October 2013 - tor-commits - lists.torproject.org

[tlsdate/master] In verbose mode, display TLS time as well as HTTPS time
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit f70fba4051e1a1abcf12cebb2cc462ea5bd847cd Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 15:16:23 2013 -0400 In verbose mode, display TLS time as well as HTTPS time --- src/tlsdate-helper.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/tlsdate-helper.c b/src/tlsdate-helper.c index a724402..4dce354 100644 --- a/src/tlsdate-helper.c +++ b/src/tlsdate-helper.c @@ -1205,6 +1205,11 @@ run_ssl (uint32_t *time_map, int time_is_an_illusion, int http) if (1 != BIO_do_handshake(s_bio)) die ("SSL handshake failed\n"); + // from /usr/include/openssl/ssl3.h + // ssl->s3->server_random is an unsigned char of 32 bits + memcpy(&result_time, ssl->s3->server_random, sizeof (uint32_t)); + verb("V: In TLS response, T=%lu\n", (unsigned long)ntohl(result_time)); + if (http) { char buf[1024]; verb("V: Starting HTTP\n"); @@ -1221,10 +1226,6 @@ run_ssl (uint32_t *time_map, int time_is_an_illusion, int http) verb("V: Got HTTP response. T=%lu\n", (unsigned long)result_time); result_time = htonl(result_time); - } else { - // from /usr/include/openssl/ssl3.h - // ssl->s3->server_random is an unsigned char of 32 bits - memcpy(&result_time, ssl->s3->server_random, sizeof (uint32_t)); } // Verify the peer certificate against the CA certs on the local system

1 0

[tlsdate/master] Add a changelog
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 32b5bdaf88c8ea2300cd934bef32a921ad906b33 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 15:29:22 2013 -0400 Add a changelog --- CHANGELOG | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG b/CHANGELOG index 34879c5..206a97d 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -19,6 +19,7 @@ Added integration tests. Run with ./run-tests Refactored event loop. Added suspend/resume RTC corruption detection. + Add -w option to get time from HTTPS header instead of from TLS ServerHello 0.0.6 Mon 18 Feb, 2013 Ensure that tlsdate compiles with g++ by explicit casting rather than implicit casting by whatever compiler is compiling tlsdate.

1 0

[tlsdate/master] Merge pull request #121 from nmathewson/http_date
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 8147f0a72ef9e2c40c1719f1da0aed0221f71ed9 Merge: cb81206 cc1fde0 Author: \033]2;Jacob Appelbaum\007 <jacob(a)appelbaum.net> Date: Wed Oct 30 09:40:32 2013 -0700 Merge pull request #121 from nmathewson/http_date Rudimentary support for HTTP Date headers CHANGELOG | 1 + configure.ac | 17 +++++ man/tlsdate-helper.1 | 2 +- man/tlsdate.1 | 6 +- src/tlsdate-helper.c | 203 ++++++++++++++++++++++++++++++++++++++++++++++++-- src/tlsdate-helper.h | 2 +- src/tlsdate.c | 10 ++- src/util.c | 10 +++ 8 files changed, 239 insertions(+), 12 deletions(-)

1 0

[tlsdate/master] Restrict loggable date fields even harder.
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit cc1fde04ad35d4df138390e04e981a04ff34073e Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 14 11:30:00 2013 -0400 Restrict loggable date fields even harder. --- src/tlsdate-helper.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/tlsdate-helper.c b/src/tlsdate-helper.c index 7813158..311d374 100644 --- a/src/tlsdate-helper.c +++ b/src/tlsdate-helper.c @@ -222,7 +222,7 @@ sanitize_string(const char *s) { const unsigned char *cp; for (cp = (const unsigned char *)s; *cp; cp++) { - if (*cp < 32 || *cp > 127) + if (*cp < 32 || *cp >= 127) return "string with invalid characters"; } return s; @@ -254,6 +254,10 @@ handle_date_line(const char *dateline, uint32_t *result) return 0; dateline += 8; + if (strlen(dateline) > MAX_DATE_LINE_LEN) { + verb("V: The date line was impossibly long.\n"); + return -1; + } verb("V: The alleged date is <%s>\n", sanitize_string(dateline)); while (*dateline == ' ')

1 0

[tlsdate/master] Add missing \n
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit bd6674468571d2fe306a9b14e53245de51f4133a Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Wed Oct 30 17:54:39 2013 +0100 Add missing \n --- src/tlsdate-helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/tlsdate-helper.c b/src/tlsdate-helper.c index 311d374..dc65c77 100644 --- a/src/tlsdate-helper.c +++ b/src/tlsdate-helper.c @@ -328,7 +328,7 @@ read_http_date_from_bio(BIO *bio, uint32_t *result) return 0; buf_len += n; buf[buf_len] = 0; - verb("V: read %d bytes.", n, buf); + verb("V: read %d bytes.\n", n, buf); dateline = memmem(buf, buf_len, "\r\nDate: ", 8); if (NULL == dateline)

