- tor-dev - lists.torproject.org

Implementation plan for prop271 "Another algorithm for guard selection"
by George Kadianakis 29 Jul '16

29 Jul '16

Hello people, our new guard algorithm proposal (prop271) is getting finalized and we are planning to move to implementation soon. You can find the proposal here: https://gitweb.torproject.org/torspec.git/tree/proposals/271-another-guard-… You can also find the STRIKE team's implementation of proposal 259 here: https://github.com/twstrike/tor_for_patching Ideally we should borrow as much code as possible from their implementation. To move forward with engineering, here follows an initial thirteen step implementation plan for proposal 271. Where it made sense, I tried to provide links to current functions that can be used, or to code that the STRIKE team wrote and can be reused or studied. Let me know what I should make clearer or where I should go further in depth. --- Design decisions: An initial design decision here is whether we should make a new file for this feature or use the old entrynodes.c file? A related question here is whether both algos should co-exist, or should the new one replace the old? I leave both decisions to the person who writes the code. --- Implementation plan: 1) Create main guard selection state data structure (instead of using global variables) ** Ideally there should be no global variables, so that in the future we can have multiple parallel guardsets (e.g. prop247) ** Thoughtworks: guard_selection_t 2) Sample SAMPLED_GUARDS from GUARDS ** Fill in state for each sampled guard (added_on_date, etc.) ** Save/load SAMPLED_GUARDS to/from state ** Unittests for sampling/saving/loading ** Thoughtworks function: fill_sampled_guards_from_entrynodes() ** Thoughtworks unittest: test_fill_in_sampled_set() 3) Derive FILTERED_GUARDS / USABLE_FILTERED_GUARDS from SAMPLED_GUARDS ** The filtering function can be called at any point (e.g. ON_CONSENSUS) ** Write unittests ensuring correctness of filtering ** See populate_live_entry_guards() ** Thoughtworks function: filter_set() / filter_sampled() 4) Maintain set of PRIMARY_GUARDS ** Functions to extract set of (live) primary guards out of FILTERED_GUARDS ** Unittest ** Thoughtworks function: retry_primary_guards() / next_primary_guard() ** Thoughtworks unittests: test_next_primary_guard() 5) Selecting guards for circuits ** Meant to replace choose_random_entry_impl() ** See section SELECTING in prop271 ** Add new circuit states to or_circuit_t ** Implement the guard selection logic ** Unittests on circuit state machine ** Unittests on guard selection logic 6) Update guard state when a circuit fails/succeeds ** Section ON_FAIL and ON_SUCCESS ** See entry_guard_register_connect_status() ** Unittest 7) Maintain CONFIRMED_GUARDS ** Add guard to CONFIRMED_GUARDS when circuit succeeds ** Fill in state info for each confirmed guard (confirmed_on_date, etc.) ** Migration from old state format to new ** Thoughtworks unittest: test_used_guards_parse_state() 8) Retry schedule for guards (section RETRYING) ** See entry_is_time_to_retry() ** Unittest 9) Update list of waiting circuits (section UPDATE_WAITING) ** Implementation of guard "higher priority" ordering (see CONFIRMED) ** Unittest 10) Update state whenever we get a new consensus (section ON_CONSENSUS) ** Update SAMPLED_GUARDS elements (section SAMPLED) ** Remove obsolete/expired guards ** See entry_guards_compute_status() / remove_obsolete_entry_guards() ** Thoughtworks function: entry_guards_update_profiles() 11) Bridge support ** Thoughtworks function: fill_in_from_bidges() 12) Separate state instances when EntryNodes/ExcludeNodes/etc are used ** See prop271 MEANINGFUL_RESTRICTION_FRAC etc. 13) Glue things together! ** Add clean and meaningful logging so that we can *heavily* field test the feature in our machines

