November 2019 - tor-commits - lists.torproject.org

[tor/master] changes: Add file for ticket #31371
by dgoulet＠torproject.org 06 Nov '19

06 Nov '19

commit 65013a6924e5b97987819d93b4b8dc1acbee3c1e Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Nov 6 10:27:34 2019 -0500 changes: Add file for ticket #31371 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- changes/ticket31371 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/changes/ticket31371 b/changes/ticket31371 new file mode 100644 index 000000000..25457da81 --- /dev/null +++ b/changes/ticket31371 @@ -0,0 +1,3 @@ + o Minor feature (heartbeat, onion service): + - Add the DoS INTRODUCE2 defenses counter to the heartbeat DoS message. + Closes ticket 31371.

1 0

[tor/master] Merge branch 'tor-github/pr/1491'
by dgoulet＠torproject.org 06 Nov '19

06 Nov '19

commit 49cb7d6ec4fd57922e80f16f859ef691491a92d7 Merge: 059a5795d 1407e2b16 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Nov 6 10:23:33 2019 -0500 Merge branch 'tor-github/pr/1491' src/core/or/dos.c | 13 +++++++++++-- src/feature/hs/hs_dos.c | 27 ++++++++++++++++++++++++--- src/feature/hs/hs_dos.h | 3 +++ src/test/test_status.c | 3 ++- 4 files changed, 40 insertions(+), 6 deletions(-)

1 0

[tor/master] dos: Add HS DoS INTRO2 rejected stats in heartbeat
by dgoulet＠torproject.org 06 Nov '19

06 Nov '19

commit e85f86bb7b676435b2eb11006f111f6e45b8d252 Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Oct 31 13:57:14 2019 -0400 dos: Add HS DoS INTRO2 rejected stats in heartbeat The DoS heartbeat now contains the number of rejected INTRODUCE2 cell that the relay has seen. Closes #31371 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/core/or/dos.c | 13 +++++++++++-- src/feature/hs/hs_dos.c | 7 +++++++ src/feature/hs/hs_dos.h | 3 +++ 3 files changed, 21 insertions(+), 2 deletions(-) diff --git a/src/core/or/dos.c b/src/core/or/dos.c index 5f9bbf90a..8cfea910b 100644 --- a/src/core/or/dos.c +++ b/src/core/or/dos.c @@ -15,6 +15,7 @@ #include "core/or/channel.h" #include "core/or/connection_or.h" #include "core/or/relay.h" +#include "feature/hs/hs_dos.h" #include "feature/nodelist/networkstatus.h" #include "feature/nodelist/nodelist.h" #include "feature/relay/routermode.h" @@ -629,6 +630,7 @@ dos_log_heartbeat(void) char *cc_msg = NULL; char *single_hop_client_msg = NULL; char *circ_stats_msg = NULL; + char *hs_dos_intro2_msg = NULL; /* Stats number coming from relay.c append_cell_to_circuit_queue(). */ tor_asprintf(&circ_stats_msg, @@ -654,17 +656,24 @@ dos_log_heartbeat(void) num_single_hop_client_refused); } + /* HS DoS stats. */ + tor_asprintf(&hs_dos_intro2_msg, + " %" PRIu64 " INTRODUCE2 rejected.", + hs_dos_get_intro2_rejected_count()); + log_notice(LD_HEARTBEAT, - "DoS mitigation since startup:%s%s%s%s", + "DoS mitigation since startup:%s%s%s%s%s", circ_stats_msg, (cc_msg != NULL) ? cc_msg : " [cc not enabled]", (conn_msg != NULL) ? conn_msg : " [conn not enabled]", - (single_hop_client_msg != NULL) ? single_hop_client_msg : ""); + (single_hop_client_msg != NULL) ? single_hop_client_msg : "", + (hs_dos_intro2_msg != NULL) ? hs_dos_intro2_msg : ""); tor_free(conn_msg); tor_free(cc_msg); tor_free(single_hop_client_msg); tor_free(circ_stats_msg); + tor_free(hs_dos_intro2_msg); return; } diff --git a/src/feature/hs/hs_dos.c b/src/feature/hs/hs_dos.c index 81041475e..d36ee97e6 100644 --- a/src/feature/hs/hs_dos.c +++ b/src/feature/hs/hs_dos.c @@ -206,6 +206,13 @@ hs_dos_can_send_intro2(or_circuit_t *s_intro_circ) return true; } +/* Return rolling count of rejected INTRO2. */ +uint64_t +hs_dos_get_intro2_rejected_count(void) +{ + return intro2_rejected_count; +} + /* Initialize the onion service Denial of Service subsystem. */ void hs_dos_init(void) diff --git a/src/feature/hs/hs_dos.h b/src/feature/hs/hs_dos.h index ccf4e2717..b9e39aca4 100644 --- a/src/feature/hs/hs_dos.h +++ b/src/feature/hs/hs_dos.h @@ -24,6 +24,9 @@ void hs_dos_consensus_has_changed(const networkstatus_t *ns); bool hs_dos_can_send_intro2(or_circuit_t *s_intro_circ); void hs_dos_setup_default_intro2_defenses(or_circuit_t *circ); +/* Statistics. */ +uint64_t hs_dos_get_intro2_rejected_count(void); + #ifdef HS_DOS_PRIVATE #ifdef TOR_UNIT_TESTS

