- tor-commits - lists.torproject.org

[tor/maint-0.2.2] Merge branch 'bug4424' into maint-0.2.2
by nickm＠torproject.org 07 Nov '11

07 Nov '11

commit ca282e53263de564774944a8aa93e88271983461 Merge: 4d8306e 02d89c5 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 7 11:47:28 2011 -0500 Merge branch 'bug4424' into maint-0.2.2 changes/bug4424 | 6 ++++++ src/or/rendclient.c | 9 +++++++-- 2 files changed, 13 insertions(+), 2 deletions(-)

1 0

[tor/master] Added man entry for ClientTransportPlugin.
by nickm＠torproject.org 07 Nov '11

07 Nov '11

commit 1c532594e77aa22617c51b988a93084cfc0dc900 Author: George Kadianakis <desnacked(a)gmail.com> Date: Sun Nov 6 00:50:22 2011 +0100 Added man entry for ClientTransportPlugin. --- doc/tor.1.txt | 14 ++++++++++++-- 1 files changed, 12 insertions(+), 2 deletions(-) diff --git a/doc/tor.1.txt b/doc/tor.1.txt index 89dd7dc..cea2d75 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -110,6 +110,12 @@ Other options can be specified either on the command-line (--option You should never need to change this value, since a network-wide value is published in the consensus and your relay will use that value. (Default: 0) +**ClientTransportPlugin** __transport__ socks4|socks5 __IP__:__PORT__:: + When set along with a corresponding Bridge line, the Tor client + forwards its traffic to a SOCKS-speaking proxy on "IP:PORT". It's + the duty of that proxy to properly forward the traffic to the + bridge. + **ConnLimit** __NUM__:: The minimum number of file descriptors that must be available to the Tor process before it will start. Tor will ask the OS for as many file @@ -483,13 +489,17 @@ The following options are useful only for clients (that is, if so using these relays might make your client stand out. (Default: 1) -**Bridge** __IP__:__ORPort__ [fingerprint]:: +**Bridge** [__transport__] __IP__:__ORPort__ [__fingerprint__]:: When set along with UseBridges, instructs Tor to use the relay at "IP:ORPort" as a "bridge" relaying into the Tor network. If "fingerprint" is provided (using the same format as for DirServer), we will verify that the relay running at that location has the right fingerprint. We also use fingerprint to look up the bridge descriptor at the bridge authority, if - it's provided and if UpdateBridgesFromAuthority is set too. + it's provided and if UpdateBridgesFromAuthority is set too. + + + + If "transport" is provided, and matches to a ClientTransportPlugin + line, we use that pluggable transports proxy to transfer data to + the bridge. **LearnCircuitBuildTimeout** **0**|**1**:: If 0, CircuitBuildTimeout adaptive learning is disabled. (Default: 1)

1 0

[tor/master] Merge remote-tracking branch 'asn-mytor/bug4012_clienttransportplugin'
by nickm＠torproject.org 07 Nov '11

07 Nov '11

commit 21dd6eae9eb6904586fc0f809a257943b85314be Merge: 51f53b5 1c53259 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 7 11:37:29 2011 -0500 Merge remote-tracking branch 'asn-mytor/bug4012_clienttransportplugin' doc/tor.1.txt | 14 ++++++++++++-- 1 files changed, 12 insertions(+), 2 deletions(-)

1 0

[tor-cloud/master] Tried to add more info to the BUILD instructions, will clean up the text later
by runa＠torproject.org 07 Nov '11

