- tor-commits - lists.torproject.org

[snowflake/master] convert all coffeescript tests to jasmine
by serene＠torproject.org 07 Feb '16

07 Feb '16

commit e38bed8be3f876da5c840710f82a2f5e6b67ecc5 Author: Serene Han <keroserene+git(a)gmail.com> Date: Thu Feb 4 14:13:03 2016 -0800 convert all coffeescript tests to jasmine --- .gitignore | 1 + .travis.yml | 2 +- proxy/Cakefile | 23 ++-- proxy/README.md | 9 +- proxy/snowflake.coffee | 4 +- proxy/snowflake_test.coffee | 323 -------------------------------------------- proxy/spec.coffee | 180 ++++++++++++++++++++++++ proxy/websocket.coffee | 1 + 8 files changed, 205 insertions(+), 338 deletions(-) diff --git a/.gitignore b/.gitignore index 516f3ff..b1db25c 100644 --- a/.gitignore +++ b/.gitignore @@ -10,4 +10,5 @@ snowflake.log proxy/test proxy/build proxy/node_modules +proxy/spec ignore/ diff --git a/.travis.yml b/.travis.yml index c860b37..4a7aedd 100644 --- a/.travis.yml +++ b/.travis.yml @@ -4,7 +4,7 @@ go: - 1.5 before_script: - npm install -g coffee-script coffeelint + npm install -g coffee-script coffeelint jasmine script: - make check diff --git a/proxy/Cakefile b/proxy/Cakefile index fc92934..c569110 100644 --- a/proxy/Cakefile +++ b/proxy/Cakefile @@ -11,10 +11,10 @@ FILES = [ 'ui.coffee' 'snowflake.coffee' ] -FILES_TEST = [ - 'snowflake_test.coffee' +FILES_SPEC = [ + 'spec.coffee' ] -FILES_ALL = FILES.concat FILES_TEST +FILES_ALL = FILES.concat FILES_SPEC OUTFILE = 'build/snowflake.coffee' STATIC = 'static' @@ -23,16 +23,18 @@ concatCoffeeFiles = -> exec 'cat ' + FILES.join(' ') + ' | cat > ' + OUTFILE copyStaticFiles = -> exec 'cp ' + STATIC + '/* build/' compileCoffee = -> - exec 'coffee -o build -c build/snowflake.coffee', (err, stdout, stderr) -> + exec 'coffee -o build -b -c build/snowflake.coffee', (err, stdout, stderr) -> throw err if err task 'test', 'snowflake unit tests', -> - exec 'mkdir -p test' - testFile = 'test/snowflake.bundle.coffee' - exec 'cat ' + FILES.join(' ') + ' snowflake_test.coffee | cat > ' + testFile - exec 'coffee ' + testFile + ' -v', (err, stdout, stderr) -> - throw err if err - console.log stdout + stderr + exec 'jasmine init >&-' + jasmineFiles = FILES.concat FILES_SPEC + outFile = 'spec/snowflake.bundle.coffee' + exec 'cat ' + jasmineFiles.join(' ') + ' | cat > ' + outFile + exec 'coffee -o spec -cb ' + outFile + spawn 'jasmine', ['spec/snowflake.bundle.js'], { + stdio: 'inherit' + } task 'build', 'build the snowflake proxy', -> exec 'mkdir -p build' @@ -49,4 +51,5 @@ task 'lint', 'ensure idiomatic coffeescript', -> task 'clean', 'remove all built files', -> exec 'rm -r build' + exec 'rm -r spec' exec 'rm -r test/snowflake.bundle.coffee' diff --git a/proxy/README.md b/proxy/README.md index 1affaca..364ac0e 100644 --- a/proxy/README.md +++ b/proxy/README.md @@ -2,12 +2,16 @@ This is the browser proxy component of Snowflake. ### Testing: -Unit tests are available with: +Unit testing with Jasmine are available with: ``` cake test ``` +Requires jasmine. (`npm install -g jasmine`) -To run locally, start a webserver and navigate to `snowflake.html`. +To run locally, either: +- Navigate to `proxy/build/embed.html` +- For a more fully featured "debug" version, + start a webserver and navigate to `snowflake.html`. ### Parameters @@ -16,7 +20,6 @@ snowflake uses the default relay `192.81.135.242:9901` and uses automatic signaling with the default broker at `https://snowflake-reg.appspot.com/`. - Here are optional parameters to include