1 0

[tor/master] dos: Account rejection in hs_dos_can_send_intro2
by dgoulet＠torproject.org 06 Nov '19

06 Nov '19

commit ff8823d03cef50cb3a78f13a35558288e54c2173 Author: David Goulet <dgoulet(a)torproject.org> Date: Thu Oct 31 13:50:36 2019 -0400 dos: Account rejection in hs_dos_can_send_intro2 This required a small refactoring so we could count properly the INTRO2 sending disallow. Part of #31371 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/feature/hs/hs_dos.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/src/feature/hs/hs_dos.c b/src/feature/hs/hs_dos.c index 19794e09d..81041475e 100644 --- a/src/feature/hs/hs_dos.c +++ b/src/feature/hs/hs_dos.c @@ -45,6 +45,9 @@ * introduction DoS defense. Disabled by default. */ #define HS_DOS_INTRODUCE_ENABLED_DEFAULT 0 +/* INTRODUCE2 rejected request counter. */ +static uint64_t intro2_rejected_count = 0; + /* Consensus parameters. The ESTABLISH_INTRO DoS cell extension have higher * priority than these values. If no extension is sent, these are used only by * the introduction point. */ @@ -163,12 +166,12 @@ hs_dos_can_send_intro2(or_circuit_t *s_intro_circ) * This can be set by the consensus, the ESTABLISH_INTRO cell extension or * the hardcoded values in tor code. */ if (!s_intro_circ->introduce2_dos_defense_enabled) { - return true; + goto allow; } /* Should not happen but if so, scream loudly. */ if (BUG(TO_CIRCUIT(s_intro_circ)->purpose != CIRCUIT_PURPOSE_INTRO_POINT)) { - return false; + goto disallow; } /* This is called just after we got a valid and parsed INTRODUCE1 cell. The @@ -189,7 +192,18 @@ hs_dos_can_send_intro2(or_circuit_t *s_intro_circ) } /* Finally, we can send a new INTRODUCE2 if there are still tokens. */ - return token_bucket_ctr_get(&s_intro_circ->introduce2_bucket) > 0; + if (token_bucket_ctr_get(&s_intro_circ->introduce2_bucket) > 0) { + goto allow; + } + + /* Fallthrough is to disallow since this means the bucket has reached 0. */ + disallow: + /* Increment stats counter, we are rejecting the INTRO2 cell. */ + intro2_rejected_count++; + return false; + + allow: + return true; } /* Initialize the onion service Denial of Service subsystem. */

1 0

[tor/master] test: Fix DoS heartbeat unit test after adding INTRO2
by dgoulet＠torproject.org 06 Nov '19

06 Nov '19

commit 1407e2b169bf187b77528417882a065a4e8f1e60 Author: David Goulet <dgoulet(a)torproject.org> Date: Wed Nov 6 08:09:35 2019 -0500 test: Fix DoS heartbeat unit test after adding INTRO2 Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/test/test_status.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/test/test_status.c b/src/test/test_status.c index 2fb2a7b24..aabe93452 100644 --- a/src/test/test_status.c +++ b/src/test/test_status.c @@ -449,12 +449,13 @@ NS(logv)(int severity, log_domain_mask_t domain, case 5: tt_int_op(severity, OP_EQ, LOG_NOTICE); tt_u64_op(domain, OP_EQ, LD_HEARTBEAT); - tt_str_op(format, OP_EQ, "DoS mitigation since startup:%s%s%s%s"); + tt_str_op(format, OP_EQ, "DoS mitigation since startup:%s%s%s%s%s"); tt_str_op(va_arg(ap, char *), OP_EQ, " 0 circuits killed with too many cells."); tt_str_op(va_arg(ap, char *), OP_EQ, " [cc not enabled]"); tt_str_op(va_arg(ap, char *), OP_EQ, " [conn not enabled]"); tt_str_op(va_arg(ap, char *), OP_EQ, ""); + tt_str_op(va_arg(ap, char *), OP_EQ, " 0 INTRODUCE2 rejected."); break; default: tt_abort_msg("unexpected call to logv()"); // TODO: prettyprint args

