- tor-dev - lists.torproject.org

Re: [tor-dev] [tor-relays] BitTorrent complaint
by grarpamp 12 Apr '13

12 Apr '13

Swiped from the 'BitTorrent complaint' thread over on relays... > If an exit relay then drops that > connection silently, Tor (and the user) cannot know it needs to select a > different exit. The connections simply fail. > ... > What you do with that iptables rule (or similar rules) is block a bunch > of URLs. There may be room to take and work this capability further... Instead of populating the directory with the actual exit policies, offload this into a client poll of a … [View More]

1 0

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by Navin Francis 12 Apr '13

12 Apr '13

I managed to build it with MSVC after tinkering with the code a little. Did you guys make any progress in making tor a library? It seems like I can directly call functions like handle_getinfo_helper in control.c to control tor. //application_main.cpp //Application that starts tor in a new thread in the same process #include <future> #include <iostream> #include "libtor.h" using namespace std; int main(int argc, char *argv[]){ auto tor_return=async(launch::async,start_tor_main,argc, … [View More]

1 0

(Py)Obfsproxy Debian packages
by George Kadianakis 11 Apr '13

11 Apr '13

Greetings (Debian) people, we have decided to keep the Obfsproxy name and simply replace the old C codebase with the new Python codebase. It seems that 'obfsproxy' is an extremely powerful brand name and changing it will result in user confusion. That said, what is the best way to update the Debian packages so that they contain the Python codebase? I remember weasel telling me that updated packages can only be included in Debian after wheezy is stabilized. Can we have Python Obfsproxy … [View More]

3 7

Building Tor on OS X with brew fails
by Bernard Tyers - ei8fdb 11 Apr '13

11 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi there, I just tried building Tor with brew on OS X (10.6.8) using the instructions available on the TP website ( ). It fails at the last few steps complaining of a 404: Homebrew. If formula fail to build uninstall Macports/Fink and reinstall any affected formula. Also installing dependencies: libevent ==> Downloading http://monkey.org/~provos/libevent-2.0.12-stable.tar.gz #####################################################################… [View More]

3 3

Fwd: Fwd: Orbot feature for GSoC 2013
by Nathan Freitas 11 Apr '13

11 Apr '13

Is there room for an Orbot developer under Tor's GSoC? I know that I was completely awol during this process, and not a mentor, but this is a worthwhile effort! -------- Original Message -------- Subject: Fwd: Orbot feature for GSoC 2013 Date: Thu, 11 Apr 2013 17:50:26 +0200 From: Pavlos <onexemailx(a)gmail.com> To: nathan(a)guardianproject.info CC: abel(a)guardianproject.info Hello, I talked in #tor-dev and asked about a feature I could implement for Orbot as part of … [View More]

3 3

Help me test Tor Browser Launcher
by Micah Lee 10 Apr '13

10 Apr '13

I posted a little over a month ago about Tor Browser Launcher, a project I've been working on to make it easier for GNU/Linux users to securely download, install, keep updated, and launch TBB: https://github.com/micahflee/torbrowser-launcher I think it's about ready for a first release! I wrote a blog post all about it (including screenshots), where I ask for help testing it: https://micahflee.com/2013/04/sudo-apt-get-install-torbrowser/ Please give me feedback, and post any bugs you find … [View More]

2 4

Tor in Google Summer of Code 2013
by Damian Johnson 10 Apr '13

10 Apr '13

Interested in coding on Tor and getting paid for it by Google? If you are a student, we have good news for you: We have been accepted as a mentoring organization for Google Summer of Code 2013! https://www.google-melange.com/gsoc/homepage/google/gsoc2013 https://www.google-melange.com/gsoc/org/google/gsoc2013/tor Here are the facts: The summer of code gives you the opportunity to work on your own Tor-related coding project with one of the Tor developers as your mentor. You can apply for a … [View More]

1 0

Hidden service access without TOR
by Jesus Cea 09 Apr '13

09 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Somebody pointed to me "Using Tor as a library" <https://lists.torproject.org/pipermail/tor-dev/2013-March/004564.html>. I am thinking about writing a proxy service to install in your local machine to be able to access TOR Hidden Services without having to install the full TOR in your machine. Client anonimity here is not an issue, but being able to access to "onion" hidden services easily and faster than providing mutual anonimity. All … [View More]

