February 2017 - tor-commits - lists.torproject.org

[onionoo/master] Don't require searches by IPv6 address to start with [.
by karsten＠torproject.org 28 Feb '17

28 Feb '17

commit 723e71a09ea6bfb8ebc4d4b40b51c2ff0aebd510 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Sat Jan 7 10:50:52 2017 +0100 Don't require searches by IPv6 address to start with [. Implements #16552. --- CHANGELOG.md | 7 +++++ .../torproject/onionoo/server/RequestHandler.java | 3 +- .../torproject/onionoo/server/ResourceServlet.java | 18 ++++++++--- .../torproject/onionoo/server/ResponseBuilder.java | 4 +-- src/main/resources/web/index.html | 10 +++---- .../onionoo/server/ResourceServletTest.java | 35 ++++++++++++++++++++++ 6 files changed, 65 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bd30ca0..465e145 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# Changes in version 4.0-x.x.x - 2017-xx-xx + + * Medium changes + - Accept searches by IPv6 addresses even without leading or + enclosing square brackets. + + # Changes in version 3.2-1.1.0 - 2017-01-27 * Major changes diff --git a/src/main/java/org/torproject/onionoo/server/RequestHandler.java b/src/main/java/org/torproject/onionoo/server/RequestHandler.java index 49e0259..98ece58 100644 --- a/src/main/java/org/torproject/onionoo/server/RequestHandler.java +++ b/src/main/java/org/torproject/onionoo/server/RequestHandler.java @@ -261,7 +261,8 @@ public class RequestHandler { } else { List<String> addresses = entry.getAddresses(); for (String address : addresses) { - if (address.startsWith(searchTerm.toLowerCase())) { + if (address.startsWith(searchTerm.toLowerCase()) + || address.startsWith("[" + searchTerm.toLowerCase())) { /* Address matches. */ lineMatches = true; break; diff --git a/src/main/java/org/torproject/onionoo/server/ResourceServlet.java b/src/main/java/org/torproject/onionoo/server/ResourceServlet.java index 9a4c679..c5fd949 100644 --- a/src/main/java/org/torproject/onionoo/server/ResourceServlet.java +++ b/src/main/java/org/torproject/onionoo/server/ResourceServlet.java @@ -75,6 +75,12 @@ public class ResourceServlet extends HttpServlet { new HashSet<>(Arrays.asList(("search,fingerprint,order,limit," + "offset,fields").split(","))); + private static String ipv6AddressPatternString = + "^\\[?[0-9a-fA-F:\\.]{1,39}\\]?$"; + + private static Pattern ipv6AddressPattern = + Pattern.compile(ipv6AddressPatternString); + /** Handles the HTTP GET request in the wrapped <code>request</code> by * writing an HTTP GET response to the likewise <code>response</code>, * both of which are wrapped to facilitate testing. */ @@ -150,13 +156,17 @@ public class ResourceServlet extends HttpServlet { } List<String> unqualifiedSearchTerms = new ArrayList<>(); for (String searchTerm : searchTerms) { - if (searchTerm.contains(":") && !searchTerm.startsWith("[")) { + if (searchTerm.contains(":")) { String[] parts = searchTerm.split(":", 2); String parameterKey = parts[0]; if (!knownParameters.contains(parameterKey) || illegalSearchQualifiers.contains(parameterKey)) { - response.sendError(HttpServletResponse.SC_BAD_REQUEST); - return; + if (ipv6AddressPattern.matcher(parameterKey).matches()) { + unqualifiedSearchTerms.add(searchTerm); + } else { + response.sendError(HttpServletResponse.SC_BAD_REQUEST); + return; + } } if (!parameterMap.containsKey(parameterKey)) { String parameterValue = parts[1]; @@ -369,7 +379,7 @@ public class ResourceServlet extends HttpServlet { Pattern.compile("^\\$?[0-9a-fA-F]{1,40}$|" /* Hex fingerprint. */ + "^[0-9a-zA-Z+/]{1,27}$|" /* Base64 fingerprint. */ + "^[0-9a-zA-Z\\.]{1,19}$|" /* Nickname or IPv4 address. */ - + "^\\[[0-9a-fA-F:\\.]{1,39}\\]?