- tor-commits - lists.torproject.org

[arm/master] fix: config description content too long
by atagar＠torproject.org 09 Aug '11

09 Aug '11

commit e239fd7931d6014306a76648663f6f6b2a92323d Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Aug 8 08:42:58 2011 -0700 fix: config description content too long Descriptions for configuration options were one cell too long, causing it to draw on top of the border if just the right length. --- src/cli/configPanel.py | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/cli/configPanel.py b/src/cli/configPanel.py index e4a48fc..2e8e1c1 100644 --- a/src/cli/configPanel.py +++ b/src/cli/configPanel.py @@ -601,11 +601,11 @@ class ConfigPanel(panel.Panel): if i != descriptionHeight - 1: # there's more lines to display - msg, remainder = uiTools.cropStr(lineContent, width - 2, 4, 4, uiTools.Ending.HYPHEN, True) + msg, remainder = uiTools.cropStr(lineContent, width - 3, 4, 4, uiTools.Ending.HYPHEN, True) descriptionContent = remainder.strip() + descriptionContent else: # this is the last line, end it with an ellipse - msg = uiTools.cropStr(lineContent, width - 2, 4, 4) + msg = uiTools.cropStr(lineContent, width - 3, 4, 4) self.addstr(3 + i, 2, msg, selectionFormat)

1 0

[arm/master] Periodically refreshing display
by atagar＠torproject.org 09 Aug '11

09 Aug '11

commit 3f93c66d2536ae85a0880b98425fedb507ad8503 Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Aug 8 08:30:48 2011 -0700 Periodically refreshing display On some platforms the terminal gets into a screwed up state, displaying scrambled content (I haven't reproduced this on my system, but seen it on an Ubuntu netbook). Redrawing the display, reguardless of if the content has changed every five seconds so this glitches will correct themselves. Arm had previously done this but I took it out when the display code had stabilized (to cut down on load). However, this doesn't have a noticeable cpu cost so might as well put it back. This also simplifies some of the redrawing logic, centralizing it in the controller. --- armrc.sample | 5 ++ src/cli/controller.py | 75 +++++++++++++++++++----------------- src/cli/graphing/bandwidthStats.py | 2 +- src/cli/graphing/graphPanel.py | 2 +- src/cli/headerPanel.py | 2 +- src/cli/menu/item.py | 2 +- src/cli/menu/menu.py | 2 +- src/cli/wizard.py | 6 +- 8 files changed, 53 insertions(+), 43 deletions(-) diff --git a/armrc.sample b/armrc.sample index 1edd024..d547b6c 100644 --- a/armrc.sample +++ b/armrc.sample @@ -57,6 +57,11 @@ features.showFdUsage false # Seconds to wait on user input before refreshing content features.redrawRate 5 +# Rate (seconds) to periodically redraw the screen, disabled if zero. This +# shouldn't be necessary, but can correct issues if the terminal gets into a +# funky state. +features.refreshRate 5 + # Confirms promt to confirm when quiting if true features.confirmQuit true diff --git a/src/cli/controller.py b/src/cli/controller.py index 1554949..d2c9d73 100644 --- a/src/cli/controller.py +++ b/src/cli/controller.py @@ -37,6 +37,7 @@ CONFIG = {"startup.events": "N3", "features.panels.show.config": True, "features.panels.show.torrc": True, "features.redrawRate": 5, + "features.refreshRate": 5, "features.confirmQuit": True, "features.graph.type": 1, "features.graph.bw.prepopulate": True, @@ -171,6 +172,7 @@ class Controller: self._forceRedraw = False self._isDone = False self._torManager = TorManager(self) + self._lastDrawn = 0 self.setMsg() # initializes our control message def getScreen(self): @@ -310,39 +312,49 @@ class Controller: return allPanels - def requestRedraw(self, immediate = False): + def redraw(self, force = True): """ - Requests that all content is redrawn when the interface is next rendered. + Redraws the displayed panel content. Arguments: - immediate - redraws now if true, otherwise waits for when next normally - drawn + force - redraws reguardless of if it's needed if true, otherwise ignores + the request when there arne't changes to be displayed """ - if immediate: - displayPanels = self.getDisplayPanels() - - occupiedContent = 0 - for panelImpl in displayPanels: - panelImpl.setTop(occupiedContent) - occupiedContent += panelImpl.getHeight() - - for panelImpl in displayPanels: - panelImpl.redraw(True) - else: - self._forceRedraw = True + force |= self._forceRedraw + self._forceRedraw = False + + currentTime = time.time() + if CONFIG["features.refreshRate"] != 0: + if self._lastDrawn + CONFIG["features.refreshRate"] <= currentTime: + force = True + + displayPanels = self.getDisplayPanels() + + occupiedContent = 0 + for panelImpl in displayPanels: + panelImpl.setTop(occupiedContent) + occupiedContent += panelImpl.getHeight() + + for panelImpl in displayPanels: + panelImpl.redraw(force) + + if force: self._lastDrawn = currentTime - def isRedrawRequested(self, clearFlag = False): + def requestRedraw(self): + """ + Requests that all content is redrawn when the interface is next rendered. """ - True if a full redraw has been requested, false otherwise. - Arguments: - clearFlag - request clears the flag if true + self._forceRedraw = True + + def getLastRedrawTime(self): + """ + Provides the time when the content was last redrawn, zero if the content + has never been drawn. """ - returnValue = self._forceRedraw - if clearFlag: self._forceRedraw = False - return returnValue + return self._lastDrawn def setMsg(self, msg = None, attr = None, redraw = False): """ @@ -612,7 +624,9 @@ def startTorMonitor(startTime): # initializes interface configs