- tor-dev - lists.torproject.org

Re: [tor-dev] [tor-assistants] Python metrics-lib
by Damian Johnson 17 May '12

17 May '12

Hi Beck, hi Karsten. First I'd like to make sure that I'm clear on what we're trying to do. The javadocs for VerifyDescriptors [1] says that it... > Verify server descriptors using the contained signing key. Verify that > 1) a contained fingerprint is actually a hash of the signing key and > 2) a router signature was created using the signing key. > > Verify consensuses using the separate certs. Verify that > 1) the fingerprint in a cert is actually a hash of the identity key, > 2) a cert was signed using the identity key, > 3) a consensus was signed using the signing key from the cert. Honestly I'm not yet sure what most of this means. The first #2 is simply checking that the descriptor content can be verified using the router-signature and signing-key, right? If so then this sounds like a good place to start since it's entirely self-contained within the descriptor and just involves implementation and testing of... https://gitweb.torproject.org/stem.git/blob/HEAD:/stem/descriptor/server_de… > However, I need some suggestions for the choice of Python cryptography API, since I haven't used any before. Nor have I. At present stem does not have any dependencies outside of python's builtin functions. If we need PyCrypto and it's the best choice then so be it, but be sure to wrap the imports in a try/catch so we only raise an ImportError when executing the function that requires the PyCrypto library. Cheers! -Damian [1] https://gitweb.torproject.org/metrics-tasks.git/blob/HEAD:/task-2768/Verify…

7 20

directory requests
by SiNA Rabbani 16 May '12

16 May '12

I see the same IP sending the same request over and over. Is this normal behaviour? All the best, SiNA XXX.XXX.XXX.XXX - - [16/May/2012:15:15:00 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:01 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:02 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:02 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:02 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:02 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:02 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:02 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:04 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:06 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:08 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:09 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:12 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:13 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:13 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:13 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:16 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:16 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:16 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" XXX.XXX.XXX.XXX - - [16/May/2012:15:15:19 -0400] "GET /tor/status/all.z HTTP/1.0" 200 540655 "-" "-" "-" -- First they ignore you, then they laugh at you, then they fight you, then you win ~ Mahatma Gandhi

1 0

Re: [tor-dev] HFOSS as Wesleyan this summer
by Damian Johnson 16 May '12

16 May '12

Hi Megan, hi Erik, glad to have you working with us this summer! First a bit of a project introduction is probably in order. Stem is a python controller library for tor. Like its predecessor, TorCtl [1], it uses tor's control protocol [2] to help developers program against the tor process, enabling them to build things similar to Vidalia [3] and arm [4]. Most of stem's core bits (process communication with tor, asynchronous message handling, etc) are done, and development is now focused on the wrapper around that which makes for a developer-friendly API. There's still a ton of work to do, and currently three people hacking on the project... * Damian (project author) * Ravi (GSoC student) - Working on a grab bag of stem related tasks including the general controller, some descriptor parsing, and migrating the first client (arm) over to stem. [5] * Beck (volunteer) - Doing a deep dive into the crypto behind descriptor validation. [6][7] Karsten, Ravi, and I just updated stem's development wiki yesterday so it should be reasonably up to date... https://trac.torproject.org/projects/tor/wiki/doc/stem Codebase: https://gitweb.torproject.org/stem.git So my first question is, what are your interests? It seems that most people either lean toward research or application, and we have a lot to do that fit both. To start with please take a look at the wiki's bugs and improvements sections. Those are bite sized tasks that should be reasonably small and start immersing you in the codebase. After that, both the metrics-lib tasks (more research focused) or porting the tor interpretor (more application) would be great projects. Here's a brief overview of the communication channels we use: - #tor and #tor-dev on OFTC: we're most active on irc, so I definitely suggest being in these channels [8] - tor-talk [9] is our user mailing list which is somewhat high volume. - tor-dev [10] is a lower volume development list and a good place for technical discussions. Unless something is private please include this in your email cc. Hope this helps, and again - welcome! -Damian PS. I highly suggest introducing yourself to this list. The more you're involved with the tor community the better, and we'd be thrilled if you stuck around after your project to become core tor developers! [1] https://www.torproject.org/getinvolved/volunteer.html.en#project-torctl [2] https://gitweb.torproject.org/torspec.git/blob/HEAD:/control-spec.txt [3] https://www.torproject.org/getinvolved/volunteer.html.en#project-vidalia [4] http://www.atagar.com/arm/ [5] https://www.torproject.org/about/gsocProposal/gsoc12-proposal-stemImproveme… [6] https://trac.torproject.org/5810 [7] https://lists.torproject.org/pipermail/tor-dev/2012-May/003510.html [8] https://www.torproject.org/about/contact.html.en#irc [9] https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk/ [10] https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev/

