Initial commit: Simple Tor probe.

.gitignore

+/.gradle

LICENSE.txt

+Copyright 2018 Sublime Software Ltd
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

README.md

+A simple Tor connectivity tester.
+
+Connects to a given IP address and port, does a TLS handshake with Tor's
+supported cipher suites, and exchanges versions cells.
+
+Addresses and ports of Tor directory authorities can be found here:
+
+https://github.com/OpenObservatory/ooni-resources/blob/master/bridge_reachability/tor-bridges-ip-port.csv
+
+References:
+
+https://trac.torproject.org/projects/tor/wiki/org/projects/Tor/TLSHistory
+
+https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt

build.gradle

+allprojects {
+	repositories {
+		jcenter()
+	}
+}
+
+buildscript {
+	repositories {
+		jcenter()
+	}
+	dependencies {
+		classpath 'com.github.jengelman.gradle.plugins:shadow:4.0.1'
+	}
+}

gradle/wrapper/gradle-wrapper.properties

+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-4.10.2-all.zip
+distributionSha256Sum=b7aedd369a26b177147bcb715f8b1fc4fe32b0a6ade0d7fd8ee5ed0c6f731f2c

gradlew

+#!/usr/bin/env sh
+
+##############################################################################
+##
+##  Gradle start up script for UN*X
+##
+##############################################################################
+
+# Attempt to set APP_HOME
+# Resolve links: $0 may be a link
+PRG="$0"
+# Need this for relative symlinks.
+while [ -h "$PRG" ] ; do
+    ls=`ls -ld "$PRG"`
+    link=`expr "$ls" : '.*-> \(.*\)$'`
+    if expr "$link" : '/.*' > /dev/null; then
+        PRG="$link"
+    else
+        PRG=`dirname "$PRG"`"/$link"
+    fi
+done
+SAVED="`pwd`"
+cd "`dirname \"$PRG\"`/" >/dev/null
+APP_HOME="`pwd -P`"
+cd "$SAVED" >/dev/null
+
+APP_NAME="Gradle"
+APP_BASE_NAME=`basename "$0"`
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS=""
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD="maximum"
+
+warn ( ) {
+    echo "$*"
+}
+
+die ( ) {
+    echo
+    echo "$*"
+    echo
+    exit 1
+}
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "`uname`" in
+  CYGWIN* )
+    cygwin=true
+    ;;
+  Darwin* )
+    darwin=true
+    ;;
+  MINGW* )
+    msys=true
+    ;;
+  NONSTOP* )
+    nonstop=true
+    ;;
+esac
+
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD="$JAVA_HOME/jre/sh/java"
+    else
+        JAVACMD="$JAVA_HOME/bin/java"
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD="java"
+    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+fi
+
+# Increase the maximum file descriptors if we can.
+if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then
+    MAX_FD_LIMIT=`ulimit -H -n`
+    if [ $? -eq 0 ] ; then
+        if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
+            MAX_FD="$MAX_FD_LIMIT"
+        fi
+        ulimit -n $MAX_FD
+        if [ $? -ne 0 ] ; then
+            warn "Could not set maximum file descriptor limit: $MAX_FD"
+        fi
+    else
+        warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
+    fi
+fi
+
+# For Darwin, add options to specify how the application appears in the dock
+if $darwin; then
+    GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
+fi
+
+# For Cygwin, switch paths to Windows format before running java
+if $cygwin ; then
+    APP_HOME=`cygpath --path --mixed "$APP_HOME"`
+    CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
+    JAVACMD=`cygpath --unix "$JAVACMD"`
+
+    # We build the pattern for arguments to be converted via cygpath
+    ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
+    SEP=""
+    for dir in $ROOTDIRSRAW ; do
+        ROOTDIRS="$ROOTDIRS$SEP$dir"
+        SEP="|"
+    done
+    OURCYGPATTERN="(^($ROOTDIRS))"
+    # Add a user-defined pattern to the cygpath arguments
+    if [ "$GRADLE_CYGPATTERN" != "" ] ; then
+        OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
+    fi
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    i=0
+    for arg in "$@" ; do
+        CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
+        CHECK2=`echo "$arg"|egrep -c "^-"`                                 ### Determine if an option
+
+        if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then                    ### Added a condition
+            eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
+        else
+            eval `echo args$i`="\"$arg\""
+        fi
+        i=$((i+1))
+    done
+    case $i in
+        (0) set -- ;;
+        (1) set -- "$args0" ;;
+        (2) set -- "$args0" "$args1" ;;
+        (3) set -- "$args0" "$args1" "$args2" ;;
+        (4) set -- "$args0" "$args1" "$args2" "$args3" ;;
+        (5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
+        (6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
+        (7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
+        (8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
+        (9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
+    esac
+fi
+
+# Escape application args
+save ( ) {
+    for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done
+    echo " "
+}
+APP_ARGS=$(save "$@")
+
+# Collect all arguments for the java command, following the shell quoting and substitution rules
+eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS"
+
+# by default we should be in the correct project dir, but when run from Finder on Mac, the cwd is wrong
+if [ "$(uname)" = "Darwin" ] && [ "$HOME" = "$PWD" ]; then
+  cd "$(dirname "$0")"
+fi
+
+exec "$JAVACMD" "$@"