config = conf.getConfig("arm") - config.update(CONFIG) + config.update(CONFIG, { + "features.redrawRate": 1, + "features.refreshRate": 0}) cli.graphing.graphPanel.loadConfig(config) cli.connections.connEntry.loadConfig(config) @@ -710,17 +724,8 @@ def drawTorMonitor(stdscr, startTime): for panelImpl in control.getAllPanels(): panelImpl.setVisible(panelImpl in displayPanels) - # panel placement - occupiedContent = 0 - for panelImpl in displayPanels: - panelImpl.setTop(occupiedContent) - occupiedContent += panelImpl.getHeight() - - # redraws visible content - forceRedraw = control.isRedrawRequested(True) - for panelImpl in displayPanels: - panelImpl.redraw(forceRedraw) - + # redraws the interface if it's needed + control.redraw(False) stdscr.refresh() # wait for user keyboard input until timeout, unless an override was set diff --git a/src/cli/graphing/bandwidthStats.py b/src/cli/graphing/bandwidthStats.py index 654443c..9782d9f 100644 --- a/src/cli/graphing/bandwidthStats.py +++ b/src/cli/graphing/bandwidthStats.py @@ -100,7 +100,7 @@ class BandwidthStats(graphPanel.GraphStats): self.isAccounting = isAccountingEnabled # redraws the whole screen since our height changed - cli.controller.getController().requestRedraw(True) + cli.controller.getController().redraw() # redraws to reflect changes (this especially noticeable when we have # accounting and shut down since it then gives notice of the shutdown) diff --git a/src/cli/graphing/graphPanel.py b/src/cli/graphing/graphPanel.py index b080871..76221ff 100644 --- a/src/cli/graphing/graphPanel.py +++ b/src/cli/graphing/graphPanel.py @@ -324,7 +324,7 @@ class GraphPanel(panel.Panel): self.setGraphHeight(self.graphHeight - 1) elif uiTools.isSelectionKey(key): break - control.requestRedraw(True) + control.redraw() finally: control.setMsg() panel.CURSES_LOCK.release() diff --git a/src/cli/headerPanel.py b/src/cli/headerPanel.py index e64a6de..4e78f6c 100644 --- a/src/cli/headerPanel.py +++ b/src/cli/headerPanel.py @@ -427,7 +427,7 @@ class HeaderPanel(panel.Panel, threading.Thread): # We're toggling between being a relay and client, causing the height # of this panel to change. Redraw all content so we don't get # overlapping content. - cli.controller.getController().requestRedraw(True) + cli.controller.getController().redraw() else: # just need to redraw ourselves self.redraw(True) diff --git a/src/cli/menu/item.py b/src/cli/menu/item.py index f46cdbb..1ed3f1f 100644 --- a/src/cli/menu/item.py +++ b/src/cli/menu/item.py @@ -58,7 +58,7 @@ class MenuItem(): if self._callback: control = cli.controller.getController() control.setMsg() - control.requestRedraw(True) + control.redraw() self._callback() return True diff --git a/src/cli/menu/menu.py b/src/cli/menu/menu.py index 8302551..a93a1e0 100644 --- a/src/cli/menu/menu.py +++ b/src/cli/menu/menu.py @@ -114,7 +114,7 @@ def showMenu(): cursor.handleKey(key) # redraws the rest of the interface if we're rendering on it again - if not cursor.isDone(): control.requestRedraw(True) + if not cursor.isDone(): control.redraw() finally: control.setMsg() cli.popups.finalize() diff --git a/src/cli/wizard.py b/src/cli/wizard.py index f0c14a8..82b2825 100644 --- a/src/cli/wizard.py +++ b/src/cli/wizard.py @@ -342,7 +342,7 @@ def showWizard(): generatedTorrc = getTorrc(relayType, config, disabledOpt) torrcLocation = manager.getTorrcPath() - controller.requestRedraw(True) + controller.redraw() confirmationSelection = showConfirmationDialog(generatedTorrc, torrcLocation) if confirmationSelection == NEXT: @@ -463,7 +463,7 @@ def showWizard(): elif confirmationSelection == CANCEL: break # redraws screen to clear away the dialog we just showed - cli.controller.getController().requestRedraw(True) + cli.controller.getController().redraw() def promptRelayType(initialSelection): """ @@ -621,7 +621,7 @@ def promptConfigOptions(relayType, config, disabledOpt): try: options[selection].setValue(newValue.strip()) except ValueError, exc: cli.popups.showMsg(str(exc), 3) - cli.controller.getController().requestRedraw(True) + cli.controller.getController().redraw() elif key == 27: selection, key = -1, curses.KEY_ENTER # esc - cancel finally: cli.popups.finalize()

1 0

[arm/master] Forcing redraw when user presses ctrl+L
by atagar＠torproject.org 09 Aug '11

