tor-commits May 2019

tor-commits@lists.torproject.org

17 participants
2795 discussions

[community/master] Merge commit 'aa59a59d108fab414610367eb78c59ed81f3e274'
by hiro＠torproject.org 27 May '19

27 May '19

commit f759fa9b1abbbd7177ea3b3560f62b7417cf28e9 Merge: 2dec44b aa59a59 Author: hiro <hiro(a)torproject.org> Date: Mon May 27 14:52:48 2019 +0200 Merge commit 'aa59a59d108fab414610367eb78c59ed81f3e274' templates/home.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

1 0

[community/master] relay guide: add platform specific content
by hiro＠torproject.org 27 May '19

27 May '19

commit aa62941d87449d96c10fe2cc0da836704873db24 Author: nusenu <nusenu-github(a)riseup.net> Date: Sat Apr 27 23:08:45 2019 +0000 relay guide: add platform specific content move exit configuration into separate file remove openSUSE --- .../technical-setup/centosrhel/contents.lr | 9 + .../technical-setup/debianubuntu/contents.lr | 43 +++++ .../technical-setup/exit-relay/contents.lr | 205 +++++++++++++++++++++ .../technical-setup/fedora/contents.lr | 9 + .../technical-setup/freebsd/contents.lr | 9 + 5 files changed, 275 insertions(+) diff --git a/content/relay-operations/technical-setup/centosrhel/contents.lr b/content/relay-operations/technical-setup/centosrhel/contents.lr new file mode 100644 index 0000000..224dadf --- /dev/null +++ b/content/relay-operations/technical-setup/centosrhel/contents.lr @@ -0,0 +1,9 @@ +_model: page +--- +title: CentOS/RHEL +--- +html: relay-operations.html +--- +section: relay operations +--- +section_id: relay-operations diff --git a/content/relay-operations/technical-setup/debianubuntu/contents.lr b/content/relay-operations/technical-setup/debianubuntu/contents.lr new file mode 100644 index 0000000..c8627c5 --- /dev/null +++ b/content/relay-operations/technical-setup/debianubuntu/contents.lr @@ -0,0 +1,43 @@ +_model: page +--- +title: Debian/Ubuntu +--- +html: relay-operations.html +--- +section: relay operations +--- +section_id: relay-operations +--- +body: + +# 1. Configure Tor Package Repository + +Enable the Torproject package repository by following the instructions +**[here](https://2019.www.torproject.org/docs/debian.html.en#ubuntu)**. + +# 2. Package Installation + +Install the `tor` package: + +`apt update && apt install tor` + +# 3. Configuration File + +Put the configuration file `/etc/tor/torrc` in place: + +``` +#change the nickname "myNiceRelay" to a name that you like +Nickname myNiceRelay +ORPort 443 +ExitRelay 0 +SocksPort 0 +ControlSocket 0 +# Change the email address bellow and be aware that it will be published +ContactInfo tor-operator@your-emailaddress-domain +``` + +# 4. Restart the Service + +Restart the tor daemon so your configuration changes take effect: + +`systemctl restart tor@default` diff --git a/content/relay-operations/technical-setup/exit-relay/contents.lr b/content/relay-operations/technical-setup/exit-relay/contents.lr new file mode 100644 index 0000000..8686f47 --- /dev/null +++ b/content/relay-operations/technical-setup/exit-relay/contents.lr @@ -0,0 +1,205 @@ +_model: page +--- +title: Exit Relay Configuration +--- +html: relay-operations.html +--- +section: relay operations +--- +section_id: relay-operations +--- +key: 5 +--- +body: + +We assume you read through the [relay guide](..) already. This subpage is +for operators that want to turn on exiting on their relay. + +It is recommended that you setup exit relays on servers dedicated to this +purpose. It is not recommended to install Tor exit relays on servers that you +need for other services as well. Do not mix your own traffic with your exit +relay traffic. + +## Reverse DNS and WHOIS record + +Before turning your non-exit relay into an exit relay, ensure that you have set a +reverse DNS record (PTR) to make it more obvious that this is a tor +exit relay. Something like "tor-exit" it its name is a good start. + +If your provider offers it, make sure your WHOIS record contains clear +indications that this is a Tor exit relay. + +## Exit Notice HTML page + +To make it even more obvious that this is a Tor exit relay you should serve a +Tor exit notice HTML page. Tor can do that for you if your DirPort is on TCP +port 80, you can make use of tor's DirPortFrontPage feature to display a +HTML file on that port. This file will be shown to anyone directing his browser +to your Tor exit relay IP address. + +``` +DirPort 80 +DirPortFrontPage /path/to/html/file +``` + +We offer a sample Tor exit notice HTML file, but you might want to adjust it to +your needs: +https://gitweb.torproject.org/tor.git/plain/contrib/operator-tools/tor-exit-notice.html + +Here are some more tips for running a reliable exit relay: +https://blog.torproject.org/tips-running-exit-node + +## Exit Policy + +Defining the [exit +policy](https://www.torproject.org/docs/tor-manual.html.en#ExitPolicy) +is one of the most important parts of an exit relay configuration. The exit +policy defines which destination ports you are willing to forward. This has an +impact on the amount of abuse emails you will get (less ports means less abuse +emails, but an exit relay allowing only few ports is also less useful). If you +want to be a useful exit relay you must **at least allow destination ports 80 +and 443**. + +As a new exit relay - especially if you are new to your hoster - it is good to +start with a reduced exit policy (to reduce the amount of abuse emails) and +further open it up as you become more experienced. The reduced exit policy can +be found on the +[ReducedExitPolicy](https://trac.torproject.org/projects/tor/wiki/doc/ReducedExitPolicy) +wiki page. + +To become an exit relay change ExitRelay from 0 to 1 in your torrc configuration +file and restart the tor daemon. + +``` +ExitRelay 1 +``` + +## DNS on Exit Relays + +Unlike other types of relays, exit relays also do DNS resolution for Tor +clients. DNS resolution on exit relays is crucial for Tor clients, it should be +reliable and fast by using caching. + +* DNS resolution can have a significant impact on the performance and reliability your exit relay provides. Poor DNS performance will result in less traffic going through your exit relay. +* Don't use any of the big DNS resolvers as your primary or fallback DNS resolver to avoid centralization (Google, OpenDNS, Quad9, Cloudflare, 4.2.2.1-6) +* We recommend running a local caching and DNSSEC-validating resolver without using any forwarders (specific instructions follow bellow for each operating systems) +* if you want to add a second DNS resolver as a fallback to your /etc/resolv.conf configuration, try to choose a resolver within your autonomous system and make sure it is not your first entry in that file (the first entry should be your local resolver) +* if a local resolver like unbound is not an option for you try to use a resolver that your provider runs in the same autonomous system (to find out if an IP address is in the same AS as your relay, you can look it up, using for example https://bgp.he.net). +* try to avoid adding too many resolvers to your /etc/resolv.conf file to limit exposure on an AS-level (try to not use more than two entries) + +There are multiple options for DNS server software, unbound has become a popular +one but **feel free to use any other you are comfortable with**. When choosing your +DNS resolver software try to ensure it supports DNSSEC validation and QNAME +minimisation (RFC7816). In every case the software should be installed +using the OS package manager to ensure it is updated with the rest of the +system. + +By using your own DNS resolver you are less vulnerable to DNS-based censorship +that your upstream resolver might impose. + +Here follow specific instructions on how to install and configure unbound on +your exit - a DNSSEC-validating and caching resolver. unbound has many +configuration and tuning nobs but we try to keep these instructions as simple +and short as possible and the basic setup will do just fine for most operators. + +After switching to unbound verify it works as expected by resolving a valid +hostname, if it does not work, you can restore the old resolv.conf file. + +### Debian/Ubuntu + +The following 3 commands install unbound, backup your DNS configuration and tell +the system to use the local unbound: + +``` +apt install unbound +cp /etc/resolv.conf /etc/resolv.conf.backup +echo nameserver 127.0.0.1 > /etc/resolv.conf +``` + +To avoid that the configuration gets changed (for example by the DHCP client): + +``` +chattr +i /etc/resolv.conf +``` + +The Debian configuration ships with QNAME minimisation (RFC7816) enabled +by default so you don't need to enable it explicitly. The unbound resolver you +just installed does also DNSSEC validation. + +### CentOS/RHEL + +Install the unbound package: + +``` +yum install unbound +``` + +in /etc/unbound/unbound.conf replace the line + +``` +# qname-minimisation: no +``` + +with: + +``` +qname-minimisation: yes +``` + +enable and start unbound: + +``` +systemctl enable unbound +systemctl start unbound +``` + +Tell the system to use the local unbound server: + +``` +cp /etc/resolv.conf /etc/resolv.conf.backup +echo nameserver 127.0.0.1 > /etc/resolv.conf +``` + +To avoid that the configuration gets changed (for example by the DHCP client): + +``` +chattr +i /etc/resolv.conf +``` + +### FreeBSD + +FreeBSD ships unbound in the base system but the one in ports is usually +following upstream more closely so we install the unbound package: + +``` +pkg install unbound +``` + +Replace the content in /usr/local/etc/unbound/unbound.conf with the following lines: + +``` +server: + verbosity: 1 + qname-minimisation: yes +``` + +enable and start the unbound service: + +``` +sysrc unbound_enable=YES +service unbound start +``` + +Tell the system to use the local unbound server: + +``` +cp /etc/resolv.conf /etc/resolv.conf.backup +echo nameserver 127.0.0.1 > /etc/resolv.conf +``` + +To avoid that the configuration gets changed (for example by the DHCP client): + +``` +chflags schg /etc/resolv.conf +``` + diff --git a/content/relay-operations/technical-setup/fedora/contents.lr b/content/relay-operations/technical-setup/fedora/contents.lr new file mode 100644 index 0000000..a0ab0a4 --- /dev/null +++ b/content/relay-operations/technical-setup/fedora/contents.lr @@ -0,0 +1,9 @@ +_model: page +--- +title: Fedora +--- +html: relay-operations.html +--- +section: relay operations +--- +section_id: relay-operations diff --git a/content/relay-operations/technical-setup/freebsd/contents.lr b/content/relay-operations/technical-setup/freebsd/contents.lr new file mode 100644 index 0000000..de83c05 --- /dev/null +++ b/content/relay-operations/technical-setup/freebsd/contents.lr @@ -0,0 +1,9 @@ +_model: page +--- +title: FreeBSD +--- +html: relay-operations.html +--- +section: relay operations +--- +section_id: relay-operations

