March 2018 - tor-commits - lists.torproject.org

[snowflake/master] Use ListenAndServe{TLS} rather than separate Listen and Serve.
by dcf＠torproject.org 14 Mar '18

14 Mar '18

commit 19b317e7814cc0cfaab8b20bc61c3663005c02dc Author: David Fifield <david(a)bamsoftware.com> Date: Mon Mar 12 13:34:57 2018 -0700 Use ListenAndServe{TLS} rather than separate Listen and Serve. This is a port of commit cea86c937dc278ba6b2100c238b1d5206bbae2f0 from meek. Its purpose is to remove the need to copy-paste parts of net/http.Server.ListenAndServeTLS. Here is a copy of the commit message from meek: The net/http package provides ListenAndServe and ListenAndServeTLS functions, but it doesn't provide a way to set up a listener without also entering an infinite serve loop. This matters for ListenAndServeTLS, which sets up a lot of magic behind the scenes for TLS and HTTP/2 support. Formerly, we had copy-pasted code from ListenAndServeTLS, but that code has only gotten more complicated in upstream net/http. The price we pay for this is that it's no longer possible for a server bindaddr to ask to listen on port 0 (i.e., a random ephemeral port). That's because we never get a change to find out what the listening address is, before entering the serve loop. What we gain is HTTP/2 support; formerly our copy-pasted code had the side effect of disabling HTTP/2, because it was copied from an older version and did things like config.NextProtos = []string{"http/1.1"} The new code calls http2.ConfigureServer first, but that's not what's providing HTTP/2 support. HTTP/2 support happens by default. The reason we call http2.ConfigureServer is because we need to set TLSConfig.GetCertificate, and http2.ConfigureServer is a convenient way to initialize TLSConfig in a way that is guaranteed to work with HTTP/2. --- server/server.go | 116 ++++++++++++++++++++++++++++--------------------------- 1 file changed, 60 insertions(+), 56 deletions(-) diff --git a/server/server.go b/server/server.go index 5ec3ff9..8fd703a 100644 --- a/server/server.go +++ b/server/server.go @@ -22,6 +22,7 @@ import ( "git.torproject.org/pluggable-transports/goptlib.git" "git.torproject.org/pluggable-transports/websocket.git/websocket" "golang.org/x/crypto/acme/autocert" + "golang.org/x/net/http2" ) const ptMethodName = "snowflake" @@ -171,64 +172,63 @@ func webSocketHandler(ws *websocket.WebSocket) { proxy(or, &conn) } -func listenTLS(network string, addr *net.TCPAddr, m *autocert.Manager) (net.Listener, error) { - // This is cribbed from the source of net/http.Server.ListenAndServeTLS. - // We have to separate the Listen and Serve parts because we need to - // report the listening address before entering Serve (which is an - // infinite loop). +func initServer(addr *net.TCPAddr, + getCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error), + listenAndServe func(*http.Server)) (*http.Server, error) { + // We're not capable of listening on port 0 (i.e., an ephemeral port + // unknown in advance). The reason is that while the net/http package + // exposes ListenAndServe and ListenAndServeTLS, those functions never + // return, so there's no opportunity to find out what the port number + // is, in between the Listen and Serve steps. // https://groups.google.com/d/msg/Golang-nuts/3F1VRCCENp8/3hcayZiwYM8J - config := &tls.Config{} - config.NextProtos = []string{"http/1.1"} - config.GetCertificate = m.GetCertificate + if addr.Port == 0 { + return nil, fmt.Errorf("cannot listen on port %d; configure a port using ServerTransportListenAddr", addr.Port) + } - conn, err := net.ListenTCP(network, addr) + var config websocket.Config + config.MaxMessageSize = maxMessageSize + server := &http.Server{ + Addr: addr.String(), + Handler: config.Handler(webSocketHandler), + ReadTimeout: requestTimeout, + } + // We need to override server.TLSConfig.GetCertificate--but first + // server.TLSConfig needs to be non-nil. If we just create our own new + // &tls.Config, it will lack the default settings that the net/http + // package sets up for things like HTTP/2. Therefore we first call + // http2.ConfigureServer for its side effect of