1 0

[translation/support-portal] https://gitweb.torproject.org/translation.git/commit/?h=support-portal
by translation＠torproject.org 06 Nov '19

06 Nov '19

commit 8494e751be2c7f9a20b2c1d5c2bd338e430ad05a Author: Translation commit bot <translation(a)torproject.org> Date: Wed Nov 6 15:23:39 2019 +0000 https://gitweb.torproject.org/translation.git/commit/?h=support-portal --- contents+es.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contents+es.po b/contents+es.po index 2d63606a2..da0f48e87 100644 --- a/contents+es.po +++ b/contents+es.po @@ -2949,7 +2949,7 @@ msgid "" msgstr "" "Hasta donde nosotros sabemos, Google no está haciendo nada intencionado para" " obstaculizar el uso de Tor. El mensaje de error sobre ordenadores " -"infectados debería de desaparecer al cabo de poco tiempo." +"infectados desaparece normalmente al cabo de poco tiempo." #: https//support.torproject.org/tbb/tbb-45/ #: (content/tbb/tbb-45/contents+en.lrquestion.title)

1 0

[translation/tpo-web_completed] https://gitweb.torproject.org/translation.git/commit/?h=tpo-web_completed
by translation＠torproject.org 06 Nov '19

06 Nov '19

commit 629bf1676343ac8078704563ef09d7566375a266 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Nov 6 15:23:15 2019 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tpo-web_completed --- contents+es.po | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/contents+es.po b/contents+es.po index 8b35ac907..7bd015620 100644 --- a/contents+es.po +++ b/contents+es.po @@ -8,8 +8,8 @@ # erinm, 2019 # IDRASSI Mounir <mounir.idrassi(a)idrix.fr>, 2019 # Carlos Guerra <contacto(a)guerracarlos.com>, 2019 -# Emma Peel, 2019 # Zuhualime Akoochimoya, 2019 +# Emma Peel, 2019 # msgid "" msgstr "" @@ -17,7 +17,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2019-11-06 15:48+CET\n" "PO-Revision-Date: 2019-03-09 10:41+0000\n" -"Last-Translator: Zuhualime Akoochimoya, 2019\n" +"Last-Translator: Emma Peel, 2019\n" "Language-Team: Spanish (https://www.transifex.com/otf/teams/1519/es/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n"

1 0

[translation/tpo-web] https://gitweb.torproject.org/translation.git/commit/?h=tpo-web
by translation＠torproject.org 06 Nov '19

06 Nov '19

commit 14324c32afccb6fc75305be1285196768d34cab7 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Nov 6 15:23:05 2019 +0000 https://gitweb.torproject.org/translation.git/commit/?h=tpo-web --- contents+es.po | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/contents+es.po b/contents+es.po index 7440e0cb1..204828b22 100644 --- a/contents+es.po +++ b/contents+es.po @@ -8,8 +8,8 @@ # erinm, 2019 # IDRASSI Mounir <mounir.idrassi(a)idrix.fr>, 2019 # Carlos Guerra <contacto(a)guerracarlos.com>, 2019 -# Emma Peel, 2019 # Zuhualime Akoochimoya, 2019 +# Emma Peel, 2019 # msgid "" msgstr "" @@ -17,7 +17,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2019-11-06 15:48+CET\n" "PO-Revision-Date: 2019-03-09 10:41+0000\n" -"Last-Translator: Zuhualime Akoochimoya, 2019\n" +"Last-Translator: Emma Peel, 2019\n" "Language-Team: Spanish (https://www.transifex.com/otf/teams/1519/es/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -227,6 +227,10 @@ msgid "" "add more. Want to help us translate? [See " "here](https://community.torproject.org/localization/)" msgstr "" +"Queremos que todos puedan disfrutar del Navegador Tor en su propio idioma. " +"Tor ahora está disponible en 32 idiomas diferentes, y estamos trabajando " +"para agregar más. ¿Quieres ayudarnos a traducir? [Mira " +"aquí](https://community.torproject.org/localization/)" #: https//www.torproject.org/download/tor/ #: (content/download/tor/contents+en.lrpage.title) @@ -308,6 +312,9 @@ msgid "" " the most popular and widely used free, open source privacy technologies: " "Tor Browser and the Tor network." msgstr "" +"Tor project y su comunidad circundante desarrollan y distribuyen algunas de " +"las más populares y ampliamente utilizadas tecnologías gratuitas de " +"privacidad de código abierto: Tor Browser y la red Tor. " #: https//www.torproject.org/about/cy-pres/ #: (content/about/cy-pres/contents+en.lrpage.body) @@ -1045,10 +1052,14 @@ msgid "" "infrastructure, please email tor-security(a)lists.torproject.org. If you've " "found a security bug in Tor or Tor Browser, feel free to submit it for our" msgstr "" +"Si has encontrado un problema de seguridad en uno de nuestros proyectos o en" +" nuestra infraestructura, por favor envía un correo electrónico a tor-" +"security(a)lists.torproject.org. Si has encontrado un problema de seguridad en" +" Tor o Tor Browser también lo puedes agregar a nuestro " #: templates/contact.html:80 msgid "bug bounty program." -msgstr "" +msgstr "programa de bug bounty" #: templates/contact.html:80 msgid "" @@ -1208,6 +1219,9 @@ msgid "" "Tor Browser will block browser plugins such as Flash, RealPlayer, QuickTime," " and others: they can be manipulated into revealing your IP address." msgstr "" +"Navegador Tor bloqueará complementos de navegador tales como Flash, " +"RealPlayer, QuickTime, y otros: pueden ser manipulados para revelar tu " +"dirección IP." #: templates/download.html:27 msgid "" @@ -1338,6 +1352,9 @@ msgid "" "Tor Browser aims to make all users look the same, making it difficult for " "you to be fingerprinted based on your browser and device information." msgstr "" +"El Navegador Tor intenta que todos los usuarios parezcan iguales, haciendo " +"más difícil que puedas ser identificado unívocamente basándose en la " +"información de tu navegador y dispositivo." #: templates/home.html:58 msgid "Multi-layered Encryption"