1 0

[tlsdate/master] Add README note about HTTP Date parsing
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 8ae0ac5a7ab0236178c9807e98bb7dca36eb43a2 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Wed Oct 30 18:12:16 2013 +0100 Add README note about HTTP Date parsing --- README | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/README b/README index 1c9e793..79e1d01 100644 --- a/README +++ b/README @@ -51,3 +51,11 @@ time warp to restore sanity and do so with a leap of faith: % sudo tlsdate -V -l -t Fri Apr 19 18:08:03 PDT 2013 + +Some SSL/TLS services do not provide accurate time in their handshake process; +tlsdate may also be used to fetch time by processing the HTTP Date headers of +HTTP services: + + % sudo tlsdate -V -l -t -w + Wed Oct 30 18:08:46 CET 2013 +

1 0

[tlsdate/master] Define a max length for the HTTP Date: header
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit df8cbc962d330c692dc1bac3ce11e8507787131b Author: Ingy döt Net <ingy(a)ingy.net> Date: Wed Oct 30 16:21:06 2013 +0000 Define a max length for the HTTP Date: header --- src/tlsdate-helper.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/tlsdate-helper.h b/src/tlsdate-helper.h index 6890a88..7b6e181 100644 --- a/src/tlsdate-helper.h +++ b/src/tlsdate-helper.h @@ -89,6 +89,9 @@ int verbose; // To support our RFC 2595 wildcard verification #define RFC2595_MIN_LABEL_COUNT 3 +// Define a max length for the HTTP Date: header +#define MAX_DATE_LINE_LEN 32 + static int ca_racket; static const char *host;

1 0

[tlsdate/master] move defines into the proper header
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 7bee41df971fbb325d8eda6a4c4671aa4af9f44c Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Wed Oct 30 17:58:26 2013 +0100 move defines into the proper header --- src/tlsdate-helper.c | 8 -------- src/tlsdate-helper.h | 10 ++++++++++ 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/src/tlsdate-helper.c b/src/tlsdate-helper.c index dc65c77..cec6fbe 100644 --- a/src/tlsdate-helper.c +++ b/src/tlsdate-helper.c @@ -312,8 +312,6 @@ handle_date_line(const char *dateline, uint32_t *result) return 1; } -#define MAX_HTTP_HEADERS_SIZE 8192 - static int read_http_date_from_bio(BIO *bio, uint32_t *result) { @@ -924,12 +922,6 @@ inspect_key (SSL *ssl, const char *hostname) } #endif -#define HTTP_REQUEST \ - "HEAD / HTTP/1.1\r\n" \ - "User-Agent: %s\r\n" \ - "Host: %s\r\n" \ - "\r\n" - #ifdef USE_POLARSSL void check_timestamp (uint32_t server_time) diff --git a/src/tlsdate-helper.h b/src/tlsdate-helper.h index 7b6e181..8b44b47 100644 --- a/src/tlsdate-helper.h +++ b/src/tlsdate-helper.h @@ -92,6 +92,16 @@ int verbose; // Define a max length for the HTTP Date: header #define MAX_DATE_LINE_LEN 32 +// Define a max length for HTTP headers +#define MAX_HTTP_HEADERS_SIZE 8192 + +// Define our basic HTTP request +#define HTTP_REQUEST \ + "HEAD / HTTP/1.1\r\n" \ + "User-Agent: %s\r\n" \ + "Host: %s\r\n" \ + "\r\n" + static int ca_racket; static const char *host;

1 0

[tlsdate/master] Update .gitignore to reflect ctags/vim usage
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 7476ac884bace36186ce8a47b3f6749610976431 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Wed Oct 30 21:11:07 2013 +0100 Update .gitignore to reflect ctags/vim usage --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index d49250a..7f4ca56 100644 --- a/.gitignore +++ b/.gitignore @@ -35,5 +35,6 @@ src/tlsdate-routeup src/tlsdated src/tlsdated_unittest TAGS +tags config.h config.in

1 0

[tlsdate/debian-master] Begin DragonFly BSD porting effort
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 556353ec01c525ae505e732cb60117aedf1ea9fd Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Thu Apr 18 19:58:23 2013 -0700 Begin DragonFly BSD porting effort --- m4/ax_platform.m4 | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/m4/ax_platform.m4 b/m4/ax_platform.m4 index 85418f9..8822b86 100644 --- a/m4/ax_platform.m4 +++ b/m4/ax_platform.m4 @@ -56,6 +56,9 @@ [*openbsd*], [TARGET_OS_OPENBSD="true" AC_DEFINE([TARGET_OS_OPENBSD],[1],[Whether we are building for OpenBSD])], + [*dragonfly*], + [TARGET_OS_DRAGONFLYBSD="true" + AC_DEFINE([TARGET_OS_DRAGONFLYBSD],[1],[Whether we are building for DragonFly BSD])], [*bsd*], [TARGET_OS_BSD="true" AC_DEFINE([TARGET_OS_BSD],[1],[Whether we are building for some other *BSD])], @@ -73,5 +76,6 @@ AM_CONDITIONAL([TARGET_FREEBSD],[test "x${TARGET_OS_FREEBSD}" = "xtrue"]) AM_CONDITIONAL([TARGET_NETBSD],[test "x${TARGET_OS_NETBSD}" = "xtrue"]) AM_CONDITIONAL([TARGET_OPENBSD],[test "x${TARGET_OS_OPENBSD}" = "xtrue"]) + AM_CONDITIONAL([TARGET_DRAGONFLYBSD],[test "x${TARGET_OS_DRAGONFLYBSD}" = "xtrue"]) AM_CONDITIONAL([TARGET_BSD],[test "x${TARGET_OS_BSD}" = "xtrue"]) ])

1 0