August 2017 - tor-commits - lists.torproject.org

[tor-browser-bundle/maint-7.0] Add Felix's obfs4 bridges to the built-in bridges.
by gk＠torproject.org 24 Aug '17

24 Aug '17

commit a0aace68fe848963408de4af7b1c659f2f446fc2 Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Aug 23 19:27:44 2017 +0000 Add Felix's obfs4 bridges to the built-in bridges. * FIXES #23166: https://bugs.torproject.org/23166 --- Bundle-Data/PTConfigs/bridge_prefs.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 03ccb07..a76985b 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -37,6 +37,8 @@ pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 38.229.1.78:80 C8C pref("extensions.torlauncher.default_bridge.obfs4.22", "obfs4 [2001:470:b381:bfff:216:3eff:fe23:d6c3]:443 CDF2E852BF539B82BD10E27E9115A31734E378C2 cert=qUVQ0srL1JI/vO6V6m/24anYXiJD3QP2HgzUKQtQ7GRqqUvs7P+tG43RtAqdhLOALP7DJQ iat-mode=1"); pref("extensions.torlauncher.default_bridge.obfs4.23", "obfs4 37.218.240.34:40035 88CD36D45A35271963EF82E511C8827A24730913 cert=eGXYfWODcgqIdPJ+rRupg4GGvVGfh25FWaIXZkit206OSngsp7GAIiGIXOJJROMxEqFKJg iat-mode=1"); pref("extensions.torlauncher.default_bridge.obfs4.24", "obfs4 37.218.245.14:38224 D9A82D2F9C2F65A18407B1D2B764F130847F8B5D cert=bjRaMrr1BRiAW8IE9U5z27fQaYgOhX1UCmOpg2pFpoMvo6ZgQMzLsaTzzQNTlm7hNcb+Sg iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.25", "obfs4 85.31.186.98:443 011F2599C0E9B27EE74B353155E244813763C3E5 cert=ayq0XzCwhpdysn5o0EyDUbmSOx3X/oTEbzDMvczHOdBJKlvIdHHLJGkZARtT4dcBFArPPg iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.26", "obfs4 85.31.186.26:443 91A6354697E6B02A386312F68D82CF86824D3606 cert=PBwr+S8JTVZo6MPdHnkTwXJPILWADLqfMGoVvhZClMq/Urndyd42BwX9YFJHZnBB3H0XCw iat-mode=0"); pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2cly7j4zqgua7.cloudfront.net/ front=a0.awsstatic.com"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com");

1 0

[tor-browser-bundle/master] Add Felix's obfs4 bridges to the built-in bridges.
by gk＠torproject.org 24 Aug '17

24 Aug '17

commit fc2449fc0ef8bebfeaaa1a44c23215a86f64d75a Author: Isis Lovecruft <isis(a)torproject.org> Date: Wed Aug 23 19:27:44 2017 +0000 Add Felix's obfs4 bridges to the built-in bridges. * FIXES #23166: https://bugs.torproject.org/23166 --- Bundle-Data/PTConfigs/bridge_prefs.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Bundle-Data/PTConfigs/bridge_prefs.js b/Bundle-Data/PTConfigs/bridge_prefs.js index 2f68a1f..258586f 100644 --- a/Bundle-Data/PTConfigs/bridge_prefs.js +++ b/Bundle-Data/PTConfigs/bridge_prefs.js @@ -37,6 +37,8 @@ pref("extensions.torlauncher.default_bridge.obfs4.20", "obfs4 38.229.1.78:80 C8C pref("extensions.torlauncher.default_bridge.obfs4.22", "obfs4 [2001:470:b381:bfff:216:3eff:fe23:d6c3]:443 CDF2E852BF539B82BD10E27E9115A31734E378C2 cert=qUVQ0srL1JI/vO6V6m/24anYXiJD3QP2HgzUKQtQ7GRqqUvs7P+tG43RtAqdhLOALP7DJQ iat-mode=1"); pref("extensions.torlauncher.default_bridge.obfs4.23", "obfs4 37.218.240.34:40035 88CD36D45A35271963EF82E511C8827A24730913 cert=eGXYfWODcgqIdPJ+rRupg4GGvVGfh25FWaIXZkit206OSngsp7GAIiGIXOJJROMxEqFKJg iat-mode=1"); pref("extensions.torlauncher.default_bridge.obfs4.24", "obfs4 37.218.245.14:38224 D9A82D2F9C2F65A18407B1D2B764F130847F8B5D cert=bjRaMrr1BRiAW8IE9U5z27fQaYgOhX1UCmOpg2pFpoMvo6ZgQMzLsaTzzQNTlm7hNcb+Sg iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.25", "obfs4 85.31.186.98:443 011F2599C0E9B27EE74B353155E244813763C3E5 cert=ayq0XzCwhpdysn5o0EyDUbmSOx3X/oTEbzDMvczHOdBJKlvIdHHLJGkZARtT4dcBFArPPg iat-mode=0"); +pref("extensions.torlauncher.default_bridge.obfs4.26", "obfs4 85.31.186.26:443 91A6354697E6B02A386312F68D82CF86824D3606 cert=PBwr+S8JTVZo6MPdHnkTwXJPILWADLqfMGoVvhZClMq/Urndyd42BwX9YFJHZnBB3H0XCw iat-mode=0"); pref("extensions.torlauncher.default_bridge.meek-amazon.1", "meek 0.0.2.0:2 B9E7141C594AF25699E0079C1F0146F409495296 url=https://d2cly7j4zqgua7.cloudfront.net/ front=a0.awsstatic.com"); pref("extensions.torlauncher.default_bridge.meek-azure.1", "meek 0.0.2.0:3 97700DFE9F483596DDA6264C4D7DF7641E1E39CE url=https://meek.azureedge.net/ front=ajax.aspnetcdn.com");

