- tor-commits - lists.torproject.org

[Git][tpo/applications/tor-browser-build][main] Bug 40777: Update Go to 1.20.4 and create a Go bootstrap project
by Pier Angelo Vendrame (＠pierov) 25 May '23

25 May '23

Pier Angelo Vendrame pushed to branch main at The Tor Project / Applications / tor-browser-build Commits: b37e2ebd by Pier Angelo Vendrame at 2023-05-25T18:28:35+02:00 Bug 40777: Update Go to 1.20.4 and create a Go bootstrap project The Go compiler is written in Go, but it is possible to bootstrap it from C wiht Go 1.4. Before this commit, we used to build Go 1.4 for all our platforms, so we built a compiler to throw it away several times. Starting from Go 1.20, the team decided to require Go V-3 to bootstrap (i.e., Go 1.17 to bootrastrap Go 1.20). Bootstrapping is still feasible, but throwing away two compilers is not a good idea. So, we decided to create a Go bootstrap project, and build it only once (for Linux amd64) until it will be able to build more recent Go compilers. - - - - - 5 changed files: - + projects/go-bootstrap/build - + projects/go-bootstrap/config - projects/go/0001-Use-fixed-go-build-tmp-directory.patch - projects/go/build - projects/go/config Changes: ===================================== projects/go-bootstrap/build ===================================== @@ -0,0 +1,38 @@ +#!/bin/bash +[% c("var/set_default_env") -%] + +# This project is expected to be built only on Linux. +# Then the actual Go compiler will be built for each platform. + +distdir=/var/tmp/dist/[% project %] +mkdir -p /var/tmp/build /var/tmp/dist + +# Building go 1.4.x +# This is needed to bootstrap the go that we actually use +# https://golang.org/doc/install/source#go14 +tar -C /var/tmp/build --transform='s,^go\>,go1.4,' -xf $rootdir/[% c('input_files_by_name/go14') %] +cd /var/tmp/build/go1.4/src +# Disable cgo to avoid conflicts with newer GCC. cgo is not needed for the bootstrap go. +# https://github.com/golang/go/issues/13114#issuecomment-186922245 +# Disable CC etc. that are set up for cross builds. +CGO_ENABLED=0 CC= CFLAGS= LDFLAGS= ./make.bash +export GOROOT_BOOTSTRAP="/var/tmp/build/go1.4" + +cd $rootdir + +tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/go') %] +export GOROOT="$distdir" +mv /var/tmp/dist/go $distdir +cd $distdir/src + +./make.bash + +# This directory is non-reproducible and doesn't exist in official Go releases, +# so remove it to preserve reproducibility of the output. +rm -rf $distdir/pkg/obj/go-build/ + +cd /var/tmp/dist +[% c('tar', { + tar_src => [ project ], + tar_args => '-czf ' _ dest_dir _ '/' _ c('filename'), + }) %] ===================================== projects/go-bootstrap/config ===================================== @@ -0,0 +1,14 @@ +# vim: filetype=yaml sw=2 +version: 1.19.9 +filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' +container: + use_container: 1 + +input_files: + - project: container-image + - URL: 'https://golang.org/dl/go[% c("version") %].src.tar.gz' + name: go + sha256sum: 131190a4697a70c5b1d232df5d3f55a3f9ec0e78e40516196ffb3f09ae6a5744 + - URL: https://dl.google.com/go/go1.4-bootstrap-20171003.tar.gz + name: go14 + sha256sum: f4ff5b5eb3a3cae1c993723f3eab519c5bae18866b5e5f96fe1102f0cb5c3e52 ===================================== projects/go/0001-Use-fixed-go-build-tmp-directory.patch ===================================== @@ -1,4 +1,4 @@ -From 958f724b1b434702c3d44ceaca646791674d07b1 Mon Sep 17 00:00:00 2001 +From 2c1c98d6404284df744a194dd23bd3660f365387 Mon Sep 17 00:00:00 2001 From: Georg Koppen <gk(a)torproject.org> Date: Fri, 17 Apr 2020 10:24:23 +0000 Subject: [PATCH] Use fixed go-build tmp directory @@ -6,15 +6,18 @@ Subject: [PATCH] Use fixed go-build tmp directory Use fixed go-build tmp directory, when the directory does not exist, in order to avoid some reproducibility issues where build directory gets embedded in generated binaries. +--- + src/cmd/go/internal/work/action.go | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/cmd/go/internal/work/action.go b/src/cmd/go/internal/work/action.go -index 33b7818fb2..5e369d0f53 100644 +index 8beb1345d0..dccf39c1c1 100644 --- a/src/cmd/go/internal/work/action.go +++ b/src/cmd/go/internal/work/action.go -@@ -252,9 +252,13 @@ func (b *Builder) Init() { - if cfg.BuildN { - b.WorkDir = "$WORK" - } else { +@@ -279,9 +279,13 @@ func NewBuilder(workDir string) *Builder { + if !buildInitStarted { + panic("internal error: NewBuilder called before BuildInit") + } - tmp, err := os.MkdirTemp(cfg.Getenv("GOTMPDIR"), "go-build") - if err != nil { - base.Fatalf("go: creating work dir: %v", err) @@ -29,5 +32,5 @@ index 33b7818fb2..5e369d0f53 100644 if !filepath.IsAbs(tmp) { abs, err := filepath.Abs(tmp) -- -2.26.1 +2.39.2 ===================================== projects/go/build ===================================== @@ -3,27 +3,8 @@ distdir=/var/tmp/dist/[% project %] mkdir -p /var/tmp/dist -[% IF c("var/linux") %] - # Config options for hardening-wrapper - export DEB_BUILD_HARDENING=1 - export DEB_BUILD_HARDENING_STACKPROTECTOR=1 - export DEB_BUILD_HARDENING_FORTIFY=1 - export DEB_BUILD_HARDENING_FORMAT=1 - export DEB_BUILD_HARDENING_PIE=1 -[% END %] - -mkdir -p /var/tmp/build - -# Building go 1.4.x -# This is needed to bootstrap the go that we actually use -# https://golang.org/doc/install/source#go14 -tar -C /var/tmp/build --transform='s,^go\>,go1.4,' -xf $rootdir/[% c('input_files_by_name/go14') %] -cd /var/tmp/build/go1.4/src -# Disable cgo to avoid conflicts with newer GCC. cgo is not needed for the bootstrap go. -# https://github.com/golang/go/issues/13114#issuecomment-186922245 -# Disable CC etc. that are set up for cross builds. -CGO_ENABLED=0 CC= CFLAGS= LDFLAGS= ./make.bash -export GOROOT_BOOTSTRAP="/var/tmp/build/go1.4" +tar -C /var/tmp/dist -xf $rootdir/[% c('input_files_by_name/go-bootstrap') %] +export GOROOT_BOOTSTRAP="/var/tmp/dist/go-bootstrap" cd $rootdir [% IF ! c("var/linux") %] ===================================== projects/go/config ===================================== @@ -1,12 +1,10 @@ # vim: filetype=yaml sw=2 -version: 1.19.9 -filename: '[% project %]-[% c("version") %]-[% c("var/build_id") %].tar.gz' +version: 1.20.4 +filename: '[% project %]-[% c("version") %]-[% c("var/osname") %]-[% c("var/build_id") %].tar.gz' container: use_container: 1 var: - go14_version: 1.4.3 - setup: | mkdir -p /var/tmp/dist tar -C /var/tmp/dist -xf $rootdir/[% c("go_tarfile") %] @@ -121,9 +119,10 @@ input_files: enable: '[% ! c("var/linux") %]' - URL: 'https://golang.org/dl/go[% c("version") %].src.tar.gz' name: go - sha256sum: 131190a4697a70c5b1d232df5d3f55a3f9ec0e78e40516196ffb3f09ae6a5744 - - URL: 'https://golang.org/dl/go[% c("var/go14_version") %].src.tar.gz' - name: go14 - sha256sum: 9947fc705b0b841b5938c48b22dc33e9647ec0752bae66e50278df4f23f64959 + sha256sum: 9f34ace128764b7a3a4b238b805856cc1b2184304df9e5690825b0710f4202d6 + - project: go-bootstrap + name: go-bootstrap + target_replace: + '^.*browser-.*': 'basebrowser-linux-x86_64' - filename: 0001-Use-fixed-go-build-tmp-directory.patch enable: '[% c("var/android") %]' View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/commit/b… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[tor] branch main updated (a1042f4873 -> d5dea2202c)
by gitolite role 25 May '23

