October 2013 - tor-commits - lists.torproject.org

[tlsdate/debian-master] Restrict loggable date fields even harder.
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit cc1fde04ad35d4df138390e04e981a04ff34073e Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Oct 14 11:30:00 2013 -0400 Restrict loggable date fields even harder. --- src/tlsdate-helper.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/tlsdate-helper.c b/src/tlsdate-helper.c index 7813158..311d374 100644 --- a/src/tlsdate-helper.c +++ b/src/tlsdate-helper.c @@ -222,7 +222,7 @@ sanitize_string(const char *s) { const unsigned char *cp; for (cp = (const unsigned char *)s; *cp; cp++) { - if (*cp < 32 || *cp > 127) + if (*cp < 32 || *cp >= 127) return "string with invalid characters"; } return s; @@ -254,6 +254,10 @@ handle_date_line(const char *dateline, uint32_t *result) return 0; dateline += 8; + if (strlen(dateline) > MAX_DATE_LINE_LEN) { + verb("V: The date line was impossibly long.\n"); + return -1; + } verb("V: The alleged date is <%s>\n", sanitize_string(dateline)); while (*dateline == ' ')

1 0

[tlsdate/debian-master] Add a changelog
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 32b5bdaf88c8ea2300cd934bef32a921ad906b33 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 15:29:22 2013 -0400 Add a changelog --- CHANGELOG | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG b/CHANGELOG index 34879c5..206a97d 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -19,6 +19,7 @@ Added integration tests. Run with ./run-tests Refactored event loop. Added suspend/resume RTC corruption detection. + Add -w option to get time from HTTPS header instead of from TLS ServerHello 0.0.6 Mon 18 Feb, 2013 Ensure that tlsdate compiles with g++ by explicit casting rather than implicit casting by whatever compiler is compiling tlsdate.

1 0

[tlsdate/debian-master] add systemd service file for tlsdated
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 8282207cf1613e2ef444e06ac1dab7d88cd2c2ef Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Thu Oct 31 11:36:10 2013 +0100 add systemd service file for tlsdated --- tlsdate.service | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tlsdate.service b/tlsdate.service new file mode 100644 index 0000000..6a116be --- /dev/null +++ b/tlsdate.service @@ -0,0 +1,6 @@ +[Unit] +Description=Secure parasitic rdate replacement + +[Service] +ExecStart=/usr/bin/tlsdated +Type=forking

1 0

[tlsdate/debian-master] Make user-agent a configuration option
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 671152207209a890f35f774ef938cff24cdc3b98 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 15:28:09 2013 -0400 Make user-agent a configuration option --- configure.ac | 10 ++++++++++ src/tlsdate-helper.c | 3 +-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index f1a424f..99b81de 100644 --- a/configure.ac +++ b/configure.ac @@ -39,6 +39,16 @@ dnl Place we install our config file TLSDATE_CONF_DIR="${sysconfdir}/$PACKAGE_NAME/" AC_SUBST([TLSDATE_CONF_DIR]) +dnl HTTPS User-agent +AC_ARG_WITH([https-user-agent], + [AS_HELP_STRING([--with-https-user-agent=AGENT], + [a User-Agent value to send when running in HTTPS mode])], + [], + [with_https_user_agent="TLSDate/1.0"]) +AC_DEFINE_UNQUOTED([HTTPS_USER_AGENT], + ["${with_https_user_agent}"], + [User-Agent value to send when running as an HTTPS client]) + dnl check for PolarSSL OPT_POLARSSL=yes diff --git a/src/tlsdate-helper.c b/src/tlsdate-helper.c index 4dce354..7813158 100644 --- a/src/tlsdate-helper.c +++ b/src/tlsdate-helper.c @@ -925,7 +925,6 @@ inspect_key (SSL *ssl, const char *hostname) "User-Agent: %s\r\n" \ "Host: %s\r\n" \ "\r\n" -#define HTTP_USER_AGENT "TLSDate/1.0" #ifdef USE_POLARSSL void @@ -1214,7 +1213,7 @@ run_ssl (uint32_t *time_map, int time_is_an_illusion, int http) char buf[1024]; verb("V: Starting HTTP\n"); if (snprintf(buf, sizeof(buf), - HTTP_REQUEST, HTTP_USER_AGENT, hostname_to_verify) >= 1024) + HTTP_REQUEST, HTTPS_USER_AGENT, hostname_to_verify) >= 1024) die("hostname too long"); buf[1023]='\0'; /* Unneeded. */ verb("V: Writing HTTP request\n");

1 0

[tlsdate/debian-master] Add missing \n
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit bd6674468571d2fe306a9b14e53245de51f4133a Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Wed Oct 30 17:54:39 2013 +0100 Add missing \n --- src/tlsdate-helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/tlsdate-helper.c b/src/tlsdate-helper.c index 311d374..dc65c77 100644 --- a/src/tlsdate-helper.c +++ b/src/tlsdate-helper.c @@ -328,7 +328,7 @@ read_http_date_from_bio(BIO *bio, uint32_t *result) return 0; buf_len += n; buf[buf_len] = 0; - verb("V: read %d bytes.", n, buf); + verb("V: read %d bytes.\n", n, buf); dateline = memmem(buf, buf_len, "\r\nDate: ", 8); if (NULL == dateline)

