March 2015 - tor-commits - lists.torproject.org

[stem/master] Check that hidden service introductory points are IPv4
by atagar＠torproject.org 28 Feb '15

28 Feb '15

commit 58d0556236739760703e61cb345ee687d6dd5af1 Author: Damian Johnson <atagar(a)torproject.org> Date: Tue Feb 24 09:05:36 2015 -0800 Check that hidden service introductory points are IPv4 Got clarification from Nick on #15010. --- stem/descriptor/hidden_service_descriptor.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/stem/descriptor/hidden_service_descriptor.py b/stem/descriptor/hidden_service_descriptor.py index d626144..8e0ba67 100644 --- a/stem/descriptor/hidden_service_descriptor.py +++ b/stem/descriptor/hidden_service_descriptor.py @@ -263,7 +263,9 @@ class HiddenServiceDescriptor(Descriptor): if keyword == 'introduction-point': attr['identifier'] = value elif keyword == 'ip-address': - # TODO: need clarification about if this IPv4, IPv6, or both + if not stem.util.connection.is_valid_ipv4_address(value): + raise ValueError("'%s' is an invalid IPv4 address" % value) + attr['address'] = value elif keyword == 'onion-port': if not stem.util.connection.is_valid_port(value):

1 0

[stem/master] Use integer hidden service versions
by atagar＠torproject.org 28 Feb '15

28 Feb '15

commit 746b6eb4b750561b7f4baa3f9d670ca47f0f3b29 Author: Damian Johnson <atagar(a)torproject.org> Date: Tue Feb 24 09:28:45 2015 -0800 Use integer hidden service versions Clarification courtesy of #15010. --- stem/descriptor/hidden_service_descriptor.py | 28 +++++++++++++++------ test/unit/descriptor/hidden_service_descriptor.py | 8 +++--- 2 files changed, 25 insertions(+), 11 deletions(-) diff --git a/stem/descriptor/hidden_service_descriptor.py b/stem/descriptor/hidden_service_descriptor.py index 8e0ba67..68997ab 100644 --- a/stem/descriptor/hidden_service_descriptor.py +++ b/stem/descriptor/hidden_service_descriptor.py @@ -109,13 +109,28 @@ def _parse_file(descriptor_file, validate = False, **kwargs): break # done parsing file -# TODO: For the 'version' and 'protocol-versions' lines should they be ints -# instead? Presently the spec says it's a 'version-number' which is an -# undefined type. +def _parse_version_line(descriptor, entries): + value = _value('version', entries) + + if value.isdigit(): + descriptor.version = int(value) + else: + raise ValueError('version line must have a positive integer value: %s' % value) + def _parse_protocol_versions_line(descriptor, entries): value = _value('protocol-versions', entries) - descriptor.protocol_versions = value.split(',') + + try: + versions = [int(entry) for entry in value.split(',')] + except ValueError: + raise ValueError('protocol-versions line has non-numeric versoins: protocol-versions %s' % value) + + for v in versions: + if v <= 0: + raise ValueError('protocol-versions must be positive integers: %s' % value) + + descriptor.protocol_versions = versions def _parse_introduction_points_line(descriptor, entries): @@ -144,7 +159,6 @@ def _parse_introduction_points_line(descriptor, entries): descriptor.introduction_points_content = decoded_field _parse_rendezvous_service_descriptor_line = _parse_simple_line('rendezvous-service-descriptor', 'descriptor_id') -_parse_version_line = _parse_simple_line('version', 'version') _parse_permanent_key_line = _parse_key_block('permanent-key', 'permanent_key', 'RSA PUBLIC KEY') _parse_secret_id_part_line = _parse_simple_line('secret-id-part', 'secret_id_part') _parse_publication_time_line = _parse_timestamp_line('publication-time', 'published') @@ -156,12 +170,12 @@ class HiddenServiceDescriptor(Descriptor): Hidden service descriptor. :var str descriptor_id: **\*** identifier for this descriptor, this is a base32 hash of several fields - :var str version: **\*** hidden service descriptor version + :var int version: **\*** hidden service descriptor version :var str permanent_key: **\*** long term key of the hidden service :var str secret_id_part: **\*** hash of the time period, cookie, and replica values so our descriptor_id can be validated :var datetime published: **\*** time in UTC when this descriptor was made - :var list protocol_versions: **\*** versions that are supported when establishing a connection + :var list protocol_versions: **\*** list of **int** versions that are supported when establishing a connection :var str introduction_points_encoded: **\*** raw introduction points blob :var list introduction_points_auth: **\*** tuples of the form (auth_method, auth_data) for our introduction_points_content diff --git a/test/unit/descriptor/hidden_service_descriptor.py b/test/unit/descriptor/hidden_service_descriptor.py index 4853a28..a430b06 100644 --- a/test/unit/descriptor/hidden_service_descriptor.py +++ b/test/unit/descriptor/hidden_service_descriptor.py @@ -195,18 +195,18 @@ class TestHiddenServiceDescriptor(unittest.TestCase): desc = next(stem.descriptor.parse_file(descriptor_file, 'hidden-service-descriptor 1.0', validate = True)) self.assertEqual('utjk4arxqg6s6zzo7n6cjnq6ot34udhr', desc.descriptor_id) - self.assertEqual('2', desc.version) + self.assertEqual(2, desc.version) self.assertEqual('6355jaerje3bqozopwq2qmpf4iviizdn', desc.secret_id_part) self.assertEqual(datetime.datetime(2014, 10, 31, 23, 0, 0), desc.published) - self.assertEqual(['2', '3'], desc.protocol_versions) + self.assertEqual([2, 3], desc.protocol_versions) def _assert_matches_duckduckgo(self, desc): self.assertEqual('y3olqqblqw2gbh6phimfuiroechjjafa', desc.descriptor_id) - self.assertEqual('2', desc.version) + self.assertEqual(2, desc.version) self.assertEqual(EXPECTED_DDG_PERMANENT_KEY, desc.permanent_key) self.assertEqual('e24kgecavwsznj7gpbktqsiwgvngsf4e', desc.secret_id_part) self.assertEqual(datetime.datetime(2015, 2, 23, 20, 0, 0), desc.published) - self.assertEqual(['2', '3'], desc.protocol_versions) + self.assertEqual([2, 3], desc.protocol_versions) self.assertEqual(EXPECTED_DDG_INTRODUCTION_POINTS_ENCODED, desc.introduction_points_encoded) self.assertEqual([], desc.introduction_points_auth) self.assertEqual(EXPECTED_DDG_INTRODUCTION_POINTS_CONTENT, desc.introduction_points_content)

1 0

[stem/master] get_hidden_service_descriptor() helper for testing them
by atagar＠torproject.org 28 Feb '15

