May 2017 - tor-commits - lists.torproject.org

[support-portal/master] Add reduced policy question
by colin＠torproject.org 15 May '17

15 May '17

commit c813045174662ae418f8c35ddb6a6711243468b7 Author: Colin Childs <colin(a)torproject.org> Date: Sun May 14 21:09:42 2017 -0500 Add reduced policy question --- plain/operator.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/plain/operator.txt b/plain/operator.txt index 4a55428..eb68790 100644 --- a/plain/operator.txt +++ b/plain/operator.txt @@ -38,7 +38,6 @@ RunAsDaemon 1 When it decides that it's reachable, it will upload a "server descriptor" to … [View More]

1 0

[support-portal/master] Dropping question for setting up vanilla bridges, combining with general
by colin＠torproject.org 15 May '17

15 May '17

commit 561b73442047f6912f8c84734051cc8d07a4d4a4 Author: Colin Childs <colin(a)torproject.org> Date: Sun May 14 21:12:14 2017 -0500 Dropping question for setting up vanilla bridges, combining with general bridge question --- plain/operator.txt | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/plain/operator.txt b/plain/operator.txt index eb68790..888399c 100644 --- a/plain/operator.txt +++ b/plain/operator.txt @@ -41,10 +41,7 @@ When it decides that it's … [View More]

1 0

[support-portal/master] Push initial answer for Debian middle / guard operators
by colin＠torproject.org 15 May '17

15 May '17

commit 56c1bf050f0907b7f70ad959de8cb1505f5a13c2 Author: Colin Childs <colin(a)torproject.org> Date: Sun May 14 21:05:13 2017 -0500 Push initial answer for Debian middle / guard operators --- plain/operator.txt | 44 +++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 41 insertions(+), 3 deletions(-) diff --git a/plain/operator.txt b/plain/operator.txt index 6cf98d6..4a55428 100644 --- a/plain/operator.txt +++ b/plain/operator.txt @@ -1,7 +1,45 @@ -Q. How do I run a … [View More]middle/guard relay? +Q. How do I run a middle/guard relay on Debian? A. +1. If you're on Debian, start with "apt-get install tor" (as root). +2. Make sure your clock, date, and timezone are set correctly. Intall the ntp or openntpd (or similar) package to keep it that way. +3. Edit /etc/torrc to look like the following: +''' +## The IP address or hostname for incoming connections (leave commented and Tor will guess) +#Address noname.example.com -Q. How do I run an exit relay? +## Set the nickname of this relay +Nickname ididnteditheconfig + +## Set your own contact info +ContactInfo 0xFFFFFFFF Random Person <nobody AT example dot com> + +## If you control multiple relays, include then in the family +#MyFamily $keyid,$keyid,... + +ORPort 9001 +DirPort 9030 + +## Set your bandwidth rate (leave commented and Tor will run without bandwidth caps) +#RelayBandwidthRate 30 MBytes +#RelayBandwidthBurst 100 MBytes + +SocksPort 0 +SocksPolicy reject * + +ExitPolicy reject *:* + +Log notice file /var/log/tor/log +DataDirectory /var/lib/tor +RunAsDaemon 1 +''' + +4. Run "service tor reload" (as root) +5. Once your relay connects to the network, it will try to determine whether the ports you configured are reachable from the outside. This step is usually fast, but it may take a few minutes. Look for a log entry in your /var/log/tor/log like Self-testing indicates your ORPort is reachable from the outside. Excellent. If you don't see this message, it means that your relay is not reachable from the outside you should re-check your firewalls, check that it's testing the IP and port you think it should be testing, etc. + +When it decides that it's reachable, it will upload a "server descriptor" to the directory authorities, to let clients know what address, ports, keys, etc your relay is using. After a few hours (to give it enough time to propagate), you can query Atlas[https://atlas.torproject.org] to see whether your relay has successfully registered in the network. + + +Q. How do I run an exit relay on Debian? A. Q. How do I run a vanilla bridge? @@ -17,7 +55,7 @@ Q. How do I run a single onion service? A. Q. What is the difference between a single and standard onion service? -A. Over the past several years, we've collaborated with many large scale service providers such as Facebook and Riseup, organizations that deployed Onion Services to improve their performance. +A. Over the past several years, we've collaborated with many large scale service providers such as Facebook and Riseup, organizations that deployed Onion Services to improve their performance. Onion services are great because they offer both anonymity on the service and the client side. However, there are cases where the onion service does not require anonymity. The main example of this is when the service provider does not need to hide the location of its servers. [View Less]

