- tor-commits - lists.torproject.org

[translation/vidalia] Update translations for vidalia
by translation＠torproject.org 27 Nov '11

27 Nov '11

commit efca5a6c910dc6352d53748397e5ce63b61d4204 Author: Translation commit bot <translation(a)torproject.org> Date: Sun Nov 27 14:45:20 2011 +0000 Update translations for vidalia --- ar/vidalia_ar.po | 31 +++++++++++++++++++++++++++++-- 1 files changed, 29 insertions(+), 2 deletions(-) diff --git a/ar/vidalia_ar.po b/ar/vidalia_ar.po index 28642d8..440df2e 100644 --- a/ar/vidalia_ar.po +++ b/ar/vidalia_ar.po @@ -11,7 +11,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2011-09-07 14:40+0000\n" -"PO-Revision-Date: 2011-11-27 14:14+0000\n" +"PO-Revision-Date: 2011-11-27 14:41+0000\n" "Last-Translator: macdeath <manmacdeath(a)gmail.com>\n" "Language-Team: translations(a)vidalia-project.net\n" "MIME-Version: 1.0\n" @@ -174,13 +174,17 @@ msgctxt "AdvancedPage" msgid "" "The specified Tor configuration file location contains characters that " "cannot be represented in your system's current 8-bit character encoding." -msgstr "ملف الإعدادات المحدد يحتوي على أحرف لا يستطيع نظامك إظهارها " +msgstr "" +"ملف الإعدادات المحدد يحتوي على أحرف لا يستطيع نظامك إظهارها لاعتماده على " +"نظام ترقيم 8-بت " msgctxt "AdvancedPage" msgid "" "The specified Tor data directory location contains characters that cannot be" " represented in your system's current 8-bit character encoding." msgstr "" +"مجلد المعلومات المحدد يحتوي على أحرف لا يستطيع نظامك إظهارها لاعتماده على " +"نظام ترقيم 8-بت" msgctxt "AdvancedPage" msgid "Warning" @@ -3295,6 +3299,9 @@ msgid "" "version of the software, which may contain important security, reliability " "and performance fixes." msgstr "" +"أنت الآن على إصدار \"%1\" من التور, والذي قد لا يعمل مع الشبكة التورية " +"الحالية. رجاءً طوره إلى آخر نسخ، والتي قد تحتوي على إصلاحات مهمة في الأمن " +"والكفائة." msgctxt "StatusEventWidget" msgid "Your Tor Software is Out-of-date" @@ -3320,6 +3327,8 @@ msgid "" "The Tor software encountered an internal bug. Please report the following " "error message to the Tor developers at bugs.torproject.org: \"%1\"" msgstr "" +"أعاق البرنامج خلل داخلي. رجاءً أبلغ مبرمجي \"تور\" عن الخلل التالي على " +"bugs.torproject.org: \"%1\"" msgctxt "StatusEventWidget" msgid "" @@ -3328,6 +3337,9 @@ msgid "" "will not be able to function. Please verify your computer displays the " "correct time." msgstr "" +"يظن تور أن ساعة حاسبك الآلي أخرت %1 ثانية عن الأصل \"%2\". لو لم تكن ساعتك " +"مضبوطة، لن يستطيع تور العمل بشكل سليم. رجاءً تأكد من صحة الوفت الذي يظهره " +"حاسبك." msgctxt "StatusEventWidget" msgid "" @@ -3336,6 +3348,9 @@ msgid "" "will not be able to function. Please verify your computer displays the " "correct time." msgstr "" +"يظن تور أن ساعة حاسبك الآلي قدمت %1 ثانية عن الأصل \"%2\". لو لم تكن ساعتك " +"مضبوطة، لن يستطيع تور العمل بشكل سليم. رجاءً تأكد من صحة الوفت الذي يظهره " +"حاسبك." msgctxt "StatusEventWidget" msgid "Your Computer's Clock is Potentially Incorrect" @@ -3348,6 +3363,9 @@ msgid "" "information over the Tor network is dangerous and not recommended. For your " "protection, Tor has automatically closed this connection." msgstr "" +"أظن أن أحد البرامج التي على حاسبك حاول أن يتصل بلا تشفير من المحطة %1. إرسال" +" معلومات غير مشفرة من خلال الشبكة التورية خطر ولا ينصح به. لأجل حمايتك، أغلق" +" تور الإتصال ذاتيا." msgctxt "StatusEventWidget" msgid "" @@ -3355,6 +3373,8 @@ msgid "" "unencrypted connection through Tor to port %1. Sending unencrypted " "information over the Tor network is dangerous and not recommended." msgstr "" +"أظن أن أحد البرامج التي على حاسبك حاول أن يتصل بلا تشفير من المحطة %1. إرسال" +" معلومات غير مشفرة من خلال الشبكة التورية خطر ولا ينصح به." msgctxt "StatusEventWidget" msgid "Potentially Dangerous Connection!" @@ -3367,6 +3387,9 @@ msgid "" "ensure you configure your applications to use only SOCKS4a or SOCKS5 with " "remote hostname resolution." msgstr "" +" أحد برامجك اتصل بـ%1 من خلال تور باستخدام بروتوكول قد يسرب بعض المعلومات عن" +" اتجاهك. رجاءً تأكد من ترتيب برامجك لاستخدام الـSocks4a أو الSocks5ـ لا غير " +"حسن الاتصال بمستضفين غير محلين." msgctxt "StatusEventWidget" msgid "Unknown SOCKS Protocol" @@ -3378,6 +3401,8 @@ msgid "" " protocol that Tor does not understand. Please ensure you configure your " "applications to use only SOCKS4a or SOCKS5 with remote hostname resolution." msgstr "" +" حاول أحد برامجك أن يتصل ببروتركول لا يفهمه تور. رجاءً تأكد من ترتيب برامجك " +"لاستخدام الـSocks4a أو الSocks5ـ لا غير حسن الاتصال بمستضفين غير محلين." msgctxt "StatusEventWidget" msgid "Invalid Destination Hostname" @@ -3389,6 +3414,8 @@ msgid "" "\"%1\", which Tor does not recognize as a valid hostname. Please check your " "application's configuration." msgstr "" +"حاول أحد برامجك أن يتصل بـ%1، والذي لا يعتبره تور مستضيف ممكن. رجاءً تحقق من" +" إعداد برنامجك." msgctxt "StatusEventWidget" msgid "External IP Address Changed"

