Trac issueshttps://gitlab.torproject.org/legacy/trac/-/issues2022-05-18T23:27:33Zhttps://gitlab.torproject.org/legacy/trac/-/issues/11406UI for ExitNode country selection in tor-launcher2022-05-18T23:27:33ZMatt PaganUI for ExitNode country selection in tor-launcherUsers often want to know how to make it appear they are coming from a certain country. There should be a more usable way of doing this than manually adding an ExitNodes line in the Tor Browser's torrc. The country code interface should h...Users often want to know how to make it appear they are coming from a certain country. There should be a more usable way of doing this than manually adding an ExitNodes line in the Tor Browser's torrc. The country code interface should have a clear warning that setting a country will make you less anonymous.Kathleen BradeKathleen Bradehttps://gitlab.torproject.org/legacy/trac/-/issues/6Confused server clocks can screw up timing2022-03-22T13:04:03Zweasel (Peter Palfrader)Confused server clocks can screw up timing[Moved from bugzilla]
Reporter: nickm@alum.mit.edu (Nick Mathewson)
Description:
Opened: 2003-08-29 20:44
Some users have reported that the mixminion server has a nasty failure mode when
a server's clock moves backwards by a large i...[Moved from bugzilla]
Reporter: nickm@alum.mit.edu (Nick Mathewson)
Description:
Opened: 2003-08-29 20:44
Some users have reported that the mixminion server has a nasty failure mode when
a server's clock moves backwards by a large interval. When the server asks
"when did we last (do something)", the answer "tomorrow" can cause crashes or
weird behavior.
I'm deferring this for a while, because (a) I want to get 0.0.5 put to bed, and
(b) the workaround is trivial: keep your clock set right.
[Automatically added by flyspray2trac: Operating System: All]Nick MathewsonNick Mathewsonhttps://gitlab.torproject.org/legacy/trac/-/issues/14014Add obfs4proxy to the default tor apparmor profile2021-09-02T14:28:02ZTracAdd obfs4proxy to the default tor apparmor profileThe current apparmor profile shipped with tor allows tor to launch obfsproxy but not Yawning's new obfs4proxy. To fix you just need to add:
```
/usr/bin/obfs4proxy PUx,
```
to debian/tor.apparmor-profile.abstraction. I specify that pa...The current apparmor profile shipped with tor allows tor to launch obfsproxy but not Yawning's new obfs4proxy. To fix you just need to add:
```
/usr/bin/obfs4proxy PUx,
```
to debian/tor.apparmor-profile.abstraction. I specify that path because that's where the current debian package installs to; however, obfs4's debian packaging source does not appear to be included in tor's git. Perhaps Yawning can verify whether this will continue to be the stable install location?
**Trac**:
**Username**: vladtsyrklevichweasel (Peter Palfrader)weasel (Peter Palfrader)https://gitlab.torproject.org/legacy/trac/-/issues/19834Rethink how we handle issues while sanitizing bridge descriptors2021-08-23T14:43:21ZKarsten LoesingRethink how we handle issues while sanitizing bridge descriptorsThe bridge descriptor sanitizer parses tarballs containing non-sanitized bridge descriptors, modifies their content by removing bridge IP addresses and other sensitive parts, and writes sanitized versions of those bridge descriptors to d...The bridge descriptor sanitizer parses tarballs containing non-sanitized bridge descriptors, modifies their content by removing bridge IP addresses and other sensitive parts, and writes sanitized versions of those bridge descriptors to disk.
The sanitizer needs to recognize the lines contained in bridge descriptors to distinguish between lines that must be changed and others that can be kept unchanged, and it needs to be able to understand the exact format of certain lines in order to sanitize their contents.
