June 2017 - tor-commits - lists.torproject.org

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 23 Jun '17

23 Jun '17

commit d42d68610aceabc5ce8692422d79f55382cc9310 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Jun 23 00:45:21 2017 +0000 Update translations for https_everywhere --- ur_PK/ssl-observatory.dtd | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/ur_PK/ssl-observatory.dtd b/ur_PK/ssl-observatory.dtd index 90f78e3..7d9abc7 100644 --- a/ur_PK/ssl-observatory.dtd +++ b/ur_PK/ssl-observatory.dtd @@ -1,6 +1,6 @@  <!ENTITY ssl-observatory.popup.details "تفصیلات اور خلوت کی معلومات"> -<!ENTITY ssl-observatory.popup.later "Ask Me Later"> +<!ENTITY ssl-observatory.popup.later "مجھ سے بعد میں پوچھیے۔"> <!ENTITY ssl-observatory.popup.no "نہیں"> <!ENTITY ssl-observatory.popup.text "HTTPS Everywhere can detect attacks @@ -20,8 +20,7 @@ to turn it on?">-->  <!ENTITY ssl-observatory.prefs.adv_priv_opts1 -"It is safe to enable this, unless you use a very -intrusive corporate network:"> +"اسے مجاز بنانا محفوظ ہے، جب تک کہ آپ نہایت دخل انداز مشترکہ نظام استعمال نہ کریں۔"> <!ENTITY ssl-observatory.prefs.adv_priv_opts2 "محفوظ ہے، جب تک آپ مشترکہ نظام خفیہ انٹرانیٹ سرور کے ساتھ استعمال کریں۔"> @@ -36,7 +35,7 @@ intrusive corporate network:"> <!ENTITY ssl-observatory.prefs.anonymous_unavailable "Check certificates using Tor for anonymity (requires Tor)"> <!ENTITY ssl-observatory.prefs.anonymous_tooltip -"This option requires Tor to be installed and running"> +"اس انتخاب کے لیے ٹور کا انسٹال ہونا اور چالو ہونا ضروری ہے۔"> <!ENTITY ssl-observatory.prefs.asn "When you see a new certificate, tell the Observatory which ISP you are connected to"> @@ -50,7 +49,7 @@ intrusive corporate network:"> <!ENTITY ssl-observatory.prefs.show_cert_warning_tooltip "This will check submitted certificates against known Certificate Revocation Lists. Unfortunately we cannot guarantee that we will flag every revoked certificate, but if you do see a warning there's a good chance something is wrong."> -<!ENTITY ssl-observatory.prefs.done "Done"> +<!ENTITY ssl-observatory.prefs.done "مکمل ہوگیا"> <!ENTITY ssl-observatory.prefs.explanation "HTTPS Everywhere can use EFF's SSL Observatory. This does two things: (1) @@ -70,7 +69,7 @@ received by the Observatory will indicate that somebody visited www.something.com, but not who visited the site, or what specific page they looked at. Mouseover the options for further details:"> -<!ENTITY ssl-observatory.prefs.hide "Hide advanced options"> +<!ENTITY ssl-observatory.prefs.hide "مزید انتخابات کو چُھپائیے۔"> <!ENTITY ssl-observatory.prefs.nonanon "Check certificates even if Tor is not available"> @@ -91,7 +90,7 @@ looked at. Mouseover the options for further details:"> <!ENTITY ssl-observatory.prefs.use "Use the Observatory?"> <!ENTITY ssl-observatory.warning.title "WARNING from EFF's SSL Observatory"> <!ENTITY ssl-observatory.warning.showcert "Show the certificate chain"> -<!ENTITY ssl-observatory.warning.okay "I understand"> +<!ENTITY ssl-observatory.warning.okay "میں سمجھ گیا۔"> <!ENTITY ssl-observatory.warning.text "EFF's SSL Observatory has issued a warning about the HTTPS certificiate(s) for this site:"> <!ENTITY ssl-observatory.warning.defense "If you are logged in to this site, it may be advisable to change your password once you have a safe connection. (These warnings can be disabled in the "SSL Observatory" tab of the HTTPS Everywhere preferences dialog.)">

1 0

[translation/https_everywhere] Update translations for https_everywhere
by translation＠torproject.org 23 Jun '17

