tor-commits January 2018

tor-commits@lists.torproject.org

18 participants
1738 discussions

[tor/master] dos: Add a heartbeat log
by nickm＠torproject.org 30 Jan '18

30 Jan '18

commit 14a8b87852887f8c20a424ff32a2b6746105dd6c Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Jan 25 16:36:05 2018 -0500 dos: Add a heartbeat log Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/dos.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ src/or/dos.h | 1 + src/or/status.c | 2 ++ 3 files changed, 48 insertions(+) diff --git a/src/or/dos.c b/src/or/dos.c index d98d3db16..40e88aead 100644 --- a/src/or/dos.c +++ b/src/or/dos.c @@ -555,6 +555,51 @@ dos_should_refuse_single_hop_client(void) 0 /* default */, 0, 1); } +/* Log a heartbeat message with some statistics. */ +void +dos_log_heartbeat(void) +{ + char *conn_msg = NULL; + char *cc_msg = NULL; + char *single_hop_client_msg = NULL; + + if (!dos_is_enabled()) { + goto end; + } + + if (dos_cc_enabled) { + tor_asprintf(&cc_msg, + " %" PRIu64 " circuits rejected," + " %" PRIu32 " marked addresses.", + cc_num_rejected_cells, cc_num_marked_addrs); + } + + if (dos_conn_enabled) { + tor_asprintf(&conn_msg, + " %" PRIu64 " connections closed.", + conn_num_addr_rejected); + } + + if (dos_should_refuse_single_hop_client()) { + tor_asprintf(&single_hop_client_msg, + " %" PRIu64 " single hop clients refused.", + num_single_hop_client_refused); + } + + log_notice(LD_HEARTBEAT, + "DoS mitigation since startup:%s%s%s", + (cc_msg != NULL) ? cc_msg : " [cc not enabled]", + (conn_msg != NULL) ? conn_msg : " [conn not enabled]", + (single_hop_client_msg != NULL) ? single_hop_client_msg : ""); + + tor_free(conn_msg); + tor_free(cc_msg); + tor_free(single_hop_client_msg); + + end: + return; +} + /* Called when a new client connection has been established on the given * address. */ void diff --git a/src/or/dos.h b/src/or/dos.h index ec4c033ae..56835169d 100644 --- a/src/or/dos.h +++ b/src/or/dos.h @@ -47,6 +47,7 @@ void dos_init(void); void dos_free_all(void); void dos_consensus_has_changed(const networkstatus_t *ns); int dos_enabled(void); +void dos_log_heartbeat(void); void dos_new_client_conn(or_connection_t *or_conn); void dos_close_client_conn(const or_connection_t *or_conn); diff --git a/src/or/status.c b/src/or/status.c index fce6a1015..fa2238b9f 100644 --- a/src/or/status.c +++ b/src/or/status.c @@ -27,6 +27,7 @@ #include "hibernate.h" #include "rephist.h" #include "statefile.h" +#include "dos.h" static void log_accounting(const time_t now, const or_options_t *options); #include "geoip.h" @@ -145,6 +146,7 @@ log_heartbeat(time_t now) if (public_server_mode(options)) { rep_hist_log_circuit_handshake_stats(now); rep_hist_log_link_protocol_counts(); + dos_log_heartbeat(); } circuit_log_ancient_one_hop_circuits(1800);

1 0

[tor/master] Merge branch 'ticket24902_029_05' into ticket24902_033_02
by nickm＠torproject.org 30 Jan '18

