March 2015 - tor-commits - lists.torproject.org

[bridgedb/master] Revert change in addressClass check in filterBridgesByTransport().
by isis＠torproject.org 25 Mar '15

25 Mar '15

commit 3ef37df6ca94679ff3b76df6a713231d5e7b4f21 Author: Isis Lovecruft <isis(a)torproject.org> Date: Mon Mar 23 02:02:49 2015 +0000 Revert change in addressClass check in filterBridgesByTransport(). The `addressClass` passed to `filterBridgesByTransport()` is either `ipaddr.IPv4Address` or `ipaddr.IPv6Address`, not an instance of either. * REVERT a change to filterBridgesByTransport made in adb67e64. --- lib/bridgedb/Filters.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/bridgedb/Filters.py b/lib/bridgedb/Filters.py index d96d3ec..b857967 100644 --- a/lib/bridgedb/Filters.py +++ b/lib/bridgedb/Filters.py @@ -74,7 +74,7 @@ def filterBridgesByIP6(bridge): setattr(filterBridgesByIP6, "description", "ip=6") def filterBridgesByTransport(methodname, addressClass=None): - if not isinstance(addressClass, (IPv6Address, IPv4Address)): + if not ((addressClass is IPv4Address) or (addressClass is IPv6Address)): addressClass = IPv4Address ruleset = frozenset([methodname, addressClass])

1 0

[bridgedb/master] Change TLS cert checking in txrecaptcha to work with Twisted>=14.0.0.
by isis＠torproject.org 25 Mar '15

