- tor-dev - lists.torproject.org

Proposal 299: Preferring IPv4 or IPv6 based on IP Version Failure Count
by Neel Chauhan 08 Feb '19

08 Feb '19

Hi tor-dev@ mailing list, First off, thank you to Nick for making this an official proposal and thank you again for marking it as open. I really appreciate this. Also, thank you teor for aiding me on my first proposal. My proposal is available on torspec here: https://gitweb.torproject.org/torspec.git/tree/proposals/299-ip-failure-cou… Now that my proposal "Preferring IPv4 or IPv6 based on IP Version Failure Count" is Open, I would really appreciate your opinions on this. Is it good, bad? Could it have any improvements? Best, Neel Chauhan === https://www.neelc.org

2 2

anti-censorship weekly meeting
by Gaba 07 Feb '19

07 Feb '19

Hi! Sending a reminder that we are having our weekly meeting for the anti-censorship work on Thursday 20:00 UTC on #tor-meeting at OFTC. The meeting pad is here: https://pad.riseup.net/p/tor-censorship-2019-keep cheers, gaba -- Project Manager - Network, Metrics and Anti-censorship Teams

2 1

The Tor project as a GSoC voucher for Whonix?
by iry 06 Feb '19

06 Feb '19

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Dear Tor Developers, Whonix is applying to be a Google Summer of Code organization this year. I am writing on behalf of Whonix to ask if the Tor project could be a voucher for Whonix. Specifically, in the application form, it asks: > If you are a new organization to GSoC, is there a Google employee > or previously participating organization who will vouch for you? If > so, please enter their name, contact email, and relationship to > your organization. Whonix community would be really appreciated if Tor can be our voucher this year. And please feel free to contact me to provide the information described above anytime before the deadline (February 6, 2019 at 20:00 UTC). Thank you very much! Cheers, iry -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEzKSpZKlpRovTotu+oUtNvG3N1TwFAlxY0EMACgkQoUtNvG3N 1TwY/A//SawazcU4EosRFRkF8YJSz3LsRor820uF+X/QovEi5J8EJGaXBgO+Dp+Q Ryi/LzmdGwIWfmWJKk+kWpzfIROYkmNWS6xzz+iwZEYvxvJ2QH5twlAWKDWSwFHm kz7/6AhWnoq+GnsBF+Eg0jNcxSQGLum89Ul4Y3kll4PYriqpDxzQblYt7qzffJJu UJdh9Y5SkSRyX0HThuRgMtCs1l9z7BEY0tkLbUm1pRcU8KuomTy4f1L45T49h7ub rfDc4AOBcA8wtX3CF/1oR0AmRo5YvwD9rMNsk4f+bHphdn07iOcwF5kGi6TxA8Va fLUflN0cIPnk62RmQPebkHSjcyWi74z4rxe2j7trmiDyN2DI3D7wLxNQPYRzO5/H 4YodMAgUkhNluDmJ0Hewq6e3q9js5/6ks1vTGbJjzTW+le2+MOiSiJeZgQYfdF1d Fu7Yf3h6HmIs9zg9zv9qf7CUSizBQVqGqnSUVVyMSsSE5xtX0Enri15PodkMac5C 87m5JDJIuf6HdsCiJ+cXQsCOoTCVz1rFxUMmH3URIOJQX6POZlYjZ4yir1TVc1Uj OkjvsUO89YbnmBpnTJe/0KGS+OjXI+NE3iQfV5d6hIoruqVuIMzL6/O/1Q4onviu oFiCp/ilBtDm8lRlXAbKAIKibYPSAPhoO4xN9jI1NIPoWouwusk= =xX5B -----END PGP SIGNATURE-----

