June 2012 - tor-commits - lists.torproject.org

[tor/master] Make get_mozilla_ciphers script a little more regexy and readable
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit a6a905cc11da1f13db08e43b17fb32ed5295a23e Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 14 16:45:38 2012 -0400 Make get_mozilla_ciphers script a little more regexy and readable --- src/common/get_mozilla_ciphers.py | 123 +++++++++++++++++++------------------ 1 files changed, 62 insertions(+), 61 deletions(-) diff --git a/src/common/get_mozilla_ciphers.py b/src/common/get_mozilla_ciphers.py index 59f8b59..378ce01 100644 --- a/src/common/get_mozilla_ciphers.py +++ b/src/common/get_mozilla_ciphers.py @@ -1,54 +1,64 @@ #!/usr/bin/python +# coding=utf-8 # Copyright 2011, The Tor Project, Inc -# original version by Arturo Filastò +# original version by Arturo FilastÃ² # This script parses Firefox and OpenSSL sources, and uses this information # to generate a ciphers.inc file. -# Read the cpp file to understand what Ciphers map to what name +import re + +##### +# Read the cpp file to understand what Ciphers map to what name : +# Make "ciphers" a map from name used in the javascript to a cipher macro name fileA = open('security/manager/ssl/src/nsNSSComponent.cpp','r') -start = None -lines = fileA.readlines() -for i, line in enumerate(lines): - if line.strip().startswith('static CipherPref CipherPrefs'): +# The input format is a file containing exactly one section of the form: +# static CipherPref CipherPrefs[] = { +# {"name", MACRO_NAME}, // comment +# ... +# {NULL, 0} +# } + +inCipherSection = False +cipherLines = [] +for line in fileA: + if line.startswith('static CipherPref CipherPrefs'): # Get the starting boundary of the Cipher Preferences - start = i - - if start and line.strip().startswith('{NULL, 0}'): - # Get the ending boundary of the Cipher Prefs - end = i - break + inCipherSection = True + elif inCipherSection: + line = line.strip() + if line.startswith('{NULL, 0}'): + # At the ending boundary of the Cipher Prefs + break + else: + cipherLines.append(line) fileA.close() # Parse the lines and put them into a dict ciphers = {} -for x in lines[start:end]: - line = x.strip() - if line.startswith('{'): - for i, y in enumerate(line): - if y == '}': - parsed = line[1:i] - key, value = parsed.split(',') - ciphers[key.replace("\"","")] = value.strip() - -# Read the JS file to understand what ciphers are enabled +for line in cipherLines: + m = re.search(r'^{\s*\"([^\"]+)\",\s*(\S*)\s*}', line) + if m: + key,value = m.groups() + ciphers[key] = value + +##### +# Read the JS file to understand what ciphers are enabled. The format is +# pref("name", true/false); +# Build a map enabled_ciphers from javascript name to "true" or "false", +# and an (unordered!) list of the macro names for those ciphers that are +# enabled. fileB = open('netwerk/base/public/security-prefs.js', 'r') enabled_ciphers = {} -for x in fileB.readlines(): - start = None - line = x.strip() - for i, y in enumerate(line): - if y == "(": - start = i - if start and y == ")": - end = i - if start: - inner = line[start+1:end] - key, value = inner.replace("\"","").split(",") - if key.startswith('security.ssl3'): - enabled_ciphers[key.strip()] = value.strip() +for line in fileB: + m = re.match(r'pref$\"([^\"]+)\"\s*,\s*(\S*)\s*$', line) + if not m: + continue + key, val = m.groups() + if key.startswith("security.ssl3"): + enabled_ciphers[key] = val fileB.close() used_ciphers = [] @@ -56,27 +66,21 @@ for k, v in enabled_ciphers.items(): if v == "true": used_ciphers.append(ciphers[k]) - oSSLinclude = ('/usr/include/openssl/ssl3.h', '/usr/include/openssl/ssl.h', '/usr/include/openssl/ssl2.h', '/usr/include/openssl/ssl23.h', '/usr/include/openssl/tls1.h') +##### +# This reads the hex code for the ciphers that are used by firefox. +# sslProtoD is set to a map from macro name to macro value in sslproto.h; +# cipher_codes is set to an (unordered!) list of these hex values. sslProto = open('security/nss/lib/ssl/sslproto.h', 'r') sslProtoD = {} -# This reads the HEX code for the ciphers that are used -# by firefox. -for x in sslProto.readlines(): - line = x.strip() - if line.lower().startswith("#define"): - # If I ever see somebody putting mixed tab - # and spaces I will cut their fingers :) - line = line.replace('\t', ' ') - key = line.split(' ')[1] - value = line.split(' ')[-1] - key = key.strip() - value = value.strip() - print "%s %s\n\n" % (key, value) +for line in sslProto: + m = re.match('#define\s+(\S+)\s+(\S+)', line) + if m: + key, value = m.groups() sslProtoD[key] = value sslProto.close() @@ -84,23 +88,23 @@ cipher_codes = [] for x in used_ciphers: cipher_codes.append(sslProtoD[x].lower()) +#### +# Now read through all the openssl include files, and try to find the openssl +# macro names for those files. cipher_hex = {} for fl in oSSLinclude: fp = open(fl, 'r') - for x in fp.readlines(): - line = x.strip() - if line.lower().startswith("#define"): - line = line.replace('\t', ' ') - value = line.split(' ')[1] - key = line.split(' ')[-1] - key = key.strip() - value = value.strip() + for line in fp.readlines(): + m = re.match('#define\s+(\S+)\s+(\S+)', line) + if m: + value,key = m.groups() if key.startswith('0x'): key = key.replace('0x0300','0x').lower() #print "%s %s" % (key, value) cipher_hex[key] = value fp.close() +# Now generate the output. for x in cipher_codes: try: res = """#ifdef %s @@ -109,9 +113,6 @@ for x in cipher_codes: XCIPHER(%s, %s) #endif""" % (cipher_hex[x], x, cipher_hex[x], x, cipher_hex[x]) print res - except: + except KeyError: print "Not found %s" % x - -#print enabled_ciphers -#print ciphers

