- tor-commits - lists.torproject.org

r25895: {} add my EADV presentation, remove the old tech pres we never (in projects/presentations: . images)
by Andrew Lewman 19 Nov '12

19 Nov '12

Author: phobos Date: 2012-11-19 15:55:44 +0000 (Mon, 19 Nov 2012) New Revision: 25895 Added: projects/presentations/2012-11-16-EADV-Tech-Stalking-Advice.odp projects/presentations/2012-11-16-EADV-Tech-Stalking-Advice.pdf projects/presentations/images/2012-09-27-top-10-country-table.png projects/presentations/images/direct-users-2009-09-27-off-300-2012-09-27-all.png projects/presentations/images/grand-mosque-du-paris.jpg projects/presentations/images/grandma-at-computer.jpg projects/presentations/images/networksize-2009-09-27-300-2012-09-27.png projects/presentations/images/porn-star.jpg projects/presentations/images/save-the-corps.jpg projects/presentations/images/stalker-2.jpg Removed: projects/presentations/technical-solutions-to-internet-surveillance.tex Log: add my EADV presentation, remove the old tech pres we never use Added: projects/presentations/2012-11-16-EADV-Tech-Stalking-Advice.odp =================================================================== (Binary files differ) Property changes on: projects/presentations/2012-11-16-EADV-Tech-Stalking-Advice.odp ___________________________________________________________________ Added: svn:mime-type + application/octet-stream Added: projects/presentations/2012-11-16-EADV-Tech-Stalking-Advice.pdf =================================================================== (Binary files differ) Property changes on: projects/presentations/2012-11-16-EADV-Tech-Stalking-Advice.pdf ___________________________________________________________________ Added: svn:mime-type + application/octet-stream Added: projects/presentations/images/2012-09-27-top-10-country-table.png =================================================================== (Binary files differ) Property changes on: projects/presentations/images/2012-09-27-top-10-country-table.png ___________________________________________________________________ Added: svn:mime-type + image/png Added: projects/presentations/images/direct-users-2009-09-27-off-300-2012-09-27-all.png =================================================================== (Binary files differ) Property changes on: projects/presentations/images/direct-users-2009-09-27-off-300-2012-09-27-all.png ___________________________________________________________________ Added: svn:mime-type + image/png Added: projects/presentations/images/grand-mosque-du-paris.jpg =================================================================== (Binary files differ) Property changes on: projects/presentations/images/grand-mosque-du-paris.jpg ___________________________________________________________________ Added: svn:mime-type + image/jpeg Added: projects/presentations/images/grandma-at-computer.jpg =================================================================== (Binary files differ) Property changes on: projects/presentations/images/grandma-at-computer.jpg ___________________________________________________________________ Added: svn:mime-type + image/jpeg Added: projects/presentations/images/networksize-2009-09-27-300-2012-09-27.png =================================================================== (Binary files differ) Property changes on: projects/presentations/images/networksize-2009-09-27-300-2012-09-27.png ___________________________________________________________________ Added: svn:mime-type + image/png Added: projects/presentations/images/porn-star.jpg =================================================================== (Binary files differ) Property changes on: projects/presentations/images/porn-star.jpg ___________________________________________________________________ Added: svn:mime-type + image/jpeg Added: projects/presentations/images/save-the-corps.jpg =================================================================== (Binary files differ) Property changes on: projects/presentations/images/save-the-corps.jpg ___________________________________________________________________ Added: svn:mime-type + image/jpeg Added: projects/presentations/images/stalker-2.jpg =================================================================== (Binary files differ) Property changes on: projects/presentations/images/stalker-2.jpg ___________________________________________________________________ Added: svn:mime-type + image/jpeg Deleted: projects/presentations/technical-solutions-to-internet-surveillance.tex =================================================================== --- projects/presentations/technical-solutions-to-internet-surveillance.tex 2012-11-18 20:54:03 UTC (rev 25894) +++ projects/presentations/technical-solutions-to-internet-surveillance.tex 2012-11-19 15:55:44 UTC (rev 25895) @@ -1,428 +0,0 @@ -\documentclass{beamer} -\mode<presentation> -\usetheme{Pittsburgh} -\usecolortheme{beaver} -\title{Technical