October 2020 - tor-commits - lists.torproject.org

[snowflake/master] Add Dockerfile and README for deploying probetest
by cohosh＠torproject.org 29 Oct '20

29 Oct '20

commit a4f10d9d6eaa8806adc5eefaf7ac46d4050340d1 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Wed Oct 14 15:49:01 2020 -0400 Add Dockerfile and README for deploying probetest The easiest way to set up the probe server behind a symmetric NAT is to deploy it as a Docker container and alter the iptables rules for the Docker network subnet that the container runs in. --- probetest/Dockerfile | 3 +++ probetest/README.md | 44 ++++++++++++++++++++++++++++++++++++++++++++ probetest/docker-compose.yml | 11 +++++++++++ 3 files changed, 58 insertions(+) diff --git a/probetest/Dockerfile b/probetest/Dockerfile new file mode 100644 index 0000000..966ab28 --- /dev/null +++ b/probetest/Dockerfile @@ -0,0 +1,3 @@ +FROM golang:1.13 + +COPY probetest /go/bin diff --git a/probetest/README.md b/probetest/README.md new file mode 100644 index 0000000..8af42f5 --- /dev/null +++ b/probetest/README.md @@ -0,0 +1,44 @@ +This is code for a remote probe test component of Snowflake. + +### Overview + +This is a probe test server to allow proxies to test their compatability +with Snowflake. Right now the only type of test implemented is a +compatability check for clients with symmetric NATs. + +### Running your own + +The server uses TLS by default. +There is a `--disable-tls` option for testing purposes, +but you should use TLS in production. + +To build the probe server, run +```go build``` + +To deploy the probe server, first set the necessary env variables with +``` +export HOSTNAMES=${YOUR HOSTNAMES} +export EMAIL=${YOUR EMAIL} +``` +then run ```docker-compose up``` + +Setting up a symmetric NAT configuration requires a few extra steps. After +upping the docker container, run +```docker inspect snowflake-probetest``` +to find the subnet used by the probetest container. Then run +```sudo iptables -L -t nat``` to find the POSTROUTING rules for the subnet. +It should look something like this: +``` +Chain POSTROUTING (policy ACCEPT) +target prot opt source destination +MASQUERADE all -- 172.19.0.0/16 anywhere +``` +to modify this rule, execute the command +```sudo iptables -t nat -R POSTROUTING $RULE_NUM -s 172.19.0.0/16 -j MASQUERADE --random``` +where RULE_NUM is the numbered rule corresponding to your docker container's subnet masquerade rule. +Afterwards, you should see the rule changed to be: +``` +Chain POSTROUTING (policy ACCEPT) +target prot opt source destination +MASQUERADE all -- 172.19.0.0/16 anywhere random +``` diff --git a/probetest/docker-compose.yml b/probetest/docker-compose.yml new file mode 100644 index 0000000..9283383 --- /dev/null +++ b/probetest/docker-compose.yml @@ -0,0 +1,11 @@ + version: "3.8" + + services: + snowflake-probetest: + build: . + container_name: snowflake-probetest + ports: + - "8443:8443" + volumes: + - /home/snowflake-broker/acme-cert-cache:/go/bin/acme-cert-cache + entrypoint: [ "probetest" , "-addr", ":8443" , "-acme-hostnames", $HOSTNAMES, "-acme-email", $EMAIL, "-acme-cert-cache", "/go/bin/acme-cert-cache"]

1 0

[snowflake/master] Refactor proxy to reuse signaling code
by cohosh＠torproject.org 29 Oct '20

