- tor-dev - lists.torproject.org

Reminder: tor dev meetings Wednesdays 1330 UTC
by Nick Mathewson 03 Sep '14

03 Sep '14

Reminder: the next Tor meeting is on #tor-dev on OFTC, at 1330 UTC on Wednesday. (That's approximately 12 hours from now: this is a time change.) This is the weekly IRC meeting for people working on the program "tor". (It won't cover all the other programs developed under the Tor umbrella.) cheers, -- Nick

1 2

oonibackend 1.1.0 released
by Arturo Filastò 02 Sep '14

02 Sep '14

Hello Oonitarians, I am pleased to announce that a new version of oonibackend has now been released. Here are some of the changes introduced in the new version: * Make changes to the bouncer API to make it aware of the policy of collectors. * Improve the bouncer API to make it more RESTful. * Add test helper that can be used to discover the DNS resolver being used by the probe. * Code coverage and unittesting improvements. * Fix compatibility with latest txtorcon versions. Starting from this version we will also be uploading the package to pypi, hence you will be able to install oonibackend with: pip install oonibackend https://pypi.python.org/pypi/oonibackend Have fun, ~ Art.

1 0

DNSSEC
by merc1984＠f-m.fm 02 Sep '14

02 Sep '14

I am surprised to find that there is no form of DNSSEC associated with TOR. I am running dnscrypt, but find that I fail the DNSSEC test at http://dnssec.vs.uni-due.de/ when using the TBB. I have unbound chained to dnscrypt which is on a rotary to 5 trusted DNS resolvers. How can you not understand what this means WRT DNS cache poisoning? Why are we susceptible to DNS cache poisoning? I suppose that the TOR system needs to resolve .onion addresses, but there should be some way of using dnssec locally if the TOR system cannot provide authenticated DNS. No one in the #tor irc channel seems to know how TOR DNS is done, and unfortunately there's not a word about it at https://trac.torproject.org/projects/tor/wiki/doc/DnsResolver . But I suspect it must be TCP DNS as TOR can't do UDP. And I suspect DNS must be done by relay servers, in order to resolve intermediate .onion addresses. Beyond that, it's a mystery how it's done. How to secure TOR DNS? -- http://www.fastmail.fm - mmm... Fastmail...

5 6

[PATCH] Proposal 236 and voting
by George Kadianakis 01 Sep '14

01 Sep '14

I inline a patch that specifies how voting should happen in proposal 236. The changes reflect a discussion I had yesterday with nickm during the Tor IRC meeting. BTW, while I like the simplicity of the new vote (just an integer), I'm afraid that this might hide any misconfigurations of the guardiness system in authorities. For example, maybe an authority is misconfigured and considers only 2 consensuses for guardiness data (instead of 6000 consensuses) and if it publishes only an integer percentage then we might not notice this misconfiguration. Maybe the number of consensuses parsed and the number of months considered should also be mentioned somewhere in the votes?

2 2

Weather post-GSoC
by meejah 31 Aug '14

31 Aug '14

Now that GSoC is over, there are some things that should be accomplished in the Tor Weather codebase soon to reach "deployment": 1. remove local copy of OnionPy and replace with real thing 2. (ideally automated) front-end tests 3. ensure production and Vagrant setup are as close as possible 4. tests with dump/copy of live database Less important, but still Very Nice To Have: 5. more unit-test coverage would be nice too 6. nicer-looking HTML I do not have enough spare cycles to accomplish all these things myself. I will commit to rapidly reviewing/merging to the "develop" branch any pull-requests. If any of the above sounds interesting, please follow-up here (or in #tor-dev). Thanks, meejah

2 5

DNSSEC
by merc1984＠f-m.fm 31 Aug '14

31 Aug '14

Does anyone know why TOR does not use DNSSEC? The only documentation I found on the TORProject website for DNS does not actually explain how DNS works on TOR. I infer it must be TCP, as TOR can not do UDP, and I imagine that relay nodes must be the resolvers in order to resolve .onion domains. But beyond that there is no information on how it works. Seems to me that the lack of DNSSEC in TOR is a gigantic security hole. (DNS cache poisoning) -- http://www.fastmail.fm - Access your email from home and the web

