May 2017 - tor-commits - lists.torproject.org

[webwml/master] mention the newer ed25519 key for debian relay operators
by arma＠torproject.org 15 May '17

15 May '17

commit b3014bd2873d13436d65b267bab55e31b08f100b Author: Roger Dingledine <arma(a)torproject.org> Date: Sun May 14 23:23:57 2017 -0400 mention the newer ed25519 key for debian relay operators --- docs/en/tor-relay-debian.wml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/en/tor-relay-debian.wml b/docs/en/tor-relay-debian.wml index 7008d82..827b29d 100644 --- a/docs/en/tor-relay-debian.wml +++ b/docs/en/tor-relay-debian.wml @@ -126,8 +126,10 @@ href="<wiki>/doc/TorExitGuidelines">guidelines </p> <p> - 8. Consider backing up your Tor relay's private key - ("/var/lib/tor/keys/secret_id_key"). You'll need this identity key to + 8. Consider backing up your Tor relay's private keys + ("/var/lib/tor/keys/secret_id_key" and + "/var/lib/tor/keys/ed25519_master_id_secret_key"). + You'll need these identity keys to <a href="<page docs/faq>#UpgradeOrMove">move or restore your Tor relay</a>. </p>

1 0

[support-portal/master] Add reduced policy question
by colin＠torproject.org 15 May '17

15 May '17

commit c813045174662ae418f8c35ddb6a6711243468b7 Author: Colin Childs <colin(a)torproject.org> Date: Sun May 14 21:09:42 2017 -0500 Add reduced policy question --- plain/operator.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/plain/operator.txt b/plain/operator.txt index 4a55428..eb68790 100644 --- a/plain/operator.txt +++ b/plain/operator.txt @@ -38,7 +38,6 @@ RunAsDaemon 1 When it decides that it's reachable, it will upload a "server descriptor" to the directory authorities, to let clients know what address, ports, keys, etc your relay is using. After a few hours (to give it enough time to propagate), you can query Atlas[https://atlas.torproject.org] to see whether your relay has successfully registered in the network. - Q. How do I run an exit relay on Debian? A. @@ -87,3 +86,5 @@ A. Q. Can I load balance an onion service? A. +Q. What is the reduced exit policy? +A.

1 0

[support-portal/master] Dropping question for setting up vanilla bridges, combining with general
by colin＠torproject.org 15 May '17

15 May '17

commit 561b73442047f6912f8c84734051cc8d07a4d4a4 Author: Colin Childs <colin(a)torproject.org> Date: Sun May 14 21:12:14 2017 -0500 Dropping question for setting up vanilla bridges, combining with general bridge question --- plain/operator.txt | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/plain/operator.txt b/plain/operator.txt index eb68790..888399c 100644 --- a/plain/operator.txt +++ b/plain/operator.txt @@ -41,10 +41,7 @@ When it decides that it's reachable, it will upload a "server descriptor" to the Q. How do I run an exit relay on Debian? A. -Q. How do I run a vanilla bridge? -A. - -Q. How do I run a bridge with pluggable transports? +Q. How do I run a bridge? A. Q. How do I run a standard onion service?

1 0

[support-portal/master] Push initial answer for Debian middle / guard operators
by colin＠torproject.org 15 May '17