30 Jan '18

commit cd81403cc0d73d53cb7f3650b38d49c54100af25 Merge: 03ab24b44 9aca7d473 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jan 30 09:33:12 2018 -0500 Merge branch 'ticket24902_029_05' into ticket24902_033_02 changes/ticket24902 | 13 + doc/tor.1.txt | 88 ++++++ src/common/log.c | 2 +- src/common/torlog.h | 4 +- src/or/channel.c | 9 +- src/or/channel.h | 3 +- src/or/command.c | 13 + src/or/config.c | 25 ++ src/or/connection.c | 16 ++ src/or/dos.c | 737 +++++++++++++++++++++++++++++++++++++++++++++++++ src/or/dos.h | 140 ++++++++++ src/or/geoip.c | 63 +++-- src/or/geoip.h | 27 ++ src/or/include.am | 2 + src/or/main.c | 2 + src/or/networkstatus.c | 2 + src/or/or.h | 33 +++ src/or/rendmid.c | 12 + src/or/status.c | 2 + src/test/include.am | 1 + src/test/test.c | 1 + src/test/test.h | 1 + src/test/test_dos.c | 248 +++++++++++++++++ 23 files changed, 1410 insertions(+), 34 deletions(-) diff --cc doc/tor.1.txt index ef3d1eb9e,58997cdf3..5ad818365 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@@ -2749,9 -2438,97 +2749,97 @@@ The following options are used to confi non-anonymous HiddenServiceSingleHopMode. Enables direct connections in the server-side hidden service protocol. If you are using this option, you need to disable all client-side services on your Tor instance, - including setting SOCKSPort to "0". - (Default: 0) + including setting SOCKSPort to "0". Can not be changed while tor is + running. (Default: 0) + DENIAL OF SERVICE MITIGATION OPTIONS + ------------------------------------ + + The following options are useful only for a public relay. They control the + Denial of Service mitigation subsystem. + + [[DoSCircuitCreationEnabled]] **DoSCircuitCreationEnabled** **0**|**1**|**auto**:: + + Enable circuit creation DoS mitigation. If enabled, tor will cache client + IPs along with statistics in order to detect circuit DoS attacks. If an + address is positively identified, tor will activate defenses against the + address. See the DoSCircuitCreationDefenseType option for more details. + This is a client to relay detection only. "auto" means use the consensus + parameter. + (Default: auto) + + [[DoSCircuitCreationMinConnections]] **DoSCircuitCreationMinConnections** __NUM__:: + + Minimum threshold of concurrent connections before a client address can be + flagged as executing a circuit creation DoS. In other words, once a client + address reaches the circuit rate and has a minimum of NUM concurrent + connections, a detection is positive. "0" means use the consensus + parameter. + (Default: 0) + + [[DoSCircuitCreationRate]] **DoSCircuitCreationRate** __NUM__:: + + The allowed circuit creation rate per second applied per client IP + address. If this option is 0, it obeys a consensus parameter. (Default: 0) + + [[DoSCircuitCreationBurst]] **DoSCircuitCreationBurst** __NUM__:: + + The allowed circuit creation burst per client IP address. If the circuit + rate and the burst are reached, a client is marked as executing a circuit + creation DoS. "0" means use the consensus parameter. + (Default: 0) + + [[DoSCircuitCreationDefenseType]] **DoSCircuitCreationDefenseType** __NUM__:: + + This is the type of defense applied to a detected client address. The + possible values are: + + 1: No defense. + 2: Refuse circuit creation for the DoSCircuitCreationDefenseTimePeriod period of time. + + + "0" means use the consensus parameter. + (Default: 0) + + [[DoSCircuitCreationDefenseTimePeriod]] **DoSCircuitCreationDefenseTimePeriod** __NUM__:: + + The base time period that the DoS defense is activated for. The actual + value is selected randomly for each activation from NUM+1 to 3/2 * NUM. + "0" means use the consensus parameter. + (Default: 0) + + [[DoSConnectionEnabled]] **DoSConnectionEnabled** **0**|**1**|**auto**:: + + Enable the connection DoS mitigation. For client address only, this allows + tor to mitigate against large number of concurrent connections made by a + single IP address. "auto" means use the consensus parameter. + (Default: auto) + + [[DoSConnectionMaxConcurrentCount]] **DoSConnectionMaxConcurrentCount** __NUM__:: + + The maximum threshold of concurrent connection from a client IP address. + Above this limit, a defense selected by DoSConnectionDefenseType is + applied. "0" means use the consensus parameter. + (Default: 0) + + [[DoSConnectionDefenseType]] **DoSConnectionDefenseType** __NUM__:: + + This is the type of defense applied to a detected client address for the + connection mitigation. The possible values are: + + 1: No defense. + 2: Immediately close new connections. + + + "0" means use the consensus parameter. + (Default: 0) + + [[DoSRefuseSingleHopClientRendezvous]] **DoSRefuseSingleHopClientRendezvous** **0**|**1**|**auto**:: + + Refuse establishment of rendezvous points for single hop clients. In other + words, if a client directly connects to the relay and sends an + ESTABLISH_RENDEZVOUS cell, it is silently dropped. "auto" means use the + consensus parameter. + (Default: auto) + TESTING NETWORK OPTIONS ----------------------- diff --cc src/common/log.c index ac6d07a92,4db1c9f0d..d59e5a403 --- a/src/common/log.c +++ b/src/common/log.c @@@ -1263,7 -1177,7 +1263,7 @@@ static const char *domain_list[] = "GENERAL", "CRYPTO", "NET", "CONFIG", "FS", "PROTOCOL", "MM", "HTTP", "APP", "CONTROL", "CIRC", "REND", "BUG", "DIR", "DIRSERV", "OR", "EDGE", "ACCT", "HIST", "HANDSHAKE", "HEARTBEAT", "CHANNEL", - "SCHED", "GUARD", "CONSDIFF", NULL - "SCHED", "DOS", NULL ++ "SCHED", "GUARD", "CONSDIFF", "DOS", NULL }; /** Return a bitmask for the log domain for which <b>domain</b> is the name, diff --cc src/common/torlog.h index b7d033adb,20b7d938f..cadfe3b87 --- a/src/common/torlog.h +++ b/src/common/torlog.h @@@ -99,12 -99,10 +99,14 @@@ #define LD_CHANNEL (1u<<21) /** Scheduler */ #define LD_SCHED (1u<<22) +/** Guard nodes */ +#define LD_GUARD (1u<<23) +/** Generation and application of consensus diffs. */ +#define LD_CONSDIFF (1u<<24) + /** Denial of Service mitigation. */ -#define LD_DOS (1u<<23) ++#define LD_DOS (1u<<25) /** Number of logging domains in the code. */ - #define N_LOGGING_DOMAINS 25 -#define N_LOGGING_DOMAINS 24 ++#define N_LOGGING_DOMAINS 26 /** This log message is not safe to send to a callback-based logger * immediately. Used as a flag, not a log domain. */ diff --cc src/or/channel.c index 345a90a00,54e10666d..094bf93e6 --- a/src/or/channel.c +++ b/src/or/channel.c @@@ -1885,9 -2570,20 +1885,10 @@@ channel_do_open_actions(channel_t *chan router_set_status(chan->identity_digest, 1); } else { /* only report it to the geoip module if it's not a known router */ - if (!router_get_by_id_digest(chan->identity_digest)) { + if (!connection_or_digest_is_known_relay(chan->identity_digest)) { if (channel_get_addr_if_possible(chan, &remote_addr)) { char *transport_name = NULL; + channel_tls_t *tlschan = BASE_CHAN_TO_TLS(chan); if (chan->get_transport_name(chan, &transport_name) < 0) transport_name = NULL; diff --cc src/or/config.c index afaf86785,3b4027433..f6875b7ed --- a/src/or/config.c +++ b/src/or/config.c @@@ -81,8 -29,8 +81,9 @@@ #include "dirserv.h" #include "dirvote.h" #include "dns.h" + #include "dos.h" #include "entrynodes.h" +#include "git_revision.h" #include "geoip.h" #include "hibernate.h" #include "main.h" @@@ -314,8 -240,21 +315,21 @@@ static config_var_t option_vars_[] = OBSOLETE("DisableIOCP"), OBSOLETE("DisableV2DirectoryInfo_"), OBSOLETE("DynamicDHGroups"), - VPORT(DNSPort, LINELIST, NULL), - V(DNSListenAddress, LINELIST, NULL), + VPORT(DNSPort), + OBSOLETE("DNSListenAddress"), + /* DoS circuit creation options. */ + V(DoSCircuitCreationEnabled, AUTOBOOL, "auto"), + V(DoSCircuitCreationMinConnections, UINT, "0"), + V(DoSCircuitCreationRate, UINT, "0"), + V(DoSCircuitCreationBurst, UINT, "0"), + V(DoSCircuitCreationDefenseType, INT, "0"), + V(DoSCircuitCreationDefenseTimePeriod, INTERVAL, "0"), + /* DoS connection options. */ + V(DoSConnectionEnabled, AUTOBOOL, "auto"), + V(DoSConnectionMaxConcurrentCount, UINT, "0"), + V(DoSConnectionDefenseType, INT, "0"), + /* DoS single hop client options. */ + V(DoSRefuseSingleHopClientRendezvous, AUTOBOOL, "auto"), V(DownloadExtraInfo, BOOL, "0"), V(TestingEnableConnBwEvent, BOOL, "0"), V(TestingEnableCellStatsEvent, BOOL, "0"), diff --cc src/or/connection.c index a020bef77,791fd95c2..5bbb61dfa --- a/src/or/connection.c +++ b/src/or/connection.c @@@ -702,9 -687,16 +703,16 @@@ connection_free_,(connection_t *conn) connection_ap_warn_and_unmark_if_pending_circ(TO_ENTRY_CONN(conn), "connection_free"); } -#endif +#endif /* 1 */ + + /* Notify the circuit creation DoS mitigation subsystem that an OR client + * connection has been closed. And only do that if we track it. */ + if (conn->type == CONN_TYPE_OR) { + dos_close_client_conn(TO_OR_CONN(conn)); + } + connection_unregister_events(conn); - connection_free_(conn); + connection_free_minimal(conn); } /** diff --cc src/or/geoip.h index acf61b97a,aa0fca50f..ccedc1bc1 --- a/src/or/geoip.h +++ b/src/or/geoip.h @@@ -19,7 -20,30 +20,30 @@@ STATIC int geoip_parse_entry(const cha STATIC int geoip_get_country_by_ipv4(uint32_t ipaddr); STATIC int geoip_get_country_by_ipv6(const struct in6_addr *addr); STATIC void clear_geoip_db(void); -#endif +#endif /* defined(GEOIP_PRIVATE) */ + + /** Entry in a map from IP address to the last time we've seen an incoming + * connection from that IP address. Used by bridges only to track which + * countries have them blocked, or the DoS mitigation subsystem if enabled. */ + typedef struct clientmap_entry_t { + HT_ENTRY(clientmap_entry_t) node; + tor_addr_t addr; + /* Name of pluggable transport used by this client. NULL if no + pluggable transport was used. */ + char *transport_name; + + /** Time when we last saw this IP address, in MINUTES since the epoch. + * + * (This will run out of space around 4011 CE. If Tor is still in use around + * 4000 CE, please remember to add more bits to last_seen_in_minutes.) */ + unsigned int last_seen_in_minutes:30; + unsigned int action:2; + + /* This object is used to keep some statistics per client address for the + * DoS mitigation subsystem. */ + dos_client_stats_t dos_stats; + } clientmap_entry_t; + int should_record_bridge_info(const or_options_t *options); int geoip_load_file(sa_family_t family, const char *filename); MOCK_DECL(int, geoip_get_country_by_addr, (const tor_addr_t *addr)); diff --cc src/or/main.c index 10e606f3a,fcd8dc902..96c7e77c7 --- a/src/or/main.c +++ b/src/or/main.c @@@ -3483,9 -2990,7 +3484,10 @@@ tor_free_all(int postfork control_free_all(); sandbox_free_getaddrinfo_cache(); protover_free_all(); + bridges_free_all(); + consdiffmgr_free_all(); + hs_free_all(); + dos_free_all(); if (!postfork) { config_free_all(); or_state_free_all(); diff --cc src/or/networkstatus.c index aa0a8d15c,d9ae32560..77898445d --- a/src/or/networkstatus.c +++ b/src/or/networkstatus.c @@@ -51,8 -23,8 +51,9 @@@ #include "directory.h" #include "dirserv.h" #include "dirvote.h" + #include "dos.h" #include "entrynodes.h" +#include "hibernate.h" #include "main.h" #include "microdesc.h" #include "networkstatus.h" @@@ -1605,7 -1509,7 +1606,8 @@@ notify_networkstatus_changed(const netw const networkstatus_t *new_c) { notify_control_networkstatus_changed(old_c, new_c); + scheduler_notify_networkstatus_changed(old_c, new_c); + dos_consensus_has_changed(new_c); } /** Copy all the ancillary information (like router download status and so on) diff --cc src/or/or.h index c81e29c95,024a9cff0..0436533a9 --- a/src/or/or.h +++ b/src/or/or.h @@@ -4658,53 -4515,36 +4662,82 @@@ typedef struct /** If 1, we skip all OOS checks. */ int DisableOOSCheck; + /** Autobool: Should we include Ed25519 identities in extend2 cells? + * If -1, we should do whatever the consensus parameter says. */ + int ExtendByEd25519ID; + + /** Bool (default: 1): When testing routerinfos as a directory authority, + * do we enforce Ed25519 identity match? */ + /* NOTE: remove this option someday. */ + int AuthDirTestEd25519LinkKeys; + + /** Bool (default: 0): Tells if a %include was used on torrc */ + int IncludeUsed; + + /** The seconds after expiration which we as a relay should keep old + * consensuses around so that we can generate diffs from them. If 0, + * use the default. */ + int MaxConsensusAgeForDiffs; + + /** Bool (default: 0). Tells Tor to never try to exec another program. + */ + int NoExec; + + /** Have the KIST scheduler run every X milliseconds. If less than zero, do + * not use the KIST scheduler but use the old vanilla scheduler instead. If + * zero, do what the consensus says and fall back to using KIST as if this is + * set to "10 msec" if the consensus doesn't say anything. */ + int KISTSchedRunInterval; + + /** A multiplier for the KIST per-socket limit calculation. */ + double KISTSockBufSizeFactor; + + /** The list of scheduler type string ordered by priority that is first one + * has to be tried first. Default: KIST,KISTLite,Vanilla */ + smartlist_t *Schedulers; + /* An ordered list of scheduler_types mapped from Schedulers. */ + smartlist_t *SchedulerTypes_; + + /** List of files that were opened by %include in torrc and torrc-defaults */ + smartlist_t *FilesOpenedByIncludes; + + /** If true, Tor shouldn't install any posix signal handlers, since it is + * running embedded inside another process. + */ + int DisableSignalHandlers; ++ + /** Autobool: Is the circuit creation DoS mitigation subsystem enabled? */ + int DoSCircuitCreationEnabled; + /** Minimum concurrent connection needed from one single address before any + * defense is used. */ + int DoSCircuitCreationMinConnections; + /** Circuit rate used to refill the token bucket. */ + int DoSCircuitCreationRate; + /** Maximum allowed burst of circuits. Reaching that value, the address is + * detected as malicious and a defense might be used. */ + int DoSCircuitCreationBurst; + /** When an address is marked as malicous, what defense should be used + * against it. See the dos_cc_defense_type_t enum. */ + int DoSCircuitCreationDefenseType; + /** For how much time (in seconds) the defense is applicable for a malicious + * address. A random time delta is added to the defense time of an address + * which will be between 1 second and half of this value. */ + int DoSCircuitCreationDefenseTimePeriod; + + /** Autobool: Is the DoS connection mitigation subsystem enabled? */ + int DoSConnectionEnabled; + /** Maximum concurrent connection allowed per address. */ + int DoSConnectionMaxConcurrentCount; + /** When an address is reaches the maximum count, what defense should be + * used against it. See the dos_conn_defense_type_t enum. */ + int DoSConnectionDefenseType; + + /** Autobool: Do we refuse single hop client rendezvous? */ + int DoSRefuseSingleHopClientRendezvous; } or_options_t; +#define LOG_PROTOCOL_WARN (get_protocol_warning_severity_level()) + /** Persistent state for an onion router, as saved to disk. */ typedef struct { uint32_t magic_; diff --cc src/or/rendmid.c index 66d2f9311,441d5043c..c4a34ca62 --- a/src/or/rendmid.c +++ b/src/or/rendmid.c @@@ -11,7 -12,7 +12,8 @@@ #include "circuitlist.h" #include "circuituse.h" #include "config.h" +#include "crypto.h" + #include "dos.h" #include "relay.h" #include "rendmid.h" #include "rephist.h" diff --cc src/or/status.c index 187dc4ad2,fa2238b9f..3b4c60585 --- a/src/or/status.c +++ b/src/or/status.c @@@ -27,8 -27,7 +27,9 @@@ #include "hibernate.h" #include "rephist.h" #include "statefile.h" +#include "hs_stats.h" +#include "hs_service.h" + #include "dos.h" static void log_accounting(const time_t now, const or_options_t *options); #include "geoip.h" diff --cc src/test/include.am index a4b9705fd,91b0a5910..9783f93d5 --- a/src/test/include.am +++ b/src/test/include.am @@@ -114,6 -92,6 +114,7 @@@ src_test_test_SOURCES = src/test/test_dir.c \ src/test/test_dir_common.c \ src/test/test_dir_handle_get.c \ ++ src/test/test_dos.c \ src/test/test_entryconn.c \ src/test/test_entrynodes.c \ src/test/test_guardfraction.c \ diff --cc src/test/test.c index f225fd277,f66dee2d0..cba746517 --- a/src/test/test.c +++ b/src/test/test.c @@@ -1193,6 -1201,6 +1193,7 @@@ struct testgroup_t testgroups[] = { "dir/", dir_tests }, { "dir_handle_get/", dir_handle_get_tests }, { "dir/md/", microdesc_tests }, ++ { "dos/", dos_tests }, { "entryconn/", entryconn_tests }, { "entrynodes/", entrynodes_tests }, { "guardfraction/", guardfraction_tests }, diff --cc src/test/test.h index 93d527ba1,41df6b134..b41f0e54b --- a/src/test/test.h +++ b/src/test/test.h @@@ -199,9 -190,9 +199,10 @@@ extern struct testcase_t container_test extern struct testcase_t controller_tests[]; extern struct testcase_t controller_event_tests[]; extern struct testcase_t crypto_tests[]; -extern struct testcase_t dos_tests[]; +extern struct testcase_t crypto_openssl_tests[]; extern struct testcase_t dir_tests[]; extern struct testcase_t dir_handle_get_tests[]; ++extern struct testcase_t dos_tests[]; extern struct testcase_t entryconn_tests[]; extern struct testcase_t entrynodes_tests[]; extern struct testcase_t guardfraction_tests[];