1 0

[translation/https_everywhere_completed] https://gitweb.torproject.org/translation.git/commit/?h=https_everywhere_completed
by translation＠torproject.org 06 Nov '19

06 Nov '19

commit d357413c7fa2bd10bf7beb45be3ee6a3399c9587 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Nov 6 15:16:07 2019 +0000 https://gitweb.torproject.org/translation.git/commit/?h=https_everywhere_co… --- pt_BR/https-everywhere.dtd | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/pt_BR/https-everywhere.dtd b/pt_BR/https-everywhere.dtd index 00968db4d..8d524f36e 100644 --- a/pt_BR/https-everywhere.dtd +++ b/pt_BR/https-everywhere.dtd @@ -28,7 +28,7 @@ <!ENTITY https-everywhere.options.autoUpdateRulesets "Atualizar automaticamente os conjuntos de regras"> <!ENTITY https-everywhere.options.userRulesListed "Regras de usuários do HTTPS Everywhere"> <!ENTITY https-everywhere.options.disabledUrlsListed "HTTPS Everywhere Sites Desabilitados"> -<!ENTITY https-everywhere.options.updateChannelsWarning "Alerta: Adicionando atualização de canais pode motivar atacantes a sequestrar seu navegador. Somente edite essa seção se você souber o que você está fazendo!"> +<!ENTITY https-everywhere.options.updateChannelsWarning ""> <!ENTITY https-everywhere.options.addUpdateChannel "Adicione canal de atualização"> <!ENTITY https-everywhere.options.enterUpdateChannelName "Entre com o nome do canal de atualização"> <!ENTITY https-everywhere.options.delete "Apagar"> @@ -40,28 +40,29 @@ <!ENTITY https-everywhere.prefs.export_settings "Exportar Configurações"> <!ENTITY https-everywhere.prefs.reset_defaults "Restaurar as configurações padrão"> -<!ENTITY https-everywhere.prefs.reset_defaults_message "Isso redefinirá cada conjunto de regras de volta ao seu estado inicial. Deseja continuar?"> +<!ENTITY https-everywhere.prefs.reset_defaults_message ""> -<!ENTITY https-everywhere.cancel.he_blocking_explainer "O HTTPS Everywhere percebeu que você estava navegando para uma página não HTTPS e tentou enviar você para a versão HTTPS. A versão HTTPS não está disponível. O mais provável é que este site não suporte HTTPS, mas também é possível que um invasor esteja bloqueando a versão HTTPS. Se você desejar visualizar a versão não criptografada desta página, ainda poderá desativá-la desativando a opção "Criptografar todos os sites qualificados" (EASE) na sua extensão HTTPS Everywhere. Esteja ciente de que desabilitar essa opção pode deixar seu navegador vulnerável a ataques de downgrade com base na rede nos sites que você visita."> -<!ENTITY https-everywhere.cancel.he_blocking_network "Ataques inferiores e básico de rede"> +<!ENTITY https-everywhere.cancel.he_blocking_explainer ""> +<!ENTITY https-everywhere.cancel.he_blocking_network ""> <!ENTITY https-everywhere.cancel.open_page "Abrir página insegura"> +<!ENTITY https-everywhere.cancel.http_once ""> <!ENTITY https-everywhere.chrome.settings_for_this_site_header "Configurações para este site"> <!ENTITY https-everywhere.chrome.settings_for_this_site_subheader "Mude suas preferências para conexões criptografadas"> -<!ENTITY https-everywhere.chrome.settings_for_this_site_explained "À medida que navega em websites diferentes, pode alterar as suas preferências para cada website"> +<!ENTITY https-everywhere.chrome.settings_for_this_site_explained ""> <!ENTITY https-everywhere.chrome.stable_rules "Regras estáveis"> <!ENTITY https-everywhere.chrome.stable_rules_description "Forçar conexões criptografadas para estes sites:"> <!ENTITY https-everywhere.chrome.experimental_rules "Regras experimentais"> -<!ENTITY https-everywhere.chrome.experimental_rules_description "Pode causar avisos ou ruptura. Desabilitado por padrão."> +<!ENTITY https-everywhere.chrome.experimental_rules_description ""> <!ENTITY https-everywhere.chrome.disable_on_this_site "Desabilitar o HTTPS Everywhere neste site."> <!ENTITY https-everywhere.chrome.enable_on_this_site "Habilitar o HTTPS Everywhere neste site."> <!ENTITY https-everywhere.chrome.add_rule "Adicione uma exceção para esse site"> <!ENTITY https-everywhere.chrome.add_new_rule "Adicione uma nova regra para esse site"> -<!ENTITY https-everywhere.chrome.always_https_for_host "Sempre usar https para este hospedeiro"> -<!ENTITY https-everywhere.chrome.host "Hospedeiro:"> +<!ENTITY https-everywhere.chrome.always_https_for_host ""> +<!ENTITY https-everywhere.chrome.host ""> <!ENTITY https-everywhere.chrome.show_advanced "Mostrar opções avançadas"> -<!ENTITY https-everywhere.chrome.hide_advanced "Ocultar opções avançadas"> +<!ENTITY https-everywhere.chrome.hide_advanced ""> <!ENTITY https-everywhere.chrome.rule_name "Nome da regra"> -<!ENTITY https-everywhere.chrome.regex "Expressão regular correspondente"> +<!ENTITY https-everywhere.chrome.regex ""> <!ENTITY https-everywhere.chrome.redirect_to "Redirecionar para"> <!ENTITY https-everywhere.chrome.status_cancel_button "Cancelar">