1 0

[translation/support-portal_completed] Update translations for support-portal_completed
by translation＠torproject.org 27 May '19

27 May '19

commit 61a8bd9a61c0b4a8ffb0c22c48fc1157b53fa2a0 Author: Translation commit bot <translation(a)torproject.org> Date: Mon May 27 12:51:08 2019 +0000 Update translations for support-portal_completed --- contents+fr.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contents+fr.po b/contents+fr.po index f014a1b6e..4f1350339 100644 --- a/contents+fr.po +++ b/contents+fr.po @@ -3260,7 +3260,7 @@ msgid "" "href=\"https://trac.torproject.org/projects/tor/wiki/TorRelayGuide\">Tor " "Relay Guide</a>." msgstr "" -"Vous trouverez la ressource la plus fouillée sur la mise en place d’un " +"Vous trouverez la ressource la plus fouillée sur la mise en fonction d’un " "relais dans notre <a " "href=\"https://trac.torproject.org/projects/tor/wiki/TorRelayGuide\">guide " "sur les relais Tor</a> (page en anglais)."

1 0

[translation/support-portal] Update translations for support-portal
by translation＠torproject.org 27 May '19

27 May '19

commit 949fdd0b107c20e8e23a6117637feb4c95c82e56 Author: Translation commit bot <translation(a)torproject.org> Date: Mon May 27 12:51:00 2019 +0000 Update translations for support-portal --- contents+fr.po | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contents+fr.po b/contents+fr.po index f014a1b6e..4f1350339 100644 --- a/contents+fr.po +++ b/contents+fr.po @@ -3260,7 +3260,7 @@ msgid "" "href=\"https://trac.torproject.org/projects/tor/wiki/TorRelayGuide\">Tor " "Relay Guide</a>." msgstr "" -"Vous trouverez la ressource la plus fouillée sur la mise en place d’un " +"Vous trouverez la ressource la plus fouillée sur la mise en fonction d’un " "relais dans notre <a " "href=\"https://trac.torproject.org/projects/tor/wiki/TorRelayGuide\">guide " "sur les relais Tor</a> (page en anglais)."

1 0

[translation/communitytpo-contentspot_completed] Update translations for communitytpo-contentspot_completed
by translation＠torproject.org 27 May '19

