September 2015 - tor-commits - lists.torproject.org

[tor/master] Add `KeepAliveIsolateSOCKSAuth` as a SOCKSPort option.
by nickm＠torproject.org 08 Sep '15

08 Sep '15

commit 54510d4d1a66d2dd9a618699bd2e51bf4ade4dea Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Tue Sep 1 16:30:48 2015 +0000 Add `KeepAliveIsolateSOCKSAuth` as a SOCKSPort option. This controls the circuit dirtyness reset behavior added for Tor Browser's user experience fix (#15482). Unlike previous iterations of this patch, the tunable actually works, and is documented. --- changes/feature15482 | 5 +++++ doc/tor.1.txt | 7 ++++++- src/or/circuituse.c | 10 +++++----- src/or/config.c | 11 +++++++++++ src/or/or.h | 7 +++++++ 5 files changed, 34 insertions(+), 6 deletions(-) diff --git a/changes/feature15482 b/changes/feature15482 new file mode 100644 index 0000000..4e32d39 --- /dev/null +++ b/changes/feature15482 @@ -0,0 +1,5 @@ + o Minor features (client-side privacy) + - Indefinitely extend circuit lifespan by resetting dirtyness, if + IsolateSOCKSAuth is in use, the new `KeepAliveIsolateSOCKSAuth` + option is set, and streams with SOCKS authentication are attached + to the circuit. Implements feature 15482. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index af99570..803fd18 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -934,7 +934,9 @@ The following options are useful only for clients (that is, if Feel free to reuse a circuit that was first used at most NUM seconds ago, but never attach a new stream to a circuit that is too old. For hidden services, this applies to the __last__ time a circuit was used, not the - first. (Default: 10 minutes) + first. Circuits with streams constructed with SOCKS authentication via + SocksPorts that have **KeepAliveIsolateSOCKSAuth** ignore this value. + (Default: 10 minutes) [[MaxClientCircuitsPending]] **MaxClientCircuitsPending** __NUM__:: Do not allow more than NUM circuits to be pending at a time for handling @@ -991,6 +993,9 @@ The following options are useful only for clients (that is, if **IsolateDestAddr**;; Don't share circuits with streams targeting a different destination address. + **KeepAliveIsolateSOCKSAuth**;; + If **IsolateSOCKSAuth** is enabled, keep alive circuits that have + streams with SOCKS authentication set indefinitely. **SessionGroup=**__INT__;; If no other isolation rules would prevent it, allow streams on this port to share circuits with streams from every other diff --git a/src/or/circuituse.c b/src/or/circuituse.c index e10bb82..00340fd 100644 --- a/src/or/circuituse.c +++ b/src/or/circuituse.c @@ -2284,11 +2284,11 @@ connection_ap_handshake_attach_chosen_circuit(entry_connection_t *conn, base_conn->state = AP_CONN_STATE_CIRCUIT_WAIT; - if (!circ->base_.timestamp_dirty) { - circ->base_.timestamp_dirty = approx_time(); - } else if ((conn->entry_cfg.isolation_flags & ISO_SOCKSAUTH) && - (conn->socks_request->usernamelen || - conn->socks_request->passwordlen)) { + if (!circ->base_.timestamp_dirty || + ((conn->entry_cfg.isolation_flags & ISO_SOCKSAUTH) && + (conn->entry_cfg.socks_iso_keep_alive) && + (conn->socks_request->usernamelen || + conn->socks_request->passwordlen))) { /* When stream isolation is in use and controlled by an application * we are willing to keep using the stream. */ circ->base_.timestamp_dirty = approx_time(); diff --git a/src/or/config.c b/src/or/config.c index 6e782de..aca956c 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -6022,6 +6022,7 @@ parse_port_config(smartlist_t *out, int sessiongroup = SESSION_GROUP_UNSET; unsigned isolation = ISO_DEFAULT; int prefer_no_auth = 0; + int socks_iso_keep_alive = 0; char *addrport; uint16_t ptmp=0; @@ -6246,6 +6247,8 @@ parse_port_config(smartlist_t *out, isoflag = ISO_CLIENTPROTO; } else if (!strcasecmp(elt, "IsolateClientAddr")) { isoflag = ISO_CLIENTADDR; + } else if (!strcasecmp(elt, "KeepAliveIsolateSOCKSAuth")) { + socks_iso_keep_alive = 1; } else { log_warn(LD_CONFIG, "Unrecognized %sPort option '%s'", portname, escaped(elt_orig)); @@ -6276,6 +6279,13 @@ parse_port_config(smartlist_t *out, goto err; } + if (!(isolation & ISO_SOCKSAUTH) && socks_iso_keep_alive) { + log_warn(LD_CONFIG, "You have a %sPort entry with both " + "NoIsolateSOCKSAuth and KeepAliveIsolateSOCKSAuth set.", + portname); + goto err; + } + if (out && port) { size_t namelen = unix_socket_path ? strlen(unix_socket_path) : 0; port_cfg_t *cfg = port_cfg_new(namelen); @@ -6309,6 +6319,7 @@ parse_port_config(smartlist_t *out, cfg->entry_cfg.socks_prefer_no_auth = prefer_no_auth; if (! (isolation & ISO_SOCKSAUTH)) cfg->entry_cfg.socks_prefer_no_auth = 1; + cfg->entry_cfg.socks_iso_keep_alive = socks_iso_keep_alive; smartlist_add(out, cfg); } diff --git a/src/or/or.h b/src/or/or.h index 8c40f1a..6660a0d 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -1155,6 +1155,8 @@ typedef struct entry_port_cfg_t { /** When both no-auth and user/pass are advertised by a SOCKS client, select * no-auth. */ unsigned int socks_prefer_no_auth : 1; + /** When ISO_SOCKSAUTH is in use, Keep-Alive circuits indefinitely. */ + unsigned int socks_iso_keep_alive : 1; /* Client port types only: */ unsigned int ipv4_traffic : 1; @@ -2877,6 +2879,11 @@ typedef struct circuit_t { * circuits entered certain states. This usage probably won't * interfere with this field's primary purpose, but we should * document it more thoroughly to make sure of that. + * + * XXX027 The SocksPort option KeepaliveIsolateSOCKSAuth will artificially + * adjust this value forward each time a suitable stream is attached to an + * already constructed circuit, potentially keeping the circuit alive + * indefinitely. */ time_t timestamp_dirty;

