January 2016 - tor-commits - lists.torproject.org

[tor/master] Refine the memwipe() arguments check for 18089 a little more.
by nickm＠torproject.org 19 Jan '16

19 Jan '16

commit e2efa9e321972709933b6b9a68da035e1a91aa08 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 19 08:28:58 2016 -0500 Refine the memwipe() arguments check for 18089 a little more. We still silently ignore memwipe(NULL, ch, 0); and memwipe(ptr, ch, 0); /* for ptr != NULL */ But we now assert on: memwipe(NULL, ch, 30); --- src/common/crypto.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 4e0b383..8402ca0 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -3030,9 +3030,11 @@ base32_decode(char *dest, size_t destlen, const char *src, size_t srclen) void memwipe(void *mem, uint8_t byte, size_t sz) { - if (mem == NULL || sz == 0) { + if (sz == 0) { return; } + /* If sz is nonzero, then mem must not be NULL. */ + tor_assert(mem != NULL); /* Data this large is likely to be an underflow. */ tor_assert(sz < SIZE_T_CEILING);

1 0

[tor/master] Merge branch 'maint-0.2.6' into maint-0.2.7
by nickm＠torproject.org 19 Jan '16

19 Jan '16

commit 534a0ba59b4d772b0e3e6a1dfc5050d534fdb9fc Merge: 8335b1f e2efa9e Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 19 08:30:39 2016 -0500 Merge branch 'maint-0.2.6' into maint-0.2.7 src/common/crypto.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

[tor/master] Merge branch 'maint-0.2.7'
by nickm＠torproject.org 19 Jan '16

19 Jan '16

commit f557a7f327d6574018f836e6d7ba767a6082c491 Merge: 7b6d7aa 534a0ba Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 19 08:30:48 2016 -0500 Merge branch 'maint-0.2.7' src/common/crypto.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

[tor/maint-0.2.6] Refine the memwipe() arguments check for 18089 a little more.
by nickm＠torproject.org 19 Jan '16

19 Jan '16

commit e2efa9e321972709933b6b9a68da035e1a91aa08 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Jan 19 08:28:58 2016 -0500 Refine the memwipe() arguments check for 18089 a little more. We still silently ignore memwipe(NULL, ch, 0); and memwipe(ptr, ch, 0); /* for ptr != NULL */ But we now assert on: memwipe(NULL, ch, 30); --- src/common/crypto.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index 4e0b383..8402ca0 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -3030,9 +3030,11 @@ base32_decode(char *dest, size_t destlen, const char *src, size_t srclen) void memwipe(void *mem, uint8_t byte, size_t sz) { - if (mem == NULL || sz == 0) { + if (sz == 0) { return; } + /* If sz is nonzero, then mem must not be NULL. */ + tor_assert(mem != NULL); /* Data this large is likely to be an underflow. */ tor_assert(sz < SIZE_T_CEILING);

1 0

[tor-browser-bundle/hardened-builds] Update port for ndnop3 obfs4 bridge and add new ndnop5 obfs4 brige.
by gk＠torproject.org 19 Jan '16

