April 2017 - tor-commits - lists.torproject.org

[metrics-web/master] Skip bridge network statuses with zero running bridges.
by karsten＠torproject.org 23 Apr '17

23 Apr '17

commit c257f671bd64bacbe15d057be1b83878ad7bf0ce Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed Mar 1 16:22:27 2017 +0100 Skip bridge network statuses with zero running bridges. Fixes #21587. --- .../ernie/cron/network/ConsensusStatsFileHandler.java | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/modules/legacy/src/main/java/org/torproject/ernie/cron/network/ConsensusStatsFileHandler.java b/modules/legacy/src/main/java/org/torproject/ernie/cron/network/ConsensusStatsFileHandler.java index 9aef3e4..801794f 100644 --- a/modules/legacy/src/main/java/org/torproject/ernie/cron/network/ConsensusStatsFileHandler.java +++ b/modules/legacy/src/main/java/org/torproject/ernie/cron/network/ConsensusStatsFileHandler.java @@ -257,17 +257,23 @@ public class ConsensusStatsFileHandler { * and bridge authority. */ Map<String, Map<String, int[]>> bridgesPerDayAndAuthority = new HashMap<>(); for (String bridgesRawLine : this.bridgesRaw.values()) { + String[] parts = bridgesRawLine.split(","); + int brunning = Integer.parseInt(parts[2]); + if (brunning <= 0) { + /* Skip this status which contains zero bridges with the Running + * flag. */ + continue; + } String date = bridgesRawLine.substring(0, 10); if (!bridgesPerDayAndAuthority.containsKey(date)) { bridgesPerDayAndAuthority.put(date, new TreeMap<String, int[]>()); } - String[] parts = bridgesRawLine.split(","); String authority = parts[1]; if (!bridgesPerDayAndAuthority.get(date).containsKey(authority)) { bridgesPerDayAndAuthority.get(date).put(authority, new int[3]); } int[] bridges = bridgesPerDayAndAuthority.get(date).get(authority); - bridges[0] += Integer.parseInt(parts[2]); + bridges[0] += brunning; bridges[1] += Integer.parseInt(parts[3]); bridges[2]++; }

1 0

[metrics-web/master] Resolve deprecation warnings.
by karsten＠torproject.org 23 Apr '17

