March 2017 - tor-commits - lists.torproject.org

[translation/whisperback] Update translations for whisperback
by translation＠torproject.org 31 Mar '17

31 Mar '17

commit 3f1aa0de38b0b75acb56257c28ef32984f47bbeb Author: Translation commit bot <translation(a)torproject.org> Date: Fri Mar 31 10:45:15 2017 +0000 Update translations for whisperback --- it/it.po | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/it/it.po b/it/it.po index c276337..5c2f638 100644 --- a/it/it.po +++ b/it/it.po @@ -10,15 +10,15 @@ # mmondora <michele.mondora(a)gmail.com>, 2012 # mmondora <michele.mondora(a)gmail.com>, 2012 # Random_R, 2013 -# Random_R, 2013 +# Random_R, 2013,2017 # Vincenzo Cerminara <rebek994(a)gmail.com>, 2012 msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2017-03-20 12:09+0000\n" -"PO-Revision-Date: 2017-03-21 08:24+0000\n" -"Last-Translator: carolyn <carolyn(a)anhalt.org>\n" +"PO-Revision-Date: 2017-03-31 10:24+0000\n" +"Last-Translator: Random_R\n" "Language-Team: Italian (http://www.transifex.com/otf/torproject/language/it/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -50,19 +50,19 @@ msgstr "La variabile %s non è stata trovata in nessuno dei file di configurazio #: ../whisperBack/gui.py:110 msgid "Name of the affected software" -msgstr "" +msgstr "Nome del software coinvolto" #: ../whisperBack/gui.py:112 msgid "Exact steps to reproduce the error" -msgstr "" +msgstr "Passi per replicare l'errore" #: ../whisperBack/gui.py:114 msgid "Actual result and description of the error" -msgstr "" +msgstr "Risultato effettivo e descrizione dell'errore" #: ../whisperBack/gui.py:116 msgid "Desired result" -msgstr "" +msgstr "Risultato atteso" #: ../whisperBack/gui.py:152 msgid "Unable to load a valid configuration."

1 0

[translation/tor-browser-manual] Update translations for tor-browser-manual
by translation＠torproject.org 31 Mar '17

31 Mar '17

commit 2d27e81deb3c14fc157ca79f0bb734f6b08df022 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Mar 31 09:48:19 2017 +0000 Update translations for tor-browser-manual --- tr/tr.po | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tr/tr.po b/tr/tr.po index 5da11e8..6a4b9ec 100644 --- a/tr/tr.po +++ b/tr/tr.po @@ -210,6 +210,9 @@ msgid "" " to the Tor network. Select “Use custom bridges” and enter each bridge " "address on a separate line." msgstr "" +"İnternet Servis Sağlayıcınız Tor ağına bağlantıları engelliyorsa, " +"sorulduğunda \"Evet\"i seçiniz. \"Özel köprüleri kullanın\"ı seçin ve her " +"köprü adresini farklı bir satıra girin." #. This is a reference to an external file such as an image or video. When #. the file changes, the md5 hash will change to let you know you need to

1 0

[goptlib/master] Add tests for error functions.
by dcf＠torproject.org 31 Mar '17

31 Mar '17

commit c1cf6bee9adc78bce3ceed72d6b8cd3ce50976ae Author: David Fifield <david(a)bamsoftware.com> Date: Fri Mar 31 00:14:45 2017 -0700 Add tests for error functions. The ProxyError test currently panics because of a bug in ProxyError. --- FAIL: TestErrors (0.00s) panic: keyword "PROXY-ERROR %s\n" contains forbidden bytes [recovered] panic: keyword "PROXY-ERROR %s\n" contains forbidden bytes --- pt_test.go | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/pt_test.go b/pt_test.go index fb9e61f..f6b9ea8 100644 --- a/pt_test.go +++ b/pt_test.go @@ -13,6 +13,32 @@ import ( "testing" ) +func TestErrors(t *testing.T) { + Stdout = ioutil.Discard + + var err error + err = envError("XYZ") + if err.Error() != "ENV-ERROR XYZ" { + t.Errorf("unexpected string %q from envError", err.Error()) + } + err = versionError("XYZ") + if err.Error() != "VERSION-ERROR XYZ" { + t.Errorf("unexpected string %q from versionError", err.Error()) + } + err = CmethodError("method", "XYZ") + if err.Error() != "CMETHOD-ERROR method XYZ" { + t.Errorf("unexpected string %q from CmethodError", err.Error()) + } + err = SmethodError("method", "XYZ") + if err.Error() != "SMETHOD-ERROR method XYZ" { + t.Errorf("unexpected string %q from SmethodError", err.Error()) + } + err = ProxyError("XYZ") + if err.Error() != "PROXY-ERROR XYZ" { + t.Errorf("unexpected string %q from ProxyError", err.Error()) + } +} + func TestKeywordIsSafe(t *testing.T) { tests := [...]struct { keyword string