29 Oct '20

commit 7a0428e3b11ba437f27d09b1a9ad0fa820e54d24 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Tue Oct 13 11:06:14 2020 -0400 Refactor proxy to reuse signaling code Simplify proxy interactions with the broker signaling server and prepare for the introduction of an additional signaling server. --- proxy/proxy-go_test.go | 5 ++- proxy/snowflake.go | 114 +++++++++++++++++++++++++------------------------ 2 files changed, 61 insertions(+), 58 deletions(-) diff --git a/proxy/proxy-go_test.go b/proxy/proxy-go_test.go index 1218289..e2fb82e 100644 --- a/proxy/proxy-go_test.go +++ b/proxy/proxy-go_test.go @@ -337,7 +337,7 @@ func TestBrokerInteractions(t *testing.T) { const sampleAnswer = `{"type":"answer","sdp":` + sampleSDP + `}` Convey("Proxy connections to broker", t, func() { - broker := new(Broker) + broker := new(SignalingServer) broker.url, _ = url.Parse("localhost") //Mock peerConnection @@ -417,7 +417,8 @@ func TestBrokerInteractions(t *testing.T) { } err = broker.sendAnswer("test", pc) So(err, ShouldNotEqual, nil) - So(err.Error(), ShouldResemble, "broker returned 410") + So(err.Error(), ShouldResemble, + "error sending answer to broker: remote returned status code 410") //Error if we can't parse broker message broker.transport = &MockTransport{ diff --git a/proxy/snowflake.go b/proxy/snowflake.go index 96851ae..276ebed 100644 --- a/proxy/snowflake.go +++ b/proxy/snowflake.go @@ -44,7 +44,7 @@ const dataChannelTimeout = 20 * time.Second const readLimit = 100000 //Maximum number of bytes to be read from an HTTP request -var broker *Broker +var broker *SignalingServer var relayURL string var currentNATType = NATUnknown @@ -110,12 +110,6 @@ func remoteIPFromSDP(str string) net.IP { return nil } -type Broker struct { - url *url.URL - transport http.RoundTripper - keepLocalAddresses bool -} - type webRTCConn struct { dc *webrtc.DataChannel pc *webrtc.PeerConnection @@ -200,8 +194,33 @@ func limitedRead(r io.Reader, limit int64) ([]byte, error) { return p, err } -func (b *Broker) pollOffer(sid string) *webrtc.SessionDescription { - brokerPath := b.url.ResolveReference(&url.URL{Path: "proxy"}) +type SignalingServer struct { + url *url.URL + transport http.RoundTripper + keepLocalAddresses bool +} + +func (s *SignalingServer) Post(path string, payload io.Reader) ([]byte, error) { + + req, err := http.NewRequest("POST", path, payload) + if err != nil { + return nil, err + } + resp, err := s.transport.RoundTrip(req) + if err != nil { + return nil, err + } + + if resp.StatusCode != http.StatusOK { + return nil, fmt.Errorf("remote returned status code %d", resp.StatusCode) + } + + defer resp.Body.Close() + return limitedRead(resp.Body, readLimit) +} + +func (s *SignalingServer) pollOffer(sid string) *webrtc.SessionDescription { + brokerPath := s.url.ResolveReference(&url.URL{Path: "proxy"}) timeOfNextPoll := time.Now() for { // Sleep until we're scheduled to poll again. @@ -220,45 +239,33 @@ func (b *Broker) pollOffer(sid string) *webrtc.SessionDescription { log.Printf("Error encoding poll message: %s", err.Error()) return nil } - req, _ := http.NewRequest("POST", brokerPath.String(), bytes.NewBuffer(body)) - resp, err := b.transport.RoundTrip(req) + resp, err := s.Post(brokerPath.String(), bytes.NewBuffer(body)) if err != nil { - log.Printf("error polling broker: %s", err) - } else { - defer resp.Body.Close() - if resp.StatusCode != http.StatusOK { - log.Printf("broker returns: %d", resp.StatusCode) - } else { - body, err := limitedRead(resp.Body, readLimit) - if err != nil { - log.Printf("error reading broker response: %s", err) - } else { - - offer, _, err := messages.DecodePollResponse(body) - if err != nil { - log.Printf("error reading broker response: %s", err.Error()) - log.Printf("body: %s", body) - return nil - } - if offer != "" { - offer, err := util.DeserializeSessionDescription(offer) - if err != nil { - log.Printf("Error processing session description: %s", err.Error()) - return nil - } - return offer + log.Printf("error polling broker: %s", err.Error()) + } - } - } + offer, _, err := messages.DecodePollResponse(resp) + if err != nil { + log.Printf("Error reading broker response: %s", err.Error()) + log.Printf("body: %s", resp) + return nil + } + if offer != "" { + offer, err := util.DeserializeSessionDescription(offer) + if err != nil { + log.Printf("Error processing session description: %s", err.Error()) + return nil } + return offer + } } } -func (b *Broker) sendAnswer(sid string, pc *webrtc.PeerConnection) error { - brokerPath := b.url.ResolveReference(&url.URL{Path: "answer"}) +func (s *SignalingServer) sendAnswer(sid string, pc *webrtc.PeerConnection) error { + brokerPath := s.url.ResolveReference(&url.URL{Path: "answer"}) ld := pc.LocalDescription() - if !b.keepLocalAddresses { + if !s.keepLocalAddresses { ld = &webrtc.SessionDescription{ Type: ld.Type, SDP: util.StripLocalAddresses(ld.SDP), @@ -272,20 +279,12 @@ func (b *Broker) sendAnswer(sid string, pc *webrtc.PeerConnection) error { if err != nil { return err } - req, _ := http.NewRequest("POST", brokerPath.String(), bytes.NewBuffer(body)) - resp, err := b.transport.RoundTrip(req) + resp, err := s.Post(brokerPath.String(), bytes.NewBuffer(body)) if err != nil { - return err - } - if resp.StatusCode != http.StatusOK { - return fmt.Errorf("broker returned %d", resp.StatusCode) + return fmt.Errorf("error sending answer to broker: %s", err.Error()) } - body, err = limitedRead(resp.Body, readLimit) - if err != nil { - return fmt.Errorf("error reading broker response: %s", err) - } - success, err := messages.DecodeAnswerResponse(body) + success, err := messages.DecodeAnswerResponse(resp) if err != nil { return err } @@ -327,7 +326,6 @@ func datachannelHandler(conn *webRTCConn, remoteAddr net.Addr) { log.Fatalf("invalid relay url: %s", err) } - // Retrieve client IP address if remoteAddr != nil { // Encode client IP address in relay URL q := u.Query() @@ -354,7 +352,11 @@ func datachannelHandler(conn *webRTCConn, remoteAddr net.Addr) { // candidates is complete and the answer is available in LocalDescription. // Installs an OnDataChannel callback that creates a webRTCConn and passes it to // datachannelHandler. -func makePeerConnectionFromOffer(sdp *webrtc.SessionDescription, config webrtc.Configuration, dataChan chan struct{}) (*webrtc.PeerConnection, error) { +func makePeerConnectionFromOffer(sdp *webrtc.SessionDescription, + config webrtc.Configuration, + dataChan chan struct{}, + handler func(conn *webRTCConn, remoteAddr net.Addr)) (*webrtc.PeerConnection, error) { + pc, err := webrtc.NewPeerConnection(config) if err != nil { return nil, fmt.Errorf("accept: NewPeerConnection: %s", err) @@ -390,7 +392,7 @@ func makePeerConnectionFromOffer(sdp *webrtc.SessionDescription, config webrtc.C } }) - go datachannelHandler(conn, conn.RemoteAddr()) + go handler(conn, conn.RemoteAddr()) }) err = pc.SetRemoteDescription(*sdp) @@ -433,7 +435,7 @@ func runSession(sid string) { return } dataChan := make(chan struct{}) - pc, err := makePeerConnectionFromOffer(offer, config, dataChan) + pc, err := makePeerConnectionFromOffer(offer, config, dataChan, datachannelHandler) if err != nil { log.Printf("error making WebRTC connection: %s", err) retToken() @@ -500,7 +502,7 @@ func main() { log.Println("starting") var err error - broker = new(Broker) + broker = new(SignalingServer) broker.keepLocalAddresses = keepLocalAddresses broker.url, err = url.Parse(rawBrokerURL) if err != nil {

