ooni-dev

ooni-dev@lists.torproject.org

306 discussions

OONI status report for May 2014
by Arturo Filastò 02 Jun '14

02 Jun '14

# ooni-probe * Released ooni-probe 1.0.2. For a detailed changelog see: https://lists.torproject.org/pipermail/ooni-dev/2014-May/000114.html * ooniprobe 1.0.2 is now part of debian testing and is also present inside of wheezy-backports. https://packages.debian.org/testing/main/ooniprobe https://packages.debian.org/source/wheezy-backports/ooniprobe * Record the IP address of the exit node being when performing HTTP requests over Tor. https://github.com/TheTorProject/ooni-probe/pull/299 * Add support for adding annotations to reports: https://github.com/TheTorProject/ooni-probe/commit/49f78b1294dc31555187351f… https://github.com/TheTorProject/ooni-probe/commit/5a283100c38a56221683f2dc… * Various PEP8 and PyFlakes related code quality improvements: https://github.com/TheTorProject/ooni-probe/commit/458a992bb31d66735dc97818… https://github.com/TheTorProject/ooni-probe/commit/170bad3df93f2d30e1c96a48… # ooni-backend * Use a secure RNG instead of python's RNG for generating the report IDs: https://github.com/TheTorProject/ooni-backend/commit/7dfd89b22c66eb4cfc3821… * Fix some misc bugs: https://github.com/TheTorProject/ooni-backend/commit/5765bd000ee5b9f729cf43… # ooni-reader This is a new tool useful for converting ooni reports from one format to another and identifying reports and report entries that should be looked at. The current version supports writing CSV files and has definitions for the following tests: * captiveportal * http_requesty * dns_consistency * http_header_field_manipulation * http_invalid_request_line * tcp_connect This means that it is possible to identify possible symptoms of internet censorship in the above tests. The project can be found here: https://github.com/TheTorProject/ooni-reader ~ Art.

1 0

ooniprobe 1.0.2 released
by Arturo Filastò 11 May '14

11 May '14

We are pleased to announce that ooniprobe 1.0.2 has been released. It includes a series of bugfixes and improvements including: * Add ooniprobe manpage. * Fix various security issues raised by the least authority audit. * Add a test that checks for Tor bridge reachability. * Record the IP address of the exit node being used in torified requests. * Captive portal test now uses the ooni-probe test templates. * Have better test naming consistency. You may download it from pypi here: https://pypi.python.org/pypi/ooniprobe/1.0.2 Soon the debian package for it will also be updated. Have fun, ~ Art.

1 0

OONI team report April 2014
by Arturo Filastò 05 May '14

05 May '14

# OONI team report April 2014 ## Least Authority security audit This month we mainly focused on addressing the issues raised during the Least Authority audit of the application. In particular the following issues were found and a resolution for them has been provided. No critical vulnerability has been found inside of the probe software. Users are nonetheless highly encouraged to update to the latest version of ooni-probe as soon as a release is out. * Issue A. CSRF Token Not Compared in Constant Time https://github.com/TheTorProject/ooni-probe/issues/317 * Issue B. Arbitrary File Write in Input File Uploader https://github.com/TheTorProject/ooni-probe/issues/318 * Issue C. User Input Written to Logs: https://github.com/TheTorProject/ooni-probe/issues/302 * Issue D. Tor Build Script Downloads zlib Over HTTP: https://github.com/TheTorProject/ooni-probe/issues/303 * Issue E. Denial of Service by Uploading Lots of Header Lines: https://github.com/TheTorProject/ooni-probe/issues/304 * Issue G. Cross-Site Scripting in HTTPRandomPage: https://github.com/TheTorProject/ooni-probe/issues/305 * Issue F. `oonid` Lacks Authentication Checks https://github.com/TheTorProject/ooni-probe/issues/319 ## Improvements to ooni-probe * Added support for recording the Tor Exit IP used when performing the http_requests test: https://github.com/TheTorProject/ooni-probe/issues/81 https://github.com/TheTorProject/ooni-probe/pull/299 * We now have a manpage for the ooniprobe cli tool. https://github.com/TheTorProject/ooni-probe/pull/315 * Fixed an issue that lead to unittests writing outside the build directory leading to the debian package build bot complaining: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=743108 https://github.com/TheTorProject/ooni-probe/pull/314 * The bridge_reachability test now supports fteproxy and includes the Tor version in the report: https://github.com/TheTorProject/ooni-probe/pull/297 ~ Art.

1 0

Tinkering with M-Lab servers.
by Nathan Wilcox 30 Apr '14

30 Apr '14

Hey Oonitarians, We wanted to start checking out the deployment process in earnest for Ooni. We already should have ssh access to the test slices, such as mlab1.nuq0t.measurement-lab.org. Does anyone mind if we log in and tinker with that slice over the next couple of weeks? We're planning on running through the process (probably by using ooni-support [1] ) in a few hours unless someone raises an alarm. Speaking of which, does either M-Lab or Ooni have any kind of operations ticketing system where we should track this kind of stuff, or shall we just stick to email for now? -- Nathan Wilcox Least Authoritarian

3 3

OONI Debian packages
by jony-port＠bitmessage.ch 02 Apr '14

02 Apr '14

Hi, Which spec is being used to create Debian packages for OONI?

