February 2020 - tor-commits - lists.torproject.org

[bridgedb/develop] Assert that crypto keys are bytes
by phw＠torproject.org 19 Feb '20

19 Feb '20

commit 28b3fb3d396c31fe905bd5881f2dfff1fa9d12f6 Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Jan 20 18:18:20 2020 -0800 Assert that crypto keys are bytes Simple update to these assertions... Traceback (most recent call last): File "/home/atagar/Desktop/tor/bridgedb/bridgedb/test/test_crypto.py", line 75, in test_getKey_tmpfile "key isn't a string! type=%r" % type(key)) File "/usr/local/lib/python3.5/dist-packages/twisted/trial/_synctest.py", line 649, in assertIsInstance instance, classOrTuple, suffix)) twisted.trial.unittest.FailTest: b'#\x1e\xe1\xef\x93\x1c\xdf\x1c\x81\xdd\x02\xc3\xd1$\x07\xfb\xac\x00qSG\xb1\x84\xd6\xe32N,\xa9\xfe\xc8\xa0' is not an instance of <class 'str'>: key isn't a string! type=<class 'bytes'> Test results changed as follows... before: FAILED (skips=115, failures=9, successes=860) after: FAILED (skips=115, failures=3, successes=866) --- bridgedb/test/test_captcha.py | 10 +++++----- bridgedb/test/test_crypto.py | 12 ++++++------ 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/bridgedb/test/test_captcha.py b/bridgedb/test/test_captcha.py index cc0c99c..d504761 100644 --- a/bridgedb/test/test_captcha.py +++ b/bridgedb/test/test_captcha.py @@ -77,8 +77,8 @@ class ReCaptchaTests(unittest.TestCase): reason += "connection.\nThis test failed with: %s" % error raise unittest.SkipTest(reason) else: - self.assertIsInstance(self.c.image, str) - self.assertIsInstance(self.c.challenge, str) + self.assertIsInstance(self.c.image, bytes) + self.assertIsInstance(self.c.challenge, bytes) finally: # Replace the original environment variable if there was one: if oldkey: @@ -146,7 +146,7 @@ class GimpCaptchaTests(unittest.TestCase): c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) challenge = c.createChallenge('w00t') - self.assertIsInstance(challenge, str) + self.assertIsInstance(challenge, bytes) def test_createChallenge_base64(self): """createChallenge() return value should be urlsafe base64-encoded.""" @@ -189,8 +189,8 @@ class GimpCaptchaTests(unittest.TestCase): c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() - self.assertIsInstance(image, str) - self.assertIsInstance(challenge, str) + self.assertIsInstance(image, bytes) + self.assertIsInstance(challenge, bytes) def test_get_emptyCacheDir(self): """An empty cacheDir should raise GimpCaptchaError.""" diff --git a/bridgedb/test/test_crypto.py b/bridgedb/test/test_crypto.py index 9911686..45c06ae 100644 --- a/bridgedb/test/test_crypto.py +++ b/bridgedb/test/test_crypto.py @@ -64,15 +64,15 @@ class GetKeyTests(unittest.TestCase): """Test retrieving the secret_key from an empty file.""" filename = os.path.join(os.getcwd(), 'sekrit') key = crypto.getKey(filename) - self.failUnlessIsInstance(key, str, - "key isn't a string! type=%r" % type(key)) + self.failUnlessIsInstance(key, bytes, + "key isn't bytes! type=%r" % type(key)) def test_getKey_tmpfile(self): """Test retrieving the secret_key from a new tmpfile.""" filename = self.mktemp() key = crypto.getKey(filename) - self.failUnlessIsInstance(key, str, - "key isn't a string! type=%r" % type(key)) + self.failUnlessIsInstance(key, bytes, + "key isn't bytes! type=%r" % type(key)) def test_getKey_keyexists(self): """Write the example key to a file and test reading it back.""" @@ -82,8 +82,8 @@ class GetKeyTests(unittest.TestCase): fh.flush() key = crypto.getKey(filename) - self.failUnlessIsInstance(key, str, - "key isn't a string! type=%r" % type(key)) + self.failUnlessIsInstance(key, bytes, + "key isn't bytes! type=%r" % type(key)) self.assertEqual(SEKRIT_KEY, key, """The example key and the one read from file differ! key (in hex): %s

