- tor-commits - lists.torproject.org

[spec/master] Update ts-012-lantern.md
by art＠torproject.org 09 May '16

09 May '16

commit 49727e85ecdff4e2bde31d48dff9775ee6a3dcd9 Author: Arturo Filastò <arturo(a)filasto.net> Date: Mon Jun 29 20:48:52 2015 +0200 Update ts-012-lantern.md --- test-specs/ts-012-lantern.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test-specs/ts-012-lantern.md b/test-specs/ts-012-lantern.md index 51d41e8..4aa1f07 100644 --- a/test-specs/ts-012-lantern.md +++ b/test-specs/ts-012-lantern.md @@ -38,7 +38,7 @@ None. ## Required output data -bootstrapped: +success: **boolean** The bootstrap status of Lantern (success or failure). lantern_linux --headless: @@ -61,7 +61,7 @@ failure: ## Semantics -'bootstrapped' - True or False - whether Lantern has bootstrapped. +'success' - True or False - whether Lantern has bootstrapped. 'body' - http page body if successfully requested. 'failure' - optional, present if there is a failure. 'lantern_linux --headless':

1 0

[spec/master] Add draft of lantern test specification
by art＠torproject.org 09 May '16

09 May '16

commit ed70fa743fd5a05a56c2623c8191c0ace8f019c0 Author: aagbsn <aagbsn(a)extc.org> Date: Mon Apr 6 14:31:30 2015 +0000 Add draft of lantern test specification --- test-specs/ts-012-lantern.md | 111 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 111 insertions(+) diff --git a/test-specs/ts-012-lantern.md b/test-specs/ts-012-lantern.md new file mode 100644 index 0000000..51d41e8 --- /dev/null +++ b/test-specs/ts-012-lantern.md @@ -0,0 +1,111 @@ +# Specification version number + +2015-04-03-000 + +# Specification name + +Lantern Test + +# Test preconditions + +Downloaded or compiled the "lantern_linux" binary and made executable and in +the users PATH environment variable. + +# Expected impact + +Ability to measure whether Lantern is working from the given network vantage point. + +# Expected inputs + +A single URL to fetch, supplied by command line argument "--url (-u)". To test +Lantern, it must be a URL from the whitelisted set. +See: https://github.com/getlantern/flashlight/blob/master/genconfig/proxiedsites/ + +# Test description + +This test launches Lantern in --headless mode, and parses output to determine +if it has bootstrapped. After bootstrap, it fetches the URL supplied by the +--url option using Lanterns http proxy interface listening on 127.0.0.1.8787. + +The specific string used to determine bootstrap from Lantern output in version +"0.0.1" is "client (http) proxy at" from standard output. + +# Expected output + +## Parent data format + +None. + +## Required output data + +bootstrapped: +**boolean** The bootstrap status of Lantern (success or failure). + +lantern_linux --headless: +**dictionary** the parent key of Lanterns output that contains the keys stdout and stderr + +stdout: +**string** Output produced by Lanterns standard output. + +stderr: +**string** Error produced by Lanterns standard error. + +body: +**string** The page body of a successful HTTP request. + +failure: +**string** If failure, then the corresponding failure message. + + +## Data specification version number + +## Semantics + +'bootstrapped' - True or False - whether Lantern has bootstrapped. +'body' - http page body if successfully requested. +'failure' - optional, present if there is a failure. +'lantern_linux --headless': + 'stdout' - Contents of standard output produced by Lantern. + 'stderr' - Contents of standard error produced by Lantern. + + +## Possible conclusions + +We can determine whether or not Lantern is able to bootstrap, according to its output. +We can determine whether or not a given URL is reachable via Lantern. + +## Example output sample +``` +--- +input_hashes: [] +options: [-u, google.com] +probe_asn: AS1234 +probe_cc: US +probe_city: null +probe_ip: 127.0.0.1 +software_name: ooniprobe +software_version: 1.2.3-rc1 +start_time: 1428344311.0 +test_name: lantern_circumvention_tool_test +test_version: 0.0.1 +... +--- +body: "<HTML><HEAD><meta http-equiv=\"content-type\" content=\"text/html;charset=utf-8\"\ + >\n<TITLE>301 Moved</TITLE></HEAD><BODY>\n<H1>301 Moved</H1>\nThe document has moved\n\ + <A HREF=\"http://www.google.com/\">here</A>.\r\n</BODY></HTML>\r\n" +bootstrapped: true +input: null +lantern_linux --headless: {exit_reason: process_done, stderr: '', stdout: ''} +``` + +## Expected Post-processing efforts + +# Privacy considerations + +Lantern does not seek to provide anonymity. Lantern contains tracking analytics +software and may connect directly to Lantern-provided proxy endpoints, or use +fronted domains via Content Delivery Networks (CDNs) as a data channel. + +# Packet capture considerations + +This test does not capture packets by default.

