April 2019 - tor-commits - lists.torproject.org

[translation/support-portal] Update translations for support-portal
by translation＠torproject.org 16 Apr '19

16 Apr '19

commit d945707104df3d0079efd1712b223b2f0843a9e3 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Apr 16 17:50:43 2019 +0000 Update translations for support-portal --- contents+it.po | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/contents+it.po b/contents+it.po index 3bfd21396..a83cb6676 100644 --- a/contents+it.po +++ b/contents+it.po @@ -5105,6 +5105,8 @@ msgid "" "Onion services offer advantages over ordinary services on the non-private " "web, including:" msgstr "" +"I servizi Onion offrono vantaggi sui servizi comuni del web pubblico, " +"ovvero:" #: https//support.torproject.org/misc/glossary/ #: (content/misc/glossary/contents+en.lrquestion.description) @@ -5327,7 +5329,7 @@ msgstr "" #: https//support.torproject.org/misc/glossary/ #: (content/misc/glossary/contents+en.lrquestion.description) msgid "This signature can be verified by the public key." -msgstr "" +msgstr "La firma può essere verificata dalla chiave pubblica." #: https//support.torproject.org/misc/glossary/ #: (content/misc/glossary/contents+en.lrquestion.description)

1 0

[tpo/master] Browser versions one per line
by hiro＠torproject.org 16 Apr '19

16 Apr '19

commit 6bb7a1e6090c2c25dcec8da67b492eb0eaf446f1 Author: hiro <hiro(a)torproject.org> Date: Tue Apr 16 19:27:28 2019 +0200 Browser versions one per line --- .../projects/torbrowser/RecommendedTBBVersions/contents.lr | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/content/projects/torbrowser/RecommendedTBBVersions/contents.lr b/content/projects/torbrowser/RecommendedTBBVersions/contents.lr index 56a3483..0ab95b1 100644 --- a/content/projects/torbrowser/RecommendedTBBVersions/contents.lr +++ b/content/projects/torbrowser/RecommendedTBBVersions/contents.lr @@ -4,4 +4,13 @@ _template: empty.html --- body: -["8.0.8", "8.0.8-MacOS", "8.0.8-Linux", "8.0.8-Windows", "8.5a10", "8.5a10-MacOS", "8.5a10-Linux", "8.5a10-Windows"] +[ +"8.0.8", +"8.0.8-MacOS", +"8.0.8-Linux", +"8.0.8-Windows", +"8.5a10", +"8.5a10-MacOS", +"8.5a10-Linux", +"8.5a10-Windows" +]

1 0

[tpo/master] Make other platforms discoverable
by hiro＠torproject.org 16 Apr '19

16 Apr '19

commit 988c3f75e57b33cc44e67be0e9a00826b71a7ef6 Author: Antonela <hola(a)antonela.me> Date: Tue Apr 16 14:16:28 2019 -0300 Make other platforms discoverable #29907 --- templates/hero-download.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/hero-download.html b/templates/hero-download.html index dfe9704..2be2ea6 100644 --- a/templates/hero-download.html +++ b/templates/hero-download.html @@ -39,7 +39,7 @@ </div> </div> <div class="row p-5"> - <a class="mx-auto text-white py-3" href="{{ 'languages'|url(alt=this.alt) }}"><u>{{ _('Download in another language') }}</u></a> + <a class="mx-auto text-white py-3" href="{{ 'languages'|url(alt=this.alt) }}"><u>{{ _('Download in another language or platform') }}</u></a> <a class="mx-auto text-white py-3" href="{{ 'alpha'|url(alt=this.alt) }}"><u>{{ _('Advanced Install Options') }}</u></a> <a class="mx-auto text-white py-3" href="{{ 'tor'|url(alt=this.alt) }}"><u>{{ _('Download Tor Source Code') }}</u></a> </div>