15 May '17

commit 56c1bf050f0907b7f70ad959de8cb1505f5a13c2 Author: Colin Childs <colin(a)torproject.org> Date: Sun May 14 21:05:13 2017 -0500 Push initial answer for Debian middle / guard operators --- plain/operator.txt | 44 +++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 41 insertions(+), 3 deletions(-) diff --git a/plain/operator.txt b/plain/operator.txt index 6cf98d6..4a55428 100644 --- a/plain/operator.txt +++ b/plain/operator.txt @@ -1,7 +1,45 @@ -Q. How do I run a middle/guard relay? +Q. How do I run a middle/guard relay on Debian? A. +1. If you're on Debian, start with "apt-get install tor" (as root). +2. Make sure your clock, date, and timezone are set correctly. Intall the ntp or openntpd (or similar) package to keep it that way. +3. Edit /etc/torrc to look like the following: +''' +## The IP address or hostname for incoming connections (leave commented and Tor will guess) +#Address noname.example.com -Q. How do I run an exit relay? +## Set the nickname of this relay +Nickname ididnteditheconfig + +## Set your own contact info +ContactInfo 0xFFFFFFFF Random Person <nobody AT example dot com> + +## If you control multiple relays, include then in the family +#MyFamily $keyid,$keyid,... + +ORPort 9001 +DirPort 9030 + +## Set your bandwidth rate (leave commented and Tor will run without bandwidth caps) +#RelayBandwidthRate 30 MBytes +#RelayBandwidthBurst 100 MBytes + +SocksPort 0 +SocksPolicy reject * + +ExitPolicy reject *:* + +Log notice file /var/log/tor/log +DataDirectory /var/lib/tor +RunAsDaemon 1 +''' + +4. Run "service tor reload" (as root) +5. Once your relay connects to the network, it will try to determine whether the ports you configured are reachable from the outside. This step is usually fast, but it may take a few minutes. Look for a log entry in your /var/log/tor/log like Self-testing indicates your ORPort is reachable from the outside. Excellent. If you don't see this message, it means that your relay is not reachable from the outside you should re-check your firewalls, check that it's testing the IP and port you think it should be testing, etc. + +When it decides that it's reachable, it will upload a "server descriptor" to the directory authorities, to let clients know what address, ports, keys, etc your relay is using. After a few hours (to give it enough time to propagate), you can query Atlas[https://atlas.torproject.org] to see whether your relay has successfully registered in the network. + + +Q. How do I run an exit relay on Debian? A. Q. How do I run a vanilla bridge? @@ -17,7 +55,7 @@ Q. How do I run a single onion service? A. Q. What is the difference between a single and standard onion service? -A. Over the past several years, we've collaborated with many large scale service providers such as Facebook and Riseup, organizations that deployed Onion Services to improve their performance. +A. Over the past several years, we've collaborated with many large scale service providers such as Facebook and Riseup, organizations that deployed Onion Services to improve their performance. Onion services are great because they offer both anonymity on the service and the client side. However, there are cases where the onion service does not require anonymity. The main example of this is when the service provider does not need to hide the location of its servers.

1 0

[support-portal/master] More torbrowserfaq.txt answers
by colin＠torproject.org 15 May '17

15 May '17

commit b4e96062e7bbc811d116d7e5cf6f12242c1748d0 Author: Colin Childs <colin(a)torproject.org> Date: Tue May 9 00:22:39 2017 -0500 More torbrowserfaq.txt answers --- plain/torbrowserfaq.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plain/torbrowserfaq.txt b/plain/torbrowserfaq.txt index 088a353..a90284c 100644 --- a/plain/torbrowserfaq.txt +++ b/plain/torbrowserfaq.txt @@ -116,13 +116,13 @@ Q. Why did my search engine switch to DuckDuckGo? A. Q. I'm having a problem with DuckDuckGo. -A. +A. Please see the DuckDuckGo support portal at https://duck.co/help. If you believe this is a Tor Browser issue, please let us know at <tk>. Q. I'm having a problem with NoScript. -A. +A. Please see the NoScript FAQ at https://noscript.net/faq. If you believe this is a Tor Browser issue, please let us know at <tk>. Q. I'm having a problem with HTTPSEverywhere -A. +A. Please see the HTTPS-Everywhere FAQ at https://www.eff.org/https-everywhere/faq. If you believe this is a Tor Browser issue, please let us know at <tk>.. Q. Why should I use Tor Browser? Why can't I use Tor + Firefox or Tor + Chrome? A.