1 0

[tor/master] Try to make get_mozilla_ciphers output the right macros in the right order
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit c5dca8f20886f797d079e6de1547dd2e42a9b222 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 14 17:53:17 2012 -0400 Try to make get_mozilla_ciphers output the right macros in the right order --- src/common/get_mozilla_ciphers.py | 77 +++++++++++++++++++++++++++++++----- 1 files changed, 66 insertions(+), 11 deletions(-) diff --git a/src/common/get_mozilla_ciphers.py b/src/common/get_mozilla_ciphers.py index 9b8af2e..629b4dc 100644 --- a/src/common/get_mozilla_ciphers.py +++ b/src/common/get_mozilla_ciphers.py @@ -54,11 +54,35 @@ fileA.close() # Parse the lines and put them into a dict ciphers = {} +cipher_pref = {} for line in cipherLines: m = re.search(r'^{\s*\"([^\"]+)\",\s*(\S*)\s*}', line) if m: key,value = m.groups() ciphers[key] = value + cipher_pref[value] = key + +#### +# Now find the correct order for the ciphers +fileC = open(ff('security/nss/lib/ssl/sslenum.c'), 'r') +firefox_ciphers = [] +inEnum=False +for line in fileC: + if not inEnum: + if "SSL_ImplementedCiphers[] =" in line: + inEnum = True + continue + + if line.startswith("};"): + break + + m = re.match(r'^\s*([A-Z_0-9]+)\s*', line) + if m: + if m.group(1) == "0": + break + firefox_ciphers.append(m.group(1)) + +fileC.close() ##### # Read the JS file to understand what ciphers are enabled. The format is @@ -111,28 +135,59 @@ for x in used_ciphers: #### # Now read through all the openssl include files, and try to find the openssl # macro names for those files. -cipher_hex = {} +openssl_macro_by_hex = {} +all_openssl_macros = {} for fl in oSSLinclude: fp = open(ossl(fl), 'r') for line in fp.readlines(): m = re.match('#define\s+(\S+)\s+(\S+)', line) if m: value,key = m.groups() - if key.startswith('0x'): + if key.startswith('0x') and "_CK_" in value: key = key.replace('0x0300','0x').lower() #print "%s %s" % (key, value) - cipher_hex[key] = value + openssl_macro_by_hex[key] = value + all_openssl_macros[value]=key fp.close() # Now generate the output. -for x in cipher_codes: +print """\ +/* This is an include file used to define the list of ciphers clients should + * advertise. Before including it, you should define the CIPHER and XCIPHER + * macros. + * + * This file was automatically generated by get_mozilla_ciphers.py. + */""" +# Go in order by the order in CipherPrefs +for firefox_macro in firefox_ciphers: + try: - res = """#ifdef %s - CIPHER(%s, %s) - #else - XCIPHER(%s, %s) - #endif""" % (cipher_hex[x], x, cipher_hex[x], x, cipher_hex[x]) - print res + js_cipher_name = cipher_pref[firefox_macro] except KeyError: - print "Not found %s" % x + # This one has no javascript preference. + continue + + # The cipher needs to be enabled in security-prefs.js + if enabled_ciphers.get(js_cipher_name, 'false') != 'true': + continue + hexval = sslProtoD[firefox_macro] + + try: + openssl_macro = openssl_macro_by_hex[hexval.lower()] + openssl_macro = openssl_macro.replace("_CK_", "_TXT_") + if openssl_macro not in all_openssl_macros: + raise KeyError() + format = {'hex':hexval, 'macro':openssl_macro, 'note':""} + except KeyError: + # openssl doesn't have a macro for this. + format = {'hex':hexval, 'macro':firefox_macro, + 'note':"/* No openssl macro found for "+hexval+" */\n"} + + res = """\ +%(note)s#ifdef %(macro)s + CIPHER(%(hex)s, %(macro)s) +#else + XCIPHER(%(hex)s, %(macro)s) +#endif""" % format + print res

