- tor-dev - lists.torproject.org

Linux kernel transproxy packet leak (w/ repro case + workaround)
by Mike Perry 28 Mar '14

28 Mar '14

Hello all, I've discovered that the Linux kernel appears to have a leak in how it applies transproxy rules to the TCP CLOSE_WAIT shutdown condition under certain circumstances. This applies to both the kernels in use by common Android devices (Cyanogenmod 10.x and 11-M4), as well as the Linux kernel in Ubuntu 13.04 (3.8.0-35-generic). The bug can be triggered either by a remote server closing a connection, or by restarting the local tor client. Basically, the bug happens when a transproxy connection shuts down completely before a client application properly closes the socket. This seems to cause the kernel to lose track of the fact that the client application connection was being transproxied, and when the client application finally does close its socket (or exits), the Linux kernel generates a FIN ACK that completely bypasses any transproxy rules you have installed. It sends this packet first as the UID of the app in question, and if that fails, it resends it as a blank UID (the kernel itself). Here's how to reproduce it and see for yourself: First run the attached iptables script, and launch a tor daemon with the attached torrc (edit the iptables script's TOR_UID=`id -u debian-tor` and NETWORK_USER_ID=1000 vars if your setup is different). Then, fire up tcpdump, like so: sudo tcpdump -n -i wlan0 host 74.125.28.104 and tcp port 80 Replace '-i wlan0' with your network interface. If you use '-i any', you will also see transproxied packets (which are not normally leaked). Then, as your transproxied user, paste this python snippet into a python interpreter: import socket s = socket.create_connection(("74.125.28.104", 80)) (That IP handles www.google.com) After the connection is made, you should see something like the following in 'netstat -natp': tcp 0 0 127.0.0.1:9040 192.168.1.23:42235 ESTABLISHED 1121/tor tcp 0 0 192.168.1.23:42235 74.125.28.104:80 ESTABLISHED 977/python At this point, either wait a couple minutes for Google to close that connection on you, or shut down your Tor daemon. In either case, you should see the first connection transition to TIME_WAIT, or FIN_WAIT2, or similar, lose track of its PID+UID, and then finally disappear entirely, but the python program will remain in CLOSE_WAIT indefinitely. Once the first connection is fully gone (this takes 60s from TIME_WAIT state with default TCP settings), issue this in your python shell: s.close() At this point, you will see a FIN ACK or RST ACK packet appear in your tcpdump window. That packet has leaked past the iptables firewall rules, and past the transproxy rules. It went straight to Google. I have noticed several Android apps (including Firefox, F-Droid, and many Google apps and Android services) that allow their sockets to sit in CLOSE_WAIT upon remote close while transproxied, and they all leak packets in this case, which happens frequently in normal usage. I am not sure if this is just a common programming error, an issue with how the Android networking APIs are designed, something specifically exacerbated by the transproxy, or some combination of these. For a workaround, I was able to prevent this issue with the addition of the following rules: iptables -I OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,FIN ACK,FIN -j DROP iptables -I OUTPUT ! -o lo ! -d 127.0.0.1 ! -s 127.0.0.1 -p tcp -m tcp --tcp-flags ACK,RST ACK,RST -j DROP None of the transproxy documentation I could find mentions this issue, nor suggests any additional safety rules. This means every transproxied Tor user is unwittingly leaking packets, at least some of the time. Sorry to be the bearer of bad news. Please send workaround discussion to tor-talk, and kernel/TCP state machine discussion to tor-dev. I Cc'd both like a jerk, because I figure each group might have different sets of commentary, and both groups should be aware of this issue. Don't be a jerk like me, please. Use your best judgment to Cc one list or the other. -- Mike Perry