1 0

[tor/master] dos: Man page entry for DoS mitigation
by nickm＠torproject.org 30 Jan '18

30 Jan '18

commit a3714268f659998dc879ed723852440cd8be1b04 Author: David Goulet <dgoulet(a)torproject.org> Date: Fri Jan 26 09:00:17 2018 -0500 dos: Man page entry for DoS mitigation Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- doc/tor.1.txt | 90 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 90 insertions(+) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 4c5d5359a..a2bbb8ab6 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2441,6 +2441,96 @@ The following options are used to configure a hidden service. including setting SOCKSPort to "0". (Default: 0) +DENIAL OF SERVICE MITIGATION OPTIONS +------------------------------------ + +The following options are useful only for a public relay. They control the +Denial of Service mitigation subsystem. + +[[DoSCircuitCreationEnabled]] **DoSCircuitCreationEnabled** **0**|**1**|**auto**:: + + Enable circuit creation DoS mitigation. If enabled, tor will cache client + IPs along with statistics in order to detect circuit DoS attacks. If an + address is positively identified, tor will activate defenses against the + address. See the DoSCircuitCreationDefenseType option for more details. + This is a client to relay detection only. "auto" means use the consensus + parameter. + (Default: auto) + +[[DoSCircuitCreationMinConnections]] **DoSCircuitCreationMinConnections** __NUM__:: + + Minimum threshold of concurrent connections before a client address can be + flagged as executing a circuit creation DoS. In other words, once a client + address reaches the circuit rate and has a minimum of NUM concurrent + connections, a detection is positive. "0" means use the consensus + parameter. + (Default: 0) + +[[DoSCircuitCreationRateTenths]] **DoSCircuitCreationRateTenths** __NUM__:: + + The allowed circuit creation rate in tenths of circuit per second applied + per client IP address. For example, if you want to set a rate of 5 + circuits per second allowed per IP address, this value should be set to + 50. If this option is 0, it obeys a consensus parameter. (Default: 0) + +[[DoSCircuitCreationBurst]] **DoSCircuitCreationBurst** __NUM__:: + + The allowed circuit creation burst per client IP address. If the circuit + rate and the burst are reached, a client is marked as executing a circuit + creation DoS. "0" means use the consensus parameter. + (Default: 0) + +[[DoSCircuitCreationDefenseType]] **DoSCircuitCreationDefenseType** __NUM__:: + + This is the type of defense applied to a detected client address. The + possible values are: + + 1: No defense. + 2: Refuse circuit creation for the DoSCircuitCreationDefenseTimePeriod period of time. ++ + "0" means use the consensus parameter. + (Default: 0) + +[[DoSCircuitCreationDefenseTimePeriod]] **DoSCircuitCreationDefenseTimePeriod** __NUM__:: + + The base time period that the DoS defense is activated for. The actual + value is selected randomly for each activation from NUM+1 to 3/2 * NUM. + "0" means use the consensus parameter. + (Default: 0) + +[[DoSConnectionEnabled]] **DoSConnectionEnabled** **0**|**1**|**auto**:: + + Enable the connection DoS mitigation. For client address only, this allows + tor to mitigate against large number of concurrent connections made by a + single IP address. "auto" means use the consensus parameter. + (Default: auto) + +[[DoSConnectionMaxConcurrentCount]] **DoSConnectionMaxConcurrentCount** __NUM__:: + + The maximum threshold of concurrent connection from a client IP address. + Above this limit, a defense selected by DoSConnectionDefenseType is + applied. "0" means use the consensus parameter. + (Default: 0) + +[[DoSConnectionDefenseType]] **DoSConnectionDefenseType** __NUM__:: + + This is the type of defense applied to a detected client address for the + connection mitigation. The possible values are: + + 1: No defense. + 2: Immediately close new connections. ++ + "0" means use the consensus parameter. + (Default: 0) + +[[DoSRefuseSingleHopClientRendezvous]] **DoSRefuseSingleHopClientRendezvous** **0**|**1**|**auto**:: + + Refuse establishment of rendezvous points for single hop clients. In other + words, if a client directly connects to the relay and sends an + ESTABLISH_RENDEZVOUS cell, it is silently dropped. "auto" means use the + consensus parameter. + (Default: auto) + TESTING NETWORK OPTIONS -----------------------

1 0

[tor/master] test: Add unit tests for the DoS subsystem
by nickm＠torproject.org 30 Jan '18

30 Jan '18

commit c3c2b55decc80028728780422fe2766ec6517246 Author: George Kadianakis <desnacked(a)riseup.net> Date: Thu Jan 25 16:38:59 2018 -0500 test: Add unit tests for the DoS subsystem Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/or/channel.c | 4 +- src/or/channel.h | 3 +- src/test/include.am | 1 + src/test/test.c | 1 + src/test/test.h | 1 + src/test/test_dos.c | 248 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 255 insertions(+), 3 deletions(-) diff --git a/src/or/channel.c b/src/or/channel.c index fdd3f81e8..54e10666d 100644 --- a/src/or/channel.c +++ b/src/or/channel.c @@ -3845,8 +3845,8 @@ channel_get_canonical_remote_descr(channel_t *chan) * supports this operation, and return 1. Return 0 if the underlying transport * doesn't let us do this. */ -int -channel_get_addr_if_possible(channel_t *chan, tor_addr_t *addr_out) +MOCK_IMPL(int, +channel_get_addr_if_possible,(channel_t *chan, tor_addr_t *addr_out)) { tor_assert(chan); tor_assert(addr_out); diff --git a/src/or/channel.h b/src/or/channel.h index a711b56d4..bcd345e8d 100644 --- a/src/or/channel.h +++ b/src/or/channel.h @@ -550,7 +550,8 @@ MOCK_DECL(void, channel_dump_statistics, (channel_t *chan, int severity)); void channel_dump_transport_statistics(channel_t *chan, int severity); const char * channel_get_actual_remote_descr(channel_t *chan); const char * channel_get_actual_remote_address(channel_t *chan); -int channel_get_addr_if_possible(channel_t *chan, tor_addr_t *addr_out); +MOCK_DECL(int, channel_get_addr_if_possible, (channel_t *chan, + tor_addr_t *addr_out)); const char * channel_get_canonical_remote_descr(channel_t *chan); int channel_has_queued_writes(channel_t *chan); int channel_is_bad_for_new_circs(channel_t *chan); diff --git a/src/test/include.am b/src/test/include.am index 8ecfaf10c..91b0a5910 100644 --- a/src/test/include.am +++ b/src/test/include.am @@ -87,6 +87,7 @@ src_test_test_SOURCES = \ src/test/test_controller.c \ src/test/test_controller_events.c \ src/test/test_crypto.c \ + src/test/test_dos.c \ src/test/test_data.c \ src/test/test_dir.c \ src/test/test_dir_common.c \ diff --git a/src/test/test.c b/src/test/test.c index 9a41b976b..f66dee2d0 100644 --- a/src/test/test.c +++ b/src/test/test.c @@ -1197,6 +1197,7 @@ struct testgroup_t testgroups[] = { { "control/", controller_tests }, { "control/event/", controller_event_tests }, { "crypto/", crypto_tests }, + { "dos/", dos_tests }, { "dir/", dir_tests }, { "dir_handle_get/", dir_handle_get_tests }, { "dir/md/", microdesc_tests }, diff --git a/src/test/test.h b/src/test/test.h index 25336ac83..41df6b134 100644 --- a/src/test/test.h +++ b/src/test/test.h @@ -190,6 +190,7 @@ extern struct testcase_t container_tests[]; extern struct testcase_t controller_tests[]; extern struct testcase_t controller_event_tests[]; extern struct testcase_t crypto_tests[]; +extern struct testcase_t dos_tests[]; extern struct testcase_t dir_tests[]; extern struct testcase_t dir_handle_get_tests[]; extern struct testcase_t entryconn_tests[]; diff --git a/src/test/test_dos.c b/src/test/test_dos.c new file mode 100644 index 000000000..5a8474ad8 --- /dev/null +++ b/src/test/test_dos.c @@ -0,0 +1,248 @@ +/* Copyright (c) 2018, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +#define DOS_PRIVATE +#define TOR_CHANNEL_INTERNAL_ +#define CIRCUITLIST_PRIVATE + +#include "or.h" +#include "dos.h" +#include "circuitlist.h" +#include "geoip.h" +#include "channel.h" +#include "test.h" +#include "log_test_helpers.h" + +static unsigned int +mock_enable_dos_protection(const networkstatus_t *ns) +{ + (void) ns; + return 1; +} + +/** Test that the connection tracker of the DoS subsystem will block clients + * who try to establish too many connections */ +static void +test_dos_conn_creation(void *arg) +{ + (void) arg; + + MOCK(get_param_cc_enabled, mock_enable_dos_protection); + MOCK(get_param_conn_enabled, mock_enable_dos_protection); + + /* Initialize test data */ + or_connection_t or_conn; + time_t now = 1281533250; /* 2010-08-11 13:27:30 UTC */ + tt_int_op(AF_INET,OP_EQ, tor_addr_parse(&or_conn.real_addr, + "18.0.0.1")); + tor_addr_t *addr = &or_conn.real_addr; + + /* Get DoS subsystem limits */ + dos_init(); + uint32_t max_concurrent_conns = get_param_conn_max_concurrent_count(NULL); + + /* Introduce new client */ + geoip_note_client_seen(GEOIP_CLIENT_CONNECT, addr, NULL, now); + { /* Register many conns from this client but not enough to get it blocked */ + unsigned int i; + for (i = 0; i < max_concurrent_conns; i++) { + dos_new_client_conn(&or_conn); + } + } + + /* Check that new conns are still permitted */ + tt_int_op(DOS_CONN_DEFENSE_NONE, OP_EQ, + dos_conn_addr_get_defense_type(addr)); + + /* Register another conn and check that new conns are not allowed anymore */ + dos_new_client_conn(&or_conn); + tt_int_op(DOS_CONN_DEFENSE_CLOSE, OP_EQ, + dos_conn_addr_get_defense_type(addr)); + + /* Close a client conn and see that a new conn will be permitted again */ + dos_close_client_conn(&or_conn); + tt_int_op(DOS_CONN_DEFENSE_NONE, OP_EQ, + dos_conn_addr_get_defense_type(addr)); + + /* Register another conn and see that defense measures get reactivated */ + dos_new_client_conn(&or_conn); + tt_int_op(DOS_CONN_DEFENSE_CLOSE, OP_EQ, + dos_conn_addr_get_defense_type(addr)); + + done: + dos_free_all(); +} + +/** Helper mock: Place a fake IP addr for this channel in <b>addr_out</b> */ +static int +mock_channel_get_addr_if_possible(channel_t *chan, tor_addr_t *addr_out) +{ + (void)chan; + tt_int_op(AF_INET,OP_EQ, tor_addr_parse(addr_out, "18.0.0.1"));; + return 1; + + done: + return 0; +} + +/** Test that the circuit tracker of the DoS subsystem will block clients who + * try to establish too many circuits. */ +static void +test_dos_circuit_creation(void *arg) +{ + (void) arg; + unsigned int i; + + MOCK(get_param_cc_enabled, mock_enable_dos_protection); + MOCK(get_param_conn_enabled, mock_enable_dos_protection); + MOCK(channel_get_addr_if_possible, + mock_channel_get_addr_if_possible); + + /* Initialize channels/conns/circs that will be used */ + channel_t *chan = tor_malloc_zero(sizeof(channel_t)); + channel_init(chan); + chan->is_client = 1; + + /* Initialize test data */ + or_connection_t or_conn; + time_t now = 1281533250; /* 2010-08-11 13:27:30 UTC */ + tt_int_op(AF_INET,OP_EQ, tor_addr_parse(&or_conn.real_addr, + "18.0.0.1")); + tor_addr_t *addr = &or_conn.real_addr; + + /* Get DoS subsystem limits */ + dos_init(); + uint32_t max_circuit_count = get_param_cc_circuit_burst(NULL); + uint32_t min_conc_conns_for_cc = + get_param_cc_min_concurrent_connection(NULL); + + /* Introduce new client and establish enough connections to activate the + * circuit counting subsystem */ + geoip_note_client_seen(GEOIP_CLIENT_CONNECT, addr, NULL, now); + for (i = 0; i < min_conc_conns_for_cc ; i++) { + dos_new_client_conn(&or_conn); + } + + /* Register new circuits for this client and conn, but not enough to get + * detected as dos */ + for (i=0; i < max_circuit_count-1; i++) { + dos_cc_new_create_cell(chan); + } + /* see that we didn't get detected for dosing */ + tt_int_op(DOS_CC_DEFENSE_NONE, OP_EQ, dos_cc_get_defense_type(chan)); + + /* Register another CREATE cell that will push us over the limit. Check that + * the cell gets refused. */ + dos_cc_new_create_cell(chan); + tt_int_op(DOS_CC_DEFENSE_REFUSE_CELL, OP_EQ, dos_cc_get_defense_type(chan)); + + /* TODO: Wait a few seconds before sending the cell, and check that the + buckets got refilled properly. */ + /* TODO: Actually send a Tor cell (instead of calling the DoS function) and + * check that it will get refused */ + + done: + tor_free(chan); + dos_free_all(); +} + +/** Test that the DoS subsystem properly refills the circuit token buckets. */ +static void +test_dos_bucket_refill(void *arg) +{ + (void) arg; + int i; + /* For this test, this variable is set to the current circ count of the token + * bucket. */ + uint32_t current_circ_count; + + MOCK(get_param_cc_enabled, mock_enable_dos_protection); + MOCK(get_param_conn_enabled, mock_enable_dos_protection); + MOCK(channel_get_addr_if_possible, + mock_channel_get_addr_if_possible); + + time_t now = 1281533250; /* 2010-08-11 13:27:30 UTC */ + update_approx_time(now); + + /* Initialize channels/conns/circs that will be used */ + channel_t *chan = tor_malloc_zero(sizeof(channel_t)); + channel_init(chan); + chan->is_client = 1; + or_connection_t or_conn; + tt_int_op(AF_INET,OP_EQ, tor_addr_parse(&or_conn.real_addr, + "18.0.0.1")); + tor_addr_t *addr = &or_conn.real_addr; + + /* Initialize DoS subsystem and get relevant limits */ + dos_init(); + uint32_t max_circuit_count = get_param_cc_circuit_burst(NULL); + int circ_rate = tor_lround(get_circuit_rate_per_second()); + /* Check that the circuit rate is a positive number and smaller than the max + * circuit count */ + tt_int_op(circ_rate, OP_GT, 1); + tt_int_op(circ_rate, OP_LT, max_circuit_count); + + /* Register this client */ + geoip_note_client_seen(GEOIP_CLIENT_CONNECT, addr, NULL, now); + dos_new_client_conn(&or_conn); + + /* Fetch this client from the geoip cache and get its DoS structs */ + clientmap_entry_t *entry = geoip_lookup_client(addr, NULL, + GEOIP_CLIENT_CONNECT); + tt_assert(entry); + dos_client_stats_t* dos_stats = &entry->dos_stats; + /* Check that the circuit bucket is still uninitialized */ + tt_uint_op(dos_stats->cc_stats.circuit_bucket, OP_EQ, 0); + + /* Send a create cell: then check that the circ token bucket got initialized + * and one circ was subtracted. */ + dos_cc_new_create_cell(chan); + current_circ_count = max_circuit_count - 1; + tt_uint_op(dos_stats->cc_stats.circuit_bucket, OP_EQ, current_circ_count); + + /* Now send 29 more CREATEs and ensure that the bucket is missing 30 + * tokens */ + for (i=0; i < 29; i++) { + dos_cc_new_create_cell(chan); + current_circ_count--; + } + tt_uint_op(dos_stats->cc_stats.circuit_bucket, OP_EQ, current_circ_count); + + /* OK! Progress time forward one sec, refill the bucket and check that the + * refill happened correctly. */ + now += 1; + update_approx_time(now); + cc_stats_refill_bucket(&dos_stats->cc_stats, addr); + /* check refill */ + current_circ_count += circ_rate; + tt_uint_op(dos_stats->cc_stats.circuit_bucket, OP_EQ, current_circ_count); + + /* Now send as many CREATE cells as needed to deplete our token bucket + * completely */ + for (; current_circ_count != 0; current_circ_count--) { + dos_cc_new_create_cell(chan); + } + tt_uint_op(current_circ_count, OP_EQ, 0); + tt_uint_op(dos_stats->cc_stats.circuit_bucket, OP_EQ, current_circ_count); + + /* Now progress time a week forward, and check that the token bucket does not + * have more than max_circs allowance, even tho we let it simmer for so + * long. */ + now += 604800; /* a week */ + update_approx_time(now); + cc_stats_refill_bucket(&dos_stats->cc_stats, addr); + current_circ_count += max_circuit_count; + tt_uint_op(dos_stats->cc_stats.circuit_bucket, OP_EQ, current_circ_count); + + done: + tor_free(chan); + dos_free_all(); +} + +struct testcase_t dos_tests[] = { + { "conn_creation", test_dos_conn_creation, TT_FORK, NULL, NULL }, + { "circuit_creation", test_dos_circuit_creation, TT_FORK, NULL, NULL }, + { "bucket_refill", test_dos_bucket_refill, TT_FORK, NULL, NULL }, + END_OF_TESTCASES +}; +

1 0

[tor/master] dos: Add changes file for ticket 24902
by nickm＠torproject.org 30 Jan '18

30 Jan '18

commit 9aca7d47306222f2870ec16a7291a8215d6c3316 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Jan 30 09:15:33 2018 -0500 dos: Add changes file for ticket 24902 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket24902 | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/changes/ticket24902 b/changes/ticket24902 new file mode 100644 index 000000000..1a2ef95cc --- /dev/null +++ b/changes/ticket24902 @@ -0,0 +1,13 @@ + o Major features (denial of service mitigation): + - Give relays some defenses against the recent network overload. We start + with three defenses (default parameters in parentheses). First: if a + single client address makes too many concurrent connections (>100), hang + up on further connections. Second: if a single client address makes + circuits too quickly (more than 3 per second, with an allowed burst of + 90) while also having too many connections open (3), refuse new create + cells for the next while (1-2 hours). Third: if a client asks to + establish a rendezvous point to you directly, ignore the request. These + defenses can be manually controlled by new torrc options, but relays + will also take guidance from consensus parameters, so there's no need to + configure anything manually. Implements ticket 24902. +

1 0

[tor-messenger-build/master] Also add the logo to the config file
by sukhbir＠torproject.org 30 Jan '18

30 Jan '18

commit 7bb4436dda23bf06ab02dfcb038817bbf2391738 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Tue Jan 30 15:54:16 2018 -0500 Also add the logo to the config file --- projects/tor-launcher/config | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/tor-launcher/config b/projects/tor-launcher/config index 10d0937..aa83531 100644 --- a/projects/tor-launcher/config +++ b/projects/tor-launcher/config @@ -10,3 +10,4 @@ input_files: content: '[% INCLUDE controlport.patch.tmpl -%]' refresh_input: 1 enable: '[% c("var/tor_control_port") %]' + - filename: tm-logo.svg

1 0

[tor-messenger-build/master] Set Tor Messenger's logo in Tor Launcher
by sukhbir＠torproject.org 30 Jan '18