1 0

Faravahar Directory + reverse proxy
by SiNA Rabbani 16 May '12

16 May '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Last week I experimented with OpenSSL 1.0.1c and saw a huge increase in traffic. Unfortunately, my hardware was not up to the task and I started seeing timeouts and other errors. I have decided to replace the server with a much beefier one in the very near future. Meanwhile, I installed nginx as a reverse proxy on the Directory Port. nginx config: server { listen 154.35.32.5:80; server_name _; location / { proxy_pass http://154.35.32.5:81; } } Tor: DirPort 80 DirListenAddress 154.35.32.5:81 It was very easy and nice to configure Tor Directory behind a reverse proxy. The DirListenAddress came super handy!! Nice design. Currently the directory port is responding blazing fast: http://faravahar.rabbani.jp/tor/status/all.z Can someone poke at the directory port and let me know if they can find any issue with serving Tor in this fashion? If this works fine, I will try to configure the directory port on a fancy DDoS mitigation gear next. All the best, SiNA - -- First they ignore you, then they laugh at you, then they fight you, then you win ~ Mahatma Gandhi -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQIcBAEBAgAGBQJPs17iAAoJEJPBwXYLR9VtSvgP/3X77PZCF9yv2MGHuWwkyIDM 1Xye/A4Q5Vnm1ZekNpzsXHK0jNsl0FWKS0/zzx9zkokzeHbwN+CG7Y5jYJBdIbvP DL81Q5VDjsR8tS6MOcEHK+DqnHPpKSSNf2FYCeX9KAstumim+PTV7G84I+0sq4ZL 7B/o43XEuGA3518oLM0v1QcHW+gn58vmpgw0Xh74iv+9EKCCrEY3OJImhXp3tuoe xoM3R9mdcI87uafU/ZyToPO/sAO7f/A3yZXjvMY9XKCLEXMpSqDgrKx3Xt+AeJVs 2qtBfamiT76hpH9kv8429iP3LzJJfWUZvOl5dgziMg6GaD07KKHKFqyN9KYR/7RQ k/Gm0yQcECGxzyBRVxYIAIQFWOpK7c1/Sa9Mn4VNlzqAflYTbJrf47YDfX7vlFE0 giILtLvjcOK4fkv0OD1bTo+pFbY62WXAoZ3VwWu9jEBkgYAvdD55WWyg/zYJCKLi aSCy8f1VszPU9dciSN4JjgPU+zXvY/Zzkui2r4Y5IduVjI0h4FhTyVUETrqJj8Rt eyhfyWYONoGurSPH/LUwlfsI8T4ertZCKv9kLOl7AkOoDIrbj0XUf1mhZyjGz5H7 cN3y0q8iy87InH8udIndAUVRwYTysAHiHvZ5ycbB4OcNMK1JlC6RL3hJx64rNbob hpYatE88b/E9vlZENF8q =SepB -----END PGP SIGNATURE-----

1 0

Proposal: Make bridges report statistics on daily v3 network status requests
by Karsten Loesing 15 May '12

15 May '12

Hi Nick, here is the proposal as discussed in #5807 to improve our bridge usage statistics. Thanks, Karsten

2 2

Tor iOS repository is back online
by sid77＠slackware.it 14 May '12

14 May '12

Hi all, I'd like to announce that the Tor iOS repository is back online! TL;DR is just a two step solution: 1) If you still have the old repository installed, remove the "Sid77's Source" package, otherwise skip to step 2 2) Use Cydia to add a new repository and write or paste this url: http://sid77.slackware.it/ios/ Quick FAQ: + What happenened? Around the beginning of April, one of the machine of the slackware.it network suffered an awful disaster. Both of its disks failed, and sid77.slackware.it was hosted over there :( + There was a backup? Obviously not. Well, to be honest, I *DID* a backup the day before the disaster but I wasn't able to retrieve it in time. How lucky! :D + What does it mean? Source code was mirrored on several places and on github.com so it wasn't a big loss, however, the old GPG signing key with ID 0x6295C2FE is gone and lost. Eventually, it will expires in 2015 but I am pretty ashamed of not having a revoke certificate handy. + Why did it take you so long? Me and the rest of slackware.it admins were all busy with Real Life(tm), we tried to recover what we could from the disaster before rebuilding the missing pieces from scratch. + Ok, now what? How can I have the repository back? First, if you still have the old repository installed, remove the "Sid77's Source" package, otherwise go on. Open Cydia then go to Sources->Edit->Add and write or paste this url: http://sid77.slackware.it/ios/ then tap "Add Source". Once the repository is recognized tap, on "evelyn" (its name) and install or upgrade "Tor Toggle". Packages are signed with the new key with ID 0x09F4FCCE: Cydia will import it as son you add the new source to your repositories. + Do you know there's a "Mobile Tor" package on Big Boss repository? Yes I do. It's not mine nor I endorse it. It was uploaded by "W00t" and its package ID is org.torproject.mobiletor but I do not think its an official torproject.org package. I downloaded the deb and, as far I can tell, it should be an all-in-one version of every package I have released so far: it contains Tor, Polipo, libevent and the startup scripts. I think it misses the SBSettings toggle but I'm not that sure. I have already released an updated "Mobile Tor" version 0.3-4 in my repository which should be picked up by Cydia. In theory, the upgraded version was useless as the two packages have different IDs but I'd like to be better safe then sorry ;-) Well, it should be a good idea to remove BigBoss' "Mobile Tor" before upgrading to my packages as both of them will try to write the same files. That's all, in the following days I will update the rest of the site with package descriptions and everything else. Ciao, Marco