1 0

[spec/master] Fix meek test spec (PR #38)
by art＠torproject.org 09 May '16

09 May '16

commit e9ce1835133729871396af7ae10988171c88a6cc Author: anadahz <kojgelo(a)inbox.com> Date: Thu Apr 9 01:46:57 2015 +0200 Fix meek test spec (PR #38) --- test-specs/ts-013-meek-fronted-requests.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/test-specs/ts-013-meek-fronted-requests.md b/test-specs/ts-013-meek-fronted-requests.md index f211cc4..f78066e 100644 --- a/test-specs/ts-013-meek-fronted-requests.md +++ b/test-specs/ts-013-meek-fronted-requests.md @@ -36,9 +36,12 @@ Example: # Test description -Performs a HTTP GET request to a list of fronted domains with the Host -Header of the "inside" meek-server. The meek-server handles a GET request and -response with: "I’m just a happy little web server.\n". +Performs a HTTP GET request over TLS (HTTPS) to a list of fronted domains with +the Host Header of the "inside" meek-server. For diagnostic purposes the +meek-server handles a GET request and respond with: "I’m just a happy little +web server.\n". The GET request is sent over TLS to the root of the fronted +domain with the Host Header option of the desired meek-server host. + # Expected output @@ -55,12 +58,12 @@ df-001-httpt-000 * The received responses -* If the meek request is blocked +* If the meek server is blocked or unreachable ## Semantics -censored: - **boolean** indicates if an HTTP GET response to the meek server is +success: + **boolean** indicates if an HTTPS GET response to the meek server is successfull ## Possible conclusions @@ -71,7 +74,6 @@ If the fronted request/response to the meek server is successful. ``` agent: agent -censored: false input: ajax.aspnetcdn.com:az668014.vo.msecnd.net requests: - request: @@ -105,4 +107,5 @@ requests: - - Content-Type - [text/plain; charset=utf-8] socksproxy: null +success: true ```

1 0

[spec/master] Merge pull request #45 from juga0/feature/openvpn
by art＠torproject.org 09 May '16

09 May '16

commit 93fbc7be087d2dd17e1f3542675007e74701bf85 Merge: d8eb40b 6c858ff Author: Arturo Filastò <arturo(a)filasto.net> Date: Fri Nov 13 10:50:50 2015 +0100 Merge pull request #45 from juga0/feature/openvpn add openvpn test specification test-specs/ts-015-openvpn.md | 218 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 218 insertions(+)