3 5

Release: obfs4proxy-0.0.9
by Yawning Angel 05 Feb '19

05 Feb '19

Hello all, I just tagged obfs4proxy-0.0.9. The main features of this release are primarily related to improving the behavior of the `meek_lite` transport. Since some of the changes are major, I will expand on them separately from the brief summary given in the ChangeLog. * A forked version[0] of https://github.com/refraction-networking/utls is now used to mask the TLS signature. This results in a ClientHello that should resemble modern versions of Firefox by default. While the utls profile is named `HelloFirefox_63`, a cursory examination leads me to believe that there are no differences in FF 65. The bridge line option `utls=<fingerprint>` will allow specifying the behavior, with (case-insenstive) string representations of the utls fingerprint names. `none` will revert to the previous behavior. Not all fingerprints were tested and or are guaranteed to work. Development was primarily done with `HelloChrome_70, `HelloFirefox_63`, and `HelloChrome_71` (experimental). While I can not vouch for the mimicry accuracy of every single profile, all of the profiles that attempt to mimic browsers should function fairly well[1], though this partially depends on the the configuration of the host doing the fronting. * meek_lite now has HPKP[2] style public key pins for all of the Microsoft CA certs that are used to sign Azure leaf certificates. This is only enabled when `utls` is being used, because I'm lazy. If Microsoft happens to change their CA certificates prior to the next release, 2024-05-20, or you are ok with being actively man-in-the- middled for some reason, adding `disableHPKP=true` to the bridge line will disable certificate pin validation. HPKP headers in HTTP responses are ignored, only the static pin list is consulted. * Due to a shift in my philosophy, portions of the new code are released under the GNU General Public License v3. Exceptions to the viral nature of the license will be considered on a case-by-case basis. Contact me for more details. Tarball/Signature: https://people.torproject.org/~yawning/releases/obfs4proxy/obfs4proxy-0.0.9… https://people.torproject.org/~yawning/releases/obfs4proxy/obfs4proxy-0.0.9… Changes in version 0.0.9 - 2019-02-05: - Various meek_lite code cleanups and bug fixes. - Bug 29077: uTLS for ClientHello camouflage (meek_lite). - More fixes to HTTP Basic auth. - (meek_lite) Pin the certificate chain public keys for the default Tor Browser Azure bridge (meek_lite). Regards, -- Yawning Angel [0]: obfs4proxy WILL NOT build with the upstream version of the library, and the Firefox fingerprint will not function with Azure using the upstream version. [1]: For "I can watch Eluveitie music videos on youtube over it" definitions of "fairly well". [2]: Yes, the HPKP spec is rather dead in the wild with a lot of people giving up on it. It is my opinion that in this context having such a mechanism makes sense.

1 0

New Proposal: Preferring IPv4 or IPv6 based on IP Version Failure Count
by Neel Chauhan 29 Jan '19

29 Jan '19

Hi tor-dev@ mailing list, I have been working on Bug #27491 (https://trac.torproject.org/projects/tor/ticket/27491) and have been asked to write a proposal. My proposal is attached to this email as a text file. I would really appreciate your comments on this proposal (is it good, bad, any problems with it?). Thank You, Neel Chahan

4 6

Building meek-server with Go 1.11.5
by Matthew Finkel 27 Jan '19

27 Jan '19

Attached is a script for building meek-server. I used this for completing #29171. The newest version of Go is only available in Sid and Buster[0], so this script creates a Buster environment and installs the dependencies. The script assumes debootstrap and sudo are installed (and you have necessary privilege). As of today, a Debian Buster system should create a reproducible binary with a SHA-256 digest 6e242798f861308083e54bc0ca3989a03b0818475e9b6df4589ced10c7e3aadc (confirmed over multi-path builds). This is simply an FYI, in case anyone else want so to use it. - Matt [0] https://security-tracker.debian.org/tracker/source-package/golang-1.11

1 0

using obfs4 to tunnel to a SOCKS proxy server
by Hans-Christoph Steiner 24 Jan '19

