June 2015 - tor-commits - lists.torproject.org

[torflow/master] Demote loglevel back down to notice.
by mikeperry＠torproject.org 01 Jun '15

01 Jun '15

commit dc969644beb2495288fdcb7a7f0ff6d71f11d380 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Mon Jun 1 13:29:00 2015 -0700 Demote loglevel back down to notice. Also fix issues with logging system usage and upgrade some messages. --- NetworkScanners/BwAuthority/aggregate.py | 7 +++---- NetworkScanners/BwAuthority/bwauthority.py | 16 +++++++++------- NetworkScanners/BwAuthority/bwauthority_child.py | 10 +++++----- .../BwAuthority/data/scanner.1/bwauthority.cfg | 2 +- .../BwAuthority/data/scanner.2/bwauthority.cfg | 2 +- .../BwAuthority/data/scanner.3/bwauthority.cfg | 2 +- .../BwAuthority/data/scanner.4/bwauthority.cfg | 2 +- .../BwAuthority/data/scanner.5/bwauthority.cfg | 2 +- .../BwAuthority/data/scanner.6/bwauthority.cfg | 2 +- .../BwAuthority/data/scanner.7/bwauthority.cfg | 2 +- .../BwAuthority/data/scanner.8/bwauthority.cfg | 2 +- .../BwAuthority/data/scanner.9/bwauthority.cfg | 2 +- 12 files changed, 26 insertions(+), 25 deletions(-) diff --git a/NetworkScanners/BwAuthority/aggregate.py b/NetworkScanners/BwAuthority/aggregate.py index 6d35dba..01ea8b5 100755 --- a/NetworkScanners/BwAuthority/aggregate.py +++ b/NetworkScanners/BwAuthority/aggregate.py @@ -362,13 +362,12 @@ def write_file_list(datadir): def main(argv): TorUtil.read_config(argv[1]+"/scanner.1/bwauthority.cfg") - TorUtil.loglevel = "DEBUG" TorUtil.logfile = "data/aggregate-debug.log" (branch, head) = TorUtil.get_git_version(PATH_TO_TORFLOW_REPO) - plog('INFO', 'TorFlow Version: %s' % branch+' '+head) + plog('NOTICE', 'TorFlow Version: %s' % branch+' '+head) (branch, head) = TorUtil.get_git_version(PATH_TO_TORCTL_REPO) - plog('INFO', 'TorCtl Version: %s' % branch+' '+head) + plog('NOTICE', 'TorCtl Version: %s' % branch+' '+head) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((TorUtil.control_host,TorUtil.control_port)) @@ -849,7 +848,7 @@ def main(argv): plog("INFO", "Avg network -pid_error="+str(sum(map(lambda n: n.pid_error, n_nodes))/len(n_nodes))) - plog("INFO", + plog("NOTICE", "Measured "+str(measured_pct) +"% of all tor nodes (" +str(measured_bw_pct)+"% of previous consensus bw).") diff --git a/NetworkScanners/BwAuthority/bwauthority.py b/NetworkScanners/BwAuthority/bwauthority.py index 6a04542..89c0d34 100755 --- a/NetworkScanners/BwAuthority/bwauthority.py +++ b/NetworkScanners/BwAuthority/bwauthority.py @@ -4,6 +4,7 @@ from sys import path from sys import exit from subprocess import Popen path.append("../../") +import TorCtl.TorUtil from TorCtl.TorUtil import plog as plog from TorCtl.TorUtil import get_git_version as get_git_version from signal import signal, SIGTERM, SIGKILL @@ -21,10 +22,11 @@ PATH_TO_TORCTL_REPO = '../../.git/modules/TorCtl/' p = None def main(argv): + TorCtl.TorUtil.read_config(argv[1]) (branch, head) = get_git_version(PATH_TO_TORFLOW_REPO) - plog('INFO', 'TorFlow Version: %s' % branch+' '+head) + plog('NOTICE', 'TorFlow Version: %s' % branch+' '+head) (branch, head) = get_git_version(PATH_TO_TORCTL_REPO) - plog('INFO', 'TorCtl Version: %s' % branch+' '+head) + plog('NOTICE', 'TorCtl Version: %s' % branch+' '+head) slice_num = 0 while True: plog('INFO', 'Beginning time loop') @@ -34,9 +36,9 @@ def main(argv): if (p.returncode == 0): slice_num += 1 elif (p.returncode == RESTART_SLICE): - plog('INFO', 'restarting slice_num '+str(slice_num)) + plog('NOTICE', 'restarting slice_num '+str(slice_num)) elif (p.returncode == STOP_PCT_REACHED): - plog('INFO', 'restarting from slice 0') + plog('NOTICE', 'restarting from slice 0') slice_num = 0 elif (abs(p.returncode) == SIGKILL): plog('WARN', 'Child process recieved SIGKILL, exiting') @@ -67,6 +69,6 @@ if __name__ == '__main__': except KeyboardInterrupt: global p p.kill() - plog('INFO', "Ctrl + C was pressed. Exiting ... ") - except Exception, e: - plog('ERROR', "An unexpected error occured.") + plog('NOTICE', "Ctrl + C was pressed. Exiting ... ") + except Exception as e: + plog('ERROR', "An unexpected error occured: "+str(e)) diff --git a/NetworkScanners/BwAuthority/bwauthority_child.py b/NetworkScanners/BwAuthority/bwauthority_child.py index a42a9b5..a36728f 100755 --- a/NetworkScanners/BwAuthority/bwauthority_child.py +++ b/NetworkScanners/BwAuthority/bwauthority_child.py @@ -221,6 +221,7 @@ class BwScanHandler(ScanSupport.SQLScanHandler): def speedrace(hdlr, start_pct, stop_pct, circs_per_node, save_every, out_dir, max_fetch_time, sleep_start_tp, sleep_stop_tp, slice_num, min_streams, sql_file, only_unmeasured): + plog("NOTICE", "Starting slice for percentiles "+str(start_pct)+"-"+str(stop_pct)) hdlr.set_pct_rstr(start_pct, stop_pct) attempt = 0 @@ -300,12 +301,12 @@ def speedrace(hdlr, start_pct, stop_pct, circs_per_node, save_every, out_dir, return successful def main(argv): - plog("DEBUG", "Child Process Spawning...") TorUtil.read_config(argv[1]) (start_pct,stop_pct,nodes_per_slice,save_every,circs_per_node,out_dir, max_fetch_time,tor_dir,sleep_start,sleep_stop, min_streams,pid_file_name,db_url,only_unmeasured, min_unmeasured) = read_config(argv[1]) + plog("NOTICE", "Child Process Spawned...") # make sure necessary out_dir directory exists path = os.getcwd()+'/'+out_dir @@ -365,10 +366,9 @@ def main(argv): # check to see if we are done if (slice_num * pct_step + start_pct > stop_pct): - plog('INFO', 'stop_pct: %s reached. Exiting with %s' % (stop_pct, STOP_PCT_REACHED)) + plog('NOTICE', 'Child stop point %s reached. Exiting with %s' % (stop_pct, STOP_PCT_REACHED)) sys.exit(STOP_PCT_REACHED) - plog("DEBUG", "Starting slice number %s" % slice_num) successful = speedrace(hdlr, slice_num*pct_step + start_pct, (slice_num + 1)*pct_step + start_pct, circs_per_node, save_every, out_dir, max_fetch_time, sleep_start, sleep_stop, slice_num, min_streams, sql_file, only_unmeasured) @@ -383,9 +383,9 @@ def main(argv): # out_dir, max_fetch_time, sleep_start, sleep_stop, slice_num, sql_file) # XXX: Hack this to return a codelen double the slice size on failure? - plog("NOTICE", "Slice success count: "+str(successful)) + plog("INFO", "Slice success count: "+str(successful)) if successful == 0: - plog("NOTICE", "Slice success count is ZERO!") + plog("WARN", "Slice success count was ZERO!") sys.exit(0) diff --git a/NetworkScanners/BwAuthority/data/scanner.1/bwauthority.cfg b/NetworkScanners/BwAuthority/data/scanner.1/bwauthority.cfg index ad9a4cd..f58a4e2 100644 --- a/NetworkScanners/BwAuthority/data/scanner.1/bwauthority.cfg +++ b/NetworkScanners/BwAuthority/data/scanner.1/bwauthority.cfg @@ -1,5 +1,5 @@ [TorCtl] -loglevel=WARN +loglevel = NOTICE tor_host = 127.0.0.1 tor_port = 9110 control_host = 127.0.0.1 diff --git a/NetworkScanners/BwAuthority/data/scanner.2/bwauthority.cfg b/NetworkScanners/BwAuthority/data/scanner.2/bwauthority.cfg index 3e94e5e..73190c9 100644 --- a/NetworkScanners/BwAuthority/data/scanner.2/bwauthority.cfg +++ b/NetworkScanners/BwAuthority/data/scanner.2/bwauthority.cfg @@ -1,5 +1,5 @@ [TorCtl] -loglevel=WARN +loglevel = NOTICE tor_host = 127.0.0.1 tor_port = 9110 control_host = 127.0.0.1 diff --git a/NetworkScanners/BwAuthority/data/scanner.3/bwauthority.cfg b/NetworkScanners/BwAuthority/data/scanner.3/bwauthority.cfg index 71c3285..9a97c50 100644 --- a/NetworkScanners/BwAuthority/data/scanner.3/bwauthority.cfg +++ b/NetworkScanners/BwAuthority/data/scanner.3/bwauthority.cfg @@ -1,5 +1,5 @@ [TorCtl] -loglevel=WARN +loglevel = NOTICE tor_host = 127.0.0.1 tor_port = 9110 control_host = 127.0.0.1 diff --git a/NetworkScanners/BwAuthority/data/scanner.4/bwauthority.cfg b/NetworkScanners/BwAuthority/data/scanner.4/bwauthority.cfg index 9a676ec..29204d6 100644 --- a/NetworkScanners/BwAuthority/data/scanner.4/bwauthority.cfg +++ b/NetworkScanners/BwAuthority/data/scanner.4/bwauthority.cfg @@ -1,5 +1,5 @@ [TorCtl] -loglevel=WARN +loglevel = NOTICE tor_host = 127.0.0.1 tor_port = 9110 control_host = 127.0.0.1 diff --git a/NetworkScanners/BwAuthority/data/scanner.5/bwauthority.cfg b/NetworkScanners/BwAuthority/data/scanner.5/bwauthority.cfg index 1acb1a2..d3e619e 100644 --- a/NetworkScanners/BwAuthority/data/scanner.5/bwauthority.cfg +++ b/NetworkScanners/BwAuthority/data/scanner.5/bwauthority.cfg @@ -1,5 +1,5 @@ [TorCtl] -loglevel=WARN +loglevel = NOTICE tor_host = 127.0.0.1 tor_port = 9120 control_host = 127.0.0.1 diff --git a/NetworkScanners/BwAuthority/data/scanner.6/bwauthority.cfg b/NetworkScanners/BwAuthority/data/scanner.6/bwauthority.cfg index 5bc3616..4851165 100755 --- a/NetworkScanners/BwAuthority/data/scanner.6/bwauthority.cfg +++ b/NetworkScanners/BwAuthority/data/scanner.6/bwauthority.cfg @@ -1,5 +1,5 @@ [TorCtl] -loglevel=WARN +loglevel = NOTICE tor_host = 127.0.0.1 tor_port = 9120 control_host = 127.0.0.1 diff --git a/NetworkScanners/BwAuthority/data/scanner.7/bwauthority.cfg b/NetworkScanners/BwAuthority/data/scanner.7/bwauthority.cfg index 2898b80..a81b0ac 100755 --- a/NetworkScanners/BwAuthority/data/scanner.7/bwauthority.cfg +++ b/NetworkScanners/BwAuthority/data/scanner.7/bwauthority.cfg @@ -1,5 +1,5 @@ [TorCtl] -loglevel=WARN +loglevel = NOTICE tor_host = 127.0.0.1 tor_port = 9120 control_host = 127.0.0.1 diff --git a/NetworkScanners/BwAuthority/data/scanner.8/bwauthority.cfg b/NetworkScanners/BwAuthority/data/scanner.8/bwauthority.cfg index 56a5cfa..25515f7 100755 --- a/NetworkScanners/BwAuthority/data/scanner.8/bwauthority.cfg +++ b/NetworkScanners/BwAuthority/data/scanner.8/bwauthority.cfg @@ -1,5 +1,5 @@ [TorCtl] -loglevel=WARN +loglevel = NOTICE tor_host = 127.0.0.1 tor_port = 9120 control_host = 127.0.0.1 diff --git a/NetworkScanners/BwAuthority/data/scanner.9/bwauthority.cfg b/NetworkScanners/BwAuthority/data/scanner.9/bwauthority.cfg index 7e49dbb..7cbbded 100644 --- a/NetworkScanners/BwAuthority/data/scanner.9/bwauthority.cfg +++ b/NetworkScanners/BwAuthority/data/scanner.9/bwauthority.cfg @@ -1,5 +1,5 @@ [TorCtl] -loglevel=WARN +loglevel = NOTICE tor_host = 127.0.0.1 tor_port = 9120 control_host = 127.0.0.1

