tor-commits February 2019

tor-commits@lists.torproject.org

16 participants
1788 discussions

[translation/support-portal] Update translations for support-portal
by translation＠torproject.org 02 Feb '19

02 Feb '19

commit d15135a8dd0dccd53ea435d7d291d0162704ea1b Author: Translation commit bot <translation(a)torproject.org> Date: Sat Feb 2 18:49:56 2019 +0000 Update translations for support-portal --- contents+es-AR.po | 46 +++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 45 insertions(+), 1 deletion(-) diff --git a/contents+es-AR.po b/contents+es-AR.po index c5cc514bd..36b433290 100644 --- a/contents+es-AR.po +++ b/contents+es-AR.po @@ -1287,6 +1287,14 @@ msgid "" "not clear any private information or unlink your activity, nor does it " "affect your current connections to other websites." msgstr "" +"Esta opción es útil si la [salida](#exit) que estás usando es incapaz de " +"conectar al sitio web que requerís, o no lo está cargando apropiadamente. " +"Seleccionándola causará que la pestaña o ventana actualmente activa sea " +"recargada sobre un nuevo [circuito Tor](#circuit). Otras pestañas y ventanas" +" abiertas desde el mismo sitio web usarán también el nuevo circuito, una vez" +" que sean recargadas. Esta opción no limpia ninguna información privada o " +"desvincula tu actividad, ni tampoco afecta tus conexiones actuales a otros " +"sitios web." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1306,6 +1314,12 @@ msgid "" "tools for getting around these blocks, including [bridges](#bridge), " "[pluggable transports](#pluggable-transports), and [GetTor](#gettor)." msgstr "" +"A veces, el acceso directo a la [red de Tor](#tor-/-tor-network/-core-tor) " +"es bloqueado pot tu [Proveedor de Servicio de Internet (ISP)](#internet-" +"service-provider-isp) o por un gobierno. El navegador Tor incluye algunas " +"herramientas de elusión para evitar estos obstáculos, tales como " +"[puentes](#bridge), [transportes conectables](#pluggable-transports), y " +"[GetTor](#gettor)." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1324,6 +1338,11 @@ msgid "" "the window, which allows you to control the [JavaScript](#javascript)that " "runs on individual web pages, or to block it entirely." msgstr "" +"El [navegador Tor](#tor-browser) incluye una [adición](#add-on-extension-or-" +"plugin) llamada NoScript, accedida a través del icono \"S\" en la esquina " +"superior derecha de la ventana, la cual te permite controlar al " +"[JavaScript](#javascript) que corre en páginas web individuales, o " +"bloquearlo por entero." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1342,6 +1361,11 @@ msgid "" "for command-line usage. This is a tool for monitoring the core Tor process " "on a system, often useful for relay operators." msgstr "" +"El monitor de [relevo](#relay) de anonimato (antiguamente arm, ahora nyx) es" +" un monitor de estado ejecutado en terminal para [Tor](#tor-/-tor-network" +"/-core-tor), para ser usado mediante línea de commandos. Esta es una " +"herramienta para monitorear el proceso Tor principal en un sistema, a menudo" +" útil para operadores de relevo." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1367,6 +1391,10 @@ msgid "" " it does not look like Tor or any other protocol. Obfs3 bridges will work in" " most places." msgstr "" +"Obfs3 es un [transporte conectable](#pluggable-transports) que hace que el " +"[tráfico](#traffic) [Tor](#tor-/-tor-network/-core-tor) parezca aleatorio, " +"de manera que no luzca como Tor o cualquier otro protocolo. Los puentes " +"Obfs3 funcionarán en la mayoría de los lugares." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1385,6 +1413,11 @@ msgid "" "obfs3, and also prevents censors from finding bridges by Internet scanning. " "Obfs4 bridges are less likely to be blocked than obfs3 [bridges](#bridge)." msgstr "" +"Obfs4 es un [transporte conectable](#pluggable-transports) que hace que el " +"[tráfico](#traffic) [Tor](#tor-/-tor-network/-core-tor) parezca aleatorio, " +"como obfs3, y también evita que los censores encuentren puentes mediante el " +"escaneo de Internet. Los puentes Obfs4 son menos probables de ser bloqueados" +" que los [puentes](#bridge) obfs3." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1401,6 +1434,9 @@ msgid "" "A standardized internet domain name used by onion services that ends in " ".onion and is designed to be [self-authenticating](#self-authenticating)." msgstr "" +"Un nombre de dominio de internet estandarizado usado por servicios onion que" +" termina en .onion, y está diseñado para ser [auto autenticante](#self-" +"authenticating)." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1418,6 +1454,9 @@ msgid "" " observation network for detecting [censorship](#network-censorship), " "surveillance and [traffic](#traffic) manipulation on the internet." msgstr "" +"OONI significa \"Observatorio Abierto de Interferencia de Red\", es una red " +"global de observación para detección de la [censura de red](#network-" +"censorship), vigilancia y manipulación de [tráfico](#traffic) en internet." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1435,6 +1474,9 @@ msgid "" " services (like websites) that are only accessible through the [Tor " "network](#tor-/-tor-network/-core-tor)." msgstr "" +"Servicios onion (antiguamente conocidos como “[servicios ocultos](#hidden-" +"services)”) son servicios (como sitios web) que solamente son accesibles a " +"través de la [red de Tor](#tor-/-tor-network/-core-tor)." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1444,13 +1486,15 @@ msgid "" "Onion services offer advantages over ordinary services on the non-private " "web, including:" msgstr "" +"Los servicios onion ofrecen ventajas sobre los servicios ordinarios en la " +"web abierta, incluyendo:" #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) #: https//support.torproject.org/misc/tor-glossary/ #: (content/misc/glossary/contents+en.lrquestion.description) msgid "* hidden location and [IP address](#ip-address)" -msgstr "" +msgstr "* ubicación y [dirección IP](#ip-address) ocultas" #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description)

