April 2018 - tor-commits - lists.torproject.org

[tor/release-0.3.3] Merge branch 'maint-0.3.3' into release-0.3.3
by nickm＠torproject.org 15 Apr '18

15 Apr '18

commit d17ddb8393b206748d19e3717f41146dbdd245d9 Merge: 81d71f0d4 3ee4c9b1f Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Apr 15 15:41:24 2018 -0400 Merge branch 'maint-0.3.3' into release-0.3.3 configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)

1 0

[webwml/master] website: bump to 0.3.3.5-rc
by nickm＠torproject.org 15 Apr '18

15 Apr '18

commit 82bf1c1d2816ed5e0d2c92481a0db0c4817da71d Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Apr 15 15:39:36 2018 -0400 website: bump to 0.3.3.5-rc --- Makefile | 2 +- include/versions.wmi | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 09f7d37f..e212fc0e 100644 --- a/Makefile +++ b/Makefile @@ -15,7 +15,7 @@ # website component, and set it to needs_review. export STABLETAG=tor-0.3.2.10 -export DEVTAG=tor-0.3.3.4-alpha +export DEVTAG=tor-0.3.3.5-rc WMLBASE=. SUBDIRS=docs eff projects press about download getinvolved donate docs/torbutton diff --git a/include/versions.wmi b/include/versions.wmi index ca422909..a4c56ebd 100644 --- a/include/versions.wmi +++ b/include/versions.wmi @@ -1,5 +1,5 @@ <define-tag version-stable whitespace=delete>0.3.2.10</define-tag> -<define-tag version-alpha whitespace=delete>0.3.3.4-alpha</define-tag> +<define-tag version-alpha whitespace=delete>0.3.3.5-rc</define-tag> <define-tag version-torbrowserdevelopbranch whitespace=delete>maint-7.5</define-tag>

1 0

[tor/release-0.3.3] Edit changelog for 0.3.3.5-rc
by nickm＠torproject.org 15 Apr '18

