November 2011 - tor-commits - lists.torproject.org

[translation/tsum] Update translations for tsum
by translation＠torproject.org 16 Nov '11

16 Nov '11

commit 1ecc2eca177607e51ecf09113a3c16c7970f7478 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Nov 16 12:45:04 2011 +0000 Update translations for tsum --- ar/tsum.po | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/ar/tsum.po b/ar/tsum.po index 4b97e93..ec42e51 100644 --- a/ar/tsum.po +++ b/ar/tsum.po @@ -13,7 +13,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2011-11-05 17:16+0000\n" -"PO-Revision-Date: 2011-11-16 12:13+0000\n" +"PO-Revision-Date: 2011-11-16 12:20+0000\n" "Last-Translator: 0xAli <protectednet(a)hotmail.com>\n" "Language-Team: LANGUAGE <LL(a)li.org>\n" "MIME-Version: 1.0\n" @@ -551,6 +551,9 @@ msgid "" "and use winzip to extract the archive. Before renaming the file, tell " "Windows to show file extensions:" msgstr "" +"لو لم تستطع تحميل برنامج 7-Zip. حاول إعادة تسمية إمتدادات الملفات من .z إلى " +".zip وجرب تستخدم برنامج الـ winzip لفك ضغط الأرشيف, قبل تسمية الملف, غير " +"إعدادات الويندوز ليظهر إمتدادات الملفات:" #. type: Plain text #: en/tsum.text:254 @@ -588,6 +591,8 @@ msgid "" "### What to do with split packages\n" "When you request a split package, the parts may arrive out of order. You need to make sure you have received all the parts before you attempt to unpack them. Save all the parts into one directory on your computer, unzip them, and double-click the file that ends in \"..split.part01.exe\" to start the unpacking process." msgstr "" +"### ماذا نفعل في الملفات المقسمة\n" +"عندما تطلب الملفات المقسمة, من الممكن أن تصل الأجزاء في ترتيب مختلف. لابد أن تتأكد أنك حصلت على كل الأجزاء قبل أن تحاول فك الضغط عنهم. إحفظ كل الأجزاء في مجلد واحد في جهازك, فك الضغط عنهم, ثم إضغط نقرتين على الملف الذي يكون في آخر إسمه \"..split.part01.exe\" لتبدأ عملية فك الضغط." #. type: Plain text #: en/tsum.text:277

1 0

[translation/tsum] Update translations for tsum
by translation＠torproject.org 16 Nov '11

16 Nov '11

commit ae9cae543b517419391663fed373d9fc66a83de1 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Nov 16 12:15:04 2011 +0000 Update translations for tsum --- ar/tsum.po | 24 +++++++++++++++++++++++- 1 files changed, 23 insertions(+), 1 deletions(-) diff --git a/ar/tsum.po b/ar/tsum.po index 9c49f6f..4b97e93 100644 --- a/ar/tsum.po +++ b/ar/tsum.po @@ -13,7 +13,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2011-11-05 17:16+0000\n" -"PO-Revision-Date: 2011-11-16 11:43+0000\n" +"PO-Revision-Date: 2011-11-16 12:13+0000\n" "Last-Translator: 0xAli <protectednet(a)hotmail.com>\n" "Language-Team: LANGUAGE <LL(a)li.org>\n" "MIME-Version: 1.0\n" @@ -47,6 +47,8 @@ msgid "" " lot of emails every single day. There is no need to worry if we don't get " "back to you straight away." msgstr "" +"من فضلك تذكر إننا نقوم بالمساعدة على أساس تطوعي, وقد يصلنا الكثير من الرسائل" +" كل يوم, لا داعي للقلق إذا لم نرد عليك بسرعة." #. type: Plain text #: en/tsum.text:13 @@ -101,6 +103,9 @@ msgid "" "to a website with a username and password, make sure that you are using " "HTTPS (e.g. **https**://torproject.org/, not **http**://torproject.org/)." msgstr "" +"لو كنت تقوم بالأعمال المهمة والحساسة, كالدخول على حسابك على موقع ما بإدخال " +"إسم المستخدم وكلمة المرور على سبيل المثال, تأكد من أنك تتصفح بإستخدام نظام " +"التصفح الآمن (مثلاً: https://torproject.org ,وليس http://torproject.org)" #. type: Plain text #: en/tsum.text:38 @@ -130,6 +135,9 @@ msgid "" " browse to the [Tor Project website](https://www.torproject.org/) and " "download it there, or you can use GetTor, the email autoresponder." msgstr "" +"هناك طريقتان مختلفتان للحصول على برنامج تور, يمكنك الدخول على [موقع مشروع " +"التور](https://www.torproject.org/) وتحميله من هناك, أو يمكنك إستخدام " +"GetTor, نظام الرد الأوتوماتيكي على الإيميل." #. type: Plain text #: en/tsum.text:53 @@ -137,6 +145,8 @@ msgid "" "### How to get Tor via email\n" "To receive the English Tor Browser Bundle for Windows, send an email to gettor(a)torproject.org with **windows** in the body of the message. You can leave the subject blank." msgstr "" +"### كيف تحصل على تور من خلال البريد الإلكتروني\n" +"للحصول على حزمة التصفح الخاصة ببرنامج تور باللغة الإنجليزية الذي يعمل على نظام الويندوز, إرسل رسالة إلكترونية لـ gettor(a)torproject.org مع وضع كلمة **windows** في نص الرسالة, يمكنك أن تترك عنوان الرسالة فارغاً." #. type: Plain text #: en/tsum.text:57 @@ -165,6 +175,11 @@ msgid "" "want, send an email to help(a)rt.torproject.org and we\n" "will give you a list of website mirrors to use.\n" msgstr "" +"**ملحوظة**: حزمة متصفح تور الخاصة بنظامي تشغيل اللينوكس والماك حجمهم كبير, " +"ولن يمكنك الحصول عليهما بإستخدام إيميل جي ميل أو هوتميل أو ياهوو. لو لم " +"يمكنك الحصول على الحزمة التي تريدها, ارسل رسالة بريد إلكتروني على " +"help(a)rt.torproject.org ونحن سنرد عليك برسالة بها قائمة من المواقع التي قامت " +"برفع البرنامج.\n" #. type: Plain text #: en/tsum.text:73 @@ -172,6 +187,8 @@ msgid "" "#### How to get Tor as several small sized packages\n" "It is possible to request the Tor Browser Bundle for Windows as several small sized packages, instead of one big package. This can be useful if you don't have a lot of bandwidth available, or if your email provider does not allow you to receive large attachments." msgstr "" +"#### كيفية الحصول على تور مقسم على أجزاء أصغر\n" +"من الممكن طلب حزمة متصفح تور لنظام الويندوز ويكون مقسماً على أجزاء أصغر, بدلاً من ملف واحد كبير. يكون هذا مفيداً إذا كانت سرعة الإنترنت الخاصة بك قليلة, أو لو الموقع الذي عليه حساب الإيميل الخاص بك لا يستقبل مرفقات كبيرة الحجم." #. type: Plain text #: en/tsum.text:76 @@ -189,6 +206,8 @@ msgid "" "windows \n" "split\n" msgstr "" +"windows \n" +"split\n" #. type: Plain text #: en/tsum.text:83 @@ -197,6 +216,9 @@ msgid "" "*What to do with split packages* for information on how to unpack and re-" "assemble the small sized packages." msgstr "" +"لابد أن تضع كلمة *split* في سطر وحيد, إقرأ الجزء الخاص بـ *ماذا نفعل في " +"الملفات المقسمة* لمزيد من المعلومات عن كيفية فك ضغط وتجميع الأجزاء صغيرة " +"الحجم." #. type: Plain text #: en/tsum.text:89