1 0

[translation/support-portal] Update translations for support-portal
by translation＠torproject.org 02 Feb '19

02 Feb '19

commit 95d76004cb0c177f6a6160c9e773c32cb979c2bf Author: Translation commit bot <translation(a)torproject.org> Date: Sat Feb 2 13:50:02 2019 +0000 Update translations for support-portal --- contents+es-AR.po | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/contents+es-AR.po b/contents+es-AR.po index fb18077ae..c5cc514bd 100644 --- a/contents+es-AR.po +++ b/contents+es-AR.po @@ -1034,6 +1034,9 @@ msgid "" " for accessing and using the Internet. When using [Tor Browser](#tor-" "browser), your ISP cannot see what websites you're visiting." msgstr "" +"Un proveedor de servicio de Internet (ISP) es una organización que provee " +"servicios para acceder y usar Internet. Al usar el [navegador Tor](#tor-" +"browser), tu ISP no puede ver que sitios web estás visitando." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1052,6 +1055,10 @@ msgid "" " participating in a computer network that uses the Internet Protocol for " "communication." msgstr "" +"Una dirección de Protocolo de Internet (dirección IP) es una etiqueta " +"numérica (o alfanumérica en el caso de IPv6) asignada a cada dispositivo " +"(ej., computadora, impresora) participando en una red que usa el Protocolo " +"de Internet para comunicación." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1061,6 +1068,8 @@ msgid "" "IP addresses are the location address of the device, similar to the " "addresses of physical locations." msgstr "" +"Las direcciones IP son la dirección de ubicación del dispositivo, similares " +"a las direcciones de ubicaciones físicas." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1070,6 +1079,8 @@ msgid "" "[Tor Browser](#tor-browser) obscures your location by making it look like " "your [traffic](#traffic) is coming from an IP address that is not your own." msgstr "" +"El [navegador Tor](#tor-browser) ofusca tu ubicación al hacer que parezca " +"que tu [tráfico](#traffic) viene desde una dirección IP que no es la tuya." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1098,6 +1109,13 @@ msgid "" "Browser](#tor-browser) can be used to manage Javascript on different " "websites." msgstr "" +"JavaScript es un lenguaje de programación que los sitios web utilizan para " +"ofrecer elementos interactivos, tales como video, animación, audio, y líneas" +" temporales de estado. Desafortunadamente, JavaScript también puede permitir" +" ataques a la seguridad del [navegador web](#web-browser), las cuales " +"pudieran conducir a la pérdida del anonimato. La [extensión](#add-on-" +"extension-or-plugin) [NoScript](#noscript) en el [navegador Tor](#tor-" +"browser) puede ser usada para gestionar Javascript en diferentes sitios web." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1156,6 +1174,12 @@ msgid "" "Services; meek-azure makes it look like you are using a Microsoft web site; " "and meek-google makes it look like you are using Google search." msgstr "" +"Estos [transportes conectables](#pluggable-transports) hacen que parezca que" +" vos estás navegando un sitio web de envergadura, en vez de estar usando " +"[Tor](#tor-/-tor-network/-core-tor). Meek-amazon hace que parezca que estás " +"usando Amazon Web Services; meek-azure hace que parezca que estás usando un " +"sitio web de Microsoft; y meek-google hace que parezca que estás usando " +"búsqueda de Google." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1173,6 +1197,9 @@ msgid "" "function as either a \"middle\" or a \"[guard](#guard)\" for different " "users." msgstr "" +"La posición media en el [circuito Tor](#circuit). Los relevos que no son de " +"salida pueden funcionar tanto como \"medio\" o como \"[guarda](#guard)\" " +"para diferentes usuarios." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1197,6 +1224,9 @@ msgid "" " your subsequent browser activity from being linkable to what you were doing" " before." msgstr "" +"Nueva Identidad es una característica del [navegador Tor](#tor-browser), " +"usada si querés evitar que la subsecuente actividad de tu navegador sea " +"vinculable a lo que estabas haciendo antes." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1207,6 +1237,10 @@ msgid "" "information such as [cookies](#cookie) and [browsing history](#browsing-" "history), and use New [Tor circuits](#circuit) for all connections." msgstr "" +"Seleccionándola, se cerrarán todas las pestañas y ventanas abiertas, se " +"limpiará toda información privada tales como [cookies](#cookie) e [historial" +" de navegación](#browsing-history), y se usarán Nuevos [circuitos " +"Tor](#circuit) para todas las conexiones." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1216,6 +1250,9 @@ msgid "" "Tor Browser will warn you that all activity and downloads will be stopped, " "so take this into account before clicking “New Identity”." msgstr "" +"El navegador Tor te va a advertir que todas las actividades y descargas " +"serán paradas, de manera que tené esto en cuenta antes de cliquear \"Nueva " +"Identidad\"." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description) @@ -1226,6 +1263,9 @@ msgid "" "particular site, similarly to \"[New Tor Circuit for this Site](#new-tor-" "circuit-for-this-site)\"." msgstr "" +"Nueva Identidad puede ayudar también si el navegador Tor está teniendo " +"dificultad en conectarse a un sitio particular, similarmente a \"[Nuevo " +"Circuito Tor para éste Sitio](#new-tor-circuit-for-this-site)\"." #: https//support.torproject.org/glossary/ #: (content/glossary/contents+en.lrquestion.description)