1 0

Thandy and what's next
by Tomas Touceda 13 May '12

13 May '12

Hello everyone, Thandy, for those who haven't heard about it by now, in few words is a package system for Tor packages and the like. One of the biggest problems we have right now is keeping users' Tor up to date, so we are trying to make time to get this going. (For more detailed information about Thandy check [1], specially the doc/ and specs/ directories) A couple of months ago, nickm and erinn worked in writing the package format spec (see [2] for more details), and now I'm going to start working as fast as I can (which may be slow) in implementing this last spec and get a working Thandy. On the more technical side, the idea is to implement this in Python as a first approach. In terms of distribution, Python isn't the best choice for platforms like Windows, but right now porting Thandy to another language isn't among the top priorities. This will probably be merged with the alpha track of releases we are making, so this can have as much testing as it can before going to stable. [1] https://gitweb.torproject.org/thandy.git/tree [2] https://gitweb.torproject.org/erinn/thandy.git/blob/934300a7c4c6c0493bedaf0… Cheers, -- Tomas Touceda Gentoo Developer - Qt, Scheme, Lisp

4 4

Orbot makefile / build update
by Nathan Freitas 09 May '12

09 May '12

Since the dawn of Orbot, way back in 2009, the onion routing robot app has been built using an unwieldy combination of tools, based on an extremely out of date method for cross-compiling C code for Android/ARM. In the 1.x era of Android, there was no Native Development Kit as their is now, but thanks to some craft individuals, scripts were developed to utilize the compilers found within the core Android OS build kit. However, this mean you had to build the entire Android OS to be able to build Orbot, and you were potentially relying upon highly unstable internal libraries. This week, I finally bit the bullet, and decided to rewrite the build process utilizing the more proper NDK tools, as well as utilize Git submodules as a means for managing retrieval and version control of dependencies. With the help of _hc, sebastian, rransom, vapourEyes, asn and others, I was able to work through the various issues of porting over to the more limited NDK environment, and come out with a properly formatted Makefile for building all native code that Orbot relies upon. This means that to fully build Orbot (including tor, privoxy, and obfsproxy binaries, and the jtorctrl java library) you simply need to ensure you have the Android SDK and NDK setup, and then: 1) git clone git://git.torproject.org/orbot.git 2) cd orbot 3) make -C external 4) android update project --name Orbot --target android-15 --path . 5) ant debug That's it! (in theory). At this point, I would love some clean eyes to look at this, try it out, ask questions and who knows, perhaps submit a patch or two. Human readme on new build process and prereqs: https://gitweb.torproject.org/orbot.git/blob/HEAD:/BUILD Makefile for Orbot and dependencies (openssl, libevent, privoxy, obfsproxy) https://gitweb.torproject.org/orbot.git/blob/HEAD:/external/Makefile Successfully executed build on our build server: https://build.safermobile.org/job/Gibberbot/49/console happy friday, n8fr8

2 2

Win32: tor-gencert.c
by Gisle Vanem 07 May '12

07 May '12

MSVC doesn't have <unistd.h>. Hence this little patch is needed: --- Git-latest\src\tools\tor-gencert.c Tue Jan 24 17:05:52 2012 +++ src\tools\tor-gencert.c Thu Apr 26 08:51:02 2012 @@ -9,7 +9,9 @@ #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> +#ifdef HAVE_UNISTD_H #include <unistd.h> +#endif #include <openssl/evp.h> #include <openssl/pem.h> --------------- --gv

2 1

TorBrowser and Firefox ESR
by Jérémy Bobbio 07 May '12

07 May '12

Hi! (I tried to ask the question to Mike Perry on IRC but I am not sure that it was the best place to do so, also given that my proxy had connectivity issue yesterday. If someone have already answered me there, I apologies for wasting a little bit of your time, but I did not receive the reply.) It looks like Firefox maintainers in Debian have decided to ship Extended Support Releases in the upcoming Wheezy release. This made me wonder if ESR changed any plans concerning TorBrowser. Will Tor Browser Bundle keep following upstream "personal use" releases or switch to ESR? Cheers, -- Jérémy Bobbio .''`. lunar(a)debian.org : :Ⓐ : # apt-get install anarchism `. `'` `-