1 0

[tpo/master] Merge remote-tracking branch 'anto/master'
by hiro＠torproject.org 16 Apr '19

16 Apr '19

commit 71faa51259a83a5a0af82b13518aa5da144837de Merge: 984abba 988c3f7 Author: hiro <hiro(a)torproject.org> Date: Tue Apr 16 19:24:04 2019 +0200 Merge remote-tracking branch 'anto/master' templates/hero-download.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[tpo/master] Fix various typos
by hiro＠torproject.org 16 Apr '19

16 Apr '19

commit 984abbacb023ac3e913fa631081d4825ada96ade Author: hiro <hiro(a)torproject.org> Date: Tue Apr 16 19:21:46 2019 +0200 Fix various typos --- content/about/reports/2011-form-pc/contents.lr | 2 +- .../projects/torbrowser/RecommendedTBBVersions/contents.lr | 11 +---------- models/text.ini | 2 +- 3 files changed, 3 insertions(+), 12 deletions(-) diff --git a/content/about/reports/2011-form-pc/contents.lr b/content/about/reports/2011-form-pc/contents.lr index c9181ef..7d5b541 100644 --- a/content/about/reports/2011-form-pc/contents.lr +++ b/content/about/reports/2011-form-pc/contents.lr @@ -6,7 +6,7 @@ date: 2011 --- tags: FISCAL YEAR --- -title: 2011 Steate of MA Form PC +title: 2011 State of MA Form PC --- _hidden: yes --- diff --git a/content/projects/torbrowser/RecommendedTBBVersions/contents.lr b/content/projects/torbrowser/RecommendedTBBVersions/contents.lr index 0ab95b1..56a3483 100644 --- a/content/projects/torbrowser/RecommendedTBBVersions/contents.lr +++ b/content/projects/torbrowser/RecommendedTBBVersions/contents.lr @@ -4,13 +4,4 @@ _template: empty.html --- body: -[ -"8.0.8", -"8.0.8-MacOS", -"8.0.8-Linux", -"8.0.8-Windows", -"8.5a10", -"8.5a10-MacOS", -"8.5a10-Linux", -"8.5a10-Windows" -] +["8.0.8", "8.0.8-MacOS", "8.0.8-Linux", "8.0.8-Windows", "8.5a10", "8.5a10-MacOS", "8.5a10-Linux", "8.5a10-Windows"] diff --git a/models/text.ini b/models/text.ini index 75e24ba..3d57509 100644 --- a/models/text.ini +++ b/models/text.ini @@ -4,4 +4,4 @@ label = Text [fields.body] label = Body -type = text +type = html

1 0

[translation/support-portal] Update translations for support-portal
by translation＠torproject.org 16 Apr '19

16 Apr '19

commit 5146bee325b61a6f804f483ee4e4155f7d6a0fb5 Author: Translation commit bot <translation(a)torproject.org> Date: Tue Apr 16 17:20:37 2019 +0000 Update translations for support-portal --- contents+it.po | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/contents+it.po b/contents+it.po index b9036f5e2..3bfd21396 100644 --- a/contents+it.po +++ b/contents+it.po @@ -2132,7 +2132,7 @@ msgid "" " Browser?" msgstr "" "Posso utilizzare ancora altri browser, come Chrome o Firefox, mentre " -"utilizzo Tor Browser?" +"utilizzo Tor Broswer?" #: https//support.torproject.org/tbb/tbb-5/ #: (content/tbb/tbb-5/contents+en.lrquestion.description) @@ -4995,6 +4995,10 @@ msgid "" "tools for getting around these blocks, including [bridges](#bridge), " "[pluggable transports](#pluggable-transports), and [GetTor](#gettor)." msgstr "" +"A volte l'accesso diretto alla rete Tor potrebbe essere bloccare dal tuo " +"Provider internet o dal governo. Tor include alcuni strumenti di elusione " +"per aggirare questi ostacoli che includono [bridges](#bridge), [pluggable " +"transports](#pluggable-transports), e [GetTor](#gettor)." #: https//support.torproject.org/misc/glossary/ #: (content/misc/glossary/contents+en.lrquestion.description) @@ -5144,6 +5148,8 @@ msgstr "" #: (content/misc/glossary/contents+en.lrquestion.description) msgid "These websites use the .onion Top Level Domain (TLD)." msgstr "" +"Questi siti web utilizzano il dominio di primo livello (Top Level Domain) " +".onion." #: https//support.torproject.org/misc/glossary/ #: (content/misc/glossary/contents+en.lrquestion.description) @@ -5170,6 +5176,10 @@ msgid "" "desktop operating systems are Windows, OS X and Linux. Android and iOS are " "the dominant mobile operating systems." msgstr "" +"Il software di sistema principale che gestisce le risorse hardware e le " +"risorse software e fornisce i servizi comuni per i programmi del computer. I" +" sistemi operativi desktop più usati sono Windows, OS X e Linux. Android e " +"iOS sono i sistemi operativi principali per i telefoni." #: https//support.torproject.org/misc/glossary/ #: (content/misc/glossary/contents+en.lrquestion.description)