25 Mar '15

commit 6be3a91e82f80cdc6c19f55d021580a65b64f115 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Mar 25 01:46:25 2015 +0000 Change TLS cert checking in txrecaptcha to work with Twisted>=14.0.0. --- lib/bridgedb/txrecaptcha.py | 55 +++++++++++++++++++++++++++++++++++++++---- 1 file changed, 50 insertions(+), 5 deletions(-) diff --git a/lib/bridgedb/txrecaptcha.py b/lib/bridgedb/txrecaptcha.py index a8a0532..3666904 100644 --- a/lib/bridgedb/txrecaptcha.py +++ b/lib/bridgedb/txrecaptcha.py @@ -25,6 +25,8 @@ which are copyright the authors of the recaptcha-client_ package. import logging import urllib +from OpenSSL.crypto import FILETYPE_PEM +from OpenSSL.crypto import load_certificate from twisted import version as _twistedversion from twisted.internet import defer @@ -40,13 +42,33 @@ from zope.interface import implements from bridgedb.crypto import SSLVerifyingContextFactory - #: This was taken from recaptcha.client.captcha.API_SSL_SERVER. API_SSL_SERVER = API_SERVER = "https://www.google.com/recaptcha/api" API_SSL_VERIFY_URL = "%s/verify" % API_SSL_SERVER -# `t.w.client.HTTPConnectionPool` isn't available in Twisted-12.0.0 (see -# ticket #11219): +#: (type: `OpenSSL.crypto.X509`) Only trust certificate for the reCAPTCHA +#: :data:`API_SSL_SERVER` which were signed by the Google Internet Authority CA. +GOOGLE_INTERNET_AUTHORITY_CA_CERT = load_certificate(FILETYPE_PEM, bytes("""\ +-----BEGIN CERTIFICATE----- +MIICsDCCAhmgAwIBAgIDFXfhMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT +MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0 +aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTIxMjEyMTU1ODUwWhcNMTMxMjMxMTU1ODUw +WjBGMQswCQYDVQQGEwJVUzETMBEGA1UEChMKR29vZ2xlIEluYzEiMCAGA1UEAxMZ +R29vZ2xlIEludGVybmV0IEF1dGhvcml0eTCBnzANBgkqhkiG9w0BAQEFAAOBjQAw +gYkCgYEAye23pIucV+eEPkB9hPSP0XFjU5nneXQUr0SZMyCSjXvlKAy6rWxJfoNf +NFlOCnowzdDXxFdF7dWq1nMmzq0yE7jXDx07393cCDaob1FEm8rWIFJztyaHNWrb +qeXUWaUr/GcZOfqTGBhs3t0lig4zFEfC7wFQeeT9adGnwKziV28CAwEAAaOBozCB +oDAfBgNVHSMEGDAWgBRI5mj5K9KylddH2CMgEE8zmJCf1DAdBgNVHQ4EFgQUv8Aw +6/VDET5nup6R+/xq2uNrEiQwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8E +BAMCAQYwOgYDVR0fBDMwMTAvoC2gK4YpaHR0cDovL2NybC5nZW90cnVzdC5jb20v +Y3Jscy9zZWN1cmVjYS5jcmwwDQYJKoZIhvcNAQEFBQADgYEAvprjecFG+iJsxzEF +ZUNgujFQodUovxOWZshcnDW7fZ7mTlk3zpeVJrGPZzhaDhvuJjIfKqHweFB7gwB+ +ARlIjNvrPq86fpVg0NOTawALkSqOUMl3MynBQO+spR7EHcRbADQ/JemfTEh2Ycfl +vZqhEFBfurZkX0eTANq98ZvVfpg= +-----END CERTIFICATE-----""")) + +# `t.w.client.HTTPConnectionPool` isn't available in Twisted-12.0.0 +# (see ticket #11219: https://bugs.torproject.org/11219) _connectionPoolAvailable = _twistedversion >= Version('twisted', 12, 1, 0) if _connectionPoolAvailable: logging.info("Using HTTPConnectionPool for reCaptcha API server.") @@ -61,6 +83,23 @@ else: _agent = client.Agent(reactor) +# Twisted>=14.0.0 changed the way in which hostname verification works. +if _twistedversion >= Version('twisted', 14, 0, 0): + from twisted.internet._sslverify import OpenSSLCertificateAuthorities + + class RecaptchaOpenSSLCertificateAuthorities(OpenSSLCertificateAuthorities): + """The trusted CAs for connecting to reCAPTCHA servers.""" + #: A list of `OpenSSL.crypto.X509` objects. + caCerts = [GOOGLE_INTERNET_AUTHORITY_CA_CERT,] + def __init__(self): + super(RecaptchaOpenSSLCertificateAuthorities, self).__init__(self.caCerts) + + class RecaptchaPolicyForHTTPS(client.BrowserLikePolicyForHTTPS): + _trustRoot = RecaptchaOpenSSLCertificateAuthorities() + def __init__(self): + super(RecaptchaPolicyForHTTPS, self).__init__(trustRoot=self._trustRoot) + + def _setAgent(agent): """Set the global :attr:`agent`. @@ -86,15 +125,21 @@ def _getAgent(reactor=reactor, url=API_SSL_VERIFY_URL, connectTimeout=30, :api:`twisted.internet.reactor.connectSSL` for specifying the connection timeout. (default: ``30``) """ + # Twisted>=14.0.0 changed the way in which hostname verification works. + if _twistedversion >= Version('twisted', 14, 0, 0): + contextFactory = RecaptchaPolicyForHTTPS() + else: + contextFactory = SSLVerifyingContextFactory(url) + if _connectionPoolAvailable: return client.Agent(reactor, - contextFactory=SSLVerifyingContextFactory(url), + contextFactory=contextFactory, connectTimeout=connectTimeout, pool=_pool, **kwargs) else: return client.Agent(reactor, - contextFactory=SSLVerifyingContextFactory(url), + contextFactory=contextFactory, connectTimeout=connectTimeout, **kwargs)

1 0

[bridgedb/master] Merge branch 'release-0.3.1'
by isis＠torproject.org 25 Mar '15

25 Mar '15

1 0

[bridgedb/master] Fix syntax error in bridgedb.pot file.
by isis＠torproject.org 25 Mar '15

25 Mar '15

commit 9ec5a96a437edd203ea0979a9a60c0297619f426 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Mar 25 09:47:43 2015 +0000 Fix syntax error in bridgedb.pot file. --- lib/bridgedb/i18n/templates/bridgedb.pot | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/bridgedb/i18n/templates/bridgedb.pot b/lib/bridgedb/i18n/templates/bridgedb.pot index 28e4fd9..bd10a21 100644 --- a/lib/bridgedb/i18n/templates/bridgedb.pot +++ b/lib/bridgedb/i18n/templates/bridgedb.pot @@ -11,7 +11,7 @@ msgid "" msgstr "" "Project-Id-Version: bridgedb 0.2.4-234-g193c80a-dirty\n" -"Report-Msgid-Bugs-To: 'https://trac.torproject.org/projects/tor/newticket?component=BridgeDB&keywo…' +"Report-Msgid-Bugs-To: 'https://trac.torproject.org/projects/tor/newticket?component=BridgeDB&keywo…'" "POT-Creation-Date: 2015-03-19 22:13+0000\n" "PO-Revision-Date: 2015-03-19 22:13+0000\n" "Last-Translator: Isis Lovecruft <isis(a)torproject.org>\n"

