- tor-commits - lists.torproject.org

[ooni-probe/master] Set high timeout for job completions
by art＠torproject.org 07 Feb '12

07 Feb '12

commit 6ed48824be116f3616d5973474b78dc6421aeec7 Author: Arturo Filastò <hellais(a)gmail.com> Date: Tue Feb 7 23:05:28 2012 +0100 Set high timeout for job completions --- refactor/plugoo.py | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/refactor/plugoo.py b/refactor/plugoo.py index 0a41a2c..1540034 100644 --- a/refactor/plugoo.py +++ b/refactor/plugoo.py @@ -281,7 +281,7 @@ class Plugoo(): print ret self.report(ret) - def run(self, assets=None, buffer=10, timeout=30): + def run(self, assets=None, buffer=10, timeout=100000): self.logger.info("Starting %s", self.name) jobs = [] if assets:

1 0

[ooni-probe/master] Parametrize timeout in bridge testing
by art＠torproject.org 07 Feb '12

07 Feb '12

commit 82f969df3d46f1dfd8382e5b77f227c25f463845 Author: Arturo Filastò <hellais(a)gmail.com> Date: Tue Feb 7 23:03:40 2012 +0100 Parametrize timeout in bridge testing --- refactor/ooni-probe.conf | 1 + refactor/tests/bridget.py | 2 ++ 2 files changed, 3 insertions(+), 0 deletions(-) diff --git a/refactor/ooni-probe.conf b/refactor/ooni-probe.conf index 75302f8..2e22961 100644 --- a/refactor/ooni-probe.conf +++ b/refactor/ooni-probe.conf @@ -51,6 +51,7 @@ keyword_method = http,telnet ### Tor bridge testing tor_bridges = bridgetests.txt +tor_bridges_timeout = 40 [report] file = report.log diff --git a/refactor/tests/bridget.py b/refactor/tests/bridget.py index 71d210a..83ff72f 100644 --- a/refactor/tests/bridget.py +++ b/refactor/tests/bridget.py @@ -54,6 +54,8 @@ DataDirectory %s def connect(self, bridge, timeout=None): if not timeout: + if self.config.tests.tor_bridges_timeout: + self.timeout = self.config.tests.tor_bridges_timeout timeout = self.timeout torrc, tordir = self.writetorrc(bridge) cmd = ["tor", "-f", torrc]

1 0

[ooni-probe/master] Merge branch 'master' of ssh://git-rw.torproject.org/ooni-probe
by art＠torproject.org 07 Feb '12

07 Feb '12

commit 615c95a994f3344e3ddbabf9cf0c7785edc61390 Merge: 82f969d 1662e4f Author: Arturo Filastò <hellais(a)gmail.com> Date: Tue Feb 7 23:04:07 2012 +0100 Merge branch 'master' of ssh://git-rw.torproject.org/ooni-probe .gitignore | 1 - 1 files changed, 0 insertions(+), 1 deletions(-)

1 0

[ooni-probe/master] Update gitignore
by art＠torproject.org 07 Feb '12

07 Feb '12

commit 1662e4f4025227c94912e24040af980154a3564d Author: Arturo Filastò <hellais(a)gmail.com> Date: Tue Feb 7 22:43:49 2012 +0100 Update gitignore --- .gitignore | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/.gitignore b/.gitignore index 5d58673..b1e99aa 100644 --- a/.gitignore +++ b/.gitignore @@ -5,4 +5,3 @@ proxy-lists/ip-cc.txt proxy-lists/ips.txt proxy-lists/italy-dns-ips.txt proxy-lists/italy-http-ips.txt -refactor/assets/*

