May 2019 - tor-commits - lists.torproject.org

[meek/master] socks5 proxy support for uTLS.
by dcf＠torproject.org 09 May '19

09 May '19

commit 70c28e34dca7125895921c4161033666148dc3f0 Author: David Fifield <david(a)bamsoftware.com> Date: Sat Feb 2 01:52:10 2019 -0700 socks5 proxy support for uTLS. --- meek-client/meek-client.go | 2 +- meek-client/utls.go | 80 ++++++++++++++++++++++++++++++++++++++-------- meek-client/utls_test.go | 49 ++++++++++++++++++++++++++++ 3 files changed, 116 insertions(+), 15 deletions(-) diff --git a/meek-client/meek-client.go b/meek-client/meek-client.go index 74ef2c5..d76ca98 100644 --- a/meek-client/meek-client.go +++ b/meek-client/meek-client.go @@ -325,7 +325,7 @@ func handler(conn *pt.SocksConn) error { } info.RoundTripper = helperRoundTripper } else if utlsOK { - info.RoundTripper, err = NewUTLSRoundTripper(utlsName, nil) + info.RoundTripper, err = NewUTLSRoundTripper(utlsName, nil, options.ProxyURL) if err != nil { return err } diff --git a/meek-client/utls.go b/meek-client/utls.go index e8d0bc0..1cdeca1 100644 --- a/meek-client/utls.go +++ b/meek-client/utls.go @@ -45,6 +45,7 @@ import ( utls "github.com/refraction-networking/utls" "golang.org/x/net/http2" + "golang.org/x/net/proxy" ) // Copy the public fields (fields for which CanSet is true) from src to dst. @@ -88,12 +89,8 @@ func addrForDial(url *url.URL) (string, error) { // Analogous to tls.Dial. Connect to the given address and initiate a TLS // handshake using the given ClientHelloID, returning the resulting connection. -func dialUTLS(network, addr string, cfg *utls.Config, clientHelloID *utls.ClientHelloID) (*utls.UConn, error) { - if options.ProxyURL != nil { - return nil, fmt.Errorf("no proxy allowed with uTLS") - } - - conn, err := net.Dial(network, addr) +func dialUTLS(network, addr string, cfg *utls.Config, clientHelloID *utls.ClientHelloID, forward proxy.Dialer) (*utls.UConn, error) { + conn, err := forward.Dial(network, addr) if err != nil { return nil, err } @@ -121,14 +118,18 @@ type UTLSRoundTripper struct { clientHelloID *utls.ClientHelloID config *utls.Config + proxyDialer proxy.Dialer rt http.RoundTripper + + // Transport for HTTP requests, which don't use uTLS. + httpRT *http.Transport } func (rt *UTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) { switch req.URL.Scheme { case "http": - // If http, we don't invoke uTLS; just pass it to the global http.Transport. - return httpRoundTripper.RoundTrip(req) + // If http, we don't invoke uTLS; just pass it to an ordinary http.Transport. + return rt.httpRT.RoundTrip(req) case "https": default: return nil, fmt.Errorf("unsupported URL scheme %q", req.URL.Scheme) @@ -141,7 +142,7 @@ func (rt *UTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) // On the first call, make an http.Transport or http2.Transport // as appropriate. var err error - rt.rt, err = makeRoundTripper(req.URL, rt.clientHelloID, rt.config) + rt.rt, err = makeRoundTripper(req.URL, rt.clientHelloID, rt.config, rt.proxyDialer) if err != nil { return nil, err } @@ -150,16 +151,52 @@ func (rt *UTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) return rt.rt.RoundTrip(req) } -func makeRoundTripper(url *url.URL, clientHelloID *utls.ClientHelloID, cfg *utls.Config) (http.RoundTripper, error) { +// Unlike when using the native Go net/http (whose built-in proxy support we can +// use by setting Proxy on an http.Transport), and unlike when using the browser +// helper (the browser has its own proxy support), when using uTLS we have to +// craft our own proxy connections. +func makeProxyDialer(proxyURL *url.URL) (proxy.Dialer, error) { + var proxyDialer proxy.Dialer = proxy.Direct + if proxyURL == nil { + return proxyDialer, nil + } + + proxyAddr, err := addrForDial(proxyURL) + if err != nil { + return nil, err + } + + var auth *proxy.Auth + if userpass := proxyURL.User; userpass != nil { + auth = &proxy.Auth{ + User: userpass.Username(), + } + if password, ok := userpass.Password(); ok { + auth.Password = password + } + } + + switch proxyURL.Scheme { + case "socks5": + proxyDialer, err = proxy.SOCKS5("tcp", proxyAddr, auth, proxyDialer) + default: + return nil, fmt.Errorf("cannot use proxy scheme %q with uTLS", proxyURL.Scheme) + } + + return proxyDialer, err +} + +func makeRoundTripper(url *url.URL, clientHelloID *utls.ClientHelloID, cfg *utls.Config, proxyDialer proxy.Dialer) (http.RoundTripper, error) { addr, err := addrForDial(url) if err != nil { return nil, err } - // Connect to the given address and initiate a TLS handshake using - // the given ClientHelloID. Return the resulting connection. + // Connect to the given address, through a proxy if requested, and + // initiate a TLS handshake using the given ClientHelloID. Return the + // resulting connection. dial := func(network, addr string) (*utls.UConn, error) { - return dialUTLS(network, addr, cfg, clientHelloID) + return dialUTLS(network, addr, cfg, clientHelloID, proxyDialer) } bootstrapConn, err := dial("tcp", addr) @@ -243,7 +280,7 @@ var clientHelloIDMap = map[string]*utls.ClientHelloID{ "helloios_11_1": &utls.HelloIOS_11_1, } -func NewUTLSRoundTripper(name string, cfg *utls.Config) (http.RoundTripper, error) { +func NewUTLSRoundTripper(name string, cfg *utls.Config, proxyURL *url.URL) (http.RoundTripper, error) { // Lookup is case-insensitive. clientHelloID, ok := clientHelloIDMap[strings.ToLower(name)] if !ok { @@ -253,8 +290,23 @@ func NewUTLSRoundTripper(name string, cfg *utls.Config) (http.RoundTripper, erro // Special case for "none" and HelloGolang. return httpRoundTripper, nil } + + proxyDialer, err := makeProxyDialer(proxyURL) + if err != nil { + return nil, err + } + + // This special-case RoundTripper is used for HTTP requests, which don't + // use uTLS but should use the specified proxy. + httpRT := &http.Transport{} + copyPublicFields(httpRT, httpRoundTripper) + httpRT.Proxy = http.ProxyURL(proxyURL) + return &UTLSRoundTripper{ clientHelloID: clientHelloID, config: cfg, + proxyDialer: proxyDialer, + // rt will be set in the first call to RoundTrip. + httpRT: httpRT, }, nil } diff --git a/meek-client/utls_test.go b/meek-client/utls_test.go index 2eb72af..0e62dac 100644 --- a/meek-client/utls_test.go +++ b/meek-client/utls_test.go @@ -230,3 +230,52 @@ func TestUTLSServerName(t *testing.T) { t.Errorf("expected \"test.example\" server_name extension with given ServerName and hostname dial") } } + +// Test that HTTP requests (which don't go through the uTLS code path) still use +// any proxy that's configured on the UTLSRoundTripper. +func TestUTLSHTTPWithProxy(t *testing.T) { + // Make a web server that we should *not* be able to reach. + server := &http.Server{ + Handler: http.NotFoundHandler(), + } + serverLn, err := net.Listen("tcp", "127.0.0.1:0") + if err != nil { + panic(err) + } + defer serverLn.Close() + go server.Serve(serverLn) + + // Make a non-functional proxy server. + proxyLn, err := net.Listen("tcp", "127.0.0.1:0") + if err != nil { + panic(err) + } + defer proxyLn.Close() + go func() { + for { + conn, err := proxyLn.Accept() + if err == nil { + conn.Close() // go away + } + } + }() + + // Try to access the web server through the non-functional proxy. + for _, proxyURL := range []url.URL{ + url.URL{Scheme: "socks5", Host: proxyLn.Addr().String()}, + } { + rt, err := NewUTLSRoundTripper("HelloFirefox_63", &utls.Config{InsecureSkipVerify: true}, &proxyURL) + if err != nil { + panic(err) + } + fetchURL := url.URL{Scheme: "http", Host: serverLn.Addr().String()} + req, err := http.NewRequest("GET", fetchURL.String(), nil) + if err != nil { + panic(err) + } + _, err = rt.RoundTrip(req) + if err == nil { + t.Errorf("fetch of %s through %s proxy should have failed", &fetchURL, proxyURL.Scheme) + } + } +}

1 0

[meek/master] Integrate uTLS as an option for TLS camouflage.
by dcf＠torproject.org 09 May '19