23 Jun '17

commit 3d9f5180ef24e1ba1894ed9dd03f3e5aeb4be3ab Author: Translation commit bot <translation(a)torproject.org> Date: Fri Jun 23 00:15:27 2017 +0000 Update translations for https_everywhere --- ur_PK/ssl-observatory.dtd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ur_PK/ssl-observatory.dtd b/ur_PK/ssl-observatory.dtd index cca012a..90f78e3 100644 --- a/ur_PK/ssl-observatory.dtd +++ b/ur_PK/ssl-observatory.dtd @@ -1,5 +1,5 @@  -<!ENTITY ssl-observatory.popup.details "تفصیلات اور پرائیویسی کی معلومات"> +<!ENTITY ssl-observatory.popup.details "تفصیلات اور خلوت کی معلومات"> <!ENTITY ssl-observatory.popup.later "Ask Me Later"> <!ENTITY ssl-observatory.popup.no "نہیں"> @@ -24,7 +24,7 @@ to turn it on?">--> intrusive corporate network:"> <!ENTITY ssl-observatory.prefs.adv_priv_opts2 -"Safe, unless you use a corporate network with secret intranet server names:"> +"محفوظ ہے، جب تک آپ مشترکہ نظام خفیہ انٹرانیٹ سرور کے ساتھ استعمال کریں۔"> <!ENTITY ssl-observatory.prefs.alt_roots "Submit and check certificates signed by non-standard root CAs">

1 0

[stem/master] Note cryptography ticket in comment explaining hack
by atagar＠torproject.org 22 Jun '17

22 Jun '17

commit 4ad096fdade80daa0ee47f5c2b0cfa8d0d9bc94d Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Jun 22 09:01:58 2017 -0700 Note cryptography ticket in comment explaining hack Noting the issue we filed so we can drop the hack if/when cryptography provides a better method. --- stem/descriptor/server_descriptor.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/stem/descriptor/server_descriptor.py b/stem/descriptor/server_descriptor.py index 2c7258a..8dbd0f0 100644 --- a/stem/descriptor/server_descriptor.py +++ b/stem/descriptor/server_descriptor.py @@ -844,7 +844,8 @@ class RelayDescriptor(ServerDescriptor): # the hash algorithm used. Tor doesn't. This causes signature # validation failures and unfortunately cryptography have no nice way # of excluding these so we need to mock out part of their internals... - # ewww. + # + # https://github.com/pyca/cryptography/issues/3713 def no_op(*args, **kwargs): return 1

1 0

[stem/master] Linking to more active fork for munin-tor
by atagar＠torproject.org 22 Jun '17

22 Jun '17

commit f4a169acf3fa0fc002fefdd06243331b5f7f68a2 Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Jun 22 09:10:38 2017 -0700 Linking to more active fork for munin-tor Author of this fork reached out pointing out that the copy of munin-tor we link to is unmaintained and that they're resurrecting the project. --- docs/tutorials/double_double_toil_and_trouble.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tutorials/double_double_toil_and_trouble.rst b/docs/tutorials/double_double_toil_and_trouble.rst index aaeb4f3..2104ed9 100644 --- a/docs/tutorials/double_double_toil_and_trouble.rst +++ b/docs/tutorials/double_double_toil_and_trouble.rst @@ -65,7 +65,7 @@ Applications `Metrics Tasks <https://gitweb.torproject.org/metrics-tasks.git/tree>`_ One-off tasks related to Tor metrics. These mostly involve using descriptor information to answer a particular question. Tasks that involve Stem are: `1854 <https://gitweb.torproject.org/metrics-tasks.git/blob/HEAD:/task-1854/pylinf…>`_, `6232 <https://gitweb.torproject.org/metrics-tasks.git/tree/task-6232/pyentropy.py>`_, and `7241 <https://gitweb.torproject.org/metrics-tasks.git/tree/task-7241/first_pass.py>`_. `Onion Box <https://github.com/ralphwetzel/theonionbox>`_ Web dashboard for relay operation. `check_tor <http://anonscm.debian.org/gitweb/?p=users/lunar/check_tor.git;a=blob;f=chec…>`_ Nagios check to verify that a relay is participating in the Tor network. -`munin-tor <https://github.com/mweinelt/munin-tor>`_ Plugin to provide Munin graphs. +`munin-tor <https://github.com/daftaupe/munin-plugins-tor>`_ Plugin to provide Munin graphs. `tbbscraper <https://github.com/zackw/tbbscraper/blob/master/collector/lib/controller/co…>`_ Automated website scraper over Tor. `torIRC <https://gist.github.com/torifier/f1a7c1ac7b6b003cd9e1c187df2c5347>`_ IRC-like chat client using Tor hidden services. `exit-funding <https://github.com/torservers/exit-funding>`_ Script to estimate how much exit relays have been used.