1 0

[spec/master] add psiphon test specification
by art＠torproject.org 09 May '16

09 May '16

commit 7e00a17673a88593bef3676c391b6f0c47a3c700 Author: juga0 <juga> Date: Wed Nov 11 13:36:55 2015 +0000 add psiphon test specification * add initial version of add psiphon test specification * add ConnectionDone error in df-000-base.md. This error is triggered when the URL in a HTTP request is not found using psiphon --- data-formats/df-000-base.md | 2 + test-specs/ts-014-psiphon.md | 146 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 148 insertions(+) diff --git a/data-formats/df-000-base.md b/data-formats/df-000-base.md index 27120d8..d0d5378 100644 --- a/data-formats/df-000-base.md +++ b/data-formats/df-000-base.md @@ -135,6 +135,8 @@ error_string: * twisted.internet.error.TCPTimedOutError: `tcp_timed_out_error` +* twisted.internet.error.ConnectionDone: `connection_done` + * twisted.web._newclient.ResponseNeverReceived: `response_never_received` * twisted.internet.error.TimeoutError: `generic_timeout_error` diff --git a/test-specs/ts-014-psiphon.md b/test-specs/ts-014-psiphon.md new file mode 100644 index 0000000..7bc6c04 --- /dev/null +++ b/test-specs/ts-014-psiphon.md @@ -0,0 +1,146 @@ +# Specification version number + +2015-10-11-000 + +# Specification name + +Psiphon Test + +# Test preconditions + +Have psiphon-circumvention-system (including psiphon-circumvention-system/pyclient/psi_client.py) cloned in the home of the user that runs ooni or somewhere else accessible to the user that runs ooni. + +# Expected impact + +Ability to measure whether Psiphon is working from the given network vantage point. + +# Expected inputs + +Optionally: +A single URL to fetch, supplied by command line argument "--url (-u)". +Psiphon path, specified by the command line argument "--psiphonpath (-p)" +The ip:port that Psiphon will use for the SOCKS proxy, with the command line argument "--socksproxy (-s)" + +# Test description + +This test first check that the Psiphon path exists, then launches Psiphon and parses output to determine if it has bootstrapped. After bootstrap, it fetches google.com (or other URL specified by the --url argument) using Psiphons SOCKS proxy listening on 127.0.0.1:1080 (or otherwise specified by the --socksproxy argument). + +The specific string used to determine bootstrap from Psiphon output in version +"0.0.1" is "Press Ctrl-C to terminate." from standard output. + +# Expected output + +## Parent data format + +The following keys from df-001-httpt.md are used when Psiphon bootstraps: requests, socksproxy, agent. +When Psiphon is not installed or does not bootstrap, only agent and socksproxy are used. + +## Required output data + +psiphon_installed: +**boolean** Whether Psiphon client is found or not (success or failure). + +success: +**boolean** The bootstrap status of Psiphon (success or failure). + +/tmp/<temporary file>: +**dictionary** the parent key of Psiphon's output that contains the keys stdout and stderr and exit_reason + +stdout: +**string** Output produced by Psiphon's standard output. + +stderr: +**string** Error produced by Psiphon's standard error. + +## Data specification version number + +## Semantics + +'psiphon_installed' - True or False - whether Psiphon is found. +'success' - True or False - whether Psiphon has bootstrapped. +'body' - http page body if successfully requested. +'/tmp/<temporary file>': + 'stdout' - Contents of standard output produced by Psiphon. + 'stderr' - Contents of standard error produced by Psiphon. + + +## Possible conclusions + +We can determine whether or not Psiphon is found. +We can determine whether or not Psiphon is able to bootstrap, according to its output. +We can determine whether or not a given URL is reachable via Psiphon. + +## Example output sample +``` +--- +input_hashes: [] +options: [-u, google.com] +probe_asn: AS0 +probe_cc: ZZ +probe_city: null +probe_ip: 127.0.0.1 +report_id: 4dAHr0ceNDBmw5lUQ7pBoxqgyUSfP873Qj1zv5VyElnSSTXwcsLYeCv69DsUjb94 +software_name: ooniprobe +software_version: 1.3.1 +start_time: 1444686051.0 +test_helpers: {} +test_name: psiphon_test +test_version: 0.0.1 +... +--- +/tmp/tmplKg8K3: {exit_reason: process_done, stderr: '', stdout: "./ssh is not a valid\ + \ executable. Using standard ssh.\r\n\r\nYour SOCKS proxy is now running at 127.0.0.1:1080\r\ + \n\r\nPress Ctrl-C to terminate.\r\nTerminating...\r\nConnection closed\r\n"} +agent: agent +input: null +psiphon_installed: true +requests: +- request: + body: null + headers: [] + method: GET + tor: {is_tor: false} + url: http://google.com + response: + body: "<HTML><HEAD><meta http-equiv=\"content-type\" content=\"text/html;charset=utf-8\"\ + >\n<TITLE>301 Moved</TITLE></HEAD><BODY>\n<H1>301 Moved</H1>\nThe document has\ + \ moved\n<A HREF=\"http://www.google.com/\">here</A>.\r\n</BODY></HTML>\r\n" + code: 301 + headers: + - - Content-Length + - ['219'] + - - X-XSS-Protection + - [1; mode=block] + - - Expires + - ['Wed, 11 Nov 2015 21:40:58 UTC'] + - - Server + - [gws] + - - Connection + - [close] + - - Location + - ['http://www.google.com/'] + - - Cache-Control + - ['public, max-age=2592000'] + - - Date + - ['Mon, 12 Oct 2015 21:40:58 UTC'] + - - X-Frame-Options + - [SAMEORIGIN] + - - Content-Type + - [text/html; charset=UTF-8] +socksproxy: 127.0.0.1:1080 +test_runtime: 7.373162031173706 +test_start_time: 1444686052.0 +... +``` + +## Expected Post-processing efforts + +# Privacy considerations + +Psiphon does not seek to provide anonymity. +An adversary can observe that a user is connecting to Psiphon servers. +Psiphon servers can also determine the users location. + +# Packet capture considerations + +This test does not capture packets by default.