1 0

Call for testing/review: obfsclient-0.0.2
by Yawning Angel 28 Mar '14

28 Mar '14

Hello all, I just tagged obfsclient v0.0.2 (Release) Download at: https://github.com/Yawning/obfsclient/archive/v0.0.2.tar.gz This is mostly a bug fix release that addresses issues found in testing/actual use. The code is quite stable now, and I have been using it for all of my tor for approximately 2 weeks. Changes since 0.0.1: * Change the command line arguments to match the obfsproxy counterparts. This fixes issue #31. * Apply pushback between each side of the proxied connection to limit the amount of data that can be buffered. This fixes issue #3. * Use bufferevent_write_buffer to save allocating/copying in obfs2/obfs3. This fixes issue #24. * Fix assertions primarily seen on abrupt connection close by disabling all reads on transition into the various SOCKS5 FLUSHING states. * Cleaned up the logging, and log SOCKS5 assertions to the log file. * Send a TTL EXPIRED SOCKS5 error on connection timeouts. * Fixed an assertion that occurred if the outgoing connection immediately failed (Eg: Network interface being down). * Darwin build fixes, pointed out by Jeroen Massar. * FreeBSD 8.x/9.0 build fix, pointed out by Fabian Keil. NB: Darwin builds require using liballium from git and not 0.0.1, due to a minor code change to a embedded dependency. It is also entirely possible that I broke this again via changes made since then, but I don't use Darwin at all. Assuming there are no major bugs, I am hoping that 0.0.3 will be a feature release so the pace should be less hectic. Questions, comments, feedback appreciated as always, -- Yawning Angel

2 1

Two torspec proposals
by Virgil Griffith 28 Mar '14

28 Mar '14

I have two proposals to add to the torspec.git. They are: (1) http://dl.dropbox.com/u/3308162/230-quicken-tor2web-mode.txt (2) http://dl.dropbox.com/u/3308162/231-remittance-addresses.txt If someone with commit rights will add them that'd be lovely and we can ignore the rest of this message. If not, I request permission to commit to torspec.git. My PGP is here and we can discuss setting up a password, etc: http://virgil.gr/1+Virgil_Griffith_pub.asc -V

3 2

Starting work on hidden services
by Helder Ribeiro 28 Mar '14

28 Mar '14

Hi everyone, I'm an undergraduate student at University of Campinas, in Brazil, starting now I'll be working all year, >=20h/week on research about and improvements to tor hidden services under the supervision of Prof. Diego F. Aranha. I'm generally very inexperienced both with Tor (I've been reading papers and specs, but don't know my way around the source yet) and with programming C in the real world (contrived class projects are basically all I've done), so there will be a lot to ramp up to. Given the above time and experience constraints, I want to 1. do something that is not urgent/blocking; 2. stay as far away as possible from security-sensitive code, and 3. bite off something that is doable, including ramp-up, within a semester. Going through the "Hidden Services need some love" blog post, I found the item "Analyze Hidden Service Circuit Establishment Timing With Torperf" fitting. From reading the tickets, it seems like I would need to add some instrumentation (#3459) and then do the measurements. Some questions: - Is there anything else that would fit the above constraints that you need done more? I'm starting to write the grant proposal (submission is in 2 weeks) and I can still change it to anything else. (I'll dedicate the same amount of time to the project this year regardless of having the grant approved.) - Who should I report to? - Assuming I stick to the timing analysis above, are there any specific questions that you would like the analysis to answer? Thanks a lot! Cheers, Helder

3 6

[Orbot patch] Properly skip tests when building libevent
by Daniel Martí 27 Mar '14

27 Mar '14

This fixes the remaining $(top_srcdir) errors and properly generates event2/event-config.h Signed-off-by: Daniel Martí <mvdan(a)mvdan.cc> --- external/Makefile | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/external/Makefile b/external/Makefile index bce8d83..7a9f637 100644 --- a/external/Makefile +++ b/external/Makefile @@ -116,6 +116,8 @@ openssl-clean: # libevent libevent/Makefile: + sed -i 's@$SUBDIRS = . include$ sample test@\1@' libevent/Makefile.am + sed -i 's@$AC_OUTPUT(Makefile include/Makefile$ test/Makefile sample/Makefile)@\1)@' libevent/configure.in cd libevent && ./autogen.sh cp config.sub libevent cp config.guess libevent @@ -126,7 +128,7 @@ libevent/Makefile: --disable-shared libevent-build-stamp: libevent/Makefile - $(MAKE) -C libevent all-am + $(MAKE) -C libevent ./include/event2/event-config.h all-am touch libevent-build-stamp libevent: openssl libevent-build-stamp -- Daniel Martí - mvdan(a)mvdan.cc - http://mvdan.cc/ PGP: A9DA 13CD F7A1 4ACD D3DE E530 F4CA FFDB 4348 041C