1 0

[goptlib/master] Fix ProxyError.
by dcf＠torproject.org 31 Mar '17

31 Mar '17

commit 0f5cab77926a352c229bc5653d904fefd799653c Author: David Fifield <david(a)bamsoftware.com> Date: Fri Mar 31 00:15:45 2017 -0700 Fix ProxyError. It would always panic with a the message keyword "PROXY-ERROR %s\n" contains forbidden bytes --- pt.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pt.go b/pt.go index 8cd5ff9..9633254 100644 --- a/pt.go +++ b/pt.go @@ -300,7 +300,7 @@ func SmethodError(methodName, msg string) error { // Emit a PROXY-ERROR line with explanation text. Returns a representation of // the error. func ProxyError(msg string) error { - return doError("PROXY-ERROR %s\n", msg) + return doError("PROXY-ERROR", msg) } // Emit a CMETHOD line. socks must be "socks4" or "socks5". Call this once for

1 0

[goptlib/master] Fix a ProxyError usage example.
by dcf＠torproject.org 31 Mar '17

31 Mar '17

commit fcc1d072d63b3e843495d4af4c0f522ddbb9fefc Author: David Fifield <david(a)bamsoftware.com> Date: Fri Mar 31 00:19:47 2017 -0700 Fix a ProxyError usage example. --- pt.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pt.go b/pt.go index 9633254..3c018a6 100644 --- a/pt.go +++ b/pt.go @@ -42,7 +42,7 @@ // if ptInfo.ProxyURL != nil { // // you need to interpret the proxy URL yourself // // call pt.ProxyDone instead if it's a type you understand -// pt.ProxyError("proxy %s is not supported") +// pt.ProxyError(fmt.Sprintf("proxy %s is not supported", ptInfo.ProxyURL)) // os.Exit(1) // } // for _, methodName := range ptInfo.MethodNames {

1 0

[meek/master] Use ServerTransportListenAddr instead of --port where possible.
by dcf＠torproject.org 31 Mar '17

31 Mar '17

commit 71caf085cba2b6fa2e7de597e379a2a67e26b16b Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 30 18:28:54 2017 -0700 Use ServerTransportListenAddr instead of --port where possible. --- doc/meek-server.1.txt | 10 +++++++--- meek-server/meek-server.go | 6 ++++-- meek-server/torrc | 3 ++- 3 files changed, 13 insertions(+), 6 deletions(-) diff --git a/doc/meek-server.1.txt b/doc/meek-server.1.txt index 3ba6b5a..f079978 100644 --- a/doc/meek-server.1.txt +++ b/doc/meek-server.1.txt @@ -26,12 +26,14 @@ Configuration for meek-server usually appears in a torrc file. Here is a sample configuration using HTTPS: ---- ExtORPort auto -ServerTransportPlugin meek exec ./meek-server --port 8443 --cert cert.pem --key key.pem --log meek-server.log +ServerTransportListenAddr meek 0.0.0.0:8443 +ServerTransportPlugin meek exec ./meek-server 8443 --cert cert.pem --key key.pem --log meek-server.log ---- Here is a sample configuration using plain HTTP: ---- ExtORPort auto -ServerTransportPlugin meek exec ./meek-server --port 8080 --disable-tls --log meek-server.log +ServerTransportListenAddr meek 0.0.0.0:8080 +ServerTransportPlugin meek exec ./meek-server --disable-tls --log meek-server.log ---- OPTIONS @@ -52,7 +54,9 @@ OPTIONS **--port**=__PORT__:: Port to listen on. Overrides the TOR_PT_SERVER_BINDADDR environment - variable set by tor. + variable set by tor. In most cases you should set the + **ServerTransportListenAddr** option in torrc, rather than use the + **--port** option. **-h**, **--help**:: Display a help message and exit. diff --git a/meek-server/meek-server.go b/meek-server/meek-server.go index 7736615..bf0f8a4 100644 --- a/meek-server/meek-server.go +++ b/meek-server/meek-server.go @@ -3,9 +3,11 @@ // data to a local OR port. // // Sample usage in torrc: -// ServerTransportPlugin meek exec ./meek-server --port 8443 --cert cert.pem --key key.pem --log meek-server.log +// ServerTransportListenAddr meek 0.0.0.0:8443 +// ServerTransportPlugin meek exec ./meek-server --cert cert.pem --key key.pem --log meek-server.log // Plain HTTP usage: -// ServerTransportPlugin meek exec ./meek-server --port 8080 --disable-tls --log meek-server.log +// ServerTransportListenAddr meek 0.0.0.0:8080 +// ServerTransportPlugin meek exec ./meek-server --disable-tls --log meek-server.log // // The server runs in HTTPS mode by default, and the --cert and --key options // are required. Use the --disable-tls option to run with plain HTTP. diff --git a/meek-server/torrc b/meek-server/torrc index db22794..613cb9c 100644 --- a/meek-server/torrc +++ b/meek-server/torrc @@ -2,5 +2,6 @@ BridgeRelay 1 ORPort 9001 ExtORPort auto SocksPort 0 -ServerTransportPlugin meek exec ./meek-server --log meek-server.log --port 7002 --cert cert.pem --key key.pem +ServerTransportListenAddr meek 0.0.0.0:7002 +ServerTransportPlugin meek exec ./meek-server --log meek-server.log --cert cert.pem --key key.pem ExitPolicy reject *:*