2 2

Re: [tor-dev] tbb-build for Windows
by John Crain 06 May '12

06 May '12

Hi Shondoit, Thanks for taking time! > If you have a clean VM, with a default install of Windows 7, then please try it out and > let me know. If you have a dirty Windows XP in the back of your closet, try it out > as well. I'd love to hear how it breaks and then improving it. Would you be interested in the opposite? That is, a (slightly) dirty default install of Windows 7 (x64), and a clean VM with a default install of Windows XP SP3? Alternatively, I could install XP into a new partition on HDD, if you'd prefer. > Don't forget to set-up Git (git config [...]), clone torbrowser.git, > add my personal repo, checkout 'personal-build' Could you please expand on this? I haven't used Git via mingw and I don't much feel like taking the time to RTFM ;) P.S. How would one go about using your work for profile build(s) to test benefits of something like [0,1]? [0] #3978: "Better TBB about:config settings(?); re: browsing and loading speed, etc." https://trac.torproject.org/projects/tor/ticket/3978 [1] https://trac.torproject.org/projects/tor/attachment/ticket/3978/tbb-ff-pgo.… -- John Crain johncrain(a)eml.cc -- http://www.fastmail.fm - A fast, anti-spam email service.

2 3

Win32/MSVC: tinytest.c problems
by Gisle Vanem 06 May '12

06 May '12

There are 2 problems with the use of 'stricmp()' (line 295) in tinytest.c. 1. As it is now, I'm getting an undefined reference to 'stricmp' when linking tinytest.exe and using '-nodefault:oldnames' in the link-flags. Can we please remove this lib from the requirements? 2. 'stricmp()' is used nowhere else in Tor. But rather 'strcasecmp()'. Can we use that for consistency instead? Need to include "or.h" to include src/compat.h. Like the lines from src/compat.h says: /* Windows names string functions differently from most other platforms. */ #define strncasecmp _strnicmp #define strcasecmp _stricmp How about this little patch: --- ..\..\Git-latest\src\test\tinytest.c Wed Mar 21 10:16:58 2012 +++ tinytest.c Fri May 04 14:07:55 2012 @@ -22,6 +22,9 @@ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ + +#include "or.h" + #ifdef TINYTEST_LOCAL #include "tinytest_local.h" #endif @@ -292,7 +295,7 @@ #ifdef _WIN32 const char *sp = strrchr(v[0], '.'); const char *extension = ""; - if (!sp || stricmp(sp, ".exe")) + if (!sp || strcasecmp(sp, ".exe")) extension = ".exe"; /* Add an exe so CreateProcess will work */ snprintf(commandname, sizeof(commandname), "%s%s", v[0], extension); commandname[MAX_PATH]='\0'; ----------------- There are more MSVC-issues in other test/*.c files. I can get back to that. --gv