1 0

[stem/master] Log thread tracebacks on stderr
by atagar＠torproject.org 16 Apr '19

16 Apr '19

commit 57f38b8af9c1a7c6b48afaa37554a0cc8a2644bf Author: Damian Johnson <atagar(a)torproject.org> Date: Tue Apr 16 10:09:01 2019 -0700 Log thread tracebacks on stderr Damn me! While I was working on this I was careful to print to stderr but then forgot the attribute in the final patch. --- run_tests.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/run_tests.py b/run_tests.py index 6d0951e9..642644c7 100755 --- a/run_tests.py +++ b/run_tests.py @@ -101,7 +101,7 @@ def log_traceback(sig, frame): lines.append(stacktrace) lines.append('=' * 80) - println('\n'.join(lines)) + println('\n'.join(lines), STDERR) # propagate the signal to any multiprocessing children

1 0

[snowflake/master] Merge branch 'ticket30125'
by cohosh＠torproject.org 16 Apr '19

16 Apr '19

commit d11e55aabe3753dbddca18ae084c80ad09e282d3 Merge: d4c5d4e b4a4a25 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Tue Apr 16 12:59:56 2019 -0400 Merge branch 'ticket30125' broker/broker.go | 7 +++ client/snowflake.go | 18 +++--- common/safelog/log.go | 59 +++++++++++++++++++ common/safelog/log_test.go | 140 +++++++++++++++++++++++++++++++++++++++++++++ proxy-go/snowflake.go | 7 ++- server/server.go | 54 +---------------- server/server_test.go | 135 ------------------------------------------- 7 files changed, 224 insertions(+), 196 deletions(-)

1 0

[snowflake/master] Use safelog scrubber in broker and proxy-go
by cohosh＠torproject.org 16 Apr '19

