February 2018 - tor-commits - lists.torproject.org

[translation/tor-launcher-properties] Update translations for tor-launcher-properties
by translation＠torproject.org 13 Feb '18

13 Feb '18

commit 40eae40ddf55781a517362f9c743a010fd8e5012 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Feb 13 20:46:39 2018 +0000 Update translations for tor-launcher-properties --- fr/torlauncher.properties | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fr/torlauncher.properties b/fr/torlauncher.properties index 066dd152f..b3632ec72 100644 --- a/fr/torlauncher.properties +++ b/fr/torlauncher.properties @@ -10,7 +10,7 @@ torlauncher.tor_controlconn_failed=Impossible de se connecter au port de contrô torlauncher.tor_failed_to_start=Tor n’a pas pu démarrer. torlauncher.tor_control_failed=La prise de contrôle de Tor a échoué. torlauncher.tor_bootstrap_failed=Échec lors de la connexion de Tor au réseau Tor. -torlauncher.tor_bootstrap_failed_details=%1$S a échoué (%2$S). +torlauncher.tor_bootstrap_failed_details=L’étape %1$S a échoué (%2$S). torlauncher.unable_to_start_tor=Impossible de démarrer Tor.\n\n%S torlauncher.tor_missing=Il manque l’exécutable Tor. @@ -40,7 +40,7 @@ torlauncher.done=Terminé torlauncher.forAssistance=Pour de l’assistance, contacter %S torlauncher.forAssistance2=Pour de l’assistance, visiter %S -torlauncher.copiedNLogMessages=La copie est terminée. %S messages de journalisation de Tor sont prêts à être coller dans un éditeur de texte ou un courriel. +torlauncher.copiedNLogMessages=La copie est terminée. %S messages de journalisation de Tor sont prêts à être collés dans un éditeur de texte ou un courriel. torlauncher.bootstrapStatus.conn_dir=Connexion à un annuaire de relais torlauncher.bootstrapStatus.handshake_dir=Mise en place d’une connexion chiffrée à l’annuaire

1 0

[translation/tails-persistence-setup] Update translations for tails-persistence-setup
by translation＠torproject.org 13 Feb '18

13 Feb '18

commit ba998a9853bdcdd60b25f12bd9d4f79c9b7aa666 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Feb 13 20:46:05 2018 +0000 Update translations for tails-persistence-setup --- az/az.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/az/az.po b/az/az.po index 783b705b1..0cc77bb56 100644 --- a/az/az.po +++ b/az/az.po @@ -9,7 +9,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: Tails developers <tails(a)boum.org>\n" "POT-Creation-Date: 2017-05-15 13:51+0200\n" -"PO-Revision-Date: 2017-12-11 17:28+0000\n" +"PO-Revision-Date: 2018-02-13 20:30+0000\n" "Last-Translator: carolyn <carolyn(a)anhalt.org>\n" "Language-Team: Azerbaijani (http://www.transifex.com/otf/torproject/language/az/)\n" "MIME-Version: 1.0\n"

1 0

[translation/liveusb-creator] Update translations for liveusb-creator
by translation＠torproject.org 13 Feb '18

13 Feb '18

commit 38bc8e3d1b5c84280c9983d93cd8af3052318527 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Feb 13 20:45:52 2018 +0000 Update translations for liveusb-creator --- az/az.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/az/az.po b/az/az.po index b46666dbf..3cad3e4ed 100644 --- a/az/az.po +++ b/az/az.po @@ -11,7 +11,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2017-11-10 15:57+0100\n" -"PO-Revision-Date: 2017-11-11 03:09+0000\n" +"PO-Revision-Date: 2018-02-13 20:32+0000\n" "Last-Translator: carolyn <carolyn(a)anhalt.org>\n" "Language-Team: Azerbaijani (http://www.transifex.com/otf/torproject/language/az/)\n" "MIME-Version: 1.0\n" @@ -314,7 +314,7 @@ msgstr "" #: ../tails_installer/gui.py:456 msgid "Upgrade" -msgstr "" +msgstr "Yenilə" #: ../tails_installer/gui.py:462 ../data/tails-installer.ui.h:7 msgid "Install"

1 0

[translation/bridgedb_completed] Update translations for bridgedb_completed
by translation＠torproject.org 13 Feb '18

13 Feb '18

commit 00795a3556563d1d3ddb03fa5a48b61e0f57bbbe Author: Translation commit bot <translation(a)torproject.org> Date: Tue Feb 13 20:15:11 2018 +0000 Update translations for bridgedb_completed --- fr/LC_MESSAGES/bridgedb.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fr/LC_MESSAGES/bridgedb.po b/fr/LC_MESSAGES/bridgedb.po index e46fe589c..b55d32fa8 100644 --- a/fr/LC_MESSAGES/bridgedb.po +++ b/fr/LC_MESSAGES/bridgedb.po @@ -29,7 +29,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: 'https://trac.torproject.org/projects/tor/newticket?component=BridgeDB&keywo…'\n" "POT-Creation-Date: 2015-07-25 03:40+0000\n" -"PO-Revision-Date: 2018-02-13 19:43+0000\n" +"PO-Revision-Date: 2018-02-13 19:50+0000\n" "Last-Translator: French language coordinator <french.coordinator(a)rbox.me>\n" "Language-Team: French (http://www.transifex.com/otf/torproject/language/fr/)\n" "MIME-Version: 1.0\n" @@ -328,7 +328,7 @@ msgstr "Avez-vous besoin d’adresses IPv6 ?" #: bridgedb/strings.py:135 #, python-format msgid "Do you need a %s?" -msgstr "Avez-vous besoin d’un %s ?" +msgstr "Avez-vous besoin d’un transport enfichable (%s) ?" #: bridgedb/strings.py:139 msgid "Your browser is not displaying images properly."

1 0

[translation/bridgedb] Update translations for bridgedb
by translation＠torproject.org 13 Feb '18

13 Feb '18

commit c698fc673f942512952b62d75d7dfe1f78721784 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Feb 13 20:15:05 2018 +0000 Update translations for bridgedb --- fr/LC_MESSAGES/bridgedb.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fr/LC_MESSAGES/bridgedb.po b/fr/LC_MESSAGES/bridgedb.po index e46fe589c..b55d32fa8 100644 --- a/fr/LC_MESSAGES/bridgedb.po +++ b/fr/LC_MESSAGES/bridgedb.po @@ -29,7 +29,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: 'https://trac.torproject.org/projects/tor/newticket?component=BridgeDB&keywo…'\n" "POT-Creation-Date: 2015-07-25 03:40+0000\n" -"PO-Revision-Date: 2018-02-13 19:43+0000\n" +"PO-Revision-Date: 2018-02-13 19:50+0000\n" "Last-Translator: French language coordinator <french.coordinator(a)rbox.me>\n" "Language-Team: French (http://www.transifex.com/otf/torproject/language/fr/)\n" "MIME-Version: 1.0\n" @@ -328,7 +328,7 @@ msgstr "Avez-vous besoin d’adresses IPv6 ?" #: bridgedb/strings.py:135 #, python-format msgid "Do you need a %s?" -msgstr "Avez-vous besoin d’un %s ?" +msgstr "Avez-vous besoin d’un transport enfichable (%s) ?" #: bridgedb/strings.py:139 msgid "Your browser is not displaying images properly."

1 0

[tor/master] dos: Don't set consensus param if we aren't a public relay
by nickm＠torproject.org 13 Feb '18

13 Feb '18

commit 4fe4f8179fe81244319c7fdec64299b6506434a2 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Feb 13 10:29:41 2018 -0500 dos: Don't set consensus param if we aren't a public relay We had this safeguard around dos_init() but not when the consensus changes which can modify consensus parameters and possibly enable the DoS mitigation even if tor wasn't a public relay. Fixes #25223 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/bug25223 | 3 +++ src/or/dos.c | 8 ++++++++ 2 files changed, 11 insertions(+) diff --git a/changes/bug25223 b/changes/bug25223 new file mode 100644 index 000000000..2a7eb6b25 --- /dev/null +++ b/changes/bug25223 @@ -0,0 +1,3 @@ + o Minor bugfixes (DoS mitigation): + - Make sure we don't modify consensus parameters if we aren't a public + relay when a new consensus arrives. Fixes bug 25223. diff --git a/src/or/dos.c b/src/or/dos.c index 9e8a7a9ab..bfa415e7b 100644 --- a/src/or/dos.c +++ b/src/or/dos.c @@ -738,6 +738,14 @@ dos_close_client_conn(const or_connection_t *or_conn) void dos_consensus_has_changed(const networkstatus_t *ns) { + /* There are two ways to configure this subsystem, one at startup through + * dos_init() which is called when the options are parsed. And this one + * through the consensus. We don't want to enable any DoS mitigation if we + * aren't a public relay. */ + if (!public_server_mode(get_options())) { + return; + } + cc_consensus_has_changed(ns); conn_consensus_has_changed(ns);

1 0

[tor/master] dos: Add extra safety asserts in cc_stats_refill_bucket()
by nickm＠torproject.org 13 Feb '18

13 Feb '18

commit 305e39d0f8bcc39d45c2877495046bd927347106 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Feb 13 10:41:21 2018 -0500 dos: Add extra safety asserts in cc_stats_refill_bucket() Never allow the function to set a bucket value above the allowed circuit burst. Closes #25202 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket25202 | 4 ++++ src/or/dos.c | 10 ++++++++++ 2 files changed, 14 insertions(+) diff --git a/changes/ticket25202 b/changes/ticket25202 new file mode 100644 index 000000000..5edef44f0 --- /dev/null +++ b/changes/ticket25202 @@ -0,0 +1,4 @@ + o Minor bugfixes (DoS mitigation): + - Add extra safety checks when refilling the circuit creation bucket to + ensure we never set a value that is above the allowed burst. Fixes + ticket 25202. diff --git a/src/or/dos.c b/src/or/dos.c index 9e8a7a9ab..e7f3241ef 100644 --- a/src/or/dos.c +++ b/src/or/dos.c @@ -309,6 +309,16 @@ cc_stats_refill_bucket(cc_client_stats_t *stats, const tor_addr_t *addr) new_circuit_bucket_count = MIN(stats->circuit_bucket + (uint32_t)num_token, dos_cc_circuit_burst); } + + /* This function is not allowed to make the bucket count larger than the + * burst value */ + tor_assert_nonfatal(new_circuit_bucket_count <= dos_cc_circuit_burst); + /* This function is not allowed to make the bucket count smaller, unless it + * is decreasing it to a newly configured, lower burst value. We allow the + * bucket to stay the same size, in case the circuit rate is zero. */ + tor_assert_nonfatal(new_circuit_bucket_count >= stats->circuit_bucket || + new_circuit_bucket_count == dos_cc_circuit_burst); + log_debug(LD_DOS, "DoS address %s has its circuit bucket value: %" PRIu32 ". Filling it to %" PRIu32 ". Circuit rate is %" PRIu64 ". Elapsed time is %" PRIi64,

1 0

[tor/master] Merge remote-tracking branch 'dgoulet/bug25223_029_01' into ticket24902_029_05
by nickm＠torproject.org 13 Feb '18

13 Feb '18

commit b60ffc5ce0fc9dfd4c2fbb238e32143c64fadbda Merge: 305e39d0f 4fe4f8179 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Feb 13 13:11:10 2018 -0500 Merge remote-tracking branch 'dgoulet/bug25223_029_01' into ticket24902_029_05 changes/bug25223 | 3 +++ src/or/dos.c | 8 ++++++++ 2 files changed, 11 insertions(+)

1 0

[tor/master] man: Document default values if not in the consensus for DoS mitigation
by nickm＠torproject.org 13 Feb '18

