summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Do the release ritual for obfsproxy-0.2.12.HEADmasterGeorge Kadianakis2014-07-22
|
* Add txsocksx and parsley as py2exe dependencies.George Kadianakis2014-07-22
|
* Do the release ritual for obfsproxy-0.2.11.George Kadianakis2014-07-16
|
* When in external mode, only call setup() of the transports we are launching.George Kadianakis2014-07-16
|
* Catch some exceptions in scramblesuit's setup() and fail gracefully.George Kadianakis2014-07-16
| | | | | Conflicts: obfsproxy/transports/scramblesuit/scramblesuit.py
* Write password to a file, instead of the whole Bridge line.George Kadianakis2014-07-16
| | | | | | | | | | | | | Because of technical problems (see #10887:comment:11) it was not so easy to write the actual Bridge line that people were supposed to use. Let's just write the password for now. Conflicts: obfsproxy/transports/scramblesuit/const.py obfsproxy/transports/scramblesuit/state.py Conflicts: obfsproxy/transports/scramblesuit/scramblesuit.py
* Remove a broken unittest.George Kadianakis2014-07-16
|
* Use temporary files instead of "/tmp" in scramblesuit unittests.George Kadianakis2014-07-16
| | | | | Conflicts: obfsproxy/test/transports/test_scramblesuit.py
* Fix path joining in scramblesuit/state.py.George Kadianakis2014-07-15
|
* Add a ChangeLog entry for --password-file.George Kadianakis2014-07-15
|
* Add --password-file for scramblesuit UniformDH passwordirregulator2014-07-15
| | | | | | This argument permits to run obfsproxy in unmanaged mode and pass a file containing the scramblesuit password. That way password won't be visible in process list.
* Add ChangeLog entry about scramblesuit's packetmorpher improvements.George Kadianakis2014-07-15
|
* Add PacketMorpher unittests.George Kadianakis2014-07-15
|
* Improve packet morphing algorithm.Philipp Winter2014-07-15
| | | | | | | | | We only want to run the packet morphing algorithm when we really need it -- which is immediately before we send data. Previously, we would morph immediately upon receiving data which is not optimal. This should fix <https://bugs.torproject.org/10991>. Thanks to Yawning Angel who pointed out the problem.
* Add missing markers to HMACs.Philipp Winter2014-07-15
| | | | Thanks to Yawning Angel for catching this.
* Use more readable error messages.Philipp Winter2014-07-15
| | | | | | To a user, it's not immediately clear that a given password was not well formed. The refactored error messages should fix that. See bug <https://bugs.torproject.org/11143> for context.
* Add ChangeLog entry about scramblesuit spec improvements.George Kadianakis2014-07-15
| | | | | Conflicts: ChangeLog
* Elaborate on protocol polymorphism.Philipp Winter2014-07-15
| | | | | | | | | While the general idea is explained, there are no exact details. Implementations may use different (CS)PRNGs to derive probability distributions. Such "flow diversity" might even be beneficial. Conflicts: doc/scramblesuit/scramblesuit-spec.txt
* Fix ticket handshake spec.Philipp Winter2014-07-15
| | | | | The first message makes use of the HMAC key which is derived from the master key. It does not use the master key itself.
* Add missing reference.Philipp Winter2014-07-15
|
* Add TicketTest unittest.George Kadianakis2014-07-15
|
* When authenticating, also test epoch boundaries.Philipp Winter2014-07-15
| | | | | | | On occasion, a client's or a server's epoch might already have increased whereas the epoch of the other party didn't. This is a benign event and there is no reason to fail authentication because of this. As a result, as a server, we now also test boundary values, i.e., epoch - 1, epoch, epoch + 1.
* Make the server simply echo the client's epoch.Philipp Winter2014-07-15
| | | | That's only relevant for UniformDH.
* Let the server echo the epoch.Philipp Winter2014-07-15
| | | | There's no need for the server to determine its own epoch.
* Add scramblesuit unittests for the state module.George Kadianakis2014-07-15
|
* Increase closing threshold.Philipp Winter2014-07-15
| | | | | | Since we no longer process data after authentication has failed, we might as well increase the closing threshold. The larger interval hopefully makes ScrambleSuit bridges less fingerprintable for active adversaries.
* Stop processing data after authentication failed.Philipp Winter2014-07-15
| | | | | | | | If the client did not authenticate after MAX_HANDSHAKE_LENGTH bytes, authentication has failed. For obfuscation, we keep the connection open a while longer but we stop processing all data from that point on to prevent denial-of-service attacks. (Partial) patch by Yawning Angel. For previous discussion, see: <https://bugs.torproject.org/11092>.