Solutions to Internet Surveillance} -\author{Andrew Lewman \\ andrew(a)torproject.org \\ https://torproject.org} -\date{\today} -\begin{document} - -% General flow: -% internet is becoming centralized; good: cheaper to deploy, easier to manage; bad: control points, surveillance points -% govt wants data, see total info awareness (wow, look at that logo or how to freak out your population) (give credit to moxie) -% wiretapping the internet: mention some countries with programs about wiretapping, show nsa-room in AT&T San Fran -% here's a better way to collect vast amounts of data about your population: show facebook logo -% want more than just social interactions? show google logo, look at all of this data, email, instant messaging, topics of interest (search queries, results clicked, ads shown/clicked) -% is absence of signal enough to arouse suspicion? cell phone location data, google services, facebook accounts? -% how do you hide in a crowd without arousing suspicion? show tor headed liberty bell pic, don't be this guy -% - -\begin{frame} - \maketitle - \begin{center} - \includegraphics[height=3cm]{./images/2009-tor-logo} - \hspace{1cm} - \includegraphics[height=3cm]{./images/TIA-logo} - \end{center} -\end{frame} - -\begin{frame} -\frametitle{Internet architecture is becoming centralized} -\includegraphics[width=10cm]{./images/cnmap} -\flushright -\tiny Diagram: China Internet Network Information Center -\end{frame} - -\begin{frame} -\frametitle{Internet surveillance is pervasive} - - \begin{columns}[t] - \column{7cm} -\begin{itemize} -\item Conventional surveillance methods had to be targeted -\item Internet censorship is capable of monitoring everyone, all of the time -\item Governments are increasing monitoring: SORM (Russia), Golden Shield (China), Data Retention Directive (EU), and Interception Modernisation Programme (UK), Warrantless Wiretapping (USA) -\item 1 in 7 East German citizens worked for the Stasi. Today we can achieve the same results with a fraction of the cost -\end{itemize} - - \column{5cm} - \vbox{} - \parbox{5cm}{\includegraphics[width=4.5cm]{./images/nsa-room}} - \end{columns} - -\end{frame} - -\begin{frame} -\frametitle{Traffic data surveillance} - -\begin{itemize} -\item Traffic data (who talks to whom, how often and for how long) is the core of intelligence capabilities -\item This information is cheaper to record and store, compared to full content -\item Because it can be easily processed by computer, data mining techniques can be used to understand social structures -\end{itemize} - -\begin{quotation} -\noindent \includegraphics[width=1cm]{./images/opquo}\quad No government of any colour is to be trusted with such a roadmap to our souls -\end{quotation} -\flushright --- Sir Ken Macdonald, former director of public prosecutions, on the UK Interception Modernisation Program - -\end{frame} - -\begin{frame} - \frametitle{Importantly, information on social networks can be derived} - \begin{columns}[t] - \column{4.5cm} - \vspace{0cm} - - {\color{red}$\bullet$} Communities\newline - {\color{blue}$\bullet$} People - \column{7cm} - \vbox{} - - \includegraphics[clip, trim=5cm 12cm 2cm 5cm,width=7cm]{./images/network} - \end{columns} - \flushright{\tiny From "The Economics of Mass Surveillance" by George Danezis and Bettina Wittneben} - \end{frame} - -\begin{frame} -\frametitle{Search Engine results are censored} -\includegraphics[width=11cm]{./images/tiananmen} -\begin{center} -Searching for "Tiananmen Square" on Google.com and Google.cn -\end{center} -\end{frame} - -\begin{frame} -\frametitle{Sweden's iPRED experience} -\includegraphics[scale=1]{./images/netnodnov} -\end{frame} - -\begin{frame} -\frametitle{Incentives} -\noindent \includegraphics[width=1cm]{./images/opquo}\quad Our analysis shows that consumers increasingly want to decide for themselves when to watch and from which screen. Unfortunately, many have become adept at circumventing the IPRED legislation. -\flushright --- Jens Heron, Mediavision -\end{frame} - -\begin{frame} -\frametitle{Resisting Internet censorship} - -\begin{quotation} -\noindent \includegraphics[width=1cm]{./images/opquo}\quad The Net interprets censorship as damage and routes around it. -\end{quotation} -\flushright --- John Gilmore, 1993 - -\flushleft - -No longer true on a technical level: censorship is in the routers. -\medskip - -Remains true on a social level: when material is censored, people distribute copies and draw attention to them -\medskip - -But what if people are too afraid to do this? -\end{frame} - -\begin{frame} -\frametitle{Twitter in Iran: Good.} -\includegraphics[scale=0.5]{./images/twitter-iran-protests-time} -\flushright{\tiny From http://www.time.com/time/world/article/0,8599,1905125,00.html} -\end{frame} - -\begin{frame} -\frametitle{Twitter in USA: Bad.