1 0

[tor/master] add parenthesis to make cast work right.
by nickm＠torproject.org 23 Aug '17

23 Aug '17

commit 18f3f1ffa3b2f08418b52f55dfe059c5b5d864b4 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 23 13:12:58 2017 -0400 add parenthesis to make cast work right. --- src/or/hs_service.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/or/hs_service.c b/src/or/hs_service.c index 3f6de0ba2..afdb6e844 100644 --- a/src/or/hs_service.c +++ b/src/or/hs_service.c @@ -1877,7 +1877,7 @@ can_service_launch_intro_circuit(hs_service_t *service, time_t now) INTRO_CIRC_RETRY_PERIOD, service->state.num_intro_circ_launched, (long int) elapsed_time, - (long int) INTRO_CIRC_RETRY_PERIOD - elapsed_time); + (long int) (INTRO_CIRC_RETRY_PERIOD - elapsed_time)); tor_free(msg); } }

1 0

[tor/master] Add test_hs_descriptor.inc to include.am to unbreak distcheck.
by nickm＠torproject.org 23 Aug '17

23 Aug '17

commit ee73c1848e0a2cf5d2ce4f3ddb76517e7f11bea3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 23 13:08:59 2017 -0400 Add test_hs_descriptor.inc to include.am to unbreak distcheck. --- src/test/include.am | 1 + 1 file changed, 1 insertion(+) diff --git a/src/test/include.am b/src/test/include.am index c0d95d951..d1488057e 100644 --- a/src/test/include.am +++ b/src/test/include.am @@ -287,6 +287,7 @@ noinst_HEADERS+= \ src/test/failing_routerdescs.inc \ src/test/ed25519_vectors.inc \ src/test/test_descriptors.inc \ + src/test/test_hs_descriptor.inc \ src/test/vote_descriptors.inc noinst_PROGRAMS+= src/test/test-ntor-cl

1 0

[nyx/master] Create data directory if it doesn't already exist
by atagar＠torproject.org 23 Aug '17

23 Aug '17

commit 68211c55bac70fcf24f6bb082e2cd1deccd323ee Author: Damian Johnson <atagar(a)torproject.org> Date: Tue Aug 22 09:56:18 2017 -0700 Create data directory if it doesn't already exist When fetching a data directory path ensuring the directory exists. Presently this doesn't do anything because this is only used for manual caching (which creates the directory itself), but as we cache more things this'll be handy. --- nyx/__init__.py | 17 +++++++++++++++-- nyx/panel/config.py | 6 ++---- 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/nyx/__init__.py b/nyx/__init__.py index 5cd4a22..5cd0898 100644 --- a/nyx/__init__.py +++ b/nyx/__init__.py @@ -232,9 +232,22 @@ def init_controller(*args, **kwargs): @uses_settings -def data_directory(config): +def data_directory(config, filename): path = config.get('data_directory', '~/.nyx') - return None if path == 'disabled' else os.path.expanduser(path) + + if path == 'disabled': + return None + + data_dir = os.path.expanduser(path) + + if not os.path.exists(data_dir): + try: + os.mkdir(data_dir) + except OSError as exc: + stem.util.log.log_once('nyx.data_directory_unavailable', stem.util.log.NOTICE, 'Unable to create a data directory at %s (%s). This is fine, but caching is disabled meaning performance will be diminished a bit.' % (data_dir, exc)) + return None + + return os.path.join(data_dir, filename) @uses_settings diff --git a/nyx/panel/config.py b/nyx/panel/config.py index d786981..07a04b0 100644 --- a/nyx/panel/config.py +++ b/nyx/panel/config.py @@ -130,11 +130,9 @@ class ConfigPanel(nyx.panel.Panel): self._sort_order = CONFIG['config_order'] self._show_all = False # show all options, or just the important ones - data_dir = data_directory() - - if data_dir: - cached_manual_path = os.path.join(data_dir, 'manual') + cached_manual_path = data_directory('manual') + if cached_manual_path: if os.path.exists(cached_manual_path): manual = stem.manual.Manual.from_cache(cached_manual_path) else:

1 0

[nyx/master] Use stem's size_of rather than sys
by atagar＠torproject.org 23 Aug '17

23 Aug '17

commit 8a5ff56d77ffe161321f8ee2a016c8705c0ca506 Author: Damian Johnson <atagar(a)torproject.org> Date: Wed Aug 23 10:01:54 2017 -0700 Use stem's size_of rather than sys The sys.getsizeof function doesn't recurse to get the actual size of collections. Using stem's new helper for this. --- nyx/tracker.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/nyx/tracker.py b/nyx/tracker.py index 2c89467..affe680 100644 --- a/nyx/tracker.py +++ b/nyx/tracker.py @@ -52,7 +52,6 @@ Background tasks for gathering information about the tor process. import collections import os -import sys import time import threading @@ -834,7 +833,7 @@ class ConsensusTracker(object): self._fingerprint_cache.setdefault(address, []).append((or_port, fingerprint)) self._relay_cache[fingerprint] = (address, or_port, nickname) - stem.util.log.info('Cached consensus data. Took %0.2fs. Cache size is %s for fingerprints, %s for relays' % (time.time() - start_time, stem.util.str_tools.size_label(sys.getsizeof(self._fingerprint_cache)), stem.util.str_tools.size_label(sys.getsizeof(self._relay_cache)))) + stem.util.log.info('Cached consensus data. Took %0.2fs. Cache size is %s for fingerprints, %s for relays' % (time.time() - start_time, stem.util.str_tools.size_label(system.size_of(self._fingerprint_cache), 2), stem.util.str_tools.size_label(system.size_of(self._relay_cache), 2))) controller.add_event_listener(lambda event: self.update(event.desc), stem.control.EventType.NEWCONSENSUS) @@ -862,7 +861,7 @@ class ConsensusTracker(object): self._fingerprint_cache = new_fingerprint_cache self._relay_cache = new_relay_cache - stem.util.log.info('Updated consensus cache. Took %0.2fs. Cache size is %s for fingerprints, %s for relays' % (time.time() - start_time, stem.util.str_tools.size_label(sys.getsizeof(self._fingerprint_cache)), stem.util.str_tools.size_label(sys.getsizeof(self._relay_cache)))) + stem.util.log.info('Updated consensus cache. Took %0.2fs. Cache size is %s for fingerprints, %s for relays' % (time.time() - start_time, stem.util.str_tools.size_label(system.size_of(self._fingerprint_cache), 2), stem.util.str_tools.size_label(system.size_of(self._relay_cache), 2))) def my_router_status_entry(self): """

1 0

[torspec/master] 19537: Try to document and clarify GETINFO downloads/*
by nickm＠torproject.org 23 Aug '17