23 Apr '17

commit 6538573b044cd6a8f9c3c36926d9bf4707d0def1 Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Tue Feb 28 14:14:05 2017 +0100 Resolve deprecation warnings. Fixes #21578. --- .../src/main/java/org/torproject/metrics/advbwdist/Main.java | 5 +++-- .../src/main/java/org/torproject/metrics/clients/Main.java | 10 ++++++---- .../torproject/ernie/cron/RelayDescriptorDatabaseImporter.java | 8 ++++++-- .../ernie/cron/network/ConsensusStatsFileHandler.java | 8 ++++++-- .../torproject/ernie/cron/performance/TorperfProcessor.java | 5 +++-- 5 files changed, 24 insertions(+), 12 deletions(-) diff --git a/modules/advbwdist/src/main/java/org/torproject/metrics/advbwdist/Main.java b/modules/advbwdist/src/main/java/org/torproject/metrics/advbwdist/Main.java index 7d7678d..a3135c0 100644 --- a/modules/advbwdist/src/main/java/org/torproject/metrics/advbwdist/Main.java +++ b/modules/advbwdist/src/main/java/org/torproject/metrics/advbwdist/Main.java @@ -59,8 +59,8 @@ public class Main { descriptorReader = DescriptorSourceFactory.createDescriptorReader(); descriptorReader.addDirectory( new File("../../shared/in/recent/relay-descriptors/consensuses")); - descriptorReader.setExcludeFiles( - new File("status/parsed-consensuses")); + File historyFile = new File("status/parsed-consensuses"); + descriptorReader.setHistoryFile(historyFile); descriptorFiles = descriptorReader.readDescriptors(); File resultsFile = new File("stats/advbwdist-validafter.csv"); resultsFile.getParentFile().mkdirs(); @@ -152,6 +152,7 @@ public class Main { } } } + descriptorReader.saveHistoryFile(historyFile); bw.close(); } } diff --git a/modules/clients/src/main/java/org/torproject/metrics/clients/Main.java b/modules/clients/src/main/java/org/torproject/metrics/clients/Main.java index dff73f7..dc34d37 100644 --- a/modules/clients/src/main/java/org/torproject/metrics/clients/Main.java +++ b/modules/clients/src/main/java/org/torproject/metrics/clients/Main.java @@ -63,8 +63,8 @@ public class Main { private static void parseRelayDescriptors() throws Exception { DescriptorReader descriptorReader = DescriptorSourceFactory.createDescriptorReader(); - descriptorReader.setExcludeFiles(new File( - "status/relay-descriptors")); + File historyFile = new File("status/relay-descriptors"); + descriptorReader.setHistoryFile(historyFile); descriptorReader.addDirectory(new File( "../../shared/in/recent/relay-descriptors/consensuses")); descriptorReader.addDirectory(new File( @@ -86,6 +86,7 @@ public class Main { } } } + descriptorReader.saveHistoryFile(historyFile); } private static void parseRelayExtraInfoDescriptor( @@ -206,8 +207,8 @@ public class Main { private static void parseBridgeDescriptors() throws Exception { DescriptorReader descriptorReader = DescriptorSourceFactory.createDescriptorReader(); - descriptorReader.setExcludeFiles(new File( - "status/bridge-descriptors")); + File historyFile = new File("status/bridge-descriptors"); + descriptorReader.setHistoryFile(historyFile); descriptorReader.addDirectory(new File( "../../shared/in/recent/bridge-descriptors")); descriptorReader.addDirectory(new File( @@ -225,6 +226,7 @@ public class Main { } } } + descriptorReader.saveHistoryFile(historyFile); } private static void parseBridgeExtraInfoDescriptor( diff --git