1 0

[tor/master] Make NoKeepAliveIsolateSOCKSAuth work as expected
by nickm＠torproject.org 08 Sep '15

08 Sep '15

commit 7ffc048f0aeab1b0e828b546df71cb647da443e5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 8 14:03:54 2015 -0400 Make NoKeepAliveIsolateSOCKSAuth work as expected --- src/or/config.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/config.c b/src/or/config.c index db78d52..190e4d4 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -6263,7 +6263,7 @@ parse_port_config(smartlist_t *out, } else if (!strcasecmp(elt, "IsolateClientAddr")) { isoflag = ISO_CLIENTADDR; } else if (!strcasecmp(elt, "KeepAliveIsolateSOCKSAuth")) { - socks_iso_keep_alive = 1; + socks_iso_keep_alive = ! no; } else { log_warn(LD_CONFIG, "Unrecognized %sPort option '%s'", portname, escaped(elt_orig));

1 0

[tor/master] Handle negative inputs to crypto_random_time_range().
by nickm＠torproject.org 08 Sep '15

08 Sep '15

commit 280672bdbc2c694ebe17f9972657d118e84be723 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 8 10:22:01 2015 -0400 Handle negative inputs to crypto_random_time_range(). (These inputs are possible when Shadow starts the world at time_t 0, and breaks our assumption that Tor didn't exist in the 1970s.) Fixes regression introduced in 241e6b09. Fixes #16980. --- changes/bug16980 | 6 ++++++ src/common/crypto.c | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/changes/bug16980 b/changes/bug16980 new file mode 100644 index 0000000..43a817e --- /dev/null +++ b/changes/bug16980 @@ -0,0 +1,6 @@ + o Minor bugfixes: + + - Fix the behavior of crypto_time_t when told to consider times + before 1970. (These times were possible when running in a + simulated network environment where time()'s output starts at + zero.) Fixes bug 16980; bugfix on 0.2.7.1-alpha. diff --git a/src/common/crypto.c b/src/common/crypto.c index 6d4b0d7..815c2ec 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -2440,7 +2440,8 @@ crypto_rand_uint64_range(uint64_t min, uint64_t max) time_t crypto_rand_time_range(time_t min, time_t max) { - return (time_t) crypto_rand_uint64_range(min, max); + tor_assert(min < max); + return min + (time_t)crypto_rand_uint64(max - min); } /** Return a pseudorandom 64-bit integer, chosen uniformly from the values