1 0

[translation/tsum] Update translations for tsum
by translation＠torproject.org 16 Nov '11

16 Nov '11

commit 88cc127d6fbeea3348739b288cb330df85e1e0b3 Author: Translation commit bot <translation(a)torproject.org> Date: Wed Nov 16 11:45:04 2011 +0000 Update translations for tsum --- ar/tsum.po | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletions(-) diff --git a/ar/tsum.po b/ar/tsum.po index 87beb17..9c49f6f 100644 --- a/ar/tsum.po +++ b/ar/tsum.po @@ -13,7 +13,7 @@ msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2011-11-05 17:16+0000\n" -"PO-Revision-Date: 2011-11-16 11:04+0000\n" +"PO-Revision-Date: 2011-11-16 11:43+0000\n" "Last-Translator: 0xAli <protectednet(a)hotmail.com>\n" "Language-Team: LANGUAGE <LL(a)li.org>\n" "MIME-Version: 1.0\n" @@ -35,6 +35,10 @@ msgid "" "find the answer to your question in this document, email " "help(a)rt.torproject.org." msgstr "" +"دليل المستخدم هذا يحتوي على معلومات عن كيفية تحميل برنامج تور, وكيفية " +"إستخدامه, وماذا يجب أن تفعل إذا كان تور لا يستطيع الإتصال بالشبكة, إذا كنت " +"لا تجد إجابة سؤالك في هذه الصفحة, من فضلك ارسل إيميل على " +"help(a)rt.torproject.org " #. type: Plain text #: en/tsum.text:11 @@ -175,6 +179,8 @@ msgid "" "Send an email to gettor(a)torproject.org with the following words in the body " "of the email:" msgstr "" +"ارسل بريد إلكتروني لـ gettor(a)torproject.org ويجب أن تكون الكلمات التالية في " +"نص الرسالة:" #. type: Plain text #: en/tsum.text:79

1 0

[translation/tsum] Update translations for tsum
by translation＠torproject.org 16 Nov '11

16 Nov '11

commit 44a5dc137947881ee8f1d10f1acd0afd8217379e Author: Translation commit bot <translation(a)torproject.org> Date: Wed Nov 16 11:15:04 2011 +0000 Update translations for tsum --- ar/tsum.po | 9 +++++---- 1 files changed, 5 insertions(+), 4 deletions(-) diff --git a/ar/tsum.po b/ar/tsum.po index f93d298..87beb17 100644 --- a/ar/tsum.po +++ b/ar/tsum.po @@ -6,14 +6,15 @@ # <damnlinux(a)yahoo.com>, 2011. # Mohamed Elgindy <melgindy(a)gmail.com>, 2011. # Mohammed Babiker <sudanhacker(a)hotmail.com>, 2011. +# <protectednet(a)hotmail.com>, 2011. # <SoEnLion(a)gmail.com>, 2011. msgid "" msgstr "" "Project-Id-Version: The Tor Project\n" "Report-Msgid-Bugs-To: https://trac.torproject.org/projects/tor\n" "POT-Creation-Date: 2011-11-05 17:16+0000\n" -"PO-Revision-Date: 2011-11-07 21:43+0000\n" -"Last-Translator: melgindy <melgindy(a)gmail.com>\n" +"PO-Revision-Date: 2011-11-16 11:04+0000\n" +"Last-Translator: 0xAli <protectednet(a)hotmail.com>\n" "Language-Team: LANGUAGE <LL(a)li.org>\n" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=UTF-8\n" @@ -24,7 +25,7 @@ msgstr "" #. type: Plain text #: en/tsum.text:2 msgid "# The Short User Manual\n" -msgstr "" +msgstr "# دليل المستخدم المختصر\n" #. type: Plain text #: en/tsum.text:7 @@ -60,7 +61,7 @@ msgid "" " traffic is sent out onto the public Internet." msgstr "" "التور شبكة تتكون من قنوات إفتراضية تسمح لك بتحسين خصوصيتك وأمنك في الإنترنت " -". يعمل طور عن طريق إرسال بياناتك عبر ثلاثة مخدمات إفتراضية (تعرف أيضاً بإسم " +". يعمل طور عن طريق إرسال بياناتك عبر ثلاثة خوادم إفتراضية (تعرف أيضاً بإسم " "المرحلات) توجد داخل شبكة تور وذلك قبل أن تصل البيانات إلي شبكة الإنترنت " "العامة ."

1 0

[pytorctl/master] Make memory-only sqlite work.
by mikeperry＠torproject.org 16 Nov '11

16 Nov '11

commit 3de91767e208d1642a8cf89dc1b645f637abaf8e Author: Mike Perry <mikeperry-git(a)fscked.org> Date: Tue Nov 15 18:42:18 2011 -0800 Make memory-only sqlite work. --- SQLSupport.py | 9 ++++++++- 1 files changed, 8 insertions(+), 1 deletions(-) diff --git a/SQLSupport.py b/SQLSupport.py index e50dd71..28963fc 100644 --- a/SQLSupport.py +++ b/SQLSupport.py @@ -22,6 +22,7 @@ from TorUtil import meta_port, meta_host, control_port, control_host, control_pa from TorCtl import EVENT_TYPE, EVENT_STATE, TorCtlError import sqlalchemy +import sqlalchemy.pool import sqlalchemy.orm.exc from sqlalchemy.orm import scoped_session, sessionmaker, eagerload, lazyload, eagerload_all from sqlalchemy.orm.exc import NoResultFound @@ -58,7 +59,13 @@ tc_metadata.echo=True tc_session = scoped_session(sessionmaker(autoflush=True)) def setup_db(db_uri, echo=False, drop=False): - tc_engine = create_engine(db_uri, echo=echo) + # Memory-only sqlite requires some magic options... + if db_uri == "sqlite://": + tc_engine = create_engine(db_uri, echo=echo, + connect_args={'check_same_thread':False}, + poolclass=sqlalchemy.pool.StaticPool) + else: + tc_engine = create_engine(db_uri, echo=echo) tc_metadata.bind = tc_engine tc_metadata.echo = echo