16 Apr '19

commit 482d60d9d36cf8df077b01f30fd2e06f70c82739 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Thu Apr 11 14:47:31 2019 -0400 Use safelog scrubber in broker and proxy-go --- broker/broker.go | 7 +++++++ proxy-go/snowflake.go | 7 ++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/broker/broker.go b/broker/broker.go index b3a255e..7b998f6 100644 --- a/broker/broker.go +++ b/broker/broker.go @@ -10,12 +10,15 @@ import ( "crypto/tls" "flag" "fmt" + "io" "io/ioutil" "log" "net/http" + "os" "strings" "time" + "git.torproject.org/pluggable-transports/snowflake.git/common/safelog" "golang.org/x/crypto/acme/autocert" ) @@ -233,6 +236,10 @@ func main() { flag.BoolVar(&disableTLS, "disable-tls", false, "don't use HTTPS") flag.Parse() + var logOutput io.Writer = os.Stderr + //We want to send the log output through our scrubber first + log.SetOutput(&safelog.LogScrubber{Output: logOutput}) + log.SetFlags(log.LstdFlags | log.LUTC) ctx := NewBrokerContext() diff --git a/proxy-go/snowflake.go b/proxy-go/snowflake.go index 50c20a5..dda9a9a 100644 --- a/proxy-go/snowflake.go +++ b/proxy-go/snowflake.go @@ -18,6 +18,7 @@ import ( "sync" "time" + "git.torproject.org/pluggable-transports/snowflake.git/common/safelog" "github.com/keroserene/go-webrtc" "golang.org/x/net/websocket" ) @@ -26,6 +27,7 @@ const defaultBrokerURL = "https://snowflake-broker.bamsoftware.com/" const defaultRelayURL = "wss://snowflake.bamsoftware.com/" const defaultSTUNURL = "stun:stun.l.google.com:19302" const pollInterval = 5 * time.Second + //amount of time after sending an SDP answer before the proxy assumes the //client is not going to connect const dataChannelTimeout = time.Minute @@ -380,6 +382,7 @@ func main() { flag.StringVar(&logFilename, "log", "", "log filename") flag.Parse() + var logOutput io.Writer = os.Stderr log.SetFlags(log.LstdFlags | log.LUTC) if logFilename != "" { f, err := os.OpenFile(logFilename, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600) @@ -387,8 +390,10 @@ func main() { log.Fatal(err) } defer f.Close() - log.SetOutput(io.MultiWriter(os.Stderr, f)) + logOutput = io.MultiWriter(os.Stderr, f) } + //We want to send the log output through our scrubber first + log.SetOutput(&safelog.LogScrubber{Output: logOutput}) log.Println("starting")

1 0

[snowflake/master] Refactored server log scrubber into package
by cohosh＠torproject.org 16 Apr '19