a/modules/legacy/src/main/java/org/torproject/ernie/cron/RelayDescriptorDatabaseImporter.java b/modules/legacy/src/main/java/org/torproject/ernie/cron/RelayDescriptorDatabaseImporter.java index 97a330e..657f0d7 100644 --- a/modules/legacy/src/main/java/org/torproject/ernie/cron/RelayDescriptorDatabaseImporter.java +++ b/modules/legacy/src/main/java/org/torproject/ernie/cron/RelayDescriptorDatabaseImporter.java @@ -843,9 +843,10 @@ public final class RelayDescriptorDatabaseImporter { reader.addDirectory(archivesDirectory); } } + File historyFile = new File(statsDirectory, + "database-importer-relay-descriptor-history"); if (keepImportHistory) { - reader.setExcludeFiles(new File(statsDirectory, - "database-importer-relay-descriptor-history")); + reader.setHistoryFile(historyFile); } Iterator<DescriptorFile> descriptorFiles = reader.readDescriptors(); while (descriptorFiles.hasNext()) { @@ -864,6 +865,9 @@ public final class RelayDescriptorDatabaseImporter { } } } + if (keepImportHistory) { + reader.saveHistoryFile(historyFile); + } } logger.info("Finished importing relay descriptors."); diff --git a/modules/legacy/src/main/java/org/torproject/ernie/cron/network/ConsensusStatsFileHandler.java b/modules/legacy/src/main/java/org/torproject/ernie/cron/network/ConsensusStatsFileHandler.java index aa9469e..9aef3e4 100644 --- a/modules/legacy/src/main/java/org/torproject/ernie/cron/network/ConsensusStatsFileHandler.java +++ b/modules/legacy/src/main/java/org/torproject/ernie/cron/network/ConsensusStatsFileHandler.java @@ -192,9 +192,10 @@ public class ConsensusStatsFileHandler { DescriptorReader reader = DescriptorSourceFactory.createDescriptorReader(); reader.addDirectory(bridgesDir); + File historyFile = new File(statsDirectory, + "consensus-stats-bridge-descriptor-history"); if (keepImportHistory) { - reader.setExcludeFiles(new File(statsDirectory, - "consensus-stats-bridge-descriptor-history")); + reader.setHistoryFile(historyFile); } Iterator<DescriptorFile> descriptorFiles = reader.readDescriptors(); while (descriptorFiles.hasNext()) { @@ -222,6 +223,9 @@ public class ConsensusStatsFileHandler { } } } + if (keepImportHistory) { + reader.saveHistoryFile(historyFile); + } logger.info("Finished importing bridge descriptors."); } } diff --git a/modules/legacy/src/main/java/org/torproject/ernie/cron/performance/TorperfProcessor.java b/modules/legacy/src/main/java/org/torproject/ernie/cron/performance/TorperfProcessor.java index 25b0050..0c2be9d 100644 --- a/modules/legacy/src/main/java/org/torproject/ernie/cron/performance/TorperfProcessor.java +++ b/modules/legacy/src/main/java/org/torproject/ernie/cron/performance/TorperfProcessor.java @@ -84,8 +84,8 @@ public class TorperfProcessor { DescriptorReader descriptorReader = DescriptorSourceFactory.createDescriptorReader(); descriptorReader.addDirectory(torperfDirectory); - descriptorReader.setExcludeFiles(new File(statsDirectory, - "torperf-history")); + File historyFile = new File(statsDirectory, "torperf-history"); + descriptorReader.setHistoryFile(historyFile); Iterator<DescriptorFile> descriptorFiles = descriptorReader.readDescriptors(); while (descriptorFiles.hasNext()) { @@ -139,6 +139,7 @@ public class TorperfProcessor { } } } + descriptorReader.saveHistoryFile(historyFile); logger.fine("Finished importing files in " + torperfDirectory + "/."); }