27 May '19

commit 883a869ee2e87f0b9e9f82fd6f58881cb7309182 Author: Translation commit bot <translation(a)torproject.org> Date: Mon May 27 12:15:56 2019 +0000 Update translations for communitytpo-contentspot_completed --- contents+en.po | 86 +++++++++++++++++++++++++++++++++++++++++++++++----------- contents.pot | 86 +++++++++++++++++++++++++++++++++++++++++++++++----------- 2 files changed, 140 insertions(+), 32 deletions(-) diff --git a/contents+en.po b/contents+en.po index d921ab2a5..ae2b0ec1d 100644 --- a/contents+en.po +++ b/contents+en.po @@ -3,7 +3,7 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2019-05-22 10:45+CET\n" +"POT-Creation-Date: 2019-05-27 14:12+CET\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" "Language-Team: en <LL(a)li.org>\n" @@ -241,11 +241,13 @@ msgstr "" msgid "" "Our current translation priorities are translating the [Tor " "Browser](https://torpat.ch/locales), its documentation and the [Tor Project " -"website](https://torpat.ch/tpo-locales)." +"website](https://torpat.ch/tpo-locales), and there are always other " +"documents to translate." msgstr "" "Our current translation priorities are translating the [Tor " "Browser](https://torpat.ch/locales), its documentation and the [Tor Project " -"website](https://torpat.ch/tpo-locales)." +"website](https://torpat.ch/tpo-locales), and there are always other " +"documents to translate." #: https//torproject.org/menu2/ (content/menu2/contents+en.lrpage.title) #: (content/menu2/contents+en.lrpage.body) @@ -3726,8 +3728,26 @@ msgstr "Translate strings" #: https//torproject.org/localization/translate-strings/ #: (content/localization/translate-strings/contents+en.lrpage.subtitle) -msgid "How to do this ..." -msgstr "How to do this ..." +msgid "How to translate" +msgstr "How to translate" + +#: https//torproject.org/localization/translate-strings/ +#: (content/localization/translate-strings/contents+en.lrpage.body) +msgid "" +"The Tor Project translatable strings are spread over different projects in " +"Transifex." +msgstr "" +"The Tor Project translatable strings are spread over different projects in " +"Transifex." + +#: https//torproject.org/localization/translate-strings/ +#: (content/localization/translate-strings/contents+en.lrpage.body) +msgid "" +"To find out about our priorities and translation needs you can read the [Tor" +" Localization Lab wiki page](https://wiki.localizationlab.org/index.php/Tor)" +msgstr "" +"To find out about our priorities and translation needs you can read the [Tor" +" Localization Lab wiki page](https://wiki.localizationlab.org/index.php/Tor)" #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.title) @@ -3738,12 +3758,12 @@ msgstr "Becoming a Tor translator" #: (content/localization/becoming-tor-translator/contents+en.lrpage.subtitle) msgid "" "Tor Project localization is hosted in the Localization Lab Hub on Transifex," -" a third-party translation tool. Read on for details on how to sign up and " -"begin contributing." +" a third-party translation platform. Read on for details on how to sign up " +"and begin contributing." msgstr "" "Tor Project localization is hosted in the Localization Lab Hub on Transifex," -" a third-party translation tool. Read on for details on how to sign up and " -"begin contributing." +" a third-party translation platform. Read on for details on how to sign up " +"and begin contributing." #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.body) @@ -3752,31 +3772,56 @@ msgid "" "or the Tor Browser to your language, your help would be greatly appreciated!" " Tor Project localization is hosted in the [Localization Lab " "Hub](https://www.localizationlab.org/) on Transifex, a third-party " -"translation tool. In order to begin contributing you will have to sign up " -"with Transifex. Below is an outline of how to sign up and begin." +"translation platform." msgstr "" "If you are interested in helping out the project by translating the manual " "or the Tor Browser to your language, your help would be greatly appreciated!" " Tor Project localization is hosted in the [Localization Lab " "Hub](https://www.localizationlab.org/) on Transifex, a third-party " -"translation tool. In order to begin contributing you will have to sign up " -"with Transifex. Below is an outline of how to sign up and begin." +"translation platform." #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.body) msgid "" +"In order to begin contributing you will have to sign up with Transifex. " +"Below is an outline of how to sign up and begin." +msgstr "" +"In order to begin contributing you will have to sign up with Transifex. " +"Below is an outline of how to sign up and begin." + +#: https//torproject.org/localization/becoming-tor-translator/ +#: (content/localization/becoming-tor-translator/contents+en.lrpage.body) +msgid "" +"Before translating, please read through the Tor Project page on the " +"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor)." +msgstr "" "Before translating, please read through the Tor Project page on the " -"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor). " +"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor)." + +#: https//torproject.org/localization/becoming-tor-translator/ +#: (content/localization/becoming-tor-translator/contents+en.lrpage.body) +msgid "" "There you will find translation guidelines and resources that will help you " "contribute to Tor translations." msgstr "" -"Before translating, please read through the Tor Project page on the " -"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor). " "There you will find translation guidelines and resources that will help you " "contribute to Tor translations." #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.body) +msgid "" +"You are cordially invited to join the [Tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n), to " +"organize translations, participate in our decisions, report errors in source" +" strings, etc." +msgstr "" +"You are cordially invited to join the [Tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n), to " +"organize translations, participate in our decisions, report errors in source" +" strings, etc." + +#: https//torproject.org/localization/becoming-tor-translator/ +#: (content/localization/becoming-tor-translator/contents+en.lrpage.body) msgid "# Signing Up On Transifex" msgstr "# Signing Up On Transifex" @@ -3952,6 +3997,15 @@ msgstr "" "* You can report such issues on [irc](https://webchat.oftc.net/), on the " "#tor-l10n channel (you may need to be registered to log in)." +#: https//torproject.org/localization/translation-problem/ +#: (content/localization/translation-problem/contents+en.lrpage.body) +msgid "" +"* You can send an email to the [tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n)." +msgstr "" +"* You can send an email to the [tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n)." + #: https//torproject.org/outreach/kit/ #: (content/outreach/kit/contents+en.lrpage.title) msgid "Stream team kit" diff --git a/contents.pot b/contents.pot index d921ab2a5..ae2b0ec1d 100644 --- a/contents.pot +++ b/contents.pot @@ -3,7 +3,7 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2019-05-22 10:45+CET\n" +"POT-Creation-Date: 2019-05-27 14:12+CET\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" "Language-Team: en <LL(a)li.org>\n" @@ -241,11 +241,13 @@ msgstr "" msgid "" "Our current translation priorities are translating the [Tor " "Browser](https://torpat.ch/locales), its documentation and the [Tor Project " -"website](https://torpat.ch/tpo-locales)." +"website](https://torpat.ch/tpo-locales), and there are always other " +"documents to translate." msgstr "" "Our current translation priorities are translating the [Tor " "Browser](https://torpat.ch/locales), its documentation and the [Tor Project " -"website](https://torpat.ch/tpo-locales)." +"website](https://torpat.ch/tpo-locales), and there are always other " +"documents to translate." #: https//torproject.org/menu2/ (content/menu2/contents+en.lrpage.title) #: (content/menu2/contents+en.lrpage.body) @@ -3726,8 +3728,26 @@ msgstr "Translate strings" #: https//torproject.org/localization/translate-strings/ #: (content/localization/translate-strings/contents+en.lrpage.subtitle) -msgid "How to do this ..." -msgstr "How to do this ..." +msgid "How to translate" +msgstr "How to translate" + +#: https//torproject.org/localization/translate-strings/ +#: (content/localization/translate-strings/contents+en.lrpage.body) +msgid "" +"The Tor Project translatable strings are spread over different projects in " +"Transifex." +msgstr "" +"The Tor Project translatable strings are spread over different projects in " +"Transifex." + +#: https//torproject.org/localization/translate-strings/ +#: (content/localization/translate-strings/contents+en.lrpage.body) +msgid "" +"To find out about our priorities and translation needs you can read the [Tor" +" Localization Lab wiki page](https://wiki.localizationlab.org/index.php/Tor)" +msgstr "" +"To find out about our priorities and translation needs you can read the [Tor" +" Localization Lab wiki page](https://wiki.localizationlab.org/index.php/Tor)" #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.title) @@ -3738,12 +3758,12 @@ msgstr "Becoming a Tor translator" #: (content/localization/becoming-tor-translator/contents+en.lrpage.subtitle) msgid "" "Tor Project localization is hosted in the Localization Lab Hub on Transifex," -" a third-party translation tool. Read on for details on how to sign up and " -"begin contributing." +" a third-party translation platform. Read on for details on how to sign up " +"and begin contributing." msgstr "" "Tor Project localization is hosted in the Localization Lab Hub on Transifex," -" a third-party translation tool. Read on for details on how to sign up and " -"begin contributing." +" a third-party translation platform. Read on for details on how to sign up " +"and begin contributing." #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.body) @@ -3752,31 +3772,56 @@ msgid "" "or the Tor Browser to your language, your help would be greatly appreciated!" " Tor Project localization is hosted in the [Localization Lab " "Hub](https://www.localizationlab.org/) on Transifex, a third-party " -"translation tool. In order to begin contributing you will have to sign up " -"with Transifex. Below is an outline of how to sign up and begin." +"translation platform." msgstr "" "If you are interested in helping out the project by translating the manual " "or the Tor Browser to your language, your help would be greatly appreciated!" " Tor Project localization is hosted in the [Localization Lab " "Hub](https://www.localizationlab.org/) on Transifex, a third-party " -"translation tool. In order to begin contributing you will have to sign up " -"with Transifex. Below is an outline of how to sign up and begin." +"translation platform." #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.body) msgid "" +"In order to begin contributing you will have to sign up with Transifex. " +"Below is an outline of how to sign up and begin." +msgstr "" +"In order to begin contributing you will have to sign up with Transifex. " +"Below is an outline of how to sign up and begin." + +#: https//torproject.org/localization/becoming-tor-translator/ +#: (content/localization/becoming-tor-translator/contents+en.lrpage.body) +msgid "" +"Before translating, please read through the Tor Project page on the " +"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor)." +msgstr "" "Before translating, please read through the Tor Project page on the " -"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor). " +"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor)." + +#: https//torproject.org/localization/becoming-tor-translator/ +#: (content/localization/becoming-tor-translator/contents+en.lrpage.body) +msgid "" "There you will find translation guidelines and resources that will help you " "contribute to Tor translations." msgstr "" -"Before translating, please read through the Tor Project page on the " -"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor). " "There you will find translation guidelines and resources that will help you " "contribute to Tor translations." #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.body) +msgid "" +"You are cordially invited to join the [Tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n), to " +"organize translations, participate in our decisions, report errors in source" +" strings, etc." +msgstr "" +"You are cordially invited to join the [Tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n), to " +"organize translations, participate in our decisions, report errors in source" +" strings, etc." + +#: https//torproject.org/localization/becoming-tor-translator/ +#: (content/localization/becoming-tor-translator/contents+en.lrpage.body) msgid "# Signing Up On Transifex" msgstr "# Signing Up On Transifex" @@ -3952,6 +3997,15 @@ msgstr "" "* You can report such issues on [irc](https://webchat.oftc.net/), on the " "#tor-l10n channel (you may need to be registered to log in)." +#: https//torproject.org/localization/translation-problem/ +#: (content/localization/translation-problem/contents+en.lrpage.body) +msgid "" +"* You can send an email to the [tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n)." +msgstr "" +"* You can send an email to the [tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n)." + #: https//torproject.org/outreach/kit/ #: (content/outreach/kit/contents+en.lrpage.title) msgid "Stream team kit"