1 0

[support-portal/master] More torbrowserfaq.txt answers
by colin＠torproject.org 15 May '17

15 May '17

commit b4e96062e7bbc811d116d7e5cf6f12242c1748d0 Author: Colin Childs <colin(a)torproject.org> Date: Tue May 9 00:22:39 2017 -0500 More torbrowserfaq.txt answers --- plain/torbrowserfaq.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plain/torbrowserfaq.txt b/plain/torbrowserfaq.txt index 088a353..a90284c 100644 --- a/plain/torbrowserfaq.txt +++ b/plain/torbrowserfaq.txt @@ -116,13 +116,13 @@ Q. Why did my search engine switch to DuckDuckGo? A. Q. … [View More]

1 0

[stem/master] Check consensus signatures
by atagar＠torproject.org 15 May '17

15 May '17

commit 8c84eea733f8be0d5f74265c7387230df3200f7b Author: Tyler Parks <tparks5(a)mail.csuchico.edu> Date: Sun May 14 17:18:09 2017 -0700 Check consensus signatures We already validate crypto of most descriptor types but lacked this check for arguably the most important thing: the consensus. This requires key certificates so unlike other descriptors this isn't validated by default. Rather, callers need to call validate_signatures() with the authority … [View More]certificates. This branch has been a collaboration between Tyler and Damian over a couple weeks of bouncing remotes back and forth. :P https://trac.torproject.org/projects/tor/ticket/11045 --- docs/change_log.rst | 1 + stem/descriptor/__init__.py | 6 +----- stem/descriptor/networkstatus.py | 33 +++++++++++++++++++++++++++++++++ stem/descriptor/remote.py | 13 ++++++++++++- test/integ/descriptor/__init__.py | 4 ++-- test/integ/descriptor/networkstatus.py | 15 ++++++++++++++- 6 files changed, 63 insertions(+), 9 deletions(-) diff --git a/docs/change_log.rst b/docs/change_log.rst index b99d0b4..cd5dcd5 100644 --- a/docs/change_log.rst +++ b/docs/change_log.rst @@ -55,6 +55,7 @@ The following are only available within Stem's `git repository * Supporting `descriptor creation <tutorials/mirror_mirror_on_the_wall.html#can-i-create-descriptors>`_ (:trac:`10227`) * Support and validation for `ed25519 certificates <api/descriptor/certificate.html>`_ (`spec <https://gitweb.torproject.org/torspec.git/tree/cert-spec.txt>`_, :trac:`21558`) + * Added :func:`~stem.descriptor.networkstatus.NetworkStatusDocumentV3.validate_signatures` to check our key certificate signatures (:trac:`11045`) * Moved from the deprecated `pycrypto <https://www.dlitz.net/software/pycrypto/>`_ module to `cryptography <https://pypi.python.org/pypi/cryptography>`_ for validating signatures (:trac:`21086`) * Sped descriptor reading by ~25% by deferring defaulting when validating * Added server descriptor's new extra_info_sha256_digest attribute (:spec:`0f03581`) diff --git a/stem/descriptor/__init__.py b/stem/descriptor/__init__.py index 1826b36..b9c31af 100644 --- a/stem/descriptor/__init__.py +++ b/stem/descriptor/__init__.py @@ -681,17 +681,14 @@ class Descriptor(object): from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives.serialization import load_der_public_key from cryptography.utils import int_to_bytes, int_from_bytes - key = load_der_public_key(_bytes_for_block(signing_key), default_backend()) modulus = key.public_numbers().n public_exponent = key.public_numbers().e - sig_as_bytes = _bytes_for_block(signature) sig_as_long = int_from_bytes(sig_as_bytes, byteorder='big') # convert signature to an int - blocksize = 128 # block size will always be 128 for a 1024 bit key + blocksize = len(sig_as_bytes) # 256B for NetworkStatusDocuments, 128B for others # use the public exponent[e] & the modulus[n] to decrypt the int - decrypted_int = pow(sig_as_long, public_exponent, modulus) # convert the int to a byte array @@ -708,7 +705,6 @@ class Descriptor(object): # More info here http://www.ietf.org/rfc/rfc2313.txt # esp the Notes in section 8.1 ############################################################################ - try: if decrypted_bytes.index(b'\x00\x01') != 0: raise ValueError('Verification failed, identifier missing') diff --git a/stem/descriptor/networkstatus.py