April 2015 - tor-commits - lists.torproject.org

[obfs4/master] Do the release ritual for obfs4proxy-0.0.5.
by yawning＠torproject.org 15 Apr '15

15 Apr '15

commit 3540313e53fc851c833d98281fd64c8fd32effeb Author: Yawning Angel <yawning(a)torproject.org> Date: Wed Apr 15 20:54:07 2015 +0000 Do the release ritual for obfs4proxy-0.0.5. --- ChangeLog | 2 +- obfs4proxy/obfs4proxy.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 6c7213c..3569518 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,4 @@ -Changes in version 0.0.5 - UNRELEASED: +Changes in version 0.0.5 - 2015-04-15: - Go vet/fmt fixes, and misc. code cleanups. Patches by mvdan. - Changed the go.net import path to the new location (golang.org/x/net) - Added limited support for detecting if the parent process crashes. diff --git a/obfs4proxy/obfs4proxy.go b/obfs4proxy/obfs4proxy.go index 33fbce7..5d13b32 100644 --- a/obfs4proxy/obfs4proxy.go +++ b/obfs4proxy/obfs4proxy.go @@ -51,7 +51,7 @@ import ( ) const ( - obfs4proxyVersion = "0.0.4" + obfs4proxyVersion = "0.0.5" obfs4proxyLogFile = "obfs4proxy.log" socksAddr = "127.0.0.1:0" )

1 0

[obfs4/master] Use a built in SOCKS 5 server instead of goptlibs.
by yawning＠torproject.org 15 Apr '15