1 0

r25223: {projects} fix a typo in figure 1 from our 2004 paper, since i just got (projects/design-paper)
by Roger Dingledine 16 Nov '11

16 Nov '11

Author: arma Date: 2011-11-16 02:34:29 +0000 (Wed, 16 Nov 2011) New Revision: 25223 Modified: projects/design-paper/interaction.eps projects/design-paper/interaction.fig projects/design-paper/interaction.pdf Log: fix a typo in figure 1 from our 2004 paper, since i just got a request to reuse it Modified: projects/design-paper/interaction.eps =================================================================== --- projects/design-paper/interaction.eps 2011-11-15 12:59:22 UTC (rev 25222) +++ projects/design-paper/interaction.eps 2011-11-16 02:34:29 UTC (rev 25223) @@ -1,11 +1,11 @@ -%!PS-Adobe-2.0 EPSF-2.0 +%!PS-Adobe-3.0 EPSF-3.0 %%Title: interaction.fig -%%Creator: fig2dev Version 3.2 Patchlevel 3d -%%CreationDate: Sat Jan 31 05:25:23 2004 -%%For: nickm(a)totoro.wangafu.net () -%%BoundingBox: 0 0 449 235 -%%Magnification: 1.0000 +%%Creator: fig2dev Version 3.2 Patchlevel 5d +%%CreationDate: Tue Nov 15 21:03:09 2011 +%%BoundingBox: 0 0 450 236 +%Magnification: 1.0000 %%EndComments +%%BeginProlog /$F2psDict 200 dict def $F2psDict begin $F2psDict /mtrx matrix put @@ -44,10 +44,6 @@ /col31 {1.000 0.840 0.000 srgb} bind def end -save -newpath 0 235 moveto 0 0 lineto 449 0 lineto 449 235 lineto closepath clip newpath --62.3 239.8 translate -1 -1 scale /cp {closepath} bind def /ef {eofill} bind def @@ -122,20 +118,37 @@ /$F2psBegin {$F2psDict begin /$F2psEnteredState save def} def /$F2psEnd {$F2psEnteredState restore end} def +/pageheader { +save +newpath 0 236 moveto 0 0 lineto 450 0 lineto 450 236 lineto closepath clip newpath +-62.1 239.8 translate +1 -1 scale $F2psBegin 10 setmiterlimit +0 slj 0 slc 0.06000 0.06000 sc +} bind def +/pagefooter { +$F2psEnd +restore +} bind def +%%EndProlog +pageheader % % Fig objects follow % +% +% here starts figure with depth 50 % Polyline +0 slj +0 slc 15.000 slw n 6000 300 m 6000 3975 l gs col0 s gr % Polyline 7.500 slw gs clippath -3615 555 m 3615 495 l 3464 495 l 3584 525 l 3464 555 l cp +3464 555 m 3615 555 l 3615 495 l 3464 495 l 3464 495 l 3584 525 l 3464 555 l cp eoclip n 1200 525 m 3600 525 l gs col0 s gr gr @@ -144,7 +157,7 @@ n 3464 555 m 3584 525 l 3464 495 l 3464 555 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -1185 795 m 1185 855 l 1336 855 l 1216 825 l 1336 795 l cp +1336 795 m 1185 795 l 1185 855 l 1336 855 l 1336 855 l 1216 825 l 1336 795 l cp eoclip n 3600 825 m 1200 825 l gs col0 s gr gr @@ -158,7 +171,7 @@ % Polyline 7.500 slw gs clippath -3615 1155 m 3615 1095 l 3464 1095 l 3584 1125 l 3464 1155 l cp +3464 1155 m 3615 1155 l 3615 1095 l 3464 1095 l 3464 1095 l 3584 1125 l 3464 1155 l cp eoclip n 1200 1125 m 3600 1125 l gs col0 s gr gr @@ -172,7 +185,7 @@ % Polyline 7.500 slw gs clippath -6015 1230 m 6015 1170 l 5864 1170 l 5984 1200 l 5864 1230 l cp +5864 1230 m 6015 1230 l 6015 1170 l 5864 1170 l 5864 1170 l 5984 1200 l 5864 1230 l cp eoclip n 3600 1200 m 6000 1200 l gs col0 s gr gr @@ -181,7 +194,7 @@ n 5864 1230 m 5984 1200 l 5864 1170 l 5864 1230 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -3585 1470 m 3585 1530 l 3736 1530 l 3616 1500 l 3736 1470 l cp +3736 1470 m 3585 1470 l 3585 1530 l 3736 1530 l 3736 1530 l 3616 1500 l 3736 1470 l cp eoclip n 6000 1500 m 3600 1500 l gs col0 s gr gr @@ -190,7 +203,7 @@ n 3736 1470 m 3616 1500 l 3736 1530 l 3736 1470 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -1185 1545 m 1185 1605 l 1336 1605 l 1216 1575 l 1336 1545 l cp +1336 1545 m 1185 1545 l 1185 1605 l 1336 1605 l 1336 1605 l 1216 1575 l 1336 1545 l cp eoclip n 3600 1575 m 1200 1575 l gs col0 s gr gr @@ -203,7 +216,7 @@ 8325 1800 l gs col0 s gr [] 0 sd % Polyline gs clippath -3615 2130 m 3615 2070 l 3464 2070 l 3584 2100 l 3464 2130 l cp +3464 2130 m 3615 2130 l 3615 2070 l 3464 2070 l 3464 2070 l 3584 2100 l 3464 2130 l cp eoclip n 1200 2100 m 3600 2100 l gs col0 s gr gr @@ -212,7 +225,7 @@ n 3464 2130 m 3584 2100 l 3464 2070 l 3464 2130 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -6015 2205 m 6015 2145 l 5864 2145 l 5984 2175 l 5864 2205 l cp +5864 2205 m 6015 2205 l 6015 2145 l 5864 2145 l 5864 2145 l 5984 2175 l 5864 2205 l cp eoclip n 3600 2175 m 6000 2175 l gs col0 s gr gr @@ -222,8 +235,8 @@ % Polyline [60] 0 sd gs clippath -8190 2430 m 8190 2370 l 8039 2370 l 8159 2400 l 8039 2430 l cp -5985 2370 m 5985 2430 l 6136 2430 l 6016 2400 l 6136 2370 l cp +8039 2430 m 8190 2430 l 8190 2370 l 8039 2370 l 8039 2370 l 8159 2400 l 8039 2430 l cp +6136 2370 m 5985 2370 l 5985 2430 l 6136 2430 l 6136 2430 l 6016 2400 l 6136 2370 l cp eoclip n 6000 2400 m 8175 2400 l gs col0 s gr gr @@ -234,7 +247,7 @@ n 8039 2430 m 8159 2400 l 8039 2370 l 8039 2430 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -3585 2520 m 3585 2580 l 3736 2580 l 3616 2550 l 3736 2520 l cp +3736 2520 m 3585 2520 l 3585 2580 l 3736 2580 l 3736 2580 l 3616 2550 l 3736 2520 l cp eoclip n 6000 2550 m 3600 2550 l gs col0 s gr gr @@ -243,7 +256,7 @@ n 3736 2520 m 3616 2550 l 3736 2580 l 3736 2520 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -1185 2595 m 1185 2655 l 1336 2655 l 1216 2625 l 1336 2595 l cp +1336 2595 m 1185 2595 l 1185 2655 l 1336 2655 l 1336 2655 l 1216 2625 l 1336 2595 l cp eoclip n 3600 2625 m 1200 2625 l gs col0 s gr gr @@ -252,7 +265,7 @@ n 1336 2595 m 1216 2625 l 1336 2655 l 1336 2595 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -3615 3030 m 3615 2970 l 3464 2970 l 3584 3000 l 3464 3030 l cp +3464 3030 m 3615 3030 l 3615 2970 l 3464 2970 l 3464 2970 l 3584 3000 l 3464 3030 l cp eoclip n 1200 3000 m 3600 3000 l