1 0

[GSOC16] Fingerprint Central - Status report n°5
by Pierre Laperdrix 29 Jul '16

29 Jul '16

Hi everyone, Here is my fifth status report for my GSOC project. Repository: https://github.com/plaperdr/fp-central Beta: https://fpcentral.irisa.fr 1 - Support of TBB versions for statistics through tags I have added the selection of TBB versions for the custom statistics page. In order to do that, I designed and developed the tag system that I planned to develop much later for the project. For those who do not know what tags are, it is a way to classify fingerprints and put them into different categories. By analyzing collected fingerprints, the system can assign one or more tags to them. After several iterations, I think I found a good balance between expressiveness and simplicity. You can find the documentation on how to add your own tag to the system here: https://github.com/plaperdr/fp-central/blob/master/fingerprint/tags/README.… I have added a command to refresh and recompute all tags in case a new one is added to the system or if the logic of one tag has been changed. Right now, the tag system is used to tag each fingerprint with the corresponding TBB version but it can be used later on for many different things like identifying the OS or the type of the browser. 2 - Better and more complete custom statistics page. The custom statistics page is now much more complete than before. In addition to the already-existing pie chart, I have added an HTML table which gives the complete list of data from the chosen attributes. You can sort the data and download it in several different formats. It is a handy feature if you want to put the fingerprints into a different software or if you want to copy/paste them for a thorough bug report. I've pushed the latest updates today to the beta server so that you can try them right now and send me feedback on them. My goal for the next two weeks is to iron things out in the beta and fix bugs. I still need to make sure that only TBB fingerprints are stored in the database. Feature-wise, it seems that I'm getting near the end on the list of features I wrote in my proposal. The only real big one that is left is to have a page to see if your complete TBB fingerprint is "acceptable" (right now, only several attributes are checked). Finally, for the final stretch in the second half of august, I'm planning on completing the documentation and the french localization while making sure that deployment and updates of the site are as easy as possible. Have a great week-end, Pierre

1 0

[GSoC 2016] Orfox - Report 5
by Amogh Pradeep 28 Jul '16

28 Jul '16

Hey guys, These are the things I’ve done in the past couple of weeks. 1) GetUserDataDirectoryHome in nsXREDirProvider. Looks like the blocker in nsXREDirProvider was the GetUserDataDirectoryHome function. https://trac.torproject.org/projects/tor/ticket/19706 <https://trac.torproject.org/projects/tor/ticket/19706> is the ticket opened to track updates regarding this. Once this is ready, we would be able to upstream all the Orfox patches to the tor-browser repo. 2) Commits clean up. I’ve made a couple of passes on the commits to Orfox that we have, to reorder them and merge them as much as possible. This will make it easier to maintain things in the future, and it would be easier to review code as we merge it with tor browser. 3) Disabling search widget. The search widget for Orfox has now been removed. https://dev.guardianproject.info/issues/7444 <https://dev.guardianproject.info/issues/7444> Commit: https://github.com/amoghbl1/tor-browser/commit/f415a732a8e50c2c34f43d905c36… <https://github.com/amoghbl1/tor-browser/commit/f415a732a8e50c2c34f43d905c36…> At this moment, I don’t see the advantage of having this feature and would prefer not supporting it, in order to make it easier to maintain Orfox. In other new, I am migrating this week from CET to IST! This might make it slightly harder to be online during most active hours, but I will try to be around. Hope you guys have a great weekend. Best, Amogh Pradeep amoghbl1(a)gmail.com

2 1

Further sandboxing Tor Browser (aka Tor + Firejail redux).
by Yawning Angel 22 Jul '16

