September 2015 - tor-commits - lists.torproject.org

[tor/master] Merge branch 'bug17109_v2_squashed'
by nickm＠torproject.org 22 Sep '15

22 Sep '15

commit 99f94feb6a778f16becbc8386bd7536840bc3ab7 Merge: b584152 ae98dd2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Sep 22 08:36:39 2015 -0400 Merge branch 'bug17109_v2_squashed' changes/bug17109 | 4 ++++ configure.ac | 13 +++++++++++++ 2 files changed, 17 insertions(+)

1 0

[tor/master] Check that openssl has ECC support during configure
by nickm＠torproject.org 22 Sep '15

22 Sep '15

commit ae98dd255b3db5585c0eab17dab702f72046ee57 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sat Sep 19 16:36:55 2015 +0200 Check that openssl has ECC support during configure This allows builds on machines with a crippled openssl to fail early during configure. Bugfix on 0.2.7.1-alpha, which introduced the requirement for ECC support. Fixes bug 17109. --- changes/bug17109 | 4 ++++ configure.ac | 13 +++++++++++++ 2 files changed, 17 insertions(+) diff --git a/changes/bug17109 b/changes/bug17109 new file mode 100644 index 0000000..9f80f6e --- /dev/null +++ b/changes/bug17109 @@ -0,0 +1,4 @@ + o Minor bugfixes: + - Fail during configure if we're trying to build against an OpenSSL + built without ECC support. Fixes bug 17109, bugfix on + 0.2.7.1-alpha which started requiring ECC. diff --git a/configure.ac b/configure.ac index bf818ac..2220c18 100644 --- a/configure.ac +++ b/configure.ac @@ -642,6 +642,19 @@ AC_TRY_COMPILE([ [ : ], [ AC_ERROR([OpenSSL is too old. We require 1.0.0 or later. You can specify a path to a newer one with --with-openssl-dir.]) ]) +AC_TRY_COMPILE([ +#include <openssl/opensslv.h> +#include <openssl/evp.h> +#if defined(OPENSSL_NO_EC) || defined(OPENSSL_NO_ECDH) || defined(OPENSSL_NO_ECDSA) +#error "no ECC" +#endif +#if !defined(NID_X9_62_prime256v1) || !defined(NID_secp224r1) +#error "curves unavailable" +#endif + ], [], + [ : ], + [ AC_ERROR([OpenSSL is built without full ECC support, including curves P256 and P224. You can specify a path to one with ECC support with --with-openssl-dir.]) ]) + AC_CHECK_MEMBERS([struct ssl_method_st.get_cipher_by_char], , , [#include <openssl/ssl.h> ])

1 0

[tor/master] Update docs with advice for separate IPv4 and IPv6 exit policies
by nickm＠torproject.org 22 Sep '15