28 Feb '15

commit 528503f9e5b1157c9410eea5cbce82025c194459 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Feb 25 10:11:16 2015 -0800 get_hidden_service_descriptor() helper for testing them Adding a helper for generating hidden service descriptors. This is done for all of our descriptor types, and helps us test individual fields. Presently just checking that the minimal descriptor it generates is valid. --- stem/descriptor/hidden_service_descriptor.py | 4 +- test/mocking.py | 44 +++++++++++++++++++++ test/unit/descriptor/hidden_service_descriptor.py | 20 ++++++++++ 3 files changed, 67 insertions(+), 1 deletion(-) diff --git a/stem/descriptor/hidden_service_descriptor.py b/stem/descriptor/hidden_service_descriptor.py index 68997ab..f247b07 100644 --- a/stem/descriptor/hidden_service_descriptor.py +++ b/stem/descriptor/hidden_service_descriptor.py @@ -254,7 +254,9 @@ class HiddenServiceDescriptor(Descriptor): # TODO: Support fields encrypted with a desriptor-cookie. Need sample data # to implement this. - if not self.introduction_points_content.startswith('introduction-point '): + if not self.introduction_points_content: + return [] + elif not self.introduction_points_content.startswith('introduction-point '): raise DecryptionFailure('introduction-point content is encrypted') introduction_points = [] diff --git a/test/mocking.py b/test/mocking.py index fdfc71d..604beec 100644 --- a/test/mocking.py +++ b/test/mocking.py @@ -33,14 +33,19 @@ Helper functions for creating mock objects. get_router_status_entry_v2 - RouterStatusEntryV2 get_router_status_entry_v3 - RouterStatusEntryV3 get_router_status_entry_micro_v3 - RouterStatusEntryMicroV3 + + stem.descriptor.hidden-service_descriptor + get_hidden_service_descriptor - HiddenServiceDescriptor """ import base64 import hashlib import itertools import re +import textwrap import stem.descriptor.extrainfo_descriptor +import stem.descriptor.hidden_service_descriptor import stem.descriptor.microdescriptor import stem.descriptor.networkstatus import stem.descriptor.router_status_entry @@ -178,6 +183,20 @@ NETWORK_STATUS_DOCUMENT_FOOTER = ( ('directory-signature', '%s %s\n%s' % (DOC_SIG.identity, DOC_SIG.key_digest, DOC_SIG.signature)), ) +HIDDEN_SERVICE_HEADER = ( + ('rendezvous-service-descriptor', 'y3olqqblqw2gbh6phimfuiroechjjafa'), + ('version', '2'), + ('permanent-key', '\n-----BEGIN RSA PUBLIC KEY-----%s-----END RSA PUBLIC KEY-----' % CRYPTO_BLOB), + ('secret-id-part', 'e24kgecavwsznj7gpbktqsiwgvngsf4e'), + ('publication-time', '2015-02-23 20:00:00'), + ('protocol-versions', '2,3'), + ('introduction-points', '\n-----BEGIN MESSAGE-----\n-----END MESSAGE-----'), +) + +HIDDEN_SERVICE_FOOTER = ( + ('signature', '\n-----BEGIN SIGNATURE-----%s-----END SIGNATURE-----' % CRYPTO_BLOB), +) + def get_all_combinations(attr, include_empty = False): """ @@ -499,6 +518,31 @@ def get_router_status_entry_micro_v3(attr = None, exclude = (), content = False) return stem.descriptor.router_status_entry.RouterStatusEntryMicroV3(desc_content, validate = True) +def get_hidden_service_descriptor(attr = None, exclude = (), content = False, introduction_points_lines = None): + """ + Provides the descriptor content for... + stem.descriptor.hidden_service_descriptor.HidenServiceDescriptor + + :param dict attr: keyword/value mappings to be included in the descriptor + :param list exclude: mandatory keywords to exclude from the descriptor + :param bool content: provides the str content of the descriptor rather than the class if True + :param list introduction_points_lines: lines to be included in the introduction-points field + + :returns: HidenServiceDescriptor for the requested descriptor content + """ + + if introduction_points_lines is not None: + encoded = base64.b64encode(introduction_points_lines('\n')) + attr['introduction-points'] = '\n-----BEGIN MESSAGE-----\n%s\n-----END MESSAGE-----' % '\n'.join(textwrap.wrap(encoded, 64)) + + desc_content = _get_descriptor_content(attr, exclude, HIDDEN_SERVICE_HEADER, HIDDEN_SERVICE_FOOTER) + + if content: + return desc_content + else: + return stem.descriptor.hidden_service_descriptor.HiddenServiceDescriptor(desc_content, validate = True) + + def get_directory_authority(attr = None, exclude = (), is_vote = False, content = False): """ Provides the descriptor content for... diff --git a/test/unit/descriptor/hidden_service_descriptor.py b/test/unit/descriptor/hidden_service_descriptor.py index a430b06..1a1c14d 100644 --- a/test/unit/descriptor/hidden_service_descriptor.py +++ b/test/unit/descriptor/hidden_service_descriptor.py @@ -7,6 +7,7 @@ import unittest import stem.descriptor +from test.mocking import CRYPTO_BLOB, get_hidden_service_descriptor from test.unit.descriptor import get_resource EXPECTED_DDG_PERMANENT_KEY = """\ @@ -238,3 +239,22 @@ class TestHiddenServiceDescriptor(unittest.TestCase): self.assertEqual(EXPECT_POINT_3_ONION_KEY, point.onion_key) self.assertEqual(EXPECT_POINT_3_SERVICE_KEY, point.service_key) self.assertEqual([], point.intro_authentication) + + def test_minimal_hidden_service_descriptor(self): + """ + Basic sanity check that we can parse a hidden service descriptor with minimal attributes. + """ + + desc = get_hidden_service_descriptor() + + self.assertEqual('y3olqqblqw2gbh6phimfuiroechjjafa', desc.descriptor_id) + self.assertEqual(2, desc.version) + self.assertTrue(CRYPTO_BLOB in desc.permanent_key) + self.assertEqual('e24kgecavwsznj7gpbktqsiwgvngsf4e', desc.secret_id_part) + self.assertEqual(datetime.datetime(2015, 2, 23, 20, 0, 0), desc.published) + self.assertEqual([2, 3], desc.protocol_versions) + self.assertEqual('-----BEGIN MESSAGE-----\n-----END MESSAGE-----', desc.introduction_points_encoded) + self.assertEqual([], desc.introduction_points_auth) + self.assertEqual('', desc.introduction_points_content) + self.assertTrue(CRYPTO_BLOB in desc.signature) + self.assertEqual([], desc.introduction_points())

1 0

[stem/master] Unit tests for hidden service descriptor edge cases
by atagar＠torproject.org 28 Feb '15

28 Feb '15

commit b3c42c61ecf883b311af17665abb7213e2361abc Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 28 14:35:40 2015 -0800 Unit tests for hidden service descriptor edge cases Expanding its unit test coverage and few fixes for isssues it surfaced. --- stem/descriptor/hidden_service_descriptor.py | 23 ++-- test/mocking.py | 2 +- test/unit/descriptor/hidden_service_descriptor.py | 149 +++++++++++++++++++++ 3 files changed, 162 insertions(+), 12 deletions(-) diff --git a/stem/descriptor/hidden_service_descriptor.py b/stem/descriptor/hidden_service_descriptor.py index f247b07..c1970a0 100644 --- a/stem/descriptor/hidden_service_descriptor.py +++ b/stem/descriptor/hidden_service_descriptor.py @@ -16,12 +16,8 @@ the HSDir flag. HiddenServiceDescriptor - Tor hidden service descriptor. """ -# TODO: Add a description for how to retrieve them when tor supports that (#14847). - -# TODO: We should add a '@type hidden-service-descriptor 1.0' annotation to -# CollecTor... -# -# https://collector.torproject.org/formats.html +# TODO: Add a description for how to retrieve them when tor supports that +# (#14847) and then update #15009. import base64 import collections @@ -141,8 +137,11 @@ def _parse_introduction_points_line(descriptor, entries): descriptor.introduction_points_encoded = block_contents - blob = ''.join(block_contents.split('\n')[1:-1]) - decoded_field = base64.b64decode(stem.util.str_tools._to_bytes(blob)) + try: + blob = ''.join(block_contents.split('\n')[1:-1]) + decoded_field = base64.b64decode(stem.util.str_tools._to_bytes(blob)) + except TypeError: + raise ValueError("'introduction-points' isn't base64 encoded content:\n%s" % block_contents) auth_types = [] @@ -176,11 +175,11 @@ class HiddenServiceDescriptor(Descriptor): values so our descriptor_id can be validated :var datetime published: **\*** time in UTC when this descriptor was made :var list protocol_versions: **\*** list of **int** versions that are supported when establishing a connection - :var str introduction_points_encoded: **\*** raw introduction points blob + :var str introduction_points_encoded: raw introduction points blob :var list introduction_points_auth: **\*** tuples of the form (auth_method, auth_data) for our introduction_points_content - :var str introduction_points_content: **\*** decoded introduction-points - content without authentication data, if using cookie authentication this is + :var str introduction_points_content: decoded introduction-points content + without authentication data, if using cookie authentication this is encrypted :var str signature: signature of the descriptor content @@ -196,6 +195,8 @@ class HiddenServiceDescriptor(Descriptor): 'published': (None, _parse_publication_time_line), 'protocol_versions': ([], _parse_protocol_versions_line), 'introduction_points_encoded': (None, _parse_introduction_points_line), + 'introduction_points_auth': ([], _parse_introduction_points_line), + 'introduction_points_content': (None, _parse_introduction_points_line), 'signature': (None, _parse_signature_line), } diff --git a/test/mocking.py b/test/mocking.py index 604beec..4a3f272 100644 --- a/test/mocking.py +++ b/test/mocking.py @@ -531,7 +531,7 @@ def get_hidden_service_descriptor(attr = None, exclude = (), content = False, in :returns: HidenServiceDescriptor for the requested descriptor content """ - if introduction_points_lines is not None: + if (not attr or 'introduction-points' not in attr) and introduction_points_lines is not None: encoded = base64.b64encode(introduction_points_lines('\n')) attr['introduction-points'] = '\n-----BEGIN MESSAGE-----\n%s\n-----END MESSAGE-----' % '\n'.join(textwrap.wrap(encoded, 64)) diff --git a/test/unit/descriptor/hidden_service_descriptor.py b/test/unit/descriptor/hidden_service_descriptor.py index 1a1c14d..3b9c652 100644 --- a/test/unit/descriptor/hidden_service_descriptor.py +++ b/test/unit/descriptor/hidden_service_descriptor.py @@ -7,9 +7,17 @@ import unittest import stem.descriptor +from stem.descriptor.hidden_service_descriptor import REQUIRED_FIELDS, HiddenServiceDescriptor + from test.mocking import CRYPTO_BLOB, get_hidden_service_descriptor from test.unit.descriptor import get_resource +MESSAGE_BLOCK = """ +-----BEGIN MESSAGE----- +%s +-----END MESSAGE-----\ +""" + EXPECTED_DDG_PERMANENT_KEY = """\ -----BEGIN RSA PUBLIC KEY----- MIGJAoGBAJ/SzzgrXPxTlFrKVhXh3buCWv2QfcNgncUpDpKouLn3AtPH5Ocys0jE @@ -258,3 +266,144 @@ class TestHiddenServiceDescriptor(unittest.TestCase): self.assertEqual('', desc.introduction_points_content) self.assertTrue(CRYPTO_BLOB in desc.signature) self.assertEqual([], desc.introduction_points()) + + def test_unrecognized_line(self): + """ + Includes unrecognized content in the descriptor. + """ + + desc = get_hidden_service_descriptor({'pepperjack': 'is oh so tasty!'}) + self.assertEqual(['pepperjack is oh so tasty!'], desc.get_unrecognized_lines()) + + def test_proceeding_line(self): + """ + Includes a line prior to the 'rendezvous-service-descriptor' entry. + """ + + desc_text = b'hibernate 1\n' + get_hidden_service_descriptor(content = True) + self._expect_invalid_attr(desc_text) + + def test_trailing_line(self): + """ + Includes a line after the 'router-signature' entry. + """ + + desc_text = get_hidden_service_descriptor(content = True) + b'\nhibernate 1' + self._expect_invalid_attr(desc_text) + + def test_required_fields(self): + """ + Check that we require the mandatory fields. + """ + + line_to_attr = { + 'rendezvous-service-descriptor': 'descriptor_id', + 'version': 'version', + 'permanent-key': 'permanent_key', + 'secret-id-part': 'secret_id_part', + 'publication-time': 'published', + 'introduction-points': 'introduction_points_encoded', + 'protocol-versions': 'protocol_versions', + 'signature': 'signature', + } + + for line in REQUIRED_FIELDS: + desc_text = get_hidden_service_descriptor(content = True, exclude = (line,)) + + expected = [] if line == 'protocol-versions' else None + self._expect_invalid_attr(desc_text, line_to_attr[line], expected) + + def test_invalid_version(self): + """ + Checks that our version field expects a numeric value. + """ + + test_values = ( + '', + '-10', + 'hello', + ) + + for test_value in test_values: + desc_text = get_hidden_service_descriptor({'version': test_value}, content = True) + self._expect_invalid_attr(desc_text, 'version') + + def test_invalid_protocol_versions(self): + """ + Checks that our protocol-versions field expects comma separated numeric + values. + """ + + test_values = ( + '', + '-10', + 'hello', + '10,', + ',10', + '10,-10', + '10,hello', + ) + + for test_value in test_values: + desc_text = get_hidden_service_descriptor({'protocol-versions': test_value}, content = True) + self._expect_invalid_attr(desc_text, 'protocol_versions', []) + + def test_introduction_points_when_empty(self): + """ + It's valid to advertise zero introduciton points. I'm not clear if this + would mean an empty protocol-versions field or that it's omitted but either + are valid according to the spec. + """ + + missing_field_desc = get_hidden_service_descriptor(exclude = ('introduction-points',)) + + self.assertEqual(None, missing_field_desc.introduction_points_encoded) + self.assertEqual([], missing_field_desc.introduction_points_auth) + self.assertEqual(None, missing_field_desc.introduction_points_content) + self.assertEqual([], missing_field_desc.introduction_points()) + + empty_field_desc = get_hidden_service_descriptor({'introduction-points': MESSAGE_BLOCK % ''}) + + self.assertEqual((MESSAGE_BLOCK % '').strip(), empty_field_desc.introduction_points_encoded) + self.assertEqual([], empty_field_desc.introduction_points_auth) + self.assertEqual('', empty_field_desc.introduction_points_content) + self.assertEqual([], empty_field_desc.introduction_points()) + + def test_introduction_points_when_not_base64(self): + """ + Checks the introduction-points field when the content isn't base64 encoded. + """ + + test_values = ( + MESSAGE_BLOCK % '12345', + MESSAGE_BLOCK % 'hello', + ) + + for test_value in test_values: + desc_text = get_hidden_service_descriptor({'introduction-points': test_value}, content = True) + + desc = self._expect_invalid_attr(desc_text, 'introduction_points_encoded', test_value.strip()) + self.assertEqual([], desc.introduction_points_auth) + self.assertEqual(None, desc.introduction_points_content) + self.assertEqual([], desc.introduction_points()) + + def _expect_invalid_attr(self, desc_text, attr = None, expected_value = None): + """ + Asserts that construction will fail due to desc_text having a malformed + attribute. If an attr is provided then we check that it matches an expected + value when we're constructed without validation. + """ + + self.assertRaises(ValueError, HiddenServiceDescriptor, desc_text, True) + desc = HiddenServiceDescriptor(desc_text, validate = False) + + if attr: + # check that the invalid attribute matches the expected value when + # constructed without validation + + self.assertEqual(expected_value, getattr(desc, attr)) + else: + # check a default attribute + self.assertEqual('y3olqqblqw2gbh6phimfuiroechjjafa', desc.descriptor_id) + + return desc

