tor-commits August 2017

tor-commits@lists.torproject.org

17 participants
1132 discussions

[snowflake/master] go fmt
by dcf＠torproject.org 03 Aug '17

03 Aug '17

commit 1966612113d1583f9bbe458611e7ffcf19b8f257 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Jul 14 20:06:00 2017 -0700 go fmt --- broker/broker.go | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/broker/broker.go b/broker/broker.go index e3aecb1..f56f31b 100644 --- a/broker/broker.go +++ b/broker/broker.go @@ -7,15 +7,15 @@ package main import ( "container/heap" + "flag" "fmt" "io/ioutil" "log" "net" "net/http" - "time" - "sync" "os" - "flag" + "sync" + "time" ) const ( @@ -240,7 +240,6 @@ func main() { flag.Parse() - if cert == "" || cert_key == "" { log.Println("Missing options, exiting.") fmt.Println("Usage:") @@ -267,18 +266,18 @@ func main() { wg.Add(2) //Run HTTP server - go func(){ + go func() { defer wg.Done() - err := http.ListenAndServe(":" + http_port, nil) + err := http.ListenAndServe(":"+http_port, nil) if err != nil { log.Println("ListenAndServe: ", err) } }() //Run HTTPS server - go func(){ + go func() { defer wg.Done() - err := http.ListenAndServeTLS(":" + https_port, cert, cert_key, nil) + err := http.ListenAndServeTLS(":"+https_port, cert, cert_key, nil) if err != nil { log.Println("ListenAndServeTLS: ", err) }

1 0

[snowflake/master] Replace --webPort and --tlsPort with a single --addr option.
by dcf＠torproject.org 03 Aug '17

03 Aug '17

commit afe771690364e14586f24d98b65f0a2172cac1cc Author: David Fifield <david(a)bamsoftware.com> Date: Fri Jul 14 20:29:02 2017 -0700 Replace --webPort and --tlsPort with a single --addr option. --- broker/README.md | 4 +--- broker/broker.go | 11 +++++------ 2 files changed, 6 insertions(+), 9 deletions(-) diff --git a/broker/README.md b/broker/README.md index 8d8c968..38a8029 100644 --- a/broker/README.md +++ b/broker/README.md @@ -42,9 +42,7 @@ without having to run as root: ``` setcap 'cap_net_bind_service=+ep' /usr/local/bin/broker ``` -You can control the listening port with the --tlsPort -or --webPort options (--webPort is honored only when -also using --disable-tls). +You can control the listening port with the --addr option. You'll need to provide the URL of the custom broker to the client plugin using the `--url $URL` flag. diff --git a/broker/broker.go b/broker/broker.go index 9892fc3..a41265b 100644 --- a/broker/broker.go +++ b/broker/broker.go @@ -234,14 +234,13 @@ func ipHandler(w http.ResponseWriter, r *http.Request) { func main() { var acmeEmail string var acmeHostnamesCommas string + var addr string var disableTLS bool - var http_port, https_port string flag.StringVar(&acmeEmail, "acme-email", "", "optional contact email for Let's Encrypt notifications") flag.StringVar(&acmeHostnamesCommas, "acme-hostnames", "", "comma-separated hostnames for TLS certificate") + flag.StringVar(&addr, "addr", ":443", "address to listen on") flag.BoolVar(&disableTLS, "disable-tls", false, "don't use HTTPS") - flag.StringVar(&http_port, "webPort", "80", "HTTP port number") - flag.StringVar(&https_port, "tlsPort", "443", "HTTPS port number") flag.Parse() ctx := NewBrokerContext() @@ -257,7 +256,9 @@ func main() { http.Handle("/debug", SnowflakeHandler{ctx, debugHandler}) var err error - var server http.Server + server := http.Server{ + Addr: addr, + } if acmeHostnamesCommas != "" { acmeHostnames := strings.Split(acmeHostnamesCommas, ",") @@ -269,11 +270,9 @@ func main() { Email: acmeEmail, } - server.Addr = net.JoinHostPort("", https_port) server.TLSConfig = &tls.Config{GetCertificate: certManager.GetCertificate} err = server.ListenAndServeTLS("", "") } else if disableTLS { - server.Addr = net.JoinHostPort("", http_port) err = server.ListenAndServe() } else { log.Fatal("the --acme-hostnames or --disable-tls option is required")