1 0

[torflow/master] Fix README for the file server.
by mikeperry＠torproject.org 01 Jun '15

01 Jun '15

commit dd3d01fae752ff0c400ec55a700dfa11c31546d6 Author: Mike Perry <mikeperry-git(a)torproject.org> Date: Mon Jun 1 13:33:55 2015 -0700 Fix README for the file server. --- NetworkScanners/BwAuthority/README.BwAuthorities | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NetworkScanners/BwAuthority/README.BwAuthorities b/NetworkScanners/BwAuthority/README.BwAuthorities index 7e055b4..e268151 100644 --- a/NetworkScanners/BwAuthority/README.BwAuthorities +++ b/NetworkScanners/BwAuthority/README.BwAuthorities @@ -156,7 +156,7 @@ That's all there is to it. No '????' step needed! Appendix A: Creating the HTTPS scanning server -The scanner server will need approx 30-40Mbit of upstream available, and will +The scanner server will need 500Mbit-1Gbit of upstream available, and will need to serve https via a fixed IP. SSL is needed to avoid HTTP content caches at the various exit nodes. Self-signed certs are OK.

1 0

[translation/tor_animation] Update translations for tor_animation
by translation＠torproject.org 01 Jun '15

01 Jun '15

commit 3d502ca1520307a34ee3f6945f5b7e898a4b2359 Author: Translation commit bot <translation(a)torproject.org> Date: Mon Jun 1 20:46:39 2015 +0000 Update translations for tor_animation --- he.srt | 72 ++++++++++++++++++++++++++++++++-------------------------------- 1 file changed, 36 insertions(+), 36 deletions(-) diff --git a/he.srt b/he.srt index 78c998d..c112c49 100644 --- a/he.srt +++ b/he.srt @@ -1,33 +1,33 @@ 1 00:00:00,660 --> 00:00:02,780 -We've gotten very used to the Internet. +התרגלנו מאוד לשימוש באינטרנט. 2 00:00:03,120 --> 00:00:07,700 -We are constantly sharing information -about ourselves and our private lives: +אנחנו כל הזמן חולקים מידע +על עצמינו ועל חיינו הפרטיים. 3 00:00:08,000 --> 00:00:09,960 -food we eat, people we meet, +מה אנחנו אוכלים ועם מי אנחנו נפגשים. 4 00:00:10,180 --> 00:00:12,480 -places we go, and the stuff we read. +המקומות שאנחנו מבקרים בהם, ומה אנחנו קוראים. 5 00:00:13,280 --> 00:00:14,640 -Let me explain it better. +תנו לי להסביר את זה טוב יותר. 6 00:00:14,920 --> 00:00:17,740 -Right at this moment, -if someone attempts to look you up, +ברגע זה ממש +אם מישהו ינסה לחפש מידע עליכם 7 00:00:18,060 --> 00:00:22,480 -they'll see your real identity, -precise location, operating system, +הם יגלו את זהותכם האמיתית +את המיקום המדוייק שלכם, ואיזה מערכת הפעלה אתם משתמשים 8 00:00:22,800 --> 00:00:26,500 @@ -40,126 +40,126 @@ and so much more information about you and your life 10 -00:00:29,620 --> 00:00:32,460 +00:00:29,200 --> 00:00:31,500 which you probably didn't mean to share with unknown strangers, 11 -00:00:32,920 --> 00:00:35,840 +00:00:31,700 --> 00:00:34,000 who could easily use this data to exploit you. 12 -00:00:36,220 --> 00:00:38,120 +00:00:34,500 --> 00:00:37,000 But not if you're using Tor! 13 -00:00:39,140 --> 00:00:42,840 +00:00:37,140 --> 00:00:40,840 Tor Browser protects our privacy and identity on the Internet. 14 -00:00:43,560 --> 00:00:46,760 +00:00:41,560 --> 00:00:44,760 Tor secures your connection with three layers of encryption 15 -00:00:46,940 --> 00:00:51,760 +00:00:44,940 --> 00:00:49,760 and passes it through three voluntarily operated servers around the world, 16 -00:00:52,280 --> 00:00:55,520 +00:00:50,280 --> 00:00:53,520 which enables us to communicate anonymously over the Internet. 17 -00:00:58,560 --> 00:01:00,280 +00:00:56,560 --> 00:00:58,280 Tor also protects our data 18 -00:01:00,400 --> 00:01:03,900 +00:00:58,400 --> 00:01:01,900 against corporate or government targeted and mass surveillance. 19 -00:01:04,880 --> 00:01:09,340 +00:01:02,880 --> 00:01:07,340 Perhaps you live in a repressive country which tries to control and surveil the Internet. 20 -00:01:09,900 --> 00:01:13,800 +00:01:07,900 --> 00:01:11,800 Or perhaps you don't want big corporations taking advantage of your personal information. 21 -00:01:14,880 --> 00:01:17,640 +00:01:12,880 --> 00:01:15,640 Tor makes all of its users to look the same 22 -00:01:17,920 --> 00:01:20,800 +00:01:15,920 --> 00:01:18,800 which confuses the observer and makes you anonymous. 23 -00:01:21,500 --> 00:01:24,980 +00:01:19,500 --> 00:01:22,980 So, the more people use the Tor network, the stronger it gets 24 -00:01:25,140 --> 00:01:29,800 +00:01:23,140 --> 00:01:27,800 as it's easier to hide in a crowd of people who look exactly the same. 25 -00:01:30,700 --> 00:01:33,240 +00:01:28,700 --> 00:01:31,240 You can bypass the censorship without being worried about 26 -00:01:33,400 --> 00:01:36,100 +00:01:31,400 --> 00:01:34,100 the censor knowing what you do on the Internet. 27 -00:01:38,540 --> 00:01:41,440 +00:01:36,540 --> 00:01:39,440 The ads won't follow you everywhere for months, 28 -00:01:41,640 --> 00:01:43,300 +00:01:39,640 --> 00:01:41,300 starting when you first clicked on a product. 29 -00:01:45,880 --> 00:01:49,380 +00:01:43,880 --> 00:01:47,380 By using Tor, the sites you visit won't even know who you are, 30 -00:01:49,540 --> 00:01:51,760 +00:01:47,540 --> 00:01:49,760 from what part of the world you're visiting them, 31 -00:01:51,920 --> 00:01:53,920 +00:01:49,920 --> 00:01:51,920 unless you login and tell them so. 32 -00:01:56,200 --> 00:01:57,840 +00:01:54,200 --> 00:01:55,840 By downloading and using Tor, 33 -00:01:58,200 --> 00:02:00,560 +00:01:56,200 --> 00:01:58,560 you can protect the people who need anonymity, 34 -00:02:00,880 --> 00:02:03,640 +00:01:58,880 --> 00:02:01,640 like activists, journalists and bloggers. 35 -00:02:04,000 --> 00:02:09,000 +00:02:02,000 --> 00:02:07,000 Download and use Tor! Or run a relay!