1 0

[tlsdate/debian-master] Update manpage with http option
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 0aa0bf8ee6102d032c8833db043c007cd5bc36c2 Author: Nick Mathewson <nickm(a)torproject.org> Date: Thu Oct 10 15:21:50 2013 -0400 Update manpage with http option --- man/tlsdate-helper.1 | 2 +- man/tlsdate.1 | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/man/tlsdate-helper.1 b/man/tlsdate-helper.1 index 8260434..d81f694 100644 --- a/man/tlsdate-helper.1 +++ b/man/tlsdate-helper.1 @@ -6,7 +6,7 @@ tlsdate-helper \- secure parasitic rdate replacement .SH SYNOPSIS .B tlsdate-helper host port protocol ca_racket verbose certdir setclock \ -showtime timewarp leapaway proxy-type://proxyhost:proxyport +showtime timewarp leapaway proxy-type://proxyhost:proxyport httpmode .SH DESCRIPTION .B tlsdate-helper is a tool for setting the system clock by hand or by communication diff --git a/man/tlsdate.1 b/man/tlsdate.1 index e34c81d..82e3d7c 100644 --- a/man/tlsdate.1 +++ b/man/tlsdate.1 @@ -5,7 +5,7 @@ .SH NAME tlsdate \- secure parasitic rdate replacement .SH SYNOPSIS -.B tlsdate [\-hnvVstl] [\-H [hostname]] [\-p [port]] [\-P [sslv23|sslv3|tlsv1]] \ +.B tlsdate [\-hnvVstlw] [\-H [hostname]] [\-p [port]] [\-P [sslv23|sslv3|tlsv1]] \ [\-\-certdir [dirname]] [\-x [\-\-proxy] proxy\-type://proxyhost:proxyport] .SH DESCRIPTION .B tlsdate @@ -76,6 +76,10 @@ if there are any other issues, such as self-signed certificates or if the user pins to a CA that is not used by the remote server. This is useful if your RTC is broken on boot and you are unable to use DNSEC until you've at least had some kind of leap of cryptographically assured data. +.IP "\-w | \-\-http" +Run in web mode: look for the time in an HTTP "Date" header inside an +HTTPS connection, rather than in the TLS connection itself. The provided +hostname and port must support HTTPS. .SH BUGS It's likely! Let us know by contacting jacob(a)appelbaum.net

1 0

[tlsdate/debian-master] Add README note about HTTP Date parsing
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 8ae0ac5a7ab0236178c9807e98bb7dca36eb43a2 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Wed Oct 30 18:12:16 2013 +0100 Add README note about HTTP Date parsing --- README | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/README b/README index 1c9e793..79e1d01 100644 --- a/README +++ b/README @@ -51,3 +51,11 @@ time warp to restore sanity and do so with a leap of faith: % sudo tlsdate -V -l -t Fri Apr 19 18:08:03 PDT 2013 + +Some SSL/TLS services do not provide accurate time in their handshake process; +tlsdate may also be used to fetch time by processing the HTTP Date headers of +HTTP services: + + % sudo tlsdate -V -l -t -w + Wed Oct 30 18:08:46 CET 2013 +

1 0

[tlsdate/debian-master] move defines into the proper header
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 7bee41df971fbb325d8eda6a4c4671aa4af9f44c Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Wed Oct 30 17:58:26 2013 +0100 move defines into the proper header --- src/tlsdate-helper.c | 8 -------- src/tlsdate-helper.h | 10 ++++++++++ 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/src/tlsdate-helper.c b/src/tlsdate-helper.c index dc65c77..cec6fbe 100644 --- a/src/tlsdate-helper.c +++ b/src/tlsdate-helper.c @@ -312,8 +312,6 @@ handle_date_line(const char *dateline, uint32_t *result) return 1; } -#define MAX_HTTP_HEADERS_SIZE 8192 - static int read_http_date_from_bio(BIO *bio, uint32_t *result) { @@ -924,12 +922,6 @@ inspect_key (SSL *ssl, const char *hostname) } #endif -#define HTTP_REQUEST \ - "HEAD / HTTP/1.1\r\n" \ - "User-Agent: %s\r\n" \ - "Host: %s\r\n" \ - "\r\n" - #ifdef USE_POLARSSL void check_timestamp (uint32_t server_time) diff --git a/src/tlsdate-helper.h b/src/tlsdate-helper.h index 7b6e181..8b44b47 100644 --- a/src/tlsdate-helper.h +++ b/src/tlsdate-helper.h @@ -92,6 +92,16 @@ int verbose; // Define a max length for the HTTP Date: header #define MAX_DATE_LINE_LEN 32 +// Define a max length for HTTP headers +#define MAX_HTTP_HEADERS_SIZE 8192 + +// Define our basic HTTP request +#define HTTP_REQUEST \ + "HEAD / HTTP/1.1\r\n" \ + "User-Agent: %s\r\n" \ + "Host: %s\r\n" \ + "\r\n" + static int ca_racket; static const char *host;

1 0

[tlsdate/debian-master] Merge branch 'master' into debian-master
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 146aedf906006e76d2be76d9df235743b4752edc Merge: 152d6da cb88346 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Thu Oct 31 11:47:57 2013 +0100 Merge branch 'master' into debian-master

1 0

[tlsdate/debian-master] Update .gitignore to reflect ctags/vim usage
by ioerror＠torproject.org 31 Oct '13

31 Oct '13

commit 7476ac884bace36186ce8a47b3f6749610976431 Author: Jacob Appelbaum <jacob(a)appelbaum.net> Date: Wed Oct 30 21:11:07 2013 +0100 Update .gitignore to reflect ctags/vim usage --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index d49250a..7f4ca56 100644 --- a/.gitignore +++ b/.gitignore @@ -35,5 +35,6 @@ src/tlsdate-routeup src/tlsdated src/tlsdated_unittest TAGS +tags config.h config.in

1 0