1 0

[snowflake/master] Customize reflect.go for Snowflake broker.
by dcf＠torproject.org 03 Aug '17

03 Aug '17

commit 827972e2bfebdfb0555228f69de48711a7e5f1b1 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Jul 15 12:04:59 2017 -0700 Customize reflect.go for Snowflake broker. Don't need Meek-IP. --- appengine/README | 18 +++++++----------- appengine/app.yaml | 3 --- appengine/reflect.go | 31 ++++++------------------------- 3 files changed, 13 insertions(+), 39 deletions(-) diff --git a/appengine/README b/appengine/README index d71277a..bec9fcb 100644 --- a/appengine/README +++ b/appengine/README @@ -1,7 +1,5 @@ -This component runs on Google App Engine. It lies between meek-client -and meek-server. The App Engine component receives requests from the -client and forwards them to the server, then receives responses from the -server and forwards them to the client. +This component runs on Google App Engine. It reflects domain-fronted +requests from a client to the Snowflake broker. You need the Go App Engine SDK in order to deploy the app. https://cloud.google.com/sdk/docs/#linux @@ -10,8 +8,7 @@ After unpacking, install the app-engine-go component: To test locally, run google-cloud-sdk/bin/dev_appserver.py app.yaml -The app will be running at http://127.0.0.1:8080/. You can test broker -forwarding function by browsing to http://127.0.0.1:8000/ip. +The app will be running at http://127.0.0.1:8080/. To deploy to App Engine, first create a new project and app. You have to think of a unique name (marked as "<appname>" in the commands). You only @@ -23,9 +20,8 @@ log in to a Google account. Then to deploy the project, run: google-cloud-sdk/bin/gcloud app deploy --project=<appname> -To configure meek-client to talk to the App Engine app, provide -"https://<appname>.appspot.com/" as the url and "www.google.com" as the -front domain. +To configure the Snowflake client to talk to the App Engine app, provide +"https://<appname>.appspot.com/" as the --url option. UseBridges 1 - Bridge meek 0.0.2.0:1 url=https://example.appspot.com/ front=www.google.com - ClientTransportPlugin meek exec ./meek-client --log meek-client.log + Bridge snowflake 0.0.2.0:1 + ClientTransportPlugin snowflake exec ./client -url https://<appname>.appspot.com/ -front www.google.com diff --git a/appengine/app.yaml b/appengine/app.yaml index ff6efc1..44df436 100644 --- a/appengine/app.yaml +++ b/appengine/app.yaml @@ -1,8 +1,5 @@ runtime: go api_version: go1 -automatic_scaling: - max_idle_instances: 2 - min_pending_latency: 1000ms handlers: - url: /.* diff --git a/appengine/reflect.go b/appengine/reflect.go index ccf11f3..f6b5336 100644 --- a/appengine/reflect.go +++ b/appengine/reflect.go @@ -1,10 +1,9 @@ -// A web app for Google App Engine that proxies HTTP requests and responses to a -// Tor relay running meek-server. +// A web app for Google App Engine that proxies HTTP requests and responses to +// the Snowflake broker. package reflect import ( "io" - "net" "net/http" "net/url" "time" @@ -14,7 +13,7 @@ import ( ) const ( - forwardURL = "https://meek.bamsoftware.com/" + forwardURL = "https://snowflake-broker.bamsoftware.com/" // A timeout of 0 means to use the App Engine default (5 seconds). urlFetchTimeout = 20 * time.Second ) @@ -32,26 +31,14 @@ func pathJoin(a, b string) string { return a + b } -// We reflect only a whitelisted set of header fields. In requests, the full -// list includes things like User-Agent and X-Appengine-Country that the Tor -// bridge doesn't need to know. In responses, there may be things like -// Transfer-Encoding that interfere with App Engine's own hop-by-hop headers. +// We reflect only a whitelisted set of header fields. Otherwise, we may copy +// headers like Transfer-Encoding that interfere with App Engine's own +// hop-by-hop headers. var reflectedHeaderFields = []string{ "Content-Type", "X-Session-Id", } -// Get the original client IP address as a string. When using the standard -// net/http server, Request.RemoteAddr is a "host:port" string; however App -// Engine seems to use just "host". We check for both to be safe. -func getClientAddr(r *http.Request) string { - host, _, err := net.SplitHostPort(r.RemoteAddr) - if err == nil { - return host - } - return r.RemoteAddr -} - // Make a copy of r, with the URL being changed to be relative to forwardURL, // and including only the headers in reflectedHeaderFields. func copyRequest(r *http.Request) (*http.Request, error) { @@ -74,12 +61,6 @@ func copyRequest(r *http.Request) (*http.Request, error) { } } } - // Set the original client IP address in a Meek-IP header. We would use - // X-Forwarded-For, but App Engine prohibits setting that header: - // https://cloud.google.com/appengine/docs/standard/go/outbound-requests#reque… - // We could use Forwarded from RFC 7239, but other CDNs already use - // X-Forwarded-For and this way we only need one parser. - c.Header.Add("Meek-IP", getClientAddr(r)) return c, nil }