This process can go wrong in various ways, and we need to decide how to handle those situations. Possible situations are:
1. A tarball is malformed or can otherwise not be opened.
2. A tarball contains one or more files that cannot be opened.
3. A tarball file contains an unknown descriptor type.
4. An internal problem prohibits sanitizing descriptor parts (e.g., missing secret for sanitizing IP address).
5. A descriptor is missing parts that are required for properly sanitizing its contents.
6. A descriptor contains an unrecognized line.
7. A descriptor line doesn't follow the expected format, contains fewer or more arguments, etc.
Possible ways of handling such situations are:
A. Skip a line we don't understand and keep the rest of the descriptor.
B. Skip a descriptor.
C. Skip the file contained in the tarball and continue with the next.
D. Abort processing the tarball.
E. Skip the entire tarball, including discarding any descriptors processed before running into the problem, and attempt to process the tarball again in the next execution.
F. Abstain from processing a given descriptor type until a problem has been resolved.
G. Discard any descriptors processed in a tarball until running into the problem, abort the current execution, and refuse starting the next execution until the problem has been resolved.
H. (in addition to A-G). Inform the operator by logging the problem.
I. (in addition to A-G). Warn the operator and ask them to resolve the problem.
Looking at this list, I think that my preferred ways of handling problems would be something like:
- B+H in situations 5, 6, and 7;
- E+I in situations 1, 2, and 3; and
- G+I in situation 4.
That's not exactly what we're currently doing. And I'm not even sure if somebody else operating a CollecTor instance with the bridgedescs module would have the same preferences.
Let's discuss!https://gitlab.torproject.org/legacy/trac/-/issues/29493User repo for new website2020-12-11T15:59:29ZDamian JohnsonUser repo for new websiteHi, I'll be making patches for our new website and I'd appreciate a user repository to stage pull requests...
Requested repo: user/atagar/web/tpo.git
For pull requests of: https://gitweb.torproject.org/project/web/tpo.git/
Thanks!Hi, I'll be making patches for our new website and I'd appreciate a user repository to stage pull requests...
Requested repo: user/atagar/web/tpo.git
For pull requests of: https://gitweb.torproject.org/project/web/tpo.git/
Thanks!https://gitlab.torproject.org/legacy/trac/-/issues/29677evaluate password management options2020-10-19T16:05:39Zanarcatevaluate password management optionsduring the [[org/meetings/2017Montreal/Notes/BusFactor]] session, one of the things that was discussed was the password management system that is (was?) stored in SVN. Specifically:
* We need a better password management solution than ...during the [[org/meetings/2017Montreal/Notes/BusFactor]] session, one of the things that was discussed was the password management system that is (was?) stored in SVN. Specifically:
* We need a better password management solution than the one we have in corporate SVN right now.
* We should look over if the password's in this database should be rotated.
* Figure out if the passwords for paypal have been rotated by Jon et al and ensure that it will be put in the password database. We should also look into the "paypal dongle" or 2-step authentication?
I have some experience reviewing password managers, so I might be able to provide some advice here if someone expands on the requirements and problems with the current approach.https://gitlab.torproject.org/legacy/trac/-/issues/30009consider trocla for secrets management in puppet2020-07-06T14:05:06Zanarcatconsider trocla for secrets management in puppetsecrets generated by puppet currently use a custom hkdf function that is homegrown. the ad-hoc standard for this in the puppet community i'm usually working with is [trocla](https://github.com/duritong/trocla) which is [well integrated w...secrets generated by puppet currently use a custom hkdf function that is homegrown. the ad-hoc standard for this in the puppet community i'm usually working with is [trocla](https://github.com/duritong/trocla) which is [well integrated with puppet](https://github.com/duritong/puppet-trocla).
Trocla generates, on the fly, a strong random password for each key you ask it. It also supports various hashing mechanisms (bcrypt, pgsql, x509, etc) so that the Puppet client never actually sees the cleartext. It seems like a better approach than sending the cleartext like we currently do.