09 Aug '11

commit 38c2f3662ac8858fabc54a5826c1af601590c9b0 Author: Damian Johnson <atagar(a)torproject.org> Date: Mon Aug 8 08:50:15 2011 -0700 Forcing redraw when user presses ctrl+L Triggering a manual redraw when the user presses ctrl+L, which is expected of terminal applications. This addresses: https://trac.torproject.org/projects/tor/ticket/2830 --- src/cli/controller.py | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/src/cli/controller.py b/src/cli/controller.py index d2c9d73..8b87b1d 100644 --- a/src/cli/controller.py +++ b/src/cli/controller.py @@ -765,6 +765,9 @@ def drawTorMonitor(stdscr, startTime): overrideKey = cli.popups.showHelpPopup() elif key == ord('w') or key == ord('W'): cli.wizard.showWizard() + elif key == ord('l') - 96: + # force redraw when ctrl+l is pressed + control.redraw() else: for panelImpl in displayPanels: isKeystrokeConsumed = panelImpl.handleKey(key)

1 0

[tor/master] Make --quiet and --hush apply to default logs, not only initial logs
by nickm＠torproject.org 09 Aug '11

09 Aug '11

commit e5e7b6d71835841f037841ea60cb4f39b554b892 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Aug 4 14:23:51 2011 -0400 Make --quiet and --hush apply to default logs, not only initial logs Fixes bug 3550; bugfix on 0.2.0.10-alpha (where --quiet was introduced). --- changes/bug3550 | 5 +++++ src/or/config.c | 11 +++++++++-- src/or/main.c | 7 +++++++ 3 files changed, 21 insertions(+), 2 deletions(-) diff --git a/changes/bug3550 b/changes/bug3550 new file mode 100644 index 0000000..658179f --- /dev/null +++ b/changes/bug3550 @@ -0,0 +1,5 @@ + o Minor bugfixes: + - The "--quiet" and "--hush" options now apply not only to Tor's + behavior before user-configured logs are added, but also to + Tor's behavior in the absense of configured logs. Fixes bug + 3550; bugfix on 0.2.0.10-alpha. diff --git a/src/or/config.c b/src/or/config.c index 088617b..ddce958 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -40,6 +40,9 @@ #include "procmon.h" +/* From main.c */ +extern int quiet_level; + /** Enumeration of types which option values can take */ typedef enum config_type_t { CONFIG_TYPE_STRING = 0, /**< An arbitrary string. */ @@ -3095,8 +3098,12 @@ options_validate(or_options_t *old_options, or_options_t *options, "misconfigured or something else goes wrong."); /* Special case on first boot if no Log options are given. */ - if (!options->Logs && !options->RunAsDaemon && !from_setconf) - config_line_append(&options->Logs, "Log", "notice stdout"); + if (!options->Logs && !options->RunAsDaemon && !from_setconf) { + if (quiet_level == 0) + config_line_append(&options->Logs, "Log", "notice stdout"); + else if (quiet_level == 1) + config_line_append(&options->Logs, "Log", "warn stdout"); + } if (options_init_logs(options, 1)<0) /* Validate the log(s) */ REJECT("Failed to validate Log options. See logs for details."); diff --git a/src/or/main.c b/src/or/main.c index 54e6451..260de16 100644 --- a/src/or/main.c +++ b/src/or/main.c @@ -154,6 +154,12 @@ int can_complete_circuit=0; * they are obsolete? */ #define TLS_HANDSHAKE_TIMEOUT (60) +/** Decides our behavior when no logs are configured/before any + * logs have been configured. For 0, we log notice to stdout as normal. + * For 1, we log warnings only. For 2, we log nothing. + */ +int quiet_level = 0; + /********* END VARIABLES ************/ /**************************************************************************** @@ -2148,6 +2154,7 @@ tor_init(int argc, char *argv[]) default: add_temp_log(LOG_NOTICE); } + quiet_level = quiet; log(LOG_NOTICE, LD_GENERAL, "Tor v%s. This is experimental software. " "Do not rely on it for strong anonymity. (Running on %s)",get_version(),

1 0

[tor/master] Merge remote-tracking branch 'public/bug3550'
by nickm＠torproject.org 09 Aug '11

09 Aug '11

commit a72b1815e83fcd7d24731b9a41f956267e8780fc Merge: cb24a06 e5e7b6d Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 8 10:05:41 2011 -0400 Merge remote-tracking branch 'public/bug3550' changes/bug3550 | 5 +++++ src/or/config.c | 11 +++++++++-- src/or/main.c | 7 +++++++ 3 files changed, 21 insertions(+), 2 deletions(-)

1 0

[tor/master] Fix log message typo
by nickm＠torproject.org 08 Aug '11

08 Aug '11

commit 52421e91014ee8c1d105bb07b336c95a64dc557f Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sat Aug 6 00:25:07 2011 -0700 Fix log message typo --- src/or/connection_edge.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index ae2dfd2..971cee2 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -3528,7 +3528,7 @@ connection_edge_update_circuit_isolation(const edge_connection_t *conn, return mixed; if ((mixed & conn->isolation_flags) != 0) { - log_warn(LD_BUG, "Updating a circuit with seemingly incomaptible " + log_warn(LD_BUG, "Updating a circuit with seemingly incompatible " "isolation flags."); } circ->isolation_flags_mixed |= mixed;

