April 2013 - tor-dev - lists.torproject.org

Moving our website to git and splitting it in two
by Peter Palfrader 08 Apr '13

08 Apr '13

Hi, Tom asked what was needed to get our website moved to git. Probably not much. And while we're at it we could split the repository into two parts: - things that are copied over verbatim, and - things that build stuff that make our website. Splitting this makes it easier to publish something more clean to our webservers - there is little point in putting build scripts and sources into the webroot right along the finished html files. https://people.torproject.org/~weasel/tor-web-underlay/ and https://people.torproject.org/~weasel/tor-web-web/ (add .git to clone) Should we move to this? Something different? Cheers, weasel -- | .''`. ** Debian ** Peter Palfrader | : :' : The universal http://www.palfrader.org/ | `. `' Operating System | `- http://www.debian.org/

7 13

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by wac 06 Apr '13

06 Apr '13

Hi Navin: Some versions of zlib can be built with the IDE but for the one I used (oldest bugfree because of gzip support) I used nmake. Just open Visual Studio command prompt. Or if you don't locate it, (but recommend you to do it) just run vcvars32.bat (is in bin directory) to set up the environment. For libevent: open the Visual Studio Command Prompt, then cd \where\you\put\it nmake -f makefile.nmake for zlib something similar. for openssl you need to do more steps and install perl for configuration (they recommend activestateperl) at INSTALL.W32 file just read "Visual C++" section. I just used dynamic library but there is a way to do it static library if you want. when you open the solution left click at the project. Select properties. Then go to Configuration properties -> C/C++ -> General See there "Additional include directories". You need to change those as they are not relative. Then go to Configuration properties -> Linker -> General See there "Additional Library Directories". You need to change those too to point to your directory. I then dropped the openssl dlls next to Tor executable. I want you to know I changed the runtime to be non debug version as I don't needed to debug there so if you want to do it you need to somehow build them with debug symbols and take back debug build of tor to use debug runtime otherwise it won't link as the linker would find duplicated symbols. Maybe the tree is unnecessary but ok there it goes. Regards Waldo ------------------------------ On Thu, Apr 4, 2013 20:56 EDT Navin Francis wrote: >Hi Waldo, > >I tried to build using your project and I think most of the Tor code works >but I am not sure how to add all the libraries. Can they be built from the >IDE? > >Can you also run "tree /f >files.txt" in your source folder and attach the >file. That way, I can make sure I have the same files as you. > >thanks, >Navin > > >On Tue, Apr 2, 2013 at 10:49 PM, wac <waldoalvarez00(a)yahoo.com> wrote: > > > ------------------------------ > On Wed, Apr 3, 2013 00:38 EDT Navin Francis wrote: > > Hi Nick: > > >It seems like like we are trying to do almost exactly the same thing :) > > > >You also mentioned that you got Tor working as a visual studio project. I > >was trying to do this myself, but its really a PITA since the Tor > >configuration does not generate a visual studio project and the VC++ > >libraries don't play well with the cygwin libraries (I thought that Tor > >only supports cygwin on windows). If your code compiles, I would really > >appreciate it if you can upload it somewhere. > > Sure. I did it with visual studio 2010 since cygwin weights a lot and I am > over dialup. So just used resources available ;). The solutions + project + > instructions will serve to you? I attached the solutions + project. I am > looking to upload the rest once I am done. I tested writing and works like > a charm but I am using the same thread. Requested www.torproject.orgwebpage using Tor :). Still gotta make things reentrant. Maybe someone > wants to join. > > You need to place the files inside the folder win32 and drop the files > there. I named it tor-windows-vs2010 but you likely can choose whatever you > want for the name. > > You will have to change libraries location and header files since I didn't > set them relative. > > I built all the libraries from source. OpenSSL, libevent and zlib with > visual studio as well with nmake using the visual studio console. For > OpenSSL you need Perl. Not sure if zlib is ok since I had to try several > for gzip support and picked an old one. > > If you need help building the libraries just let me know. > > Ahh and I had to move some files around. At least curve25519-donna.c I > placed it in win 32 directory for Tor 0.2.4. > > That should do, but if you hit something just let me know. > > Regards > Waldo > > > _______________________________________________ > tor-dev mailing list > tor-dev(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev > >

1 0

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by wac 05 Apr '13

05 Apr '13

------------------------------ On Wed, Apr 3, 2013 00:38 EDT Navin Francis wrote: Hi Nick: >It seems like like we are trying to do almost exactly the same thing :) > >You also mentioned that you got Tor working as a visual studio project. I >was trying to do this myself, but its really a PITA since the Tor >configuration does not generate a visual studio project and the VC++ >libraries don't play well with the cygwin libraries (I thought that Tor >only supports cygwin on windows). If your code compiles, I would really >appreciate it if you can upload it somewhere. Sure. I did it with visual studio 2010 since cygwin weights a lot and I am over dialup. So just used resources available ;). The solutions + project + instructions will serve to you? I attached the solutions + project. I am looking to upload the rest once I am done. I tested writing and works like a charm but I am using the same thread. Requested www.torproject.org webpage using Tor :). Still gotta make things reentrant. Maybe someone wants to join. You need to place the files inside the folder win32 and drop the files there. I named it tor-windows-vs2010 but you likely can choose whatever you want for the name. You will have to change libraries location and header files since I didn't set them relative. I built all the libraries from source. OpenSSL, libevent and zlib with visual studio as well with nmake using the visual studio console. For OpenSSL you need Perl. Not sure if zlib is ok since I had to try several for gzip support and picked an old one. If you need help building the libraries just let me know. Ahh and I had to move some files around. At least curve25519-donna.c I placed it in win 32 directory for Tor 0.2.4. That should do, but if you hit something just let me know. Regards Waldo > >Regards, >Navin > > >On Mon, Apr 1, 2013 at 9:20 PM, wac <waldoalvarez00(a)yahoo.com> wrote: > > > Hi Nick: > > > * Using process isolation to isolate Tor from its controllers makes it > > easier to tell Tor bugs from controller bugs.... > > > * Using process isolation to isolate Tor from its controllers can also > > make it easier to secure each of the two domains properly against bugs > > in the other, especially if you're using OS or VM sandboxing features. > > This is a point I think is valid to consider. Thanks for pointing it. > However a library is not equal to lack of process isolation. I could have > the application (for instance the browser) launch a process being a thin > layer around the library and exchange data using some IPC mechanism. That > could be a future step. > > >plus maybe another library that would find a running Tor or launch one as > needed. > > Is there a standard way of doing this? If not maybe would be good idea to > define it. A way to know if Tor is running and the listening > interfaces/ports. Authenticating it if possible, I would not like to have > malware pretending to be Tor and have it easily steal all my network > traffic because of this. Perhaps finding the binary somehow and check the > hash? And avoid malware using Tor as a presentation key to then shut it > down and replace it. Good questions I think. Maybe this should be just > configurable by end user instead of doing it automatically until they are > answered. > > If platform dependent I think could be defined for each platform. > > > That way we wouldn't have a huge pile of apps all stuck downloading > their own directory > >information > > I have no intentions to drop cached information, I actually pretend to > share it as much as possible. Ok is not a perfect world, some will happen. > Maybe this could be defined as well to allow diverging implementations > filling other niches than Tor, share already downloaded data or refresh it > in a cooperative way. > > > Nonetheless, people keep wanting to do it the way you suggest, and it's > free software, so do what you like. > > Correct, freedom of choice ;). Other ppl is not able to decide what's best > for me! Anyways recommendations are always welcome. > > Regards > Waldo > > _______________________________________________ > tor-dev mailing list > tor-dev(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev >

2 1

default value of CookieAuthentication is wrong inthe documentation
by Tomáš Hnyk 04 Apr '13

04 Apr '13

Hello, I am using tor on Ubuntu 12.10, version of tor: v0.2.3.22-rc (git-4a0c70a817797420) The documentation https://www.torproject.org/docs/tor-manual.html.en says that default value of CookieAuthentication is 0. However, until I set it 0 in my torrc, tor wanted a cookie ("host 9051 515 Authentication failed: Wrong length on authentication cookie.") My torrc is this: FascistFirewall 1 ControlPort 9051 CookieAuthentication 0 I guess the documentation (on the web and the man page and comments in torrc file) should ve mended to reflect this. Or am I missing something? Regards, Tomas Hnyk P.S.: I know I should use some form of authentication, but I just wanted to get tor running first and see what it can do.