15 Apr '15

commit a8d7134f1097bd50803da0e2a86c07524e433b51 Author: Yawning Angel <yawning(a)torproject.org> Date: Sun Apr 12 19:00:46 2015 +0000 Use a built in SOCKS 5 server instead of goptlibs. Differences from my goptlib branch: * Instead of exposing a net.Listener, just expose a Handshake() routine that takes an existing net.Conn. (#14135 is irrelevant to this socks server. * There's an extra routine for sending back sensible errors on Dial failure instead of "General failure". * The code is slightly cleaner (IMO). Gotchas: * If the goptlib pt.Args datatype or external interface changes, args.go will need to be updated. Tested with obfs3 and obfs4, including IPv6. --- ChangeLog | 1 + common/socks5/args.go | 96 ++++++++++ common/socks5/args_test.go | 144 +++++++++++++++ common/socks5/rfc1929.go | 105 +++++++++++ common/socks5/socks5.go | 358 +++++++++++++++++++++++++++++++++++++ common/socks5/socks_test.go | 412 +++++++++++++++++++++++++++++++++++++++++++ obfs4proxy/obfs4proxy.go | 51 +++--- 7 files changed, 1142 insertions(+), 25 deletions(-) diff --git a/ChangeLog b/ChangeLog index 50a2f49..6c7213c 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,6 +6,7 @@ Changes in version 0.0.5 - UNRELEASED: - Moved the leveled logging wrappers into common/log so they are usable in transport implementations. - Added a DEBUG log level. + - Use a bundled SOCKS 5 server instead of goptlib's SocksListener. Changes in version 0.0.4 - 2015-02-17 - Improve the runtime performance of the obfs4 handshake tests. diff --git a/common/socks5/args.go b/common/socks5/args.go new file mode 100644 index 0000000..d9ea099 --- /dev/null +++ b/common/socks5/args.go @@ -0,0 +1,96 @@ +/* + * Copyright (c) 2015, Yawning Angel <yawning at torproject dot org> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +package socks5 + +import ( + "fmt" + "git.torproject.org/pluggable-transports/goptlib.git" +) + +// parseClientParameters takes a client parameter string formatted according to +// "Passing PT-specific parameters to a client PT" in the pluggable transport +// specification, and returns it as a goptlib Args structure. +// +// This is functionally identical to the equivalently named goptlib routine. +func parseClientParameters(argStr string) (args pt.Args, err error) { + args = make(pt.Args) + if len(argStr) == 0 { + return + } + + var key string + var acc []byte + prevIsEscape := false + for idx, ch := range []byte(argStr) { + switch ch { + case '\\': + prevIsEscape = !prevIsEscape + if prevIsEscape { + continue + } + case '=': + if !prevIsEscape { + if key != "" { + break + } + if len(acc) == 0 { + return nil, fmt.Errorf("unexpected '=' at %d", idx) + } + key = string(acc) + acc = nil + continue + } + case ';': + if !prevIsEscape { + if key == "" || idx == len(argStr)-1 { + return nil, fmt.Errorf("unexpected ';' at %d", idx) + } + args.Add(key, string(acc)) + key = "" + acc = nil + continue + } + default: + if prevIsEscape { + return nil, fmt.Errorf("unexpected '\\' at %d", idx-1) + } + } + prevIsEscape = false + acc = append(acc, ch) + } + if prevIsEscape { + return nil, fmt.Errorf("underminated escape character") + } + // Handle the final k,v pair if any. + if key == "" { + return nil, fmt.Errorf("final key with no value") + } + args.Add(key, string(acc)) + + return args, nil +} diff --git a/common/socks5/args_test.go b/common/socks5/args_test.go new file mode 100644 index 0000000..d9d3f22 --- /dev/null +++ b/common/socks5/args_test.go @@ -0,0 +1,144 @@ +// Shamelessly stolen from goptlib's args_test.go. + +package socks5 + +import ( + "testing" + + "git.torproject.org/pluggable-transports/goptlib.git" +) + +func stringSlicesEqual(a, b []string) bool { + if len(a) != len(b) { + return false + } + for i := range a { + if a[i] != b[i] { + return false + } + } + return true +} + +func argsEqual(a, b pt.Args) bool { + for k, av := range a { + bv := b[k] + if !stringSlicesEqual(av, bv) { + return false + } + } + for k, bv := range b { + av := a[k] + if !stringSlicesEqual(av, bv) { + return false + } + } + return true +} + +func TestParseClientParameters(t *testing.T) { + badTests := [...]string{ + "key", + "key\\", + "=value", + "==value", + "==key=value", + "key=value\\", + "a=b;key=value\\", + "a;b=c", + ";", + "key=value;", + ";key=value", + "key\\=value", + } + goodTests := [...]struct { + input string + expected pt.Args + }{ + { + "", + pt.Args{}, + }, + { + "key=", + pt.Args{"key": []string{""}}, + }, + { + "key==", + pt.Args{"key": []string{"="}}, + }, + { + "key=value", + pt.Args{"key": []string{"value"}}, + }, + { + "a=b=c", + pt.Args{"a": []string{"b=c"}}, + }, + { + "key=a\nb", + pt.Args{"key": []string{"a\nb"}}, + }, + { + "key=value\\;", + pt.Args{"key": []string{"value;"}}, + }, + { + "key=\"value\"", + pt.Args{"key": []string{"\"value\""}}, + }, + { + "key=\"\"value\"\"", + pt.Args{"key": []string{"\"\"value\"\""}}, + }, + { + "\"key=value\"", + pt.Args{"\"key": []string{"value\""}}, + }, + { + "key=value;key=value", + pt.Args{"key": []string{"value", "value"}}, + }, + { + "key=value1;key=value2", + pt.Args{"key": []string{"value1", "value2"}}, + }, + { + "key1=value1;key2=value2;key1=value3", + pt.Args{"key1": []string{"value1", "value3"}, "key2": []string{"value2"}}, + }, + { + "\\;=\\;;\\\\=\\;", + pt.Args{";": []string{";"}, "\\": []string{";"}}, + }, + { + "a\\=b=c", + pt.Args{"a=b": []string{"c"}}, + }, + { + "shared-secret=rahasia;secrets-file=/tmp/blob", + pt.Args{"shared-secret": []string{"rahasia"}, "secrets-file": []string{"/tmp/blob"}}, + }, + { + "rocks=20;height=5.6", + pt.Args{"rocks": []string{"20"}, "height": []string{"5.6"}}, + }, + } + + for _, input := range badTests { + _, err := parseClientParameters(input) + if err == nil { + t.Errorf("%q unexpectedly succeeded", input) + } + } + + for _, test := range goodTests { + args, err := parseClientParameters(test.input) + if err != nil { + t.Errorf("%q unexpectedly returned an error: %s", test.input, err) + } + if !argsEqual(args, test.expected) { + t.Errorf("%q → %q (expected %q)", test.input, args, test.expected) + } + } +} diff --git a/common/socks5/rfc1929.go b/common/socks5/rfc1929.go new file mode 100644 index 0000000..f8176f1 --- /dev/null +++ b/common/socks5/rfc1929.go @@ -0,0 +1,105 @@ +/* + * Copyright (c) 2015, Yawning Angel <yawning at torproject dot org> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +package socks5 + +import "fmt" + +const ( + authRFC1929Ver = 0x01 + authRFC1929Success = 0x00 + authRFC1929Fail = 0x01 +) + +func (req *Request) authRFC1929() (err error) { + sendErrResp := func() { + // Swallow write/flush errors, the auth failure is the relevant error. + resp := []byte{authRFC1929Ver, authRFC1929Fail} + req.rw.Write(resp[:]) + req.flushBuffers() + } + + // The client sends a Username/Password request. + // uint8_t ver (0x01) + // uint8_t ulen (>= 1) + // uint8_t uname[ulen] + // uint8_t plen (>= 1) + // uint8_t passwd[plen] + + if err = req.readByteVerify("auth version", authRFC1929Ver); err != nil { + sendErrResp() + return + } + + // Read the username. + var ulen byte + if ulen, err = req.readByte(); err != nil { + sendErrResp() + return + } else if ulen < 1 { + sendErrResp() + return fmt.Errorf("username with 0 length") + } + var uname []byte + if uname, err = req.readBytes(int(ulen)); err != nil { + sendErrResp() + return + } + + // Read the password. + var plen byte + if plen, err = req.readByte(); err != nil { + sendErrResp() + return + } else if plen < 1 { + sendErrResp() + return fmt.Errorf("password with 0 length") + } + var passwd []byte + if passwd, err = req.readBytes(int(plen)); err != nil { + sendErrResp() + return + } + + // Pluggable transports use the username/password field to pass + // per-connection arguments. The fields contain ASCII strings that + // are combined and then parsed into key/value pairs. + argStr := string(uname) + if !