1 0

[tor-messenger-build/master] Clear the server field if domain is changed
by sukhbir＠torproject.org 01 Jun '15

01 Jun '15

commit eba4fc6a1c4e63491f8a4136f2f19fa043988c77 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Mon Jun 1 14:08:41 2015 -0400 Clear the server field if domain is changed --- projects/instantbird/xmpp-onion-js.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/instantbird/xmpp-onion-js.patch b/projects/instantbird/xmpp-onion-js.patch index e6365fc..03652ee 100644 --- a/projects/instantbird/xmpp-onion-js.patch +++ b/projects/instantbird/xmpp-onion-js.patch @@ -43,7 +43,7 @@ diff --git a/im/content/accountWizard.js b/im/content/accountWizard.js }, + setOnionAddress: function aw_setOnionAddress() { -+ if (this.proto.id == "prpl-jabber" && this.onionAddress) { ++ if (this.proto.id == "prpl-jabber") { + document.getElementById("prpl-jabber-server").value = this.onionAddress; + } + },

1 0

[obfs4/master] Delay transport initialization till after logging has been setup.
by yawning＠torproject.org 01 Jun '15

01 Jun '15

commit 69ffcc39c63f4a9a192082da71eea6b06a1e75d7 Author: Yawning Angel <yawning(a)torproject.org> Date: Mon Jun 1 16:15:35 2015 +0000 Delay transport initialization till after logging has been setup. --- ChangeLog | 2 ++ obfs4proxy/obfs4proxy.go | 4 ++++ transports/transports.go | 11 +++++------ 3 files changed, 11 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index 15de989..774be88 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,6 @@ Changes in version 0.0.6 - UNRELEASED: + - Delay transport factory initialization till after logging has been + initialized. Changes in version 0.0.5 - 2015-04-15: - Go vet/fmt fixes, and misc. code cleanups. Patches by mvdan. diff --git a/obfs4proxy/obfs4proxy.go b/obfs4proxy/obfs4proxy.go index 5f7f171..a817583 100644 --- a/obfs4proxy/obfs4proxy.go +++ b/obfs4proxy/obfs4proxy.go @@ -347,6 +347,10 @@ func main() { if err = log.Init(*enableLogging, path.Join(stateDir, obfs4proxyLogFile), *unsafeLogging); err != nil { golog.Fatalf("[ERROR]: %s - failed to initialize logging", execName) } + if err = transports.Init(); err != nil { + log.Errorf("%s - failed to initialize transports: %s", execName, err) + os.Exit(-1) + } log.Noticef("%s - launched", getVersion()) diff --git a/transports/transports.go b/transports/transports.go index ba4e099..e35673b 100644 --- a/transports/transports.go +++ b/transports/transports.go @@ -41,7 +41,7 @@ import ( ) var transportMapLock sync.Mutex -var transportMap map[string]base.Transport +var transportMap map[string]base.Transport = make(map[string]base.Transport) // Register registers a transport protocol. func Register(transport base.Transport) error { @@ -81,13 +81,12 @@ func Get(name string) base.Transport { return t } -func init() { - // Initialize the transport list. - transportMap = make(map[string]base.Transport) - - // Register all the currently supported transports. +// Init initializes all of the integrated transports. +func Init() error { Register(new(obfs2.Transport)) Register(new(obfs3.Transport)) Register(new(obfs4.Transport)) Register(new(scramblesuit.Transport)) + + return nil }

1 0

[torspec/master] Add a note on master-key-ed25519 to prop220
by nickm＠torproject.org 01 Jun '15

01 Jun '15

commit 0ebd5db019e32229f2f4afed4b4871501cac0084 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 1 11:54:30 2015 -0400 Add a note on master-key-ed25519 to prop220 --- proposals/220-ecc-id-keys.txt | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/proposals/220-ecc-id-keys.txt b/proposals/220-ecc-id-keys.txt index cf11740..793ef90 100644 --- a/proposals/220-ecc-id-keys.txt +++ b/proposals/220-ecc-id-keys.txt @@ -224,6 +224,11 @@ Status: Draft key also signs all three keys as part of signing the descriptor. + When an ed25519 signature is present, there MAY be a "master-key-ed25519" + element containing the base64 encoded ed25519 master key as a single + argument. If it is present, it MUST match the identity key in + the certificate. + 2.5.1. Checking descriptor signatures. Current versions of Tor will handle these new formats by ignoring the

1 0

[tor/master] Add a master-key-ed25519 line for convenience
by nickm＠torproject.org 01 Jun '15