gs col0 s gr gr @@ -261,7 +274,7 @@ n 3464 3030 m 3584 3000 l 3464 2970 l 3464 3030 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -6015 3105 m 6015 3045 l 5864 3045 l 5984 3075 l 5864 3105 l cp +5864 3105 m 6015 3105 l 6015 3045 l 5864 3045 l 5864 3045 l 5984 3075 l 5864 3105 l cp eoclip n 3600 3075 m 6000 3075 l gs col0 s gr gr @@ -270,7 +283,7 @@ n 5864 3105 m 5984 3075 l 5864 3045 l 5864 3105 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -8190 3180 m 8190 3120 l 8039 3120 l 8159 3150 l 8039 3180 l cp +8039 3180 m 8190 3180 l 8190 3120 l 8039 3120 l 8039 3120 l 8159 3150 l 8039 3180 l cp eoclip n 6000 3150 m 8175 3150 l gs col0 s gr gr @@ -279,7 +292,7 @@ n 8039 3180 m 8159 3150 l 8039 3120 l 8039 3180 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -5985 3420 m 5985 3480 l 6136 3480 l 6016 3450 l 6136 3420 l cp +6136 3420 m 5985 3420 l 5985 3480 l 6136 3480 l 6136 3480 l 6016 3450 l 6136 3420 l cp eoclip n 8175 3450 m 6000 3450 l gs col0 s gr gr @@ -288,7 +301,7 @@ n 6136 3420 m 6016 3450 l 6136 3480 l 6136 3420 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -5985 3495 m 5985 3555 l 6136 3555 l 6016 3525 l 6136 3495 l cp +6136 3495 m 5985 3495 l 5985 3555 l 6136 3555 l 6136 3555 l 6016 3525 l 6136 3495 l cp eoclip n 8175 3525 m 6000 3525 l gs col0 s gr gr @@ -297,7 +310,7 @@ n 6136 3495 m 6016 3525 l 6136 3555 l 6136 3495 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -5985 3570 m 5985 3630 l 6136 3630 l 6016 3600 l 6136 3570 l cp +6136 3570 m 5985 3570 l 5985 3630 l 6136 3630 l 6136 3630 l 6016 3600 l 6136 3570 l cp eoclip n 8175 3600 m 6000 3600 l gs col0 s gr gr @@ -306,7 +319,7 @@ n 6136 3570 m 6016 3600 l 6136 3630 l 6136 3570 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -3585 3495 m 3585 3555 l 3736 3555 l 3616 3525 l 3736 3495 l cp +3736 3495 m 3585 3495 l 3585 3555 l 3736 3555 l 3736 3555 l 3616 3525 l 3736 3495 l cp eoclip n 6000 3525 m 3600 3525 l gs col0 s gr gr @@ -315,7 +328,7 @@ n 3736 3495 m 3616 3525 l 3736 3555 l 3736 3495 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -3585 3645 m 3585 3705 l 3736 3705 l 3616 3675 l 3736 3645 l cp +3736 3645 m 3585 3645 l 3585 3705 l 3736 3705 l 3736 3705 l 3616 3675 l 3736 3645 l cp eoclip n 6000 3675 m 3600 3675 l gs col0 s gr gr @@ -324,7 +337,7 @@ n 3736 3645 m 3616 3675 l 3736 3705 l 3736 3645 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -3585 3570 m 3585 3630 l 3736 3630 l 3616 3600 l 3736 3570 l cp +3736 3570 m 3585 3570 l 3585 3630 l 3736 3630 l 3736 3630 l 3616 3600 l 3736 3570 l cp eoclip n 6000 3600 m 3600 3600 l gs col0 s gr gr @@ -333,7 +346,7 @@ n 3736 3570 m 3616 3600 l 3736 3630 l 3736 3570 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -1185 3645 m 1185 3705 l 1336 3705 l 1216 3675 l 1336 3645 l cp +1336 3645 m 1185 3645 l 1185 3705 l 1336 3705 l 1336 3705 l 1216 3675 l 1336 3645 l cp eoclip n 3600 3675 m 1200 3675 l gs col0 s gr gr @@ -342,7 +355,7 @@ n 1336 3645 m 1216 3675 l 1336 3705 l 1336 3645 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -1185 3720 m 1185 3780 l 1336 3780 l 1216 3750 l 1336 3720 l cp +1336 3720 m 1185 3720 l 1185 3780 l 1336 3780 l 1336 3780 l 1216 3750 l 1336 3720 l cp eoclip n 3600 3750 m 1200 3750 l gs col0 s gr gr @@ -351,7 +364,7 @@ n 1336 3720 m 1216 3750 l 1336 3780 l 1336 3720 l cp gs 0.00 setgray ef gr col0 s % Polyline gs clippath -1185 3795 m 1185 3855 l 1336 3855 l 1216 3825 l 1336 3795 l cp +1336 3795 m 1185 3795 l 1185 3855 l 1336 3855 l 1336 3855 l 1216 3825 l 1336 3795 l cp eoclip n 3600 3825 m 1200 3825 l gs col0 s gr gr @@ -366,98 +379,101 @@ 7.500 slw n 6300 825 m 7950 825 l 7950 1725 l 6300 1725 l cp gs col7 1.00 shd ef gr gs col0 s gr -/Times-Bold-iso ff 180.00 scf sf +/Times-Bold-iso ff 200.00 scf sf 3375 225 m gs 1 -1 sc (OR 1) col0 sh gr -/Times-Bold-iso ff 180.00 scf sf +/Times-Bold-iso ff 200.00 scf sf 1050 225 m gs 1 -1 sc (Alice) col0 sh gr -/Times-Bold-iso ff 180.00 scf sf +/Times-Bold-iso ff 200.00 scf sf 5775 225 m gs 1 -1 sc (OR 2) col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 6075 3075 m gs 1 -1 sc ("HTTP GET...") col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 4800 3975 m gs 1 -1 sc (. . .) dup sw pop 2 div neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 7125 3975 m gs 1 -1 sc (. . .) dup sw pop 2 div neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 2400 3975 m gs 1 -1 sc (. . .) dup sw pop 2 div neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 7125 2325 m gs 1 -1 sc ($TCP handshake$) dup sw pop 2 div neg 0 rm col0 sh gr -/Times-Bold-iso ff 180.00 scf sf +/Times-Bold-iso ff 200.00 scf sf 7875 225 m gs 1 -1 sc (website) col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 7125 1425 m gs 1 -1 sc ({X}--AES encryption) dup sw pop 2 div neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 7125 1200 m gs 1 -1 sc (E$x$--RSA encryption) dup sw pop 2 div neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 7125 975 m gs 1 -1 sc (Legend:) dup sw pop 2 div neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 2400 225 m gs 1 -1 sc ($link is TLS-encrypted$) dup sw pop 2 div neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 1275 1050 m gs 1 -1 sc (Relay c1{Extend, OR2, E$g^x2$}) col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 1275 2025 m gs 1 -1 sc (Relay c1{{Begin <website>:80}}) col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 3525 1500 m gs 1 -1 sc (Relay c1{Extended, g^y2, H$K2$}) dup sw pop neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 3675 2100 m gs 1 -1 sc (Relay c2{Begin <website>:80}) col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 3525 2550 m gs 1 -1 sc (Relay c1{{Connected}}) dup sw pop neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 5925 2475 m gs 1 -1 sc (Relay c2{Connected}) dup sw pop neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 1275 2925 m gs 1 -1 sc (Relay c1{{Data, "HTTP GET..."