25 May '23

This is an automated email from the git hooks/post-receive script. dgoulet pushed a change to branch main in repository tor. from a1042f4873 Merge branch 'tor-gitlab/mr/443' new 36076d3c46 Added INTRO and REND metrics for relay. new 24bc66f663 Fixed REND1 metric label value new 2f8a88448d Fixed est intro getter using wrong array new 1899b6230d Removed getter abstraction and moved from rephist to relay_metrics. new 8cbfc90686 Fixed new arguments for metrics_store_add new 5b76ce1843 Added void stubs for the relay metrics functions to fix building without relay module new 7e57b9dbbf Fixed enum type not found in relay_stub new 3d5d8d59c1 Added relay prefix to new metrics functions new 273227afe1 Forgot about the stub names new d5dea2202c changes: Add file for ticket 40797 The 10 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: changes/ticket40797 | 4 + src/feature/hs/hs_intropoint.c | 18 ++++ src/feature/relay/relay_metrics.c | 180 ++++++++++++++++++++++++++++++++++++++ src/feature/relay/relay_metrics.h | 60 ++++++++++++- src/feature/relay/relay_stub.c | 25 ++++++ src/feature/rend/rendmid.c | 13 +++ 6 files changed, 299 insertions(+), 1 deletion(-) create mode 100644 changes/ticket40797 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 10

[tor] branch main updated (970a534f03 -> a1042f4873)
by gitolite role 25 May '23

25 May '23

This is an automated email from the git hooks/post-receive script. dgoulet pushed a change to branch main in repository tor. from 970a534f03 test: Fix parseconf to account for ClientUseIPv6 change for dirauth disabled new 5118a8003b Log state transitions for Pluggable Transports new 0d51dfa605 Log name of managed proxy in exit handler. new 3338b34ec9 Only terminate PT processes that are running. new 58f0e548ff Log at LD_PT instead of LD_GENERAL for PT process stdout lines. new 506781d41e Restart PT processes when they die on us. new 5f432bff31 Add missing changes file for tor#33669. new a1042f4873 Merge branch 'tor-gitlab/mr/443' The 7 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: changes/ticket33669 | 3 ++ src/feature/client/transports.c | 99 ++++++++++++++++++++++++++++++++++------- src/feature/client/transports.h | 2 + 3 files changed, 88 insertions(+), 16 deletions(-) create mode 100644 changes/ticket33669 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 7

[tor] branch main updated: test: Fix parseconf to account for ClientUseIPv6 change for dirauth disabled
by gitolite role 25 May '23

25 May '23

This is an automated email from the git hooks/post-receive script. dgoulet pushed a commit to branch main in repository tor. The following commit(s) were added to refs/heads/main by this push: new 970a534f03 test: Fix parseconf to account for ClientUseIPv6 change for dirauth disabled 970a534f03 is described below commit 970a534f03e19cc4957b200310418ff595f1d550 Author: David Goulet <dgoulet(a)torproject.org> AuthorDate: Thu May 25 10:20:12 2023 -0400 test: Fix parseconf to account for ClientUseIPv6 change for dirauth disabled Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/test/conf_examples/large_1/expected_no_dirauth | 1 - 1 file changed, 1 deletion(-) diff --git a/src/test/conf_examples/large_1/expected_no_dirauth b/src/test/conf_examples/large_1/expected_no_dirauth index 21f08d0a33..e4e811caaf 100644 --- a/src/test/conf_examples/large_1/expected_no_dirauth +++ b/src/test/conf_examples/large_1/expected_no_dirauth @@ -19,7 +19,6 @@ ClientPreferIPv6DirPort 1 ClientPreferIPv6ORPort 1 ClientRejectInternalAddresses 0 ClientUseIPv4 0 -ClientUseIPv6 1 ConnDirectionStatistics 1 ConnectionPadding 1 ConnLimit 64 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[tor] branch main updated: test: Fix parseconf to account for ClientUseIPv6 change
by gitolite role 25 May '23