1 0

[tor/master] Fix handling of ISO_STREAM
by nickm＠torproject.org 08 Aug '11

08 Aug '11

commit cab3641638540834a0867f26eb5b432fd793fd5e Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sat Aug 6 13:42:32 2011 -0700 Fix handling of ISO_STREAM Now we track *which* stream with ISO_STREAM set is associated to a particular circuit, so that we won't think that stream is incompatible with its circuit and launch another one a second later, and we use that same field to mark circuits which have had an ISO_STREAM stream attached to them, so that we won't ever put a second stream on that circuit. Fixes bug 3695. --- src/or/connection_edge.c | 9 ++++++--- src/or/or.h | 3 +++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 971cee2..37a695c 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -3432,9 +3432,9 @@ connection_edge_compatible_with_circuit(const edge_connection_t *conn, tor_strdup(conn->socks_request->address); } - /* If isolation_values_set, then the circuit is not compatible with - * any new ISO_STREAM stream. */ - if (iso & ISO_STREAM) + if ((iso & ISO_STREAM) && + (circ->associated_isolated_stream_global_id != + TO_CONN(conn)->global_identifier)) return 0; if ((iso & ISO_DESTPORT) && conn->socks_request->port != circ->dest_port) @@ -3487,6 +3487,8 @@ connection_edge_update_circuit_isolation(const edge_connection_t *conn, if (!circ->isolation_values_set) { if (dry_run) return -1; + circ->associated_isolated_stream_global_id = + TO_CONN(conn)->global_identifier; circ->dest_port = conn->socks_request->port; circ->dest_address = tor_strdup(conn->original_dest_address); circ->client_proto_type = conn->socks_request->listener_type; @@ -3562,6 +3564,7 @@ circuit_clear_isolation(origin_circuit_t *circ) circ->isolation_values_set = 0; circ->isolation_flags_mixed = 0; + circ->associated_isolated_stream_global_id = 0; circ->client_proto_type = 0; circ->client_proto_socksver = 0; circ->dest_port = 0; diff --git a/src/or/or.h b/src/or/or.h index eb271b5..9c5d354 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -2530,6 +2530,9 @@ typedef struct origin_circuit_t { socks_username_len and socks_password_len for their lengths. */ char *socks_username; char *socks_password; + /** Global identifier for the first stream attached here; used by + * ISO_STREAM. */ + uint64_t associated_isolated_stream_global_id; /**@}*/ } origin_circuit_t;

1 0

[tor/master] Remove connection_edge_streams_are_compatible
by nickm＠torproject.org 08 Aug '11

08 Aug '11

commit cb24a06a3e1825001ea97f1a19249dade2f68215 Author: Robert Ransom <rransom.8774(a)gmail.com> Date: Sat Aug 6 13:44:28 2011 -0700 Remove connection_edge_streams_are_compatible It's dead code (not used anywhere by the current proposal 171 algorithm). --- src/or/connection_edge.c | 52 ---------------------------------------------- src/or/connection_edge.h | 2 - 2 files changed, 0 insertions(+), 54 deletions(-) diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 37a695c..7dd6ee0 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -3346,58 +3346,6 @@ memeq_opt(const char *a, size_t alen, const char *b, size_t blen) } } -/** Return true iff <b>a</b> and <b>b</b> have isolation rules and fields that - * make it permissible to put them on the same circuit.*/ -int -connection_edge_streams_are_compatible(const edge_connection_t *a, - const edge_connection_t *b) -{ - const uint8_t iso = a->isolation_flags | b->isolation_flags; - const socks_request_t *a_sr = a->socks_request; - const socks_request_t *b_sr = b->socks_request; - - if (! a->original_dest_address) { - log_warn(LD_BUG, "Reached connection_edge_streams_are_compatible without " - "having set a->original_dest_address"); - ((edge_connection_t*)a)->original_dest_address = - tor_strdup(a->socks_request->address); - } - if (! b->original_dest_address) { - log_warn(LD_BUG, "Reached connection_edge_streams_are_compatible without " - "having set b->original_dest_address"); - ((edge_connection_t*)b)->original_dest_address = - tor_strdup(a->socks_request->address); - } - - if (iso & ISO_STREAM) - return 0; - - if ((iso & ISO_DESTPORT) && a->socks_request->port != b->socks_request->port) - return 0; - if ((iso & ISO_DESTADDR) && - strcasecmp(a->original_dest_address, b->original_dest_address)) - return 0; - if ((iso & ISO_SOCKSAUTH) && - (! memeq_opt(a_sr->username, a_sr->usernamelen, - b_sr->username, b_sr->usernamelen) || - ! memeq_opt(a_sr->password, a_sr->passwordlen, - b_sr->password, b_sr->passwordlen))) - return 0; - if ((iso & ISO_CLIENTPROTO) && - (a->socks_request->listener_type != b->socks_request->listener_type || - a->socks_request->socks_version != b->socks_request->socks_version)) - return 0; - if ((iso & ISO_CLIENTADDR) && - !tor_addr_eq(&TO_CONN(a)->addr, &TO_CONN(b)->addr)) - return 0; - if ((iso & ISO_SESSIONGRP) && a->session_group != b->session_group) - return 0; - if ((iso & ISO_NYM_EPOCH) && a->nym_epoch != b->nym_epoch) - return 0; - - return 1; -} - /** * Return true iff none of the isolation flags and fields in <b>conn</b> * should prevent it from being attached to <b>circ</b>. diff --git a/src/or/connection_edge.h b/src/or/connection_edge.h index 85293a0..36aead1 100644 --- a/src/or/connection_edge.h +++ b/src/or/connection_edge.h @@ -105,8 +105,6 @@ hostname_type_t parse_extended_hostname(char *address, int allowdotexit); int get_pf_socket(void); #endif -int connection_edge_streams_are_compatible(const edge_connection_t *a, - const edge_connection_t *b); int connection_edge_compatible_with_circuit(const edge_connection_t *conn, const origin_circuit_t *circ); int connection_edge_update_circuit_isolation(const edge_connection_t *conn,