01 Jun '15

commit 3d653dff5e891c1e547ef7eacbc991410a98c1cb Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 1 11:24:55 2015 -0400 Add a master-key-ed25519 line for convenience --- src/or/router.c | 10 +++++++++- src/or/routerparse.c | 29 ++++++++++++++++++++++++++++- src/test/test_dir.c | 12 ++++++++++-- 3 files changed, 47 insertions(+), 4 deletions(-) diff --git a/src/or/router.c b/src/or/router.c index 6868e7b..0903eb2 100644 --- a/src/or/router.c +++ b/src/or/router.c @@ -2406,6 +2406,7 @@ router_dump_router_to_string(routerinfo_t *router, if (emit_ed_sigs) { /* Encode ed25519 signing cert */ char ed_cert_base64[256]; + char ed_fp_base64[ED25519_BASE64_LEN+1]; if (base64_encode(ed_cert_base64, sizeof(ed_cert_base64), (const char*)router->signing_key_cert->encoded, router->signing_key_cert->encoded_len, @@ -2413,10 +2414,17 @@ router_dump_router_to_string(routerinfo_t *router, log_err(LD_BUG,"Couldn't base64-encode signing key certificate!"); goto err; } + if (ed25519_public_to_base64(ed_fp_base64, + &router->signing_key_cert->signing_key)<0) { + log_err(LD_BUG,"Couldn't base64-encode identity key\n"); + goto err; + } tor_asprintf(&ed_cert_line, "identity-ed25519\n" "-----BEGIN ED25519 CERT-----\n" "%s" - "-----END ED25519 CERT-----\n", ed_cert_base64); + "-----END ED25519 CERT-----\n" + "master-key-ed25519 %s\n", + ed_cert_base64, ed_fp_base64); } /* PEM-encode the onion key */ diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 1413d40..ae50cda 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -89,6 +89,7 @@ typedef enum { K_IPV6_POLICY, K_ROUTER_SIG_ED25519, K_IDENTITY_ED25519, + K_MASTER_KEY_ED25519, K_ONION_KEY_CROSSCERT, K_NTOR_ONION_KEY_CROSSCERT, @@ -302,6 +303,7 @@ static token_rule_t routerdesc_token_table[] = { T01("extra-info-digest", K_EXTRA_INFO_DIGEST, GE(1), NO_OBJ ), T01("hidden-service-dir", K_HIDDEN_SERVICE_DIR, NO_ARGS, NO_OBJ ), T01("identity-ed25519", K_IDENTITY_ED25519, NO_ARGS, NEED_OBJ ), + T01("master-key-ed25519", K_MASTER_KEY_ED25519, GE(1), NO_OBJ ), T01("router-sig-ed25519", K_ROUTER_SIG_ED25519, GE(1), NO_OBJ ), T01("onion-key-crosscert", K_ONION_KEY_CROSSCERT, NO_ARGS, NEED_OBJ ), T01("ntor-onion-key-crosscert", K_NTOR_ONION_KEY_CROSSCERT, @@ -1337,9 +1339,11 @@ router_parse_entry_from_string(const char *s, const char *end, } { - directory_token_t *ed_sig_tok, *ed_cert_tok, *cc_tap_tok, *cc_ntor_tok; + directory_token_t *ed_sig_tok, *ed_cert_tok, *cc_tap_tok, *cc_ntor_tok, + *master_key_tok; ed_sig_tok = find_opt_by_keyword(tokens, K_ROUTER_SIG_ED25519); ed_cert_tok = find_opt_by_keyword(tokens, K_IDENTITY_ED25519); + master_key_tok = find_opt_by_keyword(tokens, K_MASTER_KEY_ED25519); cc_tap_tok = find_opt_by_keyword(tokens, K_ONION_KEY_CROSSCERT); cc_ntor_tok = find_opt_by_keyword(tokens, K_NTOR_ONION_KEY_CROSSCERT); int n_ed_toks = !!ed_sig_tok + !!ed_cert_tok + @@ -1350,6 +1354,11 @@ router_parse_entry_from_string(const char *s, const char *end, "cross-certification support"); goto err; } + if (master_key_tok && !ed_sig_tok) { + log_warn(LD_DIR, "Router descriptor has ed25519 master key but no " + "certificate"); + goto err; + } if (ed_sig_tok) { tor_assert(ed_cert_tok && cc_tap_tok && cc_ntor_tok); const int ed_cert_token_pos = smartlist_pos(tokens, ed_cert_tok); @@ -1394,12 +1403,30 @@ router_parse_entry_from_string(const char *s, const char *end, goto err; } router->signing_key_cert = cert; /* makes sure it gets freed. */ + if (cert->cert_type != CERT_TYPE_ID_SIGNING || ! cert->signing_key_included) { log_warn(LD_DIR, "Invalid form for ed25519 cert"); goto err; } + if (master_key_tok) { + /* This token is optional, but if it's present, it must match + * the signature in the signing cert, or supplant it. */ + tor_assert(master_key_tok->n_args >= 1); + ed25519_public_key_t pkey; + if (ed25519_public_from_base64(&pkey, master_key_tok->args[0])<0) { + log_warn(LD_DIR, "Can't parse ed25519 master key"); + goto err; + } + + if (fast_memneq(&cert->signing_key.pubkey, + pkey.pubkey, ED25519_PUBKEY_LEN)) { + log_warn(LD_DIR, "Ed25519 master key does not match " + "key in certificate"); + goto err; + } + } ntor_cc_cert = tor_cert_parse((const uint8_t*)cc_ntor_tok->object_body, cc_ntor_tok->object_size); if (!ntor_cc_cert) { diff --git a/src/test/test_dir.c b/src/test/test_dir.c index 32ac8d4..35bd8ea 100644 --- a/src/test/test_dir.c +++ b/src/test/test_dir.c @@ -227,8 +227,16 @@ test_dir_formats(void *arg) "identity-ed25519\n" "-----BEGIN ED25519 CERT-----\n", sizeof(buf2)); strlcat(buf2, cert_buf, sizeof(buf2)); - strlcat(buf2, "-----END ED25519 CERT-----\n" - "platform Tor "VERSION" on ", sizeof(buf2)); + strlcat(buf2, "-----END ED25519 CERT-----\n", sizeof(buf2)); + strlcat(buf2, "master-key-ed25519 ", sizeof(buf2)); + { + char k[ED25519_BASE64_LEN+1]; + tt_assert(ed25519_public_to_base64(k, &r2->signing_key_cert->signing_key) + >= 0); + strlcat(buf2, k, sizeof(buf2)); + strlcat(buf2, "\n", sizeof(buf2)); + } + strlcat(buf2, "platform Tor "VERSION" on ", sizeof(buf2)); strlcat(buf2, get_uname(), sizeof(buf2)); strlcat(buf2, "\n" "protocols Link 1 2 Circuit 1\n"