07 Nov '11

commit f11df67e8d0b5021927170a9696f130193005b5a Author: Runa A. Sandvik <runa.sandvik(a)gmail.com> Date: Mon Nov 7 16:34:39 2011 +0000 Tried to add more info to the BUILD instructions, will clean up the text later --- BUILD | 43 ++++++++++++++++++++++++++++++++++++------- 1 files changed, 36 insertions(+), 7 deletions(-) diff --git a/BUILD b/BUILD index 5866339..461ddc1 100644 --- a/BUILD +++ b/BUILD @@ -1,11 +1,16 @@ - Installation: - 1) Install ec2-api-tools on your laptop or build machine - 2) Generate and save your private keys: - export EC2_PRIVATE_KEY=~/keys/pk.cert - export EC2_CERT=~./keys/cert.pem - 3) Test your ec2-api-tools: + 0) Edit /etc/apt/sources.list to include multiverse + 1) Install ec2-api-tools and git-core on your laptop or build machine + 2) If the setup of openjdk-6-jre-headless is giving you a headache (e.g. crashing the instance), try using the 64-bit Ubuntu image instead. + 3) Clone https://git.torproject.org/tor-cloud.git + 4) Get the private keys (pk.cert and cert.pem) from Amazon and put them somewhere safe + 5) Run the following two commands to make sure the system knows about the private keys: + + # export EC2_PRIVATE_KEY=/path/to/pk.cert + # export EC2_CERT=/path/to/cert.pem + + 1) Test that ec2-api-tools is working: root@inf0:~/Tor-Cloud# ec2-describe-regions REGION eu-west-1 ec2.eu-west-1.amazonaws.com REGION us-east-1 ec2.us-east-1.amazonaws.com @@ -13,7 +18,16 @@ Installation: REGION us-west-1 ec2.us-west-1.amazonaws.com REGION ap-southeast-1 ec2.ap-southeast-1.amazonaws.com - 4) Generate private keys for each region: + 4) Create Generate private keys for each region. For each key + generated, save it in keys/: + + # ec2-add-keypair --region us-east-1 tor-cloud-us-east-1 + # ec2-add-keypair --region us-west-1 tor-cloud-us-west-1 + # ec2-add-keypair --region us-west-1 tor-cloud-eu-west-1 + # ec2-add-keypair --region us-west-1 tor-cloud-ap-northeast-1 + # ec2-add-keypair --region us-west-1 tor-cloud-ap-southeast-1 + + for example: ec2-add-keypair --region us-east-1 tor-cloud-east-1 and save the key in: ~/keys/tor-cloud-east-1.pem, don't forget to run chmod 600 ~/keys/* @@ -25,12 +39,27 @@ Installation: -rw------- 1 root root 1.7K 2011-09-12 19:09 tor-cloud-us-east-1.pem -rw------- 1 root root 1.7K 2011-09-12 19:09 tor-cloud-us-west-1.pem + + + 5) Create a Security Group called "tor-cloud-build" and allow SSH inbound traffic. 6) You are now ready to build Bridge AMIs: For example, to build in "ap-southeast-1" region run: ./build.sh bridge ap-southeast-1 /home/architect/keys/tor-cloud-ap-southeast-1.pem tor-cloud-ap-southeast-1 + 7) The last thing the build.sh will spit out is the region and the AMI ID: + + ec2-describe-snapshots --region us-east-1 + IMAGE ami-5799503e + + 8) Before other people can launch it, make sure you make it + public in AWS: + + - Images, AMIs, right clic, edit permissions, set to public + + + TIP: You can run the build command for all the regions at the same time. Use screen or & to send the process to background!

1 0

[tor/master] Add a changes file for 4410
by nickm＠torproject.org 07 Nov '11

07 Nov '11

commit be6928d6e78a47800a96962403efff753ad70e84 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sun Nov 6 17:24:09 2011 +0100 Add a changes file for 4410 --- changes/bug4410 | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/changes/bug4410 b/changes/bug4410 new file mode 100644 index 0000000..f42893a --- /dev/null +++ b/changes/bug4410 @@ -0,0 +1,5 @@ + o Major bugfixes: + - Correctly sanity-check that we don't underflow on a memory allocation + for introduction point decryption. Bug discovered by Dan Rosenberg. + Fixes bug 4410; bugfix on 0.2.1.5-alpha. +