1 0

[meek/utls_2] Don't set the helper proxy when not using the helper.
by dcf＠torproject.org 02 Feb '19

02 Feb '19

commit 68221fd260c5989ebdbdd0e0a596c5c162fa0efd Author: David Fifield <david(a)bamsoftware.com> Date: Fri Feb 1 01:59:35 2019 -0700 Don't set the helper proxy when not using the helper. It causes an error when it uses something unsupported, like username:password. This was a regression added in 3fe68658f433adb2b8bec215d4daf48e81003cf7. --- meek-client/meek-client.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/meek-client/meek-client.go b/meek-client/meek-client.go index d773dcb..11c26d2 100644 --- a/meek-client/meek-client.go +++ b/meek-client/meek-client.go @@ -461,10 +461,12 @@ func main() { } log.Printf("using proxy %s", options.ProxyURL.String()) httpRoundTripper.Proxy = http.ProxyURL(options.ProxyURL) - err = helperRoundTripper.SetProxy(options.ProxyURL) - if err != nil { - pt.ProxyError(err.Error()) - log.Fatal(fmt.Sprintf("proxy error: %s", err)) + if options.UseHelper { + err = helperRoundTripper.SetProxy(options.ProxyURL) + if err != nil { + pt.ProxyError(err.Error()) + log.Fatal(fmt.Sprintf("proxy error: %s", err)) + } } if ptInfo.ProxyURL != nil { pt.ProxyDone()

1 0

[meek/utls_2] Have NewUTLSRoundTripper take a *utls.Config.
by dcf＠torproject.org 02 Feb '19

02 Feb '19

commit 36b58407a8d8376df2adc6c371d74c09e2b0a417 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Feb 2 00:04:25 2019 -0700 Have NewUTLSRoundTripper take a *utls.Config. Plan to use this for testing. --- meek-client/meek-client.go | 2 +- meek-client/utls.go | 25 +++++++++++++++++++------ 2 files changed, 20 insertions(+), 7 deletions(-) diff --git a/meek-client/meek-client.go b/meek-client/meek-client.go index 11c26d2..462eeb3 100644 --- a/meek-client/meek-client.go +++ b/meek-client/meek-client.go @@ -323,7 +323,7 @@ func handler(conn *pt.SocksConn) error { } info.RoundTripper = helperRoundTripper } else if utlsOK { - info.RoundTripper, err = NewUTLSRoundTripper(utlsName) + info.RoundTripper, err = NewUTLSRoundTripper(utlsName, nil) if err != nil { return err } diff --git a/meek-client/utls.go b/meek-client/utls.go index 832b3d6..bb288f7 100644 --- a/meek-client/utls.go +++ b/meek-client/utls.go @@ -94,7 +94,12 @@ func dialUTLS(network, addr string, cfg *utls.Config, clientHelloID *utls.Client if err != nil { return nil, err } + serverName, _, err := net.SplitHostPort(addr) + if err != nil { + return nil, err + } uconn := utls.UClient(conn, cfg, *clientHelloID) + uconn.SetSNI(serverName) err = uconn.Handshake() if err != nil { return nil, err @@ -110,6 +115,7 @@ type UTLSRoundTripper struct { sync.Mutex clientHelloID *utls.ClientHelloID + config *utls.Config rt http.RoundTripper } @@ -130,7 +136,7 @@ func (rt *UTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) // On the first call, make an http.Transport or http2.Transport // as appropriate. var err error - rt.rt, err = makeRoundTripper(req, rt.clientHelloID) + rt.rt, err = makeRoundTripper(req, rt.clientHelloID, rt.config) if err != nil { return nil, err } @@ -139,13 +145,19 @@ func (rt *UTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) return rt.rt.RoundTrip(req) } -func makeRoundTripper(req *http.Request, clientHelloID *utls.ClientHelloID) (http.RoundTripper, error) { +func makeRoundTripper(req *http.Request, clientHelloID *utls.ClientHelloID, cfg *utls.Config) (http.RoundTripper, error) { addr, err := addrForDial(req.URL) if err != nil { return nil, err } - cfg := &utls.Config{ServerName: req.URL.Hostname()} - bootstrapConn, err := dialUTLS("tcp", addr, cfg, clientHelloID) + + // Connect to the given address and initiate a TLS handshake using + // the given ClientHelloID. Return the resulting connection. + dial := func(network, addr string) (*utls.UConn, error) { + return dialUTLS(network, addr, cfg, clientHelloID) + } + + bootstrapConn, err := dial("tcp", addr) if err != nil { return nil, err } @@ -169,7 +181,7 @@ func makeRoundTripper(req *http.Request, clientHelloID *utls.ClientHelloID) (htt } // Later dials make a new connection. - uconn, err := dialUTLS(network, addr, cfg, clientHelloID) + uconn, err := dial(network, addr) if err != nil { return nil, err } @@ -225,7 +237,7 @@ var clientHelloIDMap = map[string]*utls.ClientHelloID{ "helloios_11_1": &utls.HelloIOS_11_1, } -func NewUTLSRoundTripper(name string) (http.RoundTripper, error) { +func NewUTLSRoundTripper(name string, cfg *utls.Config) (http.RoundTripper, error) { // Lookup is case-insensitive. clientHelloID, ok := clientHelloIDMap[strings.ToLower(name)] if !ok { @@ -237,5 +249,6 @@ func NewUTLSRoundTripper(name string) (http.RoundTripper, error) { } return &UTLSRoundTripper{ clientHelloID: clientHelloID, + config: cfg, }, nil }