1 0

[tor/master] Have get_mozilla_ciphers take sourcedirs as arguments
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit 092b9aca8cb8a63022d47afc38b385957f1a59fb Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 14 16:53:39 2012 -0400 Have get_mozilla_ciphers take sourcedirs as arguments --- src/common/get_mozilla_ciphers.py | 34 +++++++++++++++++++++++++++------- 1 files changed, 27 insertions(+), 7 deletions(-) diff --git a/src/common/get_mozilla_ciphers.py b/src/common/get_mozilla_ciphers.py index 378ce01..9b8af2e 100644 --- a/src/common/get_mozilla_ciphers.py +++ b/src/common/get_mozilla_ciphers.py @@ -5,13 +5,30 @@ # This script parses Firefox and OpenSSL sources, and uses this information # to generate a ciphers.inc file. +# +# It takes two arguments: the location of a firefox source directory, and the +# location of an openssl source directory. +import os import re +import sys + +if len(sys.argv) != 3: + print >>sys.stderr, "Syntax: get_mozilla_ciphers.py <firefox-source-dir> <openssl-source-dir>" + sys.exit(1) + +ff_root = sys.argv[1] +ossl_root = sys.argv[2] + +def ff(s): + return os.path.join(ff_root, s) +def ossl(s): + return os.path.join(ossl_root, s) ##### # Read the cpp file to understand what Ciphers map to what name : # Make "ciphers" a map from name used in the javascript to a cipher macro name -fileA = open('security/manager/ssl/src/nsNSSComponent.cpp','r') +fileA = open(ff('security/manager/ssl/src/nsNSSComponent.cpp'),'r') # The input format is a file containing exactly one section of the form: # static CipherPref CipherPrefs[] = { @@ -49,7 +66,7 @@ for line in cipherLines: # Build a map enabled_ciphers from javascript name to "true" or "false", # and an (unordered!) list of the macro names for those ciphers that are # enabled. -fileB = open('netwerk/base/public/security-prefs.js', 'r') +fileB = open(ff('netwerk/base/public/security-prefs.js'), 'r') enabled_ciphers = {} for line in fileB: @@ -66,15 +83,18 @@ for k, v in enabled_ciphers.items(): if v == "true": used_ciphers.append(ciphers[k]) -oSSLinclude = ('/usr/include/openssl/ssl3.h', '/usr/include/openssl/ssl.h', - '/usr/include/openssl/ssl2.h', '/usr/include/openssl/ssl23.h', - '/usr/include/openssl/tls1.h') +#oSSLinclude = ('/usr/include/openssl/ssl3.h', '/usr/include/openssl/ssl.h', +# '/usr/include/openssl/ssl2.h', '/usr/include/openssl/ssl23.h', +# '/usr/include/openssl/tls1.h') +oSSLinclude = ('ssl/ssl3.h', 'ssl/ssl.h', + 'ssl/ssl2.h', 'ssl/ssl23.h', + 'ssl/tls1.h') ##### # This reads the hex code for the ciphers that are used by firefox. # sslProtoD is set to a map from macro name to macro value in sslproto.h; # cipher_codes is set to an (unordered!) list of these hex values. -sslProto = open('security/nss/lib/ssl/sslproto.h', 'r') +sslProto = open(ff('security/nss/lib/ssl/sslproto.h'), 'r') sslProtoD = {} for line in sslProto: @@ -93,7 +113,7 @@ for x in used_ciphers: # macro names for those files. cipher_hex = {} for fl in oSSLinclude: - fp = open(fl, 'r') + fp = open(ossl(fl), 'r') for line in fp.readlines(): m = re.match('#define\s+(\S+)\s+(\S+)', line) if m:

1 0

[tor/master] get_mozilla_ciphers: output lowercase hex.
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit c2ed9a2940fa33bad94efa26fac9b45446731b67 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 14 18:19:21 2012 -0400 get_mozilla_ciphers: output lowercase hex. --- src/common/get_mozilla_ciphers.py | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/common/get_mozilla_ciphers.py b/src/common/get_mozilla_ciphers.py index 629b4dc..61e8c4d 100644 --- a/src/common/get_mozilla_ciphers.py +++ b/src/common/get_mozilla_ciphers.py @@ -171,7 +171,7 @@ for firefox_macro in firefox_ciphers: if enabled_ciphers.get(js_cipher_name, 'false') != 'true': continue - hexval = sslProtoD[firefox_macro] + hexval = sslProtoD[firefox_macro].lower() try: openssl_macro = openssl_macro_by_hex[hexval.lower()]