1 0

[snowflake/master] Add a remote service to test NAT compatability
by cohosh＠torproject.org 29 Oct '20

29 Oct '20

commit f368c871095dae3aa990e7d46a1d6612af9909b9 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Tue Oct 13 17:18:50 2020 -0400 Add a remote service to test NAT compatability Add a remote probetest service that will allow proxies to test their compatability with symmetric NATs. --- .gitignore | 1 + probetest/probetest.go | 226 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 227 insertions(+) diff --git a/.gitignore b/.gitignore index 9f36c7c..002f95e 100644 --- a/.gitignore +++ b/.gitignore @@ -8,5 +8,6 @@ broker/broker client/client server/server proxy/proxy +probetest/probetest snowflake.log ignore/ diff --git a/probetest/probetest.go b/probetest/probetest.go new file mode 100644 index 0000000..af08e32 --- /dev/null +++ b/probetest/probetest.go @@ -0,0 +1,226 @@ +/* +Probe test server to check the reachability of Snowflake proxies from +clients with symmetric NATs. + +The probe server receives an offer from a proxy, returns an answer, and then +attempts to establish a datachannel connection to that proxy. The proxy will +self-determine whether the connection opened successfully. +*/ +package main + +import ( + "crypto/tls" + "flag" + "fmt" + "io" + "io/ioutil" + "log" + "net/http" + "os" + "strings" + "time" + + "git.torproject.org/pluggable-transports/snowflake.git/common/messages" + "git.torproject.org/pluggable-transports/snowflake.git/common/safelog" + "git.torproject.org/pluggable-transports/snowflake.git/common/util" + + "github.com/pion/webrtc/v2" + "golang.org/x/crypto/acme/autocert" +) + +const ( + readLimit = 100000 //Maximum number of bytes to be read from an HTTP request + dataChannelTimeout = 20 * time.Second //time after which we assume proxy data channel will not open + stunUrl = "stun:stun.l.google.com:19302" //default STUN URL +) + +// Create a PeerConnection from an SDP offer. Blocks until the gathering of ICE +// candidates is complete and the answer is available in LocalDescription. +func makePeerConnectionFromOffer(sdp *webrtc.SessionDescription, + dataChan chan struct{}) (*webrtc.PeerConnection, error) { + + config := webrtc.Configuration{ + ICEServers: []webrtc.ICEServer{ + { + URLs: []string{stunUrl}, + }, + }, + } + pc, err := webrtc.NewPeerConnection(config) + if err != nil { + return nil, fmt.Errorf("accept: NewPeerConnection: %s", err) + } + pc.OnDataChannel(func(dc *webrtc.DataChannel) { + close(dataChan) + }) + + err = pc.SetRemoteDescription(*sdp) + if err != nil { + if inerr := pc.Close(); inerr != nil { + log.Printf("unable to call pc.Close after pc.SetRemoteDescription with error: %v", inerr) + } + return nil, fmt.Errorf("accept: SetRemoteDescription: %s", err) + } + + answer, err := pc.CreateAnswer(nil) + if err != nil { + if inerr := pc.Close(); inerr != nil { + log.Printf("ICE gathering has generated an error when calling pc.Close: %v", inerr) + } + return nil, err + } + + err = pc.SetLocalDescription(answer) + if err != nil { + if err = pc.Close(); err != nil { + log.Printf("pc.Close after setting local description returned : %v", err) + } + return nil, err + } + + return pc, nil +} + +func probeHandler(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Access-Control-Allow-Origin", "*") + resp, err := ioutil.ReadAll(http.MaxBytesReader(w, r.Body, readLimit)) + if nil != err { + log.Println("Invalid data.") + w.WriteHeader(http.StatusBadRequest) + return + } + + offer, _, err := messages.DecodePollResponse(resp) + if err != nil { + log.Printf("Error reading offer: %s", err.Error()) + w.WriteHeader(http.StatusBadRequest) + return + } + if offer == "" { + log.Printf("Error processing session description: %s", err.Error()) + w.WriteHeader(http.StatusBadRequest) + return + } + sdp, err := util.DeserializeSessionDescription(offer) + if