2 2

Re: [tor-dev] StegoTorus gsoc2014
by vmon＠riseup.net 27 Mar '14

27 Mar '14

Hey Amin, Good to hear from you. As the first step try to download the latest stegotorus code: git clone https://github.com/zackw/stegotorus cd stegotorus git checkout tor-improve and try to compile it: autoreconf ./configure PKG_CONFIG_PATH=`pwd`&& make When you are successfully able to build it then, then I'll ask you to write a minor patch for Stegotorus to test your ability for being a successful GSoC candidate. > I will send the edited proposal to you in order to discuss it. > Again, I am so sorry for the delay. Sure, It is OK to submit a proposal to address the open tasks, however you need to show in your proposal that you understood the tasks and you have some idea about how to resolve them. Best of luck, vmon AMIN SLEIMI <amin.sleimi(a)gmail.com> writes: > Hi vmon, > > I would like to thank you for your comment and I apologize for the > delay. For my personal experience, I joined a CV summarizing my > studies and projects. I am currently hacking StegoTorus's source code > and I would enhance my proposal according to this study along with the > paper "StegoTorus: A Camouﬂage Proxy for the Tor Anonymity System". > > I will send the edited proposal to you in order to discuss it. > Again, I am so sorry for the delay. > > Regards, > > > Amin Sleimi.