2 2

tbb-build for Windows
by Shondoit Walker 06 May '12

06 May '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The last couple of days I've been working on recreating my build environment. I remember from the last time that it was a major PITA. (Especially with outdated docs, that aside) I decided to automate as much as possible and I came up with the following bootstrapper. It's a minimal bundle and contains 7zip and mingw-get needed to completely deploy everything. How it works is like follows: The user downloads and extracts the package to C:\MinGW (for example) Then double-clicks '.\install.cmd' and the process starts. It will first copy the files to the necessary places and then runs mingw-get to retrieve all packages. After that it downloads and unpacks MsysGit (Yes, it integrates git into mingw ;) It downloads and unpacks CMake and lastly it sets some default settings to integrate msysgit features into mingw, like git auto-completion. Note that the entire thing is self-contained. It installs nothing. For now, the user still needs to download the following manually, but they can use the default install locations: Qt, MSVS C++ Express, WinSDK 7.0, DirectX SDK I could only use sha1sum for msysgit because it's the only one that offers it. mingw-get might use hashes internally. This entire process differs none from manually downloading all packages in terms of integrity checking. I'm not sure where I was going with this lil' project, but personally, I'll keep using it. I just thought sharing it would be a good idea. It might be a step in the right direction for deterministic builds. The source can be found at: https://github.com/Shondoit/tbb-build The latest package can be downloaded from: https://github.com/downloads/Shondoit/tbb-build/tbb-build-1.2.1.zip Extract it to C:\MinGW and run install.cmd, after it's finished you can start mingw with start.cmd If you have a clean VM, with a default install of Windows 7, then please try it out and let me know. If you have a dirty Windows XP in the back of your closet, try it out as well. I'd love to hear how it breaks and then improving it. Note: you need to use my 'personal-build' branch from my personal tpo repo since the latest patches have not been merged yet. And you need to install Qt, MSVC, WinSDK and DX SDK, found here: http://releases.qt-project.org/qt4/source/qt-win-opensource-4.8.1-mingw.exe http://download.microsoft.com/download/A/E/7/AE743F1F-632B-4809-87A9-AA1BB3… http://download.microsoft.com/download/A/5/4/A54BADB6-9C3F-478D-8657-93B3FC… http://download.microsoft.com/download/7/A/B/7ABD2203-C472-4036-8BA0-E50552… Qt needs to be installed /after/ tbb-build finished completely. Don't forget to set-up Git (git config [...]), clone torbrowser.git, add my personal repo, checkout 'personal-build' And then the following should Just Work*?*: $ make -f build-scripts/windows.mk build-all-binaries bundle Good luck, Thanks, And regards, Shondoit -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPpdGcAAoJEPkeD+x3AmlW2h0IAJBDV96W/ttwW/AlGJqNhbWB Qjqz23ToX9oIhm4S3XVJ4UmnrBSMbgG611+aFVl1BRieOTCaaCNFZADF9YUrunex dXPI0v+MhLu31Lc/yjIA8wbf8lhKQT35nLn4SQLG6lKV9tbxZYSIkNsYB4oVzLXr 9n512ILU48t8E4yZzobsqdJEvgW89V91tG6nPoW27oDJnG9vvU6c93yLVAZhCtgK TMRGa48Vvw+vyC+Gr5XMYEMD3D4LB7jpf3yIrd7USKGDrrgRAXn+av6PYLxmizhV GlCD+PYjcaCIx1CO+gK5UnuZfEQUFXuQAvtw+unXVVDq1oHb7lMYpkOpcUt1BPA= =tpTj -----END PGP SIGNATURE-----

1 0

Re: [tor-dev] [tor-assistants] Python metrics-lib
by Karsten Loesing 06 May '12

06 May '12

[Moving this thread to tor-dev as suggested by Damian in separate mail.] Hi Damian, hi Beck, On 5/4/12 6:59 PM, Damian Johnson wrote: > Hi Beck. > >> I noticed that stem has not been updated during the last ten days > > Yup, I've been busy for a while with a new arm release [1] and a > variety of other chores. Ravi is currently working on safe cookie > support and I'll be getting back into stem development this weekend. > >> it's a good time to start doing some substantial work > > Great! > >> So for me, a reasonable next step is to build some subclass on top of the base Descriptor class. What do you think? > > Sounds good. What descriptor type would you like to tackle first? > Karsten, do you have any suggestions? Ravi plans to do network status > entries and microdescriptors so I'd suggest something besides those. There are quite a few options. How about extending stem to implement #2768? There's already Java code for verifying server descriptors and consensuses in metrics-tasks.git [0]. On stem's side this requires parsing the crypto parts of server descriptors, consensuses, and certificates. If the network statuses aren't there yet, starting with server descriptors should be fine. And once there's verification code for server descriptors and consensuses, there are more things to verify in Tor's various descriptors. Another option would be to write the parsing code for extra-info descriptors including all the stats. Once we have consensuses, server descriptors, and extra-info descriptors in stem, we can start writing a Python version of Onionoo [1], the service that provides the data for Atlas [2]. Let me know if you need more options or more input on these. Thanks, Karsten [0] https://gitweb.torproject.org/metrics-tasks.git/tree/HEAD:/task-2768 [1] https://www.torproject.org/projects/onionoo.html.en [2] https://atlas.torproject.org/ > Also, since you're interested in this area I'd suggest giving this a read... > https://trac.torproject.org/projects/tor/ticket/5651 > > There's nothing that needs to be done for it on our end at the moment > - just related to the stem/metrics-lib work. > > Cheers! -Damian > > [1] https://blog.torproject.org/blog/arm-release-145 > > On Fri, May 4, 2012 at 9:32 AM, Beck Chen <csybeck(a)gmail.com> wrote: >> Hi Damian, >> >> Greetings! I've read through the metrics-lib and stem.descriptor code and >> skimmed the directory server specs since you sent me the discussion thread >> between you and Karsten. I noticed that stem has not been updated during the >> last ten days, and since I've finished my semester and gone back to China, >> it's a good time to start doing some substantial work. >> >> In stem.descriptor, we already have counterparts for Descriptor.java, >> DescriptorReader.java, and ServerDescriptor.java now, and as you mentioned, >> they pretty much behave in the same way. So for me, a reasonable next step >> is to build some subclass on top of the base Descriptor class. What do you >> think? I believe you have discussed this with Karsten, so it will be helpful >> if you can forward me some of your discussions. >> >> Beck