So I'd like to start using this for new code and possibly convert existing code to this, if that's acceptable.anarcatanarcathttps://gitlab.torproject.org/legacy/trac/-/issues/34062Gracefully shutdown services in GetTor2020-06-21T18:06:11ZCecylia BocovichGracefully shutdown services in GetTorI get these errors when I shutdown or restart GetTor. Seems like something we can easily implement:
```
2020-04-29T15:24:03+0000 [gettor#debug] SERVICE:: Calling shutdown on sendmail
2020-04-29T15:24:03+0000 [twisted.internet.defer#crit...I get these errors when I shutdown or restart GetTor. Seems like something we can easily implement:
```
2020-04-29T15:24:03+0000 [gettor#debug] SERVICE:: Calling shutdown on sendmail
2020-04-29T15:24:03+0000 [twisted.internet.defer#critical] Unhandled error in Deferred:
2020-04-29T15:24:03+0000 [twisted.internet.defer#critical]
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/twisted/internet/base.py", line 428, in fireEvent
result = callable(*args, **kwargs)
File "/usr/lib/python3/dist-packages/twisted/application/service.py", line 296, in stopServ
ice
l.append(defer.maybeDeferred(service.stopService))
File "/usr/lib/python3/dist-packages/twisted/internet/defer.py", line 151, in maybeDeferred
result = f(*args, **kw)
File "/usr/lib/python3/dist-packages/twisted/application/service.py", line 296, in stopServ
ice
l.append(defer.maybeDeferred(service.stopService))
--- <exception caught here> ---
File "/usr/lib/python3/dist-packages/twisted/internet/defer.py", line 151, in maybeDeferred
result = f(*args, **kw)
File "/srv/gettor.torproject.org/home/gettor/gettor/services/__init__.py", line 60, in stop
Service
self.instance.shutdown()
builtins.AttributeError: 'Sendmail' object has no attribute 'shutdown'
```https://gitlab.torproject.org/legacy/trac/-/issues/34061Reduce amount of GetTor logging2020-06-21T18:06:11ZCecylia BocovichReduce amount of GetTor loggingWe're logging at a very high level (looks like at debug), and outputting frequent successes when we only really need to be logging errors.
For example: a successfully processed email in `log/email_parser.log` outputs:
```
2020-04-27 23:...We're logging at a very high level (looks like at debug), and outputting frequent successes when we only really need to be logging errors.
For example: a successfully processed email in `log/email_parser.log` outputs:
```
2020-04-27 23:18:53+0000 [-] Log opened.
2020-04-27 23:18:53+0000 [process email] New email request received.
2020-04-27 23:18:53+0000 [process email] Reading new email.
2020-04-27 23:18:53+0000 [-] Database query executed successfully.
2020-04-27 23:18:53+0000 [email parser] Building email message from string.
2020-04-27 23:18:53+0000 [email parser] Normalizing and validating FROM email address.
2020-04-27 23:18:53+0000 [email parser] Email address normalized and validated.
2020-04-27 23:18:53+0000 [email parser] Request from [hid]
2020-04-27 23:18:53+0000 [email parser] Found request for links.
2020-04-27 23:18:53+0000 [-] Database query executed successfully.
2020-04-27 23:18:53+0000 [-] Main loop terminated.
2020-04-27 23:18:53+0000 [process email] Email request processed.
```
and in `log/gettor.log`:
```
2020-04-29T14:46:51+0000 [gettor#info] Getting links for windows is.
2020-04-29T14:46:51+0000 [-] Database query executed successfully.
2020-04-29T14:46:51+0000 [gettor#info] Sending links to [hid].
2020-04-29T14:46:51+0000 [gettor#debug] Creating plain text email
2020-04-29T14:46:51+0000 [gettor#debug] Calling asynchronous sendmail.
2020-04-29T14:46:51+0000 [twisted.mail.smtp.ESMTPSenderFactory#info] Starting factory <twisted.mail.smtp.ESMTPSenderFactory object at 0x7f0bba74b780>
2020-04-29T14:46:51+0000 [gettor#info] Email sent successfully.
2020-04-29T14:46:51+0000 [twisted.mail.smtp.ESMTPSenderFactory#info] Stopping factory <twisted.mail.smtp.ESMTPSenderFactory object at 0x7f0bba74b780>
2020-04-29T14:46:51+0000 [-] Database query executed successfully.