* Add and use const.MAX_HANDSHAKE_LENGTH.Philipp Winter2014-07-15
|
* Only search for mark in expected space.Philipp Winter2014-07-15
| | | | | | We know in which array slice the mark is expected. As a result, we don't have to look any further than that. Patch by Yawning Angel. See the following ticket for reference: <https://bugs.torproject.org/11092>.
* Fix problems in UniformDH spec.Philipp Winter2014-07-15
| | | | | | | | | 1. Fix a typo by changing "X" to "Y". 2. Add "M_C" and "M_S" to the respective MAC function as they are also authenticated. The problem was pointed out by Yawning Angel in: <https://bugs.torproject.org/10893>
* Fix typo.Philipp Winter2014-07-15
| | | | | The problem was pointed out by Yawning Angel in: <https://bugs.torproject.org/10893#comment:3>
* Add ChangeLog entry for #11092.George Kadianakis2014-07-15
| | | | | Conflicts: ChangeLog
* Close connection if authentication fails.Philipp Winter2014-07-15
| | | | | | | | Adapt the server's behaviour to the spec change of commit 892846eb. When a server bootstraps for the first time, it randomly generates a byte threshold after which unauthenticated connections are closed. This should fix <https://bugs.torproject.org/11092>.
* Elaborate on server's behaviour.Philipp Winter2014-07-15
| | | | | | | | | In particular, discuss strategies which servers should implement if clients cannot authenticate. Otherwise, malicious clients could run computation-based or memory-based denial-of-service attacks. This problem was reported by Yawning Angel. This should fix <https://bugs.torproject.org/11092>.
* Do the release ritual for obfsproxy-0.2.10.George Kadianakis2014-06-05
|
* Add a ChangeLog entry for #9878.George Kadianakis2014-05-10
|
* Log pyptlib version on startup.John Giannelos2014-05-10
|
* Don't set transport circuit to None when closing a circuit.George Kadianakis2014-05-08
|
* Don't do networking on connections that should be closed.George Kadianakis2014-05-08
|
* Print ScrambleSuit disclaimer on startup.George Kadianakis2014-05-06
| | | | instead of printing it for every new connection
* Do the release ritual for obfsproxy-0.2.9.George Kadianakis2014-05-01
|
* Make sure that AES-CTR counter of obfs{2,3} won't overflow.George Kadianakis2014-04-26
|
* Add a compatibility layer for Twisted's UnsupportedAddressFamily.George Kadianakis2014-04-25
| | | | | | | twisted.internet.error.UnsupportedAddressFamily was added in twisted-12.1.0. This commit adds a stub that emulates it for platforms that don't have a recent Twisted (e.g. Debian squeeze/wheezy).
* Make txsocksx an optional dependency.George Kadianakis2014-04-25
| | | | Server-side obfsproxy does not need txsocksx.
* Proxy support: Ensure we have txsocksx and a recent enough Twisted.George Kadianakis2014-04-25
| | | | | | From now on, obfsproxy when configured to connect to a proxy (either using --proxy or TOR_PT_PROXY) will refuse to run if it doesn't have txsocksx or its Twisted is too old (< 13.2.0).
* Merge branch 'bug8956_tweak'George Kadianakis2014-04-16
|\ | | | | | | | | Conflicts: ChangeLog
| * Tweak the proxy logging a bit.George Kadianakis2014-04-16
| | | | | | | | | | | | Clean some long lines, and some instances of pylint's logging-not-lazy (although the rest of the codebase has many more instances of this).
| * Clean up error handling when the http proxy doesn't return status.Yawning Angel2014-04-16
| | | | | | | | | | | | | | | | | | | | Some HTTP proxys opt to close the connection instead of returning a HTTP status code on certain failures (Eg: polipo auth faliure, privoxy ACL denial). This change logs a better error message to the obfsproxy log when that happens. As an added bonus the SOCKS5 server now knows about EHOSTUNREACH, so a more informative response is sent on that failure type.
| * Don't feed None to parseProxyURI() in external mode.George Kadianakis2014-04-15
| |
| * Add support for connecting via a HTTPS CONNECT proxy.Yawning Angel2014-04-15
| | | | | | | | | | | | This adds a HTTPS CONNECT client. It's been lightly tested with both privoxy and apache2 and appears to work, both without authentication and with Basic.
generated by cgit v1.2.1 (git 2.18.0) at 2024-02-02 10:38:56 +0000