1 0

[bridgedb/develop] Fix email header encoding
by phw＠torproject.org 19 Feb '20

19 Feb '20

commit 5c1c88c6a7ccad888da7ef49e6b2d0ab909bebf9 Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Jan 19 17:59:10 2020 -0800 Fix email header encoding Type issues that manifested in the following... Traceback (most recent call last): File "/home/atagar/Desktop/tor/bridgedb/bridgedb/test/test_email_server.py", line 208, in test_SMTPIncomingDelivery_receivedHeader self.assertSubstring("Received: from example.com", hdr) File "/usr/local/lib/python3.5/dist-packages/twisted/trial/_synctest.py", line 571, in assertSubstring return self.failUnlessIn(substring, astring, msg) File "/usr/local/lib/python3.5/dist-packages/twisted/trial/_synctest.py", line 492, in assertIn % (containee, container)) twisted.trial.unittest.FailTest: 'Received: from example.com' not in "Received: from b'example.com' ([b'127.0.0.1'] helo=b'example.com')\n\tby b'morrigan' with BridgeDB (0.9.1+61.g862b4bd.dirty)\n\tfor client(a)example.com; b'Sun, 19 Jan 2020 17:35:00 -0800' " Test results changed as follows... before: FAILED (skips=115, failures=21, successes=848) after: FAILED (skips=115, failures=20, successes=849) --- bridgedb/distributors/email/server.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/bridgedb/distributors/email/server.py b/bridgedb/distributors/email/server.py index f9590be..38ed988 100644 --- a/bridgedb/distributors/email/server.py +++ b/bridgedb/distributors/email/server.py @@ -290,11 +290,11 @@ class SMTPIncomingDelivery(smtp.SMTP): :type recipients: list :param recipients: A list of :api:`twisted.mail.smtp.User` instances. """ - helo_ = ' helo={0}'.format(helo[0]) if helo[0] else '' - from_ = 'from %s ([%s]%s)' % (helo[0], helo[1], helo_) - by_ = 'by %s with BridgeDB (%s)' % (smtp.DNSNAME, __version__) - for_ = 'for %s; %s ' % (' '.join(map(str, recipients)), rfc822date()) - return str('Received: %s\n\t%s\n\t%s' % (from_, by_, for_)) + helo_ = b' helo=%s' % (helo[0] if helo[0] else '') + from_ = b'from %s ([%s]%s)' % (helo[0], helo[1], helo_) + by_ = b'by %s with BridgeDB (%s)' % (smtp.DNSNAME, __version__.encode('utf-8')) + for_ = b'for %s; %s ' % (b' '.join([str(r).encode('utf-8') for r in recipients]), rfc822date()) + return 'Received: %s\n\t%s\n\t%s' % (from_.decode('utf-8'), by_.decode('utf-8'), for_.decode('utf-8')) def validateFrom(self, helo, origin): """Validate the ``MAIL FROM:`` address on the incoming SMTP connection.

1 0

[bridgedb/develop] Make getCaptchaImage return (bytes, str).
by phw＠torproject.org 19 Feb '20