2 1

[GSoC] Greetings!
by Ravi Chandra Padmala 28 Apr '12

28 Apr '12

Hello everyone. I'm Ravi Chandra Padmala (aka neena). I'm an undergraduate student at GITAM University in Visakhapatnam, India. I've been a user of open source software for 6 years now. My go-to programming language is usually python. I have tinkered with a few other languages, and I try my best to be programming language agnostic, I will be working on Stem this summer (as a part of the Google Summer of Code program). Damian (atagar) is my primary mentor. Among other things, I'll be implementing the general controller class for Stem. If anyone is interested in exactly what I'm going to be working on, do take a look at my proposal which is available here[1]. If anyone needs to contact me, this is my primary email. I'm 'neena' on IRC (irc.oftc.net) I'm geographically located in GMT+5:30. (Though, my body clock is in GMT-1). -- Cheers, neena [1] https://www.torproject.org/about/gsocProposal/gsoc12-proposal-stemImproveme….

1 0

New from GSoC
by 九零后 28 Apr '12

28 Apr '12

Hi, I come here from GSoc and want to join project Obfsproxy. But I can't find the contributors' mail , where can I get it?

2 1

[Patch] test_util.c with MSVC
by Gisle Vanem 26 Apr '12

26 Apr '12

The src/test/test_util.c doesn't compile with MSVC (CL ver. 16.00.30319.01). It doesn't like the "#ifdef 0" construct, but the whole chunk should be enabled with some modifications IMHO. 'path_is_relative()' doesn't handle the "http:\\dir" case though. Why should it? Besides 'expand_filename()' isn't for Windows. I suggest this patch: --- Git-latest\src\test\test_util.c Fri Apr 06 22:45:14 2012 +++ src\test\test_util.c Thu Apr 26 08:59:18 2012 @@ -1526,10 +1526,6 @@ /* Windows */ #ifdef MS_WINDOWS - /* I don't have Windows so I can't test this, hence the "#ifdef - 0". These are tests that look useful, so please try to get them - running and uncomment if it all works as it should */ -#ifdef 0 test_eq(1, path_is_relative("dir")); test_eq(1, path_is_relative("dir\\")); test_eq(1, path_is_relative("dir\\a:")); @@ -1538,8 +1534,7 @@ test_eq(0, path_is_relative("\\dir")); test_eq(0, path_is_relative("a:\\dir")); test_eq(0, path_is_relative("z:\\dir")); - test_eq(0, path_is_relative("http:\\dir")); -#endif + test_eq(1, path_is_relative("http:\\dir")); /* path_is_relative() doesn't test for such */ #endif done: @@ -2887,7 +2882,9 @@ UTIL_LEGACY(config_line_quotes), UTIL_LEGACY(config_line_comment_character), UTIL_LEGACY(config_line_escaped_content), +#ifndef MS_WINDOWS UTIL_LEGACY(expand_filename), +#endif UTIL_LEGACY(strmisc), UTIL_LEGACY(pow2), UTIL_LEGACY(gzip), With the above, test/test.exe now says: util/path_is_relative: OK --gv

3 2

[GSoC] Introduction - Vidalia
by Feroze Naina 26 Apr '12

26 Apr '12

Hello, I'm Feroze and I will be working on the hidden service configuration and bandwidth scheduling plugins for Vidalia. I'm specially excited about the bandwidth scheduling plugin as I've felt the need for this. Users would like to specify different bandwidth allocation for Tor relay at different times. Currently, you have to setup a cron job and manually create a script which is tedious. I will be creating a simple interface to specify hour-wise bandwidth for every day of the week. My proposal outlines this in detail - http://www.google-melange.com/gsoc/proposal/review/google/gsoc2012/feroze/6… I'll be on #vidalia and #tor-dev with the nickname feroze.