err != nil { + log.Printf("Error processing session description: %s", err.Error()) + w.WriteHeader(http.StatusBadRequest) + return + } + + dataChan := make(chan struct{}) + pc, err := makePeerConnectionFromOffer(sdp, dataChan) + if err != nil { + log.Printf("Error making WebRTC connection: %s", err) + w.WriteHeader(http.StatusInternalServerError) + return + } + + sdp = &webrtc.SessionDescription{ + Type: pc.LocalDescription().Type, + SDP: util.StripLocalAddresses(pc.LocalDescription().SDP), + } + answer, err := util.SerializeSessionDescription(sdp) + if err != nil { + log.Printf("Error making WebRTC connection: %s", err) + w.WriteHeader(http.StatusInternalServerError) + return + } + body, err := messages.EncodeAnswerRequest(answer, "") + if err != nil { + log.Printf("Error making WebRTC connection: %s", err) + w.WriteHeader(http.StatusInternalServerError) + return + } + + w.Write(body) + // Set a timeout on peerconnection. If the connection state has not + // advanced to PeerConnectionStateConnected in this time, + // destroy the peer connection and return the token. + select { + case <-dataChan: + if err := pc.Close(); err != nil { + log.Printf("Error calling pc.Close: %v", err) + } + case <-time.After(dataChannelTimeout): + if err := pc.Close(); err != nil { + log.Printf("Error calling pc.Close: %v", err) + } + } + return + +} + +func main() { + var acmeEmail string + var acmeHostnamesCommas string + var acmeCertCacheDir string + var addr string + var disableTLS bool + var certFilename, keyFilename string + var unsafeLogging bool + + flag.StringVar(&acmeEmail, "acme-email", "", "optional contact email for Let's Encrypt notifications") + flag.StringVar(&acmeHostnamesCommas, "acme-hostnames", "", "comma-separated hostnames for TLS certificate") + flag.StringVar(&acmeCertCacheDir, "acme-cert-cache", "acme-cert-cache", "directory in which certificates should be cached") + flag.StringVar(&certFilename, "cert", "", "TLS certificate file") + flag.StringVar(&keyFilename, "key", "", "TLS private key file") + flag.StringVar(&addr, "addr", ":8443", "address to listen on") + flag.BoolVar(&disableTLS, "disable-tls", false, "don't use HTTPS") + flag.BoolVar(&unsafeLogging, "unsafe-logging", false, "prevent logs from being scrubbed") + flag.Parse() + + var logOutput io.Writer = os.Stderr + if unsafeLogging { + log.SetOutput(logOutput) + } else { + // Scrub log output just in case an address ends up there + log.SetOutput(&safelog.LogScrubber{Output: logOutput}) + } + + log.SetFlags(log.LstdFlags | log.LUTC) + + http.HandleFunc("/probe", probeHandler) + + server := http.Server{ + Addr: addr, + } + + var err error + if acmeHostnamesCommas != "" { + acmeHostnames := strings.Split(acmeHostnamesCommas, ",") + log.Printf("ACME hostnames: %q", acmeHostnames) + + var cache autocert.Cache + if err = os.MkdirAll(acmeCertCacheDir, 0700); err != nil { + log.Printf("Warning: Couldn't create cache directory %q (reason: %s) so we're *not* using our certificate cache.", acmeCertCacheDir, err) + } else { + cache = autocert.DirCache(acmeCertCacheDir) + } + + certManager := autocert.Manager{ + Cache: cache, + Prompt: autocert.AcceptTOS, + HostPolicy: autocert.HostWhitelist(acmeHostnames...), + Email: acmeEmail, + } + // start certificate manager handler + go func() { + log.Printf("Starting HTTP-01 listener") + log.Fatal(http.ListenAndServe(":80", certManager.HTTPHandler(nil))) + }() + + server.TLSConfig = &tls.Config{GetCertificate: certManager.GetCertificate} + err = server.ListenAndServeTLS("", "") + } else if certFilename != "" && keyFilename != "" { + err = server.ListenAndServeTLS(certFilename, keyFilename) + } else if disableTLS { + err = server.ListenAndServe() + } else { + log.Fatal("the --cert and --key, --acme-hostnames, or --disable-tls option is required") + } + + if err != nil { + log.Println(err) + } +}