19 Jan '16

commit 4a27862b00cc8dce3ed9288dedb938b0fe0e8c05 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Jan 18 13:53:58 2016 -0800 Update port for ndnop3 obfs4 bridge and add new ndnop5 obfs4 brige. ndnop3 is listening on a new port. It will continue listening on its old port too. ndnop5 is a new bridge with a different fingerprint. --- Bundle-Data/PTConfigs/bridge_prefs.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index f4a8448..685c651 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -21,9 +21,10 @@ pref("extensions.torlauncher.default_bridge.fte-ipv6.2", "fte [2001:49f0:d00a:1: pref("extensions.torlauncher.default_bridge.scramblesuit.1", "scramblesuit 83.212.101.3:443 A09D536DD1752D542E1FBB3C9CE4449D51298239 password=XTCXLG2JAMJKZW2POLBAOWOQETQSMASH"); pref("extensions.torlauncher.default_bridge.obfs4.1", "obfs4 198.245.60.50:443 752CF7825B3B9EA6A98C83AC41F7099D67007EA5 cert=xpmQtKUqQ/6v5X7ijgYE/f03+l2/EuQ1dexjyUhh16wQlu/cpXUGalmhDIlhuiQPNEKmKw iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.2", "obfs4 109.105.109.165:24215 8DFCD8FB3285E855F5A55EDDA35696C743ABFC4E cert=Bvg/itxeL4TWKLP6N1MaQzSOC6tcRIBv6q57DYAZc3b2AzuM+/TfB7mqTFEfXILCjEwzVA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.2", "obfs4 109.105.109.165:10527 8DFCD8FB3285E855F5A55EDDA35696C743ABFC4E cert=Bvg/itxeL4TWKLP6N1MaQzSOC6tcRIBv6q57DYAZc3b2AzuM+/TfB7mqTFEfXILCjEwzVA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.3", "obfs4 83.212.101.3:41213 A09D536DD1752D542E1FBB3C9CE4449D51298239 cert=lPRQ/MXdD1t5SRZ9MquYQNT9m5DV757jtdXdlePmRCudUU9CFUOX1Tm7/meFSyPOsud7Cw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.4", "obfs4 104.131.108.182:56880 EF577C30B9F788B0E1801CF7E433B3B77792B77A cert=0SFhfDQrKjUJP8Qq6wrwSICEPf3Vl/nJRsYxWbg3QRoSqhl2EB78MPS2lQxbXY4EW1wwXA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.5", "obfs4 109.105.109.147:13764 BBB28DF0F201E706BE564EFE690FE9577DD8386D cert=KfMQN/tNMFdda61hMgpiMI7pbwU1T+wxjTulYnfw+4sgvG0zSH7N7fwT10BI8MUdAD7iJA iat-mode=0"); pref("extensions.torlauncher.default_bridge.meek-google.1", "meek 0.0.2.0:1 46D4A71197B8FA515A826C6B017C522FE264655B url=https://meek-reflect.appspot.com/ front=www.google.com"); pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com");

1 0

[tor-browser-bundle/master] Update port for ndnop3 obfs4 bridge and add new ndnop5 obfs4 brige.
by gk＠torproject.org 19 Jan '16

19 Jan '16

commit 7699096ba7eacbd5e13bcf9abe2601a42da0b45d Author: David Fifield <david(a)bamsoftware.com> Date: Mon Jan 18 13:53:58 2016 -0800 Update port for ndnop3 obfs4 bridge and add new ndnop5 obfs4 brige. ndnop3 is listening on a new port. It will continue listening on its old port too. ndnop5 is a new bridge with a different fingerprint. --- Bundle-Data/PTConfigs/bridge_prefs.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index f4a8448..685c651 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -21,9 +21,10 @@ pref("extensions.torlauncher.default_bridge.fte-ipv6.2", "fte [2001:49f0:d00a:1: pref("extensions.torlauncher.default_bridge.scramblesuit.1", "scramblesuit 83.212.101.3:443 A09D536DD1752D542E1FBB3C9CE4449D51298239 password=XTCXLG2JAMJKZW2POLBAOWOQETQSMASH"); pref("extensions.torlauncher.default_bridge.obfs4.1", "obfs4 198.245.60.50:443 752CF7825B3B9EA6A98C83AC41F7099D67007EA5 cert=xpmQtKUqQ/6v5X7ijgYE/f03+l2/EuQ1dexjyUhh16wQlu/cpXUGalmhDIlhuiQPNEKmKw iat-mode=0"); -pref("extensions.torlauncher.default_bridge.obfs4.2", "obfs4 109.105.109.165:24215 8DFCD8FB3285E855F5A55EDDA35696C743ABFC4E cert=Bvg/itxeL4TWKLP6N1MaQzSOC6tcRIBv6q57DYAZc3b2AzuM+/TfB7mqTFEfXILCjEwzVA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.2", "obfs4 109.105.109.165:10527 8DFCD8FB3285E855F5A55EDDA35696C743ABFC4E cert=Bvg/itxeL4TWKLP6N1MaQzSOC6tcRIBv6q57DYAZc3b2AzuM+/TfB7mqTFEfXILCjEwzVA iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.3", "obfs4 83.212.101.3:41213 A09D536DD1752D542E1FBB3C9CE4449D51298239 cert=lPRQ/MXdD1t5SRZ9MquYQNT9m5DV757jtdXdlePmRCudUU9CFUOX1Tm7/meFSyPOsud7Cw iat-mode=0"); pref("extensions.torlauncher.default_bridge.obfs4.4", "obfs4 104.131.108.182:56880 EF577C30B9F788B0E1801CF7E433B3B77792B77A cert=0SFhfDQrKjUJP8Qq6wrwSICEPf3Vl/nJRsYxWbg3QRoSqhl2EB78MPS2lQxbXY4EW1wwXA iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.5", "obfs4 109.105.109.147:13764 BBB28DF0F201E706BE564EFE690FE9577DD8386D cert=KfMQN/tNMFdda61hMgpiMI7pbwU1T+wxjTulYnfw+4sgvG0zSH7N7fwT10BI8MUdAD7iJA iat-mode=0"); pref("extensions.torlauncher.default_bridge.meek-google.1", "meek 0.0.2.0:1 46D4A71197B8FA515A826C6B017C522FE264655B url=https://meek-reflect.appspot.com/ front=www.google.com"); pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2zfqthxsdq309.cloudfront.net/ front=a0.awsstatic.com");