1 0

[spec/master] Merge pull request #43 from TheTorProject/fix/naming
by art＠torproject.org 09 May '16

09 May '16

commit d8eb40b9ea39128fe18aef6acb758c45cfef9a85 Merge: 69e2b34 955b50d Author: Arturo Filastò <arturo(a)filasto.net> Date: Sun Nov 8 10:22:59 2015 +0100 Merge pull request #43 from TheTorProject/fix/naming Rename test spec to conform with name test spec

1 0

[spec/master] Update ts-012-lantern.md
by art＠torproject.org 09 May '16

09 May '16

commit 955b50d2f0fd8b933edb0575f0ffcc34489ec4f6 Author: Arturo Filastò <arturo(a)filasto.net> Date: Mon Jun 29 20:48:52 2015 +0200 Update ts-012-lantern.md --- test-specs/ts-012-lantern.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test-specs/ts-012-lantern.md b/test-specs/ts-012-lantern.md index 51d41e8..4aa1f07 100644 --- a/test-specs/ts-012-lantern.md +++ b/test-specs/ts-012-lantern.md @@ -38,7 +38,7 @@ None. ## Required output data -bootstrapped: +success: **boolean** The bootstrap status of Lantern (success or failure). lantern_linux --headless: @@ -61,7 +61,7 @@ failure: ## Semantics -'bootstrapped' - True or False - whether Lantern has bootstrapped. +'success' - True or False - whether Lantern has bootstrapped. 'body' - http page body if successfully requested. 'failure' - optional, present if there is a failure. 'lantern_linux --headless':

