January 2018 - tor-commits - lists.torproject.org

[tor-browser-spec/master] Update design doc update date
by gk＠torproject.org 24 Jan '18

24 Jan '18

commit be5a4e2bad1cd1ca6d7ba1043202e9e4099e0ebd Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jan 24 09:11:54 2018 +0000 Update design doc update date --- design-doc/design.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/design-doc/design.xml b/design-doc/design.xml index 762f7b4..6f112f6 100644 --- a/design-doc/design.xml +++ b/design-doc/design.xml @@ -29,7 +29,7 @@ <address><email>gk#torproject org</email></address> </affiliation> </author> - <pubdate>January 23th, 2017</pubdate> + <pubdate>January 24th, 2017</pubdate> </articleinfo> <sect1>

1 0

[tor-browser-spec/master] Bug 21256: Fixup for Referer related entry
by gk＠torproject.org 24 Jan '18

24 Jan '18

commit 2b6b3cc54424d617b188729ad2cdd9915a27847f Author: Georg Koppen <gk(a)torproject.org> Date: Wed Jan 24 09:10:28 2018 +0000 Bug 21256: Fixup for Referer related entry --- design-doc/design.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/design-doc/design.xml b/design-doc/design.xml index a52e7aa..762f7b4 100644 --- a/design-doc/design.xml +++ b/design-doc/design.xml @@ -3759,7 +3759,7 @@ occurring. <listitem><command>The Referer Header</command> <para> -When leaving a .onion domain we set the Referer header to the destination by +When leaving a .onion domain we set the Referer header to an empty string by <ulink url="https://gitweb.torproject.org/tor-browser.git/commit/?h=tor-browser-52.5.2e…"> providing a preference</ulink>, <command>network.http.referer.hideOnionSource</command>, and setting it to <command>true</command>. That avoids leaking information which might be especially problematic in the case of transitioning

1 0

[translation/tor-launcher-network-settings_completed] Update translations for tor-launcher-network-settings_completed
by translation＠torproject.org 23 Jan '18

23 Jan '18

commit ab4eb6b3bb42797c6043a39ee407cb51fee3b634 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Jan 23 21:46:56 2018 +0000 Update translations for tor-launcher-network-settings_completed --- es/network-settings.dtd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/es/network-settings.dtd b/es/network-settings.dtd index 101ff1255..9f87481ab 100644 --- a/es/network-settings.dtd +++ b/es/network-settings.dtd @@ -51,8 +51,8 @@ <!ENTITY torsettings.proxyHelp1 "Se necesita un proxy local cuando se conecta a través de una red de empresa, escuela o universidad. Si no estás seguro de cómo responder a esta pregunta, consulta la configuración de Internet en otro navegador o consulta la configuración de red de tu sistema para ver si se necesita un proxy."> <!ENTITY torsettings.bridgeHelpTitle "Ayuda de repetidores puente ('bridge relays')"> -<!ENTITY torsettings.bridgeHelp1 "Los puentes son transmisores no listados que dificultan el bloqueo de las conexiones a la red Tor&#160. Cada tipo de puente utiliza un método diferente para evitar la censura&#160. Los obfs hacen que tu tráfico parezca ruido aleatorio, y los modestos hacen que tu tráfico parezca que se está conectando a ese servicio en lugar de a Tor."> +<!ENTITY torsettings.bridgeHelp1 "Los puentes son transmisores no listados que dificultan el bloqueo de las conexiones a la red Tor.  Cada tipo de puente utiliza un método diferente para evitar la censura.  Los obfs hacen que tu tráfico parezca ruido aleatorio, y los modestos hacen que tu tráfico parezca que se está conectando a ese servicio en lugar de a Tor."> <!ENTITY torsettings.bridgeHelp2 "Debido a la forma en que ciertos países intentan bloquear a Tor, ciertos puentes funcionan en algunos países pero no en otros. Si no estás segura de qué puentes funcionan en tu país, visita torproject.org/about/contact.html#support">  -<!ENTITY torprogress.pleaseWait "Espera mientras establecemos una conexión a la red To.&#160r. Esto puede durar varios minutos."> +<!ENTITY torprogress.pleaseWait "Espera mientras establecemos una conexión a la red Tor.  Esto puede durar varios minutos.">

1 0

[translation/tor-launcher-network-settings] Update translations for tor-launcher-network-settings
by translation＠torproject.org 23 Jan '18