15 Apr '18

commit 420840434c322223ca93a29596477eeda101f091 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Apr 15 13:54:21 2018 -0400 Edit changelog for 0.3.3.5-rc --- ChangeLog | 101 +++++++++++++++++++++++++++++--------------------------------- 1 file changed, 47 insertions(+), 54 deletions(-) diff --git a/ChangeLog b/ChangeLog index ed8f6ed8c..9a1b3610b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,29 +1,25 @@ -o Major bugfixes (performance, load balancing): - -Changes in version 0.3.3.5-rc - 2018-04-14 - BLURB +Changes in version 0.3.3.5-rc - 2018-04-15 + Tor 0.3.3.5-rc fixes various bugs in earlier versions of Tor, + including some that could affect reliability or correctness. - - Directory authorities no longer vote in favor of the Guard flag for - relays that don't advertise directory support. Starting in Tor - 0.3.0.1-alpha, Tor clients have been avoiding using such relays in the - Guard position, leading to increasingly broken load balancing for the - 5%-or-so of Guards that don't advertise directory support. Fixes bug - 22310; bugfix on 0.3.0.6. + This is the first release candidate in the 0.3.3 series. If we find no + new bugs or regression here, then the first stable 0.3.3 release will + be nearly identical to this one. - o Major bugfixes (protover, voting): + o Major bugfixes (security, protover, voting): - Revise Rust implementation of protover to use a more memory- efficient voting algorithm and corresponding data structures, thus - avoiding a potential (but small impact) DoS attack where specially - crafted protocol strings would expand to several potential - megabytes in memory. In the process, several portions of code were - revised to be methods on new, custom types, rather than functions - taking interchangeable types, thus increasing type safety of the - module. Custom error types and handling were added as well, in - order to facilitate better error dismissal/handling in outside - crates and avoid mistakenly passing an internal error string to C - over the FFI boundary. Many tests were added, and some previous - differences between the C and Rust implementations have been - remedied. Fixes bug 24031; bugfix on 0.3.3.1-alpha. + avoiding a potential memory-based DoS attack where specially + crafted protocol strings would expand to fill available memory. + Fixes bug 24031; bugfix on 0.3.3.1-alpha. + + o Major bugfixes (performance, load balancing): + - Directory authorities no longer vote in favor of the Guard flag + for relays without directory support. Starting in Tor + 0.3.0.1-alpha, Tor clients have been avoiding using such relays in + the Guard position, leading to increasingly broken load balancing + for the 5%-or-so of Guards that don't advertise directory support. + Fixes bug 22310; bugfix on 0.3.0.6. o Minor feature (continuous integration): - Update the Travis CI configuration to use the stable Rust channel, @@ -31,43 +27,30 @@ Changes in version 0.3.3.5-rc - 2018-04-14 o Minor features (config options): - Change the way the default value for MaxMemInQueues is calculated. - We now use 0.4 * RAM if the system have 8 GB RAM or more, otherwise - we use the former value of 0.75 * RAM. Closes ticket 24782. + We now use 40% of the hardware RAM if the system has 8 GB RAM or + more. Otherwise we use the former value of 75%. Closes + ticket 24782. o Minor features (geoip): - Update geoip and geoip6 to the April 3 2018 Maxmind GeoLite2 Country database. Closes ticket 25718. - o Minor bugfix (Exit node DNS retries): - - Re-attempt timed-out DNS queries 3 times before failure, since our - timeout is 5 seconds for them, but clients wait 10-15. Also allow - slightly more timeouts per resolver before giving up on it in the - case where an exit has multiple resolvers configured. Fixes bug - 21394; bugfix on 0.3.1.9. - o Minor bugfixes (client): - When using a listed relay as a bridge, and also using microdescriptors, and considering that relay as a non-bridge in a - circuit, consider its microdescriptor as a valid source of - information about that relay. Fixes bug 25691; bugfix - on 0.3.3.4-alpha. - - o Minor bugfixes (compilation, rust): - - Build correctly when the rust dependencies submodule is loaded, - but the TOR_RUST_DEPENDENCIES environment variable is not set. - Fixes bug 25679; bugfix on 0.3.3.1-alpha. - - o Minor bugfixes (configuration): - - Remove undescores from the _HSLayer{2,3}Nodes options. This - expert-user configuration can now be enabled as HSLayer{2,3}Nodes. - Fixes bug 25581; bugfix on 0.3.3.1-alpha + circuit, treat its microdescriptor as a valid source of + information about that relay. This change should prevent a non- + fatal assertion error. Fixes bug 25691; bugfix on 0.3.3.4-alpha. o Minor bugfixes (controller): - Restore the correct operation of the RESOLVE command, which had been broken since we added the ability to enable/disable DNS on specific listener ports. Fixes bug 25617; bugfix on 0.2.9.3-alpha. - o Minor bugfixes (distribution, compilation): + o Minor bugfixes (distribution, compilation, rust): + - Build correctly when the rust dependencies submodule is loaded, + but the TOR_RUST_DEPENDENCIES environment variable is not set. + Fixes bug 25679; bugfix on 0.3.3.1-alpha. - Actually include all of our Rust source in our source distributions. (Previously, a few of the files were accidentally omitted.) Fixes bug 25732; bugfix on 0.3.3.2-alpha. @@ -80,19 +63,29 @@ Changes in version 0.3.3.5-rc - 2018-04-14 - Revert a misformatting issue in the ExitPolicy documentation. Fixes bug 25582; bugfix on 0.3.3.1-alpha. - o Minor bugfixes (hidden services): - - Re-instate counting pending client HSDir fetch circuits against - the MaxClientCircuitsPending rate limit. Fixes bug 24989; bugfix - on 0.3.3.0-alpha-dev. + o Minor bugfixes (Exit node DNS retries): + - Re-attempt timed-out DNS queries 3 times before failure, since our + timeout is 5 seconds for them, but clients wait 10-15. Also allow + slightly more timeouts per resolver before giving up on it in the + case where an exit has multiple resolvers configured. Fixes bug + 21394; bugfix on 0.3.1.9. + + o Minor bugfixes (onion services): + - Re-instate counting the client HSDir fetch circuits against the + MaxClientCircuitsPending rate limit. Fixes bug 24989; bugfix + on 0.3.3.1-alpha. + - Remove underscores from the _HSLayer{2,3}Nodes options. This + expert-user configuration can now be enabled as HSLayer{2,3}Nodes. + Fixes bug 25581; bugfix on 0.3.3.1-alpha o Code simplification and refactoring: - - Move the list of default directory authorities to their own file - for inclusion using the C preprocessor. Closes ticket 24854. Patch - by "beastr0". + - Move the list of default directory authorities to its own file. + Closes ticket 24854. Patch by "beastr0". o Documentation (manpage, denial of service): - - Better detail the denial of service options by listing the - different mitigation in place. Closes ticket 25248. + - Provide more detail about the denial-of-service options, by + listing each mitigation and explaining how they relate. Closes + ticket 25248. Changes in version 0.3.3.4-alpha - 2018-03-29