1 0

[meek/master] Regen man pages.
by dcf＠torproject.org 23 Apr '17

23 Apr '17

commit 451320610020753ccaee2d533972a6ae5a1873c0 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Apr 22 23:30:37 2017 -0700 Regen man pages. --- doc/meek-server.1 | 82 +++++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 71 insertions(+), 11 deletions(-) diff --git a/doc/meek-server.1 b/doc/meek-server.1 index 5dab7dd..09d198c 100644 --- a/doc/meek-server.1 +++ b/doc/meek-server.1 @@ -1,13 +1,13 @@ '\" t .\" Title: meek-server .\" Author: [FIXME: author] [see http://docbook.sf.net/el/author] -.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/> -.\" Date: 08/10/2014 +.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/> +.\" Date: 04/22/2017 .\" Manual: \ \& .\" Source: \ \& .\" Language: English .\" -.TH "MEEK\-SERVER" "1" "08/10/2014" "\ \&" "\ \&" +.TH "MEEK\-SERVER" "1" "04/22/2017" "\ \&" "\ \&" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -31,40 +31,96 @@ meek-server \- The meek server transport plugin .SH "SYNOPSIS" .sp -\fBmeek\-server\fR \fB\-\-cert\fR=\fIFILENAME\fR \fB\-\-key\fR=\fIFILENAME\fR [\fIOPTIONS\fR] +\fBmeek\-server\fR \fB\-\-acme\-hostnames\fR=\fIHOSTNAME\fR [\fIOPTIONS\fR] .SH "DESCRIPTION" .sp meek\-server is a transport plugin for Tor that encodes a stream as a sequence of HTTP requests and responses\&. .sp -The server runs in HTTPS mode by default, and the \fB\-\-cert\fR and \fB\-\-key\fR options are required\&. Use the \fB\-\-disable\-tls\fR option to run with plain HTTP\&. +You will need to configure TLS certificates\&. There are two ways to set up certificates: .sp -Configuration for meek\-server usually appears in a torrc file\&. Here is a sample configuration using HTTPS: +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +\fB\-\-acme\-hostnames\fR=\fIHOSTNAME\fR +(with optional +\fB\-\-acme\-email\fR=\fIEMAIL\fR) will automatically get certificates for +\fIHOSTNAME\fR +using Let\(cqs Encrypt\&. This only works when meek\-server is running on port 443\&. +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +\fB\-\-cert\fR=\fIFILENAME\fR +and +\fB\-\-key\fR=\fIFILENAME\fR +allow use to use your own externally acquired certificate\&. +.RE +.sp +Configuration for meek\-server usually appears in a torrc file\&. Here is a sample configuration using automatic Let\(cqs Encrypt certificates: .sp .if n \{\ .RS 4 .\} .nf ExtORPort auto -ServerTransportPlugin meek exec \&./meek\-server \-\-port 8443 \-\-cert cert\&.pem \-\-key key\&.pem \-\-log meek\-server\&.log +ServerTransportListenAddr 0\&.0\&.0\&.0:443 +ServerTransportPlugin meek exec \&./meek\-server \-\-acme\-hostnames meek\-server\&.example \-\-log meek\-server\&.log .fi .if n \{\ .RE .\} .sp -Here is a sample configuration using plain HTTP: +Here is a sample configuration using externally acquired certificates: .sp .if n \{\ .RS 4 .\} .nf ExtORPort auto -ServerTransportPlugin meek exec \&./meek\-server \-\-port 8080 \-\-disable\-tls \-\-log meek\-server\&.log +ServerTransportListenAddr meek 0\&.0\&.0\&.0:8443 +ServerTransportPlugin meek exec \&./meek\-server 8443 \-\-cert cert\&.pem \-\-key key\&.pem \-\-log meek\-server\&.log +.fi +.if n \{\ +.RE +.\} +.sp +To listen on port 443 without needed to run as root, on Linux, you can use the setcap program, part of libcap2: +.sp +.if n \{\ +.RS 4 +.\} +.nf +setcap \*(Aqcap_net_bind_service=+ep\*(Aq /usr/local/bin/meek\-server .fi .if n \{\ .RE .\} .SH "OPTIONS" .PP +\fB\-\-acme\-email\fR=\fIEMAIL\fR +.RS 4 +Optional email address to register for Let\(cqs Encrypt notifications when using +\fB\-\-acme\-hostnames\fR\&. +.RE +.PP +\fB\-\-acme\-hostnames\fR=\fIHOSTNAME\fR[,\fIHOSTNAME\fR]\&... +.RS 4 +Comma\-separated list of hostnames to honor when getting automatic certificates from Let\(cqs Encrypt\&. meek\-server has to be running on port 443 in order for the +\fB\-\-acme\-hostnames\fR +option to work\&. The certificates will be cached in the pt_state/meek\-certificate\-cache directory inside tor state directory\&. +.RE +.PP \fB\-\-cert\fR=\fIFILENAME\fR .RS 4 Name of a PEM\-encoded TLS certificate file\&. Required unless @@ -72,7 +128,7 @@ Name of a PEM\-encoded TLS certificate file\&. Required unless is used\&. .RE .sp -\fB\-\-disable\-tls\fR: Use plain HTTP rather than HTTPS\&. +\fB\-\-disable\-tls\fR: Use plain HTTP rather than HTTPS\&. This option is only for testing purposes\&. Don\(cqt use it in production\&. .sp \fB\-\-key\fR=\fIFILENAME\fR: Name of a PEM\-encoded TLS private key file\&. Required unless \fB\-\-disable\-tls\fR is used\&. .PP @@ -83,7 +139,11 @@ Name of a file to write log messages to (default stderr)\&. .PP \fB\-\-port\fR=\fIPORT\fR .RS 4 -Port to listen on\&. Overrides the TOR_PT_SERVER_BINDADDR environment variable set by tor\&. +Port to listen on\&. Overrides the TOR_PT_SERVER_BINDADDR environment variable set by tor\&. In most cases you should set the +\fBServerTransportListenAddr\fR +option in torrc, rather than use the +\fB\-\-port\fR +option\&. .RE .PP \fB\-h\fR, \fB\-\-help\fR

1 0

[meek/master] Use ListenAndServe{TLS} rather than separate Listen and Serve.
by dcf＠torproject.org 23 Apr '17