1 0

[ooni-probe/master] Add assets directory
by art＠torproject.org 07 Feb '12

07 Feb '12

commit f92bfe90bb020e748304f53556d0b692d704113a Author: Arturo Filastò <hellais(a)gmail.com> Date: Tue Feb 7 22:35:20 2012 +0100 Add assets directory --- .gitignore | 1 + refactor/assets/testasset.txt | 8 -------- refactor/assets/testasset2.txt | 8 -------- refactor/plugoo.py | 5 +++-- 4 files changed, 4 insertions(+), 18 deletions(-) diff --git a/.gitignore b/.gitignore index b1e99aa..5d58673 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ proxy-lists/ip-cc.txt proxy-lists/ips.txt proxy-lists/italy-dns-ips.txt proxy-lists/italy-http-ips.txt +refactor/assets/* diff --git a/refactor/assets/testasset.txt b/refactor/assets/testasset.txt deleted file mode 100644 index 274e331..0000000 --- a/refactor/assets/testasset.txt +++ /dev/null @@ -1,8 +0,0 @@ -# This an example ooni-probe asset file. -# The properties of assets are definied with the "#:" syntax -#:name The asset name -#:desc The description of this asset is bla bla bla bla bla -#:tests testa,testb,testc -#:files something.xml,somethingelse.xml -This is the main body of the assets. -bla bla bla \ No newline at end of file diff --git a/refactor/assets/testasset2.txt b/refactor/assets/testasset2.txt deleted file mode 100644 index 71bbabc..0000000 --- a/refactor/assets/testasset2.txt +++ /dev/null @@ -1,8 +0,0 @@ -# This an example ooni-probe asset file. -# The properties of assets are definied with the "#:" syntax -#:name Another asset -#:desc The description of this asset is bla bla1321212 -#:tests testa,testb,testd -#:files something.xml,somethingelse.xml -This is the main body of the assets. -bla bla bla diff --git a/refactor/plugoo.py b/refactor/plugoo.py index 84eef01..0a41a2c 100644 --- a/refactor/plugoo.py +++ b/refactor/plugoo.py @@ -102,8 +102,7 @@ class Report: This should be invoked every time you wish to write some data to the reporting system """ - print "Writing report(s)" - self.logger.info("Writing report(s)") + #print "Writing report(s)" dump = "- " + yaml.dump(data) reports = [] @@ -297,6 +296,7 @@ class Plugoo(): gevent.joinall(jobs, timeout=timeout) for job in jobs: #print "JOB VAL: %s" % job.value + self.logger.info("Writing report(s)") self.report(job.value) job.kill() jobs = [] @@ -305,6 +305,7 @@ class Plugoo(): gevent.joinall(jobs, timeout=timeout) for job in jobs: #print "JOB VAL: %s" % job.value + self.logger.info("Writing report(s)") self.report(job.value) job.kill() jobs = []

1 0

[ooni-probe/master] Make output a bit more pretty
by art＠torproject.org 07 Feb '12

07 Feb '12

commit f2e0c7d3ad1c3aaf10c741655fb3c0b9d1daed43 Author: Arturo Filastò <hellais(a)gmail.com> Date: Tue Feb 7 22:26:37 2012 +0100 Make output a bit more pretty --- refactor/plugoo.py | 9 +++++---- 1 files changed, 5 insertions(+), 4 deletions(-) diff --git a/refactor/plugoo.py b/refactor/plugoo.py index 9162050..84eef01 100644 --- a/refactor/plugoo.py +++ b/refactor/plugoo.py @@ -120,7 +120,7 @@ class Report: gevent.joinall(jobs) ret = [] for job in jobs: - print job.value + #print job.value ret.append(job.value) return ret @@ -216,7 +216,8 @@ class Report: """This sends the report using the specified type. """ - print "Reporting %s to %s" % (data, type) + #print "Reporting %s to %s" % (data, type) + self.logger.info("Reporting to %s" % type) getattr(self, type+"_report").__call__(data) class Plugoo(): @@ -295,7 +296,7 @@ class Plugoo(): # Run the jobs with the selected timeout gevent.joinall(jobs, timeout=timeout) for job in jobs: - print "JOB VAL: %s" % job.value + #print "JOB VAL: %s" % job.value self.report(job.value) job.kill() jobs = [] @@ -303,7 +304,7 @@ class Plugoo(): if len(jobs) > 0: gevent.joinall(jobs, timeout=timeout) for job in jobs: - print job.value + #print "JOB VAL: %s" % job.value self.report(job.value) job.kill() jobs = []

1 0

[ooni-probe/master] Add conditional import for scapy
by art＠torproject.org 07 Feb '12

07 Feb '12

commit 13c7ba31fe59ee00df271e690b931a2f80944060 Author: Arturo Filastò <hellais(a)gmail.com> Date: Tue Feb 7 22:18:45 2012 +0100 Add conditional import for scapy --- refactor/tests/traceroute.py | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-) diff --git a/refactor/tests/traceroute.py b/refactor/tests/traceroute.py index 69f87e5..d7e722a 100644 --- a/refactor/tests/traceroute.py +++ b/refactor/tests/traceroute.py @@ -1,11 +1,15 @@ try: from dns import resolver except: - print "Error dnspython is not installed (http://www.dnspython.org/)" + print "Error: dnspython is not installed (http://www.dnspython.org/)" import gevent import os import plugoo -import scapy + +try: + import scapy +except: + print "Error: traceroute plugin requires scapy to be installed (http://www.secdev.org/projects/scapy)" from plugoo import Plugoo, Asset