1 0

[donate-static/master] Fix #7 add bitcoin cash prefix
by gus＠torproject.org 29 Oct '20

29 Oct '20

commit c8fe4e979c4bfb63e219abe22f5d481eb710f5dc Author: gus <gus(a)torproject.org> Date: Thu Oct 29 09:22:34 2020 -0400 Fix #7 add bitcoin cash prefix --- templates/cryptocurrency.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/cryptocurrency.html b/templates/cryptocurrency.html index 1244f79d..197ff6cd 100644 --- a/templates/cryptocurrency.html +++ b/templates/cryptocurrency.html @@ -77,7 +77,7 @@ }, { 'symbol': 'BCH', - 'id': 'qrtyy8w9yv6ffqtny9gp56m8kztl3nwwzcqyzsv32k', + 'id': 'bitcoincash:qrtyy8w9yv6ffqtny9gp56m8kztl3nwwzcqyzsv32k', 'name': 'Bitcoin Cash', }, {

1 0

[snowflake-webext/master] Make a test connection to determine NAT type
by cohosh＠torproject.org 29 Oct '20

29 Oct '20

commit e1958c454de9e24f464efaf82837fa6da1270120 Author: Cecylia Bocovich <cohosh(a)torproject.org> Date: Wed Oct 14 11:32:29 2020 -0400 Make a test connection to determine NAT type Make a test connection to the symmetrically NAT'd probe site to determine NAT type. This replaces the previous method of getting ICE candidates from two different STUN servers and more definitively determines compatability with a symmetrically NAT'd client. --- config.js | 2 ++ init-badge.js | 7 ++++-- init-webext.js | 9 +++++--- util.js | 72 +++++++++++++++++++++++++++++++++++++++++----------------- 4 files changed, 64 insertions(+), 26 deletions(-) diff --git a/config.js b/config.js index d662013..b5db8b5 100644 --- a/config.js +++ b/config.js @@ -46,3 +46,5 @@ Config.prototype.pcConfig = { } ] }; + +Config.PROBEURL = "https://snowflake-broker.torproject.net:8443/probe"; diff --git a/init-badge.js b/init-badge.js index 4b432fc..6c4c7a7 100644 --- a/init-badge.js +++ b/init-badge.js @@ -150,10 +150,13 @@ var debug, snowflake, config, broker, ui, log, dbg, init, update, initNATType, s initNATType = function() { this.natType = "unknown"; (function loop(_this) { - Util.checkNATType().then((type) => { + Util.checkNATType(config.datachannelTimeout).then((type) => { console.log("Setting NAT type: " + type); _this.natType = type; - }).catch((e) => console.log(e)); + }).catch((e) => { + console.log(e); + _this.natType = "unknown"; + }); // reset NAT type every 24 hours in case proxy location changed setTimeout(_this.initNATType, 24 * 60 * 60 * 1000); })(this); diff --git a/init-webext.js b/init-webext.js index e38ab88..0a2c22b 100644 --- a/init-webext.js +++ b/init-webext.js @@ -13,7 +13,6 @@ class WebExtUI extends UI { this.onMessage = this.onMessage.bind(this); this.onDisconnect = this.onDisconnect.bind(this); this.initStats(); - this.initNATType(); chrome.runtime.onConnect.addListener(this.onConnect); } @@ -29,10 +28,13 @@ class WebExtUI extends UI { initNATType() { this.natType = "unknown"; (function loop(_this) { - Util.checkNATType().then((type) => { + Util.checkNATType(config.datachannelTimeout).then((type) => { console.log("Setting NAT type: " + type); _this.natType = type; - }).catch((e) => console.log(e)); + }).catch((e) => { + console.log(e); + _this.natType = "unknown"; + }); // reset NAT type every 24 hours in case proxy location changed setTimeout(_this.initNATType, 24 * 60 * 60 * 1000); })(this); @@ -200,6 +202,7 @@ var debug, snowflake, config, broker, ui, log, dbg, init, update, silenceNotific snowflake = new Snowflake(config, ui, broker); log('== snowflake proxy =='); ui.initToggle(); + ui.initNATType(); }; update = function() { diff --git a/util.js b/util.js index ee36478..8ab65d9 100644 --- a/util.js +++ b/util.js @@ -1,5 +1,5 @@ /* exported Util, Params, DummyRateLimit */ -/* global PeerConnection */ +/* global PeerConnection, Config */ /* A JavaScript WebRTC snowflake proxy @@ -21,33 +21,63 @@ class Util { return navigator.cookieEnabled; } - // returns a promise that fullfills to "restricted" if the - // mapping is symmetric, and we know it's a restrictive NAT, - // and fullfills to "unknown" if the mapping is not - // symmetric. - static checkNATType() { + // returns a promise that fullfills to "restricted" if we + // fail to make a test connection to a known restricted + // NAT, "unrestricted" if the test connection fails, and + // "unknown" if we fail to reach the probe test server + static checkNATType(timeout) { return new Promise((fulfill, reject) => { - let port = null; + let open = false; let pc = new PeerConnection({iceServers: [ - {urls: 'stun:stun1.l.google.com:19302'}, - {urls: 'stun:stun2.l.google.com:19302'} + {urls: 'stun:stun1.l.google.com:19302'} ]}); - pc.createDataChannel("NAT test"); - pc.onicecandidate = function(e) { - if (e.candidate) { - let p = Parse.portFromCandidate(e.candidate.candidate); - if (port == null) port = p; - else if (p != null && p != port) fulfill("restricted"); - } else { // done parsing candidates - fulfill("unknown"); - } + let channel = pc.createDataChannel("NAT test"); + channel.onopen = function() { + open = true; + fulfill("unrestricted"); + channel.close(); + pc.close(); }; - pc.createOffer().then((offer) => { - pc.setLocalDescription(offer); - }).catch((e) => { + pc.createOffer() + .then((offer) => pc.setLocalDescription(offer)) + .then(() => Util.sendOffer(pc.localDescription)) + .then((answer) => pc.setRemoteDescription(JSON.parse(answer))) + .catch((e) => { console.log(e); reject("Error checking NAT type"); }); + setTimeout(() => {if(!open) fulfill("restricted");}, timeout); + }); + } + + // Assumes getClientOffer happened, and a WebRTC SDP answer has been generated. + // Sends it back to the broker, which passes it back to the original client. + static sendOffer(offer) { + return new Promise((fulfill, reject) => { + var xhr; + xhr = new XMLHttpRequest(); + xhr.timeout = 10 * 1000; + xhr.onreadystatechange = function() { + if (xhr.DONE !== xhr.readyState) { + return; + } + switch (xhr.status) { + case 200: + var response = JSON.parse(xhr.responseText); + return fulfill(response.Answer); // Should contain offer. + default: + console.log('Probe ERROR: Unexpected ' + xhr.status + ' - ' + xhr.statusText); + return reject('Failed to get answer from probe service'); + } + }; + var data = {"Status": "client match", "Offer": JSON.stringify(offer)}; + try { + xhr.open('POST', Config.PROBEURL); + } catch (error) { + console.log('Signaling Server: exception while connecting: ' + error.message); + return reject('unable to connect to signaling server'); + } + return xhr.send(JSON.stringify(data)); }); } }