1 0

[snowflake/master] Copy appengine directory from meek commit 6057a9e9d6.
by dcf＠torproject.org 03 Aug '17

03 Aug '17

commit a150a991d0c2ba66ca9e567bd088c603c9434775 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Jul 15 11:48:28 2017 -0700 Copy appengine directory from meek commit 6057a9e9d6. --- appengine/README | 31 +++++++++++++ appengine/app.yaml | 10 ++++ appengine/reflect.go | 127 +++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 168 insertions(+) diff --git a/appengine/README b/appengine/README new file mode 100644 index 0000000..d71277a --- /dev/null +++ b/appengine/README @@ -0,0 +1,31 @@ +This component runs on Google App Engine. It lies between meek-client +and meek-server. The App Engine component receives requests from the +client and forwards them to the server, then receives responses from the +server and forwards them to the client. + +You need the Go App Engine SDK in order to deploy the app. + https://cloud.google.com/sdk/docs/#linux +After unpacking, install the app-engine-go component: + google-cloud-sdk/bin/gcloud components install app-engine-go + +To test locally, run + google-cloud-sdk/bin/dev_appserver.py app.yaml +The app will be running at http://127.0.0.1:8080/. You can test broker +forwarding function by browsing to http://127.0.0.1:8000/ip. + +To deploy to App Engine, first create a new project and app. You have to +think of a unique name (marked as "<appname>" in the commands). You only +have to do the "create" step once; subsequent times you can go straight +to the "deploy" step. This command will open a browser window so you can +log in to a Google account. + google-cloud-sdk/bin/gcloud projects create <appname> + google-cloud-sdk/bin/gcloud app create --project=<appname> +Then to deploy the project, run: + google-cloud-sdk/bin/gcloud app deploy --project=<appname> + +To configure meek-client to talk to the App Engine app, provide +"https://<appname>.appspot.com/" as the url and "www.google.com" as the +front domain. + UseBridges 1 + Bridge meek 0.0.2.0:1 url=https://example.appspot.com/ front=www.google.com + ClientTransportPlugin meek exec ./meek-client --log meek-client.log diff --git a/appengine/app.yaml b/appengine/app.yaml new file mode 100644 index 0000000..ff6efc1 --- /dev/null +++ b/appengine/app.yaml @@ -0,0 +1,10 @@ +runtime: go +api_version: go1 +automatic_scaling: + max_idle_instances: 2 + min_pending_latency: 1000ms + +handlers: +- url: /.* + script: _go_app + secure: always diff --git a/appengine/reflect.go b/appengine/reflect.go new file mode 100644 index 0000000..ccf11f3 --- /dev/null +++ b/appengine/reflect.go @@ -0,0 +1,127 @@ +// A web app for Google App Engine that proxies HTTP requests and responses to a +// Tor relay running meek-server. +package reflect + +import ( + "io" + "net" + "net/http" + "net/url" + "time" + + "appengine" + "appengine/urlfetch" +) + +const ( + forwardURL = "https://meek.bamsoftware.com/" + // A timeout of 0 means to use the App Engine default (5 seconds). + urlFetchTimeout = 20 * time.Second +) + +var context appengine.Context + +// Join two URL paths. +func pathJoin(a, b string) string { + if len(a) > 0 && a[len(a)-1] == '/' { + a = a[:len(a)-1] + } + if len(b) == 0 || b[0] != '/' { + b = "/" + b + } + return a + b +} + +// We reflect only a whitelisted set of header fields. In requests, the full +// list includes things like User-Agent and X-Appengine-Country that the Tor +// bridge doesn't need to know. In responses, there may be things like +// Transfer-Encoding that interfere with App Engine's own hop-by-hop headers. +var reflectedHeaderFields = []string{ + "Content-Type", + "X-Session-Id", +} + +// Get the original client IP address as a string. When using the standard +// net/http server, Request.RemoteAddr is a "host:port" string; however App +// Engine seems to use just "host". We check for both to be safe. +func getClientAddr(r *http.Request) string { + host, _, err := net.SplitHostPort(r.RemoteAddr) + if err == nil { + return host + } + return r.RemoteAddr +} + +// Make a copy of r, with the URL being changed to be relative to forwardURL, +// and including only the headers in reflectedHeaderFields. +func copyRequest(r *http.Request) (*http.Request, error) { + u, err := url.Parse(forwardURL) + if err != nil { + return nil, err + } + // Append the requested path to the path in forwardURL, so that + // forwardURL can be something like "https://example.com/reflect". + u.Path = pathJoin(u.Path, r.URL.Path) + c, err := http.NewRequest(r.Method, u.String(), r.Body) + if err != nil { + return nil, err + } + for _, key := range reflectedHeaderFields { + values, ok := r.Header[key] + if ok { + for _, value := range values { + c.Header.Add(key, value) + } + } + } + // Set the original client IP address in a Meek-IP header. We would use + // X-Forwarded-For, but App Engine prohibits setting that header: + // https://cloud.google.com/appengine/docs/standard/go/outbound-requests#reque… + // We could use Forwarded from RFC 7239, but other CDNs already use + // X-Forwarded-For and this way we only need one parser. + c.Header.Add("Meek-IP", getClientAddr(r)) + return c, nil +} + +func handler(w http.ResponseWriter, r *http.Request) { + context = appengine.NewContext(r) + fr, err := copyRequest(r) + if err != nil { + context.Errorf("copyRequest: %s", err) + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + // Use urlfetch.Transport directly instead of urlfetch.Client because we + // want only a single HTTP transaction, not following redirects. + transport := urlfetch.Transport{ + Context: context, + // Despite the name, Transport.Deadline is really a timeout and + // not an absolute deadline as used in the net package. In + // other words it is a time.Duration, not a time.Time. + Deadline: urlFetchTimeout, + } + resp, err := transport.RoundTrip(fr) + if err != nil { + context.Errorf("RoundTrip: %s", err) + http.Error(w, err.Error(), http.StatusInternalServerError) + return + } + defer resp.Body.Close() + for _, key := range reflectedHeaderFields { + values, ok := resp.Header[key] + if ok { + for _, value := range values { + w.Header().Add(key, value) + } + } + } + w.WriteHeader(resp.StatusCode) + n, err := io.Copy(w, resp.Body) + if err != nil { + context.Errorf("io.Copy after %d bytes: %s", n, err) + } +} + +func init() { + http.HandleFunc("/", handler) +}

1 0

[snowflake/master] autocert (Let's Encrypt) for broker.
by dcf＠torproject.org 03 Aug '17