1 0

[tor/release-0.3.3] More small changelog edits
by nickm＠torproject.org 15 Apr '18

15 Apr '18

commit 81d71f0d41adf0d8beb0ef1f7f750f20636d5c50 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Apr 15 15:10:57 2018 -0400 More small changelog edits --- ChangeLog | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index 9a1b3610b..b4d58bd8a 100644 --- a/ChangeLog +++ b/ChangeLog @@ -16,9 +16,9 @@ Changes in version 0.3.3.5-rc - 2018-04-15 o Major bugfixes (performance, load balancing): - Directory authorities no longer vote in favor of the Guard flag for relays without directory support. Starting in Tor - 0.3.0.1-alpha, Tor clients have been avoiding using such relays in - the Guard position, leading to increasingly broken load balancing - for the 5%-or-so of Guards that don't advertise directory support. + 0.3.0.1-alpha, clients have been avoiding using such relays in the + Guard position, leading to increasingly broken load balancing for + the 5%-or-so of Guards that don't advertise directory support. Fixes bug 22310; bugfix on 0.3.0.6. o Minor feature (continuous integration): @@ -63,12 +63,11 @@ Changes in version 0.3.3.5-rc - 2018-04-15 - Revert a misformatting issue in the ExitPolicy documentation. Fixes bug 25582; bugfix on 0.3.3.1-alpha. - o Minor bugfixes (Exit node DNS retries): + o Minor bugfixes (exit node DNS retries): - Re-attempt timed-out DNS queries 3 times before failure, since our timeout is 5 seconds for them, but clients wait 10-15. Also allow - slightly more timeouts per resolver before giving up on it in the - case where an exit has multiple resolvers configured. Fixes bug - 21394; bugfix on 0.3.1.9. + slightly more timeouts per resolver when an exit has multiple + resolvers configured. Fixes bug 21394; bugfix on 0.3.1.9. o Minor bugfixes (onion services): - Re-instate counting the client HSDir fetch circuits against the

1 0

[translation/tails-misc] Update translations for tails-misc
by translation＠torproject.org 15 Apr '18

15 Apr '18

commit 660a1c8fdf2a9baa83c1c2d831891d3efd3368ef Author: Translation commit bot <translation(a)torproject.org> Date: Sun Apr 15 16:46:40 2018 +0000 Update translations for tails-misc --- ta.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ta.po b/ta.po index 3e89702ed..c5c0eed3f 100644 --- a/ta.po +++ b/ta.po @@ -10,8 +10,8 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2018-03-12 19:03+0100\n" -"PO-Revision-Date: 2018-04-12 19:07+0000\n" -"Last-Translator: Sivarajah Bagerathan <bagerathan(a)gmail.com>\n" +"PO-Revision-Date: 2018-04-15 16:40+0000\n" +"Last-Translator: Bala Subramaniyan <balapandu222(a)hotmail.com>\n" "Language-Team: Tamil (http://www.transifex.com/otf/torproject/language/ta/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n"