1 0

[translation/communitytpo-contentspot] Update translations for communitytpo-contentspot
by translation＠torproject.org 27 May '19

27 May '19

commit 78ab7c6ee557538a3aef95a9737183d6a78bbc57 Author: Translation commit bot <translation(a)torproject.org> Date: Mon May 27 12:15:47 2019 +0000 Update translations for communitytpo-contentspot --- contents+en.po | 86 +++++++++++++++++++++++++++++++++++++++++++++++----------- contents.pot | 86 +++++++++++++++++++++++++++++++++++++++++++++++----------- 2 files changed, 140 insertions(+), 32 deletions(-) diff --git a/contents+en.po b/contents+en.po index d921ab2a5..ae2b0ec1d 100644 --- a/contents+en.po +++ b/contents+en.po @@ -3,7 +3,7 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2019-05-22 10:45+CET\n" +"POT-Creation-Date: 2019-05-27 14:12+CET\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" "Language-Team: en <LL(a)li.org>\n" @@ -241,11 +241,13 @@ msgstr "" msgid "" "Our current translation priorities are translating the [Tor " "Browser](https://torpat.ch/locales), its documentation and the [Tor Project " -"website](https://torpat.ch/tpo-locales)." +"website](https://torpat.ch/tpo-locales), and there are always other " +"documents to translate." msgstr "" "Our current translation priorities are translating the [Tor " "Browser](https://torpat.ch/locales), its documentation and the [Tor Project " -"website](https://torpat.ch/tpo-locales)." +"website](https://torpat.ch/tpo-locales), and there are always other " +"documents to translate." #: https//torproject.org/menu2/ (content/menu2/contents+en.lrpage.title) #: (content/menu2/contents+en.lrpage.body) @@ -3726,8 +3728,26 @@ msgstr "Translate strings" #: https//torproject.org/localization/translate-strings/ #: (content/localization/translate-strings/contents+en.lrpage.subtitle) -msgid "How to do this ..." -msgstr "How to do this ..." +msgid "How to translate" +msgstr "How to translate" + +#: https//torproject.org/localization/translate-strings/ +#: (content/localization/translate-strings/contents+en.lrpage.body) +msgid "" +"The Tor Project translatable strings are spread over different projects in " +"Transifex." +msgstr "" +"The Tor Project translatable strings are spread over different projects in " +"Transifex." + +#: https//torproject.org/localization/translate-strings/ +#: (content/localization/translate-strings/contents+en.lrpage.body) +msgid "" +"To find out about our priorities and translation needs you can read the [Tor" +" Localization Lab wiki page](https://wiki.localizationlab.org/index.php/Tor)" +msgstr "" +"To find out about our priorities and translation needs you can read the [Tor" +" Localization Lab wiki page](https://wiki.localizationlab.org/index.php/Tor)" #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.title) @@ -3738,12 +3758,12 @@ msgstr "Becoming a Tor translator" #: (content/localization/becoming-tor-translator/contents+en.lrpage.subtitle) msgid "" "Tor Project localization is hosted in the Localization Lab Hub on Transifex," -" a third-party translation tool. Read on for details on how to sign up and " -"begin contributing." +" a third-party translation platform. Read on for details on how to sign up " +"and begin contributing." msgstr "" "Tor Project localization is hosted in the Localization Lab Hub on Transifex," -" a third-party translation tool. Read on for details on how to sign up and " -"begin contributing." +" a third-party translation platform. Read on for details on how to sign up " +"and begin contributing." #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.body) @@ -3752,31 +3772,56 @@ msgid "" "or the Tor Browser to your language, your help would be greatly appreciated!" " Tor Project localization is hosted in the [Localization Lab " "Hub](https://www.localizationlab.org/) on Transifex, a third-party " -"translation tool. In order to begin contributing you will have to sign up " -"with Transifex. Below is an outline of how to sign up and begin." +"translation platform." msgstr "" "If you are interested in helping out the project by translating the manual " "or the Tor Browser to your language, your help would be greatly appreciated!" " Tor Project localization is hosted in the [Localization Lab " "Hub](https://www.localizationlab.org/) on Transifex, a third-party " -"translation tool. In order to begin contributing you will have to sign up " -"with Transifex. Below is an outline of how to sign up and begin." +"translation platform." #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.body) msgid "" +"In order to begin contributing you will have to sign up with Transifex. " +"Below is an outline of how to sign up and begin." +msgstr "" +"In order to begin contributing you will have to sign up with Transifex. " +"Below is an outline of how to sign up and begin." + +#: https//torproject.org/localization/becoming-tor-translator/ +#: (content/localization/becoming-tor-translator/contents+en.lrpage.body) +msgid "" +"Before translating, please read through the Tor Project page on the " +"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor)." +msgstr "" "Before translating, please read through the Tor Project page on the " -"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor). " +"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor)." + +#: https//torproject.org/localization/becoming-tor-translator/ +#: (content/localization/becoming-tor-translator/contents+en.lrpage.body) +msgid "" "There you will find translation guidelines and resources that will help you " "contribute to Tor translations." msgstr "" -"Before translating, please read through the Tor Project page on the " -"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor). " "There you will find translation guidelines and resources that will help you " "contribute to Tor translations." #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.body) +msgid "" +"You are cordially invited to join the [Tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n), to " +"organize translations, participate in our decisions, report errors in source" +" strings, etc." +msgstr "" +"You are cordially invited to join the [Tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n), to " +"organize translations, participate in our decisions, report errors in source" +" strings, etc." + +#: https//torproject.org/localization/becoming-tor-translator/ +#: (content/localization/becoming-tor-translator/contents+en.lrpage.body) msgid "# Signing Up On Transifex" msgstr "# Signing Up On Transifex" @@ -3952,6 +3997,15 @@ msgstr "" "* You can report such issues on [irc](https://webchat.oftc.net/), on the " "#tor-l10n channel (you may need to be registered to log in)." +#: https//torproject.org/localization/translation-problem/ +#: (content/localization/translation-problem/contents+en.lrpage.body) +msgid "" +"* You can send an email to the [tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n)." +msgstr "" +"* You can send an email to the [tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n)." + #: https//torproject.org/outreach/kit/ #: (content/outreach/kit/contents+en.lrpage.title) msgid "Stream team kit" diff --git a/contents.pot b/contents.pot index d921ab2a5..ae2b0ec1d 100644 --- a/contents.pot +++ b/contents.pot @@ -3,7 +3,7 @@ msgid "" msgstr "" "Project-Id-Version: PACKAGE VERSION\n" "Report-Msgid-Bugs-To: \n" -"POT-Creation-Date: 2019-05-22 10:45+CET\n" +"POT-Creation-Date: 2019-05-27 14:12+CET\n" "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n" "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n" "Language-Team: en <LL(a)li.org>\n" @@ -241,11 +241,13 @@ msgstr "" msgid "" "Our current translation priorities are translating the [Tor " "Browser](https://torpat.ch/locales), its documentation and the [Tor Project " -"website](https://torpat.ch/tpo-locales)." +"website](https://torpat.ch/tpo-locales), and there are always other " +"documents to translate." msgstr "" "Our current translation priorities are translating the [Tor " "Browser](https://torpat.ch/locales), its documentation and the [Tor Project " -"website](https://torpat.ch/tpo-locales)." +"website](https://torpat.ch/tpo-locales), and there are always other " +"documents to translate." #: https//torproject.org/menu2/ (content/menu2/contents+en.lrpage.title) #: (content/menu2/contents+en.lrpage.body) @@ -3726,8 +3728,26 @@ msgstr "Translate strings" #: https//torproject.org/localization/translate-strings/ #: (content/localization/translate-strings/contents+en.lrpage.subtitle) -msgid "How to do this ..." -msgstr "How to do this ..." +msgid "How to translate" +msgstr "How to translate" + +#: https//torproject.org/localization/translate-strings/ +#: (content/localization/translate-strings/contents+en.lrpage.body) +msgid "" +"The Tor Project translatable strings are spread over different projects in " +"Transifex." +msgstr "" +"The Tor Project translatable strings are spread over different projects in " +"Transifex." + +#: https//torproject.org/localization/translate-strings/ +#: (content/localization/translate-strings/contents+en.lrpage.body) +msgid "" +"To find out about our priorities and translation needs you can read the [Tor" +" Localization Lab wiki page](https://wiki.localizationlab.org/index.php/Tor)" +msgstr "" +"To find out about our priorities and translation needs you can read the [Tor" +" Localization Lab wiki page](https://wiki.localizationlab.org/index.php/Tor)" #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.title) @@ -3738,12 +3758,12 @@ msgstr "Becoming a Tor translator" #: (content/localization/becoming-tor-translator/contents+en.lrpage.subtitle) msgid "" "Tor Project localization is hosted in the Localization Lab Hub on Transifex," -" a third-party translation tool. Read on for details on how to sign up and " -"begin contributing." +" a third-party translation platform. Read on for details on how to sign up " +"and begin contributing." msgstr "" "Tor Project localization is hosted in the Localization Lab Hub on Transifex," -" a third-party translation tool. Read on for details on how to sign up and " -"begin contributing." +" a third-party translation platform. Read on for details on how to sign up " +"and begin contributing." #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.body) @@ -3752,31 +3772,56 @@ msgid "" "or the Tor Browser to your language, your help would be greatly appreciated!" " Tor Project localization is hosted in the [Localization Lab " "Hub](https://www.localizationlab.org/) on Transifex, a third-party " -"translation tool. In order to begin contributing you will have to sign up " -"with Transifex. Below is an outline of how to sign up and begin." +"translation platform." msgstr "" "If you are interested in helping out the project by translating the manual " "or the Tor Browser to your language, your help would be greatly appreciated!" " Tor Project localization is hosted in the [Localization Lab " "Hub](https://www.localizationlab.org/) on Transifex, a third-party " -"translation tool. In order to begin contributing you will have to sign up " -"with Transifex. Below is an outline of how to sign up and begin." +"translation platform." #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.body) msgid "" +"In order to begin contributing you will have to sign up with Transifex. " +"Below is an outline of how to sign up and begin." +msgstr "" +"In order to begin contributing you will have to sign up with Transifex. " +"Below is an outline of how to sign up and begin." + +#: https//torproject.org/localization/becoming-tor-translator/ +#: (content/localization/becoming-tor-translator/contents+en.lrpage.body) +msgid "" +"Before translating, please read through the Tor Project page on the " +"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor)." +msgstr "" "Before translating, please read through the Tor Project page on the " -"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor). " +"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor)." + +#: https//torproject.org/localization/becoming-tor-translator/ +#: (content/localization/becoming-tor-translator/contents+en.lrpage.body) +msgid "" "There you will find translation guidelines and resources that will help you " "contribute to Tor translations." msgstr "" -"Before translating, please read through the Tor Project page on the " -"[Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor). " "There you will find translation guidelines and resources that will help you " "contribute to Tor translations." #: https//torproject.org/localization/becoming-tor-translator/ #: (content/localization/becoming-tor-translator/contents+en.lrpage.body) +msgid "" +"You are cordially invited to join the [Tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n), to " +"organize translations, participate in our decisions, report errors in source" +" strings, etc." +msgstr "" +"You are cordially invited to join the [Tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n), to " +"organize translations, participate in our decisions, report errors in source" +" strings, etc." + +#: https//torproject.org/localization/becoming-tor-translator/ +#: (content/localization/becoming-tor-translator/contents+en.lrpage.body) msgid "# Signing Up On Transifex" msgstr "# Signing Up On Transifex" @@ -3952,6 +3997,15 @@ msgstr "" "* You can report such issues on [irc](https://webchat.oftc.net/), on the " "#tor-l10n channel (you may need to be registered to log in)." +#: https//torproject.org/localization/translation-problem/ +#: (content/localization/translation-problem/contents+en.lrpage.body) +msgid "" +"* You can send an email to the [tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n)." +msgstr "" +"* You can send an email to the [tor localization mailing " +"list](https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-l10n)." + #: https//torproject.org/outreach/kit/ #: (content/outreach/kit/contents+en.lrpage.title) msgid "Stream team kit"