1 0

[torspec/master] Trivial whitespace cleanup
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit 57efa12578944a1afb535e2c28374257c40f5c23 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sat Nov 26 03:57:54 2011 +0100 Trivial whitespace cleanup --- control-spec.txt | 4 ++-- dir-spec-v2.txt | 5 +++-- dir-spec.txt | 14 +++++++------- gettor-spec.txt | 53 +++++++++++++++++++++++++++-------------------------- path-spec.txt | 7 ++++--- 5 files changed, 43 insertions(+), 40 deletions(-) diff --git a/control-spec.txt b/control-spec.txt index 01dc4d5..88be91e 100644 --- a/control-spec.txt +++ b/control-spec.txt @@ -541,7 +541,7 @@ 0.2.2.1-alpha and later by default, each line is of the form: LongName SP ORStatus CRLF - In Tor versions 0.1.2.2-alpha through 0.2.2.1-alpha with feature + In Tor versions 0.1.2.2-alpha through 0.2.2.1-alpha with feature VERBOSE_NAMES turned off and before version 0.1.2.2-alpha, each line is of the form: ServerID SP ORStatus CRLF @@ -552,7 +552,7 @@ 0.2.2.1-alpha and later by default, each line is of the form: LongName SP Status [SP ISOTime] CRLF - In Tor versions 0.1.2.2-alpha through 0.2.2.1-alpha with feature + In Tor versions 0.1.2.2-alpha through 0.2.2.1-alpha with feature VERBOSE_NAMES turned off and before version 0.1.2.2-alpha, each line is of the form: ServerID2 SP Status [SP ISOTime] CRLF diff --git a/dir-spec-v2.txt b/dir-spec-v2.txt index d1be27f..7b06b02 100644 --- a/dir-spec-v2.txt +++ b/dir-spec-v2.txt @@ -155,7 +155,7 @@ Every router descriptor MUST start with a "router" Item; MUST end with a "router-signature" Item and an extra NL; and MUST contain exactly one instance of each of the following Items: "published" "onion-key" - "signing-key" "bandwidth". + "signing-key" "bandwidth". A router descriptor MAY have zero or one of each of the following Items, but MUST NOT have more than one: "contact", "uptime", "fingerprint", @@ -892,5 +892,6 @@ 7.2. HTTP status codes - XXX We should write down what return codes dirservers send in what situations. + XXX We should write down what return codes dirservers send in what + situations. diff --git a/dir-spec.txt b/dir-spec.txt index b4db02e..539581b 100644 --- a/dir-spec.txt +++ b/dir-spec.txt @@ -1342,12 +1342,12 @@ An estimate of the bandwidth of this relay, in an arbitrary unit (currently kilobytes per second). Used to weight router - selection. + selection. - Additionally, the Measured= keyword is present in votes by + Additionally, the Measured= keyword is present in votes by participating bandwidth measurement authorities to indicate - a measured bandwidth currently produced by measuring stream - capacities. + a measured bandwidth currently produced by measuring stream + capacities. Other weighting keywords may be added later. Clients MUST ignore keywords they do not recognize. @@ -1632,9 +1632,9 @@ one, breaking ties in favor of the lexicographically larger vote.) The port list is encoded as specified in 3.4.2. - * If consensus-method 6 or later is in use and if 3 or more - authorities provide a Measured= keyword in their votes for - a router, the authorities produce a consensus containing a + * If consensus-method 6 or later is in use and if 3 or more + authorities provide a Measured= keyword in their votes for + a router, the authorities produce a consensus containing a Bandwidth= keyword equal to the median of the Measured= votes. * If consensus-method 7 or later is in use, the params line is diff --git a/gettor-spec.txt b/gettor-spec.txt index 0a30efc..dd26b3d 100644 --- a/gettor-spec.txt +++ b/gettor-spec.txt @@ -8,27 +8,27 @@ 1. Overview - GetTor was created to resolve direct and indirect censorship of Tor's software. - In many countries and networks Tor's main website is blocked and would be Tor - users are unable to download even the source code to the Tor program. Other - software hosted by the Tor Project is similarly censored. The filtering - of the possible download sites is sometimes easy to bypass by using our TLS enabled - website. In other cases the website and all of the mirrors are entirely - blocked; this is a situation where a user seems to actually need Tor to fetch - Tor. We discovered that it is feasible to use alternate transport methods such - as SMTP between a non-trusted third party or with IRC and XDCC. + GetTor was created to resolve direct and indirect censorship of Tor's + software. In many countries and networks Tor's main website is blocked and + would be Tor