25 May '23

This is an automated email from the git hooks/post-receive script. dgoulet pushed a commit to branch main in repository tor. The following commit(s) were added to refs/heads/main by this push: new 86bc3cc452 test: Fix parseconf to account for ClientUseIPv6 change 86bc3cc452 is described below commit 86bc3cc452c1d1a0f314ac447ed1254c9d87d97d Author: David Goulet <dgoulet(a)torproject.org> AuthorDate: Thu May 25 09:21:23 2023 -0400 test: Fix parseconf to account for ClientUseIPv6 change Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- src/test/conf_examples/large_1/expected | 1 - 1 file changed, 1 deletion(-) diff --git a/src/test/conf_examples/large_1/expected b/src/test/conf_examples/large_1/expected index 73e48cf0d3..85f96a24c9 100644 --- a/src/test/conf_examples/large_1/expected +++ b/src/test/conf_examples/large_1/expected @@ -19,7 +19,6 @@ ClientPreferIPv6DirPort 1 ClientPreferIPv6ORPort 1 ClientRejectInternalAddresses 0 ClientUseIPv4 0 -ClientUseIPv6 1 ConnDirectionStatistics 1 ConnectionPadding 1 ConnLimit 64 -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[Git][tpo/applications/tor-browser][tor-browser-102.11.0esr-12.5-1] fixup! Bug 23247: Communicating security expectations for .onion
by ma1 (＠ma1) 25 May '23

25 May '23

ma1 pushed to branch tor-browser-102.11.0esr-12.5-1 at The Tor Project / Applications / Tor Browser Commits: dbec6cf6 by cypherpunks1 at 2023-05-24T09:21:07-08:00 fixup! Bug 23247: Communicating security expectations for .onion Bug 41785: Show http onion resources as secure in network monitor - - - - - 1 changed file: - devtools/shared/webconsole/network-helper.js Changes: ===================================== devtools/shared/webconsole/network-helper.js ===================================== @@ -600,6 +600,9 @@ var NetworkHelper = { // The request did not contain any security info. if (!securityInfo) { + if (httpActivity.hostname && httpActivity.hostname.endsWith(".onion")) { + info.state = "secure"; + } return info; } @@ -651,7 +654,11 @@ var NetworkHelper = { // schemes other than https and wss are subject to // downgrade/etc at the scheme level and should always be // considered insecure - info.state = "insecure"; + if (httpActivity.hostname && httpActivity.hostname.endsWith(".onion")) { + info.state = "secure"; + } else { + info.state = "insecure"; + } } else if (state & wpl.STATE_IS_SECURE) { // The connection is secure if the scheme is sufficient info.state = "secure"; View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/dbec6cf… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/dbec6cf… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[Git][tpo/applications/tor-browser-update-responses][main] alpha: new version, 12.5a6
by richard (＠richard) 24 May '23