in the query string. ``` manual - enables copy-paste signalling mode. diff --git a/proxy/snowflake.coffee b/proxy/snowflake.coffee index 74f6a6e..eea1518 100644 --- a/proxy/snowflake.coffee +++ b/proxy/snowflake.coffee @@ -15,10 +15,12 @@ COPY_PASTE_ENABLED = false DEBUG = false query = null -if window && window.location +if 'undefined' != typeof window && window.location query = Query.parse(window.location.search.substr(1)) DEBUG = Params.getBool(query, 'debug', false) COPY_PASTE_ENABLED = Params.getBool(query, 'manual', false) +else + window = {} # HEADLESS is true if we are running not in a browser with a DOM. HEADLESS = 'undefined' == typeof(document) diff --git a/proxy/snowflake_test.coffee b/proxy/snowflake_test.coffee deleted file mode 100644 index 624257a..0000000 --- a/proxy/snowflake_test.coffee +++ /dev/null @@ -1,323 +0,0 @@ -window = {} -ui = {} - -VERBOSE = false -VERBOSE = true if process.argv.indexOf('-v') >= 0 - -numTests = 0 -numFailed = 0 - -announce = (testName) -> - console.log '\n --- ' + testName + ' ---' if VERBOSE - -pass = (test) -> - numTests++ - console.log 'PASS ' + test if VERBOSE - -fail = (test, expected, actual) -> - numTests++ - numFailed++ - console.log 'FAIL ' + test + - ' expected: ' + JSON.stringify(expected) + - ' actual: ' + JSON.stringify(actual) - -# Stubs for browser functionality. -class WebSocket - OPEN: 1 - CLOSED: 0 - -testBuildUrl = -> - TESTS = [{ - args: ['http', 'example.com'] - expected: 'http://example.com' - },{ - args: ['http', 'example.com', 80] - expected: 'http://example.com' - },{ - args: ['http', 'example.com', 81], - expected: 'http://example.com:81' - },{ - args: ['https', 'example.com', 443] - expected: 'https://example.com' - },{ - args: ['https', 'example.com', 444] - expected: 'https://example.com:444' - },{ - args: ['http', 'example.com', 80, '/'] - expected: 'http://example.com/' - },{ - args: ['http', 'example.com', 80, '/test?k=%#v'] - expected: 'http://example.com/test%3Fk%3D%25%23v' - },{ - args: ['http', 'example.com', 80, '/test', []] - expected: 'http://example.com/test?' - },{ - args: ['http', 'example.com', 80, '/test', [['k', '%#v']]] - expected: 'http://example.com/test?k=%25%23v' - },{ - args: ['http', 'example.com', 80, '/test', [['a', 'b'], ['c', 'd']]] - expected: 'http://example.com/test?a=b&c=d' - },{ - args: ['http', '1.2.3.4'] - expected: 'http://1.2.3.4' - },{ - args: ['http', '1:2::3:4'] - expected: 'http://[1:2::3:4]' - },{ - args: ['http', 'bog][us'] - expected: 'http://bog%5D%5Bus' - },{ - args: ['http', 'bog:u]s'] - expected: 'http://bog%3Au%5Ds' - }] - announce 'testBuildUrl' - for test in TESTS - actual = buildUrl.apply undefined, test.args - if actual == test.expected - pass test.args - else - fail test.args, test.expected, actual - -### -This test only checks that things work for strings formatted like -document.cookie. Browsers maintain several properties about this string, for -example cookie names are unique with no trailing whitespace. See -http://www.ietf.org/rfc/rfc2965.txt for the grammar. -### -testParseCookieString = -> - TESTS = [{ - cs: '' - expected: {} - },{ - cs: 'a=b' - expected: { a: 'b' } - },{ - cs: 'a=b=c' - expected: { a: 'b=c' } - },{ - cs: 'a=b; c=d' - expected: { a: 'b', c: 'd' } - },{ - cs: 'a=b ; c=d' - expected: { a: 'b', c: 'd' } - },{ - cs: 'a= b', - expected: { a: 'b' } - },{ - cs: 'a=' - expected: { a: '' } - }, { - cs: 'key', - expected: null - }, { - cs: 'key=%26%20' - expected: { key: '& ' } - }, { - cs: 'a=\'\'' - expected: { a: '\'\'' } - }] - announce 'testParseCookieString' - for test in TESTS - actual = Parse.cookie test.cs - if JSON.stringify(actual) == JSON.stringify(test.expected) - pass test.cs - else - fail test.cs, test.expected, actual - -testParseQueryString = -> - TESTS = [{ - qs: '' - expected: {} - },{ - qs: 'a=b' - expected: { a: 'b' } - },{ - qs: 'a=b=c' - expected: { a: 'b=c' } - },{ - qs: 'a=b&c=d' - expected: { a: 'b', c: 'd' } - },{ - qs: 'client=&relay=1.2.3.4%3A9001' - expected: { client: '', relay: '1.2.3.4:9001' } - },{ - qs: 'a=b%26c=d' - expected: { a: 'b&c=d' } - },{ - qs: 'a%3db=d' - expected: { 'a=b': 'd' } - },{ - qs: 'a=b+c%20d' - expected: { 'a': 'b c d' } - },{ - qs: 'a=b+c%2bd' - expected: { 'a': 'b c+d' } - },{ - qs: 'a+b=c' - expected: { 'a b': 'c' } - },{ - qs: 'a=b+c+d' - expected: { a: 'b c d' } - # First appearance wins. - },{ - qs: 'a=b&c=d&a=e' - expected: { a: 'b', c: 'd' } - },{ - qs: 'a' - expected: { a: '' } - },{ - qs: '=b', - expected: { '': 'b' } - },{ - qs: '&a=b' - expected: { '': '', a: 'b' } - },{ - qs: 'a=b&' - expected: { a: 'b', '':'' } - },{ - qs: 'a=b&&c=d' - expected: { a: 'b', '':'', c: 'd' } - }] - announce 'testParseQueryString' - for test in TESTS - actual = Query.parse test.qs - if JSON.stringify(actual) == JSON.stringify(test.expected) - pass test.qs - else - fail test.qs, test.expected, actual - -testGetParamBoolean = -> - TESTS = [{ - qs: 'param=true' - expected: true - },{ - qs: 'param', - expected: true - },{ - qs: 'param=' - expected: true - },{ - qs: 'param=1' - expected: true - },{ - qs: 'param=0' - expected: false - },{ - qs: 'param=false' - expected: false - },{ - qs: 'param=unexpected' - expected: null - },{ - qs: 'pram=true' - expected: false - }] - announce 'testGetParamBoolean' - for test in TESTS - query = Query.parse test.qs - actual = Params.getBool(query, 'param', false) - if actual == test.expected - pass test.qs - else - fail test.qs, test.expected, actual - -testParseAddress = -> - TESTS = [{ - spec: '' - expected: null - },{ - spec: '3.3.3.3:4444' - expected: { host: '3.3.3.3', port: 4444 } - },{ - spec: '3.3.3.3' - expected: null - },{ - spec: '3.3.3.3:0x1111' - expected: null - },{ - spec: '3.3.3.3:-4444' - expected: null - },{ - spec: '3.3.3.3:65536' - expected: null - },{ - spec: '[1:2::a:f]:4444' - expected: { host: '1:2::a:f', port: 4444 } - },{ - spec: '[1:2::a:f]' - expected: null - },{ - spec: '[1:2::a:f]:0x1111' - expected: null - },{ - spec: '[1:2::a:f]:-4444' - expected: null - },{ - spec: '[1:2::a:f]:65536' - expected: null - },{ - spec: '[1:2::ffff:1.2.3.4]:4444' - expected: { host: '1:2::ffff:1.2.3.4', port: 4444 } - }] - announce 'testParseAddrSpec' - for test in TESTS - actual = Parse.address test.spec - if JSON.stringify(actual) == JSON.stringify(test.expected) - pass test.spec - else - fail test.spec, test.expected, actual - -testGetParamAddress = -> - DEFAULT = { host: '1.1.1.1', port: 2222 } - TESTS = [{ - query: {} - expected: DEFAULT - },{ - query: { addr: '3.3.3.3:4444' }, - expected: { host: '3.3.3.3', port: 4444 } - },{ - query: { x: '3.3.3.3:4444' } - expected: DEFAULT - },{ - query: { addr: '---' } - expected: null - }] - - announce 'testGetParamAddress' - for test in TESTS - actual = Params.getAddress test.query, 'addr', DEFAULT - if JSON.stringify(actual) == JSON.stringify(test.expected) - pass test.query - else - fail test.query, test.expected, actual - -testProxyPair = -> - announce 'testProxyPair' - fakeRelay = Parse.address '0.0.0.0:12345' - rateLimit = new DummyRateLimit() - destination = [] - fakeClient = - send: (d) -> destination.push d - pp = new ProxyPair(fakeClient, fakeRelay, rateLimit) - pp.connectRelay() - if null != pp.relay.onopen then pass 'relay.onopen' - else fail 'relay onopen must not be null.' - if null != pp.relay.onclose then pass 'relay.onclose' - else fail 'relay onclose must not be null.' - if null != pp.relay.onerror then pass 'relay.onerror' - else fail 'relay onerror must not be null.' - if null != pp.relay.onmessage then pass 'relay.onmessage' - else fail 'relay onmessage must not be null.' - # TODO: Test for flush - # pp.c2rSchedule.push { data: 'omg' } - # pp.flush() - # if destination == ['omg'] then pass 'flush' - # else fail 'flush', ['omg'], destination - -testBuildUrl() -testParseCookieString() -testParseQueryString() -testGetParamBoolean() -testParseAddress() -testGetParamAddress() -testProxyPair() diff --git a/proxy/spec.coffee b/proxy/spec.coffee new file mode 100644 index 0000000..3d8ae61 --- /dev/null +++ b/proxy/spec.coffee @@ -0,0 +1,180 @@ +### +jasmine tests for Snowflake +### + +# Stubs to fake browser functionality. +class WebSocket + OPEN: 1 + CLOSED: 0 +ui = {} + +describe 'BuildUrl', -> + it 'should parse just protocol and host', -> + expect(buildUrl('http', 'example.com')).toBe 'http://example.com' + it 'should handle different ports', -> + expect buildUrl 'http', 'example.com', 80 + .toBe 'http://example.com' + expect buildUrl 'http', 'example.com', 81 + .toBe 'http://example.com:81' + expect buildUrl 'http', 'example.com', 443 + .toBe 'http://example.com:443' + expect buildUrl 'http', 'example.com', 444 + .toBe 'http://example.com:444' + it 'should handle paths', -> + expect buildUrl 'http', 'example.com', 80, '/' + .toBe 'http://example.com/' + expect buildUrl 'http', 'example.com', 80,'/test?k=%#v' + .toBe 'http://example.com/test%3Fk%3D%25%23v' + expect buildUrl 'http', 'example.com', 80, '/test' + .toBe 'http://example.com/test' + it 'should handle params', -> + expect buildUrl 'http', 'example.com', 80, '/test', [['k', '%#v']] + .toBe 'http://example.com/test?k=%25%23v' + expect buildUrl 'http', 'example.com', 80, '/test', [['a', 'b'], ['c', 'd']] + .toBe 'http://example.com/test?a=b&c=d' + it 'should handle ips', -> + expect buildUrl 'http', '1.2.3.4' + .toBe 'http://1.2.3.4' + expect buildUrl 'http', '1:2::3:4' + .toBe 'http://[1:2::3:4]' + it 'should handle bogus', -> + expect buildUrl 'http', 'bog][us' + .toBe 'http://bog%5D%5Bus' + expect buildUrl 'http', 'bog:u]s' + .toBe 'http://bog%3Au%5Ds' + +describe 'Parse', -> + + describe 'cookie', -> + it 'parses correctly', -> + expect Parse.cookie '' + .toEqual {} + expect Parse.cookie 'a=b' + .toEqual { a: 'b' } + expect Parse.cookie 'a=b=c' + .toEqual { a: 'b=c' } + expect Parse.cookie 'a=b; c=d' + .toEqual { a: 'b', c: 'd' } + expect Parse.cookie 'a=b ; c=d' + .toEqual { a: 'b', c: 'd' } + expect Parse.cookie 'a= b' + .toEqual { a: 'b' } + expect Parse.cookie 'a=' + .toEqual { a: '' } + expect Parse.cookie 'key' + .toBeNull() + expect Parse.cookie 'key=%26%20' + .toEqual { key: '& ' } + expect Parse.cookie 'a=\'\'' + .toEqual { a: '\'\'' } + + describe 'address', -> + it 'parses IPv4', -> + expect Parse.address '' + .toBeNull() + expect Parse.address '3.3.3.3:4444' + .toEqual { host: '3.3.3.3', port: 4444 } + expect Parse.address '3.3.3.3' + .toBeNull() + expect Parse.address '3.3.3.3:0x1111' + .toBeNull() + expect Parse.address '3.3.3.3:-4444' + .toBeNull() + expect Parse.address '3.3.3.3:65536' + .toBeNull() + it 'parses IPv6', -> + expect Parse.address '[1:2::a:f]:4444' + .toEqual { host: '1:2::a:f', port: 4444 } + expect Parse.address '[1:2::a:f]' + .toBeNull() + expect Parse.address '[1:2::a:f]:0x1111' + .toBeNull() + expect Parse.address '[1:2::a:f]:-4444' + .toBeNull() + expect Parse.address '[1:2::a:f]:65536' + .toBeNull() + expect Parse.address '[1:2::ffff:1.2.3.4]:4444' + .toEqual { host: '1:2::ffff:1.2.3.4', port: 4444 } + +describe 'query string', -> + it 'should parse correctly', -> + expect Query.parse '' + .toEqual {} + expect Query.parse 'a=b' + .toEqual { a: 'b' } + expect Query.parse 'a=b=c' + .toEqual { a: 'b=c' } + expect Query.parse 'a=b&c=d' + .toEqual { a: 'b', c: 'd' } + expect Query.parse 'client=&relay=1.2.3.4%3A9001' + .toEqual { client: '', relay: '1.2.3.4:9001' } + expect Query.parse 'a=b%26c=d' + .toEqual { a: 'b&c=d' } + expect Query.parse 'a%3db=d' + .toEqual { 'a=b': 'd' } + expect Query.parse 'a=b+c%20d' + .toEqual { 'a': 'b c d' } + expect Query.parse 'a=b+c%2bd' + .toEqual { 'a': 'b c+d' } + expect Query.parse 'a+b=c' + .toEqual { 'a b': 'c' } + expect Query.parse 'a=b+c+d' + .toEqual { a: 'b c d' } + it 'uses the first appearance of duplicate key', -> + expect Query.parse 'a=b&c=d&a=e' + .toEqual { a: 'b', c: 'd' } + expect Query.parse 'a' + .toEqual { a: '' } + expect Query.parse '=b' + .toEqual { '': 'b' } + expect Query.parse '&a=b' + .toEqual { '': '', a: 'b' } + expect Query.parse 'a=b&' + .toEqual { a: 'b', '':'' } + expect Query.parse 'a=b&&c=d' + .toEqual { a: 'b', '':'', c: 'd' } + +describe 'Params', -> + describe 'bool', -> + getBool = (query) -> + Params.getBool (Query.parse query), 'param', false + it 'parses correctly', -> + expect(getBool 'param=true').toEqual true + expect(getBool 'param').toEqual true + expect(getBool 'param=').toEqual true + expect(getBool 'param=1').toEqual true + expect(getBool 'param=0').toEqual false + expect(getBool 'param=false').toEqual false + expect(getBool 'param=unexpected').toBeNull() + expect(getBool 'pram=true').toEqual false + + describe 'address', -> + DEFAULT = { host: '1.1.1.1', port: 2222 } + getAddress = (query) -> + Params.getAddress query, 'addr', DEFAULT + it 'parses correctly', -> + expect(getAddress {}).toEqual DEFAULT + expect getAddress { addr: '3.3.3.3:4444' } + .toEqual { host: '3.3.3.3', port: 4444 } + expect getAddress { x: '3.3.3.3:4444' } + .toEqual DEFAULT + expect getAddress { addr: '---' } + .toBeNull() + +describe 'ProxyPair', -> + fakeRelay = Parse.address '0.0.0.0:12345' + rateLimit = new DummyRateLimit() + destination = [] + fakeClient = send: (d) -> destination.push d + pp = new ProxyPair(fakeClient, fakeRelay, rateLimit) + it 'handles relay correctly', -> + pp.connectRelay() + expect(pp.relay.onopen).not.toBeNull() + expect(pp.relay.onclose).not.toBeNull() + expect(pp.relay.onerror).not.toBeNull() + expect(pp.relay.onmessage).not.toBeNull() + # TODO: Test for flush + # pp.c2rSchedule.push { data: 'omg' } + # pp.flush() + # if destination == ['omg'] then pass 'flush' + # else fail 'flush', ['omg'], destination diff --git a/proxy/websocket.coffee b/proxy/websocket.coffee index eca6f2a..03fa0e8 100644 --- a/proxy/websocket.coffee +++ b/proxy/websocket.coffee @@ -57,3 +57,4 @@ makeWebsocket = (addr) -> ws.binaryType = 'arraybuffer' ws +# module.exports.buildUrl = buildUrl