1 0

[tor/master] Only reject POSTDESCRIPTOR purpose= when the purpose is unrecognized
by asn＠torproject.org 27 May '19

27 May '19

commit 57ee0e3af98e5dce398e8bc7f6f2b77e53208288 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 23 08:24:29 2019 -0400 Only reject POSTDESCRIPTOR purpose= when the purpose is unrecognized Fixes bug 30580; bugfix on 0.4.1.1-alpha. --- changes/ticket30580 | 4 ++++ src/feature/control/control_cmd.c | 8 +++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/changes/ticket30580 b/changes/ticket30580 new file mode 100644 index 000000000..9ff1a33e4 --- /dev/null +++ b/changes/ticket30580 @@ -0,0 +1,4 @@ + o Minor bugfixes (controller): + - POSTDESCRIPTOR requests should work again. Previously, they were + broken if a "purpose=" flag was specified. Fixes bug 30580; + bugfix on 0.4.1.1-alpha. diff --git a/src/feature/control/control_cmd.c b/src/feature/control/control_cmd.c index 5555a2c5c..17d5b0c7f 100644 --- a/src/feature/control/control_cmd.c +++ b/src/feature/control/control_cmd.c @@ -1049,9 +1049,11 @@ handle_control_postdescriptor(control_connection_t *conn, line = config_line_find_case(args->kwargs, "purpose"); if (line) { purpose = router_purpose_from_string(line->value); - control_printf_endreply(conn, 552, "Unknown purpose \"%s\"", - line->value); - goto done; + if (purpose == ROUTER_PURPOSE_UNKNOWN) { + control_printf_endreply(conn, 552, "Unknown purpose \"%s\"", + line->value); + goto done; + } } line = config_line_find_case(args->kwargs, "cache"); if (line) {

1 0

[tor/master] Merge branch 'tor-github/pr/1042'
by asn＠torproject.org 27 May '19

27 May '19

commit 0a86f14addd031ac69647f4ab6fc66c1835cd31e Merge: 130eb227a 57ee0e3af Author: George Kadianakis <desnacked(a)riseup.net> Date: Mon May 27 14:22:01 2019 +0300 Merge branch 'tor-github/pr/1042' changes/ticket30580 | 4 ++++ src/feature/control/control_cmd.c | 8 +++++--- 2 files changed, 9 insertions(+), 3 deletions(-)

1 0

[tor/master] Tests for deciding how full our relay cells should be
by asn＠torproject.org 27 May '19