24 Jan '19

Hey all, Hopefully this is a valid place to ask about PTs technical details. So n8fr8, uniqx (Michael Pöhn), and I are working to make an easily reproducible obfs4 client and server setup with ansible scripts uniqx got the setup working with obfs4 connecting to a port on the server side, like a webserver. Weŕe trying to figure out a way to make this obfs4 setup to behave like an SSH port forward, but weŕe banging our heads against the concept. For example, could the obfs4 server side provide a generic SOCKS proxy? Hereś the use case: wikimedia foundation wants to run their own PTs built into their own client but it needs to support multiple domains, e.g. en.wikipedia.org and commons.wikimedia.org. So we would like to have a generic SOCKS proxy for the client. Then server side, the SOCKS proxy only allows connections to a whitelist of wikimedia servers. Here are uniqxś PT projects: https://gitlab.com/uniqx/pt-obfs4proxy-minimal-demo https://gitlab.com/uniqx/pt-socks5-over-obfs4proxy https://gitlab.com/uniqx/pt-obfs4proxy-tcp-bridge https://gitlab.com/uniqx/pt-tor-obfs4-bridge-test-vm .hc -- PGP fingerprint: EE66 20C7 136B 0D2C 456C 0A4D E9E2 8DEA 00AA 5556 https://pgp.mit.edu/pks/lookup?op=vindex&search=0xE9E28DEA00AA5556

3 4

anti-censorship weekly meeting notes
by Gaba 24 Jan '19

24 Jan '19

Hi! We had the weekly meeting today! Our next meeting will be in two weeks on February 7th 20:00 UTC You can find the logs here: http://meetbot.debian.net/tor-meeting/2019/tor-meeting.2019-01-24-20.04.html And the contents of the pad: ANTI-CENSORSHIP work meeting pad -------------------------------- Next meeting: Thursday February 7th 20:00 UTC Weekly meetings every Thursday 20:00 UTC on #tor-meeting at OFTC (channel is logged while meetings are in progress). == Goal of this meeting == Weekly checkin about the status of anti-censorship work at Tor. Coordinate collaboration between people/teams on anti-censorship. == Links to Useful documents == Anti-censorship Roadmap: https://storm.torproject.org/shared/KXkqlNP8ouNks_ey5khZKUSbNj9ZoidXmEp80OD… Snowflake Roadmap: https://storm.torproject.org/shared/OdNtwrtRrqklh76l4PfcngBbQFDbjv_jRroj0We… Gettor Roadmap: https://storm.torproject.org/shared/rhsSl_3Pb253HPqoCdFiAdmXQ57NUG_BLvBCxqF… Bridgedb Roadmap: https://storm.torproject.org/shared/O4XpgyW_q6CAtPPO_nd_Qc16Up-jXqdJLG8gXZY… Roger's thoughts on anti-censorship's priorities: https://storm.torproject.org/shared/kU83M2pQehsnQZPzR_mwmYslAijqKgYNOEak57T… Komlo's thoughts on anti-censorship's plan: https://pad.riseup.net/p/CensorshipTeam-Planning-keep Dfcr's thoughts on anti-censorship's priorities (Snowflake only): https://share.riseup.net/#sU0_Jv7OXz8dDK5DHqDVAw ------------------------------- ---- 24th January 2019 ---- ------------------------------- == Announcements == Snowflake extensions: needs developer, let's check who/how in the browser team can do it (antonela, pili, gabA) <-- still working on this Gettor: meet outside weekly anti-censorship meeting to define scope (antonela, gaba, hiro) <-- still working on this == Discussion == Snowflake == Actions == == Updates == FORMAT! Name: Last week: - What you worked on last week a This week: - What you are planning to work on next week (related to anti-censorship work). Help with: - Something you may need help with. Gaba: This week (01/24): preparation for roadmap exercise with network team ahf: Last week: - Documenting current Snowflake architecture and identify problems related to scalability and usability (both for developers and users). (#28848) - Documenting basic WebRTC usage to allow other developers to quickly join in on it. (#28048) [<-- wrong ticket number? 28048 is "Metrics: Allow to search for relays per continent"] - Identifying bug where Snowflake proxy becomes unresponsive in a smaller environment. (possibly #25429?) This week (01/24): - Was out sick friday/monday, didn't do much. - Preparing for network team meeting in brussels where I hope to help the new hire for the anti-censorship team with things related to this: - A talk about Snowflake that will hopefully make everyone be able to look at the code quickly. - Email to Kat about some scalability concerns that I think is worth having in mind about Snowflake: Numbers of bridges, etc. kat5: Working on: - report 2 - private bridge guide for NGOs (hold off until we figure out a strategy for making set-up easy) anto: Working on: - Snowflake Web Extension UI - https://trac.torproject.org/projects/tor/ticket/23888 - Put together a PRD for Gettor, needs more info and review - https://docs.google.com/document/d/18R_tUnqfFkn7d93w0pEbBOLxB62KAWHbUGd5MPK… Help with - snowflake extension: in need of a developer pili (offline): working on: - gettor - agreed on next steps to deploy refactored code with ilv and hiro - still need to define project scope with gaba, antonela and hiro help with: - Browser team can't commit anyone to work on snowflake web extension - can we not just: a) wait for integration into cupcake (see https://github.com/glamrock/cupcake/issues/24) - we can help them with this also b) wait for anti-censorship developer - we need to also think about who is going to maintain this webextension dcf: Last week: - minor UX improvement for Snowflake proxy (#25722) - antonela has more ambitious changes in #27385 - monkeying with uTLS in meek-client (#29077) - meek and snowflake sysadmin This week: - more uTLS in meek-client, restore proxy support - more sysadmin (#29171, #29172) Samdney: Working on: - Will also have a look at the WebExtension ticket #23888 :) - Looking for something where they can help!!! - If you have anything in the direction of "research" or "investigation" in something, then I'm your guy! :) (- I'm working on a research project about censor <-> classical attacker in game theory. That's maybe later, when I have results :), interesting for UX/dev stuff.) _hc/eighthave: uniqx and I have been working on ways to integrate PTs into apps easily. we have a working client/server automation setup based in Python. We also were trying to do a more generic proxy, https://lists.torproject.org/pipermail/tor-dev/2019-January/013637.html n8fr8 is working on getting obfs4 into our Android Pluggable Transports library. he's having trouble getting it to connect to our server automation In Feb, I'll be working on figuring out a good URL scheme for bridge configuraton - #15035 OTF accepted our Concept Note with Stephen Farrell for working on ESNI and ensuring circumvention is included. We are submitting the proposal now, chances look good!