1 0

[tor/master] Merge branch 'bug16980'
by nickm＠torproject.org 08 Sep '15

08 Sep '15

commit 4c6fd7106fdf1a31c1e50a992c03dac69cd25a47 Merge: 81e3dee 280672b Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 8 10:41:51 2015 -0400 Merge branch 'bug16980' changes/bug16980 | 6 ++++++ src/common/crypto.c | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-)

1 0

[translation/tor-messenger-privproperties_completed] Update translations for tor-messenger-privproperties_completed
by translation＠torproject.org 08 Sep '15

08 Sep '15

commit 4902d742f6bbcda35bc34063373b5aad64fd49b9 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Sep 8 13:16:42 2015 +0000 Update translations for tor-messenger-privproperties_completed --- hr_HR/priv.properties | 1 + 1 file changed, 1 insertion(+) diff --git a/hr_HR/priv.properties b/hr_HR/priv.properties new file mode 100644 index 0000000..947fe9b --- /dev/null +++ b/hr_HR/priv.properties @@ -0,0 +1 @@ +priv.account=Generiranje privatnog ključa za %S (%S)...

1 0

[translation/tor-messenger-otrproperties_completed] Update translations for tor-messenger-otrproperties_completed
by translation＠torproject.org 08 Sep '15

08 Sep '15

commit 51317d091a63caa1964be0ee5be5a359e73ddbf4 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Sep 8 13:16:35 2015 +0000 Update translations for tor-messenger-otrproperties_completed --- hr_HR/otr.properties | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/hr_HR/otr.properties b/hr_HR/otr.properties new file mode 100644 index 0000000..fff9b26 --- /dev/null +++ b/hr_HR/otr.properties @@ -0,0 +1,31 @@ +msgevent.encryption_required_part1=Pokušali ste poslati neenkriptiranu poruku %S. Neenkriptirane poruke nisu dozvoljene. +msgevent.encryption_required_part2=Pokušavam započeti privatni razgovor. Vaša poruka će biti ponovno poslana kad privatni razgovor započne. +msgevent.encryption_error=Došlo je do pogreške prilikom enkripcije Vaše poruke. Poruka nije poslana. +msgevent.connection_ended=%S je već zatvorio svoju privatnu vezu prema Vama. Vaša poruka nije poslana. Ili završite svoj privatni razgovor ili ga ponovno pokrenite. +msgevent.setup_error=Došlo je do pogreške prilikom uspostave privatnog razgovora s %S. +msgevent.msg_reflected=Primate vlastite OTR poruke. Ili želite pričati sami sa sobom, ili netko reflektira Vaše poruke natrag Vama. +msgevent.msg_resent=Posljednja poruka za %S je poslana ponovno. +msgevent.rcvdmsg_not_private=Enkriptirana poruka primljena od %S je nečitljiva, jer trenutno ne komunicirate privatno. +msgevent.rcvdmsg_unreadable=Primili smo nečitljivu enkriptiranu poruku od %S. +msgevent.rcvdmsg_malformed=Primili smo poruku o malformiranim podatcima od %S. +msgevent.log_heartbeat_rcvd=Otkucaj srca primljen od %S. +msgevent.log_heartbeat_sent=Otkucaj srca poslan prema %S. +msgevent.rcvdmsg_general_err=Došlo je do OTR pogreške. +msgevent.rcvdmsg_unecrypted=Primili smo neenkriptiranu poruku od %S. +msgevent.rcvdmsg_unrecognized=Primili smo neprepoznatu OTR poruku od %S. +msgevent.rcvdmsg_for_other_instance=%S je poslao poruku namjenjenu za različitu sesiju. Ako ste prijavljeni više puta, možda je neka druga sesija primila tu poruku. +context.gone_secure_private=Privatni razgovor s %S pokrenut. +context.gone_secure_unverified=Privatni razgovor s %S pokrenut. Kako bilo, identitet kontakta nije verificiran. +context.still_secure=Uspješno osvježen privatni razgovor s %S. +error.enc=Došlo je do pogreške prilikom enkripcije poruke. +error.not_priv=Poslali ste enkriptirane podatke prema %S, koji to nije očekivao. +error.unreadable=Poslali ste nečitljivu enkriptiranu poruku. +error.malformed=Poslali ste poruku malformiranih podataka. +resent=[ponovno poslano] +tlv.disconnected=%S je završio privatni razgovor s Vama; i Vi bi trebali učiniti isto. +query.msg=%S je zatražio Neslužbeni privatni razgovor. Kako bilo, Vi nemate priključak koji to podržava. Pogledajte http://otr.cypherpunks.ca/ za više informacija. +trust.unused=Nekorišteno +trust.not_private=Nije privatno +trust.unverified=Neverificirano +trust.private=Privatno +trust.finished=Završeno