1 0

[stem/master] GETCONF provides an empty string for CommaList and RouterList
by atagar＠torproject.org 06 Feb '16

06 Feb '16

commit fc35ea1a74b6f9a95b6d1c2d21069f837dc725bb Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 6 15:38:41 2016 -0800 GETCONF provides an empty string for CommaList and RouterList Workaround for a tor bug... https://trac.torproject.org/projects/tor/ticket/18263 --- stem/response/getconf.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/stem/response/getconf.py b/stem/response/getconf.py index 03d4e19..9d786fc 100644 --- a/stem/response/getconf.py +++ b/stem/response/getconf.py @@ -48,6 +48,14 @@ class GetConfResponse(stem.response.ControlMessage): else: key, value = (line.pop(), None) + # Tor's CommaList and RouterList have a bug where they map to an empty + # string when undefined rather than None... + # + # https://trac.torproject.org/projects/tor/ticket/18263 + + if value == '': + value = None + if key not in self.entries: self.entries[key] = []

1 0

[stem/master] Don't add 'settings_loaded' to configs
by atagar＠torproject.org 06 Feb '16

06 Feb '16

commit 59172be86b9ba4a22d6a9f7faf02bf51e69b0a2e Author: Damian Johnson <atagar(a)torproject.org> Date: Sat Feb 6 14:28:51 2016 -0800 Don't add 'settings_loaded' to configs Our @uses_settings annotation stored and loaded a 'settings_loaded' value to track if it had already lazy loaded content. This is inappropriate - we shouldn't muck with the content of our user's configs. --- stem/util/conf.py | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/stem/util/conf.py b/stem/util/conf.py index a2763eb..dff5ace 100644 --- a/stem/util/conf.py +++ b/stem/util/conf.py @@ -275,15 +275,15 @@ def uses_settings(handle, path, lazy_load = True): config = get_config(handle) - if not lazy_load and not config.get('settings_loaded', False): + if not lazy_load and not config._settings_loaded: config.load(path) - config.set('settings_loaded', 'true') + config._settings_loaded = True def decorator(func): def wrapped(*args, **kwargs): - if lazy_load and not config.get('settings_loaded', False): + if lazy_load and not config._settings_loaded: config.load(path) - config.set('settings_loaded', 'true') + config._settings_loaded = True if 'config' in inspect.getargspec(func).args: return func(*args, config = config, **kwargs) @@ -460,6 +460,9 @@ class Config(object): # keys that have been requested (used to provide unused config contents) self._requested_keys = set() + # flag to support lazy loading in uses_settings() + self._settings_loaded = False + def load(self, path = None, commenting = True): """ Reads in the contents of the given path, adding its configuration values

1 0

[tor/master] Document port_out argument to tor_addr_from_sockaddr
by nickm＠torproject.org 06 Feb '16

06 Feb '16

commit 2d879bd39febfcce9ce39f13c897951fee7d8784 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Feb 6 15:34:47 2016 -0500 Document port_out argument to tor_addr_from_sockaddr --- src/common/address.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/common/address.c b/src/common/address.c index 86c32ef..70675c0 100644 --- a/src/common/address.c +++ b/src/common/address.c @@ -148,7 +148,9 @@ tor_addr_make_af_unix(tor_addr_t *a) } /** Set the tor_addr_t in a to contain the socket address contained in - * sa. Return 0 on success and -1 on failure. */ + * sa. IF port_out is non-NULL and sa contains a port, + * set *port_out to that port. Return 0 on success and -1 on + * failure. */ int tor_addr_from_sockaddr(tor_addr_t *a, const struct sockaddr *sa, uint16_t *port_out)

1 0

[tor/master] Validate the DH parameters for correctness.
by nickm＠torproject.org 06 Feb '16