1 0

[stem/master] Verifying hidden service descriptor signatures
by atagar＠torproject.org 28 Feb '15

28 Feb '15

commit db5bfa4f574764fffe8610eace05cb3dea51ac36 Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 28 20:52:17 2015 -0800 Verifying hidden service descriptor signatures This is identical to how server descriptors are validated, so taking this opportunity to tidy that up a bit in the process. --- stem/descriptor/__init__.py | 112 +++++++++++++++++ stem/descriptor/hidden_service_descriptor.py | 28 +++-- stem/descriptor/server_descriptor.py | 138 ++------------------- test/mocking.py | 5 +- test/unit/descriptor/hidden_service_descriptor.py | 6 +- test/unit/descriptor/server_descriptor.py | 4 +- test/unit/tutorial.py | 2 +- 7 files changed, 150 insertions(+), 145 deletions(-) diff --git a/stem/descriptor/__init__.py b/stem/descriptor/__init__.py index 87f7f73..85ff986 100644 --- a/stem/descriptor/__init__.py +++ b/stem/descriptor/__init__.py @@ -50,7 +50,10 @@ __all__ = [ 'Descriptor', ] +import base64 +import codecs import copy +import hashlib import os import re import tarfile @@ -499,6 +502,97 @@ class Descriptor(object): def _name(self, is_plural = False): return str(type(self)) + def _digest_for_signature(self, signing_key, signature): + """ + Provides the signed digest we should have given this key and signature. + + :param str signing_key: key block used to make this signature + :param str signature: signed digest for this descriptor content + + :returns: the digest string encoded in uppercase hex + + :raises: ValueError if unable to provide a validly signed digest + """ + + if not stem.prereq.is_crypto_available(): + raise ValueError('Generating the signed digest requires pycrypto') + + from Crypto.Util import asn1 + from Crypto.Util.number import bytes_to_long, long_to_bytes + + # get the ASN.1 sequence + + seq = asn1.DerSequence() + seq.decode(_bytes_for_block(signing_key)) + modulus, public_exponent = seq[0], seq[1] + + sig_as_bytes = _bytes_for_block(signature) + sig_as_long = bytes_to_long(sig_as_bytes) # convert signature to an int + blocksize = 128 # block size will always be 128 for a 1024 bit key + + # use the public exponent[e] & the modulus[n] to decrypt the int + + decrypted_int = pow(sig_as_long, public_exponent, modulus) + + # convert the int to a byte array + + decrypted_bytes = long_to_bytes(decrypted_int, blocksize) + + ############################################################################ + # The decrypted bytes should have a structure exactly along these lines. + # 1 byte - [null '\x00'] + # 1 byte - [block type identifier '\x01'] - Should always be 1 + # N bytes - [padding '\xFF' ] + # 1 byte - [separator '\x00' ] + # M bytes - [message] + # Total - 128 bytes + # More info here http://www.ietf.org/rfc/rfc2313.txt + # esp the Notes in section 8.1 + ############################################################################ + + try: + if decrypted_bytes.index(b'\x00\x01') != 0: + raise ValueError('Verification failed, identifier missing') + except ValueError: + raise ValueError('Verification failed, malformed data') + + try: + identifier_offset = 2 + + # find the separator + seperator_index = decrypted_bytes.index(b'\x00', identifier_offset) + except ValueError: + raise ValueError('Verification failed, seperator not found') + + digest_hex = codecs.encode(decrypted_bytes[seperator_index + 1:], 'hex_codec') + return stem.util.str_tools._to_unicode(digest_hex.upper()) + + def _digest_for_content(self, start, end): + """ + Provides the digest of our descriptor's content in a given range. + + :param bytes start: start of the range to generate a digest for + :param bytes end: end of the range to generate a digest for + + :returns: the digest string encoded in uppercase hex + + :raises: ValueError if the digest canot be calculated + """ + + raw_descriptor = self.get_bytes() + + start_index = raw_descriptor.find(start) + end_index = raw_descriptor.find(end, start_index) + + if start_index == -1: + raise ValueError("Digest is for the range starting with '%s' but that isn't in our descriptor" % start) + elif end_index == -1: + raise ValueError("Digest is for the range ending with '%s' but that isn't in our descriptor" % end) + + digest_content = raw_descriptor[start_index:end_index + len(end)] + digest_hash = hashlib.sha1(stem.util.str_tools._to_bytes(digest_content)) + return stem.util.str_tools._to_unicode(digest_hash.hexdigest().upper()) + def __getattr__(self, name): # If attribute isn't already present we might be lazy loading it... @@ -593,6 +687,24 @@ def _read_until_keywords(keywords, descriptor_file, inclusive = False, ignore_fi return content +def _bytes_for_block(content): + """ + Provides the base64 decoded content of a pgp-style block. + + :param str content: block to be decoded + + :returns: decoded block content + + :raises: **TypeError** if this isn't base64 encoded content + """ + + # strip the '-----BEGIN RSA PUBLIC KEY-----' header and footer + + content = ''.join(content.split('\n')[1:-1]) + + return base64.b64decode(stem.util.str_tools._to_bytes(content)) + + def _get_pseudo_pgp_block(remaining_contents): """ Checks if given contents begins with a pseudo-Open-PGP-style block and, if diff --git a/stem/descriptor/hidden_service_descriptor.py b/stem/descriptor/hidden_service_descriptor.py index c1970a0..075c2c2 100644 --- a/stem/descriptor/hidden_service_descriptor.py +++ b/stem/descriptor/hidden_service_descriptor.py @@ -19,19 +19,17 @@ the HSDir flag. # TODO: Add a description for how to retrieve them when tor supports that # (#14847) and then update #15009. -import base64 import collections import io import stem.util.connection -from stem import str_type - from stem.descriptor import ( PGP_BLOCK_END, Descriptor, _get_descriptor_components, _read_until_keywords, + _bytes_for_block, _value, _parse_simple_line, _parse_timestamp_line, @@ -138,16 +136,15 @@ def _parse_introduction_points_line(descriptor, entries): descriptor.introduction_points_encoded = block_contents try: - blob = ''.join(block_contents.split('\n')[1:-1]) - decoded_field = base64.b64decode(stem.util.str_tools._to_bytes(blob)) + decoded_field = _bytes_for_block(block_contents) except TypeError: raise ValueError("'introduction-points' isn't base64 encoded content:\n%s" % block_contents) auth_types = [] - while decoded_field.startswith('service-authentication ') and '\n' in decoded_field: - auth_line, decoded_field = decoded_field.split('\n', 1) - auth_line_comp = auth_line.split(' ') + while decoded_field.startswith(b'service-authentication ') and b'\n' in decoded_field: + auth_line, decoded_field = decoded_field.split(b'\n', 1) + auth_line_comp = auth_line.split(b' ') if len(auth_line_comp) < 3: raise ValueError("Within introduction-points we expected 'service-authentication [auth_type] [auth_data]', but had '%s'" % auth_line) @@ -178,7 +175,7 @@ class HiddenServiceDescriptor(Descriptor): :var str introduction_points_encoded: raw introduction points blob :var list introduction_points_auth: **\*** tuples of the form (auth_method, auth_data) for our introduction_points_content - :var str introduction_points_content: decoded introduction-points content + :var bytes introduction_points_content: decoded introduction-points content without authentication data, if using cookie authentication this is encrypted :var str signature: signature of the descriptor content @@ -228,6 +225,13 @@ class HiddenServiceDescriptor(Descriptor): raise ValueError("Hidden service descriptor must end with a 'signature' entry") self._parse(entries, validate) + + if stem.prereq.is_crypto_available(): + signed_digest = self._digest_for_signature(self.permanent_key, self.signature) + content_digest = self._digest_for_content(b'rendezvous-service-descriptor ', b'\nsignature\n') + + if signed_digest != content_digest: + raise ValueError('Decrypted digest does not match local digest (calculated: %s, local: %s)' % (signed_digest, content_digest)) else: self._entries = entries @@ -257,14 +261,14 @@ class HiddenServiceDescriptor(Descriptor): if not self.introduction_points_content: return [] - elif not self.introduction_points_content.startswith('introduction-point '): + elif not self.introduction_points_content.startswith(b'introduction-point '): raise DecryptionFailure('introduction-point content is encrypted') introduction_points = [] - content_io = io.StringIO(str_type(self.introduction_points_content)) + content_io = io.BytesIO(self.introduction_points_content) while True: - content = ''.join(_read_until_keywords('introduction-point', content_io, ignore_first = True)) + content = b''.join(_read_until_keywords('introduction-point', content_io, ignore_first = True)) if not content: break # reached the end diff --git a/stem/descriptor/server_descriptor.py b/stem/descriptor/server_descriptor.py index 55b4183..54ee645 100644 --- a/stem/descriptor/server_descriptor.py +++ b/stem/descriptor/server_descriptor.py @@ -31,8 +31,6 @@ etc). This information is provided from a few sources... +- get_annotation_lines - lines that provided the annotations """ -import base64 -import codecs import functools import hashlib import re @@ -46,13 +44,13 @@ import stem.util.tor_tools import stem.version from stem import str_type -from stem.util import log from stem.descriptor import ( PGP_BLOCK_END, Descriptor, _get_descriptor_components, _read_until_keywords, + _bytes_for_block, _value, _values, _parse_simple_line, @@ -670,9 +668,18 @@ class RelayDescriptor(ServerDescriptor): def __init__(self, raw_contents, validate = False, annotations = None): super(RelayDescriptor, self).