1 0

[bridgedb/develop] Merge branch 'release-0.3.1'
by isis＠torproject.org 25 Mar '15

25 Mar '15

1 0

[bridgedb/master] Catch DescriptorWarnings and log them when we get identical descriptors.
by isis＠torproject.org 25 Mar '15

25 Mar '15

commit a27d79055d7b8de22a069c6ab8ee6ce2ffcd459a Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Mar 21 03:31:06 2015 +0000 Catch DescriptorWarnings and log them when we get identical descriptors. It turns out this actually does happen. Not very many times, though. When redeploying BridgeDB-0.3.0 with the new Stem descriptor parsers from #9380, [0] there were two bridges who had completely identical descriptor (including identical timestamps). Each of those bridges had exactly one perfectly identical duplicate descriptor each, and each bridge was quite new, having just appeared within the last 8 hours. Previously, the BridgeDB process would die because we didn't catch these errors. This fixes that. [0]: https://bugs.torproject.org/9380 --- lib/bridgedb/parse/descriptors.py | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/bridgedb/parse/descriptors.py b/lib/bridgedb/parse/descriptors.py index 80063ca..409a200 100644 --- a/lib/bridgedb/parse/descriptors.py +++ b/lib/bridgedb/parse/descriptors.py @@ -198,10 +198,14 @@ def deduplicate(descriptors): # ``platform`` line in its server-descriptor and tell whoever # wrote that code that they're probably (D)DOSing the Tor network. else: - raise DescriptorWarning( - ("Duplicate descriptor with identical timestamp (%s) for " - "router with fingerprint '%s'!") - % (descriptor.published, fingerprint)) + try: + raise DescriptorWarning( + ("Duplicate descriptor with identical timestamp (%s) " + "for router with fingerprint '%s'!") + % (descriptor.published, fingerprint)) + # And just in case it does happen, catch the warning: + except DescriptorWarning as descwarn: + logging.warn("DescriptorWarning: %s" % str(descwarn)) # Hoorah! No duplicates! (yet...) else:

1 0

[bridgedb/develop] Merge branch 'master' into develop
by isis＠torproject.org 25 Mar '15

25 Mar '15

commit 5912b3ca830b238e56d6e2a78fe359024379596d Merge: 9ec5a96 3a1aa0d Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Mar 25 19:02:12 2015 +0000 Merge branch 'master' into develop

1 0

[bridgedb/master] Fix error for initializeGnuPG() return value when signing fails.
by isis＠torproject.org 25 Mar '15

25 Mar '15

commit 105de16be5962ecdc6979936da17bb587aece69b Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Mar 21 03:36:48 2015 +0000 Fix error for initializeGnuPG() return value when signing fails. When the test signing in bridgedb.crypto.initializeGnuPG() fails, the return value would be `None`, rather than the gpg interface and the signing function, `(gpg, gpgSignMessage)`, or `(None, None)` as it does with the other failure modes. This would cause the EmailServerContext to raise a TypeError because `None` is not iterable, and cannot be assigned to two variables. We now return `(None, None)` when the test signing fails. This is a bugfix on #10385. [0] [0]: https://bugs.torproject.org/10385 --- lib/bridgedb/crypto.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/bridgedb/crypto.py b/lib/bridgedb/crypto.py index c17957b..d6dbbad 100644 --- a/lib/bridgedb/crypto.py +++ b/lib/bridgedb/crypto.py @@ -355,6 +355,8 @@ def initializeGnuPG(config): logging.info("Test signature with GnuPG key %s okay:\n%s" % (primary, sig)) return (gpg, gpgSignMessage) + return ret + class SSLVerifyingContextFactory(ssl.CertificateOptions): """``OpenSSL.SSL.Context`` factory which does full certificate-chain and

1 0

[bridgedb/master] Merge branch 'hotfix/10385-init-gpg-ret' into develop
by isis＠torproject.org 25 Mar '15

25 Mar '15

commit 5b401e30773acdff7eb797c83ee711f36acd30cf Merge: a066884 105de16 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Mar 21 03:59:55 2015 +0000 Merge branch 'hotfix/10385-init-gpg-ret' into develop lib/bridgedb/crypto.py | 2 ++ 1 file changed, 2 insertions(+)

1 0

[bridgedb/master] Merge branch 'master' into develop
by isis＠torproject.org 25 Mar '15

25 Mar '15

commit a06688478f76fb1bcc6e5a0f4d4aa41720bc8eb0 Merge: cdc0ffa 6f0f536 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Mar 21 02:00:52 2015 +0000 Merge branch 'master' into develop

1 0