06 Feb '16

commit c625ab9f5a36a99f9dff2fa842d2e43d23ad1908 Author: Yawning Angel <yawning(a)schwanenlied.me> Date: Tue Feb 2 22:03:48 2016 +0000 Validate the DH parameters for correctness. We use sensible parameters taken from common sources, and no longer have dynamic DH groups as an option, but it feels prudent to have OpenSSL validate p and g at initialization time. --- changes/bug18221 | 3 ++ src/common/crypto.c | 79 +++++++++++++++++++++++++++++++++++++++++++++++------ 2 files changed, 74 insertions(+), 8 deletions(-) diff --git a/changes/bug18221 b/changes/bug18221 new file mode 100644 index 0000000..afc2404 --- /dev/null +++ b/changes/bug18221 @@ -0,0 +1,3 @@ + o Minor features (crypto): + - Validate the Diffie-Hellman hard coded parameters and ensure that + p is a safe prime, and g is suitable. Closes ticket 18221. diff --git a/src/common/crypto.c b/src/common/crypto.c index a42c461..431ff30 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -2084,6 +2084,71 @@ static BIGNUM *dh_param_p_tls = NULL; /** Shared G parameter for our DH key exchanges. */ static BIGNUM *dh_param_g = NULL; +/** Validate a given set of Diffie-Hellman parameters. This is moderately + * computationally expensive (milliseconds), so should only be called when + * the DH parameters change. Returns 0 on success, * -1 on failure. + */ +static int +crypto_validate_dh_params(const BIGNUM *p, const BIGNUM *g) +{ + DH *dh = NULL; + int ret = -1; + + /* Copy into a temporary DH object. */ + if (!(dh = DH_new())) + goto out; + if (!(dh->p = BN_dup(p))) + goto out; + if (!(dh->g = BN_dup(g))) + goto out; + + /* Perform the validation. */ + int codes = 0; + if (!DH_check(dh, &codes)) + goto out; + if (BN_is_word(dh->g, DH_GENERATOR_2)) { + /* Per https://wiki.openssl.org/index.php/Diffie-Hellman_parameters + * + * OpenSSL checks the prime is congruent to 11 when g = 2; while the + * IETF's primes are congruent to 23 when g = 2. + */ + BN_ULONG residue = BN_mod_word(dh->p, 24); + if (residue == 11 || residue == 23) + codes &= ~DH_NOT_SUITABLE_GENERATOR; + } + if (codes != 0) /* Specifics on why the params suck is irrelevant. */ + goto out; + + /* Things are probably not evil. */ + ret = 0; + + out: + if (dh) + DH_free(dh); + return ret; +} + +/** Set the global Diffie-Hellman generator, used for both TLS and internal + * DH stuff. + */ +static void +crypto_set_dh_generator(void) +{ + BIGNUM *generator; + int r; + + if (dh_param_g) + return; + + generator = BN_new(); + tor_assert(generator); + + r = BN_set_word(generator, DH_GENERATOR); + tor_assert(r); + + dh_param_g = generator; +} + /** Set the global TLS Diffie-Hellman modulus. Use the Apache mod_ssl DH * modulus. */ void @@ -2116,6 +2181,8 @@ crypto_set_tls_dh_prime(void) tor_assert(tls_prime); dh_param_p_tls = tls_prime; + crypto_set_dh_generator(); + tor_assert(0 == crypto_validate_dh_params(dh_param_p_tls, dh_param_g)); } /** Initialize dh_param_p and dh_param_g if they are not already @@ -2123,18 +2190,13 @@ crypto_set_tls_dh_prime(void) static void init_dh_param(void) { - BIGNUM *circuit_dh_prime, *generator; + BIGNUM *circuit_dh_prime; int r; if (dh_param_p && dh_param_g) return; circuit_dh_prime = BN_new(); - generator = BN_new(); - tor_assert(circuit_dh_prime && generator); - - /* Set our generator for all DH parameters */ - r = BN_set_word(generator, DH_GENERATOR); - tor_assert(r); + tor_assert(circuit_dh_prime); /* This is from rfc2409, section 6.2. It's a safe prime, and supposedly it equals: @@ -2150,7 +2212,8 @@ init_dh_param(void) /* Set the new values as the global DH parameters. */ dh_param_p = circuit_dh_prime; - dh_param_g = generator; + crypto_set_dh_generator(); + tor_assert(0 == crypto_validate_dh_params(dh_param_p, dh_param_g)); if (!dh_param_p_tls) { crypto_set_tls_dh_prime();

1 0

[tor/master] Merge remote-tracking branch 'yawning/bug18221'
by nickm＠torproject.org 06 Feb '16

06 Feb '16

commit 0f5f6b8a412615026603954b1760006723026da1 Merge: b645e2f c625ab9 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Feb 6 15:30:22 2016 -0500 Merge remote-tracking branch 'yawning/bug18221' changes/bug18221 | 3 ++ src/common/crypto.c | 79 +++++++++++++++++++++++++++++++++++++++++++++++------ 2 files changed, 74 insertions(+), 8 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'alec/dead_code_removal'
by nickm＠torproject.org 06 Feb '16

06 Feb '16

commit b645e2f2b0113b143078a4fb6c227280b17fcb00 Merge: 928380e 6852868 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Feb 6 15:08:49 2016 -0500 Merge remote-tracking branch 'alec/dead_code_removal' src/or/main.c | 38 -------------------------------------- 1 file changed, 38 deletions(-)