__init__(raw_contents, validate, annotations) - # validate the descriptor if required if validate: - self._validate_content() + if self.fingerprint: + key_hash = hashlib.sha1(_bytes_for_block(self.signing_key)).hexdigest() + + if key_hash != self.fingerprint.lower(): + raise ValueError('Fingerprint does not match the hash of our signing key (fingerprint: %s, signing key hash: %s)' % (self.fingerprint.lower(), key_hash)) + + if stem.prereq.is_crypto_available(): + signed_digest = self._digest_for_signature(self.signing_key, self.signature) + + if signed_digest != self.digest(): + raise ValueError('Decrypted digest does not match local digest (calculated: %s, local: %s)' % (signed_digest, self.digest())) @lru_cache() def digest(self): @@ -684,112 +691,7 @@ class RelayDescriptor(ServerDescriptor): :raises: ValueError if the digest canot be calculated """ - # Digest is calculated from everything in the - # descriptor except the router-signature. - - raw_descriptor = self.get_bytes() - start_token = b'router ' - sig_token = b'\nrouter-signature\n' - start = raw_descriptor.find(start_token) - sig_start = raw_descriptor.find(sig_token) - end = sig_start + len(sig_token) - - if start >= 0 and sig_start > 0 and end > start: - for_digest = raw_descriptor[start:end] - digest_hash = hashlib.sha1(stem.util.str_tools._to_bytes(for_digest)) - return stem.util.str_tools._to_unicode(digest_hash.hexdigest().upper()) - else: - raise ValueError('unable to calculate digest for descriptor') - - def _validate_content(self): - """ - Validates that the descriptor content matches the signature. - - :raises: ValueError if the signature does not match the content - """ - - key_as_bytes = RelayDescriptor._get_key_bytes(self.signing_key) - - # ensure the fingerprint is a hash of the signing key - - if self.fingerprint: - # calculate the signing key hash - - key_der_as_hash = hashlib.sha1(stem.util.str_tools._to_bytes(key_as_bytes)).hexdigest() - - if key_der_as_hash != self.fingerprint.lower(): - log.warn('Signing key hash: %s != fingerprint: %s' % (key_der_as_hash, self.fingerprint.lower())) - raise ValueError('Fingerprint does not match hash') - - self._verify_digest(key_as_bytes) - - def _verify_digest(self, key_as_der): - # check that our digest matches what was signed - - if not stem.prereq.is_crypto_available(): - return - - from Crypto.Util import asn1 - from Crypto.Util.number import bytes_to_long, long_to_bytes - - # get the ASN.1 sequence - - seq = asn1.DerSequence() - seq.decode(key_as_der) - modulus = seq[0] - public_exponent = seq[1] # should always be 65537 - - sig_as_bytes = RelayDescriptor._get_key_bytes(self.signature) - - # convert the descriptor signature to an int - - sig_as_long = bytes_to_long(sig_as_bytes) - - # use the public exponent[e] & the modulus[n] to decrypt the int - - decrypted_int = pow(sig_as_long, public_exponent, modulus) - - # block size will always be 128 for a 1024 bit key - - blocksize = 128 - - # convert the int to a byte array. - - decrypted_bytes = long_to_bytes(decrypted_int, blocksize) - - ############################################################################ - # The decrypted bytes should have a structure exactly along these lines. - # 1 byte - [null '\x00'] - # 1 byte - [block type identifier '\x01'] - Should always be 1 - # N bytes - [padding '\xFF' ] - # 1 byte - [separator '\x00' ] - # M bytes - [message] - # Total - 128 bytes - # More info here http://www.ietf.org/rfc/rfc2313.txt - # esp the Notes in section 8.1 - ############################################################################ - - try: - if decrypted_bytes.index(b'\x00\x01') != 0: - raise ValueError('Verification failed, identifier missing') - except ValueError: - raise ValueError('Verification failed, malformed data') - - try: - identifier_offset = 2 - - # find the separator - seperator_index = decrypted_bytes.index(b'\x00', identifier_offset) - except ValueError: - raise ValueError('Verification failed, seperator not found') - - digest_hex = codecs.encode(decrypted_bytes[seperator_index + 1:], 'hex_codec') - digest = stem.util.str_tools._to_unicode(digest_hex.upper()) - - local_digest = self.digest() - - if digest != local_digest: - raise ValueError('Decrypted digest does not match local digest (calculated: %s, local: %s)' % (digest, local_digest)) + return self._digest_for_content(b'router ', b'\nrouter-signature\n') def _compare(self, other, method): if not isinstance(other, RelayDescriptor): @@ -809,20 +711,6 @@ class RelayDescriptor(ServerDescriptor): def __le__(self, other): return self._compare(other, lambda s, o: s <= o) - @staticmethod - def _get_key_bytes(key_string): - # Remove the newlines from the key string & strip off the - # '-----BEGIN RSA PUBLIC KEY-----' header and - # '-----END RSA PUBLIC KEY-----' footer - - key_as_string = ''.join(key_string.split('\n')[1:4]) - - # get the key representation in bytes - - key_bytes = base64.b64decode(stem.util.str_tools._to_bytes(key_as_string)) - - return key_bytes - class BridgeDescriptor(ServerDescriptor): """ diff --git a/test/mocking.py b/test/mocking.py index 4a3f272..156ac4a 100644 --- a/test/mocking.py +++ b/test/mocking.py @@ -372,7 +372,7 @@ def get_relay_server_descriptor(attr = None, exclude = (), content = False, sign if sign_content: desc_content = sign_descriptor_content(desc_content) - with patch('stem.descriptor.server_descriptor.RelayDescriptor._verify_digest', Mock()): + with patch('stem.prereq.is_crypto_available', Mock(return_value = False)): desc = stem.descriptor.server_descriptor.RelayDescriptor(desc_content, validate = True) return desc @@ -540,7 +540,8 @@ def get_hidden_service_descriptor(attr = None, exclude = (), content = False, in if content: return desc_content else: - return stem.descriptor.hidden_service_descriptor.HiddenServiceDescriptor(desc_content, validate = True) + with patch('stem.prereq.is_crypto_available', Mock(return_value = False)): + return stem.descriptor.hidden_service_descriptor.HiddenServiceDescriptor(desc_content, validate = True) def get_directory_authority(attr = None, exclude = (), is_vote = False, content = False): diff --git a/test/unit/descriptor/hidden_service_descriptor.py b/test/unit/descriptor/hidden_service_descriptor.py index ef8ad43..911e9fa 100644 --- a/test/unit/descriptor/hidden_service_descriptor.py +++ b/test/unit/descriptor/hidden_service_descriptor.py @@ -74,7 +74,7 @@ TkQgUlNBIFBVQkxJQyBLRVktLS0tLQoK -----END MESSAGE-----\ """ -EXPECTED_DDG_INTRODUCTION_POINTS_CONTENT = """\ +EXPECTED_DDG_INTRODUCTION_POINTS_CONTENT = b"""\ introduction-point iwki77xtbvp6qvedfrwdzncxs3ckayeu ip-address 178.62.222.129 onion-port 443 @@ -353,7 +353,7 @@ class TestHiddenServiceDescriptor(unittest.TestCase): self.assertEqual([2, 3], desc.protocol_versions) self.assertEqual('-----BEGIN MESSAGE-----\n-----END MESSAGE-----', desc.introduction_points_encoded) self.assertEqual([], desc.introduction_points_auth) - self.assertEqual('', desc.introduction_points_content) + self.assertEqual(b'', desc.introduction_points_content) self.assertTrue(CRYPTO_BLOB in desc.signature) self.assertEqual([], desc.introduction_points()) @@ -456,7 +456,7 @@ class TestHiddenServiceDescriptor(unittest.TestCase): self.assertEqual((MESSAGE_BLOCK % '').strip(), empty_field_desc.introduction_points_encoded) self.assertEqual([], empty_field_desc.introduction_points_auth) - self.assertEqual('', empty_field_desc.introduction_points_content) + self.assertEqual(b'', empty_field_desc.introduction_points_content) self.assertEqual([], empty_field_desc.introduction_points()) def test_introduction_points_when_not_base64(self): diff --git a/test/unit/descriptor/server_descriptor.py b/test/unit/descriptor/server_descriptor.py index 00d2bb3..fd0c032 100644 --- a/test/unit/descriptor/server_descriptor.py +++ b/test/unit/descriptor/server_descriptor.py @@ -452,7 +452,7 @@ Qlx9HNCqCY877ztFRC624ja2ql6A2hBcuoYMbkHjcQ4= desc_text = get_relay_server_descriptor({'opt': 'protocols Link 1 2'}, content = True) self._expect_invalid_attr(desc_text, 'circuit_protocols') - @patch('stem.descriptor.server_descriptor.RelayDescriptor._verify_digest', Mock()) + @patch('stem.prereq.is_crypto_available', Mock(return_value = False)) def test_published_leap_year(self): """ Constructs with a published entry for a leap year, and when the date is @@ -508,7 +508,7 @@ Qlx9HNCqCY877ztFRC624ja2ql6A2hBcuoYMbkHjcQ4= self.assertEqual(900, desc.read_history_interval) self.assertEqual([], desc.read_history_values) - @patch('stem.descriptor.server_descriptor.RelayDescriptor._verify_digest', Mock()) + @patch('stem.prereq.is_crypto_available', Mock(return_value = False)) def test_annotations(self): """ Checks that content before a descriptor are parsed as annotations. diff --git a/test/unit/tutorial.py b/test/unit/tutorial.py index 55a170b..7d20437 100644 --- a/test/unit/tutorial.py +++ b/test/unit/tutorial.py @@ -201,7 +201,7 @@ class TestTutorial(unittest.TestCase): @patch('sys.stdout', new_callable = StringIO) @patch('stem.descriptor.remote.DescriptorDownloader') - @patch('stem.descriptor.server_descriptor.RelayDescriptor._verify_digest', Mock()) + @patch('stem.prereq.is_crypto_available', Mock(return_value = False)) def test_mirror_mirror_on_the_wall_5(self, downloader_mock, stdout_mock): def tutorial_example(): from stem.descriptor.remote import DescriptorDownloader

