October 2013 - tor-commits - lists.torproject.org

[tor/master] Merge remote-tracking branch 'public/bug9731b' into maint-0.2.4
by nickm＠torproject.org 31 Oct '13

31 Oct '13

commit db2c2a69091724037e0e6dd0c58f0b18558ce437 Merge: 1b312f7 c553288 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 31 14:08:28 2013 -0400 Merge remote-tracking branch 'public/bug9731b' into maint-0.2.4 changes/bug9731 | 3 +++ src/or/connection.c | 6 ++++++ 2 files changed, 9 insertions(+)

1 0

[tor/master] Merge remote-tracking branch 'public/bug9731'
by nickm＠torproject.org 31 Oct '13

31 Oct '13

commit 702c0502cf3121e2e698963cf53adb00ae2d136d Merge: 8676a08 9205552 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 31 14:09:18 2013 -0400 Merge remote-tracking branch 'public/bug9731' changes/bug9731 | 3 +++ src/or/connection.c | 6 ++++++ 2 files changed, 9 insertions(+)

1 0

[tor/master] Move #9731 checks to start of their functions
by nickm＠torproject.org 31 Oct '13

31 Oct '13

commit 96f92f2062118b61a43134170b92001d3be1c128 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 31 14:10:23 2013 -0400 Move #9731 checks to start of their functions At arma's suggestion. --- src/or/connection.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/or/connection.c b/src/or/connection.c index 43ec43f..210c658 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -2684,6 +2684,9 @@ connection_consider_empty_read_buckets(connection_t *conn) { const char *reason; + if (!connection_is_rate_limited(conn)) + return; /* Always okay. */ + if (global_read_bucket <= 0) { reason = "global read bucket exhausted. Pausing."; } else if (connection_counts_as_relayed_traffic(conn, approx_time()) && @@ -2696,9 +2699,6 @@ connection_consider_empty_read_buckets(connection_t *conn) } else return; /* all good, no need to stop it */ - if (!connection_is_rate_limited(conn)) - return; /* Always okay. */ - LOG_FN_CONN(conn, (LOG_DEBUG, LD_NET, "%s", reason)); conn->read_blocked_on_bw = 1; connection_stop_reading(conn);

1 0

[tor/maint-0.2.4] Don't apply read/write buckets to cpuworker connections
by nickm＠torproject.org 31 Oct '13

31 Oct '13

commit c5532889a8e4b2788253c420af6568820483147c Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Sep 13 13:37:53 2013 -0400 Don't apply read/write buckets to cpuworker connections Fixes bug 9731 --- changes/bug9731 | 3 +++ src/or/connection.c | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/changes/bug9731 b/changes/bug9731 new file mode 100644 index 0000000..828496a --- /dev/null +++ b/changes/bug9731 @@ -0,0 +1,3 @@ + o Major bugfixes: + - Do not apply connection_consider_empty_read/write_buckets to + cpuworker connections. diff --git a/src/or/connection.c b/src/or/connection.c index 6e754a0..78cc31e 100644 --- a/src/or/connection.c +++ b/src/or/connection.c @@ -2483,6 +2483,9 @@ connection_consider_empty_read_buckets(connection_t *conn) } else return; /* all good, no need to stop it */ + if (conn->type == CONN_TYPE_CPUWORKER) + return; /* Always okay. */ + LOG_FN_CONN(conn, (LOG_DEBUG, LD_NET, "%s", reason)); conn->read_blocked_on_bw = 1; connection_stop_reading(conn); @@ -2507,6 +2510,9 @@ connection_consider_empty_write_buckets(connection_t *conn) } else return; /* all good, no need to stop it */ + if (conn->type == CONN_TYPE_CPUWORKER) + return; /* Always okay. */ + LOG_FN_CONN(conn, (LOG_DEBUG, LD_NET, "%s", reason)); conn->write_blocked_on_bw = 1; connection_stop_writing(conn);

1 0

[tor/maint-0.2.4] Merge remote-tracking branch 'public/bug9731b' into maint-0.2.4
by nickm＠torproject.org 31 Oct '13

31 Oct '13

commit db2c2a69091724037e0e6dd0c58f0b18558ce437 Merge: 1b312f7 c553288 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 31 14:08:28 2013 -0400 Merge remote-tracking branch 'public/bug9731b' into maint-0.2.4 changes/bug9731 | 3 +++ src/or/connection.c | 6 ++++++ 2 files changed, 9 insertions(+)

1 0

[tor/master] Switch ECDHE group default logic for bridge/relay TLS
by nickm＠torproject.org 31 Oct '13