1 0

[translation/tor-messenger-otrproperties] Update translations for tor-messenger-otrproperties
by translation＠torproject.org 08 Sep '15

08 Sep '15

commit 1af18d948fe2f8079ecdeee374cfd4cd2c89e1fc Author: Translation commit bot <translation(a)torproject.org> Date: Tue Sep 8 13:16:32 2015 +0000 Update translations for tor-messenger-otrproperties --- hr_HR/otr.properties | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/hr_HR/otr.properties b/hr_HR/otr.properties index 9190510..fff9b26 100644 --- a/hr_HR/otr.properties +++ b/hr_HR/otr.properties @@ -23,9 +23,9 @@ error.unreadable=Poslali ste nečitljivu enkriptiranu poruku. error.malformed=Poslali ste poruku malformiranih podataka. resent=[ponovno poslano] tlv.disconnected=%S je završio privatni razgovor s Vama; i Vi bi trebali učiniti isto. -query.msg=%S has requested an Off-the Record private conversation. However, you do not have a plugin to support that. See http://otr.cypherpunks.ca/ for more information. -trust.unused=Unused -trust.not_private=Not Private -trust.unverified=Unverified -trust.private=Private -trust.finished=Finished +query.msg=%S je zatražio Neslužbeni privatni razgovor. Kako bilo, Vi nemate priključak koji to podržava. Pogledajte http://otr.cypherpunks.ca/ za više informacija. +trust.unused=Nekorišteno +trust.not_private=Nije privatno +trust.unverified=Neverificirano +trust.private=Privatno +trust.finished=Završeno

1 0

[translation/torbutton-abouttorproperties_completed] Update translations for torbutton-abouttorproperties_completed
by translation＠torproject.org 08 Sep '15

08 Sep '15

commit 9ec9c01aeff9de81be78fba0b414932d9489aabe Author: Translation commit bot <translation(a)torproject.org> Date: Tue Sep 8 13:16:07 2015 +0000 Update translations for torbutton-abouttorproperties_completed --- hr_HR/abouttor.properties | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/hr_HR/abouttor.properties b/hr_HR/abouttor.properties new file mode 100644 index 0000000..4873d80 --- /dev/null +++ b/hr_HR/abouttor.properties @@ -0,0 +1,21 @@ +# Copyright (c) 2014, The Tor Project, Inc. +# See LICENSE for licensing information. +# vim: set sw=2 sts=2 ts=8 et: + +aboutTor.searchSP.privacy=Pretraži <a href="%1$S">sigurno</a> sa <a href="%2$S">Startpage-om</a>. +# The following string is a link which replaces %1$S above. +aboutTor.searchSP.privacy.link=https://startpage.com/eng/protect-privacy.html +# The following string is a link which replaces %2$S above. +aboutTor.searchSP.search.link=https://startpage.com/ + +aboutTor.searchDDG.privacy=Pretraži <a href="%1$S">sigurno</a> s <a href="%2$S">DuckDuckGo</a>. +# The following string is a link which replaces %1$S above. +aboutTor.searchDDG.privacy.link=https://duckduckgo.com/privacy.html +# The following string is a link which replaces %2$S above. +aboutTor.searchDDG.search.link=https://duckduckgo.com/ + +aboutTor.searchDC.privacy=Pretraži <a href="%1$S">sigurno</a> s <a href="%2$S">Disconnect.me</a>. +# The following string is a link which replaces %1$S above. +aboutTor.searchDC.privacy.link=https://disconnect.me/privacy +# The following string is a link which replaces %2$S above. +aboutTor.searchDC.search.link=https://search.disconnect.me/

1 0

[translation/torbutton-abouttorproperties] Update translations for torbutton-abouttorproperties
by translation＠torproject.org 08 Sep '15