$|" /* IPv6 address. */ + + ipv6AddressPatternString + "|" /* IPv6 address. */ + "^[a-zA-Z_]+:\\p{Graph}+$" /* Qualified search term. */); protected static String[] parseSearchParameters(String queryString) { diff --git a/src/main/java/org/torproject/onionoo/server/ResponseBuilder.java b/src/main/java/org/torproject/onionoo/server/ResponseBuilder.java index e07868a..c9cec32 100644 --- a/src/main/java/org/torproject/onionoo/server/ResponseBuilder.java +++ b/src/main/java/org/torproject/onionoo/server/ResponseBuilder.java @@ -102,9 +102,9 @@ public class ResponseBuilder { return this.charsWritten; } - private static final String PROTOCOL_VERSION = "3.2"; + private static final String PROTOCOL_VERSION = "4.0"; - private static final String NEXT_MAJOR_VERSION_SCHEDULED = "2017-02-27"; + private static final String NEXT_MAJOR_VERSION_SCHEDULED = null; private void writeRelays(List<SummaryDocument> relays, PrintWriter pw) { this.write(pw, "{\"version\":\"%s\",\n", PROTOCOL_VERSION); diff --git a/src/main/resources/web/index.html b/src/main/resources/web/index.html index 6e863e5..d8fe74a 100644 --- a/src/main/resources/web/index.html +++ b/src/main/resources/web/index.html @@ -346,10 +346,9 @@ characters of a space-separated fingerprint on November 15, 2015.</li> <li>3.2: Extended order parameter to "first_seen" and added response meta data fields "relays_skipped", "relays_truncated", "bridges_skipped", and "bridges_truncated" on January 27, 2017.</li> -<li>4.0: (scheduled, but not deployed yet!): Extend -search parameter to not require leading or enclosing square brackets -around IPv6 addresses anymore, to be deployed by February 27, -2017.</li> +<li>4.0: Extended search parameter to not require +leading or enclosing square brackets around IPv6 addresses anymore on +February 28, 2017.</li> </ul> @@ -456,7 +455,8 @@ Return only (1) relays with the parameter value matching (part of a) nickname, (possibly $-prefixed) beginning of a hex-encoded fingerprint, any 4 hex characters of a space-separated fingerprint, beginning of a base64-encoded fingerprint without trailing equal signs, or beginning of -an IP address, (2) bridges with (part of a) nickname or (possibly +an IP address (possibly enclosed in square brackets in case of IPv6), +(2) bridges with (part of a) nickname or (possibly $-prefixed) beginning of a hashed hex-encoded fingerprint, and (3) relays and/or bridges matching a given qualified search term. Searches by relay IP address include all known addresses used for onion diff --git a/src/test/java/org/torproject/onionoo/server/ResourceServletTest.java b/src/test/java/org/torproject/onionoo/server/ResourceServletTest.java index e4a9e3d..a28c66b 100644 --- a/src/test/java/org/torproject/onionoo/server/ResourceServletTest.java +++ b/src/test/java/org/torproject/onionoo/server/ResourceServletTest.java @@ -707,6 +707,34 @@ public class ResourceServletTest { } @Test() + public void testSearchIpv6Slash64NoBrackets() { + this.assertSummaryDocument( + "/summary?search=2001:4f8:3:2e::", 1, + new String[] { "Ferrari458" }, 0, null); + } + + @Test() + public void testSearchIpv6Slash8Colon() { + this.assertSummaryDocument( + "/summary?search=[2001:", 1, + new String[] { "Ferrari458" }, 0, null); + } + + @Test() + public void testSearchIpv6Slash8NoColon() { + this.assertSummaryDocument( + "/summary?search=[2001", 1, + new String[] { "Ferrari458" }, 0, null); + } + + @Test() + public void testSearchIpv6Slash8NoColonNoBrackets() { + this.assertSummaryDocument( + "/summary?search=2001", 1, + new String[] { "Ferrari458" }, 0, null); + } + + @Test() public void testSearchIpv6Uncompressed() { this.assertSummaryDocument( "/summary?search=[2001:04f8:0003:002e:0000:0000:0000:0051]", 0, @@ -887,6 +915,13 @@ public class ResourceServletTest { this.assertErrorStatusCode("/summary?search=limit:1", 400); } + @Test() + public void testSearchDeadBeef() { + /* This does not return 400 Bad Request, even though "dead" is not a valid + * search term qualifier, because this could be the start of an IPv6 address + * without leading bracket. */ + this.assertSummaryDocument("/summary?search=dead:beef", 0, null, 0, null); + } @Test() public void testSearchEmailAddress() {