19 Feb '20

commit ba88dbc286c065ff49bd1d585789eaaa6af7690a Author: Philipp Winter <phw(a)nymity.ch> Date: Wed Feb 5 15:57:23 2020 -0800 Make getCaptchaImage return (bytes, str). --- bridgedb/captcha.py | 2 +- bridgedb/distributors/https/server.py | 8 ++++---- bridgedb/test/test_captcha.py | 8 ++++---- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/bridgedb/captcha.py b/bridgedb/captcha.py index 23bb333..2bdf6b9 100644 --- a/bridgedb/captcha.py +++ b/bridgedb/captcha.py @@ -373,7 +373,7 @@ class GimpCaptcha(Captcha): encBlob = self.publicKey.encrypt(blob.encode('utf-8')) hmac = crypto.getHMAC(self.hmacKey, encBlob) challenge = urlsafe_b64encode(hmac + encBlob) - return challenge + return challenge.decode("utf-8") def get(self): """Get a random CAPTCHA from the cache directory. diff --git a/bridgedb/distributors/https/server.py b/bridgedb/distributors/https/server.py index 52a083f..98b31d0 100644 --- a/bridgedb/distributors/https/server.py +++ b/bridgedb/distributors/https/server.py @@ -473,11 +473,11 @@ class CaptchaProtectedResource(CustomErrorHandlingResource, CSPResource): :rtype: tuple :returns: A 2-tuple of ``(image, challenge)``, where ``image`` is a - binary, JPEG-encoded image, and ``challenge`` is a unique + JPEG-encoded image of type bytes, and ``challenge`` is a unique string. If unable to retrieve a CAPTCHA, returns a tuple - containing two empty strings. + containing (b'', ''). """ - return ('', '') + return (b'', '') def extractClientSolution(self, request): """Extract the client's CAPTCHA solution from a POST request. @@ -539,7 +539,7 @@ class CaptchaProtectedResource(CustomErrorHandlingResource, CSPResource): lang=langs[0], langOverride=translations.isLangOverridden(request), imgstr=imgstr.decode("utf-8"), - challenge_field=challenge.decode("utf-8")) + challenge_field=challenge) except Exception as err: rendered = replaceErrorPage(request, err, 'captcha.html') diff --git a/bridgedb/test/test_captcha.py b/bridgedb/test/test_captcha.py index d52440d..b87251e 100644 --- a/bridgedb/test/test_captcha.py +++ b/bridgedb/test/test_captcha.py @@ -78,7 +78,7 @@ class ReCaptchaTests(unittest.TestCase): raise unittest.SkipTest(reason) else: self.assertIsInstance(self.c.image, bytes) - self.assertIsInstance(self.c.challenge, bytes) + self.assertIsInstance(self.c.challenge, str) finally: # Replace the original environment variable if there was one: if oldkey: @@ -146,7 +146,7 @@ class GimpCaptchaTests(unittest.TestCase): c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) challenge = c.createChallenge('w00t') - self.assertIsInstance(challenge, bytes) + self.assertIsInstance(challenge, str) def test_createChallenge_base64(self): """createChallenge() return value should be urlsafe base64-encoded.""" @@ -190,7 +190,7 @@ class GimpCaptchaTests(unittest.TestCase): self.cacheDir) image, challenge = c.get() self.assertIsInstance(image, bytes) - self.assertIsInstance(challenge, bytes) + self.assertIsInstance(challenge, str) def test_get_emptyCacheDir(self): """An empty cacheDir should raise GimpCaptchaError.""" @@ -238,7 +238,7 @@ class GimpCaptchaTests(unittest.TestCase): c = captcha.GimpCaptcha(self.publik, self.sekrit, self.hmacKey, self.cacheDir) image, challenge = c.get() - challengeBadB64 = challenge.decode('utf-8').rstrip('==') + "\x42\x42\x42" + challengeBadB64 = challenge.rstrip('==') + "\x42\x42\x42" self.assertEquals( c.check(challenge, c.answer, c.secretKey, c.hmacKey), True)

1 0

[bridgedb/develop] Fix type issue for moat response
by phw＠torproject.org 19 Feb '20