30 Jan '18

commit 3e87965ab90ab3bb6c026ebc158293fb4badc3b4 Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Tue Jan 30 15:53:17 2018 -0500 Set Tor Messenger's logo in Tor Launcher --- projects/tor-launcher/build | 3 + projects/tor-launcher/tm-logo.svg | 141 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 144 insertions(+) diff --git a/projects/tor-launcher/build b/projects/tor-launcher/build index 0891389..45be6a6 100644 --- a/projects/tor-launcher/build +++ b/projects/tor-launcher/build @@ -5,5 +5,8 @@ cd [% project %]-[% c('version') %] [% IF c("var/tor_control_port") -%] patch -p1 < ../controlport.patch [% END -%] +[% IF c("var/tor-messenger") -%] +cp ../tm-logo.svg src/chrome/skin/tbb-logo.svg +[% END -%] make package mv pkg/*.xpi [% dest_dir _ '/' _ c('filename') %] diff --git a/projects/tor-launcher/tm-logo.svg b/projects/tor-launcher/tm-logo.svg new file mode 100644 index 0000000..279c7cd --- /dev/null +++ b/projects/tor-launcher/tm-logo.svg @@ -0,0 +1,141 @@ +<?xml version="1.0" encoding="UTF-8" standalone="no"?> +<svg + xmlns:dc="http://purl.org/dc/elements/1.1/" + xmlns:cc="http://creativecommons.org/ns#" + xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns="http://www.w3.org/2000/svg" + xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd" + xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape" + version="1.1" + id="Layer_1" + x="0px" + y="0px" + viewBox="0 0 328.6 66.3" + enable-background="new 0 0 328.6 66.3" + xml:space="preserve" + sodipodi:docname="tbb-logo.svg" + inkscape:version="0.92.2 (5c3e80d, 2017-08-06)"><metadata + id="metadata1177"><rdf:RDF><cc:Work + rdf:about=""><dc:format>image/svg+xml</dc:format><dc:type + rdf:resource="http://purl.org/dc/dcmitype/StillImage" /></cc:Work></rdf:RDF></metadata><defs + id="defs1175" /><sodipodi:namedview + pagecolor="#ffffff" + bordercolor="#666666" + borderopacity="1" + objecttolerance="10" + gridtolerance="10" + guidetolerance="10" + inkscape:pageopacity="0" + inkscape:pageshadow="2" + inkscape:window-width="1916" + inkscape:window-height="1037" + id="namedview1173" + showgrid="false" + inkscape:zoom="2.186549" + inkscape:cx="168.79494" + inkscape:cy="36.696549" + inkscape:window-x="0" + inkscape:window-y="18" + inkscape:window-maximized="0" + inkscape:current-layer="g1099" /><g + id="g1170"><g + id="g1099"><g + transform="matrix(0.34430464,0,0,0.45424661,-83.472839,-113.69093)" + id="g36"><path + d="m 692.606,310.394 h 2.218 v 82.385 h -2.112 v -59.254 l 0.317,-18.272 -28.835,77.526 h -2.112 l -28.835,-77.526 0.317,18.272 v 59.254 h -2.113 v -82.385 h 2.219 l 29.468,79.428 z" + id="path18" + inkscape:connector-curvature="0" /><path + d="m 755.032,310.394 v 2.112 H 713.84 v 37.179 h 35.911 v 2.112 H 713.84 v 38.869 h 41.192 v 2.112 h -43.306 v -82.385 h 43.306 z" + id="path20" + inkscape:connector-curvature="0" /><path + d="m 766.124,331.518 v -1.056 c 0,-12.886 10.984,-20.702 24.715,-20.702 17.217,0 24.927,9.718 24.927,25.455 v 2.641 h -2.112 c 0,-18.378 -7.499,-25.983 -22.392,-25.983 h -0.634 c -11.936,0 -22.181,7.183 -22.181,18.062 v 1.057 c 0,10.562 6.231,16.054 23.131,18.061 18.062,2.112 24.716,9.718 24.716,21.441 v 1.057 c 0,14.259 -11.091,21.863 -25.35,21.863 -17.005,0 -25.349,-10.562 -25.349,-25.982 v -1.057 h 2.112 c 0,16.477 8.344,24.927 22.92,24.927 h 0.634 c 13.097,0 22.92,-7.077 22.92,-19.329 v -1.056 c 0,-12.041 -6.865,-17.745 -23.659,-19.857 -17.956,-2.22 -24.398,-9.085 -24.398,-19.542 z" + id="path22" + inkscape:connector-curvature="0" /><path + d="m 827.386,331.518 v -1.056 c 0,-12.886 10.984,-20.702 24.715,-20.702 17.217,0 24.927,9.718 24.927,25.455 v 2.641 h -2.112 c 0,-18.378 -7.499,-25.983 -22.392,-25.983 h -0.634 c -11.936,0 -22.181,7.183 -22.181,18.062 v 1.057 c 0,10.562 6.231,16.054 23.131,18.061 18.062,2.112 24.716,9.718 24.716,21.441 v 1.057 c 0,14.259 -11.091,21.863 -25.35,21.863 -17.005,0 -25.349,-10.562 -25.349,-25.982 v -1.057 h 2.112 c 0,16.477 8.344,24.927 22.92,24.927 h 0.634 c 13.097,0 22.92,-7.077 22.92,-19.329 v -1.056 c 0,-12.041 -6.865,-17.745 -23.659,-19.857 -17.956,-2.22 -24.398,-9.085 -24.398,-19.542 z" + id="path24" + inkscape:connector-curvature="0" /><path + d="m 934.593,310.394 v 2.112 H 893.4 v 37.179 h 35.911 v 2.112 H 893.4 v 38.869 h 41.192 v 2.112 h -43.306 v -82.385 h 43.307 z" + id="path26" + inkscape:connector-curvature="0" /><path + d="m 996.91,373.767 v -63.373 h 2.113 v 82.385 h -2.641 l -46.052,-79.321 0.106,15.948 v 63.373 h -2.113 v -82.385 h 2.641 l 46.052,79.321 z" + id="path28" + inkscape:connector-curvature="0" /><path + d="m 1014.341,353.698 v -4.225 c 0,-28.729 10.034,-39.714 27.462,-39.714 17.428,0 23.765,10.879 23.765,27.778 v 2.43 h -2.112 c 0,-19.646 -6.231,-28.096 -21.336,-28.096 h -0.634 c -15.421,0 -25.032,10.14 -25.032,37.602 v 4.225 c 0,27.462 9.506,37.602 26.194,37.602 h 0.634 c 10.245,0 17.005,-3.803 20.174,-7.816 v -26.827 h -16.794 v -2.113 h 18.906 v 29.892 c -3.38,4.33 -10.351,8.978 -22.603,8.978 -18.695,-0.002 -28.624,-10.986 -28.624,-39.716 z" + id="path30" + inkscape:connector-curvature="0" /><path + d="m 1125.247,310.394 v 2.112 h -41.192 v 37.179 h 35.911 v 2.112 h -35.911 v 38.869 h 41.192 v 2.112 h -43.306 v -82.385 h 43.306 z" + id="path32" + inkscape:connector-curvature="0" /><path + d="m 1141.092,392.778 h -2.113 v -82.385 h 20.386 c 11.195,0 23.342,4.542 23.342,22.181 v 2.112 c 0,13.309 -6.971,19.224 -15.104,21.229 l 15.104,36.862 h -2.323 l -14.893,-36.439 c -2.007,0.423 -4.119,0.528 -6.126,0.528 h -18.272 v 35.912 z m 18.166,-38.023 c 8.661,0 21.23,-2.746 21.23,-20.174 v -1.901 c 0,-17.428 -12.569,-20.174 -21.23,-20.174 h -18.166 v 42.249 z" + id="path34" + inkscape:connector-curvature="0" /></g></g><g + id="g1105"><g + id="g1103"><rect + x="120.4" + y="6.2" + fill="#494949" + width="3" + height="58" + id="rect1101" /></g></g><g + id="g1168"><g + id="g1160"><g + id="layer3_17_" + transform="translate(-92,-63.999774)"><g + id="layer5_17_"><g + id="path2554_28_"><g + id="g1109"><path + fill="#68B044" + d="M152.1,68.8l-1.7,6.8c2.4-4.8,6.3-8.4,10.7-11.6c-3.2,3.8-6.2,7.5-8,11.3c3.1-4.3,7.2-6.7,11.8-8.2 c-6.2,5.5-11,11.4-14.8,17.3l-3-1.3C147.7,78.3,149.5,73.5,152.1,68.8L152.1,68.8z" + id="path1107" /></g></g><g + id="path2534_7_"><g + id="g1114"><path + fill="#F5F8DE" + d="M144.2,81.8l5.6,2.3c0,1.4-0.1,5.8,0.8,7.1c9.4,12.1,7.8,36.2-1.9,36.8c-14.7,0-20.4-10-20.4-19.2 c0-8.4,10.1-14,16.1-18.9C146,88.6,145.7,85.6,144.2,81.8L144.2,81.8z" + id="path1112" /></g></g><g + id="path2536_18_"><g + id="g1119"><path + fill="#7E4798" + d="M149.9,84l2,1c-0.2,1.3,0.1,4.3,1.4,5.1c5.9,3.7,11.5,7.7,13.7,11.7c7.8,14.1-5.5,27.2-17,25.9 c6.2-4.6,8.1-14.1,5.7-24.5c-1-4.1-2.4-7.7-5.1-11.9C149.6,89.4,150,86.9,149.9,84L149.9,84z" + id="path1117" /></g></g></g><g + id="layer4_17_"><g + id="path2540_18_"><g + id="g1125"><path + fill="#010101" + d="M147.6,90.8c-0.4,2.2-0.9,6.2-2.8,7.6c-0.8,0.6-1.6,1.1-2.5,1.7c-3.4,2.3-6.9,4.5-8.4,10.2 c-0.3,1.2,0,2.5,0.2,3.7c0.9,3.4,3.3,7.2,5.2,9.3c0,0.1,0.4,0.3,0.4,0.4c1.6,1.9,2.1,2.4,8,3.7l-0.1,0.7 c-3.6-1-6.5-1.8-8.4-4c0,0-0.3-0.4-0.3-0.4c-2-2.3-4.4-6.1-5.3-9.7c-0.3-1.4-0.6-2.5-0.2-4c1.6-5.8,5.2-8.1,8.7-10.5 c0.8-0.5,1.8-1,2.5-1.6C146,96.8,146.8,93.5,147.6,90.8L147.6,90.8z" + id="path1123" /></g></g><g + id="path2542_18_"><g + id="g1130"><path + fill="#010101" + d="M149.1,99.9c0,2.5-0.2,3.7,0.4,5.5c0.4,1,1.7,2.5,2.1,3.9c0.5,1.9,1.1,3.9,1,5.2c0,1.4-0.1,4.1-0.7,7 c-0.5,2.4-1.6,4.4-3.4,5.5c-1.9-0.4-4.1-1-5.4-2.2c-2.5-2.2-4.8-5.9-5.1-9.1c-0.2-2.6,2.2-6.5,5.6-8.4 c2.9-1.7,3.5-3.6,4.1-6.6c-0.9,2.7-1.7,4.9-4.4,6.3c-4,2.1-6.1,5.6-5.9,9c0.3,4.3,2,7.2,5.4,9.5c1.4,1,4.1,2.1,5.8,2.3v-0.2 c1.3-0.2,2.9-2.3,3.7-5.1c0.7-2.5,1-5.8,0.9-7.8c0-1.2-0.6-3.8-1.5-6.1c-0.5-1.3-1.3-2.6-1.9-3.5 C149.4,104.2,149.4,102.2,149.1,99.9z" + id="path1128" /></g></g><g + id="path2544_18_"><g + id="g1135"><path + fill="#010101" + d="M148.7,109.7c0,1.7,0.7,3.8,1,6c0.2,1.6,0.1,3.3,0.1,4.7c0,1.7-0.6,4.6-1.4,6.1 c-0.7-0.3-1-0.7-1.5-1.3c-0.6-0.8-1-1.6-1.3-2.6c-0.3-0.7-0.6-1.5-0.8-2.5c-0.2-1.4-0.1-3.7,1.5-6c1.2-1.8,1.5-2,2-4 c-0.6,1.9-1,2-2.3,3.6c-1.5,1.7-1.7,4.2-1.7,6.3c0,0.9,0.3,1.8,0.7,2.7c0.4,1,0.7,1.9,1.2,2.6c0.8,1.2,1.8,1.8,2.3,1.9 c0,0,0,0,0,0c0,0,0,0,0,0v-0.1c0.9-1,1.5-2.1,1.7-3.1c0.2-1.2,0.3-2.5,0.4-4c0.1-1.2,0-2.9-0.3-4.6 C149.8,113.4,149,111.2,148.7,109.7L148.7,109.7z" + id="path1133" /></g></g><g + id="path2550_18_"><g + id="g1140"><path + fill="#010101" + d="M149,88.7c0,2.5,0.2,7.1,0.9,8.9c0.2,0.6,2,3.3,3.2,6.6c0.9,2.3,1,4.4,1.2,5 c0.6,2.7-0.1,7.3-1.1,11.6c-0.5,2.3-2.1,5.2-4,6.4l-0.4,0.7c1,0,3.6-2.6,4.5-5.7c1.5-5.3,2.1-7.8,1.4-13.7 c-0.1-0.6-0.3-2.5-1.2-4.6c-1.3-3.2-3.2-6.2-3.5-6.9C149.7,96,149.1,91.7,149,88.7L149,88.7z" + id="path1138" /></g></g><g + id="path2552_18_"><g + id="g1145"><path + fill="#010101" + d="M149.9,84.3c-0.1,2.5-0.2,4.6,0.3,6.4c0.5,2.1,3.2,5,4.3,8.4c2.1,6.5,1.6,15,0,21.6 c-0.6,2.3-3.3,5.7-6,6.8l2,0.5c1.1,0,3.9-2.7,5-5.7c1.8-4.7,2.1-10.3,1.4-16.3c0-0.6-1-5.7-1.9-7.8c-1.3-3.2-3.3-5.4-4.1-7.4 c-0.6-1.5-0.8-5.4-0.4-6.3L149.9,84.3z" + id="path1143" /></g></g></g></g><g + id="path2528_14_"><g + id="g1152"><path + fill="#7E4798" + d="M2.7,6.2H41c1.4,0,2.7,1.2,2.7,2.7v11.3c0,1.5-1.2,2.7-2.7,2.7h-7.9c-1.8,0-2.5,1-2.5,2.1v37 c0,1.2-1,2.2-2.2,2.2h-13c-1.2,0-2.1-1-2.1-2.2V24.7c0-1.1-1-1.8-1.9-1.8H2.7c-1.5,0-2.7-1.2-2.7-2.7V8.9 C0,7.4,1.2,6.2,2.7,6.2z" + id="path1150" /></g></g><g + id="path2532_14_"><g + id="g1157"><path + fill="#7E4798" + d="M100.9,21.2h3.4c1.2,0,2.2,1,2.2,2.2v12.1c0,1.6,0.1,2.2-1.8,2.2c-3.8,0-5.5,2-5.5,4.2v20.5 c0,1-0.9,1.8-2,1.8H85.1c-1.1,0-2-0.8-2-1.8V39.1c0-0.4,0-1,0-1.3c0.7-8.6,7.4-15.5,16-16.4C99.4,21.3,100.5,21.2,100.9,21.2 L100.9,21.2z" + id="path1155" /></g></g></g><g + id="g1166"><g + id="g1164"><path + fill="#010101" + d="M72,32.8c-2.1-1.9-4.6-3.4-7.3-4.9c-1.2-0.7-4.9-3.5-3.6-7.6l-9.3-3.8l-0.6,0.5c3.1,5.6,1.5,8.5,0,9.6 c-3.1,2.1-7.6,4.8-9.9,7.2c-4.3,4.4-5.6,8.7-5.2,14.3c0.4,7.2,5.6,13.1,12.6,15.5c3.1,1,5.9,1.1,9,1.1c5.1,0,10.3-1.3,14-4.5 c4-3.3,6.4-8.3,6.4-13.5C78.1,41.2,75.9,36.3,72,32.8z M70.6,58.9c-3.4,2.9-9.7,4.8-13,4.7c-3.7-0.2-7.3-0.8-10.4-2.3 c-5.6-2.7-9.3-8.5-9.5-13.3c-0.5-9.7,4.1-12.5,8.4-16c2.4-2,5.8-3,7.7-6.5c0.4-0.8,0.6-2.5,0.1-4.2c-0.2-0.6-1.1-2.8-1.4-3.2 l7,3.1c-0.9,3.2,1.8,6.5,3.9,7.7c2.1,1.2,5.5,3.4,7.5,5.3c3.6,3.2,5.5,7.7,5.5,12.5C76.3,51.2,74.3,55.8,70.6,58.9z" + id="path1162" /></g></g></g></g></svg> \ No newline at end of file