1 0

[metrics-web/master] Fix year in latest news entry.
by karsten＠torproject.org 28 Feb '17

28 Feb '17

commit 62db9706b49ef0f4348bddfdc0ec2380e3df6061 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Tue Feb 28 09:16:28 2017 +0100 Fix year in latest news entry. --- website/etc/news.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/website/etc/news.json b/website/etc/news.json index 47afd78..a593979 100644 --- a/website/etc/news.json +++ b/website/etc/news.json @@ -377,7 +377,7 @@ ] }, { - "start": "2016-02-10", + "start": "2017-02-10", "protocols": [ "<OR>", "exit"

1 0

[metrics-web/master] Update news.
by karsten＠torproject.org 28 Feb '17

28 Feb '17

commit f674f7aec0a165591b902791907d1806e8f1e348 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Tue Feb 28 09:11:50 2017 +0100 Update news. --- website/etc/news.json | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/website/etc/news.json b/website/etc/news.json index 629e7da..47afd78 100644 --- a/website/etc/news.json +++ b/website/etc/news.json @@ -377,6 +377,17 @@ ] }, { + "start": "2016-02-10", + "protocols": [ + "<OR>", + "exit" + ], + "description": "Measurement error from bandwidth authority causes decrease in measured bandwidth in Europe.", + "links": [ + "<a href=\"https://lists.torproject.org/pipermail/tor-project/2017-February/000963.htm…">mailing list post</a>" + ] + }, + { "start": "2016-02-24", "place": "tm", "protocols": [

1 0

[tor/master] Code to disable memory sentinels for fuzzing
by nickm＠torproject.org 27 Feb '17