22 Jul '16

I felt randomly inspired, so I spent some time poking at my firejail Tor Browser sandboxing effort, and made progress towards something more robust. In particular, I switched to using AF_LOCAL (aka AF_UNIX) sockets, via a brute force-ish approach, which seems to be working well, despite some caveats. In theory, this raises the difficulty of proxy bypass type things significantly (in that you need a sandbox escape sploit to use AF_INET/AF_INET6). In practice, who knows, for what it's worth the subterranean reptiloids who beam thoughts into my head from their satellite installations reassure me that it's safer. WARNING: * If you are not comfortable with running/configuring a system tor daemon, keeping it up to date, and keeping it in sync with the one shipped with Tor Browser when it diverges, stop reading, and wait for the Tor Browser people to come up with their own sandboxing solution. * If you expect me to provide any sort of help beyond "merging sensible patches", likewise stop reading, and wait for the Tor Browser people to come up with their own sandboxing solution. Really. Prerequisites: * A system tor daemon with the Control port and Socks port exposed as AF_LOCAL sockets, with permissions configured such that the user running Tor Browser can write to both. Due to torbutton quirks, having a SocksPort on 127.0.0.1:9050 is also a good idea, though not strictly necessary. * A recent version of firejail (nb: I did not test this with a USER_NS kernel. It may be better, it may be worse.). Setup: 1. Clone https://git.schwanenlied.me/yawning/tor-firejail 2. (Optional) Back up your Tor Browser install so you can go back to the way things used to be when you mess up. 3. Follow the instructions in the README.md, adjusting paths as appropriate. It should be self explanatory. If it's not, revert back to how things were, and wait for a more official solution. Depending on how your tor is setup, you probably need to set a bunch of env vars (At a minimum, TOR_SKIP_LAUNCH is required. Everything else depends on how the control/socks sockets are setup, and where they live, the modified start-tor-browser script has more documentation in comments.). 4. Run start-tor-browser, use lsof/netstat/whatever to verify that the AF_LOCAL sockets are being used. Caveats: * The security of this assumes that the firejail options I use to enforce address family restrictions work as advertised. * You need a system-wide tor, because if you tried to run the tor daemon inside the sandbox, it won't be able to access the network. * The firejail profile I provide disallows access to everything in the user's home directory except for the directory that actually contains Tor Browser. Edit the profile to change this if you care about it. I like the behavior for various reasons so I'm not going to change it. * The `about:tor` display falsely reports an error unless there's a SocksPort on 9050, due to torbutton. You can alternatively lie to torbutton about where the listener is if you engage in control port related tinfoil hattery. * You need to repeat parts of the installation steps after updating. How it works: * firejail's sandbox forbids all non-AF_LOCAL sockets. * A small stub is injected into the firefox process at runtime via LD_PRELOAD that fixes up socket calls to go to the system wide tor instance's AF_LOCAL sockets. Random thoughts: * The stub should be adequate for using other similar sandboxing solutions (eg: flatpak's bubblewrap, Google's thing, whatever). The code is compact, and is something anyone half way competent could write in 15 mins or so (it may have dumb bugs, dunno). Using the stub on it's own without the sandbox would be a horrible idea. * Assuming Tor Browser works as advertised, the only reason it needs control port access for this sort of use case is the circuit display (as of torbutton commit 36d849291ec0b20a58cccc2cd846fcd2540c9bbe, sending NEWNYM should be unnecessary if domain isolation is applied to everything). Regards, -- Yawning Angel

2 2

Tor with collective signatures
by Nicolas Gailly 22 Jul '16

22 Jul '16

Hi, First, thanks a lot both of you for your in-depth comments, I know it takes time, but they've been very helpful! Then I mean to ask you about what you said regarding the fallback directory keys. So keys are not embedded but only hashes, OK. As you pointed out, CoSi would need to download full descriptors in order to safely get the private keys of all the witnesses. This solution would need to clearly be defined as you said in order to be correct. However, there exists another solution and I'd like to know if it looks reasonable in the context of Tor . => Considering the two roles of Fallback directory mirrors are different (serving the consensus document to Tor / collectively signing on it), we thought it would make sense to create new keys for this role and embed those into the Tor source code. These keys would have to be ed25519 keys (same size as the ID), so the size overhead is minimal (32 bytes * 100 = 3.2KB vs 1.5MB). The only reason I can think of why Tor includes hashes instead of public keys is because of local storage: How does Tor consider an increase of storage need by 3.2KB ? Is it acceptable or not ? That would : * Bring down the need for exchanging the descriptors between the fallbacks / no more bandwidth / * No complex scenario such as "fallback key download mechanism" * Simplify the verification on the client side also (no need to get the keys if you already have them). * Add an additional steps for the relays operators where they would need to create that key and inform the Tor people about their public key. Maybe you thought of this solution and there's a reason why you did not mention it, or maybe you did not, then what do you think of it ? Cheers, Nicolas

4 7

Re: [tor-dev] tor-dev Digest, Vol 66, Issue 17
by Nathan Kettle 22 Jul '16

22 Jul '16

unsubscribe On Fri, Jul 22, 2016 at 10:00 PM, <tor-dev-request(a)lists.torproject.org> wrote: > Send tor-dev mailing list submissions to > tor-dev(a)lists.torproject.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev > or, via email, send a message with subject or body 'help' to > tor-dev-request(a)lists.torproject.org > > You can reach the person managing the list at > tor-dev-owner(a)lists.torproject.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tor-dev digest..." > > > Today's Topics: > > 1. Re: Tor with collective signatures (isis agora lovecruft) > 2. Further sandboxing Tor Browser (aka Tor + Firejail redux). > (Yawning Angel) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 21 Jul 2016 15:05:07 +0000 > From: isis agora lovecruft <isis(a)torproject.org> > To: tor-dev(a)lists.torproject.org > Cc: Philipp Jovanovic <philipp.jovanovic(a)epfl.ch> > Subject: Re: [tor-dev] Tor with collective signatures > Message-ID: <20160721150507.GE8911(a)patternsinthevoid.net> > Content-Type: text/plain; charset="utf-8" > > Nicolas Gailly transcribed 59K bytes: > > Hi, > > > > Here's a new version of the proposal with some minor fixes discussed > > with teor last time. > > > > 0.4: > > - changed *included* to *appended* > > - 3.2: end of paragraph, a valid consensus document contains a > majority > > of CoSi signatures. > > - Acknowledgments include teor and Tom Ritter. > > > > As always, critics / feedbacks / thoughts are more than welcome :) > > > > Thanks ! > > > > Nicolas > > > > Ps: Our team and I are going to be at PETS this year, so if you don't > > have time now to > > > > read the whole thing, but you are still willing to know about CoSi and > > how it could improve > > > > Tor security, I/we will be happy to talk with some of you there also. > > Hello all, > > At PETS this afternoon, Nicolas Gailly, Philipp Jovanovic, Ismail Khoffi, > Georg Koppen, Nick Mathewson, and I met to discuss the collective signing > proposal. I'm just going to breifly summarise the discussion here. > > One of the major concerns voiced was that, if we made it mandatory that a > collective signature on a consensus be verifiable (for some N number of > signers, where N might be all of them but it's not important) for a client > to > accept and use a consensus, then attacks upon the witnesses (or any > disruption > to the witness signing system) will cause clients to no longer be able to > bootstrap. Conversely, if we made it so that it only emitted some warning > when the collective signature could not be verified, then (likely) no users > would see this warning (or even if they did, they'd treat it in the same > manner as a TLS certificate warning and simply click through it). > > There is also concern that, with enforcing collective signatures, that the > Tor > network has a larger attack surface w.r.t. (D)DoSing: an adversary could > DoS 5 > of the 9 DirAuths *or* they could DoS whatever necessary percentage of the > witness servers. Additionally, an adversary who controls some portion of > the > witness servers may DoS other witnesses in order to amplify the relative > proportion of the collective signature which they control. > > There was some discussion over whether to integrate this into core tor, or > rather to just use Nicolas' CoSi Golang tool in a separate process. > Everyone > agreed that rewriting something from Go to C is suboptimal. > > One idea was if we used CoSi, but rather than "don't trust/use a consensus > if > it doesn't have a good CoSi" we could use it as a mechanism for clients to > report (to some system somewhere? perhaps part of the prop#267 consensus > transparency logs?) when CoSis don't verify successfully. > > Another idea was to use CoSi to sign the metadata file which Firefox's > updater > uses to learn where to fetch updates so that a client would know that the > same > Tor Browser updates were being served to other different vantage points. > > Todo list: > > 1. It's not super necessary, but more analysis of the bandwidth overhead > for > running this protocol would be nice, i.e. network-wide overhead, not > just > the overhead for a single witness. > > 2. It would be nice to have some RFC-like description so that alternate > implementations could be created, e.g. include encodings, state > machines, > message formats. (We strive to maintain our specifications with the > delusion that there are secretly hundreds of other tor implementations > in > every existing language, and that any of them should be compatible if > they > follow the specification.) > > 3. Update the proposal to mention that each DirAuth would have their own > tree, thus the consensus document in the end would have somewhere > between > 5 and 9 CoSi signatures. > > 4. There's a typo in §5.2: s/witnesse's/witnesses'/ > > Thanks, everyone, for the great discussion! > > Best regards, > -- > ♥Ⓐ isis agora lovecruft > _________________________________________________________ > OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 > Current Keys: https://fyb.patternsinthevoid.net/isis.txt >