1 0

[spec/master] add openvpn test specification
by art＠torproject.org 09 May '16

09 May '16

commit 6c858ffb4dd220594f05a0fea34645019c4c1e6a Author: juga0 <juga> Date: Wed Nov 11 19:53:29 2015 +0000 add openvpn test specification --- test-specs/ts-015-openvpn.md | 218 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 218 insertions(+) diff --git a/test-specs/ts-015-openvpn.md b/test-specs/ts-015-openvpn.md new file mode 100644 index 0000000..84ed367 --- /dev/null +++ b/test-specs/ts-015-openvpn.md @@ -0,0 +1,218 @@ +# Specification version number + +2015-10-11-000 + +# Specification name + +OpenVPN Test + +# Test preconditions + +Have OpenVPN installed and configured to work with at least one server and privileges to run the test as root. + +# Expected impact + +Ability to measure whether OpenVPN is working from the given network vantage point. + +# Expected inputs + +A single URL to fetch, supplied by command line argument "--url (-u)". +OpenVPN configuration file, specified by the command line argument "--openvpn-config (-c)" + +# Test description + +This test first launches OpenVPN and parses output to determine if it has bootstrapped. After bootstrap, it fetches the URL specified by the --url argument using OpenVPN. + +The specific string used to determine bootstrap from OpenVPN output in version +"0.0.1" is "Initialization Sequence Completed" from standard output. + +# Expected output + +## Parent data format + +None. + +## Required output data + +success: +**boolean** The bootstrap status of OpenVPN (success or failure). + +OpenVPN_linux --headless: +**dictionary** the parent key of OpenVPNs output that contains the keys stdout and stderr + +stdout: +**string** Output produced by OpenVPNs standard output. + +stderr: +**string** Error produced by OpenVPNs standard error. + +body: +**string** The page body of a successful HTTP request. + +failure: +**string** If failure, then the corresponding failure message. + +## Data specification version number + +## Semantics + +'success' - True or False - whether OpenVPN has bootstrapped. +'body' - http page body if successfully requested. +'failure' - optional, present if there is a failure. +'l/usr/sbin/openvpn --config configfile': + 'stdout' - Contents of standard output produced by OpenVPN. + 'stderr' - Contents of standard error produced by OpenVPN. + +## Possible conclusions + +We can determine whether or not OpenVPN is able to bootstrap, according to its output. +We can determine whether or not a given URL is reachable via OpenVPN. + +## Example output sample +``` +--- +input_hashes: [] +options: [-c, openvpnconfigfile.ovpn, -u, ''] +probe_asn: AS0 +probe_cc: ZZ +probe_city: null +probe_ip: 127.0.0.1 +report_id: nqvK7YrK6J5Di7BiWDwPUBfyKcbLoVWeU4DgnxTzzKWMQABvhC2l3q6aLUwF0CA9 +software_name: ooniprobe +software_version: 1.3.1 +start_time: 1444925440.0 +test_helpers: {} +test_name: test_openvpn_circumvent +test_version: 0.0.1 +... +--- +/usr/sbin/openvpn --config /pathtoopenvpnconfigfile/openvpnconfigfile.ovpn: { + exit_reason: process_done, stderr: '', stdout: 'Thu Oct 15 20:10:40 2015 OpenVPN + 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] + [IPv6] built on Dec 1 2014 + + Thu Oct 15 20:10:40 2015 WARNING: file ''/tmp/openvpn.txt'' is group or others + accessible + + Thu Oct 15 20:10:40 2015 Control Channel Authentication: tls-auth using INLINE + static key file + + Thu Oct 15 20:10:40 2015 Attempting to establish TCP connection with [AF_INET]10.0.0.10:993 + [nonblock] + + Thu Oct 15 20:10:41 2015 TCP connection established with [AF_INET]10.0.0.10:993 + + Thu Oct 15 20:10:41 2015 TCPv4_CLIENT link local: [undef] + + Thu Oct 15 20:10:41 2015 TCPv4_CLIENT link remote: [AF_INET]10.0.0.10:993 + + Thu Oct 15 20:10:41 2015 WARNING: this configuration may cache passwords in memory + -- use the auth-nocache option to prevent this + + Thu Oct 15 20:10:46 2015 [server] Peer Connection Initiated with [AF_INET]10.0.0.10:993 + + Thu Oct 15 20:10:48 2015 Options error: Unrecognized option or missing parameter(s) + in [PUSH-OPTIONS]:3: dhcp (2.3.2) + + Thu Oct 15 20:10:48 2015 TUN/TAP device tun0 opened + + Thu Oct 15 20:10:48 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 + + Thu Oct 15 20:10:48 2015 /sbin/ip link set dev tun0 up mtu 1500 + + Thu Oct 15 20:10:48 2015 /sbin/ip addr add dev tun0 local 10.10.0.34 peer 10.10.0.33 + + Thu Oct 15 20:10:48 2015 Initialization Sequence Completed + + '} +body: "<?xml version=\"1.0\"?>\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\ + \n \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\">\n<html xmlns=\"http://www.w3.org/1999/xhtml\"\ + >\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html;charset=utf-8\"\ + \ />\n<title>This is a Tor Exit Router</title>\n\n\n\n</head>\n<body>\n\n<p style=\"text-align:center; font-size:xx-large; font-weight:bold\"\ + >This is a\nTor Exit Router</p>\n\n<p>\nMost likely you are accessing this website\ + \ because you had some issue with\nthe traffic coming from this IP. This router\ + \ is part of the <a\nhref=\"https://www.torproject.org/\">Tor Anonymity Network</a>,\ + \ which is\ndedicated to <a href=\"https://www.torproject.org/about/overview\">providing\n\ + privacy</a> to people who need it most: average computer users. This\nrouter IP\ + \ should be generating no other traffic, unless it has been\ncompromised.</p>\n\n\ + <p style=\"text-align:center\">\n<a href=\"https://www.torproject.org/about/overview\"\ + >\n<img src=\"how_tor_works_thumb.png\" alt=\"How Tor works\" style=\"border-style:none\"\ + />\n</a></p>\n\n<p>\nTor sees use by <a href=\"https://www.torproject.org/about/torusers\"\ + >many\nimportant segments of the population</a>, including whistle blowers,\njournalists,\ + \ Chinese dissidents skirting the Great Firewall and oppressive\ncensorship, abuse\ + \ victims, stalker targets, the US military, and law\nenforcement, just to name\ + \ a few. While Tor is not designed for malicious\ncomputer users, it is true that\ + \ they can use the network for malicious ends.\nIn reality however, the actual amount\ + \ of <a\nhref=\"https://www.torproject.org/docs/faq-abuse\">abuse</a> is quite low.\ + \ This\nis largely because criminals and hackers have significantly better access\ + \ to\nprivacy and anonymity than do the regular users whom they prey upon. Criminals\n\ + can and do <a\nhref=\"http://voices.washingtonpost.com/securityfix/2008/08/web_fraud_20_tools.htm…"\ + >build,\nsell, and trade</a> far larger and <a\nhref=\"http://voices.washingtonpost.com/securityfix/2008/08/web_fraud_20_distribut…"\ + >more\npowerful networks</a> than Tor on a daily basis. Thus, in the mind of this\n\ + operator, the social need for easily accessible censorship-resistant private,\n\ + anonymous communication trumps the risk of unskilled bad actors, who are\nalmost\ + \ always more easily uncovered by traditional police work than by\nextensive monitoring\ + \ and surveillance anyway.