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2
by nickm＠torproject.org 07 Nov '11

07 Nov '11

commit 4d8306e0e92200e1a25a073480ec342e22e590b7 Merge: 9725646 be6928d Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 7 10:42:34 2011 -0500 Merge remote-tracking branch 'origin/maint-0.2.1' into maint-0.2.2 changes/bug4410 | 5 +++++ src/or/routerparse.c | 5 +++++ 2 files changed, 10 insertions(+), 0 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.2'
by nickm＠torproject.org 07 Nov '11

07 Nov '11

commit 51f53b590ee15c972adcff9e7d94c904a9267ac2 Merge: 350fe95 4d8306e Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 7 10:44:02 2011 -0500 Merge remote-tracking branch 'origin/maint-0.2.2' changes/bug4410 | 5 +++++ src/or/routerparse.c | 5 +++++ 2 files changed, 10 insertions(+), 0 deletions(-)

1 0

[tor/master] Fix remotely triggerable assert during ip decryption
by nickm＠torproject.org 07 Nov '11

07 Nov '11

commit d5161ab895b9c14a66a08fb38521dd12c0772a97 Author: Dan Rosenberg <dan.j.rosenberg(a)gmail.com> Date: Sun Nov 6 17:23:14 2011 +0100 Fix remotely triggerable assert during ip decryption Fixes bug 4410. --- src/or/routerparse.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 19f9e38..843fc79 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -3858,6 +3858,11 @@ rend_decrypt_introduction_points(char **ipos_decrypted, crypto_cipher_env_t *cipher; char *dec; int declen; + if (ipos_encrypted_size < CIPHER_IV_LEN + 2) { + log_warn(LD_REND, "Size of encrypted introduction points is too " + "small."); + return -1; + } dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1); cipher = crypto_create_init_cipher(descriptor_cookie, 0); declen = crypto_cipher_decrypt_with_iv(cipher, dec,

1 0

[tor/maint-0.2.2] Fix remotely triggerable assert during ip decryption
by nickm＠torproject.org 07 Nov '11

07 Nov '11

commit d5161ab895b9c14a66a08fb38521dd12c0772a97 Author: Dan Rosenberg <dan.j.rosenberg(a)gmail.com> Date: Sun Nov 6 17:23:14 2011 +0100 Fix remotely triggerable assert during ip decryption Fixes bug 4410. --- src/or/routerparse.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/src/or/routerparse.c b/src/or/routerparse.c index 19f9e38..843fc79 100644 --- a/src/or/routerparse.c +++ b/src/or/routerparse.c @@ -3858,6 +3858,11 @@ rend_decrypt_introduction_points(char **ipos_decrypted, crypto_cipher_env_t *cipher; char *dec; int declen; + if (ipos_encrypted_size < CIPHER_IV_LEN + 2) { + log_warn(LD_REND, "Size of encrypted introduction points is too " + "small."); + return -1; + } dec = tor_malloc_zero(ipos_encrypted_size - CIPHER_IV_LEN - 1); cipher = crypto_create_init_cipher(descriptor_cookie, 0); declen = crypto_cipher_decrypt_with_iv(cipher, dec,

1 0

[tor/maint-0.2.2] Add a changes file for 4410
by nickm＠torproject.org 07 Nov '11

07 Nov '11

commit be6928d6e78a47800a96962403efff753ad70e84 Author: Sebastian Hahn <sebastian(a)torproject.org> Date: Sun Nov 6 17:24:09 2011 +0100 Add a changes file for 4410 --- changes/bug4410 | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/changes/bug4410 b/changes/bug4410 new file mode 100644 index 0000000..f42893a --- /dev/null +++ b/changes/bug4410 @@ -0,0 +1,5 @@ + o Major bugfixes: + - Correctly sanity-check that we don't underflow on a memory allocation + for introduction point decryption. Bug discovered by Dan Rosenberg. + Fixes bug 4410; bugfix on 0.2.1.5-alpha. +

1 0