tor-commits February 2019

tor-commits@lists.torproject.org

16 participants
1788 discussions

[tor/master] Allow empty username/password in SOCKS5 username/password auth message
by nickm＠torproject.org 08 Feb '19

08 Feb '19

commit 790150e57a98221fbb4cfdc5c34b3395808416b4 Author: rl1987 <rl1987(a)sdf.lonestar.org> Date: Sat Jan 26 10:55:53 2019 +0200 Allow empty username/password in SOCKS5 username/password auth message --- changes/bug29175_035 | 4 ++++ src/core/proto/proto_socks.c | 12 ++++++++---- src/test/test_socks.c | 39 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 51 insertions(+), 4 deletions(-) diff --git a/changes/bug29175_035 b/changes/bug29175_035 new file mode 100644 index 000000000..134c1d952 --- /dev/null +++ b/changes/bug29175_035 @@ -0,0 +1,4 @@ + o Major bugfixes (networking): + - Gracefully handle empty username/password fields in SOCKS5 + username/password auth messsage and allow SOCKS5 handshake to + continue. Fixes bug 29175; bugfix on 0.3.5.1-alpha. diff --git a/src/core/proto/proto_socks.c b/src/core/proto/proto_socks.c index a8f4a06c2..8b78ed44c 100644 --- a/src/core/proto/proto_socks.c +++ b/src/core/proto/proto_socks.c @@ -450,18 +450,22 @@ parse_socks5_userpass_auth(const uint8_t *raw_data, socks_request_t *req, tor_free(req->username); req->username = tor_memdup_nulterm(username, usernamelen); req->usernamelen = usernamelen; - - req->got_auth = 1; } if (passwordlen && password) { tor_free(req->password); req->password = tor_memdup_nulterm(password, passwordlen); req->passwordlen = passwordlen; - - req->got_auth = 1; } + /** + * Yes, we allow username and/or password to be empty. Yes, that does + * violate RFC 1929. However, some client software can send a username/ + * password message with these fields being empty and we want to allow them + * to be used with Tor. + */ + req->got_auth = 1; + end: socks5_client_userpass_auth_free(trunnel_req); return res; diff --git a/src/test/test_socks.c b/src/test/test_socks.c index 2832d42fc..783f4726e 100644 --- a/src/test/test_socks.c +++ b/src/test/test_socks.c @@ -479,6 +479,44 @@ test_socks_5_authenticate(void *ptr) ; } +/** Perform SOCKS 5 authentication with empty username/password fields. + * Technically this violates RfC 1929, but some client software will send + * this kind of message to Tor. + * */ +static void +test_socks_5_authenticate_empty_user_pass(void *ptr) +{ + SOCKS_TEST_INIT(); + + /* SOCKS 5 Negotiate username/password authentication */ + ADD_DATA(buf, "\x05\x01\x02"); + + tt_assert(!fetch_from_buf_socks(buf, socks, + get_options()->TestSocks, + get_options()->SafeSocks)); + tt_int_op(2,OP_EQ, socks->replylen); + tt_int_op(5,OP_EQ, socks->reply[0]); + tt_int_op(SOCKS_USER_PASS,OP_EQ, socks->reply[1]); + tt_int_op(5,OP_EQ, socks->socks_version); + + tt_int_op(0,OP_EQ, buf_datalen(buf)); + + /* SOCKS 5 Send username/password auth message with empty user/pass fields */ + ADD_DATA(buf, "\x01\x00\x00"); + tt_assert(!fetch_from_buf_socks(buf, socks, + get_options()->TestSocks, + get_options()->SafeSocks)); + tt_int_op(5,OP_EQ, socks->socks_version); + tt_int_op(2,OP_EQ, socks->replylen); + tt_int_op(1,OP_EQ, socks->reply[0]); + tt_int_op(0,OP_EQ, socks->reply[1]); + + tt_int_op(0,OP_EQ, socks->usernamelen); + tt_int_op(0,OP_EQ, socks->passwordlen); + + done: + ; +} /** Perform SOCKS 5 authentication and send data all in one go */ static void test_socks_5_authenticate_with_data(void *ptr) @@ -1035,6 +1073,7 @@ struct testcase_t socks_tests[] = { SOCKSENT(5_auth_unsupported_version), SOCKSENT(5_auth_before_negotiation), SOCKSENT(5_authenticate), + SOCKSENT(5_authenticate_empty_user_pass), SOCKSENT(5_authenticate_with_data), SOCKSENT(5_malformed_commands), SOCKSENT(5_bad_arguments),

1 0

[tor/master] Merge remote-tracking branch 'tor-github/pr/670' into maint-0.3.5
by nickm＠torproject.org 08 Feb '19

08 Feb '19

commit 4b36f9676db4ca98101c26ba5fc539ed458ae571 Merge: bca25eebf 790150e57 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 8 08:19:31 2019 -0500 Merge remote-tracking branch 'tor-github/pr/670' into maint-0.3.5 changes/bug29175_035 | 4 ++++ src/core/proto/proto_socks.c | 12 ++++++++---- src/test/test_socks.c | 39 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 51 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.3.5] Allow empty username/password in SOCKS5 username/password auth message
by nickm＠torproject.org 08 Feb '19

08 Feb '19

1 0

[tor/master] Merge branch 'maint-0.3.5'
by nickm＠torproject.org 08 Feb '19

08 Feb '19

commit b1ae2fd65ba165722dc121df7bb0be4ec5d6597c Merge: bfd1d7024 4b36f9676 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 8 08:19:34 2019 -0500 Merge branch 'maint-0.3.5' changes/bug29175_035 | 4 ++++ src/core/proto/proto_socks.c | 12 ++++++++---- src/test/test_socks.c | 39 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 51 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.3.5] Merge remote-tracking branch 'tor-github/pr/670' into maint-0.3.5
by nickm＠torproject.org 08 Feb '19

08 Feb '19

1 0

[tor/release-0.3.5] Allow empty username/password in SOCKS5 username/password auth message
by nickm＠torproject.org 08 Feb '19

08 Feb '19

1 0

[tor/release-0.3.5] Merge remote-tracking branch 'tor-github/pr/670' into maint-0.3.5
by nickm＠torproject.org 08 Feb '19

08 Feb '19

1 0

[tor/release-0.3.5] Merge branch 'maint-0.3.5' into release-0.3.5
by nickm＠torproject.org 08 Feb '19

08 Feb '19

commit 7a9fb4c0819271cc28f76bdb4867a57e634d3ce8 Merge: 1cc234ed0 4b36f9676 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 8 08:19:34 2019 -0500 Merge branch 'maint-0.3.5' into release-0.3.5 changes/bug29175_035 | 4 ++++ src/core/proto/proto_socks.c | 12 ++++++++---- src/test/test_socks.c | 39 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 51 insertions(+), 4 deletions(-)

1 0

[translation/tbmanual-contentspot] Update translations for tbmanual-contentspot
by translation＠torproject.org 08 Feb '19