19 Feb '20

commit 702abdb2c00101962fc840d35f1c441c7ca67f91 Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Jan 19 18:05:41 2020 -0800 Fix type issue for moat response Fixing the following... Traceback (most recent call last): File "/home/atagar/Desktop/tor/bridgedb/bridgedb/test/test_distributors_moat_server.py", line 298, in test_getChild self.assertIn('does not implement GET http://dummy/', detail) File "/usr/local/lib/python3.5/dist-packages/twisted/trial/_synctest.py", line 492, in assertIn % (containee, container)) twisted.trial.unittest.FailTest: 'does not implement GET http://dummy/' not in "moat version 0.1.0 does not implement b'GET' b'http://dummy/'" Test results changed as follows... before: FAILED (skips=115, failures=20, successes=849) after: FAILED (skips=115, failures=19, successes=850) --- bridgedb/distributors/moat/server.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bridgedb/distributors/moat/server.py b/bridgedb/distributors/moat/server.py index 4dde385..e49a6bb 100644 --- a/bridgedb/distributors/moat/server.py +++ b/bridgedb/distributors/moat/server.py @@ -240,7 +240,7 @@ class CustomErrorHandlingResource(resource.Resource): response = resource501 response.detail = "moat version %s does not implement %s %s" % \ - (MOAT_API_VERSION, request.method, request.uri) + (MOAT_API_VERSION, request.method.decode('utf-8'), request.uri.decode('utf-8')) return response

1 0

[bridgedb/develop] Fix gimp captcha check
by phw＠torproject.org 19 Feb '20

19 Feb '20

commit 1767e28d61a97afeb3a55bbbe8f0bb3fd7e10e9b Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Jan 20 16:43:26 2020 -0800 Fix gimp captcha check BridgeDB's multiple layers of catch-alls made this take over an hour to solve. The surface level exception is... Traceback (most recent call last): File "/home/atagar/Desktop/tor/bridgedb/bridgedb/test/test_distributors_moat_server.py", line 947, in test_render_POST_unexpired_with_qrcode self.assertIsNotNone(decoded.get('data')) File "/usr/lib/python3.5/unittest/case.py", line 1229, in assertIsNotNone self.fail(self._formatMessage(msg, standardMsg)) twisted.trial.unittest.FailTest: unexpectedly None ... but multiple layers down the actual error is... Traceback (most recent call last): File "/home/atagar/Desktop/tor/bridgedb/bridgedb/test/test_distributors_moat_server.py", line 691, in test_withoutBlockIn self.resource.render(request) File "/usr/local/lib/python3.5/dist-packages/twisted/web/resource.py", line 265, in render return m(request) File "/home/atagar/Desktop/tor/bridgedb/bridgedb/distributors/moat/server.py", line 716, in render_POST valid = self.checkSolution(challenge, solution, clientIP) File "/home/atagar/Desktop/tor/bridgedb/bridgedb/distributors/moat/server.py", line 631, in checkSolution raise impossible File "/home/atagar/Desktop/tor/bridgedb/bridgedb/distributors/moat/server.py", line 628, in checkSolution self.secretKey, clientHMACKey) File "/home/atagar/Desktop/tor/bridgedb/bridgedb/captcha.py", line 293, in check timestamp = answerBlob[:12].lstrip('0') builtins.TypeError: a bytes-like object is required, not 'str' Test results changed as follows... before: FAILED (skips=115, failures=17, successes=852) after: FAILED (skips=115, failures=9, successes=860) --- bridgedb/captcha.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bridgedb/captcha.py b/bridgedb/captcha.py index fe0b876..6d8e8f7 100644 --- a/bridgedb/captcha.py +++ b/bridgedb/captcha.py @@ -289,10 +289,10 @@ class GimpCaptcha(Captcha): if hmacIsValid: try: answerBlob = secretKey.decrypt(encBlob) - timestamp = answerBlob[:12].lstrip('0') + timestamp = answerBlob[:12].lstrip(b'0') then = cls.sched.nextIntervalStarts(int(timestamp)) now = int(time.time()) - answer = answerBlob[12:] + answer = answerBlob[12:].decode('utf-8') except Exception as error: logging.warn(str(error)) else:

1 0

[bridgedb/develop] Scheduling tests are timezone sensitive
by phw＠torproject.org 19 Feb '20