</p>\n\n<p>\nIn terms of applicable law, the best way\ + \ to understand Tor is to consider it a\nnetwork of routers operating as common\ + \ carriers, much like the Internet\nbackbone. However, unlike the Internet backbone\ + \ routers, Tor routers\nexplicitly do not contain identifiable routing information\ + \ about the source of\na packet, and no single Tor node can determine both the origin\ + \ and destination\nof a given transmission.</p>\n\n<p>\nAs such, there is little\ + \ the operator of this router can do to help you track\nthe connection further.\ + \ This router maintains no logs of any of the Tor\ntraffic, so there is little that\ + \ can be done to trace either legitimate or\nillegitimate traffic (or to filter\ + \ one from the other). Attempts to\nseize this router will accomplish nothing.</p>\n\ + \n\n\n<p>\nIf you are a representative of a company\ + \ who feels that this router is being\nused to violate the DMCA, please be aware\ + \ that this machine does not host or\ncontain any illegal content. Also be aware\ + \ that network infrastructure\nmaintainers are not liable for the type of content\ + \ that passes over their\nequipment, in accordance with <a\nhref=\"http://www.law.cornell.edu/uscode/text/17/512\"\ + >DMCA\n\"safe harbor\" provisions</a>. In other words, you will have just as much\ + \ luck\nsending a takedown notice to the Internet backbone providers. Please consult\n\ + <a href=\"https://www.torproject.org/eff/tor-dmca-response\">EFF's prepared\nresponse</a>\ + \ for more information on this matter.</p>\n\n<p>For more information, please consult\ + \ the following documentation:</p>\n\n<ol>\n<li><a href=\"https://www.torproject.org/about/overview\"\ + >Tor Overview</a></li>\n<li><a href=\"https://www.torproject.org/docs/faq-abuse\"\ + >Tor Abuse FAQ</a></li>\n<li><a href=\"https://www.torproject.org/eff/tor-legal-faq\"\ + >Tor Legal FAQ</a></li>\n</ol>\n\n<p>\nThat being said, if you still have a complaint\ + \ about the router, you may\nemail the <a href=\"mailto:tor@openvpnconfigfile.ie\">maintainer</a>.\ + \ If\ncomplaints are related to a particular service that is being abused, I will\n\ + consider removing that service from my exit policy, which would prevent my\nrouter\ + \ from allowing that traffic to exit through it. I can only do this on an\nIP+destination\ + \ port basis, however. Common P2P ports are\nalready blocked.</p>\n\n<p>\nYou also\ + \ have the option of blocking this IP address and others on\nthe Tor network if\ + \ you so desire. The Tor project provides a <a\nhref=\"https://check.torproject.org/cgi-bin/TorBulkExitList.py\"\ + >web service</a>\nto fetch a list of all IP addresses of Tor exit nodes that allow\ + \ exiting to a\nspecified IP:port combination, and an official <a\nhref=\"https://www.torproject.org/tordnsel/dist/\"\ + >DNSRBL</a> is also available to\ndetermine if a given IP address is actually a\ + \ Tor exit server. Please\nbe considerate\nwhen using these options. It would be\ + \ unfortunate to deny all Tor users access\nto your site indefinitely simply because\ + \ of a few bad apples.</p>\n\n<p style=\"text-align:center; margin-bottom: 0.5em\"\ + >Exit Node provided by:<p>\n<h2 style=\"text-align: center\"><a style=\"color: black\"\ + \ href=\"http://www.openvpnconfigfile.ie\">DU Pirate Party</a><h2>\n\n</body>\n</html>\n" +input: null +success: true +test_runtime: 8.374207019805908 +test_start_time: 1444925440.0 +... +``` + +## Expected Post-processing efforts + +# Privacy considerations + +OpenVPN does not seek to provide anonymity. +An adversary can observe that a user is connecting to OpenVPN servers. +OpenVPN servers can also determine the users location. + +# Packet capture considerations + +This test does not capture packets by default.