2020-04-29T14:46:51+0000 [-] Database query executed successfully.
```
We could reduce this to one log message at most. Especially since this information *should* be captured in the stats database.Cecylia BocovichCecylia Bocovichhttps://gitlab.torproject.org/legacy/trac/-/issues/26175Support Experimental Tor Browser for Github Provider2020-06-21T18:05:41ZirySupport Experimental Tor Browser for Github ProviderCould you please upload [Experimental Tor Browser](https://www.torproject.org/projects/torbrowser.html.en#downloads-alpha) to https://github.com/TheTorProject/gettorbrowser ? Since it is considered as the fastest and most convenient way ...Could you please upload [Experimental Tor Browser](https://www.torproject.org/projects/torbrowser.html.en#downloads-alpha) to https://github.com/TheTorProject/gettorbrowser ? Since it is considered as the fastest and most convenient way to download Tor Browser in censored area, this would be extremely helpful.
I assume the work has been done with an automation script, so if it is possible to open source it, I will try modifying the script myself and then do a pull request on the GitHub.https://gitlab.torproject.org/legacy/trac/-/issues/22011Implement telegram bot for gettor2020-06-21T18:05:33ZArturo FilastòImplement telegram bot for gettorSomebody on twitter suggested we add a telegram bot for gettor: https://twitter.com/DarthJahus/status/855040650831462400.
I see this also being something useful for bridges.tpo.
Originally reported here: https://github.com/TheTorProjec...Somebody on twitter suggested we add a telegram bot for gettor: https://twitter.com/DarthJahus/status/855040650831462400.
I see this also being something useful for bridges.tpo.
Originally reported here: https://github.com/TheTorProject/gettor/issues/18https://gitlab.torproject.org/legacy/trac/-/issues/20659Parse mail subject in the email autoresponder2020-06-21T18:05:30ZIsrael LeivaParse mail subject in the email autoresponderI think it might be useful to parse the mail subject because:
* Usability. dcf1 once told me that people trying the bridgedb email autoresponder first tried sending the request on the subject. It might also be the case for gettor.
...I think it might be useful to parse the mail subject because:
* Usability. dcf1 once told me that people trying the bridgedb email autoresponder first tried sending the request on the subject. It might also be the case for gettor.
* This #20618 (although unlikely to happen again?).
* It's easy to implement.https://gitlab.torproject.org/legacy/trac/-/issues/18750Can you please enable OTR for your XMPP account?2020-06-21T18:05:25ZTracCan you please enable OTR for your XMPP account?Greetings,
I tried to obtain a Tor download link from get_tor(at)riseup.net using OTR but your XMPP account doesn't seem to be set up for OTR.
Would you consider enabling that option? (Or perhaps there's a good reason for not enabling...Greetings,
I tried to obtain a Tor download link from get_tor(at)riseup.net using OTR but your XMPP account doesn't seem to be set up for OTR.
Would you consider enabling that option? (Or perhaps there's a good reason for not enabling it?)
Thanks for creating so many alternative ways for people to get Tor.
Cheers!
**Trac**:
**Username**: geeyourhairsmellsterrifichttps://gitlab.torproject.org/legacy/trac/-/issues/13781Add support for downloading .mar files2020-06-21T18:05:13ZIsrael LeivaAdd support for downloading .mar filesNow it's possible to download .mar (Mozilla updates) files for all three platforms. These new files have different name format and should be treated separately. One option is to add the .mar file every time someone makes a request. Anoth...Now it's possible to download .mar (Mozilla updates) files for all three platforms. These new files have different name format and should be treated separately. One option is to add the .mar file every time someone makes a request. Another option is to specify a certain command to specifically request the .mar file for a given OS.Israel LeivaIsrael Leivahttps://gitlab.torproject.org/legacy/trac/-/issues/9048GetTor doesn't respond to googlemail.com addresses2020-06-21T18:05:06ZMatt PaganGetTor doesn't respond to googlemail.com addressesEach google user with a *[at]gmail.com address automatically receives a *[at]googlemail.com address as well. Emails go to the same mailbox. I have received at least one RT ticket sent from a googlemail.com address where the user was conf...Each google user with a *[at]gmail.com address automatically receives a *[at]googlemail.com address as well. Emails go to the same mailbox. I have received at least one RT ticket sent from a googlemail.com address where the user was confused as to why he didn't receive the requested Tor package.Matt PaganMatt Paganhttps://gitlab.torproject.org/legacy/trac/-/issues/3921Allow windows+de in addition to windows_de2020-06-21T18:04:50ZRoger DingledineAllow windows+de in addition to windows_deI see lines like "windows_en" and "windows_de" in recent gettor commits. Great.