initializing + // server.TLSConfig properly. An alternative would be to make a dummy + // net.Listener, call Serve on it, and let it return. + // https://github.com/golang/go/issues/16588#issuecomment-237386446 + err := http2.ConfigureServer(server, nil) if err != nil { - return nil, err + return server, err } + server.TLSConfig.GetCertificate = getCertificate - // Additionally disable SSLv3 because of the POODLE attack. - // http://googleonlinesecurity.blogspot.com/2014/10/this-poodle-bites-exploiti… - // https://code.google.com/p/go/source/detail?r=ad9e191a51946e43f1abac8b6a2fef… - config.MinVersion = tls.VersionTLS10 - - tlsListener := tls.NewListener(conn, config) - - return tlsListener, nil -} + go listenAndServe(server) -func startListener(network string, addr *net.TCPAddr) (net.Listener, error) { - ln, err := net.ListenTCP(network, addr) - if err != nil { - return nil, err - } - log.Printf("listening with plain HTTP on %s", ln.Addr()) - return startServer(ln) + return server, nil } -func startListenerTLS(network string, addr *net.TCPAddr, m *autocert.Manager) (net.Listener, error) { - ln, err := listenTLS(network, addr, m) - if err != nil { - return nil, err - } - log.Printf("listening with HTTPS on %s", ln.Addr()) - return startServer(ln) +func startServer(addr *net.TCPAddr) (*http.Server, error) { + return initServer(addr, nil, func(server *http.Server) { + log.Printf("listening with plain HTTP on %s", addr) + err := server.ListenAndServe() + if err != nil { + log.Printf("error in ListenAndServe: %s", err) + } + }) } -func startServer(ln net.Listener) (net.Listener, error) { - go func() { - defer ln.Close() - var config websocket.Config - config.MaxMessageSize = maxMessageSize - s := &http.Server{ - Handler: config.Handler(webSocketHandler), - ReadTimeout: requestTimeout, - } - err := s.Serve(ln) +func startServerTLS(addr *net.TCPAddr, getCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error)) (*http.Server, error) { + return initServer(addr, getCertificate, func(server *http.Server) { + log.Printf("listening with HTTPS on %s", addr) + err := server.ListenAndServeTLS("", "") if err != nil { - log.Printf("http.Serve: %s", err) + log.Printf("error in ListenAndServeTLS: %s", err) } - }() - return ln, nil + }) } func getCertificateCacheDir() (string, error) { @@ -303,7 +303,7 @@ func main() { // https://github.com/ietf-wg-acme/acme/blob/master/draft-ietf-acme-acme.md#ht… needHTTP01Listener := !disableTLS - listeners := make([]net.Listener, 0) + servers := make([]*http.Server, 0) for _, bindaddr := range ptInfo.Bindaddrs { if bindaddr.MethodName != ptMethodName { pt.SmethodError(bindaddr.MethodName, "no such method") @@ -320,32 +320,36 @@ func main() { pt.SmethodError(bindaddr.MethodName, "HTTP-01 ACME listener: "+err.Error()) continue } + server := &http.Server{ + Addr: addr.String(), + Handler: certManager.HTTPHandler(nil), + } go func() { - log.Fatal(http.Serve(lnHTTP01, certManager.HTTPHandler(nil))) + log.Fatal(server.Serve(lnHTTP01)) }() - listeners = append(listeners, lnHTTP01) + servers = append(servers, server) needHTTP01Listener = false } - var ln net.Listener + var server *http.Server args := pt.Args{} if disableTLS { args.Add("tls", "no") - ln, err = startListener("tcp", bindaddr.Addr) + server, err = startServer(bindaddr.Addr) } else { args.Add("tls", "yes") for _, hostname := range acmeHostnames { args.Add("hostname", hostname) } - ln, err = startListenerTLS("tcp", bindaddr.Addr, certManager) + server, err = startServerTLS(bindaddr.Addr, certManager.GetCertificate) } if err != nil { log.Printf("error opening listener: %s", err) pt.SmethodError(bindaddr.MethodName, err.Error()) continue } - pt.SmethodArgs(bindaddr.MethodName, ln.Addr(), args) - listeners = append(listeners, ln) + pt.SmethodArgs(bindaddr.MethodName, bindaddr.Addr, args) + servers = append(servers, server) } pt.SmethodsDone() @@ -366,8 +370,8 @@ func main() { // signal received, shut down log.Printf("caught signal %q, exiting", sig) - for _, ln := range listeners { - ln.Close() + for _, server := range servers { + server.Close() } for n := range handlerChan { numHandlers += n

1 0

[snowflake/master] Wait briefly after calling ListenAndServe{TLS} to see if it errors.
by dcf＠torproject.org 14 Mar '18

14 Mar '18

commit ea7b9c02231cc03f1f0a879528310a93681b80ff Author: David Fifield <david(a)bamsoftware.com> Date: Mon Mar 12 14:21:11 2018 -0700 Wait briefly after calling ListenAndServe{TLS} to see if it errors. This is a port of commit e3f3054f8b74caa639a6d9be09702693af9a70e7 from meek. In the previous commit, we changed from separate Listen and Serve steps to always calling ListenAndServe. However, we would really like to immediately get feedback if any errors happen in the Listen step inside the call, because it's much better for debugging if those errors get reported to tor through SMETHOD-ERROR--rather than reporting success to tor and actually logging an error only in the snowflake log. So we wait 100 ms for an error to occur before deciding that the Listen succeeded. We don't need to apply this hack to the ACME HTTP-01 listener, because it's a plaintext listener. Unlike in the TLS case, there isn't any internal magic that the net library does that we have to rely on. We just call net.ListenTCP and check for an error. --- server/server.go | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) diff --git a/server/server.go b/server/server.go index 8fd703a..0136fc0 100644 --- a/server/server.go +++ b/server/server.go @@ -30,6 +30,10 @@ const requestTimeout = 10 * time.Second const maxMessageSize = 64 * 1024 +// How long to wait for ListenAndServe or ListenAndServeTLS to return an error +// before deciding that it's not going to return. +const listenAndServeErrorTimeout = 100 * time.Millisecond + var ptInfo pt.ServerInfo // When a connection handler starts, +1 is written to this channel; when it @@ -174,7 +178,7 @@ func webSocketHandler(ws *websocket.WebSocket) { func initServer(addr *net.TCPAddr, getCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error), - listenAndServe func(*http.Server)) (*http.Server, error) { + listenAndServe func(*http.Server, chan<- error)) (*http.Server, error) { // We're not capable of listening on port 0 (i.e., an ephemeral port // unknown in advance). The reason is that while the net/http package // exposes ListenAndServe and ListenAndServeTLS, those functions never @@ -206,28 +210,44 @@ func initServer(addr *net.TCPAddr, } server.TLSConfig.GetCertificate = getCertificate - go listenAndServe(server) + // Another unfortunate effect of the inseparable net/http ListenAndServe + // is that we can't check for Listen errors like "permission denied" and + // "address already in use" without potentially entering the infinite + // loop of Serve. The hack we apply here is to wait a short time, + // listenAndServeErrorTimeout, to see if an error is returned (because + // it's better if the error message goes to the tor log through + // SMETHOD-ERROR than if it only goes to the snowflake log). + errChan := make(chan error) + go listenAndServe(server, errChan) + select { + case err = <-errChan: + break + case <-time.After(listenAndServeErrorTimeout): + break + } - return server, nil + return server, err } func startServer(addr *net.TCPAddr) (*http.Server, error) { - return initServer(addr, nil, func(server *http.Server) { + return initServer(addr, nil, func(server *http.Server, errChan chan<- error) { log.Printf("listening with plain HTTP on %s", addr) err := server.ListenAndServe() if err != nil { log.Printf("error in ListenAndServe: %s", err) } + errChan <- err }) } func startServerTLS(addr *net.TCPAddr, getCertificate func(*tls.ClientHelloInfo) (*tls.Certificate, error)) (*http.Server, error) { - return initServer(addr, getCertificate, func(server *http.Server) { + return initServer(addr, getCertificate, func(server *http.Server, errChan chan<- error) { log.Printf("listening with HTTPS on %s", addr) err := server.ListenAndServeTLS("", "") if err != nil { log.Printf("error in ListenAndServeTLS: %s", err) } + errChan <- err }) }

1 0

[tor/master] DisableNetwork documentation improvised
by nickm＠torproject.org 13 Mar '18

13 Mar '18

commit 42008ee72180752dc442ccd69b568e786f9a9bb8 Author: ArunaMaurya221B <aruna.maurya12(a)gmail.com> Date: Mon Feb 12 15:09:00 2018 +0530 DisableNetwork documentation improvised --- doc/tor.1.txt | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index bc04ed6ed..3ebddf9b3 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -311,7 +311,9 @@ GENERAL OPTIONS other than controller connections, and we close (and don't reattempt) any outbound connections. Controllers sometimes use this option to avoid using - the network until Tor is fully configured. (Default: 0) + the network until Tor is fully configured. Tor will make still certain + network-related calls (like DNS lookups) as a part of its configuration + process, even if DisableNetwork is set. (Default: 0) [[ConstrainedSockets]] **ConstrainedSockets** **0**|**1**:: If set, Tor will tell the kernel to attempt to shrink the buffers for all

1 0

[tor/master] PaddingStatistics documented properly
by nickm＠torproject.org 13 Mar '18

13 Mar '18

commit c29e66a88345ec90d8a8cffbad94beabd0b364ad Author: ArunaMaurya221B <aruna.maurya12(a)gmail.com> Date: Sat Feb 10 19:40:05 2018 +0530 PaddingStatistics documented properly --- doc/tor.1.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 24b075785..7259149d9 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2257,8 +2257,8 @@ is non-zero): When this option is enabled, Tor collects statistics for padding cells sent and received by this relay, in addition to total cell counts. These statistics are rounded, and omitted if traffic is low. This - information is important for load balancing decisions related to padding. - (Default: 1) + information is important for load balancing decisions related to padding. If ExtraInfoStatistics is enabled, it will be published + as a part of extra-info document. (Default: 1) [[DirReqStatistics]] **DirReqStatistics** **0**|**1**:: Relays and bridges only.

1 0

[tor/master] Revised patch with 78 characters per line
by nickm＠torproject.org 13 Mar '18

13 Mar '18

commit a9203c65f11986dbed98c8f6b8d6ae9390db455f Author: ArunaMaurya221B <aruna.maurya12(a)gmail.com> Date: Wed Mar 7 19:13:22 2018 +0530 Revised patch with 78 characters per line --- doc/tor.1.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 7259149d9..bc04ed6ed 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -2257,7 +2257,8 @@ is non-zero): When this option is enabled, Tor collects statistics for padding cells sent and received by this relay, in addition to total cell counts. These statistics are rounded, and omitted if traffic is low. This - information is important for load balancing decisions related to padding. If ExtraInfoStatistics is enabled, it will be published + information is important for load balancing decisions related to padding. + If ExtraInfoStatistics is enabled, it will be published as a part of extra-info document. (Default: 1) [[DirReqStatistics]] **DirReqStatistics** **0**|**1**::

1 0

[tor/master] Merge remote-tracking branch 'teor/rust-std'
by nickm＠torproject.org 13 Mar '18

13 Mar '18

commit bebd5809f381d9ead529efeb28d62dac01f846a8 Merge: 03f748d0c 01a977b49 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 13 16:15:00 2018 -0400 Merge remote-tracking branch 'teor/rust-std' doc/HACKING/CodingStandardsRust.md | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)

1 0

[tor/master] Update the primitive types explanation in the Rust coding standards
by nickm＠torproject.org 13 Mar '18

13 Mar '18

commit 01a977b492327f39e7490e9ffbc5a27f15734dc9 Author: teor <teor2345(a)gmail.com> Date: Tue Feb 27 15:55:13 2018 +1100 Update the primitive types explanation in the Rust coding standards Part of #25368. Includes c_double in anticipation of #23061. --- doc/HACKING/CodingStandardsRust.md | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/doc/HACKING/CodingStandardsRust.md b/doc/HACKING/CodingStandardsRust.md index d0b17c160..731a7bb85 100644 --- a/doc/HACKING/CodingStandardsRust.md +++ b/doc/HACKING/CodingStandardsRust.md @@ -284,12 +284,26 @@ Here are some additional bits of advice and rules: } } -3. Pass only integer types and bytes over the boundary +3. Pass only C-compatible primitive types and bytes over the boundary - The only non-integer type which may cross the FFI boundary is + Rust's C-compatible primitive types are integers and floats. + These types are declared in the [libc crate](https://doc.rust-lang.org/libc/x86_64-unknown-linux-gnu/libc/index.h…. + Most Rust objects have different [representations](https://doc.rust-lang.org/libc/x86_64-unknown-linux-gnu/li… + in C and Rust, so they can't be passed using FFI. + + Tor currently uses the following Rust primitive types from libc for FFI: + * defined-size integers: `uint32_t` + * native-sized integers: `c_int` + * native-sized floats: `c_double` + * native-sized raw pointers: `* c_void`, `* c_char`, `** c_char` + + TODO: C smartlist to Stringlist conversion using FFI + + The only non-primitive type which may cross the FFI boundary is bytes, e.g. `&[u8]`. This SHOULD be done on the Rust side by - passing a pointer (`*mut libc::c_char`) and a length - (`libc::size_t`). + passing a pointer (`*mut libc::c_char`). The length can be passed + explicitly (`libc::size_t`), or the string can be NUL-byte terminated + C string. One might be tempted to do this via doing `CString::new("blah").unwrap().into_raw()`. This has several problems:

1 0

[snowflake/master] Use ResolveReference to construct the /client URL.
by arlo＠torproject.org 13 Mar '18

13 Mar '18

commit c61336c897b5d21cc94a21241e98b33df5dcbf78 Author: David Fifield <david(a)bamsoftware.com> Date: Mon Mar 12 20:28:01 2018 -0700 Use ResolveReference to construct the /client URL. This way works when the base URL lacks a path, e.g. "http://127.0.0.1:8080". https://bugs.torproject.org/25472 --- client/rendezvous.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/client/rendezvous.go b/client/rendezvous.go index 0aed3f7..cab7f5a 100644 --- a/client/rendezvous.go +++ b/client/rendezvous.go @@ -80,7 +80,8 @@ func (bc *BrokerChannel) Negotiate(offer *webrtc.SessionDescription) ( bc.Host, "\nFront URL: ", bc.url.Host) data := bytes.NewReader([]byte(offer.Serialize())) // Suffix with broker's client registration handler. - request, err := http.NewRequest("POST", bc.url.String()+"client", data) + clientURL := bc.url.ResolveReference(&url.URL{Path: "client"}) + request, err := http.NewRequest("POST", clientURL.String(), data) if nil != err { return nil, err }

1 0

[snowflake/master] Provide a flag to Log to state dir
by arlo＠torproject.org 13 Mar '18

13 Mar '18

commit 8a31312ca11f75eeb070ba30e25ba2096418e941 Author: Arlo Breault <arlolra(a)gmail.com> Date: Thu Mar 8 16:05:33 2018 -0500 Provide a flag to Log to state dir --- client/snowflake.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/client/snowflake.go b/client/snowflake.go index b958a7f..3b8a248 100644 --- a/client/snowflake.go +++ b/client/snowflake.go @@ -10,6 +10,7 @@ import ( "net" "os" "os/signal" + "path/filepath" "strings" "sync" "syscall" @@ -126,13 +127,22 @@ func main() { brokerURL := flag.String("url", "", "URL of signaling broker") frontDomain := flag.String("front", "", "front domain") logFilename := flag.String("log", "", "name of log file") + logToStateDir := flag.Bool("logToStateDir", false, "resolve the log file relative to tor's pt state dir") max := flag.Int("max", DefaultSnowflakeCapacity, "capacity for number of multiplexed WebRTC peers") flag.Parse() webrtc.SetLoggingVerbosity(1) log.SetFlags(log.LstdFlags | log.LUTC) + if *logFilename != "" { + if *logToStateDir { + stateDir, err := pt.MakeStateDir() + if err != nil { + log.Fatal(err) + } + *logFilename = filepath.Join(stateDir, *logFilename) + } logFile, err := os.OpenFile(*logFilename, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0600) if err != nil {

1 0

[translation/tails-misc_completed] Update translations for tails-misc_completed
by translation＠torproject.org 13 Mar '18

13 Mar '18

commit 3ddb546fbe7568afc6da14dfb7b66cb9075b7080 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Mar 13 18:46:47 2018 +0000 Update translations for tails-misc_completed --- es.po | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/es.po b/es.po index 1529337a2..ff1e898e4 100644 --- a/es.po +++ b/es.po @@ -16,8 +16,8 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2018-03-12 19:03+0100\n" -"PO-Revision-Date: 2018-03-13 09:11+0000\n" -"Last-Translator: strel\n" +"PO-Revision-Date: 2018-03-13 18:29+0000\n" +"Last-Translator: Emma Peel\n" "Language-Team: Spanish (http://www.transifex.com/otf/torproject/language/es/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -204,7 +204,7 @@ msgstr "Falló el MAC spoofing para la tarjeta de red ${nic_name} (${nic}). La r #: config/chroot_local-includes/usr/local/bin/tails-screen-locker:109 msgid "Lock Screen" -msgstr "Pantalla de bloqueo" +msgstr "Bloquear pantalla" #: config/chroot_local-includes/usr/local/bin/tails-screen-locker:118 #: config/chroot_local-includes/usr/local/bin/tor-browser:46 @@ -217,7 +217,7 @@ msgstr "Bloqueo de pantalla" #: config/chroot_local-includes/usr/local/bin/tails-screen-locker:130 msgid "Set up a password to unlock the screen." -msgstr "Establezca una contraseña para desbloquear la pantalla." +msgstr "Establece una contraseña para desbloquear la pantalla" #: config/chroot_local-includes/usr/local/bin/tails-screen-locker:135 msgid "Password"

1 0