27 Feb '17

commit b923c4dc9f011ab8f62e03211407d042dbe9f92a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 13 09:10:11 2017 -0500 Code to disable memory sentinels for fuzzing This feature makes it possible to turn off memory sentinels (like those used for safety in buffers.c and memarea.c) when fuzzing, so that we can catch bugs that they would otherwise prevent. --- changes/bug21439 | 7 ++++ configure.ac | 7 ++++ src/common/memarea.c | 91 ++++++++++++++++++++++++++++++++++++++++++++++++++++ src/or/buffers.c | 10 +++++- src/test/test_util.c | 7 ++++ 5 files changed, 121 insertions(+), 1 deletion(-) diff --git a/changes/bug21439 b/changes/bug21439 new file mode 100644 index 0000000..3acc53b --- /dev/null +++ b/changes/bug21439 @@ -0,0 +1,7 @@ + o Minor features (testing): + - Add a "--disable-memory-sentinels" feature to help with fuzzing. + When Tor is compiled with this option, we disable a number of + redundant memory-safety failsafes that are intended to stop + bugs from becoming security issues. This makes it easier to hunt + for bugs that would be security issues without the failsafes + turned on. Closes ticket 21439. diff --git a/configure.ac b/configure.ac index c9e0c2a..8adba3b 100644 --- a/configure.ac +++ b/configure.ac @@ -53,6 +53,8 @@ AC_ARG_ENABLE(libfuzzer, AS_HELP_STRING(--enable-libfuzzer, [build extra fuzzers based on 'libfuzzer'])) AC_ARG_ENABLE(oss-fuzz, AS_HELP_STRING(--enable-oss-fuzz, [build extra fuzzers based on 'oss-fuzz' environment])) +AC_ARG_ENABLE(memory-sentinels, + AS_HELP_STRING(--disable-memory-sentinels, [disable code that tries to prevent some kinds of memory access bugs. For fuzzing only.])) if test "x$enable_coverage" != "xyes" -a "x$enable_asserts_in_tests" = "xno" ; then AC_MSG_ERROR([Can't disable assertions outside of coverage build]) @@ -76,6 +78,11 @@ if test "$enable_system_torrc" = "no"; then [Defined if we're not going to look for a torrc in SYSCONF]) fi +if test "$enable_memory_sentinels" = "no"; then + AC_DEFINE(DISABLE_MEMORY_SENTINELS, 1, + [Defined if we're turning off memory safety code to look for bugs]) +fi + AM_CONDITIONAL(USE_OPENBSD_MALLOC, test "x$enable_openbsd_malloc" = "xyes") AC_ARG_ENABLE(asciidoc, diff --git a/src/common/memarea.c b/src/common/memarea.c index 7d16b70..12781e7 100644 --- a/src/common/memarea.c +++ b/src/common/memarea.c @@ -12,6 +12,9 @@ #include "util.h" #include "compat.h" #include "torlog.h" +#include "container.h" + +#ifndef DISABLE_MEMORY_SENTINELS /** If true, we try to detect any attempts to write beyond the length of a * memarea. */ @@ -304,3 +307,91 @@ memarea_assert_ok(memarea_t *area) } } +#else + +struct memarea_t { + smartlist_t *pieces; +}; + +memarea_t * +memarea_new(void) +{ + memarea_t *ma = tor_malloc_zero(sizeof(memarea_t)); + ma->pieces = smartlist_new(); + return ma; +} +void +memarea_drop_all(memarea_t *area) +{ + memarea_clear(area); + smartlist_free(area->pieces); + tor_free(area); +} +void +memarea_clear(memarea_t *area) +{ + SMARTLIST_FOREACH(area->pieces, void *, p, tor_free_(p)); + smartlist_clear(area->pieces); +} +int +memarea_owns_ptr(const memarea_t *area, const void *ptr) +{ + SMARTLIST_FOREACH(area->pieces, const void *, p, if (ptr == p) return 1;); + return 0; +} + +void * +memarea_alloc(memarea_t *area, size_t sz) +{ + void *result = tor_malloc(sz); + smartlist_add(area->pieces, result); + return result; +} + +void * +memarea_alloc_zero(memarea_t *area, size_t sz) +{ + void *result = tor_malloc_zero(sz); + smartlist_add(area->pieces, result); + return result; +} +void * +memarea_memdup(memarea_t *area, const void *s, size_t n) +{ + void *r = memarea_alloc(area, n); + memcpy(r, s, n); + return r; +} +char * +memarea_strdup(memarea_t *area, const char *s) +{ + size_t n = strlen(s); + char *r = memarea_alloc(area, n+1); + memcpy(r, s, n); + r[n] = 0; + return r; +} +char * +memarea_strndup(memarea_t *area, const char *s, size_t n) +{ + size_t ln = strnlen(s, n); + char *r = memarea_alloc(area, ln+1); + memcpy(r, s, ln); + r[ln] = 0; + return r; +} +void +memarea_get_stats(memarea_t *area, + size_t *allocated_out, size_t *used_out) +{ + (void)area; + *allocated_out = *used_out = 128; +} +void +memarea_assert_ok(memarea_t *area) +{ + (void)area; +} + +#endif + diff --git a/src/or/buffers.c b/src/or/buffers.c index 58ce573..40c7d68 100644 --- a/src/or/buffers.c +++ b/src/or/buffers.c @@ -83,7 +83,11 @@ static int parse_socks_client(const uint8_t *data, size_t datalen, #define CHUNK_HEADER_LEN STRUCT_OFFSET(chunk_t, mem[0]) /* We leave this many NUL bytes at the end of the buffer. */ +#ifdef DISABLE_MEMORY_SENTINELS +#define SENTINEL_LEN 0 +#else #define SENTINEL_LEN 4 +#endif /* Header size plus NUL bytes at the end */ #define CHUNK_OVERHEAD (CHUNK_HEADER_LEN + SENTINEL_LEN) @@ -97,18 +101,22 @@ static int parse_socks_client(const uint8_t *data, size_t datalen, #define DEBUG_SENTINEL -#ifdef DEBUG_SENTINEL +#if defined(DEBUG_SENTINEL) && !defined(DISABLE_MEMORY_SENTINELS) #define DBG_S(s) s #else #define DBG_S(s) (void)0 #endif +#ifdef DISABLE_MEMORY_SENTINELS +#define CHUNK_SET_SENTINEL(chunk, alloclen) STMT_NIL +#else #define CHUNK_SET_SENTINEL(chunk, alloclen) do { \ uint8_t *a = (uint8_t*) &(chunk)->mem[(chunk)->memlen]; \ DBG_S(uint8_t *b = &((uint8_t*)(chunk))[(alloclen)-SENTINEL_LEN]); \ DBG_S(tor_assert(a == b)); \ memset(a,0,SENTINEL_LEN); \ } while (0) +#endif /** Return the next character in chunk onto which data can be appended. * If the chunk is full, this might be off the end of chunk->mem. */ diff --git a/src/test/test_util.c b/src/test/test_util.c index fafb84f..2b1d488 100644 --- a/src/test/test_util.c +++ b/src/test/test_util.c @@ -3339,6 +3339,13 @@ test_util_memarea(void *arg) void *malloced_ptr = NULL; int i; +#ifdef DISABLE_MEMORY_SENTINELS + /* If memory sentinels are disabled, this whole module is just an alias for + malloc(), which is free to lay out memory most any way it wants. */ + if (1) + tt_skip(); +#endif + (void)arg; tt_assert(area);