1 0

[meek/utls_2] Have makeRoundTripper take a URL, not a whole Request.
by dcf＠torproject.org 02 Feb '19

02 Feb '19

commit 24b8bac89e1941041bc826b2a7161e229ea73fc1 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Feb 2 01:51:28 2019 -0700 Have makeRoundTripper take a URL, not a whole Request. --- meek-client/utls.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/meek-client/utls.go b/meek-client/utls.go index bb288f7..7372c20 100644 --- a/meek-client/utls.go +++ b/meek-client/utls.go @@ -136,7 +136,7 @@ func (rt *UTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) // On the first call, make an http.Transport or http2.Transport // as appropriate. var err error - rt.rt, err = makeRoundTripper(req, rt.clientHelloID, rt.config) + rt.rt, err = makeRoundTripper(req.URL, rt.clientHelloID, rt.config) if err != nil { return nil, err } @@ -145,8 +145,8 @@ func (rt *UTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) return rt.rt.RoundTrip(req) } -func makeRoundTripper(req *http.Request, clientHelloID *utls.ClientHelloID, cfg *utls.Config) (http.RoundTripper, error) { - addr, err := addrForDial(req.URL) +func makeRoundTripper(url *url.URL, clientHelloID *utls.ClientHelloID, cfg *utls.Config) (http.RoundTripper, error) { + addr, err := addrForDial(url) if err != nil { return nil, err }

1 0

[meek/utls_2] Also recognize utls=none.
by dcf＠torproject.org 02 Feb '19

02 Feb '19

commit 81e4a15deaa8eccb797335b9ca84c1b17f8bdd41 Author: David Fifield <david(a)bamsoftware.com> Date: Thu Jan 31 10:50:48 2019 -0700 Also recognize utls=none. https://bugs.torproject.org/29077#comment:13 --- doc/meek-client.1 | 2 +- doc/meek-client.1.txt | 3 ++- meek-client/utls.go | 3 ++- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/doc/meek-client.1 b/doc/meek-client.1 index 4e44056..1ca6640 100644 --- a/doc/meek-client.1 +++ b/doc/meek-client.1 @@ -197,7 +197,7 @@ HelloIOS_11_1 HelloIOS_Auto .RE .sp -As a special case, the value HelloGolang is recognized as an alias for omitting the +As a special case, the values "none" and "HelloGolang" are recognized as aliases for omitting the \fButls\fR SOCKS arg; i\&.e\&., use native Go TLS\&. .RE diff --git a/doc/meek-client.1.txt b/doc/meek-client.1.txt index fc2303e..89d1265 100644 --- a/doc/meek-client.1.txt +++ b/doc/meek-client.1.txt @@ -64,7 +64,8 @@ The possible values of __CLIENTHELLOID__ are: - HelloIOS_11_1 - HelloIOS_Auto -As a special case, the value HelloGolang is recognized as an alias for +As a special case, the values "none" and "HelloGolang" +are recognized as aliases for omitting the **utls** SOCKS arg; i.e., use native Go TLS. -- diff --git a/meek-client/utls.go b/meek-client/utls.go index f64b731..832b3d6 100644 --- a/meek-client/utls.go +++ b/meek-client/utls.go @@ -209,6 +209,7 @@ func makeRoundTripper(req *http.Request, clientHelloID *utls.ClientHelloID) (htt var clientHelloIDMap = map[string]*utls.ClientHelloID{ // No HelloCustom: not useful for external configuration. // No HelloRandomized: doesn't negotiate consistent ALPN. + "none": nil, // special case: disable uTLS "hellogolang": nil, // special case: disable uTLS "hellorandomizedalpn": &utls.HelloRandomizedALPN, "hellorandomizednoalpn": &utls.HelloRandomizedNoALPN, @@ -231,7 +232,7 @@ func NewUTLSRoundTripper(name string) (http.RoundTripper, error) { return nil, fmt.Errorf("no uTLS Client Hello ID named %q", name) } if clientHelloID == nil { - // Special case for HelloGolang. + // Special case for "none" and HelloGolang. return httpRoundTripper, nil } return &UTLSRoundTripper{