1 0

[tor-browser/tor-browser-83.0b1-10.0-1] fixup! Bug 13252: Do not store data in the app bundle
by sysrqb＠torproject.org 29 Oct '20

29 Oct '20

commit 136d1345a7953f89c5b4998a7544045cd9c68d51 Author: Alex Catarineu <acat(a)torproject.org> Date: Wed Oct 28 15:24:34 2020 +0100 fixup! Bug 13252: Do not store data in the app bundle Fixes 40205: Replace occurrence of EmptyCString with 0-length _ns literal --- xpcom/io/TorFileUtils.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xpcom/io/TorFileUtils.cpp b/xpcom/io/TorFileUtils.cpp index ce75ab1e1c07..6bd03f1f7fed 100644 --- a/xpcom/io/TorFileUtils.cpp +++ b/xpcom/io/TorFileUtils.cpp @@ -71,7 +71,7 @@ nsresult TorBrowser_GetUserDataDir(nsIFile* aExeFile, nsIFile** aFile) { // points to ~/Library/Application Support, we first create an empty // nsIFile object (no path) and then use InitWithFSRef() to set the // path. - rv = NS_NewNativeLocalFile(EmptyCString(), true, getter_AddRefs(tbDataDir)); + rv = NS_NewNativeLocalFile(""_ns, true, getter_AddRefs(tbDataDir)); NS_ENSURE_SUCCESS(rv, rv); nsCOMPtr<nsILocalFileMac> dirFileMac = do_QueryInterface(tbDataDir); if (!dirFileMac) return NS_ERROR_UNEXPECTED;

1 0

[community/master] Merge branch 'fix-screenshot-display-l10n'
by gus＠torproject.org 29 Oct '20