08 Feb '19

commit 3275c7b21acd56bf447ca5df772ce1213f4bab61 Author: Translation commit bot <translation(a)torproject.org> Date: Fri Feb 8 13:17:49 2019 +0000 Update translations for tbmanual-contentspot --- contents+is.po | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/contents+is.po b/contents+is.po index 8dbb899ca..f8d2b06f5 100644 --- a/contents+is.po +++ b/contents+is.po @@ -111,6 +111,9 @@ msgid "" " valid for a single session (until Tor Browser is exited or a <a href" "=\"/managing-identities/#new-identity\">New Identity</a> is requested)." msgstr "" +"Sjálfgefið geymir Tor-vafrinn ekki neinn vafurferil. Vefkökur eru einungis " +"gildar í stökum setum (þar til hætt er í Tor-vafranum eða beðið um <a href" +"=\"/managing-identities/#new-identity\">Nýtt auðkenni</a>)." #: https//tb-manual.torproject.org/en-US/about/ #: (content/about/contents+en-US.lrtopic.body) @@ -126,6 +129,11 @@ msgid "" "relay in the circuit (the “exit relay”) then sends the traffic out onto the " "public Internet." msgstr "" +"Tor er net af sýndargöngum (virtual tunnels) sem gera þér kleift að bæta " +"friðhelgi þína og öryggi á internetinu. Tor virkar þannig að umferðin þín er" +" send í gegnum þrjá handahófsvalda þjóna (einnig nefndir *endurvarpar*) í " +"Tor-netkerfinu. Síðasti endurvarpinn í rásinni (nefndur “úttaksendurvarpi”) " +"sendir þá umferðina út á opinbera internetið." #: https//tb-manual.torproject.org/en-US/about/ #: (content/about/contents+en-US.lrtopic.body) @@ -144,6 +152,10 @@ msgid "" "three keys represent the layers of encryption between the user and each " "relay." msgstr "" +"Myndin hér fyrir ofan sýnir hvernig notandi vafrar um hin ýmsu vefsvæði í " +"gegnum Tor. Grænu tölvurnar á milli tákna endurvarpa á Tor-netkerfinu, á " +"meðan lyklarnir þrír tákna lögin af dulritun sem aðskilja notandann og hvern" +" endurvarpa." #: https//tb-manual.torproject.org/en-US/downloading/ #: (content/downloading/contents+en-US.lrtopic.title) @@ -164,6 +176,11 @@ msgid "" "/secure-connections.html\">HTTPS</a>, which makes it much harder for " "somebody to tamper with." msgstr "" +"Öruggasta og einfaldasta leiðin til að sækja Tor-vafrann er af opinberri " +"vesíðu Tor-verkefnisins á https://www.torproject.org. Tengingin við síðuna " +"er tryggð með <a href=\"https://tb-manual.torproject.org/en-US/secure-" +"connections.html\">HTTPS</a>, sem gerir utanaðkomandi aðilum erfiðara fyrir " +"með að eiga við niðurhalið." #: https//tb-manual.torproject.org/en-US/downloading/ #: (content/downloading/contents+en-US.lrtopic.body) @@ -172,6 +189,10 @@ msgid "" "for example, it could be blocked on your network. If this happens, you can " "use one of the alternative download methods listed below." msgstr "" +"Hinsvegar, það geta komið upp tilvik þar sem þú hefur ekki aðgang að " +"vefsvæði Tor-verkefnisins: til dæmis gæti það verið útilokað á netkerfinu " +"þar sem þú tengist. Ef sú er raunin, gætirðu prófað einhverjar af þeim " +"varaleiðum til niðurhals sem taldar eru upp hér fyrir neðan." #: https//tb-manual.torproject.org/en-US/downloading/ #: (content/downloading/contents+en-US.lrtopic.body) @@ -186,6 +207,10 @@ msgid "" "mirrors, either through [EFF](https://tor.eff.org) or [Calyx " "Institute](https://tor.calyxinstitute.org)." msgstr "" +"Ef þér tekst ekki að sækja Tor-vafrann af opinberri heimasíðu Tor-" +"verkefnisins, þá geturðu reynt að sækja hann af einum af opinberu " +"hugbúnaðarspeglunum okkar, annað hvort í gegnum [EFF](https://tor.eff.org) " +"eða [Calyx Institute](https://tor.calyxinstitute.org)." #: https//tb-manual.torproject.org/en-US/downloading/ #: (content/downloading/contents+en-US.lrtopic.body) @@ -199,6 +224,9 @@ msgid "" "the latest version of Tor Browser, hosted at a variety of locations, such as" " Dropbox, Google Drive and GitHub." msgstr "" +"GetTor er þjónusta sem bregst sjálfvirkt við skilaboðum með því að senda " +"tengla á nýjustu útgáfur Tor-vafrans, hýstar á ýmsum mismunandi stöðum, svo " +"sem Dropbox, Google Drive og GitHub." #: https//tb-manual.torproject.org/en-US/downloading/ #: (content/downloading/contents+en-US.lrtopic.body) @@ -212,6 +240,9 @@ msgid "" "simply write “windows”, “osx”, or “linux”, (without quotation marks) " "depending on your operating system." msgstr "" +"Sendu tölvupóst til gettor(a)torproject.org og skrifaðu einfaldlega í meginmál" +" póstsins “windows”, “osx”, eða “linux”, (án gæsalappanna) eftir því hvert " +"stýrikerfið þitt er." #: https//tb-manual.torproject.org/en-US/downloading/ #: (content/downloading/contents+en-US.lrtopic.body) @@ -223,6 +254,12 @@ msgid "" "“32-bit” or “64-bit” software: this depends on the model of the computer you" " are using." msgstr "" +"GetTor mun svara með tölvupósti sem inniheldur tengla sem beina á " +"niðurhalspakka Tor-vafrans, á undirritun dulritunarinnar (nauðsynlegt til að" +" geta sannreynt niðurhalið), fingrafar dulritunarlykilsins sem notaður var " +"við gerð undirritunarinnar, og á gátsummu pakkans (checksum). Þér gæti verið" +" boðið að velja á milli “32-bita” eða “64-bita” hugbúnaðar: það fer eftir " +"hvaða gerð af tölvu þú ert að nota." #: https//tb-manual.torproject.org/en-US/downloading/ #: (content/downloading/contents+en-US.lrtopic.body) @@ -236,6 +273,9 @@ msgid "" "Message to @get_tor with the words \"osx en\" in it (you don't need to " "follow the account)." msgstr "" +"Til að fá tengla fyrir niðurhal Tor-vafrans á ensku fyrir OS X, sendu bein " +"skilaboð (direct message) til @get_tor með orðunum \"osx en\" í skilaboðunum" +" (þú þarft ekki að vera fylgjandi þessa reiknings)." #: https//tb-manual.torproject.org/en-US/downloading/ #: (content/downloading/contents+en-US.lrtopic.body) @@ -248,6 +288,8 @@ msgid "" "To get links for downloading Tor Browser in Chinese for Linux, send a " "message to gettor(a)torproject.org with the words \"linux zh\" in it." msgstr "" +"Til að fá tengla fyrir niðurhal Tor-vafrans á kínversku fyrir Linux, sendu " +"skilaboð til gettor(a)torproject.org með orðunum \"linux zh\" í skilaboðunum." #: https//tb-manual.torproject.org/en-US/running-tor-browser/ #: (content/running-tor-browser/contents+en-US.lrtopic.title)