b/stem/descriptor/networkstatus.py index ff9f105..1a155cd 100644 --- a/stem/descriptor/networkstatus.py +++ b/stem/descriptor/networkstatus.py @@ -1055,6 +1055,39 @@ class NetworkStatusDocumentV3(NetworkStatusDocument): self.routers = dict((desc.fingerprint, desc) for desc in router_iter) self._footer(document_file, validate) + def validate_signatures(self, key_certs): + """ + Validates we're properly signed by the signing certificates. + + .. versionadded:: 1.6.0 + + :param list key_certs: :class:`~stem.descriptor.networkstatus.KeyCertificates` + to validate the consensus against + + :raises: **ValueError** if an insufficient number of valid signatures are present. + """ + + # sha1 hash of the body and header + + local_digest = self._digest_for_content(b'network-status-version', b'directory-signature ') + + valid_digests, total_digests = 0, 0 + required_digests = len(self.signatures) / 2.0 + signing_keys = dict([(cert.fingerprint, cert.signing_key) for cert in key_certs]) + + for sig in self.signatures: + if sig.identity not in signing_keys: + continue + + signed_digest = self._digest_for_signature(signing_keys[sig.identity], sig.signature) + total_digests += 1 + + if signed_digest == local_digest: + valid_digests += 1 + + if valid_digests < required_digests: + raise ValueError('Network Status Document has %i valid signatures out of %i total, needed %i' % (valid_digests, total_digests, required_digests)) + def get_unrecognized_lines(self): if self._lazy_loading: self._parse(self._header_entries, False, parser_for_line = self.HEADER_PARSER_FOR_LINE) diff --git a/stem/descriptor/remote.py b/stem/descriptor/remote.py index 79f3889..2f44504 100644 --- a/stem/descriptor/remote.py +++ b/stem/descriptor/remote.py @@ -98,6 +98,7 @@ except ImportError: import urllib2 as urllib import stem.descriptor +import stem.prereq from stem import Flag from stem.util import _hash_attr, connection, log, str_tools, tor_tools @@ -628,7 +629,17 @@ class DescriptorDownloader(object): if authority_v3ident: resource += '/%s' % authority_v3ident - return self.query(resource + '.z', **query_args) + consensus_query = self.query(resource + '.z', **query_args) + + # if we're performing validation then check that it's signed by the + # authority key certificates + + if consensus_query.validate and consensus_query.document_handler == stem.descriptor.DocumentHandler.DOCUMENT and stem.prereq.is_crypto_available(): + consensus = list(consensus_query.run())[0] + key_certs = self.get_key_certificates(**query_args).run() + consensus.validate_signatures(key_certs) + + return consensus_query def get_vote(self, authority, **query_args): """ diff --git a/test/integ/descriptor/__init__.py b/test/integ/descriptor/__init__.py index b2f7121..331316a 100644 --- a/test/integ/descriptor/__init__.py +++ b/test/integ/descriptor/__init__.py @@ -5,7 +5,7 @@ Integration tests for stem.descriptor.* contents. __all__ = [ 'extrainfo_descriptor', 'microdescriptor', + 'networkstatus', + 'remote' 'server_descriptor', - 'get_resource', - 'open_desc', ] diff --git a/test/integ/descriptor/networkstatus.py b/test/integ/descriptor/networkstatus.py index 72d503a..59dca00 100644 --- a/test/integ/descriptor/networkstatus.py +++ b/test/integ/descriptor/networkstatus.py @@ -7,17 +7,30 @@ import unittest import stem import stem.descriptor -import stem.descriptor.networkstatus +import stem.descriptor.remote import stem.version import test.runner from test.util import ( register_new_capability, only_run_once, + require_cryptography, + require_online, ) class TestNetworkStatus(unittest.TestCase): + @require_online + @require_cryptography + @only_run_once + def test_signature_validation(self): + """ + The full consensus is pretty sizable so rather than storing a copy of it + using the remote module. Chekcing the signature on the current consensus. + """ + + stem.descriptor.remote.get_consensus(document_handler = stem.descriptor.DocumentHandler.DOCUMENT, validate = True).run() + @only_run_once def test_cached_consensus(self): """ [View Less]