1 0

[GSoC] Tails-server - Introduction
by jvoisin 25 Apr '12

25 Apr '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I am jvoisin, the student who will work on tails-server[1] during this year's GSoC; my mentors will be intrigeri and anonym. I already worked for Tor last year, on the "Metadata Anonymisation Toolkit" project[2]; and I hope that I'll do as good (and even better) than last year ! You can check my proposal[3] if you are curious/interested about what I'm planning to do this Summer. I'm hanging on #tor-dev with the nick jvoisin. Have a nice day, - - jvoisin 1. https://tails.boum.org/todo/server_edition/ 2. https://mat.boum.org/ 3. https://www.google-melange.com/gsoc/proposal/review/google/gsoc2012/jvoisin… -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJPl+vOAAoJEJdo/TzEiBXynroP/jgiFrf3/NgEyZXSqvlAENw9 cLrUvDl2auYq78l0cuwJXxS3qb4ypow8VfqLHhFEn9I+d3ei7l1L5ozO6QkLcjYy RISnWcN5HFkr5VKbU3LcSWXe50WqHh2/8SvzZxraMLpLpxxrOSWT9YnUtRu/m+LR aX5X10HXlsmTqrNEoJgUfzgePSwYUDltAHPrzI7NelznS+CyCukRpuJ/nJd3fkSR u/xlxoZR5aX3dIHMwupUISG0B59aYYbp1XUw1rYz+/XXMxLzcKblP+UqRk3ayuMg a2LVY1pA32wrS6Bev6rwf+7xYdbVYDpLgWkSfZIenP3q2ynv14iLkIkruQK73d4V ibj9DydcRBOhzdOm36xqoV1ddhI6upJqxPC53dwInCYQLuZUf8mu0tvNI/yivaGA MkvAFabPLpaqk8KNDPSoBFVgigsjJgXfHfkM3MUd8zLrHQf//Q9wYlr1MMZNNyG6 ajhZqRdFKiEUb6Mxgk3sVcIvZCTC37Kkd4RGWBcm8VMLZz/9+7346sgcx/E4yB5o GgU0qthsWB9Gpb7+VckedQFwQ/G+Ffjd7RIV3VJuTU6+QH7NPy1wmc30bVBE0wCY keLmWAOKVbDe5QmpZokx/j+Nx8gAah61Atq3BKFmshwI980BpCEC0KemGtEH8+oR mywN3qE7fF18micBUVWW =We9H -----END PGP SIGNATURE-----

1 0

Greetings && The APAF project
by Michele Orrù 24 Apr '12

24 Apr '12

Hello. I'm wrtiting this email to introduce myself to the tor community. I'm new to tor, I've started to discover its community with the GlobaLeaks project; and now, for the Google Summer of Code, I will be involved in the APAF project. So probably all these days I will hang around your irc channel and this mailing list, getting known to some of the core developers. The APAF project, as described by Arturo in https://lists.torproject.org/pipermail/tor-dev/2012-March/003416.html , aims to be a static file server written in python, on the same development idea behind the tor browser bundle: being a simple and portable executable for non-technical user. So, the core idea is to create a python standalone .exe / .app so that anybody can easily set up a tor hidden service and configure it (via web browser or gui, to be defined); hoping that this will spread the use of hidden services, which AFAIK, nowdays aren't so much used. The most powerful concept behind this in my opinion is that, by design, the APAF should be as modular as possible, so that any other python application developer will be able to build its own software in such a way that it runs as a Tor Hidden Service. "Most powerful" becouse learning and collaboration shall be behind the opensouce idea, which is what I hope to work for. Deadlines for the project are described in https://pad.riseup.net/p/APAF-timeline Starting today, I am going to outline the design of the APAF - which libraries it is going to use, mockups, how to be configured, and so on. Since I will probably discuss all these choices with my mentor Arturo on the irc channel #tor-dev, any advice is welcome :) Regards, -- ù

1 0

Alternatives to Tor Exit Enclaves
by Arturo Filastò 19 Apr '12

19 Apr '12

The purpose of Exit Enclaves was to allow people running a website to make Tor users access it without ever leaving the Tor network. This leads to the clients having end-to-end encryption with the target destination. Even in previous version this had some issues, one of which was the fact that at the first connection the user would not be accessing the destination over a Tor circuit if the destination was provided in a hostname format (and not IP). The current stable version of Tor (0.2.2.x) still supports Exit enclaves. The new versions of Tor (> 0.2.3.x) use a new descriptor format (microdescriptors) allow relays to specify an Exit Enclave policy, but clients will not use it, therefore voiding the purpose of exit enclaving. I believe there is the need for something similar to Tor Exit Enclaving and the closest thing I see fit these requirements are Tor Encrypted Services (https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/ideas/xxx-en…) Encrypted Services (EC), are basically regular Tor Hidden Services, that do not provide anonymity for the server and gain a better performance because of this (they have a one-hop circuit to the RV and IP). The problem with making Encrypted services work to replace Exit Enclaves is that the client needs to have a way to understand that their destination is running also as an Encrypted Service. In this very high level overview I don't go into very much detail of how this system will actually work, but I hope it will prompt some discussion on the matter. I think this can be achieved mainly in 3 ways. 1) The client already knows all of the EC's 2) The client looks up if a destination is an EC when trying to connect to it 3) The final hop looks up if the destination is an EC These all have some drawbacks: In 1) the client needs to download the full list of EC's, therefore if the number of EC's get's very large it will take clients much more to bootstrap and they will need to store more data. The good thing of this though is that the speed of connections would be as fast as they are at the moment as it does not require any extra connections. In 2) the clients needs to complete an extra round-trip for every connection. I don't think this is a valid solution as it would degrade the quality of connections for every user. In 3) the final hop would do along side a normal A lookup for hostnames a CNAME lookup ( or another special field). If it finds that such a lookup returns a .onion address instead of returning a RELAY_CONNECTED cell it will return a ENCRYPTED_SERVICE cell containing the .onion address of the target ES. The client will then cache this address and connect to it. This approach adds a little bit of overhead (since two DNS lookups need to be made), but it is still faster than 2). It suffers from the issue of the exit node could spoof the .onion address and redirect the user to a malicious .onion address. This is quite a tough problem that I am still unsure how it could be solved. If we have support for DNSSec this issue could be mitigated. I would love some feedback on this topic. - Art.