1 0

[stem/master] Test for incorrect password failed with RUN_MULTIPLE target
by atagar＠torproject.org 22 Jun '17

22 Jun '17

commit 5cd23cd9abc81c452e819afa8dbb79db438fb6b0 Author: Damian Johnson <atagar(a)torproject.org> Date: Thu Jun 22 08:48:13 2017 -0700 Test for incorrect password failed with RUN_MULTIPLE target Oops, one of our test targets has both cookie *and* password auth. Our new test failed there because providing an incorrect password doesn't matter. Skipping the test with that target. --- test/integ/connection/authentication.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/integ/connection/authentication.py b/test/integ/connection/authentication.py index a8c0c82..1ab6aae 100644 --- a/test/integ/connection/authentication.py +++ b/test/integ/connection/authentication.py @@ -278,8 +278,8 @@ class TestAuthenticate(unittest.TestCase): runner = test.runner.get_runner() - if test.runner.Torrc.PASSWORD not in runner.get_options(): - self.skipTest('(requires password auth)') + if test.runner.Torrc.PASSWORD not in runner.get_options() or test.runner.Torrc.COOKIE in runner.get_options(): + self.skipTest('(requires only password auth)') return for i in range(10):

1 0

[tor/master] Merge branch 'maint-0.3.0' into maint-0.3.1
by nickm＠torproject.org 22 Jun '17

22 Jun '17

commit 2c49a9852dd7b8241f823ea0a0c8d90581518c7d Merge: 784b29a bdd267e Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 22 10:56:08 2017 -0400 Merge branch 'maint-0.3.0' into maint-0.3.1 changes/bug22400_01 | 4 ++++ src/or/entrynodes.c | 36 +++++++++++++++++++++++++----------- 2 files changed, 29 insertions(+), 11 deletions(-)

1 0

[tor/release-0.3.0] Merge branch 'maint-0.3.0' into release-0.3.0
by nickm＠torproject.org 22 Jun '17

22 Jun '17

commit e23084bc6a9343013988d7c14c7a70b8244825ce Merge: 1bf534c bdd267e Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 22 10:56:08 2017 -0400 Merge branch 'maint-0.3.0' into release-0.3.0 changes/bug22400_01 | 4 ++++ src/or/entrynodes.c | 36 +++++++++++++++++++++++++----------- 2 files changed, 29 insertions(+), 11 deletions(-)

1 0

[tor/master] Merge branch 'maint-0.3.1'
by nickm＠torproject.org 22 Jun '17

22 Jun '17

commit 90046a09dd95c789e28f63c320c1c16e58ecf57a Merge: ee7101a 2c49a98 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 22 10:56:08 2017 -0400 Merge branch 'maint-0.3.1' changes/bug22400_01 | 4 ++++ src/or/entrynodes.c | 36 +++++++++++++++++++++++++----------- 2 files changed, 29 insertions(+), 11 deletions(-)

1 0

[tor/master] Combine our "don't do this if no consensus" entryguards checks
by nickm＠torproject.org 22 Jun '17