1 0

[tor-browser-build/master] Pick up new tor-browser tag
by boklm＠torproject.org 15 May '17

15 May '17

commit 5084700b66e5c2420554cbfea9e11995b4be5ec5 Author: Nicolas Vigier <boklm(a)torproject.org> Date: Mon May 15 02:03:23 2017 +0200 Pick up new tor-browser tag --- projects/firefox/config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/projects/firefox/config b/projects/firefox/config index f5c765f..9c807ad 100644 --- a/projects/firefox/config +++ b/projects/firefox/config @@ -1,13 +1,13 @@ # vim: filetype=yaml sw=2 version: '[% c("abbrev") %]' filename:… [View More]

1 0

[tor/master] Remove two obsoleted options.
by nickm＠torproject.org 14 May '17

14 May '17

commit c83657c6878f805f01b5656c9f9a34f6fadc7307 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun May 14 19:06:15 2017 -0400 Remove two obsoleted options. Spotted by atagar Closes #22257 --- doc/tor.1.txt | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 1fffe08..0af4e5f 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -661,12 +661,6 @@ GENERAL OPTIONS following the Tor specification. Otherwise, they … [View More]

1 0

[tor/master] fmt two man page entries
by arma＠torproject.org 14 May '17

14 May '17

commit 1474aaa4563508a9b1c75d495101b697ce7d7fbd Author: Roger Dingledine <arma(a)torproject.org> Date: Sun May 14 19:04:00 2017 -0400 fmt two man page entries whoever made the patch for #17975 wasn't using a proper green-screen vt100. :) --- doc/tor.1.txt | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 96e5fa1..1fffe08 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -638,18 +638,19 @@ … [View More]

1 0

[tor/master] remove stray equals sign
by arma＠torproject.org 14 May '17

14 May '17

commit 2cf8f6772b80d73561a987a7153fd382fb805047 Author: Roger Dingledine <arma(a)torproject.org> Date: Sun May 14 19:00:36 2017 -0400 remove stray equals sign resolves ticket 22256. this typo crept in during bug 21715's commit fd8284c8. --- doc/tor.1.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 17977af..96e5fa1 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -638,7 +638,7 @@ GENERAL OPTIONS (127.0.0.… [View More]

1 0

[translation/https_everywhere_completed] Update translations for https_everywhere_completed
by translation＠torproject.org 14 May '17

14 May '17

commit 9cb88f673689875407885d5e15a54d942e6b15cd Author: Translation commit bot <translation(a)torproject.org> Date: Sun May 14 22:15:36 2017 +0000 Update translations for https_everywhere_completed --- sr/https-everywhere.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sr/https-everywhere.properties b/sr/https-everywhere.properties index 2929bb1..26c4bf4 100644 --- a/sr/https-everywhere.properties +++ b/sr/https-everywhere.properties @@ -1,6 +1,6 @@ … [View More]

1 0