09 May '19

commit b8fb876145cda3c14d335a3fc88b5e422a926150 Author: David Fifield <david(a)bamsoftware.com> Date: Tue Jan 22 23:38:26 2019 -0700 Integrate uTLS as an option for TLS camouflage. This adapts a technique that Yawning used in obfs4proxy for meek_lite: https://gitlab.com/yawning/obfs4/commit/4d453dab2120082b00bf6e63ab4aaeeda6b… https://lists.torproject.org/pipermail/tor-dev/2019-January/013633.html It's activated by the new utls= SOCKS arg or --utls command line option. The argument is the name of a uTLS ClientHelloID; e.g., HelloChrome_Auto. We omit HelloCustom (not useful externally), HelloGolang (just don't use utls), and HelloRandomized (may negotiate HTTP/1.1 or HTTP/2 at different times, which is incompatible with the way the integration works). When using HTTP/1, we copy default timeouts etc. from the Go net/http.DefaultTransport. Unfortunately I don't know a way to do the same for HTTP/2. Configuring an http.Transport and then calling http2.ConfigureTransport on it doesn't work; it leads to the same problem of an HTTP/1 client speaking to an HTTP/2 server. We recognize utls=none and utls=HelloGolang as an alias for omitting utls=. This is for compatibility with obfs4proxy meek_lite. https://bugs.torproject.org/29077#comment:13 --- meek-client/meek-client.go | 30 +++++- meek-client/utls.go | 260 +++++++++++++++++++++++++++++++++++++++++++++ meek-client/utls_test.go | 232 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 518 insertions(+), 4 deletions(-) diff --git a/meek-client/meek-client.go b/meek-client/meek-client.go index 73ca214..74ef2c5 100644 --- a/meek-client/meek-client.go +++ b/meek-client/meek-client.go @@ -79,9 +79,9 @@ const ( helperWriteTimeout = 2 * time.Second ) -// We use this RoundTripper to make all our requests when --helper is not -// in effect. We use the defaults, except we take control of the Proxy setting -// (notably, disabling the default ProxyFromEnvironment). +// We use this RoundTripper to make all our requests when neither --helper nor +// utls is in effect. We use the defaults, except we take control of the Proxy +// setting (notably, disabling the default ProxyFromEnvironment). var httpRoundTripper *http.Transport = http.DefaultTransport.(*http.Transport) // We use this RoundTripper when --helper is in effect. @@ -96,6 +96,7 @@ var options struct { Front string ProxyURL *url.URL UseHelper bool + UTLSName string } // RequestInfo encapsulates all the configuration used for a request–response @@ -307,9 +308,29 @@ func handler(conn *pt.SocksConn) error { info.URL.Host = front } - info.RoundTripper = httpRoundTripper + // First check utls= SOCKS arg, then --utls option. + utlsName, utlsOK := conn.Req.Args.Get("utls") + if utlsOK { + } else if options.UTLSName != "" { + utlsName = options.UTLSName + utlsOK = true + } + + // First we check --helper: if it was specified, then we always use the + // helper, and utls is disallowed. Otherwise, we use utls if requested; + // or else fall back to native net/http. if options.UseHelper { + if utlsOK { + return fmt.Errorf("cannot use utls with --helper") + } info.RoundTripper = helperRoundTripper + } else if utlsOK { + info.RoundTripper, err = NewUTLSRoundTripper(utlsName, nil) + if err != nil { + return err + } + } else { + info.RoundTripper = httpRoundTripper } return copyLoop(conn, &info) @@ -387,6 +408,7 @@ func main() { flag.StringVar(&logFilename, "log", "", "name of log file") flag.StringVar(&proxy, "proxy", "", "proxy URL") flag.StringVar(&options.URL, "url", "", "URL to request if no url= SOCKS arg") + flag.StringVar(&options.UTLSName, "utls", "", "uTLS Client Hello ID") flag.Parse() ptInfo, err := pt.ClientSetup(nil) diff --git a/meek-client/utls.go b/meek-client/utls.go new file mode 100644 index 0000000..e8d0bc0 --- /dev/null +++ b/meek-client/utls.go @@ -0,0 +1,260 @@ +// Support code for TLS camouflage using uTLS. +// +// The goal is: provide an http.RoundTripper abstraction that retains the +// features of http.Transport (e.g., persistent connections and HTTP/2 support), +// while making TLS connections using uTLS in place of crypto/tls. The challenge +// is: while http.Transport provides a DialTLS hook, setting it to non-nil +// disables automatic HTTP/2 support in the client. Most of the uTLS +// fingerprints contain an ALPN extension containing "h2"; i.e., they declare +// support for HTTP/2. If the server also supports HTTP/2, then uTLS may +// negotiate an HTTP/2 connection without the http.Transport knowing it, which +// leads to an HTTP/1.1 client speaking to an HTTP/2 server, a protocol error. +// +// The code here uses an idea adapted from meek_lite in obfs4proxy: +// https://gitlab.com/yawning/obfs4/commit/4d453dab2120082b00bf6e63ab4aaeeda6b… +// Instead of setting DialTLS on an http.Transport and exposing it directly, we +// expose a wrapper type, UTLSRoundTripper, that contains within it either an +// http.Transport or an http2.Transport. The first time a caller calls RoundTrip +// on the wrapper, we initiate a uTLS connection (bootstrapConn), then peek at +// the ALPN-negotiated protocol: if "h2", create an internal http2.Transport; +// otherwise, create an internal http.Transport. In either case, set DialTLS on +// the created Transport to a function that dials using uTLS. As a special case, +// the first time the DialTLS callback is called, it reuses bootstrapConn (the +// one made to peek at the ALPN), rather than make a new connection. +// +// Subsequent calls to RoundTripper on the wrapper just pass the requests though +// the previously created http.Transport or http2.Transport. We assume that in +// future RoundTrips, the ALPN-negotiated protocol will remain the same as it +// was in the initial RoundTrip. At this point it is the http.Transport or +// http2.Transport calling DialTLS, not us, so we can't dynamically swap the +// underlying transport based on the ALPN. +// +// https://bugs.torproject.org/29077 +// https://github.com/refraction-networking/utls/issues/16 +package main + +import ( + "crypto/tls" + "fmt" + "net" + "net/http" + "net/url" + "reflect" + "strings" + "sync" + + utls "github.com/refraction-networking/utls" + "golang.org/x/net/http2" +) + +// Copy the public fields (fields for which CanSet is true) from src to dst. +// src and dst must be pointers to the same type. We use this to make copies of +// httpRoundTripper. We cannot use struct assignment, because http.Transport +// contains private mutexes. The idea of using reflection to copy only the +// public fields comes from a post by Nick Craig-Wood: +// https://groups.google.com/d/msg/Golang-Nuts/SDiGYNVE8iY/89hRKTF4BAAJ +func copyPublicFields(dst, src interface{}) { + if reflect.TypeOf(dst) != reflect.TypeOf(src) { + panic("unequal types") + } + dstValue := reflect.ValueOf(dst).Elem() + srcValue := reflect.ValueOf(src).Elem() + for i := 0; i < dstValue.NumField(); i++ { + if dstValue.Field(i).CanSet() { + dstValue.Field(i).Set(srcValue.Field(i)) + } + } +} + +// Extract a host:port address from a URL, suitable for passing to net.Dial. +func addrForDial(url *url.URL) (string, error) { + host := url.Hostname() + // net/http would use golang.org/x/net/idna here, to convert a possible + // internationalized domain name to ASCII. + port := url.Port() + if port == "" { + // No port? Use the default for the scheme. + switch url.Scheme { + case "http": + port = "80" + case "https": + port = "443" + default: + return "", fmt.Errorf("unsupported URL scheme %q", url.Scheme) + } + } + return net.JoinHostPort(host, port), nil +} + +// Analogous to tls.Dial. Connect to the given address and initiate a TLS +// handshake using the given ClientHelloID, returning the resulting connection. +func dialUTLS(network, addr string, cfg *utls.Config, clientHelloID *utls.ClientHelloID) (*utls.UConn, error) { + if options.ProxyURL != nil { + return nil, fmt.Errorf("no proxy allowed with uTLS") + } + + conn, err := net.Dial(network, addr) + if err != nil { + return nil, err + } + uconn := utls.UClient(conn, cfg, *clientHelloID) + if cfg == nil || cfg.ServerName == "" { + serverName, _, err := net.SplitHostPort(addr) + if err != nil { + return nil, err + } + uconn.SetSNI(serverName) + } + err = uconn.Handshake() + if err != nil { + return nil, err + } + return uconn, nil +} + +// A http.RoundTripper that uses uTLS (with a specified Client Hello ID) to make +// TLS connections. +// +// Can only be reused among servers which negotiate the same ALPN. +type UTLSRoundTripper struct { + sync.Mutex + + clientHelloID *utls.ClientHelloID + config *utls.Config + rt http.RoundTripper +} + +func (rt *UTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) { + switch req.URL.Scheme { + case "http": + // If http, we don't invoke uTLS; just pass it to the global http.Transport. + return httpRoundTripper.RoundTrip(req) + case "https": + default: + return nil, fmt.Errorf("unsupported URL scheme %q", req.URL.Scheme) + } + + rt.Lock() + defer rt.Unlock() + + if rt.rt == nil { + // On the first call, make an http.Transport or http2.Transport + // as appropriate. + var err error + rt.rt, err = makeRoundTripper(req.URL, rt.clientHelloID, rt.config) + if err != nil { + return nil, err + } + } + // Forward the request to the internal http.Transport or http2.Transport. + return rt.rt.RoundTrip(req) +} + +func makeRoundTripper(url *url.URL, clientHelloID *utls.ClientHelloID, cfg *utls.Config) (http.RoundTripper, error) { + addr, err := addrForDial(url) + if err != nil { + return nil, err + } + + // Connect to the given address and initiate a TLS handshake using + // the given ClientHelloID. Return the resulting connection. + dial := func(network, addr string) (*utls.UConn, error) { + return dialUTLS(network, addr, cfg, clientHelloID) + } + + bootstrapConn, err := dial("tcp", addr) + if err != nil { + return nil, err + } + + // Peek at what protocol we negotiated. + protocol := bootstrapConn.ConnectionState().NegotiatedProtocol + + // Protects bootstrapConn. + var lock sync.Mutex + // This is the callback for future dials done by the internal + // http.Transport or http2.Transport. + dialTLS := func(network, addr string) (net.Conn, error) { + lock.Lock() + defer lock.Unlock() + + // On the first dial, reuse bootstrapConn. + if bootstrapConn != nil { + uconn := bootstrapConn + bootstrapConn = nil + return uconn, nil + } + + // Later dials make a new connection. + uconn, err := dial(network, addr) + if err != nil { + return nil, err + } + if uconn.ConnectionState().NegotiatedProtocol != protocol { + return nil, fmt.Errorf("unexpected switch from ALPN %q to %q", + protocol, uconn.ConnectionState().NegotiatedProtocol) + } + + return uconn, nil + } + + // Construct an http.Transport or http2.Transport depending on ALPN. + switch protocol { + case http2.NextProtoTLS: + // Unfortunately http2.Transport does not expose the same + // configuration options as http.Transport with regard to + // timeouts, etc., so we are at the mercy of the defaults. + // https://github.com/golang/go/issues/16581 + return &http2.Transport{ + DialTLS: func(network, addr string, _ *tls.Config) (net.Conn, error) { + // Ignore the *tls.Config parameter; use our + // static cfg instead. + return dialTLS(network, addr) + }, + }, nil + default: + // With http.Transport, copy important default fields from + // http.DefaultTransport, such as TLSHandshakeTimeout and + // IdleConnTimeout. + tr := &http.Transport{} + copyPublicFields(tr, httpRoundTripper) + tr.DialTLS = dialTLS + return tr, nil + } +} + +// When you update this map, also update the man page in doc/meek-client.1.txt. +var clientHelloIDMap = map[string]*utls.ClientHelloID{ + // No HelloCustom: not useful for external configuration. + // No HelloRandomized: doesn't negotiate consistent ALPN. + "none": nil, // special case: disable uTLS + "hellogolang": nil, // special case: disable uTLS + "hellorandomizedalpn": &utls.HelloRandomizedALPN, + "hellorandomizednoalpn": &utls.HelloRandomizedNoALPN, + "hellofirefox_auto": &utls.HelloFirefox_Auto, + "hellofirefox_55": &utls.HelloFirefox_55, + "hellofirefox_56": &utls.HelloFirefox_56, + "hellofirefox_63": &utls.HelloFirefox_63, + "hellochrome_auto": &utls.HelloChrome_Auto, + "hellochrome_58": &utls.HelloChrome_58, + "hellochrome_62": &utls.HelloChrome_62, + "hellochrome_70": &utls.HelloChrome_70, + "helloios_auto": &utls.HelloIOS_Auto, + "helloios_11_1": &utls.HelloIOS_11_1, +} + +func NewUTLSRoundTripper(name string, cfg *utls.Config) (http.RoundTripper, error) { + // Lookup is case-insensitive. + clientHelloID, ok := clientHelloIDMap[strings.ToLower(name)] + if !ok { + return nil, fmt.Errorf("no uTLS Client Hello ID named %q", name) + } + if clientHelloID == nil { + // Special case for "none" and HelloGolang. + return httpRoundTripper, nil + } + return &UTLSRoundTripper{ + clientHelloID: clientHelloID, + config: cfg, + }, nil +} diff --git a/meek-client/utls_test.go b/meek-client/utls_test.go new file mode 100644 index 0000000..2eb72af --- /dev/null +++ b/meek-client/utls_test.go @@ -0,0 +1,232 @@ +package main + +import ( + "bytes" + "io" + "net" + "net/http" + "net/url" + "testing" + + utls "github.com/refraction-networking/utls" +) + +func TestCopyPublicFieldsHTTPTransport(t *testing.T) { + src := http.DefaultTransport.(*http.Transport) + dst := &http.Transport{} + copyPublicFields(dst, src) + // Test various fields that we might care about a copy of http.Transport + // having. + if dst.DisableKeepAlives != src.DisableKeepAlives { + t.Errorf("mismatch on DisableKeepAlives") + } + if dst.DisableCompression != src.DisableCompression { + t.Errorf("mismatch on DisableCompression") + } + if dst.MaxIdleConns != src.MaxIdleConns { + t.Errorf("mismatch on MaxIdleConns") + } + if dst.MaxIdleConnsPerHost != src.MaxIdleConnsPerHost { + t.Errorf("mismatch on MaxIdleConnsPerHost") + } + if dst.MaxConnsPerHost != src.MaxConnsPerHost { + t.Errorf("mismatch on MaxConnsPerHost") + } + if dst.IdleConnTimeout != src.IdleConnTimeout { + t.Errorf("mismatch on IdleConnTimeout") + } + if dst.ResponseHeaderTimeout != src.ResponseHeaderTimeout { + t.Errorf("mismatch on ResponseHeaderTimeout") + } + if dst.ExpectContinueTimeout != src.ExpectContinueTimeout { + t.Errorf("mismatch on ExpectContinueTimeout") + } + if dst.MaxResponseHeaderBytes != src.MaxResponseHeaderBytes { + t.Errorf("mismatch on MaxResponseHeaderBytes") + } +} + +// Test that the name lookup of NewUTLSRoundTripper is case-insensitive. +func TestNewUTLSRoundTripperCase(t *testing.T) { + mixed, err := NewUTLSRoundTripper("HelloFirefox_Auto", nil, nil) + if err != nil { + t.Fatalf("error on %q: %v", "HelloFirefox_Auto", err) + } + upper, err := NewUTLSRoundTripper("HELLOFIREFOX_AUTO", nil, nil) + if err != nil { + t.Fatalf("error on %q: %v", "HELLOFIREFOX_AUTO", err) + } + lower, err := NewUTLSRoundTripper("hellofirefox_auto", nil, nil) + if err != nil { + t.Fatalf("error on %q: %v", "hellofirefox_auto", err) + } + if mixed.