24 May '23

richard pushed to branch main at The Tor Project / Applications / Tor Browser update responses Commits: 6dc9b712 by Richard Pospesel at 2023-05-24T20:20:54+00:00 alpha: new version, 12.5a6 - - - - - 30 changed files: - update_3/alpha/.htaccess - − update_3/alpha/12.5a4-12.5a5-linux32-ALL.xml - − update_3/alpha/12.5a4-12.5a5-linux64-ALL.xml - − update_3/alpha/12.5a4-12.5a5-macos-ALL.xml - − update_3/alpha/12.5a4-12.5a5-win32-ALL.xml - − update_3/alpha/12.5a4-12.5a5-win64-ALL.xml - + update_3/alpha/12.5a4-12.5a6-linux32-ALL.xml - + update_3/alpha/12.5a4-12.5a6-linux64-ALL.xml - + update_3/alpha/12.5a4-12.5a6-macos-ALL.xml - + update_3/alpha/12.5a4-12.5a6-win32-ALL.xml - + update_3/alpha/12.5a4-12.5a6-win64-ALL.xml - + update_3/alpha/12.5a5-12.5a6-linux32-ALL.xml - + update_3/alpha/12.5a5-12.5a6-linux64-ALL.xml - + update_3/alpha/12.5a5-12.5a6-macos-ALL.xml - + update_3/alpha/12.5a5-12.5a6-win32-ALL.xml - + update_3/alpha/12.5a5-12.5a6-win64-ALL.xml - − update_3/alpha/12.5a5-linux32-ALL.xml - − update_3/alpha/12.5a5-linux64-ALL.xml - − update_3/alpha/12.5a5-macos-ALL.xml - − update_3/alpha/12.5a5-win32-ALL.xml - − update_3/alpha/12.5a5-win64-ALL.xml - + update_3/alpha/12.5a6-linux32-ALL.xml - + update_3/alpha/12.5a6-linux64-ALL.xml - + update_3/alpha/12.5a6-macos-ALL.xml - + update_3/alpha/12.5a6-win32-ALL.xml - + update_3/alpha/12.5a6-win64-ALL.xml - update_3/alpha/download-android-aarch64.json - update_3/alpha/download-android-armv7.json - update_3/alpha/download-android-x86.json - update_3/alpha/download-android-x86_64.json The diff was not included because it is too large. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-update-responses… -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-update-responses… You're receiving this email because of your account on gitlab.torproject.org.

1 0

[torspec] branch main updated: tor-spec: Revise the CircID selection section
by gitolite role 24 May '23

24 May '23

This is an automated email from the git hooks/post-receive script. dgoulet pushed a commit to branch main in repository torspec. The following commit(s) were added to refs/heads/main by this push: new d612d23 tor-spec: Revise the CircID selection section new 646fbf7 Merge branch 'tor-gitlab/mr/125' d612d23 is described below commit d612d2344a4fe388401af35003ce695616845a97 Author: Emil Engler <me(a)emilengler.com> AuthorDate: Tue May 2 08:48:58 2023 +0200 tor-spec: Revise the CircID selection section This commit updates the "5.1.1. Choosing circuit IDs in create cells" section, in order to clarify its importance, as well as to adjust it to modern link protocol versions. The first goal is achieved, by directly adding a "MUST" in the first paragraph, alongside a reformulation in the paragraph explaining the method in link protocol version 4 or higher. The second goal is achieved by merging the second paragraph with the third paragraph, as the second paragraph only applies to the link protocol versions addressed in the third one. --- tor-spec.txt | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/tor-spec.txt b/tor-spec.txt index 8f30624..c6dbcfd 100644 --- a/tor-spec.txt +++ b/tor-spec.txt @@ -1068,28 +1068,28 @@ see tor-design.pdf. 5.1.1. Choosing circuit IDs in create cells - The CircID for a CREATE/CREATE2 cell is an arbitrarily chosen - nonzero integer, selected by the node (OP or OR) that sends the - CREATE/CREATE2 cell. In link protocol 3 or lower, CircIDs are 2 - bytes long; in protocol 4 or higher, CircIDs are 4 bytes long. - - To prevent CircID collisions, when one node sends a CREATE/CREATE2 - cell to another, it chooses from only one half of the possible - values based on the ORs' public identity keys. - - In link protocol version 3 or lower, if the sending node has a lower - key, it chooses a CircID with an MSB of 0; otherwise, it chooses a - CircID with an MSB of 1. (Public keys are compared numerically by - modulus.) With protocol version 3 or lower, a client with no public key - MAY choose any CircID it wishes, since clients never need to process a - CREATE/CREATE2 cell. + The CircID for a CREATE/CREATE2 cell is a nonzero integer, selected + by the node (OP or OR) that sends the CREATE/CREATED2 cell. + Depending on the link protocol version, there are certain rules for + choosing the value of CircID which MUST be obeyed, as implementations + MAY decide to refuse in case of a violation. In link protocol 3 or + lower, CircIDs are 2 bytes long; in protocol 4 or higher, CircIDs are + 4 bytes long. + + In link protocol version 3 or lower, the nodes choose from only one + half of the possible values based on the ORs' public identity keys, + in order to avoid collisions. If the sending node has a lower key, + it chooses a CircID with an MSB of 0; otherwise, it chooses a CircID + with an MSB of 1. (Public keys are compared numerically by modulus.) + A client with no public key MAY choose any CircID it wishes, since + clients never need to process CREATE/CREATE2 cells. In link protocol version 4 or higher, whichever node initiated the - connection sets its MSB to 1, and whichever node didn't initiate the - connection sets its MSB to 0. + connection MUST set its MSB to 1, and whichever node didn't initiate + the connection MUST set its MSB to 0. The CircID value 0 is specifically reserved for cells that do not - belong to any circuit: CircID 0 must not be used for circuits. No + belong to any circuit: CircID 0 MUST not be used for circuits. No other CircID value, including 0x8000 or 0x80000000, is reserved. Existing Tor implementations choose their CircID values at random from -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[torspec] branch main updated (a1cd058 -> 51e2149)
by gitolite role 24 May '23