1 0

[meek/utls_2] socks5 proxy support for uTLS.
by dcf＠torproject.org 02 Feb '19

02 Feb '19

commit 34f28e8273062c1f6f6fa60f7816dca63a191a5e Author: David Fifield <david(a)bamsoftware.com> Date: Sat Feb 2 01:52:10 2019 -0700 socks5 proxy support for uTLS. --- meek-client/meek-client.go | 2 +- meek-client/utls.go | 59 ++++++++++++++++++++++++++++++++++++---------- 2 files changed, 48 insertions(+), 13 deletions(-) diff --git a/meek-client/meek-client.go b/meek-client/meek-client.go index 462eeb3..5cc889c 100644 --- a/meek-client/meek-client.go +++ b/meek-client/meek-client.go @@ -323,7 +323,7 @@ func handler(conn *pt.SocksConn) error { } info.RoundTripper = helperRoundTripper } else if utlsOK { - info.RoundTripper, err = NewUTLSRoundTripper(utlsName, nil) + info.RoundTripper, err = NewUTLSRoundTripper(utlsName, nil, options.ProxyURL) if err != nil { return err } diff --git a/meek-client/utls.go b/meek-client/utls.go index 7372c20..67cf104 100644 --- a/meek-client/utls.go +++ b/meek-client/utls.go @@ -45,6 +45,7 @@ import ( utls "github.com/refraction-networking/utls" "golang.org/x/net/http2" + "golang.org/x/net/proxy" ) // Copy the public fields (fields for which CanSet is true) from src to dst. @@ -85,12 +86,8 @@ func addrForDial(url *url.URL) (string, error) { // Analogous to tls.Dial. Connect to the given address and initiate a TLS // handshake using the given ClientHelloID, returning the resulting connection. -func dialUTLS(network, addr string, cfg *utls.Config, clientHelloID *utls.ClientHelloID) (*utls.UConn, error) { - if options.ProxyURL != nil { - return nil, fmt.Errorf("no proxy allowed with uTLS") - } - - conn, err := net.Dial(network, addr) +func dialUTLS(network, addr string, cfg *utls.Config, clientHelloID *utls.ClientHelloID, forward proxy.Dialer) (*utls.UConn, error) { + conn, err := forward.Dial(network, addr) if err != nil { return nil, err } @@ -116,6 +113,7 @@ type UTLSRoundTripper struct { clientHelloID *utls.ClientHelloID config *utls.Config + proxyDialer proxy.Dialer rt http.RoundTripper } @@ -136,7 +134,7 @@ func (rt *UTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) // On the first call, make an http.Transport or http2.Transport // as appropriate. var err error - rt.rt, err = makeRoundTripper(req.URL, rt.clientHelloID, rt.config) + rt.rt, err = makeRoundTripper(req.URL, rt.clientHelloID, rt.config, rt.proxyDialer) if err != nil { return nil, err } @@ -145,16 +143,48 @@ func (rt *UTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) return rt.rt.RoundTrip(req) } -func makeRoundTripper(url *url.URL, clientHelloID *utls.ClientHelloID, cfg *utls.Config) (http.RoundTripper, error) { +func makeProxyDialer(proxyURL *url.URL) (proxy.Dialer, error) { + var proxyDialer proxy.Dialer = proxy.Direct + if proxyURL == nil { + return proxyDialer, nil + } + + proxyAddr, err := addrForDial(proxyURL) + if err != nil { + return nil, err + } + + var auth *proxy.Auth + if userpass := proxyURL.User; userpass != nil { + auth = &proxy.Auth{ + User: userpass.Username(), + } + if password, ok := userpass.Password(); ok { + auth.Password = password + } + } + + switch proxyURL.Scheme { + case "socks5": + proxyDialer, err = proxy.SOCKS5("tcp", proxyAddr, auth, proxyDialer) + default: + return nil, fmt.Errorf("cannot use proxy scheme %q with uTLS", proxyURL.Scheme) + } + + return proxyDialer, err +} + +func makeRoundTripper(url *url.URL, clientHelloID *utls.ClientHelloID, cfg *utls.Config, proxyDialer proxy.Dialer) (http.RoundTripper, error) { addr, err := addrForDial(url) if err != nil { return nil, err } - // Connect to the given address and initiate a TLS handshake using - // the given ClientHelloID. Return the resulting connection. + // Connect to the given address, through a proxy if requested, and + // initiate a TLS handshake using the given ClientHelloID. Return the + // resulting connection. dial := func(network, addr string) (*utls.UConn, error) { - return dialUTLS(network, addr, cfg, clientHelloID) + return dialUTLS(network, addr, cfg, clientHelloID, proxyDialer) } bootstrapConn, err := dial("tcp", addr) @@ -237,7 +267,7 @@ var clientHelloIDMap = map[string]*utls.ClientHelloID{ "helloios_11_1": &utls.HelloIOS_11_1, } -func NewUTLSRoundTripper(name string, cfg *utls.Config) (http.RoundTripper, error) { +func NewUTLSRoundTripper(name string, cfg *utls.Config, proxyURL *url.URL) (http.RoundTripper, error) { // Lookup is case-insensitive. clientHelloID, ok := clientHelloIDMap[strings.ToLower(name)] if !ok { @@ -247,8 +277,13 @@ func NewUTLSRoundTripper(name string, cfg *utls.Config) (http.RoundTripper, erro // Special case for "none" and HelloGolang. return httpRoundTripper, nil } + proxyDialer, err := makeProxyDialer(proxyURL) + if err != nil { + return nil, err + } return &UTLSRoundTripper{ clientHelloID: clientHelloID, config: cfg, + proxyDialer: proxyDialer, }, nil }

