March 2015 - tor-commits - lists.torproject.org

[bridgedb/master] Add crypto.initializeGnuPG() function.
by isis＠torproject.org 21 Mar '15

21 Mar '15

commit a4fc36eabb00bb47114b8379319d3897a63427ac Author: Isis Lovecruft <isis(a)torproject.org> Date: Sun Feb 22 10:58:04 2015 +0000 Add crypto.initializeGnuPG() function. This switches BridgeDB to using python-gnupg rather than pygpgme. * FIXES #10385 https://bugs.torproject.org/10385 --- lib/bridgedb/crypto.py | 79 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 79 insertions(+) diff --git a/lib/bridgedb/crypto.py b/lib/bridgedb/crypto.py index a16e45a..6bb5c7d 100644 --- a/lib/bridgedb/crypto.py +++ b/lib/bridgedb/crypto.py @@ -41,6 +41,7 @@ Module Overview from __future__ import absolute_import from __future__ import unicode_literals +import gnupg import hashlib import hmac import io @@ -273,14 +274,92 @@ def removePKCS1Padding(message): return unpadded +def initializeGnuPG(config): + """Initialize a GnuPG interface and test our configured keys. + + .. note:: This function uses python-gnupg_. + + :type config: :class:`bridgedb.persistent.Conf` + :param config: The loaded config file. + :rtype: 2-tuple + :returns: If ``EMAIL_GPG_SIGNING_ENABLED`` isn't ``True``, or we couldn't + initialize GnuPG and make a successful test signature with the + specified key, then a 2-tuple of ``None`` is returned. Otherwise, the + first item in the tuple is a :class:`gnupg.GPG` interface_ with the + GnuPG homedir set to the ``EMAIL_GPG_HOMEDIR`` option and the signing + key specified by the ``EMAIL_GPG_SIGNING_KEY_FINGERPRINT`` option in + bridgedb.conf set as the default key. The second item in the tuple is + a signing function with the passphrase (as specified in either + ``EMAIL_GPG_PASSPHRASE`` or ``EMAIL_GPG_PASSPHRASE_FILE``) already + set. + + .. _python-gnupg: https://pypi.python.org/pypi/gnupg/ + .. _interface: https://python-gnupg.readthedocs.org/en/latest/gnupg.html#gnupg-module + """ + ret = (None, None) + if not config.EMAIL_GPG_SIGNING_ENABLED: + return ret + homedir = config.EMAIL_GPG_HOMEDIR + primary = config.EMAIL_GPG_PRIMARY_KEY_FINGERPRINT + passphrase = config.EMAIL_GPG_PASSPHRASE + passFile = config.EMAIL_GPG_PASSPHRASE_FILE + logging.info("Using %s as our GnuPG home directory..." % homedir) + gpg = gnupg.GPG(homedir=homedir) + logging.info("Initialized GnuPG interface using %s binary with version %s." + % (gpg.binary, gpg.binary_version)) + primarySK = None + primaryPK = None + secrets = gpg.list_keys(secret=True) + publics = gpg.list_keys() + if not secrets: + logging.warn("No secret keys found in %s!" % gpg.secring) + return ret + primarySK = filter(lambda key: key['fingerprint'] == primary, secrets) + primaryPK = filter(lambda key: key['fingerprint'] == primary, publics) + if primarySK and primaryPK: + logging.info("Found GnuPG primary key with fingerprint: %s" % primary) + for sub in primaryPK[0]['subkeys']: + logging.info(" Subkey: %s Usage: %s" % (sub[0], sub[1].upper())) + else: + logging.warn("GnuPG key %s could not be found in %s!" % (primary, gpg.secring)) + return ret + + if passphrase: + logging.info("Read GnuPG passphrase from config.") + elif passFile: + try: + with open(passFile) as fh: + passphrase = fh.read() + except (IOError, OSError): + logging.error("Could not open GnuPG passphrase file: %s!" % passFile) + else: + logging.info("Read GnuPG passphrase from file: %s" % passFile) + def gpgSignMessage(message): + """Sign **message** with the default key specified by + ``EMAIL_GPG_PRIMARY_KEY_FINGERPRINT``. + + :param str message: A message to sign. + :rtype: str or ``None``. + :returns: A string containing the clearsigned message, or ``None`` if + the signing failed. + """ + sig = gpg.sign(message, default_key=primary, passphrase=passphrase) + if sig and sig.data: + return sig.data + + logging.debug("Testing signature created with GnuPG key...") + sig = gpgSignMessage("Testing 1 2 3") + if sig: + logging.info("Test signature with GnuPG key %s okay:\n%s" % (primary, sig)) + return (gpg, gpgSignMessage) class SSLVerifyingContextFactory(ssl.CertificateOptions):

1 0

[bridgedb/master] Remove unused GPGME variables in bridgedb.crypto.
by isis＠torproject.org 21 Mar '15

21 Mar '15

commit 9d7377bf8ef23da3b4e80d60a31b447de3af986b Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Feb 24 01:43:47 2015 +0000 Remove unused GPGME variables in bridgedb.crypto. --- lib/bridgedb/crypto.py | 6 ------ 1 file changed, 6 deletions(-) diff --git a/lib/bridgedb/crypto.py b/lib/bridgedb/crypto.py index 6bb5c7d..c17957b 100644 --- a/lib/bridgedb/crypto.py +++ b/lib/bridgedb/crypto.py @@ -80,12 +80,6 @@ except TypeError: # pragma: no cover else: NEW_BUFFER_INTERFACE = True -#: Settings for the GPGME Context and `Crypto Engine`_. -#: .. _`Crypto Engine`: -#: http://www.gnupg.org/documentation/manuals/gpgme/Crypto-Engine.html#Crypto-… -GPGME_CONTEXT_HOMEDIR = '.gnupg' -GPGME_CONTEXT_BINARY = which('gpg2') or which('gpg') # These will be lists - class PKCS1PaddingError(Exception): """Raised when there is a problem adding or removing PKCS#1 padding."""

1 0

[bridgedb/master] Merge branch 'fix/10385-python-gnupg_r1' into develop
by isis＠torproject.org 21 Mar '15

21 Mar '15

commit f6e03ed98acf1e54130b3ccf9b2bb184849bec50 Merge: b8365ad 9d7377b Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Feb 24 04:42:14 2015 +0000 Merge branch 'fix/10385-python-gnupg_r1' into develop lib/bridgedb/crypto.py | 6 ------ 1 file changed, 6 deletions(-)

1 0

[bridgedb/master] Add more unittests for bridgedb.util module.
by isis＠torproject.org 21 Mar '15