1 0

[tor/master] Merge branch 'disable_memory_sentinels_squashed'
by nickm＠torproject.org 27 Feb '17

27 Feb '17

commit c0aa7ac5acd7b6f1d261a8a6eb5db2d3571e1f2f Merge: 4808540 b923c4d Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 27 16:25:25 2017 -0500 Merge branch 'disable_memory_sentinels_squashed' changes/bug21439 | 7 ++++ configure.ac | 7 ++++ src/common/memarea.c | 91 ++++++++++++++++++++++++++++++++++++++++++++++++++++ src/or/buffers.c | 10 +++++- src/test/test_util.c | 7 ++++ 5 files changed, 121 insertions(+), 1 deletion(-)

1 0

[webwml/master] Update GSoC page to say we're accepted
by atagar＠torproject.org 27 Feb '17

27 Feb '17

commit 1a9a1bc4b3ca15c522bd1e944f519ac437f0bebf Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Feb 27 12:00:28 2017 -0800 Update GSoC page to say we're accepted Time to pass along the good news! --- about/en/gsoc.wml | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/about/en/gsoc.wml b/about/en/gsoc.wml index 54ceddd..87fc838 100644 --- a/about/en/gsoc.wml +++ b/about/en/gsoc.wml @@ -17,14 +17,9 @@ The Tor Project, in collaboration with <a href="https://www.eff.org/">The Electronic Frontier Foundation</a>, have taken part in Google Summer of Code - for 2007 through 2016, mentoring the total of 64 students. We have applied - to <a href="https://summerofcode.withgoogle.com/">GSoC 2017</a>, and we - should know at the end of February whether we are in this year. -