13 Feb '18

commit 9cf8d669fa416c151f60cb795555b6ef2ab53ecf Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Feb 13 10:53:47 2018 -0500 man: Document default values if not in the consensus for DoS mitigation Fixes #25236 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- doc/tor.1.txt | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 58997cdf3..a7ee7d11c 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2454,7 +2454,7 @@ Denial of Service mitigation subsystem. address is positively identified, tor will activate defenses against the address. See the DoSCircuitCreationDefenseType option for more details. This is a client to relay detection only. "auto" means use the consensus - parameter. + parameter. If not defined in the consensus, the value is 0. (Default: auto) [[DoSCircuitCreationMinConnections]] **DoSCircuitCreationMinConnections** __NUM__:: @@ -2463,19 +2463,22 @@ Denial of Service mitigation subsystem. flagged as executing a circuit creation DoS. In other words, once a client address reaches the circuit rate and has a minimum of NUM concurrent connections, a detection is positive. "0" means use the consensus - parameter. + parameter. If not defined in the consensus, the value is 3. (Default: 0) [[DoSCircuitCreationRate]] **DoSCircuitCreationRate** __NUM__:: The allowed circuit creation rate per second applied per client IP - address. If this option is 0, it obeys a consensus parameter. (Default: 0) + address. If this option is 0, it obeys a consensus parameter. If not + defined in the consensus, the value is 3. + (Default: 0) [[DoSCircuitCreationBurst]] **DoSCircuitCreationBurst** __NUM__:: The allowed circuit creation burst per client IP address. If the circuit rate and the burst are reached, a client is marked as executing a circuit - creation DoS. "0" means use the consensus parameter. + creation DoS. "0" means use the consensus parameter. If not defined in the + consensus, the value is 90. (Default: 0) [[DoSCircuitCreationDefenseType]] **DoSCircuitCreationDefenseType** __NUM__:: @@ -2486,28 +2489,31 @@ Denial of Service mitigation subsystem. 1: No defense. 2: Refuse circuit creation for the DoSCircuitCreationDefenseTimePeriod period of time. + - "0" means use the consensus parameter. + "0" means use the consensus parameter. If not defined in the consensus, + the value is 2. (Default: 0) -[[DoSCircuitCreationDefenseTimePeriod]] **DoSCircuitCreationDefenseTimePeriod** __NUM__:: +[[DoSCircuitCreationDefenseTimePeriod]] **DoSCircuitCreationDefenseTimePeriod** __N__ **seconds**|**minutes**|**hours**:: - The base time period that the DoS defense is activated for. The actual - value is selected randomly for each activation from NUM+1 to 3/2 * NUM. - "0" means use the consensus parameter. - (Default: 0) + The base time period in seconds that the DoS defense is activated for. The + actual value is selected randomly for each activation from N+1 to 3/2 * N. + "0" means use the consensus parameter. If not defined in the consensus, + the value is 3600 seconds (1 hour). (Default: 0) [[DoSConnectionEnabled]] **DoSConnectionEnabled** **0**|**1**|**auto**:: Enable the connection DoS mitigation. For client address only, this allows tor to mitigate against large number of concurrent connections made by a - single IP address. "auto" means use the consensus parameter. + single IP address. "auto" means use the consensus parameter. If not + defined in the consensus, the value is 0. (Default: auto) [[DoSConnectionMaxConcurrentCount]] **DoSConnectionMaxConcurrentCount** __NUM__:: The maximum threshold of concurrent connection from a client IP address. Above this limit, a defense selected by DoSConnectionDefenseType is - applied. "0" means use the consensus parameter. + applied. "0" means use the consensus parameter. If not defined in the + consensus, the value is 100. (Default: 0) [[DoSConnectionDefenseType]] **DoSConnectionDefenseType** __NUM__:: @@ -2518,7 +2524,8 @@ Denial of Service mitigation subsystem. 1: No defense. 2: Immediately close new connections. + - "0" means use the consensus parameter. + "0" means use the consensus parameter. If not defined in the consensus, + the value is 2. (Default: 0) [[DoSRefuseSingleHopClientRendezvous]] **DoSRefuseSingleHopClientRendezvous** **0**|**1**|**auto**:: @@ -2526,7 +2533,7 @@ Denial of Service mitigation subsystem. Refuse establishment of rendezvous points for single hop clients. In other words, if a client directly connects to the relay and sends an ESTABLISH_RENDEZVOUS cell, it is silently dropped. "auto" means use the - consensus parameter. + consensus parameter. If not defined in the consensus, the value is 0. (Default: auto) TESTING NETWORK OPTIONS

1 0

[tor/master] Make check-changes happy
by nickm＠torproject.org 13 Feb '18

13 Feb '18

commit e7f631478254c38d6d8b1bea65840b4c6429e4f4 Author: David Goulet <dgoulet(a)torproject.org> Date: Tue Feb 13 14:56:31 2018 -0500 Make check-changes happy Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/bug25223 | 3 ++- changes/ticket25202 | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/changes/bug25223 b/changes/bug25223 index 2a7eb6b25..fdd556350 100644 --- a/changes/bug25223 +++ b/changes/bug25223 @@ -1,3 +1,4 @@ o Minor bugfixes (DoS mitigation): - Make sure we don't modify consensus parameters if we aren't a public - relay when a new consensus arrives. Fixes bug 25223. + relay when a new consensus arrives. Fixes bug 25223; bugfix on + 0.3.3.2-alpha. diff --git a/changes/ticket25202 b/changes/ticket25202 index 5edef44f0..ba64abad7 100644 --- a/changes/ticket25202 +++ b/changes/ticket25202 @@ -1,4 +1,4 @@ o Minor bugfixes (DoS mitigation): - Add extra safety checks when refilling the circuit creation bucket to ensure we never set a value that is above the allowed burst. Fixes - ticket 25202. + bug 25202; bugfix on 0.3.3.2-alpha.

1 0