1 0

[ooni-probe/master] Trap errors in importing dnspython
by art＠torproject.org 07 Feb '12

07 Feb '12

commit f63fc45985dae2f23ddf0453945b0f3d228bfbf3 Author: Arturo Filastò <hellais(a)gmail.com> Date: Tue Feb 7 20:46:39 2012 +0100 Trap errors in importing dnspython --- refactor/tests/dnstamper.py | 29 ++++++++++++++++------------- refactor/tests/traceroute.py | 31 +++++++++++++++++-------------- 2 files changed, 33 insertions(+), 27 deletions(-) diff --git a/refactor/tests/dnstamper.py b/refactor/tests/dnstamper.py index e68414d..987a948 100644 --- a/refactor/tests/dnstamper.py +++ b/refactor/tests/dnstamper.py @@ -1,4 +1,7 @@ -from dns import resolver +try: + from dns import resolver +except: + print "Error dnspython is not installed! (http://www.dnspython.org/)" import gevent import os import plugoo @@ -13,27 +16,27 @@ class DNST(Plugoo): res = resolver.Resolver(configure=False) res.nameservers = [ns] answer = res.query(hostname) - - ret = [] - + + ret = [] + for data in answer: ret.append(data.address) - + return ret - - def experiment(self, *a, **kw): + + def experiment(self, *a, **kw): # this is just a dirty hack address = kw['data'][0] ns = kw['data'][1] - + config = self.config - + print "ADDRESS: %s" % address print "NAMESERVER: %s" % ns - + exp = self.lookup(address, ns) control = self.lookup(address, config.tests.dns_control_server) - + if len(set(exp) & set(control)) > 0: print "%s : no tampering on %s" % (address, ns) return (address, ns, False) @@ -46,7 +49,7 @@ def run(ooni): """ config = ooni.config urls = [] - + dns_experiment = DNSTAsset(os.path.join(config.main.assetdir, \ config.tests.dns_experiment)) dns_experiment_dns = DNSTAsset(os.path.join(config.main.assetdir, \ @@ -58,5 +61,5 @@ def run(ooni): ooni.logger.info("starting test") dnstest.run(assets) ooni.logger.info("finished") - + diff --git a/refactor/tests/traceroute.py b/refactor/tests/traceroute.py index 13eb578..69f87e5 100644 --- a/refactor/tests/traceroute.py +++ b/refactor/tests/traceroute.py @@ -1,4 +1,7 @@ -from dns import resolver +try: + from dns import resolver +except: + print "Error dnspython is not installed (http://www.dnspython.org/)" import gevent import os import plugoo @@ -40,52 +43,52 @@ class Traceroute(Plugoo): send_sock.connect((dst, dst_port)) except socket.timeout: pass - + except Exception, e: print "Error doing connect %s" % e else: send_sock.sendto("", (dst, dst_port)) - + curr_addr = None try: print "receiving data..." _, curr_addr = recv_sock.recvfrom(512) curr_addr = curr_addr[0] - + except socket.error, e: print "SOCKET ERROR: %s" % e - + except Exception, e: print "ERROR: %s" % e - + finally: send_sock.close() recv_sock.close() - + if curr_addr is not None: curr_host = "%s" % curr_addr else: curr_host = "*" - + print "%d\t%s" % (ttl, curr_host) if curr_addr == dest_addr or ttl > max_hops: break ttl += 1 - - - def experiment(self, *a, **kw): + + + def experiment(self, *a, **kw): # this is just a dirty hack address = kw['data'][0] - + self.traceroute(address) def run(ooni): """Run the test""" config = ooni.config urls = [] - + traceroute_experiment = TracerouteAsset(os.path.join(config.main.assetdir, \ config.tests.traceroute)) @@ -95,5 +98,5 @@ def run(ooni): ooni.logger.info("starting traceroute test") traceroute.run(assets) ooni.logger.info("finished") - +