1 0

[webwml/master] Core tor GSoC project ideas
by atagar＠torproject.org 27 Feb '17

27 Feb '17

commit b4db53b1539aa0dc92009c73d25e8c44de6f6e41 Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Feb 27 11:53:28 2017 -0800 Core tor GSoC project ideas Nick has been leading discussions with core tor folks concerning some GSoC project ideas. Adding what they've come up with... https://storm.torproject.org/shared/Xh2gRt-Oy__EaM8_4DAIhrYFMXbOnC09AfLGbHx… --- getinvolved/en/volunteer.wml | 169 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 168 insertions(+), 1 deletion(-) diff --git a/getinvolved/en/volunteer.wml b/getinvolved/en/volunteer.wml index e276865..3f70741 100644 --- a/getinvolved/en/volunteer.wml +++ b/getinvolved/en/volunteer.wml @@ -395,7 +395,14 @@ meetings around the world.</li> Project Ideas: - <a href="#improveHiddenServices">Help improve Tor hidden services</a> + <a href="#improveHiddenServices">Help improve Tor hidden services</a> + <a href="#torFuzzing">Fuzzing coverage of Tor</a> + <a href="#relayCryptoParallelism">Relay crypto parallelism</a> + <a href="#anonymousLocalCountStatistics">Anonymous local count statistics</a> + <a href="#improveSocks5Variant">Improved SOCKS5 variant</a> + <a href="#hiddenServiceCryptoParallelism">Hidden service crypto parallelism</a> + <a href="#supportAllDNS">Support all kinds of DNS in Tor</a> + <a href="#improveIpv6Support">Improve IPv6 support</a> <a id="project-torbrowser"></a> @@ -835,6 +842,166 @@ ideas. </li> + <a id="torFuzzing"></a> + <li> + Fuzzing coverage of Tor + + Likely Mentors: Nick (nickm), ahf, teor + + +Starting in 0.3.0.x, Tor supports a few fuzzing systems to check our +code for bugs. But as of now, we only support a few possible entry +points to Tor. It would be great to add fuzzing support for more of +our codebase -- ideally to include our whole network-facing interface. +That way, we could find more bugs in our code faster, and fix them +before they can get out of hand. + + + +This won't be so easy, however: to fuzz effectively, we need to +refactor or mock the target function so that it doesn't change any +global state, or verify any signatures, or take too long to run. With +lots of our network code, that's not so easy. Make sure you +understand how our mocking system works, and what the challenges are, +before you apply for this one. + + </li> + + <a id="relayCryptoParallelism"></a> + <li> + Relay crypto parallelism + + Likely Mentors: Isis, Nick (nickm) + + +Tor relays spend a lot of time encrypting and decrypting relay +traffic, doing SHA1 and AES-CTR operations. But right now, all of +this is done in the main thread! It would be cool to split this +across multiple cores instead. + + + +This won't be so easy though. The code today is written to expect +immediate results from its encryption operations, so you would need to +do some pretty tricky refactoring in order get performance and +correctness here. Make sure you understand how circuit crypto is +invoked today, and what the challenges are, before you apply for this +one. + + + +For more information <a href="https://trac.torproject.org/projects/tor/ticket/1749">see its ticket</a>. + + </li> + + <a id="anonymousLocalCountStatistics"></a> + <li> + Anonymous local count statistics + + Likely Mentors: Nick (nickm), teor + + +There are some places in Tor where we count things (like distinct IPs) +to later report anonymized statistics. But if the local Tor instance +were compromised, this data would be exposed. There are statistical +methods which insteasd allow us to record this data in a way that's +already anonymous, before we ever summarize it. Interested? + + + +For more information <a href="https://trac.torproject.org/projects/tor/ticket/7532">see its ticket</a>. + + </li> + + <a id="improveSocks5Variant"></a> + <li> + Improved SOCKS5 variant + + Likely Mentors: Nick (nickm), David Goulet (dgoulet) + + +In proposal 229, we describe a bunch of additional SOCKS extensions +that Tor-aware applications could use to get more fine-grained control +over how Tor handles their streams. It would be cool to implement +this! If there's time remaining, you might want to add support to one +or more applications. Or maybe to torsocks? + + + +For more information <a href="https://trac.torproject.org/projects/tor/ticket/12456">see its ticket</a>. + + </li> + + <a id="hiddenServiceCryptoParallelism"></a> + <li> + Hidden service crypto parallelism + + Likely Mentors: Nick (nickm), David Goulet (dgoulet) + + +Hidden services, hidden service clients, hidden service directories, +and introduction points all need to do a few public-key operations as +they operate. But right now, these operations are all done on the +main thread. It would be good to have these run across multiple cores. + + + +This could probably be done in a way similar to how we currently hand +circuit extension handshakes in onion.c and cpuworker.c, but we'd need +to extend the state machine for hidden services to add an additional +state. It could help hidden services operate much more efficiently. + + + +For more information <a href="https://trac.torproject.org/projects/tor/ticket/13738">see its ticket</a>. + + </li> + + <a id="supportAllDNS"></a> + <li> + Support all kinds of DNS in Tor + + Likely Mentors: Nick (nickm), George (asn) + + +Right now Tor can query for the kind of DNS information you'd find in +A records, AAAA records, and PTR records. It would be neat to be able +to support more general DNS queries to allow things like MX loopups, +DNSSEC lookups, and so on. We have a design proposal (number 219) for +this, but it might need some clean-up. + + + +For more information <a href="https://trac.torproject.org/projects/tor/ticket/7829">see its ticket</a>. + + </li> + + <a id="improveIpv6Support"></a> + <li> + Improve IPv6 support + + Likely Mentors: ahf, teor + + +Tor works over IPv6, but require some manual configuration. +Clients and relays could automatically detect IPv6 availability, +and configure themselves appropriately. Implementing a +"happy eyeballs"-like algorithm is a challenge in an anonymity +network: are you up for it? + + + <ul> + <li><a href="https://trac.torproject.org/projects/tor/ticket/6939">Missing IPv6 ORPort reachability check</a></li> + <li><a href="https://trac.torproject.org/projects/tor/ticket/4847">Bridges binding only to an IPv6 address doesn't work</a></li> + <li><a href="https://trac.torproject.org/projects/tor/ticket/5940">Figure out own IPv6 address</a></li> + <li><a href="https://trac.torproject.org/projects/tor/ticket/17011">Teach chutney to verify over IPv6</a></li> + </ul> + + +For more information <a href="https://trac.torproject.org/projects/tor/ticket/17811">see its ticket</a>. + + </li> + <a id="feedbackExtension"></a> <li> Feedback Extension for Tor Browser