4 8

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by wac 03 Apr '13

03 Apr '13

Hi Nick: > * Using process isolation to isolate Tor from its controllers makes it > easier to tell Tor bugs from controller bugs.... > * Using process isolation to isolate Tor from its controllers can also > make it easier to secure each of the two domains properly against bugs > in the other, especially if you're using OS or VM sandboxing features. This is a point I think is valid to consider. Thanks for pointing it. However a library is not equal to lack of process isolation. I could have the application (for instance the browser) launch a process being a thin layer around the library and exchange data using some IPC mechanism. That could be a future step. >plus maybe another library that would find a running Tor or launch one as needed. Is there a standard way of doing this? If not maybe would be good idea to define it. A way to know if Tor is running and the listening interfaces/ports. Authenticating it if possible, I would not like to have malware pretending to be Tor and have it easily steal all my network traffic because of this. Perhaps finding the binary somehow and check the hash? And avoid malware using Tor as a presentation key to then shut it down and replace it. Good questions I think. Maybe this should be just configurable by end user instead of doing it automatically until they are answered. If platform dependent I think could be defined for each platform. > That way we wouldn't have a huge pile of apps all stuck downloading their own directory >information I have no intentions to drop cached information, I actually pretend to share it as much as possible. Ok is not a perfect world, some will happen. Maybe this could be defined as well to allow diverging implementations filling other niches than Tor, share already downloaded data or refresh it in a cooperative way. > Nonetheless, people keep wanting to do it the way you suggest, and it's free software, so do what you like. Correct, freedom of choice ;). Other ppl is not able to decide what's best for me! Anyways recommendations are always welcome. Regards Waldo

2 1

How many OR Listen per Tor relay?
by SiNA Rabbani 02 Apr '13

02 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 How many public IP addresses can 1 Tor relay listen for and also publish to directories? Note that non of these public IP addresses are going to actually exists on the relay, plan is to use iptables to forward traffic from multiple locations on the Internet back to a *monsters* relay. Think of it as NAT with Public IP addresses. - --SiNA - -- “Be the change you want to see in the world.” Gandhi -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJRW0JsAAoJEDxieAEiLOmoi4oP/0gV4gOsYuI/L5xO+puYyP2P bFX0rakNkOcoD6CTgdNYRAMRjTRUo65nvtoUT54EAsBJxej3hqd+eoVibaWdmbVC pXC7y/gRdHhAoICcwd6Q7h+VIBtoT6B4TY1+U23P1uwwjsLGJFFqapLKklZNQedR chfG8YbztYAzdaLD9oXok8Tn4ryhfisLDXVln4XPp1O4wOT78haNBl3PQ9Xd7NvR 8frFJ8LqIvcaD5NKOp+Q5tHvqsJO2UqkiF8hgOstIcq1KvAJq6BbZPHyN45YZmqk ydrLmO0q6LKKnYjJJ6Vus9GhOTnytdn9kaIN7d0wDES6atPg9CbcmiHuz6mCL5mc uo9kDoelfa+GmZS++onbRvi1/0ATzAqebemu8O/hkjTKTzAPcEDeoE6LjQX2ZVzR kVEbsqXr3tS/TetpiS3RZEHHyrqKbON379XAln/aVSrafPdgq5CdEZnyPA9SnP7y bs36Dx8bN4mJpMy468Q4paQEMf5v08g4zKgnBu628V9MkyVtWrURH1OLUNk+mtg6 3jaM9ca38padwjL3aw4d7dohrG8Eil+fUfugm976ao6rj0hNCfFWWgCAPpQYJJxb JJCaNmNsbBcZohYOnApGYK5g9Ud67QFHbPlO/JcCvFXzfpqddgyvyic9FplWZ+rU 1A8FdvP6zFLs2PPHztgI =Xke+ -----END PGP SIGNATURE-----

1 0

Embedding tor in an application and using tor without opening a port
by Navin Francis 02 Apr '13

02 Apr '13

I am making a small application that always uses tor to communicate. I have embedded tor into the application by compiling and linking the tor source code along with my own code and calling tor's main() from within my own main(). To send data, tor has to open a port on the machine and my application would have to send data to 127.0.0.1:port This seems a little unnecessary since both tor and my application run in the same process. More importantly, it seems like any program on the machine can use my application's embedded tor client by connecting to the right port. The easiest way to avoid opening a port seems to be to modify the socket implementation so that it accesses an array rather than sending/receiving data. Are there any existing applications that embed tor in this manner? Is there a better way to do this, and if not, are there any corner cases I have to watch out for?