} -\includegraphics[scale=0.45]{./images/twitter-g20-pittsburgh-gothamist} -\flushright{\tiny from http://gothamist.com/2009/10/05/fbi\_raids\_queens\_home\_in\_g20\_protes.p… -\end{frame} - - \begin{frame} - \frametitle{The Transparent Society} - - \begin{columns}[t] - \column{7cm} -\begin{itemize} -\item David Brin proposed that in a world of pervasive surveillance, balance could be maintained by allowing everyone to monitor everyone else -\item Bruce Schneier retorted that surveillance amplifies existing powers -\item Many countries restrict anonymous speech (e.g.\ Germany and China) -\item It is easy for those in power to call on the weak to link their names to opinions -\end{itemize} - - \column{5cm} - \vbox{} - \parbox{5cm}{\includegraphics[width=4.5cm]{./images/namesheet}} - -\flushright{\tiny Photo: Manos Simonides} - \end{columns} -\end{frame} - -\begin{frame} -\frametitle{Censorship resistance systems} -\begin{itemize} -\item Software to resist censorship should -\begin{itemize} - \item have a diverse set of users - \item work where you are without special steps - \item be sustainable (what if the company goes broke?) - \item be decentralized (swapping censors doesn't help you) - \item protect you by default - \item have accessible standards and published designs (black box vs. glass box) - \item be fast enough that you'll use it daily - \item doesn't promise perfect everything including a fully encrypted Internet -\end{itemize} -\item<1-> These properties should be maintained even if the censorship resistance system is partially compromised -\end{itemize} -\end{frame} - -\begin{frame} -\frametitle{Blocking with technology} -\begin{itemize} -\item When a country's government controls international connectivity, they can block requests for banned websites and destinations -\item There are a number of different approaches (DNS blocking, IP address blocking, etc.) -\item Software may be produced in-country, but often is an adapted commercial product -\item These companies not only make the software, but provide a continuously updated list of websites to be blocked -\end{itemize} -\end{frame} - - \begin{frame} - \frametitle{Normal web browsing} - - \begin{centering} - \vbox{} - - \includegraphics[clip, trim=1cm 4cm 1cm 2.2cm, width=10cm]{./images/no-proxy} - \end{centering} - -\vspace{-1cm} - - \flushright - - \tiny Diagram: Jane Gowan - - \end{frame} - - \begin{frame} - \frametitle{DNS tampering} - - \begin{centering} - \vbox{} - - \includegraphics[clip, trim=1cm 4cm 1cm 2.2cm, width=10cm]{./images/dns} - \end{centering} - -\vspace{-1cm} - - \flushright - - \tiny Diagram: Jane Gowan - - \end{frame} - - \begin{frame} - \frametitle{IP blocking} - - \begin{centering} - \vbox{} - - \includegraphics[clip, trim=1cm 4cm 1cm 2.2cm, width=10cm]{./images/ip} - \end{centering} - -\vspace{-1cm} - - \flushright - - \tiny Diagram: Jane Gowan - - \end{frame} - - \begin{frame} -\frametitle{Trade-offs in blocking systems} -\begin{itemize} -\item<1-> DNS blocking -\begin{itemize} -\item Easy and cheap to implement -\item Blocks at domain name granularity -- over blocks protocols, web pages -\item Trivial to bypass -\end{itemize} -\item<2-> IP blocking -\begin{itemize} -\item Easy and cheap to implement -\item Blocks at IP address (perhaps port) -- over-blocks virtual hosting -\end{itemize} -\item<3-> Proxy blocking -\begin{itemize} -\item Expensive to implement -\item Blocks at webpage level -- low over-blocking -\end{itemize} -\item<4-> Hybrid blocking -- IP based redirection to proxy -\begin{itemize} -\item Tricky to get right, but cheap -\item Has some vulnerabilities -\item Blocks at webpage level -- low over-blocking -\end{itemize} -\end{itemize} -\end{frame} - -\begin{frame} -\frametitle{Who wants online privacy?} -\begin{itemize} -\item<1-> Ordinary people -\begin{itemize} -\item To avoid personal information being sold to marketers -\item Protect themselves when researching sensitive topics -\end{itemize} -\item<2-> Military and Law Enforcement -\begin{itemize} -\item To carry out intelligence gathering -\item Protect undercover field agents -\item Offer anonymous tip lines -\end{itemize} -\item<3-> Journalists -\begin{itemize} -\item To protect sources, such as whistle blowers -\end{itemize} -\item<4-> Human rights workers -\begin{itemize} -\item To publicize abuses and protect themselves from surveillance -\item Blogging about controversial subjects -\end{itemize} -\item<5-> Businesses -\begin{itemize} -\item To observe their competition and build anonymous collaborations -\end{itemize} -\end{itemize} -\end{frame} - -\begin{frame} -\frametitle{Anonymous communication} -\begin{itemize} -\item People have to hide in a crowd of other people ("anonymity loves company") -\item The goal of the system is to make all users look as similar as possible, to give a bigger crowd -\item Hide who is communicating with whom -\item Layered encryption and random delays hide correlation between input traffic and output