users are unable to download even the source code to the Tor + program. Other software hosted by the Tor Project is similarly censored. The + filtering of the possible download sites is sometimes easy to bypass by using + our TLS enabled website. In other cases the website and all of the mirrors are + entirely blocked; this is a situation where a user seems to actually need Tor + to fetch Tor. We discovered that it is feasible to use alternate transport + methods such as SMTP between a non-trusted third party or with IRC and XDCC. 2. Implementation Any compliant GetTor implementation will implement at least a single transport - to meet the needs of a certain class of users. It should be i18n and l10n compliant - for all user facing interactions; users should be able to manually set their - language and this should serve as their preference for localization of any - software delivered. The implementation must be free software and it should be - freely available by request from the implementation that they interface with - to download any of the other software available from that GetTor instance. - Security and privacy considerations should be described on a per transport - basis. + to meet the needs of a certain class of users. It should be i18n and l10n + compliant for all user facing interactions; users should be able to manually + set their language and this should serve as their preference for localization + of any software delivered. The implementation must be free software and it + should be freely available by request from the implementation that they + interface with to download any of the other software available from that + GetTor instance. Security and privacy considerations should be described on a + per transport basis. 2.1 Reference implementation @@ -36,16 +36,17 @@ 3. SMTP transport - The SMTP transport for GetTor should allow users to send any RFC822 compliant message - in any known human language; GetTor should respond in whatever language is - detected with supplementary translations in the same email. GetTor shall offer - a list of all available software in the body of the email - it should offer the - software as a list of packages and their subsequent descriptions. + The SMTP transport for GetTor should allow users to send any RFC822 compliant + message in any known human language; GetTor should respond in whatever + language is detected with supplementary translations in the same email. + GetTor shall offer a list of all available software in the body of the email - + it should offer the software as a list of packages and their subsequent + descriptions. 3.1 SMTP transport security considerations - Any GetTor instance that offers SMTP as a transport should optionally implement - the checking of DKIM signatures to ensure that email is not forged. + Any GetTor instance that offers SMTP as a transport should optionally + implement the checking of DKIM signatures to ensure that email is not forged. Optionally GetTor should take an OpenPGP key from the user and encrypt the response with a blinded message. @@ -63,8 +64,8 @@ 4. Other transports - At this time no other transports have been specified. IRC XDCC is a likely useful - system as is XMPP/Jabber with the newest OTR file sharing transport. + At this time no other transports have been specified. IRC XDCC is a likely + useful system as is XMPP/Jabber with the newest OTR file sharing transport. 5. Implementation suggestions diff --git a/path-spec.txt b/path-spec.txt index 480772e..7d19889 100644 --- a/path-spec.txt +++ b/path-spec.txt @@ -348,7 +348,8 @@ of their choices. frequently occurring 50ms histogram bin, until the point where 1000 circuits are recorded. After this point, the weighted average of the top 'cbtnummodes' (default: 3) midpoint modes is used as Xm. All times below - this value are counted as having the midpoint value of this weighted average bin. + this value are counted as having the midpoint value of this weighted average + bin. The timeout itself is calculated by using the Pareto Quantile function (the inverted CDF) to give us the value on the CDF such that 80% of the mass @@ -471,8 +472,8 @@ of their choices. Min: Value of cbtquantile parameter Max: 99 Effect: This is the position on the quantile curve to use to set the - timeout value to use to actually close circuits. It is a percent - (0-99). + timeout value to use to actually close circuits. It is a + percent (0-99). cbttestfreq Default: 60

1 0

[torspec/master] Update dir-spec with proposal 178
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit 71a28234703724b97508936e396f0a028e2523d8 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sat Nov 26 04:11:24 2011 +0100 Update dir-spec with proposal 178 --- dir-spec.txt | 17 ++++++++++++++--- 1 files changed, 14 insertions(+), 3 deletions(-) diff --git a/dir-spec.txt b/dir-spec.txt index 539581b..f1aef64 100644 --- a/dir-spec.txt +++ b/dir-spec.txt @@ -1566,9 +1566,15 @@ Known-flags is the union of all flags known by any voter. - Entries are given on the "params" line for every keyword on which any - authority voted. The values given are the low-median of all votes on - that keyword. + Entries are given on the "params" line for every keyword on which a + majority of authorities (total authorities, not just those + participating in this vote) voted on, or if at least three + authorities voted for that parameter. The values given are the + low-median of all votes on that keyword. + + Consensus methods 11 and before, entries are given on the "params" + line for every keyword on which any authority voted, the value given + being the low-median of all votes on that keyword. "client-versions" and "server-versions" are sorted in ascending order; A version is recommended in the consensus if it is recommended @@ -1645,6 +1651,10 @@ method 11 or later is in use, any router that is determined to get the BadExit flag doesn't count when we're calculating weights. + * If consensus method 12 or later is used, only consensus + parameters that more than half of the total number of + authorities voted for are included in the consensus. + The signatures at the end of a consensus document are sorted in ascending order by identity digest. @@ -1671,6 +1681,7 @@ "9" -- Provides weights for selecting flagged routers in paths "10" -- Fixes edge case bugs in router flag selection weights "11" -- Don't consider BadExits when calculating bandwidth weights + "12" -- Params are only included if enough auths voted for them Before generating a consensus, an authority must decide which consensus

1 0

[torspec/master] mark 178 as closed
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit 11cf7fcd00d6667ab01287cfbf9bf1f4ef15d64c Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 27 09:35:30 2011 -0500 mark 178 as closed --- proposals/000-index.txt | 4 ++-- proposals/178-param-voting.txt | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/proposals/000-index.txt b/proposals/000-index.txt index c270a26..68ce0b2 100644 --- a/proposals/000-index.txt +++ b/proposals/000-index.txt @@ -98,7 +98,7 @@ Proposals by number: 175 Automatically promoting Tor clients to nodes [DRAFT] 176 Proposed version-3 link handshake for Tor [CLOSED] 177 Abstaining from votes on individual flags [OPEN] -178 Require majority of authorities to vote for consensus parameters [OPEN] +178 Require majority of authorities to vote for consensus parameters [CLOSED] 179 TLS certificate and parameter normalization [DRAFT] 180 Pluggable transports for circumvention [OPEN] 181 Optimistic Data for Tor: Client Side [CLOSED] @@ -138,7 +138,6 @@ Proposals by status: 165 Easy migration for voting authority sets 168 Reduce default circuit window 177 Abstaining from votes on individual flags [for 0.2.3.x] - 178 Require majority of authorities to vote for consensus parameters [for 0.2.3.x] 180 Pluggable transports for circumvention [for 0.2.3.x] 185 Directory caches without DirPort 187 Reserve a cell type to allow client authorization [for 0.2.3.x] @@ -198,6 +197,7 @@ Proposals by status: 171 Separate streams across circuits by connection metadata [in 0.2.3.3-alpha] 174 Optimistic Data for Tor: Server Side [in 0.2.3.1-alpha] 176 Proposed version-3 link handshake for Tor [for 0.2.3] + 178 Require majority of authorities to vote for consensus parameters [in 0.2.3.9-alpha] 181 Optimistic Data for Tor: Client Side [in 0.2.3.3-alpha] 183 Refill Intervals [in 0.2.3.5-alpha] 184 Miscellaneous changes for a v3 Tor link protocol [for 0.2.3.x] diff --git a/proposals/178-param-voting.txt b/proposals/178-param-voting.txt index dddfaff..58d2a62 100644 --- a/proposals/178-param-voting.txt +++ b/proposals/178-param-voting.txt @@ -2,8 +2,8 @@ Filename: 178-param-voting.txt Title: Require majority of authorities to vote for consensus parameters Author: Sebastian Hahn Created: 16-Feb-2011 -Status: Open -Target: 0.2.3.x +Status: Closed +Implemented-In: 0.2.3.9-alpha Overview:

1 0

[tor/master] Implement consensus method 12 (proposal 178)
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit e5e4bfd167425699a559a3a1545c0a3d6946f82e Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sun Feb 20 21:05:17 2011 -0500 Implement consensus method 12 (proposal 178) --- changes/proposal178 | 6 ++++ src/or/dirvote.c | 32 ++++++++++++++++----- src/or/dirvote.h | 3 +- src/test/test_dir.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++++--- 4 files changed, 104 insertions(+), 13 deletions(-) diff --git a/changes/proposal178 b/changes/proposal178 new file mode 100644 index 0000000..ee70695 --- /dev/null +++ b/changes/proposal178 @@ -0,0 +1,6 @@ + o Major features: + - Implement a more secure consensus parameter voting algorithm that + ensures that at least three directory authorities or a majority of + them voted on a given parameter before including it in the + consensus. Implements proposal 178. + diff --git a/src/or/dirvote.c b/src/or/dirvote.c index bf34c62..01e2358 100644 --- a/src/or/dirvote.c +++ b/src/or/dirvote.c @@ -50,7 +50,7 @@ static int dirvote_publish_consensus(void); static char *make_consensus_method_list(int low, int high, const char *sep); /** The highest consensus method that we currently support. */ -#define MAX_SUPPORTED_CONSENSUS_METHOD 11 +#define MAX_SUPPORTED_CONSENSUS_METHOD 12 /** Lowest consensus method that contains a 'directory-footer' marker */ #define MIN_METHOD_FOR_FOOTER 9 @@ -64,6 +64,10 @@ static char *make_consensus_method_list(int low, int high, const char *sep); /** Lowest consensus method that generates microdescriptors */ #define MIN_METHOD_FOR_MICRODESC 8 +/** Lowest consensus method that ensures a majority of authorities voted + * for a param. */ +#define MIN_METHOD_FOR_MAJORITY_PARAMS 12 + /* ===== * Voting * =====*/ @@ -608,11 +612,16 @@ compute_consensus_versions_list(smartlist_t *lst, int n_versioning) return result; } +/** Minimum number of directory authorities voting for a parameter to + * include it in the consensus, if consensus method 12 or later is to be + * used. See proposal 178 for details. */ +#define MIN_VOTES_FOR_PARAM 3 + /** Helper: given a list of valid networkstatus_t, return a new string * containing the contents of the consensus network parameter set. */ /* private */ char * -dirvote_compute_params(smartlist_t *votes) +dirvote_compute_params(smartlist_t *votes, int method, int total_authorities) { int i; int32_t *vals; @@ -669,11 +678,17 @@ dirvote_compute_params(smartlist_t *votes) next_param = smartlist_get(param_list, param_sl_idx+1); if (!next_param || strncmp(next_param, param, cur_param_len)) { /* We've reached the end of a series. */ - int32_t median = median_int32(vals, i); - char *out_string = tor_malloc(64+cur_param_len); - memcpy(out_string, param, cur_param_len); - tor_snprintf(out_string+cur_param_len,64, "%ld", (long)median); - smartlist_add(output, out_string); + /* Make sure enough authorities voted on this param, unless the + * the consensus method we use is too old for that. */ + if (method < MIN_METHOD_FOR_MAJORITY_PARAMS || + i > total_authorities/2 || + i >= MIN_VOTES_FOR_PARAM) { + int32_t median = median_int32(vals, i); + char *out_string = tor_malloc(64+cur_param_len); + memcpy(out_string, param, cur_param_len); + tor_snprintf(out_string+cur_param_len,64, "%ld", (long)median); + smartlist_add(output, out_string); + } i = 0; if (next_param) { @@ -1496,7 +1511,8 @@ networkstatus_compute_consensus(smartlist_t *votes, } if (consensus_method >= MIN_METHOD_FOR_PARAMS) { - params = dirvote_compute_params(votes); + params = dirvote_compute_params(votes, consensus_method, + total_authorities); if (params) { smartlist_add(chunks, tor_strdup("params ")); smartlist_add(chunks, params); diff --git a/src/or/dirvote.h b/src/or/dirvote.h index d196351..1f4dc36 100644 --- a/src/or/dirvote.h +++ b/src/or/dirvote.h @@ -84,7 +84,8 @@ document_signature_t *voter_get_sig_by_algorithm( #ifdef DIRVOTE_PRIVATE char *format_networkstatus_vote(crypto_pk_env_t *private_key, networkstatus_t *v3_ns); -char *dirvote_compute_params(smartlist_t *votes); +char *dirvote_compute_params(smartlist_t *votes, int method, + int total_authorities); #endif #endif diff --git a/src/test/test_dir.c b/src/test/test_dir.c index 205d7b5..5b7ce5c 100644 --- a/src/test/test_dir.c +++ b/src/test/test_dir.c @@ -620,13 +620,81 @@ test_dir_param_voting(void) test_eq(0, networkstatus_get_param(&vote4, "foobar", 0, -100, 8)); smartlist_add(votes, &vote1); + + /* Do the first tests without adding all the other votes, for + * networks without many dirauths. */ + + res = dirvote_compute_params(votes, 11, 6); + test_streq(res, "ab=90 abcd=20 cw=50 x-yz=-99"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 2); + test_streq(res, ""); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 1); + test_streq(res, "ab=90 abcd=20 cw=50 x-yz=-99"); + tor_free(res); + smartlist_add(votes, &vote2); + + res = dirvote_compute_params(votes, 11, 2); + test_streq(res, "ab=27 abcd=20 cw=5 x-yz=-99"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 2); + test_streq(res, "ab=27 cw=5 x-yz=-99"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 3); + test_streq(res, "ab=27 cw=5 x-yz=-99"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 6); + test_streq(res, ""); + tor_free(res); + smartlist_add(votes, &vote3); + + res = dirvote_compute_params(votes, 11, 3); + test_streq(res, "ab=27 abcd=20 c=60 cw=50 x-yz=-9 zzzzz=101"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 3); + test_streq(res, "ab=27 abcd=20 cw=50 x-yz=-9"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 5); + test_streq(res, "cw=50 x-yz=-9"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 9); + test_streq(res, "cw=50 x-yz=-9"); + tor_free(res); + smartlist_add(votes, &vote4); - res = dirvote_compute_params(votes); - test_streq(res, - "ab=90 abcd=20 c=1 cw=50 x-yz=-9 zzzzz=101"); + res = dirvote_compute_params(votes, 11, 4); + test_streq(res, "ab=90 abcd=20 c=1 cw=50 x-yz=-9 zzzzz=101"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 4); + test_streq(res, "ab=90 abcd=20 cw=50 x-yz=-9"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 5); + test_streq(res, "ab=90 abcd=20 cw=50 x-yz=-9"); + tor_free(res); + + /* Test that the special-cased "at least three dirauths voted for + * this param" logic works as expected. */ + res = dirvote_compute_params(votes, 12, 6); + test_streq(res, "ab=90 abcd=20 cw=50 x-yz=-9"); + tor_free(res); + + res = dirvote_compute_params(votes, 12, 10); + test_streq(res, "ab=90 abcd=20 cw=50 x-yz=-9"); + tor_free(res); done: tor_free(res); @@ -1049,7 +1117,7 @@ test_dir_v3_networkstatus(void) "Running:Stable:V2Dir:Valid"); tor_free(cp); cp = smartlist_join_strings(con->net_params, ":", 0, NULL); - test_streq(cp, "bar=2000000000:circuitwindow=80:foo=660"); + test_streq(cp, "circuitwindow=80:foo=660"); tor_free(cp); test_eq(4, smartlist_len(con->voters)); /*3 voters, 1 legacy key.*/