1 0

[meek/master] Export certContext.GetCertificate.
by dcf＠torproject.org 31 Mar '17

31 Mar '17

commit d60a7508f5fce26681a52842fd50af7692544ec0 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 23 01:11:31 2017 -0700 Export certContext.GetCertificate. --- meek-server/certificate.go | 2 +- meek-server/meek-server.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/meek-server/certificate.go b/meek-server/certificate.go index 2c57d85..82302db 100644 --- a/meek-server/certificate.go +++ b/meek-server/certificate.go @@ -89,7 +89,7 @@ func (ctx *certContext) reloadCertificate() (*tls.Certificate, error) { return cert, nil } -func (ctx *certContext) getCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) { +func (ctx *certContext) GetCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) { cert, err := ctx.reloadCertificate() if err != nil { // Failure to reload the certificate is a non-fatal error as this diff --git a/meek-server/meek-server.go b/meek-server/meek-server.go index eb7adc9..7736615 100644 --- a/meek-server/meek-server.go +++ b/meek-server/meek-server.go @@ -279,7 +279,7 @@ func listenTLS(network string, addr *net.TCPAddr, certFilename, keyFilename stri // Install a GetCertificate callback that ensures that the certificate is // up to date. - config.GetCertificate = ctx.getCertificate + config.GetCertificate = ctx.GetCertificate conn, err := net.ListenTCP(network, addr) if err != nil {

1 0

[meek/master] Deemphazise --disable-tls in the meek-server man page.
by dcf＠torproject.org 31 Mar '17

31 Mar '17

commit bd6df09ec9c6dfcd0446fcc6c1d61dbc9a97dc84 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Mar 30 18:42:10 2017 -0700 Deemphazise --disable-tls in the meek-server man page. --- doc/meek-server.1.txt | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/doc/meek-server.1.txt b/doc/meek-server.1.txt index f079978..b162af8 100644 --- a/doc/meek-server.1.txt +++ b/doc/meek-server.1.txt @@ -19,8 +19,7 @@ meek-server is a transport plugin for Tor that encodes a stream as a sequence of HTTP requests and responses. The server runs in HTTPS mode by default, and the **--cert** and -**--key** options are required. Use the **--disable-tls** option to run -with plain HTTP. +**--key** options are required. Configuration for meek-server usually appears in a torrc file. Here is a sample configuration using HTTPS: @@ -29,12 +28,6 @@ ExtORPort auto ServerTransportListenAddr meek 0.0.0.0:8443 ServerTransportPlugin meek exec ./meek-server 8443 --cert cert.pem --key key.pem --log meek-server.log ---- -Here is a sample configuration using plain HTTP: ----- -ExtORPort auto -ServerTransportListenAddr meek 0.0.0.0:8080 -ServerTransportPlugin meek exec ./meek-server --disable-tls --log meek-server.log ----- OPTIONS ------- @@ -43,7 +36,8 @@ OPTIONS **--disable-tls** is used. **--disable-tls**: - Use plain HTTP rather than HTTPS. + Use plain HTTP rather than HTTPS. This option is only for testing + purposes. Don't use it in production. **--key**=__FILENAME__: Name of a PEM-encoded TLS private key file. Required unless