03 Aug '17

commit 2d89aa0b7bf10c571f934b846c363cf4a2b9b761 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Jul 14 20:25:46 2017 -0700 autocert (Let's Encrypt) for broker. Replaces --cert and --key with --acme-hostnames and --acme-email. --- broker/README.md | 26 +++++++++++++++++++--- broker/broker.go | 68 +++++++++++++++++++++++++++----------------------------- 2 files changed, 56 insertions(+), 38 deletions(-) diff --git a/broker/README.md b/broker/README.md index 1efe9fc..8d8c968 100644 --- a/broker/README.md +++ b/broker/README.md @@ -22,9 +22,29 @@ The Broker expects: ### Running your own -You can run your own Broker on localhost, you'll need to pass a TLS -certificate file using `--cert` option and the corresponding private key -file using `--key` option. +The server uses TLS by default. +There is a `--disable-tls` option for testing purposes, +but you should use TLS in production. + +The server automatically fetches certificates +from [Let's Encrypt](https://en.wikipedia.org/wiki/Let's_Encrypt) as needed. +Use the `--acme-hostnames` option to tell the server +what hostnames it may request certificates for. +You can optionally provide a contact email address, +using the `--acme-email` option, +so that Let's Encrypt can inform you of any problems. + +In order to fetch certificates automatically, +the server needs to be listening on port 443 (the default). +On Linux, you can use the `setcap` program, +part of libcap2, to enable the broker to bind to low-numbered ports +without having to run as root: +``` +setcap 'cap_net_bind_service=+ep' /usr/local/bin/broker +``` +You can control the listening port with the --tlsPort +or --webPort options (--webPort is honored only when +also using --disable-tls). You'll need to provide the URL of the custom broker to the client plugin using the `--url $URL` flag. diff --git a/broker/broker.go b/broker/broker.go index f56f31b..9892fc3 100644 --- a/broker/broker.go +++ b/broker/broker.go @@ -7,15 +7,17 @@ package main import ( "container/heap" + "crypto/tls" "flag" "fmt" "io/ioutil" "log" "net" "net/http" - "os" - "sync" + "strings" "time" + + "golang.org/x/crypto/acme/autocert" ) const ( @@ -230,26 +232,18 @@ func ipHandler(w http.ResponseWriter, r *http.Request) { } func main() { - var cert, cert_key, http_port, https_port string - - flag.StringVar(&cert, "cert", "", "TLS certificate file") - flag.StringVar(&cert_key, "key", "", "TLS key file") + var acmeEmail string + var acmeHostnamesCommas string + var disableTLS bool + var http_port, https_port string + flag.StringVar(&acmeEmail, "acme-email", "", "optional contact email for Let's Encrypt notifications") + flag.StringVar(&acmeHostnamesCommas, "acme-hostnames", "", "comma-separated hostnames for TLS certificate") + flag.BoolVar(&disableTLS, "disable-tls", false, "don't use HTTPS") flag.StringVar(&http_port, "webPort", "80", "HTTP port number") flag.StringVar(&https_port, "tlsPort", "443", "HTTPS port number") - flag.Parse() - if cert == "" || cert_key == "" { - log.Println("Missing options, exiting.") - fmt.Println("Usage:") - flag.PrintDefaults() - os.Exit(1) - } - - log.Println("Using cert file:", cert) - log.Println("Using cert key file: ", cert_key) - ctx := NewBrokerContext() go ctx.Broker() @@ -262,26 +256,30 @@ func main() { http.Handle("/answer", SnowflakeHandler{ctx, proxyAnswers}) http.Handle("/debug", SnowflakeHandler{ctx, debugHandler}) - var wg sync.WaitGroup - wg.Add(2) + var err error + var server http.Server - //Run HTTP server - go func() { - defer wg.Done() - err := http.ListenAndServe(":"+http_port, nil) - if err != nil { - log.Println("ListenAndServe: ", err) - } - }() + if acmeHostnamesCommas != "" { + acmeHostnames := strings.Split(acmeHostnamesCommas, ",") + log.Printf("ACME hostnames: %q", acmeHostnames) - //Run HTTPS server - go func() { - defer wg.Done() - err := http.ListenAndServeTLS(":"+https_port, cert, cert_key, nil) - if err != nil { - log.Println("ListenAndServeTLS: ", err) + certManager := autocert.Manager{ + Prompt: autocert.AcceptTOS, + HostPolicy: autocert.HostWhitelist(acmeHostnames...), + Email: acmeEmail, } - }() - wg.Wait() + server.Addr = net.JoinHostPort("", https_port) + server.TLSConfig = &tls.Config{GetCertificate: certManager.GetCertificate} + err = server.ListenAndServeTLS("", "") + } else if disableTLS { + server.Addr = net.JoinHostPort("", http_port) + err = server.ListenAndServe() + } else { + log.Fatal("the --acme-hostnames or --disable-tls option is required") + } + + if err != nil { + log.Fatal(err) + } }