23 Aug '17

commit 675c470fe61d2368a5bd16ee297e02f0a94911a2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 23 10:10:15 2017 -0400 19537: Try to document and clarify GETINFO downloads/* --- control-spec.txt | 72 ++++++++++++++++++++++++++++++++++---------------------- 1 file changed, 44 insertions(+), 28 deletions(-) diff --git a/control-spec.txt b/control-spec.txt index b31111c..69a77c1 100644 --- a/control-spec.txt +++ b/control-spec.txt @@ -920,17 +920,31 @@ "downloads/" The keys under downloads/ are used to query download statuses; they all return either a sequence of newline-terminated hex encoded digests, or - a serialized download status as follows: - - "next-attempt-at" SP ISOTime CRLF - "n-download-failures" SP UInt CRLF - "n-download-attempts" SP UInt CRLF - "schedule" SP DownloadSchedule CRLF - "want-authority" SP DownloadWantAuthority CRLF - "increment-on" SP DownloadIncrementOn CRLF - "backoff" SP DownloadBackoff CRLF - [ "last-backoff-position" Uint CRLF - "last-delay-used UInt CRLF ] + a "serialized download status" as follows: + + SerializedDownloadSatus = + -- when do we plan to next attempt to download this object? + "next-attempt-at" SP ISOTime CRLF + -- how many times have we failed since the last success? + "n-download-failures" SP UInt CRLF + -- how many times have we tried to download this? + "n-download-attempts" SP UInt CRLF + -- according to which schedule rule will we download this? + "schedule" SP DownloadSchedule CRLF + -- do we want to fetch this from an authority, or will any cache do? + "want-authority" SP DownloadWantAuthority CRLF + -- do we increase our download delay whenever we fail to fetch this, + -- or whenever we attempt fetching this? + "increment-on" SP DownloadIncrementOn CRLF + -- do we increase the download schedule deterministically, or at + -- random? + "backoff" SP DownloadBackoff CRLF + [ + -- with an exponential backoff, where are we in the schedule? + "last-backoff-position" Uint CRLF + -- with an exponential backoff, what was our last delay? + "last-delay-used UInt CRLF + ] where @@ -950,35 +964,37 @@ In detail, the keys supported are: "downloads/networkstatus/ns" - The serialized download status for the FLAV_NS consensus for whichever - bootstrap state Tor is currently in. + The SerializedDownloadStatus for the NS-flavored consensus for + whichever bootstrap state Tor is currently in. "downloads/networkstatus/ns/bootstrap" - The serialized download status for the FLAV_NS consensus at bootstrap - time, regardless of whether we are currently bootstrapping. + The SerializedDownloadStatus for the NS-flavored consensus at + bootstrap time, regardless of whether we are currently bootstrapping. "downloads/networkstatus/ns/running" - The serialized download status for the FLAV_NS consensus when running, - regardless of whether we are currently bootstrapping. + + The SerializedDownloadStatus for the NS-flavored consensus when + running, regardless of whether we are currently bootstrapping. "downloads/networkstatus/microdesc" - The serialized download status for the FLAV_MICRODESC consensus for + The SerializedDownloadStatus for the microdesc-flavored consensus for whichever bootstrap state Tor is currently in. "downloads/networkstatus/microdesc/bootstrap" - The serialized download status for the FLAV_MICRODESC consensus at + The SerializedDownloadStatus for the microdesc-flavored consensus at bootstrap time, regardless of whether we are currently bootstrapping. "downloads/networkstatus/microdesc/running" - The serialized download status for the FLAV_MICRODESC consensus when + The SerializedDownloadStatus for the microdesc-flavored consensus when running, regardless of whether we are currently bootstrapping. "downloads/cert/fps" - A newline-separated list of hex-encoded digests for authority certificates - for which we have download status available. + + A newline-separated list of hex-encoded digests for authority + certificates for which we have download status available. "downloads/cert/fp/<Fingerprint>" - A serialized download status for the default certificate for the + A SerializedDownloadStatus for the default certificate for the identity digest <Fingerprint> returned by the downloads/cert/fps key. "downloads/cert/fp/<Fingerprint>/sks" @@ -987,7 +1003,7 @@ downloads/cert/fps key. "downloads/cert/fp/<Fingerprint>/<SKDigest>" - A serialized download status for the certificate for the identity + A SerializedDownloadStatus for the certificate for the identity digest <Fingerprint> returned by the downloads/cert/fps key and signing key digest <SKDigest> returned by the downloads/cert/fp/<Fingerprint>/ sks key. @@ -996,19 +1012,19 @@ A newline-separated list of hex-encoded router descriptor digests [note, not identity digests - the Tor process may not have seen them yet while downloading router descriptors]. If the Tor process is not - using a FLAV_NS consensus, a 551 error is returned. + using a NS-flavored consensus, a 551 error is returned. "downloads/desc/<Digest>" - A serialized download status for the router descriptor with digest + A SerializedDownloadStatus for the router descriptor with digest <Digest> as returned by the downloads/desc/descs key. If the Tor - process is not using a FLAV_NS consensus, a 551 error is returned. + process is not using a NS-flavored consensus, a 551 error is returned. "downloads/bridge/bridges" A newline-separated list of hex-encoded bridge identity digests. If the Tor process is not using bridges, a 551 error is returned. "downloads/bridge/<Digest>" - A serialized download status for the bridge descriptor with identity + A SerializedDownloadStatus for the bridge descriptor with identity digest <Digest> as returned by the downloads/bridge/bridges key. If the Tor process is not using bridges, a 551 error is returned.