(plen == 1 && passwd[0] == 0x00) { + // tor will set the password to 'NUL', if the field doesn't contain any + // actual argument data. + argStr += string(passwd) + } + if req.Args, err = parseClientParameters(argStr); err != nil { + sendErrResp() + return + } + + resp := []byte{authRFC1929Ver, authRFC1929Success} + _, err = req.rw.Write(resp[:]) + return +} diff --git a/common/socks5/socks5.go b/common/socks5/socks5.go new file mode 100644 index 0000000..d15e542 --- /dev/null +++ b/common/socks5/socks5.go @@ -0,0 +1,358 @@ +/* + * Copyright (c) 2015, Yawning Angel <yawning at torproject dot org> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +// Package socks5 implements a SOCKS 5 server and the required pluggable +// transport specific extensions. For more information see RFC 1928 and RFC +// 1929. +// +// Notes: +// * GSSAPI authentication, is NOT supported. +// * Only the CONNECT command is supported. +// * The authentication provided by the client is always accepted as it is +// used as a channel to pass information rather than for authentication for +// pluggable transports. +package socks5 + +import ( + "bufio" + "bytes" + "fmt" + "io" + "net" + "syscall" + "time" + + "git.torproject.org/pluggable-transports/goptlib.git" +) + +const ( + version = 0x05 + rsv = 0x00 + + cmdConnect = 0x01 + + atypIPv4 = 0x01 + atypDomainName = 0x03 + atypIPv6 = 0x04 + + authNoneRequired = 0x00 + authUsernamePassword = 0x02 + authNoAcceptableMethods = 0xff + + requestTimeout = 5 * time.Second +) + +// ReplyCode is a SOCKS 5 reply code. +type ReplyCode byte + +// The various SOCKS 5 reply codes from RFC 1928. +const ( + ReplySucceeded ReplyCode = iota + ReplyGeneralFailure + ReplyConnectionNotAllowed + ReplyNetworkUnreachable + ReplyHostUnreachable + ReplyConnectionRefused + ReplyTTLExpired + ReplyCommandNotSupported + ReplyAddressNotSupported +) + +// Version returns a string suitable to be included in a call to Cmethod. +func Version() string { + return "socks5" +} + +// ErrorToReplyCode converts an error to the "best" reply code. +func ErrorToReplyCode(err error) ReplyCode { + opErr, ok := err.(*net.OpError) + if !ok { + return ReplyGeneralFailure + } + + errno, ok := opErr.Err.(syscall.Errno) + if !ok { + return ReplyGeneralFailure + } + switch errno { + case syscall.EADDRNOTAVAIL: + return ReplyAddressNotSupported + case syscall.ETIMEDOUT: + return ReplyTTLExpired + case syscall.ENETUNREACH: + return ReplyNetworkUnreachable + case syscall.EHOSTUNREACH: + return ReplyHostUnreachable + case syscall.ECONNREFUSED, syscall.ECONNRESET: + return ReplyConnectionRefused + default: + return ReplyGeneralFailure + } +} + +// Request describes a SOCKS 5 request. +type Request struct { + Target string + Args pt.Args + rw *bufio.ReadWriter +} + +// Handshake attempts to handle a incoming client handshake over the provided +// connection and receive the SOCKS5 request. The routine handles sending +// appropriate errors if applicable, but will not close the connection. +func Handshake(conn net.Conn) (*Request, error) { + // Arm the handshake timeout. + var err error + if err = conn.SetDeadline(time.Now().Add(requestTimeout)); err != nil { + return nil, err + } + defer func() { + // Disarm the handshake timeout, only propagate the error if + // the handshake was successful. + nerr := conn.SetDeadline(time.Time{}) + if err == nil { + err = nerr + } + }() + + req := new(Request) + req.rw = bufio.NewReadWriter(bufio.NewReader(conn), bufio.NewWriter(conn)) + + // Negotiate the protocol version and authentication method. + var method byte + if method, err = req.negotiateAuth(); err != nil { + return nil, err + } + + // Authenticate if neccecary. + if err = req.authenticate(method); err != nil { + return nil, err + } + + // Read the client command. + if err = req.readCommand(); err != nil { + return nil, err + } + + return req, err +} + +// Reply sends a SOCKS5 reply to the corresponding request. The BND.ADDR and +// BND.PORT fields are always set to an address/port corresponding to +// "0.0.0.0:0". +func (req *Request) Reply(code ReplyCode) error { + // The server sends a reply message. + // uint8_t ver (0x05) + // uint8_t rep + // uint8_t rsv (0x00) + // uint8_t atyp + // uint8_t bnd_addr[] + // uint16_t bnd_port + + var resp [4 + 4 + 2]byte + resp[0] = version + resp[1] = byte(code) + resp[2] = rsv + resp[3] = atypIPv4 + + if _, err := req.rw.Write(resp[:]); err != nil { + return err + } + + return req.flushBuffers() +} + +func (req *Request) negotiateAuth() (byte, error) { + // The client sends a version identifier/selection message. + // uint8_t ver (0x05) + // uint8_t nmethods (>= 1). + // uint8_t methods[nmethods] + + var err error + if err = req.readByteVerify("version", version); err != nil { + return 0, err + } + + // Read the number of methods, and the methods. + var nmethods byte + method := byte(authNoAcceptableMethods) + if nmethods, err = req.readByte(); err != nil { + return method, err + } + var methods []byte + if methods, err = req.readBytes(int(nmethods)); err != nil { + return 0, err + } + + // Pick the best authentication method, prioritizing authenticating + // over not if both options are present. + if bytes.IndexByte(methods, authUsernamePassword) != -1 { + method = authUsernamePassword + } else if bytes.IndexByte(methods, authNoneRequired) != -1 { + method = authNoneRequired + } + + // The server sends a method selection message. + // uint8_t ver (0x05) + // uint8_t method + msg := []byte{version, method} + if _, err = req.rw.Write(msg); err != nil { + return 0, err + } + + return method, req.flushBuffers() +} + +func (req *Request) authenticate(method byte) error { + switch method { + case authNoneRequired: + // No authentication required. + case authUsernamePassword: + if err := req.authRFC1929(); err != nil { + return err + } + case authNoAcceptableMethods: + return fmt.Errorf("no acceptable authentication methods") + default: + // This should never happen as only supported auth methods should be + // negotiated. + return fmt.Errorf("negotiated unsupported method 0x%02x", method) + } + + return req.flushBuffers() +} + +func (req *Request) readCommand() error { + // The client sends the request details. + // uint8_t ver (0x05) + // uint8_t cmd + // uint8_t rsv (0x00) + // uint8_t atyp + // uint8_t dst_addr[] + // uint16_t dst_port + + var err error + if err = req.readByteVerify("version", version); err != nil { + req.Reply(ReplyGeneralFailure) + return err + } + if err = req.readByteVerify("command", cmdConnect); err != nil { + req.Reply(ReplyCommandNotSupported) + return err + } + if err = req.readByteVerify("reserved", rsv); err != nil { + req.Reply(ReplyGeneralFailure) + return err + } + + // Read the destination address/port. + var atyp byte + var host string + if atyp, err = req.readByte(); err != nil { + req.Reply(ReplyGeneralFailure) + return err + } + switch atyp { + case atypIPv4: + var addr []byte + if addr, err = req.readBytes(net.IPv4len); err != nil { + req.Reply(ReplyGeneralFailure) + return err + } + host = net.IPv4(addr[0], addr[1], addr[2], addr[3]).String() + case atypDomainName: + var alen byte + if alen, err = req.readByte(); err != nil { + req.Reply(ReplyGeneralFailure) + return err + } + if alen == 0 { + req.Reply(ReplyGeneralFailure) + return fmt.Errorf("domain name with 0 length") + } + var addr []byte + if addr, err = req.readBytes(int(alen)); err != nil { + req.Reply(ReplyGeneralFailure) + return err + } + host = string(addr) + case atypIPv6: + var rawAddr []byte + if rawAddr, err = req.readBytes(net.IPv6len); err != nil { + req.Reply(ReplyGeneralFailure) + return err + } + addr := make(net.IP, net.IPv6len) + copy(addr[:], rawAddr[:]) + host = fmt.Sprintf("[%s]", addr.String()) + default: + req.Reply(ReplyAddressNotSupported) + return fmt.Errorf("unsupported address type 0x%02x", atyp) + } + var rawPort []byte + if rawPort, err = req.readBytes(2); err != nil { + req.Reply(ReplyGeneralFailure) + return err + } + port := int(rawPort[0])<<8 | int(rawPort[1]) + req.Target = fmt.Sprintf("%s:%d", host, port) + + return req.flushBuffers() +} + +func (req *Request) flushBuffers() error { + if err := req.rw.Flush(); err != nil { + return err + } + if req.rw.Reader.Buffered() > 0 { + return fmt.Errorf("read buffer has %d bytes of trailing data", req.rw.Reader.Buffered()) + } + return nil +} + +func (req *Request) readByte() (byte, error) { + return req.rw.ReadByte() +} + +func (req *Request) readByteVerify(descr string, expected byte) error { + val, err := req.rw.ReadByte() + if err != nil { + return