Commit e6c9aaef authored by anonym's avatar anonym
Browse files

Merge remote-tracking branch 'origin/feature/stretch' into feature/12464-tor-browser-7.0

parents 9066f2fb 53c8a7ed
......@@ -8,6 +8,7 @@ set -e
systemctl enable memlockd.service
# Enable our own systemd unit files
systemctl enable onion-grater.service
systemctl enable tails-autotest-remote-shell.service
systemctl enable tails-reconfigure-kexec.service
systemctl enable tails-reconfigure-memlockd.service
......@@ -16,7 +17,6 @@ systemctl enable tails-set-wireless-devices-state.service
systemctl enable tails-tor-has-bootstrapped.target
systemctl enable tails-wait-until-tor-has-bootstrapped.service
systemctl enable tails-tor-has-bootstrapped-flag-file.service
systemctl enable tor-controlport-filter.service
systemctl enable var-tmp.mount
# Enable our own systemd user unit files
......
{
"auto_connect": true,
"coin_chooser": "Privacy",
"proxy": "socks5:localhost:9050",
"server": ""
}
......@@ -4,7 +4,7 @@ Documentation=https://tails.boum.org/contribute/design/
[Service]
Type=simple
ExecStart=/usr/local/lib/tor-controlport-filter
ExecStart=/usr/local/lib/onion-grater
CapabilityBoundingSet=CAP_DAC_OVERRIDE CAP_SYS_PTRACE
PrivateDevices=yes
PrivateTmp=yes
......
#!/usr/bin/python3
#!/usr/bin/python3 -u
# This filter proxy allows fine-grained access whitelists of commands
# (and their argunents) and events on a per-application basis, stored
# in:
#
# /etc/tor-controlport-filter.d/
# /etc/onion-grater.d/
#
# that are pretty self-explanatory as long as you understand the Tor
# ControlPort language. The format is expressed in YAML where the
......@@ -122,14 +122,17 @@
# clients.
import argparse
import fcntl
import glob
import ipaddress
import os.path
import psutil
import re
import socket
import socketserver
import stem
import stem.control
import struct
import sys
import textwrap
import yaml
......@@ -179,6 +182,15 @@ def exe_path_of_pid(pid):
return psutil.Process(pid).exe()
def get_ip_address(ifname):
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
return socket.inet_ntoa(fcntl.ioctl(
s.fileno(),
0x8915, # SIOCGIFADDR
struct.pack('256s', bytes(ifname[:15], 'utf-8'))
)[20:24])
class FilteredControlPortProxySession:
"""
Class used to deal with a single session, delegated from the handler
......@@ -466,10 +478,10 @@ class FilteredControlPortProxyHandler(socketserver.StreamRequestHandler):
self.restrict_stream_events = False
self.server_address = self.server.server_address
self.subscribed_event_listeners = []
for filter_file in glob.glob('/etc/tor-controlport-filter.d/*.yml'):
for filter_file in glob.glob('/etc/onion-grater.d/*.yml'):
try:
with open(filter_file, "rb") as fh:
filters = yaml.load(fh.read())
filters = yaml.safe_load(fh.read())
name = re.sub(r'\.yml$', '', os.path.basename(filter_file))
for filter_ in filters:
if name not in filter_:
......@@ -661,6 +673,12 @@ def main():
help="specifies the port on which the server listens " +
"(default: {})".format(DEFAULT_LISTEN_PORT)
)
parser.add_argument(
"--listen-interface",
type=str, metavar='INTERFACE',
help="specifies the interface on which the server listens " +
"(default: NULL)"
)
parser.add_argument(
"--control-cookie-path",
type=str, metavar='PATH', default=DEFAULT_COOKIE_PATH,
......@@ -694,7 +712,14 @@ def main():
global_args.__dict__['print_requests'] = global_args.complain or \
global_args.debug
global_args.__dict__['print_responses'] = global_args.debug
address = (global_args.listen_address, global_args.listen_port)
if global_args.listen_interface:
ip_address = get_ip_address(global_args.listen_interface)
if global_args.debug:
log("IP address for interface {} : {}".format(
global_args.listen_interface,ip_address))
else:
ip_address = global_args.listen_address
address = (ip_address, global_args.listen_port)
server = FilteredControlPortProxy(address, FilteredControlPortProxyHandler)
log("Tor control port filter started, listening on {}:{}".format(*address))
try:
......