}}) col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 3675 3000 m gs 1 -1 sc (Relay c2{Data, "HTTP GET..."}) col0 sh gr -/Times-Roman-iso ff 150.00 scf sf -4800 225 m -gs 1 -1 sc ($link is TLS-encryped$) dup sw pop 2 div neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 7050 225 m gs 1 -1 sc ($unencrypted$) dup sw pop 2 div neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 7125 1650 m gs 1 -1 sc (cN--a circID) dup sw pop 2 div neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 3525 3600 m gs 1 -1 sc (Relay c1{{Data, $response$}}) dup sw pop neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 8100 3375 m gs 1 -1 sc ($response$) dup sw pop neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 5925 3450 m gs 1 -1 sc (Relay c2{Data, $response$}) dup sw pop neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 5925 1425 m gs 1 -1 sc (Created c2, g^y2, H$K2$) dup sw pop neg 0 rm col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 3675 1125 m gs 1 -1 sc (Create c2, E$g^x2$) col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 1275 450 m gs 1 -1 sc (Create c1, E$g^x1$) col0 sh gr -/Times-Roman-iso ff 150.00 scf sf +/Times-Roman-iso ff 166.67 scf sf 3525 750 m gs 1 -1 sc (Created c1, g^y1, H$K1$) dup sw pop neg 0 rm col0 sh gr -$F2psEnd -rs +/Times-Roman-iso ff 166.67 scf sf +4800 225 m +gs 1 -1 sc ($link is TLS-encrypted$) dup sw pop 2 div neg 0 rm col0 sh gr +% here ends figure; +pagefooter +showpage +%%Trailer +%EOF Modified: projects/design-paper/interaction.fig =================================================================== --- projects/design-paper/interaction.fig 2011-11-15 12:59:22 UTC (rev 25222) +++ projects/design-paper/interaction.fig 2011-11-16 02:34:29 UTC (rev 25223) @@ -1,4 +1,4 @@ -#FIG 3.2 +#FIG 3.2 Produced by xfig version 3.2.5b Landscape Center Inches @@ -89,34 +89,34 @@ 8175 300 8175 3975 2 2 0 1 0 7 50 0 20 3.000 0 0 -1 0 0 5 6300 825 7950 825 7950 1725 6300 1725 6300 825 -4 0 0 50 0 2 12 0.0000 4 135 450 3375 225 OR 1\001 -4 0 0 50 0 2 12 0.0000 4 135 420 1050 225 Alice\001 -4 0 0 50 0 2 12 0.0000 4 135 450 5775 225 OR 2\001 +4 0 0 50 0 2 12 0.0000 4 135 480 3375 225 OR 1\001 +4 0 0 50 0 2 12 0.0000 4 135 435 1050 225 Alice\001 +4 0 0 50 0 2 12 0.0000 4 135 480 5775 225 OR 2\001 4 0 0 50 0 0 10 0.0000 4 105 960 6075 3075 "HTTP GET..."\001 -4 1 0 50 0 0 10 0.0000 4 15 135 4800 3975 . . .\001 -4 1 0 50 0 0 10 0.0000 4 15 135 7125 3975 . . .\001 -4 1 0 50 0 0 10 0.0000 4 15 135 2400 3975 . . .\001 +4 1 0 50 0 0 10 0.0000 4 15 195 4800 3975 . . .\001 +4 1 0 50 0 0 10 0.0000 4 15 195 7125 3975 . . .\001 +4 1 0 50 0 0 10 0.0000 4 15 195 2400 3975 . . .\001 4 1 0 50 0 0 10 0.0000 4 135 1050 7125 2325 (TCP handshake)\001 -4 0 0 50 0 2 12 0.0000 4 135 630 7875 225 website\001 -4 1 0 50 0 0 10 0.0000 4 135 1335 7125 1425 {X}--AES encryption\001 -4 1 0 50 0 0 10 0.0000 4 135 1410 7125 1200 E(x)--RSA encryption\001 +4 0 0 50 0 2 12 0.0000 4 135 615 7875 225 website\001 +4 1 0 50 0 0 10 0.0000 4 150 1335 7125 1425 {X}--AES encryption\001 +4 1 0 50 0 0 10 0.0000 4 150 1410 7125 1200 E(x)--RSA encryption\001 4 1 0 50 0 0 10 0.0000 4 135 480 7125 975 Legend:\001 -4 1 0 50 0 0 10 0.0000 4 135 1455 2400 225 (link is TLS-encrypted)\001 -4 0 0 50 0 0 10 0.0000 4 135 2085 1275 1050 Relay c1{Extend, OR2, E(g^x2)}\001 +4 1 0 50 0 0 10 0.0000 4 150 1455 2400 225 (link is TLS-encrypted)\001 +4 0 0 50 0 0 10 0.0000 4 135 2055 1275 1050 Relay c1{Extend, OR2, E(g^x2)}\001 4 0 0 50 0 0 10 0.0000 4 135 1965 1275 2025 Relay c1{{Begin <website>:80}}\001 -4 2 0 50 0 0 10 0.0000 4 135 2190 3525 1500 Relay c1{Extended, g^y2, H(K2)}\001 +4 2 0 50 0 0 10 0.0000 4 135 2100 3525 1500 Relay c1{Extended, g^y2, H(K2)}\001 4 0 0 50 0 0 10 0.0000 4 135 1845 3675 2100 Relay c2{Begin <website>:80}\001 4 2 0 50 0 0 10 0.0000 4 135 1410 3525 2550 Relay c1{{Connected}}\001 4 2 0 50 0 0 10 0.0000 4 135 1290 5925 2475 Relay c2{Connected}\001 4 0 0 50 0 0 10 0.0000 4 135 2085 1275 2925 Relay c1{{Data, "HTTP GET..."}}\001 4 0 0 50 0 0 10 0.0000 4 135 1965 3675 3000 Relay c2{Data, "HTTP GET..."}\001 -4 1 0 50 0 0 10 0.0000 4 135 1365 4800 225 (link is TLS-encryped)\001 -4 1 0 50 0 0 10 0.0000 4 135 870 7050 225 (unencrypted)\001 +4 1 0 50 0 0 10 0.0000 4 150 870 7050 225 (unencrypted)\001 4 1 0 50 0 0 10 0.0000 4 105 780 7125 1650 cN--a circID\001 -4 2 0 50 0 0 10 0.0000 4 135 1860 3525 3600 Relay c1{{Data, (response)}}\001 -4 2 0 50 0 0 10 0.0000 4 135 645 8100 3375 (response)\001 -4 2 0 50 0 0 10 0.0000 4 135 1650 5925 3450 Relay c2{Data, (response)}\001 -4 2 0 50 0 0 10 0.0000 4 135 1545 5925 1425 Created c2, g^y2, H(K2)\001 +4 2 0 50 0 0 10 0.0000 4 150 1770 3525 3600 Relay c1{{Data, (response)}}\001 +4 2 0 50 0 0 10 0.0000 4 150 645 8100 3375 (response)\001 +4 2 0 50 0 0 10 0.0000 4 150 1650 5925 3450 Relay c2{Data, (response)}\001 +4 2 0 50 0 0 10 0.0000 4 135 1515 5925 1425 Created c2, g^y2, H(K2)\001 4 0 0 50 0 0 10 0.0000 4 135 1170 3675 1125 Create c2, E(g^x2)\001 4 0 0 50 0 0 10 0.0000 4 135 1170 1275 450 Create c1, E(g^x1)\001 -4 2 0 50 0 0 10 0.0000 4 135 1545 3525 750 Created c1, g^y1, H(K1)\001 +4 2 0 50 0 0 10 0.0000 4 135 1515 3525 750 Created c1, g^y1, H(K1)\001 +4 1 0 50 0 0 10 0.0000 4 150 1455 4800 225 (link is TLS-encrypted)\001 Modified: projects/design-paper/interaction.pdf =================================================================== (Binary files differ)