1 0

[tpo/master] i18n updates
by hiro＠torproject.org 08 Feb '19

08 Feb '19

commit 5b7077d20314943c96a4af7959bcca5c59ee44b9 Author: emma peel <emma.peel(a)riseup.net> Date: Thu Feb 7 18:22:40 2019 +0100 i18n updates --- templates/download-android.html | 12 ++++++------ templates/hero-download.html | 10 +++++----- templates/macros/jobs.html | 2 +- templates/macros/reports.html | 4 ++-- 4 files changed, 14 insertions(+), 14 deletions(-) diff --git a/templates/download-android.html b/templates/download-android.html index 30ebe45..41433fb 100644 --- a/templates/download-android.html +++ b/templates/download-android.html @@ -9,18 +9,18 @@ </div> </div> <div class="row"> - <h4 class="mx-auto display-4 text-white">Get Tor Browser for Android.</h4> + <h4 class="mx-auto display-4 text-white">{{ _('Get Tor Browser for Android.') }}</h4> </div> <div class="row"> - <h1 class="mx-auto defend text-white">Protect yourself against tracking, surveillance, and censorship. </h1> + <h1 class="mx-auto defend text-white">{{ _('Protect yourself against tracking, surveillance, and censorship.') }}</h1> </div> <div class="row my-5"> - <a class="btn btn-lg btn-light text-primary py-3 px-4 my-1 mx-auto" href="">Download .apk</a> - <a class="btn btn-lg btn-light text-primary py-3 px-4 my-1 mx-auto" href="">Go to Google Play</a> - <a class="btn btn-lg btn-light text-primary py-3 px-4 my-1 mx-auto disabled" href="">Go to F-droid <small class="badge-pill badge-dark mx-1 nick">S00N</small></a> + <a class="btn btn-lg btn-light text-primary py-3 px-4 my-1 mx-auto" href="">{{ _('Download .apk') }}</a> + <a class="btn btn-lg btn-light text-primary py-3 px-4 my-1 mx-auto" href="">{{ _('Go to Google Play') }}</a> + <a class="btn btn-lg btn-light text-primary py-3 px-4 my-1 mx-auto disabled" href="">{{ _('Go to F-droid <small class="badge-pill badge-dark mx-1 nick">S00N</small>')|safe }}</a> </div> <div class="row"> - <p class="text-light mx-auto nick"><i class="fab fa-apple display-5 text-light pr-3"></i>Are you a iOS user? We encourage you to try <a class="mx-auto" href=""><u>Onion Browser.</u></a></p> + <p class="text-light mx-auto nick">{{ _('Are you a iOS user? We encourage you to try <a class="mx-auto" href=""><u>Onion Browser.</u></a>')|safe }}</p> </div> </div> <div class="d-none d-lg-block col-lg-4"> diff --git a/templates/hero-download.html b/templates/hero-download.html index c3ab624..17fb171 100644 --- a/templates/hero-download.html +++ b/templates/hero-download.html @@ -1,8 +1,8 @@ <div class="row"> - <h1 class="mx-auto display-2 text-white">Defend yourself.</h1> + <h1 class="mx-auto display-2 text-white">{{ _('Defend yourself.') }}</h1> </div> <div class="row"> - <h1 class="mx-auto defend text-white">Protect yourself against tracking, surveillance, and censorship. </h1> + <h1 class="mx-auto defend text-white">{{ _('Protect yourself against tracking, surveillance, and censorship.') }}</h1> </div> <div class="row p-5 mx-auto"> {% for id, item in bag('platforms+' + this.alt).items() %} @@ -30,9 +30,9 @@ {% endfor %} </div> <div class="row p-5"> - <a class="mx-auto text-white py-3" href="{{ 'languages'|url }}"><u>Download in another language</u></a> - <a class="mx-auto text-white py-3" href="{{ 'options'|url }}"><u>Advanced Install Options</u></a> + <a class="mx-auto text-white py-3" href="{{ 'languages'|url }}"><u>{{ _('Download in another language') }}</u></a> + <a class="mx-auto text-white py-3" href="{{ 'options'|url }}"><u>{{ _('Advanced Install Options') }}</u></a> </div> <div class="hidden-sm row p-5 justify-content-center window-bg"> - <a class="mx-auto text-white p-5" href=""><u>Read the latest release announcements</u></a> + <a class="mx-auto text-white p-5" href=""><u>{{ _('Read the latest release announcements') }}</u></a> </div> diff --git a/templates/macros/jobs.html b/templates/macros/jobs.html index f180ff9..5adad47 100644 --- a/templates/macros/jobs.html +++ b/templates/macros/jobs.html @@ -8,7 +8,7 @@ <div> <div class="card-body"> {{ item.summary }} - <a href="{{ item.path|url }}">Read more.</a> + <a href="{{ item.path|url }}">{{ _('Read more.') }}</a> </div> </div> </div> diff --git a/templates/macros/reports.html b/templates/macros/reports.html index b2d9916..d9ccbe3 100644 --- a/templates/macros/reports.html +++ b/templates/macros/reports.html @@ -2,7 +2,7 @@ <tr> <td>{{ item.title }}</td> <td>{{ item.description }}</td> - <td><a href="{{ item.link }}">View PDF</a></td> + <td><a href="{{ item.link }}">{{ _('View PDF') }}</a></td> </tr> {% endmacro %} @@ -16,6 +16,6 @@ {% endfor %} </td> <td>{{ item.title }}</td> - <td><a href="{{ item.link }}">View PDF</a></td> + <td><a href="{{ item.link }}">{{ _('View PDF') }}</a></td> </tr> {% endmacro %}

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits February 2019