(*UTLSRoundTripper).clientHelloID != upper.(*UTLSRoundTripper).clientHelloID || + upper.(*UTLSRoundTripper).clientHelloID != lower.(*UTLSRoundTripper).clientHelloID { + t.Fatalf("mismatch %p %p %p", + mixed.(*UTLSRoundTripper).clientHelloID, + upper.(*UTLSRoundTripper).clientHelloID, + lower.(*UTLSRoundTripper).clientHelloID) + } +} + +// Return a byte slice which is the ClientHello sent when rt does a RoundTrip. +// Opens a temporary listener on an ephemeral port on localhost. The host you +// provide can be an IP address like "127.0.0.1" or a name like "localhost", but +// it has to resolve to localhost. +func clientHelloResultingFromRoundTrip(t *testing.T, host string, rt *UTLSRoundTripper) ([]byte, error) { + ch := make(chan []byte, 1) + + ln, err := net.Listen("tcp", "127.0.0.1:0") + if err != nil { + return nil, err + } + defer ln.Close() + + go func() { + defer func() { + close(ch) + }() + conn, err := ln.Accept() + if err != nil { + t.Error(err) + return + } + defer conn.Close() + buf := make([]byte, 1024) + n, err := conn.Read(buf) + if err != nil { + t.Error(err) + return + } + ch <- buf[:n] + }() + + _, port, err := net.SplitHostPort(ln.Addr().String()) + if err != nil { + return nil, err + } + u := &url.URL{ + Scheme: "https", + Host: net.JoinHostPort(host, port), + } + req, err := http.NewRequest("POST", u.String(), nil) + if err != nil { + return nil, err + } + // The RoundTrip fails because the goroutine "server" hangs up. So + // ignore an EOF error. + _, err = rt.RoundTrip(req) + if err != nil && err != io.EOF { + return nil, err + } + + return <-ch, nil +} + +// Test that a uTLS RoundTripper actually does something to the TLS Client +// Hello. We don't check all the ClientHelloIDs; this is just a guard against a +// catastrophic incompatibility or something else that makes uTLS stop working. +func TestUTLSClientHello(t *testing.T) { + // We use HelloIOS_11_1 because its lengthy ALPN means we will not + // confuse it with a native Go fingerprint, and lack of GREASE means we + // do not have to account for many variations. + rt, err := NewUTLSRoundTripper("HelloIOS_11_1", &utls.Config{InsecureSkipVerify: true, ServerName: "localhost"}, nil) + if err != nil { + panic(err) + } + + buf, err := clientHelloResultingFromRoundTrip(t, "127.0.0.1", rt.(*UTLSRoundTripper)) + // A poor man's regexp matching because the regexp package only works on + // UTF-8–encoded strings, not arbitrary byte slices. Every byte matches + // itself, except '.' which matches anything. NB '.' and '\x2e' are the + // same. + pattern := "" + + // Handshake, Client Hello, TLS 1.2, Client Random + "\x16\x03\x01\x01\x01\x01\x00\x00\xfd\x03\x03................................" + + // Session ID + "\x20................................" + + // Ciphersuites and compression methods + "\x00\x28\xc0\x2c\xc0\x2b\xc0\x24\xc0\x23\xc0\x0a\xc0\x09\xcc\xa9\xc0\x30\xc0\x2f\xc0\x28\xc0\x27\xc0\x14\xc0\x13\xcc\xa8\x00\x9d\x00\x9c\x00\x3d\x00\x3c\x00\x35\x00\x2f\x01\x00" + + // Extensions + "\x00\x8c\xff\x01\x00\x01\x00" + + "\x00\x00\x00\x0e\x00\x0c\x00\x00\x09localhost" + + "\x00\x17\x00\x00" + + "\x00\x0d\x00\x14\x00\x12\x04\x03\x08\x04\x04\x01\x05\x03\x08\x05\x05\x01\x08\x06\x06\x01\x02\x01" + + "\x00\x05\x00\x05\x01\x00\x00\x00\x00" + + "\x33\x74\x00\x00" + + "\x00\x12\x00\x00" + + "\x00\x10\x00\x30\x00\x2e\x02\x68\x32\x05\x68\x32\x2d\x31\x36\x05\x68\x32\x2d\x31\x35\x05\x68\x32\x2d\x31\x34\x08\x73\x70\x64\x79\x2f\x33\x2e\x31\x06\x73\x70\x64\x79\x2f\x33\x08\x68\x74\x74\x70\x2f\x31\x2e\x31" + + "\x00\x0b\x00\x02\x01\x00" + + "\x00\x0a\x00\x0a\x00\x08\x00\x1d\x00\x17\x00\x18\x00\x19" + if len(buf) != len(pattern) { + t.Errorf("fingerprint was not as expected: %+q", buf) + } + for i := 0; i < len(pattern); i++ { + a := buf[i] + b := pattern[i] + if b != '.' && a != b { + t.Fatalf("fingerprint mismatch a position %v: %+q", i, buf) + } + } +} + +func TestUTLSServerName(t *testing.T) { + const clientHelloIDName = "HelloFirefox_63" + + // No ServerName, dial IP address. Results in an invalid server_name + // extension with a 0-length host_name. Not sure if that's what it + // should do, but check if the behavior ever changes. + rt, err := NewUTLSRoundTripper(clientHelloIDName, &utls.Config{InsecureSkipVerify: true}, nil) + if err != nil { + panic(err) + } + buf, err := clientHelloResultingFromRoundTrip(t, "127.0.0.1", rt.(*UTLSRoundTripper)) + if err != nil { + panic(err) + } + if !bytes.Contains(buf, []byte("\x00\x00\x00\x05\x00\x03\x00\x00\x00")) { + t.Errorf("expected 0-length server_name extension with no ServerName and IP address dial") + } + + // No ServerName, dial hostname. server_name extension should come from + // the dial address. + rt, err = NewUTLSRoundTripper(clientHelloIDName, &utls.Config{InsecureSkipVerify: true}, nil) + if err != nil { + panic(err) + } + buf, err = clientHelloResultingFromRoundTrip(t, "localhost", rt.(*UTLSRoundTripper)) + if err != nil { + panic(err) + } + if !bytes.Contains(buf, []byte("\x00\x00\x00\x0e\x00\x0c\x00\x00\x09localhost")) { + t.Errorf("expected \"localhost\" server_name extension with no ServerName and hostname dial") + } + + // Given ServerName, dial IP address. server_name extension should from + // the ServerName. + rt, err = NewUTLSRoundTripper(clientHelloIDName, &utls.Config{InsecureSkipVerify: true, ServerName: "test.example"}, nil) + if err != nil { + panic(err) + } + buf, err = clientHelloResultingFromRoundTrip(t, "127.0.0.1", rt.(*UTLSRoundTripper)) + if err != nil { + panic(err) + } + if !bytes.Contains(buf, []byte("\x00\x00\x00\x11\x00\x0f\x00\x00\x0ctest.example")) { + t.Errorf("expected \"test.example\" server_name extension with given ServerName and IP address dial") + } + + // Given ServerName, dial hostname. server_name extension should from + // the ServerName. + rt, err = NewUTLSRoundTripper(clientHelloIDName, &utls.Config{InsecureSkipVerify: true, ServerName: "test.example"}, nil) + if err != nil { + panic(err) + } + buf, err = clientHelloResultingFromRoundTrip(t, "localhost", rt.(*UTLSRoundTripper)) + if err != nil { + panic(err) + } + if !bytes.Contains(buf, []byte("\x00\x00\x00\x11\x00\x0f\x00\x00\x0ctest.example")) { + t.Errorf("expected \"test.example\" server_name extension with given ServerName and hostname dial") + } +}