3 2

Gpg subkey for deb.torproject.org archive expired
by Lampshade 30 Aug '14

30 Aug '14

pub 2048R/886DDD89 2009-09-04 [expires: 2014-09-03] Key fingerprint = A3C4 F0F9 79CA A22C DBA8 F512 EE8C BC9E 886D DD89 uid deb.torproject.org archive signing key sub 2048R/219EC810 2009-09-04 [expires: 2014-08-29] Above text is from https://www.torproject.org/docs/signing-keys.html.en Today is 30 august, so subkey expired and master key is going to expire soon. Please generate new keys for Debian and Ubuntu users, of course in secure manner.

2 1

Re: [tor-dev] problems building on osx 10.9.4
by Tim 30 Aug '14

30 Aug '14

Hi Alan, Apologies for the overlapping reply to your last question - I'm still catching up. Chutney on OS X I can successfully run chutney with the following environmental variables set: PYTHON=python CHUTNEY_PATH=/path/to/chutney make test-network I then a lot of output, which ends with this result: Verifying data transmission: Success You may wish to permanently set PYTHON and CHUTNEY_PATH in your ~/.bashrc using: export PYTHON=python export CHUTNEY_PATH=/path/to/chutney You may need to supply the full path to python, but it's unlikely. For the record, I'm using python 2.7.8 from MacPorts to match some libraries I have installed. coverage-html on OS X For what it's worth, when I first tried to run make coverage-html on my os x setup, I get output ending with: lcov --capture --rc lcov_branch_coverage=1 --no-external --directory . --output-file "./coverage_html/lcov.tmp" Capturing coverage data from . Found gcov version: 4.2.1 Scanning . for .gcda files ... geninfo: WARNING: no .gcda files found in . - skipping! Finished .info-file creation lcov --remove "./coverage_html/lcov.tmp" --rc lcov_branch_coverage=1 'test/*' 'ext/tinytest*' '/usr/*' --output-file "./coverage_html/lcov.info" Reading tracefile ./coverage_html/lcov.tmp lcov: ERROR: no valid records found in tracefile ./coverage_html/lcov.tmp make: *** [coverage-html] Error 255 This was because my configure invocation didn't include the test coverage option: ./configure --with-libevent-dir=/opt/local --with-openssl-dir=/opt/local --enable-coverage --disable-asciidoc The documentation is successfully produced with: make clean && make && make test && make coverage-html Overall coverage rate: lines......: 33.6% (16872 of 50276 lines) functions..: 47.5% (1590 of 3350 functions) branches...: 23.7% (9708 of 40978 branches) As I said, I've used MacPorts - https://www.macports.org/ - to install: $ port list lcov libevent openssl lcov @1.11 devel/lcov libevent @2.0.21 devel/libevent openssl @1.0.1i devel/openssl You may wish to switch to lcov 1.11 if your version is giving you grief on OS X. So it appears there is no need to switch to Linux just yet… you'll run into similar configuration issues on any platform :-) Tim On 30 Aug 2014, at 13:22 , tor-dev-request(a)lists.torproject.org wrote: > Date: Fri, 29 Aug 2014 13:29:30 -0400 > From: Alan Fay <emptyset(a)freesideatlanta.org> > To: tor-dev(a)lists.torproject.org > Subject: Re: [tor-dev] problems building on osx 10.9.4 > Message-ID: > <CAFC4BBwOHTPrCZ6yT7-4i_6AYwnqGuqpUeLue=MAW7xdJF7o_Q(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Arlo, > > Thanks, I got the build working with a local build/path of libevent2, just > as you described. I used brew for the other dependencies. > > I am able to run ./scripts/test/coverage coverage-output without problems, > but running: > $ make coverage-html > > Has the following problem: [ > http://0bin.net/paste/9DYCmagMbr8HNiw4#rtSQ-ia0BrOS1nzilEVu3dBlUKrenXGRyVXD… > ] > gcov doesn't have a -v switch, just -version (this was from lcov installed > via $ brew install lcov) > > I got chutney after a little bit of searching. The documentation doesn't > make clear that chutney is part of the tor projects, located here: [ > https://gitweb.torproject.org/chutney.git] > > One of errors I get from running $ make test-network is: > ./chutney: line 4: python2: command not found > > This looks like a platform problem. That's why I'm wondering if it's > better to work on this code on some flavor of Linux system instead of osx. > > Thanks, > Alan