21 Mar '15

commit 145db3c76f60cf47fb76b6c82049d99ebc2368d6 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Feb 24 08:33:23 2015 +0000 Add more unittests for bridgedb.util module. --- lib/bridgedb/test/test_util.py | 42 ++++++++++++++++++++++++++++++++++++++++ lib/bridgedb/util.py | 2 +- 2 files changed, 43 insertions(+), 1 deletion(-) diff --git a/lib/bridgedb/test/test_util.py b/lib/bridgedb/test/test_util.py index 065c401..272c5b7 100644 --- a/lib/bridgedb/test/test_util.py +++ b/lib/bridgedb/test/test_util.py @@ -15,6 +15,7 @@ from __future__ import absolute_import from __future__ import print_function from __future__ import unicode_literals +import logging import os from twisted.mail.smtp import Address @@ -43,6 +44,15 @@ class MiscLoggingUtilTests(unittest.TestCase): self.assertEqual(len(logHandlers), 1) self.assertTrue('console' not in logHandlers) + def test_getLogHandlers_disable_logfile(self): + """util._getLogHandlers() should return ['console'] if stderr logging + is disabled. + """ + logHandlers = util._getLogHandlers(logToFile=False) + self.assertIsInstance(logHandlers, list) + self.assertEqual(len(logHandlers), 1) + self.assertTrue('rotating' not in logHandlers) + def test_getRotatingFileHandler(self): """_getRotatingFileHandler() should create a file with 0600 permissions (os.ST_WRITE | os.ST_APPEND). @@ -100,3 +110,35 @@ class LevenshteinDistanceTests(unittest.TestCase): fuzzyMatch = 4 distance = util.levenshteinDistance(email1.local, email2.local) self.assertLessEqual(distance, fuzzyMatch) + + +class JustifiedLogFormatterTests(unittest.TestCase): + """Unittests for :class:`bridgedb.util.JustifiedLogFormatter`.""" + + def setUp(self): + # name, level, path, lineno, message, args, exc_info + self.record = logging.LogRecord('name', logging.INFO, '/foo/bar/baz', + 12345, 'This is a message', None, None) + + def test_util_JustifiedLogFormatter(self): + formatter = util.JustifiedLogFormatter() + self.assertIsInstance(formatter, logging.Formatter) + + def test_util_JustifiedLogFormatter_logThreads(self): + formatter = util.JustifiedLogFormatter(logThreads=True) + self.assertIsInstance(formatter, logging.Formatter) + + def test_util_JustifiedLogFormatter_formatCallingFuncName(self): + formatter = util.JustifiedLogFormatter() + record = formatter._formatCallingFuncName(self.record) + self.assertIsInstance(formatter, logging.Formatter) + self.assertIsInstance(record, logging.LogRecord) + + def test_util_JustifiedLogFormatter_format(self): + formatter = util.JustifiedLogFormatter() + formatted = formatter.format(self.record) + self.assertIsInstance(formatter, logging.Formatter) + self.assertIsInstance(formatted, basestring) + self.assertNotEqual(formatted, '') + self.assertTrue('INFO' in formatted) + self.assertTrue('This is a message' in formatted) diff --git a/lib/bridgedb/util.py b/lib/bridgedb/util.py index 63fd5e6..4253d4e 100644 --- a/lib/bridgedb/util.py +++ b/lib/bridgedb/util.py @@ -62,7 +62,7 @@ def _getRotatingFileHandler(filename, mode='a', maxBytes=1000000, backupCount=0, os.chown(filename, uid, gid) try: os.chmod(filename, os.ST_WRITE | os.ST_APPEND) - except AttributeError: + except AttributeError: # pragma: no cover logging.error(""" XXX FIXME: Travis chokes on `os.ST_WRITE` saying that the module doesn't have that attribute, for some reason:

1 0

[bridgedb/master] Change allVanillaAddresses; Stem only allows the ORAddresses to be IPv4.
by isis＠torproject.org 21 Mar '15

21 Mar '15

commit 281aa6deda4a4d43f8fd57f72ffa4c324ec7767a Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 03:16:17 2015 +0000 Change allVanillaAddresses; Stem only allows the ORAddresses to be IPv4. * CHANGE Bridge.allVanillaAddresses to only expect the Bridge's primary ORAddress to be IPv4. --- lib/bridgedb/bridges.py | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/lib/bridgedb/bridges.py b/lib/bridgedb/bridges.py index 3c47967..e59a2ad 100644 --- a/lib/bridgedb/bridges.py +++ b/lib/bridgedb/bridges.py @@ -1020,11 +1020,9 @@ class Bridge(BridgeBackwardsCompatibility): address and port. """ addresses = self.orAddresses - # Add the default ORPort address: - if isIPv4(self.address): - addresses.append((self.address, self.orPort, 4)) - elif isIPv6(self.address): - addresses.append((self.address, self.orPort, 6)) + # Add the default ORPort address (it will always be IPv4, otherwise + # Stem should have raised a ValueError during parsing): + addresses.append((self.address, self.orPort, 4)) return addresses def assertOK(self):

1 0

[bridgedb/master] Add missing warnings module import in bridgedb.bridges.
by isis＠torproject.org 21 Mar '15

21 Mar '15

commit b8a359029d2ebb536e556b95c15257cf847101a6 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 03:28:53 2015 +0000 Add missing warnings module import in bridgedb.bridges. --- lib/bridgedb/bridges.py | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/bridgedb/bridges.py b/lib/bridgedb/bridges.py index e59a2ad..b882e5b 100644 --- a/lib/bridgedb/bridges.py +++ b/lib/bridgedb/bridges.py @@ -17,6 +17,7 @@ import hashlib import ipaddr import logging import os +import warnings from Crypto.Util import asn1 from Crypto.Util.number import bytes_to_long