1 0

[meek/master] https proxy support for uTLS.
by dcf＠torproject.org 09 May '19

09 May '19

commit 4290a67a65a98303b2feb34a230ab23daabb9895 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Feb 1 01:46:07 2019 -0700 https proxy support for uTLS. Tor doesn't support this kind of proxy (https://bugs.torproject.org/26306) but I want to support the same kinds of proxies with uTLS as are supported using the native Go net/http, for ease of explaining the proxy restrictions in the man page. We use the same uTLS ClientHelloID for the TLS connection to the HTTPS proxy, as we use for the TLS connection through the tunnel. --- meek-client/proxy_http.go | 27 +++++++++++++ meek-client/proxy_test.go | 96 ++++++++++++++++++++++++++++++++++++++++++----- meek-client/utls.go | 14 ++++++- meek-client/utls_test.go | 1 + 4 files changed, 127 insertions(+), 11 deletions(-) diff --git a/meek-client/proxy_http.go b/meek-client/proxy_http.go index 1136eb2..f9aeb71 100644 --- a/meek-client/proxy_http.go +++ b/meek-client/proxy_http.go @@ -8,6 +8,7 @@ import ( "net/http" "net/url" + utls "github.com/refraction-networking/utls" "golang.org/x/net/proxy" ) @@ -74,3 +75,29 @@ func ProxyHTTP(network, addr string, auth *proxy.Auth, forward proxy.Dialer) (*h forward: forward, }, nil } + +type UTLSDialer struct { + config *utls.Config + clientHelloID *utls.ClientHelloID + forward proxy.Dialer +} + +func (dialer *UTLSDialer) Dial(network, addr string) (net.Conn, error) { + return dialUTLS(network, addr, dialer.config, dialer.clientHelloID, dialer.forward) +} + +func ProxyHTTPS(network, addr string, auth *proxy.Auth, forward proxy.Dialer, cfg *utls.Config, clientHelloID *utls.ClientHelloID) (*httpProxy, error) { + return &httpProxy{ + network: network, + addr: addr, + auth: auth, + forward: &UTLSDialer{ + config: cfg, + // We use the same uTLS ClientHelloID for the TLS + // connection to the HTTPS proxy, as we use for the TLS + // connection through the tunnel. + clientHelloID: clientHelloID, + forward: forward, + }, + }, nil +} diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go index c13cf12..b44c9a2 100644 --- a/meek-client/proxy_test.go +++ b/meek-client/proxy_test.go @@ -2,12 +2,21 @@ package main import ( "bufio" + "crypto/ecdsa" + "crypto/elliptic" + "crypto/rand" + "crypto/tls" + "crypto/x509" + "crypto/x509/pkix" "io" + "math/big" "net" "net/http" "net/url" "testing" + "time" + utls "github.com/refraction-networking/utls" "golang.org/x/net/proxy" ) @@ -67,15 +76,9 @@ func TestAddrForDial(t *testing.T) { // Dial the given address with the given proxy, and return the http.Request that // the proxy server would have received. -func requestResultingFromDial(t *testing.T, makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) { +func requestResultingFromDial(t *testing.T, ln net.Listener, makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) { ch := make(chan *http.Request, 1) - ln, err := net.Listen("tcp", "127.0.0.1:0") - if err != nil { - return nil, err - } - defer ln.Close() - go func() { defer func() { close(ch) @@ -109,9 +112,18 @@ func requestResultingFromDial(t *testing.T, makeProxy func(addr net.Addr) (*http return <-ch, nil } +func requestResultingFromDialHTTP(t *testing.T, makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) { + ln, err := net.Listen("tcp", "127.0.0.1:0") + if err != nil { + return nil, err + } + defer ln.Close() + return requestResultingFromDial(t, ln, makeProxy, network, addr) +} + // Test that the HTTP proxy client sends a correct request. func TestProxyHTTPCONNECT(t *testing.T) { - req, err := requestResultingFromDial(t, func(addr net.Addr) (*httpProxy, error) { + req, err := requestResultingFromDialHTTP(t, func(addr net.Addr) (*httpProxy, error) { return ProxyHTTP("tcp", addr.String(), nil, proxy.Direct) }, "tcp", testAddr) if err != nil { @@ -134,7 +146,7 @@ func TestProxyHTTPProxyAuthorization(t *testing.T) { User: testUsername, Password: testPassword, } - req, err := requestResultingFromDial(t, func(addr net.Addr) (*httpProxy, error) { + req, err := requestResultingFromDialHTTP(t, func(addr net.Addr) (*httpProxy, error) { return ProxyHTTP("tcp", addr.String(), auth, proxy.Direct) }, "tcp", testAddr) if err != nil { @@ -163,3 +175,69 @@ func TestProxyHTTPProxyAuthorization(t *testing.T) { t.Errorf("expected password %q, got %q", testPassword, password) } } + +// Create a TLS listener using a temporary self-signed certificate. +// https://golang.org/src/crypto/tls/generate_cert.go +func selfSignedTLSListen(network, addr string) (net.Listener, error) { + priv, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) + if err != nil { + return nil, err + } + + notBefore := time.Now() + notAfter := notBefore.Add(100 * time.Second) + template := x509.Certificate{ + SerialNumber: big.NewInt(123), + Subject: pkix.Name{ + Organization: []string{"Test"}, + }, + NotBefore: notBefore, + NotAfter: notAfter, + KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign, + IsCA: true, + ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, + BasicConstraintsValid: true, + } + + cert, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv) + if err != nil { + return nil, err + } + config := tls.Config{ + Certificates: []tls.Certificate{ + tls.Certificate{ + Certificate: [][]byte{cert}, + PrivateKey: priv, + }, + }, + } + + return tls.Listen(network, addr, &config) +} + +func requestResultingFromDialHTTPS(t *testing.T, makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) { + ln, err := selfSignedTLSListen("tcp", "127.0.0.1:0") + if err != nil { + return nil, err + } + defer ln.Close() + return requestResultingFromDial(t, ln, makeProxy, network, addr) +} + +func TestProxyHTTPSCONNECT(t *testing.T) { + req, err := requestResultingFromDialHTTPS(t, func(addr net.Addr) (*httpProxy, error) { + return ProxyHTTPS("tcp", addr.String(), nil, proxy.Direct, &utls.Config{InsecureSkipVerify: true}, &utls.HelloFirefox_Auto) + }, "tcp", testAddr) + if err != nil { + panic(err) + } + if req.Method != "CONNECT" { + t.Errorf("expected method %q, got %q", "CONNECT", req.Method) + } + if req.URL.Hostname() != testHost || req.URL.Port() != testPort { + t.Errorf("expected URL %q, got %q", testAddr, req.URL.String()) + } + if req.Host != testAddr { + t.Errorf("expected %q, got %q", "Host: "+req.Host, "Host: "+testAddr) + } +} diff --git a/meek-client/utls.go b/meek-client/utls.go index 5c1e484..66b1a93 100644 --- a/meek-client/utls.go +++ b/meek-client/utls.go @@ -155,7 +155,7 @@ func (rt *UTLSRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) // use by setting Proxy on an http.Transport), and unlike when using the browser // helper (the browser has its own proxy support), when using uTLS we have to // craft our own proxy connections. -func makeProxyDialer(proxyURL *url.URL) (proxy.Dialer, error) { +func makeProxyDialer(proxyURL *url.URL, cfg *utls.Config, clientHelloID *utls.ClientHelloID) (proxy.Dialer, error) { var proxyDialer proxy.Dialer = proxy.Direct if proxyURL == nil { return proxyDialer, nil @@ -181,6 +181,16 @@ func makeProxyDialer(proxyURL *url.URL) (proxy.Dialer, error) { proxyDialer, err = proxy.SOCKS5("tcp", proxyAddr, auth, proxyDialer) case "http": proxyDialer, err = ProxyHTTP("tcp", proxyAddr, auth, proxyDialer) + case "https": + // We use the same uTLS Config for TLS to the HTTPS proxy, as we + // use for HTTPS connections through the tunnel. We make a clone + // of the Config to avoid concurrent modification as the two + // layers set the ServerName value. + var cfgClone *utls.Config + if cfg != nil { + cfgClone = cfg.Clone() + } + proxyDialer, err = ProxyHTTPS("tcp", proxyAddr, auth, proxyDialer, cfgClone, clientHelloID) default: return nil, fmt.Errorf("cannot use proxy scheme %q with uTLS", proxyURL.Scheme) } @@ -293,7 +303,7 @@ func NewUTLSRoundTripper(name string, cfg *utls.Config, proxyURL *url.URL) (http return httpRoundTripper, nil } - proxyDialer, err := makeProxyDialer(proxyURL) + proxyDialer, err := makeProxyDialer(proxyURL, cfg, clientHelloID) if err != nil { return nil, err } diff --git a/meek-client/utls_test.go b/meek-client/utls_test.go index fbdd969..eebb1db 100644 --- a/meek-client/utls_test.go +++ b/meek-client/utls_test.go @@ -264,6 +264,7 @@ func TestUTLSHTTPWithProxy(t *testing.T) { for _, proxyURL := range []url.URL{ url.URL{Scheme: "socks5", Host: proxyLn.Addr().String()}, url.URL{Scheme: "http", Host: proxyLn.Addr().String()}, + url.URL{Scheme: "https", Host: proxyLn.Addr().String()}, } { rt, err := NewUTLSRoundTripper("HelloFirefox_63", &utls.Config{InsecureSkipVerify: true}, &proxyURL) if err != nil {