2 1

Some good tickets to start hacking on OONI
by Arturo Filastò 02 Apr '14

02 Apr '14

Here is a list of some tickets that can give you a good starting point for hacking on OONI. Some are easier than others to solve. # Easy tickets ooni test decks specifying logfile path but it is not used: https://github.com/TheTorProject/ooni-probe/issues/123 Verify the version of config files: https://github.com/TheTorProject/ooni-probe/issues/190 ooni crashes if no collector option is used with several decks: https://github.com/TheTorProject/ooni-probe/issues/274 # Harder tickets Add support for storing the order in which HTTP headers are received: https://github.com/TheTorProject/ooni-probe/issues/254 Add support for having multiple test classes inside of a nettest file: https://github.com/TheTorProject/ooni-probe/issues/289 Recursion limit problem in TaskManager: https://github.com/TheTorProject/ooni-probe/issues/296 Detect when a probe is using the wrong test helpers: https://github.com/TheTorProject/ooni-probe/issues/158 If you have any questions on these tickets you should either comment on the issue tracker or reply to this email thread. Happy hacking! ~ Art.

1 0

OONI team report for March 2014
by Arturo Filastò 01 Apr '14

01 Apr '14

Here is a summary of the activities carried out by the OONI team in the month of March. ## Released ooniprobe 1.0.1. This is the changelog for the release [1] * Fix bugs in the traceroute test that lead to not all packets being collected. * All values inside of http_requests test are now initialized inside of setUp. * Fix a bug that lead to the input value of the report not being set in some circumstances. ## Bridge reachability Worked on getting a bridge reachability test integrated into master. [2] We now have a test that verifies which tor bridges are working supporting obfs2,obfs3,scramblesuit and ft. This test is now running from 3 different network vantage points in Russia, China and the US. The reports are currently stored inside a private oonib collector until we decide what shall be done with the reports. ## Refactoring of captiveportal test arunpandianp did an awesome job at refactoring the captiveportal test to use our own DNS and HTTP test templates. [3] This has as an effect the fact that we no longer need the dnspython dependency! The other major win is that now the reports for the captiveportal test include (as well as the test specific report data that is backward compatible) also data that is specific to the test templates being used (the DNS queries and answers, the HTTP requests and responses). ## OONI probe package in debian Thanks to Lunars great work we now have a debian package for ooniprobe 1.0.1 [4] ## Planetlab deployment script We now have an automatic deployment script for ooniprobe on mlab. [5] This turned out to be a less trivial than initially expected task given the fact that most planetlab slices run Fedora 8 (yeah the one that is end of life since 2009 :P). This means that a **lot** of things need to be compiled so that we can have a recent version of Tor (for scramblesuit and ft) and a recent version of python (for running ooniprobe). This also lead us to write a couple of tiny patches for pyopenssl [6] and cryptography [7] to support such old distro. ## OONIB admin tool We added a tool for administering oonibackend instances. This allows the administrator to add inputs and decks to the policy without having to manually compute the hashes and edit the policy and collector files [8]. ## Misc bugfixes in oonib and ooniprobe We also fixes a bunch of miscellaneous bugs in ooniprobe [9][10] and oonib [11][12]. ## Least authority audit The audit of oonib and ooniprobe has started in ooniprobe. Their team has been doing a great job also at spotting some bugs [13] and submitting some pull requests with fixes[14][15][16][17][18]. ## Interesting reports collected We can see the escalation of DNS censorship in Turkey in the following reports: https://213.138.109.232/TR/http_requests_test-2014-03-29T000037Z-AS9121-pro… https://213.138.109.232/TR/http_requests_test-2014-03-31T000048Z-AS9121-pro… https://213.138.109.232/TR/http_requests_test-2014-04-01T000033Z-AS9121-pro… https://213.138.109.232/TR/dns_consistency-2014-03-29T000037Z-AS9121-probe.… https://213.138.109.232/TR/dns_consistency-2014-03-30T000023Z-AS9121-probe.… https://213.138.109.232/TR/dns_consistency-2014-03-31T000038Z-AS9121-probe.… https://213.138.109.232/TR/dns_consistency-2014-04-01T000034Z-AS9121-probe.… # What we plan to work on next? * We will be improving the bridge_reachability test and deploy it in more countries. * Work on some charting and graphing for some ooniprobe tests * Evaluate the GSoC submissions. This is all for the moment. Have fun! ~ Art. [1] https://github.com/TheTorProject/ooni-probe/commit/743cf208ebcb1bda3b8eebc8… [2] https://github.com/TheTorProject/ooni-probe/pull/72 [3] https://github.com/TheTorProject/ooni-probe/pull/287 [4] https://packages.debian.org/unstable/main/ooniprobe [5] https://github.com/TheTorProject/ooni-probe/blob/master/scripts/install_on_… [6] https://github.com/pyca/pyopenssl/pull/59 [7] https://github.com/pyca/cryptography/pull/767 [8] https://github.com/TheTorProject/ooni-backend/commit/25fd345bedcabdc6158451… [9] https://github.com/TheTorProject/ooni-probe/commit/8bceb1b2632bb1a3a62d1dfa… [10] https://github.com/TheTorProject/ooni-probe/commit/d982fedd0c28c75d545b9265… [11] https://github.com/TheTorProject/ooni-backend/commit/dc9e53cd63866f894b73ed… [12] https://github.com/TheTorProject/ooni-backend/commit/aebeb92b87bd7b4f19f8b1… [13] https://github.com/TheTorProject/ooni-backend/issues/37 [14] https://github.com/TheTorProject/ooni-backend/pull/36 [15] https://github.com/TheTorProject/ooni-backend/pull/38 [16] https://github.com/TheTorProject/ooni-backend/pull/39 [17] https://github.com/TheTorProject/ooni-backend/pull/40 [18] https://github.com/TheTorProject/ooni-backend/pull/41