1 0

[ooni-probe/master] Add install.txt file
by art＠torproject.org 07 Feb '12

07 Feb '12

commit 3f1c1aacb3e1b9fd71f30eab8a47203664546093 Author: Arturo Filastò <hellais(a)gmail.com> Date: Tue Feb 7 20:29:07 2012 +0100 Add install.txt file --- refactor/install.txt | 4 ++++ refactor/plugoo.py | 2 +- 2 files changed, 5 insertions(+), 1 deletions(-) diff --git a/refactor/install.txt b/refactor/install.txt new file mode 100644 index 0000000..8818d47 --- /dev/null +++ b/refactor/install.txt @@ -0,0 +1,4 @@ +install libdnet-1.12 +sudo pip install pylibpcap +sudo pip install pcapy +sudo pip install scapy diff --git a/refactor/plugoo.py b/refactor/plugoo.py index 7606382..9162050 100644 --- a/refactor/plugoo.py +++ b/refactor/plugoo.py @@ -295,7 +295,7 @@ class Plugoo(): # Run the jobs with the selected timeout gevent.joinall(jobs, timeout=timeout) for job in jobs: - print job.value + print "JOB VAL: %s" % job.value self.report(job.value) job.kill() jobs = []

1 0

[torspec/master] Add proposal 193: safe cookie authentication.
by nickm＠torproject.org 07 Feb '12