19 Feb '20

commit 34d1eeb019d771f4eb9b02f5a5f4dbf985d46528 Author: Damian Johnson <atagar(a)torproject.org> Date: Sun Jan 19 17:10:50 2020 -0800 Scheduling tests are timezone sensitive This one isn't python 3 related but rather simply a BridgeDB bug when the system's local time isn't UTC... Traceback (most recent call last): File "/home/atagar/Desktop/tor/bridgedb/bridgedb/test/test_schedule.py", line 191, in test_ScheduledInterval_getInterval_seconds self._check_getInterval(10, 'seconds', 60) File "/home/atagar/Desktop/tor/bridgedb/bridgedb/test/test_schedule.py", line 173, in _check_getInterval self.assertApproximates(now, secs, variance) File "/usr/local/lib/python3.5/dist-packages/twisted/trial/_synctest.py", line 562, in assertApproximates raise self.failureException(msg or "%s ~== %s" % (first, second)) twisted.trial.unittest.FailTest: 1579475685 ~== 1579446840 Test results changed as follows... before: FAILED (skips=115, failures=26, successes=843) after: FAILED (skips=115, failures=23, successes=846) --- bridgedb/schedule.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bridgedb/schedule.py b/bridgedb/schedule.py index 4704130..a2ebf6a 100644 --- a/bridgedb/schedule.py +++ b/bridgedb/schedule.py @@ -49,7 +49,7 @@ def fromUnixSeconds(timestamp): :param int timestamp: A timestamp in Unix Era seconds. :rtype: :any:`datetime.datetime` """ - return datetime.fromtimestamp(timestamp) + return datetime.utcfromtimestamp(timestamp) class ISchedule(interface.Interface):

1 0

[bridgedb/develop] Add missing pyOpenSSL dependency.
by phw＠torproject.org 19 Feb '20

19 Feb '20

commit 86e379ff748225f63d0032fe6b1811b0d8a2d655 Author: Philipp Winter <phw(a)nymity.ch> Date: Mon Jan 27 16:14:17 2020 -0800 Add missing pyOpenSSL dependency. --- .travis.requirements.txt | 1 + 1 file changed, 1 insertion(+) diff --git a/.travis.requirements.txt b/.travis.requirements.txt index 7132226..1a1d7ff 100644 --- a/.travis.requirements.txt +++ b/.travis.requirements.txt @@ -25,6 +25,7 @@ gnupg==2.3.1 ipaddr==2.2.0 mechanize==0.4.5 Pillow==6.2.2 +pyOpenSSL==19.0.0 pygeoip==0.3.2 qrcode==6.1 service_identity==18.1.0

1 0

[bridgedb/develop] Fix dkim header check
by phw＠torproject.org 19 Feb '20

19 Feb '20

commit aa6cbac12ffc93ffe664f9ede816e66214583c4a Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Jan 20 15:25:03 2020 -0800 Fix dkim header check Oops, this one's my bad. When migrating from the rfc822 module I broke this check. The new email message's get() method returns a string rather than a list so we shouldn't index into it (we were setting dkimHeader to only the first character). This fixes... Traceback (most recent call last): File "/home/atagar/Desktop/tor/bridgedb/bridgedb/test/test_email_dkim.py", line 57, in test_checkDKIM_good self.assertTrue(result) File "/usr/local/lib/python3.5/dist-packages/twisted/trial/_synctest.py", line 395, in assertTrue super(_Assertions, self).assertTrue(condition, msg) File "/usr/lib/python3.5/unittest/case.py", line 677, in assertTrue raise self.failureException(msg) twisted.trial.unittest.FailTest: False is not true Test results changed as follows... before: FAILED (skips=115, failures=19, successes=850) after: FAILED (skips=115, failures=18, successes=851) --- bridgedb/distributors/email/dkim.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/bridgedb/distributors/email/dkim.py b/bridgedb/distributors/email/dkim.py index 48118c8..5cee31d 100644 --- a/bridgedb/distributors/email/dkim.py +++ b/bridgedb/distributors/email/dkim.py @@ -64,9 +64,7 @@ def checkDKIM(message, rules): # getheader() returns the last of a given kind of header; we want # to get the first, so we use getheaders() instead. dkimHeaders = message.get("X-DKIM-Authentication-Results") - dkimHeader = "<no header>" - if dkimHeaders: - dkimHeader = dkimHeaders[0] + dkimHeader = dkimHeaders if dkimHeaders else "<no header>" if not dkimHeader.startswith("pass"): logging.info("Rejecting bad DKIM header on incoming email: %r " % dkimHeader)