2 1

Moving our website to git and splitting it in two
by Peter Palfrader 08 Apr '13

08 Apr '13

Hi, Tom asked what was needed to get our website moved to git. Probably not much. And while we're at it we could split the repository into two parts: - things that are copied over verbatim, and - things that build stuff that make our website. Splitting this makes it easier to publish something more clean to our webservers - there is little point in putting build scripts and sources into the webroot right along the finished html files. https://people.torproject.org/~weasel/tor-web-underlay/… [View More]

7 13

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by wac 06 Apr '13

06 Apr '13

Hi Navin: Some versions of zlib can be built with the IDE but for the one I used (oldest bugfree because of gzip support) I used nmake. Just open Visual Studio command prompt. Or if you don't locate it, (but recommend you to do it) just run vcvars32.bat (is in bin directory) to set up the environment. For libevent: open the Visual Studio Command Prompt, then cd \where\you\put\it nmake -f makefile.nmake for zlib something similar. for openssl you need to do more steps and install perl for … [View More]configuration (they recommend activestateperl) at INSTALL.W32 file just read "Visual C++" section. I just used dynamic library but there is a way to do it static library if you want. when you open the solution left click at the project. Select properties. Then go to Configuration properties -> C/C++ -> General See there "Additional include directories". You need to change those as they are not relative. Then go to Configuration properties -> Linker -> General See there "Additional Library Directories". You need to change those too to point to your directory. I then dropped the openssl dlls next to Tor executable. I want you to know I changed the runtime to be non debug version as I don't needed to debug there so if you want to do it you need to somehow build them with debug symbols and take back debug build of tor to use debug runtime otherwise it won't link as the linker would find duplicated symbols. Maybe the tree is unnecessary but ok there it goes. Regards Waldo ------------------------------ On Thu, Apr 4, 2013 20:56 EDT Navin Francis wrote: >Hi Waldo, > >I tried to build using your project and I think most of the Tor code works >but I am not sure how to add all the libraries. Can they be built from the >IDE? > >Can you also run "tree /f >files.txt" in your source folder and attach the >file. That way, I can make sure I have the same files as you. > >thanks, >Navin > > >On Tue, Apr 2, 2013 at 10:49 PM, wac <waldoalvarez00(a)yahoo.com> wrote: > > > ------------------------------ > On Wed, Apr 3, 2013 00:38 EDT Navin Francis wrote: > > Hi Nick: > > >It seems like like we are trying to do almost exactly the same thing :) > > > >You also mentioned that you got Tor working as a visual studio project. I > >was trying to do this myself, but its really a PITA since the Tor > >configuration does not generate a visual studio project and the VC++ > >libraries don't play well with the cygwin libraries (I thought that Tor > >only supports cygwin on windows). If your code compiles, I would really > >appreciate it if you can upload it somewhere. > > Sure. I did it with visual studio 2010 since cygwin weights a lot and I am > over dialup. So just used resources available ;). The solutions + project + > instructions will serve to you? I attached the solutions + project. I am > looking to upload the rest once I am done. I tested writing and works like > a charm but I am using the same thread. Requested www.torproject.orgwebpage using Tor :). Still gotta make things reentrant. Maybe someone > wants to join. > > You need to place the files inside the folder win32 and drop the files > there. I named it tor-windows-vs2010 but you likely can choose whatever you > want for the name. > > You will have to change libraries location and header files since I didn't > set them relative. > > I built all the libraries from source. OpenSSL, libevent and zlib with > visual studio as well with nmake using the visual studio console. For > OpenSSL you need Perl. Not sure if zlib is ok since I had to try several > for gzip support and picked an old one. > > If you need help building the libraries just let me know. > > Ahh and I had to move some files around. At least curve25519-donna.c I > placed it in win 32 directory for Tor 0.2.4. > > That should do, but if you hit something just let me know. > > Regards > Waldo > > > _______________________________________________ > tor-dev mailing list > tor-dev(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev > > [View Less]