gradlew.bat

+@if "%DEBUG%" == "" @echo off
+@rem ##########################################################################
+@rem
+@rem  Gradle startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables with windows NT shell
+if "%OS%"=="Windows_NT" setlocal
+
+set DIRNAME=%~dp0
+if "%DIRNAME%" == "" set DIRNAME=.
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS=
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if "%ERRORLEVEL%" == "0" goto init
+
+echo.
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto init
+
+echo.
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
+echo.
+echo Please set the JAVA_HOME variable in your environment to match the
+echo location of your Java installation.
+
+goto fail
+
+:init
+@rem Get command-line arguments, handling Windows variants
+
+if not "%OS%" == "Windows_NT" goto win9xME_args
+
+:win9xME_args
+@rem Slurp the command line arguments.
+set CMD_LINE_ARGS=
+set _SKIP=2
+
+:win9xME_args_slurp
+if "x%~1" == "x" goto execute
+
+set CMD_LINE_ARGS=%*
+
+:execute
+@rem Setup the command line
+
+set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
+
+@rem Execute Gradle
+"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS%
+
+:end
+@rem End local scope for the variables with windows NT shell
+if "%ERRORLEVEL%"=="0" goto mainEnd
+
+:fail
+rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
+rem the _cmd.exe /c_ return code!
+if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
+exit /b 1
+
+:mainEnd
+if "%OS%"=="Windows_NT" endlocal
+
+:omega

settings.gradle

+include ':tor-probe-core'

tor-probe-core/build.gradle

+apply plugin: 'java-library'
+sourceCompatibility = 1.8
+targetCompatibility = 1.8
+
+apply plugin: 'idea'
+apply plugin: 'com.github.johnrengelman.shadow'
+
+version = '0.0.1'
+
+jar {
+	manifest {
+		attributes('Main-Class': 'org.briarproject.torprobe.TorProbe')
+	}
+}
+
+dependencies {
+	api 'com.madgag.spongycastle:core:1.58.0.0'
+}