1 0

[snowflake/master] Merge branch 'standalone-broker'
by dcf＠torproject.org 03 Aug '17

03 Aug '17

commit 36debdfdd24e978fc323ec352852fc4af0bc4ae5 Merge: 3e3e4b8 827972e Author: David Fifield <david(a)bamsoftware.com> Date: Wed Aug 2 19:34:00 2017 -0700 Merge branch 'standalone-broker' appengine/README | 27 ++++++++++ {broker => appengine}/app.yaml | 3 -- appengine/reflect.go | 108 ++++++++++++++++++++++++++++++++++++++++ broker/README.md | 37 ++++++++------ broker/broker.go | 56 ++++++++++++++++++++- broker/metrics.go | 2 +- broker/snowflake-broker_test.go | 2 +- broker/snowflake-heap.go | 2 +- 8 files changed, 215 insertions(+), 22 deletions(-) diff --cc broker/broker.go index a56f40b,a41265b..6cb08d9 --- a/broker/broker.go +++ b/broker/broker.go @@@ -217,9 -222,27 +222,29 @@@ func robotsTxtHandler(w http.ResponseWr w.Write([]byte("User-agent: *\nDisallow:\n")) } - func init() { + func ipHandler(w http.ResponseWriter, r *http.Request) { + remoteAddr := r.RemoteAddr + if net.ParseIP(remoteAddr).To4() == nil { + remoteAddr = "[" + remoteAddr + "]" + } + w.Header().Set("Content-Type", "text/plain; charset=utf-8") + w.Write([]byte(remoteAddr)) + } + + func main() { + var acmeEmail string + var acmeHostnamesCommas string + var addr string + var disableTLS bool + + flag.StringVar(&acmeEmail, "acme-email", "", "optional contact email for Let's Encrypt notifications") + flag.StringVar(&acmeHostnamesCommas, "acme-hostnames", "", "comma-separated hostnames for TLS certificate") + flag.StringVar(&addr, "addr", ":443", "address to listen on") + flag.BoolVar(&disableTLS, "disable-tls", false, "don't use HTTPS") + flag.Parse() + + log.SetFlags(log.LstdFlags | log.LUTC) + ctx := NewBrokerContext() go ctx.Broker()

1 0

[translation/tor-browser-manual] Update translations for tor-browser-manual
by translation＠torproject.org 03 Aug '17

03 Aug '17

commit e6a1862124b5aa179c544ffd8aac81b9f05053eb Author: Translation commit bot <translation(a)torproject.org> Date: Thu Aug 3 01:49:40 2017 +0000 Update translations for tor-browser-manual --- da/da.po | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/da/da.po b/da/da.po index bf7da961a..300b1b60f 100644 --- a/da/da.po +++ b/da/da.po @@ -92,6 +92,11 @@ msgid "" " last relay in the circuit (the “exit relay”) then sends the traffic out " "onto the public Internet." msgstr "" +"Tor er et netværk af virtuelle tunneller der giver dig mulighed for at " +"forbedre dit privatliv og din sikkerhed på internettet. Tor virker ved at " +"sende din trafik gennem tre tilfældige servere (også kaldet <em>relæ</em>) i" +" tor-netværket. Det sidste relæ er kredsløbet (“udgangsrelæet”) som sender " +"trafikken ud på den offentlige del af internettet." #. This is a reference to an external file such as an image or video. When #. the file changes, the md5 hash will change to let you know you need to

1 0

[tor/release-0.3.1] Merge branch 'maint-0.3.1' into release-0.3.1
by nickm＠torproject.org 02 Aug '17

02 Aug '17

commit 3938692f3280355f6f8d9b43ed5ac5b9c93bb48f Merge: 4872c28af a9a8d53de Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 2 12:51:46 2017 -0400 Merge branch 'maint-0.3.1' into release-0.3.1 changes/bug23071 | 5 +++++ src/test/hs_ntor_ref.py | 31 ++++++++++++++++++++++++------- 2 files changed, 29 insertions(+), 7 deletions(-)