1 0

[meek/master] http proxy support for uTLS.
by dcf＠torproject.org 09 May '19

09 May '19

commit 92400c9d9191fe7b661086128639f7f228f5b9e2 Author: David Fifield <david(a)bamsoftware.com> Date: Wed Feb 6 20:42:24 2019 -0700 http proxy support for uTLS. --- meek-client/proxy_http.go | 76 +++++++++++++++++++++ meek-client/proxy_test.go | 165 ++++++++++++++++++++++++++++++++++++++++++++++ meek-client/utls.go | 2 + meek-client/utls_test.go | 1 + 4 files changed, 244 insertions(+) diff --git a/meek-client/proxy_http.go b/meek-client/proxy_http.go new file mode 100644 index 0000000..1136eb2 --- /dev/null +++ b/meek-client/proxy_http.go @@ -0,0 +1,76 @@ +package main + +import ( + "bufio" + "encoding/base64" + "fmt" + "net" + "net/http" + "net/url" + + "golang.org/x/net/proxy" +) + +// https://tools.ietf.org/html/rfc7231#section-4.3.6 +// Conceivably we could also proxy over HTTP/2: +// https://httpwg.org/specs/rfc7540.html#CONNECT +// https://github.com/caddyserver/forwardproxy/blob/05b2092e07f9d10b3803d8fb97… + +type httpProxy struct { + network, addr string + auth *proxy.Auth + forward proxy.Dialer +} + +func (pr *httpProxy) Dial(network, addr string) (net.Conn, error) { + connectReq := &http.Request{ + Method: "CONNECT", + URL: &url.URL{Opaque: addr}, + Host: addr, + Header: make(http.Header), + } + // http.Transport has a ProxyConnectHeader field that we are ignoring + // here. + if pr.auth != nil { + connectReq.Header.Set("Proxy-Authorization", "basic "+ + base64.StdEncoding.EncodeToString([]byte(pr.auth.User+":"+pr.auth.Password))) + } + + conn, err := pr.forward.Dial(pr.network, pr.addr) + if err != nil { + return nil, err + } + + err = connectReq.Write(conn) + if err != nil { + conn.Close() + return nil, err + } + + // The Go stdlib says: "Okay to use and discard buffered reader here, + // because TLS server will not speak until spoken to." + br := bufio.NewReader(conn) + resp, err := http.ReadResponse(br, connectReq) + if br.Buffered() != 0 { + panic(br.Buffered()) + } + if err != nil { + conn.Close() + return nil, err + } + if resp.StatusCode != 200 { + conn.Close() + return nil, fmt.Errorf("proxy server returned %q", resp.Status) + } + + return conn, nil +} + +func ProxyHTTP(network, addr string, auth *proxy.Auth, forward proxy.Dialer) (*httpProxy, error) { + return &httpProxy{ + network: network, + addr: addr, + auth: auth, + forward: forward, + }, nil +} diff --git a/meek-client/proxy_test.go b/meek-client/proxy_test.go new file mode 100644 index 0000000..c13cf12 --- /dev/null +++ b/meek-client/proxy_test.go @@ -0,0 +1,165 @@ +package main + +import ( + "bufio" + "io" + "net" + "net/http" + "net/url" + "testing" + + "golang.org/x/net/proxy" +) + +const testHost = "test.example" +const testPort = "1234" +const testAddr = testHost + ":" + testPort +const testUsername = "username" +const testPassword = "password" + +// Test that addrForDial returns a numeric port number. It needs to be numeric +// because we pass it as part of the authority-form URL in HTTP proxy requests. +// https://tools.ietf.org/html/rfc7230#section-5.3.3 authority-form +// https://tools.ietf.org/html/rfc3986#section-3.2.3 port +func TestAddrForDial(t *testing.T) { + // good tests + for _, test := range []struct { + URL string + Addr string + }{ + {"http://example.com", "example.com:80"}, + {"http://example.com/", "example.com:80"}, + {"https://example.com/", "example.com:443"}, + {"http://example.com:443/", "example.com:443"}, + {"ftp://example.com:21/", "example.com:21"}, + } { + u, err := url.Parse(test.URL) + if err != nil { + panic(err) + } + addr, err := addrForDial(u) + if err != nil { + t.Errorf("%q → error %v", test.URL, err) + continue + } + if addr != test.Addr { + t.Errorf("%q → %q, expected %q", test.URL, addr, test.Addr) + } + } + + // bad tests + for _, input := range []string{ + "example.com", + "example.com:80", + "ftp://example.com/", + } { + u, err := url.Parse(input) + if err != nil { + panic(err) + } + addr, err := addrForDial(u) + if err == nil { + t.Errorf("%q → %q, expected error", input, addr) + continue + } + } +} + +// Dial the given address with the given proxy, and return the http.Request that +// the proxy server would have received. +func requestResultingFromDial(t *testing.T, makeProxy func(addr net.Addr) (*httpProxy, error), network, addr string) (*http.Request, error) { + ch := make(chan *http.Request, 1) + + ln, err := net.Listen("tcp", "127.0.0.1:0") + if err != nil { + return nil, err + } + defer ln.Close() + + go func() { + defer func() { + close(ch) + }() + conn, err := ln.Accept() + if err != nil { + t.Error(err) + return + } + defer conn.Close() + br := bufio.NewReader(conn) + req, err := http.ReadRequest(br) + if err != nil { + t.Error(err) + return + } + ch <- req + }() + + pr, err := makeProxy(ln.Addr()) + if err != nil { + return nil, err + } + // The Dial fails because the goroutine "server" hangs up. So ignore an + // ErrUnexpectedEOF error. + _, err = pr.Dial(network, addr) + if err != nil && err != io.ErrUnexpectedEOF { + return nil, err + } + + return <-ch, nil +} + +// Test that the HTTP proxy client sends a correct request. +func TestProxyHTTPCONNECT(t *testing.T) { + req, err := requestResultingFromDial(t, func(addr net.Addr) (*httpProxy, error) { + return ProxyHTTP("tcp", addr.String(), nil, proxy.Direct) + }, "tcp", testAddr) + if err != nil { + panic(err) + } + if req.Method != "CONNECT" { + t.Errorf("expected method %q, got %q", "CONNECT", req.Method) + } + if req.URL.Hostname() != testHost || req.URL.Port() != testPort { + t.Errorf("expected URL %q, got %q", testAddr, req.URL.String()) + } + if req.Host != testAddr { + t.Errorf("expected %q, got %q", "Host: "+req.Host, "Host: "+testAddr) + } +} + +// Test that the HTTP proxy client sends authorization credentials. +func TestProxyHTTPProxyAuthorization(t *testing.T) { + auth := &proxy.Auth{ + User: testUsername, + Password: testPassword, + } + req, err := requestResultingFromDial(t, func(addr net.Addr) (*httpProxy, error) { + return ProxyHTTP("tcp", addr.String(), auth, proxy.Direct) + }, "tcp", testAddr) + if err != nil { + panic(err) + } + pa := req.Header.Get("Proxy-Authorization") + if pa == "" { + t.Fatalf("didn't get a Proxy-Authorization header") + } + // The standard library Request.BasicAuth does parsing of basic + // authentication, but only in the Authorization header, not + // Proxy-Authorization. + newReq := &http.Request{ + Header: http.Header{ + "Authorization": []string{pa}, + }, + } + username, password, ok := newReq.BasicAuth() + if !ok { + panic("shouldn't fail") + } + if username != testUsername { + t.Errorf("expected username %q, got %q", testUsername, username) + } + if password != testPassword { + t.Errorf("expected password %q, got %q", testPassword, password) + } +} diff --git a/meek-client/utls.go b/meek-client/utls.go index 1cdeca1..5c1e484 100644 --- a/meek-client/utls.go +++ b/meek-client/utls.go @@ -179,6 +179,8 @@ func makeProxyDialer(proxyURL *url.URL) (proxy.Dialer, error) { switch proxyURL.Scheme { case "socks5": proxyDialer, err = proxy.SOCKS5("tcp", proxyAddr, auth, proxyDialer) + case "http": + proxyDialer, err = ProxyHTTP("tcp", proxyAddr, auth, proxyDialer) default: return nil, fmt.Errorf("cannot use proxy scheme %q with uTLS", proxyURL.Scheme) } diff --git a/meek-client/utls_test.go b/meek-client/utls_test.go index 0e62dac..fbdd969 100644 --- a/meek-client/utls_test.go +++ b/meek-client/utls_test.go @@ -263,6 +263,7 @@ func TestUTLSHTTPWithProxy(t *testing.T) { // Try to access the web server through the non-functional proxy. for _, proxyURL := range []url.URL{ url.URL{Scheme: "socks5", Host: proxyLn.Addr().String()}, + url.URL{Scheme: "http", Host: proxyLn.Addr().String()}, } { rt, err := NewUTLSRoundTripper("HelloFirefox_63", &utls.Config{InsecureSkipVerify: true}, &proxyURL) if err != nil {

1 0

[meek/master] Document utls options in meek-client man page.
by dcf＠torproject.org 09 May '19

09 May '19

commit cb5f5978a9168ab05247506cfad37f578a3246c4 Author: David Fifield <david(a)bamsoftware.com> Date: Fri Jan 25 00:25:18 2019 -0700 Document utls options in meek-client man page. --- doc/meek-client.1 | 159 +++++++++++++++++++++++++++++++++++++++++++++++++- doc/meek-client.1.txt | 30 ++++++++++ 2 files changed, 187 insertions(+), 2 deletions(-) diff --git a/doc/meek-client.1 b/doc/meek-client.1 index b379116..58fd755 100644 --- a/doc/meek-client.1 +++ b/doc/meek-client.1 @@ -2,12 +2,12 @@ .\" Title: meek-client .\" Author: [FIXME: author] [see http://docbook.sf.net/el/author] .\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/> -.\" Date: 02/01/2019 +.\" Date: 02/06/2019 .\" Manual: \ \& .\" Source: \ \& .\" Language: English .\" -.TH "MEEK\-CLIENT" "1" "02/01/2019" "\ \&" "\ \&" +.TH "MEEK\-CLIENT" "1" "02/06/2019" "\ \&" "\ \&" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -54,6 +54,153 @@ Front domain name\&. If provided, this domain name will replace the domain name \fBurl\fR in the DNS request and TLS SNI field\&. The URL\(cqs true domain name will still appear in the Host header of HTTP requests\&. .RE +.PP +\fButls\fR=\fICLIENTHELLOID\fR +.RS 4 +Use the +uTLS library +with the named TLS fingerprint for TLS camouflage\&. This arg is incompatible with the +\fB\-\-helper\fR +command line option\&. The possible values of +\fICLIENTHELLOID\fR +are: +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +HelloRandomizedALPN +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +HelloRandomizedNoALPN +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +HelloFirefox_55 +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +HelloFirefox_56 +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +HelloFirefox_63 +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +HelloFirefox_Auto +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +HelloChrome_58 +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +HelloChrome_62 +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +HelloChrome_70 +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +HelloChrome_Auto +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +HelloIOS_11_1 +.RE +.sp +.RS 4 +.ie n \{\ +\h'-04'\(bu\h'+03'\c +.\} +.el \{\ +.sp -1 +.IP \(bu 2.3 +.\} +HelloIOS_Auto +.RE +.sp +As a special case, the values "none" and "HelloGolang" are recognized as aliases for omitting the +\fButls\fR +SOCKS arg; i\&.e\&., use native Go TLS\&. +.RE .sp For backward compatibility, each SOCKS arg also has an equivalent command line option\&. For example, this configuration using SOCKS args: .sp @@ -144,6 +291,14 @@ URL to correspond with\&. Prefer using the SOCKS arg on a bridge line over using this command line option\&. .RE .PP +\fB\-\-utls\fR=\fICLIENTHELLOID\fR +.RS 4 +Use uTLS with the given TLS fingerprint for TLS camouflage\&. This option is incompatible with +\fB\-\-helper\fR\&. Prefer using the +\fButls\fR +SOCKS arg over using this command line option\&. +.RE +.PP \fB\-h\fR, \fB\-\-help\fR .RS 4 Display a help message and exit\&. diff --git a/doc/meek-client.1.txt b/doc/meek-client.1.txt index d7883ec..33e2916 100644 --- a/doc/meek-client.1.txt +++ b/doc/meek-client.1.txt @@ -43,6 +43,31 @@ The possible SOCKS args are: of **url** in the DNS request and TLS SNI field. The URL's true domain name will still appear in the Host header of HTTP requests. +**utls**=__CLIENTHELLOID__:: ++ +-- +Use the https://github.com/refraction-networking/utls[uTLS library] +with the named TLS fingerprint for TLS camouflage. +This arg is incompatible with the **--helper** command line option. +The possible values of __CLIENTHELLOID__ are: + +- HelloRandomizedALPN +- HelloRandomizedNoALPN +- HelloFirefox_55 +- HelloFirefox_56 +- HelloFirefox_63 +- HelloFirefox_Auto +- HelloChrome_58 +- HelloChrome_62 +- HelloChrome_70 +- HelloChrome_Auto +- HelloIOS_11_1 +- HelloIOS_Auto + +As a special case, the values "none" and "HelloGolang" +are recognized as aliases for +omitting the **utls** SOCKS arg; i.e., use native Go TLS. +-- For backward compatibility, each SOCKS arg also has an equivalent command line option. @@ -109,6 +134,11 @@ OPTIONS URL to correspond with. Prefer using the **url** SOCKS arg on a bridge line over using this command line option. +**--utls**=__CLIENTHELLOID__:: + Use uTLS with the given TLS fingerprint for TLS camouflage. + This option is incompatible with **--helper**. + Prefer using the **utls** SOCKS arg over using this command line option. + **-h**, **--help**:: Display a help message and exit.