1 0

[translation/bridgedb_completed] Update translations for bridgedb_completed
by translation＠torproject.org 15 Apr '18

15 Apr '18

commit 29d82679ed54ab0c106282ef97e496baf176d9ce Author: Translation commit bot <translation(a)torproject.org> Date: Sun Apr 15 06:15:13 2018 +0000 Update translations for bridgedb_completed --- hy/LC_MESSAGES/bridgedb.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hy/LC_MESSAGES/bridgedb.po b/hy/LC_MESSAGES/bridgedb.po index 697f20b6e..7bb8e81d6 100644 --- a/hy/LC_MESSAGES/bridgedb.po +++ b/hy/LC_MESSAGES/bridgedb.po @@ -11,7 +11,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: 'https://trac.torproject.org/projects/tor/newticket?component=BridgeDB&keywo…'\n" "POT-Creation-Date: 2015-07-25 03:40+0000\n" -"PO-Revision-Date: 2018-02-04 19:22+0000\n" +"PO-Revision-Date: 2018-04-15 05:53+0000\n" "Last-Translator: Sergei <serjsafarian(a)gmail.com>\n" "Language-Team: Armenian (http://www.transifex.com/otf/torproject/language/hy/)\n" "MIME-Version: 1.0\n" @@ -273,7 +273,7 @@ msgstr "Կամուրջներ ստանալու մեկ այլ եղանակ է էլ #: bridgedb/strings.py:115 msgid "My bridges don't work! I need help!" -msgstr "Իմ bridge-երը չե՛ն աշխատում: Օգնությո՛ւն:" +msgstr "Իմ կամուրջները չեն աշխատում։ Ինձ օգնություն է պետք։" #. TRANSLATORS: Please DO NOT translate "Tor". #: bridgedb/strings.py:117

1 0

[translation/bridgedb] Update translations for bridgedb
by translation＠torproject.org 15 Apr '18

15 Apr '18

commit 5d222a265695f91a7fb7ec59e14b5cb0032b3030 Author: Translation commit bot <translation(a)torproject.org> Date: Sun Apr 15 06:15:05 2018 +0000 Update translations for bridgedb --- hy/LC_MESSAGES/bridgedb.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hy/LC_MESSAGES/bridgedb.po b/hy/LC_MESSAGES/bridgedb.po index 697f20b6e..7bb8e81d6 100644 --- a/hy/LC_MESSAGES/bridgedb.po +++ b/hy/LC_MESSAGES/bridgedb.po @@ -11,7 +11,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: 'https://trac.torproject.org/projects/tor/newticket?component=BridgeDB&keywo…'\n" "POT-Creation-Date: 2015-07-25 03:40+0000\n" -"PO-Revision-Date: 2018-02-04 19:22+0000\n" +"PO-Revision-Date: 2018-04-15 05:53+0000\n" "Last-Translator: Sergei <serjsafarian(a)gmail.com>\n" "Language-Team: Armenian (http://www.transifex.com/otf/torproject/language/hy/)\n" "MIME-Version: 1.0\n" @@ -273,7 +273,7 @@ msgstr "Կամուրջներ ստանալու մեկ այլ եղանակ է էլ #: bridgedb/strings.py:115 msgid "My bridges don't work! I need help!" -msgstr "Իմ bridge-երը չե՛ն աշխատում: Օգնությո՛ւն:" +msgstr "Իմ կամուրջները չեն աշխատում։ Ինձ օգնություն է պետք։" #. TRANSLATORS: Please DO NOT translate "Tor". #: bridgedb/strings.py:117

1 0

[stem/master] Use 'GETINFO exit-policy/full' to get exit policies
by atagar＠torproject.org 14 Apr '18