1 0

[torspec/master] I am told that prop#210 is actually superseded?
by nickm＠torproject.org 27 Feb '17

27 Feb '17

commit 41049b27b2b604b7bc80ab4ab9ded3041434df85 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Feb 27 12:37:35 2017 -0500 I am told that prop#210 is actually superseded? --- proposals/000-index.txt | 4 ++-- proposals/210-faster-headless-consensus-bootstrap.txt | 6 +++++- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/proposals/000-index.txt b/proposals/000-index.txt index 9a57ba0..c849377 100644 --- a/proposals/000-index.txt +++ b/proposals/000-index.txt @@ -130,7 +130,7 @@ Proposals by number: 207 Directory guards [CLOSED] 208 IPv6 Exits Redux [CLOSED] 209 Tuning the Parameters for the Path Bias Defense [OPEN] -210 Faster Headless Consensus Bootstrapping [FINISHED] +210 Faster Headless Consensus Bootstrapping [SUPERSEDED] 211 Internal Mapaddress for Tor Configuration Testing [RESERVE] 212 Increase Acceptable Consensus Age [OPEN] 213 Remove stream-level sendmes from the design [DEAD] @@ -275,7 +275,6 @@ Proposals by status: 162 Publish the consensus in multiple flavors [in 0.2.3.1-alpha] 196 Extended ORPort and TransportControlPort [for 0.2.4.x] 204 Subdomain support for Hidden Service addresses - 210 Faster Headless Consensus Bootstrapping [for 0.2.8.x+] 217 Tor Extended ORPort Authentication [for 0.2.5.x] 220 Migrate server identity keys to Ed25519 [for 0.2.x.x] 232 Pluggable Transport through SOCKS proxy [in 0.2.6] @@ -365,6 +364,7 @@ Proposals by status: 170 Configuration options regarding circuit building 185 Directory caches without DirPort 194 Mnemonic .onion URLs + 210 Faster Headless Consensus Bootstrapping 225 Strawman proposal: commit-and-reveal shared rng 252 Single Onion Services 266 Removing current obsolete clients from the Tor network diff --git a/proposals/210-faster-headless-consensus-bootstrap.txt b/proposals/210-faster-headless-consensus-bootstrap.txt index 6737bc2..380a9ac 100644 --- a/proposals/210-faster-headless-consensus-bootstrap.txt +++ b/proposals/210-faster-headless-consensus-bootstrap.txt @@ -3,9 +3,13 @@ Title: Faster Headless Consensus Bootstrapping Author: Mike Perry, Tim Wilson-Brown, Peter Palfrader Created: 01-10-2012 Last Modified: 02-10-2015 -Status: Finished +Status: Superseded Target: 0.2.8.x+ +Status-notes: + + * This has been partially superseded by the fallback directory code, + and partially by the exponential-backoff code. Overview and Motiviation

1 0

[tor-browser-build/master] Re-zip the omni.ja files
by boklm＠torproject.org 27 Feb '17