1 0

[tor/master] Merge branch 'bug4744_squashed'
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit aa1fc73e3328e64e02c8bc881d6ffb6590191eea Merge: 5a3d963 df6bd47 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 13 12:09:13 2012 -0400 Merge branch 'bug4744_squashed' changes/bug4744 | 4 + changes/prop198 | 12 +++ src/common/ciphers.inc | 47 ++++++++- src/common/get_mozilla_ciphers.py | 192 +++++++++++++++++++++++++++++++++++++ src/common/tortls.c | 72 ++++++++++++-- 5 files changed, 313 insertions(+), 14 deletions(-)

1 0

[tor/master] get_mozilla_ciphers: look at ssl3con.c, not sslenum.c
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit bd0657602d54be7b0c9032c40f73a0b738b0282c Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 14 18:36:58 2012 -0400 get_mozilla_ciphers: look at ssl3con.c, not sslenum.c --- src/common/get_mozilla_ciphers.py | 8 +++----- 1 files changed, 3 insertions(+), 5 deletions(-) diff --git a/src/common/get_mozilla_ciphers.py b/src/common/get_mozilla_ciphers.py index 61e8c4d..f925031 100644 --- a/src/common/get_mozilla_ciphers.py +++ b/src/common/get_mozilla_ciphers.py @@ -64,22 +64,20 @@ for line in cipherLines: #### # Now find the correct order for the ciphers -fileC = open(ff('security/nss/lib/ssl/sslenum.c'), 'r') +fileC = open(ff('security/nss/lib/ssl/ssl3con.c'), 'r') firefox_ciphers = [] inEnum=False for line in fileC: if not inEnum: - if "SSL_ImplementedCiphers[] =" in line: + if "ssl3CipherSuiteCfg cipherSuites[" in line: inEnum = True continue if line.startswith("};"): break - m = re.match(r'^\s*([A-Z_0-9]+)\s*', line) + m = re.match(r'^\s*\{\s*([A-Z_0-9]+),', line) if m: - if m.group(1) == "0": - break firefox_ciphers.append(m.group(1)) fileC.close()

1 0

[tor/master] Change smartlist_create->smartlist_new in bug4744 branch as merged to master
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit 37ef4f1689b51f2c78a1f02ec466b2fd34d11636 Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Jun 13 12:16:02 2012 -0400 Change smartlist_create->smartlist_new in bug4744 branch as merged to master --- src/common/tortls.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index cce25a8..53bcc98 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1460,7 +1460,7 @@ rectify_client_ciphers(STACK_OF(SSL_CIPHER) **ciphers) /* We need to set CLIENT_CIPHER_STACK to an array of the ciphers * we want to use/advertise. */ int i = 0, j = 0; - smartlist_t *unsupported = smartlist_create(); + smartlist_t *unsupported = smartlist_new(); /* First, create a dummy SSL_CIPHER for every cipher. */ CLIENT_CIPHER_DUMMIES =