23 Jan '18

commit 441f8aeebce0356a5d667c21b0ecd656f5604db9 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Jan 23 21:46:50 2018 +0000 Update translations for tor-launcher-network-settings --- es/network-settings.dtd | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/es/network-settings.dtd b/es/network-settings.dtd index 101ff1255..9f87481ab 100644 --- a/es/network-settings.dtd +++ b/es/network-settings.dtd @@ -51,8 +51,8 @@ <!ENTITY torsettings.proxyHelp1 "Se necesita un proxy local cuando se conecta a través de una red de empresa, escuela o universidad. Si no estás seguro de cómo responder a esta pregunta, consulta la configuración de Internet en otro navegador o consulta la configuración de red de tu sistema para ver si se necesita un proxy."> <!ENTITY torsettings.bridgeHelpTitle "Ayuda de repetidores puente ('bridge relays')"> -<!ENTITY torsettings.bridgeHelp1 "Los puentes son transmisores no listados que dificultan el bloqueo de las conexiones a la red Tor&#160. Cada tipo de puente utiliza un método diferente para evitar la censura&#160. Los obfs hacen que tu tráfico parezca ruido aleatorio, y los modestos hacen que tu tráfico parezca que se está conectando a ese servicio en lugar de a Tor."> +<!ENTITY torsettings.bridgeHelp1 "Los puentes son transmisores no listados que dificultan el bloqueo de las conexiones a la red Tor.  Cada tipo de puente utiliza un método diferente para evitar la censura.  Los obfs hacen que tu tráfico parezca ruido aleatorio, y los modestos hacen que tu tráfico parezca que se está conectando a ese servicio en lugar de a Tor."> <!ENTITY torsettings.bridgeHelp2 "Debido a la forma en que ciertos países intentan bloquear a Tor, ciertos puentes funcionan en algunos países pero no en otros. Si no estás segura de qué puentes funcionan en tu país, visita torproject.org/about/contact.html#support">  -<!ENTITY torprogress.pleaseWait "Espera mientras establecemos una conexión a la red To.&#160r. Esto puede durar varios minutos."> +<!ENTITY torprogress.pleaseWait "Espera mientras establecemos una conexión a la red Tor.  Esto puede durar varios minutos.">

1 0

[bridgedb/develop] Fix problem with "missing resources" on production moat server.
by isis＠torproject.org 23 Jan '18

23 Jan '18

commit 19c111cdabd70c3c69933e09b8efe06bb679d844 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Jan 23 21:03:35 2018 +0000 Fix problem with "missing resources" on production moat server. * FIXES #24432 https://bugs.torproject.org/24432. --- bridgedb/distributors/moat/server.py | 1 + 1 file changed, 1 insertion(+) diff --git a/bridgedb/distributors/moat/server.py b/bridgedb/distributors/moat/server.py index eb356fe..f4bff69 100644 --- a/bridgedb/distributors/moat/server.py +++ b/bridgedb/distributors/moat/server.py @@ -748,6 +748,7 @@ def addMoatServer(config, distributor): root = CustomErrorHandlingResource() root.putChild("meek", meek) + root.putChild("moat", moat) site = Site(root) site.displayTracebacks = False

1 0

[bridgedb/develop] Merge branch 'fix/24432' into develop
by isis＠torproject.org 23 Jan '18

23 Jan '18

commit 3a5dce31dc43f1ea7292e67372b57385ab5a4788 Merge: 94327eb 19c111c Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Jan 23 21:05:21 2018 +0000 Merge branch 'fix/24432' into develop bridgedb/distributors/moat/server.py | 1 + scripts/externalize-pt-client | 12 +++++++++ scripts/test-moat | 49 ++++++++++++++++++++++++++++-------- 3 files changed, 52 insertions(+), 10 deletions(-)

1 0

[bridgedb/develop] Merge branch 'fix/24704' into develop
by isis＠torproject.org 23 Jan '18

23 Jan '18

commit 94327eb3eca56785f865483d1ccdf4aa6e03752e Merge: c6c9f47 8aedf0b Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Jan 23 02:02:09 2018 +0000 Merge branch 'fix/24704' into develop bridgedb/test/test_Bridges.py | 95 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 93 insertions(+), 2 deletions(-)

1 0

[bridgedb/develop] Add David's script for running an external meek client.
by isis＠torproject.org 23 Jan '18

23 Jan '18

commit 2783933bf9935b6a7ab4ce97386887865a45589a Author: David Fifield <david(a)bamsoftware.com> Date: Tue Nov 28 02:05:58 2017 +0000 Add David's script for running an external meek client. --- scripts/externalize-pt-client | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/scripts/externalize-pt-client b/scripts/externalize-pt-client new file mode 100755 index 0000000..bbe01c6 --- /dev/null +++ b/scripts/externalize-pt-client @@ -0,0 +1,12 @@ +#!/bin/bash +set -e +CMDLINE="${@:?need a meek-client command line}" +TRANSPORTS=meek +# This could be controlled by a command-line arg. +PORT=10000 +TOR_PT_MANAGED_TRANSPORT_VER=1 \ + TOR_PT_CLIENT_TRANSPORTS="$TRANSPORTS" $CMDLINE \ + | sed -n -u -e '/^CMETHOD /{s/^.*127\.0\.0\.1://;p}' | while read pt_port; do + echo "forwarding port $PORT -> $pt_port" + socat -v -v TCP-LISTEN:$PORT,fork,reuseaddr TCP-CONNECT:127.0.0.1:$pt_port & +done

1 0

[bridgedb/develop] Modify scripts/test-moat to also test production through a meek tunnel.
by isis＠torproject.org 23 Jan '18

23 Jan '18

commit 247d425ed8526eb9b0319e644c340deb3faa49e4 Author: Isis Lovecruft <isis(a)torproject.org> Date: Tue Nov 28 02:03:07 2017 +0000 Modify scripts/test-moat to also test production through a meek tunnel. --- scripts/test-moat | 49 +++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 39 insertions(+), 10 deletions(-) diff --git a/scripts/test-moat b/scripts/test-moat index 13b835e..81999d8 100755 --- a/scripts/test-moat +++ b/scripts/test-moat @@ -1,7 +1,32 @@ #!/usr/bin/env bash +# +# To test a local moat server, simply do: +# +# test-moat fetch +# +# To test the production server, run the externalize-pt-client.sh script like so: +# +# ./externalize-pt-client.orig.sh /path/to/meek-client \ +# -url https://tor-bridges-hyphae-channel.appspot.com/ -front www.google.com +# +# and then call this script with: +# +# TEST_PRODUCTION_MOAT=1 test-moat fetch + +set -ex CHALLENGE= SOLUTION= +METHOD=http +URL_PREFIX=/meek/moat + +if test -n "$TEST_PRODUCTION_MOAT" ; then + METHOD=https + SERVER=bridges.torproject.org + PORT=443 + URL_PREFIX=/moat + PROXY='--proxy socks4a://127.0.0.1:10000/' +fi function usage() { printf "Usage: %s [fetch] [check [challenge solution]]\n" "$(basename $0)" @@ -13,20 +38,24 @@ if test "$#" -lt 1 ; then fi function do_fetch() { - curl -H 'Content-Type: application/vnd.api+json' \ - -H 'Accept: application/vnd.api+json' \ - -H 'X-Forwarded-For: 1.2.3.4' \ - --data '{"data": [{"supported": ["obfs4"], "version": "0.1.0", "type": "client-transports"}]}' \ - http://127.0.0.1:6790/meek/moat/fetch + curl \ + ${PROXY} \ + -H 'Content-Type: application/vnd.api+json' \ + -H 'Accept: application/vnd.api+json' \ + -H 'X-Forwarded-For: 1.2.3.4' \ + --data '{"data": [{"supported": ["obfs4"], "version": "0.1.0", "type": "client-transports"}]}' \ + $METHOD://${SERVER:=127.0.0.1}:${PORT:=6790}$URL_PREFIX/fetch echo } function do_check() { - curl -H 'Content-Type: application/vnd.api+json' \ - -H 'Accept: application/vnd.api+json' \ - -H 'X-Forwarded-For: 1.2.3.4' \ - --data '{"data": [{"challenge": "'$CHALLENGE'", "solution": "'$SOLUTION'", "version": "0.1.0", "qrcode": "false", "type": "moat-solution", "id": 2, "transport": "obfs4"}]}' \ - http://127.0.0.1:6790/meek/moat/check + curl \ + ${PROXY} \ + -H 'Content-Type: application/vnd.api+json' \ + -H 'Accept: application/vnd.api+json' \ + -H 'X-Forwarded-For: 1.2.3.4' \ + --data '{"data": [{"challenge": "'${CHALLENGE:=foo}'", "solution": "'${SOLUTION:=bar}'", "version": "0.1.0", "qrcode": "false", "type": "moat-solution", "id": 2, "transport": "obfs4"}]}' \ + $METHOD://${SERVER:=127.0.0.1}:${PORT:=6790}$URL_PREFIX/check echo }

1 0

[bridgedb/develop] Add more unittests for legacy code in Bridges.py.
by isis＠torproject.org 23 Jan '18

23 Jan '18

commit 8aedf0b81874d828c85470a5ef36dbce8324d291 Author: Isis Lovecruft <isis(a)torproject.org> Date: Fri Dec 22 03:18:06 2017 +0000 Add more unittests for legacy code in Bridges.py. --- bridgedb/test/test_Bridges.py | 95 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 93 insertions(+), 2 deletions(-) diff --git a/bridgedb/test/test_Bridges.py b/bridgedb/test/test_Bridges.py index 092b033..5991952 100644 --- a/bridgedb/test/test_Bridges.py +++ b/bridgedb/test/test_Bridges.py @@ -14,6 +14,7 @@ from __future__ import print_function import copy +import io import ipaddr import logging @@ -23,9 +24,9 @@ from bridgedb import Bridges from bridgedb.test import util # For additional logger output for debugging, comment out the following: -#logging.disable(50) +logging.disable(50) # and then uncomment the following line: -Bridges.logging.getLogger().setLevel(10) +#Bridges.logging.getLogger().setLevel(10) class BridgeRingTests(unittest.TestCase): @@ -34,6 +35,11 @@ class BridgeRingTests(unittest.TestCase): def setUp(self): self.ring = Bridges.BridgeRing('fake-hmac-key') + def addRandomBridges(self): + bridges = copy.deepcopy(util.generateFakeBridges()) + + [self.ring.insert(bridge) for bridge in bridges] + def addBridgesFromSameSubnet(self): bridges = copy.deepcopy(util.generateFakeBridges()) subnet = "5.5.%d.%d" @@ -62,3 +68,88 @@ class BridgeRingTests(unittest.TestCase): # Since they're all in the same /16, we should only get one # bridge back: self.assertEqual(len(bridges), 1) + + def test_filterDistinctSubnets_random_bridges(self): + """Even after filtering, in a normal case we should get the amount of + bridges we asked for. However, we should always get at least one. + """ + self.addRandomBridges() + + chosen = self.ring.bridges.keys()[:3] + bridges = self.ring.filterDistinctSubnets(chosen) + + self.assertGreaterEqual(len(bridges), 1) + + def test_clear(self): + """Clear should get rid of all the inserted bridges.""" + self.addRandomBridges() + self.assertGreater(len(self.ring), 0) + self.ring.clear() + self.assertEqual(len(self.ring), 0) + + def test_getBridges_filterBySubnet(self): + """We should still get the number of bridges we asked for, even when + filtering by distinct subnets. + """ + self.addRandomBridges() + bridges = self.ring.getBridges('a' * Bridges.DIGEST_LEN, N=3, filterBySubnet=True) + self.assertEqual(len(bridges), 3) + + def test_dumpAssignments(self): + """This should dump the bridges to the file.""" + self.addRandomBridges() + + f = io.StringIO() + + self.ring.dumpAssignments(f) + + f.flush() + f.seek(0) + + data = f.read() + first = self.ring.bridges.values()[0].fingerprint + + # The first bridge's fingerprint should be within the data somewhere + self.assertIn(first, data) + + +class FixedBridgeSplitterTests(unittest.TestCase): + """Unittests for :class:`bridgedb.Bridges.FixedBridgeSplitter`.""" + + def setUp(self): + self.rings = [Bridges.BridgeRing('fake-hmac-key-1'), + Bridges.BridgeRing('fake-hmac-key-2')] + self.splitter = Bridges.FixedBridgeSplitter('fake-hmac-key', self.rings) + + def addRandomBridges(self): + bridges = copy.deepcopy(util.generateFakeBridges()) + + [self.splitter.insert(bridge) for bridge in bridges] + + def test_insert(self): + self.addRandomBridges() + self.assertGreater(len(self.splitter), 0) + + def test_clear(self): + """Clear should get rid of all the inserted bridges.""" + self.addRandomBridges() + self.assertGreater(len(self.splitter), 0) + self.splitter.clear() + self.assertEqual(len(self.splitter), 0) + + def test_dumpAssignments(self): + """This should dump the bridges to the file.""" + self.addRandomBridges() + + f = io.StringIO() + + self.splitter.dumpAssignments(f) + + f.flush() + f.seek(0) + + data = f.read() + first = self.splitter.rings[0].bridges.values()[0].fingerprint + + # The first bridge's fingerprint should be within the data somewhere + self.assertIn(first, data)

1 0