1 0

[tor/release-0.3.1] Merge branch 'bug23071_031' into maint-0.3.1
by nickm＠torproject.org 02 Aug '17

02 Aug '17

commit a9a8d53dec3badb0176a1eebeaaa9aca04a4feff Merge: 830b7b31b ee849ee8b Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Aug 2 12:51:42 2017 -0400 Merge branch 'bug23071_031' into maint-0.3.1 changes/bug23071 | 5 +++++ src/test/hs_ntor_ref.py | 31 ++++++++++++++++++++++++------- 2 files changed, 29 insertions(+), 7 deletions(-)

1 0

[tor/maint-0.3.1] Fix the hs_ntor integration tests to work with the pysha3 module
by nickm＠torproject.org 02 Aug '17

02 Aug '17

commit 8b5b7d470f4ef1957df77d343c8e87b1350351e3 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jul 31 20:28:42 2017 -0400 Fix the hs_ntor integration tests to work with the pysha3 module The sha3 module should still work. Fixes bug 23071; bugfix on 0.3.1.1-alpha. --- changes/bug23071 | 5 +++++ src/test/hs_ntor_ref.py | 31 ++++++++++++++++++++++++------- 2 files changed, 29 insertions(+), 7 deletions(-) diff --git a/changes/bug23071 b/changes/bug23071 new file mode 100644 index 000000000..4756dd625 --- /dev/null +++ b/changes/bug23071 @@ -0,0 +1,5 @@ + o Minor bugfixes (tests): + - Port the hs_ntor handshake test to work correctly with recent + versions of the pysha3 module. Fixes bug 23071; bugfix on + 0.3.1.1-alpha. + diff --git a/src/test/hs_ntor_ref.py b/src/test/hs_ntor_ref.py index 813e79782..46e0e3fa4 100644 --- a/src/test/hs_ntor_ref.py +++ b/src/test/hs_ntor_ref.py @@ -54,11 +54,28 @@ except ImportError: import slownacl_curve25519 curve25519mod = slownacl_curve25519 +import hashlib try: import sha3 except ImportError: - # error code 77 tells automake to skip this test - sys.exit(77) + # In python 3.6, the sha3 functions are in hashlib whether we + # import sha3 or not. + pass + +try: + # Pull the sha3 functions in. + from hashlib import sha3_256, shake_256 + shake_squeeze = shake_256.digest +except ImportError: + if hasattr(sha3, "SHA3256"): + # If this happens, then we have the old "sha3" module which + # hashlib and pysha3 superseded. + sha3_256 = sha3.SHA3256 + shake_256 = sha3.SHAKE256 + shake_squeeze = shake_256.squeeze + else: + # error code 77 tells automake to skip this test + sys.exit(77) # Import Nick's ntor reference implementation in Python # We are gonna use a few of its utilities. @@ -81,7 +98,7 @@ def mac(k,m): def htonll(num): return struct.pack('!q', num) - s = sha3.SHA3256() + s = sha3_256() s.update(htonll(len(k))) s.update(k) s.update(m) @@ -107,9 +124,9 @@ def intro2_ntor_client(intro_auth_pubkey_str, intro_enc_pubkey, assert(len(secret) == INTRO_SECRET_LEN) info = M_HSEXPAND + subcredential - kdf = sha3.SHAKE256() + kdf = shake_256() kdf.update(secret + T_HSENC + info) - key_material = kdf.squeeze(64*8) + key_material = shake_squeeze(kdf, 64*8) enc_key = key_material[0:32] mac_key = key_material[32:64] @@ -139,9 +156,9 @@ def intro2_ntor_service(intro_auth_pubkey_str, client_enc_pubkey, service_enc_pr assert(len(secret) == INTRO_SECRET_LEN) info = M_HSEXPAND + subcredential - kdf = sha3.SHAKE256() + kdf = shake_256() kdf.update(secret + T_HSENC + info) - key_material = kdf.squeeze(64*8) + key_material = shake_squeeze(kdf, 64*8) enc_key = key_material[0:32] mac_key = key_material[32:64]

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits August 2017