1 0

[meek/utls_2] http proxy support for uTLS.
by dcf＠torproject.org 02 Feb '19

02 Feb '19

commit dbafd218e275718951915bd0262c46a3c615448c Author: David Fifield <david(a)bamsoftware.com> Date: Thu Jan 31 21:16:42 2019 -0700 http proxy support for uTLS. --- meek-client/proxy_http.go | 76 +++++++++++++++++++++++++++++++++ meek-client/proxy_test.go | 104 ++++++++++++++++++++++++++++++++++++++++++++++ meek-client/utls.go | 2 + 3 files changed, 182 insertions(+) diff --git a/meek-client/proxy_http.go b/meek-client/proxy_http.go new file mode 100644 index 0000000..1136eb2 --- /dev/null +++ b/meek-client/proxy_http.go @@ -0,0 +1,76 @@ +package main + +import ( + "bufio" + "encoding/base64" + "fmt" + "net" + "net/http" + "net/url" + + "golang.org/x/net/proxy" +) + +// https://tools.ietf.org/html/rfc7231#section-4.3.6 +// Conceivably we could also proxy over HTTP/2: +// https://httpwg.org/specs/rfc7540.html#CONNECT +// https://github.com/caddyserver/forwardproxy/blob/05b2092e07f9d10b3803d8fb97… + +type httpProxy struct { + network, addr string + auth *proxy.Auth + forward proxy.Dialer +} + +func (pr *httpProxy) Dial(network, addr string) (net.Conn, error) { + connectReq := &http.Request{ + Method: "CONNECT", + URL: &url.URL{Opaque: addr}, + Host: addr, + Header: make(http.Header), + } + // http.Transport has a ProxyConnectHeader field that we are ignoring + // here. + if pr.auth != nil { + connectReq.Header.Set("Proxy-Authorization", "basic "+ + base64.StdEncoding.EncodeToString([]byte(pr.auth.User+":"+pr.auth.Password))) + } + + conn, err := pr.forward.Dial(pr.network, pr.addr) + if err != nil { + return nil, err + } + + err = connectReq.Write(conn) + if err != nil { + conn.Close() + return nil, err + } + + // The Go stdlib says: "Okay to use and discard buffered reader here, + // because TLS server will not speak until spoken to." + br := bufio.NewReader(conn) + resp, err := http.ReadResponse(br, connectReq) + if br.Buffered() != 0 { + panic(br.Buffered()) + } + if err != nil { + conn.Close() + return nil, err + } + if resp.StatusCode != 200 { + conn.Close() + return nil, fmt.Errorf("proxy server returned %q", resp.Status) + } + + return conn, nil +} + +func ProxyHTTP(network, addr string, auth *proxy.Auth, forward proxy.Dialer) (*httpProxy, error) { + return &httpProxy{ + network: network, + addr: addr, + auth: auth, + forward: forward, + }, nil +} diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go index 5e87e56..783165a 100644 --- a/meek-client/proxy_test.go +++ b/meek-client/proxy_test.go @@ -1,10 +1,21 @@ package main import ( + "bufio" + "net" + "net/http" "net/url" "testing" + + "golang.org/x/net/proxy" ) +const testHost = "test.example" +const testPort = "1234" +const testAddr = testHost + ":" + testPort +const testUsername = "username" +const testPassword = "password" + // Test that addrForDial returns a numeric port number. It needs to be numeric // because we pass it as part of the authority-form URL in HTTP proxy requests. // https://tools.ietf.org/html/rfc7230#section-5.3.3 authority-form @@ -52,3 +63,96 @@ func TestAddrForDial(t *testing.T) { } } } + +// Dial the given address with the given proxy, and return the http.Request that +// the proxy server would have received. +func requestResultingFromDial(makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) { + ch := make(chan *http.Request, 1) + + ln, err := net.Listen("tcp", "127.0.0.1:0") + if err != nil { + return nil, err + } + defer ln.Close() + + go func() { + defer func() { + close(ch) + }() + conn, err := ln.Accept() + if err != nil { + panic(err) + } + defer conn.Close() + br := bufio.NewReader(conn) + req, err := http.ReadRequest(br) + if err != nil { + panic(err) + } + ch <- req + }() + + pr, err := makeProxy(ln.Addr()) + if err != nil { + return nil, err + } + // The Dial fails because the goroutine "server" hangs up. + _, _ = pr.Dial(network, addr) + + return <-ch, nil +} + +// Test that the HTTP proxy client sends a correct request. +func TestProxyHTTPCONNECT(t *testing.T) { + req, err := requestResultingFromDial(func(addr net.Addr) (*httpProxy, error) { + return ProxyHTTP("tcp", addr.String(), nil, proxy.Direct) + }, "tcp", testAddr) + if err != nil { + panic(err) + } + if req.Method != "CONNECT" { + t.Errorf("expected method %q, got %q", "CONNECT", req.Method) + } + if req.URL.Hostname() != testHost || req.URL.Port() != testPort { + t.Errorf("expected URL %q, got %q", testAddr, req.URL.String()) + } + if req.Host != testAddr { + t.Errorf("expected %q, got %q", "Host: "+req.Host, "Host: "+testAddr) + } +} + +// Test that the HTTP proxy client sends authorization credentials. +func TestProxyHTTPProxyAuthorization(t *testing.T) { + auth := &proxy.Auth{ + User: testUsername, + Password: testPassword, + } + req, err := requestResultingFromDial(func(addr net.Addr) (*httpProxy, error) { + return ProxyHTTP("tcp", addr.String(), auth, proxy.Direct) + }, "tcp", testAddr) + if err != nil { + panic(err) + } + pa := req.Header.Get("Proxy-Authorization") + if pa == "" { + t.Fatalf("didn't get a Proxy-Authorization header") + } + // The standard library Request.BasicAuth does parsing of basic + // authentication, but only in the Authorization header, not + // Proxy-Authorization. + newReq := &http.Request{ + Header: http.Header{ + "Authorization": []string{pa}, + }, + } + username, password, ok := newReq.BasicAuth() + if !ok { + panic("shouldn't fail") + } + if username != testUsername { + t.Errorf("expected username %q, got %q", testUsername, username) + } + if password != testPassword { + t.Errorf("expected password %q, got %q", testPassword, password) + } +} diff --git a/meek-client/utls.go b/meek-client/utls.go index 1f9d32d..cbb2aaa 100644 --- a/meek-client/utls.go +++ b/meek-client/utls.go @@ -170,6 +170,8 @@ func makeProxyDialer(proxyURL *url.URL) (proxy.Dialer, error) { switch proxyURL.Scheme { case "socks5": proxyDialer, err = proxy.SOCKS5("tcp", proxyAddr, auth, proxyDialer) + case "http": + proxyDialer, err = ProxyHTTP("tcp", proxyAddr, auth, proxyDialer) default: return nil, fmt.Errorf("cannot use proxy scheme %q with uTLS", proxyURL.Scheme) }

1 0

[meek/utls_2] Make addrForDial's default ports numeric, also recognize http.
by dcf＠torproject.org 02 Feb '19