1 0

[tor-messenger-build/master] Update config file for the last commit
by sukhbir＠torproject.org 30 Jan '18

30 Jan '18

commit 454d3e4e8115d7cd15a7109332b3a144fe6bdb6e Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Tue Jan 30 11:38:10 2018 -0500 Update config file for the last commit --- projects/mozilla/STL_win64.patch | 24 ------------------------ projects/mozilla/config | 2 +- 2 files changed, 1 insertion(+), 25 deletions(-) diff --git a/projects/mozilla/STL_win64.patch b/projects/mozilla/STL_win64.patch deleted file mode 100644 index e528905..0000000 --- a/projects/mozilla/STL_win64.patch +++ /dev/null @@ -1,24 +0,0 @@ -From 8f8c1a1069d4907d3cedae578975225d8caeecaf Mon Sep 17 00:00:00 2001 -From: Nicolas Vigier <boklm(a)torproject.org> -Date: Sat, 12 Aug 2017 22:00:13 +0200 -Subject: [PATCH] Bug 23231: disable STL Wrappers on Windows - -Workaround for: -https://bugzilla.mozilla.org/show_bug.cgi?id=1392604 ---- - old-configure.in | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/old-configure.in b/old-configure.in -index f5a2f05..e247551 100644 ---- a/old-configure.in -+++ b/old-configure.in -@@ -1338,7 +1338,7 @@ MOZ_CXX11 - AC_LANG_C - - case "${OS_TARGET}" in --Darwin) -+WINNT|Darwin) - ;; - *) - STL_FLAGS="-I${DIST}/stl_wrappers" diff --git a/projects/mozilla/config b/projects/mozilla/config index f3c4234..81d52d7 100644 --- a/projects/mozilla/config +++ b/projects/mozilla/config @@ -11,5 +11,5 @@ input_files: - filename: 0003-OSX-package-as-tar.bz2.patch - filename: 0004-Updater-fixups-for-TM.patch - filename: 0005-Permit-storing-exceptions-even-w-inPrivateBrowsingMo.patch - - filename: STL_win64.patch + - filename: 0006-Bug-23231-disable-STL-Wrappers-on-Windows.patch enable: '[% c("var/windows-x86_64") %]'

1 0

[tor-messenger-build/master] Use proper formatting for mozilla/ patches
by sukhbir＠torproject.org 30 Jan '18