err + } + if val != expected { + return fmt.Errorf("message field '%s' was 0x%02x (expected 0x%02x)", descr, val, expected) + } + return nil +} + +func (req *Request) readBytes(n int) ([]byte, error) { + b := make([]byte, n) + if _, err := io.ReadFull(req.rw, b); err != nil { + return nil, err + } + return b, nil +} diff --git a/common/socks5/socks_test.go b/common/socks5/socks_test.go new file mode 100644 index 0000000..720476f --- /dev/null +++ b/common/socks5/socks_test.go @@ -0,0 +1,412 @@ +/* + * Copyright (c) 2015, Yawning Angel <yawning at torproject dot org> + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +package socks5 + +import ( + "bufio" + "bytes" + "encoding/hex" + "io" + "net" + "testing" +) + +func tcpAddrsEqual(a, b *net.TCPAddr) bool { + return a.IP.Equal(b.IP) && a.Port == b.Port +} + +// testReadWriter is a bytes.Buffer backed io.ReadWriter used for testing. The +// Read and Write routines are to be used by the component being tested. Data +// can be written to and read back via the writeHex and readHex routines. +type testReadWriter struct { + readBuf bytes.Buffer + writeBuf bytes.Buffer +} + +func (c *testReadWriter) Read(buf []byte) (n int, err error) { + return c.readBuf.Read(buf) +} + +func (c *testReadWriter) Write(buf []byte) (n int, err error) { + return c.writeBuf.Write(buf) +} + +func (c *testReadWriter) writeHex(str string) (n int, err error) { + var buf []byte + if buf, err = hex.DecodeString(str); err != nil { + return + } + return c.readBuf.Write(buf) +} + +func (c *testReadWriter) readHex() string { + return hex.EncodeToString(c.writeBuf.Bytes()) +} + +func (c *testReadWriter) toBufio() *bufio.ReadWriter { + return bufio.NewReadWriter(bufio.NewReader(c), bufio.NewWriter(c)) +} + +func (c *testReadWriter) toRequest() *Request { + req := new(Request) + req.rw = c.toBufio() + return req +} + +func (c *testReadWriter) reset(req *Request) { + c.readBuf.Reset() + c.writeBuf.Reset() + req.rw = c.toBufio() +} + +// TestAuthInvalidVersion tests auth negotiation with an invalid version. +func TestAuthInvalidVersion(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + + // VER = 03, NMETHODS = 01, METHODS = [00] + c.writeHex("030100") + if _, err := req.negotiateAuth(); err == nil { + t.Error("negotiateAuth(InvalidVersion) succeded") + } +} + +// TestAuthInvalidNMethods tests auth negotiaton with no methods. +func TestAuthInvalidNMethods(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + var err error + var method byte + + // VER = 05, NMETHODS = 00 + c.writeHex("0500") + if method, err = req.negotiateAuth(); err != nil { + t.Error("negotiateAuth(No Methods) failed:", err) + } + if method != authNoAcceptableMethods { + t.Error("negotiateAuth(No Methods) picked unexpected method:", method) + } + if msg := c.readHex(); msg != "05ff" { + t.Error("negotiateAuth(No Methods) invalid response:", msg) + } +} + +// TestAuthNoneRequired tests auth negotiaton with NO AUTHENTICATION REQUIRED. +func TestAuthNoneRequired(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + var err error + var method byte + + // VER = 05, NMETHODS = 01, METHODS = [00] + c.writeHex("050100") + if method, err = req.negotiateAuth(); err != nil { + t.Error("negotiateAuth(None) failed:", err) + } + if method != authNoneRequired { + t.Error("negotiateAuth(None) unexpected method:", method) + } + if msg := c.readHex(); msg != "0500" { + t.Error("negotiateAuth(None) invalid response:", msg) + } +} + +// TestAuthUsernamePassword tests auth negotiation with USERNAME/PASSWORD. +func TestAuthUsernamePassword(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + var err error + var method byte + + // VER = 05, NMETHODS = 01, METHODS = [02] + c.writeHex("050102") + if method, err = req.negotiateAuth(); err != nil { + t.Error("negotiateAuth(UsernamePassword) failed:", err) + } + if method != authUsernamePassword { + t.Error("negotiateAuth(UsernamePassword) unexpected method:", method) + } + if msg := c.readHex(); msg != "0502" { + t.Error("negotiateAuth(UsernamePassword) invalid response:", msg) + } +} + +// TestAuthBoth tests auth negotiation containing both NO AUTHENTICATION +// REQUIRED and USERNAME/PASSWORD. +func TestAuthBoth(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + var err error + var method byte + + // VER = 05, NMETHODS = 02, METHODS = [00, 02] + c.writeHex("05020002") + if method, err = req.negotiateAuth(); err != nil { + t.Error("negotiateAuth(Both) failed:", err) + } + if method != authUsernamePassword { + t.Error("negotiateAuth(Both) unexpected method:", method) + } + if msg := c.readHex(); msg != "0502" { + t.Error("negotiateAuth(Both) invalid response:", msg) + } +} + +// TestAuthUnsupported tests auth negotiation with a unsupported method. +func TestAuthUnsupported(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + var err error + var method byte + + // VER = 05, NMETHODS = 01, METHODS = [01] (GSSAPI) + c.writeHex("050101") + if method, err = req.negotiateAuth(); err != nil { + t.Error("negotiateAuth(Unknown) failed:", err) + } + if method != authNoAcceptableMethods { + t.Error("negotiateAuth(Unknown) picked unexpected method:", method) + } + if msg := c.readHex(); msg != "05ff" { + t.Error("negotiateAuth(Unknown) invalid response:", msg) + } +} + +// TestAuthUnsupported2 tests auth negotiation with supported and unsupported +// methods. +func TestAuthUnsupported2(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + var err error + var method byte + + // VER = 05, NMETHODS = 03, METHODS = [00,01,02] + c.writeHex("0503000102") + if method, err = req.negotiateAuth(); err != nil { + t.Error("negotiateAuth(Unknown2) failed:", err) + } + if method != authUsernamePassword { + t.Error("negotiateAuth(Unknown2) picked unexpected method:", method) + } + if msg := c.readHex(); msg != "0502" { + t.Error("negotiateAuth(Unknown2) invalid response:", msg) + } +} + +// TestRFC1929InvalidVersion tests RFC1929 auth with an invalid version. +func TestRFC1929InvalidVersion(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + + // VER = 03, ULEN = 5, UNAME = "ABCDE", PLEN = 5, PASSWD = "abcde" + c.writeHex("03054142434445056162636465") + if err := req.authenticate(authUsernamePassword); err == nil { + t.Error("authenticate(InvalidVersion) succeded") + } + if msg := c.readHex(); msg != "0101" { + t.Error("authenticate(InvalidVersion) invalid response:", msg) + } +} + +// TestRFC1929InvalidUlen tests RFC1929 auth with an invalid ULEN. +func TestRFC1929InvalidUlen(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + + // VER = 01, ULEN = 0, UNAME = "", PLEN = 5, PASSWD = "abcde" + c.writeHex("0100056162636465") + if err := req.authenticate(authUsernamePassword); err == nil { + t.Error("authenticate(InvalidUlen) succeded") + } + if msg := c.readHex(); msg != "0101" { + t.Error("authenticate(InvalidUlen) invalid response:", msg) + } +} + +// TestRFC1929InvalidPlen tests RFC1929 auth with an invalid PLEN. +func TestRFC1929InvalidPlen(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + + // VER = 01, ULEN = 5, UNAME = "ABCDE", PLEN = 0, PASSWD = "" + c.writeHex("0105414243444500") + if err := req.authenticate(authUsernamePassword); err == nil { + t.Error("authenticate(InvalidPlen) succeded") + } + if msg := c.readHex(); msg != "0101" { + t.Error("authenticate(InvalidPlen) invalid response:", msg) + } +} + +// TestRFC1929InvalidArgs tests RFC1929 auth with invalid pt args. +func TestRFC1929InvalidPTArgs(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + + // VER = 01, ULEN = 5, UNAME = "ABCDE", PLEN = 5, PASSWD = "abcde" + c.writeHex("01054142434445056162636465") + if err := req.authenticate(authUsernamePassword); err == nil { + t.Error("authenticate(InvalidArgs) succeded") + } + if msg := c.readHex(); msg != "0101" { + t.Error("authenticate(InvalidArgs) invalid response:", msg) + } +} + +// TestRFC1929Success tests RFC1929 auth with valid pt args. +func TestRFC1929Success(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + + // VER = 01, ULEN = 9, UNAME = "key=value", PLEN = 1, PASSWD = "\0" + c.writeHex("01096b65793d76616c75650100") + if err := req.authenticate(authUsernamePassword); err != nil { + t.Error("authenticate(Success) failed:", err) + } + if msg := c.readHex(); msg != "0100" { + t.Error("authenticate(Success) invalid response:", msg) + } + v, ok := req.Args.Get("key") + if v != "value" || !ok { + t.Error("RFC1929 k,v parse failure:", v) + } +} + +// TestRequestInvalidHdr tests SOCKS5 requests with invalid VER/CMD/RSV/ATYPE +func TestRequestInvalidHdr(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + + // VER = 03, CMD = 01, RSV = 00, ATYPE = 01, DST.ADDR = 127.0.0.1, DST.PORT = 9050 + c.writeHex("030100017f000001235a") + if err := req.readCommand(); err == nil { + t.Error("readCommand(InvalidVer) succeded") + } + if msg := c.readHex(); msg != "05010001000000000000" { + t.Error("readCommand(InvalidVer) invalid response:", msg) + } + c.reset(req) + + // VER = 05, CMD = 05, RSV = 00, ATYPE = 01, DST.ADDR = 127.0.0.1, DST.PORT = 9050 + c.writeHex("050500017f000001235a") + if err := req.readCommand(); err == nil { + t.Error("readCommand(InvalidCmd) succeded") + } + if msg := c.readHex(); msg != "05070001000000000000" { + t.Error("readCommand(InvalidCmd) invalid response:", msg) + } + c.reset(req) + + // VER = 05, CMD = 01, RSV = 30, ATYPE = 01, DST.ADDR = 127.0.0.1, DST.PORT = 9050 + c.writeHex("050130017f000001235a") + if err := req.readCommand(); err == nil { + t.Error("readCommand(InvalidRsv) succeded") + } + if msg := c.readHex(); msg != "05010001000000000000" { + t.Error("readCommand(InvalidRsv) invalid response:", msg) + } + c.reset(req) + + // VER = 05, CMD = 01, RSV = 01, ATYPE = 05, DST.ADDR = 127.0.0.1, DST.PORT = 9050 + c.writeHex("050100057f000001235a") + if err := req.readCommand(); err == nil { + t.Error("readCommand(InvalidAtype) succeded") + } + if msg := c.readHex(); msg != "05080001000000000000" { + t.Error("readCommand(InvalidAtype) invalid response:", msg) + } + c.reset(req) +} + +// TestRequestIPv4 tests IPv4 SOCKS5 requests. +func TestRequestIPv4(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + + // VER = 05, CMD = 01, RSV = 00, ATYPE = 01, DST.ADDR = 127.0.0.1, DST.PORT = 9050 + c.writeHex("050100017f000001235a") + if err := req.readCommand(); err != nil { + t.Error("readCommand(IPv4) failed:", err) + } + addr, err := net.ResolveTCPAddr("tcp", req.Target) + if err != nil { + t.Error("net.ResolveTCPAddr failed:", err) + } + if !tcpAddrsEqual(addr, &net.TCPAddr{IP: net.ParseIP("127.0.0.1"), Port: 9050}) { + t.Error("Unexpected target:", addr) + } +} + +// TestRequestIPv6 tests IPv4 SOCKS5 requests. +func TestRequestIPv6(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + + // VER = 05, CMD = 01, RSV = 00, ATYPE = 04, DST.ADDR = 0102:0304:0506:0708:090a:0b0c:0d0e:0f10, DST.PORT = 9050 + c.writeHex("050100040102030405060708090a0b0c0d0e0f10235a") + if err := req.readCommand(); err != nil { + t.Error("readCommand(IPv6) failed:", err) + } + addr, err := net.ResolveTCPAddr("tcp", req.Target) + if err != nil { + t.Error("net.ResolveTCPAddr failed:", err) + } + if !tcpAddrsEqual(addr, &net.TCPAddr{IP: net.ParseIP("0102:0304:0506:0708:090a:0b0c:0d0e:0f10"), Port: 9050}) { + t.Error("Unexpected target:", addr) + } +} + +// TestRequestFQDN tests FQDN (DOMAINNAME) SOCKS5 requests. +func TestRequestFQDN(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + + // VER = 05, CMD = 01, RSV = 00, ATYPE = 04, DST.ADDR = example.com, DST.PORT = 9050 + c.writeHex("050100030b6578616d706c652e636f6d235a") + if err := req.readCommand(); err != nil { + t.Error("readCommand(FQDN) failed:", err) + } + if req.Target != "example.com:9050" { + t.Error("Unexpected target:", req.Target) + } +} + +// TestResponseNil tests nil address SOCKS5 responses. +func TestResponseNil(t *testing.T) { + c := new(testReadWriter) + req := c.toRequest() + + if err := req.Reply(ReplySucceeded); err != nil { + t.Error("Reply(ReplySucceeded) failed:", err) + } + if msg := c.readHex(); msg != "05000001000000000000" { + t.Error("Reply(ReplySucceeded) invalid response:", msg) + } +} + +var _ io.ReadWriter = (*testReadWriter)(nil) diff --git a/obfs4proxy/obfs4proxy.go b/obfs4proxy/obfs4proxy.go index 608dd55..33fbce7 100644 --- a/obfs4proxy/obfs4proxy.go +++ b/obfs4proxy/obfs4proxy.go @@ -45,6 +45,7 @@ import ( "git.torproject.org/pluggable-transports/goptlib.git" "git.torproject.org/pluggable-transports/obfs4.git/common/log" + "git.torproject.org/pluggable-transports/obfs4.git/common/socks5" "git.torproject.org/pluggable-transports/obfs4.git/transports" "git.torproject.org/pluggable-transports/obfs4.git/transports/base" ) @@ -58,10 +59,6 @@ const ( var stateDir string var termMon *termMonitor -// DialFn is a function pointer to a function that matches the net.Dialer.Dial -// interface. -type DialFn func(string, string) (net.Conn, error) - func clientSetup() (launched bool, listeners []net.Listener) { ptClientInfo, err := pt.ClientSetup(transports.Transports()) if err != nil { @@ -89,14 +86,14 @@ func clientSetup() (launched bool, listeners []net.Listener) { continue } - ln, err := pt.ListenSocks("tcp", socksAddr) + ln, err := net.Listen("tcp", socksAddr) if err != nil { pt.CmethodError(name, err.Error()) continue } go clientAcceptLoop(f, ln, ptClientProxy) - pt.Cmethod(name, ln.Version(), ln.Addr()) + pt.Cmethod(name, socks5.Version(), ln.Addr()) log.Infof("%s - registered listener: %s", name, ln.Addr()) @@ -108,10 +105,10 @@ func clientSetup() (launched bool, listeners []net.Listener) { return } -func clientAcceptLoop(f base.ClientFactory, ln *pt.SocksListener, proxyURI *url.URL) error { +func clientAcceptLoop(f base.ClientFactory, ln net.Listener, proxyURI *url.URL) error { defer ln.Close() for { - conn, err := ln.AcceptSocks() + conn, err := ln.Accept() if err != nil { if e, ok := err.(net.Error); ok && !e.Temporary() { return err @@ -122,42 +119,46 @@ func clientAcceptLoop(f base.ClientFactory, ln *pt.SocksListener, proxyURI *url. } } -func clientHandler(f base.ClientFactory, conn *pt.SocksConn, proxyURI *url.URL) { +func clientHandler(f base.ClientFactory, conn net.Conn, proxyURI *url.URL) { defer conn.Close() termMon.onHandlerStart() defer termMon.onHandlerFinish() name := f.Transport().Name() - addrStr := log.ElideAddr(conn.Req.Target) - log.Infof("%s(%s) - new connection", name, addrStr) + + // Read the client's SOCKS handshake. + socksReq, err := socks5.Handshake(conn) + if err != nil { + log.Errorf("%s - client failed socks handshake: %s", name, err) + return + } + addrStr := log.ElideAddr(socksReq.Target) // Deal with arguments. - args, err := f.ParseArgs(&conn.Req.Args) + args, err := f.ParseArgs(&socksReq.Args) if err != nil { log.Errorf("%s(%s) - invalid arguments: %s", name, addrStr, err) - conn.Reject() + socksReq.Reply(socks5.ReplyGeneralFailure) return } // Obtain the proxy dialer if any, and create the outgoing TCP connection. - var dialFn DialFn - if proxyURI == nil { - dialFn = proxy.Direct.Dial - } else { - // This is unlikely to happen as the proxy protocol is verified during - // the configuration phase. + dialFn := proxy.Direct.Dial + if proxyURI != nil { dialer, err := proxy.FromURL(proxyURI, proxy.Direct) if err != nil { + // This should basically never happen, since config protocol + // verifies this. log.Errorf("%s(%s) - failed to obtain proxy dialer: %s", name, addrStr, log.ElideError(err)) - conn.Reject() + socksReq.Reply(socks5.ReplyGeneralFailure) return } dialFn = dialer.Dial } - remoteConn, err := dialFn("tcp", conn.Req.Target) // XXX: Allow UDP? + remoteConn, err := dialFn("tcp", socksReq.Target) // XXX: Allow UDP? if err != nil { log.Errorf("%s(%s) - outgoing connection failed: %s", name, addrStr, log.ElideError(err)) - conn.Reject() + socksReq.Reply(socks5.ErrorToReplyCode(err)) return } defer remoteConn.Close() @@ -167,12 +168,12 @@ func clientHandler(f base.ClientFactory, conn *pt.SocksConn, proxyURI *url.URL) remote, err := f.WrapConn(remoteConn, args) if err != nil { log.Errorf("%s(%s) - handshake failed: %s", name, addrStr, log.ElideError(err)) - conn.Reject() + socksReq.Reply(socks5.ReplyGeneralFailure) return } - err = conn.Grant(remoteConn.RemoteAddr().(*net.TCPAddr)) + err = socksReq.Reply(socks5.ReplySucceeded) if err != nil { - log.Errorf("%s(%s) - SOCKS grant failed: %s", name, addrStr, log.ElideError(err)) + log.Errorf("%s(%s) - SOCKS reply failed: %s", name, addrStr, log.ElideError(err)) return }