02 Feb '19

commit 970595f9639dfdee707621932a09b86ed41af4fd Author: David Fifield <david(a)bamsoftware.com> Date: Fri Feb 1 20:19:18 2019 -0700 Make addrForDial's default ports numeric, also recognize http. This is needed for an HTTP proxy. A CONNECT request is host:port but the port can only be numeric. --- meek-client/proxy_test.go | 54 +++++++++++++++++++++++++++++++++++++++++++++++ meek-client/utls.go | 11 ++++++---- 2 files changed, 61 insertions(+), 4 deletions(-) diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go new file mode 100644 index 0000000..5e87e56 --- /dev/null +++ b/meek-client/proxy_test.go @@ -0,0 +1,54 @@ +package main + +import ( + "net/url" + "testing" +) + +// Test that addrForDial returns a numeric port number. It needs to be numeric +// because we pass it as part of the authority-form URL in HTTP proxy requests. +// https://tools.ietf.org/html/rfc7230#section-5.3.3 authority-form +// https://tools.ietf.org/html/rfc3986#section-3.2.3 port +func TestAddrForDial(t *testing.T) { + // good tests + for _, test := range []struct { + URL string + Addr string + }{ + {"http://example.com", "example.com:80"}, + {"http://example.com/", "example.com:80"}, + {"https://example.com/", "example.com:443"}, + {"http://example.com:443/", "example.com:443"}, + {"ftp://example.com:21/", "example.com:21"}, + } { + u, err := url.Parse(test.URL) + if err != nil { + panic(err) + } + addr, err := addrForDial(u) + if err != nil { + t.Errorf("%q → error %v", test.URL, err) + continue + } + if addr != test.Addr { + t.Errorf("%q → %q, expected %q", test.URL, addr, test.Addr) + } + } + + // bad tests + for _, input := range []string{ + "example.com", + "example.com:80", + "ftp://example.com/", + } { + u, err := url.Parse(input) + if err != nil { + panic(err) + } + addr, err := addrForDial(u) + if err == nil { + t.Errorf("%q → %q, expected error", input, addr) + continue + } + } +} diff --git a/meek-client/utls.go b/meek-client/utls.go index 67cf104..1f9d32d 100644 --- a/meek-client/utls.go +++ b/meek-client/utls.go @@ -74,10 +74,13 @@ func addrForDial(url *url.URL) (string, error) { // internationalized domain name to ASCII. port := url.Port() if port == "" { - // No port? Use the default for the scheme. We only care about https. - if url.Scheme == "https" { - port = "https" - } else { + // No port? Use the default for the scheme. + switch url.Scheme { + case "http": + port = "80" + case "https": + port = "443" + default: return "", fmt.Errorf("unsupported URL scheme %q", url.Scheme) } }