08 Sep '15

commit 71a8c7d66733799f858307a476cb39236a27dab6 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Sep 8 13:16:03 2015 +0000 Update translations for torbutton-abouttorproperties --- hr_HR/abouttor.properties | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hr_HR/abouttor.properties b/hr_HR/abouttor.properties index d607324..4873d80 100644 --- a/hr_HR/abouttor.properties +++ b/hr_HR/abouttor.properties @@ -2,19 +2,19 @@ # See LICENSE for licensing information. # vim: set sw=2 sts=2 ts=8 et: -aboutTor.searchSP.privacy=Search <a href="%1$S">securely</a> with <a href="%2$S">Startpage</a>. +aboutTor.searchSP.privacy=Pretraži <a href="%1$S">sigurno</a> sa <a href="%2$S">Startpage-om</a>. # The following string is a link which replaces %1$S above. aboutTor.searchSP.privacy.link=https://startpage.com/eng/protect-privacy.ht… # The following string is a link which replaces %2$S above. aboutTor.searchSP.search.link=https://startpage.com/ -aboutTor.searchDDG.privacy=Search <a href="%1$S">securely</a> with <a href="%2$S">DuckDuckGo</a>. +aboutTor.searchDDG.privacy=Pretraži <a href="%1$S">sigurno</a> s <a href="%2$S">DuckDuckGo</a>. # The following string is a link which replaces %1$S above. aboutTor.searchDDG.privacy.link=https://duckduckgo.com/privacy.html # The following string is a link which replaces %2$S above. aboutTor.searchDDG.search.link=https://duckduckgo.com/ -aboutTor.searchDC.privacy=Search <a href="%1$S">securely</a> with <a href="%2$S">Disconnect.me</a>. +aboutTor.searchDC.privacy=Pretraži <a href="%1$S">sigurno</a> s <a href="%2$S">Disconnect.me</a>. # The following string is a link which replaces %1$S above. aboutTor.searchDC.privacy.link=https://disconnect.me/privacy # The following string is a link which replaces %2$S above.

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 08 Sep '15

08 Sep '15

commit 0e7236fcc2ca76b1ce9fc1aadfdb1dcf93ffb88b Author: Translation commit bot <translation(a)torproject.org> Date: Tue Sep 8 12:45:15 2015 +0000 Update translations for https_everywhere --- te/https-everywhere.dtd | 4 ++-- te/https-everywhere.properties | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/te/https-everywhere.dtd b/te/https-everywhere.dtd index eac7ddf..23814d6 100644 --- a/te/https-everywhere.dtd +++ b/te/https-everywhere.dtd @@ -13,8 +13,8 @@ <!ENTITY https-everywhere.menu.about "About HTTPS Everywhere"> <!ENTITY https-everywhere.menu.observatory "SSL Observatory Preferences"> -<!ENTITY https-everywhere.menu.globalEnable "Enable HTTPS Everywhere"> -<!ENTITY https-everywhere.menu.globalDisable "Disable HTTPS Everywhere"> +<!ENTITY https-everywhere.menu.globalEnable "ప్రతీచోటా HTTPS చేతనించు"> +<!ENTITY https-everywhere.menu.globalDisable "ప్రతీచోటా HTTPS అచేతనించు"> <!ENTITY https-everywhere.menu.blockHttpRequests "Block all HTTP requests"> <!ENTITY https-everywhere.menu.showCounter "Show Counter"> <!ENTITY https-everywhere.menu.viewAllRules "View All Rules"> diff --git a/te/https-everywhere.properties b/te/https-everywhere.properties index be83831..c2c0043 100644 --- a/te/https-everywhere.properties +++ b/te/https-everywhere.properties @@ -1,8 +1,8 @@ -https-everywhere.menu.globalEnable = Enable HTTPS Everywhere -https-everywhere.menu.globalDisable = Disable HTTPS Everywhere -https-everywhere.menu.enableDisable = Enable / Disable Rules -https-everywhere.menu.noRules = (No Rules for This Page) -https-everywhere.menu.unknownRules = (Rules for This Page Unknown) +https-everywhere.menu.globalEnable = ప్రతీచోటా HTTPS చేతనించు +https-everywhere.menu.globalDisable = ప్రతీచోటా HTTPS అచేతనించు +https-everywhere.menu.enableDisable = నియమాలను చేతనించు/అచేతనించు +https-everywhere.menu.noRules = (ఈ పుటకి నియమాలు లేవు) +https-everywhere.menu.unknownRules = (ఈ పుటకి ఏ నియమాలు ఉన్నాయో తెలియదు) https-everywhere.toolbar.hint = HTTPS Everywhere is now active. You can toggle it on a site-by-site basis by clicking the icon in the address bar. https-everywhere.migration.notification0 = In order to implement a crucial fix, this update resets your HTTPS Everywhere rule preferences to their default values. https-everywhere.menu.ruleset-tests = Run HTTPS Everywhere Ruleset Tests

1 0