1 0

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by wac 05 Apr '13

05 Apr '13

------------------------------ On Wed, Apr 3, 2013 00:38 EDT Navin Francis wrote: Hi Nick: >It seems like like we are trying to do almost exactly the same thing :) > >You also mentioned that you got Tor working as a visual studio project. I >was trying to do this myself, but its really a PITA since the Tor >configuration does not generate a visual studio project and the VC++ >libraries don't play well with the cygwin libraries (I thought that Tor >only supports cygwin on … [View More]windows). If your code compiles, I would really >appreciate it if you can upload it somewhere. Sure. I did it with visual studio 2010 since cygwin weights a lot and I am over dialup. So just used resources available ;). The solutions + project + instructions will serve to you? I attached the solutions + project. I am looking to upload the rest once I am done. I tested writing and works like a charm but I am using the same thread. Requested www.torproject.org webpage using Tor :). Still gotta make things reentrant. Maybe someone wants to join. You need to place the files inside the folder win32 and drop the files there. I named it tor-windows-vs2010 but you likely can choose whatever you want for the name. You will have to change libraries location and header files since I didn't set them relative. I built all the libraries from source. OpenSSL, libevent and zlib with visual studio as well with nmake using the visual studio console. For OpenSSL you need Perl. Not sure if zlib is ok since I had to try several for gzip support and picked an old one. If you need help building the libraries just let me know. Ahh and I had to move some files around. At least curve25519-donna.c I placed it in win 32 directory for Tor 0.2.4. That should do, but if you hit something just let me know. Regards Waldo > >Regards, >Navin > > >On Mon, Apr 1, 2013 at 9:20 PM, wac <waldoalvarez00(a)yahoo.com> wrote: > > > Hi Nick: > > > * Using process isolation to isolate Tor from its controllers makes it > > easier to tell Tor bugs from controller bugs.... > > > * Using process isolation to isolate Tor from its controllers can also > > make it easier to secure each of the two domains properly against bugs > > in the other, especially if you're using OS or VM sandboxing features. > > This is a point I think is valid to consider. Thanks for pointing it. > However a library is not equal to lack of process isolation. I could have > the application (for instance the browser) launch a process being a thin > layer around the library and exchange data using some IPC mechanism. That > could be a future step. > > >plus maybe another library that would find a running Tor or launch one as > needed. > > Is there a standard way of doing this? If not maybe would be good idea to > define it. A way to know if Tor is running and the listening > interfaces/ports. Authenticating it if possible, I would not like to have > malware pretending to be Tor and have it easily steal all my network > traffic because of this. Perhaps finding the binary somehow and check the > hash? And avoid malware using Tor as a presentation key to then shut it > down and replace it. Good questions I think. Maybe this should be just > configurable by end user instead of doing it automatically until they are > answered. > > If platform dependent I think could be defined for each platform. > > > That way we wouldn't have a huge pile of apps all stuck downloading > their own directory > >information > > I have no intentions to drop cached information, I actually pretend to > share it as much as possible. Ok is not a perfect world, some will happen. > Maybe this could be defined as well to allow diverging implementations > filling other niches than Tor, share already downloaded data or refresh it > in a cooperative way. > > > Nonetheless, people keep wanting to do it the way you suggest, and it's > free software, so do what you like. > > Correct, freedom of choice ;). Other ppl is not able to decide what's best > for me! Anyways recommendations are always welcome. > > Regards > Waldo > > _______________________________________________ > tor-dev mailing list > tor-dev(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev > [View Less]

2 1

default value of CookieAuthentication is wrong inthe documentation
by Tomáš Hnyk 04 Apr '13

04 Apr '13

Hello, I am using tor on Ubuntu 12.10, version of tor: v0.2.3.22-rc (git-4a0c70a817797420) The documentation https://www.torproject.org/docs/tor-manual.html.en says that default value of CookieAuthentication is 0. However, until I set it 0 in my torrc, tor wanted a cookie ("host 9051 515 Authentication failed: Wrong length on authentication cookie.") My torrc is this: FascistFirewall 1 ControlPort 9051 CookieAuthentication 0 I guess the documentation (on the web and the man page and comments … [View More]

4 8

Re: [tor-dev] Embedding tor in an application and using tor without opening a port
by wac 03 Apr '13

03 Apr '13

Hi Nick: > * Using process isolation to isolate Tor from its controllers makes it > easier to tell Tor bugs from controller bugs.... > * Using process isolation to isolate Tor from its controllers can also > make it easier to secure each of the two domains properly against bugs > in the other, especially if you're using OS or VM sandboxing features. This is a point I think is valid to consider. Thanks for pointing it. However a library is not equal to lack of process isolation.… [View More]

