self.bridges[pos] = bridge self.bridgesByID[ident] = bridge - logging.debug("Adding %s to %s" % (bridge.ip, self.name)) + logging.debug("Adding %s to %s" % (bridge.address, self.name)) def _sort(self): """Helper: put the keys in sorted order.""" @@ -592,7 +593,7 @@ class UnallocatedHolder(BridgeHolder): self.fingerprints = [] def insert(self, bridge): - logging.debug("Leaving %s unallocated", bridge.getConfigLine(True)) + logging.debug("Leaving %s unallocated", bridge.fingerprint) if not bridge.fingerprint in self.fingerprints: self.fingerprints.append(bridge.fingerprint) @@ -670,10 +671,12 @@ class BridgeSplitter(BridgeHolder): for s in self.statsHolders: s.insert(bridge) - if not bridge.running: + + # The bridge must be running to insert it: + if not bridge.flags.running: return - bridgeID = bridge.getID() + bridgeID = bridge.fingerprint # Determine which ring to put this bridge in if we haven't seen it # before. @@ -753,7 +756,8 @@ class FilteredBridgeSplitter(BridgeHolder): :type bridge: :class:`~bridgedb.Bridges.Bridge` :param bridge: The bridge to add. """ - if not bridge.running: + # The bridge must be running to insert it: + if not bridge.flags.running: logging.warn( "Skipping hashring insertion for non-running bridge: '%s'" % logSafely(bridge.fingerprint)) @@ -879,8 +883,7 @@ class FilteredBridgeSplitter(BridgeHolder): desc.append(g.description) # add transports - logging.debug("%s supports %d transports" % (toHex(b.getID()), - len(b.transports))) + logging.debug("%s supports %d transports" % (b, len(b.transports))) for transport in b.transports: desc.append("transport=%s"%(transport.methodname))

1 0

[bridgedb/develop] Catch ValueErrors in isValidFingerprint.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit 95f0cfecca414ee3fe6c64d121300fe889f13f0f Author: Isis Lovecruft <isis(a)torproject.org> Date: Fri Dec 12 11:23:44 2014 +0000 Catch ValueErrors in isValidFingerprint. --- lib/bridgedb/parse/fingerprint.py | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/lib/bridgedb/parse/fingerprint.py b/lib/bridgedb/parse/fingerprint.py index 17f15c3..900fc06 100644 --- a/lib/bridgedb/parse/fingerprint.py +++ b/lib/bridgedb/parse/fingerprint.py @@ -34,11 +34,13 @@ def isValidFingerprint(fingerprint): :rtype: bool :returns: ``True`` if the **fingerprint** was valid, ``False`` otherwise. """ - if len(fingerprint) == HEX_FINGERPRINT_LEN: - try: - fromHex(fingerprint) - except TypeError: - logging.debug("Invalid hex fingerprint: %r" % repr(fingerprint)) - else: - return True + try: + if len(fingerprint) != HEX_FINGERPRINT_LEN: + raise ValueError("Fingerprint has incorrect length: %r" + % repr(fingerprint)) + fromHex(fingerprint) + except (TypeError, ValueError): + logging.debug("Invalid hex fingerprint: %r" % repr(fingerprint)) + else: + return True return False

1 0

[bridgedb/develop] This test was supposed to test deduplication. Now it does.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit 65f18cd7c31a97274a8277688f0512b69ac1e3e3 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Aug 26 03:58:28 2014 +0000 This test was supposed to test deduplication. Now it does. --- lib/bridgedb/test/test_parse_descriptors.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/lib/bridgedb/test/test_parse_descriptors.py b/lib/bridgedb/test/test_parse_descriptors.py index 2a1171e..b947a39 100644 --- a/lib/bridgedb/test/test_parse_descriptors.py +++ b/lib/bridgedb/test/test_parse_descriptors.py @@ -265,6 +265,5 @@ class ParseDescriptorsTests(unittest.TestCase): descFileOne = io.BytesIO(BRIDGE_EXTRA_INFO_DESCRIPTOR) descFileTwo = io.BytesIO(BRIDGE_EXTRA_INFO_DESCRIPTOR_NEWER_DUPLICATE) routers = descriptors.parseBridgeExtraInfoFiles(descFileOne, descFileTwo) - bridge = routers.values()[0] - self.assertEqual(bridge.fingerprint, - u'6FA9216CF3A06E89A03121ACC31F70F8DFD7DDCC') + # We shouldn't have duplicates: + self.assertEqual(len(routers), 1)