1 0

[tor/master] Implement the client side of proposal 198
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit df6bd478eeb8164b99156bf9528e1b058fe491fd Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 15 15:32:18 2012 -0400 Implement the client side of proposal 198 This is a feature removal: we no longer fake any ciphersuite other than the not-really-standard SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA (0xfeff). This change will let servers rely on our actually supporting what we claim to support, and thereby let Tor migrate to better TLS ciphersuites. As a drawback, Tor instances that use old openssl versions and openssl builds with ciphers disabled will no longer give the "firefox" cipher list. --- changes/prop198 | 12 ++++++++ src/common/tortls.c | 72 +++++++++++++++++++++++++++++++++++++++++++------- 2 files changed, 74 insertions(+), 10 deletions(-) diff --git a/changes/prop198 b/changes/prop198 new file mode 100644 index 0000000..fd66686 --- /dev/null +++ b/changes/prop198 @@ -0,0 +1,12 @@ + o Removed features: + + - Remove support for clients claiming to support any standard + ciphersuites that we can actually provide. (As of modern + OpenSSL versions, it's not necessary to fake any standard + ciphersuite, and doing so prevents us from using better + ciphersuites in the future, since servers can't know whether an + advertised ciphersuite is really supported or not.) Some + hosts--notably, ones with very old versions of OpenSSL or where + OpenSSL has been built with ECC disabled-- will stand out + because of this change; TBB users should not be affected. + This implements the client side of proposal 198. diff --git a/src/common/tortls.c b/src/common/tortls.c index 4c9d218..6ffd822 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -593,6 +593,9 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa, * our OpenSSL doesn't know about. */ static const char CLIENT_CIPHER_LIST[] = #include "./ciphers.inc" + /* Tell it not to use SSLv2 ciphers, so that it can select an SSLv3 version + * of any cipher we say. */ + "!SSLv2" ; #undef CIPHER #undef XCIPHER @@ -984,11 +987,35 @@ tor_tls_server_info_callback(const SSL *ssl, int type, int val) } #endif +/** Explain which ciphers we're missing. */ +static void +log_unsupported_ciphers(smartlist_t *unsupported) +{ + char *joined; + + log_notice(LD_NET, "We weren't able to find support for all of the " + "TLS ciphersuites that we wanted to advertise. This won't " + "hurt security, but it might make your Tor (if run as a client) " + "more easy for censors to block."); + + if (SSLeay() < 0x10000000L) { + log_notice(LD_NET, "To correct this, use a more recent OpenSSL, " + "built without disabling any secure ciphers or features."); + } else { + log_notice(LD_NET, "To correct this, use a version of OpenSSL " + "built with none of its ciphers disabled."); + } + + joined = smartlist_join_strings(unsupported, ":", 0, NULL); + log_info(LD_NET, "The unsupported ciphers were: %s", joined); + tor_free(joined); +} + /** Replace *<b>ciphers</b> with a new list of SSL ciphersuites: specifically, - * a list designed to mimic a common web browser. Some of the ciphers in the - * list won't actually be implemented by OpenSSL: that's okay so long as the - * server doesn't select them, and the server won't select anything besides - * what's in SERVER_CIPHER_LIST. + * a list designed to mimic a common web browser. We might not be able to do + * that if OpenSSL doesn't support all the ciphers we want. Some of the + * ciphers in the list won't actually be implemented by OpenSSL: that's okay + * so long as the server doesn't select them. * * [If the server <b>does</b> select a bogus cipher, we won't crash or * anything; we'll just fail later when we try to look up the cipher in @@ -1000,14 +1027,17 @@ rectify_client_ciphers(STACK_OF(SSL_CIPHER) **ciphers) #ifdef V2_HANDSHAKE_CLIENT if (PREDICT_UNLIKELY(!CLIENT_CIPHER_STACK)) { /* We need to set CLIENT_CIPHER_STACK to an array of the ciphers - * we want.*/ + * we want to use/advertise. */ int i = 0, j = 0; + smartlist_t *unsupported = smartlist_create(); /* First, create a dummy SSL_CIPHER for every cipher. */ CLIENT_CIPHER_DUMMIES = tor_malloc_zero(sizeof(SSL_CIPHER)*N_CLIENT_CIPHERS); for (i=0; i < N_CLIENT_CIPHERS; ++i) { CLIENT_CIPHER_DUMMIES[i].valid = 1; + /* The "3<<24" here signifies that the cipher is supposed to work with + * SSL3 and TLS1. */ CLIENT_CIPHER_DUMMIES[i].id = CLIENT_CIPHER_INFO_LIST[i].id | (3<<24); CLIENT_CIPHER_DUMMIES[i].name = CLIENT_CIPHER_INFO_LIST[i].name; } @@ -1022,27 +1052,49 @@ rectify_client_ciphers(STACK_OF(SSL_CIPHER) **ciphers) } /* Then copy as many ciphers as we can from the good list, inserting - * dummies as needed. */ - j=0; - for (i = 0; i < N_CLIENT_CIPHERS; ) { + * dummies as needed. Let j be an index into list of ciphers we have + * (*ciphers) and let i be an index into the ciphers we want + * (CLIENT_INFO_CIPHER_LIST). We are building a list of ciphers in + * CLIENT_CIPHER_STACK. + */ + for (i = j = 0; i < N_CLIENT_CIPHERS; ) { SSL_CIPHER *cipher = NULL; if (j < sk_SSL_CIPHER_num(*ciphers)) cipher = sk_SSL_CIPHER_value(*ciphers, j); if (cipher && ((cipher->id >> 24) & 0xff) != 3) { - log_debug(LD_NET, "Skipping v2 cipher %s", cipher->name); + /* Skip over non-v3 ciphers entirely. (This should no longer be + * needed, thanks to saying !SSLv2 above.) */ + log_debug(LD_NET, "Skipping v%d cipher %s", + (int)((cipher->id>>24) & 0xff), + cipher->name); ++j; } else if (cipher && (cipher->id & 0xffff) == CLIENT_CIPHER_INFO_LIST[i].id) { + /* "cipher" is the cipher we expect. Put it on the list. */ log_debug(LD_NET, "Found cipher %s", cipher->name); sk_SSL_CIPHER_push(CLIENT_CIPHER_STACK, cipher); ++j; ++i; - } else { + } else if (!strcmp(CLIENT_CIPHER_DUMMIES[i].name, + "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA")) { + /* We found bogus cipher 0xfeff, which OpenSSL doesn't support and + * never has. For this one, we need a dummy. */ log_debug(LD_NET, "Inserting fake %s", CLIENT_CIPHER_DUMMIES[i].name); sk_SSL_CIPHER_push(CLIENT_CIPHER_STACK, &CLIENT_CIPHER_DUMMIES[i]); ++i; + } else { + /* OpenSSL doesn't have this one. */ + log_debug(LD_NET, "Completely omitting unsupported cipher %s", + CLIENT_CIPHER_INFO_LIST[i].name); + smartlist_add(unsupported, (char*) CLIENT_CIPHER_INFO_LIST[i].name); + ++i; } } + + if (smartlist_len(unsupported)) + log_unsupported_ciphers(unsupported); + + smartlist_free(unsupported); } sk_SSL_CIPHER_free(*ciphers);