14 Apr '18

commit f7a34305929019cefca21a20d6a2334cf85eae4f Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Apr 14 13:21:31 2018 -0700 Use 'GETINFO exit-policy/full' to get exit policies Our get_exit_policy() method predates tor's controller command to get it (we were in 2013, whereas tor added the 'exit-policy/full' GETINFO option in 2014). It has now been long enough that we can expect relays to have this. This is much simpler and more reliable than attempting to make sense of the user's ExitPolicy torrc entries... https://trac.torproject.org/projects/tor/ticket/25739 I'm a tad uncertain if tor's parsing is correct, but GETINFO should be the authoritative source for how tor interprets it... >>> GETCONF ExitPolicy 250 ExitPolicy=reject6 2a04:1447:4:3::74/32,accept 123.45.67.89:123,reject *:* >>> GETINFO exit-policy/full 250+exit-policy/full= reject6 *:* accept 123.45.67.89:123 reject *:* . 250 OK --- docs/change_log.rst | 1 + stem/control.py | 28 +++++++++++----------------- 2 files changed, 12 insertions(+), 17 deletions(-) diff --git a/docs/change_log.rst b/docs/change_log.rst index e4053d91..b6121982 100644 --- a/docs/change_log.rst +++ b/docs/change_log.rst @@ -49,6 +49,7 @@ The following are only available within Stem's `git repository * Documented v3 hidden service support (:trac:`25124`, :spec:`6bd0a69`) * Added support for limiting the maximum number of streams to :func:`~stem.control.Controller.create_ephemeral_hidden_service` (:spec:`2fcb1c2`) * Stacktrace if :func:`stem.connection.connect` had a string port argument + * More reliable ExitPolicy resolution (:trac:`25739`) * Replaced socket's :func:`~stem.socket.ControlPort.get_address`, :func:`~stem.socket.ControlPort.get_port`, and :func:`~stem.socket.ControlSocketFile.get_socket_path` with attributes * Removed 'raw' argument from :func:`~stem.socket.ControlSocket.send` diff --git a/stem/control.py b/stem/control.py index 8d25064b..3db4d35a 100644 --- a/stem/control.py +++ b/stem/control.py @@ -1265,8 +1265,12 @@ class Controller(BaseController): """ get_exit_policy(default = UNDEFINED) - Effective ExitPolicy for our relay. This accounts for - ExitPolicyRejectPrivate and default policies. + Effective ExitPolicy for our relay. + + .. versionchanged:: 1.7.0 + Policies retrieved through 'GETINFO exit-policy/full' rather than + parsing the user's torrc entries. This should be more reliable for + some edge cases. (:trac:`25739`) :param object default: response if the query fails @@ -1281,23 +1285,13 @@ class Controller(BaseController): """ with self._msg_lock: - config_policy = self._get_cache('exit_policy') - - if not config_policy: - policy = [] - - if self.get_conf('ExitPolicyRejectPrivate') == '1': - policy.append('reject private:*') - - for policy_line in self.get_conf('ExitPolicy', multiple = True): - policy += policy_line.split(',') - - policy += self.get_info('exit-policy/default').split(',') + policy = self._get_cache('exit_policy') - config_policy = stem.exit_policy.get_config_policy(policy, self.get_info('address', None)) - self._set_cache({'exit_policy': config_policy}) + if not policy: + policy = stem.exit_policy.ExitPolicy(*self.get_info('exit-policy/full').splitlines()) + self._set_cache({'exit_policy': policy}) - return config_policy + return policy @with_default() def get_ports(self, listener_type, default = UNDEFINED):

1 0

[doctor/master] Prevent duplicate 'fingerprint changed' notices
by atagar＠torproject.org 14 Apr '18