22 Sep '15

commit 249e82c906bbab12ed7a1bdab7b89289fc6dcc1c Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Tue Sep 22 11:41:16 2015 +1000 Update docs with advice for separate IPv4 and IPv6 exit policies Advise users how to configure separate IPv4 and IPv6 exit policies in the manpage and sample torrcs. Related to fixes in ticket #16069 and #17027. Patch by "teor". Patch on 2eb7eafc9d78 and a96c0affcb4c (25 Oct 2012), released in 0.2.4.7-alpha. --- changes/ipv6-exitpolicy-docs | 8 ++++++++ doc/tor.1.txt | 10 +++++++--- src/config/torrc.minimal.in-staging | 16 +++++++++++----- src/config/torrc.sample.in | 16 +++++++++++----- 4 files changed, 37 insertions(+), 13 deletions(-) diff --git a/changes/ipv6-exitpolicy-docs b/changes/ipv6-exitpolicy-docs new file mode 100644 index 0000000..033c283 --- /dev/null +++ b/changes/ipv6-exitpolicy-docs @@ -0,0 +1,8 @@ + o Minor bug fixes (documentation, torrc exit policies): + - Advise users how to configure separate IPv4 and IPv6 exit + policies in the manpage and sample torrcs. + - Fixup formatting errors in the documentation changes from + tickets #16069 and #17027. + Related to fixes in ticket #16069 and #17027. Patch by "teor". + Patch on 2eb7eafc9d78 and a96c0affcb4c (25 Oct 2012), + released in 0.2.4.7-alpha. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 736cf75..38d0990 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1570,9 +1570,13 @@ is non-zero): all on one line. + + Policies are considered first to last, and the first match wins. If you - want to \_replace_ the default exit policy, end your exit policy with - either a reject \*:* or an accept \*:*. Otherwise, you're \_augmenting_ - (prepending to) the default exit policy. The default exit policy is: + + want to allow the same ports on IPv4 and IPv6, write your rules using + accept/reject *. If you want to allow different ports on IPv4 and IPv6, + write your IPv6 rules using accept6/reject6 *6, and your IPv4 rules using + accept/reject *4. If you want to \_replace_ the default exit policy, end + your exit policy with either a reject \*:* or an accept \*:*. Otherwise, + you're \_augmenting_ (prepending to) the default exit policy. The default + exit policy is: + reject *:25 reject *:119 diff --git a/src/config/torrc.minimal.in-staging b/src/config/torrc.minimal.in-staging index ed3300f..e3b528f 100644 --- a/src/config/torrc.minimal.in-staging +++ b/src/config/torrc.minimal.in-staging @@ -1,5 +1,5 @@ ## Configuration file for a typical Tor user -## Last updated 15 September 2015 for Tor 0.2.7.3-alpha. +## Last updated 22 September 2015 for Tor 0.2.7.3-alpha. ## (may or may not work for much older or much newer versions of Tor.) ## ## Lines that begin with "## " try to explain what's going on. Lines @@ -157,10 +157,16 @@ #MyFamily $keyid,$keyid,... ## A comma-separated list of exit policies. They're considered first -## to last, and the first match wins. If you want to _replace_ -## the default exit policy, end this with either a reject *:* or an -## accept *:*. Otherwise, you're _augmenting_ (prepending to) the -## default exit policy. Leave commented to just use the default, which is +## to last, and the first match wins. +## +## If you want to allow the same ports on IPv4 and IPv6, write your rules +## using accept/reject *. If you want to allow different ports on IPv4 and +## IPv6, write your IPv6 rules using accept6/reject6 *6, and your IPv4 rules +## using accept/reject *4. +## +## If you want to _replace_ the default exit policy, end this with either a +## reject *:* or an accept *:*. Otherwise, you're _augmenting_ (prepending to) +## the default exit policy. Leave commented to just use the default, which is ## described in the man page or at ## https://www.torproject.org/documentation.html ## diff --git a/src/config/torrc.sample.in b/src/config/torrc.sample.in index ed3300f..e3b528f 100644 --- a/src/config/torrc.sample.in +++ b/src/config/torrc.sample.in @@ -1,5 +1,5 @@ ## Configuration file for a typical Tor user -## Last updated 15 September 2015 for Tor 0.2.7.3-alpha. +## Last updated 22 September 2015 for Tor 0.2.7.3-alpha. ## (may or may not work for much older or much newer versions of Tor.) ## ## Lines that begin with "## " try to explain what's going on. Lines @@ -157,10 +157,16 @@ #MyFamily $keyid,$keyid,... ## A comma-separated list of exit policies. They're considered first -## to last, and the first match wins. If you want to _replace_ -## the default exit policy, end this with either a reject *:* or an -## accept *:*. Otherwise, you're _augmenting_ (prepending to) the -## default exit policy. Leave commented to just use the default, which is +## to last, and the first match wins. +## +## If you want to allow the same ports on IPv4 and IPv6, write your rules +## using accept/reject *. If you want to allow different ports on IPv4 and +## IPv6, write your IPv6 rules using accept6/reject6 *6, and your IPv4 rules +## using accept/reject *4. +## +## If you want to _replace_ the default exit policy, end this with either a +## reject *:* or an accept *:*. Otherwise, you're _augmenting_ (prepending to) +## the default exit policy. Leave commented to just use the default, which is ## described in the man page or at ## https://www.torproject.org/documentation.html ##

1 0

[tor/master] Add IPv6 syntax to ExitPolicy intro paragraph in man page
by nickm＠torproject.org 22 Sep '15

22 Sep '15

commit 726852514211cf707e7b811a5393e3bfbb4dba11 Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Tue Sep 22 11:44:13 2015 +1000 Add IPv6 syntax to ExitPolicy intro paragraph in man page --- doc/tor.1.txt | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 38d0990..29a9f63 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1529,9 +1529,11 @@ is non-zero): [[ExitPolicy]] **ExitPolicy** __policy__,__policy__,__...__:: Set an exit policy for this server. Each policy is of the form - "**accept**|**reject** __ADDR__[/__MASK__][:__PORT__]". If /__MASK__ is + "**accept[6]**|**reject[6]** __ADDR__[/__MASK__][:__PORT__]". If /__MASK__ is omitted then this policy just applies to the host given. Instead of giving - a host or network you can also use "\*" to denote the universe (0.0.0.0/0). + a host or network you can also use "\*" to denote the universe (0.0.0.0/0 + and ::/128), or \*4 to denote all IPv4 addresses, and \*6 to denote all + IPv6 addresses. __PORT__ can be a single port number, an interval of ports "__FROM_PORT__-__TO_PORT__", or "\*". If __PORT__ is omitted, that means "\*". +

1 0

[tor/master] Update private ExitPolicy in man page and torrcs for 10727, formatting
by nickm＠torproject.org 22 Sep '15

22 Sep '15

commit b584152874b57e36533ec35bc7c2d38cabf832bf Author: teor (Tim Wilson-Brown) <teor2345(a)gmail.com> Date: Tue Sep 22 11:50:04 2015 +1000 Update private ExitPolicy in man page and torrcs for 10727, formatting Update the definition of the private exit policy in the man page and torrcs. It didn't get merged correctly into the man page, and it was incomplete in the torrcs. (Unfortunately, we only reject the primary configured IPv4 and IPv6 addresses, not all configured IPv4 and IPv6 addresses.) Also fixup msn page formatting errors from changes in tickets 16069 and 17027, mainly unescaped *s. --- doc/tor.1.txt | 25 ++++++++++++++----------- src/config/torrc.minimal.in-staging | 2 +- src/config/torrc.sample.in | 2 +- 3 files changed, 16 insertions(+), 13 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 29a9f63..6fab7f2 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1529,7 +1529,7 @@ is non-zero): [[ExitPolicy]] **ExitPolicy** __policy__,__policy__,__...__:: Set an exit policy for this server. Each policy is of the form - "**accept[6]**|**reject[6]** __ADDR__[/__MASK__][:__PORT__]". If /__MASK__ is + "**accept[6]**|**reject[6]** __ADDR__[/__MASK__][:__PORT__]". If /__MASK__ is omitted then this policy just applies to the host given. Instead of giving a host or network you can also use "\*" to denote the universe (0.0.0.0/0 and ::/128), or \*4 to denote all IPv4 addresses, and \*6 to denote all @@ -1542,15 +1542,15 @@ is non-zero): reject any IPv4 traffic destined for MIT except for web.mit.edu, and accept any other IPv4 or IPv6 traffic. + + - Tor also allows IPv6 exit policy entries. For instance, "reject6 [FC00::]/7:*" + Tor also allows IPv6 exit policy entries. For instance, "reject6 [FC00::]/7:\*" rejects all destinations that share 7 most significant bit prefix with - address FC00::. Respectively, "accept6 [C000::]/3:*" accepts all destinations + address FC00::. Respectively, "accept6 [C000::]/3:\*" accepts all destinations that share 3 most significant bit prefix with address C000::. + + accept6 and reject6 only produce IPv6 exit policy entries. Using an IPv4 address with accept6 or reject6 is ignored and generates a warning. - accept/reject allows either IPv4 or IPv6 addresses. Use *4 as an IPv4 - wildcard address, and *6 as an IPv6 wildcard address. accept/reject * + accept/reject allows either IPv4 or IPv6 addresses. Use \*4 as an IPv4 + wildcard address, and \*6 as an IPv6 wildcard address. accept/reject * expands to matching IPv4 and IPv6 wildcard address rules. + + To specify all IPv4 and IPv6 internal and link-local networks (including @@ -1558,9 +1558,12 @@ is non-zero): 172.16.0.0/12, [::]/8, [FC00::]/7, [FE80::]/10, [FEC0::]/10, [FF00::]/8, and [::]/127), you can use the "private" alias instead of an address. ("private" always produces rules for IPv4 and IPv6 addresses, even when - used with accept6/reject6.) - These addresses are rejected by default (at the beginning of your exit - policy), along with your public IP address, unless you set the + used with accept6/reject6.) + + + + Private addresses are rejected by default (at the beginning of your exit + policy), along with the configured primary public IPv4 and IPv6 addresses, + and any public IPv4 and IPv6 addresses on any interface on the relay. + These private addresses are rejected unless you set the ExitPolicyRejectPrivate config option to 0. For example, once you've done that, you could allow HTTP to 127.0.0.1 and block all other connections to internal networks with "accept 127.0.0.1:80,reject private:\*", though that @@ -1573,9 +1576,9 @@ is non-zero): + Policies are considered first to last, and the first match wins. If you want to allow the same ports on IPv4 and IPv6, write your rules using - accept/reject *. If you want to allow different ports on IPv4 and IPv6, - write your IPv6 rules using accept6/reject6 *6, and your IPv4 rules using - accept/reject *4. If you want to \_replace_ the default exit policy, end + accept/reject \*. If you want to allow different ports on IPv4 and IPv6, + write your IPv6 rules using accept6/reject6 \*6, and your IPv4 rules using + accept/reject \*4. If you want to \_replace_ the default exit policy, end your exit policy with either a reject \*:* or an accept \*:*. Otherwise, you're \_augmenting_ (prepending to) the default exit policy. The default exit policy is: + diff --git a/src/config/torrc.minimal.in-staging b/src/config/torrc.minimal.in-staging index e3b528f..ff324a9 100644 --- a/src/config/torrc.minimal.in-staging +++ b/src/config/torrc.minimal.in-staging @@ -178,7 +178,7 @@ ## users will be told that those destinations are down. ## ## For security, by default Tor rejects connections to private (local) -## networks, including to the configured public IPv4 and IPv6 addresses, +## networks, including to the configured primary public IPv4 and IPv6 addresses, ## and any public IPv4 and IPv6 addresses on any interface on the relay. ## See the man page entry for ExitPolicyRejectPrivate if you want to allow ## "exit enclaving". diff --git a/src/config/torrc.sample.in b/src/config/torrc.sample.in index e3b528f..ff324a9 100644 --- a/src/config/torrc.sample.in +++ b/src/config/torrc.sample.in @@ -178,7 +178,7 @@ ## users will be told that those destinations are down. ## ## For security, by default Tor rejects connections to private (local) -## networks, including to the configured public IPv4 and IPv6 addresses, +## networks, including to the configured primary public IPv4 and IPv6 addresses, ## and any public IPv4 and IPv6 addresses on any interface on the relay. ## See the man page entry for ExitPolicyRejectPrivate if you want to allow ## "exit enclaving".

1 0

[translation/tor-messenger-ircproperties] Update translations for tor-messenger-ircproperties
by translation＠torproject.org 22 Sep '15

22 Sep '15

commit 5428cd5e4bc718c9a8453df550cf9b4000cf6915 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Sep 22 11:46:26 2015 +0000 Update translations for tor-messenger-ircproperties --- sq/irc.properties | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sq/irc.properties b/sq/irc.properties index b26ca8e..ed8b540 100644 --- a/sq/irc.properties +++ b/sq/irc.properties @@ -6,12 +6,12 @@ # This is displayed inside the accountUsernameInfoWithDescription # string defined in imAccounts.properties when the user is # configuring an IRC account. -irc.usernameHint=nick +irc.usernameHint=pseudonim # LOCALIZATION NOTE (connection.error.*): # These will show in the account manager if the account is # disconnected because of an error. -connection.error.lost=Lost connection with server +connection.error.lost=Është humbur lidhja me shërbyesin. connection.error.timeOut=Connection timed out connection.error.invalidUsername=%S is not an allowed username connection.error.invalidPassword=Invalid server password

1 0

[translation/tor-messenger-privdtd_completed] Update translations for tor-messenger-privdtd_completed
by translation＠torproject.org 22 Sep '15

22 Sep '15

commit 78fbbe281feebc0236369005ca3c3d92c1aa71a5 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Sep 22 07:16:54 2015 +0000 Update translations for tor-messenger-privdtd_completed --- sq/priv.dtd | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sq/priv.dtd b/sq/priv.dtd new file mode 100644 index 0000000..a5a3890 --- /dev/null +++ b/sq/priv.dtd @@ -0,0 +1,2 @@ +<!ENTITY privDialog.title "Krijimi i çelësave personalë"> +<!ENTITY privDialog.done "Kryer"> \ No newline at end of file

1 0

[translation/tor-messenger-privdtd] Update translations for tor-messenger-privdtd
by translation＠torproject.org 22 Sep '15

22 Sep '15

commit de8aaf7b91c91425e88c2f5af69e31dc173caafc Author: Translation commit bot <translation(a)torproject.org> Date: Tue Sep 22 07:16:50 2015 +0000 Update translations for tor-messenger-privdtd --- sq/priv.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sq/priv.dtd b/sq/priv.dtd index fbc319d..a5a3890 100644 --- a/sq/priv.dtd +++ b/sq/priv.dtd @@ -1,2 +1,2 @@ -<!ENTITY privDialog.title "Generating private key"> +<!ENTITY privDialog.title "Krijimi i çelësave personalë"> <!ENTITY privDialog.done "Kryer"> \ No newline at end of file

1 0

[translation/tor-messenger-privproperties_completed] Update translations for tor-messenger-privproperties_completed
by translation＠torproject.org 22 Sep '15

22 Sep '15

commit 7ccfe518a596ea722651fec555b1024ba7f9aba0 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Sep 22 07:16:46 2015 +0000 Update translations for tor-messenger-privproperties_completed --- sq/priv.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sq/priv.properties b/sq/priv.properties index 543e7b1..f515ae3 100644 --- a/sq/priv.properties +++ b/sq/priv.properties @@ -1 +1 @@ -priv.account=Duke gjeneruar çelësa personalë për %S (%S) ... +priv.account=Duke krijuar çelësa personalë për %S (%S) ...

1 0

[tor-commits] [translation/tor-messenger-loggerproperties_completed] Update translations for tor-messenger-loggerproperties_completed
by translation＠torproject.org 22 Sep '15

22 Sep '15

commit 2f646b34d9931da82ea6538ea4cba708a473c8f9 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Sep 22 07:16:41 2015 +0000 Update translations for tor-messenger-loggerproperties_completed --- sq/logger.properties | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/sq/logger.properties b/sq/logger.properties new file mode 100644 index 0000000..4364fbd --- /dev/null +++ b/sq/logger.properties @@ -0,0 +1,7 @@ +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +# LOCALIZATION NOTE (badLogfile): +# %S is the filename of the log file. +badLogfile=Skedar regjistri i zbrazët ose i dëntuar: %S

1 0