1 0

[flashproxy/master] Revert "Set UseMicrodescriptors=0 in torrc."
by dcf＠torproject.org 15 Nov '11

15 Nov '11

commit b6f1b3a9213cba29448f28fc0ccbf3986bbd597b Author: David Fifield <david(a)bamsoftware.com> Date: Tue Nov 15 14:42:49 2011 -0800 Revert "Set UseMicrodescriptors=0 in torrc." This reverts commit c1f7a98d7e8a1f8c0df89685d06ca53e790c01fe. A better solution to this was to upgrade the flash proxy bridge to 0.2.3. UseMicrodescriptors isn't present in 0.2.2 clients. The underlying problem is ticket #4013 in trac.torproject.org. --- torrc | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) diff --git a/torrc b/torrc index 98769f4..0bab31c 100644 --- a/torrc +++ b/torrc @@ -5,7 +5,6 @@ UseBridges 1 Bridge 127.0.0.1:9001 -UseMicrodescriptors 0 Socks4Proxy 127.0.0.1:9001 # In case you are not able to receive remote connections on port 9000, comment

1 0

[tor/master] Merge branch 'bug4371_squashed'
by nickm＠torproject.org 15 Nov '11

15 Nov '11

commit c4a4ac7de6d32482fad36ce5af9b1e932cd506cb Merge: 26fcb4b 69dd993 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Nov 15 15:58:00 2011 -0500 Merge branch 'bug4371_squashed' changes/bug4371 | 3 ++ src/common/tortls.c | 55 ++++++++++++++++++++++++++++---------------------- src/common/tortls.h | 7 ++++- src/or/command.c | 8 +++--- 4 files changed, 43 insertions(+), 30 deletions(-)

1 0

[tor/master] Allow up to a 30 days future skew, 48 hours past skew in certs.
by nickm＠torproject.org 15 Nov '11