traffic -\end{itemize} -\end{frame} - -\begin{frame} -\frametitle{Tor is a low-latency anonymity system} -\begin{itemize} -\item<1-> Based on technology developed in the Onion Routing project -\item<2-> Privacy by design, not by policy (no data collected) -\item<3-> Commonly used for web browsing and instant messaging (works for any TCP traffic) -\item<4-> Originally built as a pure anonymity system (hides who is talking to whom) -\item<5-> Now designed to resist censorship too (hides whether someone is using the system at all) -\item<6-> Centralized directory authorities publish a list of all servers; client doesn't trust the network by design -\end{itemize} - -\begin{center} -\includegraphics[height=3cm]{./images/2009-tor-logo} -\end{center} - -\end{frame} - - \begin{frame} - \frametitle{Tor hides communication patterns by relaying data through volunteer servers} - \begin{center} - \begin{overlayarea}{9cm}{6cm} - \only<1>{\includegraphics[width=9cm]{./images/tor-network}} - \only<2>{\includegraphics[width=9cm]{./images/tor-safe-selection}} - \only<3>{\includegraphics[width=9cm]{./images/tor-safe-path}} - \end{overlayarea} - \flushright - - \tiny Diagram: Robert Watson - \end{center} - \end{frame} - -\begin{frame} -\frametitle{Tor hidden services allow censorship resistant services} -\includegraphics[scale=0.5]{./images/wikileaks} -\end{frame} - -\begin{frame} -\frametitle{How is Tor different from other systems?} -\\[1cm] -\begin{center} -\only<1>{\includegraphics[height=7cm]{./images/single_hop_relay}} -\only<2>{\includegraphics[height=7cm]{./images/evil_single_hop_relay}} -\only<3>{\includegraphics[height=7cm]{./images/data_snooping_single_hop_relay}} -\end{center} -\end{frame} - -\begin{frame} -\frametitle{Limitations of censorship resistance} -\begin{itemize} -\item Censorship resistance is thought controversial -- especially by the censors -\item There is something for everyone to like, and something for everyone to dislike, going on with censorship resistance systems -\item Bad people do use them to do bad things (for many different definitions of bad people) -\item It is impossible to block bad uses, even if we could come up with a common definition of bad content -\item The systems are not perfect, so it is possible some people will be caught -\end{itemize} -\end{frame} - -\begin{frame} -\frametitle{Conclusions} - \begin{columns}[t] - \column{7cm} - \begin{itemize} - \item The Internet and centralisation can both improve and harm freedom of speech - \item Slogans regarding the borderless nature and inherent freedoms of the Internet are frequently wrong - \item Technical details matter: how a system is implemented can make a radical difference - \item Technologies can be used to resist censorship and improve privacy - \item However, policies must be changed too and pressure is needed on legislators - \end{itemize} - \column{5cm} - \vbox{} - \begin{overlayarea}{5cm}{10cm} - \resizebox{5cm}{!}{\includegraphics{./images/collage}} - \end{overlayarea} - \end{columns} -\end{frame} - -\begin{frame} -\frametitle{One Version of the Future} -\begin{quotation} -\noindent \includegraphics[width=1cm]{./images/opquo}\quad I'd like to change the design of the Internet by introducing -regulation--Internet passports, Internet police and international -agreement--about following Internet standards. And if some countries -don't agree with or don't pay attention to the agreement, just cut -them off. -\end{quotation} -\flushright --- Eugene Kaspersky, Co-Founder \& CEO of Kaspersky Labs -\end{frame} - -\begin{frame} -\frametitle{A better version of the future} -\textbf{Internet Access as a Human Right} -\medskip -\begin{quotation} -\noindent \includegraphics[width=1cm]{./images/opquo}\quad -We think it's something you cannot live without in modern society. Like banking services or water or electricity, you need an Internet connection -\end{quotation} -\flushright --- Laura Vilkkonen, Ministry of Transport and Communications, Finland - -\bigskip -\textbf{Tor Project's Mission} -\medskip -\begin{quotation} -\noinent \includegraphics[width=1cm]{./images/opquo}\quad We remain committed to defending online privacy and anonymity as a human right. -\end{quotation} -\end{frame} - -\begin{frame} -\frametitle{How to get there} -\begin{itemize} -\item Increased funding of research and development for privacy, circumvention, and anti-censorship technologies -\item Policy and Legal frameworks for free access, free speech, and anonymity -%\item Mobile devices and telco innovation -%\item Ambient connectivity -\end{itemize} -\end{frame} - -\begin{frame} -\frametitle{Credits} -\begin{itemize} -\item Thank you to Steven J. Murdoch, \url{http://www.cl.cam.ac.uk/users/sjm217/}, for the research and basis for this presentation. \\ -\item Photographer and Diagram credits as listed throughout the presentation. -\end{itemize} -\end{frame} - -\end{document}