1 0

[bridgedb/master] Refactor Bridge.supportedTransportTypes property to be shorter and faster.
by isis＠torproject.org 21 Mar '15

21 Mar '15

commit 4b7845a847d48288ff1ab1008b68e4ea77a35ddd Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 03:41:23 2015 +0000 Refactor Bridge.supportedTransportTypes property to be shorter and faster. --- lib/bridgedb/bridges.py | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/lib/bridgedb/bridges.py b/lib/bridgedb/bridges.py index b882e5b..5a5cba7 100644 --- a/lib/bridgedb/bridges.py +++ b/lib/bridgedb/bridges.py @@ -1274,12 +1274,7 @@ class Bridge(BridgeBackwardsCompatibility): """A deduplicated list of all the :data:`PluggableTranport.methodname`s which this bridge supports. """ - supported = [] - - for transport in self.transports: - supported.append(transport.methodname) - - return list(set(supported)) + return list(set([pt.methodname for pt in self.transports])) def updateFromNetworkStatus(self, descriptor): """Update this bridge's attributes from a parsed networkstatus

1 0

[bridgedb/master] Extract bridge_ips from extrainfo descriptors.
by isis＠torproject.org 21 Mar '15

21 Mar '15

commit 3cd8690d590a197e2b6067f33f020812da8d7513 Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 07:20:46 2015 +0000 Extract bridge_ips from extrainfo descriptors. --- lib/bridgedb/bridges.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/bridgedb/bridges.py b/lib/bridgedb/bridges.py index d69d96f..10e1ffc 100644 --- a/lib/bridgedb/bridges.py +++ b/lib/bridgedb/bridges.py @@ -829,6 +829,7 @@ class Bridge(BridgeBackwardsCompatibility): self.software = None self.os = None self.uptime = None + self.bridgeIPs = None self.onionKey = None self.ntorOnionKey = None @@ -1534,6 +1535,7 @@ class Bridge(BridgeBackwardsCompatibility): return self.descriptors['extrainfo'] = descriptor + self.bridgeIPs = descriptor.bridge_ips oldTransports = self.transports[:]

1 0

[bridgedb/master] Update class docstring for bridgedb.bridges.Bridge class.
by isis＠torproject.org 21 Mar '15