......@@ -409,6 +409,6 @@ python-trezor
# Provide gnome-open (used to open e.g. URLs in KeePassX, Icedove, Electrum...)
libgnome2-bin
# tor-controlport-filter
# onion-grater
python3-psutil
python3-yaml
......@@ -246,3 +246,18 @@ Given /^(GnuPG|Seahorse) is configured to use Chutney's onion keyserver$/ do |ap
)
end
end
Then /^GnuPG's dirmngr uses the configured keyserver$/ do
_, _, onion_keyserver_address, _ = chutney_onionservice_info
dirmngr_request = $vm.execute_successfully(
'gpg-connect-agent --dirmngr "keyserver --hosttable" /bye', user: LIVE_USER
)
server = dirmngr_request.stdout.chomp.lines[1].split[4]
server = /keyserver\s+(\S+)$/.match(
$vm.file_content("/home/#{LIVE_USER}/.gnupg/dirmngr.conf")
)[1]
assert_equal(
"hkp://#{onion_keyserver_address}:5858", server,
"GnuPG's dirmngr does not use the correct keyserver"
)
end
......@@ -15,6 +15,7 @@ Feature: Keyserver interaction with GnuPG
When I fetch the "10CC5BC7" OpenPGP key using the GnuPG CLI
And the GnuPG fetch is successful
Then the "10CC5BC7" key is in the live user's public keyring
And GnuPG's dirmngr uses the configured keyserver
Scenario: Fetching OpenPGP keys using Seahorse should work and be done over Tor.
When I fetch the "10CC5BC7" OpenPGP key using Seahorse
......
......@@ -236,7 +236,7 @@ po_slave_languages:
#
# When updating this list, refer to the checklist in
# https://tails.boum.org/contribute/how/website/po_translatable_pages/
po_translatable_pages: '!security/audits and !security/audits/* and !news/report_2* and !news/version_0* and !news/test_0* and !news/test_*-rc? and !security/Numerous_security_holes_in_0* and (about or about/* or bugs or chat or contribute or contribute/how/donate or doc or doc/* or donate or donate/* or download or download.inline or getting_started or home or inc/stable_i386_release_notes or index or news or news/* or press or security or security/* or sidebar or support or support/* or todo or torrents or wishlist or misc or misc/* or install or install/* or upgrade or upgrade/*)'
po_translatable_pages: '!security/audits and !security/audits/* and !news/report_2* and !news/version_0* and !news/version_1* and !news/test_0* and !news/test_1* and !news/test_*-rc? and !security/Numerous_security_holes_in_0* and !security/Numerous_security_holes_in_1* and (about or about/* or bugs or chat or contribute or contribute/how/donate or doc or doc/* or donate or donate/* or download or download.inline or getting_started or home or inc/stable_i386_release_notes or index or news or news/* or press or security or security/* or sidebar or support or support/* or todo or torrents or wishlist or misc or misc/* or install or install/* or upgrade or upgrade/*)'
# internal linking behavior (default/current/negotiated)
po_link_to: current
......
......@@ -213,7 +213,7 @@ po_slave_languages:
#
# When updating this list, refer to the checklist in
# https://tails.boum.org/contribute/how/website/po_translatable_pages/
po_translatable_pages: '!security/audits and !security/audits/* and !news/report_2* and !news/version_0* and !news/test_0* and !news/test_*-rc? and !security/Numerous_security_holes_in_0* and (about or about/* or bugs or chat or contribute or contribute/how/donate or doc or doc/* or donate or donate/* or download or download.inline or getting_started or home or inc/stable_i386_release_notes or index or news or news/* or press or security or security/* or sidebar or support or support/* or todo or torrents or wishlist or misc or misc/* or install or install/* or upgrade or upgrade/*)'
po_translatable_pages: '!security/audits and !security/audits/* and !news/report_2* and !news/version_0* and !news/version_1* and !news/test_0* and !news/test_1* and !news/test_*-rc? and !security/Numerous_security_holes_in_0* and !security/Numerous_security_holes_in_1* and (about or about/* or bugs or chat or contribute or contribute/how/donate or doc or doc/* or donate or donate/* or download or download.inline or getting_started or home or inc/stable_i386_release_notes or index or news or news/* or press or security or security/* or sidebar or support or support/* or todo or torrents or wishlist or misc or misc/* or install or install/* or upgrade or upgrade/*)'
# internal linking behavior (default/current/negotiated)
po_link_to: current
......
......@@ -860,9 +860,9 @@ providers recommend and even enforce StartTLS on these ports, the effect
of these warnings were most of the time counterproductive as people had
to click through needlessly scary security warnings.
- [[!tails_gitweb_dir config/chroot_local-includes/etc/tor-controlport-filter.d/]]
- [[!tails_gitweb config/chroot_local-includes/lib/systemd/system/tor-controlport-filter.service]]
- [[!tails_gitweb config/chroot_local-includes/usr/local/lib/tor-controlport-filter]]
- [[!tails_gitweb_dir config/chroot_local-includes/etc/onion-grater.d/]]
- [[!tails_gitweb config/chroot_local-includes/lib/systemd/system/onion-grater.service]]
- [[!tails_gitweb config/chroot_local-includes/usr/local/lib/onion-grater]]
- [[!tails_gitweb config/chroot_local-includes/etc/tor/torrc]]
[[!tails_gitweb_repo onioncircuits desc="Onion Circuits"]] allows the
......
......@@ -70,12 +70,7 @@ The Tails persistent volume is a LUKS-encrypted GPT partition, labeled
Specifications
==============
Once a persistent volume is enabled, two operation modes are
supported:
* read-write access: changes to persistent files are saved
* read-only access to **only** be able to *use* persistent files
(e.g. a GnuPG keyring) without leaving any new trace.