1 0

[tor-launcher/master] Bug 13576: Tor Launcher strips "bridge" from the middle of bridge lines
by gk＠torproject.org 15 Apr '15

15 Apr '15

commit 78f505c2139341e71538e77a975f7df9f81189d0 Author: Kathy Brade <brade(a)pearlcrescent.com> Date: Thu Mar 26 14:42:20 2015 -0400 Bug 13576: Tor Launcher strips "bridge" from the middle of bridge lines Change the code that strips "bridge" to work on a line-by-line basis. Do not add a "bridge " prefix when displaying bridge configuration lines. To reduce user confusion, turn off word wrap for the custom bridge textbox. Improve alignment within bridge settings UI. Windows: Increase width of Tor Network Settings wizard slightly so it is more likely that a bridge line with a fingerprint will fit. Mac OS: Use a slightly smaller font within the custom bridge textbox. --- src/chrome/content/network-settings-overlay.xul | 5 ++--- src/chrome/content/network-settings.js | 13 +++++-------- src/chrome/skin/network-settings.css | 10 ++++++++-- 3 files changed, 15 insertions(+), 13 deletions(-) diff --git a/src/chrome/content/network-settings-overlay.xul b/src/chrome/content/network-settings-overlay.xul index 03171ec..af9ddf9 100644 --- a/src/chrome/content/network-settings-overlay.xul +++ b/src/chrome/content/network-settings-overlay.xul @@ -79,8 +79,7 @@ oncommand="onBridgeTypeRadioChange()"> <radio id="bridgeRadioDefault" label="&torsettings.useBridges.default;" selected="true" /> - <hbox align="baseline" style="margin-top: -5px"> - <spacer style="width: 1.9em" /> + <hbox id="bridgeDefaultEntry" align="baseline" style="margin-top: -5px"> <label id="defaultBridgeTypeLabel" value="&torsettings.useBridges.type;" control="defaultBridgeType"/> @@ -99,7 +98,7 @@ <vbox id="bridgeCustomEntry"> <label id="bridgeListLabel" style="margin-top:0px;" value="&torsettings.useBridges.label;" control="bridgeList"/> - <textbox id="bridgeList" multiline="true" rows="3" + <textbox id="bridgeList" multiline="true" rows="3" wrap="off" oninput="onCustomBridgesTextInput();" placeholder="&torsettings.useBridges.placeholder;" /> </vbox> diff --git a/src/chrome/content/network-settings.js b/src/chrome/content/network-settings.js index 3277553..e4ebeaa 100644 --- a/src/chrome/content/network-settings.js +++ b/src/chrome/content/network-settings.js @@ -69,6 +69,8 @@ function initDialog() var isWindows = TorLauncherUtil.isWindows; if (isWindows) document.documentElement.setAttribute("class", "os-windows"); + else if (TorLauncherUtil.isMac) + document.documentElement.setAttribute("class", "os-mac"); var forAssistance = document.getElementById("forAssistance"); if (forAssistance) @@ -1305,7 +1307,6 @@ function parseAndValidateBridges(aStr) return null; var resultStr = aStr; - resultStr = resultStr.replace(/bridge/gi, ""); // Remove "bridge" everywhere. resultStr = resultStr.replace(/\r\n/g, "\n"); // Convert \r\n pairs into \n. resultStr = resultStr.replace(/\r/g, "\n"); // Convert \r into \n. resultStr = resultStr.replace(/\n\n/g, "\n"); // Condense blank lines. @@ -1314,7 +1315,8 @@ function parseAndValidateBridges(aStr) var tmpArray = resultStr.split('\n'); for (var i = 0; i < tmpArray.length; i++) { - let s = tmpArray[i].trim(); // Remove extraneous whitespace. + let s = tmpArray[i].trim(); // Remove extraneous white space. + s = s.replace(/^bridge\s+/i, ""); // Remove "bridge " from start of line. resultArray.push(s); } @@ -1397,8 +1399,7 @@ function setElemValue(aID, aValue) // Returns true if one or more values were set. function setBridgeListElemValue(aBridgeArray) { - // To be consistent with bridges.torproject.org, pre-pend "bridge" to - // each line as it is displayed in the UI. + // Trim white space and only keep non-empty values. var bridgeList = []; if (aBridgeArray) { @@ -1406,11 +1407,7 @@ function setBridgeListElemValue(aBridgeArray) { var s = aBridgeArray[i].trim(); if (s.length > 0) - { - if (s.toLowerCase().indexOf("bridge") != 0) - s = "bridge " + s; bridgeList.push(s); - } } } diff --git a/src/chrome/skin/network-settings.css b/src/chrome/skin/network-settings.css index 331ae42..646baa6 100644 --- a/src/chrome/skin/network-settings.css +++ b/src/chrome/skin/network-settings.css @@ -24,7 +24,7 @@ wizard { } wizard.os-windows { - width: 46em; + width: 49em; height: 41em; } @@ -99,8 +99,14 @@ wizard[tor_hide_browser_logo="true"] .tbb-logo-separator { display: none; } +#bridgeDefaultEntry, #bridgeCustomEntry { - margin-left: 30px; + margin-left: 1.8em; +} + +dialog.os-mac #bridgeList, +wizard.os-mac #bridgeList { + font-size: 90%; } wizardpage[pageid="startingTor"] description,

1 0

[tor-launcher/master] Merge branch 'bug13576-01'
by gk＠torproject.org 15 Apr '15

15 Apr '15

commit a37371ac9a866612e91a791251104184caad41ca Merge: b48d563 78f505c Author: Georg Koppen <gk(a)torproject.org> Date: Wed Apr 15 20:01:36 2015 +0000 Merge branch 'bug13576-01' src/chrome/content/network-settings-overlay.xul | 5 ++--- src/chrome/content/network-settings.js | 13 +++++-------- src/chrome/skin/network-settings.css | 10 ++++++++-- 3 files changed, 15 insertions(+), 13 deletions(-)

1 0

[translation/tor_animation_completed] Update translations for tor_animation_completed
by translation＠torproject.org 15 Apr '15

15 Apr '15

commit 102973ff9d175cada930280f5ba0ef8fd4129cd5 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Apr 15 19:46:01 2015 +0000 Update translations for tor_animation_completed --- id.srt | 164 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 164 insertions(+) diff --git a/id.srt b/id.srt new file mode 100644 index 0000000..28d02b0 --- /dev/null +++ b/id.srt @@ -0,0 +1,164 @@ +1 +00:00:00,660 --> 00:00:02,780 +Kita sudah terbiasa dengan internet + +2 +00:00:03,120 --> 00:00:07,700 +Kita selalu membagi informasi +mengenai kita dan kehidupan pribadi kita: + +3 +00:00:08,000 --> 00:00:09,960 +makanan yg kita makan, orang2 yang kita temui, + +4 +00:00:10,180 --> 00:00:12,480 +tempat kita berada, dan sesuatu yang kita baca. + +5 +00:00:13,280 --> 00:00:14,640 +Akan saya jelaskan lebih lanjut. + +6 +00:00:14,920 --> 00:00:17,740 +Pada saat ini, +jika seseorang mencoba untuk mencari anda, + +7 +00:00:18,060 --> 00:00:22,480 +mereka akan melihat identitas asli anda, +lokasi, system operasi, + +8 +00:00:22,800 --> 00:00:26,500 +semua halaman web yang sudah anda kunjungi, +applikasi yang anda pakai untuk menjelajahi internet, + +9 +00:00:26,700 --> 00:00:29,140 +dan begitu banyak informasi +mengenai anda dan hidup anda + +10 +00:00:29,620 --> 00:00:32,460 +yang mungkin anda tidak bermaksud +untuk dibagi ke orang asing, + +11 +00:00:32,920 --> 00:00:35,840 +yang bisa dengan mudah menggunakan data2 itu +untuk memanfaatkan anda + +12 +00:00:36,220 --> 00:00:38,120 +Tapi tidak bila anda menggunakan Tor! + +13 +00:00:39,140 --> 00:00:42,840 +Tor Browser melindungi rahasia +dan identitas kita di internet. + +14 +00:00:43,560 --> 00:00:46,760 +Tor mengamankan koneksi anda +dengan 3 lapis pengamanan + +15 +00:00:46,940 --> 00:00:51,760 +dan melewatkannya melalui 3 +server yang beroperasi bebas di seluruh dunia + +16 +00:00:52,280 --> 00:00:55,520 +yang mana membantu kita untuk berkomunikasi +tanpa menunjukkan identitas kita di internet. + +17 +00:00:58,560 --> 00:01:00,280 +Tor juga melindungi data kita + +18 +00:01:00,400 --> 00:01:03,900 +dari intaian perusahaan besar atau pemerintah +dan pengawasan massa. + +19 +00:01:04,880 --> 00:01:09,340 +Mungkin anda hidup di negara yg terkekang +yg mencoba untuk mengontrol dan mengawasi internet. + +20 +00:01:09,900 --> 00:01:13,800 +Atau mungkin anda tidak menginginkan perusahaan besar +mengambil keuntungan dari informasi pribadi anda. + +21 +00:01:14,880 --> 00:01:17,640 +Tor membuat semua penggunanya +terlihat sama + +22 +00:01:17,920 --> 00:01:20,800 +yang akan membuat bingung pengawas +and membuat anda tidak terlihat. + +23 +00:01:21,500 --> 00:01:24,980 +Jadi, lebih banyak orang yg memakai jaringan Tor, +akan membuat jaringannya lebih kuat + +24 +00:01:25,140 --> 00:01:29,800 +dan akan membuat lebih mudah untuk bersembunyi di kerumunan +pengguna yang tampak sama persis. + +25 +00:01:30,700 --> 00:01:33,240 +Anda dapat melewati sensor +tanpa harus kuatir mengenai + +26 +00:01:33,400 --> 00:01:36,100 +sensornya akan mengetahui apa yang anda lakukan +di internet. + +27 +00:01:38,540 --> 00:01:41,440 +Iklan-iklannya tidak akan mengikuti anda +kemana-mana selama berbulan-bulan, + +28 +00:01:41,640 --> 00:01:43,300 +mulai dari pertama anda +menekan gambar suatu barang. + +29 +00:01:45,880 --> 00:01:49,380 +Dengan menggunakan Tor, situs-situs yang anda kunjungi +tidak akan tahu mengenai anda, + +30 +00:01:49,540 --> 00:01:51,760 +dari bagian dunia mana anda mengunjungi situs mereka. + +31 +00:01:51,920 --> 00:01:53,920 +kecuali anda memasukkan user dan password anda. + +32 +00:01:56,200 --> 00:01:57,840 +Dengan mengunduh dan menggunakan Tor, + +33 +00:01:58,200 --> 00:02:00,560 +anda dapat melindungi orang-orang +yang memerlukan privasi, + +34 +00:02:00,880 --> 00:02:03,640 +seperti aktivists, journalists dan blogger. + +35 +00:02:04,000 --> 00:02:09,000 +Unduh dan gunakan Tor! Atau gunakan relay! +