16 Apr '19

commit 49042511a3dd8184fe9a5d85d05e8597e0ed21d6 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Thu Apr 11 14:02:18 2019 -0400 Refactored server log scrubber into package The server log scrubbing code from ticket #21304 is now refactored into a safelog package, along with the appropriate tests --- common/safelog/log.go | 59 +++++++++++++++++++ common/safelog/log_test.go | 140 +++++++++++++++++++++++++++++++++++++++++++++ server/server.go | 54 +---------------- server/server_test.go | 135 ------------------------------------------- 4 files changed, 201 insertions(+), 187 deletions(-) diff --git a/common/safelog/log.go b/common/safelog/log.go new file mode 100644 index 0000000..8229584 --- /dev/null +++ b/common/safelog/log.go @@ -0,0 +1,59 @@ +//Package for a safer logging wrapper around the standard logging package + +//import "git.torproject.org/pluggable-transports/snowflake.git/common/safelog" +package safelog + +import ( + "bytes" + "io" + "regexp" +) + +const ipv4Address = `\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}` +const ipv6Address = `(([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?(` + ipv4Address + `))` + + `|(([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?)` +const optionalPort = `(:\d{1,5})?` +const addressPattern = `((` + ipv4Address + `)|(\[(` + ipv6Address + `)\])|(` + ipv6Address + `))` + optionalPort +const fullAddrPattern = `(^|\s|[^\w:])` + addressPattern + `(\s|(:\s)|[^\w:]|$)` + +var scrubberPatterns = []*regexp.Regexp{ + regexp.MustCompile(fullAddrPattern), +} + +var addressRegexp = regexp.MustCompile(addressPattern) + +// An io.Writer that can be used as the output for a logger that first +// sanitizes logs and then writes to the provided io.Writer +type LogScrubber struct { + Output io.Writer + buffer []byte +} + +func scrub(b []byte) []byte { + scrubbedBytes := b + for _, pattern := range scrubberPatterns { + // this is a workaround since go does not yet support look ahead or look + // behind for regular expressions. + scrubbedBytes = pattern.ReplaceAllFunc(scrubbedBytes, func(b []byte) []byte { + return addressRegexp.ReplaceAll(b, []byte("[scrubbed]")) + }) + } + return scrubbedBytes +} + +func (ls *LogScrubber) Write(b []byte) (n int, err error) { + n = len(b) + ls.buffer = append(ls.buffer, b...) + for { + i := bytes.LastIndexByte(ls.buffer, '\n') + if i == -1 { + return + } + fullLines := ls.buffer[:i+1] + _, err = ls.Output.Write(scrub(fullLines)) + if err != nil { + return + } + ls.buffer = ls.buffer[i+1:] + } +} diff --git a/common/safelog/log_test.go b/common/safelog/log_test.go new file mode 100644 index 0000000..0f342de --- /dev/null +++ b/common/safelog/log_test.go @@ -0,0 +1,140 @@ +package safelog + +import ( + "bytes" + "log" + "testing" +) + +//Check to make sure that addresses split across calls to write are still scrubbed +func TestLogScrubberSplit(t *testing.T) { + input := []byte("test\nhttp2: panic serving [2620:101:f000:780:9097:75b1:519f:dbb8]:58344: interface conversion: *http2.responseWriter is not http.Hijacker: missing method Hijack\n") + + expected := "test\nhttp2: panic serving [scrubbed]: interface conversion: *http2.responseWriter is not http.Hijacker: missing method Hijack\n" + + var buff bytes.Buffer + scrubber := &LogScrubber{Output: &buff} + n, err := scrubber.Write(input[:12]) //test\nhttp2: + if n != 12 { + t.Errorf("wrong number of bytes %d", n) + } + if err != nil { + t.Errorf("%q", err) + } + if buff.String() != "test\n" { + t.Errorf("Got %q, expected %q", buff.String(), "test\n") + } + + n, err = scrubber.Write(input[12:30]) //panic serving [2620:101:f + if n != 18 { + t.Errorf("wrong number of bytes %d", n) + } + if err != nil { + t.Errorf("%q", err) + } + if buff.String() != "test\n" { + t.Errorf("Got %q, expected %q", buff.String(), "test\n") + } + + n, err = scrubber.Write(input[30:]) //000:780:9097:75b1:519f:dbb8]:58344: interface conversion: *http2.responseWriter is not http.Hijacker: missing method Hijack\n + if n != (len(input) - 30) { + t.Errorf("wrong number of bytes %d", n) + } + if err != nil { + t.Errorf("%q", err) + } + if buff.String() != expected { + t.Errorf("Got %q, expected %q", buff.String(), expected) + } + +} + +//Test the log scrubber on known problematic log messages +func TestLogScrubberMessages(t *testing.T) { + for _, test := range []struct { + input, expected string + }{ + { + "http: TLS handshake error from 129.97.208.23:38310: ", + "http: TLS handshake error from [scrubbed]: \n", + }, + { + "http2: panic serving [2620:101:f000:780:9097:75b1:519f:dbb8]:58344: interface conversion: *http2.responseWriter is not http.Hijacker: missing method Hijack", + "http2: panic serving [scrubbed]: interface conversion: *http2.responseWriter is not http.Hijacker: missing method Hijack\n", + }, + { + //Make sure it doesn't scrub fingerprint + "a=fingerprint:sha-256 33:B6:FA:F6:94:CA:74:61:45:4A:D2:1F:2C:2F:75:8A:D9:EB:23:34:B2:30:E9:1B:2A:A6:A9:E0:44:72:CC:74", + "a=fingerprint:sha-256 33:B6:FA:F6:94:CA:74:61:45:4A:D2:1F:2C:2F:75:8A:D9:EB:23:34:B2:30:E9:1B:2A:A6:A9:E0:44:72:CC:74\n", + }, + { + //try with enclosing parens + "(1:2:3:4:c:d:e:f) {1:2:3:4:c:d:e:f}", + "([scrubbed]) {[scrubbed]}\n", + }, + } { + var buff bytes.Buffer + log.SetFlags(0) //remove all extra log output for test comparisons + log.SetOutput(&LogScrubber{Output: &buff}) + log.Print(test.input) + if buff.String() != test.expected { + t.Errorf("%q: got %q, expected %q", test.input, buff.String(), test.expected) + } + } + +} + +func TestLogScrubberGoodFormats(t *testing.T) { + for _, addr := range []string{ + // IPv4 + "1.2.3.4", + "255.255.255.255", + // IPv4 with port + "1.2.3.4:55", + "255.255.255.255:65535", + // IPv6 + "1:2:3:4:c:d:e:f", + "1111:2222:3333:4444:CCCC:DDDD:EEEE:FFFF", + // IPv6 with brackets + "[1:2:3:4:c:d:e:f]", + "[1111:2222:3333:4444:CCCC:DDDD:EEEE:FFFF]", + // IPv6 with brackets and port + "[1:2:3:4:c:d:e:f]:55", + "[1111:2222:3333:4444:CCCC:DDDD:EEEE:FFFF]:65535", + // compressed IPv6 + "::d:e:f", + "1:2:3::", + "1:2:3::d:e:f", + "1111:2222:3333::DDDD:EEEE:FFFF", + // compressed IPv6 with brackets + "[::d:e:f]", + "[1:2:3::]", + "[1:2:3::d:e:f]", + "[1111:2222:3333::DDDD:EEEE:FFFF]", + "[1:2:3:4:5:6::8]", + "[1::7:8]", + // compressed IPv6 with brackets and port + "[1::]:58344", + "[::d:e:f]:55", + "[1:2:3::]:55", + "[1:2:3::d:e:f]:55", + "[1111:2222:3333::DDDD:EEEE:FFFF]:65535", + // IPv4-compatible and IPv4-mapped + "::255.255.255.255", + "::ffff:255.255.255.255", + "[::255.255.255.255]", + "[::ffff:255.255.255.255]", + "[::255.255.255.255]:65535", + "[::ffff:255.255.255.255]:65535", + "[::ffff:0:255.255.255.255]", + "[2001:db8:3:4::192.0.2.33]", + } { + var buff bytes.Buffer + log.SetFlags(0) //remove all extra log output for test comparisons + log.SetOutput(&LogScrubber{Output: &buff}) + log.Print(addr) + if buff.String() != "[scrubbed]\n" { + t.Errorf("%q: Got %q, expected %q", addr, buff.String(), "[scrubbed]\n") + } + } +} diff --git a/server/server.go b/server/server.go index e6b6f10..cb58efa 100644 --- a/server/server.go +++ b/server/server.go @@ -3,7 +3,6 @@ package main import ( - "bytes" "crypto/tls" "errors" "flag" @@ -16,13 +15,13 @@ import ( "os" "os/signal" "path/filepath" - "regexp" "strings" "sync" "syscall" "time" "git.torproject.org/pluggable-transports/goptlib.git" + "git.torproject.org/pluggable-transports/snowflake.git/common/safelog" "git.torproject.org/pluggable-transports/websocket.git/websocket" "golang.org/x/crypto/acme/autocert" "golang.org/x/net/http2" @@ -56,55 +55,6 @@ additional HTTP listener on port 80 to work with ACME. flag.PrintDefaults() } -const ipv4Address = `\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}` -const ipv6Address = `(([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?(` + ipv4Address + `))` + - `|(([0-9a-fA-F]{0,4}:){2,7}([0-9a-fA-F]{0,4})?)` -const optionalPort = `(:\d{1,5})?` -const addressPattern = `((` + ipv4Address + `)|(\[(` + ipv6Address + `)\])|(` + ipv6Address + `))` + optionalPort -const fullAddrPattern = `(^|\s|[^\w:])` + addressPattern + `(\s|(:\s)|[^\w:]|$)` - -var scrubberPatterns = []*regexp.Regexp{ - regexp.MustCompile(fullAddrPattern), -} - -var addressRegexp = regexp.MustCompile(addressPattern) - -// An io.Writer that can be used as the output for a logger that first -// sanitizes logs and then writes to the provided io.Writer -type logScrubber struct { - output io.Writer - buffer []byte -} - -func scrub(b []byte) []byte { - scrubbedBytes := b - for _, pattern := range scrubberPatterns { - // this is a workaround since go does not yet support look ahead or look - // behind for regular expressions. - scrubbedBytes = pattern.ReplaceAllFunc(scrubbedBytes, func(b []byte) []byte { - return addressRegexp.ReplaceAll(b, []byte("[scrubbed]")) - }) - } - return scrubbedBytes -} - -func (ls *logScrubber) Write(b []byte) (n int, err error) { - n = len(b) - ls.buffer = append(ls.buffer, b...) - for { - i := bytes.LastIndexByte(ls.buffer, '\n') - if i == -1 { - return - } - fullLines := ls.buffer[:i+1] - _, err = ls.output.Write(scrub(fullLines)) - if err != nil { - return - } - ls.buffer = ls.buffer[i+1:] - } -} - // An abstraction that makes an underlying WebSocket connection look like an // io.ReadWriteCloser. type webSocketConn struct { @@ -336,7 +286,7 @@ func main() { logOutput = f } //We want to send the log output through our scrubber first - log.SetOutput(&logScrubber{output: logOutput}) + log.SetOutput(&safelog.LogScrubber{Output: logOutput}) if !disableTLS && acmeHostnamesCommas == "" { log.Fatal("the --acme-hostnames option is required") diff --git a/server/server_test.go b/server/server_test.go index fe895d2..84ac7ba 100644 --- a/server/server_test.go +++ b/server/server_test.go @@ -1,8 +1,6 @@ package main import ( - "bytes" - "log" "net" "strconv" "testing" @@ -49,136 +47,3 @@ func TestClientAddr(t *testing.T) { } } } - -//Check to make sure that addresses split across calls to write are still scrubbed -func TestLogScrubberSplit(t *testing.T) { - input := []byte("test\nhttp2: panic serving [2620:101:f000:780:9097:75b1:519f:dbb8]:58344: interface conversion: *http2.responseWriter is not http.Hijacker: missing method Hijack\n") - - expected := "test\nhttp2: panic serving [scrubbed]: interface conversion: *http2.responseWriter is not http.Hijacker: missing method Hijack\n" - - var buff bytes.Buffer - scrubber := &logScrubber{output: &buff} - n, err := scrubber.Write(input[:12]) //test\nhttp2: - if n != 12 { - t.Errorf("wrong number of bytes %d", n) - } - if err != nil { - t.Errorf("%q", err) - } - if