23 Apr '17

commit cea86c937dc278ba6b2100c238b1d5206bbae2f0 Author: David Fifield <david(a)bamsoftware.com> Date: Tue Apr 11 22:18:47 2017 -0700 Use ListenAndServe{TLS} rather than separate Listen and Serve. The net/http package provides ListenAndServe and ListenAndServeTLS functions, but it doesn't provide a way to set up a listener without also entering an infinite serve loop. This matters for ListenAndServeTLS, which sets up a lot of magic behind the scenes for TLS and HTTP/2 support. Formerly, we had copy-pasted code from ListenAndServeTLS, but that code has only gotten more complicated in upstream net/http. The price we pay for this is that it's no longer possible for a server bindaddr to ask to listen on port 0 (i.e., a random ephemeral port). That's because we never get a change to find out what the listening address is, before entering the serve loop. What we gain is HTTP/2 support; formerly our copy-pasted code had the side effect of disabling HTTP/2, because it was copied from an older version and did things like config.NextProtos = []string{"http/1.1"} The new code calls http2.ConfigureServer first, but that's not what's providing HTTP/2 support. HTTP/2 support happens by default. The reason we call http2.ConfigureServer is because we need to set TLSConfig.GetCertificate, and http2.ConfigureServer is a convenient way to initialize TLSConfig in a way that is guaranteed to work with HTTP/2. --- meek-server/meek-server.go | 116 +++++++++++++++++++++++---------------------- 1 file changed, 60 insertions(+), 56 deletions(-) diff --git a/meek-server/meek-server.go b/meek-server/meek-server.go index 2b49897..dcb0c5c 100644 --- a/meek-server/meek-server.go +++ b/meek-server/meek-server.go @@ -38,6 +38,7 @@ import ( "git.torproject.org/pluggable-transports/goptlib.git" "golang.org/x/crypto/acme/autocert" + "golang.org/x/net/http2" ) const ( @@ -273,65 +274,65 @@ func (state *State) ExpireSessions() { } } -func listenTLS(network string, addr *net.TCPAddr, getCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error)) (net.Listener, error) { - // This is cribbed from the source of net/http.Server.ListenAndServeTLS. - // We have to separate the Listen and Serve parts because we need to - // report the listening address before entering Serve (which is an - // infinite loop). +func initServer(addr *net.TCPAddr, + getCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error), + listenAndServe func(*http.Server)) (*http.Server, error) { + // We're not capable of listening on port 0 (i.e., an ephemeral port + // unknown in advance). The reason is that while the net/http package + // exposes ListenAndServe and ListenAndServeTLS, those functions never + // return, so there's no opportunity to find out what the port number + // is, in between the Listen and Serve steps. // https://groups.google.com/d/msg/Golang-nuts/3F1VRCCENp8/3hcayZiwYM8J - config := &tls.Config{} - config.NextProtos = []string{"http/1.1"} - config.GetCertificate = getCertificate - - conn, err := net.ListenTCP(network, addr) - if err != nil { - return nil, err - } - - // Additionally disable SSLv3 because of the POODLE attack. - // http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiti… - // https://code.google.com/p/go/source/detail?r=ad9e191a51946e43f1abac8b6a2fef… - config.MinVersion = tls.VersionTLS10 - - tlsListener := tls.NewListener(conn, config) - - return tlsListener, nil -} - -func startListener(network string, addr *net.TCPAddr) (net.Listener, error) { - ln, err := net.ListenTCP(network, addr) - if err != nil { - return nil, err + if addr.Port == 0 { + return