2 1

How many OR Listen per Tor relay?
by SiNA Rabbani 02 Apr '13

02 Apr '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 How many public IP addresses can 1 Tor relay listen for and also publish to directories? Note that non of these public IP addresses are going to actually exists on the relay, plan is to use iptables to forward traffic from multiple locations on the Internet back to a *monsters* relay. Think of it as NAT with Public IP addresses. - --SiNA - -- “Be the change you want to see in the world.” Gandhi -----BEGIN PGP SIGNATURE----- … [View More]

1 0

Embedding tor in an application and using tor without opening a port
by Navin Francis 02 Apr '13

02 Apr '13

I am making a small application that always uses tor to communicate. I have embedded tor into the application by compiling and linking the tor source code along with my own code and calling tor's main() from within my own main(). To send data, tor has to open a port on the machine and my application would have to send data to 127.0.0.1:port This seems a little unnecessary since both tor and my application run in the same process. More importantly, it seems like any program on the machine can … [View More]

5 6

Re: [tor-dev] Using Tor as a library
by wac 01 Apr '13

01 Apr '13

Hi Fabio: >I'd suggest for the "output" to produce a set of patches against Tor >(development version), including modifications to: >- build system >- documentation (man pages) >- unit-tests >everything following the coding guidelines of Tor with the goal/hope to >be integrated. I have not developed too much unix code (mostly at the university for linux some time ago), so I am doing this mostly for windows. As matters of fact I compiled Tor using a visual studio project (… [View More]Used to it and easy for me to trace/debug). I am going to leave the VS project in order to attract developers from the windows world. But I'll try to get into the build system and such. I was working on top of 2.4-maint but had to lower to 2.3-maint as it was crashing (and lower to libevent 1.4) since there was a null pointer access at the microdescriptor cache coming from who knows where. I plan to use the most stable build and integrate over time stable releases keeping up with Tor stable releases. Problem is with unstable releases introduced bugs could be hard to determine if it was caused by code modified by me or was just a bug introduced in Tor. It is frenetic what is happening at git. Would be too difficult for me to work on top of moving ground. Fortunately both versions doesn't seems to be too different. I think unit testing could be done better with a library as well. >It would be very valuable to define the "use case" of your library, in >particular what you are going to support and for which context of >use.For example are you going to simply support "outgoing anonymous >connection" or "are you going to support caching descriptors to avoid >excessive load on Tor network?" or "Are you going to support Tor Hidden >Service exposure to receive inbound connections" ? My aim is to just go for outgoing anonymous connection but I don't see any reason to not support the rest. Maybe bring initially anonymous connections since is the most common use case to put the ball to roll and then bring support for the rest. To look for inclusion that would have to be done in the long run. Maybe step by step stack socks/transparent/control server code on top of the library in order to clean up the code and make it simpler separating concerns. ATM I can create streams, get notifications when data arrives and when they are closed. Still looking how to write to streams. Doesn't seems easy and I am worried about concurrency. Tor seems to be using threads only with CPU workers and not built with much multithreading in mind. For control, replace control commands with library calls. So for instance Tor control handling code could call the API after parsing network data. And be plugged/unplugged. I also abstracted logging. In this way it could be printed to console, stored in a database, printed in app window, syslog or whatever your choice. I am looking to simplify Tor and abstract it somehow. Easier to audit, modify and enhance. So far I've seen very ugly patches to implement DNS resolver and transparent proxy stacking on top of part of socks handling. A more abstract interface using streams and circuits seems cleaner to me. >After a first prototype is achieved, it would be the best to: >a) define the API >b) document the API >c) submit the API for review (to tor-dev mlist) Ok I'll be doing that. I would like to get peer review from Tor developers. My idea is to keep it simple. Maybe get version, initialize library, connect and notify me when an event happens and shutdown library. >Additionally, due to the paranoia-level of Tor environment, it would be >useful a documents describing a "Threat model" with a set of risks >represented by the use of Tor as a library and how they are >managed/mitigated. Good point to consider. I think Christopher comments will be useful here. If someone wants to add some possible risk please do so. >If you will need to modify some existing core pieces of Tor code here >and there, always open a relevant ticket on http://trac.torproject.orgexplaining why a modification is relevant/useful with >a commit of the patch well documented (to stimulate/facilitate the integration). Good idea. I am using a macro when defined you could obtain the library and when undefined you get original Tor. But I guess I will leave this for the future. My need is just get anonymous connections out, maybe help Tor evolve for the better could be harder to obtain. >As a prototype example, i'd suggest you to provide an example "Python >Binding" that use your "libtor", due to the heavy use of Python within >the Tor Environment, that show how to embed Tor within a Python application. I am not too much Python inclined but I know some Python. Ok thanks for the recommendation. I'll keep this as a future task in order to attract developers from/to the Tor community. Regards Waldo [View Less]