1 0

[bridgedb/develop] Port create_descriptors script to Python 3.
by phw＠torproject.org 19 Feb '20

19 Feb '20

commit 66cdfa6c6e31759f4b56b98aec27be860c5b1dad Author: Philipp Winter <phw(a)nymity.ch> Date: Mon Jan 27 16:22:21 2020 -0800 Port create_descriptors script to Python 3. ...all this required was replacing the ipaddr module with ipaddress. --- scripts/create_descriptors | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/create_descriptors b/scripts/create_descriptors index ab6ea2e..0b9d26d 100755 --- a/scripts/create_descriptors +++ b/scripts/create_descriptors @@ -1,4 +1,4 @@ -#!/usr/bin/env python2.7 +#!/usr/bin/env python3 # # This file is part of BridgeDB, a Tor bridge distribution system. @@ -6,7 +6,7 @@ import os import random import sys import time -import ipaddr +import ipaddress import math import argparse import hashlib @@ -120,7 +120,7 @@ def get_hex_string(size): def get_random_ipv6_addr(): valid_addr = None while not valid_addr: - maybe = ipaddr.IPv6Address(random.getrandbits(128)) + maybe = ipaddress.IPv6Address(random.getrandbits(128)) valid = check_ip_validity(maybe) if valid: valid_addr = maybe

1 0

[bridgedb/develop] Test assertion failure due to class name
by phw＠torproject.org 19 Feb '20

19 Feb '20

commit 4b4be048d4050bf88f7e6d7051e380c40ef91e1d Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Jan 20 16:12:51 2020 -0800 Test assertion failure due to class name BridgeDB attempted to use metaprogramming to define the class name for bridgedb/filters.py's byIPv4 and byIPv6. Rather than puzzling that out simply changing the assertion. Honestly it would be nice if BridgeDB did less of this - it makes the code a lot harder to follow. This sidesteps... Traceback (most recent call last): File "/home/atagar/Desktop/tor/bridgedb/bridgedb/test/test_email_distributor.py", line 237, in test_EmailDistributor_prepopulateRings self.failUnlessIn("IPv4", "".join([str(ringname) for ringname in ringnames])) File "/usr/local/lib/python3.5/dist-packages/twisted/trial/_synctest.py", line 492, in assertIn % (containee, container)) twisted.trial.unittest.FailTest: 'IPv4' not in 'frozenset({<function byIPv.<locals>._byIPv at 0x7f954be99d08>})frozenset({<function byIPv.<locals>._byIPv at 0x7f954be99d90>})' Test results changed as follows... before: FAILED (skips=115, failures=18, successes=851) after: FAILED (skips=115, failures=17, successes=852) --- bridgedb/test/test_email_distributor.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/bridgedb/test/test_email_distributor.py b/bridgedb/test/test_email_distributor.py index d95370f..716d190 100644 --- a/bridgedb/test/test_email_distributor.py +++ b/bridgedb/test/test_email_distributor.py @@ -234,8 +234,8 @@ class EmailDistributorTests(unittest.TestCase): # There should be an IPv4 subring and an IPv6 ring: ringnames = dist.hashring.filterRings.keys() - self.failUnlessIn("IPv4", "".join([str(ringname) for ringname in ringnames])) - self.failUnlessIn("IPv6", "".join([str(ringname) for ringname in ringnames])) + self.failUnlessIn("IPv", "".join([str(ringname) for ringname in ringnames])) + self.assertEqual(2, len(ringnames)) [dist.hashring.insert(bridge) for bridge in self.bridges] @@ -246,8 +246,8 @@ class EmailDistributorTests(unittest.TestCase): # Ugh, the hashring code is so gross looking. subrings = dist.hashring.filterRings - subring1 = subrings.values()[0][1] - subring2 = subrings.values()[1][1] + subring1 = list(subrings.values())[0][1] + subring2 = list(subrings.values())[1][1] # Each subring should have roughly the same number of bridges. # (Having ±10 bridges in either ring, out of 500 bridges total, should # be so bad.)

1 0