1 0

[tor/master] More check-spaces fixes
by nickm＠torproject.org 01 Jun '15

01 Jun '15

commit 3028507e96a51f2058e7ce6678ac8f2d8ab1b502 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 1 10:56:54 2015 -0400 More check-spaces fixes --- src/test/test_link_handshake.c | 81 +++++++++++++++++++++++----------------- 1 file changed, 47 insertions(+), 34 deletions(-) diff --git a/src/test/test_link_handshake.c b/src/test/test_link_handshake.c index 0b3900e..7ad2c30 100644 --- a/src/test/test_link_handshake.c +++ b/src/test/test_link_handshake.c @@ -329,7 +329,7 @@ test_link_handshake_recv_certs_ok_server(void *arg) #define CERTS_FAIL(name, code) \ static void \ - test_link_handshake_recv_certs_ ## name (void *arg) \ + test_link_handshake_recv_certs_ ## name(void *arg) \ { \ certs_data_t *d = arg; \ { code ; } \ @@ -349,44 +349,54 @@ CERTS_FAIL(already_authenticated, CERTS_FAIL(empty, d->cell->payload_len = 0) CERTS_FAIL(bad_circid, d->cell->circ_id = 1) CERTS_FAIL(truncated_1, d->cell->payload[0] = 5) -CERTS_FAIL(truncated_2, { - d->cell->payload_len = 4; - memcpy(d->cell->payload, "\x01\x01\x00\x05", 4);}) -CERTS_FAIL(truncated_3, { - d->cell->payload_len = 7; - memcpy(d->cell->payload, "\x01\x01\x00\x05""abc", 7);}) +CERTS_FAIL(truncated_2, + { + d->cell->payload_len = 4; + memcpy(d->cell->payload, "\x01\x01\x00\x05", 4); + }) +CERTS_FAIL(truncated_3, + { + d->cell->payload_len = 7; + memcpy(d->cell->payload, "\x01\x01\x00\x05""abc", 7); + }) #define REENCODE() do { \ ssize_t n = certs_cell_encode(d->cell->payload, 4096, d->ccell); \ tt_int_op(n, >, 0); \ d->cell->payload_len = n; \ } while (0) -CERTS_FAIL(not_x509, { +CERTS_FAIL(not_x509, + { certs_cell_cert_setlen_body(certs_cell_get_certs(d->ccell, 0), 3); certs_cell_get_certs(d->ccell, 0)->cert_len = 3; REENCODE(); - }) -CERTS_FAIL(both_link, { + }) +CERTS_FAIL(both_link, + { certs_cell_get_certs(d->ccell, 0)->cert_type = 1; certs_cell_get_certs(d->ccell, 1)->cert_type = 1; REENCODE(); - }) -CERTS_FAIL(both_id_rsa, { + }) +CERTS_FAIL(both_id_rsa, + { certs_cell_get_certs(d->ccell, 0)->cert_type = 2; certs_cell_get_certs(d->ccell, 1)->cert_type = 2; REENCODE(); - }) -CERTS_FAIL(both_auth, { + }) +CERTS_FAIL(both_auth, + { certs_cell_get_certs(d->ccell, 0)->cert_type = 3; certs_cell_get_certs(d->ccell, 1)->cert_type = 3; REENCODE(); - }) -CERTS_FAIL(wrong_labels_1, { + }) +CERTS_FAIL(wrong_labels_1, + { certs_cell_get_certs(d->ccell, 0)->cert_type = 2; certs_cell_get_certs(d->ccell, 1)->cert_type = 1; REENCODE(); - }) -CERTS_FAIL(wrong_labels_2, { + }) +CERTS_FAIL(wrong_labels_2, + { const tor_x509_cert_t *a; const tor_x509_cert_t *b; const uint8_t *enca; @@ -399,20 +409,23 @@ CERTS_FAIL(wrong_labels_2, { certs_cell_get_certs(d->ccell, 1)->cert_len = lena; REENCODE(); }) -CERTS_FAIL(wrong_labels_3, { - certs_cell_get_certs(d->ccell, 0)->cert_type = 2; - certs_cell_get_certs(d->ccell, 1)->cert_type = 3; - REENCODE(); - }) -CERTS_FAIL(server_missing_certs, { - d->c->handshake_state->started_here = 0; - }) -CERTS_FAIL(server_wrong_labels_1, { - d->c->handshake_state->started_here = 0; - certs_cell_get_certs(d->ccell, 0)->cert_type = 2; - certs_cell_get_certs(d->ccell, 1)->cert_type = 3; - REENCODE(); - }) +CERTS_FAIL(wrong_labels_3, + { + certs_cell_get_certs(d->ccell, 0)->cert_type = 2; + certs_cell_get_certs(d->ccell, 1)->cert_type = 3; + REENCODE(); + }) +CERTS_FAIL(server_missing_certs, + { + d->c->handshake_state->started_here = 0; + }) +CERTS_FAIL(server_wrong_labels_1, + { + d->c->handshake_state->started_here = 0; + certs_cell_get_certs(d->ccell, 0)->cert_type = 2; + certs_cell_get_certs(d->ccell, 1)->cert_type = 3; + REENCODE(); + }) static void test_link_handshake_send_authchallenge(void *arg) @@ -563,7 +576,7 @@ test_link_handshake_recv_authchallenge_ok_unrecognized(void *arg) #define AUTHCHALLENGE_FAIL(name, code) \ static void \ - test_link_handshake_recv_authchallenge_ ## name (void *arg) \ + test_link_handshake_recv_authchallenge_ ## name(void *arg) \ { \ authchallenge_data_t *d = arg; \ { code ; } \ @@ -782,7 +795,7 @@ test_link_handshake_auth_cell(void *arg) #define AUTHENTICATE_FAIL(name, code) \ static void \ - test_link_handshake_auth_ ## name (void *arg) \ + test_link_handshake_auth_ ## name(void *arg) \ { \ authenticate_data_t *d = arg; \ { code ; } \