1 0

Damian's Status Report - March 2013
by Damian Johnson 01 Apr '13

01 Apr '13

Hi all. Even without counting the Boston dev meeting March was a highly productive month. Noteworthy things include... * Stem Tutorials Stem's tutorials got an overhaul, including: * A much friendlier layout. No more intimidating wall of text - the tutorials have been rewritten and broken into subsections. * "To Russia With Love" tutorial, exemplifying client usage and programmatically managing a tor process. * "Tortoise and the Hare" tutorial, demoing tor event handling through a … [View More]

1 0

Stem Release 1.0
by Damian Johnson 31 Mar '13

31 Mar '13

Hi all. After eighteen months of work and a number of delays rivaling that of the Big Dig I'm pleased to announce the initial release of stem! For those who aren't familiar with it, stem is a python controller library for tor. With it you can write scripts and applications that interact with your tor client or relay. For some examples of what you can do see the tutorials on... https://stem.torproject.org/ Stem is compatible with python 2.6 and higher (including the 3.x series), and is a near … [View More]

1 0

Re: [tor-dev] Using Tor as a library
by wac 29 Mar '13

29 Mar '13

Hi Fabio Pietrosanti: Thanks, I appreciate your help. I will be working on this. I actually was considering to maybe provide it to the community so people could pinpoint bugs and contribute patches. I will be studying onionbrowser. But seems they are running Tor as a thread inside the browser executing tor_main and then have the browser connect to itself using socks 5 which is somehow ugly. This looked interesting: https://lists.torproject.org/pipermail/tor-talk/2011-September/021528.html … [View More] but seems Tor just evolved. > That's the future of Tor, to be integrated as a library just like an > encryption library into application. Same feeling here. Thanks for your comments Christopher Schmidt. I do appreciate to hear different points of view and know beforehand feelings of people against. Yet I disagree and I would like to argument why. >Embedding a Tor client in another application cripples >auditability, configurability, updateability etc. of Tor. Not necessarily. If it is open source would be auditable. I could dynamically link the library to let you update it on your own if you want. Also the application can be updated. But even if statically linked and not updated as the Tor network evolves the application would become unusable if the standard changes therefore killing the insecure application eventually. Regarding configurability I could proxy your configuration to the Tor library. Since it is open you can check I am being honest or if there are bugs even if such application is not open source. (you could even override received configuration from the application) I could let you configure the application to use embedded Tor or not, then you could use your own tor client if you want. And this is not entirely clear to me but I believe Tor could be routed trough Tor again if you are forced to use embedded library and you are worried about it being insecure. And in any case well you can opt in or out of the application. Yet as a library I believe there would be increase of useability. That means Tor will be more popular. If it becomes more popular it means more support. I mean I probably wouldn't be donating a relay to the network If I weren't using Tor. > Even worse, an application trying to outsmart >the user by controlling Tor on its own poses a severe security risk. Well an application using Tor as it is and properly configured could create a covert channel and totally do away with your anonymity. So I am supposing the application is not intentionally evil. >From another standpoint every security chain is as strong as its weakest link. Usually the weak link is the user miss-configuring things and then comes the false sense of security. As Fabio pointed earlier the DNS leak or the direct connection for example. In any case if you want to provide arguments against I would like to hear them. I tell you what. I don't have intentions to change Tor. I basically want to do this for me. But since I notice now it could be useful to the community and the community could be providing feedback I can make it public under the same license. So this is what I am going to do. Fork Tor under the same license and change it until I get a working library. If somebody wants to join well everybody invited. I think more hands working on it will be great. And if you want to merge it with Tor well you all can decide that later. And if you want we can cooperate directly. After all both projects would be sharing a lot of sourcecode. Many fixes and optimizations will be able to come back to Tor and the library could receive updates from the Tor project. I am thinking to name it libtor. What do you say? I think a good approach could be to start with the ugly hack creating a clean API that would get extended over time and then change bit by bit until we get something clean. Regards Waldo [View Less]