1 0

[stem/master] Check consensus signatures
by atagar＠torproject.org 15 May '17

15 May '17

commit 8c84eea733f8be0d5f74265c7387230df3200f7b Author: Tyler Parks <tparks5(a)mail.csuchico.edu> Date: Sun May 14 17:18:09 2017 -0700 Check consensus signatures We already validate crypto of most descriptor types but lacked this check for arguably the most important thing: the consensus. This requires key certificates so unlike other descriptors this isn't validated by default. Rather, callers need to call validate_signatures() with the authority certificates. This branch has been a collaboration between Tyler and Damian over a couple weeks of bouncing remotes back and forth. :P https://trac.torproject.org/projects/tor/ticket/11045 --- docs/change_log.rst | 1 + stem/descriptor/__init__.py | 6 +----- stem/descriptor/networkstatus.py | 33 +++++++++++++++++++++++++++++++++ stem/descriptor/remote.py | 13 ++++++++++++- test/integ/descriptor/__init__.py | 4 ++-- test/integ/descriptor/networkstatus.py | 15 ++++++++++++++- 6 files changed, 63 insertions(+), 9 deletions(-) diff --git a/docs/change_log.rst b/docs/change_log.rst index b99d0b4..cd5dcd5 100644 --- a/docs/change_log.rst +++ b/docs/change_log.rst @@ -55,6 +55,7 @@ The following are only available within Stem's `git repository * Supporting `descriptor creation <tutorials/mirror_mirror_on_the_wall.html#can-i-create-descriptors>`_ (:trac:`10227`) * Support and validation for `ed25519 certificates <api/descriptor/certificate.html>`_ (`spec <https://gitweb.torproject.org/torspec.git/tree/cert-spec.txt>`_, :trac:`21558`) + * Added :func:`~stem.descriptor.networkstatus.NetworkStatusDocumentV3.validate_signatures` to check our key certificate signatures (:trac:`11045`) * Moved from the deprecated `pycrypto <https://www.dlitz.net/software/pycrypto/>`_ module to `cryptography <https://pypi.python.org/pypi/cryptography>`_ for validating signatures (:trac:`21086`) * Sped descriptor reading by ~25% by deferring defaulting when validating * Added server descriptor's new extra_info_sha256_digest attribute (:spec:`0f03581`) diff --git a/stem/descriptor/__init__.py b/stem/descriptor/__init__.py index 1826b36..b9c31af 100644 --- a/stem/descriptor/__init__.py +++ b/stem/descriptor/__init__.py @@ -681,17 +681,14 @@ class Descriptor(object): from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives.serialization import load_der_public_key from cryptography.utils import int_to_bytes, int_from_bytes - key = load_der_public_key(_bytes_for_block(signing_key), default_backend()) modulus = key.public_numbers().n public_exponent = key.public_numbers().e - sig_as_bytes = _bytes_for_block(signature) sig_as_long = int_from_bytes(sig_as_bytes, byteorder='big') # convert signature to an int - blocksize = 128 # block size will always be 128 for a 1024 bit key + blocksize = len(sig_as_bytes) # 256B for NetworkStatusDocuments, 128B for others # use the public exponent[e] & the modulus[n] to decrypt the int - decrypted_int = pow(sig_as_long, public_exponent, modulus) # convert the int to a byte array @@ -708,7 +705,6 @@ class Descriptor(object): # More info here http://www.ietf.org/rfc/rfc2313.txt # esp the Notes in section 8.1 ############################################################################ - try: if decrypted_bytes.index(b'\x00\x01') != 0: raise ValueError('Verification failed, identifier missing') diff --git a/stem/descriptor/networkstatus.py b/stem/descriptor/networkstatus.py index ff9f105..1a155cd 100644 --- a/stem/descriptor/networkstatus.py +++ b/stem/descriptor/networkstatus.py @@ -1055,6 +1055,39 @@ class NetworkStatusDocumentV3(NetworkStatusDocument): self.routers = dict((desc.fingerprint, desc) for desc in