1 0

[torspec/master] Add proposal 215: Let the minimum consensus method change with time
by nickm＠torproject.org 19 Nov '12

19 Nov '12

commit 07ca8670182464f24c587ec68a0dbdeb78dfccc5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 19 09:55:43 2012 -0500 Add proposal 215: Let the minimum consensus method change with time --- proposals/000-index.txt | 2 + proposals/215-update-min-consensus-ver.txt | 94 ++++++++++++++++++++++++++++ 2 files changed, 96 insertions(+), 0 deletions(-) diff --git a/proposals/000-index.txt b/proposals/000-index.txt index 332b64d..caec770 100644 --- a/proposals/000-index.txt +++ b/proposals/000-index.txt @@ -135,6 +135,7 @@ Proposals by number: 212 Increase Acceptable Consensus Age [OPEN] 213 Remove stream-level sendmes from the design [OPEN] 214 Allow 4-byte circuit IDs in a new link protocol [OPEN] +215 Let the minimum consensus method change with time [OPEN] Proposals by status: @@ -186,6 +187,7 @@ Proposals by status: 212 Increase Acceptable Consensus Age [for 0.2.4.x+] 213 Remove stream-level sendmes from the design 214 Allow 4-byte circuit IDs in a new link protocol + 215 Let the minimum consensus method change with time ACCEPTED: 117 IPv6 exits [for 0.2.4.x] 140 Provide diffs between consensuses diff --git a/proposals/215-update-min-consensus-ver.txt b/proposals/215-update-min-consensus-ver.txt new file mode 100644 index 0000000..a38145a --- /dev/null +++ b/proposals/215-update-min-consensus-ver.txt @@ -0,0 +1,94 @@ +Filename: 215-update-min-consensus-ver.txt +Title: Let the minimum consensus method change with time +Author: Nick Mathewson +Created: 15 Nov 2012 +Status: Open + + +0. Overview + + This proposal suggests that we drop the requirement that + authorities support the very old consensus method "1", and instead + move to a wider window of recognized consensus methods as Tor + evolves. + +1. Background and Motivation + + When we designed the directory voting system, we added the notion + of "consensus method" so that we could smoothly upgrade the voting + process over time. We also said that all authorities must support + the consensus method '1', and must fall back to it if they don't + support the method that the supermajority of authorities will + choose. + + Consensus method 1 is no longer viable for the Tor network. It + doesn't result in a microdescriptor consensus, and omits other + fields that clients need in order to work well. Consensus methods + under 12 have security issues, since they let a single authority + set a consensus parameter. + + In the future, new consensus methods will be needed so that + microdescriptor-using clients can use IPv6 exits and ECC + onion-keys. Rolling back from those would degrade functionality. + + We need a way to change the minimum consensus method over time. + +2. Design + + I propose that we change the minimum consensus method about once + per release cycle, or once per ever other release cycle. + + As a rule of thumb, let the minimum consensus method in Tor series + X be the highest method supported by the oldest version that + "anybody reasonable" would use for running an authority. + Typically, that's the stable version of the previous release + series. + + For flexibility, it might make sense to choose a slightly older + method, if falling back to that method wouldn't cause security + problems. + + + For example, while Tor 0.2.4.x is under development, authorities + should really not be running anything before Tor 0.2.3.x. Tor + 0.2.3.x has supported consensus method 13 since 0.2.3.21-rc, so + it's okay for 0.2.4.x to require 13 as the minimum method. We even + might go back to method 12, since the worst outcome of not using 13 + would be some warnings in client logs. Consensus method 12 was a + security improvement, so we don't want to roll back before that. + +2.1. Behavior when the method used is one we don't know + + The spec currently says that if an authority sees that a method + will be used that it doesn't support, it should act as if the + consensus method will be "1". This attempt will be doomed, since + the other authorities will be computing the consensus with a more + recent method, and any attempt to use method "1" won't get enough + signatures. + + Instead, let's say that authorities fall back to the most recent + method that they *do* support. This isn't any likelier to reach + consensus, but it is less likely to result in anybody signing + something they don't like. + + +3. Likely outcomes + + If a bunch of authorities were to downgrade to a much older + version, all at once, then newer authorities would not be able to + sign the consensus they made. That's probably for the best: if a + bunch of authorities were to suddenly start running 0.2.0.x, + consensing along with them would be a poor idea. + +4. Alternatives + + We might choose a less narrow window of allowable method, when we + can do so securely. Maybe two release series, rather than one, + would be a good interval to do when the consensus format isn't + changing rapidly. + + We might want to have the behavior when we see that everybody else + will be using a method we don't support be "Don't make a consensus + at all." That's harder to program, though. + +

1 0

[torspec/master] Adjust description of how p6 line is set in microdescs in prop208
by nickm＠torproject.org 19 Nov '12

19 Nov '12

commit 3fd84c7872f36b168d127880f15f869024c8bb20 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 19 09:53:55 2012 -0500 Adjust description of how p6 line is set in microdescs in prop208 Originally, I'd said "copy it verbatim". But that's ludicrous; instead authorities need to re-generate the part of it that they parsed and understood. --- proposals/208-ipv6-exits-redux.txt | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-) diff --git a/proposals/208-ipv6-exits-redux.txt b/proposals/208-ipv6-exits-redux.txt index 6185d2a..6f83f3c 100644 --- a/proposals/208-ipv6-exits-redux.txt +++ b/proposals/208-ipv6-exits-redux.txt @@ -39,9 +39,8 @@ Target: 0.2.4.x policies, but they should no longer need to tell the whole world about them. - After this ipv6-policy line is validated, it should get copied into a - "p6" line in microdescriptors. - + After this ipv6-policy line is validated, its numeric ports and ranges + should get copied into a "p6" line in microdescriptors. This change breaks the existing exit enclave idea for IPv6, but the exiting exit enclave implementation never worked right in the first

1 0

[tor/master] Merge branch 'bug7493_redux'
by nickm＠torproject.org 18 Nov '12

18 Nov '12

commit ea893a3c30d0e2ed9198258f65ed30e48da69ebe Merge: 06d367e bfe8d82 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 18 18:46:57 2012 -0500 Merge branch 'bug7493_redux' src/or/connection.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-)

1 0

[tor/master] Initialize ipv{4, 6}_traffic_ok in entry_connection_new
by nickm＠torproject.org 18 Nov '12

18 Nov '12

commit bfe8d829c2bcfe24e1bdfe616444f074fe0f549c Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 18 17:15:41 2012 -0500 Initialize ipv{4,6}_traffic_ok in entry_connection_new This one is necessary for sending BEGIN cells with sane flags when self-testing a directory port. All real entry connections were getting their ipv{4,6}_traffic_ok flags set from their listeners, and for begindir entry connections we didn't care, but for directory self-testing, we had a problem. Fixes at least one more case of 7493; if there are more lingering cases of 7493, this might fix them too. Bug not in any released version of Tor. --- src/or/connection.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/src/or/connection.c b/src/or/connection.c index f9d8a6d..dbcfc41 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -281,6 +281,13 @@ entry_connection_new(int type, int socket_family) tor_assert(type == CONN_TYPE_AP); connection_init(time(NULL), ENTRY_TO_CONN(entry_conn), type, socket_family); entry_conn->socks_request = socks_request_new(); + /* If this is coming from a listener, we'll set it up based on the listener + * in a little while. Otherwise, we're doing this as a linked connection + * of some kind, and we should set it up here based on the socket family */ + if (socket_family == AF_INET) + entry_conn->ipv4_traffic_ok = 1; + else if (socket_family == AF_INET6) + entry_conn->ipv6_traffic_ok = 1; return entry_conn; }