1 0

Re: [tor-dev] [network-team] [doodle poll] Meeting to discuss guard proposal draft status
by George Kadianakis 18 Jul '16

18 Jul '16

Nick Mathewson <nickm(a)torproject.org> writes: > [ text/plain ] > Hi! > > We should do proposal discussion meetings again. In particular, we > should talk about this draft I've been working on for a revised > version of the twstrike team's revised version of Isis's revised > version of the guard selection and rotation algorithm. > > I've been tracking my work on ticket #19468: > https://trac.torproject.org/projects/tor/ticket/19468 > > There's some commentary happening on gitlab: > https://gitlab.com/asn/torspec/merge_requests/2 > > I expect I'll do another round of revision by Wednesday. > > I'm trying to schedule a time for us to get together to review this, > so that we can divide it up into tickets to implement it, ideally > based on the twstrike code that we have for the prior revision. > Hello! With Nick we settled on Thursday at 14:00 UTC as the time for this meeting! The plan is to finish the meeting in strictly less than 90 minutes. #tor-dev is the place :) See you there!

5 9

[GSoC] Tails Server - status report 5
by segfault 17 Jul '16

17 Jul '16

Hi everyone, this is the fifth status report on the Tails Server GSoC project. I did two batches of user tests in the last two weeks, with five participants each. The results were mixed, more skilled users had a better user experience than less skilled users. I will try to solve the problems discovered and make it more user-friendly for less skilled users. You can read my reports and the following discussions on the Tails-UX mailinglist [1]. [1] https://mailman.boum.org/pipermail/tails-ux/2016-July/thread.html Other things I did in the last two weeks: - Fix and improve the "clickable label"-widget I implemented - Implement the autostart feature - Write documentation - Make the application translatable - Refactor the code - Fix several bugs You can still download nightly images from here [2], but the recent images don't include the latest changes yet. They will be included in the next few days. Cheers!

1 0

[GSoC16] Expand Nyx - Status Report 4
by Sambuddha Basu 16 Jul '16

16 Jul '16

Hi everyone, This is the fourth report for the 'Expand Nyx' project for GSoC 2016. I have been working on the following things since the past 2 weeks: * Added the history validation for the interpreter panel. * Added the tab completion for the interpreter panel. * Rebased code to include recent changes made by Damian. * Added some tests for the interpreter panel. The interpreter panel code ca be seen at: https://github.com/sammyshj/nyx/pull/12 In the next weeks, I will be adding rest of the tests for the interpreter panel and then start work on getting additional information provided by Onionoo. Hope everyone has a fun weekend! Thanks, Sambuddha

1 0

[GSOC16] Fingerprint Central - Status report n°4
by Pierre Laperdrix 16 Jul '16

16 Jul '16

Hi everyone, Here is my fourth status report for my GSOC project. https://github.com/plaperdr/fp-central 1 - The beta for FP Central is live! You can visit it at this address: https://fpcentral.irisa.fr/ Don't hesitate to send us feedback so that we can improve the website to make it the best we can! I'm already fixing and tweaking several things on my end. Right now, I'm updating the website once a week so don't hesitate to come back to see newly added features! 2 - I've added two statistics pages on the website. I'm still tweaking how the data is being shown to the user but the goal is that anyone can select the attributes they are interested in and get the distribution for a given time period. I'm planning on adding new ways to visualize and download data so that developers can easily get access to what they want. My goal for the next two weeks is to improve the statistics page so that it works well and add support of TBB versions. I'll also make sure that only TBB fingerprints are stored in the database so that the current stats are not polluted by other browsers. Have a great week-end, Pierre

1 0