1 0

[stem/master] Encrypted introduction-points test data
by atagar＠torproject.org 28 Feb '15

28 Feb '15

commit 70591e63fc7773db42d457b4e97d37236791d323 Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 28 15:10:07 2015 -0800 Encrypted introduction-points test data Including examples of hidden service descriptors with encrypted introduction-points fields from #15004. We don't yet have support for decrypting the fields, but at least we can assert that we raise the expected exception when it's encrypted. --- .../unit/descriptor/data/hidden_service_basic_auth | 67 ++++++++++++++ .../descriptor/data/hidden_service_stealth_auth | 60 +++++++++++++ test/unit/descriptor/hidden_service_descriptor.py | 94 +++++++++++++++++++- 3 files changed, 219 insertions(+), 2 deletions(-) diff --git a/test/unit/descriptor/data/hidden_service_basic_auth b/test/unit/descriptor/data/hidden_service_basic_auth new file mode 100644 index 0000000..d93c42a --- /dev/null +++ b/test/unit/descriptor/data/hidden_service_basic_auth @@ -0,0 +1,67 @@ +@type hidden-service-descriptor 1.0 +rendezvous-service-descriptor yfmvdrkdbyquyqk5vygyeylgj2qmrvrd +version 2 +permanent-key +-----BEGIN RSA PUBLIC KEY----- +MIGJAoGBANHC3bZRrlFFlSu22u18wBG57JpvIhglJE+u0ctMwTnw6iyJJqqxgU6U +R1gnXJlorQYDC5eHoM8nbBJu7LvUjYnqINz+En+FlpZhT+eqLk0v83IB4r0Fd6Bg +ypYLygEXUfh0bwHwYfF4mkvl6YOB6I6G5jHC46I3LH15qrdHW40FAgMBAAE= +-----END RSA PUBLIC KEY----- +secret-id-part fluw7z3s5cghuuirq3imh5jjj5ljips6 +publication-time 2015-02-24 20:00:00 +protocol-versions 2,3 +introduction-points +-----BEGIN MESSAGE----- +AQEAi3xIJz0Qv97ug9kr4U0UNN2kQhkddPHuj4op3cw+fgMLqzPlFBPAJgaEKc+g +8xBTRKUlvfkXxocfV75GyQGi2Vqu5iN1SbI5Uliu3n8IiUina5+WaOfUs9iuHJIK +cErgfT0bUfXKDLvW6/ncsgPdb6kb+jjT8NVhR4ZrRUf9ASfcY/f2WFNTmLgOR3Oa +f2tMLJcAck9VbCDjKfSC6e6HgtxRFe9dX513mDviZp15UAHkjJSKxKvqRRVkL+7W +KxJGfLY56ypZa4+afBYT/yqLzY4C47/g5TTTx9fvsdp0uQ0AmjF4LeXdZ58yNjrp +Da63SrgQQM7lZ3k4LGXzDS20FKW2/9rpWgD78QLJGeKdHngD3ERvTX4m43rtEFrD +oB/4l2nl6fh0507ASYHy7QQQMcdjpN0OWQQKpL9SskZ8aQw1dY4KU28Gooe9ff+B +RGm6BlVzMi+HGcqfMpGwFfYopmqJuOXjNlX7a1jRwrztpJKeu4J9iSTiuSOEiQSq +kUyHRLO4rWJXa2/RMWfH4XSgdUaWFjOF6kaSwmI/pRZIepi/sX8BSKm+vvOnOtlr +Tz2DVSiA2qM+P3Br9qNTDUmTu9mri6fRzzVnj+ybdTQXn60jwPw4vj4xmvVTkjfZ +ZB2gw2+sAmZJA5pnLNGu4N8veo1Jiz7FLE0m+7yjXbcBc/GHWGTJa0Sa1Hwfp82t +ohagQlRYKhLaRrM6ZvjnPMH5dqT/ypfBXcIQAh6td1+e1Hf/uXZPM/ZrgHeCJqF+ +PvLDuu4TYxOod+elZE5LfwDFPzCcMA8XNuuDzGQOFOMh9o4xTbQchyRSfhDGev/H +HpY9qxRyua+PjDCmE/F3YiFy77ITJLhCyYEdzVw43hCVY52inEauvHRzqTl7Lc53 +PhnSIW6rDWsrrSMWApCC5WRSOSKfh0u4vO13bVLTb/QmuvMEhGiXDVI3/0NEpqKF +ewqyiG9Dvv67A3/IjTe3aMRGfWREHFnEG9bonn03uoufgmQb4h9ci9+QU52sl16F +rxRpxLyMRp8dpUzZbK3qxtASp09Lc2pdgItWcMMTtPObcd7KVV/xkVqm3ezaUbRF +Nw5qDFxkG85ohTvFt3wnfxkpytMhWoBv9F0ZMEFRLY2j+cb8IqXN5dyz6rGqgSYY +dtItQvI7Lq3XnOSFy3uCGC9Vzr6PRPQIrVH/56rSRaEyM8TgVWyaQQ3xm26x9Fe2 +jUg50lG/WVzsRueBImuai1KCRC4FB/cg/kVu/s+5f5H4Z/GSD+4UpDyg3i2RYuy9 +WOA/AGEeOLY5FkOTARcWteUbi6URboaouX2lnAXK6vX6Ysn8HgE9JATVbVC/96c9 +GnWaf9yCr6Q0BvrHkS7hsJJj+VwaNPW4POSqhL+p0p+2eSWZVMlFFxNr+BNKONk+ +RAssIHF1xVRHzzl75wjzhzuq0A0crHcHb64P+glkPt4iI7SqejyCrMQh6BWia6RT +c+NwXTnbcibB56McF+xWoyHne6dg1F0urA61JfQboyWOy+Z+cNPjEIcwWhJr/+Gx +v7/yf3V1kNECa90L7BeUmFGKxL7SvgyapevWqkIQCZEcOnobXQRdWUmNqSoZmOxB +u5eDcvrdF9p5wG5IStpzO9OConG3SQb46S9OSU3O7PnjKFId6KRIM7VsprMIIBTz +HKy6ufKyMXgyxxnvE5TZQcLzA4Wv8vHWET3t3WSQEwSPx45IAbjsE587YNOkjK1X +HNT3ypfRdJacxtttR7Y5Y/XF4tJmXkCfb5RoEqIPrQTmiLYh0h02i6CqeFK9u7j/ +yAdKY3NrCBuqPM4mWCdjvtgC9i1Q98LCDiVESRrvLlfvv3iWozDUZ3qIU4TnSgti +U5+xKrmlKcWHHgADS56IECgCQyr2nZEhcNK7vKvg+KgA667tRm7M35w9eHz+J7lg +x5v5GYPH4J1UjPEb5Cwl+Vlr0XIqbhMX9MZWimpOJ0l5TisOLuTJ9ennREsFPZjN +U4IZQht7gifFlemn7D4a+UXHu95bHxDBMPJky7iYc2U3r50+JWRF+LO1L2TNDQlV +iPO8AOoI0V0cGaYE+0ZUgpUDk8fxUH5CAPCn+dbsqDh165G6590cF9eF4/yrlf2V +nbhZipPQyOTrmiCkBPQ1zuXYyfFHrJL7yK4ykiBV8c/VLT8nxeKfPwW3USKOScnx +k68qqFZ6lNFxlDwPAJR3F2H+PN5JZ8H1lTE56ujgTBpArXMPYpKri4a0lG+8QnYK +D6jOJIli5QtVQxES4X64NDwducoGHnquMZs3ScvJQPSOuTvuqaad4FrTCZGbv6Ic +emUAHDsxjffMQ9IJYulluCTVWgS/AiBk31yiUB0GsAqZYcWz5kKgTpOXBQhulACM +waokEqbyH2Vtvc1peiPi+Vh6EhTSiDoEVZ2w9GrOnjgpyK6zxzH0aIhJJxlQu8it +w+xj/3+79Bf8myVesgzCWvXbkmvc6jJaoHGopV8lTM2JUn4xYCSz71Bt4wQBKZX4 +hFXDlDZaY1k/QRP/zTfQ8pjbcohDgUVW8eftJz3ND5Iy8D3nRF9/BQB3PWox4vyQ +Fj94Eoe8NmEArIKWjUoSkn+EDgNcdHGBIaQ5is0N8r9n4E2cgMj57i4Fm37k8c6+ +hlilrggVJ8qTBGs57M0ldqRLwt1bM6SkU//oMGel7Ft3EDd98W/6RXRkmAbsLhRx +7VMb4WCUBrIZLxo1/StwHa13RyTHAt0GKPu549l3oTZezsSad8vlurbnIbxtK9Cl +hp6mYPd3Djoe5OaLe8Gnu23ko+S2+kfHIjOwkza9R5w6AzLjkjYS3C8oRwuxKOft +lj/7xMZWDrfyw5H86L0QiaZnkmD+nig1+S+Rn39mmuEgl2iwZO/ihlncUJQTEULb +7IHpmofr+5ya5xWeo/BFQhulTNr2fJN0bPkVGfp+ +-----END MESSAGE----- +signature +-----BEGIN SIGNATURE----- +mhGQNtyvf5QqeFrn1SNzdp8wN5bhEH5gxZhST5t4pFxxNCv3//ZgaQ83kIzcwex9 +xzgGREFHpTrqVPXXs8nZZgMpmnhWuloAyT1c3HSCvjnbWXX9Y82wPbVV5OYx1CYb +jLides7vbdQuS0UwEkcGMl62Ripwi0pkesgw9ZvJy+k= +-----END