24 May '23

This is an automated email from the git hooks/post-receive script. dgoulet pushed a change to branch main in repository torspec. from a1cd058 Merge branch 'tor-gitlab/mr/133' new 0d332d8 Prop329 updates for bug40781 new ee9f341 Note that we need to explicitly allow 2 INTROs new 1473e95 Prop#329: Clarity improvements new 7ea74b9 Prop329: Document Snowflake exemption to Guard restriction. new 51e2149 Merge branch 'tor-gitlab/mr/132' The 5 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "add" were already present in the repository and have only been added to this reference. Summary of changes: proposals/329-traffic-splitting.txt | 227 ++++++++++++++++++++++-------------- 1 file changed, 137 insertions(+), 90 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 5

[torspec] branch main updated: rend-spec: Add a set of test vectors for hs-ntor.
by gitolite role 24 May '23

24 May '23

This is an automated email from the git hooks/post-receive script. dgoulet pushed a commit to branch main in repository torspec. The following commit(s) were added to refs/heads/main by this push: new eeb208d rend-spec: Add a set of test vectors for hs-ntor. new a1cd058 Merge branch 'tor-gitlab/mr/133' eeb208d is described below commit eeb208d5777b395412968317095ef82159e82403 Author: Nick Mathewson <nickm(a)torproject.org> AuthorDate: Thu May 18 08:57:34 2023 -0400 rend-spec: Add a set of test vectors for hs-ntor. These were generated using a patched Tor with extra logging info. I've used them to validate (and find bugs in) the arti hs-ntor implementation. (See arti!1189.) --- rend-spec-v3.txt | 92 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+) diff --git a/rend-spec-v3.txt b/rend-spec-v3.txt index 4a12343..53880db 100644 --- a/rend-spec-v3.txt +++ b/rend-spec-v3.txt @@ -2723,3 +2723,95 @@ Appendix F. Two methods for managing revision counters. Similarly, implementations SHOULD NOT let the revision counter increase forever without resetting it -- doing so links the service across changes in the blinded public key. + +Appendix G. Text vectors + + G.1. Test vectors for hs-ntor / NTOR-WITH-EXTRA-DATA + + Here is a set of test values for the hs-ntor handshake, called + [NTOR-WITH-EXTRA-DATA] in this document. They were generated by + instrumenting Tor's code to dump the values for an INTRODUCE/RENDEZVOUS + handshake, and then by running that code on a Chutney network. + + We assume an onion service with: + + KP_hs_ipd_sid = 34E171E4358E501BFF21ED907E96AC6B + FEF697C779D040BBAF49ACC30FC5D21F + KP_hss_ntor = 8E5127A40E83AABF6493E41F142B6EE3 + 604B85A3961CD7E38D247239AFF71979 + KS_hss_ntor = A0ED5DBF94EEB2EDB3B514E4CF6ABFF6 + 022051CC5F103391F1970A3FCD15296A + N_hs_subcred = 0085D26A9DEBA252263BF0231AEAC59B + 17CA11BAD8A218238AD6487CBAD68B57 + + The client wants to make in INTRODUCE request. It generates + the following header (everything before the ENCRYPTED portion) + of its INTRODUCE1 