tor-probe-core/src/main/java/org/briarproject/torprobe/TorProbe.java

+package org.briarproject.torprobe;
+
+import org.spongycastle.crypto.tls.Certificate;
+import org.spongycastle.crypto.tls.CipherSuite;
+import org.spongycastle.crypto.tls.DefaultTlsClient;
+import org.spongycastle.crypto.tls.ServerOnlyTlsAuthentication;
+import org.spongycastle.crypto.tls.TlsAuthentication;
+import org.spongycastle.crypto.tls.TlsClientProtocol;
+
+import java.io.DataInputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.net.Socket;
+import java.security.SecureRandom;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.logging.Logger;
+
+import static java.util.logging.Level.INFO;
+
+public class TorProbe {
+
+	private static final Logger LOG =
+			Logger.getLogger(TorProbe.class.getName());
+
+	private static final int READ_TIMEOUT = 10 * 1000;
+
+	// https://trac.torproject.org/projects/tor/wiki/org/projects/Tor/TLSHistory
+	private static final int SSL3_RSA_FIPS_WITH_3DES_EDE_CBC_SHA = 0xfeff;
+
+	// https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt#n347
+	private static final int[] TOR_CIPHER_SUITES = new int[] {
+			CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
+			CipherSuite.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
+			CipherSuite.TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
+			CipherSuite.TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
+			CipherSuite.TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
+			CipherSuite.TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
+			CipherSuite.TLS_RSA_WITH_AES_256_CBC_SHA,
+			CipherSuite.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
+			CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
+			CipherSuite.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
+			CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
+			CipherSuite.TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
+			CipherSuite.TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
+			CipherSuite.TLS_ECDH_RSA_WITH_RC4_128_SHA,
+			CipherSuite.TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
+			CipherSuite.TLS_ECDH_ECDSA_WITH_RC4_128_SHA,
+			CipherSuite.TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
+			CipherSuite.TLS_RSA_WITH_RC4_128_MD5,
+			CipherSuite.TLS_RSA_WITH_RC4_128_SHA,
+			CipherSuite.TLS_RSA_WITH_AES_128_CBC_SHA,
+			CipherSuite.TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,
+			CipherSuite.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,
+			CipherSuite.TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,
+			CipherSuite.TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
+			CipherSuite.TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,
+			CipherSuite.TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,
+			SSL3_RSA_FIPS_WITH_3DES_EDE_CBC_SHA,
+			CipherSuite.TLS_RSA_WITH_3DES_EDE_CBC_SHA
+	};
+
+	// https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt#n412
+	private static final byte[] VERSIONS_CELL = new byte[] {
+			0x00, 0x00, // Circuit ID: 0
+			0x07, // Command: Versions
+			0x00, 0x06, // Payload length: 6 bytes
+			0x00, 0x03, 0x00, 0x04, 0x00, 0x05 // Supported versions: 3, 4, 5
+	};
+
+	public List<Integer> probe(String address, int port) throws IOException {
+		if (LOG.isLoggable(INFO))
+			LOG.info("Connecting to " + address + ":" + port);
+		Socket socket = new Socket(address, port);
+		LOG.info("Connected");
+		TlsClientProtocol client = new TlsClientProtocol(
+				socket.getInputStream(), socket.getOutputStream(),
+				new SecureRandom());
+		client.connect(new TorTlsClient());
+		LOG.info("TLS handshake succeeded");
+		socket.setSoTimeout(READ_TIMEOUT);
+		try {
+			// Send a versions cell
+			OutputStream out = client.getOutputStream();
+			out.write(VERSIONS_CELL);
+			out.flush();
+			LOG.info("Sent versions cell");
+
+			// Expect a versions cell in response
+			List<Integer> versions = new ArrayList<>();
+			DataInputStream in = new DataInputStream(client.getInputStream());
+			int circuitId = in.readUnsignedShort();
+			if (circuitId != 0)
+				throw new IOException("Unexpected circuit ID: " + circuitId);
+			int command = in.readUnsignedByte();
+			if (command != 7)
+				throw new IOException("Unexpected command: " + command);
+			int payloadLength = in.readUnsignedShort();
+			if (payloadLength == 0 || payloadLength % 2 != 0) {
+				throw new IOException("Invalid payload length: "
+						+ payloadLength);
+			}
+			for (int i = 0; i < payloadLength / 2; i++) {
+				int version = in.readUnsignedShort();
+				versions.add(version);
+			}
+			if (LOG.isLoggable(INFO))
+				LOG.info("Supported versions: " + versions);
+			return versions;
+		} finally {
+			client.close();
+		}
+	}
+
+	public static void main(String[] args) throws IOException {
+		if (args.length != 2) {
+			System.err.println("Usage: TorProbe <address> <port>");
+			System.exit(1);
+		}
+		String address = args[0];
+		int port = Integer.parseInt(args[1]);
+		new TorProbe().probe(address, port);
+	}
+
+	private static class TorTlsClient extends DefaultTlsClient {
+
+		@Override
+		public TlsAuthentication getAuthentication() {
+			return new ServerOnlyTlsAuthentication() {
+				@Override
+				public void notifyServerCertificate(Certificate cert)
+						throws IOException {
+					LOG.info("Received server certificate");
+					org.spongycastle.asn1.x509.Certificate[] chain =
+							cert.getCertificateList();
+					if (chain.length != 1)
+						throw new IOException("Certificate is not self-signed");
+					for (org.spongycastle.asn1.x509.Certificate c : chain) {
+						if (LOG.isLoggable(INFO)) {
+							LOG.info("Subject: " + c.getSubject());
+							LOG.info("Issuer: " + c.getIssuer());
+						}
+					}
+				}
+			};
+		}
+
+		@Override
+		public int[] getCipherSuites() {
+			return TOR_CIPHER_SUITES;
+		}
+	}
+}