27 May '19

commit fcd51fd49f8c30ab8d5d1d099d43e510187150c6 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu May 23 09:29:24 2019 -0400 Tests for deciding how full our relay cells should be --- src/core/or/relay.c | 2 +- src/core/or/relay.h | 3 ++ src/test/test_sendme.c | 79 ++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 83 insertions(+), 1 deletion(-) diff --git a/src/core/or/relay.c b/src/core/or/relay.c index c48147dff..9f90a0969 100644 --- a/src/core/or/relay.c +++ b/src/core/or/relay.c @@ -2055,7 +2055,7 @@ circuit_reset_sendme_randomness(circuit_t *circ) * Helper. Return the number of bytes that should be put into a cell from a * given edge connection on which n_available bytes are available. */ -static size_t +STATIC size_t connection_edge_get_inbuf_bytes_to_package(size_t n_available, int package_partial, circuit_t *on_circuit) diff --git a/src/core/or/relay.h b/src/core/or/relay.h index 0fc308f7d..79036f97b 100644 --- a/src/core/or/relay.h +++ b/src/core/or/relay.h @@ -123,6 +123,9 @@ STATIC int connection_edge_process_relay_cell(cell_t *cell, circuit_t *circ, edge_connection_t *conn, crypt_path_t *layer_hint); STATIC size_t get_pad_cell_offset(size_t payload_len); +STATIC size_t connection_edge_get_inbuf_bytes_to_package(size_t n_available, + int package_partial, + circuit_t *on_circuit); #endif /* defined(RELAY_PRIVATE) */ diff --git a/src/test/test_sendme.c b/src/test/test_sendme.c index fa5ae115a..eb402232b 100644 --- a/src/test/test_sendme.c +++ b/src/test/test_sendme.c @@ -270,6 +270,84 @@ test_cell_version_validation(void *arg) ; } +/* check our decisions about how much stuff to put into relay cells. */ +static void +test_package_payload_len(void *arg) +{ + (void)arg; + /* this is not a real circuit: it only has the fields needed for this + * test. */ + circuit_t *c = tor_malloc_zero(sizeof(circuit_t)); + + /* check initial conditions. */ + circuit_reset_sendme_randomness(c); + tt_assert(! c->have_sent_sufficiently_random_cell); + tt_int_op(c->send_randomness_after_n_cells, OP_GE, CIRCWINDOW_INCREMENT / 2); + tt_int_op(c->send_randomness_after_n_cells, OP_LT, CIRCWINDOW_INCREMENT); + + /* We have a bunch of cells before we need to send randomness, so the first + * few can be packaged full. */ + int initial = c->send_randomness_after_n_cells; + size_t n = connection_edge_get_inbuf_bytes_to_package(10000, 0, c); + tt_uint_op(RELAY_PAYLOAD_SIZE, OP_EQ, n); + n = connection_edge_get_inbuf_bytes_to_package(95000, 1, c); + tt_uint_op(RELAY_PAYLOAD_SIZE, OP_EQ, n); + tt_int_op(c->send_randomness_after_n_cells, OP_EQ, initial - 2); + + /* If package_partial isn't set, we won't package a partially full cell at + * all. */ + n = connection_edge_get_inbuf_bytes_to_package(RELAY_PAYLOAD_SIZE-1, 0, c); + tt_int_op(n, OP_EQ, 0); + /* no change in our state, since nothing was sent. */ + tt_assert(! c->have_sent_sufficiently_random_cell); + tt_int_op(c->send_randomness_after_n_cells, OP_EQ, initial - 2); + + /* If package_partial is set and the partial cell is not going to have + * _enough_ randomness, we package it, but we don't consider ourselves to + * have sent a sufficiently random cell. */ + n = connection_edge_get_inbuf_bytes_to_package(RELAY_PAYLOAD_SIZE-1, 1, c); + tt_int_op(n, OP_EQ, RELAY_PAYLOAD_SIZE-1); + tt_assert(! c->have_sent_sufficiently_random_cell); + tt_int_op(c->send_randomness_after_n_cells, OP_EQ, initial - 3); + + /* Make sure we set have_set_sufficiently_random_cell as appropriate. */ + n = connection_edge_get_inbuf_bytes_to_package(RELAY_PAYLOAD_SIZE-64, 1, c); + tt_int_op(n, OP_EQ, RELAY_PAYLOAD_SIZE-64); + tt_assert(c->have_sent_sufficiently_random_cell); + tt_int_op(c->send_randomness_after_n_cells, OP_EQ, initial - 4); + + /* Now let's look at what happens when we get down to zero. Since we have + * sent a sufficiently random cell, we will not force this one to have a gap. + */ + c->send_randomness_after_n_cells = 0; + n = connection_edge_get_inbuf_bytes_to_package(10000, 1, c); + tt_int_op(n, OP_EQ, RELAY_PAYLOAD_SIZE); + /* Now these will be reset. */ + tt_assert(! c->have_sent_sufficiently_random_cell); + tt_int_op(c->send_randomness_after_n_cells, OP_GE, + CIRCWINDOW_INCREMENT / 2 - 1); + + /* What would happen if we hadn't sent a sufficiently random cell? */ + c->send_randomness_after_n_cells = 0; + n = connection_edge_get_inbuf_bytes_to_package(10000, 1, c); + const size_t reduced_payload_size = RELAY_PAYLOAD_SIZE - 4 - 16; + tt_int_op(n, OP_EQ, reduced_payload_size); + /* Now these will be reset. */ + tt_assert(! c->have_sent_sufficiently_random_cell); + tt_int_op(c->send_randomness_after_n_cells, OP_GE, + CIRCWINDOW_INCREMENT / 2 - 1); + + /* Here is a fun case: if it's time to package a small cell, then + * package_partial==0 should mean we accept that many bytes. + */ + c->send_randomness_after_n_cells = 0; + n = connection_edge_get_inbuf_bytes_to_package(reduced_payload_size, 0, c); + tt_int_op(n, OP_EQ, reduced_payload_size); + + done: + tor_free(c); +} + struct testcase_t sendme_tests[] = { { "v1_record_digest", test_v1_record_digest, TT_FORK, NULL, NULL }, @@ -281,6 +359,7 @@ struct testcase_t sendme_tests[] = { NULL, NULL }, { "cell_version_validation", test_cell_version_validation, TT_FORK, NULL, NULL }, + { "package_payload_len", test_package_payload_len, 0, NULL, NULL }, END_OF_TESTCASES };

1 0

[tor/master] Make sure that we send at least some random data in RELAY_DATA cells
by asn＠torproject.org 27 May '19