15 Nov '11

commit 87622e4c7e1a3b5c80e67141de7947d0304b6f31 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Nov 14 22:21:45 2011 -0500 Allow up to a 30 days future skew, 48 hours past skew in certs. --- changes/bug4371 | 3 +++ src/common/tortls.c | 30 ++++++++++++++++-------------- src/common/tortls.h | 3 ++- 3 files changed, 21 insertions(+), 15 deletions(-) diff --git a/changes/bug4371 b/changes/bug4371 new file mode 100644 index 0000000..37e6faa --- /dev/null +++ b/changes/bug4371 @@ -0,0 +1,3 @@ + o Minor bugfixes: + - Tolerate servers with more clock skew than previously. Fixes bug 4371; + bugfix on 0.2.3.6-alpha. diff --git a/src/common/tortls.c b/src/common/tortls.c index 8cf396c..ff0d329 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -212,7 +212,8 @@ static int tor_tls_context_init_one(tor_tls_context_t **ppcontext, static tor_tls_context_t *tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime, int is_client); -static int check_cert_lifetime_internal(const X509 *cert, int tolerance); +static int check_cert_lifetime_internal(const X509 *cert, + int past_tolerance, int future_tolerance); /** Global TLS contexts. We keep them here because nobody else needs * to touch them. */ @@ -960,8 +961,7 @@ tor_tls_cert_is_valid(const tor_cert_t *cert, /* okay, the signature checked out right. Now let's check the check the * lifetime. */ - /*XXXX tolerance might be iffy here */ - if (check_cert_lifetime_internal(cert->cert, 60*60) < 0) + if (check_cert_lifetime_internal(cert->cert, 48*60*60, 30*24*60*60) < 0) return 0; cert_key = X509_get_pubkey(cert->cert); @@ -2062,14 +2062,14 @@ tor_tls_verify(int severity, tor_tls_t *tls, crypto_pk_env_t **identity_key) return r; } -/** Check whether the certificate set on the connection tls is - * expired or not-yet-valid, give or take tolerance - * seconds. Return 0 for valid, -1 for failure. +/** Check whether the certificate set on the connection tls is expired + * give or take past_tolerance seconds, or not-yet-valid give or take + * future_tolerance seconds. Return 0 for valid, -1 for failure. * * NOTE: you should call tor_tls_verify before tor_tls_check_lifetime. */ int -tor_tls_check_lifetime(tor_tls_t *tls, int tolerance) +tor_tls_check_lifetime(tor_tls_t *tls, int past_tolerance, int future_tolerance) { X509 *cert; int r = -1; @@ -2077,7 +2077,7 @@ tor_tls_check_lifetime(tor_tls_t *tls, int tolerance) if (!(cert = SSL_get_peer_certificate(tls->ssl))) goto done; - if (check_cert_lifetime_internal(cert, tolerance) < 0) + if (check_cert_lifetime_internal(cert, past_tolerance, future_tolerance) < 0) goto done; r = 0; @@ -2090,22 +2090,24 @@ tor_tls_check_lifetime(tor_tls_t *tls, int tolerance) return r; } -/** Helper: check whether cert is currently live, give or take - * tolerance seconds. If it is live, return 0. If it is not live, - * log a message and return -1. */ +/** Helper: check whether cert is expired give or take + * past_tolerance seconds, or not-yet-valid give or take + * future_tolerance seconds. If it is live, return 0. If it is not + * live, log a message and return -1. */ static int -check_cert_lifetime_internal(const X509 *cert, int tolerance) +check_cert_lifetime_internal(const X509 *cert, int past_tolerance, + int future_tolerance) { time_t now, t; now = time(NULL); - t = now + tolerance; + t = now + future_tolerance; if (X509_cmp_time(X509_get_notBefore(cert), &t) > 0) { log_cert_lifetime(cert, "not yet valid"); return -1; } - t = now - tolerance; + t = now - past_tolerance; if (X509_cmp_time(X509_get_notAfter(cert), &t) < 0) { log_cert_lifetime(cert, "already expired"); return -1; diff --git a/src/common/tortls.h b/src/common/tortls.h index d0a13cd..6791586 100644 --- a/src/common/tortls.h +++ b/src/common/tortls.h @@ -68,7 +68,8 @@ void tor_tls_free(tor_tls_t *tls); int tor_tls_peer_has_cert(tor_tls_t *tls); tor_cert_t *tor_tls_get_peer_cert(tor_tls_t *tls); int tor_tls_verify(int severity, tor_tls_t *tls, crypto_pk_env_t **identity); -int tor_tls_check_lifetime(tor_tls_t *tls, int tolerance); +int tor_tls_check_lifetime(tor_tls_t *tls, int past_tolerance, + int future_tolerance); int tor_tls_read(tor_tls_t *tls, char *cp, size_t len); int tor_tls_write(tor_tls_t *tls, const char *cp, size_t n); int tor_tls_handshake(tor_tls_t *tls);

1 0

[tor/master] Make certificate skew into a protocol warning
by nickm＠torproject.org 15 Nov '11