27 Feb '17

commit 38863663120244e4becc66fe7a10cce92d8e639b Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon Feb 27 17:46:28 2017 +0100 Re-zip the omni.ja files Re-zipping the omni.ja files is not needed to make them reproductible, however if we don't re-zip them, the files become corrupt when we update them using 'zip' (we are doing that when we update the 000-tor-browser.js preference file to set the locale) and firefox will silently fail to load some parts. --- projects/firefox/build | 17 +++++++++++++---- rbm.conf | 12 ++++++++++++ 2 files changed, 25 insertions(+), 4 deletions(-) diff --git a/projects/firefox/build b/projects/firefox/build index 42752d1..7610510 100644 --- a/projects/firefox/build +++ b/projects/firefox/build @@ -146,10 +146,19 @@ do done [% END %] -# TODO: -# ~/build/re-dzip.sh Browser/omni.ja -# ~/build/re-dzip.sh Browser/webapprt/omni.ja -# ~/build/re-dzip.sh Browser/browser/omni.ja +# Re-zipping the omni.ja files is not needed to make them reproductible, +# however if we don't re-zip them, the files become corrupt when we +# update them using 'zip' and firefox will silently fail to load some +# parts. +[% IF c("var/windows") || c("var/linux") %] + [% c("var/rezip", { rezip_file => 'Browser/omni.ja' }) %] + [% c("var/rezip", { rezip_file => 'Browser/browser/omni.ja' }) %] + [% IF c("var/linux") %][% c("var/rezip", { rezip_file => 'Browser/webapprt/omni.ja' }) %][% END %] +[% ELSIF c("var/osx") %] + [% c("var/rezip", { rezip_file => 'TorBrowser.app/Contents/Resources/omni.ja' }) %] + [% c("var/rezip", { rezip_file => 'TorBrowser.app/Contents/Resources/webapprt/omni.ja' }) %] + [% c("var/rezip", { rezip_file => 'TorBrowser.app/Contents/Resources/browser/omni.ja' }) %] +[% END %] [% IF c("var/windows") %] cp $rootdir/msvcr100.dll Browser/ diff --git a/rbm.conf b/rbm.conf index e9f7b6d..b137595 100644 --- a/rbm.conf +++ b/rbm.conf @@ -54,6 +54,18 @@ var: sign_build: '[% ENV.RBM_SIGN_BUILD %]' sign_build_gpg_opts: '[% ENV.RBM_GPG_OPTS %]' + rezip: | + rezip_tmpdir=$(mktemp -d) + mkdir -p "$rezip_tmpdir/z" + unzip -d "$rezip_tmpdir/z" -- [% c("rezip_file") %] || [ $? -lt 3 ] + pushd "$rezip_tmpdir/z" + [% c("zip", { + zip_src => [ '.' ], + zip_args => '$rezip_tmpdir/new.zip', + }) %] + popd + mv -f -- "$rezip_tmpdir/new.zip" [% c("rezip_file") %] + rm -Rf "$rezip_tmpdir" targets: notarget: linux-x86_64

1 0

[tor/release-0.3.0] Log tor warnings during 'make test-network-all'
by nickm＠torproject.org 27 Feb '17

27 Feb '17

commit fb32c522320430f0fb419e1f05530850a5a90d2f Author: teor <teor2345(a)gmail.com> Date: Tue Feb 28 01:46:16 2017 +1100 Log tor warnings during 'make test-network-all' Requires the chutney changes from 21572. (Otherwise, asks users to upgrade their chutney.) Implements 21570. --- Makefile.am | 5 +++++ changes/feature21570 | 5 +++++ 2 files changed, 10 insertions(+) diff --git a/Makefile.am b/Makefile.am index 631b44e..880420b 100644 --- a/Makefile.am +++ b/Makefile.am @@ -54,6 +54,7 @@ TEST_CFLAGS= TEST_CPPFLAGS=-DTOR_UNIT_TESTS TEST_NETWORK_FLAGS=--hs-multi-client 1 endif +TEST_NETWORK_WARNING_FLAGS=--quiet --only-warnings if LIBFUZZER_ENABLED TEST_CFLAGS += -fsanitize-coverage=trace-pc-guard,trace-cmp,trace-div @@ -135,6 +136,10 @@ test-network-all: need-chutney-path test-driver $(TESTING_TOR_BINARY) src/tools/ done; \ for f in $$flavors; do \ $(SHELL) $(top_srcdir)/test-driver --test-name $$f --log-file $(TEST_NETWORK_ALL_LOG_DIR)/$$f.log --trs-file $(TEST_NETWORK_ALL_LOG_DIR)/$$f.trs $(TEST_NETWORK_ALL_DRIVER_FLAGS) $(top_srcdir)/src/test/test-network.sh --flavor $$f $(TEST_NETWORK_FLAGS); \ + $(top_srcdir)/src/test/test-network.sh $(TEST_NETWORK_WARNING_FLAGS); \ + if test $$? -eq 2 ; then \ + echo "Please update your chutney using 'git pull' to see tor warnings here."; \ + fi; \ done; \ echo "Log and result files are available in $(TEST_NETWORK_ALL_LOG_DIR)."; \ ! grep -q FAIL test_network_log/*.trs diff --git a/changes/feature21570 b/changes/feature21570 new file mode 100644 index 0000000..40555ee --- /dev/null +++ b/changes/feature21570 @@ -0,0 +1,5 @@ + o Minor features (testing): + - During 'make test-network-all', if tor logs any warnings, ask chutney + to output them. Requires a recent version of chutney with the 21572 + patch. + Implements 21570.

1 0