1 0

Re: [tor-dev] Stegotorus tickets
by vmon＠riseup.net 27 Mar '14

27 Mar '14

Hey Noah, I've updated the tickets: 8098, 8096. I don't know much about 8090, it is not coding related and hence seems irrelevant to GSoC. I made a ticket for the task we discussed as well: #11337: Reimplement (move relevant functions, delete extra redundant code) of pdfSteg.cc, swfSteg.cc, jsSteg.cc as children of FileStegMod] If you want me to update any other specific ticket to current status of Stegotorus please give me the specific ticket number (I'm a bit short of time in the congestion of end-of-month tasks). If you'd like us to go over the code related to your task together, schedule a meeting time using Google calendar: vmonmoonshine(a)gmail.com And we can discuss it on #tor-dev(a)irc.oftc.net Good luck, vmon Noah Rahman <selimthegrim(a)gmail.com> writes: > In the interim, I'll start looking at 8090, 8098, 8096 for the > challenge period. I presume the security factor still has some > improvements left to do and if the PDF/JS/SWF modules need to be > refactored I'll count it under this. > > On Wed, Mar 26, 2014 at 12:24 AM, Noah Rahman <selimthegrim(a)gmail.com> > wrote: > > Did you get around to updating the trac yet? > > > > > > On Tue, Mar 25, 2014 at 7:40 AM, Noah Rahman > <selimthegrim(a)gmail.com> wrote: > > > do you mean the refactoring and the config files, or the key > handshake? > > > > > > On Tue, Mar 25, 2014 at 3:34 AM, <vmon(a)riseup.net> wrote: > > Hey Noah, > > It seems that you successfully compiled Stegotorus, > congratulation! ;) > > Although, you still have problem with compiling the unit > tests in google > framework, they are not essential in solving your > challenge. I recommend > that you start working on your challenge now. > > Per Google's recommendation, I've included the google unit > test code > inside the code, so that g_unittests_LDFLAGS probably won't > help > (because you are linking to the object file directly). You > might want to > download the google frame work and try to compile it > independently > without the stegotorus headache: > > https://googletest.googlecode.com/files/gtest-1.7.0.zip > > Keep the good work going! > vmon > > Noah Rahman <selimthegrim(a)gmail.com> writes: > > > after fixing the local branch and having to remove - > Werror by hand > > from the makefile yet again...maybe I am missing > something else in the > > unit tests? I checked git branch -v and it now matches > the tor-improve > > on remote/tor-improve > > > > selimthegrim@Rimsky-Korsakoffee:~/stegotorus$ make -j2 > > make all-am > > make[1]: Entering directory > `/home/selimthegrim/stegotorus' > > depbase=`echo src/steg/payload_scraper.o | sed 's| > > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/steg/payload_scraper.o -MD -MP -MF > $depbase.Tpo -c > > -o src/steg/payload_scraper.o > src/steg/payload_scraper.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > /bin/bash ./src/genmodtable.sh protolist.cc > src/protocol/chop.cc > > src/protocol/chop_blk.cc src/protocol/null.cc > > protolist.cc is unchanged > > touch stamp-protolist > > /bin/bash ./src/genmodtable.sh steglist.cc > src/steg/b64cookies.cc > > src/steg/cookies.cc src/steg/embed.cc src/steg/http.cc > > src/steg/http_apache.cc > src/steg/http_steg_mods/file_steg.cc > > src/steg/http_steg_mods/pdfSteg.cc > src/steg/http_steg_mods/swfSteg.cc > > src/steg/http_steg_mods/jsSteg.cc > src/steg/http_steg_mods/jpgSteg.cc > > src/steg/http_steg_mods/pngSteg.cc > src/steg/http_steg_mods/gifSteg.cc > > src/steg/nosteg.cc src/steg/nosteg_rr.cc > src/steg/payload_server.cc > > src/steg/trace_payload_server.cc > src/steg/payload_scraper.cc > > src/steg/apache_payload_server.cc > > steglist.cc is unchanged > > touch stamp-steglist > > depbase=`echo src/pgen_fake.o | sed 's| > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/pgen_fake.o -MD -MP -MF $depbase.Tpo > -c -o > > src/pgen_fake.o src/pgen_fake.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > /bin/bash ./src/test/genunitgrps.sh unitgrplist.cc > > src/test/unittest_base64.cc > src/test/unittest_compression.cc > > src/test/unittest_crypt.cc src/test/unittest_pdfsteg.cc > > src/test/unittest_socks.cc > > touch stamp-unitgrplist > > depbase=`echo src/test/tltester.o | sed 's| > [^/]*$|.deps/&|;s|\.o$||' > > `;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/test/tltester.o -MD -MP -MF > $depbase.Tpo -c -o > > src/test/tltester.o src/test/tltester.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo src/test/webpage_tester.o | sed 's| > > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/test/webpage_tester.o -MD -MP -MF > $depbase.Tpo -c - > > o src/test/webpage_tester.o src/test/webpage_tester.cc > &&\ > > mv -f $depbase.Tpo $depbase.Po > > src/steg/payload_scraper.cc: In member function ‘int > > PayloadScraper::scrape()’: > > src/steg/payload_scraper.cc:283:49: warning: ignoring > return value of > > ‘int system(const char*)’, declared with attribute > warn_unused_result > > [-Wunused-result] > > system(ftp_unmount_command_string.c_str()); > > ^ > > src/steg/payload_scraper.cc:312:49: warning: ignoring > return value of > > ‘int system(const char*)’, declared with attribute > warn_unused_result > > [-Wunused-result] > > system(ftp_unmount_command_string.c_str()); > > ^ > > depbase=`echo protolist.o | sed 's| > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT protolist.o -MD -MP -MF $depbase.Tpo -c - > o protolist.o > > protolist.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo steglist.o | sed 's| > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT steglist.o -MD -MP -MF $depbase.Tpo -c - > o steglist.o > > steglist.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > g++ -Wall -Wextra -Wno-missing-field-initializers - > Wformat=2 - > > std=c++0x -g -O2 -std=gnu++11 -o pgen_fake > src/pgen_fake.o src/util.o > > src/rng.o src/base64.o -lcrypto > > depbase=`echo src/test/tinytest.o | sed 's| > [^/]*$|.deps/&|;s|\.o$||' > > `;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/test/tinytest.o -MD -MP -MF > $depbase.Tpo -c -o > > src/test/tinytest.o src/test/tinytest.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo src/test/unittest.o | sed 's| > [^/]*$|.deps/&|;s|\.o$||' > > `;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/test/unittest.o -MD -MP -MF > $depbase.Tpo -c -o > > src/test/unittest.o src/test/unittest.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo src/test/unittest_base64.o | sed 's| > > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/test/unittest_base64.o -MD -MP -MF > $depbase.Tpo -c > > -o src/test/unittest_base64.o > src/test/unittest_base64.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo src/test/unittest_compression.o | sed 's| > > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/test/unittest_compression.o -MD -MP - > MF > > $depbase.Tpo -c -o src/test/unittest_compression.o > > src/test/unittest_compression.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo src/test/unittest_crypt.o | sed 's| > > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/test/unittest_crypt.o -MD -MP -MF > $depbase.Tpo -c - > > o src/test/unittest_crypt.o src/test/unittest_crypt.cc > &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo src/test/unittest_pdfsteg.o | sed 's| > > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/test/unittest_pdfsteg.o -MD -MP -MF > $depbase.Tpo - > > c -o src/test/unittest_pdfsteg.o > src/test/unittest_pdfsteg.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo src/test/unittest_socks.o | sed 's| > > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/test/unittest_socks.o -MD -MP -MF > $depbase.Tpo -c - > > o src/test/unittest_socks.o src/test/unittest_socks.cc > &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo unitgrplist.o | sed 's| > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT unitgrplist.o -MD -MP -MF $depbase.Tpo - > c -o > > unitgrplist.o unitgrplist.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo src/test/gtest/gtest_main.o | sed 's| > > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/test/gtest/gtest_main.o -MD -MP -MF > $depbase.Tpo - > > c -o src/test/gtest/gtest_main.o > src/test/gtest/gtest_main.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo src/test/gtest/gtest-all.o | sed 's| > > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/test/gtest/gtest-all.o -MD -MP -MF > $depbase.Tpo -c > > -o src/test/gtest/gtest-all.o > src/test/gtest/gtest-all.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo src/test/steg_test/steg_mod_unittest.o | > sed 's| > > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/test/steg_test/steg_mod_unittest.o - > MD -MP -MF > > $depbase.Tpo -c -o > src/test/steg_test/steg_mod_unittest.o > > src/test/steg_test/steg_mod_unittest.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo > src/test/steg_test/payload_scraper_unittest.o | sed 's| > > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT > src/test/steg_test/payload_scraper_unittest.o -MD -MP - > > MF $depbase.Tpo -c -o > src/test/steg_test/payload_scraper_unittest.o > > src/test/steg_test/payload_scraper_unittest.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > g++ -Wall -Wextra -Wno-missing-field-initializers - > Wformat=2 - > > std=c++0x -g -O2 -std=gnu++11 -o tltester > src/test/tltester.o > > src/util.o src/util-net.o -levent > > depbase=`echo src/test/tester_proxy/tester_proxy.o | sed > 's| > > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/test/tester_proxy/tester_proxy.o -MD > -MP -MF > > $depbase.Tpo -c -o src/test/tester_proxy/tester_proxy.o > > src/test/tester_proxy/tester_proxy.