1 0

[snowflake/master] Automatically fetch certificates from Let's Encrypt.
by dcf＠torproject.org 31 Mar '17

31 Mar '17

commit 61310600c3dc419da5661dba9b11da57acd5188f Author: David Fifield <david(a)bamsoftware.com> Date: Wed Jan 18 19:19:26 2017 -0800 Automatically fetch certificates from Let's Encrypt. This removes the --tls-cert and --tls-keys options and replaces them with --acme-hostname and (optional) --acme-email. It uses https://godoc.org/golang.org/x/crypto/acme/autocert, which is kind of a successor to https://godoc.org/rsc.io/letsencrypt. The autocert package only works when the listener runs on port 443. For that reason, if TOR_PT_SERVER_BINDADDR asks for a port other than 443, the program will open an *additional* listening port on 443. If there is an error opening the listener, it is reported through an SMETHOD-ERROR for the requested address. The inspiration for this code came from George Tankersley's patch for meek-server: https://bugs.torproject.org/18655#comment:8 https://github.com/gtank/meek/tree/letsencrypt --- server/server.go | 70 ++++++++++++++++++++++++++++++++++++++------------------ server/torrc | 4 ++-- 2 files changed, 50 insertions(+), 24 deletions(-) diff --git a/server/server.go b/server/server.go index 8025ad3..bedc70c 100644 --- a/server/server.go +++ b/server/server.go @@ -19,12 +19,14 @@ import ( "net/http" "os" "os/signal" + "strings" "sync" "syscall" "time" "git.torproject.org/pluggable-transports/goptlib.git" "git.torproject.org/pluggable-transports/websocket.git/websocket" + "golang.org/x/crypto/acme/autocert" ) const ptMethodName = "snowflake" @@ -150,7 +152,7 @@ func webSocketHandler(ws *websocket.WebSocket) { proxy(or, &conn) } -func listenTLS(network string, addr *net.TCPAddr, certFilename, keyFilename string) (net.Listener, error) { +func listenTLS(network string, addr *net.TCPAddr, m *autocert.Manager) (net.Listener, error) { // This is cribbed from the source of net/http.Server.ListenAndServeTLS. // We have to separate the Listen and Serve parts because we need to // report the listening address before entering Serve (which is an @@ -158,13 +160,7 @@ func listenTLS(network string, addr *net.TCPAddr, certFilename, keyFilename stri // https://groups.google.com/d/msg/Golang-nuts/3F1VRCCENp8/3hcayZiwYM8J config := &tls.Config{} config.NextProtos = []string{"http/1.1"} - - var err error - config.Certificates = make([]tls.Certificate, 1) - config.Certificates[0], err = tls.LoadX509KeyPair(certFilename, keyFilename) - if err != nil { - return nil, err - } + config.GetCertificate = m.GetCertificate conn, err := net.ListenTCP(network, addr) if err != nil { @@ -190,8 +186,8 @@ func startListener(network string, addr *net.TCPAddr) (net.Listener, error) { return startServer(ln) } -func startListenerTLS(network string, addr *net.TCPAddr, certFilename, keyFilename string) (net.Listener, error) { - ln, err := listenTLS(network, addr, certFilename, keyFilename) +func startListenerTLS(network string, addr *net.TCPAddr, m *autocert.Manager) (net.Listener, error) { + ln, err := listenTLS(network, addr, m) if err != nil { return nil, err } @@ -217,14 +213,13 @@ func startServer(ln net.Listener) (net.Listener, error) { } func main() { + var acmeHostnamesCommas string var disableTLS bool - var certFilename, keyFilename string var logFilename string flag.Usage = usage + flag.StringVar(&acmeHostnamesCommas, "acme-hostnames", "", "comma-separated hostnames for TLS certificate") flag.BoolVar(&disableTLS, "disable-tls", false, "don't use HTTPS") - flag.StringVar(&certFilename, "cert", "", "TLS certificate file (required without --disable-tls)") - flag.StringVar(&keyFilename, "key", "", "TLS private key file (required