buff.String() != "test\n" { - t.Errorf("Got %q, expected %q", buff.String(), "test\n") - } - - n, err = scrubber.Write(input[12:30]) //panic serving [2620:101:f - if n != 18 { - t.Errorf("wrong number of bytes %d", n) - } - if err != nil { - t.Errorf("%q", err) - } - if buff.String() != "test\n" { - t.Errorf("Got %q, expected %q", buff.String(), "test\n") - } - - n, err = scrubber.Write(input[30:]) //000:780:9097:75b1:519f:dbb8]:58344: interface conversion: *http2.responseWriter is not http.Hijacker: missing method Hijack\n - if n != (len(input) - 30) { - t.Errorf("wrong number of bytes %d", n) - } - if err != nil { - t.Errorf("%q", err) - } - if buff.String() != expected { - t.Errorf("Got %q, expected %q", buff.String(), expected) - } - -} - -//Test the log scrubber on known problematic log messages -func TestLogScrubberMessages(t *testing.T) { - for _, test := range []struct { - input, expected string - }{ - { - "http: TLS handshake error from 129.97.208.23:38310: ", - "http: TLS handshake error from [scrubbed]: \n", - }, - { - "http2: panic serving [2620:101:f000:780:9097:75b1:519f:dbb8]:58344: interface conversion: *http2.responseWriter is not http.Hijacker: missing method Hijack", - "http2: panic serving [scrubbed]: interface conversion: *http2.responseWriter is not http.Hijacker: missing method Hijack\n", - }, - { - //Make sure it doesn't scrub fingerprint - "a=fingerprint:sha-256 33:B6:FA:F6:94:CA:74:61:45:4A:D2:1F:2C:2F:75:8A:D9:EB:23:34:B2:30:E9:1B:2A:A6:A9:E0:44:72:CC:74", - "a=fingerprint:sha-256 33:B6:FA:F6:94:CA:74:61:45:4A:D2:1F:2C:2F:75:8A:D9:EB:23:34:B2:30:E9:1B:2A:A6:A9:E0:44:72:CC:74\n", - }, - { - //try with enclosing parens - "(1:2:3:4:c:d:e:f) {1:2:3:4:c:d:e:f}", - "([scrubbed]) {[scrubbed]}\n", - }, - } { - var buff bytes.Buffer - log.SetFlags(0) //remove all extra log output for test comparisons - log.SetOutput(&logScrubber{output: &buff}) - log.Print(test.input) - if buff.String() != test.expected { - t.Errorf("%q: got %q, expected %q", test.input, buff.String(), test.expected) - } - } - -} - -func TestLogScrubberGoodFormats(t *testing.T) { - for _, addr := range []string{ - // IPv4 - "1.2.3.4", - "255.255.255.255", - // IPv4 with port - "1.2.3.4:55", - "255.255.255.255:65535", - // IPv6 - "1:2:3:4:c:d:e:f", - "1111:2222:3333:4444:CCCC:DDDD:EEEE:FFFF", - // IPv6 with brackets - "[1:2:3:4:c:d:e:f]", - "[1111:2222:3333:4444:CCCC:DDDD:EEEE:FFFF]", - // IPv6 with brackets and port - "[1:2:3:4:c:d:e:f]:55", - "[1111:2222:3333:4444:CCCC:DDDD:EEEE:FFFF]:65535", - // compressed IPv6 - "::d:e:f", - "1:2:3::", - "1:2:3::d:e:f", - "1111:2222:3333::DDDD:EEEE:FFFF", - // compressed IPv6 with brackets - "[::d:e:f]", - "[1:2:3::]", - "[1:2:3::d:e:f]", - "[1111:2222:3333::DDDD:EEEE:FFFF]", - "[1:2:3:4:5:6::8]", - "[1::7:8]", - // compressed IPv6 with brackets and port - "[1::]:58344", - "[::d:e:f]:55", - "[1:2:3::]:55", - "[1:2:3::d:e:f]:55", - "[1111:2222:3333::DDDD:EEEE:FFFF]:65535", - // IPv4-compatible and IPv4-mapped - "::255.255.255.255", - "::ffff:255.255.255.255", - "[::255.255.255.255]", - "[::ffff:255.255.255.255]", - "[::255.255.255.255]:65535", - "[::ffff:255.255.255.255]:65535", - "[::ffff:0:255.255.255.255]", - "[2001:db8:3:4::192.0.2.33]", - } { - var buff bytes.Buffer - log.SetFlags(0) //remove all extra log output for test comparisons - log.SetOutput(&logScrubber{output: &buff}) - log.Print(addr) - if buff.String() != "[scrubbed]\n" { - t.Errorf("%q: Got %q, expected %q", addr, buff.String(), "[scrubbed]\n") - } - } -}

1 0