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > depbase=`echo src/http_parser/http_parser.o | sed 's| > > [^/]*$|.deps/&|;s|\.o$||'`;\ > > g++ -I. -I./src -I./src/steg -I./src/steg/http_steg_mods > - > > I./src/test/gtest -I./src/test/gtest/include -Wall - > Wextra - > > Wno-missing-field-initializers -Wformat=2 -std=c++0x -g - > O2 - > > std=gnu++11 -MT src/http_parser/http_parser.o -MD -MP - > MF $depbase.Tpo > > -c -o src/http_parser/http_parser.o > src/http_parser/http_parser.cc &&\ > > mv -f $depbase.Tpo $depbase.Po > > rm -f libstegotorus.a > > ar cru libstegotorus.a src/base64.o src/compression.o > > src/connections.o src/crypt.o src/mkem.o src/network.o > src/protocol.o > > src/rng.o src/socks.o src/steg.o src/util.o > src/util-net.o > > src/evbuf_util.o src/curl_util.o src/transparent_proxy.o > > src/protocol/chop.o src/protocol/chop_blk.o > src/protocol/null.o > > src/steg/b64cookies.o src/steg/cookies.o > src/steg/embed.o > > src/steg/http.o src/steg/http_apache.o > src/steg/http_apache.o > > src/steg/http_steg_mods/file_steg.o > src/steg/http_steg_mods/pdfSteg.o > > src/steg/http_steg_mods/swfSteg.o > src/steg/http_steg_mods/jsSteg.o > > src/steg/http_steg_mods/jpgSteg.o > src/steg/http_steg_mods/pngSteg.o > > src/steg/http_steg_mods/gifSteg.o src/steg/nosteg.o > > src/steg/nosteg_rr.o src/steg/payload_server.o > > src/steg/trace_payload_server.o > src/steg/payload_scraper.o > > src/steg/apache_payload_server.o src/subprocess-unix.o > protolist.o > > steglist.o > > : libstegotorus.a > > /bin/bash ./src/audit-globals.sh src/base64.o > src/compression.o > > src/connections.o src/crypt.o src/mkem.o src/network.o > src/protocol.o > > src/rng.o src/socks.o src/steg.o src/util.o > src/util-net.o > > src/evbuf_util.o src/curl_util.o src/transparent_proxy.o > > src/protocol/chop.o src/protocol/chop_blk.o > src/protocol/null.o > > src/steg/b64cookies.o src/steg/cookies.o > src/steg/embed.o > > src/steg/http.o src/steg/http_apache.o > src/steg/http_apache.o > > src/steg/http_steg_mods/file_steg.o > src/steg/http_steg_mods/pdfSteg.o > > src/steg/http_steg_mods/swfSteg.o > src/steg/http_steg_mods/jsSteg.o > > src/steg/http_steg_mods/jpgSteg.o > src/steg/http_steg_mods/pngSteg.o > > src/steg/http_steg_mods/gifSteg.o src/steg/nosteg.o > > src/steg/nosteg_rr.o src/steg/payload_server.o > > src/steg/trace_payload_server.o > src/steg/payload_scraper.o > > src/steg/apache_payload_server.o src/subprocess-unix.o > protolist.o > > steglist.o src/main.o > > sed: -e expression #1, char 113: unknown option to `s' > > touch stamp-audit-globals > > g++ -Wall -Wextra -Wno-missing-field-initializers - > Wformat=2 - > > std=c++0x -g -O2 -std=gnu++11 -o unittests > src/test/tinytest.o > > src/test/unittest.o src/test/unittest_base64.o > > src/test/unittest_compression.o > src/test/unittest_crypt.o > > src/test/unittest_pdfsteg.o src/test/unittest_socks.o > unitgrplist.o > > libstegotorus.a -levent -lcrypto -lz -lcurl - > lboost_system - > > lboost_filesystem -lconfig++ > > g++ -Wall -Wextra -Wno-missing-field-initializers - > Wformat=2 - > > std=c++0x -g -O2 -std=gnu++11 -o tester_proxy > > src/test/tester_proxy/tester_proxy.o -levent_openssl - > levent -lssl - > > lcrypto > > g++ -Wall -Wextra -Wno-missing-field-initializers - > Wformat=2 - > > std=c++0x -g -O2 -std=gnu++11 -o webpage_tester > > src/test/webpage_tester.o src/util.o src/util-net.o > src/curl_util.o > > src/http_parser/http_parser.o -levent -lcrypto -lz - > lcurl - > > lboost_system -lboost_filesystem -lconfig++ > > g++ -Wall -Wextra -Wno-missing-field-initializers - > Wformat=2 - > > std=c++0x -g -O2 -std=gnu++11 -o stegotorus src/main.o > libstegotorus.a > > -levent -lcrypto -lz -lcurl -lboost_system - > lboost_filesystem - > > lconfig++ > > g++ -Wall -Wextra -Wno-missing-field-initializers - > Wformat=2 - > > std=c++0x -g -O2 -std=gnu++11 -o g_unittests > > src/test/gtest/gtest_main.o src/test/gtest/gtest-all.o > > src/test/steg_test/steg_mod_unittest.o > > src/test/steg_test/payload_scraper_unittest.o > libstegotorus.a -levent - > > lcrypto -lz -lcurl -lboost_system -lboost_filesystem - > lconfig++ > > /usr/bin/ld: src/test/gtest/gtest-all.o: undefined > reference to symbol > > 'pthread_key_delete@@GLIBC_2.2.5' > > /lib/x86_64-linux-gnu/libpthread.so.0: error adding > symbols: DSO > > missing from command line > > collect2: error: ld returned 1 exit status > > make[1]: *** [g_unittests] Error 1 > > make[1]: Leaving directory > `/home/selimthegrim/stegotorus' > > make: *** [all] Error 2 > > > >