29 Oct '20

commit 886ee1ce210bd1243584645ee83d8e31952740b7 Merge: 89c10bb 246edcf Author: gus <gus(a)torproject.org> Date: Thu Oct 29 10:14:58 2020 -0400 Merge branch 'fix-screenshot-display-l10n' content/localization/becoming-tor-translator/contents.lr | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)

1 0

[community/master] fixed screenshot display issue in fullscreen
by gus＠torproject.org 29 Oct '20

29 Oct '20

commit 246edcfed0e0b56efbefe37340e248019a0e950e Author: Kim Le <kle2(a)student.unimelb.edu.au> Date: Wed Oct 14 13:01:34 2020 +1100 fixed screenshot display issue in fullscreen --- content/localization/becoming-tor-translator/contents.lr | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/content/localization/becoming-tor-translator/contents.lr b/content/localization/becoming-tor-translator/contents.lr index 9b348a3..9f5e07b 100644 --- a/content/localization/becoming-tor-translator/contents.lr +++ b/content/localization/becoming-tor-translator/contents.lr @@ -39,12 +39,11 @@ In order to begin contributing you will have to sign up with Transifex. Here's a 1. On the next page, select the languages you speak from the drop-down menu and continue. 1. You are now signed up! Go to the [Tor Transifex page](https://www.transifex.com/otf/torproject/). 1. Click the blue 'Join Team' button on the far right: -![Join Team](/static/images/localization/tr3.png) +<img style="display:block" src="/static/images/localization/tr3.png" alt="Join Team"> 1. Select the language you would like to translate from the dropdown menu: -![Choose Language](/static/images/localization/tr4.png) +<img style="display:block" src="/static/images/localization/tr4.png" alt="Choose Language"> 1. A notification will now show up on the top of the page like so: -![Request Submitted](/static/images/localization/tr5.png) - +<img style="display:block" src="/static/images/localization/tr5.png" alt="Request Submitted"> Before translating, please read through the Tor Project page on the [Localization Lab Wiki](https://wiki.localizationlab.org/index.php/Tor). The page includes guidelines, resources, and priorities that will help you make the most out of your contribution. After your membership is approved, you're ready to begin.

1 0

[community/master] Turning existing relay into bridge
by gus＠torproject.org 29 Oct '20

29 Oct '20

commit 286bf68ec905f14b6dc77232d7fa53c50bb9e7d5 Author: Corl3ss <corl3ss(a)corl3ss.com> Date: Fri Oct 2 11:08:26 2020 +0000 Turning existing relay into bridge Add precautions when turning a non-bridge rely into a bridge. (relative to this thread : https://lists.torproject.org/pipermail/tor-relays/2020-September/018955.html) --- content/relay-operations/technical-setup/bridge/contents.lr | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/content/relay-operations/technical-setup/bridge/contents.lr b/content/relay-operations/technical-setup/bridge/contents.lr index 54a8c35..9bfaa55 100644 --- a/content/relay-operations/technical-setup/bridge/contents.lr +++ b/content/relay-operations/technical-setup/bridge/contents.lr @@ -8,7 +8,10 @@ This guide will help you set up an obfs4 bridge to help censored users connect t 1. 24/7 Internet connectivity 2. The ability to expose TCP ports to the Internet (make sure that NAT doesn't get in the way) -Note: If you're running a platform that is not listed on this page, you can [compile obfs4 from source](https://gitlab.com/yawning/obfs4#installation). +Note 1: If you're running a platform that is not listed on this page, you can [compile obfs4 from source](https://gitlab.com/yawning/obfs4#installation). + +Note 2: If you're planning to turn an existing but non-bridge relay into a bridge relay, changing IP address, name and fingerprint is advised to avoid easy discovery and blocklisting by ISP or governments. + --- html: two-columns-page.html ---

1 0

[community/master] Merge branch 'bridge-note'
by gus＠torproject.org 29 Oct '20

29 Oct '20

commit 89c10bb921b0d102e2a6fc72e2698c08cd7dc62b Merge: 1882f3e 286bf68 Author: gus <gus(a)torproject.org> Date: Thu Oct 29 10:09:47 2020 -0400 Merge branch 'bridge-note' content/relay-operations/technical-setup/bridge/contents.lr | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)

1 0