1 0

r25894: {website} fold in one of asn's faq answers (website/trunk/projects/en)
by Roger Dingledine 18 Nov '12

18 Nov '12

Author: arma Date: 2012-11-18 20:54:03 +0000 (Sun, 18 Nov 2012) New Revision: 25894 Modified: website/trunk/projects/en/obfsproxy-debian-instructions.wml Log: fold in one of asn's faq answers Modified: website/trunk/projects/en/obfsproxy-debian-instructions.wml =================================================================== --- website/trunk/projects/en/obfsproxy-debian-instructions.wml 2012-11-17 23:44:06 UTC (rev 25893) +++ website/trunk/projects/en/obfsproxy-debian-instructions.wml 2012-11-18 20:54:03 UTC (rev 25894) @@ -123,7 +123,9 @@ The last number, in this case <i>26821</i>, is the TCP port number that you need to forward through your firewall. (This port is randomly chosen the first time Tor starts, but Tor will cache and reuse the - same number in future runs.) + same number in future runs.) If you want to change the number, + stop Tor, edit /var/lib/tor/state to change the number in the + "TransportProxy obfs2" line, and then restart Tor. </p> </div>

1 0

[translation/liveusb-creator] Update translations for liveusb-creator
by translation＠torproject.org 18 Nov '12

18 Nov '12

commit cfb6079022077c3432a79a609ba31bfb2d057cef Author: Translation commit bot <translation(a)torproject.org> Date: Sun Nov 18 18:46:06 2012 +0000 Update translations for liveusb-creator --- ar/ar.po | 28 ++++++++++++++-------------- 1 files changed, 14 insertions(+), 14 deletions(-) diff --git a/ar/ar.po b/ar/ar.po index ab85e5f..981b8fc 100644 --- a/ar/ar.po +++ b/ar/ar.po @@ -10,7 +10,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2012-04-13 14:16+0200\n" -"PO-Revision-Date: 2012-11-07 18:59+0000\n" +"PO-Revision-Date: 2012-11-18 18:31+0000\n" "Last-Translator: Fadi Mansour <fadi.redeemer.mansour(a)gmail.com>\n" "Language-Team: LANGUAGE <LL(a)li.org>\n" "MIME-Version: 1.0\n" @@ -102,19 +102,19 @@ msgstr "" #: ../liveusb/gui.py:638 msgid "Unable to mount device" -msgstr "" +msgstr "لا يمكن تركيب الجهاز" #: ../liveusb/gui.py:644 msgid "Warning: All data on the selected drive will be lost." -msgstr "" +msgstr "تحذير: كل البيانات على الجهاز المُختار ستضيع." #: ../liveusb/gui.py:646 ../liveusb/gui.py:663 msgid "Press 'Next' if you wish to continue." -msgstr "" +msgstr "اضغط \"التالي\" إن كنت تريد الاستمرار." #: ../liveusb/gui.py:648 ../liveusb/gui.py:665 msgid "Next" -msgstr "" +msgstr "التالي" #: ../liveusb/gui.py:658 msgid "" @@ -147,39 +147,39 @@ msgstr "اختر الصورة ذاتية التشغيل (ISO)" msgid "" "The selected file is unreadable.Please fix its permissions or select another" " file." -msgstr "" +msgstr "الملف المحدد غير قابل للقراءة. الرجاء تغيير صلاحياته أو اختيار ملف آخر." #: ../liveusb/gui.py:737 msgid "" "Unable to use the selected file. You may have better luck if you move your " "ISO to the root of your drive (ie: C:\\)" -msgstr "" +msgstr "لا يمكن استخدام الملف المُحدد. قد يحالفك حظ أكثر إن نقل ملف الـISO إلى المجلد الرئيسي لقرصك (قC:\\ على سبيل المثال)" #: ../liveusb/gui.py:743 #, python-format msgid "%(filename)s selected" -msgstr "" +msgstr "تم تحديد %(filename)s" #: ../liveusb/creator.py:91 msgid "You must run this application as root" -msgstr "" +msgstr "عليك تنفيذ هذا التطبيق كمدير" #: ../liveusb/creator.py:130 msgid "" "Source type does not support verification of ISO MD5 checksum, skipping" -msgstr "" +msgstr "نوع المصدر لا يدعم التحقق من مجموع التأكد MD5 للـISO، سيتم التجاوز" #: ../liveusb/creator.py:132 msgid "Verifying ISO MD5 checksum" -msgstr "" +msgstr "يتم التحقق من مجموع التأكد MD5 للـISO" #: ../liveusb/creator.py:137 msgid "ISO MD5 checksum verification failed" -msgstr "" +msgstr "فشل التحقق من مجموع التأكد MD5 للـISO" #: ../liveusb/creator.py:139 msgid "ISO MD5 checksum passed" -msgstr "" +msgstr "نجح التحقق من مجموع التأكد MD5 للـISO" #: ../liveusb/creator.py:144 msgid "Extracting live image to USB device..." @@ -188,7 +188,7 @@ msgstr "جاري استخراج الصورة الحية إلى جهاز USB..." #: ../liveusb/creator.py:151 #, python-format msgid "Wrote to device at %(speed)d MB/sec" -msgstr "" +msgstr "تمت الكتابة للجهاز بسرعة %(speed)d ميغابايت بالثانية" #: ../liveusb/creator.py:181 msgid "Setting up OLPC boot file..."