1 0

[bridgedb/develop] Rename bridgedb.Main.startup → bridgedb.Main.run.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit ddbe8c8b0d59930694c8c057581c6e5b0bdc9264 Author: Isis Lovecruft <isis(a)torproject.org> Date: Fri Aug 29 00:09:32 2014 +0000 Rename bridgedb.Main.startup → bridgedb.Main.run. * REMOVE old `bridgedb.Main.run` function, which did nothing but call `bridgedb.Main.startup` and act as the entry point into BridgeDB's main run loop in `scripts/bridgedb`. * RENAME `bridgedb.Main.startup` to `bridgedb.Main.run` so that it is now the default entry point. * UPDATE docstring for `bridgedb.Main.run`. * UPDATE docstring for `bridgedb.configure.loadConfig`, which referenced the now removed `bridgedb.Main.startup`. --- lib/bridgedb/Main.py | 21 ++++++--------------- lib/bridgedb/configure.py | 17 +++++++++-------- 2 files changed, 15 insertions(+), 23 deletions(-) diff --git a/lib/bridgedb/Main.py b/lib/bridgedb/Main.py index a3c88d9..ce3edc5 100644 --- a/lib/bridgedb/Main.py +++ b/lib/bridgedb/Main.py @@ -275,8 +275,12 @@ def createBridgeRings(cfg, proxyList, key): return splitter, emailDistributor, ipDistributor -def startup(options): - """Parse bridges, +def run(options): + """This is BridgeDB's main entry point and main runtime loop. + + Given the parsed commandline options, this function handles locating the + configuration file, loading and parsing it, and then either (re)parsing + plus (re)starting the servers, or dumping bridge assignments to files. :type options: :class:`bridgedb.parse.options.MainOptions` :param options: A pre-parsed options class containing any arguments and @@ -544,16 +548,3 @@ def runSubcommand(options, config): logging.info("Subcommand '%s' finished with status %s." % (options.subCommand, statuscode)) sys.exit(statuscode) - -def run(options): - """This is the main entry point into BridgeDB. - - Given the parsed commandline options, this function handles locating the - configuration file, loading and parsing it, and then either - starting/reloading the servers or dumping bridge assignments to files. - - :type options: :class:`bridgedb.parse.options.MainOptions` - :param options: A pre-parsed options class containing any arguments and - options given in the commandline we were called with. - """ - startup(options) diff --git a/lib/bridgedb/configure.py b/lib/bridgedb/configure.py index 731b599..e67a252 100644 --- a/lib/bridgedb/configure.py +++ b/lib/bridgedb/configure.py @@ -40,14 +40,15 @@ def loadConfig(configFile=None, configCls=None): .. _default: http://stackoverflow.com/q/17470193 .. _faster: http://lucumr.pocoo.org/2011/2/1/exec-in-python/ - :ivar boolean itsSafeToUseLogging: This is called in :func:`startup` - before :func:`safelog.configureLogging`. When called from ``startup``, - the ``configCls`` parameter is not given, because that is the first - time that a :class:`Conf` is created. If a :class:`logging.Logger` is - created in this function, then logging will not be correctly - configured, therefore, if the ``configCls`` parameter is not given, - then it's the first time this function has been called and it is - therefore not safe to make calls to the logging module. + :ivar boolean itsSafeToUseLogging: This is called in + :func:`~bridgedb.Main.run` before + :func:`bridgedb.safelog.configureLogging`. When called from + :func:`~bridgedb.Main.run`, the **configCls** parameter is not given, + because that is the first time that a :class:`Conf` is created. If a + :class:`logging.Logger` is created in this function, then logging will + not be correctly configured, therefore, if the **configCls** parameter + is not given, then it's the first time this function has been called + and it is therefore not safe to make calls to the logging module. :type: configFile: string or None :param configFile: If given, the filename of the config file to load. :type configCls: :class:`Conf` or None

1 0

[bridgedb/develop] Add docstring to `bridgedb.parse.descriptors.deduplicate()`.
by isis＠torproject.org 19 Feb '15

19 Feb '15

commit 72bb77e1d8336edd2e887711e59e1c499b7e0d16 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Aug 26 03:59:34 2014 +0000 Add docstring to `bridgedb.parse.descriptors.deduplicate()`. --- lib/bridgedb/parse/descriptors.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/lib/bridgedb/parse/descriptors.py b/lib/bridgedb/parse/descriptors.py index 362731f..939ecb0 100644 --- a/lib/bridgedb/parse/descriptors.py +++ b/lib/bridgedb/parse/descriptors.py @@ -86,6 +86,18 @@ def parseServerDescriptorsFile(filename, validate=False): return routers def deduplicate(descriptors): + """Deduplicate some descriptors, returning only the newest for each router. + + .. note:: If two descriptors for the same router are discovered, AND both + descriptors have the **same** published timestamp, then the router's + fingerprint WILL BE LOGGED ON PURPOSE, because we assume that router + to be malicious (deliberately, or unintentionally). + + :param list descriptors: A list of + :api:`stem.descriptor.server_descriptor.RelayDescriptor`s, + :api:`stem.descriptor.extrainfo_descriptor.BridgeExtraInfoDescriptor`s, + :api:`stem.descriptor.router_status_entry.RouterStatusEntryV2`s. + """ duplicates = [] nonDuplicates = []

1 0