router_iter) self._footer(document_file, validate) + def validate_signatures(self, key_certs): + """ + Validates we're properly signed by the signing certificates. + + .. versionadded:: 1.6.0 + + :param list key_certs: :class:`~stem.descriptor.networkstatus.KeyCertificates` + to validate the consensus against + + :raises: **ValueError** if an insufficient number of valid signatures are present. + """ + + # sha1 hash of the body and header + + local_digest = self._digest_for_content(b'network-status-version', b'directory-signature ') + + valid_digests, total_digests = 0, 0 + required_digests = len(self.signatures) / 2.0 + signing_keys = dict([(cert.fingerprint, cert.signing_key) for cert in key_certs]) + + for sig in self.signatures: + if sig.identity not in signing_keys: + continue + + signed_digest = self._digest_for_signature(signing_keys[sig.identity], sig.signature) + total_digests += 1 + + if signed_digest == local_digest: + valid_digests += 1 + + if valid_digests < required_digests: + raise ValueError('Network Status Document has %i valid signatures out of %i total, needed %i' % (valid_digests, total_digests, required_digests)) + def get_unrecognized_lines(self): if self._lazy_loading: self._parse(self._header_entries, False, parser_for_line = self.HEADER_PARSER_FOR_LINE) diff --git a/stem/descriptor/remote.py b/stem/descriptor/remote.py index 79f3889..2f44504 100644 --- a/stem/descriptor/remote.py +++ b/stem/descriptor/remote.py @@ -98,6 +98,7 @@ except ImportError: import urllib2 as urllib import stem.descriptor +import stem.prereq from stem import Flag from stem.util import _hash_attr, connection, log, str_tools, tor_tools @@ -628,7 +629,17 @@ class DescriptorDownloader(object): if authority_v3ident: resource += '/%s' % authority_v3ident - return self.query(resource + '.z', **query_args) + consensus_query = self.query(resource + '.z', **query_args) + + # if we're performing validation then check that it's signed by the + # authority key certificates + + if consensus_query.validate and consensus_query.document_handler == stem.descriptor.DocumentHandler.DOCUMENT and stem.prereq.is_crypto_available(): + consensus = list(consensus_query.run())[0] + key_certs = self.get_key_certificates(**query_args).run() + consensus.validate_signatures(key_certs) + + return consensus_query def get_vote(self, authority, **query_args): """ diff --git a/test/integ/descriptor/__init__.py b/test/integ/descriptor/__init__.py index b2f7121..331316a 100644 --- a/test/integ/descriptor/__init__.py +++ b/test/integ/descriptor/__init__.py @@ -5,7 +5,7 @@ Integration tests for stem.descriptor.* contents. __all__ = [ 'extrainfo_descriptor', 'microdescriptor', + 'networkstatus', + 'remote' 'server_descriptor', - 'get_resource', - 'open_desc', ] diff --git a/test/integ/descriptor/networkstatus.py b/test/integ/descriptor/networkstatus.py index 72d503a..59dca00 100644 --- a/test/integ/descriptor/networkstatus.py +++ b/test/integ/descriptor/networkstatus.py @@ -7,17 +7,30 @@ import unittest import stem import stem.descriptor -import stem.descriptor.networkstatus +import stem.descriptor.remote import stem.version import test.runner from test.util import ( register_new_capability, only_run_once, + require_cryptography, + require_online, ) class TestNetworkStatus(unittest.TestCase): + @require_online + @require_cryptography + @only_run_once + def test_signature_validation(self): + """ + The full consensus is pretty sizable so rather than storing a copy of it + using the remote module. Chekcing the signature on the current consensus. + """ + + stem.descriptor.remote.get_consensus(document_handler = stem.descriptor.DocumentHandler.DOCUMENT, validate = True).run() + @only_run_once def test_cached_consensus(self): """