1 0

[translation/https_everywhere] https://gitweb.torproject.org/translation.git/commit/?h=https_everywhere
by translation＠torproject.org 06 Nov '19

06 Nov '19

commit 325d06abd22715360fbd0ac13604b9b6621f6e00 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Nov 6 15:16:00 2019 +0000 https://gitweb.torproject.org/translation.git/commit/?h=https_everywhere --- pt_BR/https-everywhere.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pt_BR/https-everywhere.dtd b/pt_BR/https-everywhere.dtd index 6d50a8e29..6bcc0ee78 100644 --- a/pt_BR/https-everywhere.dtd +++ b/pt_BR/https-everywhere.dtd @@ -45,7 +45,7 @@ <!ENTITY https-everywhere.cancel.he_blocking_explainer "O HTTPS Everywhere percebeu que você estava navegando para uma página não HTTPS e tentou enviar você para a versão HTTPS. A versão HTTPS não está disponível. O mais provável é que este site não suporte HTTPS, mas também é possível que um invasor esteja bloqueando a versão HTTPS. Se você desejar visualizar a versão não criptografada desta página, ainda poderá desativá-la desativando a opção "Criptografar todos os sites qualificados" (EASE) na sua extensão HTTPS Everywhere. Esteja ciente de que desabilitar essa opção pode deixar seu navegador vulnerável a ataques de downgrade com base na rede nos sites que você visita."> <!ENTITY https-everywhere.cancel.he_blocking_network "Ataques inferiores e básico de rede"> <!ENTITY https-everywhere.cancel.open_page "Abrir página insegura"> -<!ENTITY https-everywhere.cancel.http_once "Open insecure page for this session only"> +<!ENTITY https-everywhere.cancel.http_once "Abrir página insegura apenas para esta sessão"> <!ENTITY https-everywhere.chrome.settings_for_this_site_header "Configurações para este site"> <!ENTITY https-everywhere.chrome.settings_for_this_site_subheader "Mude suas preferências para conexões criptografadas">

1 0