2 1

Using Tor as a library
by wac 28 Mar '13

28 Mar '13

Hi Folks: I am looking to use Tor as a library for my program. I managed to build it from the sources including the required libraries. But now I am looking for hints on how to replace the SOCKS 4/5 or the transparent proxy with direct calls from my application to link them. I'm hoping somebody here can point me in the right direction. That is turning off all listening for incoming connections. Just my application going through tor circuits. I am looking not only to send/receive data over … [View More]

5 5

Re: [tor-dev] [tor-talk] Mobile Anonymity and Circumvention seems not working
by Nathan Freitas 28 Mar '13

28 Mar '13

Does the "check.torproject.org" site return a connected message in the default browser? chandra mohan <rkchandramohan(a)gmail.com> wrote: >Hi, > > I tried Trasparent proying of Orbot as mentioned >https://guardianproject.info/apps/orbot/->OTHER >*APPS* and observed all web (traffic built-in Browser, Gmail, YouTube, >Maps and any other application >that uses standard web traffic)and all DNS requests from my Android >mobile >are not following Tor … [View More]

1 0

Tor Exit Images
by Griffin Boyce 24 Mar '13

24 Mar '13

Hey all, After talking to Wendy Seltzer, I decided to bring this up on the list. I frequently talk to people who would like to run an exit node, but who aren't as good a sysadmin as they'd like to be. It would be great if there were server images that could be fairly easily installed and then configured. All of these people so far have had the means to spend $150ish a month on the required hosting, they just felt that getting it running was a stumbling block. Thoughts? ~Griffin -- "… [View More]

3 5

Basics of Developing #newbie
by Ashish Patil 24 Mar '13

24 Mar '13

Hello! I am new to Tor-Dev & am looking forward to contributing as much as I can. My question is, after resolving any bug in my local copy of the source code, what are the next steps? Basically, do I have to build again? Run tests? And other similar tasks in what order? Hope you got my question. I went through this in the wiki & FAQs but did not find anything detailed. (Hopefully I'll write one when I know it all) --Ashish