1 0

[tor/master] Change our ciphersuite list to match ff8
by nickm＠torproject.org 13 Jun '12

13 Jun '12

commit 89c16890095d63cc6f56a378108efc3d3f063204 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue May 15 15:25:54 2012 -0400 Change our ciphersuite list to match ff8 --- changes/bug4744 | 4 +++ src/common/ciphers.inc | 47 +++++++++++++++++++++++++++++++++--- src/common/get_mozilla_ciphers.py | 1 + 3 files changed, 48 insertions(+), 4 deletions(-) diff --git a/changes/bug4744 b/changes/bug4744 new file mode 100644 index 0000000..1563cd1 --- /dev/null +++ b/changes/bug4744 @@ -0,0 +1,4 @@ + o Major features: + - Update cipher cipher list to match Firefox 8 and later. Fix for + issue 4744. + diff --git a/src/common/ciphers.inc b/src/common/ciphers.inc index c84620d..137d78b 100644 --- a/src/common/ciphers.inc +++ b/src/common/ciphers.inc @@ -1,6 +1,9 @@ /* This is an include file used to define the list of ciphers clients should * advertise. Before including it, you should define the CIPHER and XCIPHER - * macros. */ + * macros. + * + * This file was automatically generated by get_mozilla_ciphers.py. + */ #ifdef TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA CIPHER(0xc00a, TLS1_TXT_ECDHE_ECDSA_WITH_AES_256_CBC_SHA) #else @@ -11,6 +14,16 @@ #else XCIPHER(0xc014, TLS1_TXT_ECDHE_RSA_WITH_AES_256_CBC_SHA) #endif +#ifdef TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA + CIPHER(0x0088, TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA) +#else + XCIPHER(0x0088, TLS1_TXT_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA) +#endif +#ifdef TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA + CIPHER(0x0087, TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA) +#else + XCIPHER(0x0087, TLS1_TXT_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA) +#endif #ifdef TLS1_TXT_DHE_RSA_WITH_AES_256_SHA CIPHER(0x0039, TLS1_TXT_DHE_RSA_WITH_AES_256_SHA) #else @@ -31,6 +44,11 @@ #else XCIPHER(0xc005, TLS1_TXT_ECDH_ECDSA_WITH_AES_256_CBC_SHA) #endif +#ifdef TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA + CIPHER(0x0084, TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA) +#else + XCIPHER(0x0084, TLS1_TXT_RSA_WITH_CAMELLIA_256_CBC_SHA) +#endif #ifdef TLS1_TXT_RSA_WITH_AES_256_SHA CIPHER(0x0035, TLS1_TXT_RSA_WITH_AES_256_SHA) #else @@ -56,6 +74,16 @@ #else XCIPHER(0xc013, TLS1_TXT_ECDHE_RSA_WITH_AES_128_CBC_SHA) #endif +#ifdef TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA + CIPHER(0x0045, TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA) +#else + XCIPHER(0x0045, TLS1_TXT_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA) +#endif +#ifdef TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA + CIPHER(0x0044, TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA) +#else + XCIPHER(0x0044, TLS1_TXT_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA) +#endif #ifdef TLS1_TXT_DHE_RSA_WITH_AES_128_SHA CIPHER(0x0033, TLS1_TXT_DHE_RSA_WITH_AES_128_SHA) #else @@ -86,6 +114,16 @@ #else XCIPHER(0xc004, TLS1_TXT_ECDH_ECDSA_WITH_AES_128_CBC_SHA) #endif +#ifdef TLS1_TXT_RSA_WITH_SEED_SHA + CIPHER(0x0096, TLS1_TXT_RSA_WITH_SEED_SHA) +#else + XCIPHER(0x0096, TLS1_TXT_RSA_WITH_SEED_SHA) +#endif +#ifdef TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA + CIPHER(0x0041, TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA) +#else + XCIPHER(0x0041, TLS1_TXT_RSA_WITH_CAMELLIA_128_CBC_SHA) +#endif #ifdef SSL3_TXT_RSA_RC4_128_MD5 CIPHER(0x0004, SSL3_TXT_RSA_RC4_128_MD5) #else @@ -131,10 +169,11 @@ #else XCIPHER(0xc003, TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA) #endif -#ifdef SSL3_TXT_RSA_FIPS_WITH_3DES_EDE_CBC_SHA - CIPHER(0xfeff, SSL3_TXT_RSA_FIPS_WITH_3DES_EDE_CBC_SHA) +/* No openssl macro found for 0xfeff */ +#ifdef SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA + CIPHER(0xfeff, SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA) #else - XCIPHER(0xfeff, SSL3_TXT_RSA_FIPS_WITH_3DES_EDE_CBC_SHA) + XCIPHER(0xfeff, SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA) #endif #ifdef SSL3_TXT_RSA_DES_192_CBC3_SHA CIPHER(0x000a, SSL3_TXT_RSA_DES_192_CBC3_SHA) diff --git a/src/common/get_mozilla_ciphers.py b/src/common/get_mozilla_ciphers.py index f925031..c7e9a84 100644 --- a/src/common/get_mozilla_ciphers.py +++ b/src/common/get_mozilla_ciphers.py @@ -2,6 +2,7 @@ # coding=utf-8 # Copyright 2011, The Tor Project, Inc # original version by Arturo Filastò +# See LICENSE for licensing information # This script parses Firefox and OpenSSL sources, and uses this information # to generate a ciphers.inc file.

1 0

[metrics-web/master] Add daily EC2 bridges to database.
by karsten＠torproject.org 13 Jun '12

13 Jun '12

commit 1d4fbeb5c60ea873cf7920b575a8af781027394b Author: Karsten Loesing <karsten.loesing(a)gmx.net> Date: Wed Jun 13 17:10:38 2012 +0200 Add daily EC2 bridges to database. --- db/tordir.sql | 1 + .../ernie/cron/ConsensusStatsFileHandler.java | 60 +++++++++++++------- .../ernie/cron/SanitizedBridgesReader.java | 7 ++- 3 files changed, 45 insertions(+), 23 deletions(-) diff --git a/db/tordir.sql b/db/tordir.sql index e7c33f9..94c9320 100644 --- a/db/tordir.sql +++ b/db/tordir.sql @@ -860,6 +860,7 @@ $$ LANGUAGE plpgsql; CREATE TABLE bridge_network_size ( "date" DATE NOT NULL, avg_running INTEGER NOT NULL, + avg_running_ec2 INTEGER NOT NULL, CONSTRAINT bridge_network_size_pkey PRIMARY KEY(date) ); diff --git a/src/org/torproject/ernie/cron/ConsensusStatsFileHandler.java b/src/org/torproject/ernie/cron/ConsensusStatsFileHandler.java index fccb29b..1babb94 100644 --- a/src/org/torproject/ernie/cron/ConsensusStatsFileHandler.java +++ b/src/org/torproject/ernie/cron/ConsensusStatsFileHandler.java @@ -109,14 +109,17 @@ public class ConsensusStatsFileHandler { continue; } String[] parts = line.split(","); - if (parts.length != 2) { + String dateTime = parts[0]; + if (parts.length == 2) { + this.bridgesRaw.put(dateTime, line + ",0"); + } else if (parts.length == 3) { + this.bridgesRaw.put(dateTime, line); + } else { this.logger.warning("Corrupt line '" + line + "' in file " + this.bridgeConsensusStatsRawFile.getAbsolutePath() + "! Aborting to read this file!"); break; } - String dateTime = parts[0]; - this.bridgesRaw.put(dateTime, line); } br.close(); this.logger.fine("Finished reading file " @@ -133,9 +136,10 @@ public class ConsensusStatsFileHandler { * Adds the intermediate results of the number of running bridges in a * given bridge status to the existing observations. */ - public void addBridgeConsensusResults(long publishedMillis, int running) { + public void addBridgeConsensusResults(long publishedMillis, int running, + int runningEc2Bridges) { String published = dateTimeFormat.format(publishedMillis); - String line = published + "," + running; + String line = published + "," + running + "," + runningEc2Bridges; if (!this.bridgesRaw.containsKey(published)) { this.logger.finer("Adding new bridge numbers: " + line); this.bridgesRaw.put(published, line); @@ -160,7 +164,7 @@ public class ConsensusStatsFileHandler { * final results. */ if (!this.bridgesRaw.isEmpty()) { String tempDate = null; - int brunning = 0, statuses = 0; + int brunning = 0, brunningEc2 = 0, statuses = 0; Iterator<String> it = this.bridgesRaw.values().iterator(); boolean haveWrittenFinalLine = false; while (it.hasNext() || !haveWrittenFinalLine) { @@ -171,7 +175,8 @@ public class ConsensusStatsFileHandler { /* Only write results if we have seen at least half of all * statuses. */ if (statuses >= 24) { - String line = "," + (brunning / statuses); + String line = "," + (brunning / statuses) + "," + + (brunningEc2 / statuses); /* Are our results new? */ if (!this.bridgesPerDay.containsKey(tempDate)) { this.logger.finer("Adding new average bridge numbers: " @@ -184,14 +189,16 @@ public class ConsensusStatsFileHandler { this.bridgesPerDay.put(tempDate, line); } } - brunning = statuses = 0; + brunning = brunningEc2 = statuses = 0; haveWrittenFinalLine = (next == null); } /* Sum up number of running bridges. */ if (next != null) { tempDate = next.substring(0, 10); statuses++; - brunning += Integer.parseInt(next.split(",")[1]); + String[] parts = next.split(","); + brunning += Integer.parseInt(parts[1]); + brunningEc2 += Integer.parseInt(parts[2]); } } } @@ -203,7 +210,7 @@ public class ConsensusStatsFileHandler { this.bridgeConsensusStatsRawFile.getParentFile().mkdirs(); BufferedWriter bw = new BufferedWriter( new FileWriter(this.bridgeConsensusStatsRawFile)); - bw.append("datetime,brunning\n"); + bw.append("datetime,brunning,brunningec2\n"); for (String line : this.bridgesRaw.values()) { bw.append(line + "\n"); } @@ -226,39 +233,50 @@ public class ConsensusStatsFileHandler { conn.setAutoCommit(false); Statement statement = conn.createStatement(); ResultSet rs = statement.executeQuery( - "SELECT date, avg_running FROM bridge_network_size"); + "SELECT date, avg_running, avg_running_ec2 " + + "FROM bridge_network_size"); while (rs.next()) { String date = rs.getDate(1).toString(); if (insertRows.containsKey(date)) { String insertRow = insertRows.remove(date); - long newAvgRunning = Long.parseLong(insertRow.substring(1)); + String[] parts = insertRow.substring(1).split(","); + long newAvgRunning = Long.parseLong(parts[0]); + long newAvgRunningEc2 = Long.parseLong(parts[1]); long oldAvgRunning = rs.getLong(2); - if (newAvgRunning != oldAvgRunning) { + long oldAvgRunningEc2 = rs.getLong(3); + if (newAvgRunning != oldAvgRunning || + newAvgRunningEc2 != oldAvgRunningEc2) { updateRows.put(date, insertRow); } } } rs.close(); PreparedStatement psU = conn.prepareStatement( - "UPDATE bridge_network_size SET avg_running = ? " - + "WHERE date = ?"); + "UPDATE bridge_network_size SET avg_running = ?, " + + "avg_running_ec2 = ? WHERE date = ?"); for (Map.Entry<String, String> e : updateRows.entrySet()) { java.sql.Date date = java.sql.Date.valueOf(e.getKey()); - long avgRunning = Long.parseLong(e.getValue().substring(1)); + String[] parts = e.getValue().substring(1).split(","); + long avgRunning = Long.parseLong(parts[0]); + long avgRunningEc2 = Long.parseLong(parts[1]); psU.clearParameters(); psU.setLong(1, avgRunning); - psU.setDate(2, date); + psU.setLong(2, avgRunningEc2); + psU.setDate(3, date); psU.executeUpdate(); } PreparedStatement psI = conn.prepareStatement( - "INSERT INTO bridge_network_size (avg_running, date) " - + "VALUES (?, ?)"); + "INSERT INTO bridge_network_size (avg_running, " + + "avg_running_ec2, date) VALUES (?, ?, ?)"); for (Map.Entry<String, String> e : insertRows.entrySet()) { java.sql.Date date = java.sql.Date.valueOf(e.getKey()); - long avgRunning = Long.parseLong(e.getValue().substring(1)); + String[] parts = e.getValue().substring(1).split(","); + long avgRunning = Long.parseLong(parts[0]); + long avgRunningEc2 = Long.parseLong(parts[1]); psI.clearParameters(); psI.setLong(1, avgRunning); - psI.setDate(2, date); + psI.setLong(2, avgRunningEc2); + psI.setDate(3, date); psI.executeUpdate(); } conn.commit(); diff --git a/src/org/torproject/ernie/cron/SanitizedBridgesReader.java b/src/org/torproject/ernie/cron/SanitizedBridgesReader.java index c7199cd..da22e56 100644 --- a/src/org/torproject/ernie/cron/SanitizedBridgesReader.java +++ b/src/org/torproject/ernie/cron/SanitizedBridgesReader.java @@ -66,15 +66,18 @@ public class SanitizedBridgesReader { } private void addBridgeNetworkStatus(BridgeNetworkStatus status) { - int runningBridges = 0; + int runningBridges = 0, runningEc2Bridges = 0; for (NetworkStatusEntry statusEntry : status.getStatusEntries().values()) { if (statusEntry.getFlags().contains("Running")) { runningBridges++; + if (statusEntry.getNickname().startsWith("ec2bridge")) { + runningEc2Bridges++; + } } } this.csfh.addBridgeConsensusResults(status.getPublishedMillis(), - runningBridges); + runningBridges, runningEc2Bridges); } private void addServerDescriptor(ServerDescriptor descriptor) {

1 0