1 0

r24946: {website} apply patch from jeremy to fix the project layout, standardi (in website/trunk: css en images)
by Andrew Lewman 08 Aug '11

08 Aug '11

Author: phobos Date: 2011-08-07 21:16:31 +0000 (Sun, 07 Aug 2011) New Revision: 24946 Modified: website/trunk/css/layout-rtl.css website/trunk/css/layout.css website/trunk/css/typography.css website/trunk/en/index.wml website/trunk/images/icon-Arm.jpg website/trunk/images/icon-Tails.jpg website/trunk/images/icon-TorBrowser.jpg website/trunk/images/icon-TorButton.jpg website/trunk/images/icon-TorCheck.jpg website/trunk/images/icon-TorStatus.jpg website/trunk/images/icon-Vidalia.jpg Log: apply patch from jeremy to fix the project layout, standardize project icons, and css fixes for both rtl and ltr languages. Modified: website/trunk/css/layout-rtl.css =================================================================== --- website/trunk/css/layout-rtl.css 2011-08-04 17:48:07 UTC (rev 24945) +++ website/trunk/css/layout-rtl.css 2011-08-07 21:16:31 UTC (rev 24946) @@ -181,6 +181,15 @@ background-position: left top; } +.project { + float: right; + } + +.project img { + margin-right: 0px; + margin-left: 6px; + } + .meta { float: left; } Modified: website/trunk/css/layout.css =================================================================== --- website/trunk/css/layout.css 2011-08-04 17:48:07 UTC (rev 24945) +++ website/trunk/css/layout.css 2011-08-07 21:16:31 UTC (rev 24946) @@ -417,13 +417,34 @@ text-align: center; padding: 4px 0; } - .fauxhead { background: url(../images/table-arrow.jpg) right top no-repeat; width: 100%; height: 11px; } +#home-our-projects td { + height: 92px; + width: 296px; + padding: 6px; + } + +.project { + float: left; + padding: 6px; + border: 1px solid #CAC8A7; + height: 76px; + width: 284px; + -webkit-border-radius: 10px; + -moz-border-radius: 10px; + border-radius: 10px; + } + +.project img { + border: none; + margin-right: 6px; + } + .beige { background: #f5f5df; } .gray { background: #e0e0e0; } @@ -502,7 +523,7 @@ } .featured-project { width: 313px; } - + /* FORM ------------*/ input, select { @@ -662,13 +683,13 @@ text-align: center; color: #222222; border: 2px solid #cbcbaf; - background-color: #ffffed; + background-color: #ffffed; padding: 20px 20px; width: 163px; margin: 0px 0px 0px 10px; - -webkit-border-radius: 5px; - -moz-border-radius: 5px; - border-radius: 5px; + -webkit-border-radius: 5px; + -moz-border-radius: 5px; + border-radius: 5px; } .dbox p { @@ -697,18 +718,18 @@ .dbox input:focus , .dbox select:focus { - -moz-box-shadow: 0px 0px 4px #cbcbaf; - -webkit-box-shadow: 0px 0px 4px #cbcbaf; - box-shadow: 0px 0px 4px #cbcbaf; - border:2px solid #cbcbaf; - background-color: #FFFFFF; - } + -moz-box-shadow: 0px 0px 4px #cbcbaf; + -webkit-box-shadow: 0px 0px 4px #cbcbaf; + box-shadow: 0px 0px 4px #cbcbaf; + border:2px solid #cbcbaf; + background-color: #FFFFFF; + } .dbox input.radio { - border: 0px solid; - background: #ffffed; - padding: 0px 0px; - } + border: 0px solid; + background: #ffffed; + padding: 0px 0px; + } .dbox select.cur { margin-right: 5px; @@ -733,14 +754,14 @@ width: 122px; margin-top: 0px; display: block; - background-color: transparent; - color: transparent; - border:0px solid transparent; - -webkit-border-radius: 5px; - -moz-border-radius: 5px; - border-radius: 5px; - margin: 10px auto 10px auto; - padding: 0px 0px 0px 0px; + background-color: transparent; + color: transparent; + border:0px solid transparent; + -webkit-border-radius: 5px; + -moz-border-radius: 5px; + border-radius: 5px; + margin: 10px auto 10px auto; + padding: 0px 0px 0px 0px; } .dbox span { @@ -847,9 +868,9 @@ width: 115px; margin-top: -3px; display: inline-block; - background-color: transparent; - color: transparent; - border:0px solid transparent; + background-color: transparent; + color: transparent; + border:0px solid transparent; } .dbox.dsmall { @@ -868,9 +889,9 @@ height: auto; margin-top: 0px; display: block; - background-color: transparent; - color: transparent; - border:0px solid transparent; + background-color: transparent; + color: transparent; + border:0px solid transparent; } .dbox.dsmall div label { Modified: website/trunk/css/typography.css =================================================================== --- website/trunk/css/typography.css 2011-08-04 17:48:07 UTC (rev 24945) +++ website/trunk/css/typography.css 2011-08-07 21:16:31 UTC (rev 24946) @@ -216,6 +216,11 @@ padding-left: 10px; margin: 0; } + +.project p { + line-height: 18px; +} + table h3 { font-size: 1.167em; } table p { margin: 0; Modified: website/trunk/en/index.wml =================================================================== --- website/trunk/en/index.wml 2011-08-04 17:48:07 UTC (rev 24945) +++ website/trunk/en/index.wml 2011-08-07 21:16:31 UTC (rev 24946) @@ -57,17 +57,21 @@ license: LGPL v2 --> <td> + <div class="project"> <a href="http://tails.boum.org/"><img src="$(IMGROOT)/icon-Tails.jpg" alt="Tails Icon"></a> <h3><a href="http://tails.boum.org/">Tails</a></h3> <p>Live CD/USB distribution preconfigured to use Tor safely.</p> + </div> </td> <td> + <div class="project"> <a href="https://guardianproject.info/apps/orbot/"><img src="$(IMGROOT)/icon-Orbot.jpg" alt="Orbot Icon"></a> <h3><a href="https://guardianproject.info/apps/orbot/">Orbot</a></h3> <p>Tor for <a href="https://code.google.com/android/">Google Android</a> devices.</p> + </div> </td> </tr> <tr> @@ -77,10 +81,12 @@ license: LGPL v3 --> <td> + <div class="project"> <a href="http://torstatus.blutmagie.de/"><img src="$(IMGROOT)/icon-TorStatus.jpg" alt="TorStatus Icon"></a> <h3><a href="http://torstatus.blutmagie.de/">TorStatus</a></h3> <p>Site providing an overview of the Tor network.</p> + </div> </td>  <td> + <div class="project"> <a href="http://www.atagar.com/arm/"><img src="$(IMGROOT)/icon-Arm.jpg" alt="Arm Icon"></a> <h3><a href="http://www.atagar.com/arm/">Arm</a></h3> <p>Terminal application for monitoring and configuring Tor.</p> + </div> </td> </tr> <tr> <td> + <div class="project"> <a href="<page torbutton/index>"><img src="$(IMGROOT)/icon-TorButton.jpg" alt="Torbutton Icon"></a> <h3><a href="<page torbutton/index>">Torbutton</a></h3> <p>Torbutton is a 1-click way for Firefox users to enable or disable Tor in Firefox.</p> + </div> </td> <td> + <div class="project"> <a href="https://check.torproject.org/"><img src="$(IMGROOT)/icon-TorCheck.jpg" alt="Tor Check Icon"></a> <h3><a href="https://check.torproject.org/">Check</a></h3> <p>Check determines if you are successfully browsing with Tor.</p> + </div> </td> </tr> <tr> <td> + <div class="project"> <a href="<page projects/vidalia>"><img src="$(IMGROOT)/icon-Vidalia.jpg" alt="Vidalia Icon"></a> <h3><a href="<page projects/vidalia>">Vidalia</a></h3> <p>Vidalia is a graphical way to control and view Tor's connections and settings.</p> + </div> </td> <td> + <div class="project"> <a href="<page projects/torbrowser>"><img src="$(IMGROOT)/icon-TorBrowser.jpg" alt="TorBrowser Icon"></a> <h3><a href="<page projects/torbrowser>">Tor Browser</a></h3> <p>Tor Browser contains everything you need to safely browse the Internet. </p> + </div> </td> </tr> </table> Modified: website/trunk/images/icon-Arm.jpg =================================================================== (Binary files differ) Modified: website/trunk/images/icon-Tails.jpg =================================================================== (Binary files differ) Modified: website/trunk/images/icon-TorBrowser.jpg =================================================================== (Binary files differ) Modified: website/trunk/images/icon-TorButton.jpg =================================================================== (Binary files differ) Modified: website/trunk/images/icon-TorCheck.jpg =================================================================== (Binary files differ) Modified: website/trunk/images/icon-TorStatus.jpg =================================================================== (Binary files differ) Modified: website/trunk/images/icon-Vidalia.jpg =================================================================== (Binary files differ)