1 0

[oonib/master] Set the report file template in the example configuration to the default
by art＠torproject.org 09 May '16

09 May '16

commit 738eeefedc323103e22ef0ea079be7d84ae1c41d Author: Arturo Filastò <arturo(a)filasto.net> Date: Mon Apr 4 16:06:22 2016 +0200 Set the report file template in the example configuration to the default --- oonib.conf.example | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/oonib.conf.example b/oonib.conf.example index 64eb5c5..7821dc1 100644 --- a/oonib.conf.example +++ b/oonib.conf.example @@ -29,7 +29,7 @@ main: stale_time: 3600 tor_hidden_service: true - report_file_template: '{test_name}-{iso8601_timestamp}-{probe_asn}-probe.yamloo' + report_file_template: '{iso8601_timestamp}-{test_name}-{report_id}-{probe_asn}-{probe_cc}-probe-0.2.0.{ext}' helpers: http-return-json-headers: address: null

1 0

[oonib/master] Update tor and openssl versions
by art＠torproject.org 09 May '16

09 May '16

commit 331b16d3a311c48105f6d1582ad1916a614a2700 Author: Arturo Filastò <arturo(a)filasto.net> Date: Wed Apr 27 17:59:53 2016 +0200 Update tor and openssl versions --- scripts/build_tor2web_tor.sh | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/scripts/build_tor2web_tor.sh b/scripts/build_tor2web_tor.sh index e23a245..a9042ff 100755 --- a/scripts/build_tor2web_tor.sh +++ b/scripts/build_tor2web_tor.sh @@ -1,18 +1,18 @@ #!/bin/bash # Versions of libraries that we need to build a static Tor -OPENSSL_VERSION=1.0.1e +OPENSSL_VERSION=1.0.1s LIBEVENT_VERSION=2.0.21-stable ZLIB_VERSION=1.2.8 -TOR_VERSION=0.2.4.22 +TOR_VERSION=0.2.7.6 ZLIB_SHA256=36658cb768a54c1d4dec43c3116c27ed893e88b02ecfcb44f2166f9c0b7f2a0d SCRIPT_ROOT=`pwd` # Package URLS URLS="\ -https://www.torproject.org/dist/tor-$TOR_VERSION.tar.gz -https://www.torproject.org/dist/tor-$TOR_VERSION.tar.gz.asc +https://dist.torproject.org/tor-$TOR_VERSION.tar.gz +https://dist.torproject.org/tor-$TOR_VERSION.tar.gz.asc http://zlib.net/zlib-$ZLIB_VERSION.tar.gz https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz.asc https://www.openssl.org/source/openssl-$OPENSSL_VERSION.tar.gz @@ -32,23 +32,23 @@ fi # get key for nickm (libevent) gpg --fingerprint 0xb35bf85bf19489d04e28c33c21194ebb165733ea -if [ $? -ne 0 ]; then +if [ $? -ne 0 ]; then gpg --keyserver pgp.mit.edu --recv-keys 0xb35bf85bf19489d04e28c33c21194ebb165733ea gpg --fingerprint 0xb35bf85bf19489d04e28c33c21194ebb165733ea if [ $? -ne 0 ]; then exit ;fi fi -# get key for Dr Stephen Henson (openssl) -gpg --fingerprint 0xd05d8c616e27e66041ecb1b8d57ee597 -if [ $? -ne 0 ]; then - gpg --keyserver pgp.mit.edu --recv-keys 0xF295C759 - gpg --fingerprint 0xd05d8c616e27e66041ecb1b8d57ee597 +# get key for Matt Caswell <matt(a)openssl.org> (openssl) +gpg --fingerprint 0x8657abb260f056b1e5190839d9c4d26d0e604491 +if [ $? -ne 0 ]; then + gpg --keyserver pgp.mit.edu --recv-keys 0x8657abb260f056b1e5190839d9c4d26d0e604491 + gpg --fingerprint 0x8657abb260f056b1e5190839d9c4d26d0e604491 if [ $? -ne 0 ]; then exit ;fi fi # get key for arma (tor) tor gpg --fingerprint 0xf65ce37f04ba5b360ae6ee17c218525819f78451 -if [ $? -ne 0 ]; then +if [ $? -ne 0 ]; then gpg --keyserver pgp.mit.edu --recv-keys 0xf65ce37f04ba5b360ae6ee17c218525819f78451 gpg --fingerprint 0xf65ce37f04ba5b360ae6ee17c218525819f78451 if [ $? -ne 0 ]; then exit ;fi

1 0