1 0

[torbutton/master] Bug 20375: Warn users after entering fullscreen mode.
by gk＠torproject.org 23 Aug '17

23 Aug '17

commit f6b52b8d7f26277569211946248307996d12099c Author: Arthur Edelstein <arthuredelstein(a)gmail.com> Date: Tue Aug 22 12:06:21 2017 -0700 Bug 20375: Warn users after entering fullscreen mode. When the browser window is maximized, we show users a notification warning that maximizing the screen is fingerprintable. We should show this warning when the window enters fullscreen mode as well. This change is especially important for macOS, which uses window.STATE_FULLSCREEN instead of window.STATE_MAXIMIZED when the user clicks the "maximize" button on the window title bar. --- src/chrome/content/torbutton.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/chrome/content/torbutton.js b/src/chrome/content/torbutton.js index 11f4b61..db6b694 100644 --- a/src/chrome/content/torbutton.js +++ b/src/chrome/content/torbutton.js @@ -2126,7 +2126,8 @@ var torbutton_resizelistener = m_tb_resize_handler = async function() { // Wait for end of execution queue to ensure we have correct windowState. await new Promise(resolve => setTimeout(resolve, 0)); - if (window.windowState === 1) { + if (window.windowState === window.STATE_MAXIMIZED || + window.windowState === window.STATE_FULLSCREEN) { if (m_tb_prefs. getIntPref("extensions.torbutton.maximize_warnings_remaining") > 0) {

1 0

[torspec/master] document the term "reasonably live"; clarify "live"
by nickm＠torproject.org 23 Aug '17

23 Aug '17

commit 85d7c57bbdf5492046b64ccb5761547de3ea171d Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 23 10:03:30 2017 -0400 document the term "reasonably live"; clarify "live" --- dir-spec.txt | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/dir-spec.txt b/dir-spec.txt index ade48ae..3c57fb8 100644 --- a/dir-spec.txt +++ b/dir-spec.txt @@ -3295,8 +3295,8 @@ The following methods have incorrect implementations; authorities SHOULD release time.] Clients try to have a live consensus network-status document at all times. - A network-status document is "live" if the time in its valid-until field - has not passed. + A network-status document is "live" if the time in its valid-after field + has passed, and the time in its valid-until field has not passed. When a client has no consensus network-status document, it downloads it from a randomly chosen fallback directory mirror or authority. Clients @@ -3354,6 +3354,10 @@ The following methods have incorrect implementations; authorities SHOULD the same update strategy as for the normal consensus. They should not download more than one consensus flavor. + When a client does not have a live consensus, it will generally use the + most recent consensus it has if that consensus is "reasonably live". A + "reasonably live" consensus is one that expired less than 24 hours ago. + 5.2. Downloading server descriptors or microdescriptors Clients try to have the best descriptor for each router. A descriptor is

1 0

[torspec/master] 15333: Correct replies for GETINFO, SETCONF
by nickm＠torproject.org 23 Aug '17

23 Aug '17

commit d92fc8b17b207cfb8131f6922a95d022c37c06c8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 23 09:36:33 2017 -0400 15333: Correct replies for GETINFO, SETCONF SETCONF says 250 ok on success, like everything else. GETINFO had some junk left around in it that was left over from good old control-spec-v0.txt. --- control-spec.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/control-spec.txt b/control-spec.txt index 12a559f..b31111c 100644 --- a/control-spec.txt +++ b/control-spec.txt @@ -267,7 +267,7 @@ to set it back to its default). SETCONF is all-or-nothing: if there is an error in any of the configuration settings, Tor sets none of them. - Tor responds with a "250 configuration values set" reply on success. + Tor responds with a "250 OK" reply on success. If some of the listed keywords can't be found, Tor replies with a "552 Unrecognized option" message. Otherwise, Tor responds with a "513 syntax error in configuration values" reply on syntax error, or a @@ -495,8 +495,6 @@ Sent from the client to the server. The syntax is as for GETCONF: "GETINFO" 1*(SP keyword) CRLF - one or more NL-terminated strings. The server replies with an INFOVALUE - message, or a 551 or 552 error. Unlike GETCONF, this message is used for data that are not stored in the Tor configuration file, and that may be longer than a single line. On success, @@ -507,6 +505,8 @@ 250+keyword= value . + The server sends a 551 or 552 error on failure. + Recognized keys and their values include: "version" -- The version of the server's software, which MAY include the

1 0