1 0

[tor/master] Removed dead code in main.c
by nickm＠torproject.org 06 Feb '16

06 Feb '16

commit 6852868b4a1769d960dd95672716f39350ba5043 Author: Alec Heifetz <aheifetz(a)mit.edu> Date: Sat Feb 6 14:41:31 2016 -0500 Removed dead code in main.c --- src/or/main.c | 38 -------------------------------------- 1 file changed, 38 deletions(-) diff --git a/src/or/main.c b/src/or/main.c index bd4f7ea..e406070 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -191,32 +191,6 @@ int quiet_level = 0; * ****************************************************************************/ -#if 0 && defined(USE_BUFFEREVENTS) -static void -free_old_inbuf(connection_t *conn) -{ - if (! conn->inbuf) - return; - - tor_assert(conn->outbuf); - tor_assert(buf_datalen(conn->inbuf) == 0); - tor_assert(buf_datalen(conn->outbuf) == 0); - buf_free(conn->inbuf); - buf_free(conn->outbuf); - conn->inbuf = conn->outbuf = NULL; - - if (conn->read_event) { - event_del(conn->read_event); - tor_event_free(conn->read_event); - } - if (conn->write_event) { - event_del(conn->read_event); - tor_event_free(conn->write_event); - } - conn->read_event = conn->write_event = NULL; -} -#endif - #if defined(_WIN32) && defined(USE_BUFFEREVENTS) /** Remove the kernel-space send and receive buffers for s. For use * with IOCP only. */ @@ -946,18 +920,6 @@ conn_close_if_marked(int i) * would make much more sense to react in * connection_handle_read_impl, or to just stop reading in * mark_and_flush */ -#if 0 -#define MARKED_READING_RATE 180 - static ratelim_t marked_read_lim = RATELIM_INIT(MARKED_READING_RATE); - char *m; - if ((m = rate_limit_log(&marked_read_lim, now))) { - log_warn(LD_BUG, "Marked connection (fd %d, type %s, state %s) " - "is still reading; that shouldn't happen.%s", - (int)conn->s, conn_type_to_string(conn->type), - conn_state_to_string(conn->type, conn->state), m); - tor_free(m); - } -#endif conn->read_blocked_on_bw = 1; connection_stop_reading(conn); }

1 0

[tor/master] Credit the patch
by nickm＠torproject.org 06 Feb '16

06 Feb '16

commit 928380e23176040a1c1c04fc517e0808f028901c Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Feb 6 14:12:48 2016 -0500 Credit the patch --- changes/bug18258 | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/changes/bug18258 b/changes/bug18258 index d82b217..00e1224 100644 --- a/changes/bug18258 +++ b/changes/bug18258 @@ -1,7 +1,8 @@ o Code simplification and refactoring: - Remove specialized code for non-inplace AES_CTR. 99% of our AES is inplace, so there's no need to have a separate implementation - for the non-inplace code. Closes ticket 18258. + for the non-inplace code. Closes ticket 18258. Patch from + Malek. o New requirements: - Tor no longer supports versions of OpenSSL with a broken

1 0

[tor/master] Fix spaces.
by nickm＠torproject.org 06 Feb '16

06 Feb '16

commit 31a27729b9f290f46ad2f323907dc14a9bff006e Author: Nick Mathewson <nickm(a)torproject.org> Date: Sat Feb 6 14:00:24 2016 -0500 Fix spaces. --- src/common/aes.c | 1 + src/common/aes.h | 1 + src/common/crypto.c | 1 + src/test/test_tortls.c | 2 +- 4 files changed, 4 insertions(+), 1 deletion(-) diff --git a/src/common/aes.c b/src/common/aes.c index 44b9921..fd20433 100644 --- a/src/common/aes.c +++ b/src/common/aes.c @@ -380,3 +380,4 @@ aes_set_iv(aes_cnt_cipher_t *cipher, const char *iv) } #endif + diff --git a/src/common/aes.h b/src/common/aes.h index c1e5c53..bd04565 100644 --- a/src/common/aes.h +++ b/src/common/aes.h @@ -23,3 +23,4 @@ int evaluate_evp_for_aes(int force_value); int evaluate_ctr_for_aes(void); #endif + diff --git a/src/common/crypto.c b/src/common/crypto.c index 5714eea..372869d 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -3155,3 +3155,4 @@ crypto_global_cleanup(void) } /** @} */ + diff --git a/src/test/test_tortls.c b/src/test/test_tortls.c index 71b3863..138485c 100644 --- a/src/test/test_tortls.c +++ b/src/test/test_tortls.c @@ -1612,7 +1612,7 @@ test_tortls_block_renegotiation(void *ignored) tt_assert(!(tls->ssl->s3->flags & SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)); #endif - + done: tor_free(tls->ssl->s3); tor_free(tls->ssl);

1 0