1 0

[Stegotorus] Stegotorus stuff
by vmonmoonshine＠gmail.com 24 Mar '13

24 Mar '13

Hello TorDev, Here, I'm reporting my recent progress on Stegotorus as well as answering some questions from past. During past month, I mainly worked in "retransmit = false" mode trying to restore reliable browsing. I have resolved quite few bugs. Some of them where due to incomplete implementation of "retransmit = false" mode after implementing retransmission. But the major one seems to be the flush_interval implementation: if server had transmitted data to the client, the client opens a new … [View More]connection, "probably" in near future, to retrieve more data. The probability follows geometric distribution to simulate user browsing behavior. This is OK most of the time. But when you transmit 1000s of packets, inevitably it happens that it samples delays such 40-60 seconds. Unfortunately, Firefox isn't patient enough to wait so long to receive the rest of the data and judge the connection as dead. I changed this now that if it real data came from the server on previous connection, the client opens a new connection 100msec which I know isn't the point but I wanted to restore reliability. The better way might be to schedule opening few connections at a time (instead of one). In this way it is very improbable that all of them sample unacceptable delays. I am going to debug retransmission in the next step. Now few questions, that I was putting off partialy cause I was tired talking and I wanted to do something practical before talking more: From: Roger Dingledine <arma(a)mit.edu> on Sun, 13 Jan 2013 13:04:23 -0500: > 3) What's the overhead of putting your Tor traffic through each of the > steg modules? Now the chopper is measuring the efficiency of the steg modules based on the following measure for each circuit: (no of byte transmitted from upstream)/(no of bytes transmitted downstream ino order to transmit upstream bytes) The summary of the results measured using speedtest.net: |-------------+----------+---------+------+------| | | Mb/s | Mb/s | Efficiency | |-------------+----------+---------+------+------| | Steg module | Download | Upload | S->C | C->S | |-------------+----------+---------+------+------| | Direct | 19.52 | 2.08 | 1 | 1 | | nosteg | 12.98 | 2.26(!) | 0.98 | 0.98 | | http | 0.28 | 0.31 | 0.03 | 0.07 | | http_apache | 1.43 | 0.47 | 0.65 | 0.52 | |-------------+----------+---------+------+------| (!) The faster upload of nosteg than the direct connection with Stegotorus is persistent and I can't figure out why. it might be a bug with speedtest.net algorithm or a their weird notion of speed. If you are downloading, the server->client efficiency is like this: |-------------+-----------------| | Steg module | S->C Efficiency | |-------------+-----------------| | Direct | 1 | | nosteg | 0.98 | | http | 0.10 | | http_apache | 0.65 | |-------------+-----------------| The efficiency of course varies depending on the cover texts. These are measured for http module using the fake cover generated by zack and for http_apcahe using random javascripts that I have downloaded plus the pdf files I had on my computer. The advantage of http_apache over http steg module is due to http_apache always chooses the most efficient cover possible verses http module which randomly chooses 10 candidates and then chooses the best one among them. The http_apach approach, however, isn't security-wise plausible. The best solution seems to be hybrid of the two with user having a say how efficient/secure wants it to be. With all my cat and mouse with curl, it still manages to steal data from libevent and I lose 1 in 100 packets or so. In presence of retransmission this is not a big deal but I have to solve it in more fundamental way. From: George Kadianakis <desnacked(a)riseup.net> on Wed, 30 Jan 2013 14:09:35 +0200: > The code monkey inside me doesn't see any code-quality-related tickets > in that URL. stegotorus boasts 12k LoC of C++ and some of that code > was written in haste. You can divide the ST code into three major parts. Network, chopper and the steg modules. The network is basically, obfsproxy. For the chopper, beside Zack's obsession with overloading functions with the same name by changing type/no of parameters, I think the rest is a pretty good standard code and well commented (I suspect it is very similar to a typical TCP implementation). It lacks is a flow chart that explain what exactly happens when data is received or sent. The ugly code are the steg modules, (partially because it is in C rather than C++), but then the steg modules are not innate part of Stegtorus and are meant to be re-implemented by interested party. Having said that, Zack has mentioned that hardening the code is number 1 priority. Just because he mentioned it later, I haven't included it in the track list yet. > Looking at this from a deployment point of view, > I feel much more relaxed and easygoing with deploying programs written > in a high-level language (like Flashproxy or pyobfsproxy) than with > deploying an unaudited C++ program with many bad code moments. I suspect that python inefficiency will break Stegotorus completely. Now when I run Stegotorus it eats all CPU time. I know this is partially due to heavy logging and partially because I compile it with zero optimization and full debug but I can only imagine how it would look like if it was written in python. There are lots of exact timing there in scope of msec. These are not important when you are running nosteg module which is basically obfsproxy with variable packet size. But when you turn to simulating http with multi-connections and constant negotiation of chopper with steg modules, I doubt if python is an option. Beside, the steg algorithms can get quite complicated. > I think that a trac ticket with a bit of research on how painful would > be to write a deployable <high-level language>-port of stegotorus > would be a good idea. I know that Zack is also interested in exploring > this avenue. I haven't looked into pyobfsproxy, but translating the chopper into python over pyobfsproxy doesn't seems to be an impossible task (you are looking at around 3000 LoC). But then you still need some steg module to get something more than pyobfsproxy (if we close our eyes on the preformance doubts I raised). Maybe, having a cython/c interface to steg module be a middle way compromise. Wow I talk too much! I'll spare everybody for now. Vmon [View Less]

1 0

Does anyone need python 2.5 support in stem?
by Damian Johnson 22 Mar '13

22 Mar '13

Hi all. Will anyone be sad if I drop python 2.5 support from stem (just supporting 2.6 and higher, including the 3.x series)? If all goes well stem will be having its first release this next weekend and my thinking is this... * Python itself considers python 2.5 to be obsolete, having dropped docs for everything below 2.6. * Every OS I can think of except maybe CentOS has at least 2.6, and more likely 2.7. * I have a dozen dirty hacks throughout the codebase just for 2.5 compatability and I'… [View More]

2 1