1 0

Ooni Audit Kickoff Meeting
by jony-port＠bitmessage.ch 17 Mar '14

17 Mar '14

Hello list, I 'm not using Google services so I wasn't able to attend this meeting. Could someone please summarize the discussion of the Meeting?

1 0

Ooni Audit Kickoff Meeting
by Nathan Wilcox 10 Mar '14

10 Mar '14

Let's have a realtime meeting to discuss how Least Authority should focus our remaining time for our security audit work. Before we have this meeting we need to find a time that works for everyone, to make sure we have the right invite list, and to gather agenda item requests. I propose we meet a week from today on 2013-03-10 at 17:00 UTC+0 for 45 minutes. Please let me know if this time works for you. If you know someone who should attend the meeting, please forward this and cc me. If you receive this by dint of being on one of the cc'd lists, please let me know if you want your address explicitly included in future email. The agenda I envision looks something like: 1. Introduce people to each other (there are some new faces) - 5 min. 2. Nathan describes Least Authority's schedule - 5 min. 3. Nathan summarizes Least Authority's previous work with Ooni and links to it - 5 min. 4. We go around the virtual table mentioning any focuses or concerns we want to bring up for the audit - 20 min. 5. Nathan summarizes any followup tasks with specific owners that came out of the meeting - 5 min. Feel free to propose changes to this agenda, or to bring up specific items for step 4 if you want to ensure they have adequate time. -- Nathan Wilcox Least Authoritarian

1 1

Re: [ooni-dev] Campus Network Cencorship & OONI
by Arturo Filastò 17 Feb '14

17 Feb '14

Moving the thread to ooni-dev so that we can continue the discussion there. On 2/17/14, 2:43 AM, Abel Corver wrote: > Hi Art, > > Thanks! > > Yeah, let's move this to the ooni-dev mailing list! (I've subscribed to > both lists) > > Shall we discuss the what exact ticket to open there, or do you want to > file one now? I openned a ticket about this on the github issue tracker: https://github.com/TheTorProject/ooni-probe/issues/283 Let me know if you think that covers your use case and if you think there should be something added to it. ~ Art. > > On Sun, Feb 16, 2014 at 4:06 PM, Arturo Filastò <arturo(a)filasto.net > <mailto:arturo@filasto.net>> wrote: > > On 2/16/14, 12:13 AM, Abel Corver wrote: > > Hi, > > > > I'm a student in the US interested in finding out if my university is > > censoring certain pages. > > > > (1) Are there any UI tools to visualize OONI reports? > > There is currently one graphical tool for aiding in visualizing > ooniprobe reports called ooniprobix: > https://github.com/AccessNow/ooniprobix. > > This can be useful for parsing and analyzing the reports, but not > visualizing the report data. > > > (2) Do you know of existing initiatives to monitor censorship _within_ > > networks, as opposed to by country? If so, are any of them > specifically > > targeting possible campus surveillance? > > > > That is also what we are interested in measuring. That is why for > example we include by default the AS number of the network that is being > tested in the report. This allows us to know not only in which country > censorship is happening, but also which ISP is performing censorship. > > The problem, however, is that there is currently no way to say that the > censorship you are witnessing is caused by the ISP, but a local network > policy (a campus performing censorship or an office). > > I think this is a worthwhile thing to have and I think we should open a > ticket on our issue tracker to discuss how we could tackle implementing > it: https://github.com/TheTorProject/ooni-probe/issues. > > > Let me know if there're better places to ask this question. I wasn't > > able to find an OONI mailing list. > > We do have a mailing list! > > You should subscribe to ooni-dev and ooni-talk: > https://lists.torproject.org/pipermail/ooni-dev, > https://lists.torproject.org/pipermail/ooni-talk/ > > Do you mind if we move this discussion to the ooni-dev mailing list? > > ~ Art. > >

1 0

← Newer
1
...
23
24
25
26
27
28
29
30
31
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

ooni-dev