14 Apr '18

commit 0e5010b01a0da7616ceeb8ba52080bd91b4a6cc6 Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Apr 14 13:00:22 2018 -0700 Prevent duplicate 'fingerprint changed' notices Strange. It doesn't commonly happen but as reported in... https://trac.torproject.org/projects/tor/ticket/25789 ... sometimes we list a relay twice. My only guess is that this arises if a particular address/port is a relay in the consensus twice. Adjusting the code in a way that should deduplicate these. --- fingerprint_change_checker.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/fingerprint_change_checker.py b/fingerprint_change_checker.py index 96bdb2a..6bc0a94 100755 --- a/fingerprint_change_checker.py +++ b/fingerprint_change_checker.py @@ -42,7 +42,7 @@ def main(): fingerprint_changes = load_fingerprint_changes() downloader = DescriptorDownloader(timeout = 15) - alarm_for = set() + alarm_for = {} for relay in downloader.get_consensus(): prior_fingerprints = fingerprint_changes.setdefault((relay.address, relay.or_port), {}) @@ -62,13 +62,13 @@ def main(): # if we've changed more than ten times in the last ten days then alarm if len(prior_fingerprints) >= 10: - alarm_for.add((relay.address, relay.or_port, relay.fingerprint)) + alarm_for['%s:%s' % (relay.address, relay.or_port)] = (relay.address, relay.or_port, relay.fingerprint) - if alarm_for and not is_notification_suppressed(alarm_for): + if alarm_for and not is_notification_suppressed(alarm_for.values()): log.debug("Sending a notification for %i relays..." % len(alarm_for)) body = EMAIL_BODY - for address, or_port, fingerprint in alarm_for: + for address, or_port, fingerprint in alarm_for.values(): try: desc = downloader.get_server_descriptors(fingerprint).run()[0] except: @@ -102,7 +102,7 @@ def main(): subject = EMAIL_SUBJECT if len(alarm_for) == 1: - subject += ' (%s:%s)' % list(alarm_for)[0][:2] + subject += ' (%s:%s)' % alarm_for.values()[0][:2] util.send(subject, body = body, to = ['bad-relays(a)lists.torproject.org', 'atagar(a)torproject.org']) @@ -110,7 +110,7 @@ def main(): current_time = str(int(time.time())) - for address, or_port, _ in alarm_for: + for address, or_port, _ in alarm_for.values(): last_notified_config.set('%s:%s' % (address, or_port), current_time) last_notified_config.save()

1 0

[doctor/master] Properly suppress clock skew notices
by atagar＠torproject.org 14 Apr '18

14 Apr '18

commit 82435ed83fb91ae838757c32b6a6a4d49c3bc901 Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Apr 14 11:50:53 2018 -0700 Properly suppress clock skew notices Oops. The message included a float that changes each time, causing us to send a notice every hour rather than daily as intended for notice runlevel messages. --- consensus_health_checker.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/consensus_health_checker.py b/consensus_health_checker.py index 981c4a6..beb8c70 100755 --- a/consensus_health_checker.py +++ b/consensus_health_checker.py @@ -138,6 +138,11 @@ class Issue(object): attr.update({'authority': '', 'time_taken': '', 'median_time': '', 'authority_times': ''}) return CONFIG['msg'][self._template].format(**attr).replace(' ', '_') + elif self._template == 'CLOCK_SKEW': + attr = dict(self._attr) + attr.update({'authority': '', 'difference': ''}) + + return CONFIG['msg'][self._template].format(**attr).replace(' ', '_') elif self._template == 'FLAG_COUNT_DIFFERS': attr = dict(self._attr) attr.update({'consensus_count': 0, 'vote_count': 0}) @@ -959,7 +964,7 @@ def _get_documents(label, resource): for nickname, difference in clock_skew.items(): if difference > 10: - issues.append(Issue(Runlevel.NOTICE, 'CLOCK_SKEW', authority = nickname, difference = difference, to = [nickname])) + issues.append(Issue(Runlevel.NOTICE, 'CLOCK_SKEW', authority = nickname, difference = int(difference), to = [nickname])) return documents, issues

1 0