At the same time, we get mail to tor-assistants with lines like "tor-browser-bundle+fa". They're confused, since you're supposed to mail gettor+fa to specif...I see lines like "windows_en" and "windows_de" in recent gettor commits. Great.
At the same time, we get mail to tor-assistants with lines like "tor-browser-bundle+fa". They're confused, since you're supposed to mail gettor+fa to specify your language. But even so, we should accept + as well as _ for the language specifier.https://gitlab.torproject.org/legacy/trac/-/issues/3862gettor should automatically include bridges in its answer2020-06-21T18:04:48ZRoger Dingledinegettor should automatically include bridges in its answerIf somebody gettors from their gmail address, we should go to bridgedb and fetch the bridges they would have gotten, and include them in the text we mail back.
To finish this ticket we'll need to reenable dkim checking on gettor mails (...If somebody gettors from their gmail address, we should go to bridgedb and fetch the bridges they would have gotten, and include them in the text we mail back.
To finish this ticket we'll need to reenable dkim checking on gettor mails (which is part of #3381), but we'll also need to come up with some sort of secure way to ask bridgedb for its answer.
I expect that second step to be messy, so marking this ticket 'minor' priority.https://gitlab.torproject.org/legacy/trac/-/issues/1590Package names that are sent out to the user are currently hard-coded.2020-06-21T18:04:35ZAndrew LewmanPackage names that are sent out to the user are currently hard-coded.Package names that are sent out to the user are currently hard-coded. Return to a more dynamic approach,Package names that are sent out to the user are currently hard-coded. Return to a more dynamic approach,Christian FrommeChristian Frommehttps://gitlab.torproject.org/legacy/trac/-/issues/33136Setting TOR_TRANSPROXY=0 is the same as TOR_TRANSPROXY=12020-06-16T01:28:33ZboklmSetting TOR_TRANSPROXY=0 is the same as TOR_TRANSPROXY=1It looks like the torbutton code that is using the `TOR_TRANSPROXY` environment variable is only checking if the variable exists, without looking at its content. So setting the environment variable to `0` or empty still enables it, which...It looks like the torbutton code that is using the `TOR_TRANSPROXY` environment variable is only checking if the variable exists, without looking at its content. So setting the environment variable to `0` or empty still enables it, which can be confusing.https://gitlab.torproject.org/legacy/trac/-/issues/26341Enable setting torbutton.use_nontor_proxy with an environment variable2020-06-16T01:28:17ZTracEnable setting torbutton.use_nontor_proxy with an environment variableI've been working with some Whonix people to try and get a working i2p browser into Whonix, and for obvious reasons, Tor Browser was the only acceptable basis. My goal was to accomplish this without changing Tor Browser at all, but unfor...I've been working with some Whonix people to try and get a working i2p browser into Whonix, and for obvious reasons, Tor Browser was the only acceptable basis. My goal was to accomplish this without changing Tor Browser at all, but unfortunately that was not to be. In order to use i2p, I need to be able to tell Torbutton to set use_nontor_proxy=true. I have a fork on github where I successfully did this already https://github.com/eyedeekay/torbutton/commit/3879775737a640a78e4cbe99605ac22d7b201a0a which I am using to test it.
**Trac**:
**Username**: eyedeekay