cell: + + H = 000000000000000000000000000000000000000002002034E171E4358E501BFF + 21ED907E96AC6BFEF697C779D040BBAF49ACC30FC5D21F00 + + It generates the following plaintext body to encrypt. (This + is the "decrypted plaintext body" from [PROCESS_INTRO2]. + + P = 6BD364C12638DD5C3BE23D76ACA05B04E6CE932C0101000100200DE6130E4FCA + C4EDDA24E21220CC3EADAE403EF6B7D11C8273AC71908DE565450300067F0000 + 0113890214F823C4F8CC085C792E0AEE0283FE00AD7520B37D0320728D5DF39B + 7B7077A0118A900FF4456C382F0041300ACF9C58E51C392795EF870000000000 + 0000000000000000000000000000000000000000000000000000000000000000 + 000000000000000000000000000000000000000000000000000000000000 + + The client now begins the hs-ntor handshake. It generates + a curve25519 keypair: + + x = 60B4D6BF5234DCF87A4E9D7487BDF3F4 + A69B6729835E825CA29089CFDDA1E341 + X = BF04348B46D09AED726F1D66C618FDEA + 1DE58E8CB8B89738D7356A0C59111D5D + + Then it calculates: + + ENC_KEY = 9B8917BA3D05F3130DACCE5300C3DC27 + F6D012912F1C733036F822D0ED238706 + MAC_KEY = FC4058DA59D4DF61E7B40985D122F502 + FD59336BC21C30CAF5E7F0D4A2C38FD5 + + With these, it encrypts the plaintext body P with ENC_KEY, getting + an encrypted value C. It computes MAC(MAC_KEY, H | X | C), + getting a MAC value M. It then assembles the final INTRODUCE1 + body as H | X | C | M: + + 000000000000000000000000000000000000000002002034E171E4358E501BFF + 21ED907E96AC6BFEF697C779D040BBAF49ACC30FC5D21F00BF04348B46D09AED + 726F1D66C618FDEA1DE58E8CB8B89738D7356A0C59111D5DADBECCCB38E37830 + 4DCC179D3D9E437B452AF5702CED2CCFEC085BC02C4C175FA446525C1B9D5530 + 563C362FDFFB802DAB8CD9EBC7A5EE17DA62E37DEEB0EB187FBB48C63298B0E8 + 3F391B7566F42ADC97C46BA7588278273A44CE96BC68FFDAE31EF5F0913B9A9C + 7E0F173DBC0BDDCD4ACB4C4600980A7DDD9EAEC6E7F3FA3FC37CD95E5B8BFB3E + 35717012B78B4930569F895CB349A07538E42309C993223AEA77EF8AEA64F25D + DEE97DA623F1AEC0A47F150002150455845C385E5606E41A9A199E7111D54EF2 + D1A51B7554D8B3692D85AC587FB9E69DF990EFB776D8 + + Later the service receives that body in an INTRODUCE2 cell. It + processes it according to the hs-ntor handshake, and recovers + the client's plaintext P. To continue the hs-ntor handshake, + the service chooses a curve25519 keypair: + + y = 68CB5188CA0CD7924250404FAB54EE13 + 92D3D2B9C049A2E446513875952F8F55 + Y = 8FBE0DB4D4A9C7FF46701E3E0EE7FD05 + CD28BE4F302460ADDEEC9E93354EE700 + + From this and the client's input, it computes: + + AUTH_INPUT_MAC = 4A92E8437B8424D5E5EC279245D5C72B + 25A0327ACF6DAF902079FCB643D8B208 + NTOR_KEY_SEED = 4D0C72FE8AFF35559D95ECC18EB5A368 + 83402B28CDFD48C8A530A5A3D7D578DB + + The service sends back Y | AUTH_INPUT_MAC in its RENDEZVOUS1 cell + body. From these, the client finishes the handshake, validates + AUTH_INPUT_MAC, and computes the same NTOR_KEY_SEED. + + Now that both parties have the same NTOR_KEY_SEED, they can derive + the shared key material they will use for their circuit. -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0