30 Jan '18

commit 7771c1378bd74a12d06a0a3429dbaec8743383ad Author: Sukhbir Singh <sukhbir(a)torproject.org> Date: Tue Jan 30 11:22:10 2018 -0500 Use proper formatting for mozilla/ patches --- ...0001-Trac-19910-Prevents-STARTTLS-in-XMPP.patch | 6 ++--- .../mozilla/0002-Trac-16475-Block-flash-too.patch | 6 ++--- projects/mozilla/0003-OSX-package-as-tar.bz2.patch | 6 ++--- projects/mozilla/0004-Updater-fixups-for-TM.patch | 6 ++--- ...ing-exceptions-even-w-inPrivateBrowsingMo.patch | 6 ++--- ...Bug-23231-disable-STL-Wrappers-on-Windows.patch | 27 ++++++++++++++++++++++ 6 files changed, 42 insertions(+), 15 deletions(-) diff --git a/projects/mozilla/0001-Trac-19910-Prevents-STARTTLS-in-XMPP.patch b/projects/mozilla/0001-Trac-19910-Prevents-STARTTLS-in-XMPP.patch index e78e36b..d634f0b 100644 --- a/projects/mozilla/0001-Trac-19910-Prevents-STARTTLS-in-XMPP.patch +++ b/projects/mozilla/0001-Trac-19910-Prevents-STARTTLS-in-XMPP.patch @@ -1,7 +1,7 @@ -From 6ee07445bcfa1ef74934ecc7a7862afd10d0927d Mon Sep 17 00:00:00 2001 +From 4015b1fc6b60638ec28bdfb568ff263e4a69783a Mon Sep 17 00:00:00 2001 From: Arlo Breault <arlolra(a)gmail.com> Date: Fri, 1 Sep 2017 17:39:04 -0400 -Subject: [PATCH 1/5] Trac 19910: Prevents STARTTLS in XMPP +Subject: [PATCH 1/6] Trac 19910: Prevents STARTTLS in XMPP * Revert "Bug 3875: Use Optimistic Data SOCKS variant." @@ -115,5 +115,5 @@ index a21dfa4a5a11..5429637c1c3a 100644 void SetNamedPipeFD(PRFileDesc *fd) { mFD = fd; } -- -2.16.1 +2.11.0 diff --git a/projects/mozilla/0002-Trac-16475-Block-flash-too.patch b/projects/mozilla/0002-Trac-16475-Block-flash-too.patch index 5c24cdb..81d60d3 100644 --- a/projects/mozilla/0002-Trac-16475-Block-flash-too.patch +++ b/projects/mozilla/0002-Trac-16475-Block-flash-too.patch @@ -1,7 +1,7 @@ -From a1f8139363a279d8c948ef621e860e306eca2167 Mon Sep 17 00:00:00 2001 +From add0c6cef2e16013a4e937477fa74156589d310f Mon Sep 17 00:00:00 2001 From: Arlo Breault <arlolra(a)gmail.com> Date: Thu, 6 Oct 2016 20:13:35 -0700 -Subject: [PATCH 2/5] Trac 16475: Block flash too +Subject: [PATCH 2/6] Trac 16475: Block flash too * Builds on "Bug #3547: Block all plugins except flash." --- @@ -29,5 +29,5 @@ index cd1707beaf5f..d014832e0595 100644 } -- -2.16.1 +2.11.0 diff --git a/projects/mozilla/0003-OSX-package-as-tar.bz2.patch b/projects/mozilla/0003-OSX-package-as-tar.bz2.patch index ce7636d..33108b5 100644 --- a/projects/mozilla/0003-OSX-package-as-tar.bz2.patch +++ b/projects/mozilla/0003-OSX-package-as-tar.bz2.patch @@ -1,7 +1,7 @@ -From 4502122ff76eb1c6de00f3db49b6ff3121f1e9ce Mon Sep 17 00:00:00 2001 +From 4a6547f057868dcf8a6660632f2a84dcbdc9ff30 Mon Sep 17 00:00:00 2001 From: Nicolas Vigier <boklm(a)torproject.org> Date: Thu, 25 Jun 2015 12:18:43 +0200 -Subject: [PATCH 3/5] OSX: package as tar.bz2 +Subject: [PATCH 3/6] OSX: package as tar.bz2 --- toolkit/mozapps/installer/upload-files.mk | 2 +- @@ -21,5 +21,5 @@ index 51633178226c..64584f579390 100644 ifeq (,$(filter-out WINNT, $(OS_ARCH))) MOZ_PKG_FORMAT = ZIP -- -2.16.1 +2.11.0 diff --git a/projects/mozilla/0004-Updater-fixups-for-TM.patch b/projects/mozilla/0004-Updater-fixups-for-TM.patch index 305bc0f..9d3053d 100644 --- a/projects/mozilla/0004-Updater-fixups-for-TM.patch +++ b/projects/mozilla/0004-Updater-fixups-for-TM.patch @@ -1,7 +1,7 @@ -From 26c0c11d82d4192f68cdb87ea4dd2d5f6f6d52e3 Mon Sep 17 00:00:00 2001 +From 7bd981927d912cb20dc16658deccc9fa77a92690 Mon Sep 17 00:00:00 2001 From: Arlo Breault <arlolra(a)gmail.com> Date: Fri, 1 Sep 2017 17:45:40 -0400 -Subject: [PATCH 4/5] Updater fixups for TM +Subject: [PATCH 4/6] Updater fixups for TM * Remove updater links @@ -804,5 +804,5 @@ index c45961ac54e7..23d6fbe2929a 100644 nsresult rv = GetAppRootDir(aExeFile, getter_AddRefs(appRootDir)); NS_ENSURE_SUCCESS(rv, rv); -- -2.16.1 +2.11.0 diff --git a/projects/mozilla/0005-Permit-storing-exceptions-even-w-inPrivateBrowsingMo.patch b/projects/mozilla/0005-Permit-storing-exceptions-even-w-inPrivateBrowsingMo.patch index 1e327f6..9f9e15f 100644 --- a/projects/mozilla/0005-Permit-storing-exceptions-even-w-inPrivateBrowsingMo.patch +++ b/projects/mozilla/0005-Permit-storing-exceptions-even-w-inPrivateBrowsingMo.patch @@ -1,7 +1,7 @@ -From bd9333d8dfd64559b4d33f06b3871740104259f5 Mon Sep 17 00:00:00 2001 +From 7abd599adc7c76757e56cea3a4c73c1daa3c1781 Mon Sep 17 00:00:00 2001 From: Arlo Breault <arlolra(a)gmail.com> Date: Sat, 3 Dec 2016 10:01:52 -0800 -Subject: [PATCH 5/5] Permit storing exceptions even w/ inPrivateBrowsingMode +Subject: [PATCH 5/6] Permit storing exceptions even w/ inPrivateBrowsingMode --- security/manager/pki/resources/content/exceptionDialog.js | 3 ++- @@ -20,5 +20,5 @@ index 0ca24a614dca..df50701729ce 100644 + return false; // PrivateBrowsingUtils.isWindowPrivate(window); } -- -2.16.1 +2.11.0 diff --git a/projects/mozilla/0006-Bug-23231-disable-STL-Wrappers-on-Windows.patch b/projects/mozilla/0006-Bug-23231-disable-STL-Wrappers-on-Windows.patch new file mode 100644 index 0000000..1c3db22 --- /dev/null +++ b/projects/mozilla/0006-Bug-23231-disable-STL-Wrappers-on-Windows.patch @@ -0,0 +1,27 @@ +From c8b565a24def7c0c39d134bb8a85a28b0395826c Mon Sep 17 00:00:00 2001 +From: Nicolas Vigier <boklm(a)torproject.org> +Date: Sat, 12 Aug 2017 22:00:13 +0200 +Subject: [PATCH 6/6] Bug 23231: disable STL Wrappers on Windows + +Workaround for: +https://bugzilla.mozilla.org/show_bug.cgi?id=1392604 +--- + old-configure.in | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/old-configure.in b/old-configure.in +index f5a2f05629ce..e247551461b6 100644 +--- a/old-configure.in ++++ b/old-configure.in +@@ -1338,7 +1338,7 @@ MOZ_CXX11 + AC_LANG_C + + case "${OS_TARGET}" in +-Darwin) ++WINNT|Darwin) + ;; + *) + STL_FLAGS="-I${DIST}/stl_wrappers" +-- +2.11.0 +

1 0

[translation/tails-persistence-setup_completed] Update translations for tails-persistence-setup_completed
by translation＠torproject.org 30 Jan '18

30 Jan '18

commit 9ab7fa50299982b7cef759583c977bba7d814922 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Jan 30 13:16:11 2018 +0000 Update translations for tails-persistence-setup_completed --- ru/ru.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ru/ru.po b/ru/ru.po index f624e0d35..3431ed854 100644 --- a/ru/ru.po +++ b/ru/ru.po @@ -21,7 +21,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: Tails developers <tails(a)boum.org>\n" "POT-Creation-Date: 2017-05-15 13:51+0200\n" -"PO-Revision-Date: 2018-01-30 12:15+0000\n" +"PO-Revision-Date: 2018-01-30 12:46+0000\n" "Last-Translator: Andrey\n" "Language-Team: Russian (http://www.transifex.com/otf/torproject/language/ru/)\n" "MIME-Version: 1.0\n"

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits January 2018