07 Feb '12

commit bd70d0448684325d9aa0d4f7645affee0aca39fa Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Feb 7 12:39:08 2012 -0500 Add proposal 193: safe cookie authentication. --- proposals/000-index.txt | 2 + proposals/193-safe-cookie-authentication.txt | 144 ++++++++++++++++++++++++++ 2 files changed, 146 insertions(+), 0 deletions(-) diff --git a/proposals/000-index.txt b/proposals/000-index.txt index d539742..73cdd5b 100644 --- a/proposals/000-index.txt +++ b/proposals/000-index.txt @@ -113,6 +113,7 @@ Proposals by number: 190 Bridge Client Authorization Based on a Shared Secret [NEEDS-REVISION] 191 Bridge Detection Resistance against MITM-capable Adversaries [OPEN] 192 Automatically retrieve and store information about bridges [OPEN] +193 Safe cookie authentication for Tor controllers [OPEN] Proposals by status: @@ -147,6 +148,7 @@ Proposals by status: 189 AUTHORIZE and AUTHORIZED cells 191 Bridge Detection Resistance against MITM-capable Adversaries 192 Automatically retrieve and store information about bridges [for 0.2.[45].x] + 193 Safe cookie authentication for Tor controllers ACCEPTED: 117 IPv6 exits [for 0.2.3.x] 140 Provide diffs between consensuses diff --git a/proposals/193-safe-cookie-authentication.txt b/proposals/193-safe-cookie-authentication.txt new file mode 100644 index 0000000..01d8720 --- /dev/null +++ b/proposals/193-safe-cookie-authentication.txt @@ -0,0 +1,144 @@ +Filename: 193-safe-cookie-authentication.txt +Title: Safe cookie authentication for Tor controllers +Author: Robert Ransom +Created: 2012-02-04 +Status: Open + +Overview: + + Not long ago, all Tor controllers which automatically attempted + 'cookie authentication' were vulnerable to an information-disclosure + attack. (See https://bugs.torproject.org/4303 for slightly more + information.) + + Now, some Tor controllers which automatically attempt cookie + authentication are only vulnerable to an information-disclosure + attack on any 32-byte files they can read. But the Ed25519 + signature scheme (among other cryptosystems) has 32-byte secret + keys, and we would like to not worry about Tor controllers leaking + our secret keys to whatever can listen on what the controller thinks + is Tor's control port. + + Additionally, we would like to not have to remodel Tor's innards and + rewrite all of our Tor controllers to use TLS on Tor's control port + this week (or deal with the many design issues which that would + raise). + +Design: + +From af6bf472d59162428a1d7f1d77e6e77bda827414 Mon Sep 17 00:00:00 2001 +From: Robert Ransom <rransom.8774(a)gmail.com> +Date: Sun, 5 Feb 2012 04:02:23 -0800 +Subject: [PATCH] Add SAFECOOKIE control-port authentication method + +--- + control-spec.txt | 59 ++++++++++++++++++++++++++++++++++++++++++++++------- + 1 files changed, 51 insertions(+), 8 deletions(-) + +diff --git a/control-spec.txt b/control-spec.txt +index 66088f7..3651c86 100644 +--- a/control-spec.txt ++++ b/control-spec.txt +@@ -323,11 +323,12 @@ + For information on how the implementation securely stores authentication + information on disk, see section 5.1. + +- Before the client has authenticated, no command other than PROTOCOLINFO, +- AUTHENTICATE, or QUIT is valid. If the controller sends any other command, +- or sends a malformed command, or sends an unsuccessful AUTHENTICATE +- command, or sends PROTOCOLINFO more than once, Tor sends an error reply and +- closes the connection. ++ Before the client has authenticated, no command other than ++ PROTOCOLINFO, AUTHCHALLENGE, AUTHENTICATE, or QUIT is valid. If the ++ controller sends any other command, or sends a malformed command, or ++ sends an unsuccessful AUTHENTICATE command, or sends PROTOCOLINFO or ++ AUTHCHALLENGE more than once, Tor sends an error reply and closes ++ the connection. + + To prevent some cross-protocol attacks, the AUTHENTICATE command is still + required even if all authentication methods in Tor are disabled. In this +@@ -949,6 +950,7 @@ + "NULL" / ; No authentication is required + "HASHEDPASSWORD" / ; A controller must supply the original password + "COOKIE" / ; A controller must supply the contents of a cookie ++ "SAFECOOKIE" ; A controller must prove knowledge of a cookie + + AuthCookieFile = QuotedString + TorVersion = QuotedString +@@ -970,9 +972,9 @@ + methods that Tor currently accepts. + + AuthCookieFile specifies the absolute path and filename of the +- authentication cookie that Tor is expecting and is provided iff +- the METHODS field contains the method "COOKIE". Controllers MUST handle +- escape sequences inside this string. ++ authentication cookie that Tor is expecting and is provided iff the ++ METHODS field contains the method "COOKIE" and/or "SAFECOOKIE". ++ Controllers MUST handle escape sequences inside this string. + + The VERSION line contains the Tor version. + +@@ -1033,6 +1035,47 @@ + + [TAKEOWNERSHIP was added in Tor 0.2.2.28-beta.] + ++3.24. AUTHCHALLENGE ++ ++ The syntax is: ++ "AUTHCHALLENGE" SP "AUTHMETHOD=SAFECOOKIE" ++ SP "COOKIEFILE=" AuthCookieFile ++ SP "CLIENTCHALLENGE=" 2*HEXDIG / QuotedString ++ CRLF ++ ++ The server will reject this command with error code 512, then close ++ the connection, if Tor is not using the file specified in the ++ AuthCookieFile argument as a controller authentication cookie file. ++ ++ If the server accepts the command, the server reply format is: ++ "250-AUTHCHALLENGE" ++ SP "CLIENTRESPONSE=" 64*64HEXDIG ++ SP "SERVERCHALLENGE=" 2*HEXDIG ++ CRLF ++ ++ The CLIENTCHALLENGE, CLIENTRESPONSE, and SERVERCHALLENGE values are ++ encoded/decoded in the same way as the argument passed to the ++ AUTHENTICATE command. ++ ++ The CLIENTRESPONSE value is computed as: ++ HMAC-SHA256(HMAC-SHA256("Tor server-to-controller cookie authenticator", ++ CookieString) ++ ClientChallengeString) ++ (with the HMAC key as its first argument) ++ ++ After a controller sends a successful AUTHCHALLENGE command, the ++ next command sent on the connection must be an AUTHENTICATE command, ++ and the only authentication string which that AUTHENTICATE command ++ will accept is: ++ HMAC-SHA256(HMAC-SHA256("Tor controller-to-server cookie authenticator", ++ CookieString) ++ ServerChallengeString) ++ ++ [Unlike other commands besides AUTHENTICATE, AUTHCHALLENGE may be ++ used (but only once!) before AUTHENTICATE.] ++ ++ [AUTHCHALLENGE was added in Tor FIXME.] ++ + 4. Replies + + Reply codes follow the same 3-character format as used by SMTP, with the +-- +1.7.8.3 + +Rationale: + + The weird inner HMAC was meant to ensure that whatever impersonates + Tor's control port cannot even abuse a secret key meant to be used + with HMAC-SHA256. + + Then I added the server-to-controller challenge-response + authentication step, to ensure that the server can only use a + controller as an HMAC oracle if it already knows the contents of the + cookie file. Now, the inner HMAC is just a not-very-efficient way + to keep controllers from using the server as an oracle for its own + challenges (it could be replaced with a hash function). +

1 0