1 0

[tor/master] Merge branch 'safer_params_squashed'
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit b5a306e82c684bdd30b832fdfd9e2b55c06b54ae Merge: 40a87c4 e5e4bfd Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 27 09:30:13 2011 -0500 Merge branch 'safer_params_squashed' changes/proposal178 | 6 ++++ src/or/dirvote.c | 32 ++++++++++++++++----- src/or/dirvote.h | 3 +- src/test/test_dir.c | 76 ++++++++++++++++++++++++++++++++++++++++++++++++--- 4 files changed, 104 insertions(+), 13 deletions(-)

1 0

[tor/master] Use random bytes as our certificate serial numbers.
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit b42ff6545ac550c1e9cf6dbadea71717c210f323 Author: George Kadianakis <desnacked(a)gmail.com> Date: Sun Nov 27 08:20:17 2011 +0100 Use random bytes as our certificate serial numbers. Instead of using time(NULL) in our certificate serial numbers, use eight random bytes as suggested in proposal 179. --- src/common/tortls.c | 17 ++++++++++++++++- 1 files changed, 16 insertions(+), 1 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index 0571b34..9a77bab 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -585,7 +585,11 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa, const char *cname_sign, unsigned int cert_lifetime) { +#define SERIAL_NUMBER_SIZE 8 + time_t start_time, end_time; + BIGNUM *serial_number = NULL; + unsigned char serial_tmp[SERIAL_NUMBER_SIZE]; EVP_PKEY *sign_pkey = NULL, *pkey=NULL; X509 *x509 = NULL; X509_NAME *name = NULL, *name_issuer=NULL; @@ -606,8 +610,15 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa, goto error; if (!(X509_set_version(x509, 2))) goto error; - if (!(ASN1_INTEGER_set(X509_get_serialNumber(x509), (long)start_time))) + + { /* our serial number is 8 random bytes. */ + if (crypto_rand((char *)serial_tmp, sizeof(serial_tmp)) < 0) + goto error; + if (!(serial_number = BN_bin2bn(serial_tmp, sizeof(serial_tmp), NULL))) goto error; + if (!(BN_to_ASN1_INTEGER(serial_number, X509_get_serialNumber(x509)))) + goto error; + } if (!(name = tor_x509_name_new(cname))) goto error; @@ -640,11 +651,15 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa, EVP_PKEY_free(sign_pkey); if (pkey) EVP_PKEY_free(pkey); + if (serial_number) + BN_free(serial_number); if (name) X509_NAME_free(name); if (name_issuer) X509_NAME_free(name_issuer); return x509; + +#undef SERIAL_NUMBER_SIZE } /** List of ciphers that servers should select from.*/

1 0

[tor/master] Add a changes file.
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit efba71b03c5a8361352a4fac22bd7261b643bb7b Author: George Kadianakis <desnacked(a)gmail.com> Date: Sun Nov 27 09:03:37 2011 +0100 Add a changes file. --- changes/bug4584 | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/changes/bug4584 b/changes/bug4584 new file mode 100644 index 0000000..38cf2d6 --- /dev/null +++ b/changes/bug4584 @@ -0,0 +1,4 @@ + o Privacy/anonymity features (bridge detection): + - Make bridge SSL certificates a bit more stealthy by using random + serial numbers, in the same fashion as OpenSSL when generating + self-signed certificates. Implements ticket 4584.

1 0

[tor/master] Merge remote-tracking branch 'asn/bug4584'
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit e665ec6409c253ebbbf7ae0ef2601fe7c8afba7b Merge: 617617e efba71b Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 27 09:18:55 2011 -0500 Merge remote-tracking branch 'asn/bug4584' changes/bug4584 | 4 ++++ src/common/tortls.c | 17 ++++++++++++++++- 2 files changed, 20 insertions(+), 1 deletions(-)

1 0

[tor/master] indent; add comment
by nickm＠torproject.org 27 Nov '11

27 Nov '11

commit 40a87c4c08be0cdd87a3df283f285b3c2a0c8445 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Nov 27 09:24:41 2011 -0500 indent; add comment --- src/common/tortls.c | 14 ++++++++------ 1 files changed, 8 insertions(+), 6 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index 9ac5c34..b4d81de 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -585,6 +585,8 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa, const char *cname_sign, unsigned int cert_lifetime) { + /* OpenSSL generates self-signed certificates with random 64-bit serial + * numbers, so let's do that too. */ #define SERIAL_NUMBER_SIZE 8 time_t start_time, end_time; @@ -612,12 +614,12 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa, goto error; { /* our serial number is 8 random bytes. */ - if (crypto_rand((char *)serial_tmp, sizeof(serial_tmp)) < 0) - goto error; - if (!(serial_number = BN_bin2bn(serial_tmp, sizeof(serial_tmp), NULL))) - goto error; - if (!(BN_to_ASN1_INTEGER(serial_number, X509_get_serialNumber(x509)))) - goto error; + if (crypto_rand((char *)serial_tmp, sizeof(serial_tmp)) < 0) + goto error; + if (!(serial_number = BN_bin2bn(serial_tmp, sizeof(serial_tmp), NULL))) + goto error; + if (!(BN_to_ASN1_INTEGER(serial_number, X509_get_serialNumber(x509)))) + goto error; } if (!(name = tor_x509_name_new(cname)))

1 0