SIGNATURE----- diff --git a/test/unit/descriptor/data/hidden_service_stealth_auth b/test/unit/descriptor/data/hidden_service_stealth_auth new file mode 100644 index 0000000..df25c83 --- /dev/null +++ b/test/unit/descriptor/data/hidden_service_stealth_auth @@ -0,0 +1,60 @@ +@type hidden-service-descriptor 1.0 +rendezvous-service-descriptor ubf3xeibzlfil6s4larq6y5peup2z3oj +version 2 +permanent-key +-----BEGIN RSA PUBLIC KEY----- +MIGJAoGBAL1f7GdEObH+xMhf4GsaTCtfVH7ZpanegC65jn0/Kz9wlkpF+SQdIvTu +Ha2iZB34GDT2PvTy98chSxz+E3Kv2h45pQWbrwLN3Fj4qa+klclIXWcIa7GT4Pct +YZzAvHIh9t9EAe6ejYu8I+h4yL6QNAA2bYOi1d66+qCNCAFBgAqpAgMBAAE= +-----END RSA PUBLIC KEY----- +secret-id-part jczvydhzetbpdiylj3d5nsnjvaigs7xm +publication-time 2015-02-24 20:00:00 +protocol-versions 2,3 +introduction-points +-----BEGIN MESSAGE----- +AgEdbps604RR6lqeyoZBzOb6+HvlL2cDt63w8vBtyRaLirq5ZD5GDnr+R0ePj71C +nC7qmRWuwBmzSdSd0lOTaSApBvIifbJksHUeT/rq03dpnnRHdHSVqSvig6bukcWJ +LgJmrRd3ES13LXVHenD3C6AZMHuL9TG+MjLO2PIHu0mFO18aAHVnWY32Dmt144IY +c2eTVZbsKobjjwCYvDf0PBZI+B6H0PZWkDX/ykYjArpLDwydeZyp+Zwj4+k0+nRr +RPlzbHYoBY9pFYDUXDXWdL+vTsgFTG0EngLGlgUWSY5U1T1Db5HfOqc7hbqklgs/ +ULG8NUY1k41Wb+dleJI28/+ZOM9zOpHcegNx4Cn8UGbw/Yv3Tj+yki+TMeOtJyhK +PQP8NWq8zThiVhBrfpmVjMYkNeVNyVNoxRwS6rxCQjoLWSJit2Mpf57zY1AOvT1S +EqqFbsX+slD2Uk67imALh4pMtjX29VLIujpum3drLhoTHDszBRhIH61A2eAZqdJy +7JkJd1x/8x7U0l8xNWhnj/bhUHdt3OrCvlN+n8x6BwmMNoLF8JIsskTuGHOaAKSQ +WK3z0rHjgIrEjkQeuQtfmptiIgRB9LnNr+YahRnRR6XIOJGaIoVLVM2Uo2RG4MS1 +2KC3DRJ87WdMv2yNWha3w+lWt/mOALahYrvuNMU8wEuNXSi5yCo1OKirv+d5viGe +hAgVZjRymBQF+vd30zMdOG9qXNoQFUN49JfS8z5FjWmdHRt2MHlqD2isxoeabERY +T4Q50fFH8XHkRRomKBEbCwy/4t2DiqcTOSLGOSbTtf7qlUACp2bRth/g0ySAW8X/ +CaWVm53z1vdgF2+t6j1CnuIqf0dUygZ07HEAHgu3rMW0YTk04QkvR3jiKAKijvGH +3YcMJz1aJ7psWSsgiwn8a8Cs4fAcLNJcdTrnyxhQI4PMST/QLfp8nPYrhKEeifTc +vYkC4CtGuEFkWyRifIGbeD7FcjkL1zqVNu31vgo3EIVbHzylERgpgTIYBRv7aV7W +X7XAbrrgXL0zgpI0orOyPkr2KRs6CcoEqcc2MLyB6gJ5fYAm69Ige+6gWtRT6qvZ +tJXagfKZivLj73dRD6sUqTCX4tmgo7Q8WFSeNscDAVm/p4dVsw6SOoFcRgaH20yX +MBa3oLNTUNAaGbScUPx2Ja3MQS0UITwk0TFTF7hL++NhTvTp6IdgQW4DG+/bVJ3M +BRR+hsvSz5BSQQj2FUIAsJ+WoVK9ImbgsBbYxSH60jCvxTIdeh2IeUzS2T1bU9AU +jOLzcJZmNh95Nj2Qdrc8/0gin9KpgPmuPQ6CyH3TPFy88lf19v9jHUMO4SKEr7am +DAjbX3D7APKgHyZ61CkuoB3gylIRb8rRJD2ote38M6A1+04yJL/jG+PCL1UnMWdL +yJ4f4LzI9c4ksnGyl9neq0IHnA0Nlky6dmgmE+vLi6OCbEEs2v132wc5PIxRY+TW +8JWu+3wUA4tj5uQvQRqU9/lmoHG/Jxubx/HwdD9Ri17G+qX8re5sySmmq7rcZEGJ +LVrlFuvA0NdoTM4AZY23iR6trJ/Ba2Q4pQk4SfOEMSoZJmf0UbxIP0Ez6Fb+Dxzk +WKXfI+D0ScuVjzV0bs8iXTrCcynztRKndNbtpd39hGAR0rNqvnHyQGYV75bWm5dS +0S0PQ6DOzicLxjNXZFicQvwfieg9VyJikWLFLu4zAbzHnuoRk6b2KbSU4UCG/BCz +mHqz4y6GfsncsNkmFmsD5Gn9UrloWcEWgIDL05yIikL+L9DPLnNlSYtehDfxlhvh +xHzY/Rad4Nzxe62yXhSxhROLTXIolllyOFJgqZ4hBlXybBqJH7sZUll6PUpDwZdu +BK14pzMIpfxq2eYp8jI7fh4lU9YrkuSUM0Ewa7HfrltAgxMhHyaFjfINt61P9OlO +s3nuBY17+KokaSWjACkCimVLH13H5DRhfX8OBRT4LeRMUspX3cyKbccwpOmoBf4y +WPM9QXw7nQy2hwnuX6NiK5QfeCGfY64M06J2tBGcCDmjPSIcJgMcyY7jfH9yPlDt +SKyyXpZnFOJplS2v28A/1csPSGy9kk/uGN0hfFULH4VvyAgNDYzmeOd8FvrbfHH2 +8BUTI/Tq2pckxwCYBWHcjSdXRAj5moCNSxCUMtK3kWFdxLFYzoiKuiZwq171qb5L +yCHMwNDIWEMeC75XSMswHaBsK6ON0UUg5oedQkOK+II9L/DVyTs3UYJOsWDfM67E +312O9/bmsoHvr+rofF7HEc74dtUAcaDGJNyNiB+O4UmWbtEpCfuLmq2vaZa9J7Y0 +hXlD2pcibC9CWpKR58cRL+dyYHZGJ4VKg6OHlJlF+JBPeLzObNDz/zQuEt9aL9Ae +QByamqGDGcaVMVZ/A80fRoUUgHbh3bLoAmxLCvMbJ0YMtRujdtGm8ZD0WvLXQA/U +dNmQ6tsP6pyVorWVa/Ma5CR7Em5q7M6639T8WPcu7ETTO19MnWud2lPJ5A== +-----END MESSAGE----- +signature +-----BEGIN SIGNATURE----- +c8HgXcZesCwAzgDlE3kRYsq059yCIE7MH7r2jBHqJVYPRrtm/HF/mTUykwFPzwsY +ulcuoNlPfgGMKS8qBL4kFVZ9uR2Y6P4zLchoVS6wjL+cNYOQfeQs3sNZkiIrOjbb +590tr1/yrt0qUtITGhUGhBZVs9gvkuqaThTIXleEseI= +-----END SIGNATURE----- diff --git a/test/unit/descriptor/hidden_service_descriptor.py b/test/unit/descriptor/hidden_service_descriptor.py index 3b9c652..ef8ad43 100644 --- a/test/unit/descriptor/hidden_service_descriptor.py +++ b/test/unit/descriptor/hidden_service_descriptor.py @@ -7,11 +7,15 @@ import unittest import stem.descriptor -from stem.descriptor.hidden_service_descriptor import REQUIRED_FIELDS, HiddenServiceDescriptor - from test.mocking import CRYPTO_BLOB, get_hidden_service_descriptor from test.unit.descriptor import get_resource +from stem.descriptor.hidden_service_descriptor import ( + REQUIRED_FIELDS, + DecryptionFailure, + HiddenServiceDescriptor, +) + MESSAGE_BLOCK = """ -----BEGIN MESSAGE----- %s @@ -175,6 +179,57 @@ fepXdvN/Jl5qQKHIBb602kuOTl0pN8Q+YeFUSIIDcmPBLpBDhH3PvrQMcGVaiOWH -----END RSA PUBLIC KEY-----\ """ +EXPECTED_BASIC_AUTH_INTRODUCTION_POINTS_ENCODED = """\ +-----BEGIN MESSAGE----- +AQEAi3xIJz0Qv97ug9kr4U0UNN2kQhkddPHuj4op3cw+fgMLqzPlFBPAJgaEKc+g +8xBTRKUlvfkXxocfV75GyQGi2Vqu5iN1SbI5Uliu3n8IiUina5+WaOfUs9iuHJIK +cErgfT0bUfXKDLvW6/ncsgPdb6kb+jjT8NVhR4ZrRUf9ASfcY/f2WFNTmLgOR3Oa +f2tMLJcAck9VbCDjKfSC6e6HgtxRFe9dX513mDviZp15UAHkjJSKxKvqRRVkL+7W +KxJGfLY56ypZa4+afBYT/yqLzY4C47/g5TTTx9fvsdp0uQ0AmjF4LeXdZ58yNjrp +Da63SrgQQM7lZ3k4LGXzDS20FKW2/9rpWgD78QLJGeKdHngD3ERvTX4m43rtEFrD +oB/4l2nl6fh0507ASYHy7QQQMcdjpN0OWQQKpL9SskZ8aQw1dY4KU28Gooe9ff+B +RGm6BlVzMi+HGcqfMpGwFfYopmqJuOXjNlX7a1jRwrztpJKeu4J9iSTiuSOEiQSq +kUyHRLO4rWJXa2/RMWfH4XSgdUaWFjOF6kaSwmI/pRZIepi/sX8BSKm+vvOnOtlr +Tz2DVSiA2qM+P3Br9qNTDUmTu9mri6fRzzVnj+ybdTQXn60jwPw4vj4xmvVTkjfZ +ZB2gw2+sAmZJA5pnLNGu4N8veo1Jiz7FLE0m+7yjXbcBc/GHWGTJa0Sa1Hwfp82t +ohagQlRYKhLaRrM6ZvjnPMH5dqT/ypfBXcIQAh6td1+e1Hf/uXZPM/ZrgHeCJqF+ +PvLDuu4TYxOod+elZE5LfwDFPzCcMA8XNuuDzGQOFOMh9o4xTbQchyRSfhDGev/H +HpY9qxRyua+PjDCmE/F3YiFy77ITJLhCyYEdzVw43hCVY52inEauvHRzqTl7Lc53 +PhnSIW6rDWsrrSMWApCC5WRSOSKfh0u4vO13bVLTb/QmuvMEhGiXDVI3/0NEpqKF +ewqyiG9Dvv67A3/IjTe3aMRGfWREHFnEG9bonn03uoufgmQb4h9ci9+QU52sl16F +rxRpxLyMRp8dpUzZbK3qxtASp09Lc2pdgItWcMMTtPObcd7KVV/xkVqm3ezaUbRF +Nw5qDFxkG85ohTvFt3wnfxkpytMhWoBv9F0ZMEFRLY2j+cb8IqXN5dyz6rGqgSYY +dtItQvI7Lq3XnOSFy3uCGC9Vzr6PRPQIrVH/56rSRaEyM8TgVWyaQQ3xm26x9Fe2 +jUg50lG/WVzsRueBImuai1KCRC4FB/cg/kVu/s+5f5H4Z/GSD+4UpDyg3i2RYuy9 +WOA/AGEeOLY5FkOTARcWteUbi6URboaouX2lnAXK6vX6Ysn8HgE9JATVbVC/96c9 +GnWaf9yCr6Q0BvrHkS7hsJJj+VwaNPW4POSqhL+p0p+2eSWZVMlFFxNr+BNKONk+ +RAssIHF1xVRHzzl75wjzhzuq0A0crHcHb64P+glkPt4iI7SqejyCrMQh6BWia6RT +c+NwXTnbcibB56McF+xWoyHne6dg1F0urA61JfQboyWOy+Z+cNPjEIcwWhJr/+Gx +v7/yf3V1kNECa90L7BeUmFGKxL7SvgyapevWqkIQCZEcOnobXQRdWUmNqSoZmOxB +u5eDcvrdF9p5wG5IStpzO9OConG3SQb46S9OSU3O7PnjKFId6KRIM7VsprMIIBTz +HKy6ufKyMXgyxxnvE5TZQcLzA4Wv8vHWET3t3WSQEwSPx45IAbjsE587YNOkjK1X +HNT3ypfRdJacxtttR7Y5Y/XF4tJmXkCfb5RoEqIPrQTmiLYh0h02i6CqeFK9u7j/ +yAdKY3NrCBuqPM4mWCdjvtgC9i1Q98LCDiVESRrvLlfvv3iWozDUZ3qIU4TnSgti +U5+xKrmlKcWHHgADS56IECgCQyr2nZEhcNK7vKvg+KgA667tRm7M35w9eHz+J7lg +x5v5GYPH4J1UjPEb5Cwl+Vlr0XIqbhMX9MZWimpOJ0l5TisOLuTJ9ennREsFPZjN +U4IZQht7gifFlemn7D4a+UXHu95bHxDBMPJky7iYc2U3r50+JWRF+LO1L2TNDQlV +iPO8AOoI0V0cGaYE+0ZUgpUDk8fxUH5CAPCn+dbsqDh165G6590cF9eF4/yrlf2V +nbhZipPQyOTrmiCkBPQ1zuXYyfFHrJL7yK4ykiBV8c/VLT8nxeKfPwW3USKOScnx +k68qqFZ6lNFxlDwPAJR3F2H+PN5JZ8H1lTE56ujgTBpArXMPYpKri4a0lG+8QnYK +D6jOJIli5QtVQxES4X64NDwducoGHnquMZs3ScvJQPSOuTvuqaad4FrTCZGbv6Ic +emUAHDsxjffMQ9IJYulluCTVWgS/AiBk31yiUB0GsAqZYcWz5kKgTpOXBQhulACM +waokEqbyH2Vtvc1peiPi+Vh6EhTSiDoEVZ2w9GrOnjgpyK6zxzH0aIhJJxlQu8it +w+xj/3+79Bf8myVesgzCWvXbkmvc6jJaoHGopV8lTM2JUn4xYCSz71Bt4wQBKZX4 +hFXDlDZaY1k/QRP/zTfQ8pjbcohDgUVW8eftJz3ND5Iy8D3nRF9/BQB3PWox4vyQ +Fj94Eoe8NmEArIKWjUoSkn+EDgNcdHGBIaQ5is0N8r9n4E2cgMj57i4Fm37k8c6+ +hlilrggVJ8qTBGs57M0ldqRLwt1bM6SkU//oMGel7Ft3EDd98W/6RXRkmAbsLhRx +7VMb4WCUBrIZLxo1/StwHa13RyTHAt0GKPu549l3oTZezsSad8vlurbnIbxtK9Cl +hp6mYPd3Djoe5OaLe8Gnu23ko+S2+kfHIjOwkza9R5w6AzLjkjYS3C8oRwuxKOft +lj/7xMZWDrfyw5H86L0QiaZnkmD+nig1+S+Rn39mmuEgl2iwZO/ihlncUJQTEULb +7IHpmofr+5ya5xWeo/BFQhulTNr2fJN0bPkVGfp+ +-----END MESSAGE-----\ +""" + class TestHiddenServiceDescriptor(unittest.TestCase): def test_for_duckduckgo_with_validation(self): @@ -209,6 +264,41 @@ class TestHiddenServiceDescriptor(unittest.TestCase): self.assertEqual(datetime.datetime(2014, 10, 31, 23, 0, 0), desc.published) self.assertEqual([2, 3], desc.protocol_versions) + def test_with_basic_auth(self): + """ + Parse a descriptor with introduction-points encrypted with basic auth. + """ + + descriptor_file = open(get_resource('hidden_service_basic_auth'), 'rb') + + desc = next(stem.descriptor.parse_file(descriptor_file, 'hidden-service-descriptor 1.0', validate = True)) + self.assertEqual('yfmvdrkdbyquyqk5vygyeylgj2qmrvrd', desc.descriptor_id) + self.assertEqual(2, desc.version) + self.assertEqual('fluw7z3s5cghuuirq3imh5jjj5ljips6', desc.secret_id_part) + self.assertEqual(datetime.datetime(2015, 2, 24, 20, 0, 0), desc.published) + self.assertEqual([2, 3], desc.protocol_versions) + self.assertEqual(EXPECTED_BASIC_AUTH_INTRODUCTION_POINTS_ENCODED, desc.introduction_points_encoded) + self.assertEqual([], desc.introduction_points_auth) + + self.assertRaises(DecryptionFailure, desc.introduction_points) + + def test_with_stealth_auth(self): + """ + Parse a descriptor with introduction-points encrypted with stealth auth. + """ + + descriptor_file = open(get_resource('hidden_service_stealth_auth'), 'rb') + + desc = next(stem.descriptor.parse_file(descriptor_file, 'hidden-service-descriptor 1.0', validate = True)) + self.assertEqual('ubf3xeibzlfil6s4larq6y5peup2z3oj', desc.descriptor_id) + self.assertEqual(2, desc.version) + self.assertEqual('jczvydhzetbpdiylj3d5nsnjvaigs7xm', desc.secret_id_part) + self.assertEqual(datetime.datetime(2015, 2, 24, 20, 0, 0), desc.published) + self.assertEqual([2, 3], desc.protocol_versions) + self.assertEqual([], desc.introduction_points_auth) + + self.assertRaises(DecryptionFailure, desc.introduction_points) + def _assert_matches_duckduckgo(self, desc): self.assertEqual('y3olqqblqw2gbh6phimfuiroechjjafa', desc.descriptor_id) self.assertEqual(2, desc.version)