nil, fmt.Errorf("cannot listen on port %d; configure a port using ServerTransportListenAddr", addr.Port) } - log.Printf("listening with plain HTTP on %s", ln.Addr()) - return startServer(ln) -} - -func startListenerTLS(network string, addr *net.TCPAddr, getCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error)) (net.Listener, error) { - ln, err := listenTLS(network, addr, getCertificate) - if err != nil { - return nil, err - } - log.Printf("listening with HTTPS on %s", ln.Addr()) - return startServer(ln) -} -func startServer(ln net.Listener) (net.Listener, error) { state := NewState() go state.ExpireSessions() + server := &http.Server{ + Addr: addr.String(), Handler: state, ReadTimeout: readWriteTimeout, WriteTimeout: readWriteTimeout, } - go func() { - defer ln.Close() - err := server.Serve(ln) + // We need to override server.TLSConfig.GetCertificate--but first + // server.TLSConfig needs to be non-nil. If we just create our own new + // &tls.Config, it will lack the default settings that the net/http + // package sets up for things like HTTP/2. Therefore we first call + // http2.ConfigureServer for its side effect of initializing + // server.TLSConfig properly. An alternative would be to make a dummy + // net.Listener, call Serve on it, and let it return. + // https://github.com/golang/go/issues/16588#issuecomment-237386446 + err := http2.ConfigureServer(server, nil) + if err != nil { + return server, err + } + server.TLSConfig.GetCertificate = getCertificate + + go listenAndServe(server) + + return server, nil +} + +func startServer(addr *net.TCPAddr) (*http.Server, error) { + return initServer(addr, nil, func(server *http.Server) { + log.Printf("listening with plain HTTP on %s", addr) + err := server.ListenAndServe() if err != nil { - log.Printf("Error in Serve: %s", err) + log.Printf("Error in ListenAndServe: %s", err) } - }() - return ln, nil + }) +} + +func startServerTLS(addr *net.TCPAddr, getCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error)) (*http.Server, error) { + return initServer(addr, getCertificate, func(server *http.Server) { + log.Printf("listening with HTTPS on %s", addr) + err := server.ListenAndServeTLS("", "") + if err != nil { + log.Printf("Error in ListenAndServeTLS: %s", err) + } + }) } func getCertificateCacheDir() (string, error) { @@ -438,7 +439,7 @@ func main() { } log.Printf("starting version %s (%s)", programVersion, runtime.Version()) - listeners := make([]net.Listener, 0) + servers := make([]*http.Server, 0) for _, bindaddr := range ptInfo.Bindaddrs { if port != 0 { bindaddr.Addr.Port = port @@ -449,18 +450,18 @@ func main() { pt.SmethodError(bindaddr.MethodName, "The --acme-hostnames option requires one of the bindaddrs to be on port 443.") break } - var ln net.Listener + var server *http.Server if disableTLS { - ln, err = startListener("tcp", bindaddr.Addr) + server, err = startServer(bindaddr.Addr) } else { - ln, err = startListenerTLS("tcp", bindaddr.Addr, getCertificate) + server, err = startServerTLS(bindaddr.Addr, getCertificate) } if err != nil { pt.SmethodError(bindaddr.MethodName, err.Error()) break } - pt.Smethod(bindaddr.MethodName, ln.Addr()) - listeners = append(listeners, ln) + pt.Smethod(bindaddr.MethodName, bindaddr.Addr) + servers = append(servers, server) default: pt.SmethodError(bindaddr.MethodName, "no such method") } @@ -482,9 +483,12 @@ func main() { log.Printf("got signal %s", sig) } } - for _, ln := range listeners { - ln.Close() - } + /* + // Not supported until go1.8. + for _, server := range servers { + server.Close() + } + */ if sig == syscall.SIGTERM { log.Printf("done")