1 0

[meek/master] programVersion = "0.33"
by dcf＠torproject.org 09 May '19

09 May '19

commit 23cdaf6a46ebcd26fdaa9dab6d916e2d5e745605 Author: David Fifield <david(a)bamsoftware.com> Date: Thu May 9 11:02:54 2019 -0600 programVersion = "0.33" --- meek-server/meek-server.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meek-server/meek-server.go b/meek-server/meek-server.go index 72fe6a6..e39ddd8 100644 --- a/meek-server/meek-server.go +++ b/meek-server/meek-server.go @@ -44,7 +44,7 @@ import ( ) const ( - programVersion = "0.32" + programVersion = "0.33" ptMethodName = "meek" // Reject session ids shorter than this, as a weak defense against

1 0

[translation/tpo-web_completed] Update translations for tpo-web_completed
by translation＠torproject.org 09 May '19

09 May '19

commit 0a531a7c3c10df5fc41b74a971e0acd9d280cc77 Author: Translation commit bot <translation(a)torproject.org> Date: Thu May 9 19:20:47 2019 +0000 Update translations for tpo-web_completed --- contents+de.po | 10 +++++++++- contents+fr.po | 12 ++++++++++-- contents+pt-BR.po | 13 ++++++++++--- 3 files changed, 29 insertions(+), 6 deletions(-) diff --git a/contents+de.po b/contents+de.po index 6841e6670..5b0e0c95b 100644 --- a/contents+de.po +++ b/contents+de.po @@ -513,6 +513,9 @@ msgid "" "The Tor Project, Inc. is a US 501(c)(3) nonprofit organization committed to " "transparency in its work and reporting." msgstr "" +"The Tor Project, Inc. ist eine gemeinnützige Organisation in den USA " +"501(c)(3), die sich der Transparenz ihrer Arbeit und Berichterstattung " +"verpflichtet hat." #: https//www.torproject.org/press/-new-release-tails/ #: (content/press/new-release-tails/contents+en.lrpost.title) @@ -567,6 +570,11 @@ msgid "" "href=\"https://www.torproject.org/dist/torbrowser/8.5a10/\">distribution " "directory</a>." msgstr "" +"Tor Browser 8.5a10 ist nun auf derTor Browser <a " +"href=\"https://www.torproject.org/projects/torbrowser.html.en#downloads-" +"alpha\">Projektseite des Tor-Browsers</a> und auch in unserem <a " +"href=\"https://www.torproject.org/dist/torbrowser/8.5a10/\">Verteilerverzeichnis" +" </a> verfügbar." #: templates/contact.html:8 msgid "Chat with us on" @@ -731,7 +739,7 @@ msgstr "Sprache" #: templates/download-tor.html:25 templates/download-tor.html:30 msgid "sig" -msgstr "" +msgstr "sig" #: templates/download.html:5 msgid "Get Connected" diff --git a/contents+fr.po b/contents+fr.po index 7ec81dc75..1b5bfc11f 100644 --- a/contents+fr.po +++ b/contents+fr.po @@ -4,6 +4,7 @@ # Emma Peel, 2019 # erinm, 2019 # AO <ao(a)localizationlab.org>, 2019 +# Curtis Baltimore <curtisbaltimore(a)protonmail.com>, 2019 # msgid "" msgstr "" @@ -11,7 +12,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2019-05-09 15:06+CET\n" "PO-Revision-Date: 2019-03-09 10:41+0000\n" -"Last-Translator: AO <ao(a)localizationlab.org>, 2019\n" +"Last-Translator: Curtis Baltimore <curtisbaltimore(a)protonmail.com>, 2019\n" "Language-Team: French (https://www.transifex.com/otf/teams/1519/fr/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -519,6 +520,8 @@ msgid "" "The Tor Project, Inc. is a US 501(c)(3) nonprofit organization committed to " "transparency in its work and reporting." msgstr "" +"The Tor Project, Inc. est une organisme sans but lucratif américaine " +"501(c)(3) engagée à la transparence dans son travail et ses informations." #: https//www.torproject.org/press/-new-release-tails/ #: (content/press/new-release-tails/contents+en.lrpost.title) @@ -573,6 +576,11 @@ msgid "" "href=\"https://www.torproject.org/dist/torbrowser/8.5a10/\">distribution " "directory</a>." msgstr "" +"Le Navigateur Tor 8.5a10 est maintenant disponible à partir de la <a " +"href=\"https://www.torproject.org/projects/torbrowser.html.en#downloads-" +"alpha\">page du projet du Navigateur Tor</a> et aussi de notre <a " +"href=\"https://www.torproject.org/dist/torbrowser/8.5a10/\">répertoire de " +"version.</a>." #: templates/contact.html:8 msgid "Chat with us on" @@ -738,7 +746,7 @@ msgstr "Langue" #: templates/download-tor.html:25 templates/download-tor.html:30 msgid "sig" -msgstr "" +msgstr "sig" #: templates/download.html:5 msgid "Get Connected" diff --git a/contents+pt-BR.po b/contents+pt-BR.po index b85785fe6..f84bf51e2 100644 --- a/contents+pt-BR.po +++ b/contents+pt-BR.po @@ -7,11 +7,11 @@ # Hildeberto Abreu Magalhães <hildeberto(a)gmail.com>, 2019 # Anna e só <contraexemplos(a)gmail.com>, 2019 # Alexei Gonçalves de Oliveira <alexis(a)gessicahellmann.com>, 2019 -# Chacal E., 2019 # Danihells <dcdcampos75(a)gmail.com>, 2019 # Communia <ameaneantie(a)riseup.net>, 2019 # Emma Peel, 2019 # Eduardo Addad de Oliveira <eduardoaddad(a)hotmail.com>, 2019 +# Chacal E., 2019 # msgid "" msgstr "" @@ -19,7 +19,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2019-05-09 15:06+CET\n" "PO-Revision-Date: 2019-03-09 10:41+0000\n" -"Last-Translator: Eduardo Addad de Oliveira <eduardoaddad(a)hotmail.com>, 2019\n" +"Last-Translator: Chacal E., 2019\n" "Language-Team: Portuguese (Brazil) (https://www.transifex.com/otf/teams/1519/pt_BR/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -514,6 +514,8 @@ msgid "" "The Tor Project, Inc. is a US 501(c)(3) nonprofit organization committed to " "transparency in its work and reporting." msgstr "" +"O Tor Project, Inc. é uma organização sem fins lucrativos dos EUA 501(c)(3) " +"comprometida com a transparência em seu trabalho e relatórios." #: https//www.torproject.org/press/-new-release-tails/ #: (content/press/new-release-tails/contents+en.lrpost.title) @@ -568,6 +570,11 @@ msgid "" "href=\"https://www.torproject.org/dist/torbrowser/8.5a10/\">distribution " "directory</a>." msgstr "" +"O Tor Browser 8.5a10 está agora disponível na <a " +"href=\"https://www.torproject.org/projects/torbrowser.html.en#downloads-" +"alpha\">página Tor Browser Project</a> e também em nosso <a " +"href=\"https://www.torproject.org/dist/torbrowser/8.5a10/\">diretório de " +"distribuição</a>." #: templates/contact.html:8 msgid "Chat with us on" @@ -729,7 +736,7 @@ msgstr "Idioma" #: templates/download-tor.html:25 templates/download-tor.html:30 msgid "sig" -msgstr "" +msgstr "sig" #: templates/download.html:5 msgid "Get Connected"

1 0

[translation/tpo-web] Update translations for tpo-web
by translation＠torproject.org 09 May '19