1 0

[tor-browser-build/master] Pick up new tor-browser tag
by boklm＠torproject.org 15 May '17

15 May '17

commit 5084700b66e5c2420554cbfea9e11995b4be5ec5 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon May 15 02:03:23 2017 +0200 Pick up new tor-browser tag --- projects/firefox/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index f5c765f..9c807ad 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,13 +1,13 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename: 'firefox-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %]' -git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-2-build1' +git_hash: 'tor-browser-[% c("var/firefox_version") %]-[% c("var/torbrowser_branch") %]-1-build2' tag_gpg_id: 1 git_url: https://git.torproject.org/tor-browser.git gpg_keyring: torbutton.gpg var: - firefox_version: 52.1.0esr + firefox_version: 52.1.1esr torbrowser_branch: 7.0 torbrowser_update_channel: alpha copyright_year: '[% exec("git show -s --format=%ci").remove("-.*") %]'

1 0

[tor/master] Remove two obsoleted options.
by nickm＠torproject.org 15 May '17

15 May '17

commit c83657c6878f805f01b5656c9f9a34f6fadc7307 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun May 14 19:06:15 2017 -0400 Remove two obsoleted options. Spotted by atagar Closes #22257 --- doc/tor.1.txt | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 1fffe08..0af4e5f 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -661,12 +661,6 @@ GENERAL OPTIONS following the Tor specification. Otherwise, they are logged with severity \'info'. (Default: 0) -[[PredictedPortsRelevanceTime]] **PredictedPortsRelevanceTime** __NUM__:: - Set how long, after the client has made an anonymized connection to a - given port, we will try to make sure that we build circuits to - exits that support that port. This option is deprecated. Please use - CircuitsAvailableTimeout instead. - [[RunAsDaemon]] **RunAsDaemon** **0**|**1**:: If 1, Tor forks and daemonizes to the background. This option has no effect on Windows; instead you should use the --service command-line option. @@ -806,10 +800,6 @@ The following options are useful only for clients (that is, if from the specified value to twice that amount. (Default: 30 minutes; Max: 24 hours) -[[CircuitIdleTimeout]] **CircuitIdleTimeout** __NUM__:: - If we have kept a clean (never used) circuit around for NUM seconds, then - close it. This option is deprecated. Use CircuitsAvailableTimeout instead. - [[CircuitStreamTimeout]] **CircuitStreamTimeout** __NUM__:: If non-zero, this option overrides our internal timeout schedule for how many seconds until we detach a stream from a circuit and try a new circuit.

1 0

[tor/master] fmt two man page entries
by arma＠torproject.org 15 May '17

15 May '17

commit 1474aaa4563508a9b1c75d495101b697ce7d7fbd Author: Roger Dingledine <arma(a)torproject.org> Date: Sun May 14 19:04:00 2017 -0400 fmt two man page entries whoever made the patch for #17975 wasn't using a proper green-screen vt100. :) --- doc/tor.1.txt | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 96e5fa1..1fffe08 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -638,18 +638,19 @@ GENERAL OPTIONS (127.0.0.0/8 and ::1). [[OutboundBindAddressOR]] **OutboundBindAddressOR** __IP__:: - Make all outbound non-exit (relay and other) connections originate from the IP - address specified. This option overrides **OutboundBindAddress** for the same - IP version. This option may be used twice, once with an IPv4 address and once - with an IPv6 address. This setting will be ignored for connections to the - loopback addresses (127.0.0.0/8 and ::1). + Make all outbound non-exit (relay and other) connections + originate from the IP address specified. This option overrides + **OutboundBindAddress** for the same IP version. This option may + be used twice, once with an IPv4 address and once with an IPv6 + address. This setting will be ignored for connections to the loopback + addresses (127.0.0.0/8 and ::1). [[OutboundBindAddressExit]] **OutboundBindAddressExit** __IP__:: - Make all outbound exit connections originate from the IP address specified. This - option overrides **OutboundBindAddress** for the same IP version. This option - may be used twice, once with an IPv4 address and once with an IPv6 address. This - setting will be ignored for connections to the loopback addresses (127.0.0.0/8 - and ::1). + Make all outbound exit connections originate from the IP address + specified. This option overrides **OutboundBindAddress** for the + same IP version. This option may be used twice, once with an IPv4 + address and once with an IPv6 address. This setting will be ignored + for connections to the loopback addresses (127.0.0.0/8 and ::1). [[PidFile]] **PidFile** __FILE__:: On startup, write our PID to FILE. On clean shutdown, remove

1 0

[tor/master] remove stray equals sign
by arma＠torproject.org 15 May '17

15 May '17

commit 2cf8f6772b80d73561a987a7153fd382fb805047 Author: Roger Dingledine <arma(a)torproject.org> Date: Sun May 14 19:00:36 2017 -0400 remove stray equals sign resolves ticket 22256. this typo crept in during bug 21715's commit fd8284c8. --- doc/tor.1.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 17977af..96e5fa1 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -638,7 +638,7 @@ GENERAL OPTIONS (127.0.0.0/8 and ::1). [[OutboundBindAddressOR]] **OutboundBindAddressOR** __IP__:: - Make all outbound non-exit (=relay and other) connections originate from the IP + Make all outbound non-exit (relay and other) connections originate from the IP address specified. This option overrides **OutboundBindAddress** for the same IP version. This option may be used twice, once with an IPv4 address and once with an IPv6 address. This setting will be ignored for connections to the

1 0