1 0

[ooni-probe/master] Refactor HTTP Test Template
by art＠torproject.org 18 Nov '12

18 Nov '12

commit d4ee153fc0c08627b3c4d36e1b614a14e15a9fa1 Author: Arturo Filastò <art(a)fuffa.org> Date: Sun Nov 18 18:36:43 2012 +0100 Refactor HTTP Test Template --- nettests/core/http_host.py | 3 +- ooni/templates/httpt.py | 54 ++++++++++++++++++++----------------------- 2 files changed, 27 insertions(+), 30 deletions(-) diff --git a/nettests/core/http_host.py b/nettests/core/http_host.py index 252561b..3912dfc 100644 --- a/nettests/core/http_host.py +++ b/nettests/core/http_host.py @@ -49,7 +49,8 @@ class HTTPHost(httpt.HTTPTest): """ headers = {} headers["Host"] = [self.input] - return self.doRequest(self.localOptions['backend'], headers=headers) + return self.doRequest(self.localOptions['backend'], + headers=headers) def check_for_censorship(self, body): """ diff --git a/ooni/templates/httpt.py b/ooni/templates/httpt.py index 3a4201c..c2db6f5 100644 --- a/ooni/templates/httpt.py +++ b/ooni/templates/httpt.py @@ -44,6 +44,8 @@ class HTTPTest(NetTestCase): randomizeUA = True followRedirects = False + request = {} + response = {} def _setUp(self): log.debug("Setting up HTTPTest") @@ -67,8 +69,6 @@ class HTTPTest(NetTestCase): "This may make the testing less precise.") self.report['errors'].append("Could not import RedirectAgent") - self.request = {} - self.response = {} self.processInputs() log.debug("Finished test setup") @@ -111,7 +111,7 @@ class HTTPTest(NetTestCase): pass def doRequest(self, url, method="GET", - headers=None, body=None, headers_processor=None, + headers={}, body=None, headers_processor=None, body_processor=None): """ Perform an HTTP request with the specified method. @@ -136,36 +136,17 @@ class HTTPTest(NetTestCase): """ log.debug("Performing request %s %s %s" % (url, method, headers)) - d = self.build_request(url, method, headers, body) - - def errback(failure): - failure.trap(ConnectionRefusedError, SOCKSError) - if type(failure.value) is ConnectionRefusedError: - log.err("Connection refused. The backend may be down") - else: - log.err("Sock error. The SOCK proxy may be down") - self.report["failure"] = str(failure.value) - - def finished(data): - return - - d.addErrback(errback) - d.addCallback(self._cbResponse, headers_processor, body_processor) - d.addCallback(finished) - return d - - def build_request(self, url, method="GET", - headers=None, body=None): self.request['method'] = method self.request['url'] = url - self.request['headers'] = headers if headers else {} + self.request['headers'] = headers self.request['body'] = body if self.randomizeUA: + log.debug("Randomizing user agent") self.randomize_useragent() + log.debug("Writing to report the request") self.report['request'] = self.request - self.report['url'] = url # If we have a request body payload, set the request body to such # content @@ -176,9 +157,25 @@ class HTTPTest(NetTestCase): headers = Headers(self.request['headers']) - req = self.agent.request(self.request['method'], self.request['url'], - headers, body_producer) - return req + d = self.agent.request(self.request['method'], + self.request['url'], headers, body_producer) + + def errback(failure): + print failure.value + failure.trap(ConnectionRefusedError, SOCKSError) + if type(failure.value) is ConnectionRefusedError: + log.err("Connection refused. The backend may be down") + else: + log.err("Sock error. The SOCK proxy may be down") + self.report["failure"] = str(failure.value) + + def finished(data): + return + + d.addErrback(errback) + d.addCallback(self._cbResponse, headers_processor, body_processor) + d.addCallback(finished) + return d def _cbResponse(self, response, headers_processor, body_processor): log.debug("Got response %s" % response) @@ -211,4 +208,3 @@ class HTTPTest(NetTestCase): user_agent = random.choice(userAgents) self.request['headers']['User-Agent'] = [user_agent] -

1 0

[ooni-probe/master] Refactor exception logging function
by art＠torproject.org 18 Nov '12