without --disable-tls)") flag.StringVar(&logFilename, "log", "", "log file to write to") flag.Parse() @@ -237,15 +232,10 @@ func main() { log.SetOutput(f) } - if disableTLS { - if certFilename != "" || keyFilename != "" { - log.Fatalf("the --cert and --key options are not allowed with --disable-tls") - } - } else { - if certFilename == "" || keyFilename == "" { - log.Fatalf("the --cert and --key options are required") - } + if !disableTLS && acmeHostnamesCommas == "" { + log.Fatal("the --acme-hostnames option is required") } + acmeHostnames := strings.Split(acmeHostnamesCommas, ",") log.Printf("starting") var err error @@ -254,6 +244,28 @@ func main() { log.Fatalf("error in setup: %s", err) } + if !disableTLS { + log.Printf("ACME hostnames: %q", acmeHostnames) + } + certManager := autocert.Manager{ + Prompt: autocert.AcceptTOS, + HostPolicy: autocert.HostWhitelist(acmeHostnames...), + } + + // The ACME responder only works when it is running on port 443. In case + // there is not already going to be a TLS listener on port 443, we need + // to open an additional one. The port is actually opened in the loop + // below, so that any errors can be reported in the SMETHOD-ERROR of + // another bindaddr. + // https://letsencrypt.github.io/acme-spec/#domain-validation-with-server-name… + need443Listener := !disableTLS + for _, bindaddr := range ptInfo.Bindaddrs { + if !disableTLS && bindaddr.Addr.Port == 443 { + need443Listener = false + break + } + } + listeners := make([]net.Listener, 0) for _, bindaddr := range ptInfo.Bindaddrs { if bindaddr.MethodName != ptMethodName { @@ -261,6 +273,20 @@ func main() { continue } + if need443Listener { + addr := *bindaddr.Addr + addr.Port = 443 + log.Printf("opening additional ACME listener on %s", addr.String()) + ln443, err := startListenerTLS("tcp", &addr, &certManager) + if err != nil { + log.Printf("error opening ACME listener: %s", err) + pt.SmethodError(bindaddr.MethodName, "ACME listener: "+err.Error()) + continue + } + listeners = append(listeners, ln443) + need443Listener = false + } + var ln net.Listener args := pt.Args{} if disableTLS { @@ -268,7 +294,7 @@ func main() { ln, err = startListener("tcp", bindaddr.Addr) } else { args.Add("tls", "yes") - ln, err = startListenerTLS("tcp", bindaddr.Addr, certFilename, keyFilename) + ln, err = startListenerTLS("tcp", bindaddr.Addr, &certManager) } if err != nil { log.Printf("error opening listener: %s", err) diff --git a/server/torrc b/server/torrc index 74f6af0..ed71a39 100644 --- a/server/torrc +++ b/server/torrc @@ -5,5 +5,5 @@ SocksPort 0 ExitPolicy reject *:* DataDirectory datadir -ServerTransportListenAddr snowflake 0.0.0.0:9902 -ServerTransportPlugin snowflake exec ./server --disable-tls --log snowflake.log +ServerTransportListenAddr snowflake 0.0.0.0:443 +ServerTransportPlugin snowflake exec ./server --acme-hostnames snowflake.example --acme-email admin(a)snowflake.example --log snowflake.log

1 0

[snowflake/master] Add "hostname" args to the bridge descriptor as well.
by dcf＠torproject.org 31 Mar '17

31 Mar '17

commit 1b1fb37afe435ffb38d7ec53b9a79896f6b6e5c2 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Jan 20 16:51:14 2017 -0800 Add "hostname" args to the bridge descriptor as well. --- server/server.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/server/server.go b/server/server.go index 9ebe255..aaf2e05 100644 --- a/server/server.go +++ b/server/server.go @@ -301,6 +301,9 @@ func main() { ln, err = startListener("tcp", bindaddr.Addr) } else { args.Add("tls", "yes") + for _, hostname := range acmeHostnames { + args.Add("hostname", hostname) + } ln, err = startListenerTLS("tcp", bindaddr.Addr, &certManager) } if err != nil {

1 0