27 May '19

commit 0bc1241494a118d5319207a9f4683b993d389e77 Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri May 17 11:03:16 2019 -0400 Make sure that we send at least some random data in RELAY_DATA cells Proposal 289 prevents SENDME-flooding by requiring the other side to authenticate the data it has received. But this data won't actually be random if they are downloading a known resource. "No problem", we said, "let's fell the empty parts of our cells with some randomness!" and we did that in #26871. Unfortunately, if the relay data payloads are all completely full, there won't be any empty parts for us to randomize. Therefore, we now pick random "randomness windows" between CIRCWINDOW_INCREMENT/2 and CIRCWINDOW_INCREMENT. We remember whether we have sent a cell containing at least 16 bytes of randomness in that window. If we haven't, then when the window is exhausted, we send one. (This window approach is designed to lower the number of rng checks we have to do. The number 16 is pulled out of a hat to change the attacker's guessing difficulty to "impossible".) Implements 28646. --- changes/ticket26846 | 6 +++ scripts/maint/practracker/exceptions.txt | 2 +- src/core/or/circuit_st.h | 11 +++++ src/core/or/circuitlist.c | 1 + src/core/or/circuitlist.h | 2 +- src/core/or/relay.c | 76 +++++++++++++++++++++++++++++--- src/core/or/relay.h | 1 + 7 files changed, 90 insertions(+), 9 deletions(-) diff --git a/changes/ticket26846 b/changes/ticket26846 new file mode 100644 index 000000000..a18e23179 --- /dev/null +++ b/changes/ticket26846 @@ -0,0 +1,6 @@ + o Minor features (authenticated SENDME): + - Ensure that there is enough randomness on every circuit + to prevent an attacker from successfully predicting what SENDME cells + they will need to send: at a random interval, if we have not send + randomness already, leave some extra space at the end of a cell that + we can fill with random bytes. Closes ticket 26846. diff --git a/scripts/maint/practracker/exceptions.txt b/scripts/maint/practracker/exceptions.txt index 712e59dc5..3a32e97be 100644 --- a/scripts/maint/practracker/exceptions.txt +++ b/scripts/maint/practracker/exceptions.txt @@ -120,7 +120,7 @@ problem function-size /src/core/or/connection_or.c:connection_or_compute_authent problem file-size /src/core/or/policies.c 3249 problem function-size /src/core/or/policies.c:policy_summarize() 107 problem function-size /src/core/or/protover.c:protover_all_supported() 117 -problem file-size /src/core/or/relay.c 3173 +problem file-size /src/core/or/relay.c 3250 problem function-size /src/core/or/relay.c:circuit_receive_relay_cell() 127 problem function-size /src/core/or/relay.c:relay_send_command_from_edge_() 116 problem function-size /src/core/or/relay.c:connection_ap_process_end_not_open() 194 diff --git a/src/core/or/circuit_st.h b/src/core/or/circuit_st.h index 499bf93d6..3c7b93161 100644 --- a/src/core/or/circuit_st.h +++ b/src/core/or/circuit_st.h @@ -92,6 +92,10 @@ struct circuit_t { /** True iff this circuit has received a DESTROY cell in either direction */ unsigned int received_destroy : 1; + /** True iff we have sent a sufficiently random data cell since last + * we reset send_randomness_after_n_cells. */ + unsigned int have_sent_sufficiently_random_cell : 1; + uint8_t state; /**< Current status of this circuit. */ uint8_t purpose; /**< Why are we creating this circuit? */ @@ -104,6 +108,13 @@ struct circuit_t { * circuit-level sendme cells to indicate that we're willing to accept * more. */ int deliver_window; + /** + * How many cells do we have until we need to send one that contains + * sufficient randomness? Used to ensure that authenticated SENDME cells + * will reflect some unpredictable information. + **/ + uint16_t send_randomness_after_n_cells; + /** FIFO containing the digest of the cells that are just before a SENDME is * sent by the client. It is done at the last cell before our package_window * goes down to 0 which is when we expect a SENDME. diff --git a/src/core/or/circuitlist.c b/src/core/or/circuitlist.c index 72952a8a5..ebbe7f082 100644 --- a/src/core/or/circuitlist.c +++ b/src/core/or/circuitlist.c @@ -993,6 +993,7 @@ init_circuit_base(circuit_t *circ) circ->package_window = circuit_initial_package_window(); circ->deliver_window = CIRCWINDOW_START; + circuit_reset_sendme_randomness(circ); cell_queue_init(&circ->n_chan_cells); smartlist_add(circuit_get_global_list(), circ); diff --git a/src/core/or/circuitlist.h b/src/core/or/circuitlist.h index 6f5fce487..80c1f7ac4 100644 --- a/src/core/or/circuitlist.h +++ b/src/core/or/circuitlist.h @@ -218,7 +218,7 @@ void circuit_mark_all_dirty_circs_as_unusable(void); void circuit_synchronize_written_or_bandwidth(const circuit_t *c, circuit_channel_direction_t dir); MOCK_DECL(void, circuit_mark_for_close_, (circuit_t *circ, int reason, - int line, const char *file)); + int line, const char *cfile)); int circuit_get_cpath_len(origin_circuit_t *circ); int circuit_get_cpath_opened_len(const origin_circuit_t *); void circuit_clear_cpath(origin_circuit_t *circ); diff --git a/src/core/or/relay.c b/src/core/or/relay.c index 7a121780a..c48147dff 100644 --- a/src/core/or/relay.c +++ b/src/core/or/relay.c @@ -533,6 +533,10 @@ relay_command_to_string(uint8_t command) } } +/** When padding a cell with randomness, leave this many zeros after the + * payload. */ +#define CELL_PADDING_GAP 4 + /** Return the offset where the padding should start. The data_len is * the relay payload length expected to be put in the cell. It can not be * bigger than RELAY_PAYLOAD_SIZE else this function assert(). @@ -556,7 +560,7 @@ get_pad_cell_offset(size_t data_len) /* If the offset is larger than the cell payload size, we return an offset * of zero indicating that no padding needs to be added. */ - size_t offset = RELAY_HEADER_SIZE + data_len + 4; + size_t offset = RELAY_HEADER_SIZE + data_len + CELL_PADDING_GAP; if (offset >= CELL_PAYLOAD_SIZE) { return 0; } @@ -2028,26 +2032,81 @@ uint64_t stats_n_data_cells_received = 0; uint64_t stats_n_data_bytes_received = 0; /** + * Called when initializing a circuit, or when we have reached the end of the + * window in which we need to send some randomness so that incoming sendme + * cells will be unpredictable. Resets the flags and picks a new window. + */ +void +circuit_reset_sendme_randomness(circuit_t *circ) +{ + circ->have_sent_sufficiently_random_cell = 0; + circ->send_randomness_after_n_cells = CIRCWINDOW_INCREMENT / 2 + + crypto_fast_rng_get_uint(get_thread_fast_rng(), CIRCWINDOW_INCREMENT / 2); +} + +/** + * Any relay data payload containing fewer than this many real bytes is + * considered to have enough randomness to. + **/ +#define RELAY_PAYLOAD_LENGTH_FOR_RANDOM_SENDMES \ + (RELAY_PAYLOAD_SIZE - CELL_PADDING_GAP - 16) + +/** * Helper. Return the number of bytes that should be put into a cell from a * given edge connection on which n_available bytes are available. */ static size_t connection_edge_get_inbuf_bytes_to_package(size_t n_available, - int package_partial) + int package_partial, + circuit_t *on_circuit) { if (!n_available) return 0; - size_t length = RELAY_PAYLOAD_SIZE; + /* Do we need to force this payload to have space for randomness? */ + const bool force_random_bytes = + (on_circuit->send_randomness_after_n_cells == 0) && + (! on_circuit->have_sent_sufficiently_random_cell); - if (n_available < length) { /* not a full payload available */ + /* At most how much would we like to send in this cell? */ + size_t target_length; + if (force_random_bytes) { + target_length = RELAY_PAYLOAD_LENGTH_FOR_RANDOM_SENDMES; + } else { + target_length = RELAY_PAYLOAD_SIZE; + } + + /* Decide how many bytes we will actually put into this cell. */ + size_t package_length; + if (n_available >= target_length) { /* A full payload is available. */ + package_length = target_length; + } else { /* not a full payload available */ if (package_partial) - length = n_available; /* just take whatever's available now */ + package_length = n_available; /* just take whatever's available now */ else return 0; /* nothing to do until we have a full payload */ } - return length; + /* If we reach this point, we will be definitely sending the cell. */ + tor_assert_nonfatal(package_length > 0); + + if (package_length <= RELAY_PAYLOAD_LENGTH_FOR_RANDOM_SENDMES) { + /* This cell will have enough randomness in the padding to make a future + * sendme cell unpredictable. */ + on_circuit->have_sent_sufficiently_random_cell = 1; + } + + if (on_circuit->send_randomness_after_n_cells == 0) { + /* Either this cell, or some previous cell, had enough padding to + * ensure sendme unpredictability. */ + tor_assert_nonfatal(on_circuit->have_sent_sufficiently_random_cell); + /* Pick a new interval in which we need to send randomness. */ + circuit_reset_sendme_randomness(on_circuit); + } + + --on_circuit->send_randomness_after_n_cells; + + return package_length; } /** If conn has an entire relay payload of bytes on its inbuf (or @@ -2123,10 +2182,13 @@ connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial, } length = connection_edge_get_inbuf_bytes_to_package(bytes_to_process, - package_partial); + package_partial, circ); if (!length) return 0; + /* If we reach this point, we will definitely be packaging bytes into + * a cell. */ + stats_n_data_bytes_packaged += length; stats_n_data_cells_packaged += 1; diff --git a/src/core/or/relay.h b/src/core/or/relay.h index 97d5d6d0f..0fc308f7d 100644 --- a/src/core/or/relay.h +++ b/src/core/or/relay.h @@ -42,6 +42,7 @@ int connection_edge_package_raw_inbuf(edge_connection_t *conn, int package_partial, int *max_cells); void connection_edge_consider_sending_sendme(edge_connection_t *conn); +void circuit_reset_sendme_randomness(circuit_t *circ); extern uint64_t stats_n_data_cells_packaged; extern uint64_t stats_n_data_bytes_packaged;

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits May 2019