09 May '19

commit ab678a7d56fc52f542938422d48c648b7c576547 Author: Translation commit bot <translation(a)torproject.org> Date: Thu May 9 19:20:40 2019 +0000 Update translations for tpo-web --- contents+de.po | 10 +++++++++- contents+fr.po | 12 ++++++++++-- contents+pt-BR.po | 13 ++++++++++--- 3 files changed, 29 insertions(+), 6 deletions(-) diff --git a/contents+de.po b/contents+de.po index 6841e6670..5b0e0c95b 100644 --- a/contents+de.po +++ b/contents+de.po @@ -513,6 +513,9 @@ msgid "" "The Tor Project, Inc. is a US 501(c)(3) nonprofit organization committed to " "transparency in its work and reporting." msgstr "" +"The Tor Project, Inc. ist eine gemeinnützige Organisation in den USA " +"501(c)(3), die sich der Transparenz ihrer Arbeit und Berichterstattung " +"verpflichtet hat." #: https//www.torproject.org/press/-new-release-tails/ #: (content/press/new-release-tails/contents+en.lrpost.title) @@ -567,6 +570,11 @@ msgid "" "href=\"https://www.torproject.org/dist/torbrowser/8.5a10/\">distribution " "directory</a>." msgstr "" +"Tor Browser 8.5a10 ist nun auf derTor Browser <a " +"href=\"https://www.torproject.org/projects/torbrowser.html.en#downloads-" +"alpha\">Projektseite des Tor-Browsers</a> und auch in unserem <a " +"href=\"https://www.torproject.org/dist/torbrowser/8.5a10/\">Verteilerverzeichnis" +" </a> verfügbar." #: templates/contact.html:8 msgid "Chat with us on" @@ -731,7 +739,7 @@ msgstr "Sprache" #: templates/download-tor.html:25 templates/download-tor.html:30 msgid "sig" -msgstr "" +msgstr "sig" #: templates/download.html:5 msgid "Get Connected" diff --git a/contents+fr.po b/contents+fr.po index 7ec81dc75..1b5bfc11f 100644 --- a/contents+fr.po +++ b/contents+fr.po @@ -4,6 +4,7 @@ # Emma Peel, 2019 # erinm, 2019 # AO <ao(a)localizationlab.org>, 2019 +# Curtis Baltimore <curtisbaltimore(a)protonmail.com>, 2019 # msgid "" msgstr "" @@ -11,7 +12,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2019-05-09 15:06+CET\n" "PO-Revision-Date: 2019-03-09 10:41+0000\n" -"Last-Translator: AO <ao(a)localizationlab.org>, 2019\n" +"Last-Translator: Curtis Baltimore <curtisbaltimore(a)protonmail.com>, 2019\n" "Language-Team: French (https://www.transifex.com/otf/teams/1519/fr/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -519,6 +520,8 @@ msgid "" "The Tor Project, Inc. is a US 501(c)(3) nonprofit organization committed to " "transparency in its work and reporting." msgstr "" +"The Tor Project, Inc. est une organisme sans but lucratif américaine " +"501(c)(3) engagée à la transparence dans son travail et ses informations." #: https//www.torproject.org/press/-new-release-tails/ #: (content/press/new-release-tails/contents+en.lrpost.title) @@ -573,6 +576,11 @@ msgid "" "href=\"https://www.torproject.org/dist/torbrowser/8.5a10/\">distribution " "directory</a>." msgstr "" +"Le Navigateur Tor 8.5a10 est maintenant disponible à partir de la <a " +"href=\"https://www.torproject.org/projects/torbrowser.html.en#downloads-" +"alpha\">page du projet du Navigateur Tor</a> et aussi de notre <a " +"href=\"https://www.torproject.org/dist/torbrowser/8.5a10/\">répertoire de " +"version.</a>." #: templates/contact.html:8 msgid "Chat with us on" @@ -738,7 +746,7 @@ msgstr "Langue" #: templates/download-tor.html:25 templates/download-tor.html:30 msgid "sig" -msgstr "" +msgstr "sig" #: templates/download.html:5 msgid "Get Connected" diff --git a/contents+pt-BR.po b/contents+pt-BR.po index b85785fe6..f84bf51e2 100644 --- a/contents+pt-BR.po +++ b/contents+pt-BR.po @@ -7,11 +7,11 @@ # Hildeberto Abreu Magalhães <hildeberto(a)gmail.com>, 2019 # Anna e só <contraexemplos(a)gmail.com>, 2019 # Alexei Gonçalves de Oliveira <alexis(a)gessicahellmann.com>, 2019 -# Chacal E., 2019 # Danihells <dcdcampos75(a)gmail.com>, 2019 # Communia <ameaneantie(a)riseup.net>, 2019 # Emma Peel, 2019 # Eduardo Addad de Oliveira <eduardoaddad(a)hotmail.com>, 2019 +# Chacal E., 2019 # msgid "" msgstr "" @@ -19,7 +19,7 @@ msgstr "" "Report-Msgid-Bugs-To: \n" "POT-Creation-Date: 2019-05-09 15:06+CET\n" "PO-Revision-Date: 2019-03-09 10:41+0000\n" -"Last-Translator: Eduardo Addad de Oliveira <eduardoaddad(a)hotmail.com>, 2019\n" +"Last-Translator: Chacal E., 2019\n" "Language-Team: Portuguese (Brazil) (https://www.transifex.com/otf/teams/1519/pt_BR/)\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -514,6 +514,8 @@ msgid "" "The Tor Project, Inc. is a US 501(c)(3) nonprofit organization committed to " "transparency in its work and reporting." msgstr "" +"O Tor Project, Inc. é uma organização sem fins lucrativos dos EUA 501(c)(3) " +"comprometida com a transparência em seu trabalho e relatórios." #: https//www.torproject.org/press/-new-release-tails/ #: (content/press/new-release-tails/contents+en.lrpost.title) @@ -568,6 +570,11 @@ msgid "" "href=\"https://www.torproject.org/dist/torbrowser/8.5a10/\">distribution " "directory</a>." msgstr "" +"O Tor Browser 8.5a10 está agora disponível na <a " +"href=\"https://www.torproject.org/projects/torbrowser.html.en#downloads-" +"alpha\">página Tor Browser Project</a> e também em nosso <a " +"href=\"https://www.torproject.org/dist/torbrowser/8.5a10/\">diretório de " +"distribuição</a>." #: templates/contact.html:8 msgid "Chat with us on" @@ -729,7 +736,7 @@ msgstr "Idioma" #: templates/download-tor.html:25 templates/download-tor.html:30 msgid "sig" -msgstr "" +msgstr "sig" #: templates/download.html:5 msgid "Get Connected"

1 0

[translation/torbutton-securitylevelproperties] Update translations for torbutton-securitylevelproperties
by translation＠torproject.org 09 May '19

09 May '19

commit 42710b600cb58bb01ea64ff019350ae1e556cad5 Author: Translation commit bot <translation(a)torproject.org> Date: Thu May 9 19:19:50 2019 +0000 Update translations for torbutton-securitylevelproperties --- fr/securitylevel.properties | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fr/securitylevel.properties b/fr/securitylevel.properties index 05df69c90..99d19fbed 100644 --- a/fr/securitylevel.properties +++ b/fr/securitylevel.properties @@ -12,7 +12,7 @@ securityLevel.safer.description2 = Certaines polices et certains symboles mathé securityLevel.safer.description3 = Le son et la vidéo (médias HTML5) sont « cliquer pour lire ». securityLevel.safest.level = Le plus sûr securityLevel.safest.tooltip = Niveau de sécurité : le plus sûr -securityLevel.safest.summary = Ne permet que les fonctions de sites Web qui sont exigées pour les sites fixes et les services de base. Ces changements affectent les images, les médias et les scripts. +securityLevel.safest.summary = Ne permet que les fonctions de sites Web exigées pour les sites statiques et les services de base. Ces changements affectent les images, les médias et les scripts. securityLevel.safest.description1 = JavaScript est désactivé par défaut pour tous les sites. securityLevel.safest.description2 = Certaines polices, icônes, images et certains symboles mathématiques sont désactivés. securityLevel.safest.description3 = Le son et la vidéo (médias HTML5) sont « cliquer pour lire ».

1 0

[translation/torbutton-torbuttondtd_completed] Update translations for torbutton-torbuttondtd_completed
by translation＠torproject.org 09 May '19

09 May '19

commit 571222e34e60239ce4e4be26f6508e7c9fe3c752 Author: Translation commit bot <translation(a)torproject.org> Date: Thu May 9 19:19:14 2019 +0000 Update translations for torbutton-torbuttondtd_completed --- fr/torbutton.dtd | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fr/torbutton.dtd b/fr/torbutton.dtd index 647efc677..d56508bbc 100644 --- a/fr/torbutton.dtd +++ b/fr/torbutton.dtd @@ -29,7 +29,7 @@ <!ENTITY torbutton.prefs.sec_safer_description "Désactive les fonctions souvent dangereuses des sites Web, ce qui pourrait entraîner une perte de fonctionnalité de certains sites Web."> <!ENTITY torbutton.prefs.sec_safer_list_label "Au réglage Plus sûr :"> <!ENTITY torbutton.prefs.sec_safest_label "Le plus sûr"> -<!ENTITY torbutton.prefs.sec_safest_description "Ne permet que les fonctions de sites Web qui sont exigées pour les sites fixes et les services de base. Ces changements affectent les images, les médias et les scripts."> +<!ENTITY torbutton.prefs.sec_safest_description "Ne permet que les fonctions de sites Web exigées pour les sites statiques et les services de base. Ces changements affectent les images, les médias et les scripts."> <!ENTITY torbutton.prefs.sec_safest_list_label "Au réglage Le plus sûr :"> <!ENTITY torbutton.prefs.sec_learn_more_label "En apprendre davantage"> <!ENTITY torbutton.prefs.sec_js_on_https_sites_only "JavaScript est désactivé pour les sites non HTTPS.">

1 0