1 0

[meek/utls_2] https proxy support for uTLS.
by dcf＠torproject.org 02 Feb '19

02 Feb '19

commit 2b9b67b05f4c4a8f1c97cf78002bca1cc2fdd78e Author: David Fifield <david(a)bamsoftware.com> Date: Fri Feb 1 01:46:07 2019 -0700 https proxy support for uTLS. Tor doesn't support this kind of proxy (https://bugs.torproject.org/26306), but I want to support the same kinds of proxies with uTLS as are supported using the native Go net/http, for ease of explaining the proxy restrictions in the man page. We use the same uTLS ClientHelloID for the TLS connection to the HTTPS proxy, as we use for the TLS connection through the tunnel. --- meek-client/proxy_http.go | 24 +++++++++++++ meek-client/proxy_test.go | 92 ++++++++++++++++++++++++++++++++++++++++++----- meek-client/utls.go | 14 ++++++-- 3 files changed, 119 insertions(+), 11 deletions(-) diff --git a/meek-client/proxy_http.go b/meek-client/proxy_http.go index 1136eb2..933214f 100644 --- a/meek-client/proxy_http.go +++ b/meek-client/proxy_http.go @@ -8,6 +8,7 @@ import ( "net/http" "net/url" + utls "github.com/refraction-networking/utls" "golang.org/x/net/proxy" ) @@ -74,3 +75,26 @@ func ProxyHTTP(network, addr string, auth *proxy.Auth, forward proxy.Dialer) (*h forward: forward, }, nil } + +type UTLSDialer struct { + config *utls.Config + clientHelloID *utls.ClientHelloID + forward proxy.Dialer +} + +func (dialer *UTLSDialer) Dial(network, addr string) (net.Conn, error) { + return dialUTLS(network, addr, dialer.config, dialer.clientHelloID, dialer.forward) +} + +func ProxyHTTPS(network, addr string, auth *proxy.Auth, forward proxy.Dialer, cfg *utls.Config, clientHelloID *utls.ClientHelloID) (*httpProxy, error) { + return &httpProxy{ + network: network, + addr: addr, + auth: auth, + forward: &UTLSDialer{ + config: cfg, + clientHelloID: clientHelloID, + forward: forward, + }, + }, nil +} diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go index 783165a..0b37fb3 100644 --- a/meek-client/proxy_test.go +++ b/meek-client/proxy_test.go @@ -2,11 +2,20 @@ package main import ( "bufio" + "crypto/ecdsa" + "crypto/elliptic" + "crypto/rand" + "crypto/tls" + "crypto/x509" + "crypto/x509/pkix" + "math/big" "net" "net/http" "net/url" "testing" + "time" + utls "github.com/refraction-networking/utls" "golang.org/x/net/proxy" ) @@ -66,15 +75,9 @@ func TestAddrForDial(t *testing.T) { // Dial the given address with the given proxy, and return the http.Request that // the proxy server would have received. -func requestResultingFromDial(makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) { +func requestResultingFromDial(ln net.Listener, makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) { ch := make(chan *http.Request, 1) - ln, err := net.Listen("tcp", "127.0.0.1:0") - if err != nil { - return nil, err - } - defer ln.Close() - go func() { defer func() { close(ch) @@ -102,9 +105,18 @@ func requestResultingFromDial(makeProxy func(addr net.Addr) (*httpProxy, error), return <-ch, nil } +func requestResultingFromDialHTTP(makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) { + ln, err := net.Listen("tcp", "127.0.0.1:0") + if err != nil { + return nil, err + } + defer ln.Close() + return requestResultingFromDial(ln, makeProxy, network, addr) +} + // Test that the HTTP proxy client sends a correct request. func TestProxyHTTPCONNECT(t *testing.T) { - req, err := requestResultingFromDial(func(addr net.Addr) (*httpProxy, error) { + req, err := requestResultingFromDialHTTP(func(addr net.Addr) (*httpProxy, error) { return ProxyHTTP("tcp", addr.String(), nil, proxy.Direct) }, "tcp", testAddr) if err != nil { @@ -127,7 +139,7 @@ func TestProxyHTTPProxyAuthorization(t *testing.T) { User: testUsername, Password: testPassword, } - req, err := requestResultingFromDial(func(addr net.Addr) (*httpProxy, error) { + req, err := requestResultingFromDialHTTP(func(addr net.Addr) (*httpProxy, error) { return ProxyHTTP("tcp", addr.String(), auth, proxy.Direct) }, "tcp", testAddr) if err != nil { @@ -156,3 +168,65 @@ func TestProxyHTTPProxyAuthorization(t *testing.T) { t.Errorf("expected password %q, got %q", testPassword, password) } } + +func requestResultingFromDialHTTPS(makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) { + // Create a TLS listener using a temporary self-signed certificate. + // https://golang.org/src/crypto/tls/generate_cert.go + priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) + if err != nil { + return nil, err + } + + notBefore := time.Now() + notAfter := notBefore.Add(100 * time.Second) + template := x509.Certificate{ + SerialNumber: big.NewInt(123), + Subject: pkix.Name{ + Organization: []string{"Test"}, + }, + NotBefore: notBefore, + NotAfter: notAfter, + KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign, + IsCA: true, + ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, + BasicConstraintsValid: true, + } + + cert, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv) + if err != nil { + return nil, err + } + config := tls.Config{ + Certificates: []tls.Certificate{ + tls.Certificate{ + Certificate: [][]byte{cert}, + PrivateKey: priv, + }, + }, + } + + ln, err := tls.Listen("tcp", "127.0.0.1:0", &config) + if err != nil { + return nil, err + } + defer ln.Close() + return requestResultingFromDial(ln, makeProxy, network, addr) +} + +func TestProxyHTTPSCONNECT(t *testing.T) { + req, err := requestResultingFromDialHTTPS(func(addr net.Addr) (*httpProxy, error) { + return ProxyHTTPS("tcp", addr.String(), nil, proxy.Direct, &utls.Config{InsecureSkipVerify: true}, &utls.HelloFirefox_Auto) + }, "tcp", testAddr) + if err != nil { + panic(err) + } + if req.Method != "CONNECT" { + t.Errorf("expected method %q, got %q", "CONNECT", req.Method) + } + if req.URL.Hostname() != testHost || req.URL.Port() != testPort { + t.Errorf("expected URL %q, got %q", testAddr, req.URL.String()) + } + if req.Host != testAddr { + t.Errorf("expected %q, got %q", "Host: "+req.Host, "Host: "+testAddr) + } +} diff --git a/meek-client/utls.go b/meek-client/utls.go index cbb2aaa..1ea0cd0 100644 --- a/meek-client/utls.go +++ b/meek-client/utls.go @@ -146,7 +146,7 @@ func (rt *UTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) return rt.rt.RoundTrip(req) } -func makeProxyDialer(proxyURL *url.URL) (proxy.Dialer, error) { +func makeProxyDialer(proxyURL *url.URL, cfg *utls.Config, clientHelloID *utls.ClientHelloID) (proxy.Dialer, error) { var proxyDialer proxy.Dialer = proxy.Direct if proxyURL == nil { return proxyDialer, nil @@ -172,6 +172,16 @@ func makeProxyDialer(proxyURL *url.URL) (proxy.Dialer, error) { proxyDialer, err = proxy.SOCKS5("tcp", proxyAddr, auth, proxyDialer) case "http": proxyDialer, err = ProxyHTTP("tcp", proxyAddr, auth, proxyDialer) + case "https": + // We use the same uTLS Config for TLS to the HTTPS proxy, as we + // use for HTTPS connections through the tunnel. We make a clone + // of the Config to avoid concurrent modification as the two + // layers set the ServerName value. + var cfgClone *utls.Config + if cfg != nil { + cfgClone = cfg.Clone() + } + proxyDialer, err = ProxyHTTPS("tcp", proxyAddr, auth, proxyDialer, cfgClone, clientHelloID) default: return nil, fmt.Errorf("cannot use proxy scheme %q with uTLS", proxyURL.Scheme) } @@ -282,7 +292,7 @@ func NewUTLSRoundTripper(name string, cfg *utls.Config, proxyURL *url.URL) (http // Special case for "none" and HelloGolang. return httpRoundTripper, nil } - proxyDialer, err := makeProxyDialer(proxyURL) + proxyDialer, err := makeProxyDialer(proxyURL, cfg, clientHelloID) if err != nil { return nil, err }

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits February 2019