1 0

[stem/master] Include hidden service descriptors in our API docs
by atagar＠torproject.org 28 Feb '15

28 Feb '15

commit 44f3e5fe4d8586da2dd2cf0a662d4ab801676d6e Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 28 21:10:35 2015 -0800 Include hidden service descriptors in our API docs Adding our new hidden service desriptors to the generated API docs, in addition to a changelog entry and few other improvements. --- docs/api.rst | 1 + docs/change_log.rst | 1 + docs/contents.rst | 1 + stem/descriptor/hidden_service_descriptor.py | 15 +++++----- stem/util/connection.py | 38 ++++++++++++++------------ 5 files changed, 30 insertions(+), 26 deletions(-) diff --git a/docs/api.rst b/docs/api.rst index 4f1a01c..85cfdcb 100644 --- a/docs/api.rst +++ b/docs/api.rst @@ -34,6 +34,7 @@ remotely like Tor does. * `stem.descriptor.microdescriptor <api/descriptor/microdescriptor.html>`_ - Minimalistic counterpart for server descriptors. * `stem.descriptor.networkstatus <api/descriptor/networkstatus.html>`_ - Network status documents which make up the Tor consensus. * `stem.descriptor.router_status_entry <api/descriptor/router_status_entry.html>`_ - Relay entries within a network status document. + * `stem.descriptor.hidden_service_descriptor <api/descriptor/hidden_service_descriptor.html>`_ - Descriptors generated for hidden services. * `stem.descriptor.tordnsel <api/descriptor/tordnsel.html>`_ - `TorDNSEL <https://www.torproject.org/projects/tordnsel.html.en>`_ exit lists. * `stem.descriptor.reader <api/descriptor/reader.html>`_ - Reads and parses descriptor files from disk. diff --git a/docs/change_log.rst b/docs/change_log.rst index 7143655..a922894 100644 --- a/docs/change_log.rst +++ b/docs/change_log.rst @@ -58,6 +58,7 @@ conversion (:trac:`14075`). * **Descriptors** * Lazy-loading descriptors, improving performance by 25-70% depending on what type it is (:trac:`14011`) + * Added `support for hidden service descriptors <api/descriptor/hidden_service_descriptor.html>`_ (:trac:`15004`) * The :class:`~stem.descriptor.networkstatus.DirectoryAuthority` 'fingerprint' attribute was actually its 'v3ident' * Updating Faravahar's address (:trac:`14487`) diff --git a/docs/contents.rst b/docs/contents.rst index db703a2..a402dd6 100644 --- a/docs/contents.rst +++ b/docs/contents.rst @@ -42,6 +42,7 @@ Contents api/descriptor/microdescriptor api/descriptor/networkstatus api/descriptor/router_status_entry + api/descriptor/hidden_service_descriptor api/descriptor/tordnsel api/descriptor/export diff --git a/stem/descriptor/hidden_service_descriptor.py b/stem/descriptor/hidden_service_descriptor.py index 075c2c2..73f5edf 100644 --- a/stem/descriptor/hidden_service_descriptor.py +++ b/stem/descriptor/hidden_service_descriptor.py @@ -241,12 +241,12 @@ class HiddenServiceDescriptor(Descriptor): Provided this service's introduction points. This provides a list of IntroductionPoint instances, which have the following attributes... - * identifier (str): hash of this introduction point's identity key - * address (str): address of this introduction point - * port (int): port where this introduction point is listening - * onion_key (str): public key for communicating with this introduction point - * service_key (str): public key for communicating with this hidden service - * intro_authentication (list): tuples of the form (auth_type, auth_data) + * **identifier** (str): hash of this introduction point's identity key + * **address** (str): address of this introduction point + * **port** (int): port where this introduction point is listening + * **onion_key** (str): public key for communicating with this introduction point + * **service_key** (str): public key for communicating with this hidden service + * **intro_authentication** (list): tuples of the form (auth_type, auth_data) for establishing a connection :returns: **list** of IntroductionPoints instances @@ -256,8 +256,7 @@ class HiddenServiceDescriptor(Descriptor): * **DecryptionFailure** if unable to decrypt this field """ - # TODO: Support fields encrypted with a desriptor-cookie. Need sample data - # to implement this. + # TODO: Support fields encrypted with a desriptor-cookie. (#15004) if not self.introduction_points_content: return [] diff --git a/stem/util/connection.py b/stem/util/connection.py index 402a45a..475c7f5 100644 --- a/stem/util/connection.py +++ b/stem/util/connection.py @@ -26,19 +26,21 @@ Connection and networking based utility functions. Method for resolving a process' connections. .. versionadded:: 1.1.0 - - ================= =========== - Resolver Description - ================= =========== - **PROC** /proc contents - **NETSTAT** netstat - **NETSTAT_WINDOWS** netstat command under Windows - **SS** ss command - **LSOF** lsof command - **SOCKSTAT** sockstat command under *nix - **BSD_SOCKSTAT** sockstat command under FreeBSD - **BSD_PROCSTAT** procstat command under FreeBSD - ================= =========== + .. versionchanged:: 1.4.0 + Added **NETSTAT_WINDOWS**. + + ==================== =========== + Resolver Description + ==================== =========== + **PROC** /proc contents + **NETSTAT** netstat + **NETSTAT_WINDOWS** netstat command under Windows + **SS** ss command + **LSOF** lsof command + **SOCKSTAT** sockstat command under *nix + **BSD_SOCKSTAT** sockstat command under FreeBSD + **BSD_PROCSTAT** procstat command under FreeBSD + ==================== =========== """ import collections @@ -143,11 +145,11 @@ def get_connections(resolver, process_pid = None, process_name = None): Retrieves a list of the current connections for a given process. This provides a list of Connection instances, which have five attributes... - * local_address (str) - * local_port (int) - * remote_address (str) - * remote_port (int) - * protocol (str, generally either 'tcp' or 'udp') + * **local_address** (str) + * **local_port** (int) + * **remote_address** (str) + * **remote_port** (int) + * **protocol** (str, generally either 'tcp' or 'udp') .. versionadded:: 1.1.0

1 0

[stem/master] Hidden service descriptor support
by atagar＠torproject.org 28 Feb '15

28 Feb '15

commit 14beceaa9da6e816ad3da0c28049e682003efb85 Merge: 48abb68 44f3e5f Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 28 21:12:46 2015 -0800 Hidden service descriptor support Support for parsing hidden service descriptors, as defined in the rend-spec... https://trac.torproject.org/projects/tor/ticket/15004 https://gitweb.torproject.org/torspec.git/tree/rend-spec.txt#n222 This doesn't yet support encrypted introduction-points, but otherwise is a complete parser. Like server descriptors, this validates our signature's integrity if pycrypto is available. docs/api.rst | 1 + docs/change_log.rst | 1 + docs/contents.rst | 1 + stem/descriptor/__init__.py | 119 +++++ stem/descriptor/hidden_service_descriptor.py | 311 ++++++++++++ stem/descriptor/server_descriptor.py | 138 +----- stem/util/connection.py | 44 +- test/mocking.py | 47 +- test/settings.cfg | 1 + .../unit/descriptor/data/hidden_service_basic_auth | 67 +++ .../unit/descriptor/data/hidden_service_duckduckgo | 60 +++ test/unit/descriptor/data/hidden_service_facebook | 60 +++ .../descriptor/data/hidden_service_stealth_auth | 60 +++ test/unit/descriptor/hidden_service_descriptor.py | 499 ++++++++++++++++++++ test/unit/descriptor/server_descriptor.py | 4 +- test/unit/tutorial.py | 2 +- 16 files changed, 1265 insertions(+), 150 deletions(-)

1 0

[tor-browser-spec/master] Bug 14152: Update expert bundle tor version.
by mikeperry＠torproject.org 28 Feb '15

28 Feb '15

commit b63050c335137cc9a39a85c466ca94820f634a04 Author: Georg Koppen <gk(a)torproject.org> Date: Mon Feb 23 10:25:29 2015 +0000 Bug 14152: Update expert bundle tor version. --- processes/ReleaseProcess | 2 ++ 1 file changed, 2 insertions(+) diff --git a/processes/ReleaseProcess b/processes/ReleaseProcess index e0ec140..4697f0b 100644 --- a/processes/ReleaseProcess +++ b/processes/ReleaseProcess @@ -102,6 +102,8 @@ # NOTE: This *must* be done immediately after the previous step! cd webwml torsocks git pull origin + # Update `version-win32-stable` as well if we include a new stable tor + # version. See: #14152. # In the RecommendedTBBVersions file, only add the new version. Don't # remove the old one yet. That comes later. vim ./include/versions.wmi ./projects/torbrowser/RecommendedTBBVersions

1 0