1 0

Pluggable transports meeting tomorrow (Friday 28th of March 2014)
by George Kadianakis 27 Mar '14

27 Mar '14

Greetings humans, this is an email to remind you that the regular biweekly pluggable transports meeting is going to happen tomorrow. Place is the #tor-dev IRC channel in OFTC. Time is 17:00 UTC. Cheers!

1 0

[Orbot patch] Add all /external build stamps to .gitignore, cleanup
by Daniel Martí 27 Mar '14

27 Mar '14

Signed-off-by: Daniel Martí <mvdan(a)mvdan.cc> --- .gitignore | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/.gitignore b/.gitignore index 4824f92..f3fb750 100644 --- a/.gitignore +++ b/.gitignore @@ -1,16 +1,11 @@ -external/bin/ -external/include/ -external/jtorctl-build-stamp -external/lib/ -external/libevent-build-stamp -external/obfsproxy-build-stamp -external/openssl-static-build-stamp -external/privoxy-build-stamp -external/privoxy/ -external/test.c -external/test.h.gch -external/tor-build-stamp -external/translation/ +/external/bin/ +/external/include/ +/external/*-build-stamp +/external/lib/ +/external/privoxy/ +/external/test.c +/external/test.h.gch +/external/translation/ bin gen native -- Daniel Martí - mvdan(a)mvdan.cc - http://mvdan.cc/ PGP: A9DA 13CD F7A1 4ACD D3DE E530 F4CA FFDB 4348 041C

1 0

Re: [tor-dev] Implications of switching to a single guard node: some conclusions
by Nicholas Hopper 27 Mar '14

27 Mar '14

On Tue, Mar 25, 2014 at 3:41 PM, Mike Perry <mikeperry(a)torproject.org> wrote: > For control, it would be nice to know what we would be giving up if we > used that same T=2000 cutoff with three guards and compare that to > T=2000 with just one guard. Is it easy for you to rerun just that > comparison (since you seem to be suggesting that T=2000 is a good cutoff > anyway)? Takes a few hours to run the scripts again, but the results look like this. For the "unluckiest 10%" with T=1000, having 3 guards is still better than having one, while with T=2000 the difference between 3 guards and 1 is less noticeable: https://www-users.cs.umn.edu/~hopper/unlucky_threeguard_threshold_bandwidth… Interestingly, though, for the median user with the higher thresholds, having one guard results in a higher median circuit bandwidth (because a user with 3 guards is more likely to have selected one guard close to the cutoff, dragging the typical performance down): https://www-users.cs.umn.edu/~hopper/threeguard_threshold_bandwidth.png ...but I don't think these results speak to this concern: > ** The reason I ask is because I suspect there is actually an interplay > between the current circuit build timeout code and the pool of 3 guards. > The CBT cutoff will tend to cause you to avoid whichever of your guards > may be temporarily overloaded at a given time. because TorPS is a python reimplementation of the circuit selection algorithm only and doesn't have any way to simulate the CBT logic: http://torps.github.io/ -- ------------------------------------------------------------------------ Nicholas Hopper Associate Professor, Computer Science & Engineering, University of Minnesota Visiting Research Director, The Tor Project ------------------------------------------------------------------------

1 0