1 0

[translation/tor_animation] Update translations for tor_animation
by translation＠torproject.org 15 Apr '15

15 Apr '15

commit ac598de11234d40a3aa3d39e650b3774cc1dc093 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Apr 15 19:45:58 2015 +0000 Update translations for tor_animation --- id.srt | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/id.srt b/id.srt index 03dde19..28d02b0 100644 --- a/id.srt +++ b/id.srt @@ -124,42 +124,41 @@ di internet. 27 00:01:38,540 --> 00:01:41,440 -The ads won't follow you -everywhere for months, +Iklan-iklannya tidak akan mengikuti anda +kemana-mana selama berbulan-bulan, 28 00:01:41,640 --> 00:01:43,300 -starting when you first -clicked on a product. +mulai dari pertama anda +menekan gambar suatu barang. 29 00:01:45,880 --> 00:01:49,380 -By using Tor, the sites you visit -won't even know who you are, +Dengan menggunakan Tor, situs-situs yang anda kunjungi +tidak akan tahu mengenai anda, 30 00:01:49,540 --> 00:01:51,760 -from what part of the world -you're visiting them, +dari bagian dunia mana anda mengunjungi situs mereka. 31 00:01:51,920 --> 00:01:53,920 -unless you login and tell them so. +kecuali anda memasukkan user dan password anda. 32 00:01:56,200 --> 00:01:57,840 -By downloading and using Tor, +Dengan mengunduh dan menggunakan Tor, 33 00:01:58,200 --> 00:02:00,560 -you can protect the people -who need anonymity, +anda dapat melindungi orang-orang +yang memerlukan privasi, 34 00:02:00,880 --> 00:02:03,640 -like activists, journalists and bloggers. +seperti aktivists, journalists dan blogger. 35 00:02:04,000 --> 00:02:09,000 -Download and use Tor! Or run a relay! +Unduh dan gunakan Tor! Atau gunakan relay!

1 0

[translation/tor-launcher-network-settings] Update translations for tor-launcher-network-settings
by translation＠torproject.org 15 Apr '15

15 Apr '15

commit c366416819657709a55181d559b54b7edb1f0c1f Author: Translation commit bot <translation(a)torproject.org> Date: Wed Apr 15 19:45:33 2015 +0000 Update translations for tor-launcher-network-settings --- id/network-settings.dtd | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/id/network-settings.dtd b/id/network-settings.dtd index 428626b..2033052 100644 --- a/id/network-settings.dtd +++ b/id/network-settings.dtd @@ -30,7 +30,7 @@ <!ENTITY torsettings.optional "Opsional"> -<!ENTITY torsettings.useProxy.checkbox "This computer needs to use a local proxy to access the Internet"> +<!ENTITY torsettings.useProxy.checkbox "Komputer ini perlu menggunakan proxy lokal untuk mengakses internet"> <!ENTITY torsettings.useProxy.type "Tipe Proxy:"> <!ENTITY torsettings.useProxy.address "Alamat:"> <!ENTITY torsettings.useProxy.address.placeholder "alamat IP atau nama host"> @@ -54,9 +54,9 @@ <!ENTITY torsettings.bridgeHelp1 "Jika Anda tidak dapat terhubung ke jaringan Tor, bisa jadi Provider Layanan Internet (ISP) atau lembaga lain yang menghalangi Tor.   Sering kali, Anda dapat mengatasi masalah ini dengan menggunakan Tor Bridges, yang relai terdaftar yang lebih sulit untuk memblokir."> <!ENTITY torsettings.bridgeHelp1B "Anda dapat menggunakan prekonfigurasi, disediakan alamat set bridge atau Anda mungkin mendapatkan satu set kebiasaan alamat dengan menggunakan salah satu dari tiga metode ini:"> <!ENTITY torsettings.bridgeHelp2Heading "Lewat web"> -<!ENTITY torsettings.bridgeHelp2 "Use a web browser to visit https://bridges.torproject.org"> -<!ENTITY torsettings.bridgeHelp3Heading "Through the Email Autoresponder"> +<!ENTITY torsettings.bridgeHelp2 "Menggunakan applikasi penjelajah interet untuk mengunjungi https://bridges.torproject.org"> +<!ENTITY torsettings.bridgeHelp3Heading "Melalui Email Autoresponder"> <!ENTITY torsettings.bridgeHelp3.emailDesc "Send email to bridges(a)torproject.org with the line 'get bridges' by itself in the body of the message.  However, to make it harder for an attacker to learn a lot of bridge addresses, you must send this request from one of the following email providers (listed in order of preference):"> <!ENTITY torsettings.bridgeHelp3.emailList "https://www.riseup.net, https://mail.google.com, atau https://mail.yahoo.com"> -<!ENTITY torsettings.bridgeHelp4Heading "Through the Help Desk"> +<!ENTITY torsettings.bridgeHelp4Heading "Melalui Help Desk"> <!ENTITY torsettings.bridgeHelp4 "As a last resort, you can request bridge addresses by sending a polite email message to help(a)rt.torproject.org.  Please note that a person will need to respond to each request.">

1 0

[translation/tor_animation] Update translations for tor_animation
by translation＠torproject.org 15 Apr '15

15 Apr '15

commit 85dba5fa12f16ebee63b230eee316b4db8a93fd5 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Apr 15 19:15:55 2015 +0000 Update translations for tor_animation --- id.srt | 92 ++++++++++++++++++++++++++++++++-------------------------------- 1 file changed, 46 insertions(+), 46 deletions(-) diff --git a/id.srt b/id.srt index 78c998d..03dde19 100644 --- a/id.srt +++ b/id.srt @@ -1,126 +1,126 @@ 1 00:00:00,660 --> 00:00:02,780 -We've gotten very used to the Internet. +Kita sudah terbiasa dengan internet 2 00:00:03,120 --> 00:00:07,700 -We are constantly sharing information -about ourselves and our private lives: +Kita selalu membagi informasi +mengenai kita dan kehidupan pribadi kita: 3 00:00:08,000 --> 00:00:09,960 -food we eat, people we meet, +makanan yg kita makan, orang2 yang kita temui, 4 00:00:10,180 --> 00:00:12,480 -places we go, and the stuff we read. +tempat kita berada, dan sesuatu yang kita baca. 5 00:00:13,280 --> 00:00:14,640 -Let me explain it better. +Akan saya jelaskan lebih lanjut. 6 00:00:14,920 --> 00:00:17,740 -Right at this moment, -if someone attempts to look you up, +Pada saat ini, +jika seseorang mencoba untuk mencari anda, 7 00:00:18,060 --> 00:00:22,480 -they'll see your real identity, -precise location, operating system, +mereka akan melihat identitas asli anda, +lokasi, system operasi, 8 00:00:22,800 --> 00:00:26,500 -all the sites you've visited, -the browser you use to surf the web, +semua halaman web yang sudah anda kunjungi, +applikasi yang anda pakai untuk menjelajahi internet, 9 00:00:26,700 --> 00:00:29,140 -and so much more information -about you and your life +dan begitu banyak informasi +mengenai anda dan hidup anda 10 00:00:29,620 --> 00:00:32,460 -which you probably didn't mean -to share with unknown strangers, +yang mungkin anda tidak bermaksud +untuk dibagi ke orang asing, 11 00:00:32,920 --> 00:00:35,840 -who could easily use this data -to exploit you. +yang bisa dengan mudah menggunakan data2 itu +untuk memanfaatkan anda 12 00:00:36,220 --> 00:00:38,120 -But not if you're using Tor! +Tapi tidak bila anda menggunakan Tor! 13 00:00:39,140 --> 00:00:42,840 -Tor Browser protects our privacy -and identity on the Internet. +Tor Browser melindungi rahasia +dan identitas kita di internet. 14 00:00:43,560 --> 00:00:46,760 -Tor secures your connection -with three layers of encryption +Tor mengamankan koneksi anda +dengan 3 lapis pengamanan 15 00:00:46,940 --> 00:00:51,760 -and passes it through three voluntarily -operated servers around the world, +dan melewatkannya melalui 3 +server yang beroperasi bebas di seluruh dunia 16 00:00:52,280 --> 00:00:55,520 -which enables us to communicate -anonymously over the Internet. +yang mana membantu kita untuk berkomunikasi +tanpa menunjukkan identitas kita di internet. 17 00:00:58,560 --> 00:01:00,280 -Tor also protects our data +Tor juga melindungi data kita 18 00:01:00,400 --> 00:01:03,900 -against corporate or government targeted -and mass surveillance. +dari intaian perusahaan besar atau pemerintah +dan pengawasan massa. 19 00:01:04,880 --> 00:01:09,340 -Perhaps you live in a repressive country -which tries to control and surveil the Internet. +Mungkin anda hidup di negara yg terkekang +yg mencoba untuk mengontrol dan mengawasi internet. 20 00:01:09,900 --> 00:01:13,800 -Or perhaps you don't want big corporations -taking advantage of your personal information. +Atau mungkin anda tidak menginginkan perusahaan besar +mengambil keuntungan dari informasi pribadi anda. 21 00:01:14,880 --> 00:01:17,640 -Tor makes all of its users -to look the same +Tor membuat semua penggunanya +terlihat sama 22 00:01:17,920 --> 00:01:20,800 -which confuses the observer -and makes you anonymous. +yang akan membuat bingung pengawas +and membuat anda tidak terlihat. 23 00:01:21,500 --> 00:01:24,980 -So, the more people use the Tor network, -the stronger it gets +Jadi, lebih banyak orang yg memakai jaringan Tor, +akan membuat jaringannya lebih kuat 24 00:01:25,140 --> 00:01:29,800 -as it's easier to hide in a crowd -of people who look exactly the same. +dan akan membuat lebih mudah untuk bersembunyi di kerumunan +pengguna yang tampak sama persis. 25 00:01:30,700 --> 00:01:33,240 -You can bypass the censorship -without being worried about +Anda dapat melewati sensor +tanpa harus kuatir mengenai 26 00:01:33,400 --> 00:01:36,100 -the censor knowing what you do -on the Internet. +sensornya akan mengetahui apa yang anda lakukan +di internet. 27 00:01:38,540 --> 00:01:41,440