22 Jun '17

commit bdd267e74d97cf2672fa2e1e9deb2a33fd755f2c Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Jun 22 09:28:30 2017 -0400 Combine our "don't do this if no consensus" entryguards checks Suggested by asn on 22400 review. --- src/or/entrynodes.c | 45 ++++++++++++++++++++++----------------------- 1 file changed, 22 insertions(+), 23 deletions(-) diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 34dfdce..aba35e6 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1093,6 +1093,18 @@ select_and_add_guard_item_for_sample(guard_selection_t *gs, return added_guard; } +/** Return true iff we need a consensus to maintain our */ +static int +live_consensus_is_missing(const guard_selection_t *gs) +{ + tor_assert(gs); + if (gs->type == GS_TYPE_BRIDGE) { + /* We don't update bridges from the consensus; they aren't there. */ + return 0; + } + return networkstatus_get_live_consensus(approx_time()) == NULL; +} + /** * Add new guards to the sampled guards in <b>gs</b> until there are * enough usable filtered guards, but never grow the sample beyond its @@ -1105,18 +1117,10 @@ entry_guards_expand_sample(guard_selection_t *gs) tor_assert(gs); const or_options_t *options = get_options(); - if (gs->type != GS_TYPE_BRIDGE) { - networkstatus_t *consensus = networkstatus_get_latest_consensus(); - time_t now = approx_time(); - if (consensus == NULL) { - log_info(LD_GUARD, "Not expanding the sample guard set; we have " - "no consensus."); - return NULL; - } else if (!networkstatus_consensus_reasonably_live(consensus, now)) { - log_info(LD_GUARD, "Not expanding the sample guard set; we have " - "a consensus, but it is far too old."); - return NULL; - } + if (live_consensus_is_missing(gs)) { + log_info(LD_GUARD, "Not expanding the sample guard set; we have " + "no live consensus."); + return NULL; } int n_sampled = smartlist_len(gs->sampled_entry_guards); @@ -1227,18 +1231,13 @@ sampled_guards_update_from_consensus(guard_selection_t *gs) // It's important to use only a live consensus here; we don't want to // make changes based on anything expired or old. - if (gs->type != GS_TYPE_BRIDGE) { - networkstatus_t *ns = networkstatus_get_live_consensus(approx_time()); - - if (! ns) { - log_info(LD_GUARD, "No live consensus; can't update " - "sampled entry guards."); - return; - } else { - log_info(LD_GUARD, "Updating sampled guard status based on received " - "consensus."); - } + if (live_consensus_is_missing(gs)) { + log_info(LD_GUARD, "Not updating the sample guard set; we have " + "no live consensus."); + return; } + log_info(LD_GUARD, "Updating sampled guard status based on received " + "consensus."); int n_changes = 0;

1 0

[tor/release-0.3.0] Don't expand guard sample set unless consensus is "reasonably live"
by nickm＠torproject.org 22 Jun '17

22 Jun '17

commit 32e486de97be6f0267c1318298808488baf6e319 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 19 15:48:47 2017 -0400 Don't expand guard sample set unless consensus is "reasonably live" Fixes what I think is the main root cause of 22400. Bugfix on 0.3.0.1-alpha. --- changes/bug22400_01 | 4 ++++ src/or/entrynodes.c | 15 +++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/changes/bug22400_01 b/changes/bug22400_01 new file mode 100644 index 0000000..454c5f7 --- /dev/null +++ b/changes/bug22400_01 @@ -0,0 +1,4 @@ + o Major bugfixes (entry guards): + - When starting with an old consensus, do not add new entry guards + unless the consensus is "reasonably live" (under 1 day old). Fixes + one root cause of bug 22400; bugfix on 0.3.0.1-alpha. diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c index 5b5e13b..34dfdce 100644 --- a/src/or/entrynodes.c +++ b/src/or/entrynodes.c @@ -1104,6 +1104,21 @@ entry_guards_expand_sample(guard_selection_t *gs) { tor_assert(gs); const or_options_t *options = get_options(); + + if (gs->type != GS_TYPE_BRIDGE) { + networkstatus_t *consensus = networkstatus_get_latest_consensus(); + time_t now = approx_time(); + if (consensus == NULL) { + log_info(LD_GUARD, "Not expanding the sample guard set; we have " + "no consensus."); + return NULL; + } else if (!networkstatus_consensus_reasonably_live(consensus, now)) { + log_info(LD_GUARD, "Not expanding the sample guard set; we have " + "a consensus, but it is far too old."); + return NULL; + } + } + int n_sampled = smartlist_len(gs->sampled_entry_guards); entry_guard_t *added_guard = NULL; int n_usable_filtered_guards = num_reachable_filtered_guards(gs, NULL);

1 0