5 6

Re: [tor-dev] Using Tor as a library
by wac 01 Apr '13

01 Apr '13

Hi Fabio: >I'd suggest for the "output" to produce a set of patches against Tor >(development version), including modifications to: >- build system >- documentation (man pages) >- unit-tests >everything following the coding guidelines of Tor with the goal/hope to >be integrated. I have not developed too much unix code (mostly at the university for linux some time ago), so I am doing this mostly for windows. As matters of fact I compiled Tor using a visual studio project (Used to it and easy for me to trace/debug). I am going to leave the VS project in order to attract developers from the windows world. But I'll try to get into the build system and such. I was working on top of 2.4-maint but had to lower to 2.3-maint as it was crashing (and lower to libevent 1.4) since there was a null pointer access at the microdescriptor cache coming from who knows where. I plan to use the most stable build and integrate over time stable releases keeping up with Tor stable releases. Problem is with unstable releases introduced bugs could be hard to determine if it was caused by code modified by me or was just a bug introduced in Tor. It is frenetic what is happening at git. Would be too difficult for me to work on top of moving ground. Fortunately both versions doesn't seems to be too different. I think unit testing could be done better with a library as well. >It would be very valuable to define the "use case" of your library, in >particular what you are going to support and for which context of >use.For example are you going to simply support "outgoing anonymous >connection" or "are you going to support caching descriptors to avoid >excessive load on Tor network?" or "Are you going to support Tor Hidden >Service exposure to receive inbound connections" ? My aim is to just go for outgoing anonymous connection but I don't see any reason to not support the rest. Maybe bring initially anonymous connections since is the most common use case to put the ball to roll and then bring support for the rest. To look for inclusion that would have to be done in the long run. Maybe step by step stack socks/transparent/control server code on top of the library in order to clean up the code and make it simpler separating concerns. ATM I can create streams, get notifications when data arrives and when they are closed. Still looking how to write to streams. Doesn't seems easy and I am worried about concurrency. Tor seems to be using threads only with CPU workers and not built with much multithreading in mind. For control, replace control commands with library calls. So for instance Tor control handling code could call the API after parsing network data. And be plugged/unplugged. I also abstracted logging. In this way it could be printed to console, stored in a database, printed in app window, syslog or whatever your choice. I am looking to simplify Tor and abstract it somehow. Easier to audit, modify and enhance. So far I've seen very ugly patches to implement DNS resolver and transparent proxy stacking on top of part of socks handling. A more abstract interface using streams and circuits seems cleaner to me. >After a first prototype is achieved, it would be the best to: >a) define the API >b) document the API >c) submit the API for review (to tor-dev mlist) Ok I'll be doing that. I would like to get peer review from Tor developers. My idea is to keep it simple. Maybe get version, initialize library, connect and notify me when an event happens and shutdown library. >Additionally, due to the paranoia-level of Tor environment, it would be >useful a documents describing a "Threat model" with a set of risks >represented by the use of Tor as a library and how they are >managed/mitigated. Good point to consider. I think Christopher comments will be useful here. If someone wants to add some possible risk please do so. >If you will need to modify some existing core pieces of Tor code here >and there, always open a relevant ticket on http://trac.torproject.orgexplaining why a modification is relevant/useful with >a commit of the patch well documented (to stimulate/facilitate the integration). Good idea. I am using a macro when defined you could obtain the library and when undefined you get original Tor. But I guess I will leave this for the future. My need is just get anonymous connections out, maybe help Tor evolve for the better could be harder to obtain. >As a prototype example, i'd suggest you to provide an example "Python >Binding" that use your "libtor", due to the heavy use of Python within >the Tor Environment, that show how to embed Tor within a Python application. I am not too much Python inclined but I know some Python. Ok thanks for the recommendation. I'll keep this as a future task in order to attract developers from/to the Tor community. Regards Waldo

1 0

Damian's Status Report - March 2013
by Damian Johnson 01 Apr '13

01 Apr '13

Hi all. Even without counting the Boston dev meeting March was a highly productive month. Noteworthy things include... * Stem Tutorials Stem's tutorials got an overhaul, including: * A much friendlier layout. No more intimidating wall of text - the tutorials have been rewritten and broken into subsections. * "To Russia With Love" tutorial, exemplifying client usage and programmatically managing a tor process. * "Tortoise and the Hare" tutorial, demoing tor event handling through a curses bandwidth graph. * "Double Double Toil and Trouble", which ends the tutorials with a page of scripts and applications that use stem. Feedback welcome! The shiny new tutorials are available at... https://stem.torproject.org/tutorials.html * Stem Packaging Thanks to a half dozen package maintainers stem is now available on several platforms, with more in the works... https://stem.torproject.org/download.html The most recent was the Python Package Index (PyPI), which can make stem installation as simple as 'pip install stem'... https://pypi.python.org/pypi/stem/ * Google Summer of Code The timing of this year's winter developer meeting couldn't have been better. During it I begged, bribed, and poked people with pointy sticks until they 'volunteered' to mentor something in this year's GSoC. Thanks to them our project ideas page is no longer overly sparse. Google will be announcing the selected orgs on April 8th. * Stem Release 1.0 Last, but certainly not least I wrote numerous finishing touches for stem and made its long overdue initial release! https://blog.torproject.org/blog/stem-release-10 Cheers! -Damian

1 0