1 0

[arm/master] Scripts for overriding system wide torrc
by atagar＠torproject.org 07 Aug '11

07 Aug '11

commit 881ae570ebbc486376ec1fe36488804c93a7976e Author: Damian Johnson <atagar(a)torproject.org> Date: Tue Jul 26 18:20:52 2011 -0700 Scripts for overriding system wide torrc Editing scripts made by Jake for overriding a root owned system wide torrc with an alternate made by arm. For more information see: https://trac.torproject.org/projects/tor/ticket/3629 --- src/resources/torrc-override/override.c | 50 ++++++ src/resources/torrc-override/override.h | 1 + src/resources/torrc-override/override.py | 265 ++++++++++++++++++++++++++++++ 3 files changed, 316 insertions(+), 0 deletions(-) diff --git a/src/resources/torrc-override/override.c b/src/resources/torrc-override/override.c new file mode 100644 index 0000000..b989584 --- /dev/null +++ b/src/resources/torrc-override/override.c @@ -0,0 +1,50 @@ +// +// This is a very small C wrapper that invokes +// $(DESTDIR)/usr/bin/tor-arm-replace-torrc.py to work around setuid scripting +// issues on the Gnu/Linux operating system. +// +// We assume you have installed it as such for GROUP +// "debian-arm" - This should ensure that only members of the GROUP group will +// be allowed to run this program. When run this program will execute the +// $(DESTDIR)/usr/bin/tor-arm-replace-torrc.py program and will run with the +// uid and group as marked by the OS. +// +// Compile it like so: +// +// make +// +// Or by hand like so: +// +// gcc -o tor-arm-replace-torrc tor-arm-replace-torrc.c +// +// Make it useful like so: +// +// chown root:debian-arm tor-arm-replace-torrc +// chmod 04750 tor-arm-replace-torrc +// +// !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!WARNING!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +// XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +// +// If you place a user inside of the $GROUP - they are now able to reconfigure +// Tor. This may lead them to do nasty things on your system. If you start Tor +// as root, you should consider that adding a user to $GROUP is similar to +// giving those users root directly. +// +// This program was written simply to help a users who run arm locally and is +// not required if arm is communicating with a remote Tor process. +// +// XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX +// !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!WARNING!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +// +// + +#include <stdio.h> +#include <stdlib.h> +#include <sys/types.h> +#include <unistd.h> +#include "tor-arm-replace-torrc.h" + +int main() +{ + return execve(TOR_ARM_REPLACE_TORRC, NULL, NULL); +} diff --git a/src/resources/torrc-override/override.h b/src/resources/torrc-override/override.h new file mode 100644 index 0000000..65adc9d --- /dev/null +++ b/src/resources/torrc-override/override.h @@ -0,0 +1 @@ +#define TOR_ARM_REPLACE_TORRC HELPER_NAME diff --git a/src/resources/torrc-override/override.py b/src/resources/torrc-override/override.py new file mode 100755 index 0000000..6cfdbc6 --- /dev/null +++ b/src/resources/torrc-override/override.py @@ -0,0 +1,265 @@ +#!/usr/bin/python + +""" +This overwrites the system wide torrc, located at /etc/tor/torrc, with the +contents of the ARM_CONFIG_FILE. The system wide torrc is owned by root so +this will effectively need root permissions and for us to be in GROUP. + +This file is completely unusable until we make a tor-arm user and perform +other prep by running with the '--init' argument. + +After that's done this is meant to either be used by arm automatically after +writing a torrc to ARM_CONFIG_FILE or by users manually. For arm to use this +automatically you'll either need to... + +- compile torrc-override.c, setuid on the binary, and move it to your path + cd /usr/share/arm/resources/torrc-override + make + chown root:tor-arm override + chmod 04750 override + mv override /usr/bin/torrc-override + +- allow passwordless sudo for this script + edit /etc/sudoers and add a line with: + <arm user> ALL= NOPASSWD: /usr/share/arm/resources/torrc-override/override.py + +To perform this manually run: +/usr/share/arm/resources/torrc-override/override.py +pkill -sighup tor +""" + +import os +import sys +import grp +import pwd +import time +import shutil +import tempfile +import signal + +USER = "tor-arm" +GROUP = "tor-arm" +TOR_CONFIG_FILE = "/etc/tor/torrc" +ARM_CONFIG_FILE = "/var/lib/tor-arm/torrc" + +HELP_MSG = """Usage %s [OPTION] + Backup the system wide torrc (%s) and replace it with the + contents of %s. + + --init creates the necessary user and paths + --remove reverts changes made with --init +""" % (os.path.basename(sys.argv[0]), TOR_CONFIG_FILE, ARM_CONFIG_FILE) + +def init(): + """ + Performs system preparation needed for this script to run, adding the tor-arm + user and setting up paths/permissions. + """ + + # the following is just here if we have a custom destination directory (which + # arm doesn't currently account for) + if not os.path.exists("/bin/"): + print "making '/bin'..." + os.mkdir("/bin") + + if not os.path.exists("/var/lib/tor-arm/"): + print "making '/var/lib/tor-arm'..." + os.makedirs("/var/lib/tor-arm") + + if not os.path.exists("/var/lib/tor-arm/torrc"): + print "making '/var/lib/tor-arm/torrc'..." + open("/var/lib/tor-arm/torrc", 'w').close() + + try: gid = grp.getgrnam(GROUP).gr_gid + except KeyError: + print "adding %s group..." % GROUP + os.system("addgroup --quiet --system %s" % GROUP) + gid = grp.getgrnam(GROUP).gr_gid + print " done, gid: %s" % gid + + try: pwd.getpwnam(USER).pw_uid + except KeyError: + print "adding %s user..." % USER + os.system("adduser --quiet --ingroup %s --no-create-home --home /var/lib/tor-arm/ --shell /bin/sh --system %s" % (GROUP, USER)) + uid = pwd.getpwnam(USER).pw_uid + print " done, uid: %s" % uid + + os.chown("/bin", 0, 0) + os.chown("/var/lib/tor-arm", 0, gid) + os.chmod("/var/lib/tor-arm", 0750) + os.chown("/var/lib/tor-arm/torrc", 0, gid) + os.chmod("/var/lib/tor-arm/torrc", 0760) + +def remove(): + """ + Reverts the changes made by init, and also removes the optional + /bin/torrc-override binary if it exists. + """ + + print "removing %s user..." % USER + os.system("deluser --quiet %s" % USER) + + print "removing %s group..." % GROUP + os.system("delgroup --quiet %s" % GROUP) + + # might not exist since this is compiled and placed separately + try: + print "removing '/bin/torrc-override'..." + os.remove("/bin/torrc-override") + except OSError: + print " no such path" + + try: + print "removing '/var/lib/tor-arm'..." + shutil.rmtree("/var/lib/tor-arm/") + except Exception, exc: + print " unsuccessful: %s" % exc + +def replaceTorrc(): + orig_uid = os.getuid() + orig_euid = os.geteuid() + + # the USER and GROUP must exist on this system + try: + dropped_uid = pwd.getpwnam(USER).pw_uid + dropped_gid = grp.getgrnam(GROUP).gr_gid + dropped_euid, dropped_egid = dropped_uid, dropped_gid + except KeyError: + print "tor-arm user and group was not found, have you run this script with '--init'?" + exit(1) + + # if we're actually root, we skip this group check + # root can get away with all of this + if orig_uid != 0: + # check that the user is in GROUP + if not dropped_gid in os.getgroups(): + print "Your user needs to be a member of the %s group for this to work" % GROUP + sys.exit(1) + + # drop to the unprivileged group, and lose the rest of the groups + os.setgid(dropped_gid) + os.setegid(dropped_egid) + os.setresgid(dropped_gid, dropped_egid, dropped_gid) + os.setgroups([dropped_gid]) + + # make a tempfile and write out the contents + try: + tf = tempfile.NamedTemporaryFile(delete=False) # uses mkstemp internally + + # allows our child process to write to tf.name (not only if their uid matches, not their gid) + os.chown(tf.name, dropped_uid, orig_euid) + except: + print "We were unable to make a temporary file" + sys.exit(1) + + fork_pid = os.fork() + + # open the suspect config after we drop privs + # we assume the dropped privs are still enough to write to the tf + if (fork_pid == 0): + signal.signal(signal.SIGCHLD, signal.SIG_IGN) + + # Drop privs forever in the child process + # I believe this drops os.setfsuid os.setfsgid stuff + # Clear all other supplemental groups for dropped_uid + os.setgroups([dropped_gid]) + os.setresgid(dropped_gid, dropped_egid, dropped_gid) + os.setresuid(dropped_uid, dropped_euid, dropped_uid) + os.setgid(dropped_gid) + os.setegid(dropped_egid) + os.setuid(dropped_uid) + os.seteuid(dropped_euid) + + try: + af = open(ARM_CONFIG_FILE) # this is totally unpriv'ed + + # ensure that the fd we opened has the properties we requrie + configStat = os.fstat(af.fileno()) # this happens on the unpriv'ed FD + if configStat.st_gid != dropped_gid: + print "Arm's configuration file (%s) must be owned by the group %s" % (ARM_CONFIG_FILE, GROUP) + sys.exit(1) + + # if everything checks out, we're as safe as we're going to get + armConfig = af.read(1024 * 1024) # limited read but not too limited + af.close() + tf.file.write(armConfig) + tf.flush() + except: + print "Unable to open the arm config as unpriv'ed user" + sys.exit(1) + finally: + tf.close() + sys.exit(0) + else: + # If we're here, we're in the parent waiting for the child's death + # man, unix is really weird... + _, status = os.waitpid(fork_pid, 0) + + if status != 0: + print "The child seems to have failed; exiting!" + tf.close() + sys.exit(1) + + # attempt to verify that the config is OK + if os.path.exists(tf.name): + # construct our SU string + SUSTRING = "su -c 'tor --verify-config -f " + str(tf.name) + "' " + USER + # We raise privs to drop them with 'su' + os.setuid(0) + os.seteuid(0) + os.setgid(0) + os.setegid(0) + # We drop privs here and exec tor to verify it as the dropped_uid + print "Using Tor to verify that arm will not break Tor's config:" + success = os.system(SUSTRING) + if success != 0: + print "Tor says the new configuration file is invalid: %s (%s)" % (ARM_CONFIG_FILE, tf.name) + sys.exit(1) + + # backup the previous tor config + if os.path.exists(TOR_CONFIG_FILE): + try: + backupFilename = "%s_backup_%i" % (TOR_CONFIG_FILE, int(time.time())) + shutil.copy(TOR_CONFIG_FILE, backupFilename) + except IOError, exc: + print "Unable to backup %s (%s)" % (TOR_CONFIG_FILE, exc) + sys.exit(1) + + # overwrites TOR_CONFIG_FILE with ARM_CONFIG_FILE as loaded into tf.name + try: + shutil.copy(tf.name, TOR_CONFIG_FILE) + print "Successfully reconfigured Tor" + except IOError, exc: + print "Unable to copy %s to %s (%s)" % (tf.name, TOR_CONFIG_FILE, exc) + sys.exit(1) + + # unlink our temp file + try: + os.remove(tf.name) + except: + print "Unable to close temp file %s" % tf.name + sys.exit(1) + + sys.exit(0) + +if __name__ == "__main__": + # sanity check that we're on linux + if os.name != "posix": + print "This is a script specifically for configuring Linux" + sys.exit(1) + + # check that we're running effectively as root + if os.geteuid() != 0: + print "This script needs to be run as root" + sys.exit(1) + + if len(sys.argv) < 2: + replaceTorrc() + elif len(sys.argv) == 2 and sys.argv[1] == "--init": + init() + elif len(sys.argv) == 2 and sys.argv[1] == "--remove": + remove() + else: + print HELP_MSG + sys.exit(1) +

1 0