31 Oct '13

commit 72c1e5acfe1c6f04f4d7d398fc4a964d4bc5b62e Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Sep 19 10:40:41 2013 -0400 Switch ECDHE group default logic for bridge/relay TLS According to the manpage, bridges use P256 for conformity and relays use P224 for speed. But skruffy points out that we've gotten it backwards in the code. In this patch, we make the default P256 for everybody. Fixes bug 9780; bugfix on 0.2.4.8-alpha. --- changes/bug9780 | 8 ++++++++ doc/tor.1.txt | 2 +- src/common/tortls.c | 4 +--- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/changes/bug9780 b/changes/bug9780 new file mode 100644 index 0000000..3cb51bd --- /dev/null +++ b/changes/bug9780 @@ -0,0 +1,8 @@ + o Minor bugfixes (performance, fingerprinting): + - Our default TLS ecdhe groups were backwards: we meant to be using + P224 for relays (for performance win) and P256 for bridges (since + it is more common in the wild). Instead we had it backwards. After + reconsideration, we decided that the default should be P256 on all + hosts, since its security is probably better, and since P224 is + reportedly used quite little in the wild. Found by "skruffy" on + IRC. Fix for bug 9780; bugfix on 0.2.4.8-alpha. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index b206275..38423c2 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1642,7 +1642,7 @@ is non-zero): What EC group should we try to use for incoming TLS connections? P224 is faster, but makes us stand out more. Has no effect if we're a client, or if our OpenSSL version lacks support for ECDHE. - (Default: P224 for public servers; P256 for bridges.) + (Default: P256) [[CellStatistics]] **CellStatistics** **0**|**1**:: When this option is enabled, Tor writes statistics on the mean time that diff --git a/src/common/tortls.c b/src/common/tortls.c index b7e5bc1..72f6c40 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1369,10 +1369,8 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime, nid = NID_secp224r1; else if (flags & TOR_TLS_CTX_USE_ECDHE_P256) nid = NID_X9_62_prime256v1; - else if (flags & TOR_TLS_CTX_IS_PUBLIC_SERVER) - nid = NID_X9_62_prime256v1; else - nid = NID_secp224r1; + nid = NID_X9_62_prime256v1; /* Use P-256 for ECDHE. */ ec_key = EC_KEY_new_by_curve_name(nid); if (ec_key != NULL) /*XXXX Handle errors? */

1 0

[tor/master] Merge remote-tracking branch 'public/bug9780_024_v2' into maint-0.2.4
by nickm＠torproject.org 31 Oct '13

31 Oct '13

commit 1b312f7b55bc5322f3029ad12715d9f348d44650 Merge: 0e8ee79 72c1e5a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 31 14:02:28 2013 -0400 Merge remote-tracking branch 'public/bug9780_024_v2' into maint-0.2.4 changes/bug9780 | 8 ++++++++ doc/tor.1.txt | 2 +- src/common/tortls.c | 4 +--- 3 files changed, 10 insertions(+), 4 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.4'
by nickm＠torproject.org 31 Oct '13

31 Oct '13

commit 61029d69269d58e530028ee69b148581d3d8bd93 Merge: a19e3e2 1b312f7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 31 14:03:01 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' changes/bug9780 | 8 ++++++++ doc/tor.1.txt | 2 +- src/common/tortls.c | 4 +--- 3 files changed, 10 insertions(+), 4 deletions(-)

1 0

[tor/maint-0.2.4] Switch ECDHE group default logic for bridge/relay TLS
by nickm＠torproject.org 31 Oct '13

31 Oct '13

commit 72c1e5acfe1c6f04f4d7d398fc4a964d4bc5b62e Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Sep 19 10:40:41 2013 -0400 Switch ECDHE group default logic for bridge/relay TLS According to the manpage, bridges use P256 for conformity and relays use P224 for speed. But skruffy points out that we've gotten it backwards in the code. In this patch, we make the default P256 for everybody. Fixes bug 9780; bugfix on 0.2.4.8-alpha. --- changes/bug9780 | 8 ++++++++ doc/tor.1.txt | 2 +- src/common/tortls.c | 4 +--- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/changes/bug9780 b/changes/bug9780 new file mode 100644 index 0000000..3cb51bd --- /dev/null +++ b/changes/bug9780 @@ -0,0 +1,8 @@ + o Minor bugfixes (performance, fingerprinting): + - Our default TLS ecdhe groups were backwards: we meant to be using + P224 for relays (for performance win) and P256 for bridges (since + it is more common in the wild). Instead we had it backwards. After + reconsideration, we decided that the default should be P256 on all + hosts, since its security is probably better, and since P224 is + reportedly used quite little in the wild. Found by "skruffy" on + IRC. Fix for bug 9780; bugfix on 0.2.4.8-alpha. diff --git a/doc/tor.1.txt b/doc/tor.1.txt index b206275..38423c2 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1642,7 +1642,7 @@ is non-zero): What EC group should we try to use for incoming TLS connections? P224 is faster, but makes us stand out more. Has no effect if we're a client, or if our OpenSSL version lacks support for ECDHE. - (Default: P224 for public servers; P256 for bridges.) + (Default: P256) [[CellStatistics]] **CellStatistics** **0**|**1**:: When this option is enabled, Tor writes statistics on the mean time that diff --git a/src/common/tortls.c b/src/common/tortls.c index b7e5bc1..72f6c40 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -1369,10 +1369,8 @@ tor_tls_context_new(crypto_pk_t *identity, unsigned int key_lifetime, nid = NID_secp224r1; else if (flags & TOR_TLS_CTX_USE_ECDHE_P256) nid = NID_X9_62_prime256v1; - else if (flags & TOR_TLS_CTX_IS_PUBLIC_SERVER) - nid = NID_X9_62_prime256v1; else - nid = NID_secp224r1; + nid = NID_X9_62_prime256v1; /* Use P-256 for ECDHE. */ ec_key = EC_KEY_new_by_curve_name(nid); if (ec_key != NULL) /*XXXX Handle errors? */

1 0

[tor/maint-0.2.4] Merge remote-tracking branch 'public/bug9780_024_v2' into maint-0.2.4
by nickm＠torproject.org 31 Oct '13

31 Oct '13

commit 1b312f7b55bc5322f3029ad12715d9f348d44650 Merge: 0e8ee79 72c1e5a Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 31 14:02:28 2013 -0400 Merge remote-tracking branch 'public/bug9780_024_v2' into maint-0.2.4 changes/bug9780 | 8 ++++++++ doc/tor.1.txt | 2 +- src/common/tortls.c | 4 +--- 3 files changed, 10 insertions(+), 4 deletions(-)

1 0