1 0

[meek/master] Wait briefly after calling ListenAndServe{TLS} to see if it errors.
by dcf＠torproject.org 23 Apr '17

23 Apr '17

commit e3f3054f8b74caa639a6d9be09702693af9a70e7 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Apr 20 00:39:30 2017 -0700 Wait briefly after calling ListenAndServe{TLS} to see if it errors. An unfortunate effect of using net/http ListenAndServe and ListenAndServeTLS is that you don't get early errors like "permission denied" and "address already in use"--they happen later which means they appear only in the meek-server log, not in the tor log. Here we apply a hack to hold on for a fraction of a second to see if the call errors, hopefully long enough to catch most of such errors. --- meek-server/meek-server.go | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/meek-server/meek-server.go b/meek-server/meek-server.go index dcb0c5c..d1000ea 100644 --- a/meek-server/meek-server.go +++ b/meek-server/meek-server.go @@ -61,6 +61,9 @@ const ( // Cull unused session ids (with their corresponding OR port connection) // if we haven't seen any activity for this long. maxSessionStaleness = 120 * time.Second + // How long to wait for ListenAndServe or ListenAndServeTLS to return an + // error before deciding that it's not going to return. + listenAndServeErrorTimeout = 100 * time.Millisecond ) var ptInfo pt.ServerInfo @@ -276,7 +279,7 @@ func (state *State) ExpireSessions() { func initServer(addr *net.TCPAddr, getCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error), - listenAndServe func(*http.Server)) (*http.Server, error) { + listenAndServe func(*http.Server, chan<- error)) (*http.Server, error) { // We're not capable of listening on port 0 (i.e., an ephemeral port // unknown in advance). The reason is that while the net/http package // exposes ListenAndServe and ListenAndServeTLS, those functions never @@ -310,28 +313,44 @@ func initServer(addr *net.TCPAddr, } server.TLSConfig.GetCertificate = getCertificate - go listenAndServe(server) + // Another unfortunate effect of the inseparable net/http ListenAndServe + // is that we can't check for Listen errors like "permission denied" and + // "address already in use" without potentially entering the infinite + // loop of Serve. The hack we apply here is to wait a short time, + // listenAndServeErrorTimeout, to see if an error is returned (because + // it's better if the error message goes to the tor log through + // SMETHOD-ERROR than if it only goes to the meek-server log). + errChan := make(chan error) + go listenAndServe(server, errChan) + select { + case err = <-errChan: + break + case <-time.After(listenAndServeErrorTimeout): + break + } - return server, nil + return server, err } func startServer(addr *net.TCPAddr) (*http.Server, error) { - return initServer(addr, nil, func(server *http.Server) { + return initServer(addr, nil, func(server *http.Server, errChan chan<- error) { log.Printf("listening with plain HTTP on %s", addr) err := server.ListenAndServe() if err != nil { log.Printf("Error in ListenAndServe: %s", err) } + errChan <- err }) } func startServerTLS(addr *net.TCPAddr, getCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error)) (*http.Server, error) { - return initServer(addr, getCertificate, func(server *http.Server) { + return initServer(addr, getCertificate, func(server *http.Server, errChan chan<- error) { log.Printf("listening with HTTPS on %s", addr) err := server.ListenAndServeTLS("", "") if err != nil { log.Printf("Error in ListenAndServeTLS: %s", err) } + errChan <- err }) }

1 0

[meek/master] Update programVersion = "0.27".
by dcf＠torproject.org 23 Apr '17

23 Apr '17

commit 5bdd128a39c6eab2850e64c8ab75112f659d916c Author: David Fifield <david(a)bamsoftware.com> Date: Thu Apr 20 01:29:29 2017 -0700 Update programVersion = "0.27". --- meek-server/meek-server.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meek-server/meek-server.go b/meek-server/meek-server.go index d1000ea..908fb8b 100644 --- a/meek-server/meek-server.go +++ b/meek-server/meek-server.go @@ -42,7 +42,7 @@ import ( ) const ( - programVersion = "0.26" + programVersion = "0.27" ptMethodName = "meek" // Reject session ids shorter than this, as a weak defense against

1 0

[doctor/master] Drop notification about BW authority outages to notice runlevel
by atagar＠torproject.org 22 Apr '17

22 Apr '17

commit 134e6be6a2da4f6be04b531ad67f978e419b9efb Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Apr 22 11:32:13 2017 -0700 Drop notification about BW authority outages to notice runlevel Dropping the runlevel so it provides daily notifications rather than every four hours. This is because maatuska's is down and there's no ETA for it. --- consensus_health_checker.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/consensus_health_checker.py b/consensus_health_checker.py index e67f798..b88f534 100755 --- a/consensus_health_checker.py +++ b/consensus_health_checker.py @@ -553,7 +553,7 @@ def voting_bandwidth_scanners(latest_consensus, consensuses, votes): issues = [] if missing_authorities: - runlevel = Runlevel.ERROR if len(missing_authorities) > 1 else Runlevel.WARNING + runlevel = Runlevel.ERROR if len(missing_authorities) > 1 else Runlevel.NOTICE issues.append(Issue(runlevel, 'MISSING_BANDWIDTH_SCANNERS', authorities = ', '.join(missing_authorities), to = missing_authorities)) if extra_authorities:

1 0

[translation/liveusb-creator_completed] Update translations for liveusb-creator_completed
by translation＠torproject.org 22 Apr '17

22 Apr '17

commit 2383ed2fbd8999d2561c34c3356d7cf166cc4205 Author: Translation commit bot <translation(a)torproject.org> Date: Sat Apr 22 15:45:37 2017 +0000 Update translations for liveusb-creator_completed --- nb/nb.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nb/nb.po b/nb/nb.po index fbcbcc3..13d5595 100644 --- a/nb/nb.po +++ b/nb/nb.po @@ -13,7 +13,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2015-11-02 21:23+0100\n" -"PO-Revision-Date: 2017-03-30 06:56+0000\n" +"PO-Revision-Date: 2017-04-22 15:44+0000\n" "Last-Translator: Allan Nordhøy <epost(a)anotheragency.no>\n" "Language-Team: Norwegian Bokmål (http://www.transifex.com/otf/torproject/language/nb/)\n" "MIME-Version: 1.0\n"

1 0

[translation/liveusb-creator] Update translations for liveusb-creator
by translation＠torproject.org 22 Apr '17

22 Apr '17

commit 4e812da7b1a8021a502ec6898a6d4a26f8344ab9 Author: Translation commit bot <translation(a)torproject.org> Date: Sat Apr 22 15:45:33 2017 +0000 Update translations for liveusb-creator --- nb/nb.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nb/nb.po b/nb/nb.po index fbcbcc3..13d5595 100644 --- a/nb/nb.po +++ b/nb/nb.po @@ -13,7 +13,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2015-11-02 21:23+0100\n" -"PO-Revision-Date: 2017-03-30 06:56+0000\n" +"PO-Revision-Date: 2017-04-22 15:44+0000\n" "Last-Translator: Allan Nordhøy <epost(a)anotheragency.no>\n" "Language-Team: Norwegian Bokmål (http://www.transifex.com/otf/torproject/language/nb/)\n" "MIME-Version: 1.0\n"

1 0

[translation/https_everywhere_completed] Update translations for https_everywhere_completed
by translation＠torproject.org 22 Apr '17

22 Apr '17

commit cadcbc1a7badd43017c10ca50b9e29719ccba956 Author: Translation commit bot <translation(a)torproject.org> Date: Sat Apr 22 15:45:29 2017 +0000 Update translations for https_everywhere_completed --- nb/https-everywhere.dtd | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/nb/https-everywhere.dtd b/nb/https-everywhere.dtd index 1c4846b..c7a7f20 100644 --- a/nb/https-everywhere.dtd +++ b/nb/https-everywhere.dtd @@ -9,11 +9,11 @@ <!ENTITY https-everywhere.about.thanks "Takk til"> <!ENTITY https-everywhere.about.many_contributors "En masse bidragsytere, inkludert"> <!ENTITY https-everywhere.about.noscript "Også deler av HTTPS-everywhere er basert på kode fra NoScript, av Giorgio Maone og andre. Vi er takknemlige for deres utmerkede arbeid!"> -<!ENTITY https-everywhere.about.contribute "Hvis du liker HTTPS-everywhere, vurder å"> -<!ENTITY https-everywhere.about.donate_tor "Donasjoner til Tor"> +<!ENTITY https-everywhere.about.contribute "Hvis du liker HTTPS-everywhere, vurder en"> +<!ENTITY https-everywhere.about.donate_tor "donasjon til Tor"> <!ENTITY https-everywhere.about.tor_lang_code "no"> -<!ENTITY https-everywhere.about.or "eller"> -<!ENTITY https-everywhere.about.donate_eff "Donasjoner til EFF"> +<!ENTITY https-everywhere.about.or "eller en"> +<!ENTITY https-everywhere.about.donate_eff "donasjon til EFF"> <!ENTITY https-everywhere.menu.donate_eff_imperative "Doner til EFF"> <!ENTITY https-everywhere.menu.about "Om HTTPS-everywhere">

1 0