1 0

problems building on osx 10.9.4
by Tim 30 Aug '14

30 Aug '14

Alan, When building tor from the latest git sources on OS X 10.9.4, I have found that I need to: * install libevent, * install a newer version of OpenSSL (the system version is missing a symbol), and * disable man page generation. (Alternately, there are further tools that need to be installed to build the man pages.) I use the following configure invocation, for an installation in /opt/local (it looks like you're using /usr/local ): ./configure --with-libevent-dir=/opt/local --with-openssl-dir=/opt/local --disable-asciidoc I use MacPorts - https://www.macports.org/ - as a package manager, and have the following versions of the libraries installed: $ port list openssl libevent openssl @1.0.1i devel/openssl libevent @2.0.21 devel/libevent Let us know how you go. Tim On 29 Aug 2014, at 13:49 , tor-dev-request(a)lists.torproject.org wrote: > Date: Thu, 28 Aug 2014 12:33:59 -0400 > From: Alan Fay <emptyset(a)freesideatlanta.org> > To: tor-dev(a)lists.torproject.org > Subject: [tor-dev] problems building on osx 10.9.4 > Message-ID: > <CAFC4BBxo0zAeDe6n_=JgN_sagiN=DaYN0GRBJLpkZb6W90d73Q(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hello! > > I'm trying to get a working build of Tor so I can learn more about working > on item "m. Improve test coverage in Tor". Apologies ahead of time for > being green; this seemed to be the most accessible place to start > contributing...I read through doc/HACKING and I'm slowly working through > that. > > I'm running osx 10.9.4. I ran: > > $ ./autogen.sh > $ ./configure > ... > checking for libevent directory... configure: WARNING: We found the > libraries for libevent, but we could not find the C header files. You may > need to install a devel package. > configure: error: Missing headers; unable to proceed. > > I installed libevent-2.0.21-stable from source, and then nickm on #tor-dev > helped me see some permissions issues in /usr/local/include/event2 and > /usr/local/lib/libevent* ; please see: [ > http://0bin.net/paste/fuObUINKL1EOICf8#jJuGjo2wv65-7QNcHLGBcFPsNdAwhRlWmg6O… > ] > > I found reference to this error on the tor-relay mailing list here, but I > didn't get far with any of those suggested fixes, and it's also for osx > 10.4. This is the first hit when I google the error: [ > https://lists.torproject.org/pipermail/tor-relays/2012-January/001192.html] > > Thanks, > Alan >

1 0

[GSoC] Revamp GetTor summary
by ilv 30 Aug '14

30 Aug '14

Hi! First of all, I want to thank the people at tor-dev that make this happen every year, it was an awesome experience and I sincerely hope to be around for a long time. I also want to thank my mentor Sukhbir for always being around to solve doubts and checking up my progress, and to my co-mentor Nima for his always useful advices and comments. Secondly, I would like to give you a brief summary of what I did during this 3-4 months: 1) Rewrote GetTor from scratch. Now it should be easier to add new ways to distribute download links for TBB. 2) Created two components for this new GetTor: SMTP and XMPP. 3) Enabled the (old) multilingual feature. Now you can receive replies in your language (in case translation exists). 4) Created a component to automatically upload TBB to Dropbox. 5) Enabled basic blacklisting of users. It basically prevents flood by specifying a limit of requests during a certain period of time. 6) Added a small SQLite database for 5) and to get some stats. No real info about the addresses/accounts stored. I would really appreciate any feedback on the work done, specially about the points 5) and 6). Do these points make sense to you? The plan for now is to keep doing tests and deploy it asap (hopefully during September). As always, you can check the code on [0]. That would be for now, have a nice weekend! [0] https://github.com/ileiva/gettor/tree/master/src Best, -- 4096R/540BFC0E

1 0