1 0

[tor/master] Fix a memory leak in routerkeys.c
by nickm＠torproject.org 01 Jun '15

01 Jun '15

commit fcc01d7cafef86dd3ef449e474b0ff7ca45cac85 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 1 10:45:51 2015 -0400 Fix a memory leak in routerkeys.c --- src/or/routerkeys.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/or/routerkeys.c b/src/or/routerkeys.c index 8b1ade5..b17d195 100644 --- a/src/or/routerkeys.c +++ b/src/or/routerkeys.c @@ -134,6 +134,7 @@ ed_key_init_from_file(const char *fname, uint32_t flags, goto done; /* Read a cert. */ + tor_free(got_tag); uint8_t certbuf[256]; ssize_t cert_body_len = crypto_read_tagged_contents_from_file( cert_fname, "ed25519v1-cert",

1 0

[tor/master] Fix some memory leaks in ed25519 code and tests
by nickm＠torproject.org 01 Jun '15

01 Jun '15

commit d31877c6bf68c942b6c66bc7a59781d75a3dc3b5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 1 10:26:11 2015 -0400 Fix some memory leaks in ed25519 code and tests --- src/or/dircollate.c | 1 + src/test/test_dir.c | 12 +++++++----- src/test/test_microdesc.c | 1 + 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/src/or/dircollate.c b/src/or/dircollate.c index 34259ec..331e058 100644 --- a/src/or/dircollate.c +++ b/src/or/dircollate.c @@ -125,6 +125,7 @@ dircollator_free(dircollator_t *dc) digestmap_free(dc->by_collated_rsa_sha1, NULL); digestmap_free(dc->by_rsa_sha1, tor_free_); + smartlist_free(dc->all_rsa_sha1_lst); ddmap_entry_t **e, **next, *this; for (e = HT_START(double_digest_map, &dc->by_both_ids); diff --git a/src/test/test_dir.c b/src/test/test_dir.c index 3e9e955..32ac8d4 100644 --- a/src/test/test_dir.c +++ b/src/test/test_dir.c @@ -91,7 +91,6 @@ test_dir_formats(void *arg) addr_policy_t *ex1, *ex2; routerlist_t *dir1 = NULL, *dir2 = NULL; uint8_t *rsa_cc = NULL; - tor_cert_t *ntor_cc = NULL; or_options_t *options = get_options_mutable(); const addr_policy_t *p; time_t now = time(NULL); @@ -155,7 +154,6 @@ test_dir_formats(void *arg) r2->or_port = 9005; r2->dir_port = 0; r2->onion_pkey = crypto_pk_dup_key(pk2); - r2->onion_curve25519_pkey = tor_malloc_zero(sizeof(curve25519_public_key_t)); curve25519_keypair_t r2_onion_keypair; curve25519_keypair_generate(&r2_onion_keypair, 0); r2->onion_curve25519_pkey = tor_memdup(&r2_onion_keypair.pubkey, @@ -257,15 +255,19 @@ test_dir_formats(void *arg) strlcat(buf2, cert_buf, sizeof(buf2)); strlcat(buf2, "-----END CROSSCERT-----\n", sizeof(buf2)); int ntor_cc_sign; - ntor_cc = make_ntor_onion_key_crosscert(&r2_onion_keypair, + { + tor_cert_t *ntor_cc = NULL; + ntor_cc = make_ntor_onion_key_crosscert(&r2_onion_keypair, &kp1.pubkey, r2->cache_info.published_on, MIN_ONION_KEY_LIFETIME, &ntor_cc_sign); - tt_assert(ntor_cc); - base64_encode(cert_buf, sizeof(cert_buf), + tt_assert(ntor_cc); + base64_encode(cert_buf, sizeof(cert_buf), (char*)ntor_cc->encoded, ntor_cc->encoded_len, BASE64_ENCODE_MULTILINE); + tor_cert_free(ntor_cc); + } tor_snprintf(buf2+strlen(buf2), sizeof(buf2)-strlen(buf2), "ntor-onion-key-crosscert %d\n" "-----BEGIN ED25519 CERT-----\n" diff --git a/src/test/test_microdesc.c b/src/test/test_microdesc.c index 3c22e18..5dc5b2b 100644 --- a/src/test/test_microdesc.c +++ b/src/test/test_microdesc.c @@ -470,6 +470,7 @@ test_md_generate(void *arg) md = dirvote_create_microdescriptor(ri, 21); tt_str_op(md->body, ==, test_md_18); + routerinfo_free(ri); ri = router_parse_entry_from_string(test_ri2, NULL, 0, 0, NULL, NULL); microdesc_free(md);

1 0