1 0

RFC: Using `utls` in meek_lite.
by Yawning Angel 24 Jan '19

24 Jan '19

Hello, I just pushed a change to obfs4proxy master to use `utls` to mask the ClientHello signature (currently Chrome 70.x). https://gitlab.com/yawning/obfs4/commit/4d453dab2120082b00bf6e63ab4aaeeda6b… I understand that this is being worked on for the original meek (see: https://bugs.torproject.org/29077) but I felt inspired and it was relatively easy to get something working. Caveats: * This is only lightly tested, and may be doing something wrong or distinct. It seems to work well enough to watch videos over it. YMMV. * Azure uses HTTP 2. Not really a problem. * `utls.HelloFirefox_Auto` will fail to handshake with Azure due to an incompatible group being negotiated. * `utls.HelloChrome_Auto` ironically fails to handshake with `google.com` in a standalone test case for me. * `utls.HelloIOS_Auto` seems to work in all cases, so I may switch to that before I tag. Questions, comments, feedback appreciated, -- Yawning Angel

2 7

Modifying Path Selection based on geography
by sarpedon montecarlo 22 Jan '19

22 Jan '19

Hello there. I recently started to do some modifications on tor path selection by using stem, torflow/op-addon and txtorconn. but as long as i enable __LeaveStreamsUnattached option, tor will not function properly. so i decided to hack the source for this feature i seek: custom country for each position: entry:{{entry country-code}} middle:{{middle country-code}} exit:{{country-code}} i really appreciate you guys give me some hint, that which part of the source i must start to hack? i have dived into circuitbuild.c and some other core/or modules but i am confused where to start. thanks in advance.

3 4