15 Nov '11

commit 69dd993a922fcc65e931d816e1a3c916e98133f2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Nov 15 11:56:21 2011 -0500 Make certificate skew into a protocol warning --- src/common/tortls.c | 35 ++++++++++++++++++++--------------- src/common/tortls.h | 6 ++++-- src/or/command.c | 8 ++++---- 3 files changed, 28 insertions(+), 21 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index ff0d329..a41a10d 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -212,7 +212,7 @@ static int tor_tls_context_init_one(tor_tls_context_t **ppcontext, static tor_tls_context_t *tor_tls_context_new(crypto_pk_env_t *identity, unsigned int key_lifetime, int is_client); -static int check_cert_lifetime_internal(const X509 *cert, +static int check_cert_lifetime_internal(int severity, const X509 *cert, int past_tolerance, int future_tolerance); /** Global TLS contexts. We keep them here because nobody else needs @@ -945,7 +945,8 @@ tor_tls_cert_matches_key(const tor_tls_t *tls, const tor_cert_t *cert) * the key is long enough. Return 1 if the cert is good, and 0 if it's bad or * we couldn't check it. */ int -tor_tls_cert_is_valid(const tor_cert_t *cert, +tor_tls_cert_is_valid(int severity, + const tor_cert_t *cert, const tor_cert_t *signing_cert, int check_rsa_1024) { @@ -961,7 +962,8 @@ tor_tls_cert_is_valid(const tor_cert_t *cert, /* okay, the signature checked out right. Now let's check the check the * lifetime. */ - if (check_cert_lifetime_internal(cert->cert, 48*60*60, 30*24*60*60) < 0) + if (check_cert_lifetime_internal(severity, cert->cert, + 48*60*60, 30*24*60*60) < 0) return 0; cert_key = X509_get_pubkey(cert->cert); @@ -1924,7 +1926,7 @@ tor_tls_get_peer_cert(tor_tls_t *tls) /** Warn that a certificate lifetime extends through a certain range. */ static void -log_cert_lifetime(const X509 *cert, const char *problem) +log_cert_lifetime(int severity, const X509 *cert, const char *problem) { BIO *bio = NULL; BUF_MEM *buf; @@ -1934,9 +1936,10 @@ log_cert_lifetime(const X509 *cert, const char *problem) struct tm tm; if (problem) - log_warn(LD_GENERAL, - "Certificate %s: is your system clock set incorrectly?", - problem); + log(severity, LD_GENERAL, + "Certificate %s. Either their clock is set wrong, or your clock " + "is wrong.", + problem); if (!(bio = BIO_new(BIO_s_mem()))) { log_warn(LD_GENERAL, "Couldn't allocate BIO!"); goto end; @@ -1958,9 +1961,9 @@ log_cert_lifetime(const X509 *cert, const char *problem) strftime(mytime, 32, "%b %d %H:%M:%S %Y GMT", tor_gmtime_r(&now, &tm)); - log_warn(LD_GENERAL, - "(certificate lifetime runs from %s through %s. Your time is %s.)", - s1,s2,mytime); + log(severity, LD_GENERAL, + "(certificate lifetime runs from %s through %s. Your time is %s.)", + s1,s2,mytime); end: /* Not expected to get invoked */ @@ -2069,7 +2072,8 @@ tor_tls_verify(int severity, tor_tls_t *tls, crypto_pk_env_t **identity_key) * NOTE: you should call tor_tls_verify before tor_tls_check_lifetime. */ int -tor_tls_check_lifetime(tor_tls_t *tls, int past_tolerance, int future_tolerance) +tor_tls_check_lifetime(int severity, tor_tls_t *tls, + int past_tolerance, int future_tolerance) { X509 *cert; int r = -1; @@ -2077,7 +2081,8 @@ tor_tls_check_lifetime(tor_tls_t *tls, int past_tolerance, int future_tolerance) if (!(cert = SSL_get_peer_certificate(tls->ssl))) goto done; - if (check_cert_lifetime_internal(cert, past_tolerance, future_tolerance) < 0) + if (check_cert_lifetime_internal(severity, cert, + past_tolerance, future_tolerance) < 0) goto done; r = 0; @@ -2095,7 +2100,7 @@ tor_tls_check_lifetime(tor_tls_t *tls, int past_tolerance, int future_tolerance) * future_tolerance seconds. If it is live, return 0. If it is not * live, log a message and return -1. */ static int -check_cert_lifetime_internal(const X509 *cert, int past_tolerance, +check_cert_lifetime_internal(int severity, const X509 *cert, int past_tolerance, int future_tolerance) { time_t now, t; @@ -2104,12 +2109,12 @@ check_cert_lifetime_internal(const X509 *cert, int past_tolerance, t = now + future_tolerance; if (X509_cmp_time(X509_get_notBefore(cert), &t) > 0) { - log_cert_lifetime(cert, "not yet valid"); + log_cert_lifetime(severity, cert, "not yet valid"); return -1; } t = now - past_tolerance; if (X509_cmp_time(X509_get_notAfter(cert), &t) < 0) { - log_cert_lifetime(cert, "already expired"); + log_cert_lifetime(severity, cert, "already expired"); return -1; } diff --git a/src/common/tortls.h b/src/common/tortls.h index 6791586..673f18d 100644 --- a/src/common/tortls.h +++ b/src/common/tortls.h @@ -68,7 +68,8 @@ void tor_tls_free(tor_tls_t *tls); int tor_tls_peer_has_cert(tor_tls_t *tls); tor_cert_t *tor_tls_get_peer_cert(tor_tls_t *tls); int tor_tls_verify(int severity, tor_tls_t *tls, crypto_pk_env_t **identity); -int tor_tls_check_lifetime(tor_tls_t *tls, int past_tolerance, +int tor_tls_check_lifetime(int severity, + tor_tls_t *tls, int past_tolerance, int future_tolerance); int tor_tls_read(tor_tls_t *tls, char *cp, size_t len); int tor_tls_write(tor_tls_t *tls, const char *cp, size_t n); @@ -124,7 +125,8 @@ int tor_tls_get_my_certs(int server, crypto_pk_env_t *tor_tls_get_my_client_auth_key(void); crypto_pk_env_t *tor_tls_cert_get_key(tor_cert_t *cert); int tor_tls_cert_matches_key(const tor_tls_t *tls, const tor_cert_t *cert); -int tor_tls_cert_is_valid(const tor_cert_t *cert, +int tor_tls_cert_is_valid(int severity, + const tor_cert_t *cert, const tor_cert_t *signing_cert, int check_rsa_1024); diff --git a/src/or/command.c b/src/or/command.c index 5d0ebaa..a963d42 100644 --- a/src/or/command.c +++ b/src/or/command.c @@ -991,9 +991,9 @@ command_process_cert_cell(var_cell_t *cell, or_connection_t *conn) if (! tor_tls_cert_matches_key(conn->tls, link_cert)) { ERR("The link certificate didn't match the TLS public key"); } - if (! tor_tls_cert_is_valid(link_cert, id_cert, 0)) + if (! tor_tls_cert_is_valid(LOG_PROTOCOL_WARN, link_cert, id_cert, 0)) ERR("The link certificate was not valid"); - if (! tor_tls_cert_is_valid(id_cert, id_cert, 1)) + if (! tor_tls_cert_is_valid(LOG_PROTOCOL_WARN, id_cert, id_cert, 1)) ERR("The ID certificate was not valid"); conn->handshake_state->authenticated = 1; @@ -1026,9 +1026,9 @@ command_process_cert_cell(var_cell_t *cell, or_connection_t *conn) ERR("The certs we wanted were missing"); /* Remember these certificates so we can check an AUTHENTICATE cell */ - if (! tor_tls_cert_is_valid(auth_cert, id_cert, 1)) + if (! tor_tls_cert_is_valid(LOG_PROTOCOL_WARN, auth_cert, id_cert, 1)) ERR("The authentication certificate was not valid"); - if (! tor_tls_cert_is_valid(id_cert, id_cert, 1)) + if (! tor_tls_cert_is_valid(LOG_PROTOCOL_WARN, id_cert, id_cert, 1)) ERR("The ID certificate was not valid"); log_info(LD_OR, "Got some good certificates from %s:%d: "

1 0