1 0

[snowflake/master] Remove the default -http option from server/torrc.
by dcf＠torproject.org 19 Jan '16

19 Jan '16

commit 5279e32e3e72771978fecf151498c4b1bd05dc7b Author: David Fifield <david(a)bamsoftware.com> Date: Mon Jan 18 23:03:42 2016 -0800 Remove the default -http option from server/torrc. We'll ask people to insert it manually if they want to test that way. --- server/torrc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/torrc b/server/torrc index db54242..44b5964 100644 --- a/server/torrc +++ b/server/torrc @@ -5,4 +5,4 @@ SocksPort 0 ExitPolicy reject *:* DataDirectory datadir -ServerTransportPlugin snowflake exec ./server -http 127.0.0.1:8080 +ServerTransportPlugin snowflake exec ./server

1 0

[snowflake/master] Simpler instructions now for connecting directly to WebRTC server.
by dcf＠torproject.org 19 Jan '16

19 Jan '16

commit ff5d23b08c7d6301f06c478052cb7f8fea3f2f5b Author: David Fifield <david(a)bamsoftware.com> Date: Mon Jan 18 23:07:22 2016 -0800 Simpler instructions now for connecting directly to WebRTC server. --- README.md | 48 ++++++++++++++++++++++++++---------------------- 1 file changed, 26 insertions(+), 22 deletions(-) diff --git a/README.md b/README.md index b1b35b4..7b6ca9f 100644 --- a/README.md +++ b/README.md @@ -14,48 +14,52 @@ There are currently two ways to try this: - Directly to the go-webrtc server plugin. - Through a browser snowflake proxy. -Using the server plugin requires copy and pasting between 6 terminals. +Using the server plugin uses an HTTP server that simulates the interaction +that a client would have with a facilitator. Using the browser proxy (which will soon be the only way) requires copy and pasting between 3 terminals and a browser tab. Once a signalling facilitator is implemented ([issue #1](https://github.com/keroserene/snowflake/issues/1)) this will become much simpler to use. -Setting up the client is the same in both cases. -Open up three terminals for the **client:** +##### -- Via WebRTC Server -- +Edit server/torrc and add "-http 127.0.0.1:8080" to the end of the +ServerTransportPlugin line: ``` -cd client/ -go build +ServerTransportPlugin snowflake exec ./server -http 127.0.0.1:8080 ``` -A: `tor -f torrc SOCKSPort auto` - -B: `cat > signal` - -C: `tail -F snowflake.log` - -##### -- Via WebRTC Server -- +``` +cd server/ +go build +tor -f torrc +``` -To connect directly to a server plugin, -open up another three terminals for the **server:** +Edit client/torrc and add "-url http://127.0.0.1:8080" to the end of the +ClientTransportPlugin line: +``` +ClientTransportPlugin snowflake exec ./client -url http://127.0.0.1:8080/ +``` ``` -cd server/ +cd client/ go build +tor -f torrc ``` -D: `tor -f torrc` +At this point the tor client should bootstrap to 100%. -E: `cat > signal` +##### -- Via Browser Proxy -- -F: `tail -F snowflake.log` +Open up three terminals for the **client:** -- Look for the offer in terminal C; copy and paste it into terminal E. -- Copy and paste the answer in terminal F to terminal B. -- At this point the tor client should bootstrap to 100%. +A: `tor -f torrc SOCKSPort auto` + +B: `cat > signal` + +C: `tail -F snowflake.log` -##### -- Via Browser Proxy -- To connect through the WebRTC browser proxy, first make sure coffeescript is installed. Then, build with:

1 0

[snowflake/master] Do simple HTTP POST signaling in the client.
by dcf＠torproject.org 19 Jan '16

19 Jan '16

commit e0b36d2f33ba39ec70a3014c0d49c0fc29751f92 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Jan 18 22:53:22 2016 -0800 Do simple HTTP POST signaling in the client. This is just enough to be compatible with the HTTP signaling in the server, and doesn't do domain fronting or anything like that. It's just an interim replacement for the copy-paste FIFO signaling while we continue to develop the other pieces that'll be dropped in the middle. --- client/meek-webrtc.go | 16 ++++++++++++++++ client/snowflake.go | 31 ++++++++++++++++++++++--------- 2 files changed, 38 insertions(+), 9 deletions(-) diff --git a/client/meek-webrtc.go b/client/meek-webrtc.go index 6a50bd1..d783781 100644 --- a/client/meek-webrtc.go +++ b/client/meek-webrtc.go @@ -82,3 +82,19 @@ func (m *MeekChannel) Negotiate(offer *webrtc.SessionDescription) ( answer := webrtc.DeserializeSessionDescription(string(body)) return answer, nil } + +// Simple interim non-fronting HTTP POST negotiation, to be removed when more +// general fronting is present. +func sendOfferHTTP(url string, offer *webrtc.SessionDescription) (*webrtc.SessionDescription, error) { + resp, err := http.Post(url, "", bytes.NewBuffer([]byte(offer.Serialize()))) + if err != nil { + return nil, err + } + defer resp.Body.Close() + body, err := ioutil.ReadAll(resp.Body) + if err != nil { + return nil, err + } + answer := webrtc.DeserializeSessionDescription(string(body)) + return answer, nil +} diff --git a/client/snowflake.go b/client/snowflake.go index 6bf6fe5..b42b17d 100644 --- a/client/snowflake.go +++ b/client/snowflake.go @@ -5,6 +5,7 @@ package main import ( "bufio" + "flag" "fmt" "io" "log" @@ -30,6 +31,7 @@ const ( var ptInfo pt.ClientInfo var logFile *os.File +var offerURL string // When a connection handler starts, +1 is written to this channel; when it // ends, -1 is written. @@ -177,15 +179,23 @@ func dialWebRTC(config *webrtc.Configuration, meek *MeekChannel) ( fmt.Fprintln(logFile, "\n"+offer.Serialize()+"\n") log.Printf("----------------") go func() { - log.Printf("Sending offer via meek...") - answer, err := meek.Negotiate(pc.LocalDescription()) - if nil != err { - log.Printf("Signalling error: %s", err) - } - if nil == answer { - log.Printf("No answer received from meek channel.") - } else { - signalChan <- answer + // log.Printf("Sending offer via meek...") + // answer, err := meek.Negotiate(pc.LocalDescription()) + // if nil != err { + // log.Printf("Signalling error: %s", err) + // } + // if nil == answer { + // log.Printf("No answer received from meek channel.") + // } else { + // signalChan <- answer + // } + if offerURL != "" { + answer, err := sendOfferHTTP(offerURL, offer) + if err != nil { + log.Println(err) + } else { + signalChan <- answer + } } }() } @@ -307,6 +317,9 @@ func readSignalingMessages(f *os.File) { func main() { var err error + flag.StringVar(&offerURL, "url", "", "do signaling through URL") + flag.Parse() + logFile, err = os.OpenFile("snowflake.log", os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600) if err != nil { log.Fatal(err)

1 0

[snowflake/master] Remove unused notImplemented error.
by dcf＠torproject.org 19 Jan '16

19 Jan '16

commit c9eeff6fc2517e2f3f4fca064194f0458531d355 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Jan 18 22:39:18 2016 -0800 Remove unused notImplemented error. --- client/snowflake.go | 2 -- 1 file changed, 2 deletions(-) diff --git a/client/snowflake.go b/client/snowflake.go index da609b3..6bf6fe5 100644 --- a/client/snowflake.go +++ b/client/snowflake.go @@ -31,8 +31,6 @@ const ( var ptInfo pt.ClientInfo var logFile *os.File -var notImplemented = fmt.Errorf("not implemented") - // When a connection handler starts, +1 is written to this channel; when it // ends, -1 is written. var handlerChan = make(chan int)

1 0