21 Mar '15

commit 4eb8701b959610043a385f9fecf2c5a0faa2d21e Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 07:19:54 2015 +0000 Update class docstring for bridgedb.bridges.Bridge class. --- lib/bridgedb/bridges.py | 56 +++++++++++++++++++++++++++++++---------------- 1 file changed, 37 insertions(+), 19 deletions(-) diff --git a/lib/bridgedb/bridges.py b/lib/bridgedb/bridges.py index fc457d1..d69d96f 100644 --- a/lib/bridgedb/bridges.py +++ b/lib/bridgedb/bridges.py @@ -735,43 +735,61 @@ class BridgeBackwardsCompatibility(BridgeBase): class Bridge(BridgeBackwardsCompatibility): """A single bridge, and all the information we have for it. - :type fingerprint: str or None - :ivar fingerprint: + :type fingerprint: str or ``None`` + :ivar fingerprint: This ``Bridge``'s fingerprint, in lowercased + hexadecimal format. - :type nickname: str or None - :ivar nickname: + :type nickname: str or ``None`` + :ivar nickname: This ``Bridge``'s router nickname. - :ivar orPort: int or None - :ivar orPort: - - :ivar socksPort: int - :ivar socksPort: + :type socksPort: int + :ivar socksPort: This ``Bridge``'s SOCKSPort. Should always be ``0``. :type dirPort: int - :ivar dirPort: + :ivar dirPort: This ``Bridge``'s DirPort. Should always be ``0``. :type orAddresses: list - :ivar orAddresses: + :ivar orAddresses: A list of 3-tuples in the form:: + (ADDRESS, PORT, IP_VERSION) + where: + * ADDRESS is an :class:`ipaddr.IPAddress`, + * PORT is an ``int``, + * IP_VERSION is either ``4`` or ``6``. :type transports: list - :ivar transports: + :ivar transports: A list of :class:`PluggableTransport`s, one for each + transport that this :class:`Bridge` currently supports. :type flags: :class:`~bridgedb.bridges.Flags` - :ivar flags: + :ivar flags: All flags assigned by the BridgeAuthority to this + :class:`Bridge`. :type hibernating: bool - :ivar hibernating: + :ivar hibernating: ``True`` if this :class:`Bridge` is hibernating and not + currently serving clients (e.g. if the Bridge hit its configured + ``RelayBandwidthLimit``); ``False`` otherwise. + + :type _blockedIn: dict + :ivar _blockedIn: A dictionary of ``ADDRESS:PORT`` pairs to lists of + lowercased, two-letter country codes (e.g. ``"us"``, ``"gb"``, + ``"cn"``, etc.) which that ``ADDRESS:PORT`` pair is blocked in. - :type contact: str or None - :ivar contact: The contact information for the this bridge's operator. + :type contact: str or ``None`` + :ivar contact: The contact information for the this Bridge's operator. - :type platform: str or None + :type family: set or ``None`` + :ivar family: The fingerprints of other Bridges related to this one. + + :type platform: str or ``None`` :ivar platform: The ``platform`` line taken from the ``@type bridge-server-descriptor``, e.g. ``'Tor 0.2.5.4-alpha on Linux'``. - :type family: set or None - :ivar family: The fingerprints of other bridges related to this one. + :type software: :api:`stem.version.Version` or ``None`` + :ivar software: The OR version portion of the ``platform`` line. + + :type os: str or None + :ivar os: The OS portion of the ``platform`` line. """ #: (bool) If ``True``, check that the signature of the bridge's #: ``@type bridge-server-descriptor`` is valid and that the signature was

1 0

[bridgedb/master] Add test for Bridges with additional ORAddresses which are IPv4.
by isis＠torproject.org 21 Mar '15

21 Mar '15

commit bdd90d749ff31b626a9fce2d3616821062d3acfa Author: Isis Lovecruft <isis(a)torproject.org> Date: Sat Feb 14 03:35:35 2015 +0000 Add test for Bridges with additional ORAddresses which are IPv4. --- lib/bridgedb/test/test_bridges.py | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/lib/bridgedb/test/test_bridges.py b/lib/bridgedb/test/test_bridges.py index c305c10..2f21c36 100644 --- a/lib/bridgedb/test/test_bridges.py +++ b/lib/bridgedb/test/test_bridges.py @@ -839,6 +839,30 @@ class BridgeTests(unittest.TestCase): ''.join(['$', '0'*40, '~', bridge.nickname])) + def test_Bridge_updateFromNetworkStatus_IPv4_ORAddress(self): + """Calling updateFromNetworkStatus() with a descriptor which has an + IPv4 address as an additional ORAddress should result in a + FutureWarning before continuing parsing. + """ + # Add an additional IPv4 ORAddress: + ns = BRIDGE_NETWORKSTATUS.replace( + 'a [6bf3:806b:78cd:d4b4:f6a7:4ced:cfad:dad4]:36488', + 'a [6bf3:806b:78cd:d4b4:f6a7:4ced:cfad:dad4]:36488\na 123.34.56.78:36488') + self._writeNetworkstatus(ns) + self._parseAllDescriptorFiles() + + self.assertWarns( + FutureWarning, + "Got IPv4 address in 'a'/'or-address' line! Descriptor format may have changed!", + bridges.__file__, # filename + self.bridge.updateFromNetworkStatus, + self.networkstatus) + + self.assertEqual(self.bridge.fingerprint, + '2C3225C4805331025E211F4B6E5BF45C333FDD2C') + self.assertIn((ipaddr.IPAddress('123.34.56.78'), 36488, 4), + self.bridge.allVanillaAddresses) + def test_Bridge_updateFromServerDescriptor(self): """ """ self.bridge.updateFromNetworkStatus(self.networkstatus)

1 0