Once a persistent volume is enabled, changes to persistent files are saved.
Moreover:
......@@ -121,11 +116,6 @@ That's why we have decided to:
directory (e.g. `$HOME`) to regular files stored in
a persistent location (e.g. `.gitconfig`, `.vimrc`, etc.)
The read-only mode was implemented by merging the persistent
volume with a "diff" branch on ramdisk using aufs, and mount the
resultant device, so that the mountpoint is seen as writable by
applications but no actual change is made on disk.
The code we ship lives in the `tmp-persistent-custom` branch in
our [[live-boot Git repository|contribute/git]]. We build packages
from the `master` branch in there, and drop them into the Tails main
......@@ -269,8 +259,7 @@ we've written a graphical [[!tails_todo boot_menu]]:
#### Design
* asks whether to enable persistence at all; if yes, read-only or
read-write
* asks whether to enable persistence at all;
* ask list of possibly valid persistent containers to `live-persist`
* initial implementation (MVC -speak): the model (`live-persist` and
tails-greeter code that runs it) supports enabling multiple
......@@ -290,8 +279,6 @@ backend / tails-greeter interface
### Long story short
0. The user chooses to toggle persistence on in `tails-greeter`.
0. Still in `tails-greeter`, the user chooses if s/he wants read-only
or read-write persistence.
0. `tails-greeter` asks `live-boot` the list of possibly valid
persistent containers.
0. For each such volume, `tails-greeter` asks the user to enter the
......
......@@ -1161,6 +1161,14 @@ this, and skip what does not make sense for a RC.
-not -name '*~test_*~test.iuk' -delete \
\"
1. Check how much space our mirrors will need:
ssh rsync.lizard du -sh /srv/rsync/tails
Compare it to the minimum disk space we ask of our mirror operators
(30 GiB) and determine if any further action is needed to either
reduce our usage by deleting stuff, or asking them to give us more
space.
1. Delete Git branches that were merged:
bare_repo=$(mktemp -d)
......
......@@ -68,7 +68,7 @@ released:
1. Include all sources in the `.changes` file:
CHANGES_FILE="../icedove_${VERSION}~deb8u1+tails1_i386.changes" && \
CHANGES_FILE="../icedove_${VERSION}~deb8u1+tails1_amd64.changes" && \
changestool "${CHANGES_FILE}" includeallsources
1. Due to [[!tails_ticket 11531]] we won't be able to push the tag
......
......@@ -33,8 +33,8 @@ Compare the list of bundled packages and versions with the one shipped last
time. `.packages` are usually attached to the email announcing the ISO is ready.
/usr/bin/diff -u \
wiki/src/torrents/files/tails-i386-1.3.1.packages \
tails-i386-1.3.2.packages \
wiki/src/torrents/files/tails-amd64-3.1.packages \
tails-amd64-3.2.packages \
| wdiff --diff-input --terminal
Check the output for:
......@@ -203,9 +203,9 @@ tracked by tickets prefixed with `todo/test_suite:`.
* A web server on the LAN.
* A copy of `wiki/src/upgrade` from the `stable` or `testing` branch,
for example in `/var/www/tails/upgrade/v1/Tails/0.14~rc2/i386/stable/updates.yml`
for example in `/var/www/tails/upgrade/v1/Tails/3.14~rc2/amd64/stable/updates.yml`
* A copy of the `iuk` directory of our HTTP mirrors,
for example in `/var/www/tails/stable/iuk/Tails_i386_0.14-rc2_to_0.14.iuk`.
for example in `/var/www/tails/stable/iuk/Tails_amd64_3.14-rc2_to_3.14.iuk`.
To synchronize your local copy:
......
......@@ -6,7 +6,7 @@
msgid ""
msgstr ""
"Project-Id-Version: \n"
"POT-Creation-Date: 2016-04-26 17:54+0200\n"
"POT-Creation-Date: 2017-03-18 18:05+0100\n"
"PO-Revision-Date: 2016-04-19 13:22+0200\n"
"Last-Translator: Tails translators <tails@boum.org>\n"
"Language-Team: \n"
......@@ -62,15 +62,15 @@ msgstr ""
#. type: Plain text
msgid ""
"This is how Tails looks like when run in a virtual machine on Debian using "
"*VirtualBox*:"
"*GNOME Boxes*:"
msgstr ""
"So sieht Tails aus, wenn es in einer virtuellen Maschine unter Debian unter "
"der Nutzung von *VirtualBox* ausgeführt wird:"
"der Nutzung von *GNOME Boxes* ausgeführt wird:"
#. type: Plain text
#, no-wrap
msgid "[[!img tails-in-jessie.png alt=\"\" link=no]]\n"
msgstr "[[!img tails-in-jessie.png alt=\"\" link=no]]\n"
msgid "[[!img tails-in-vm.png alt=\"\" link=no]]\n"
msgstr "[[!img tails-in-vm.png alt=\"\" link=no]]\n"
#. type: Plain text
#, no-wrap
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment