June 2013 - tor-commits - lists.torproject.org

[tor/master] Bug #5170 - simplify i2d_X509
by nickm＠torproject.org 10 Jun '13

10 Jun '13

commit a022930fda028aaf04c33eba3b3ae0f85f22526b Author: Marek Majkowski <marek(a)popcount.org> Date: Thu Jun 6 12:45:25 2013 +0100 Bug #5170 - simplify i2d_X509 --- src/common/tortls.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index b7e5bc1..0773068 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -806,24 +806,24 @@ tor_cert_new(X509 *x509_cert) tor_cert_t *cert; EVP_PKEY *pkey; RSA *rsa; - int length, length2; - unsigned char *cp; + int length; + unsigned char *buf = NULL; if (!x509_cert) return NULL; - length = i2d_X509(x509_cert, NULL); + length = i2d_X509(x509_cert, &buf); cert = tor_malloc_zero(sizeof(tor_cert_t)); - if (length <= 0) { + if (length <= 0 || buf == NULL) { tor_free(cert); log_err(LD_CRYPTO, "Couldn't get length of encoded x509 certificate"); X509_free(x509_cert); return NULL; } cert->encoded_len = (size_t) length; - cp = cert->encoded = tor_malloc(length); - length2 = i2d_X509(x509_cert, &cp); - tor_assert(length2 == length); + cert->encoded = tor_malloc(length); + memcpy(cert->encoded, buf, length); + OPENSSL_free(buf); cert->cert = x509_cert;

1 0

[tor/master] Bug #5170 - test crypto_pk_get_all_digests
by nickm＠torproject.org 10 Jun '13

10 Jun '13

commit e4f51682bc6d15e5ba78dfe6dfe69e95c298954e Author: Marek Majkowski <marek(a)popcount.org> Date: Mon Jun 10 15:03:18 2013 +0100 Bug #5170 - test crypto_pk_get_all_digests --- src/test/test_crypto.c | 34 ++++++++++++++++++++++++++++++++++ src/test/test_data.c | 5 +++++ 2 files changed, 39 insertions(+) diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c index 839de7d..e45fbb8 100644 --- a/src/test/test_crypto.c +++ b/src/test/test_crypto.c @@ -14,6 +14,10 @@ #include "crypto_curve25519.h" #endif +extern const char AUTHORITY_SIGNKEY_1[]; +extern const char AUTHORITY_SIGNKEY_1_DIGEST[]; +extern const char AUTHORITY_SIGNKEY_1_DIGEST256[]; + /** Run unit tests for Diffie-Hellman functionality. */ static void test_crypto_dh(void) @@ -505,6 +509,35 @@ test_crypto_pk(void) tor_free(encoded); } +/** Sanity check for crypto pk digests */ +static void +test_crypto_digests(void) +{ + crypto_pk_t *k = NULL; + ssize_t r; + digests_t pkey_digests; + char digest[DIGEST_LEN]; + + k = crypto_pk_new(); + test_assert(k); + r = crypto_pk_read_private_key_from_string(k, AUTHORITY_SIGNKEY_1, -1); + test_assert(!r); + + r = crypto_pk_get_digest(k, digest); + test_assert(r == 0); + test_memeq(hex_str(digest, DIGEST_LEN), + AUTHORITY_SIGNKEY_1_DIGEST, HEX_DIGEST_LEN); + + r = crypto_pk_get_all_digests(k, &pkey_digests); + + test_memeq(hex_str(pkey_digests.d[DIGEST_SHA1], DIGEST_LEN), + AUTHORITY_SIGNKEY_1_DIGEST, HEX_DIGEST_LEN); + test_memeq(hex_str(pkey_digests.d[DIGEST_SHA256], DIGEST256_LEN), + AUTHORITY_SIGNKEY_1_DIGEST256, HEX_DIGEST256_LEN); +done: + crypto_pk_free(k); +} + /** Run unit tests for misc crypto formatting functionality (base64, base32, * fingerprints, etc) */ static void @@ -1103,6 +1136,7 @@ struct testcase_t crypto_tests[] = { { "aes_EVP", test_crypto_aes, TT_FORK, &pass_data, (void*)"evp" }, CRYPTO_LEGACY(sha), CRYPTO_LEGACY(pk), + CRYPTO_LEGACY(digests), CRYPTO_LEGACY(dh), CRYPTO_LEGACY(s2k), { "aes_iv_AES", test_crypto_aes_iv, TT_FORK, &pass_data, (void*)"aes" }, diff --git a/src/test/test_data.c b/src/test/test_data.c index 5f0f7cb..3c68b12 100644 --- a/src/test/test_data.c +++ b/src/test/test_data.c @@ -63,6 +63,11 @@ const char AUTHORITY_SIGNKEY_1[] = "Yx4lqK0ca5IkTp3HevwnlWaJgbaOTUspCVshzJBhDA==\n" "-----END RSA PRIVATE KEY-----\n"; +const char AUTHORITY_SIGNKEY_1_DIGEST[] = + "CBF56A83368A5150F1A9AAADAFB4D77F8C4170E2"; +const char AUTHORITY_SIGNKEY_1_DIGEST256[] = + "AF7C5468DBE3BA54A052726038D7F15F3C4CA511B1952645B3D96D83A8DFB51C"; + /** Second of 3 example authority certificates for unit testing. */ const char AUTHORITY_CERT_2[] = "dir-key-certificate-version 3\n"

1 0

[tor/master] Bug #5170 - make pkey_eq testable, introduce test_tortls.c
by nickm＠torproject.org 10 Jun '13

10 Jun '13

commit d769cd82b5b9517971bdefabfcc1c68b0a901751 Author: Marek Majkowski <marek(a)popcount.org> Date: Mon Jun 10 16:21:39 2013 +0100 Bug #5170 - make pkey_eq testable, introduce test_tortls.c --- src/common/tortls.c | 6 +++--- src/common/tortls.h | 5 +++++ src/test/include.am | 1 + src/test/test.c | 2 ++ src/test/test_tortls.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ 5 files changed, 56 insertions(+), 3 deletions(-) diff --git a/src/common/tortls.c b/src/common/tortls.c index fd0a410..c0e3603 100644 --- a/src/common/tortls.c +++ b/src/common/tortls.c @@ -980,8 +980,8 @@ tor_tls_cert_get_key(tor_cert_t *cert) } /** Return true iff <b>a</b> and <b>b</b> represent the same public key. */ -static int -pkey_eq(EVP_PKEY *a, EVP_PKEY *b) +int +tor_tls_evp_pkey_eq(EVP_PKEY *a, EVP_PKEY *b) { /* We'd like to do this, but openssl 0.9.7 doesn't have it: return EVP_PKEY_cmp(a,b) == 1; @@ -1017,7 +1017,7 @@ tor_tls_cert_matches_key(const tor_tls_t *tls, const tor_cert_t *cert) link_key = X509_get_pubkey(peercert); cert_key = X509_get_pubkey(cert->cert); - result = link_key && cert_key && pkey_eq(cert_key, link_key); + result = link_key && cert_key && tor_tls_evp_pkey_eq(cert_key, link_key); X509_free(peercert); if (link_key) diff --git a/src/common/tortls.h b/src/common/tortls.h index 49c488b..c71ed57 100644 --- a/src/common/tortls.h +++ b/src/common/tortls.h @@ -138,5 +138,10 @@ int tor_tls_cert_is_valid(int severity, int check_rsa_1024); const char *tor_tls_get_ciphersuite_name(tor_tls_t *tls); +#ifdef TORTLS_PRIVATE +/* Prototypes for private functions only used by the unit tests. */ +int tor_tls_evp_pkey_eq(EVP_PKEY *a, EVP_PKEY *b); +#endif + #endif diff --git a/src/test/include.am b/src/test/include.am index 112d1a7..af95d44 100644 --- a/src/test/include.am +++ b/src/test/include.am @@ -23,6 +23,7 @@ src_test_test_SOURCES = \ src/test/test_microdesc.c \ src/test/test_pt.c \ src/test/test_replay.c \ + src/test/test_tortls.c \ src/test/test_util.c \ src/test/test_config.c \ src/ext/tinytest.c diff --git a/src/test/test.c b/src/test/test.c index a9cf899..da5b4e5 100644 --- a/src/test/test.c +++ b/src/test/test.c @@ -2133,6 +2133,7 @@ extern struct testcase_t config_tests[]; extern struct testcase_t introduce_tests[]; extern struct testcase_t replaycache_tests[]; extern struct testcase_t cell_format_tests[]; +extern struct testcase_t tortls_tests[]; static struct testgroup_t testgroups[] = { { "", test_array }, @@ -2147,6 +2148,7 @@ static struct testgroup_t testgroups[] = { { "pt/", pt_tests }, { "config/", config_tests }, { "replaycache/", replaycache_tests }, + { "tortls/", tortls_tests }, { "introduce/", introduce_tests }, END_OF_GROUPS }; diff --git a/src/test/test_tortls.c b/src/test/test_tortls.c new file mode 100644 index 0000000..28ffbb1 --- /dev/null +++ b/src/test/test_tortls.c @@ -0,0 +1,45 @@ +/* Copyright (c) 2013-2013, The Tor Project, Inc. */ +/* See LICENSE for licensing information */ + +#include <openssl/evp.h> + +#include "orconfig.h" +#define CRYPTO_PRIVATE +#define TORTLS_PRIVATE +#include "or.h" +#include "test.h" + + +static void +test_tortls_evp_pkey_eq(void) +{ + crypto_pk_t *pk1 = NULL, *pk2 = NULL; + EVP_PKEY *evp1 = NULL, *evp2 = NULL; + + pk1 = pk_generate(0); + pk2 = pk_generate(1); + test_assert(pk1 && pk2); + + evp1 = crypto_pk_get_evp_pkey_(pk1, 0); + evp2 = crypto_pk_get_evp_pkey_(pk2, 0); + test_assert(evp1 && evp2); + + test_assert(tor_tls_evp_pkey_eq(evp1, evp2) == 0); + test_assert(tor_tls_evp_pkey_eq(evp1, evp1) == 1); + +done: + crypto_pk_free(pk1); + crypto_pk_free(pk2); + if (evp1) + EVP_PKEY_free(evp1); + if (evp2) + EVP_PKEY_free(evp2); +} + +#define TORTLS_LEGACY(name) \ + { #name, legacy_test_helper, 0, &legacy_setup, test_tortls_ ## name } + +struct testcase_t tortls_tests[] = { + TORTLS_LEGACY(evp_pkey_eq), + END_OF_TESTCASES +};

1 0

[tor/master] Make OPENSSL_free(dh_string_repr) conditional.
by nickm＠torproject.org 10 Jun '13

10 Jun '13

commit 7f9066ceee32f4df6d94b18c7b65e92d1730fce8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 10 13:49:13 2013 -0400 Make OPENSSL_free(dh_string_repr) conditional. --- src/common/crypto.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/common/crypto.c b/src/common/crypto.c index adbf639..e60172b 100644 --- a/src/common/crypto.c +++ b/src/common/crypto.c @@ -1740,7 +1740,8 @@ crypto_store_dynamic_dh_modulus(const char *fname) done: if (dh) DH_free(dh); - OPENSSL_free(dh_string_repr); + if (dh_string_repr) + OPENSSL_free(dh_string_repr); tor_free(base64_encoded_dh); tor_free(file_string);

1 0

[tor/master] Merge remote-tracking branch 'majek/bug5170'
by nickm＠torproject.org 10 Jun '13

10 Jun '13

commit aaaf082ed69d2fa75c8a2f79f42a67ee18ee3865 Merge: c300720 d769cd8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 10 13:47:57 2013 -0400 Merge remote-tracking branch 'majek/bug5170' changes/bug5170 | 5 ++++ contrib/id_to_fp.c | 77 ------------------------------------------------ src/common/crypto.c | 66 ++++++++++++++--------------------------- src/common/tortls.c | 48 +++++++++++++++--------------- src/common/tortls.h | 5 ++++ src/test/include.am | 1 + src/test/test.c | 2 ++ src/test/test_crypto.c | 34 +++++++++++++++++++++ src/test/test_data.c | 5 ++++ src/test/test_tortls.c | 45 ++++++++++++++++++++++++++++ 10 files changed, 142 insertions(+), 146 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.4'
by nickm＠torproject.org 10 Jun '13

10 Jun '13

commit c300720bfa107a54c2ce98a6937c0ce192673732 Merge: bcdc002 607b29a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 10 12:28:30 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' changes/bug9017 | 6 ++++++ src/or/connection_edge.c | 11 ++++++----- 2 files changed, 12 insertions(+), 5 deletions(-)

1 0

[tor/master] Merge branch 'bug9017' into maint-0.2.3
by nickm＠torproject.org 10 Jun '13

10 Jun '13

commit 4835faebf533f93eb390649dfcb5c8cc0289e3d3 Merge: fe689de 77a1935 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 10 12:25:14 2013 -0400 Merge branch 'bug9017' into maint-0.2.3 changes/bug9017 | 6 ++++++ src/or/connection_edge.c | 11 ++++++----- 2 files changed, 12 insertions(+), 5 deletions(-)

1 0

[tor/master] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 10 Jun '13

10 Jun '13

commit 607b29ae1abe7da7d06e4e9282ed88a2dd7fe8d4 Merge: c860a96 4835fae Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 10 12:26:39 2013 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 changes/bug9017 | 6 ++++++ src/or/connection_edge.c | 11 ++++++----- 2 files changed, 12 insertions(+), 5 deletions(-)

1 0

[tor/master] Fix (Open?)BSD fast-connect bug with optimistic data.
by nickm＠torproject.org 10 Jun '13

10 Jun '13

commit 77a193533966c5c2f81e6a85b3c2a7446076508f Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 10 12:14:49 2013 -0400 Fix (Open?)BSD fast-connect bug with optimistic data. There's an assertion failure that can occur if a connection has optimistic data waiting, and then the connect() call returns 0 on the first attempt (rather than -1 and EINPROGRESS). That latter behavior from connect() appears to be an (Open?)BSDism when dealing with remote addresses in some cases. (At least, I've only seen it reported with the BSDs under libevent, even when the address was 127.0.0.1. And we've only seen this problem in Tor with OpenBSD.) Fixes bug 9017; bugfix on 0.2.3.1-alpha, which first introduced optimistic data. (Although you could also argue that the commented-out connection_start_writing in 155c9b80 back in 2002 is the real source of the issue.) --- changes/bug9017 | 6 ++++++ src/or/connection_edge.c | 11 ++++++----- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/changes/bug9017 b/changes/bug9017 new file mode 100644 index 0000000..359c526 --- /dev/null +++ b/changes/bug9017 @@ -0,0 +1,6 @@ + o Major bugfixes: + - Avoid an assertion failure on OpenBSD (and perhaps other BSDs) + when an exit connection with optimistic data succeeds immediately + rather than returning EINPROGRESS. Fixes bug 9017; bugfix on + 0.2.3.1-alpha. + diff --git a/src/or/connection_edge.c b/src/or/connection_edge.c index 9563ca6..362ad9a 100644 --- a/src/or/connection_edge.c +++ b/src/or/connection_edge.c @@ -3302,12 +3302,13 @@ connection_exit_connect(edge_connection_t *edge_conn) conn->state = EXIT_CONN_STATE_OPEN; if (connection_get_outbuf_len(conn)) { - /* in case there are any queued data cells */ - log_warn(LD_BUG,"newly connected conn had data waiting!"); -// connection_start_writing(conn); + /* in case there are any queued data cells, from e.g. optimistic data */ + IF_HAS_NO_BUFFEREVENT(conn) + connection_watch_events(conn, READ_EVENT|WRITE_EVENT); + } else { + IF_HAS_NO_BUFFEREVENT(conn) + connection_watch_events(conn, READ_EVENT); } - IF_HAS_NO_BUFFEREVENT(conn) - connection_watch_events(conn, READ_EVENT); /* also, deliver a 'connected' cell back through the circuit. */ if (connection_edge_is_rendezvous_stream(edge_conn)) {

1 0

[tor/maint-0.2.4] Merge branch 'bug9017' into maint-0.2.3
by nickm＠torproject.org 10 Jun '13

10 Jun '13

commit 4835faebf533f93eb390649dfcb5c8cc0289e3d3 Merge: fe689de 77a1935 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Jun 10 12:25:14 2013 -0400 Merge branch 'bug9017' into maint-0.2.3 changes/bug9017 | 6 ++++++ src/or/connection_edge.c | 11 ++++++----- 2 files changed, 12 insertions(+), 5 deletions(-)

1 0