18 Nov '12

commit 434cae18828435644150ac475012a1f7689936f0 Author: Arturo Filastò <art(a)fuffa.org> Date: Sun Nov 18 18:37:58 2012 +0100 Refactor exception logging function * Print out the stack trace when the exception is of twisted.python.failure.Failure type. --- ooni/runner.py | 4 ++-- ooni/utils/log.py | 18 +++++++++++------- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/ooni/runner.py b/ooni/runner.py index f7fa5dc..40aa40c 100644 --- a/ooni/runner.py +++ b/ooni/runner.py @@ -158,8 +158,8 @@ def runTestWithInput(test_class, test_method, test_input, oreporter): log.debug("runTestWithInput: concluded %s" % test_name) return oreporter.testDone(test_instance, test_name) - def test_error(error, test_instance, test_name): - log.exception(error) + def test_error(failure, test_instance, test_name): + log.exception(failure) test_instance = test_class() test_instance.input = test_input diff --git a/ooni/utils/log.py b/ooni/utils/log.py index 6f4622d..d9b57bb 100644 --- a/ooni/utils/log.py +++ b/ooni/utils/log.py @@ -9,6 +9,7 @@ import traceback import logging from twisted.python import log as txlog +from twisted.python.failure import Failure from twisted.python.logfile import DailyLogFile from ooni.utils import otime @@ -51,13 +52,16 @@ def debug(msg, *arg, **kw): def err(msg, *arg, **kw): txlog.err("Error: " + str(msg), logLevel=logging.ERROR, *arg, **kw) -def exception(msg): - txlog.err(msg) - exc_type, exc_value, exc_traceback = sys.exc_info() - traceback.print_exception(exc_type, exc_value, exc_traceback) - -def exception(*msg): - logging.exception(msg) +def exception(error): + """ + Error can either be an error message to print to stdout and to the logfile + or it can be a twisted.python.failure.Failure instance. + """ + if isinstance(error, Failure): + error.printTraceback() + else: + exc_type, exc_value, exc_traceback = sys.exc_info() + traceback.print_exception(exc_type, exc_value, exc_traceback) class LoggerFactory(object): """

1 0

[ooni-probe/master] Use print instead of log in oonib bootstrapping process
by art＠torproject.org 18 Nov '12

18 Nov '12

commit 7175385fca0f2a4274eea537b3510974c9803997 Author: Arturo Filastò <art(a)fuffa.org> Date: Sun Nov 18 18:39:08 2012 +0100 Use print instead of log in oonib bootstrapping process * This is required because the logger is not running yet --- oonib/oonibackend.py | 13 +++++++------ 1 files changed, 7 insertions(+), 6 deletions(-) diff --git a/oonib/oonibackend.py b/oonib/oonibackend.py index 937f223..dd25c8c 100644 --- a/oonib/oonibackend.py +++ b/oonib/oonibackend.py @@ -31,7 +31,7 @@ application = service.Application('oonibackend') serviceCollection = service.IServiceCollection(application) if config.helpers.ssl.port: - log.msg("Starting SSL helper") + print "Starting SSL helper on %s" % config.helpers.ssl.port ssl_helper = internet.SSLServer(int(config.helpers.ssl.port), server.Site(HTTPBackend()), SSLContext(config)) @@ -39,13 +39,13 @@ if config.helpers.ssl.port: # Start the DNS Server related services if config.helpers.dns.tcp_port: - log.msg("Starting TCP DNS Helper on %s" % config.helpers.dns.tcp_port) + print "Starting TCP DNS Helper on %s" % config.helpers.dns.tcp_port tcp_dns_helper = internet.TCPServer(int(config.helpers.dns.tcp_port), dns_helpers.DNSTestHelper()) tcp_dns_helper.setServiceParent(serviceCollection) if config.helpers.dns.udp_port: - log.msg("Starting UDP DNS Helper on %s" % config.helpers.dns.udp_port) + print "Starting UDP DNS Helper on %s" % config.helpers.dns.udp_port udp_dns_factory = dns.DNSDatagramProtocol(dns_helpers.DNSTestHelper()) udp_dns_helper = internet.UDPServer(int(config.helpers.dns.udp_port), udp_dns_factory) @@ -54,24 +54,25 @@ if config.helpers.dns.udp_port: # XXX this needs to be ported # Start the OONI daphn3 backend if config.helpers.daphn3.port: + print "Starting Daphn3 helper on %s" % config.helpers.daphn3.port daphn3_helper = internet.TCPServer(int(config.helpers.daphn3.port), tcp_helpers.Daphn3Server()) daphn3_helper.setServiceParent(serviceCollection) if config.main.collector_port: - log.msg("Starting Collector on %s" % config.main.collector_port) + print "Starting Collector on %s" % config.main.collector_port collector = internet.TCPServer(int(config.main.collector_port), reportingBackend) collector.setServiceParent(serviceCollection) if config.helpers.tcp_echo.port: - log.msg("Starting TCP echo helper on %s" % config.helpers.tcp_echo.port) + print "Starting TCP echo helper on %s" % config.helpers.tcp_echo.port tcp_echo_helper = internet.TCPServer(int(config.helpers.tcp_echo.port), tcp_helpers.TCPEchoHelper()) tcp_echo_helper.setServiceParent(serviceCollection) if config.helpers.http_return_request.port: - log.msg("Starting HTTP return request helper on %s" % config.helpers.http_return_request.port) + print "Starting HTTP return request helper on %s" % config.helpers.http_return_request.port http_return_request_helper = internet.TCPServer( int(config.helpers.http_return_request.port), http_helpers.HTTPReturnJSONHeadersHelper)

1 0