4 6

brdgrd: Protecting bridges from the GFC
by Philipp Winter 15 Apr '12

15 Apr '12

Hi, I've been working on a small tool whose purpose is to protect bridges from the Chinese firewall. The tool runs independently of Tor and analyzes/rewrites SYNs and SYN/ACKs which it gets with the help of libnetfilter_queue. It is quick and easy to set up and can be run by bridge operators. Basically, the tool achieves two things: - Evading the Chinese DPI engine by rewriting the TCP window size during the TCP handshake. This leads to a fragmented cipher list which does not seem to be recognized by the GFC. - Blocking scanners with two dirty hacks. I did not have a lot of time to test it yet but I've found the window size rewriting to be particularly effective (yet ugly). It worked with Windows {XP, 7} and recent Linux boxes. The scanner blocking strategies are not that effective since they imply many false positives, i.e., legitimate users being locked out. Before showing this to a broader audience, I need some people looking at the code, though. The code, just 600 lines of C, is available at: https://github.com/NullHypothesis/brdgrd/ Cheers, Philipp

1 1

WebSocket pluggable transport
by David Fifield 15 Apr '12

15 Apr '12

Here is a draft of a proposal for a pluggable transport using the WebSocket protocol. In short, WebSocket is a socket-like feature accessible to JavaScript in newer web browsers. Here are some links about it: https://tools.ietf.org/html/rfc6455 http://dev.w3.org/html5/websockets/ https://developer.mozilla.org/en/WebSockets WebSocket is the transport used by flash proxies (which now use JavaScript instead of Flash). This pluggable transport is a necessary part of the flash proxy system as it stands, because something needs stand between a Tor client and a web browser proxy, and again between the proxy and a Tor relay. This proposal is mainly describing what is already implemented in https://gitweb.torproject.org/flashproxy.git The program connector.py is the client transport plugin, and for the server transport plugin I'm using a program called websockify. (websockify isn't completely satisfactory though, and replacing it is ticket #5575.) What's implemented works well enough that I have been using IRC over Tor over a WebSocket transport for about a week. I want to emphasize that this proposal is not the entirety of the flash proxy architecture, but only a part of it. I'm posting it here because 1) I want your help in getting it right, and 2) it may be useful beyond just flash proxies. Anyone interested in reading the proposal, I'd like to call your attention to a few points for comment. One is that there are different, partially incompatible, version of the WebSocket protocol. I have made the most recent version (RFC 6455) a MUST and any earlier versions a MAY. However it may be that in a little while browser support will be such that there is no reason to support old versions. The other is the base64 subprotocol used to send binary data over a text-only channel. WebSocket has a fully binary messages, but they are not supported in Firefox 10. This may be another thing that is changing rapidly enough to drop, as Firefox 11 and Chrome 16 do support binary messages. David Fifield

1 0

IRC meeting to discuss sponsor F July milestone on Thu Apr 12, 16:00--18:00 UTC in #tor-dev
by Karsten Loesing 14 Apr '12

14 Apr '12

Hi everyone, we have an upcoming sponsor F milestone on July 1. Here's the list of deliverables: https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorF/Year2#P… We need a ticket owner for all tickets in the July 1 milestone. We also need a schedule for each of those tickets with the next substep ideally being due in the next 4--6 weeks. I suggest we have an IRC meeting on Thu Apr 12, 16:00--18:00 UTC in #tor-dev. Here's the time and date for people not living in UTC land: http://www.timeanddate.com/worldclock/fixedtime.html?iso=20120412T16 People who should attend are: George, Erinn, Nick, Steven, Roger, Aaron, Jake, Linus, Sebastian, and anyone else who wants to attend. If you have any input on the project tickets before next Thursday, please feel free to comment on them. The more questions we solve before the meeting, the better. Thanks, Karsten

1 1

ampislay: anonymous connection trough IP spoofing
by Fabio Pietrosanti (naif) 12 Apr '12

12 Apr '12

Vecna [1], today published ampislay [2], an 8 years old project to implement anonymous communication trough IP spoofing. It's a not-so-conventional techniques, that have it's advantage and weakness, but that maybe considered within the Tor community for some particular use-case. It was a gift for my 2004 birthday (thanks!!!) :-) -naif [1] http://www.delirandom.net [2] https://github.com/vecna/apmislay

1 0