1 0

[ooni-probe/master] Merge pull request #380 from infinity0/master
by art＠torproject.org 15 Apr '15

15 Apr '15

commit 4f8f1b154eba975636b47329179c79ed8370ceed Merge: 4fe2884 7b01492 Author: Arturo Filastò <arturo(a)filasto.net> Date: Fri Apr 3 15:28:59 2015 +0200 Merge pull request #380 from infinity0/master 13602: build a binary of bin/ooniprobe that we can setcap on to avoid running as root bin/Makefile | 81 +++++++++++++++++++++++++++++++++++++++++++++ bin/test/ooni/__init__.py | 1 + 2 files changed, 82 insertions(+)

1 0

[ooni-probe/master] 13602: build a binary of bin/ooniprobe that we can setcap on to avoid running as root
by art＠torproject.org 15 Apr '15

15 Apr '15

commit 7b01492e082550a0917bb9141601fdfdd41fd79f Author: Ximin Luo <infinity0(a)pwned.gg> Date: Sun Mar 1 14:54:09 2015 +0100 13602: build a binary of bin/ooniprobe that we can setcap on to avoid running as root --- bin/Makefile | 81 +++++++++++++++++++++++++++++++++++++++++++++ bin/test/ooni/__init__.py | 1 + 2 files changed, 82 insertions(+) diff --git a/bin/Makefile b/bin/Makefile new file mode 100644 index 0000000..bc80843 --- /dev/null +++ b/bin/Makefile @@ -0,0 +1,81 @@ +# Wrappers for running ooniprobe as a non-root user. +# +# Build-Depends: cython, pythonX.Y-dev, libcap2-bin +# Depends: libpythonX.Y +# +# $ make && make check +# $ sudo make install # after installing the rest of ooni-probe +# $ make installcheck_unsafe # runs complete tests as non-root +# +# `make` builds a program that has file capabilities set on it. This is just +# ./ooniprobe compiled into a C program using Cython, so that one can set +# capabilities directly on the resulting binary. This way, we avoid the need +# for a separate child python interpreter with its own capabilities. Another +# advantage is that libpython.so (needed by the program) would be automatically +# upgraded by the system package manager. The version of python is hard-coded +# into the wrapper at build time; making this dynamic is possible, but much +# more complex and not yet implemented. +# +# Execution may additionally be limited to a particular unix group by using +# chgrp(1) and chmod(1) to 'o-x,g+x' after installation. +# + +# GNU Makefile conventions, see https://www.gnu.org/prep/standards/html_node/Makefile-Conventions.html +prefix = /usr/local +exec_prefix = $(prefix) +bindir = $(exec_prefix)/bin + +INSTALL = install +PYTHON = python +PYTHON_CONFIG = python-config +CYTHON = cython +SETCAP = setcap + +INSTALL_PROGRAM = $(INSTALL) +PY_CFLAGS = $(shell $(PYTHON_CONFIG) --cflags) +PY_LDFLAGS = $(shell $(PYTHON_CONFIG) --ldflags) + +BUILDDIR := ./build +SCRIPTDIR := . +TESTDIR := ./test +CAP_SCRIPT := ooniprobe +CAP_NEEDED := cap_net_admin,cap_net_raw + +# Unfortunately cython --embed ignores the arguments in the shebang line +# So we need to patch the generated code ourselves. +CYTHON_PRE_MAIN = extern int Py_IgnoreEnvironmentFlag; \ + Py_IgnoreEnvironmentFlag++; \ + extern int Py_NoUserSiteDirectory; \ + Py_NoUserSiteDirectory++; + +all: $(BUILDDIR)/$(CAP_SCRIPT) + +$(BUILDDIR)/$(CAP_SCRIPT): $(BUILDDIR)/$(CAP_SCRIPT).c Makefile + $(CC) $(PY_CFLAGS) $(PY_LDFLAGS) "$<" -o "$@" + +$(BUILDDIR)/$(CAP_SCRIPT).c: $(SCRIPTDIR)/$(CAP_SCRIPT) Makefile + mkdir -p "$(BUILDDIR)" + $(CYTHON) "$<" --embed=CYTHON_MAIN_SENTINEL -Werror -Wextra -o "$@" + sed -i \ + -e 's/$.*CYTHON_MAIN_SENTINEL.*{$/\1 $(CYTHON_PRE_MAIN)/g' \ + -e '/CYTHON_MAIN_SENTINEL[^{]*$$/,/{/s/{/{ $(CYTHON_PRE_MAIN)/g' \ + -e 's/CYTHON_MAIN_SENTINEL/main/g' "$@" + +check: $(BUILDDIR)/$(CAP_SCRIPT) + # test that setcapped binary ignores PYTHONPATH + BIN="$$(realpath "$<")" && cd "$(TESTDIR)" && PYTHONPATH=. $$BIN --version + +install: $(BUILDDIR)/$(CAP_SCRIPT) + mkdir -p "$(DESTDIR)$(bindir)" + $(INSTALL_PROGRAM) -t "$(DESTDIR)$(bindir)" "$(BUILDDIR)/$(CAP_SCRIPT)" + $(SETCAP) "$(CAP_NEEDED)"+eip "$(DESTDIR)$(bindir)/$(CAP_SCRIPT)" + +installcheck_unsafe: $(BUILDDIR)/$(CAP_SCRIPT) + # run a standard check. note that because of hardcoded paths (for security) + # this can only work after you've installed your development copy + "./$<" -i /usr/share/ooni/decks/complete.deck + +clean: + rm -rf "$(BUILDDIR)" + +.PHONY: clean all check install installcheck% diff --git a/bin/test/ooni/__init__.py b/bin/test/ooni/__init__.py new file mode 100644 index 0000000..f2cd353 --- /dev/null +++ b/bin/test/ooni/__init__.py @@ -0,0 +1 @@ +raise ValueError("test failed! wrapper did not ignore polluted PWD. either the wrapper is faulty, or ooni is still unpatched (Tor bug #13581)")

1 0